diff --git a/.repos/alchemy-effect/.eslintignore b/.repos/alchemy-effect/.eslintignore
new file mode 100644
index 00000000000..c70ce2568c2
--- /dev/null
+++ b/.repos/alchemy-effect/.eslintignore
@@ -0,0 +1 @@
+alchemy/test/**
\ No newline at end of file
diff --git a/.repos/alchemy-effect/.github/workflows/deploy.yml b/.repos/alchemy-effect/.github/workflows/deploy.yml
new file mode 100644
index 00000000000..0bb41dcc6cc
--- /dev/null
+++ b/.repos/alchemy-effect/.github/workflows/deploy.yml
@@ -0,0 +1,137 @@
+name: Deploy Website
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "website/**"
+      - "packages/alchemy/**"
+      - "bun.lock"
+      - ".github/workflows/deploy.yml"
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - closed
+    paths:
+      - "website/**"
+      - "packages/alchemy/**"
+      - "bun.lock"
+      - ".github/workflows/deploy.yml"
+
+concurrency:
+  group: deploy-website-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  STAGE: ${{ github.event_name == 'pull_request' && format('pr-{0}',
+    github.event.number) || (github.ref == 'refs/heads/main' && 'prod' ||
+    github.ref_name) }}
+
+jobs:
+  deploy:
+    if: ${{ github.event.action != 'closed' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      # Mint a token for the alchemy-version-bot GitHub App so the PR
+      # preview comment (created via GitHub.Comment in alchemy.run.ts)
+      # posts under the bot's identity instead of `github-actions[bot]`.
+      # Same App as release.yml — its installation scopes already cover
+      # PR comments.
+      - name: Generate bot token
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+
+      - name: Install dependencies
+        run: bun install
+
+      # Build the website ahead of `alchemy deploy`. The
+      # Cloudflare.StaticSite resource declares the same `bun run build`
+      # in its config and runs it as part of the create lifecycle, but
+      # on update plans alchemy reads `dist/` during plan.diff before
+      # the embedded Build resource gets a chance to (re)run, causing
+      # a NotFound on a fresh CI checkout. Building here makes the
+      # workflow correct under both create and update plans.
+      - name: Build website
+        working-directory: website
+        run: bun run build
+
+      - name: Deploy
+        working-directory: website
+        run: bun alchemy deploy --stage ${{ env.STAGE }} --yes
+        env:
+          # Alchemy's Cloudflare auth provider accepts either a scoped
+          # API token (CLOUDFLARE_API_TOKEN) or the legacy global API
+          # key paired with email (CLOUDFLARE_API_KEY +
+          # CLOUDFLARE_EMAIL). We use the latter here so CI matches
+          # the credentials in Doppler / .env, where only the admin
+          # global key is provisioned.
+          CLOUDFLARE_API_KEY: ${{ secrets.ADMIN_CLOUDFLARE_API_KEY }}
+          CLOUDFLARE_EMAIL: ${{ secrets.ADMIN_CLOUDFLARE_EMAIL }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ env.STAGE == 'prod' &&
+            secrets.PROD_CLOUDFLARE_ACCOUNT_ID ||
+            secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+          # On `pull_request` events GitHub Actions' built-in
+          # `GITHUB_SHA` is the synthetic merge commit (PR head merged
+          # into base) — that SHA never shows up in the PR's git log.
+          # `GITHUB_SHA` is also a reserved env var, so a step-level
+          # override is silently ignored. Pass the PR head SHA under
+          # a non-reserved name and read it from alchemy.run.ts.
+          BUILD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          GITHUB_TOKEN: ${{ steps.bot-token.outputs.token }}
+
+  cleanup:
+    runs-on: ubuntu-latest
+    if:
+      ${{ github.event_name == 'pull_request' && github.event.action == 'closed'
+      }}
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Generate bot token
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Safety Check
+        run: |-
+          if [ "${{ env.STAGE }}" = "prod" ]; then
+            echo "ERROR: Cannot destroy prod environment in cleanup job"
+            exit 1
+          fi
+
+      - name: Destroy Preview Environment
+        working-directory: website
+        run: bun alchemy destroy --stage ${{ env.STAGE }} --yes
+        env:
+          CLOUDFLARE_API_KEY: ${{ secrets.ADMIN_CLOUDFLARE_API_KEY }}
+          CLOUDFLARE_EMAIL: ${{ secrets.ADMIN_CLOUDFLARE_EMAIL }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_TOKEN: ${{ steps.bot-token.outputs.token }}
diff --git a/.repos/alchemy-effect/.github/workflows/pr-package.yaml b/.repos/alchemy-effect/.github/workflows/pr-package.yaml
new file mode 100644
index 00000000000..34c9018c0e8
--- /dev/null
+++ b/.repos/alchemy-effect/.github/workflows/pr-package.yaml
@@ -0,0 +1,180 @@
+name: pr-package
+
+# Publishes alchemy + better-auth + pr-package tarballs to the pr-package
+# service at pkg.ing on every push to main and every PR sync. On PR close,
+# deletes every tag we ever assigned for that PR so the underlying tarballs
+# become orphaned and the bucket cleans them up.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  PR_PACKAGE_HOST: pkg.ing
+  NODE_VERSION: "24"
+
+jobs:
+  # ── Publish on push-to-main and PR sync. ──────────────────────────────────
+  publish:
+    if: github.event_name == 'push' || (github.event_name == 'pull_request' &&
+      github.event.action != 'closed')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      # Build everything: tsdown bundles alchemy (bin/ + cli lib) and tsc -b
+      # populates lib/ for the layer packages (better-auth, pr-package).
+      # Their tarballs ship both src/ and lib/, and consumers in non-bun
+      # runtimes resolve via the `import` condition → ./lib/index.js.
+      - run: bun run build:packages
+
+      - name: Compute tags
+        id: tags
+        env:
+          EVENT: ${{ github.event_name }}
+          # `head_ref` for PRs (source branch), `ref_name` for push (e.g. "main").
+          BRANCH: ${{ github.event_name == 'pull_request' && github.head_ref ||
+            github.ref_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          # PR builds run on the merge commit by default; tag the actual head sha
+          # so consumers can pin to a specific PR commit.
+          SHA: ${{ github.event_name == 'pull_request' &&
+            github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          short="${SHA:0:7}"
+          long="$SHA"
+          tags=("$short" "$long" "$BRANCH")
+          if [ "$EVENT" = "pull_request" ]; then
+            tags+=("pr-${PR_NUMBER}")
+          fi
+          json=$(printf '%s\n' "${tags[@]}" | jq -R . | jq -s -c .)
+          echo "tags=$json" >> "$GITHUB_OUTPUT"
+          echo "short=$short" >> "$GITHUB_OUTPUT"
+          echo "Tags: $json"
+
+      # PR builds expire after 1 week; pushes to main omit the header and
+      # fall back to the worker's defaultTtl (3 weeks).
+      - name: Publish alchemy
+        env:
+          TOKEN: ${{ secrets.PR_PACKAGE_TOKEN }}
+          TAGS: ${{ steps.tags.outputs.tags }}
+          TTL: ${{ github.event_name == 'pull_request' && '1 week' || '' }}
+        working-directory: packages/alchemy
+        run: |
+          set -euo pipefail
+          rm -f *.tgz
+          bun pm pack --destination .
+          tgz=$(ls *.tgz)
+          echo "Publishing $tgz with tags $TAGS ttl=${TTL:-default}"
+          curl -fsSL --show-error -X PUT \
+            "https://${PR_PACKAGE_HOST}/projects/alchemy/packages" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            -H "X-Tags: ${TAGS}" \
+            ${TTL:+-H "X-TTL: ${TTL}"} \
+            -H "Content-Type: application/gzip" \
+            --data-binary "@${tgz}"
+
+      - name: Publish better-auth
+        env:
+          TOKEN: ${{ secrets.PR_PACKAGE_TOKEN }}
+          TAGS: ${{ steps.tags.outputs.tags }}
+          TTL: ${{ github.event_name == 'pull_request' && '1 week' || '' }}
+        working-directory: packages/better-auth
+        run: |
+          set -euo pipefail
+          rm -f *.tgz
+          bun pm pack --destination .
+          tgz=$(ls *.tgz)
+          echo "Publishing $tgz with tags $TAGS ttl=${TTL:-default}"
+          curl -fsSL --show-error -X PUT \
+            "https://${PR_PACKAGE_HOST}/projects/@alchemy.run/better-auth/packages" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            -H "X-Tags: ${TAGS}" \
+            ${TTL:+-H "X-TTL: ${TTL}"} \
+            -H "Content-Type: application/gzip" \
+            --data-binary "@${tgz}"
+
+      - name: Publish pr-package
+        env:
+          TOKEN: ${{ secrets.PR_PACKAGE_TOKEN }}
+          TAGS: ${{ steps.tags.outputs.tags }}
+          TTL: ${{ github.event_name == 'pull_request' && '1 week' || '' }}
+        working-directory: packages/pr-package
+        run: |
+          set -euo pipefail
+          rm -f *.tgz
+          bun pm pack --destination .
+          tgz=$(ls *.tgz)
+          echo "Publishing $tgz with tags $TAGS ttl=${TTL:-default}"
+          curl -fsSL --show-error -X PUT \
+            "https://${PR_PACKAGE_HOST}/projects/@alchemy.run/pr-package/packages" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            -H "X-Tags: ${TAGS}" \
+            ${TTL:+-H "X-TTL: ${TTL}"} \
+            -H "Content-Type: application/gzip" \
+            --data-binary "@${tgz}"
+
+      # PR-only: leave a sticky comment with the install URLs pinned to this
+      # commit. Uses pkg.ing (the canonical short host), which serves both
+      # the pretty alias paths and the underlying /projects/:project/tags/:tag
+      # API directly.
+      - name: Generate bot token
+        if: github.event_name == 'pull_request'
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ steps.bot-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          SHORT_SHA: ${{ steps.tags.outputs.short }}
+        run: |
+          set -euo pipefail
+          MARKER="<!-- pr-package-comment -->"
+          # Use `bun add <name>@<url>` instead of `bun add <url>`. Without an
+          # explicit name, bun's resolver hits a DependencyLoop bug when the
+          # consumer already has the same package name resolved from npm
+          # (oven-sh/bun#5789, oven-sh/bun#17946). The aliased form bypasses
+          # the buggy reconciliation path and works on fresh and existing
+          # projects alike.
+          BODY=$(printf '%s\n\nInstall the packages built from this commit:\n\n**alchemy**\n```sh\nbun add alchemy@https://pkg.ing/alchemy/%s\n```\n\n**@alchemy.run/better-auth**\n```sh\nbun add @alchemy.run/better-auth@https://pkg.ing/@alchemy.run/better-auth/%s\n```\n\n**@alchemy.run/pr-package**\n```sh\nbun add @alchemy.run/pr-package@https://pkg.ing/@alchemy.run/pr-package/%s\n```\n' "$MARKER" "$SHORT_SHA" "$SHORT_SHA" "$SHORT_SHA")
+
+          existing=$(gh api --paginate \
+            "repos/${REPO}/issues/${PR_NUMBER}/comments" \
+            --jq ".[] | select(.user.login == \"alchemy-version-bot[bot]\") | select(.body | startswith(\"${MARKER}\")) | .id" \
+            | head -1)
+
+          if [ -n "$existing" ]; then
+            gh api -X PATCH "repos/${REPO}/issues/comments/${existing}" -f body="$BODY"
+          else
+            gh api -X POST "repos/${REPO}/issues/${PR_NUMBER}/comments" -f body="$BODY"
+          fi
diff --git a/.repos/alchemy-effect/.github/workflows/release.yml b/.repos/alchemy-effect/.github/workflows/release.yml
new file mode 100644
index 00000000000..e41f2700040
--- /dev/null
+++ b/.repos/alchemy-effect/.github/workflows/release.yml
@@ -0,0 +1,432 @@
+name: Release NPM Package
+
+on:
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: "Release channel"
+        required: true
+        type: choice
+        default: beta
+        options:
+          - release
+          - beta
+          - alpha
+          - tag
+      spec:
+        description: >-
+          Channel-specific value. tag: REQUIRED, the explicit full version (e.g.
+          2.0.0-experimental.1). release: REQUIRED, patch|minor|major or an
+          explicit x.y.z. beta|alpha: optional, an integer N to force
+          2.0.0-<channel>.N; leave blank to auto-increment.
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  id-token: write
+
+env:
+  NODE_VERSION: "24"
+  # Files produced by the bump job and consumed by every publish job + the
+  # final commit job. Listed once here so additions stay in sync.
+  BUMP_ARTIFACT_PATHS: |
+    packages/alchemy/lib
+    packages/alchemy/bin
+    packages/alchemy/package.json
+    packages/better-auth/package.json
+    packages/better-auth/lib
+    packages/pr-package/package.json
+    packages/pr-package/lib
+    bun.lock
+jobs:
+  # ── Step 1: Compute the next version and stage the bump in-memory. ──
+  # No git commit: we want a failed publish to leave no orphan commit
+  # behind. The staged files ride to the publish jobs (and the final commit
+  # job) as an artifact.
+  bump:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.bump.outputs.version }}
+      channel: ${{ inputs.channel }}
+      sha: ${{ steps.sha.outputs.sha }}
+    steps:
+      - name: Validate inputs
+        env:
+          CHANNEL: ${{ inputs.channel }}
+          SPEC: ${{ inputs.spec }}
+        run: |
+          case "$CHANNEL" in
+            tag)
+              if [ -z "$SPEC" ]; then
+                echo "::error::'tag' channel requires an explicit version in 'spec' (e.g. 2.0.0-experimental.1)"
+                exit 1
+              fi
+              ;;
+            release)
+              if [ -z "$SPEC" ]; then
+                echo "::error::'release' channel requires a 'spec' (patch|minor|major|x.y.z)"
+                exit 1
+              fi
+              ;;
+          esac
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - id: sha
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          registry-url: https://registry.npmjs.org/
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      - id: bump
+        env:
+          CHANNEL: ${{ inputs.channel }}
+          SPEC: ${{ inputs.spec }}
+        run: |
+          if [ -n "$SPEC" ]; then
+            VERSION=$(bun ./scripts/release/bump.ts "$CHANNEL" "$SPEC")
+          else
+            VERSION=$(bun ./scripts/release/bump.ts "$CHANNEL")
+          fi
+          echo "Resolved version: $VERSION (channel: $CHANNEL)"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      # Build everything once, up front, against the bumped versions. Outputs
+      # ride to every publish job as the `build-output` artifact so we don't
+      # rebuild three times in parallel.
+      - run: bun run build:packages
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bump-files
+          path: ${{ env.BUMP_ARTIFACT_PATHS }}
+          if-no-files-found: error
+          retention-days: 7
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-output
+          path: |
+            packages/*/lib
+            packages/*/bin
+          if-no-files-found: error
+          retention-days: 7
+          include-hidden-files: true
+
+  # ── Step 2: Commit (bump + changelog) and tag BEFORE publishing.
+  # Committing first means the publishable source of truth is the tagged
+  # commit; publish jobs check it out by SHA. Durability: if a previous
+  # attempt already committed and tagged but failed during npm publish, the
+  # bump job's HEAD-tag detection reuses the existing version, and this job
+  # detects HEAD is already at the tag and skips the commit/push.
+  # Skipped for `tag` channel — those releases are intentionally uncommitted.
+  commit-and-tag:
+    needs: bump
+    if: inputs.channel != 'tag'
+    runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.commit.outputs.sha }}
+    steps:
+      - name: Generate bot token
+        id: bot-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
+          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+          token: ${{ steps.bot-token.outputs.token }}
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bump-files
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      - name: Configure git
+        run: |
+          git config user.email "alchemy-version-bot[bot]@users.noreply.github.com"
+          git config user.name "alchemy-version-bot[bot]"
+
+      - id: commit
+        name: Commit bump + changelog, tag, push
+        env:
+          VERSION: ${{ needs.bump.outputs.version }}
+        run: |
+          set -euo pipefail
+          TAG="v${VERSION}"
+
+          # Durability: if HEAD already points at the release tag (resumed
+          # run after a previous attempt committed+tagged but publish
+          # failed), there is nothing to do. Use HEAD as the publish SHA.
+          HEAD_TAG=$(git describe --exact-match --tags HEAD 2>/dev/null || true)
+          if [ "$HEAD_TAG" = "$TAG" ]; then
+            echo "HEAD is already at ${TAG}; skipping commit/tag/push"
+            SHA=$(git rev-parse HEAD)
+            echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Generate release notes; release-notes.ts is idempotent and
+          # bails out if the tag heading is already present in CHANGELOG.md.
+          bun scripts/release/release-notes.ts "${TAG}"
+
+          # Stage bump files (overwritten by the downloaded artifact) and
+          # the new changelog entry as a single commit.
+          git add packages/alchemy/package.json \
+                  packages/better-auth/package.json \
+                  packages/pr-package/package.json \
+                  bun.lock \
+                  CHANGELOG.md
+
+          if git diff --cached --quiet; then
+            echo "No changes to commit (already on a release commit?)"
+          else
+            git commit -m "chore(release): ${VERSION}"
+          fi
+
+          if ! git rev-parse --verify "refs/tags/${TAG}" >/dev/null 2>&1; then
+            git tag -a "${TAG}" -m "Release ${TAG}"
+          fi
+
+          git push origin HEAD
+          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
+            echo "Tag ${TAG} already on remote, skipping tag push"
+          else
+            git push origin "refs/tags/${TAG}"
+          fi
+
+          SHA=$(git rev-parse HEAD)
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+
+  # ── Step 3a: Build and publish `alchemy`. ──
+  # For non-tag channels, checkout the just-committed tagged SHA; for the
+  # `tag` channel (no commit), checkout the bump's pre-bump SHA and rely
+  # on the bump-files artifact instead.
+  publish-alchemy:
+    needs: [bump, commit-and-tag]
+    if:
+      always() && needs.bump.result == 'success' && (needs.commit-and-tag.result
+      == 'success' || needs.commit-and-tag.result == 'skipped')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.commit-and-tag.outputs.sha || needs.bump.outputs.sha }}
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          registry-url: https://registry.npmjs.org/
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Upgrade npm for OIDC trusted publishing
+        run: |
+          npm install -g npm@latest && npm --version
+          sed -i '/always-auth/d' ~/.npmrc 2>/dev/null || true
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bump-files
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-output
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      - run: bun scripts/release/publish-package.ts packages/alchemy ${{
+          needs.bump.outputs.channel }}
+
+  # ── Step 3b: Build and publish `@alchemy.run/better-auth`. ──
+  publish-better-auth:
+    needs: [bump, commit-and-tag, publish-alchemy]
+    if:
+      always() && needs.bump.result == 'success' && (needs.commit-and-tag.result
+      == 'success' || needs.commit-and-tag.result == 'skipped') &&
+      needs.publish-alchemy.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.commit-and-tag.outputs.sha || needs.bump.outputs.sha }}
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          registry-url: https://registry.npmjs.org/
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Upgrade npm for OIDC trusted publishing
+        run: |
+          npm install -g npm@latest && npm --version
+          sed -i '/always-auth/d' ~/.npmrc 2>/dev/null || true
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bump-files
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-output
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      - run: bun scripts/release/publish-package.ts packages/better-auth ${{
+          needs.bump.outputs.channel }}
+
+  # ── Step 3c: Build and publish `@alchemy.run/pr-package`. ──
+  publish-pr-package:
+    needs: [bump, commit-and-tag, publish-alchemy]
+    if:
+      always() && needs.bump.result == 'success' && (needs.commit-and-tag.result
+      == 'success' || needs.commit-and-tag.result == 'skipped') &&
+      needs.publish-alchemy.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.commit-and-tag.outputs.sha || needs.bump.outputs.sha }}
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          registry-url: https://registry.npmjs.org/
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Upgrade npm for OIDC trusted publishing
+        run: |
+          npm install -g npm@latest && npm --version
+          sed -i '/always-auth/d' ~/.npmrc 2>/dev/null || true
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bump-files
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-output
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      - run: bun scripts/release/publish-package.ts packages/pr-package ${{
+          needs.bump.outputs.channel }}
+
+  # ── Step 4: Create GitHub Release and notify Discord. ──
+  # Runs only after every publish job succeeded. The bump+changelog commit
+  # and tag were already pushed by `commit-and-tag` before publishing.
+  finalize:
+    needs:
+      [
+        bump,
+        commit-and-tag,
+        publish-alchemy,
+        publish-better-auth,
+        publish-pr-package,
+      ]
+    if: inputs.channel != 'tag'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.commit-and-tag.outputs.sha }}
+          fetch-depth: 0
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
+      - run: bun install
+
+      - name: Create GitHub Release
+        env:
+          VERSION: ${{ needs.bump.outputs.version }}
+          CHANNEL: ${{ needs.bump.outputs.channel }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bun scripts/release/github-release.ts "v${VERSION}" "${CHANNEL}"
+
+      - name: Notify Discord
+        if: success() && env.DISCORD_WEBHOOK != ''
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          VERSION: ${{ needs.bump.outputs.version }}
+          CHANNEL: ${{ needs.bump.outputs.channel }}
+        run: bun scripts/release/discord-notify.ts "v${VERSION}" "${CHANNEL}"
diff --git a/.repos/alchemy-effect/.github/workflows/test.yml b/.repos/alchemy-effect/.github/workflows/test.yml
new file mode 100644
index 00000000000..56a8d010cab
--- /dev/null
+++ b/.repos/alchemy-effect/.github/workflows/test.yml
@@ -0,0 +1,93 @@
+name: test
+
+# Smoke-tests `alchemy destroy → deploy → destroy` against each example.
+# `bun test:canary` drives the whole suite — it iterates both bun and pnpm
+# runtimes itself and publishes canary tarballs to pkg.ing before deploying.
+
+on:
+  # TODO(sam): re-enable these when they are running reliably and not polluting our account
+  # push:
+  #   branches: [main]
+  # pull_request:
+  #   types: [opened, reopened, synchronize]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  # Required for aws-actions/configure-aws-credentials to mint a session
+  # via OIDC instead of long-lived AWS_ACCESS_KEY_ID secrets.
+  id-token: write
+
+env:
+  PKGING_HOST: pkg.ing
+  NODE_VERSION: "24"
+  # PR runs use `pr-<n>` so each PR has its own isolated cloud namespace;
+  # main pushes use `main`; manual `workflow_dispatch` runs use the branch
+  # name. Forwarded to the smoke test as $SMOKE_STAGE.
+  SMOKE_STAGE: ${{ github.event_name == 'pull_request' && format('pr-{0}',
+    github.event.number) || (github.ref == 'refs/heads/main' && 'main' ||
+    github.ref_name) }}
+
+concurrency:
+  # Cancel an in-progress run for the same PR (or branch) when a new push
+  # arrives — the smoke suite mutates real cloud state, so two parallel
+  # runs against the same SMOKE_STAGE would race.
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          version: latest
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      # Bootstrap install so `bun test:canary` itself can resolve. The
+      # test then runs its own `bun install` + `pnpm install` in canary
+      # `beforeAll` after rewriting the catalog to pkg.ing tarballs, so
+      # there's nothing pnpm-specific to wire up here.
+      - run: bun install
+
+      # OIDC → short-lived AWS session. Exports AWS_ACCESS_KEY_ID,
+      # AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_REGION; the
+      # `output-credentials: true` flag also surfaces aws-account-id as a
+      # step output (which we forward as `AWS_ACCOUNT_ID` below — the
+      # action does NOT set it as an env var on its own).
+      - id: aws-creds
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+          output-credentials: true
+
+      - name: Smoke
+        env:
+          # AWS — `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`,
+          # `AWS_SESSION_TOKEN`, `AWS_REGION` are already exported by
+          # configure-aws-credentials; we only need to forward the account
+          # id, which Alchemy's `loadFromEnv` requires when CI=true.
+          AWS_ACCOUNT_ID: ${{ steps.aws-creds.outputs.aws-account-id }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.TEST_CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+          NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
+          PR_PACKAGE_TOKEN: ${{ secrets.PR_PACKAGE_TOKEN }}
+          PKGING_HOST: ${{ env.PKGING_HOST }}
+          SMOKE_STAGE: ${{ env.SMOKE_STAGE }}
+        run: bun test:canary
diff --git a/.repos/alchemy-effect/.gitignore b/.repos/alchemy-effect/.gitignore
new file mode 100644
index 00000000000..841879bb912
--- /dev/null
+++ b/.repos/alchemy-effect/.gitignore
@@ -0,0 +1,48 @@
+node_modules/
+dist/
+/lib/
+/alchemy/lib/
+.out/
+.test/
+.DS_Store
+.env
+*.tsbuildinfo
+.claude/
+.alchemy/
+# !.alchemy/github:alchemy/
+# examples/*/.alchemy
+
+.repomix-output.txt
+wrangler.jsonc
+
+# Husky - ignore generated files but keep hooks
+.husky/_
+!.husky/pre-commit
+
+.smoke
+.smoke.logs
+smoke
+# Generated by test/smoke.test.ts to make pnpm 11's deps-status check
+# resolve the bun catalog. Cleaned up at end of suite.
+pnpm-workspace.yaml
+.svelte-kit
+.astro
+.wrangler
+
+*.tgz
+*.js
+*.d.ts
+*.map
+
+.attest
+.cache
+.external
+.bundle-benchmark
+packages/alchemy/docs
+.sonda
+examples/cloudflare-worker/src/scratch.ts
+
+!/packages/alchemy/bin/cli.js
+.vendor/*
+.tmp
+pnpm-lock.yaml
\ No newline at end of file
diff --git a/.repos/alchemy-effect/.gitmodules b/.repos/alchemy-effect/.gitmodules
new file mode 100644
index 00000000000..2f258481075
--- /dev/null
+++ b/.repos/alchemy-effect/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "vendor/alchemy"]
+	path = .vendor/alchemy
+	url = git@github.com:alchemy-run/alchemy.git
diff --git a/.repos/alchemy-effect/.husky/pre-commit b/.repos/alchemy-effect/.husky/pre-commit
new file mode 100644
index 00000000000..172915addb7
--- /dev/null
+++ b/.repos/alchemy-effect/.husky/pre-commit
@@ -0,0 +1,2 @@
+bun format
+git update-index --again
diff --git a/.repos/alchemy-effect/.ignore b/.repos/alchemy-effect/.ignore
new file mode 100644
index 00000000000..6f0ec623987
--- /dev/null
+++ b/.repos/alchemy-effect/.ignore
@@ -0,0 +1 @@
+# see: https://opencode.ai/docs/tools/#ignore-patterns
\ No newline at end of file
diff --git a/.repos/alchemy-effect/.oxfmtrc.json b/.repos/alchemy-effect/.oxfmtrc.json
new file mode 100644
index 00000000000..3091cbb48a9
--- /dev/null
+++ b/.repos/alchemy-effect/.oxfmtrc.json
@@ -0,0 +1,22 @@
+{
+  "semi": true,
+  "singleQuote": false,
+  "tabWidth": 2,
+  "useTabs": false,
+  "printWidth": 80,
+  "endOfLine": "lf",
+  "ternaries": true,
+  "experimental_sort_imports": {
+    "order": "asc"
+  },
+  "ignorePatterns": [
+    "dist/**",
+    "*.min.js",
+    "**/lib/**",
+    "**/mdx/**",
+    "**/*.mdx",
+    "**/*.md",
+    "**/.vendor/**",
+    "**/package.json"
+  ]
+}
diff --git a/.repos/alchemy-effect/.oxlintrc.json b/.repos/alchemy-effect/.oxlintrc.json
new file mode 100644
index 00000000000..5ec7dbbbb64
--- /dev/null
+++ b/.repos/alchemy-effect/.oxlintrc.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "rules": {
+    "no-misused-new": "off",
+    "require-yield": "off",
+    "no-non-null-asserted-optional-chain": "off"
+  }
+}
diff --git a/.repos/alchemy-effect/.vendor/alchemy b/.repos/alchemy-effect/.vendor/alchemy
new file mode 160000
index 00000000000..c9f5e549cf0
--- /dev/null
+++ b/.repos/alchemy-effect/.vendor/alchemy
@@ -0,0 +1 @@
+Subproject commit c9f5e549cf023632c3df948c207a58336192b3c7
diff --git a/.repos/alchemy-effect/.vscode/settings.json b/.repos/alchemy-effect/.vscode/settings.json
new file mode 100644
index 00000000000..5507ee50273
--- /dev/null
+++ b/.repos/alchemy-effect/.vscode/settings.json
@@ -0,0 +1,65 @@
+{
+  "diffEditor.renderSideBySide": false,
+  "js/ts.experimental.useTsgo": true,
+  "typescript.experimental.useTsgo": true,
+  "typescript.tsdk": "node_modules/@typescript/native-preview/lib",
+  "typescript.native-preview.tsdk": "node_modules/@typescript/native-preview/lib",
+  "typescript.enablePromptUseWorkspaceTsdk": true,
+  "typescript.preferences.importModuleSpecifier": "relative",
+  "typescript.preferences.importModuleSpecifierEnding": "js",
+  "oxc.enable": true,
+  "oxc.lint.run": "onSave",
+  "json.schemaDownload.enable": true,
+  "editor.defaultFormatter": "oxc.oxc-vscode",
+  "editor.codeLens": false,
+  "editor.formatOnSave": true,
+  "editor.formatOnSaveMode": "file",
+  "editor.inlayHints.enabled": "offUnlessPressed",
+  "editor.tabSize": 2,
+  "editor.indentSize": 2,
+  "editor.insertSpaces": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll": "explicit",
+    "source.organizeImports": "explicit"
+  },
+  "[toml]": {
+    "editor.defaultFormatter": "tamasfe.even-better-toml"
+  },
+  "[json]": {
+    "editor.defaultFormatter": "vscode.json-language-features"
+  },
+  "[jsonc]": {
+    "editor.defaultFormatter": "vscode.json-language-features"
+  },
+  "[markdown]": {
+    "editor.formatOnSave": false,
+    "editor.defaultFormatter": null
+  },
+  "[mdx]": {
+    "editor.defaultFormatter": null,
+    "editor.formatOnSave": false
+  },
+  "files.exclude": {
+    "**/__pycache__": true,
+    "**/*.pyc": true,
+    "packages/alchemy/bin/**/*.js*": true,
+    "packages/alchemy/bin/**/*.d*": true
+  },
+  "[typescript]": {
+    "editor.indentSize": 2,
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "[javascript]": {
+    "editor.indentSize": 2,
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "[typescriptreact]": {
+    "editor.indentSize": 2,
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "[javascriptreact]": {
+    "editor.indentSize": 2,
+    "editor.defaultFormatter": "oxc.oxc-vscode"
+  },
+  "oxc.enable.oxfmt": true
+}
diff --git a/.repos/alchemy-effect/AGENTS.md b/.repos/alchemy-effect/AGENTS.md
new file mode 100644
index 00000000000..2d3e71d8b07
--- /dev/null
+++ b/.repos/alchemy-effect/AGENTS.md
@@ -0,0 +1,854 @@
+# alchemy
+
+Alchemy Effect is an Infrastructure-as-Effects (IaE) framework that extends Infrastructure-as-Code (IaC) by combining business logic and infrastructure config into a single, type-safe program expressed as Effects.
+
+It includes a core IaC engine built with Effect. Effect provides the foundation for type-safe, composable, and testable infrastructure programs. It brings errors into the type-system and provides declarative/composable retry logic that ensure proper and reliable handling of failures.
+
+# Concepts
+
+- **Cloud Provider** - a cloud provider that offers a set of Services, e.g. AWS, Azure, GCP, Cloudflare, Stripe, Planetscale, Neon, etc.
+- **Service** - a collection of Resources, Functions, and Bindings offered by a Cloud Provider.
+- **Resource** - a named entity that is configuted with "Input Properties" and produces "Output Attributes". May or may not have Binding Contract.
+- **Input Properties** - the properties passed as input to configure a Resource. Otherwise known as the "desired state" of the Resource.
+- **Output Attributes** - the attributes produced by a Resource. Otherwise known as the "current state" of the Resource.
+- **Stable Properties** - properties that are not affected by an Update, e.g. the ID or ARN of a Resource.
+- **Function** (aka. **Runtime**) - a special kind of Resource that includes a runtime implementation expressed as a Function producing an `Effect<A, Err, Req>`. The `Req` type captures runtime dependencies, from which Infrastructure Dependencies are inferred.
+- **Resource Provider** (see [Provider](./packages/alchemy/src/Provider.ts))
+
+A Resource Provider implements the following Lifecycle Operations:
+
+- **Diff** - compares new props with old props and determines if the Resource needs to be updated or replaced. For updates, it can also specify a list of Stable Properties that will not be changed by the update.
+- **Read** - reads the current state of a Resource and returns the current Output Attributes. May return `Unowned(attrs)` to signal an existing-but-foreign resource that the engine should refuse to take over unless `--adopt` is set.
+- **Pre-Create** - an optional operation that creates a stub of a Resource before reconcile runs. Used to resolve circular dependencies — e.g. Function A and B depend on each other, so we create a stub of Function A first and then `reconcile` later wires up the real dependency.
+- **Reconcile** - converges a Resource's actual cloud state to the desired state described by the new Input Properties. Called for both first-time provisioning and subsequent updates. The provider receives `output` (current Attributes) and `olds` (previous Props) which may both be `undefined` on a greenfield create, both defined on an update, or `output !== undefined && olds === undefined` on an adoption. See the **Reconciler doctrine** section below for the required shape.
+- **Delete** - deletes an existing Resource. It must be designed as idempotent because it is always possible for state persistence to fail after the delete operation is called. If the resource doesn't exist during deletion, it should not be considered an error.
+- **Capability** - a runtime requirement of a Function (e.g. require `SQS.SendMessage` on a `SQS.Queue`). Each Capability is split into two parts: a `Binding.Service` (runtime SDK wrapper) and a `Binding.Policy` (deploy-time IAM/binding attachment).
+- **Binding.Service** - an Effect Service that wraps an SDK client and exposes a `.bind(resource)` method returning a typed callable for runtime use. Provided as a Layer on the **Function** Effect so it gets bundled into the Lambda/Worker. See [Binding](./packages/alchemy/src/Binding.ts).
+- **Binding.Policy** - an Effect Service that runs only at deploy time to attach IAM policies (AWS) or bindings (Cloudflare) to a Function's role/config. At runtime, `Binding.Policy` uses `Effect.serviceOption` so it gracefully becomes a no-op when the layer is not provided. Policy layers are provided on the **Stack** via `AWS.providers()()`, not on the Function.
+- **Binding** - data attached to a Resource via `resource.bind(data)`. A Binding is a `{ context: PolicyContext, data: BindingData }` tuple that is collected on the Stack during plan/deploy. Bindings enable circular references between Resources — the `Binding.Policy` calls `ctx.bind({ policyStatements: [...] })` on the target Function, which records the binding data on the Stack. The Resource Provider then receives the resolved binding data in its `reconcile` lifecycle operation via the `bindings` parameter.
+- **Binding Contract** - the shape of data a Resource accepts from Bindings. For example, a Lambda Function accepts `{ env?: Record<string, any>, policyStatements?: PolicyStatement[] }` because it needs environment variables and IAM policies. A Cloudflare Worker accepts `{ bindings: Worker.Binding[] }` for its native binding system. The Binding Contract is declared as the fourth type parameter on the `Resource` interface. See [Lambda Function](./packages/alchemy/src/AWS/Lambda/Function.ts) and [Cloudflare Worker](./packages/alchemy/src/Cloudflare/Workers/Worker.ts).
+- **Dependency** - Resources depend on other Resources through two mechanisms:
+  - Output Properties of one Resource passed as Input Properties to another Resource (non-circular, directed acyclic graph)
+  - Bindings that attach data (IAM policies, env vars, Cloudflare bindings) from one Resource to another, enabling circular references between Resources.
+- **Output** - a reference to (or derived from) a Resource's "Output Attributes". E.g. Bucket.bucketArn
+- **Stack** - a collection of Resources, Functions, and Bindings that are deployed together.
+- **Stack Name** - the name of a Stack, e.g. `my-stack`
+- **Stage** - the stage of a Stack, e.g. `dev`, `prod`, `dev-sam`
+- **Stack Instance** - a deployed instance of a Stack+Stage
+- **Resource Type** - the type of a Resource, e.g. `Bucket`, `Instance`
+- **Physical Name** - a unique name for a Resource, e.g. `my-bucket-1234567890`. It is usually best to generate them using the built-in createPhysicalName utility function which generates
+- **Logical ID** - the logical ID identifying a resource within a Stack, e.g. `my-bucket`. It is stable across creates, updates, deletes and replaces.
+- **Instance ID** - a unique identifier for an instance of a Resource. It is stable across creates, updates and deletes. It changes when a resource is replaced. It is truncated and used as the suffix of the Physical Name.
+- **Event Source** - a special kind of Binding between a Function and a Resource that produces events that invoke the Function, e.g. `SQS.QueueEventSource`. Event Sources are implemented as Binding.Service + Binding.Policy pairs, where the attach logic creates/updates the event source mapping via the cloud provider API.
+- **Replacement** - the process of replacing a Resource with a new one. A new one is created, downstream dependencies are updated with the new reference, and then the old one is deleted. Or, the old one is deleted first and then the new one is created.
+- **Dependency Violation** - an error that some APIs call when an operation cannot be performed because a dependency is not met. E.g. you cannot delete an EIP until the NAT Gateway it is attached to is deleted. Lifecycle operations typically retry Dependency Violations.
+- **Eventual Consistency** - create/update/delete operations can be eventually consistent leading to a variety of failure modes. For example, a Resource may be created but not yet available for use, or a Resource may be deleted but still appear in the console. Errors caused by eventual consistency should be retried, and lifecycle operations/tests should be carefully designed to wait for consistency before proceeding.
+- **Retryable Error** - an error that can be retried. E.g. a Dependency Violation, Eventual Consistency Error, Transient Failure, etc.
+- **Non-Retryable Error** - an error that cannot be retried. E.g. a Validation Error, Authorization Error, etc.
+- **Retry Policy** - a policy for retrying errors. E.g. a fixed delay, exponential backoff, max retries, while some condition is true, or until some condition is true/false, etc.
+
+# File System Conventions
+
+Each Service's Resources follow the same pattern. Resource contract and provider are co-located in the same file. Capabilities (Binding.Service + Binding.Policy) are in separate files named after the capability.
+
+```sh
+# source files
+packages/alchemy/src/{Cloud}/{Service}/index.ts         # re-exports all resources and capabilities
+packages/alchemy/src/{Cloud}/{Service}/{Resource}.ts    # resource contract + resource provider
+packages/alchemy/src/{Cloud}/{Service}/{Capability}.ts  # Binding.Service + Binding.Policy for a capability
+# test files
+packages/alchemy/test/{Cloud}/{Service}/{Resource}.test.ts
+# docs (auto-generated from source-code JSDoc - DO NOT manually edit)
+website/src/content/docs/providers/{Cloud}/{Resource}.md  # API reference, generated by `bun generate:api-reference`
+```
+
+Examples of actual paths:
+
+```sh
+packages/alchemy/src/AWS/S3/Bucket.ts          # S3 Bucket resource + provider
+packages/alchemy/src/AWS/S3/GetObject.ts       # S3 GetObject Binding.Service + Binding.Policy
+packages/alchemy/src/AWS/S3/PutObject.ts       # S3 PutObject Binding.Service + Binding.Policy
+packages/alchemy/src/AWS/SQS/Queue.ts          # SQS Queue resource + provider
+packages/alchemy/src/AWS/SQS/SendMessage.ts    # SQS SendMessage capability
+packages/alchemy/src/AWS/Kinesis/Stream.ts     # Kinesis Stream resource + provider
+packages/alchemy/src/AWS/Kinesis/PutRecord.ts  # Kinesis PutRecord capability
+packages/alchemy/src/AWS/Lambda/Function.ts    # Lambda Function resource + provider
+packages/alchemy/src/AWS/DynamoDB/Table.ts     # DynamoDB Table resource + provider
+packages/alchemy/src/AWS/DynamoDB/GetItem.ts   # DynamoDB GetItem capability
+packages/alchemy/src/AWS/EC2/Vpc.ts            # VPC resource + provider
+packages/alchemy/src/AWS/EC2/Subnet.ts         # Subnet resource + provider
+```
+
+# Documentation Generation
+
+**Source of truth:** The source code is the single source of truth for all API documentation. JSDoc comments in `packages/alchemy/src/**/*.ts` are extracted and used to generate the public API reference markdown.
+
+:::warning
+**Never edit the generated markdown files** under `website/src/content/docs/providers/{Cloud}/`. They are overwritten on every regeneration.
+
+To "update the docs", edit the JSDoc on the source `.ts` file (resource-level JSDoc on the exported `const`, plus field-level JSDoc on each prop/attribute) and re-run the generator. There is no separate doc file to update.
+:::
+
+**How to generate docs:**
+
+```sh
+bun generate:api-reference   # -> website/src/content/docs/providers/{Cloud}/{Resource}.md
+```
+
+This is the only doc generator that produces user-facing output. ([scripts/generate-api-reference.ts](./scripts/generate-api-reference.ts)) does the following:
+
+1. Discovers resource files in `packages/alchemy/src/{Cloud}/{Service}/`
+2. Parses TypeScript with `ts-morph`
+3. Extracts the resource-level summary plus `@section` / `@example` blocks from JSDoc
+4. Writes one markdown file per resource at `website/src/content/docs/providers/{Cloud}/{Resource}.md`
+
+After editing JSDoc on a resource, run `bun generate:api-reference` to refresh the website docs.
+
+**Writing good documentation:** When adding or updating a resource, ensure all Props and Attrs have JSDoc comments:
+
+```typescript
+export interface BucketProps {
+  /**
+   * Name of the bucket. If omitted, a unique name will be generated.
+   * Must be lowercase and between 3-63 characters.
+   */
+  bucketName?: string;
+
+  /**
+   * Whether to delete all objects when the bucket is destroyed.
+   * @default false
+   */
+  forceDestroy?: boolean;
+}
+```
+
+The `@default` tag is used to document default values and will appear in the generated documentation.
+
+### Examples and Sections (IMPORTANT)
+
+**Examples are critical for documentation.** Every resource should have examples demonstrating common use cases. Use `@section` and `@example` JSDoc tags on the main Resource export to organize examples into a navigable table of contents.
+
+**Format:**
+
+- `@section <Section Title>` - Creates a heading in the Examples section and adds an entry to the Quick Reference table of contents
+- `@example <Example Title>` - Creates a subheading for a specific code example (must follow a `@section`)
+- Code blocks inside examples use standard markdown fenced code blocks (` `)
+
+**Example:**
+
+````typescript
+/**
+ * An S3 bucket for storing objects.
+ *
+ * @section Creating a Bucket
+ * @example Basic Bucket
+ * ```typescript
+ * const bucket = yield* Bucket("my-bucket", {});
+ * ```
+ *
+ * @example Bucket with Force Destroy
+ * ```typescript
+ * const bucket = yield* Bucket("my-bucket", {
+ *   forceDestroy: true,
+ * });
+ * ```
+ *
+ * @section Reading Objects
+ * @example Get Object from Bucket
+ * ```typescript
+ * const response = yield* getObject(bucket, { key: "my-key" });
+ * const body = yield* Effect.tryPromise(() => response.Body?.transformToString());
+ * ```
+ *
+ * @section Writing Objects
+ * @example Put Object to Bucket
+ * ```typescript
+ * yield* putObject(bucket, {
+ *   key: "hello.txt",
+ *   body: "Hello, World!",
+ *   contentType: "text/plain",
+ * });
+ * ```
+ */
+export const Bucket = Resource<...>("AWS.S3.Bucket");
+````
+
+This generates:
+
+1. A "Quick Reference" section with links to each `@section`
+2. An "Examples" section with organized code examples under each section heading
+
+**Best practices for examples:**
+
+- Start with the simplest use case and progress to more complex ones
+- Include examples for all major capabilities (GetObject, PutObject, etc.)
+- Show real-world patterns like error handling, combining with other resources
+- Use descriptive titles that explain what the example demonstrates
+
+# Workflow
+
+Development of Alchemy-Effect Resources is heavily pattern based. Each Service has many Resources that each have 0 oor more Capabilities and Event Sources. When working on a new Service, the following steps should be followed.
+
+1. Research the AWS Service and identify its Resources, Identifier Types, Structs, Capabilities, and Event Sources. Refer to the corresponding Terraform Provider, Pulumi Provider, and CloudFormation docs for that service (use the provided tools specifically for searching these docs for services and resources).
+
+Example (abbreviated):
+
+Service: S3
+
+Resources:
+
+- Bucket
+- BucketPolicy
+- etc.
+
+Bucket Capabilities:
+
+- GetObject
+- PutObject
+- DeleteObject
+
+Identifier Types:
+
+- Bucket Name
+- Bucket ARN
+
+Structs:
+
+- CorsRule
+- LifecycleConfiguration
+
+2. Document each of the Resource interfaces
+
+Include the following information:
+
+- ResourceName, e.g. Bucket, Instance, Queue
+- Input Properties (for each property: Name, Type, Description, Default Value, Required, Constraints, Replaces: true/false)
+- Output Attributes (for each attribute: Name, Type, Description)
+
+3. Document each of the Capabilities and Bindings
+
+Include the following information:
+
+- Capability Name, e.g. `GetObject`, `PutObject` (it maps 1:1 with an AWS API)
+- Constraints (e.g. `Key`)
+- IAM Policies (how the capability maps to an IAM Policy, e.g. Effect: Allow, Action: s3:GetObject, Resource: `arn:aws:s3:::${bucketName}/${Key}`)
+- Environment Variables (what environment variables should be added to a Lambda Function so that it can access the capability, e.g. `BUCKET_NAME`, `BUCKET_ARN`, `QUEUE_URL`, `QUEUE_ARN`, etc.)
+
+4. Research and design each of the Lifecycle Operations
+
+- **Diff** - identify which properties are always stable across any update, which properties change conditionally depending on new and old values, which properties trigger a replacement. This is usually just a distinct list, but can sometimes require if-this-then-that logic. Document it explicitly and exhaustively. Cross-reference with AWS CloudFormation, Terraform Provider and Pulumi Provider docs.
+
+:::warning
+You should almost never use `no-op` in the Diff. No-op should be explicitly designed as a way to say "i know this property changed, but i don't want it to trigger an update". This is an edge-case and not the norm. Usually you want diff to return `undefined` or `void` to let the engine apply the default update logic. Diff is usually just use as an optimization or to identify replacement instead of update.
+:::
+
+- **Read** - determine which API calls are required to read the Output Attributes of a Resource from the Cloud Provider state (otherwise known as refresh or synchronize resource state). This is usually a single Get{Resource} API call, but can be a complex set of calls depending on the Service. Read can also be called without the current Output Attributes because of past state persistence failures. These cases are handled by computing the deterministic Physical Name and looking it up or by searching for Resources using tags (if the Cloud Provider supports it). Read may return `Unowned(attrs)` when the resource exists but lacks our ownership tags, signalling the engine to gate adoption behind `--adopt` or `adopt(true)`.
+- **Pre-Create** - determine if the Resource needs a pre-create operation. This is usually only the case for the special Function/Runtime Resources like AWS Lambda Functions. If it is required, then document which API call(s) should be called and what the empty (unit) input properties are. E.g. a Lambda Function takes a simple script that exports a no-op handler function.
+- **Reconcile** - determine the API calls needed to converge the cloud's actual state to the desired state described by the new Input Properties. Reconcile must be a single flow that works whether the resource is missing (greenfield create), pre-existing under our ownership (update), or freshly adopted (`output` defined but `olds` absent). See the **Reconciler doctrine** section below.
+- **Delete** - determine which APIs should be called and in what order to delete an existing Resource. Delete should be idempotent so that if the resource has already been deleted, it is not considered an error. It is common for deletions to fail because of Dependency Violations or Eventual Consistency Errors. These are not always called Dependency Violations in the API docs, so attention should be paid to investigating each API's possible error codes and how they should be handled by the Delete operation. Should we retry for a period of time, indefinitely, or fail immediately?
+
+# Reconciler doctrine
+
+The provider's `reconcile` function replaces the legacy `create` + `update` pair. It runs every time the engine wants to make the cloud match the desired state — whether that's the first time the resource is being provisioned, a routine update, or a takeover after `read` returned an existing cloud resource.
+
+It receives `output: Attributes | undefined` and `olds: Props | undefined`:
+
+| `output`     | `olds`       | Meaning                                           |
+| ------------ | ------------ | ------------------------------------------------- |
+| `undefined`  | `undefined`  | Greenfield — no prior physical resource           |
+| defined      | defined      | Routine update — engine-owned resource            |
+| defined      | `undefined`  | Adoption — engine adopted via `read`              |
+
+A reconciler MUST work correctly for all three combinations. It MUST NOT branch the body on `output === undefined` and run different code paths for "create" vs "update". That pattern is just rename-and-branch and re-introduces every assumption the old `create`/`update` split made. Instead, write one flow:
+
+```
+1. Observe   — derive the physical identifier; read live cloud state via getX/describeX
+2. Ensure    — if the resource is missing, call createX. Catch AlreadyExists/ConflictException
+                as a race and continue. Wait for active state if applicable.
+3. Sync      — for each mutable aspect (settings, sub-resources, tags, policy):
+                 - read OBSERVED cloud state (not olds)
+                 - compute desired state from news + bindings
+                 - diff observed against desired
+                 - apply only the delta API call (skip the API entirely on no-op)
+4. Return    — re-read final state if needed; return the fresh Attributes shape
+```
+
+Key invariants:
+
+- **Observation > assumption.** Cloud state is authoritative. `olds` is at most a hint to skip a no-op API call; it is never the source of truth for what's actually deployed.
+- **Each sync step is independently idempotent.** Crash mid-reconcile, re-run, you converge.
+- **`output` is treated as a cache** for stable identifiers (physical name, ARN, immutable id). It is NOT a guarantee that the resource still exists. If it doesn't, observation falls through to "missing" and ensure recreates.
+- **`AlreadyExists`/`NotFoundException`/`ResourceInUseException`-style errors are caught**, not propagated — they're races or eventual-consistency, not failures.
+- **Tags use observed cloud tags as the diff baseline**, not `olds.tags` or `output.tags`. Adoption may bring you a resource with foreign tags that need to be reconciled.
+
+:::warning
+**Do not write `if (output === undefined) { /* create body */ } else { /* update body */ }`.** That is rename-and-branch, not reconciliation. The reconciler's body is one observe-ensure-sync flow that produces correct cloud state regardless of starting point.
+:::
+
+The canonical reference reconcilers cover the common shapes:
+
+- [S3 Bucket](./packages/alchemy/src/AWS/S3/Bucket.ts) — uses `ensureBucketExists` + `syncBucketTags` + `syncBucketPolicy` helpers; each helper is itself a tiny reconciler.
+- [SQS Queue](./packages/alchemy/src/AWS/SQS/Queue.ts) — observe via `getQueueUrl`, ensure via `createQueue` (tolerates `QueueNameExists` race), sync attributes by diffing `getQueueAttributes` against desired, sync tags.
+- [Kinesis Stream](./packages/alchemy/src/AWS/Kinesis/Stream.ts) — many mutable aspects (mode, shards, retention, encryption, metrics), each its own observed-vs-desired sync block.
+- [DynamoDB Table](./packages/alchemy/src/AWS/DynamoDB/Table.ts) — multi-API observation (table + tags + PITR + TTL), per-aspect diffing, GSI delta application.
+- [EC2 Vpc](./packages/alchemy/src/AWS/EC2/Vpc.ts) — auto-assigned id, observe via `describeVpcs([output.vpcId])` with NotFound fallback to create, sync DNS attrs by reading `describeVpcAttribute`, sync tags from observed `vpc.Tags`.
+- [Lambda Function](./packages/alchemy/src/AWS/Lambda/Function.ts) — uses `createOrUpdateFunction` / `createOrUpdateFunctionUrl` / `attachBindings` helpers, each idempotent.
+- [Cloudflare Worker](./packages/alchemy/src/Cloudflare/Workers/Worker.ts) — non-AWS API; the underlying `putWorker` is a true upsert, so reconcile observes existing settings and delegates.
+
+Existence-only resources (Lambda Permission, EC2 Route, EC2 RouteTableAssociation, IAM AccessKey, etc.) have nothing mutable beyond their identity. Their reconciler is just observe → if missing, create. There is no sync step.
+
+5. Research and design the test cases for each resource. Test cases can be single or multi-step. Single-step test cases are just testing a single create success or failure mode. Multi-step cases are testing a sequence of operations, starting with create and then updating or replacing the resource multiple times. Test cases should be designed to be exhaustive and cover all possible success and failure modes, starting from simple happy paths to long, complicated aggregate (including other resources) smoke tests.
+6. Implement the Resource contract and Provider in `packages/alchemy/src/{Cloud}/{Service}/{Resource}.ts`.
+
+The Resource contract (Props, Attributes, Binding Contract) and the Resource Provider (lifecycle operations) are co-located in the same file.
+
+Read through the established examples to understand the pattern:
+
+- [S3 Bucket](./packages/alchemy/src/AWS/S3/Bucket.ts)
+- [SQS Queue](./packages/alchemy/src/AWS/SQS/Queue.ts)
+- [DynamoDB Table](./packages/alchemy/src/AWS/DynamoDB/Table.ts)
+- [Kinesis Stream](./packages/alchemy/src/AWS/Kinesis/Stream.ts)
+- [Lambda Function](./packages/alchemy/src/AWS/Lambda/Function.ts)
+- [VPC](./packages/alchemy/src/AWS/EC2/Vpc.ts)
+- [Subnet](./packages/alchemy/src/AWS/EC2/Subnet.ts)
+
+The Resource interface takes four type parameters: `Resource<Type, Props, Attributes, BindingContract>`.
+
+```ts
+export interface Stream extends Resource<
+  "AWS.Kinesis.Stream",
+  StreamProps,
+  {
+    streamName: string;
+    streamArn: string;
+    streamStatus: StreamStatus;
+  }
+> {}
+
+export const Stream = Resource<Stream>("AWS.Kinesis.Stream");
+```
+
+For Resources that accept Bindings (like Lambda Function), include a fourth type parameter for the Binding Contract:
+
+```ts
+export interface Function extends Resource<
+  "AWS.Lambda.Function",
+  FunctionProps,
+  {
+    functionArn: string;
+    functionName: string;
+    functionUrl: string | undefined;
+    roleName: string;
+    roleArn: string;
+  },
+  {
+    env?: Record<string, any>;
+    policyStatements?: PolicyStatement[];
+  }
+> {}
+```
+
+:::tip
+Some Input Property types are wrapped in an `Input<T>`, but not all are. Only properties that may need to be references to another resource's Output Attribute. E.g. common use-cases are `Input<VpcId>`, `Input<QueueUrl>`, `Tags: Record<string, Input<string>>`.
+:::
+
+:::warning
+For fields like `name: string`, `bucketName: string`, `bucketPrefix: string`, you should not use `Input<string>` because these properties need to be statically knowable in the `diff` function.
+:::
+
+7. Implement the Capabilities as `Binding.Service` + `Binding.Policy` pairs in `packages/alchemy/src/{Cloud}/{Service}/{Capability}.ts`.
+
+Each capability has two parts:
+
+- **`Binding.Service`** — runtime SDK wrapper, provided on the Function Effect (bundled into Lambda/Worker)
+- **`Binding.Policy`** — deploy-time IAM policy attachment, provided on the Stack via `AWS.providers()()` (never bundled)
+
+Read through the established capabilities to understand the pattern:
+
+- [S3 GetObject](./packages/alchemy/src/AWS/S3/GetObject.ts) — `Binding.Service` + `Binding.Policy`
+- [S3 PutObject](./packages/alchemy/src/AWS/S3/PutObject.ts) — `Binding.Service` + `Binding.Policy`
+- [SQS SendMessage](./packages/alchemy/src/AWS/SQS/SendMessage.ts) — `Binding.Service` + `Binding.Policy`
+- [DynamoDB GetItem](./packages/alchemy/src/AWS/DynamoDB/GetItem.ts) — `Binding.Service` + `Binding.Policy`
+- [Kinesis PutRecord](./packages/alchemy/src/AWS/Kinesis/PutRecord.ts) — `Binding.Service` + `Binding.Policy`
+- [Lambda InvokeFunction](./packages/alchemy/src/AWS/Lambda/InvokeFunction.ts) — `Binding.Service` + `Binding.Policy`
+
+For Event Sources, see:
+
+- [SQS QueueEventSource](./packages/alchemy/src/AWS/SQS/QueueEventSource.ts)
+- [S3 BucketEventSource](./packages/alchemy/src/AWS/S3/BucketEventSource.ts)
+
+The `Binding.Policy` implementation calls `ctx.bind({ policyStatements: [...] })` on the target Function, which records binding data on the Stack. The `Binding.Service` implementation resolves the Policy via `yield* Policy(resource)`, then returns a typed callable that wraps the SDK client. At runtime, the Policy is not provided and becomes a no-op.
+
+Each capability exports four things:
+
+```ts
+// 1. The Binding.Service class
+export class PutRecord extends Binding.Service<...>()("AWS.Kinesis.PutRecord") {}
+
+// 2. The Binding.Service Live layer (provided on Function Effect)
+export const PutRecordLive = Layer.effect(PutRecord, ...);
+
+// 3. The Binding.Policy class
+export class PutRecordPolicy extends Binding.Policy<...>()("AWS.Kinesis.PutRecord") {}
+
+// 4. The Binding.Policy Live layer (provided on Stack via AWS.providers()())
+export const PutRecordPolicyLive = Layer.effect(PutRecordPolicy, ...);
+```
+
+### Runtime-only methods: color with `Alchemy.RuntimeContext`
+
+The runtime callable returned by a `Binding.Service` (the inner Effect inside `.bind(resource)`'s return) **must** declare `Alchemy.RuntimeContext` as a requirement. This is how Alchemy models "this code can only run inside a deployed Function/Worker" at the type level — analogous to a colored function.
+
+```ts
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+
+export class GetItem extends Binding.Service<
+  GetItem,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: GetItemRequest,
+    ) => Effect.Effect<
+      DynamoDB.GetItemOutput,
+      DynamoDB.GetItemError,
+      RuntimeContext // ← runtime-only
+    >
+  >
+>()("AWS.DynamoDB.GetItem") {}
+```
+
+Rules:
+
+- **Outer Effect** (the `bind(resource)` setup) runs at the Function's init phase. It does NOT require `RuntimeContext`.
+- **Inner Effect** (the actual SDK invocation) only makes sense inside a running Function. It MUST require `RuntimeContext`.
+- Resolve cloud-environment services (`WorkerEnvironment`, AWS SDK clients, etc.) once during Layer construction and close over them. Do NOT leak `WorkerEnvironment` / `Lambda.FunctionEnvironment` onto the runtime callable — that couples downstream service code to a specific cloud and breaks Layer encapsulation. The Function/Worker runtime satisfies `RuntimeContext` automatically.
+- The implementation can return `Effect.Effect<A, E>` without explicitly providing `RuntimeContext` (it's contravariant in `R`); just declare it on the interface.
+
+Why this matters: consumers can build cloud-agnostic services on top of bindings using `Layer.effect(Tag, ...)` without polluting their service interface with `WorkerEnvironment`. See [Layers concept](./website/src/content/docs/concepts/layers.mdx).
+
+After implementing, register the Policy in `AWS.providers()()`:
+
+- Add the `*PolicyLive` layer to `bindings()` in [Providers.ts](./packages/alchemy/src/AWS/Providers.ts)
+- Re-export from the service's `index.ts`
+
+:::tip
+If you need to know what AWS region or account ID the resource is being created/updated in, you can use this inside any of the lifecycle operations.
+
+```ts
+const region = yield * Region;
+const account = yield * Account;
+```
+
+:::
+
+:::warning
+You should favor getting the region/account INSIDE the lifecycle operations instead of inside the Layer effect like this because then it's scoped to the resource isntead of the resource provider:
+
+```ts
+reconcile: Effect.fn(function* ({ id, news, output, session }) {
+  const region = yield* Region;
+  const accountId = yield* Account;
+});
+```
+
+:::
+
+:::warning
+Do not use `Effect.orDie` in the lifecycle operations since this will crash the whole IaC engine.
+:::
+
+:::warning
+**Never use `async`/`await`, raw `Promise`, `node:fs/promises`, `node:fs`, `node:os`, or `pathe` directly in resource code.** Always use the Effect platform services so that effects remain composable, traceable, retryable, and testable:
+
+| Don't                                                | Do                                                          |
+| ---------------------------------------------------- | ----------------------------------------------------------- |
+| `import fs from "node:fs/promises"`                  | `const fs = yield* FileSystem.FileSystem`                   |
+| `await fs.readFile(p, "utf8")`                       | `yield* fs.readFileString(p)`                               |
+| `await fs.mkdtemp(...)`                              | `yield* fs.makeTempDirectory({ prefix: ... })`              |
+| `import path from "pathe"` / `node:path`             | `const path = yield* Path.Path`                             |
+| `await fetch(...)`                                   | `yield* HttpClient.HttpClient` + `HttpClientRequest`        |
+| `Effect.promise(() => listSqlFiles(dir))`            | Make `listSqlFiles` itself return `Effect` and `yield*` it |
+| `new Promise((res) => setTimeout(res, ms))`          | `yield* Effect.sleep(Duration.millis(ms))`                  |
+
+Sync, CPU-only Node APIs (e.g. `crypto.createHash().update().digest()`, `process.cwd()`, `Buffer`, `TextEncoder`) must still be wrapped in `Effect.sync(() => ...)` (or `Effect.try` if they can throw) so the call participates in the Effect runtime — tracing, interruption, and error channels. Don't call them as bare expressions inside `Effect.gen`.
+
+```ts
+const hash = yield* Effect.sync(() =>
+  crypto.createHash("sha256").update(input).digest("hex"),
+);
+const cwd = yield* Effect.sync(() => process.cwd());
+```
+
+This applies to **lifecycle operations, helpers, AND tests**. Tests must use `FileSystem.FileSystem`/`Path.Path` for any file/path access (see [Database.test.ts](./packages/alchemy/test/Cloudflare/D1/Database.test.ts) for the pattern).
+:::
+
+:::tip
+If a Resource supports tags, you should always include the internal Alchemy tags to brand the resource with the app, stage and logical ID so that we can "know" that we created it and are responsible for it.
+
+```ts
+reconcile: Effect.fn(function* ({ id, news, output, session }) {
+  const internalTags = yield* createInternalTags(id);
+  const userTags = news.tags ?? {};
+  const allTags = { ...internalTags, ...userTags };
+});
+```
+
+:::
+
+:::warning
+Do not roll your own tag diffing logic, always use `diffTags` from [Tags.ts](./packages/alchemy/src/Tags.ts), and diff against **observed cloud tags** (not `olds.tags` or `output.tags`). Adoption can hand you a resource whose tags don't match what we last persisted.
+
+```ts
+reconcile: Effect.fn(function* ({ id, news, output, session }) {
+  const internalTags = yield* createInternalTags(id);
+  const newTags = { ...news.tags, ...internalTags };
+  // Read tags fresh from the cloud so adoption (where tags may not match
+  // what we last persisted) converges correctly.
+  const oldTags = yield* fetchObservedTags(/* … */);
+  // Option 1. use `upsert` if the API expects you to create/update tags in one call
+  const { removed, upsert } = diffTags(oldTags, newTags);
+  // Option 2. use `added` and `updated` if the API expects you to create/update tags in separate calls
+  const { removed, added, updated } = diffTags(oldTags, newTags);
+  // Option 3. use `upsert` only if the API doesn't expect you to remove tags (only PUT/UPDATe)
+  const { upsert } = diffTags(oldTags, newTags);
+```
+
+:::
+
+9. Implement the test cases in `packages/alchemy/test/{Cloud}/{Service}/{Resource}.test.ts`.
+
+Read through the established test cases before continuing so that you understand the pattern and structure of the test cases.
+
+- [S3 Bucket Test Cases](./test/AWS/S3/Bucket.test.ts)
+- [SQS Queue Test Cases](./test/AWS/SQS/Queue.test.ts)
+- [Lambda Function Test Cases](./test/AWS/Lambda/Function.test.ts)
+- [Kinesis Stream Test Cases](./test/AWS/Kinesis/Stream.test.ts)
+- [DynamoDB Table Test Cases](./test/AWS/DynamoDB/Table.test.ts)
+- [VPC Test Cases](./test/AWS/EC2/Vpc.test.ts)
+- [Subnet Test Cases](./test/AWS/EC2/Subnet.test.ts)
+
+:::warning
+Never use `Date.now()` when constructing the physical name of a resource. You should either:
+
+1. Do not proide a name and rely on the resource provider to generate a unique name for you from the app, stage and logical ID.
+2. Construct a deterministic one unique to each test case. But it should be the same on each subsequent run of the test case.
+   :::
+
+3. Consider implementing an aggregate Smoke test that brings together multiple resources that are often used together.
+
+See the [VPC Smoke Test](./test/AWS/EC2/Vpc.smoke.test.ts) for an example.
+
+11. Add the resource-level JSDoc (`@section` + `@example` blocks) and field-level JSDoc on each prop/attribute on the source `.ts` file. Then run `bun generate:api-reference` to refresh `website/src/content/docs/providers/{Cloud}/{Resource}.md`. Do NOT manually edit the generated markdown.
+
+# Test Fixtures for Effect-Native Workers / Functions
+
+To test runtime behavior of an Effect-native Worker, Workflow, Lambda, etc., write a **fixture** that defines the Worker/Function with the bindings under test and exposes one HTTP route per behavior, then write a **test** that deploys the fixture once via `beforeAll` and drives it over HTTP.
+
+## File system layout
+
+Put fixtures in a `fixtures/` directory next to the test file. Each test suite owns its own fixtures — never reach across suites:
+
+```sh
+packages/alchemy/test/{Cloud}/{Service}/{Resource}.test.ts
+packages/alchemy/test/{Cloud}/{Service}/fixtures/{worker|workflow|handler}.ts
+```
+
+## Fixture shape
+
+Resolve the bindings, expose one route per behavior, default-export the class so the test can deploy it directly:
+
+```ts
+// fixtures/worker.ts
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Gateway } from "./gateway.ts";
+
+export default class TestWorker extends Cloudflare.Worker<TestWorker>()(
+  "TestWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        if (request.url.startsWith("/url")) {
+          const url = yield* aiGateway.getUrl().pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ url });
+        }
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.AiGatewayBindingLive)),
+) {}
+```
+
+## Test shape
+
+Compose a `Stack` that deploys the fixture, share one deploy across the file with `beforeAll`/`afterAll`, drive it via `HttpClient`, and retry the first request through edge propagation:
+
+```ts
+// Service.test.ts
+import * as Alchemy from "@/index.ts";
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import TestWorker from "./fixtures/worker.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const Stack = Alchemy.Stack(
+  "ServiceTestStack",
+  { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    const worker = yield* TestWorker;
+    return { url: worker.url.as<string>() };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deployed worker exercises the binding",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* client.get(`${url}/url`).pipe(
+      Effect.retry({ schedule: Schedule.exponential("500 millis"), times: 10 }),
+    );
+    expect(res.status).toBe(200);
+    const body = (yield* res.json) as { url: string };
+    expect(body.url).toContain("gateway.ai.cloudflare.com");
+  }),
+  { timeout: 180_000 },
+);
+```
+
+Notes:
+
+- `Test.make({ providers: Cloudflare.providers() })` gives you `test`, `beforeAll`, `afterAll`, `deploy`, `destroy`.
+- `beforeAll(deploy(Stack))` returns a handle (`stack` above) that every `test` body can `yield*` to get the stack outputs.
+- `afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack))` is the standard cleanup — set `NO_DESTROY=1` locally to keep the deployment around between runs while iterating.
+- Always retry the first request (`Schedule.exponential("500 millis")`) — fresh workers.dev URLs and Lambda function URLs take a few seconds to start serving 200s.
+- For POST: use `client.post(url)` for empty bodies, or `HttpClient.execute(HttpClientRequest.post(url).pipe(HttpClientRequest.bodyJsonUnsafe(body)))` for typed bodies.
+- **Never use `while (Date.now() < deadline)` loops to poll** for an async side effect (a workflow status, a cron fire, a queue drain, eventual-consistency read, etc.). Use `Effect.repeat` with a `Schedule` and an `until` predicate so the polling participates in the Effect runtime — tracing, interruption, and error propagation work correctly, and the intent is declarative. Cap iterations with `times: N` (or a bounded schedule) so the test fails fast instead of running until the vitest timeout:
+
+  ```ts
+  // good — declarative, bounded, interruption-safe
+  const value = yield* fetchValue.pipe(
+    Effect.repeat({
+      schedule: Schedule.spaced("5 seconds"),
+      until: (v) => v.ready,
+      times: 36,
+    }),
+  );
+
+  // bad — opaque loop, ignores interruption, leaks into vitest timeout
+  let value: Value | undefined;
+  const deadline = Date.now() + 180_000;
+  while (Date.now() < deadline) {
+    value = yield* fetchValue;
+    if (value.ready) break;
+    yield* Effect.sleep("5 seconds");
+  }
+  ```
+
+  See [CronEventSource.test.ts](./packages/alchemy/test/Cloudflare/Workers/CronEventSource.test.ts) for a real-world example (polling a DO via the worker's `/times` route until the cron handler fires).
+
+## Reference implementations
+
+- Cloudflare AiGateway — [worker fixture](./packages/alchemy/test/Cloudflare/AiGateway/worker.ts) + [test](./packages/alchemy/test/Cloudflare/AiGateway/AiGateway.test.ts) (the deploy+fetch case lives at the bottom of the file)
+- Cloudflare D1Connection — [worker fixture](./packages/alchemy/test/Cloudflare/D1/d1-worker.ts) + [test](./packages/alchemy/test/Cloudflare/D1/D1Binding.test.ts)
+- Cloudflare Workflow — [workflow fixture](./packages/alchemy/test/Cloudflare/Workers/fixtures/test-workflow.ts) + [worker fixture](./packages/alchemy/test/Cloudflare/Workers/fixtures/workflow-worker.ts) + [test](./packages/alchemy/test/Cloudflare/Workers/Workflow.test.ts)
+- Cloudflare Cron Trigger — [worker + DO fixture](./packages/alchemy/test/Cloudflare/Workers/fixtures/cron-worker.ts) + [test](./packages/alchemy/test/Cloudflare/Workers/CronEventSource.test.ts) (cron handler writes to a DO; test polls a fetch route with `Effect.repeat` until the scheduled handler fires)
+- Cloudflare Images — [effect fixture](./packages/alchemy/test/Cloudflare/Images/fixtures/effect-worker.ts) + [async fixture](./packages/alchemy/test/Cloudflare/Images/fixtures/async-worker.ts) + [test](./packages/alchemy/test/Cloudflare/Images/Images.test.ts)
+- AWS Lambda (DynamoDB bindings) — [Lambda fixture](./packages/alchemy/test/AWS/DynamoDB/handler.ts) + [test](./packages/alchemy/test/AWS/DynamoDB/Bindings.test.ts) (one `describe("<BindingName>")` per binding, all driving the same deployed Lambda)
+
+# Spec-Driven Service Bring-Up
+
+Use @processes/AWS.md as the source of truth for bringing a single AWS service from zero to full coverage.
+
+That process covers:
+
+- deriving resources, bindings, event sources, and helpers from distilled
+- the audit-driven implementation loop
+- deterministic checks for registration and binding test coverage
+- Lambda fixture testing conventions
+- learned conventions like no auto-marshalling and one `describe("<BindingName>")` block per binding
+
+Keep `AGENTS.md` high-level and update @processes/AWS.md when the process evolves.
+
+When a canonical resource needs mutable event-source configuration and there is any chance of circularity, prefer a resource binding contract over a plain input prop. DynamoDB Streams is the reference case: `Table` owns the actual stream state, while `streams(table)` injects that state via bindings and the runtime-specific layer handles the subscription mechanics. See @processes/AWS.md for the DynamoDB Streams case study.
+
+# Build and Type Checking
+
+Always run type checking before committing changes:
+
+```bash
+bun tsc -b
+```
+
+This runs the TypeScript compiler in build mode, which checks all projects in the workspace. This is critical because CI will fail if there are type errors.
+
+## Build Commands
+
+| Command           | Description                                                                                  |
+| ----------------- | -------------------------------------------------------------------------------------------- |
+| `bun tsc -b`      | Type check all projects (always run before committing)                                       |
+| `bun run build`   | Clean, type check, and build the alchemy package                                             |
+| `bun build:clean` | Full clean rebuild: cleans all artifacts, reinstalls dependencies, builds, and downloads env |
+
+Use `bun build:clean` when you encounter stale build artifacts or dependency issues. It runs:
+
+1. `bun clean .` - Removes all untracked files except .env
+2. `bun i` - Reinstalls dependencies
+3. `bun run build` - Builds the project
+4. `bun download:env` - Downloads environment files
+
+# Tutorial Documentation Standard
+
+Tutorials under `website/src/content/docs/tutorial/` are **step-by-step and granular**: every code snippet introduces exactly **one** new thing, followed by a short prose explanation of just that thing. Each step gets its own `##` heading.
+
+**Anti-pattern** — one snippet that adds multiple distinct changes, followed by a numbered list or bullet list explaining each:
+
+````md
+## Bind the DO to the Worker
+
+```diff lang="typescript"
++import Counter from "./counter.ts";
++import { HttpServerRequest } from "...";
+
+  Effect.gen(function* () {
++    const counters = yield* Counter;
+    return {
+      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++        if (request.url.startsWith("/counter/") && ...) {
++          const next = yield* counters.getByName(name).increment();
++          return HttpServerResponse.text(String(next));
++        }
+        return HttpServerResponse.text("Hello!");
+      }),
+    };
+  })
+```
+
+Two things just happened:
+1. `yield* Counter` registers the DO ...
+2. `counters.getByName(name)` returns a typed stub ...
+````
+
+**Correct** — split into one heading per step, each with one snippet and one explanation:
+
+````md
+## Bind the DO to the Worker
+
+```diff lang="typescript"
++import Counter from "./counter.ts";
+
+  Effect.gen(function* () {
++    const counters = yield* Counter;
+    ...
+  })
+```
+
+`yield* Counter` registers the DO with the Worker (binding + class-migration metadata) and hands you the namespace.
+
+## Call the DO from `fetch`
+
+```diff lang="typescript"
++import { HttpServerRequest } from "...";
+
+  fetch: Effect.gen(function* () {
++    const request = yield* HttpServerRequest;
++    if (request.url.startsWith("/counter/") && ...) {
++      const next = yield* counters.getByName(name).increment();
++      return HttpServerResponse.text(String(next));
++    }
+    return HttpServerResponse.text("Hello!");
+  })
+```
+
+`counters.getByName(name)` returns a typed stub — `increment()` and `get()` round-trip through Cloudflare's RPC machinery.
+````
+
+Rules of thumb:
+
+- If you find yourself writing "Two/three things just happened", "A few things are happening here", or a numbered/bulleted list explaining separate parts of a single snippet — **split the snippet**.
+- One concept ⇒ one heading ⇒ one diff snippet ⇒ one explanation paragraph (no bullets).
+- Bullet/numbered lists are fine when they describe a recap, prerequisites, or genuinely list-shaped content (e.g. "the Worker now handles two routes: PUT and GET" at the end). They are **not** fine as a substitute for splitting a compound snippet.
+- A single API call that internally does several things (e.g. `Cloudflare.upgrade()`) doesn't need splitting — describe its behavior in prose.
+- Use `diff lang="typescript"` blocks so each step shows what's added on top of the previous step.
+
+# Pull Request Conventions
+
+When you automatically open a PR, it MUST follow this structure:
+
+- **Title**: Use conventional commit format (e.g. `fix(website): mobile theme metas`, `feat(aws/s3): add bucket lifecycle rules`).
+- **Description heading levels**: NEVER use `#` or `##` in the PR description. The smallest heading allowed is `###`. The PR description must NOT begin with its own title heading — GitHub already renders the PR title above it.
+- **Content**: Aim for the minimal content needed to convey the idea.
+  - Use simple sentences. If there are multiple discrete changes, use bullet points.
+  - **Prefer code snippets over prose.** A short ` ```ts ` or ` ```diff ` block showing the new/changed shape is worth more than a paragraph explaining it. Reach for code first; only add prose to fill in the "why" the snippet can't show on its own.
+  - Be direct and succinct. Cut adjectives, justifications, and anything that reads like marketing copy. If a sentence is restating what the diff already shows, delete it.
+  - **Never include a "Test plan", "Testing", or checklist of TODOs.** PR descriptions document the change, not the verification process. If something needs manual verification, follow the draft-PR rule below.
+  - Skip examples for trivial fixes, internal refactors, or doc-only changes.
+
+Example PR description (good — code snippet does the talking):
+
+````
+Track which state-store backend each project uses by emitting a `state_store.init` span tagged with `alchemy.state_store.kind`.
+
+```ts
+// every Layer.effect(State, …) site now wraps construction:
+makeLocalState().pipe(recordStateStoreInit("local"))
+```
+
+Dashboard groups projects by kind from these spans (Axiom can't APL-query metric datasets).
+````
+- **Outstanding work / testing / review needed**: If there are outstanding steps, manual testing required, or review items, DO NOT leave a comment on the PR and DO NOT include them in the PR description. Instead:
+  1. Mark the PR as **draft**.
+  2. Tell the user (in the chat that initiated the PR creation) what is outstanding.
+
+:::warning
+**Markdown content must reach GitHub verbatim** — un-escaped backticks, fenced code blocks, etc. The reliable shape is to write the description to a file and pass `--body-file <path>` to `gh pr create` / `gh pr edit`:
+
+```sh
+# write the body to a temp file (use Write tool, not echo/cat heredoc)
+gh pr edit 179 --body-file /tmp/pr-body.md
+```
+
+Do **not** inline the body via `--body "$(cat <<'EOF' ... EOF)"`. Even with a single-quoted heredoc some shells / `gh` versions still mangle backticks and backslashes; the resulting PR body ends up with literal `\`` sequences instead of inline code spans. `--body-file` sidesteps shell quoting entirely.
+
+If you need to update an already-created PR's body, prefer `gh pr edit --body-file ...`. If that silently no-ops (older `gh` versions), fall back to `gh api -X PATCH repos/<owner>/<repo>/pulls/<n> -F body=@/tmp/pr-body.md`.
+:::
+
+The summary goes at the very top of the description as plain prose — NO heading above it, no `### Summary`, nothing. The PR title already serves as the title; do not repeat or re-title it. Only add `###` subheadings further down if the description genuinely has multiple sections worth separating.
+
+Example PR description (good):
+
+```
+Persist the user's selected theme across reloads and fix a hero scroll glitch on mobile.
+
+- Read theme from `localStorage` on mount before first paint
+- Add `<meta name="theme-color">` per theme so mobile chrome matches
+```
+
+Example PR description (BAD — do not do this):
+
+```
+## Theme persistence fix    ← no, the PR title already exists
+### Summary                  ← no, summary needs no heading
+Persist the user's theme...
+```
diff --git a/.repos/alchemy-effect/CHANGELOG.md b/.repos/alchemy-effect/CHANGELOG.md
new file mode 100644
index 00000000000..5d2ebfce521
--- /dev/null
+++ b/.repos/alchemy-effect/CHANGELOG.md
@@ -0,0 +1,1322 @@
+## v2.0.0-beta.49
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**: DNS record bindings &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/511 [<samp>(fafc9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fafc9e9c)
+- **output**: Add flatMap and method-style combinators &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/512 [<samp>(00234)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/002343f0)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Don't unwrap unredacted values &nbsp;-&nbsp; by **sam** [<samp>(f4ef0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f4ef0381)
+- **cloudflare**: Ensure all yielded Config in a Worker to use secret_text &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/510 [<samp>(38c62)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/38c62b6b)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.48...HEAD)
+
+---
+
+## v2.0.0-beta.48
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cli**:
+  - Add cloudflare create-token command &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/496 [<samp>(ab886)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ab8864fe)
+- **cloudflare**:
+  - Zone &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/493 [<samp>(38b2f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/38b2f0a8)
+  - Rename BrowserRendering to Browser &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/503 [<samp>(1a62d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1a62d247)
+  - Tunnel Bindings &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/508 [<samp>(86bcf)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/86bcf260)
+  - **browser**: Yieldable BrowserRendering marker &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/498 [<samp>(05283)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/052832a8)
+  - **images**: Yieldable Images binding &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/501 [<samp>(46c15)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/46c158a6)
+  - **ratelimit**: Add RateLimit binding &nbsp;-&nbsp; by **Alex** and **sam** in https://github.com/alchemy-run/alchemy-effect/issues/238 [<samp>(eb8f5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/eb8f5efc)
+  - **workers**: Yieldable DynamicWorkerLoader marker &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/505 [<samp>(362fc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/362fcdff)
+- **docs**:
+  - Add Bindings section and refocus Providers on lifecycle interface &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/502 [<samp>(a5fc3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a5fc3412)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**:
+  - **zone**: Use ZoneAlreadyExists tag; bump distilled 0.22.3 &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/507 [<samp>(d948f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d948f304)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.47...HEAD)
+
+---
+
+## v2.0.0-beta.47
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**:
+  - **ai-gateway**: Add LanguageModel + AI Gateway client surface &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/389 [<samp>(51150)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/51150a8c)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cli**:
+  - Skip evalStack in login and defer State store init to runtime &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/492 [<samp>(949b3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/949b3079)
+- **cloudflare**:
+  - Handle props.env in local workers &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/473 [<samp>(0b779)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0b779dfe)
+  - Stream RPC return values across durable object boundary &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/478 [<samp>(6811d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6811de57)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.46...HEAD)
+
+---
+
+## v2.0.0-beta.46
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**:
+  - **vectorize**: Add Vectorize index as a bindable resource &nbsp;-&nbsp; by **David J. Felix** and **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/407 [<samp>(2089d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2089dbf7)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**: Use remote state when updating Cloudflare State Store &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/477 [<samp>(a1a81)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a1a811e1)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.45...HEAD)
+
+---
+
+## v2.0.0-beta.45
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Random**:
+  - Add KeyPair resource &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/441 [<samp>(aa776)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aa776a6d)
+- **aws**:
+  - **lambda**: Add timeout to FunctionProps &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/440 [<samp>(38a32)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/38a32704)
+- **cloudflare**:
+  - Add Browser Rendering binding &nbsp;-&nbsp; by **Alex** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/372 [<samp>(88e95)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/88e95867)
+  - Cross-script durable object binding &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/435 [<samp>(438fb)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/438fbfe1)
+  - RpcWorker &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/387 [<samp>(d15f0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d15f0a9f)
+  - Add RpcDurableObjectNamespace + modular RpcWorker/DO &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/388 [<samp>(c801d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c801dfd3)
+  - Workflows in `alchemy dev` &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/449 [<samp>(0351d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0351d715)
+  - Worker.url now tries to infer canonical url & domain order is preserved &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/432 [<samp>(ae0a1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ae0a19a6)
+  - AnalyticsEngine and SendEmail bindings in alchemy dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/460 [<samp>(aa890)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aa890310)
+  - Custom ports in alchemy dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/469 [<samp>(68ef9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/68ef90fe)
+  - **queue**: Accept Duration.Input for messages() time props &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/443 [<samp>(f15c0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f15c0c50)
+  - **workers**: Collapse WorkerProps.bindings into WorkerProps.env &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/446 [<samp>(a0358)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a0358684)
+- **core**:
+  - Replace Alchemy.Secret and Alchemy.Variable with effect/Config &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/445 [<samp>(53e7b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/53e7b9c5)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Update Secrets reconcilation logic to update the Secret and update distilled &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(5d2d8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5d2d8daf)
+  - Wait for queue consumer to be bound &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c74a8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c74a871b)
+- **better-auth**:
+  - Better auth as peer dep &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/434 [<samp>(08244)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/08244a13)
+- **cli**:
+  - Disable --experimental-transform-types on node.js 26 &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/458 [<samp>(70359)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/703591ba)
+  - Import stack via file URL on Windows &nbsp;-&nbsp; by **d3lay** in https://github.com/alchemy-run/alchemy-effect/issues/426 [<samp>(51f6f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/51f6f9e4)
+  - Ensure auth providers don't run in parallel and only run once &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/461 [<samp>(2421c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2421cfe4)
+- **cloudflare**:
+  - Dev hyperdrive binding fails for vite/async workers &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/423 [<samp>(c83ce)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c83ce2d8)
+  - Pass DO scriptName through async bindings &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/437 [<samp>(3a8da)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3a8daa3d)
+  - Handle external require calls in vite dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/452 [<samp>(87cc9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/87cc9f0c)
+  - Cloudflare.providers() has `any` in requirements &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/456 [<samp>(81814)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/818147f8)
+  - Reconcile Worker preview subdomain state &nbsp;-&nbsp; by **Dawson** and **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/285 [<samp>(dbd04)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/dbd042e2)
+  - Handle websocket upgrade in vite dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/457 [<samp>(67b57)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/67b57f81)
+  - Run HttpServer pre-response handlers correctly &nbsp;-&nbsp; by **Lucas Thevenet**, **Sam Goodwin** and **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/404 [<samp>(2e3d1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2e3d176f)
+  - Only close Scope if it's not transferred to a Stream &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(bb970)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bb970abd)
+  - Trim bearer token to workaround effect beta.73 regression &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/468 [<samp>(2d08b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2d08bcf5)
+  - Reduce unnecessary updates in alchemy dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/455 [<samp>(ab7e7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ab7e718b)
+  - **worker**: Normalize bundle entry path on windows &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/453 [<samp>(5cd26)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5cd26234)
+- **core**:
+  - Interrupt deployments when upstream non-cylic dependency fails &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e22ee)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e22ee4bf)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.44...HEAD)
+
+---
+
+## v2.0.0-beta.44
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Bundle analyzer plugin &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/405 [<samp>(28b8c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/28b8c7a4)
+- **cloudflare**:
+  - Support Artifacts binding in dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/419 [<samp>(3917e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3917ef3a)
+  - **zaraz**: Add ZarazConfig resource &nbsp;-&nbsp; by **Alex** in https://github.com/alchemy-run/alchemy-effect/issues/371 [<samp>(7a232)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7a232990)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Node.js import resolution error from @alchemy.run/node-utils &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/406 [<samp>(4820d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4820da51)
+- **bundle**:
+  - Support Vite-style ?raw imports &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/411 [<samp>(0e989)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0e98917c)
+- **cli**:
+  - Filter bun's "not in project directory" watcher warning &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/124 [<samp>(67370)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/673701e6)
+- **cloudflare**:
+  - Update cloudflare-tools to 0.6.1 &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/403 [<samp>(cb68e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cb68ef48)
+  - Remove extraneous logs &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/410 [<samp>(7bb5d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7bb5d132)
+  - Harden local durable object handling &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/408 [<samp>(19e80)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/19e80aa2)
+  - Update cloudflare-tools to 0.6.3 &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/418 [<samp>(60826)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/60826480)
+  - Optimize WorkerBridge imports and silence warning &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/420 [<samp>(aa9ee)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aa9ee151)
+- **dev**:
+  - Dangling processes after dev server exits &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/382 [<samp>(6a8a0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6a8a0258)
+- **website**:
+  - Extract privacy.mdx style block to css file &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/398 [<samp>(fd72a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fd72a9de)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.43...HEAD)
+
+---
+
+## v2.0.0-beta.43
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **planetscale**: Add planetscale resources &nbsp;-&nbsp; by **Lucas Thevenet** and **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/113 [<samp>(ce5ea)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ce5eabbf)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Move WorkerEnvironment requirement to the Layer instead of the binding API call &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/383 [<samp>(ab3a0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ab3a0268)
+  - Allow Outputs as input to Cloudflare.Worker &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/394 [<samp>(b9ea9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b9ea9315)
+- **core**:
+  - Remove actions when destroying &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d8551)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d8551e21)
+- **docker**:
+  - Proper docker command on windows &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/377 [<samp>(d1c42)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d1c421af)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.42...HEAD)
+
+---
+
+## v2.0.0-beta.42
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - **Worker**: Defer Platform hook bindings to avoid TDZ from npm &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/378 [<samp>(1b498)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1b498227)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.41...HEAD)
+
+---
+
+## v2.0.0-beta.41
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**: Include WorkerProps.env in InferEnv &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/351 [<samp>(f157e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f157ed89)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Fix RPC and HTTP APIs by scoping runtime effects per request &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/374 [<samp>(b7cdc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b7cdca09)
+- **cloudflare**:
+  - Externalize lightningcss + fsevents in worker bundler &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/363 [<samp>(5dc95)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5dc95a0e)
+  - Provide worker env to do methods &nbsp;-&nbsp; by **Dillon Mulroy** in https://github.com/alchemy-run/alchemy-effect/issues/369 [<samp>(7b5be)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7b5be8be)
+  - Add WorkerExecutionContext and ExecutionContext to worker fetch types &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/358 [<samp>(d2d0f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d2d0fa8d)
+  - **worker**: Force delete scripts on teardown &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/348 [<samp>(f37d0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f37d06cf)
+- **core**:
+  - Eager terminal status events + pending while waiting on deps &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/376 [<samp>(b307e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b307ee5a)
+- **sidecar**:
+  - Preserve Redacted values across RPC serialization &nbsp;-&nbsp; by **Juliaan** in https://github.com/alchemy-run/alchemy-effect/issues/356 [<samp>(b2334)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b2334c5e)
+- **state**:
+  - Remove that one log we don't want, if you know you know &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/347 [<samp>(ab648)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ab648e16)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.40...HEAD)
+
+---
+
+## v2.0.0-beta.40
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **axiom**: Smartfilter chart subtype &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/339 [<samp>(f2650)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f2650d05)
+- **cloudflare**: Vite dev &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/331 [<samp>(1913a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1913aafb)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Revert scopeTransferToStream which is causing 415 &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(fe354)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fe354905)
+  - Bump state store version to 5 &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(baddd)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/baddd845)
+  - **AiGateway**:
+    - Stop reporting update on every deploy &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/332 [<samp>(2a1f7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2a1f7232)
+    - Align desired-state defaults with API defaults &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/334 [<samp>(0e3dc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0e3dcd3b)
+  - **Container**:
+    - Forward startup options through Cloudflare.start &nbsp;-&nbsp; by **Christopher Yovanovitch** in https://github.com/alchemy-run/alchemy-effect/issues/341 [<samp>(1c72b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1c72b9c0)
+  - **Worker**:
+    - Log full Cause server-side, return generic 500 to client &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/336 [<samp>(ebdbc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ebdbc0d5)
+- **aws,cloudflare**:
+  - Sanitize entrypoint urls &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/353 [<samp>(4cf38)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4cf3856c)
+- **dev**:
+  - Use @alchemy.run/node-utils lockfile &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/345 [<samp>(acc8b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/acc8b885)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.39...HEAD)
+
+---
+
+## v2.0.0-beta.39
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - **Vite**:
+    - Inline `env` props as `import.meta.env.*` in the bundle &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/330 [<samp>(c22a1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c22a1c7a)
+  - **Worker**:
+    - Cloudflare Worker HTTP effect lifecycle &nbsp;-&nbsp; by **Will King** in https://github.com/alchemy-run/alchemy-effect/issues/328 [<samp>(a1032)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a1032c34)
+    - Add missing SendEmail worker binding type and meta &nbsp;-&nbsp; by **Gerben Mulder** in https://github.com/alchemy-run/alchemy-effect/issues/326 [<samp>(a7fbb)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a7fbba51)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.38...HEAD)
+
+---
+
+## v2.0.0-beta.38
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**: Add Email Routing resources and SendEmail Worker binding &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/314 [<samp>(06dab)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/06dab7c5)
+- **core**: Action plan node type (functions that run as part of apply) &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/315 [<samp>(8a66a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8a66a896)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Move to effect@4.0.0-beta.66 &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/321 [<samp>(b57f7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b57f78cf)
+- Improve transport error fault tolerance &nbsp;-&nbsp; by **sam** [<samp>(6d67c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6d67c24f)
+- **Neon**: Use @distilled.cloud/neon SDK instead of hand-rolled API &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/270 [<samp>(1b9d4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1b9d4372)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.37...HEAD)
+
+---
+
+## v2.0.0-beta.37
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Cross-stack and cross-stage references &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/300 [<samp>(94ea3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/94ea3129)
+- **Cloudflare**:
+  - Empty r2 bucket on destroy &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/276 [<samp>(2412a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2412a3c2)
+  - Worker to worker binding types and tanstack start bridge example and docs &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/310 [<samp>(30dd9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/30dd99c9)
+  - **Workflow**: Type workflow input and output &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/304 [<samp>(1dafd)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1dafd77c)
+- **cloudflare**:
+  - Add Worker cron triggers &nbsp;-&nbsp; by **Dawson** and **sam** in https://github.com/alchemy-run/alchemy-effect/issues/288 [<samp>(cae20)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cae20c98)
+  - Add Analytics Engine binding &nbsp;-&nbsp; by **Dawson** and **sam** in https://github.com/alchemy-run/alchemy-effect/issues/286 [<samp>(ba8b3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ba8b3a16)
+- **core**:
+  - Add Alchemy.Secret and Alchemy.Variable &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/290 [<samp>(88611)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/88611eac)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Remove deprecated libsodium wrapper types &nbsp;-&nbsp; by **齐天大圣** in https://github.com/alchemy-run/alchemy-effect/issues/311 [<samp>(f3f70)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f3f7079a)
+- **Cloudflare**:
+  - **D1**: Make prepare/bind synchronous &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/299 [<samp>(6e58d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6e58da04)
+- **cloudflare**:
+  - Include wasm modules in local sidecar bundle &nbsp;-&nbsp; by **Baptiste Arnaud** and **sam** in https://github.com/alchemy-run/alchemy-effect/issues/305 [<samp>(1926d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1926d580)
+- **core**:
+  - Throw on JS string-coercion of unresolved Outputs &nbsp;-&nbsp; by **Zé Yuri** in https://github.com/alchemy-run/alchemy-effect/issues/306 [<samp>(d1b12)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d1b12ac7)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.36...HEAD)
+
+---
+
+## v2.0.0-beta.36
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**:
+  - **Images**: Add Images binding &nbsp;-&nbsp; by **Alex** in https://github.com/alchemy-run/alchemy-effect/issues/237 [<samp>(b19c3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b19c3562)
+- **cloudflare**:
+  - Support Hyperdrive in Worker bindings &nbsp;-&nbsp; by **Baptiste Arnaud** in https://github.com/alchemy-run/alchemy-effect/issues/282 [<samp>(48381)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/48381a01)
+  - **r2**: Add lifecycleRules option to R2Bucket &nbsp;-&nbsp; by **Baptiste Arnaud** in https://github.com/alchemy-run/alchemy-effect/issues/284 [<samp>(ed905)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ed905d44)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Dev**: Resolve *.localhost via undici dispatcher &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/289 [<samp>(ae6de)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ae6de171)
+
+### &nbsp;&nbsp;&nbsp;🏎 Performance
+
+- **smoke**: Batch canary install at the workspace root &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/291 [<samp>(90918)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9091856e)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.35...HEAD)
+
+---
+
+## v2.0.0-beta.35
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**:
+  - **R2**: Add bucket custom domains &nbsp;-&nbsp; by **Alex** and **sam** in https://github.com/alchemy-run/alchemy-effect/issues/241 [<samp>(a782a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a782a449)
+- **Neon**:
+  - **Project**: Add enableLogicalReplication option &nbsp;-&nbsp; by **Baptiste Arnaud** in https://github.com/alchemy-run/alchemy-effect/issues/268 [<samp>(c4945)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c49451c6)
+- **cli**:
+  - Warn when a newer alchemy version is on npm &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/253 [<samp>(7e701)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7e701205)
+  - Use plain-text renderer in non-interactive terminals &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/258 [<samp>(16485)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/16485403)
+  - Cloudflare/aws namespaces + cloudflare state logs &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/256 [<samp>(335ab)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/335ab26c)
+- **cloudflare**:
+  - Worker support non-string env bindings &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/269 [<samp>(220c3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/220c358c)
+  - **queue**: Cloudflare.messages(queue).subscribe(...) Effect consumer API &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/260 [<samp>(59c01)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/59c01867)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Move Auth Providers into layers to keep requirements never &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/271 [<samp>(38319)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/38319fa0)
+- Dev mode node compatibility and profiles &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/273 [<samp>(9f402)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9f4026b6)
+- **Cloudflare**:
+  - **QueueConsumer**: Paginate listConsumers, surface conflicts clearly &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/257 [<samp>(11d06)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/11d06201)
+  - **R2**: Simplify r2 custom domain interface to just an array &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/259 [<samp>(8953d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8953dfc2)
+- **Drizzle**:
+  - Only flag Schema as updated when migrations actually drift &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/261 [<samp>(8f2e3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8f2e33e7)
+- **cloudflare**:
+  - Disable builder.sharedConfigBuild for vite build &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/176 [<samp>(2fb34)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2fb34c2b)
+  - Update runtime to 0.3.1 &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/278 [<samp>(426e8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/426e83f6)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.34...HEAD)
+
+---
+
+## v2.0.0-beta.34
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Upgrade to distilled 0.17.0 consistently &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d681f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d681f72f)
+- **cli**: Correct args for dev command in node &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/250 [<samp>(4859d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4859dc95)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.33...HEAD)
+
+---
+
+## v2.0.0-beta.33
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**: Fix I/O error in state store &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/251 [<samp>(ec430)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ec430ad2)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.32...HEAD)
+
+---
+
+## v2.0.0-beta.32
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**: Log cf state store version mismatch &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/245 [<samp>(75f52)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/75f5220d)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**: Remove debug log statements &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(64414)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/64414547)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.31...HEAD)
+
+---
+
+## v2.0.0-beta.31
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**:
+  - **StateStore**: Wire OTLP traces, metrics, and logs &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/181 [<samp>(14b8a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/14b8ab8c)
+- **aws**:
+  - Harden ApiGateway REST resources (bindings, retries, stage patches) &nbsp;-&nbsp; by **Sam Goodwin** and **Adrian Witaszak** in https://github.com/alchemy-run/alchemy-effect/issues/169 [<samp>(e4b84)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e4b84a51)
+- **cloudflare**:
+  - Add Tunnel, VpcService, and VpcServiceRef &nbsp;-&nbsp; by **Kotkoroid** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/123 [<samp>(090c1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/090c14db)
+  - Expose raw durable object sql storage &nbsp;-&nbsp; by **m@s** in https://github.com/alchemy-run/alchemy-effect/issues/188 [<samp>(20c03)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/20c0301b)
+  - Add Hyperdrive resource with dev-mode local DB support &nbsp;-&nbsp; by **Julian Archila** in https://github.com/alchemy-run/alchemy-effect/issues/158 [<samp>(8e651)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8e651091)
+  - Workers observability traces &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/244 [<samp>(ae531)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ae5319cd)
+- **core**:
+  - Support for adoption in the core engine (using read) &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/167 [<samp>(9914e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9914ec03)
+  - Replace create+update with one `reconcile` function &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/179 [<samp>(bfd4f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bfd4f386)
+- **neon**:
+  - Add Neon serverless Postgres provider &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/134 [<samp>(3b5e8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3b5e88a8)
+- **test**:
+  - Add dev flag to test harness, toggleable via ALCHEMY_DEV &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/183 [<samp>(7856a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7856afbb)
+- **website**:
+  - Generate llms.txt from page frontmatter &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/170 [<samp>(9ad47)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9ad47381)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Dedupe Container DO bindings by namespaceId &nbsp;-&nbsp; by **Christopher Yovanovitch** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/172 [<samp>(a2c54)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a2c54999)
+  - **SecretsStore**: Adoption opt-in by default &nbsp;-&nbsp; by **Stibbs** in https://github.com/alchemy-run/alchemy-effect/issues/163 [<samp>(d9f22)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d9f22752)
+- **aws**:
+  - **lambda**:
+    - Scope public url invokes &nbsp;-&nbsp; by **José Netto** in https://github.com/alchemy-run/alchemy-effect/issues/162 [<samp>(1e092)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1e092912)
+    - Pass invoked via url permission &nbsp;-&nbsp; by **José Netto** in https://github.com/alchemy-run/alchemy-effect/issues/161 [<samp>(3e978)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3e978ff7)
+- **cloudflare**:
+  - Enable hyperdrive in dev mode &nbsp;-&nbsp; by **John Royal** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/242 [<samp>(86623)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8662373d)
+  - **worker**: Make asset hash path-independent and reuse manifest when unchanged &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/165 [<samp>(e1669)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e1669a77)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.30...HEAD)
+
+---
+
+## v2.0.0-beta.30
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**: Apply Cloudflare Access headers to HTTP requests &nbsp;-&nbsp; by **jacobiajohnson** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/160 [<samp>(fd329)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fd329e7)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.29...HEAD)
+
+---
+
+## v2.0.0-beta.29
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**: Add AiGateway resource &nbsp;-&nbsp; by **Jan Henning** in https://github.com/alchemy-run/alchemy-effect/issues/130 [<samp>(b0361)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b036165)
+- **cloudflare/state-store**: Version-gate the deployed worker &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/156 [<samp>(bdc37)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bdc37df)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Don't run update out of order for strict DAGs &nbsp;-&nbsp; by **sam** and **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/144 [<samp>(fcae5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fcae571)
+  - Run state-store secret probe under the deployed script name &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/150 [<samp>(061f8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/061f86b)
+- **cloudflare**:
+  - Handle cloudflare access for edge preview workers &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/155 [<samp>(09d01)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/09d0130)
+- **core**:
+  - Handle failed resource gracefully &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/119 [<samp>(94d4b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/94d4b3f)
+- **website**:
+  - Mobile dark hero, theme reactivity, brighter beta badge, OG host &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/146 [<samp>(05eae)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/05eae4d)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.28...HEAD)
+
+---
+
+## v2.0.0-beta.28
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Remove PlatformServices from Util barrel &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/137 [<samp>(f85dd)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f85ddfe)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.27...HEAD)
+
+---
+
+## v2.0.0-beta.27
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**: Don't bundle CLI with tsdown because it messes with import.meta.path &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/135 [<samp>(2796c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2796c33)
+- **pr-package**: Use `bun add <name>@<url>` to dodge bun DependencyLoop bug &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/132 [<samp>(989e2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/989e254)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.26...HEAD)
+
+---
+
+## v2.0.0-beta.26
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **test**: Align vitest and bun test helpers and integrate with profiles &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/129 [<samp>(07e83)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/07e83f3)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Export types as lib/.d.ts &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/121 [<samp>(a000c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a000c26)
+- Resolve bin/exec.ts via package name so devs modes bundled CLI works &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/128 [<samp>(303da)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/303daeb)
+- **cli**:
+  - Parallelize alchemy state tree &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/126 [<samp>(f3e8f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f3e8fef)
+- **cloudflare**:
+  - Bootstrap regressions in SecretsStore and StateStore &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/131 [<samp>(37db0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/37db01a)
+- **core**:
+  - Fix broken url in error message and add state store guide &nbsp;-&nbsp; by **sam** [<samp>(4b991)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4b991e7)
+  - Treat raw Resource refs as upstream dependencies &nbsp;-&nbsp; by **Mathieu Post** and **sam** in https://github.com/alchemy-run/alchemy-effect/issues/122 [<samp>(416f1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/416f19c)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.25...HEAD)
+
+---
+
+## v2.0.0-beta.25
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**: Remove broken keepAssets optimization &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(845a7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/845a7b7)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.24...HEAD)
+
+---
+
+## v2.0.0-beta.24
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Dev mode for cloudflare workers &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/88 [<samp>(5a0d7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5a0d779)
+- **core**: --adopt &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(2af88)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2af8851)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Add bootstrap command and harden bootstrap process of cloudflare &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/118 [<samp>(0858d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0858dd8)
+  - Hoist stack non-destructively &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c9621)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c9621d1)
+  - Don't fail on broken paths in state &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(05f16)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/05f16c8)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.23...HEAD)
+
+---
+
+## v2.0.0-beta.23
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **AWS**: Various bugs in Lambda Function &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(92611)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/92611cd)
+- **cli**: Logs and tail command read state from right place &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/114 [<samp>(00163)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0016361)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.22...HEAD)
+
+---
+
+## v2.0.0-beta.22
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**: D1Database migrationsDir, importFiles, and clone &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/111 [<samp>(555e8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/555e8ff)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.21...HEAD)
+
+---
+
+## v2.0.0-beta.21
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **pr-pkg**: Pr-package package &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/110 [<samp>(9442d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9442d42)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Update to distilled 0.13.1 &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b0407)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b040783)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.20...HEAD)
+
+---
+
+## v2.0.0-beta.20
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Update to effect beta.58 & distilled 0.13 &nbsp;-&nbsp; by **Michael (Pear)** [<samp>(d6f4e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d6f4e53)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.19...HEAD)
+
+---
+
+## v2.0.0-beta.19
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Axiom**:
+  - Axiom resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f2ffd)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f2ffde1)
+  - Type-safe dashboard charts &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(46f05)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/46f051d)
+- **Bundle**:
+  - Auto-detect entry package for pure annotations &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ce5f3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ce5f35b)
+- **core**:
+  - Annotate pure calls to optimize tree shaking &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e21a6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e21a605)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Axiom**:
+  - Ensure token is always present and handle missing token error in ApiTokenProvider &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(da86a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/da86abb)
+  - Don't replace token when props don't cange &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ac655)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ac65581)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.18...v2.0.0-beta.19)
+
+---
+
+## v2.0.0-beta.18
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **CloudFront**: CachePolicy, OriginRequestPolicy, ResponseHeadersPolicy, PublicKey, KeyGroup &nbsp;-&nbsp; by **Jordan** and **Claude Opus 4.7** in https://github.com/alchemy-run/alchemy-effect/issues/106 [<samp>(70201)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7020108)
+- **GitHub**: Secrets helper for creating many secrets &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(7be53)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7be536a)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.17...v2.0.0-beta.18)
+
+---
+
+## v2.0.0-beta.17
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **ECS**:
+  - Add CapacityProvider resource &nbsp;-&nbsp; by **Jordan** in https://github.com/alchemy-run/alchemy-effect/issues/103 [<samp>(cb218)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cb2183e)
+- **cli**:
+  - Add alchemy profile clear command &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/104 [<samp>(9dde9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9dde996)
+  - Add `alchemy state clear` command &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/105 [<samp>(26bf5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/26bf5e4)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Don't modify ApiToken policies, let user write explicitly. &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/102 [<samp>(5c31b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5c31b1f)
+- **GitHub**:
+  - Place Comment in the GitHub.Providers collection &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3ad95)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3ad95cb)
+- **cli**:
+  - Don't prompt for approval if plan has no changes &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(891cf)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/891cf1c)
+  - Dont print undefined outputs &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(31ade)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/31ade04)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.16...v2.0.0-beta.17)
+
+---
+
+## v2.0.0-beta.16
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**:
+  - Artifacts Store &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e531f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e531fbe)
+  - Allow account ID to be passed into AccountApiToken and UserApiToken &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(0f8ac)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0f8ac88)
+- **GitHub**:
+  - Auth provider for github supporting env, PAT and gh cli &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1de51)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1de5180)
+- **cli**:
+  - Alchemy profile show &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f83e2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f83e216)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**: Remove InstanceId from Artifact store requirement &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(de489)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/de489c7)
+- **cli**: Don't fail on broken profiles when logging in &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d8296)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d829616)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.15...v2.0.0-beta.16)
+
+---
+
+## v2.0.0-beta.15
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**: UserApiToken and AccountApiToken &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(56e0f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/56e0f79)
+- **GitHub**: Export a providers() Layer &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e5cd4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e5cd471)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Properly handle redacted outputs &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/101 [<samp>(0d049)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0d049aa)
+- **Cloudflare**:
+  - Prefix State Store secrets with Alchemy &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e2533)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e25338e)
+- **core**:
+  - Clearer error when Stack is missing state or providers &nbsp;-&nbsp; by **Michael K** [<samp>(52cf4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/52cf431)
+  - Core no longer requires cli &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/100 [<samp>(aba0e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aba0ea4)
+  - Handle Redacted values in Plan &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4fc48)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4fc4874)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.14...v2.0.0-beta.15)
+
+---
+
+## v2.0.0-beta.14
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **Cloudflare**: Cloudflare State Store &nbsp;-&nbsp; by **Sam Goodwin** and **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/94 [<samp>(d3b12)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d3b1298)
+- **cli**: Alchemy state command &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b4a1d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b4a1d94)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**: Set rolldown resolve.conditionNames for bun/node in container bundle &nbsp;-&nbsp; by **Christopher Yovanovitch** in https://github.com/alchemy-run/alchemy-effect/issues/86 [<samp>(779bb)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/779bbd1)
+- **cli**: Use a cli.js shim to support node/bun and make effect a non-optional peer &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/92 [<samp>(9b69b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9b69ba3)
+- **core**: Harden HttpStateStore to transient errors &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4071e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4071e8a)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.13...v2.0.0-beta.14)
+
+---
+
+## v2.0.0-beta.13
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cli**: Cli ships correct platform versions &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/91 [<samp>(e3597)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e3597ab)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.12...v2.0.0-beta.13)
+
+---
+
+## v2.0.0-beta.12
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **AWS**: Use account-regional S3 bucket names for assets &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6ab3f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6ab3fba)
+- **cloudflare**: Secret store resources &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/64 [<samp>(9b107)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9b10769)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Providers not inheriting parent scope &nbsp;-&nbsp; by **John Royal** [<samp>(8317b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8317bcc)
+- Include WebSocketConstructor in PlatformServices &nbsp;-&nbsp; by **John Royal** [<samp>(2dfb0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2dfb06e)
+
+### &nbsp;&nbsp;&nbsp;🏎 Performance
+
+- Use subpath imports for PlatformServices &nbsp;-&nbsp; by **John Royal** [<samp>(1867a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1867a42)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.11...v2.0.0-beta.12)
+
+---
+
+## v2.0.0-beta.11
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Support vite 7 &nbsp;-&nbsp; by **John Royal** and **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/68 [<samp>(28d0e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/28d0ef2)
+- **Cloudflare**:
+  - Install external deps in container Dockerfile &nbsp;-&nbsp; by **Christopher Yovanovitch** and **Sisyphus** in https://github.com/alchemy-run/alchemy-effect/issues/75 [<samp>(f8493)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f84934f)
+  - Add Queue, QueueBinding, and QueueConsumer resources &nbsp;-&nbsp; by **Christopher Yovanovitch** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/69 [<samp>(09e97)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/09e971b)
+- **cli**:
+  - Alchemy login &nbsp;-&nbsp; by **Sam Goodwin** and **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/67 [<samp>(fc57d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fc57db8)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Provide WorkerEnvironment to Workflow body, not wrapper &nbsp;-&nbsp; by **Christopher Yovanovitch** in https://github.com/alchemy-run/alchemy-effect/issues/71 [<samp>(a0ae1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a0ae1d6)
+  - Write all bundle chunks to container image context &nbsp;-&nbsp; by **Christopher Yovanovitch** in https://github.com/alchemy-run/alchemy-effect/issues/78 [<samp>(03306)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0330605)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.10...v2.0.0-beta.11)
+
+---
+
+## v2.0.0-beta.10
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Cloudflare**:
+  - Reduce readiness retry schedule from 104s to 30s &nbsp;-&nbsp; by **Christopher Yovanovitch** and **Sisyphus** in https://github.com/alchemy-run/alchemy-effect/issues/76 [<samp>(bb2bf)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bb2bff2)
+  - Await monitor() Promise instead of discarding it &nbsp;-&nbsp; by **Christopher Yovanovitch** and **Sisyphus** in https://github.com/alchemy-run/alchemy-effect/issues/74 [<samp>(d75e6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d75e6dd)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.9...v2.0.0-beta.10)
+
+---
+
+## v2.0.0-beta.9
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- CLI packages &nbsp;-&nbsp; by **Michael K** in https://github.com/alchemy-run/alchemy-effect/issues/66 [<samp>(73e2a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/73e2a45)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.8...v2.0.0-beta.9)
+
+---
+
+## v2.0.0-beta.8
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Add stack export to package.json &nbsp;-&nbsp; by **John Royal** [<samp>(0ede2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0ede2c3)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.7...v2.0.0-beta.8)
+
+---
+
+## v2.0.0-beta.7
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**: Use consistent comaptibility date and flags in Worker &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(deda3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/deda381)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.6...v2.0.0-beta.7)
+
+---
+
+## v2.0.0-beta.6
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**: Set nodejs_compat by default for Effect Workers &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ff780)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ff780f3)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.5...v2.0.0-beta.6)
+
+---
+
+## v2.0.0-beta.5
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Running with bun no longer runs unbundled alchemy bin &nbsp;-&nbsp; by **Michael (Pear)** [<samp>(61198)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/61198ca)
+- **core**: Use Provider collection as requirements &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f81cc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f81cccb)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.4...v2.0.0-beta.5)
+
+---
+
+## v2.0.0-beta.4
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Pr-package service &nbsp;-&nbsp; by **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/54 [<samp>(6edd8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6edd8dd)
+- **cloudflare**:
+  - Async DurableObjetNamespace binding &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(25b90)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/25b9012)
+  - Async Assets binding &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f1a3c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f1a3c6f)
+  - Alarms and ScheduledEvents &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1f183)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1f183c0)
+  - Worker Custom Domains &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(670c5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/670c575)
+- **core**:
+  - AuthProvider &nbsp;-&nbsp; by **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/61 [<samp>(bac01)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bac01b7)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Rename cli binary from "alchemy-effect" to "alchemy" &nbsp;-&nbsp; by **John Royal** [<samp>(b8b3a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b8b3a8c)
+- Fix exports &nbsp;-&nbsp; by **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/62 [<samp>(903c2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/903c262)
+- **aws**: Fix VpcEndpoint resource bad state checks &nbsp;-&nbsp; by **Michael (Pear)** and **Marc MacLeod** in https://github.com/alchemy-run/alchemy-effect/issues/63 [<samp>(f1fd2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f1fd20b)
+- **core**: Use platform-bun when running in bun, otherwise platform-node &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3b0d6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3b0d6b0)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.3...v2.0.0-beta.4)
+
+---
+
+## v2.0.0-beta.test-export-fix-4
+
+_No significant changes_
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.test-export-fix-3...v2.0.0-beta.test-export-fix-4)
+
+---
+
+## v2.0.0-beta.test-export-fix-3
+
+_No significant changes_
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.test-export-fix-2...v2.0.0-beta.test-export-fix-3)
+
+---
+
+## v2.0.0-beta.test-export-fix-2
+
+_No significant changes_
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.test-export-fix...v2.0.0-beta.test-export-fix-2)
+
+---
+
+## v2.0.0-beta.test-export-fix
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Pr-package service &nbsp;-&nbsp; by **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/54 [<samp>(6edd8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6edd8dd)
+- **cloudflare**:
+  - Async DurableObjetNamespace binding &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(25b90)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/25b9012)
+  - Async Assets binding &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f1a3c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f1a3c6f)
+  - Alarms and ScheduledEvents &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1f183)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1f183c0)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Rename cli binary from "alchemy-effect" to "alchemy" &nbsp;-&nbsp; by **John Royal** [<samp>(b8b3a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b8b3a8c)
+- Fix export order &nbsp;-&nbsp; by **Michael (Pear)** [<samp>(7bea9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7bea945)
+- **core**: Use platform-bun when running in bun, otherwise platform-node &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3b0d6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3b0d6b0)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.3...v2.0.0-beta.test-export-fix)
+
+---
+
+## v2.0.0-beta.3
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **GitHub**:
+  - Comment Resource and CI guide &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(5e938)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5e93857)
+  - Secret and Variable &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(0f620)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0f620bd)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **core**: Fix undefined Provider in plan &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e0143)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e01431f)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.2...v2.0.0-beta.3)
+
+---
+
+## v2.0.0-beta.2
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- ProviderCollections reduce number of Provider types polluting user's types &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9f76b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9f76b91)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.1...v2.0.0-beta.2)
+
+---
+
+## v2.0.0-beta.1
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Migrate to effect@4.0.0-beta.48 &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8674e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8674e8f)
+- **cloudflare**: Support R2Bucket.bind instead of R2BucketBinding.bind for all CF resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(12b50)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/12b50d3)
+- **core**: Alchemy.Stack &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(68e66)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/68e6622)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Release to alchemy package &nbsp;-&nbsp; by **Michael (Pear)** in https://github.com/alchemy-run/alchemy-effect/issues/55 [<samp>(217c5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/217c5c9)
+- **cloudflare**:
+  - Require Content Length in R2.put and use raw ReadableStream if available &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1cd6b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1cd6bda)
+  - Bundle properly formats windows paths &nbsp;-&nbsp; by **Michael (Pear)** [<samp>(5156c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5156c6c)
+- **test**:
+  - Infer and resolve Output types in Test/Bun &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9853d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9853d92)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.11.0...v2.0.0-beta.1)
+
+---
+
+## v0.11.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **test**: Add skipIf to bun testing harness &nbsp;-&nbsp; by **Michael (Pear)** [<samp>(6021c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6021c3d)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **Http**: Lazy-import platform-node to avoid crash on Bun &nbsp;-&nbsp; by **Christopher Yovanovitch** and **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/48 [<samp>(85224)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/852243b)
+- **cloudflare**: Bindings resolve Effect<Resource> and remove KV per-operation bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(61e02)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/61e0244)
+- **core**: Migrate to Provider.effect so that providers are tree-shakable &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/53 [<samp>(73029)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7302911)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.10.0...v0.11.0)
+
+---
+
+## v0.10.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**:
+  - Accept Output<T> in Worker env + Vite props &nbsp;-&nbsp; by **cooper** in https://github.com/alchemy-run/alchemy-effect/issues/51 [<samp>(9560b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9560bed)
+  - Allow bindings to be undefined &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(15c8c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/15c8c6e)
+  - Rename DynamicWorker to DynamicWorkerLoader &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(39f89)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/39f89d5)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.9.1...v0.10.0)
+
+---
+
+## v0.9.1
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**: Environment variables silently dropped &nbsp;-&nbsp; by **cooper** in https://github.com/alchemy-run/alchemy-effect/issues/49 [<samp>(847f0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/847f0c2)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.9.0...v0.9.1)
+
+---
+
+## v0.9.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **core**: Bun test helpers &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(40af3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/40af3f4)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**:
+  - Delay WorkerEnvironment resolution for R2Bucket binding until inside Worker &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b41b1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b41b1c3)
+  - Precreate Worker with tags and resolve DO namespace IDs as Worker output attributes &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c6b2a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c6b2add)
+  - Retry eventually consistent ContainerApplicationNotFound error &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(90d75)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/90d7524)
+  - Resolve Durable Object namespace IDs in precreate &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(cd1e2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cd1e25d)
+  - Use Sonda to generate bundle report &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(a7a9c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a7a9c5f)
+  - Recover from partial ContainerApplication failure &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(04890)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/04890d3)
+- **core**:
+  - Use a Deferred to support parallel caching &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ca693)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ca693b5)
+  - Exclude Artifacts from provider requirements &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(a0aec)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a0aec34)
+  - Resolve Effects in Binding.Sevice.bind &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b82f2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b82f262)
+- **test**:
+  - Return output of deploying stack in a test &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6d354)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6d354a1)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.8.0...v0.9.0)
+
+---
+
+## v0.8.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**: Async-alchemy style bindings and R2 wrapper &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4c4ca)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4c4ca91)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.7.1...v0.8.0)
+
+---
+
+## v0.7.1
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **core**: Support deploy --force &nbsp;-&nbsp; by **sam** in https://github.com/alchemy-run/alchemy-effect/issues/43 [<samp>(06b88)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/06b881a)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.7.0...v0.7.1)
+
+---
+
+## v0.7.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **cloudflare**:
+  - Vite integration &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/41 [<samp>(e3c16)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e3c160c)
+- **core**:
+  - Add Output.as<T>() &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(33186)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/33186ef)
+  - Artifact service for caching build artifacts across plan and apply &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(dc60e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/dc60e9e)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.6.4...v0.7.0)
+
+---
+
+## v0.6.4
+
+_No significant changes_
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.6.3...v0.6.4)
+
+---
+
+## v0.6.3
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **better-auth**:
+  - Add @alchemy.run/better-auth packag with D1 support &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9dc0f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9dc0ff6)
+- **cloudflare**:
+  - D1Database resource &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(48fd4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/48fd499)
+  - Expose raw Cloudflare.Request as a Tag &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(67998)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/67998cd)
+- **core**:
+  - Random resource &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(71527)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/715278e)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Replace Schedule.compose with Schedule.both &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(46195)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/461951d)
+- **cli**:
+  - Simplify logs query to latest hour &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b4a47)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b4a4733)
+  - Used TaggedError in Daemon &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(77a78)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/77a788a)
+- **cloudflare**:
+  - Export D1 resources and bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d9e94)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d9e9447)
+  - Export D1 resources and bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(bcd43)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bcd436d)
+- **core**:
+  - Support updating downstream to unlink and delete a binding &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6bdf8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6bdf8e9)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.6.2...v0.6.3)
+
+---
+
+## v0.6.2
+
+_No significant changes_
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.6.1...v0.6.2)
+
+---
+
+## v0.6.1
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Move to distilled-aws &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e12f2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e12f2a6)
+- Add S3 data plane APIs &nbsp;-&nbsp; by **Sam Goodwin** and **Claude Haiku 4.5** in https://github.com/alchemy-run/alchemy-effect/issues/34 [<samp>(f2986)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f2986ab)
+- Bootstrap CLI command &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3a79a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3a79a04)
+- Lambda.consumeTable &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(420c1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/420c124)
+- Remove ExecutionContext from Policy requirements &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(867ef)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/867ef28)
+- Implement HttpServer for Lambda and Cloudflare &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(655df)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/655dfd1)
+- Namespaces &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(46050)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4605092)
+- Implement Host, Self and make Lambda entrypoint &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1d9a2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1d9a218)
+- Generalize bundler and end to end deployment working &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(65353)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/65353fc)
+- Namespace tree for organizing Resources and Bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3b937)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3b93785)
+- Default AWS StageConfig &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(45152)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4515245)
+- Bind Outputs to environment variables &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9ff75)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9ff7587)
+- End-to-end bundling, bindings and IAM policies &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d2fef)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d2fef7a)
+- Migrate to @distilled.cloud (v2) &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(75151)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/75151e7)
+- Support external platforms &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(7ed9f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7ed9ffb)
+- **aws**:
+  - DynamoDB Bindings and an AI process for implementing an aws service &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(cdfd4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cdfd45b)
+  - DynamoDB Table Stream &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ec61a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ec61a6d)
+  - SNS Topic, Subscription, TopicSink and EventSource &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4d3af)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4d3af74)
+  - Cloudwatch Resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(30544)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3054413)
+  - Add logs and tail for Lambda Functions &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8403c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8403cda)
+- **aws, dynamodb**:
+  - Add Batch and Transact Operations &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(73a01)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/73a0134)
+- **aws, eventbridge**:
+  - EventBrdige Resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4809c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4809c8e)
+- **aws,acm**:
+  - Certificate &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c082f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c082f83)
+- **aws,autoscaling**:
+  - AutoScalingGroup, LaunchTemplate, ScalingPolicy &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d7878)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d787847)
+- **aws,cloudfront**:
+  - Distribution, Function, Invalidation, KeyValueStore, OriginAccessControl &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(2d2e5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2d2e528)
+- **aws,ec2**:
+  - EC2 Network and Instance &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8e686)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8e686d7)
+  - Share Hsot logic across EC2 Instance and LaunchTemplate &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(691e2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/691e20b)
+- **aws,ecr**:
+  - Repository Resource &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(0af1e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0af1ec1)
+- **aws,ecs**:
+  - ECS Cluster, Task and Service Resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(11c74)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/11c7438)
+- **aws,eks**:
+  - AWS Auto EKS Cluster resoruces &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9b4f9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9b4f96f)
+- **aws,elbv2**:
+  - Listener, LoadBalancer, TargetGroup &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8486e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8486e65)
+  - Support TCP protocol in Listener, LoadBalancer &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b5128)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b5128d7)
+- **aws,http**:
+  - Handle unrecoverable Http errors, fix GetObject IAM policy &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(39e5c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/39e5c6c)
+- **aws,iam**:
+  - AWS IAM Resources, Operations and Tests &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8638a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8638abe)
+- **aws,iamidentitycenter**:
+  - AccountAssignment, Group, Instance, PermissionSet &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3f864)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3f86467)
+- **aws,kinesiss**:
+  - Operations for Kinesis Streams, including EventSource and Sinks &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8b40c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8b40c72)
+- **aws,lambda**:
+  - EventBridge and Stream Event Sources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(311a0)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/311a04b)
+- **aws,logs**:
+  - LogGroup Resource &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ff7e2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ff7e2de)
+- **aws,organizations**:
+  - Account, DelegatedAdministrator, Organization, OrganizationalUnit, OrganizationResourcePolicy, Policy, PolicyAttachment, Root, RootPolicyType, TrustedServiceAccess &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ed86a)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ed86a76)
+  - TenantRoot &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b6f7b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b6f7b21)
+- **aws,pipes**:
+  - Pipe resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(38af3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/38af3e0)
+- **aws,rds**:
+  - DB\* Resources, Aurora, Connect and RDSData &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9742b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9742b8c)
+- **aws,route53**:
+  - Record &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(71d88)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/71d88cd)
+- **aws,scheduler**:
+  - Schedule, ScheduleGroup resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3be73)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3be73bd)
+- **aws,secretsmanager**:
+  - Secret Resource and Bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(a8a39)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a8a39bd)
+- **aws,sqs**:
+  - Allow DeleteMessageBatch, ReceiveMessage and SendMessage on EC2 &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(bddb4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/bddb4bb)
+- **aws,website**:
+  - SsrSite, StaticSite, Router &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d4f14)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d4f14c3)
+  - Bring StaticSite up to par with SST &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6aaac)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6aaace9)
+- **build**:
+  - Docker commands &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d12cf)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d12cf9f)
+- **cli**:
+  - Tail and logs &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(b0a06)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/b0a061e)
+  - Filter logs and tail by resource ID &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(a6514)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a6514c7)
+  - Process Manager daemon &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c0fd1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c0fd148)
+- **cloudflare**:
+  - Durable Objects and Worker entrypoint/exports &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(aa6d3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aa6d3a0)
+  - Durable Objects and Containers &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/37 [<samp>(ccade)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ccade21)
+  - DynamicWorker &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8c5d2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8c5d205)
+  - Workflows &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(874cc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/874cc9a)
+- **core**:
+  - Handle circular binding cycles &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6d843)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6d843c4)
+  - Construct.fn and two-phase apply &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(7c8bd)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7c8bd2b)
+  - Enhance convrergence of circularity in alchemy &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(fbfbf)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fbfbf2a)
+  - Allow replace on top of a partially replaced resurce &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(3c630)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3c63096)
+- **k8s**:
+  - Kubernetes Manifest, Service, ServiceAccount, etc. &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8d2d1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8d2d133)
+- **kinesis**:
+  - Add AWS Kinesis Stream resource and capabilities &nbsp;-&nbsp; by **Sam Goodwin** and **Claude Haiku 4.5** in https://github.com/alchemy-run/alchemy-effect/issues/30 [<samp>(3f30b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/3f30b79)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Improve deletion of ec2 resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c5bf6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c5bf62f)
+- Stack.make to capture providers and re-implement binding diffs in Plan &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(94e40)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/94e401c)
+- Use error.\_tag instead of error.name &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(87cbf)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/87cbfa3)
+- Handle undefined props &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(63f08)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/63f0869)
+- Write bundle temp files to .alchemy/tmp &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(0b491)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0b49156)
+- Write temporary bundle file inside .alchemy within the correct module &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6d678)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6d678c8)
+- Resource Service inherits call-site Context &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(07511)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0751195)
+- **aws**:
+  - Provide stack, stage and phase at runtime &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(befb4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/befb4ff)
+  - Add missing Provider and Binding layers &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f41c1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f41c13b)
+  - Add missing Providers &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(82f51)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/82f51ef)
+  - Bootstrap command creates and tags the bucket &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(5a36f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5a36fab)
+  - EC2 and LaunchTemplate host now provide ExecutionContext.Server &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e2f01)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e2f0100)
+  - Avoid redundant updates when source map changes &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(48fe5)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/48fe5cd)
+- **aws,cloudflare**:
+  - Fix AnomalyDetector and bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(2d47e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2d47e71)
+- **aws,sns**:
+  - ReadSubscription returns undefined if topicArn is unknown &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4e25c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4e25c3d)
+- **aws,website**:
+  - Include stack, stage and FQN in kv namespace &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(e971c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/e971ca7)
+  - End-to-end deployment of StaticSite &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1dea3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1dea3ec)
+- **cli**:
+  - Support running in node and load .env with ConfigProvider &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9b15b)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9b15b39)
+  - Support node and bun for globs &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(2bcb6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2bcb6d0)
+  - Respect caller's node runtime &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6396c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6396cd6)
+- **cloudflare**:
+  - Migrate to distilled-cloudflare and rolldown &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(a4184)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a4184ec)
+  - Distilled 0.4.0 pagination apis &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(4bffe)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/4bffe41)
+  - Hard-code all exported handler methods instead of Proxy &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(289b9)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/289b92f)
+  - Detect changes to Container and Bundle &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(924ff)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/924ffb5)
+  - Pass assetsConfig in TanstackStart and StaticSite &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(42832)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/428329f)
+  - Get HTTP server plumbing working for containers &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(cf058)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cf05888)
+- **cloudflare,assets**:
+  - Pass jwtToken to createAssetUpload &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(26228)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/262289d)
+- **core**:
+  - Accept Input<T> in Host props &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(09edc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/09edccf)
+  - Add asEffect to Output &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(5ec8d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/5ec8d27)
+- **ec2**:
+  - Query attachments when deleting IGW &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ced7f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ced7f85)
+- **process**:
+  - Export Process module &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1600d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1600d3c)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.6.0...v0.6.1)
+
+---
+
+## v0.6.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **ec2**: NAT Gateway, EIP, Egress IGW, SecurityGroups &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/24 [<samp>(ff04d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ff04d57)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.5.0...v0.6.0)
+
+---
+
+## v0.5.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Standardize physical name generation &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(91199)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9119967)
+- **cloudflare**:
+  - Rename worker.id and name workerId and workerName &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(273cb)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/273cb26)
+  - Rename Bucket.name to Bucket.bucketName and constraint name length &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(a0733)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/a0733a6)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.4.0...v0.5.0)
+
+---
+
+## v0.4.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **ec2**: Add IGW, Route, Route Table, Route Table Assoication &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/23 [<samp>(0eeb6)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0eeb613)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.3.0...v0.4.0)
+
+---
+
+## v0.3.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- **core**:
+  - Inputs and Outputs &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/19 [<samp>(fa8b8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fa8b893)
+  - DefineStack, defineStages and alchemy CLI &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/21 [<samp>(d30da)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d30da72)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- **cloudflare**: Make props optional in KV Namespace and R2 Bucket &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(dbfbe)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/dbfbe40)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.2.0...v0.3.0)
+
+---
+
+## v0.2.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Diff bindings + Queue Event Source &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/12 [<samp>(f0ba8)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f0ba897)
+- **aws**:
+  - DynamoDB Table and getItem &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/10 [<samp>(877ba)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/877ba8f)
+  - VPC &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/16 [<samp>(cda86)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/cda86ce)
+- **cloudflare**:
+  - Worker, Assets, R2, KV &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/13 [<samp>(6e5b1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6e5b107)
+- **test**:
+  - Add test utility &nbsp;-&nbsp; by **Sam Goodwin** in https://github.com/alchemy-run/alchemy-effect/issues/15 [<samp>(7a9e1)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/7a9e10f)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Properly type the Resource Provider Layers and use Layer.merge &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(77d69)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/77d69be)
+- **core**: Exclude bindings from props diff and include attributes in no-op bind &nbsp;-&nbsp; by **John Royal** in https://github.com/alchemy-run/alchemy-effect/issues/17 [<samp>(6408d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6408d2b)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v0.1.0...v0.2.0)
+
+---
+
+## v0.1.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Adopt currying pattern across codebase to deal with NoInfer and Extract limitations &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9a319)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9a3193c)
+- Remove HKTs from capability and resource &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(88a59)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/88a594a)
+- Use triples in Policy to support overriden tags for bindings &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9e8fc)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9e8fc77)
+- Introduce BindingTag to map Binding -> BindingService &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c59b7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c59b76c)
+- Capture Capability ID in Binding declaration &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(742c2)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/742c205)
+- Standardize .provider builder pattern and add 'binding' integration contract type to Runtime &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6afdd)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6afdd33)
+- Include Phase in the Plan and properly type the output of Apply &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1eade)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1eade78)
+- Add provider: { effect, succeed } to Resources &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c4233)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c42336f)
+- Thread BindNode through state and fix the planner &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(c1bb3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/c1bb313)
+- Apply bindings in the generic apply functions instead of each provider &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(f0f34)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/f0f348a)
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Bind types &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(d11c7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/d11c774)
+- Update Instance<T> to handle the resource types like Queue &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(6adca)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/6adca3c)
+- Re-work simpler types for plan and apply &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(1d08d)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/1d08d19)
+- Instance<Queue> maps to Queue instead of Resource<..> &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(aa18f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aa18f3a)
+- Pass-through of the Props and Bindings to the Service type &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(9784e)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/9784eca)
+- Remove Resource from Binding tag construction and implement layer builders &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(ada7c)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/ada7cba)
+- Plumb through new Plan structure to apply and CLI &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8c057)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8c0570b)
+- Missing props in Capability, Bindingm, Resource and Service &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(aaec3)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/aaec377)
+- Include bindings in the plan, fix papercuts, remove node:util usage &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(0a5f4)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/0a5f4d3)
+- Log message when SSO token has expired &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(8a7a7)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/8a7a72f)
+- Infer return type of Resource.provider.effect &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(2093f)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2093f17)
+- Serialize classes properly and rename packages &nbsp;-&nbsp; by **Sam Goodwin** [<samp>(2bf72)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/2bf7290)
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/c46b447ca0d46a9e4dbf08a6789770a420d90be5...v0.1.0)
+
+---
diff --git a/.repos/alchemy-effect/CLAUDE.md b/.repos/alchemy-effect/CLAUDE.md
new file mode 100644
index 00000000000..43c994c2d36
--- /dev/null
+++ b/.repos/alchemy-effect/CLAUDE.md
@@ -0,0 +1 @@
+@AGENTS.md
diff --git a/.repos/alchemy-effect/README.md b/.repos/alchemy-effect/README.md
new file mode 100644
index 00000000000..8168723fc5f
--- /dev/null
+++ b/.repos/alchemy-effect/README.md
@@ -0,0 +1,85 @@
+<div align="center">
+
+<a href="https://v2.alchemy.run">
+  <img src="./images/readme-hero.png" alt="Alchemy — Infrastructure as Effects" width="360" />
+</a>
+
+<br />
+
+[![npm](https://img.shields.io/npm/v/alchemy?style=flat-square&color=3f5a2a&label=alchemy)](https://www.npmjs.com/package/alchemy)
+[![license](https://img.shields.io/badge/license-Apache%202.0-3f5a2a?style=flat-square)](./LICENSE)
+[![discord](https://img.shields.io/badge/discord-join-3f5a2a?style=flat-square&logo=discord&logoColor=white)](https://discord.gg/jwKw8dBJdN)
+
+**Infrastructure-as-Effects** — cloud infrastructure and application logic as a single, type-safe [Effect](https://effect.website) program.
+
+[Docs](https://v2.alchemy.run) · [Tutorial](https://v2.alchemy.run/tutorial/part-1) · [Examples](./examples) · [Discord](https://discord.gg/jwKw8dBJdN)
+
+</div>
+
+---
+
+A Worker bound to a R2 bucket and serving objects from it:
+
+```typescript
+const Bucket = Cloudflare.R2Bucket("bucket");
+
+export default Cloudflare.Worker(
+  "api",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const object = yield* bucket.get(request.url);
+        return HttpServerResponse.stream(object!.body);
+      })
+    };
+  }),
+);
+```
+
+One `bind()` wires the binding, env var, and typed connection — at deploy time and at runtime.
+
+---
+
+- **One program, one language.** Resources, Lambdas/Workers, IAM, and SDKs live in the same Effect program — no YAML, no second runtime.
+- **Bindings, not glue code.** `S3.GetObject.bind(bucket)` wires the IAM policy, env var, and a typed SDK call in a single line.
+- **Errors in the type system.** Every cloud API failure is a tagged Effect error you handle — or don't — on purpose.
+- **AWS + Cloudflare today.** S3, SQS, DynamoDB, Kinesis, Lambda, EC2 / Workers, R2, D1, Durable Objects, Containers.
+- **Same code, every stage.** Local dev, `plan` / `deploy`, smoke tests, and CI all share one mental model.
+
+```sh
+bun add alchemy effect
+```
+
+## Bootstrap with an AI coding agent
+
+Paste this into Claude Code, Cursor, or any agent that can fetch a URL:
+
+```
+You are an Alchemy expert. Read https://v2.alchemy.run/llms.txt to load the
+full documentation index, then act as my pair on this project.
+
+Goal: help me set up, build, test, and deploy a cloud application with
+`alchemy` (Infrastructure-as-Effects, powered by Effect).
+
+Follow the patterns from the docs and the /examples folder. Stay idiomatic
+to Effect: use Layers for wiring, return Effects from lifecycle code, and
+keep infra and runtime in the same program. Ask before introducing new
+dependencies or breaking conventions.
+```
+
+## Learn more
+
+- [What is Alchemy?](https://v2.alchemy.run/what-is-alchemy) — the framework in 2 minutes
+- [Getting Started](https://v2.alchemy.run/getting-started) — your first Stack
+- [Tutorial](https://v2.alchemy.run/tutorial/part-1) — five-part walkthrough to a tested, CI-deployed app
+- [Examples](./examples) — runnable projects on AWS and Cloudflare
+- [llms.txt](https://v2.alchemy.run/llms.txt) — agent-ready documentation index
+
+> **alchemy** is in alpha. Expect breaking changes. Come hang in our [Discord](https://discord.gg/jwKw8dBJdN).
+
+## License
+
+Apache-2.0
diff --git a/.repos/alchemy-effect/bun.lock b/.repos/alchemy-effect/bun.lock
new file mode 100644
index 00000000000..4f05e793e75
--- /dev/null
+++ b/.repos/alchemy-effect/bun.lock
@@ -0,0 +1,5316 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "alchemy-monorepo",
+      "devDependencies": {
+        "@alchemy.run/pr-package": "workspace:*",
+        "@ark/attest": "^0.56.0",
+        "@cloudflare/puppeteer": "^1.1.0",
+        "@distilled.cloud/cloudflare": "catalog:",
+        "@effect/language-service": "^0.77.0",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@types/bun": "latest",
+        "@types/node": "latest",
+        "@typescript/native-preview": "^7.0.0-dev.20260317.1",
+        "@vitest/ui": "^4.1.0",
+        "alchemy": "workspace:*",
+        "bun-types": "^1.3.8",
+        "changelogithub": "^13.16.1",
+        "dotenv": "^17.2.3",
+        "effect": "catalog:",
+        "husky": "^9.1.7",
+        "oxfmt": "latest",
+        "oxlint": "latest",
+        "pkg-pr-new": "^0.0.62",
+        "ts-morph": "^27.0.2",
+        "typescript": "latest",
+        "vite-tsconfig-paths": "^6.1.1",
+        "vitest": "^4.0.18",
+        "yaml": "^2.8.2",
+      },
+    },
+    "examples/aws-ec2": {
+      "name": "aws-ec2-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-ecs": {
+      "name": "aws-ecs-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-eks": {
+      "name": "aws-eks-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-lambda": {
+      "name": "aws-lambda",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-lambda-httpapi": {
+      "name": "aws-lambda-httpapi",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-lambda-rpc": {
+      "name": "aws-lambda-rpc",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-rds": {
+      "name": "aws-rds-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@types/pg": "^8.18.0",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "pg": "^8.20.0",
+      },
+    },
+    "examples/aws-rest-api": {
+      "name": "aws-rest-api",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-static-site": {
+      "name": "aws-static-site-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/aws-vite": {
+      "name": "aws-vite-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/vite-plugin": "catalog:",
+        "@distilled.cloud/aws": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+      "devDependencies": {
+        "typescript": "catalog:",
+        "vite": "catalog:",
+      },
+    },
+    "examples/cloudflare-dev": {
+      "name": "cloudflare-dev",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/cloudflare-email": {
+      "name": "cloudflare-email",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/cloudflare-git-artifacts": {
+      "name": "cloudflare-git-artifacts",
+      "version": "0.0.0",
+      "dependencies": {
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/cloudflare-neon-drizzle": {
+      "name": "cloudflare-neon-drizzle",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@effect/sql-pg": "catalog:",
+        "alchemy": "workspace:*",
+        "drizzle-orm": "1.0.0-rc.1",
+        "effect": "catalog:",
+        "pg": "^8.13.0",
+      },
+      "devDependencies": {
+        "@types/pg": "^8.11.0",
+        "drizzle-kit": "1.0.0-rc.1",
+      },
+    },
+    "examples/cloudflare-planetscale-mysql-drizzle": {
+      "name": "cloudflare-planetscale-mysql-drizzle",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "drizzle-orm": "1.0.0-rc.1",
+        "effect": "catalog:",
+        "mysql2": "^3.15.3",
+      },
+      "devDependencies": {
+        "drizzle-kit": "1.0.0-rc.1",
+      },
+    },
+    "examples/cloudflare-planetscale-postgres-drizzle": {
+      "name": "cloudflare-planetscale-postgres-drizzle",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@effect/sql-pg": "catalog:",
+        "alchemy": "workspace:*",
+        "drizzle-orm": "1.0.0-rc.1",
+        "effect": "catalog:",
+        "pg": "^8.13.0",
+      },
+      "devDependencies": {
+        "@types/pg": "^8.11.0",
+        "drizzle-kit": "1.0.0-rc.1",
+      },
+    },
+    "examples/cloudflare-secrets-store": {
+      "name": "cloudflare-secrets-store",
+      "version": "0.0.0",
+      "dependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/cloudflare-solidjs-ssr": {
+      "name": "cloudflare-solid-ssr",
+      "version": "0.0.0",
+      "dependencies": {
+        "@solidjs/router": "^0.15.1",
+        "solid-js": "^1.9.5",
+      },
+      "devDependencies": {
+        "@tailwindcss/postcss": "^4.1.13",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "postcss": "^8.4.49",
+        "solid-devtools": "^0.34.3",
+        "tailwindcss": "^4.1.13",
+        "vite": "^7.1.4",
+        "vite-plugin-solid": "^2.11.8",
+      },
+    },
+    "examples/cloudflare-solidstart": {
+      "name": "example-basic",
+      "dependencies": {
+        "@solidjs/meta": "^0.29.4",
+        "@solidjs/router": "^0.15.0",
+        "@solidjs/start": "2.0.0-alpha.2",
+        "@solidjs/vite-plugin-nitro-2": "^0.1.0",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "solid-js": "^1.9.5",
+        "vite": "^7.0.0",
+      },
+    },
+    "examples/cloudflare-static-site": {
+      "name": "cloudflare-vite-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@distilled.cloud/cloudflare": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+      "devDependencies": {
+        "typescript": "catalog:",
+        "vite": "catalog:",
+      },
+    },
+    "examples/cloudflare-tanstack": {
+      "name": "cloudflare-tanstack-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@tanstack/react-router": "^1.167.4",
+        "@tanstack/react-start": "^1.166.15",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "react": "^19.2.4",
+        "react-dom": "^19.2.4",
+      },
+      "devDependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@types/react": "^19.2.14",
+        "@types/react-dom": "^19.2.3",
+        "@vitejs/plugin-react": "^6.0.1",
+        "typescript": "^5.9.3",
+        "vite": "catalog:",
+      },
+    },
+    "examples/cloudflare-tanstack-start-solid": {
+      "name": "cloudflare-tanstack-start-solid-example",
+      "version": "0.0.0",
+      "dependencies": {
+        "@tanstack/solid-router": "^1.170.4",
+        "@tanstack/solid-start": "^1.168.6",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "solid-js": "^1.9.12",
+      },
+      "devDependencies": {
+        "@cloudflare/workers-types": "catalog:",
+        "@types/bun": "latest",
+        "typescript": "catalog:",
+        "vite": "catalog:",
+        "vite-plugin-solid": "^2.11.12",
+      },
+    },
+    "examples/cloudflare-vue": {
+      "name": "cloudflare-vue",
+      "version": "0.0.0",
+      "dependencies": {
+        "vue": "beta",
+        "vue-router": "^5.0.4",
+      },
+      "devDependencies": {
+        "@tsconfig/node24": "^24.0.4",
+        "@types/node": "^24.12.0",
+        "@vitejs/plugin-vue": "^6.0.5",
+        "@vue/tsconfig": "^0.9.1",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "npm-run-all2": "^8.0.4",
+        "oxfmt": "^0.42.0",
+        "typescript": "~6.0.0",
+        "vite": "^8.0.3",
+        "vite-plugin-vue-devtools": "^8.1.1",
+        "vue-tsc": "^3.2.6",
+      },
+    },
+    "examples/cloudflare-worker": {
+      "name": "cloudflare-worker",
+      "version": "0.0.0",
+      "dependencies": {
+        "@alchemy.run/better-auth": "workspace:*",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "better-auth": "catalog:",
+        "effect": "catalog:",
+      },
+    },
+    "examples/cloudflare-worker-async": {
+      "name": "cloudflare-worker-async",
+      "version": "0.0.0",
+      "dependencies": {
+        "@alchemy.run/better-auth": "workspace:*",
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "better-auth": "catalog:",
+        "effect": "catalog:",
+      },
+    },
+    "examples/monorepo-multi-stack/backend": {
+      "name": "@monorepo-multi-stack/backend",
+      "version": "0.0.0",
+      "dependencies": {
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/monorepo-multi-stack/frontend": {
+      "name": "@monorepo-multi-stack/frontend",
+      "version": "0.0.0",
+      "dependencies": {
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@monorepo-multi-stack/backend": "workspace:*",
+        "@types/react": "^19.2.14",
+        "@types/react-dom": "^19.2.3",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "react": "^19.2.6",
+        "react-dom": "^19.2.6",
+        "vite": "catalog:",
+      },
+    },
+    "examples/monorepo-single-stack/backend": {
+      "name": "@monorepo-single-stack/backend",
+      "version": "0.0.0",
+      "dependencies": {
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "examples/monorepo-single-stack/frontend": {
+      "name": "@monorepo-single-stack/frontend",
+      "version": "0.0.0",
+      "dependencies": {
+        "@monorepo-single-stack/backend": "workspace:*",
+        "@types/react": "^19.2.14",
+        "@types/react-dom": "^19.2.3",
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+        "react": "^19.2.6",
+        "react-dom": "^19.2.6",
+        "vite": "catalog:",
+      },
+    },
+    "packages/alchemy": {
+      "name": "alchemy",
+      "version": "2.0.0-beta.48",
+      "bin": {
+        "alchemy": "./bin/cli.js",
+      },
+      "dependencies": {
+        "@alchemy.run/node-utils": "catalog:",
+        "@aws-sdk/credential-providers": "catalog:",
+        "@clack/prompts": "^0.11.0",
+        "@distilled.cloud/aws": "catalog:",
+        "@distilled.cloud/axiom": "catalog:",
+        "@distilled.cloud/cloudflare": "catalog:",
+        "@distilled.cloud/cloudflare-rolldown-plugin": "catalog:",
+        "@distilled.cloud/cloudflare-runtime": "catalog:",
+        "@distilled.cloud/cloudflare-vite-plugin": "catalog:",
+        "@distilled.cloud/core": "catalog:",
+        "@distilled.cloud/neon": "catalog:",
+        "@distilled.cloud/planetscale": "catalog:",
+        "@effect/vitest": "catalog:",
+        "@libsql/client": "catalog:",
+        "@octokit/rest": "^22.0.1",
+        "@smithy/node-config-provider": "catalog:",
+        "@smithy/shared-ini-file-loader": "catalog:",
+        "@smithy/types": "catalog:",
+        "@types/aws-lambda": "catalog:",
+        "aws4fetch": "catalog:",
+        "capnweb": "^0.6.1",
+        "fast-glob": "^3.3.2",
+        "fast-xml-parser": "catalog:",
+        "ink": "^6.3.1",
+        "jszip": "^3.10.1",
+        "libsodium-wrappers": "^0.8.3",
+        "magic-string": "^0.30.21",
+        "mysql2": "^3.15.3",
+        "pathe": "^2.0.3",
+        "pg": "^8.13.0",
+        "picomatch": "^4.0.4",
+        "react": "^19.2.0",
+        "rolldown": "catalog:",
+        "undici": "^7.16.0",
+        "yaml": "catalog:",
+      },
+      "devDependencies": {
+        "@clack/prompts": "^0.11.0",
+        "@cloudflare/puppeteer": "^1.1.0",
+        "@cloudflare/workers-types": "catalog:",
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@effect/platform-node-shared": "catalog:",
+        "@oxc-project/types": "^0.127.0",
+        "@types/aws-lambda": "catalog:",
+        "@types/bun": "catalog:",
+        "@types/node": "catalog:",
+        "@types/pg": "^8.11.0",
+        "@types/picomatch": "^4.0.0",
+        "@types/react": "^19.2.2",
+        "@types/ws": "^8.18.1",
+        "better-auth": "catalog:",
+        "effect": "catalog:",
+        "react-devtools-core": "^7.0.1",
+        "solid-js": "catalog:",
+        "tsconfig-paths": "^4.2.0",
+        "tsdown": "^0.15.4",
+        "tsx": "^4.20.6",
+        "typescript": "catalog:",
+        "ws": "catalog:",
+      },
+      "peerDependencies": {
+        "@effect/platform-bun": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "@effect/sql-pg": "catalog:",
+        "drizzle-kit": "catalog:",
+        "drizzle-orm": "catalog:",
+        "effect": "catalog:",
+        "vite": "catalog:",
+        "ws": "catalog:",
+      },
+      "optionalPeers": [
+        "@effect/platform-bun",
+        "@effect/platform-node",
+        "@effect/sql-pg",
+        "drizzle-kit",
+        "drizzle-orm",
+        "vite",
+        "ws",
+      ],
+    },
+    "packages/better-auth": {
+      "name": "@alchemy.run/better-auth",
+      "version": "2.0.0-beta.48",
+      "dependencies": {
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+      "peerDependencies": {
+        "better-auth": "catalog:",
+      },
+    },
+    "packages/pr-package": {
+      "name": "@alchemy.run/pr-package",
+      "version": "2.0.0-beta.48",
+      "dependencies": {
+        "alchemy": "workspace:*",
+        "effect": "catalog:",
+      },
+    },
+    "website": {
+      "name": "website",
+      "version": "0.0.0",
+      "dependencies": {
+        "@astrojs/check": "^0.9.4",
+        "@astrojs/mdx": "^5.0.3",
+        "@astrojs/react": "^5.0.3",
+        "@astrojs/sitemap": "^3.5.0",
+        "@astrojs/starlight": "^0.34.3",
+        "@astrojs/starlight-tailwind": "^4.0.1",
+        "@effect/platform-node": "catalog:",
+        "@iconify-json/logos": "^1.2.11",
+        "@iconify-json/lucide": "^1.2.102",
+        "@iconify/react": "^6.0.2",
+        "@resvg/resvg-js": "^2.6.2",
+        "@tailwindcss/vite": "^4.1.14",
+        "@types/react": "^19.2.14",
+        "@types/react-dom": "^19.2.3",
+        "alchemy": "workspace:*",
+        "astro": "^5.12.8",
+        "effect": "catalog:",
+        "expressive-code-twoslash": "^0.6.1",
+        "react": "^19.2.5",
+        "react-dom": "^19.2.5",
+        "react-icons": "^5.6.0",
+        "rehype-mermaid": "^3.0.0",
+        "satori": "^0.26.0",
+        "starlight-blog": "0.24.0",
+        "tailwindcss": "^4.1.14",
+      },
+      "devDependencies": {
+        "astro-broken-links-checker": "^1.1.0",
+        "typescript": "catalog:",
+        "zod": "^3",
+      },
+    },
+  },
+  "catalog": {
+    "@alchemy.run/node-utils": "0.0.4",
+    "@aws-sdk/credential-providers": "^3.0.0",
+    "@cloudflare/containers": "^0.1.1",
+    "@cloudflare/vite-plugin": "^1.13.12",
+    "@cloudflare/workers-types": "^4.20250805.0",
+    "@distilled.cloud/aws": "^0.22.4",
+    "@distilled.cloud/axiom": "^0.22.4",
+    "@distilled.cloud/cloudflare": "^0.22.4",
+    "@distilled.cloud/cloudflare-rolldown-plugin": "0.10.1",
+    "@distilled.cloud/cloudflare-runtime": "0.10.1",
+    "@distilled.cloud/cloudflare-vite-plugin": "0.10.1",
+    "@distilled.cloud/core": "^0.22.4",
+    "@distilled.cloud/neon": "^0.22.4",
+    "@distilled.cloud/planetscale": "^0.22.4",
+    "@effect/language-service": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/platform-bun": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/platform-node": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/platform-node-shared": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/sql-pg": ">=4.0.0-beta.74 || >=4.0.0",
+    "@effect/vitest": ">=4.0.0-beta.74 || >=4.0.0",
+    "@libsql/client": "^0.17.0",
+    "@opentui/core": "latest",
+    "@opentui/solid": "latest",
+    "@smithy/node-config-provider": "^4.0.0",
+    "@smithy/shared-ini-file-loader": "^4.3.4",
+    "@smithy/types": "^4.8.1",
+    "@types/aws-lambda": "^8.10.152",
+    "@types/bun": "latest",
+    "@types/node": "latest",
+    "@typescript/native-preview": "latest",
+    "ai": "^6.0.62",
+    "aws4fetch": "^1.0.20",
+    "better-auth": "^1.6.2",
+    "drizzle-kit": ">=1.0.0-rc.1",
+    "drizzle-orm": ">=1.0.0-rc.1",
+    "effect": ">=4.0.0-beta.74 || >=4.0.0",
+    "fast-xml-parser": "^5.3.4",
+    "rolldown": "1.0.1",
+    "solid-js": "latest",
+    "sonda": "^0.11.1",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.7",
+    "web-tree-sitter": "0.25.10",
+    "ws": "^8.20.0",
+    "yaml": "^2.0.0",
+  },
+  "packages": {
+    "@actions/core": ["@actions/core@1.11.1", "", { "dependencies": { "@actions/exec": "^1.1.1", "@actions/http-client": "^2.0.1" } }, "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A=="],
+
+    "@actions/exec": ["@actions/exec@1.1.1", "", { "dependencies": { "@actions/io": "^1.0.1" } }, "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w=="],
+
+    "@actions/http-client": ["@actions/http-client@2.2.3", "", { "dependencies": { "tunnel": "^0.0.6", "undici": "^5.25.4" } }, "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA=="],
+
+    "@actions/io": ["@actions/io@1.1.3", "", {}, "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="],
+
+    "@alcalzone/ansi-tokenize": ["@alcalzone/ansi-tokenize@0.2.5", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-3NX/MpTdroi0aKz134A6RC2Gb2iXVECN4QaAXnvCIxxIm3C3AVB1mkUe8NaaiyvOpDfsrqWhYtj+Q6a62RrTsw=="],
+
+    "@alchemy.run/better-auth": ["@alchemy.run/better-auth@workspace:packages/better-auth"],
+
+    "@alchemy.run/node-utils": ["@alchemy.run/node-utils@0.0.4", "", {}, "sha512-TiIhPXCTCi3tk0zmdYJJ14CNSesSfsJxXdIOP0HTSItQ1mZWLocrF7qCuEWKyW/IEFzp6kaiOf19aIA/mbCp1g=="],
+
+    "@alchemy.run/pr-package": ["@alchemy.run/pr-package@workspace:packages/pr-package"],
+
+    "@alloc/quick-lru": ["@alloc/quick-lru@5.2.0", "", {}, "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw=="],
+
+    "@antfu/install-pkg": ["@antfu/install-pkg@1.1.0", "", { "dependencies": { "package-manager-detector": "^1.3.0", "tinyexec": "^1.0.1" } }, "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ=="],
+
+    "@ark/attest": ["@ark/attest@0.56.0", "", { "dependencies": { "@ark/fs": "0.56.0", "@ark/util": "0.56.0", "@prettier/sync": "0.6.1", "@typescript/analyze-trace": "0.10.1", "@typescript/vfs": "1.6.1", "arktype": "2.1.28", "prettier": "3.6.2" }, "peerDependencies": { "typescript": "*" }, "bin": { "attest": "out/cli/cli.js" } }, "sha512-Pngs8f1UJiWbeO8LKVdyBL0K3rT/PDVACR7TPyCEULNcN8V1rVec6dKvUnQVpQSj60p4ejlK6dKs+fQoqdUMqA=="],
+
+    "@ark/fs": ["@ark/fs@0.56.0", "", {}, "sha512-zY/wDDhcvmt6/upQwZM766PAnvIzdEMcgydUGd9pqY9FMGNo9I9uE4RYAfms9AeUUtbZJu2h2Ua0tvFsO5XF4Q=="],
+
+    "@ark/schema": ["@ark/schema@0.56.0", "", { "dependencies": { "@ark/util": "0.56.0" } }, "sha512-ECg3hox/6Z/nLajxXqNhgPtNdHWC9zNsDyskwO28WinoFEnWow4IsERNz9AnXRhTZJnYIlAJ4uGn3nlLk65vZA=="],
+
+    "@ark/util": ["@ark/util@0.56.0", "", {}, "sha512-BghfRC8b9pNs3vBoDJhcta0/c1J1rsoS1+HgVUreMFPdhz/CRAKReAu57YEllNaSy98rWAdY1gE+gFup7OXpgA=="],
+
+    "@astrojs/check": ["@astrojs/check@0.9.9", "", { "dependencies": { "@astrojs/language-server": "^2.16.7", "chokidar": "^4.0.3", "kleur": "^4.1.5", "yargs": "^17.7.2" }, "peerDependencies": { "typescript": "^5.0.0 || ^6.0.0" }, "bin": { "astro-check": "bin/astro-check.js" } }, "sha512-A5UW8uIuErLWEoRQvzgXpO1gTjUFtK8r7nU2Z7GewAMxUb7bPvpk11qaKKgxqXlHJWlAvaaxy+Xg28A6bmQ1Tg=="],
+
+    "@astrojs/compiler": ["@astrojs/compiler@2.13.1", "", {}, "sha512-f3FN83d2G/v32ipNClRKgYv30onQlMZX1vCeZMjPsMMPl1mDpmbl0+N5BYo4S/ofzqJyS5hvwacEo0CCVDn/Qg=="],
+
+    "@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.10.0", "", { "dependencies": { "@types/hast": "^3.0.4", "@types/mdast": "^4.0.4", "js-yaml": "^4.1.1", "picomatch": "^4.0.4", "retext-smartypants": "^6.2.0", "shiki": "^4.0.2", "smol-toml": "^1.6.0", "unified": "^11.0.5" } }, "sha512-Ry2R3VPeIN4uPCSA4xQc+e+vsJXkalKpEbDc07hV+a/o5Bs2N/s/uDcPJH/05L19DKh9tAy7e6JM3YZ6Cxfezw=="],
+
+    "@astrojs/language-server": ["@astrojs/language-server@2.16.10", "", { "dependencies": { "@astrojs/compiler": "^2.13.1", "@astrojs/yaml2ts": "^0.2.4", "@jridgewell/sourcemap-codec": "^1.5.5", "@volar/kit": "~2.4.28", "@volar/language-core": "~2.4.28", "@volar/language-server": "~2.4.28", "@volar/language-service": "~2.4.28", "muggle-string": "^0.4.1", "tinyglobby": "^0.2.16", "volar-service-css": "0.0.70", "volar-service-emmet": "0.0.70", "volar-service-html": "0.0.70", "volar-service-prettier": "0.0.70", "volar-service-typescript": "0.0.70", "volar-service-typescript-twoslash-queries": "0.0.70", "volar-service-yaml": "0.0.70", "vscode-html-languageservice": "^5.6.2", "vscode-uri": "^3.1.0" }, "peerDependencies": { "prettier": "^3.0.0", "prettier-plugin-astro": ">=0.11.0" }, "optionalPeers": ["prettier", "prettier-plugin-astro"], "bin": { "astro-ls": "./bin/nodeServer.js" } }, "sha512-87VQ/5GSdHlRnUA+hGuerYyIGAj+9RbZmATyuKLEUePinUXhQ5YkRnRrHhOD9sSi5JOErLjrLkHnfZFEvGrV8w=="],
+
+    "@astrojs/markdown-remark": ["@astrojs/markdown-remark@7.1.2", "", { "dependencies": { "@astrojs/internal-helpers": "0.9.1", "@astrojs/prism": "4.0.2", "github-slugger": "^2.0.0", "hast-util-from-html": "^2.0.3", "hast-util-to-text": "^4.0.2", "js-yaml": "^4.1.1", "mdast-util-definitions": "^6.0.0", "rehype-raw": "^7.0.0", "rehype-stringify": "^10.0.1", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remark-smartypants": "^3.0.2", "retext-smartypants": "^6.2.0", "shiki": "^4.0.0", "smol-toml": "^1.6.0", "unified": "^11.0.5", "unist-util-remove-position": "^5.0.0", "unist-util-visit": "^5.1.0", "unist-util-visit-parents": "^6.0.2", "vfile": "^6.0.3" } }, "sha512-caXZ4Dc2St2dW8luEg22GlP0gupLdztCTQE4EzZOxW1pqWXz9mbeJEuHUkgDYcKWW8tjIHkydYDhWLVoxJ327Q=="],
+
+    "@astrojs/mdx": ["@astrojs/mdx@5.0.6", "", { "dependencies": { "@astrojs/markdown-remark": "7.1.2", "@mdx-js/mdx": "^3.1.1", "acorn": "^8.16.0", "es-module-lexer": "^2.0.0", "estree-util-visit": "^2.0.0", "hast-util-to-html": "^9.0.5", "piccolore": "^0.1.3", "rehype-raw": "^7.0.0", "remark-gfm": "^4.0.1", "remark-smartypants": "^3.0.2", "source-map": "^0.7.6", "unist-util-visit": "^5.1.0", "vfile": "^6.0.3" }, "peerDependencies": { "astro": "^6.0.0" } }, "sha512-4dKe0ZMmqujofPNDHahzClkwinn9f8jHPcaXcgdGvPAlboD2mjzkUCofli2cBnxYAkdfhC6d50gBJ8i/cH8gHw=="],
+
+    "@astrojs/prism": ["@astrojs/prism@4.0.2", "", { "dependencies": { "prismjs": "^1.30.0" } }, "sha512-KTivpmnz6lDsC6o9H4+DNm2SrE/GHzw8cNAvEJwAvUT+eoaEnn/4NtbDNfRRaxaJHdp15gf+tfHAWiXR4wB3BA=="],
+
+    "@astrojs/react": ["@astrojs/react@5.0.6", "", { "dependencies": { "@astrojs/internal-helpers": "0.10.0", "@vitejs/plugin-react": "^5.2.0", "devalue": "^5.6.4", "ultrahtml": "^1.6.0", "vite": "^7.3.2" }, "peerDependencies": { "@types/react": "^17.0.50 || ^18.0.21 || ^19.0.0", "@types/react-dom": "^17.0.17 || ^18.0.6 || ^19.0.0", "react": "^17.0.2 || ^18.0.0 || ^19.0.0", "react-dom": "^17.0.2 || ^18.0.0 || ^19.0.0" } }, "sha512-3pfjmw3sUnV5WplLblDzsAKlHv9kNmlCFAw/xP/agubiZFo4d+uPXX2jynNwAfvwyI5v+Q9uIIFwyujv9jifLg=="],
+
+    "@astrojs/rss": ["@astrojs/rss@4.0.18", "", { "dependencies": { "fast-xml-parser": "^5.5.7", "piccolore": "^0.1.3", "zod": "^4.3.6" } }, "sha512-wc5DwKlbTEdgVAWnHy8krFTeQ42t1v/DJqeq5HtulYK3FYHE4krtRGjoyhS3eXXgfdV6Raoz2RU3wrMTFAitRg=="],
+
+    "@astrojs/sitemap": ["@astrojs/sitemap@3.7.3", "", { "dependencies": { "sitemap": "^9.0.0", "stream-replace-string": "^2.0.0", "zod": "^4.3.6" } }, "sha512-f8euLVsyeAmAkSm/1M2Kb8sL8byQmfgbvBNaHFItCheTj/IpiJYSEWVcqDHZ/yEHxiS7+w87mQkzwZaPHmk5GA=="],
+
+    "@astrojs/starlight": ["@astrojs/starlight@0.34.8", "", { "dependencies": { "@astrojs/markdown-remark": "^6.3.1", "@astrojs/mdx": "^4.2.3", "@astrojs/sitemap": "^3.3.0", "@pagefind/default-ui": "^1.3.0", "@types/hast": "^3.0.4", "@types/js-yaml": "^4.0.9", "@types/mdast": "^4.0.4", "astro-expressive-code": "^0.41.1", "bcp-47": "^2.1.0", "hast-util-from-html": "^2.0.1", "hast-util-select": "^6.0.2", "hast-util-to-string": "^3.0.0", "hastscript": "^9.0.0", "i18next": "^23.11.5", "js-yaml": "^4.1.0", "klona": "^2.0.6", "mdast-util-directive": "^3.0.0", "mdast-util-to-markdown": "^2.1.0", "mdast-util-to-string": "^4.0.0", "pagefind": "^1.3.0", "rehype": "^13.0.1", "rehype-format": "^5.0.0", "remark-directive": "^3.0.0", "ultrahtml": "^1.6.0", "unified": "^11.0.5", "unist-util-visit": "^5.0.0", "vfile": "^6.0.2" }, "peerDependencies": { "astro": "^5.5.0" } }, "sha512-XuYz0TfCZhje2u1Q9FNtmTdm7/B9QP91RDI1VkPgYvDhSYlME3k8gwgcBMHnR9ASDo2p9gskrqe7t1Pub/qryg=="],
+
+    "@astrojs/starlight-tailwind": ["@astrojs/starlight-tailwind@4.0.2", "", { "peerDependencies": { "@astrojs/starlight": ">=0.34.0", "tailwindcss": "^4.0.0" } }, "sha512-SYN/6zq6hJO5tWqbQ2tWT9/jd8ubUkzkBCcF94vByC/ZJ20Mi5GPjFvAh89Yky/aIM+jXxT6W5q4p6l58GKHiQ=="],
+
+    "@astrojs/telemetry": ["@astrojs/telemetry@3.3.0", "", { "dependencies": { "ci-info": "^4.2.0", "debug": "^4.4.0", "dlv": "^1.1.3", "dset": "^3.1.4", "is-docker": "^3.0.0", "is-wsl": "^3.1.0", "which-pm-runs": "^1.1.0" } }, "sha512-UFBgfeldP06qu6khs/yY+q1cDAaArM2/7AEIqQ9Cuvf7B1hNLq0xDrZkct+QoIGyjq56y8IaE2I3CTvG99mlhQ=="],
+
+    "@astrojs/yaml2ts": ["@astrojs/yaml2ts@0.2.4", "", { "dependencies": { "yaml": "^2.8.3" } }, "sha512-8oddpOae35pJsXPQXhTkM0ypfKPskVsh2bCxRtbf7e+/Epw2nReakFYpLKjZMEr75CsoF203PMnCocpfz0s69A=="],
+
+    "@aws-crypto/crc32": ["@aws-crypto/crc32@5.2.0", "", { "dependencies": { "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "tslib": "^2.6.2" } }, "sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg=="],
+
+    "@aws-crypto/sha256-browser": ["@aws-crypto/sha256-browser@5.2.0", "", { "dependencies": { "@aws-crypto/sha256-js": "^5.2.0", "@aws-crypto/supports-web-crypto": "^5.2.0", "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "@aws-sdk/util-locate-window": "^3.0.0", "@smithy/util-utf8": "^2.0.0", "tslib": "^2.6.2" } }, "sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw=="],
+
+    "@aws-crypto/sha256-js": ["@aws-crypto/sha256-js@5.2.0", "", { "dependencies": { "@aws-crypto/util": "^5.2.0", "@aws-sdk/types": "^3.222.0", "tslib": "^2.6.2" } }, "sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA=="],
+
+    "@aws-crypto/supports-web-crypto": ["@aws-crypto/supports-web-crypto@5.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg=="],
+
+    "@aws-crypto/util": ["@aws-crypto/util@5.2.0", "", { "dependencies": { "@aws-sdk/types": "^3.222.0", "@smithy/util-utf8": "^2.0.0", "tslib": "^2.6.2" } }, "sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ=="],
+
+    "@aws-sdk/client-cognito-identity": ["@aws-sdk/client-cognito-identity@3.1057.0", "", { "dependencies": { "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.974.15", "@aws-sdk/credential-provider-node": "^3.972.47", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/fetch-http-handler": "^5.4.5", "@smithy/node-http-handler": "^4.7.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-5MliYkp2u0+2arTp5fZIaxl+xmm90LEKv/VeSxhfNQW4t0fvWJrNO429/jchWQenNoDRrOGE59VfbuZUfwFujg=="],
+
+    "@aws-sdk/core": ["@aws-sdk/core@3.974.15", "", { "dependencies": { "@aws-sdk/types": "^3.973.9", "@aws-sdk/xml-builder": "^3.972.26", "@aws/lambda-invoke-store": "^0.2.2", "@smithy/core": "^3.24.5", "@smithy/signature-v4": "^5.4.5", "@smithy/types": "^4.14.2", "bowser": "^2.11.0", "tslib": "^2.6.2" } }, "sha512-UpA0rTGW/tHGITcCqHisbuuEPraYg9GG+mWmXjY5+RxZBMLGe6aL9oe0ix50LztwAcPIkGZLH0yWdMIkCM10hw=="],
+
+    "@aws-sdk/credential-provider-cognito-identity": ["@aws-sdk/credential-provider-cognito-identity@3.972.38", "", { "dependencies": { "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-OHkK6xOx/IHkSbQdDWxnVCLU+j28EFl8wyWgBILQDFAPY8n240C/O4gjmFx+zFU12lL8njgJQ5GWAIWq88CnSQ=="],
+
+    "@aws-sdk/credential-provider-env": ["@aws-sdk/credential-provider-env@3.972.41", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-n1EbJ98yvPWWdHZZv8bRBMqqDQJrtgtxyJ4xLy2Uqrh25BCOZQ7nnS1CsFXvuH8r0b0KVHDZEGEH5FxmEMP8jg=="],
+
+    "@aws-sdk/credential-provider-http": ["@aws-sdk/credential-provider-http@3.972.43", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/fetch-http-handler": "^5.4.5", "@smithy/node-http-handler": "^4.7.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-TT76RN1NkI9WoyZqCNxOw6/WBMF7pYOTJcXbMokNFU+euSG40Kaf/t/FhDACVZWP+43wEM6ZynIPIkzS1wR1iA=="],
+
+    "@aws-sdk/credential-provider-ini": ["@aws-sdk/credential-provider-ini@3.972.46", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/credential-provider-env": "^3.972.41", "@aws-sdk/credential-provider-http": "^3.972.43", "@aws-sdk/credential-provider-login": "^3.972.45", "@aws-sdk/credential-provider-process": "^3.972.41", "@aws-sdk/credential-provider-sso": "^3.972.45", "@aws-sdk/credential-provider-web-identity": "^3.972.45", "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/credential-provider-imds": "^4.3.6", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-hvcgcwOiS0nb2XFb5Op1Pz/vYaWz5K8kKullziGpdNRuG0NwzRXseuPt2CoBqknHGaSPVesu1aOn2OcctEYdCA=="],
+
+    "@aws-sdk/credential-provider-login": ["@aws-sdk/credential-provider-login@3.972.45", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-MZQv4SNjByk1iOKmrqmzcUF/uCB05wjvEHyXKxmGQTUANTIVayX6HPUF0bzkWLvtnkH7sAn9kUCfkXbSpj9sDA=="],
+
+    "@aws-sdk/credential-provider-node": ["@aws-sdk/credential-provider-node@3.972.47", "", { "dependencies": { "@aws-sdk/credential-provider-env": "^3.972.41", "@aws-sdk/credential-provider-http": "^3.972.43", "@aws-sdk/credential-provider-ini": "^3.972.46", "@aws-sdk/credential-provider-process": "^3.972.41", "@aws-sdk/credential-provider-sso": "^3.972.45", "@aws-sdk/credential-provider-web-identity": "^3.972.45", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/credential-provider-imds": "^4.3.6", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-HrId+C0DWA5qDIyLG64/kjUB2RNtPypxmABnIctK+TA1P1kHlOYoE/Wf5T5tKOMKgb08P7k/zNyhvfJ3lh5Oag=="],
+
+    "@aws-sdk/credential-provider-process": ["@aws-sdk/credential-provider-process@3.972.41", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-7I/n1zkysouLOWvkEhjNEP4vMnD2v4kzzr3/3QBdrripEpn7ap1/I5DF3Hou1SUqkKWo1f3oPGMyFAA1FAMvsQ=="],
+
+    "@aws-sdk/credential-provider-sso": ["@aws-sdk/credential-provider-sso@3.972.45", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/token-providers": "3.1056.0", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-oHgbz/eFD8IKiksqDsz9ZMU4A59BpQq4QwJedBnGD80ZqYcHPPHZBwjBnxLVkB7iRVVHWpDclR8yWdD2PkQIUA=="],
+
+    "@aws-sdk/credential-provider-web-identity": ["@aws-sdk/credential-provider-web-identity@3.972.45", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-CDhzKdb2onv5bpnjn/acgdNmJOQthPDLsPizU7rZflsEcgMMp8Mlri+U5hdxf8ldvZJpvM3vLU6D56vfJm5AMQ=="],
+
+    "@aws-sdk/credential-providers": ["@aws-sdk/credential-providers@3.1057.0", "", { "dependencies": { "@aws-sdk/client-cognito-identity": "3.1057.0", "@aws-sdk/core": "^3.974.15", "@aws-sdk/credential-provider-cognito-identity": "^3.972.38", "@aws-sdk/credential-provider-env": "^3.972.41", "@aws-sdk/credential-provider-http": "^3.972.43", "@aws-sdk/credential-provider-ini": "^3.972.46", "@aws-sdk/credential-provider-login": "^3.972.45", "@aws-sdk/credential-provider-node": "^3.972.47", "@aws-sdk/credential-provider-process": "^3.972.41", "@aws-sdk/credential-provider-sso": "^3.972.45", "@aws-sdk/credential-provider-web-identity": "^3.972.45", "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/credential-provider-imds": "^4.3.6", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-rbrEHtz11g0kxsSkYr3fx2HABNNblp4AhB2MgPvJHgYOWfJ2eBviU7Mvoaef0PW8QH6lbZDfJcnM7eKvtvz3sw=="],
+
+    "@aws-sdk/nested-clients": ["@aws-sdk/nested-clients@3.997.13", "", { "dependencies": { "@aws-crypto/sha256-browser": "5.2.0", "@aws-crypto/sha256-js": "5.2.0", "@aws-sdk/core": "^3.974.15", "@aws-sdk/signature-v4-multi-region": "^3.996.30", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/fetch-http-handler": "^5.4.5", "@smithy/node-http-handler": "^4.7.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-2pA6eyb5nSo/ZD2cayhOTEMoGQYgspq0RI05GDLkzQ3ajZ6isS6waV6E92Am/hz4LIlLUTrbwPLurJ/fuiHvkg=="],
+
+    "@aws-sdk/signature-v4-multi-region": ["@aws-sdk/signature-v4-multi-region@3.996.30", "", { "dependencies": { "@aws-sdk/types": "^3.973.9", "@smithy/signature-v4": "^5.4.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-HULDLMVzkmTSEv6//7kx2kRevp/VYUpm8hJNNFbmhxDn0fUiGTxVcM9yg31TukvTq8nyOBDUN2gH0o5IRbKjdw=="],
+
+    "@aws-sdk/token-providers": ["@aws-sdk/token-providers@3.1056.0", "", { "dependencies": { "@aws-sdk/core": "^3.974.15", "@aws-sdk/nested-clients": "^3.997.13", "@aws-sdk/types": "^3.973.9", "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-81duvlltQlsfn5K+o8zILcystBRdbT1G2JJYVCML5NZHBz4CL/zf+sAemCtBh/uh6RQUMyInGeZLQ7/8igZhbA=="],
+
+    "@aws-sdk/types": ["@aws-sdk/types@3.973.9", "", { "dependencies": { "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-kuBfgQVdcz5Bmapc4A13YbpVw/pXkesfhetcFYwbntqas8sF41OHyd4o28+/TG2ZQdHBsv90Lsu5y6oitvYCdg=="],
+
+    "@aws-sdk/util-locate-window": ["@aws-sdk/util-locate-window@3.965.5", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ=="],
+
+    "@aws-sdk/xml-builder": ["@aws-sdk/xml-builder@3.972.26", "", { "dependencies": { "@smithy/types": "^4.14.2", "fast-xml-parser": "5.7.3", "tslib": "^2.6.2" } }, "sha512-cDbrqvDS73whl6YAPSPq0U6whzG6UWI9PuWh0wrUuGoZexhWEqhdunbukV7iBoaWnFV1AODutM5hOD6rtn439g=="],
+
+    "@aws/lambda-invoke-store": ["@aws/lambda-invoke-store@0.2.4", "", {}, "sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ=="],
+
+    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
+
+    "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
+
+    "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
+
+    "@babel/generator": ["@babel/generator@8.0.0-rc.6", "", { "dependencies": { "@babel/parser": "^8.0.0-rc.6", "@babel/types": "^8.0.0-rc.6", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "@types/jsesc": "^2.5.0", "jsesc": "^3.0.2" } }, "sha512-6mIzgVK8DgEzvIapoQwhXTMnnkuE4STQmVv9H03i/tZ2ml8oev3TRvZJgTenK2Bsq0YWNtzOrFdTyNzCMFtjJQ=="],
+
+    "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
+
+    "@babel/helper-compilation-targets": ["@babel/helper-compilation-targets@7.29.7", "", { "dependencies": { "@babel/compat-data": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "browserslist": "^4.24.0", "lru-cache": "^5.1.1", "semver": "^6.3.1" } }, "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g=="],
+
+    "@babel/helper-create-class-features-plugin": ["@babel/helper-create-class-features-plugin@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/helper-replace-supers": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/traverse": "^7.29.7", "semver": "^6.3.1" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg=="],
+
+    "@babel/helper-globals": ["@babel/helper-globals@7.29.7", "", {}, "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA=="],
+
+    "@babel/helper-member-expression-to-functions": ["@babel/helper-member-expression-to-functions@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg=="],
+
+    "@babel/helper-module-imports": ["@babel/helper-module-imports@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g=="],
+
+    "@babel/helper-module-transforms": ["@babel/helper-module-transforms@7.29.7", "", { "dependencies": { "@babel/helper-module-imports": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg=="],
+
+    "@babel/helper-optimise-call-expression": ["@babel/helper-optimise-call-expression@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong=="],
+
+    "@babel/helper-plugin-utils": ["@babel/helper-plugin-utils@7.29.7", "", {}, "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw=="],
+
+    "@babel/helper-replace-supers": ["@babel/helper-replace-supers@7.29.7", "", { "dependencies": { "@babel/helper-member-expression-to-functions": "^7.29.7", "@babel/helper-optimise-call-expression": "^7.29.7", "@babel/traverse": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0" } }, "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ=="],
+
+    "@babel/helper-skip-transparent-expression-wrappers": ["@babel/helper-skip-transparent-expression-wrappers@7.29.7", "", { "dependencies": { "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ=="],
+
+    "@babel/helper-string-parser": ["@babel/helper-string-parser@7.29.7", "", {}, "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="],
+
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@babel/helper-validator-option": ["@babel/helper-validator-option@7.29.7", "", {}, "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw=="],
+
+    "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
+
+    "@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+
+    "@babel/plugin-proposal-decorators": ["@babel/plugin-proposal-decorators@7.29.7", "", { "dependencies": { "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/plugin-syntax-decorators": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-EtU0Hi3GvrTqD56xKmZvV/uCXK2ZbwVNPNLAquVItcAZpUhkXwWlo3Fmj0c2LxgSf2I8IDULeAepwNP1OefLXg=="],
+
+    "@babel/plugin-syntax-decorators": ["@babel/plugin-syntax-decorators@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-9MTTLbF39X6sqM92JPEsoI7++26hjZvzkxKZy64aMhWLH2mPkJ/Q3AV4QLmls3R14FpSpkOwQQfUh962JGQxxg=="],
+
+    "@babel/plugin-syntax-import-attributes": ["@babel/plugin-syntax-import-attributes@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg=="],
+
+    "@babel/plugin-syntax-import-meta": ["@babel/plugin-syntax-import-meta@7.10.4", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.10.4" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g=="],
+
+    "@babel/plugin-syntax-jsx": ["@babel/plugin-syntax-jsx@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A=="],
+
+    "@babel/plugin-syntax-typescript": ["@babel/plugin-syntax-typescript@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA=="],
+
+    "@babel/plugin-transform-modules-commonjs": ["@babel/plugin-transform-modules-commonjs@7.29.7", "", { "dependencies": { "@babel/helper-module-transforms": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ=="],
+
+    "@babel/plugin-transform-react-jsx-self": ["@babel/plugin-transform-react-jsx-self@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw=="],
+
+    "@babel/plugin-transform-react-jsx-source": ["@babel/plugin-transform-react-jsx-source@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q=="],
+
+    "@babel/plugin-transform-typescript": ["@babel/plugin-transform-typescript@7.29.7", "", { "dependencies": { "@babel/helper-annotate-as-pure": "^7.29.7", "@babel/helper-create-class-features-plugin": "^7.29.7", "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-skip-transparent-expression-wrappers": "^7.29.7", "@babel/plugin-syntax-typescript": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-jK52h8LaLc7JarhQV2ofeFMts4H7vnOXnqZNA6fYglBTZewRBE51KWt3BUltW1P+KoPsYkHoJeXePuz4zo2LMw=="],
+
+    "@babel/preset-typescript": ["@babel/preset-typescript@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7", "@babel/helper-validator-option": "^7.29.7", "@babel/plugin-syntax-jsx": "^7.29.7", "@babel/plugin-transform-modules-commonjs": "^7.29.7", "@babel/plugin-transform-typescript": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-/Foi8vKY2EVbed/1eZx0gJEEwHAIxogrySI7rULcRIvhZzbvoE/b5qG5Ghc0WKAFKOHA9SD1x7RsFlOYdutIiQ=="],
+
+    "@babel/runtime": ["@babel/runtime@7.29.7", "", {}, "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw=="],
+
+    "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
+
+    "@babel/traverse": ["@babel/traverse@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/types": "^7.29.7", "debug": "^4.3.1" } }, "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw=="],
+
+    "@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+
+    "@better-auth/core": ["@better-auth/core@1.6.12", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.1.21", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.5", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-6mXtYSYfo6TvHHCZAZmfjvIQQtBDWzWzwy9iIWPEoede2lP2SuJzkfIQNuTtIGzZcn7a9iuzIm1jWDBzfnBARg=="],
+
+    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-g0sKQstvXHH70s+TjAXo86cNyWV60ahhJm1sow27RyW41U10vfBehOFinU3GPESyxl/fEr9D27rk3jdl6E3l3A=="],
+
+    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "kysely": "^0.28.17 || ^0.29.0" }, "optionalPeers": ["kysely"] }, "sha512-KhPwPmLj+MoTVGV6goPfCYf/7Fuiy2Q37GEWhvQdoFjkYKbGo995OoghBVNBnAYOakYvTYjG0JebCfiETBVX3g=="],
+
+    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1" } }, "sha512-flblsePBCcB0DA6hewAOupxyypNTQczZvkNYvRrsVlBDIh0+vHBU/dTjoDmuQnZ3egTdFNnMeC+VrNnqt/GFUg=="],
+
+    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-IeiHZN9PtIyiqYgTDlrmm8sYI++5p1OI49uWB7LHg2+touiaNUGe0uWYymQpw1zq1e8FJxKlwvOc5vw6nGrI6g=="],
+
+    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-+GvU8vZ3aJUHDBuR5PxtU5OpPQS2T9ND7s2JYm63bD6rnYztLwEo8bwHL3BvsTwSvCjFHZCtsn1A+6qyoOzTMw=="],
+
+    "@better-auth/telemetry": ["@better-auth/telemetry@1.6.12", "", { "peerDependencies": { "@better-auth/core": "^1.6.12", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.1.21" } }, "sha512-g59qLPq9SROyku0X5tiZpXXiVrsbjB1QA6OctOt9svzj7NjCFBoCAO9QlBiOTUolo0l9CF6fLlc85PoBkY5RtA=="],
+
+    "@better-auth/utils": ["@better-auth/utils@0.4.1", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-SZBPRPF3z0nBvE5ygOkxae35wnnXPRShmqFo78S+qslLeFoPu/pMgnXAuNKFMMybac3tiLaVg1e3MQW5MC+1iA=="],
+
+    "@better-fetch/fetch": ["@better-fetch/fetch@1.1.21", "", {}, "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="],
+
+    "@braintree/sanitize-url": ["@braintree/sanitize-url@7.1.2", "", {}, "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA=="],
+
+    "@capsizecss/unpack": ["@capsizecss/unpack@4.0.0", "", { "dependencies": { "fontkitten": "^1.0.0" } }, "sha512-VERIM64vtTP1C4mxQ5thVT9fK0apjPFobqybMtA1UdUujWka24ERHbRHFGmpbbhp73MhV+KSsHQH9C6uOTdEQA=="],
+
+    "@chevrotain/types": ["@chevrotain/types@11.1.2", "", {}, "sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw=="],
+
+    "@clack/core": ["@clack/core@0.5.0", "", { "dependencies": { "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow=="],
+
+    "@clack/prompts": ["@clack/prompts@0.11.0", "", { "dependencies": { "@clack/core": "0.5.0", "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw=="],
+
+    "@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.5.0", "", {}, "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg=="],
+
+    "@cloudflare/puppeteer": ["@cloudflare/puppeteer@1.1.0", "", { "dependencies": { "@puppeteer/browsers": "2.2.4", "debug": "^4.3.5", "devtools-protocol": "0.0.1299070", "ws": "^8.18.0" } }, "sha512-lN10En49avRDQvz8Gpv/WiIoGvjjDiP6P+v2y9bA6rfPT5WHfnlg2O6MwjHc1POm8A9LXf1sMdgrsdW8xWapOw=="],
+
+    "@cloudflare/unenv-preset": ["@cloudflare/unenv-preset@2.16.1", "", { "peerDependencies": { "unenv": "2.0.0-rc.24", "workerd": ">1.20260305.0 <2.0.0-0" }, "optionalPeers": ["workerd"] }, "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw=="],
+
+    "@cloudflare/vite-plugin": ["@cloudflare/vite-plugin@1.39.0", "", { "dependencies": { "@cloudflare/unenv-preset": "2.16.1", "miniflare": "4.20260526.0", "unenv": "2.0.0-rc.24", "wrangler": "4.95.0", "ws": "8.20.1" }, "peerDependencies": { "vite": "^6.1.0 || ^7.0.0 || ^8.0.0" } }, "sha512-AHC+KSR+3dtGu7Ab7I0Ode4Whx12TxMEmiZt7w+Fc3/2wYNByIzbb6cndWZ78tnveFdO1xhNLv1YaNngxGtOPg=="],
+
+    "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260526.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-/pR3GH3gfv0PUp7DjI8v0aAIDOqFwibq4bg5xT7TZgcVdBV/cJQWckdXCMqiRtHiawLwogUX00EIOINkYJ1Zqg=="],
+
+    "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260526.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rcyu0iANYfaiezKh3Mcao1O4IIgVfQldxduiL5TZT1sP0NIeRY4YReSTrzPxNnXxSYaIqaqRHMcHbUM/ic4knA=="],
+
+    "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260526.1", "", { "os": "linux", "cpu": "x64" }, "sha512-5EZAEnlLwa9oGJRo8Nd3iY5Wcd9ROGNNG90xNIGp8MEjj8v2jTn42NC47fCZKFdnLj3+S+vWEhu1x0GVJnALjA=="],
+
+    "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260526.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-X/YBQXeXFeCN7QTStoWrATEBc9WKl7PIqkw/dQkjyJ72gh3rkLe0+Xkzp3wO7gtxTDQMa7NPGy1W4+sdMf8q1g=="],
+
+    "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260526.1", "", { "os": "win32", "cpu": "x64" }, "sha512-R+tqpFFdcfZIljx8fIW9rj9fRTtDgfoA2yonsfAGa6e8snrmr+38mdFHtkRC0D3UyZpn/hOtmXiUBfdX2gMR7Q=="],
+
+    "@cloudflare/workers-types": ["@cloudflare/workers-types@4.20260529.1", "", {}, "sha512-33n3nsaWELSgn4DLKj1X9dwZc3kVDnO+jF/hLH9fdaXG9mQzKDeUkQaVRWLJXvrPXPa9RaIuSAFO4Zh9YOqOog=="],
+
+    "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="],
+
+    "@ctrl/tinycolor": ["@ctrl/tinycolor@4.2.0", "", {}, "sha512-kzyuwOAQnXJNLS9PSyrk0CWk35nWJW/zl/6KvnTBMFK65gm7U1/Z5BqjxeapjZCIhQcM/DsrEmcbRwDyXyXK4A=="],
+
+    "@distilled.cloud/aws": ["@distilled.cloud/aws@0.22.4", "", { "dependencies": { "@aws-crypto/crc32": "^5.2.0", "@aws-crypto/util": "^5.2.0", "@aws-sdk/credential-providers": "^3.994.0", "@aws-sdk/types": "^3.973.1", "@distilled.cloud/core": "0.22.4", "@smithy/shared-ini-file-loader": "^4.4.3", "@smithy/types": "^4.12.0", "@smithy/util-base64": "^4.3.0", "aws4fetch": "^1.0.20", "fast-xml-parser": "^5.3.2" }, "peerDependencies": { "effect": ">=4.0.0-beta.66 || >=4.0.0" } }, "sha512-qa+MnIdlRy6QmXuRwGqBNQnF2mu9MyUck2yeYkEesDpOH4eJFcjZy8nVUIhWxACfSIMvLd59FD6bkdVALzI5Dg=="],
+
+    "@distilled.cloud/axiom": ["@distilled.cloud/axiom@0.22.4", "", { "dependencies": { "@distilled.cloud/core": "0.22.4" }, "peerDependencies": { "effect": ">=4.0.0-beta.66 || >=4.0.0" } }, "sha512-CcSe8UPEPLGW/tGZ/ky5Hn5Gfd2/43bn5km6opeiyN45HrHbkvYURQeiqgcivJt2Y01Mh0lMeBkQQdfCjJIhjA=="],
+
+    "@distilled.cloud/cloudflare": ["@distilled.cloud/cloudflare@0.22.4", "", { "dependencies": { "@distilled.cloud/core": "0.22.4" }, "peerDependencies": { "effect": ">=4.0.0-beta.66 || >=4.0.0" } }, "sha512-hDqVoGmJlPoGCgurVFbk399gkPyu9Pr/w8D4Rv/q5twaK29Ioy5NGk2oLJrfKwaKZVeBDl7TzIxVX0wW3HQlCA=="],
+
+    "@distilled.cloud/cloudflare-rolldown-plugin": ["@distilled.cloud/cloudflare-rolldown-plugin@0.10.1", "", { "dependencies": { "@cloudflare/unenv-preset": "^2.16.0", "magic-string": "^0.30.21", "unenv": "^2.0.0-rc.24" }, "peerDependencies": { "rolldown": "^1.0.1" }, "optionalPeers": ["rolldown"] }, "sha512-nEmEmUgbVkr9AH95/rq3cnWXbovBhXRAKW5/Ae1GwFndXBcdNy2Mx7w+AWUGuA3NSkDg6Q4W4EylPtJ3sduPqg=="],
+
+    "@distilled.cloud/cloudflare-runtime": ["@distilled.cloud/cloudflare-runtime@0.10.1", "", { "dependencies": { "@alchemy.run/node-utils": "^0.0.4", "capnweb": "^0.7.0", "chokidar": "^4.0.1", "workerd": "1.20260526.1", "xdg-app-paths": "^8.3.0" }, "peerDependencies": { "@distilled.cloud/cloudflare": "^0.22.0", "@effect/platform-bun": ">=4.0.0-beta.66 || >=4.0.0", "@effect/platform-node": ">=4.0.0-beta.66 || >=4.0.0", "effect": ">=4.0.0-beta.66 || >=4.0.0" }, "optionalPeers": ["@effect/platform-bun", "@effect/platform-node"] }, "sha512-KxVqZo8Kld4krux9yf4doSIwBlNdgCLY2ivIKBXv7vo3pY3pH3fcmCXE/+rGjD2iGqPU7eyEp4DdmKcAJAqhNw=="],
+
+    "@distilled.cloud/cloudflare-vite-plugin": ["@distilled.cloud/cloudflare-vite-plugin@0.10.1", "", { "dependencies": { "@distilled.cloud/cloudflare-rolldown-plugin": "0.10.1" }, "peerDependencies": { "@distilled.cloud/cloudflare": "^0.22.0", "@distilled.cloud/cloudflare-runtime": "0.10.1", "@effect/platform-bun": ">=4.0.0-beta.66 || >=4.0.0", "@effect/platform-node": ">=4.0.0-beta.66 || >=4.0.0", "effect": ">=4.0.0-beta.66 || >=4.0.0", "vite": "^7.0.0 || ^8.0.0" }, "optionalPeers": ["@effect/platform-bun", "@effect/platform-node"] }, "sha512-g0F/BoxUy8fg4U/IkeHyauXSQ8YU9N6aBOhybn0WvtLBeOUrqHT7R3+jMQsdt2PGKhkHPT3TlxN9FPaAUn0YSg=="],
+
+    "@distilled.cloud/core": ["@distilled.cloud/core@0.22.4", "", { "peerDependencies": { "effect": ">=4.0.0-beta.66 || >=4.0.0" } }, "sha512-OuyM6cfOzQO0+n05Mb8jHDNrFxBjw27Q+9KL/uWRknLfTa3B1KDzyYJlt14MOFubl4YywreteNxGzcoGNhFN2A=="],
+
+    "@distilled.cloud/neon": ["@distilled.cloud/neon@0.22.4", "", { "dependencies": { "@distilled.cloud/core": "0.22.4" }, "peerDependencies": { "effect": ">=4.0.0-beta.66 || >=4.0.0" } }, "sha512-dE6h0mNTi5CUalMLcXgJmolYeCakB9bYCUHo1w/ERzwbb9MsyKLYckvRQbK1mcwKmrBdzZJWC1kaG8ZfNYDfTg=="],
+
+    "@distilled.cloud/planetscale": ["@distilled.cloud/planetscale@0.22.4", "", { "dependencies": { "@distilled.cloud/core": "0.22.4" }, "peerDependencies": { "effect": ">=4.0.0-beta.66 || >=4.0.0" } }, "sha512-SrMlYTnKBtZ0p6Sug4RzsSHRUPxJtjHLUmANI7q1SGDPoWZLCCfRuDdVTFBVi9WBjxlmJtDDjpHCQoEwA8qeLQ=="],
+
+    "@drizzle-team/brocli": ["@drizzle-team/brocli@0.11.0", "", {}, "sha512-hD3pekGiPg0WPCCGAZmusBBJsDqGUR66Y452YgQsZOnkdQ7ViEPKuyP4huUGEZQefp8g34RRodXYmJ2TbCH+tg=="],
+
+    "@ec-ts/twoslash": ["@ec-ts/twoslash@1.0.0", "", { "dependencies": { "@ec-ts/vfs": "^1.0.0", "twoslash-protocol": "^0.3.6" }, "peerDependencies": { "typescript": "^5.5.0" } }, "sha512-Bp4MCmeDWVRkTkuytPTszan+QGUqeftiasOBadvxSfQpbXYiWsle/N0lMrG+S14bfS9iBzI8mEqdGgd3Fvr3jQ=="],
+
+    "@ec-ts/twoslash-vue": ["@ec-ts/twoslash-vue@1.0.0", "", { "dependencies": { "@ec-ts/twoslash": "^1.0.0", "@vue/language-core": "^3.2.5", "twoslash-protocol": "^0.3.6" }, "peerDependencies": { "typescript": "^5.5.0" } }, "sha512-3bB0/1DPPLHjS0eok2Cne7xQjCQVU5AWScEBGYTqsKuTCTukDUMxUiYI54rDPQME3OLnpysiORi0FQKLA96pAg=="],
+
+    "@ec-ts/vfs": ["@ec-ts/vfs@1.0.0", "", { "peerDependencies": { "typescript": "^5.5.0" } }, "sha512-GQYRPMp58p9ak+TOwSLB/HZ+iknFyTRjqMTdXDkitNN3h5yjHuO+yeeO+/cuXiv7dyXGLYs4HaYrFgRKImp8yg=="],
+
+    "@effect/language-service": ["@effect/language-service@0.77.0", "", { "bin": { "effect-language-service": "cli.js" } }, "sha512-QP2bri8DdcK7Eo+SqFS2yNeD0Ch9kKHYxq2jeE9CaPpBknevCNFb3+hT6qSsPt2P6yOkhNP83KMy5Uk7DGBXlg=="],
+
+    "@effect/platform-bun": ["@effect/platform-bun@4.0.0-beta.74", "", { "dependencies": { "@effect/platform-node-shared": "^4.0.0-beta.74" }, "peerDependencies": { "effect": "^4.0.0-beta.74" } }, "sha512-HPozsTKom3v8uGITYX+blua0wVSk/I7ak802FoX13t4zWhHfprT8I/A8VBO4SxmcDYb/izABtHBXBgEmp612MA=="],
+
+    "@effect/platform-node": ["@effect/platform-node@4.0.0-beta.74", "", { "dependencies": { "@effect/platform-node-shared": "^4.0.0-beta.74", "mime": "^4.1.0", "undici": "^8.2.0" }, "peerDependencies": { "effect": "^4.0.0-beta.74", "ioredis": "^5.7.0" } }, "sha512-/W16mKqxvhWINLjufzc0log1sl57exXQfwd+em398/zKCbmU3S7snXTDMN6w0ju2TtgK35qrsoGBXEochij6Sg=="],
+
+    "@effect/platform-node-shared": ["@effect/platform-node-shared@4.0.0-beta.74", "", { "dependencies": { "@types/ws": "^8.18.1", "ws": "^8.20.0" }, "peerDependencies": { "effect": "^4.0.0-beta.74" } }, "sha512-C6C2hXixNcZXLaFF2u7B/FtOsqpdY7luaPuiGFBJza0P7EnYDkwaT3kB6lv7l/qctmkADc24qOsSCWIKRbC4jg=="],
+
+    "@effect/sql-pg": ["@effect/sql-pg@4.0.0-beta.74", "", { "dependencies": { "pg": "^8.20.0", "pg-connection-string": "2.12.0", "pg-cursor": "^2.19.0", "pg-pool": "^3.13.0", "pg-types": "^4.1.0" }, "peerDependencies": { "effect": "^4.0.0-beta.74" } }, "sha512-F1keL+vtp+d2HG7LQQ/WhJx4ezCrNy29T0HLbGPPvTeJTIi5/8fe2frh4WF55p6K3oi8jhkfe3fSH2Lcx0RjRw=="],
+
+    "@effect/vitest": ["@effect/vitest@4.0.0-beta.74", "", { "peerDependencies": { "effect": "^4.0.0-beta.74", "vitest": "^3.0.0 || ^4.0.0" } }, "sha512-+SFcjtbboJdWA+cP7JFW7Gp1PL7vj7uqvBnh9xY7JFU8VMsrHN5mblsqE7l7+ZFGpJvBGLgjGrhfe8QZ7f5vgg=="],
+
+    "@emmetio/abbreviation": ["@emmetio/abbreviation@2.3.3", "", { "dependencies": { "@emmetio/scanner": "^1.0.4" } }, "sha512-mgv58UrU3rh4YgbE/TzgLQwJ3pFsHHhCLqY20aJq+9comytTXUDNGG/SMtSeMJdkpxgXSXunBGLD8Boka3JyVA=="],
+
+    "@emmetio/css-abbreviation": ["@emmetio/css-abbreviation@2.1.8", "", { "dependencies": { "@emmetio/scanner": "^1.0.4" } }, "sha512-s9yjhJ6saOO/uk1V74eifykk2CBYi01STTK3WlXWGOepyKa23ymJ053+DNQjpFcy1ingpaO7AxCcwLvHFY9tuw=="],
+
+    "@emmetio/css-parser": ["@emmetio/css-parser@0.4.1", "", { "dependencies": { "@emmetio/stream-reader": "^2.2.0", "@emmetio/stream-reader-utils": "^0.1.0" } }, "sha512-2bC6m0MV/voF4CTZiAbG5MWKbq5EBmDPKu9Sb7s7nVcEzNQlrZP6mFFFlIaISM8X6514H9shWMme1fCm8cWAfQ=="],
+
+    "@emmetio/html-matcher": ["@emmetio/html-matcher@1.3.0", "", { "dependencies": { "@emmetio/scanner": "^1.0.0" } }, "sha512-NTbsvppE5eVyBMuyGfVu2CRrLvo7J4YHb6t9sBFLyY03WYhXET37qA4zOYUjBWFCRHO7pS1B9khERtY0f5JXPQ=="],
+
+    "@emmetio/scanner": ["@emmetio/scanner@1.0.4", "", {}, "sha512-IqRuJtQff7YHHBk4G8YZ45uB9BaAGcwQeVzgj/zj8/UdOhtQpEIupUhSk8dys6spFIWVZVeK20CzGEnqR5SbqA=="],
+
+    "@emmetio/stream-reader": ["@emmetio/stream-reader@2.2.0", "", {}, "sha512-fXVXEyFA5Yv3M3n8sUGT7+fvecGrZP4k6FnWWMSZVQf69kAq0LLpaBQLGcPR30m3zMmKYhECP4k/ZkzvhEW5kw=="],
+
+    "@emmetio/stream-reader-utils": ["@emmetio/stream-reader-utils@0.1.0", "", {}, "sha512-ZsZ2I9Vzso3Ho/pjZFsmmZ++FWeEd/txqybHTm4OgaZzdS8V9V/YYWQwg5TC38Z7uLWUV1vavpLLbjJtKubR1A=="],
+
+    "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
+
+    "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+
+    "@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.0", "", { "os": "aix", "cpu": "ppc64" }, "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA=="],
+
+    "@esbuild/android-arm": ["@esbuild/android-arm@0.28.0", "", { "os": "android", "cpu": "arm" }, "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ=="],
+
+    "@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.0", "", { "os": "android", "cpu": "arm64" }, "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw=="],
+
+    "@esbuild/android-x64": ["@esbuild/android-x64@0.28.0", "", { "os": "android", "cpu": "x64" }, "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA=="],
+
+    "@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q=="],
+
+    "@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ=="],
+
+    "@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.0", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q=="],
+
+    "@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw=="],
+
+    "@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.0", "", { "os": "linux", "cpu": "arm" }, "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw=="],
+
+    "@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A=="],
+
+    "@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.0", "", { "os": "linux", "cpu": "ia32" }, "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ=="],
+
+    "@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg=="],
+
+    "@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w=="],
+
+    "@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg=="],
+
+    "@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.0", "", { "os": "linux", "cpu": "none" }, "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ=="],
+
+    "@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q=="],
+
+    "@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.0", "", { "os": "linux", "cpu": "x64" }, "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ=="],
+
+    "@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw=="],
+
+    "@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.0", "", { "os": "none", "cpu": "x64" }, "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw=="],
+
+    "@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.0", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g=="],
+
+    "@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.0", "", { "os": "openbsd", "cpu": "x64" }, "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA=="],
+
+    "@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.0", "", { "os": "none", "cpu": "arm64" }, "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w=="],
+
+    "@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.0", "", { "os": "sunos", "cpu": "x64" }, "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw=="],
+
+    "@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA=="],
+
+    "@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA=="],
+
+    "@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.0", "", { "os": "win32", "cpu": "x64" }, "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw=="],
+
+    "@eslint-community/eslint-utils": ["@eslint-community/eslint-utils@4.9.1", "", { "dependencies": { "eslint-visitor-keys": "^3.4.3" }, "peerDependencies": { "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0" } }, "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ=="],
+
+    "@eslint-community/regexpp": ["@eslint-community/regexpp@4.12.2", "", {}, "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew=="],
+
+    "@eslint/config-array": ["@eslint/config-array@0.23.5", "", { "dependencies": { "@eslint/object-schema": "^3.0.5", "debug": "^4.3.1", "minimatch": "^10.2.4" } }, "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA=="],
+
+    "@eslint/config-helpers": ["@eslint/config-helpers@0.6.0", "", { "dependencies": { "@eslint/core": "^1.2.1" } }, "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA=="],
+
+    "@eslint/core": ["@eslint/core@1.2.1", "", { "dependencies": { "@types/json-schema": "^7.0.15" } }, "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ=="],
+
+    "@eslint/object-schema": ["@eslint/object-schema@3.0.5", "", {}, "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw=="],
+
+    "@eslint/plugin-kit": ["@eslint/plugin-kit@0.7.2", "", { "dependencies": { "@eslint/core": "^1.2.1", "levn": "^0.4.1" } }, "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A=="],
+
+    "@expressive-code/core": ["@expressive-code/core@0.41.7", "", { "dependencies": { "@ctrl/tinycolor": "^4.0.4", "hast-util-select": "^6.0.2", "hast-util-to-html": "^9.0.1", "hast-util-to-text": "^4.0.1", "hastscript": "^9.0.0", "postcss": "^8.4.38", "postcss-nested": "^6.0.1", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.1" } }, "sha512-ck92uZYZ9Wba2zxkiZLsZGi9N54pMSAVdrI9uW3Oo9AtLglD5RmrdTwbYPCT2S/jC36JGB2i+pnQtBm/Ib2+dg=="],
+
+    "@expressive-code/plugin-frames": ["@expressive-code/plugin-frames@0.41.7", "", { "dependencies": { "@expressive-code/core": "^0.41.7" } }, "sha512-diKtxjQw/979cTglRFaMCY/sR6hWF0kSMg8jsKLXaZBSfGS0I/Hoe7Qds3vVEgeoW+GHHQzMcwvgx/MOIXhrTA=="],
+
+    "@expressive-code/plugin-shiki": ["@expressive-code/plugin-shiki@0.41.7", "", { "dependencies": { "@expressive-code/core": "^0.41.7", "shiki": "^3.2.2" } }, "sha512-DL605bLrUOgqTdZ0Ot5MlTaWzppRkzzqzeGEu7ODnHF39IkEBbFdsC7pbl3LbUQ1DFtnfx6rD54k/cdofbW6KQ=="],
+
+    "@expressive-code/plugin-text-markers": ["@expressive-code/plugin-text-markers@0.41.7", "", { "dependencies": { "@expressive-code/core": "^0.41.7" } }, "sha512-Ewpwuc5t6eFdZmWlFyeuy3e1PTQC0jFvw2Q+2bpcWXbOZhPLsT7+h8lsSIJxb5mS7wZko7cKyQ2RLYDyK6Fpmw=="],
+
+    "@fastify/busboy": ["@fastify/busboy@2.1.1", "", {}, "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA=="],
+
+    "@fortawesome/fontawesome-free": ["@fortawesome/fontawesome-free@6.7.2", "", {}, "sha512-JUOtgFW6k9u4Y+xeIaEiLr3+cjoUPiAuLXoyKOJSia6Duzb7pq+A76P9ZdPDoAoxHdHzq6gE9/jKBGXlZT8FbA=="],
+
+    "@humanfs/core": ["@humanfs/core@0.19.2", "", { "dependencies": { "@humanfs/types": "^0.15.0" } }, "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA=="],
+
+    "@humanfs/node": ["@humanfs/node@0.16.8", "", { "dependencies": { "@humanfs/core": "^0.19.2", "@humanfs/types": "^0.15.0", "@humanwhocodes/retry": "^0.4.0" } }, "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ=="],
+
+    "@humanfs/types": ["@humanfs/types@0.15.0", "", {}, "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q=="],
+
+    "@humanwhocodes/module-importer": ["@humanwhocodes/module-importer@1.0.1", "", {}, "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA=="],
+
+    "@humanwhocodes/retry": ["@humanwhocodes/retry@0.4.3", "", {}, "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ=="],
+
+    "@iconify-json/logos": ["@iconify-json/logos@1.2.11", "", { "dependencies": { "@iconify/types": "*" } }, "sha512-fOo4pGEatuyuCFNL+cwquYMa2Im0oJHRHV7lt/Qqs5Ode/lPImHCQcfTtPzZj7qYMPb/h8YHN3TG54uEowrjNQ=="],
+
+    "@iconify-json/lucide": ["@iconify-json/lucide@1.2.110", "", { "dependencies": { "@iconify/types": "*" } }, "sha512-rLeHqnZZBxZbprbVwf6uY7HB5GkGVgvT9VujhjvaUEqFDLKZON6zR8K1f8uD1brBwf5TJ0TIvvW8mz5u2XJU+w=="],
+
+    "@iconify/react": ["@iconify/react@6.0.2", "", { "dependencies": { "@iconify/types": "^2.0.0" }, "peerDependencies": { "react": ">=16" } }, "sha512-SMmC2sactfpJD427WJEDN6PMyznTFMhByK9yLW0gOTtnjzzbsi/Ke/XqsumsavFPwNiXs8jSiYeZTmLCLwO+Fg=="],
+
+    "@iconify/types": ["@iconify/types@2.0.0", "", {}, "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg=="],
+
+    "@iconify/utils": ["@iconify/utils@3.1.3", "", { "dependencies": { "@antfu/install-pkg": "^1.1.0", "@iconify/types": "^2.0.0", "import-meta-resolve": "^4.2.0" } }, "sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw=="],
+
+    "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
+
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.2.4" }, "os": "darwin", "cpu": "arm64" }, "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w=="],
+
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.2.4" }, "os": "darwin", "cpu": "x64" }, "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw=="],
+
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.2.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g=="],
+
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.2.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg=="],
+
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.2.4", "", { "os": "linux", "cpu": "arm" }, "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A=="],
+
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw=="],
+
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.2.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA=="],
+
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.2.4", "", { "os": "linux", "cpu": "none" }, "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA=="],
+
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.2.4", "", { "os": "linux", "cpu": "s390x" }, "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ=="],
+
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw=="],
+
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw=="],
+
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg=="],
+
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.2.4" }, "os": "linux", "cpu": "arm" }, "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw=="],
+
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.2.4" }, "os": "linux", "cpu": "arm64" }, "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg=="],
+
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.2.4" }, "os": "linux", "cpu": "ppc64" }, "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA=="],
+
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.2.4" }, "os": "linux", "cpu": "none" }, "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw=="],
+
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.2.4" }, "os": "linux", "cpu": "s390x" }, "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg=="],
+
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.2.4" }, "os": "linux", "cpu": "x64" }, "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ=="],
+
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.2.4" }, "os": "linux", "cpu": "arm64" }, "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg=="],
+
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.2.4" }, "os": "linux", "cpu": "x64" }, "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q=="],
+
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.34.5", "", { "dependencies": { "@emnapi/runtime": "^1.7.0" }, "cpu": "none" }, "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw=="],
+
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.34.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g=="],
+
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.34.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg=="],
+
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.34.5", "", { "os": "win32", "cpu": "x64" }, "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw=="],
+
+    "@ioredis/commands": ["@ioredis/commands@1.10.0", "", {}, "sha512-UmeW7z4LfctwoQ5wkhVzgq8tXkreED2xZGpX+Bg+zA+WJFZCT6c062AfCK/Dfk81xZnnwdhJCUMkitihRaoC2Q=="],
+
+    "@isaacs/cliui": ["@isaacs/cliui@8.0.2", "", { "dependencies": { "string-width": "^5.1.2", "string-width-cjs": "npm:string-width@^4.2.0", "strip-ansi": "^7.0.1", "strip-ansi-cjs": "npm:strip-ansi@^6.0.1", "wrap-ansi": "^8.1.0", "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0" } }, "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA=="],
+
+    "@isaacs/fs-minipass": ["@isaacs/fs-minipass@4.0.1", "", { "dependencies": { "minipass": "^7.0.4" } }, "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w=="],
+
+    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
+
+    "@jridgewell/remapping": ["@jridgewell/remapping@2.3.5", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ=="],
+
+    "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
+
+    "@jridgewell/source-map": ["@jridgewell/source-map@0.3.11", "", { "dependencies": { "@jridgewell/gen-mapping": "^0.3.5", "@jridgewell/trace-mapping": "^0.3.25" } }, "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA=="],
+
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
+
+    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
+
+    "@js-temporal/polyfill": ["@js-temporal/polyfill@0.5.1", "", { "dependencies": { "jsbi": "^4.3.0" } }, "sha512-hloP58zRVCRSpgDxmqCWJNlizAlUgJFqG2ypq79DCvyv9tHjRYMDOcPFjzfl/A1/YxDvRCZz8wvZvmapQnKwFQ=="],
+
+    "@jsdevtools/ez-spawn": ["@jsdevtools/ez-spawn@3.0.4", "", { "dependencies": { "call-me-maybe": "^1.0.1", "cross-spawn": "^7.0.3", "string-argv": "^0.3.1", "type-detect": "^4.0.8" } }, "sha512-f5DRIOZf7wxogefH03RjMPMdBF7ADTWUMoOs9kaJo06EfwF+aFhMZMDZxHg/Xe12hptN9xoZjGso2fdjapBRIA=="],
+
+    "@libsql/client": ["@libsql/client@0.17.3", "", { "dependencies": { "@libsql/core": "^0.17.3", "@libsql/hrana-client": "^0.10.0", "js-base64": "^3.7.5", "libsql": "^0.5.28", "promise-limit": "^2.7.0" } }, "sha512-HXk9wiAoJbKFbyBH4O+aEhN6ir5ERXuXvwE5OD2eR4/5RUa3Pw/8L9zrnVdU+iNJitRvisPWaIwmhkO3bH7giA=="],
+
+    "@libsql/core": ["@libsql/core@0.17.3", "", { "dependencies": { "js-base64": "^3.7.5" } }, "sha512-2UjK1i7JBkMduJo4WdvvBxMMvVJ31pArBZNONyz/GCJJAH+1UHat2X6vn10S/WpY5fKzIT98WqYFl2vzWRLOfg=="],
+
+    "@libsql/darwin-arm64": ["@libsql/darwin-arm64@0.5.29", "", { "os": "darwin", "cpu": "arm64" }, "sha512-K+2RIB1OGFPYQbfay48GakLhqf3ArcbHqPFu7EZiaUcRgFcdw8RoltsMyvbj5ix2fY0HV3Q3Ioa/ByvQdaSM0A=="],
+
+    "@libsql/darwin-x64": ["@libsql/darwin-x64@0.5.29", "", { "os": "darwin", "cpu": "x64" }, "sha512-OtT+KFHsKFy1R5FVadr8FJ2Bb1mghtXTyJkxv0trocq7NuHntSki1eUbxpO5ezJesDvBlqFjnWaYYY516QNLhQ=="],
+
+    "@libsql/hrana-client": ["@libsql/hrana-client@0.10.0", "", { "dependencies": { "@libsql/isomorphic-ws": "^0.1.5", "js-base64": "^3.7.5" } }, "sha512-OoA4EMqRAC7kn7V2P6EQqRcpZf2W+AjsNIyCizBg339Tq/aMC7sRnzs3SklderhmQWAqEzvv8A2vhxVmWpkVvw=="],
+
+    "@libsql/isomorphic-ws": ["@libsql/isomorphic-ws@0.1.5", "", { "dependencies": { "@types/ws": "^8.5.4", "ws": "^8.13.0" } }, "sha512-DtLWIH29onUYR00i0GlQ3UdcTRC6EP4u9w/h9LxpUZJWRMARk6dQwZ6Jkd+QdwVpuAOrdxt18v0K2uIYR3fwFg=="],
+
+    "@libsql/linux-arm-gnueabihf": ["@libsql/linux-arm-gnueabihf@0.5.29", "", { "os": "linux", "cpu": "arm" }, "sha512-CD4n4zj7SJTHso4nf5cuMoWoMSS7asn5hHygsDuhRl8jjjCTT3yE+xdUvI4J7zsyb53VO5ISh4cwwOtf6k2UhQ=="],
+
+    "@libsql/linux-arm-musleabihf": ["@libsql/linux-arm-musleabihf@0.5.29", "", { "os": "linux", "cpu": "arm" }, "sha512-2Z9qBVpEJV7OeflzIR3+l5yAd4uTOLxklScYTwpZnkm2vDSGlC1PRlueLaufc4EFITkLKXK2MWBpexuNJfMVcg=="],
+
+    "@libsql/linux-arm64-gnu": ["@libsql/linux-arm64-gnu@0.5.29", "", { "os": "linux", "cpu": "arm64" }, "sha512-gURBqaiXIGGwFNEaUj8Ldk7Hps4STtG+31aEidCk5evMMdtsdfL3HPCpvys+ZF/tkOs2MWlRWoSq7SOuCE9k3w=="],
+
+    "@libsql/linux-arm64-musl": ["@libsql/linux-arm64-musl@0.5.29", "", { "os": "linux", "cpu": "arm64" }, "sha512-fwgYZ0H8mUkyVqXZHF3mT/92iIh1N94Owi/f66cPVNsk9BdGKq5gVpoKO+7UxaNzuEH1roJp2QEwsCZMvBLpqg=="],
+
+    "@libsql/linux-x64-gnu": ["@libsql/linux-x64-gnu@0.5.29", "", { "os": "linux", "cpu": "x64" }, "sha512-y14V0vY0nmMC6G0pHeJcEarcnGU2H6cm21ZceRkacWHvQAEhAG0latQkCtoS2njFOXiYIg+JYPfAoWKbi82rkg=="],
+
+    "@libsql/linux-x64-musl": ["@libsql/linux-x64-musl@0.5.29", "", { "os": "linux", "cpu": "x64" }, "sha512-gquqwA/39tH4pFl+J9n3SOMSymjX+6kZ3kWgY3b94nXFTwac9bnFNMffIomgvlFaC4ArVqMnOZD3nuJ3H3VO1w=="],
+
+    "@libsql/win32-x64-msvc": ["@libsql/win32-x64-msvc@0.5.29", "", { "os": "win32", "cpu": "x64" }, "sha512-4/0CvEdhi6+KjMxMaVbFM2n2Z44escBRoEYpR+gZg64DdetzGnYm8mcNLcoySaDJZNaBd6wz5DNdgRmcI4hXcg=="],
+
+    "@mapbox/node-pre-gyp": ["@mapbox/node-pre-gyp@2.0.3", "", { "dependencies": { "consola": "^3.2.3", "detect-libc": "^2.0.0", "https-proxy-agent": "^7.0.5", "node-fetch": "^2.6.7", "nopt": "^8.0.0", "semver": "^7.5.3", "tar": "^7.4.0" }, "bin": { "node-pre-gyp": "bin/node-pre-gyp" } }, "sha512-uwPAhccfFJlsfCxMYTwOdVfOz3xqyj8xYL3zJj8f0pb30tLohnnFPhLuqp4/qoEz8sNxe4SESZedcBojRefIzg=="],
+
+    "@mdx-js/mdx": ["@mdx-js/mdx@3.1.1", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "@types/mdx": "^2.0.0", "acorn": "^8.0.0", "collapse-white-space": "^2.0.0", "devlop": "^1.0.0", "estree-util-is-identifier-name": "^3.0.0", "estree-util-scope": "^1.0.0", "estree-walker": "^3.0.0", "hast-util-to-jsx-runtime": "^2.0.0", "markdown-extensions": "^2.0.0", "recma-build-jsx": "^1.0.0", "recma-jsx": "^1.0.0", "recma-stringify": "^1.0.0", "rehype-recma": "^1.0.0", "remark-mdx": "^3.0.0", "remark-parse": "^11.0.0", "remark-rehype": "^11.0.0", "source-map": "^0.7.0", "unified": "^11.0.0", "unist-util-position-from-estree": "^2.0.0", "unist-util-stringify-position": "^4.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0" } }, "sha512-f6ZO2ifpwAQIpzGWaBQT2TXxPv6z3RBzQKpVftEWN78Vl/YweF1uwussDx8ECAXVtr3Rs89fKyG9YlzUs9DyGQ=="],
+
+    "@mermaid-js/parser": ["@mermaid-js/parser@1.1.1", "", { "dependencies": { "@chevrotain/types": "~11.1.1" } }, "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw=="],
+
+    "@monorepo-multi-stack/backend": ["@monorepo-multi-stack/backend@workspace:examples/monorepo-multi-stack/backend"],
+
+    "@monorepo-multi-stack/frontend": ["@monorepo-multi-stack/frontend@workspace:examples/monorepo-multi-stack/frontend"],
+
+    "@monorepo-single-stack/backend": ["@monorepo-single-stack/backend@workspace:examples/monorepo-single-stack/backend"],
+
+    "@monorepo-single-stack/frontend": ["@monorepo-single-stack/frontend@workspace:examples/monorepo-single-stack/frontend"],
+
+    "@msgpackr-extract/msgpackr-extract-darwin-arm64": ["@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ=="],
+
+    "@msgpackr-extract/msgpackr-extract-darwin-x64": ["@msgpackr-extract/msgpackr-extract-darwin-x64@3.0.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w=="],
+
+    "@msgpackr-extract/msgpackr-extract-linux-arm": ["@msgpackr-extract/msgpackr-extract-linux-arm@3.0.4", "", { "os": "linux", "cpu": "arm" }, "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw=="],
+
+    "@msgpackr-extract/msgpackr-extract-linux-arm64": ["@msgpackr-extract/msgpackr-extract-linux-arm64@3.0.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw=="],
+
+    "@msgpackr-extract/msgpackr-extract-linux-x64": ["@msgpackr-extract/msgpackr-extract-linux-x64@3.0.4", "", { "os": "linux", "cpu": "x64" }, "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ=="],
+
+    "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.4", "", { "os": "win32", "cpu": "x64" }, "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ=="],
+
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
+
+    "@neon-rs/load": ["@neon-rs/load@0.0.4", "", {}, "sha512-kTPhdZyTQxB+2wpiRcFWrDcejc4JI6tkPuS7UZCG4l6Zvc5kU/gGQ/ozvHTh1XR5tS+UlfAfGuPajjzQjCiHCw=="],
+
+    "@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="],
+
+    "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
+
+    "@nodable/entities": ["@nodable/entities@2.1.1", "", {}, "sha512-Pig3HxDIoMgjdEH8OCf/dkcTmLFjJRjWuq8jSnklu284/TKOPibSRERmOykiwmyXTtv61mP+44f3GMx0tLAyjg=="],
+
+    "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="],
+
+    "@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="],
+
+    "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="],
+
+    "@nothing-but/utils": ["@nothing-but/utils@0.17.0", "", {}, "sha512-TuCHcHLOqDL0SnaAxACfuRHBNRgNJcNn9X0GiH5H3YSDBVquCr3qEIG3FOQAuMyZCbu9w8nk2CHhOsn7IvhIwQ=="],
+
+    "@octokit/action": ["@octokit/action@6.1.0", "", { "dependencies": { "@octokit/auth-action": "^4.0.0", "@octokit/core": "^5.0.0", "@octokit/plugin-paginate-rest": "^9.0.0", "@octokit/plugin-rest-endpoint-methods": "^10.0.0", "@octokit/types": "^12.0.0", "undici": "^6.0.0" } }, "sha512-lo+nHx8kAV86bxvOVOI3vFjX3gXPd/L7guAUbvs3pUvnR2KC+R7yjBkA1uACt4gYhs4LcWP3AXSGQzsbeN2XXw=="],
+
+    "@octokit/auth-action": ["@octokit/auth-action@4.1.0", "", { "dependencies": { "@octokit/auth-token": "^4.0.0", "@octokit/types": "^13.0.0" } }, "sha512-m+3t7K46IYyMk7Bl6/lF4Rv09GqDZjYmNg8IWycJ2Fa3YE3DE7vQcV6G2hUPmR9NDqenefNJwVtlisMjzymPiQ=="],
+
+    "@octokit/auth-token": ["@octokit/auth-token@6.0.0", "", {}, "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="],
+
+    "@octokit/core": ["@octokit/core@7.0.6", "", { "dependencies": { "@octokit/auth-token": "^6.0.0", "@octokit/graphql": "^9.0.3", "@octokit/request": "^10.0.6", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q=="],
+
+    "@octokit/endpoint": ["@octokit/endpoint@11.0.3", "", { "dependencies": { "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.2" } }, "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag=="],
+
+    "@octokit/graphql": ["@octokit/graphql@9.0.3", "", { "dependencies": { "@octokit/request": "^10.0.6", "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA=="],
+
+    "@octokit/openapi-types": ["@octokit/openapi-types@20.0.0", "", {}, "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="],
+
+    "@octokit/plugin-paginate-rest": ["@octokit/plugin-paginate-rest@14.0.0", "", { "dependencies": { "@octokit/types": "^16.0.0" }, "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw=="],
+
+    "@octokit/plugin-request-log": ["@octokit/plugin-request-log@6.0.0", "", { "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q=="],
+
+    "@octokit/plugin-rest-endpoint-methods": ["@octokit/plugin-rest-endpoint-methods@17.0.0", "", { "dependencies": { "@octokit/types": "^16.0.0" }, "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw=="],
+
+    "@octokit/request": ["@octokit/request@10.0.10", "", { "dependencies": { "@octokit/endpoint": "^11.0.3", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "content-type": "^2.0.0", "json-with-bigint": "^3.5.3", "universal-user-agent": "^7.0.2" } }, "sha512-KxNC2pTqqhszMNrf12ZRd4PonRgyJdsM4F/jySiddQK+DsRcfBtUvqn8t7UsyZhnRJHvX46OohDt5N3VqIWC2w=="],
+
+    "@octokit/request-error": ["@octokit/request-error@7.1.0", "", { "dependencies": { "@octokit/types": "^16.0.0" } }, "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw=="],
+
+    "@octokit/rest": ["@octokit/rest@22.0.1", "", { "dependencies": { "@octokit/core": "^7.0.6", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-request-log": "^6.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0" } }, "sha512-Jzbhzl3CEexhnivb1iQ0KJ7s5vvjMWcmRtq5aUsKmKDrRW6z3r84ngmiFKFvpZjpiU/9/S6ITPFRpn5s/3uQJw=="],
+
+    "@octokit/types": ["@octokit/types@12.6.0", "", { "dependencies": { "@octokit/openapi-types": "^20.0.0" } }, "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw=="],
+
+    "@oozcitak/dom": ["@oozcitak/dom@2.0.2", "", { "dependencies": { "@oozcitak/infra": "^2.0.2", "@oozcitak/url": "^3.0.0", "@oozcitak/util": "^10.0.0" } }, "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w=="],
+
+    "@oozcitak/infra": ["@oozcitak/infra@2.0.2", "", { "dependencies": { "@oozcitak/util": "^10.0.0" } }, "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA=="],
+
+    "@oozcitak/url": ["@oozcitak/url@3.0.0", "", { "dependencies": { "@oozcitak/infra": "^2.0.2", "@oozcitak/util": "^10.0.0" } }, "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ=="],
+
+    "@oozcitak/util": ["@oozcitak/util@10.0.0", "", {}, "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA=="],
+
+    "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.41.1", "", {}, "sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA=="],
+
+    "@oslojs/encoding": ["@oslojs/encoding@1.1.0", "", {}, "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ=="],
+
+    "@oxc-project/types": ["@oxc-project/types@0.127.0", "", {}, "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ=="],
+
+    "@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.52.0", "", { "os": "android", "cpu": "arm" }, "sha512-17EMSJnQ9g+upVHrAUYDMfH5lvRKQ9Nvg8WtEoH72oDr1VpWz+7/o3tD97U1EToen2YAQ/68JmtDYkQUi20dfQ=="],
+
+    "@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.52.0", "", { "os": "android", "cpu": "arm64" }, "sha512-A2G1IdwGEW2lLJkIxcvuirRH1CzSl/e0NX11zTlW1gvxJThfwbI/BEoaKrTNpm7M2FchvIf6guvIQU7d5iz+OQ=="],
+
+    "@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.52.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-f9+bLvOYxy7NttCLFTvQ7afmqDOWY4wIP9xdvfj5trQ1qj6f2UFAGwZESlfsMjvJNTyRpXfIlOanCI9FOvoeQA=="],
+
+    "@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.52.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-YSTB9sJ5nnQd/Q0ddHkgof0ZCHPAnWZT1IW2SJ8omz7CP7KluJhO1fNHrpqdxCtpztJwSs4hY1uAee35wKxxaw=="],
+
+    "@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.52.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-NIrRNTTPCs4UbmVs0bxLSCDlLCtIRMJIXklNKaXa5Oj2/K1UIMBvgE8+uPVo01Io3N9HF0+GAX+aAHjUgZS7vA=="],
+
+    "@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.52.0", "", { "os": "linux", "cpu": "arm" }, "sha512-JXUCde8mn3GpgQouz2PXUokgy/uT1QrRJBL2s983VWcSQp62wTFYiNXgTKdeo1Jgbr0IgUnKKvzIk/YBlj/nVQ=="],
+
+    "@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.52.0", "", { "os": "linux", "cpu": "arm" }, "sha512-psbUXaRZ+V8DaXz10Qf7LSHtdtdKAmC8fxXgeU608jjzrmWK4quamZMOpl6sf+dikoFHA85uE93Q0BqxrCdQrQ=="],
+
+    "@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.52.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Jw7MgWUU9lcLCcy82updISP3EthTlfvAwR6gWNxPzqly7+fLvOi2gHQE9xXQjpqaVLm/8P+gOzlv9ODuoVlaaw=="],
+
+    "@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.52.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-wZg6bLjDvh2KibyI3QFUYo8GTXneIFsd0JvehtvJiUmQ8WRPERgxd/VM4ctWb86U5FT1FkqgS8/wZKVB+AZScg=="],
+
+    "@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.52.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-IngE8uxhNvxcMrLjZNDo9xNLY7rEK33AKnaMd2B46he1e/mz2CfcW6If/U1wUjdRZddm1QzQaciqZkuMkdh1FA=="],
+
+    "@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.52.0", "", { "os": "linux", "cpu": "none" }, "sha512-H3+DdFMv/efN3Efmhsv18jDrpiWWqKG7wsfAlQBqAt6z/E2Bx+TwEj2Nowe51CPOWB8/mFBC2dAMSgVFLvvowA=="],
+
+    "@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.52.0", "", { "os": "linux", "cpu": "none" }, "sha512-zji+1kb7lJKohSDjzC1IsS+K/cKRs1hdVf0ZH0VbdbiakmtLvN9twBoXo/k8VdjFax7kfo+DyPxS7vv52br1aw=="],
+
+    "@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.52.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-hcLBYedpCy7ToUvvBidWk7+11Yhg1oAZ4+6hKPic/mQI6NaqXJSXMps5nFlwUuX2ewhtLZZDPg63TI042qGKBg=="],
+
+    "@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.52.0", "", { "os": "linux", "cpu": "x64" }, "sha512-IDO2loXK2OtTOhSPchU9MW25mWL2QCDGdJbjN8MXKZVS80qXe5gMTwQWu/gMJ3juoBHbkuUZNB2N1LHzNT7DoA=="],
+
+    "@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.52.0", "", { "os": "linux", "cpu": "x64" }, "sha512-mAV2Hjn0SatJ+KoAzKUC3eJhdJ8wv+3m1KyuS0dTsbF0c5weq+QrCt/DRZZM+uj/XiKzCDEUKYsBF30e2qkcyw=="],
+
+    "@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.52.0", "", { "os": "none", "cpu": "arm64" }, "sha512-vd4npaUIwChxp7XzkqmepBWTT9YMcSe/NBApVGPC30/lLyOVaV3dvma1SKo03t8O73BPRAG7EyJzGlN5cJM5hQ=="],
+
+    "@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.52.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-k2sz6gWQdMfh5HPpIS+Bw/0UEV/kaK2xuqJRrWL233sEHx9WLlsmvlPFM4HUNThkYbSN0U0vPW7LVKZWDS8hPQ=="],
+
+    "@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.52.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-rhke69GTcArodLHpjMTfNnvjTEBryDeZcUCKK/VjXDMtfTULl6QRh0ymX5/hbCUv2WjYm9h/QbW++q2vE15gWQ=="],
+
+    "@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.52.0", "", { "os": "win32", "cpu": "x64" }, "sha512-q5xL7oeXkZdEtNZWBdvehJcmt+GRu9l2bK40yJs1jJXlqq+r0Hygb1rTjq+FM2o/2xyt4cufH6KRplHp3Jjsvw=="],
+
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.67.0", "", { "os": "android", "cpu": "arm" }, "sha512-VrSi571rDv1N8HaEDM+DEX8nmT0y9jJo8tzzW13vsOWTx59xQczCIJx68n2zWOXRT5YKZsOZXp4qkHN/10x4mw=="],
+
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.67.0", "", { "os": "android", "cpu": "arm64" }, "sha512-l6+NdYxMoRohix5r5bbigW16LPicceCwGcQ6LKKuE1kUdjgFfQolJjrJsQYPFetIs78Gxj/G/f5TEGoTCwj9nQ=="],
+
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.67.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-jOzXxS1AxFxhImLIRbtGIMrEwaXcgMw3gR57WB1cRk8ai+vpr6726kxXqVvlNsrXtJ/FrmOm8RxlC0m8SW24Qg=="],
+
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.67.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-3DFAVY94OqjIZHXIPz37yGRSWwOFTAqChQ64/M69GYLawzP0KiwdhDNfqdKKYT0bTR/DNxmMnQsj3ns+8+X/Lg=="],
+
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.67.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-e4dDKZuLu8TR9DEBssWSDahlPgZBwojTTHZUvnjBRJfJJbpxYCjfjKfi0Z1+CSLMiJBwI2yCDtRM1XJQaARjmg=="],
+
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.67.0", "", { "os": "linux", "cpu": "arm" }, "sha512-BKytFdcQzbITV3xlnzDUDTEDtbUMCCiC4EaNTDZ4FyT8gdNvBC4gfiLucXp/sQl0XU3p7syTlorUWVVVBZab2g=="],
+
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.67.0", "", { "os": "linux", "cpu": "arm" }, "sha512-XYAv0esBDX7BpTzRDjVX2Vdj+zndd8ll2dFQiaeQ6zTZr7A8GRDTN7fH3FP3jU+O0vCDx85oH/EtG7BzPgAXuw=="],
+
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.67.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zizRMjA0i6u/2B0evgda04iycu+MoNuf1pBy6Eh+1CjC5wMEG7qN5zdDKTCvFc0KSYSDM9QTG3gjZHirgtQuKg=="],
+
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.67.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-zB/Tf6sUjmmvvbva9Gj3JTJ8rJ9t4I8/U0o6vSRtd0DRIsIuyegBwJAzhSUFQHdMijIRJkW0exs/yBhpw2S20w=="],
+
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.67.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-kgU40Gt74CK0TCsF51KZymkIwN9U0BajKsMijB52zPqOeZU9NAHkA/NSQkZDHEaCakx42DxhXkODiAqf2b4Gug=="],
+
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.67.0", "", { "os": "linux", "cpu": "none" }, "sha512-tOYhkk/iaG9aD3FvGpBFd1Lrw0x0RaVoJBxjUkfNzS50rC5NS5BteNCwgr8A2zCdADrIIoze6D7u6U5Ic++/iQ=="],
+
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.67.0", "", { "os": "linux", "cpu": "none" }, "sha512-sEtywrPb+0b+tHYl1SDCrw903fiC4eyKoNqzP3v+f2JT3Xcv4NEYG+P8rj+eEnX7IWhqV/xj8/JmcmVj21CXaA=="],
+
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.67.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-BvR8Moa0zCLxroOx4vZaZN9nUfwAUpSTwjZdxZyKy4bv3PrzrXrxKR/ZQ0L9wNSvlPhnMJeZfa3q5w6ZCTuN6Q=="],
+
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.67.0", "", { "os": "linux", "cpu": "x64" }, "sha512-mm2cxM6fksOpq6l0uFws8BUGKAR4dNa/cZCn37Npq7PFbhD5HDJqWfnoIvTaeRKMy5XdS2tO0MA0qbHDrnXAAA=="],
+
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.67.0", "", { "os": "linux", "cpu": "x64" }, "sha512-WmbMuLapKyDlobMkXAaAL0Y+Uczh4LETfIfQsUpbId4Ip8Ai82/jqeYTOoUCkuuhBFapgqP253+d83tLKOksJg=="],
+
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.67.0", "", { "os": "none", "cpu": "arm64" }, "sha512-9g/PqxYJelzzTAOR5Y+RiRqdeydhEuXv2KxNeFcAKQ7UsvnWSY1OP4MsuPMbTO2Pf70tz7mFhl1j13H3fyh+8g=="],
+
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.67.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-2VhwE6Gatb0vJGnN0TBuQMbKCOiZlSQ/zJvVWYLK4a9d4iDiJOen/yVQkGpmsJ90MuH66fzi0kEKI0jRQMDxGA=="],
+
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.67.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-EQ3VExXfeM1InbE5+JjufhZZTWy+kHUwgt3yZR7gQ47Je/mE0WspQPan0OJznh493L5anM210YNJtH1PXjTSFg=="],
+
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.67.0", "", { "os": "win32", "cpu": "x64" }, "sha512-bw24y+/1MHS4QDkons3YyHkPT9uCMoLHHgQhb+mb8NOjTYwub1CZ+K9Ngr8aO5DMrDrkqHwTzlTwFP2vS8Y/ZQ=="],
+
+    "@pagefind/darwin-arm64": ["@pagefind/darwin-arm64@1.5.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-MXpI+7HsAdPkvJ0gk9xj9g541BCqBZOBbdwj9g6lB5LCj6kSV6nqDSjzcAJwvOsfu0fjwvC8hQU+ecfhp+MpiQ=="],
+
+    "@pagefind/darwin-x64": ["@pagefind/darwin-x64@1.5.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-IojxFWMEJe0RQ7PQ3KXQsPIImNsbpPYpoZ+QUDrL8fAl/O27IX+LVLs74/UzEZy5uA2LD8Nz1AiwKr72vrkZQw=="],
+
+    "@pagefind/default-ui": ["@pagefind/default-ui@1.5.2", "", {}, "sha512-pm1LMnQg8N2B3n2TnjKlhaFihpz6zTiA4HiGQ6/slKO/+8K9CAU5kcjdSSPgpuk1PMuuN4hxLipUIifnrkl3Sg=="],
+
+    "@pagefind/freebsd-x64": ["@pagefind/freebsd-x64@1.5.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-7EVzo9+0w+2cbe671BtMj10UlNo83I+HrLVLfRxO731svHRJKUfJ/mo05gU14pe9PCfpKNQT8FS3Xc/oDN6pOA=="],
+
+    "@pagefind/linux-arm64": ["@pagefind/linux-arm64@1.5.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-Ovt9+K35sqzn8H3ZMXGwls4TD/wMJuvRtShHIsmUQREmaxjrDEX7gHckRCrwYJ4XE1H1p6HkLz3wukrAnsfXQw=="],
+
+    "@pagefind/linux-x64": ["@pagefind/linux-x64@1.5.2", "", { "os": "linux", "cpu": "x64" }, "sha512-V+tFqHKXhQKq/WqPBD67AFy7scn1/aZID00ws4fSDd+1daSi5UHR9VVlRrOUYKxn3VuFQYRD7lYXdZK1WED1YA=="],
+
+    "@pagefind/windows-arm64": ["@pagefind/windows-arm64@1.5.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-hN9Nh90fNW61nNRCW9ZyQrAj/mD0eRvmJ8NlTUzkbuW8kIzGJUi3cxjFkEcMZ5h/8FsKWD/VcouZl4yo1F7B6g=="],
+
+    "@pagefind/windows-x64": ["@pagefind/windows-x64@1.5.2", "", { "os": "win32", "cpu": "x64" }, "sha512-Fa2Iyw7kaDRzGMfNYNUXNW2zbL5FQVDgSOcbDHdzBrDEdpqOqg8TcZ68F22ol6NJ9IGzvUdmeyZypLW5dyhqsg=="],
+
+    "@parcel/watcher": ["@parcel/watcher@2.5.6", "", { "dependencies": { "detect-libc": "^2.0.3", "is-glob": "^4.0.3", "node-addon-api": "^7.0.0", "picomatch": "^4.0.3" }, "optionalDependencies": { "@parcel/watcher-android-arm64": "2.5.6", "@parcel/watcher-darwin-arm64": "2.5.6", "@parcel/watcher-darwin-x64": "2.5.6", "@parcel/watcher-freebsd-x64": "2.5.6", "@parcel/watcher-linux-arm-glibc": "2.5.6", "@parcel/watcher-linux-arm-musl": "2.5.6", "@parcel/watcher-linux-arm64-glibc": "2.5.6", "@parcel/watcher-linux-arm64-musl": "2.5.6", "@parcel/watcher-linux-x64-glibc": "2.5.6", "@parcel/watcher-linux-x64-musl": "2.5.6", "@parcel/watcher-win32-arm64": "2.5.6", "@parcel/watcher-win32-ia32": "2.5.6", "@parcel/watcher-win32-x64": "2.5.6" } }, "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ=="],
+
+    "@parcel/watcher-android-arm64": ["@parcel/watcher-android-arm64@2.5.6", "", { "os": "android", "cpu": "arm64" }, "sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A=="],
+
+    "@parcel/watcher-darwin-arm64": ["@parcel/watcher-darwin-arm64@2.5.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA=="],
+
+    "@parcel/watcher-darwin-x64": ["@parcel/watcher-darwin-x64@2.5.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg=="],
+
+    "@parcel/watcher-freebsd-x64": ["@parcel/watcher-freebsd-x64@2.5.6", "", { "os": "freebsd", "cpu": "x64" }, "sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng=="],
+
+    "@parcel/watcher-linux-arm-glibc": ["@parcel/watcher-linux-arm-glibc@2.5.6", "", { "os": "linux", "cpu": "arm" }, "sha512-9JiYfB6h6BgV50CCfasfLf/uvOcJskMSwcdH1PHH9rvS1IrNy8zad6IUVPVUfmXr+u+Km9IxcfMLzgdOudz9EQ=="],
+
+    "@parcel/watcher-linux-arm-musl": ["@parcel/watcher-linux-arm-musl@2.5.6", "", { "os": "linux", "cpu": "arm" }, "sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg=="],
+
+    "@parcel/watcher-linux-arm64-glibc": ["@parcel/watcher-linux-arm64-glibc@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA=="],
+
+    "@parcel/watcher-linux-arm64-musl": ["@parcel/watcher-linux-arm64-musl@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA=="],
+
+    "@parcel/watcher-linux-x64-glibc": ["@parcel/watcher-linux-x64-glibc@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ=="],
+
+    "@parcel/watcher-linux-x64-musl": ["@parcel/watcher-linux-x64-musl@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg=="],
+
+    "@parcel/watcher-wasm": ["@parcel/watcher-wasm@2.5.6", "", { "dependencies": { "is-glob": "^4.0.3", "napi-wasm": "^1.1.0", "picomatch": "^4.0.3" } }, "sha512-byAiBZ1t3tXQvc8dMD/eoyE7lTXYorhn+6uVW5AC+JGI1KtJC/LvDche5cfUE+qiefH+Ybq0bUCJU0aB1cSHUA=="],
+
+    "@parcel/watcher-win32-arm64": ["@parcel/watcher-win32-arm64@2.5.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q=="],
+
+    "@parcel/watcher-win32-ia32": ["@parcel/watcher-win32-ia32@2.5.6", "", { "os": "win32", "cpu": "ia32" }, "sha512-k35yLp1ZMwwee3Ez/pxBi5cf4AoBKYXj00CZ80jUz5h8prpiaQsiRPKQMxoLstNuqe2vR4RNPEAEcjEFzhEz/g=="],
+
+    "@parcel/watcher-win32-x64": ["@parcel/watcher-win32-x64@2.5.6", "", { "os": "win32", "cpu": "x64" }, "sha512-hbQlYcCq5dlAX9Qx+kFb0FHue6vbjlf0FrNzSKdYK2APUf7tGfGxQCk2ihEREmbR6ZMc0MVAD5RIX/41gpUzTw=="],
+
+    "@pkgjs/parseargs": ["@pkgjs/parseargs@0.11.0", "", {}, "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg=="],
+
+    "@polka/url": ["@polka/url@1.0.0-next.29", "", {}, "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww=="],
+
+    "@poppinss/colors": ["@poppinss/colors@4.1.6", "", { "dependencies": { "kleur": "^4.1.5" } }, "sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg=="],
+
+    "@poppinss/dumper": ["@poppinss/dumper@0.6.5", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw=="],
+
+    "@poppinss/exception": ["@poppinss/exception@1.2.3", "", {}, "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw=="],
+
+    "@prettier/sync": ["@prettier/sync@0.6.1", "", { "dependencies": { "make-synchronized": "^0.8.0" }, "peerDependencies": { "prettier": "*" } }, "sha512-yF9G8vK/LYUTF3Cijd7VC9La3b20F20/J/fgoR4H0B8JGOWnZVZX6+I6+vODPosjmMcpdlUV+gUqJQZp3kLOcw=="],
+
+    "@puppeteer/browsers": ["@puppeteer/browsers@2.2.4", "", { "dependencies": { "debug": "^4.3.5", "extract-zip": "^2.0.1", "progress": "^2.0.3", "proxy-agent": "^6.4.0", "semver": "^7.6.2", "tar-fs": "^3.0.6", "unbzip2-stream": "^1.4.3", "yargs": "^17.7.2" }, "bin": { "browsers": "lib/cjs/main-cli.js" } }, "sha512-BdG2qiI1dn89OTUUsx2GZSpUzW+DRffR1wlMJyKxVHYrhnKoELSDxDd+2XImUkuWPEKk76H5FcM/gPFrEK1Tfw=="],
+
+    "@quansync/fs": ["@quansync/fs@1.0.0", "", { "dependencies": { "quansync": "^1.0.0" } }, "sha512-4TJ3DFtlf1L5LDMaM6CanJ/0lckGNtJcMjQ1NAV6zDmA0tEHKZtxNKin8EgPaVX1YzljbxckyT2tJrpQKAtngQ=="],
+
+    "@resvg/resvg-js": ["@resvg/resvg-js@2.6.2", "", { "optionalDependencies": { "@resvg/resvg-js-android-arm-eabi": "2.6.2", "@resvg/resvg-js-android-arm64": "2.6.2", "@resvg/resvg-js-darwin-arm64": "2.6.2", "@resvg/resvg-js-darwin-x64": "2.6.2", "@resvg/resvg-js-linux-arm-gnueabihf": "2.6.2", "@resvg/resvg-js-linux-arm64-gnu": "2.6.2", "@resvg/resvg-js-linux-arm64-musl": "2.6.2", "@resvg/resvg-js-linux-x64-gnu": "2.6.2", "@resvg/resvg-js-linux-x64-musl": "2.6.2", "@resvg/resvg-js-win32-arm64-msvc": "2.6.2", "@resvg/resvg-js-win32-ia32-msvc": "2.6.2", "@resvg/resvg-js-win32-x64-msvc": "2.6.2" } }, "sha512-xBaJish5OeGmniDj9cW5PRa/PtmuVU3ziqrbr5xJj901ZDN4TosrVaNZpEiLZAxdfnhAe7uQ7QFWfjPe9d9K2Q=="],
+
+    "@resvg/resvg-js-android-arm-eabi": ["@resvg/resvg-js-android-arm-eabi@2.6.2", "", { "os": "android", "cpu": "arm" }, "sha512-FrJibrAk6v29eabIPgcTUMPXiEz8ssrAk7TXxsiZzww9UTQ1Z5KAbFJs+Z0Ez+VZTYgnE5IQJqBcoSiMebtPHA=="],
+
+    "@resvg/resvg-js-android-arm64": ["@resvg/resvg-js-android-arm64@2.6.2", "", { "os": "android", "cpu": "arm64" }, "sha512-VcOKezEhm2VqzXpcIJoITuvUS/fcjIw5NA/w3tjzWyzmvoCdd+QXIqy3FBGulWdClvp4g+IfUemigrkLThSjAQ=="],
+
+    "@resvg/resvg-js-darwin-arm64": ["@resvg/resvg-js-darwin-arm64@2.6.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-nmok2LnAd6nLUKI16aEB9ydMC6Lidiiq2m1nEBDR1LaaP7FGs4AJ90qDraxX+CWlVuRlvNjyYJTNv8qFjtL9+A=="],
+
+    "@resvg/resvg-js-darwin-x64": ["@resvg/resvg-js-darwin-x64@2.6.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-GInyZLjgWDfsVT6+SHxQVRwNzV0AuA1uqGsOAW+0th56J7Nh6bHHKXHBWzUrihxMetcFDmQMAX1tZ1fZDYSRsw=="],
+
+    "@resvg/resvg-js-linux-arm-gnueabihf": ["@resvg/resvg-js-linux-arm-gnueabihf@2.6.2", "", { "os": "linux", "cpu": "arm" }, "sha512-YIV3u/R9zJbpqTTNwTZM5/ocWetDKGsro0SWp70eGEM9eV2MerWyBRZnQIgzU3YBnSBQ1RcxRZvY/UxwESfZIw=="],
+
+    "@resvg/resvg-js-linux-arm64-gnu": ["@resvg/resvg-js-linux-arm64-gnu@2.6.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-zc2BlJSim7YR4FZDQ8OUoJg5holYzdiYMeobb9pJuGDidGL9KZUv7SbiD4E8oZogtYY42UZEap7dqkkYuA91pg=="],
+
+    "@resvg/resvg-js-linux-arm64-musl": ["@resvg/resvg-js-linux-arm64-musl@2.6.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-3h3dLPWNgSsD4lQBJPb4f+kvdOSJHa5PjTYVsWHxLUzH4IFTJUAnmuWpw4KqyQ3NA5QCyhw4TWgxk3jRkQxEKg=="],
+
+    "@resvg/resvg-js-linux-x64-gnu": ["@resvg/resvg-js-linux-x64-gnu@2.6.2", "", { "os": "linux", "cpu": "x64" }, "sha512-IVUe+ckIerA7xMZ50duAZzwf1U7khQe2E0QpUxu5MBJNao5RqC0zwV/Zm965vw6D3gGFUl7j4m+oJjubBVoftw=="],
+
+    "@resvg/resvg-js-linux-x64-musl": ["@resvg/resvg-js-linux-x64-musl@2.6.2", "", { "os": "linux", "cpu": "x64" }, "sha512-UOf83vqTzoYQO9SZ0fPl2ZIFtNIz/Rr/y+7X8XRX1ZnBYsQ/tTb+cj9TE+KHOdmlTFBxhYzVkP2lRByCzqi4jQ=="],
+
+    "@resvg/resvg-js-win32-arm64-msvc": ["@resvg/resvg-js-win32-arm64-msvc@2.6.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-7C/RSgCa+7vqZ7qAbItfiaAWhyRSoD4l4BQAbVDqRRsRgY+S+hgS3in0Rxr7IorKUpGE69X48q6/nOAuTJQxeQ=="],
+
+    "@resvg/resvg-js-win32-ia32-msvc": ["@resvg/resvg-js-win32-ia32-msvc@2.6.2", "", { "os": "win32", "cpu": "ia32" }, "sha512-har4aPAlvjnLcil40AC77YDIk6loMawuJwFINEM7n0pZviwMkMvjb2W5ZirsNOZY4aDbo5tLx0wNMREp5Brk+w=="],
+
+    "@resvg/resvg-js-win32-x64-msvc": ["@resvg/resvg-js-win32-x64-msvc@2.6.2", "", { "os": "win32", "cpu": "x64" }, "sha512-ZXtYhtUr5SSaBrUDq7DiyjOFJqBVL/dOBN7N/qmi/pO0IgiWW/f/ue3nbvu9joWE5aAKDoIzy/CxsY0suwGosQ=="],
+
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.1", "", { "os": "android", "cpu": "arm64" }, "sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg=="],
+
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg=="],
+
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg=="],
+
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw=="],
+
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.1", "", { "os": "linux", "cpu": "arm" }, "sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ=="],
+
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A=="],
+
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg=="],
+
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg=="],
+
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ=="],
+
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.1", "", { "os": "linux", "cpu": "x64" }, "sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw=="],
+
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.1", "", { "os": "linux", "cpu": "x64" }, "sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ=="],
+
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.1", "", { "os": "none", "cpu": "arm64" }, "sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ=="],
+
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.1", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ=="],
+
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw=="],
+
+    "@rolldown/binding-win32-ia32-msvc": ["@rolldown/binding-win32-ia32-msvc@1.0.0-beta.45", "", { "os": "win32", "cpu": "ia32" }, "sha512-wODcGzlfxqS6D7BR0srkJk3drPwXYLu7jPHN27ce2c4PUnVVmJnp9mJzUQGT4LpmHmmVdMZ+P6hKvyTGBzc1CA=="],
+
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.1", "", { "os": "win32", "cpu": "x64" }, "sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ=="],
+
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
+
+    "@rollup/plugin-alias": ["@rollup/plugin-alias@6.0.0", "", { "peerDependencies": { "rollup": ">=4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-tPCzJOtS7uuVZd+xPhoy5W4vThe6KWXNmsFCNktaAh5RTqcLiSfT4huPQIXkgJ6YCOjJHvecOAzQxLFhPxKr+g=="],
+
+    "@rollup/plugin-commonjs": ["@rollup/plugin-commonjs@29.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "commondir": "^1.0.1", "estree-walker": "^2.0.2", "fdir": "^6.2.0", "is-reference": "1.2.1", "magic-string": "^0.30.3", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^2.68.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-ZaOxZceP7SOUW7Lqw5IRVweSQYWaeIPnXIGLiB690EBA3FGJTO40EEr2L5yZplJWsgTCogILRSpcAe7+U0Otdg=="],
+
+    "@rollup/plugin-inject": ["@rollup/plugin-inject@5.0.5", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "estree-walker": "^2.0.2", "magic-string": "^0.30.3" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-2+DEJbNBoPROPkgTDNe8/1YXWcqxbN5DTjASVIOx8HS+pITXushyNiBV56RB08zuptzz8gT3YfkqriTBVycepg=="],
+
+    "@rollup/plugin-json": ["@rollup/plugin-json@6.1.0", "", { "dependencies": { "@rollup/pluginutils": "^5.1.0" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA=="],
+
+    "@rollup/plugin-node-resolve": ["@rollup/plugin-node-resolve@16.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "@types/resolve": "1.20.2", "deepmerge": "^4.2.2", "is-module": "^1.0.0", "resolve": "^1.22.1" }, "peerDependencies": { "rollup": "^2.78.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg=="],
+
+    "@rollup/plugin-replace": ["@rollup/plugin-replace@6.0.3", "", { "dependencies": { "@rollup/pluginutils": "^5.0.1", "magic-string": "^0.30.3" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA=="],
+
+    "@rollup/plugin-terser": ["@rollup/plugin-terser@1.0.0", "", { "dependencies": { "serialize-javascript": "^7.0.3", "smob": "^1.0.0", "terser": "^5.17.4" }, "peerDependencies": { "rollup": "^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-FnCxhTBx6bMOYQrar6C8h3scPt8/JwIzw3+AJ2K++6guogH5fYaIFia+zZuhqv0eo1RN7W1Pz630SyvLbDjhtQ=="],
+
+    "@rollup/pluginutils": ["@rollup/pluginutils@5.4.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-walker": "^2.0.2", "picomatch": "^4.0.2" }, "peerDependencies": { "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0" }, "optionalPeers": ["rollup"] }, "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg=="],
+
+    "@rollup/rollup-android-arm-eabi": ["@rollup/rollup-android-arm-eabi@4.60.4", "", { "os": "android", "cpu": "arm" }, "sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ=="],
+
+    "@rollup/rollup-android-arm64": ["@rollup/rollup-android-arm64@4.60.4", "", { "os": "android", "cpu": "arm64" }, "sha512-GxxTKApUpzRhof7poWvCJHRF51C67u1R7D6DiluBE8wKU1u5GWE8t+v81JvJYtbawoBFX1hLv5Ei4eVjkWokaw=="],
+
+    "@rollup/rollup-darwin-arm64": ["@rollup/rollup-darwin-arm64@4.60.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-tua0TaJxMOB1R0V0RS1jFZ/RpURFDJIOR2A6jWwQeawuFyS4gBW+rntLRaQd0EQ4bd6Vp44Z2rXW+YYDBsj6IA=="],
+
+    "@rollup/rollup-darwin-x64": ["@rollup/rollup-darwin-x64@4.60.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-CSKq7MsP+5PFIcydhAiR1K0UhEI1A2jWXVKHPCBZ151yOutENwvnPocgVHkivu2kviURtCEB6zUQw0vs8RrhMg=="],
+
+    "@rollup/rollup-freebsd-arm64": ["@rollup/rollup-freebsd-arm64@4.60.4", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-+O8OkVdyvXMtJEciu2wS/pzm1IxntEEQx3z5TAVy4l32G0etZn+RsA48ARRrFm6Ri8fvqPQfgrvNxSjKAbnd3g=="],
+
+    "@rollup/rollup-freebsd-x64": ["@rollup/rollup-freebsd-x64@4.60.4", "", { "os": "freebsd", "cpu": "x64" }, "sha512-Iw3oMskH3AfNuhU0MSN7vNbdi4me/NiYo2azqPz/Le16zHSa+3RRmliCMWWQmh4lcndccU40xcJuTYJZxNo/lw=="],
+
+    "@rollup/rollup-linux-arm-gnueabihf": ["@rollup/rollup-linux-arm-gnueabihf@4.60.4", "", { "os": "linux", "cpu": "arm" }, "sha512-EIPRXTVQpHyF8WOo219AD2yEltPehLTcTMz2fn6JsatLYSzQf00hj3rulF+yauOlF9/FtM2WpkT/hJh/KJFGhA=="],
+
+    "@rollup/rollup-linux-arm-musleabihf": ["@rollup/rollup-linux-arm-musleabihf@4.60.4", "", { "os": "linux", "cpu": "arm" }, "sha512-J3Yh9PzzF1Ovah2At+lHiGQdsYgArxBbXv/zHfSyaiFQEqvNv7DcW98pCrmdjCZBrqBiKrKKe2V+aaSGWuBe/w=="],
+
+    "@rollup/rollup-linux-arm64-gnu": ["@rollup/rollup-linux-arm64-gnu@4.60.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-BFDEZMYfUvLn37ONE1yMBojPxnMlTFsdyNoqncT0qFq1mAfllL+ATMMJd8TeuVMiX84s1KbcxcZbXInmcO2mRg=="],
+
+    "@rollup/rollup-linux-arm64-musl": ["@rollup/rollup-linux-arm64-musl@4.60.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-pc9EYOSlOgdQ2uPl1o9PF6/kLSgaUosia7gOuS8mB69IxJvlclko1MECXysjs5ryez1/5zjYqx3+xYU0TU6R1A=="],
+
+    "@rollup/rollup-linux-loong64-gnu": ["@rollup/rollup-linux-loong64-gnu@4.60.4", "", { "os": "linux", "cpu": "none" }, "sha512-NxnomyxYerDh5n4iLrNa+sH+Z+U4BMEE46V2PgQ/hoB909i8gV1M5wPojWg9fk1jWpO3IQnOs20K4wyZuFLEFQ=="],
+
+    "@rollup/rollup-linux-loong64-musl": ["@rollup/rollup-linux-loong64-musl@4.60.4", "", { "os": "linux", "cpu": "none" }, "sha512-nbJnQ8a3z1mtmrwImCYhc6BGpThAyYVRQxw9uKSKG4wR6aAYno9sVjJ0zaZcW9BPJX1GbrDPf+SvdWjgTuDmnw=="],
+
+    "@rollup/rollup-linux-ppc64-gnu": ["@rollup/rollup-linux-ppc64-gnu@4.60.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-2EU6acNrQLd8tYvo/LXW535wupT3m6fo7HKo6lr7ktQoItxTyOL1ZCR/GfGCuXl2vR+zmfI6eRXkSemafv+iVg=="],
+
+    "@rollup/rollup-linux-ppc64-musl": ["@rollup/rollup-linux-ppc64-musl@4.60.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-WeBtoMuaMxiiIrO2IYP3xs6GMWkJP2C0EoT8beTLkUPmzV1i/UcOSVw1d5r9KBODtHKilG5yFxsGRnBbK3wJ4A=="],
+
+    "@rollup/rollup-linux-riscv64-gnu": ["@rollup/rollup-linux-riscv64-gnu@4.60.4", "", { "os": "linux", "cpu": "none" }, "sha512-FJHFfqpKUI3A10WrWKiFbBZ7yVbGT4q4B5o1qKFFojqpaYoh9LrQgqWCmmcxQzVSXYtyB5bzkXrYzlHTs21MYA=="],
+
+    "@rollup/rollup-linux-riscv64-musl": ["@rollup/rollup-linux-riscv64-musl@4.60.4", "", { "os": "linux", "cpu": "none" }, "sha512-mcEl6CUT5IAUmQf1m9FYSmVqCJlpQ8r8eyftFUHG8i9OhY7BkBXSUdnLH5DOf0wCOjcP9v/QO93zpmF1SptCCw=="],
+
+    "@rollup/rollup-linux-s390x-gnu": ["@rollup/rollup-linux-s390x-gnu@4.60.4", "", { "os": "linux", "cpu": "s390x" }, "sha512-ynt3JxVd2w2buzoKDWIyiV1pJW93xlQic1THVLXilz429oijRpSHivZAgp65KBu+cMcgf1eVVjdnTLvPxgCuoQ=="],
+
+    "@rollup/rollup-linux-x64-gnu": ["@rollup/rollup-linux-x64-gnu@4.60.4", "", { "os": "linux", "cpu": "x64" }, "sha512-Boiz5+MsaROEWDf+GGEwF8VMHGhlUoQMtIPjOgA5fv4osupqTVnJteQNKJwUcnUog2G55jYXH7KZFFiJe0TEzQ=="],
+
+    "@rollup/rollup-linux-x64-musl": ["@rollup/rollup-linux-x64-musl@4.60.4", "", { "os": "linux", "cpu": "x64" }, "sha512-+qfSY27qIrFfI/Hom04KYFw3GKZSGU4lXus51wsb5EuySfFlWRwjkKWoE9emgRw/ukoT4Udsj4W/+xxG8VbPKg=="],
+
+    "@rollup/rollup-openbsd-x64": ["@rollup/rollup-openbsd-x64@4.60.4", "", { "os": "openbsd", "cpu": "x64" }, "sha512-VpTfOPHgVXEBeeR8hZ2O0F3aSso+JDWqTWmTmzcQKted54IAdUVbxE+j/MVxUsKa8L20HJhv3vUezVPoquqWjA=="],
+
+    "@rollup/rollup-openharmony-arm64": ["@rollup/rollup-openharmony-arm64@4.60.4", "", { "os": "none", "cpu": "arm64" }, "sha512-IPOsh5aRYuLv/nkU51X10Bf75Bsf6+gZdx1X+QP5QM6lIJFHHqbHLG0uJn/hWthzo13UAc2umiUorqZy3axoZg=="],
+
+    "@rollup/rollup-win32-arm64-msvc": ["@rollup/rollup-win32-arm64-msvc@4.60.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-4QzE9E81OohJ/HKzHhsqU+zcYYojVOXlFMs1DdyMT6qXl/niOH7AVElmmEdUNHHS/oRkc++d5k6Vy85zFs0DEw=="],
+
+    "@rollup/rollup-win32-ia32-msvc": ["@rollup/rollup-win32-ia32-msvc@4.60.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-zTPgT1YuHHcd+Tmx7h8aml0FWFVelV5N54oHow9SLj+GfoDy/huQ+UV396N/C7KpMDMiPspRktzM1/0r1usYEA=="],
+
+    "@rollup/rollup-win32-x64-gnu": ["@rollup/rollup-win32-x64-gnu@4.60.4", "", { "os": "win32", "cpu": "x64" }, "sha512-DRS4G7mi9lJxqEDezIkKCaUIKCrLUUDCUaCsTPCi/rtqaC6D/jjwslMQyiDU50Ka0JKpeXeRBFBAXwArY52vBw=="],
+
+    "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.60.4", "", { "os": "win32", "cpu": "x64" }, "sha512-QVTUovf40zgTqlFVrKA1uXMVvU2QWEFWfAH8Wdc48IxLvrJMQVMBRjuQyUpzZCDkakImib9eVazbWlC6ksWtJw=="],
+
+    "@sec-ant/readable-stream": ["@sec-ant/readable-stream@0.4.1", "", {}, "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="],
+
+    "@shikijs/core": ["@shikijs/core@1.29.2", "", { "dependencies": { "@shikijs/engine-javascript": "1.29.2", "@shikijs/engine-oniguruma": "1.29.2", "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.4" } }, "sha512-vju0lY9r27jJfOY4Z7+Rt/nIOjzJpZ3y+nYpqtUZInVoXQ/TJZcfGnNOGnKjFdVZb8qexiCuSlZRKcGfhhTTZQ=="],
+
+    "@shikijs/engine-javascript": ["@shikijs/engine-javascript@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1", "oniguruma-to-es": "^2.2.0" } }, "sha512-iNEZv4IrLYPv64Q6k7EPpOCE/nuvGiKl7zxdq0WFuRPF5PAE9PRo2JGq/d8crLusM59BRemJ4eOqrFrC4wiQ+A=="],
+
+    "@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1" } }, "sha512-7iiOx3SG8+g1MnlzZVDYiaeHe7Ez2Kf2HrJzdmGwkRisT7r4rak0e655AcM/tF9JG/kg5fMNYlLLKglbN7gBqA=="],
+
+    "@shikijs/langs": ["@shikijs/langs@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2" } }, "sha512-FIBA7N3LZ+223U7cJDUYd5shmciFQlYkFXlkKVaHsCPgfVLiO+e12FmQE6Tf9vuyEsFe3dIl8qGWKXgEHL9wmQ=="],
+
+    "@shikijs/primitive": ["@shikijs/primitive@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-zx2/2Uwj2q9X3KSyYREEhXO23xBw5WUhP4orK2lE4r+t9JGITmEe0JH+wPmJhqHpOT2bRRs6lAL945+LDvOAGw=="],
+
+    "@shikijs/themes": ["@shikijs/themes@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2" } }, "sha512-i9TNZlsq4uoyqSbluIcZkmPL9Bfi3djVxRnofUHwvx/h6SRW3cwgBC5SML7vsDcWyukY0eCzVN980rqP6qNl9g=="],
+
+    "@shikijs/types": ["@shikijs/types@1.29.2", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.1", "@types/hast": "^3.0.4" } }, "sha512-VJjK0eIijTZf0QSTODEXCqinjBn0joAHQ+aPSBzrv4O2d/QSbsMw+ZeSRx03kV34Hy7NzUvV/7NqfYGRLrASmw=="],
+
+    "@shikijs/vscode-textmate": ["@shikijs/vscode-textmate@10.0.2", "", {}, "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg=="],
+
+    "@shuding/opentype.js": ["@shuding/opentype.js@1.4.0-beta.0", "", { "dependencies": { "fflate": "^0.7.3", "string.prototype.codepointat": "^0.2.1" }, "bin": { "ot": "bin/ot" } }, "sha512-3NgmNyH3l/Hv6EvsWJbsvpcpUba6R8IREQ83nH83cyakCw7uM1arZKNfHwv1Wz6jgqrF/j4x5ELvR6PnK9nTcA=="],
+
+    "@sindresorhus/is": ["@sindresorhus/is@7.2.0", "", {}, "sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw=="],
+
+    "@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
+
+    "@smithy/core": ["@smithy/core@3.24.5", "", { "dependencies": { "@aws-crypto/crc32": "5.2.0", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-Kt8phUg45M15EjhYAbZ+fFikYneijLu9Liugz8ZsYz2i8j0hzGv27LWKpEHYRfvj+LyCOSijpcR/2i8RouV+cA=="],
+
+    "@smithy/credential-provider-imds": ["@smithy/credential-provider-imds@4.3.6", "", { "dependencies": { "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-tHhdiWZfG1ZIh2YcRfPJmY2gHcBmqbAzqm3ER4TIDFYsSEqTD5tICT7cgQ/kI8LRakxp12myOYyK68XPn7MnHw=="],
+
+    "@smithy/fetch-http-handler": ["@smithy/fetch-http-handler@5.4.5", "", { "dependencies": { "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-SK3VMeH0fibgdTg2QeB+O4p7Yy/2E5HBOHJeC58FshkDdeuX8lOgO7PfjYfLyPLP1ch55j91cQqKBzDS0mRjSQ=="],
+
+    "@smithy/is-array-buffer": ["@smithy/is-array-buffer@2.2.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA=="],
+
+    "@smithy/node-config-provider": ["@smithy/node-config-provider@4.4.5", "", { "dependencies": { "@smithy/core": "^3.24.5", "tslib": "^2.6.2" } }, "sha512-c2G9QJ4xVZLwAkAf+WQESSSCkKbtt33ytje1klGvTcBn6cKuqV28E+62wbRPHwuTikkB3LQ7CBnNrayCoJur5A=="],
+
+    "@smithy/node-http-handler": ["@smithy/node-http-handler@4.7.5", "", { "dependencies": { "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-3dA9TQ+ybRSZ/m0wnbZhiBy4Dezjgq1Ib/ZZrYTpJDBgpoLLU/SDzZc/g0x0MNAdOJe1wPcM+x2PBRmoOur+Sw=="],
+
+    "@smithy/shared-ini-file-loader": ["@smithy/shared-ini-file-loader@4.5.5", "", { "dependencies": { "@smithy/core": "^3.24.5", "tslib": "^2.6.2" } }, "sha512-W7IPDXj8AZdyH5EWEXmOvN7ao8iN0JKJ0FNLpGcqj08HZc0MmqGcJnGgh3DfUdGYtzrPIEudxs+ovq/EWZgLjg=="],
+
+    "@smithy/signature-v4": ["@smithy/signature-v4@5.4.5", "", { "dependencies": { "@smithy/core": "^3.24.5", "@smithy/types": "^4.14.2", "tslib": "^2.6.2" } }, "sha512-QBJKWGqIknH0dc9LWpfH1mkdokAx6iXYN3UcQ3eY6uIEyScuoQAhfl94ge7ozUy9WgFUdE8xsvwBjaYBbWmPNA=="],
+
+    "@smithy/types": ["@smithy/types@4.14.2", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw=="],
+
+    "@smithy/util-base64": ["@smithy/util-base64@4.4.5", "", { "dependencies": { "@smithy/core": "^3.24.5", "tslib": "^2.6.2" } }, "sha512-2J8l+DoX3IIiP75X5SYkJ3mIgOkxW29MxOs7oPjbXLuInQ7UL6zLw2IJHbQ44+eKDBBhTjvt+GgwsTTNBGt8zA=="],
+
+    "@smithy/util-buffer-from": ["@smithy/util-buffer-from@2.2.0", "", { "dependencies": { "@smithy/is-array-buffer": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA=="],
+
+    "@smithy/util-utf8": ["@smithy/util-utf8@2.3.0", "", { "dependencies": { "@smithy/util-buffer-from": "^2.2.0", "tslib": "^2.6.2" } }, "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A=="],
+
+    "@solid-devtools/debugger": ["@solid-devtools/debugger@0.28.1", "", { "dependencies": { "@nothing-but/utils": "~0.17.0", "@solid-devtools/shared": "^0.20.0", "@solid-primitives/bounds": "^0.1.1", "@solid-primitives/event-listener": "^2.4.1", "@solid-primitives/keyboard": "^1.3.1", "@solid-primitives/rootless": "^1.5.1", "@solid-primitives/scheduled": "^1.5.1", "@solid-primitives/static-store": "^0.1.1", "@solid-primitives/utils": "^6.3.1" }, "peerDependencies": { "solid-js": "^1.9.0" } }, "sha512-6qIUI6VYkXoRnL8oF5bvh2KgH71qlJ18hNw/mwSyY6v48eb80ZR48/5PDXufUa3q+MBSuYa1uqTMwLewpay9eg=="],
+
+    "@solid-devtools/logger": ["@solid-devtools/logger@0.9.11", "", { "dependencies": { "@nothing-but/utils": "~0.17.0", "@solid-devtools/debugger": "^0.28.1", "@solid-devtools/shared": "^0.20.0", "@solid-primitives/utils": "^6.3.1" }, "peerDependencies": { "solid-js": "^1.9.0" } }, "sha512-THbiY1iQlieL6vdgJc4FIsLe7V8a57hod/Thm8zdKrTkWL88UPZjkBBfM+mVNGusd4OCnAN20tIFBhNnuT1Dew=="],
+
+    "@solid-devtools/shared": ["@solid-devtools/shared@0.20.0", "", { "dependencies": { "@nothing-but/utils": "~0.17.0", "@solid-primitives/event-listener": "^2.4.1", "@solid-primitives/media": "^2.3.1", "@solid-primitives/refs": "^1.1.1", "@solid-primitives/rootless": "^1.5.1", "@solid-primitives/scheduled": "^1.5.1", "@solid-primitives/static-store": "^0.1.1", "@solid-primitives/styles": "^0.1.1", "@solid-primitives/utils": "^6.3.1" }, "peerDependencies": { "solid-js": "^1.9.0" } }, "sha512-o5TACmUOQsxpzpOKCjbQqGk8wL8PMi+frXG9WNu4Lh3PQVUB6hs95Kl/S8xc++zwcMguUKZJn8h5URUiMOca6Q=="],
+
+    "@solid-primitives/bounds": ["@solid-primitives/bounds@0.1.5", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.5", "@solid-primitives/resize-observer": "^2.1.5", "@solid-primitives/static-store": "^0.1.3", "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-JFym8zijMfWp1FaAmJlH3xMfenCuhjaUsoBn3kt9FtoWwLj+yt+EGYt+p3SkOKwF7h4gaGtZ5PIdSbSNVWkRmg=="],
+
+    "@solid-primitives/event-listener": ["@solid-primitives/event-listener@2.4.5", "", { "dependencies": { "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-nwRV558mIabl4yVAhZKY8cb6G+O1F0M6Z75ttTu5hk+SxdOnKSGj+eetDIu7Oax1P138ZdUU01qnBPR8rnxaEA=="],
+
+    "@solid-primitives/keyboard": ["@solid-primitives/keyboard@1.3.5", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.5", "@solid-primitives/rootless": "^1.5.3", "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-sav+l+PL+74z3yaftVs7qd8c2SXkqzuxPOVibUe5wYMt+U5Hxp3V3XCPgBPN2I6cANjvoFtz0NiU8uHVLdi9FQ=="],
+
+    "@solid-primitives/media": ["@solid-primitives/media@2.3.5", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.5", "@solid-primitives/rootless": "^1.5.3", "@solid-primitives/static-store": "^0.1.3", "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-LX9fB5WDaK87FMDtUB1qokBOfT2et9Uobv/zZaKLH9caFSz4+P70MBKEIBHcZQy+9MV5M2XvGYLTbLskjkzMjA=="],
+
+    "@solid-primitives/refs": ["@solid-primitives/refs@1.1.3", "", { "dependencies": { "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-aam02fjNKpBteewF/UliPSQCVJsIIGOLEWQOh+ll6R/QePzBOOBMcC4G+5jTaO75JuUS1d/14Q1YXT3X0Ow6iA=="],
+
+    "@solid-primitives/resize-observer": ["@solid-primitives/resize-observer@2.1.5", "", { "dependencies": { "@solid-primitives/event-listener": "^2.4.5", "@solid-primitives/rootless": "^1.5.3", "@solid-primitives/static-store": "^0.1.3", "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-AiyTknKcNBaKHbcSMuxtSNM8FjIuiSuFyFghdD0TcCMU9hKi9EmsC5pjfjDwxE+5EueB1a+T/34PLRI5vbBbKw=="],
+
+    "@solid-primitives/rootless": ["@solid-primitives/rootless@1.5.3", "", { "dependencies": { "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-N8cIDAHbWcLahNRLr0knAAQvXyEdEMoAZvIMZKmhNb1mlx9e2UOv9BRD5YNwQUJwbNoYVhhLwFOEOcVXFx0HqA=="],
+
+    "@solid-primitives/scheduled": ["@solid-primitives/scheduled@1.5.3", "", { "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-oNwLE6E6lxJAWrc8QXuwM0k2oU1BnANnkChwMw82aK1j3+mWGJkG1IFe5gCwbV+afYmjI76t9JJV3md/8tLw+g=="],
+
+    "@solid-primitives/static-store": ["@solid-primitives/static-store@0.1.3", "", { "dependencies": { "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-uxez7SXnr5GiRnzqO2IEDjOJRIXaG+0LZLBizmUA1FwSi+hrpuMzVBwyk70m4prcl8X6FDDXUl9O8hSq8wHbBQ=="],
+
+    "@solid-primitives/styles": ["@solid-primitives/styles@0.1.3", "", { "dependencies": { "@solid-primitives/rootless": "^1.5.3", "@solid-primitives/utils": "^6.4.0" }, "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-7YdA21prMeCX+oOF/1RAn02+cGz/pG4dyPWtHBC2H8aZvnC7IfThBt80mP+TioejrdfE7Lc54Uh18f7Pig+gRQ=="],
+
+    "@solid-primitives/utils": ["@solid-primitives/utils@6.4.0", "", { "peerDependencies": { "solid-js": "^1.6.12" } }, "sha512-AeGTBg8Wtkh/0s+evyLtP8piQoS4wyqqQaAFs2HJcFMMjYAtUgo+ZPduRXLjPlqKVc2ejeR544oeqpbn8Egn8A=="],
+
+    "@solidjs/meta": ["@solidjs/meta@0.29.4", "", { "peerDependencies": { "solid-js": ">=1.8.4" } }, "sha512-zdIWBGpR9zGx1p1bzIPqF5Gs+Ks/BH8R6fWhmUa/dcK1L2rUC8BAcZJzNRYBQv74kScf1TSOs0EY//Vd/I0V8g=="],
+
+    "@solidjs/router": ["@solidjs/router@0.15.4", "", { "peerDependencies": { "solid-js": "^1.8.6" } }, "sha512-WOpgg9a9T638cR+5FGbFi/IV4l2FpmBs1GpIMSPa0Ce9vyJN7Wts+X2PqMf9IYn0zUj2MlSJtm1gp7/HI/n5TQ=="],
+
+    "@solidjs/start": ["@solidjs/start@2.0.0-alpha.2", "", { "dependencies": { "@babel/core": "^7.28.3", "@babel/traverse": "^7.28.3", "@babel/types": "^7.28.5", "@solidjs/meta": "^0.29.4", "@tanstack/server-functions-plugin": "1.134.5", "@types/babel__traverse": "^7.28.0", "@types/micromatch": "^4.0.9", "cookie-es": "^2.0.0", "defu": "^6.1.4", "error-stack-parser": "^2.1.4", "es-module-lexer": "^1.7.0", "esbuild": "^0.25.3", "fast-glob": "^3.3.3", "h3": "npm:h3@2.0.1-rc.4", "html-to-image": "^1.11.13", "micromatch": "^4.0.8", "path-to-regexp": "^8.2.0", "pathe": "^2.0.3", "radix3": "^1.1.2", "seroval": "^1.4.1", "seroval-plugins": "^1.4.0", "shiki": "^1.26.1", "solid-js": "^1.9.9", "source-map-js": "^1.2.1", "srvx": "^0.9.1", "terracotta": "^1.0.6", "vite-plugin-solid": "^2.11.9" }, "peerDependencies": { "vite": "^7" } }, "sha512-z56ATi3P07q8F5Io2I+RQrwjyWZtFZzpXN/J+8scf/gqrAW83LtgRkZFZjJaGH7i9WrHP+ep9F+ZiJ2gDHVBcw=="],
+
+    "@solidjs/vite-plugin-nitro-2": ["@solidjs/vite-plugin-nitro-2@0.1.0", "", { "dependencies": { "nitropack": "^2.11.10" }, "peerDependencies": { "vite": "^7" } }, "sha512-gtT9GYhAdbfY2v3ISKYFXclxH/kK+mDhp5ENjiA1zJAfQq6XPWwIfIYm9MB73vfOp+MzVXWDHxYyUv+5pTpGTw=="],
+
+    "@speed-highlight/core": ["@speed-highlight/core@1.2.15", "", {}, "sha512-BMq1K3DsElxDWawkX6eLg9+CKJrTVGCBAWVuHXVUV2u0s2711qiChLSId6ikYPfxhdYocLNt3wWwSvDiTvFabw=="],
+
+    "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
+    "@tailwindcss/node": ["@tailwindcss/node@4.3.0", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.21.0", "jiti": "^2.6.1", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.3.0" } }, "sha512-aFb4gUhFOgdh9AXo4IzBEOzBkkAxm9VigwDJnMIYv3lcfXCJVesNfbEaBl4BNgVRyid92AmdviqwBUBRKSeY3g=="],
+
+    "@tailwindcss/oxide": ["@tailwindcss/oxide@4.3.0", "", { "optionalDependencies": { "@tailwindcss/oxide-android-arm64": "4.3.0", "@tailwindcss/oxide-darwin-arm64": "4.3.0", "@tailwindcss/oxide-darwin-x64": "4.3.0", "@tailwindcss/oxide-freebsd-x64": "4.3.0", "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.0", "@tailwindcss/oxide-linux-arm64-gnu": "4.3.0", "@tailwindcss/oxide-linux-arm64-musl": "4.3.0", "@tailwindcss/oxide-linux-x64-gnu": "4.3.0", "@tailwindcss/oxide-linux-x64-musl": "4.3.0", "@tailwindcss/oxide-wasm32-wasi": "4.3.0", "@tailwindcss/oxide-win32-arm64-msvc": "4.3.0", "@tailwindcss/oxide-win32-x64-msvc": "4.3.0" } }, "sha512-F7HZGBeN9I0/AuuJS5PwcD8xayx5ri5GhjYUDBEVYUkexyA/giwbDNjRVrxSezE3T250OU2K/wp/ltWx3UOefg=="],
+
+    "@tailwindcss/oxide-android-arm64": ["@tailwindcss/oxide-android-arm64@4.3.0", "", { "os": "android", "cpu": "arm64" }, "sha512-TJPiq67tKlLuObP6RkwvVGDoxCMBVtDgKkLfa/uyj7/FyxvQwHS+UOnVrXXgbEsfUaMgiVvC4KbJnRr26ho4Ng=="],
+
+    "@tailwindcss/oxide-darwin-arm64": ["@tailwindcss/oxide-darwin-arm64@4.3.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-oMN/WZRb+SO37BmUElEgeEWuU8E/HXRkiODxJxLe1UTHVXLrdVSgfaJV7pSlhRGMSOiXLuxTIjfsF3wYvz8cgQ=="],
+
+    "@tailwindcss/oxide-darwin-x64": ["@tailwindcss/oxide-darwin-x64@4.3.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-N6CUmu4a6bKVADfw77p+iw6Yd9Q3OBhe0veaDX+QazfuVYlQsHfDgxBrsjQ/IW+zywL8mTrNd0SdJT/zgtvMdA=="],
+
+    "@tailwindcss/oxide-freebsd-x64": ["@tailwindcss/oxide-freebsd-x64@4.3.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-zDL5hBkQdH5C6MpqbK3gQAgP80tsMwSI26vjOzjJtNCMUo0lFgOItzHKBIupOZNQxt3ouPH7RPhvNhiTfCe5CQ=="],
+
+    "@tailwindcss/oxide-linux-arm-gnueabihf": ["@tailwindcss/oxide-linux-arm-gnueabihf@4.3.0", "", { "os": "linux", "cpu": "arm" }, "sha512-R06HdNi7A7OEoMsf6d4tjZ71RCWnZQPHj2mnotSFURjNLdBC+cIgXQ7l81CqeoiQftjf6OOblxXMInMgN2VzMA=="],
+
+    "@tailwindcss/oxide-linux-arm64-gnu": ["@tailwindcss/oxide-linux-arm64-gnu@4.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-qTJHELX8jetjhRQHCLilkVLmybpzNQAtaI/gaoVoidn/ufbNDbAo8KlK2J+yPoc8wQxvDxCmh/5lr8nC1+lTbg=="],
+
+    "@tailwindcss/oxide-linux-arm64-musl": ["@tailwindcss/oxide-linux-arm64-musl@4.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Z6sukiQsngnWO+l39X4pPbiWT81IC+PLKF+PHxIlyZbGNb9MODfYlXEVlFvej5BOZInWX01kVyzeLvHsXhfczQ=="],
+
+    "@tailwindcss/oxide-linux-x64-gnu": ["@tailwindcss/oxide-linux-x64-gnu@4.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-DRNdQRpSGzRGfARVuVkxvM8Q12nh19l4BF/G7zGA1oe+9wcC6saFBHTISrpIcKzhiXtSrlSrluCfvMuledoCTQ=="],
+
+    "@tailwindcss/oxide-linux-x64-musl": ["@tailwindcss/oxide-linux-x64-musl@4.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-Z0IADbDo8bh6I7h2IQMx601AdXBLfFpEdUotft86evd/8ZPflZe9COPO8Q1vw+pfLWIUo9zN/JGZvwuAJqduqg=="],
+
+    "@tailwindcss/oxide-wasm32-wasi": ["@tailwindcss/oxide-wasm32-wasi@4.3.0", "", { "dependencies": { "@emnapi/core": "^1.10.0", "@emnapi/runtime": "^1.10.0", "@emnapi/wasi-threads": "^1.2.1", "@napi-rs/wasm-runtime": "^1.1.4", "@tybys/wasm-util": "^0.10.1", "tslib": "^2.8.1" }, "cpu": "none" }, "sha512-HNZGOUxEmElksYR7S6sC5jTeNGpobAsy9u7Gu0AskJ8/20FR9GqebUyB+HBcU/ax6BHuiuJi+Oda4B+YX6H1yA=="],
+
+    "@tailwindcss/oxide-win32-arm64-msvc": ["@tailwindcss/oxide-win32-arm64-msvc@4.3.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Pe+RPVTi1T+qymuuRpcdvwSVZjnll/f7n8gBxMMh3xLTctMDKqpdfGimbMyioqtLhUYZxdJ9wGNhV7MKHvgZsQ=="],
+
+    "@tailwindcss/oxide-win32-x64-msvc": ["@tailwindcss/oxide-win32-x64-msvc@4.3.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Mvrf2kXW/yeW/OTezZlCGOirXRcUuLIBx/5Y12BaPM7wJoryG6dfS/NJL8aBPqtTEx/Vm4T4vKzFUcKDT+TKUA=="],
+
+    "@tailwindcss/postcss": ["@tailwindcss/postcss@4.3.0", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.3.0", "@tailwindcss/oxide": "4.3.0", "postcss": "^8.5.10", "tailwindcss": "4.3.0" } }, "sha512-Jm05Tjx+9yCLGv5qw1c+84Psds8MnyrEQYCB+FFk2lgGiUjlRqdxke4mVTuYrj2xnVZqKim2Apr5ySuQRYAw/w=="],
+
+    "@tailwindcss/vite": ["@tailwindcss/vite@4.3.0", "", { "dependencies": { "@tailwindcss/node": "4.3.0", "@tailwindcss/oxide": "4.3.0", "tailwindcss": "4.3.0" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7 || ^8" } }, "sha512-t6J3OrB5Fc0ExuhohouH0fWUGMYL6PTLhW+E7zIk/pdbnJARZDCwjBznFnkh5ynRnIRSI4YjtTH0t6USjJISrw=="],
+
+    "@tanstack/directive-functions-plugin": ["@tanstack/directive-functions-plugin@1.134.5", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/router-utils": "1.133.19", "babel-dead-code-elimination": "^1.0.10", "pathe": "^2.0.3", "tiny-invariant": "^1.3.3" }, "peerDependencies": { "vite": ">=6.0.0 || >=7.0.0" } }, "sha512-J3oawV8uBRBbPoLgMdyHt+LxzTNuWRKNJJuCLWsm/yq6v0IQSvIVCgfD2+liIiSnDPxGZ8ExduPXy8IzS70eXw=="],
+
+    "@tanstack/history": ["@tanstack/history@1.162.0", "", {}, "sha512-79pf/RkhteYZTRgcR4F9kbk84P2N8rugQJswxfIqovlbRiT3yI7eBE+5QorIrZaOKktsgzRlXh1l/du/xpl4iA=="],
+
+    "@tanstack/react-router": ["@tanstack/react-router@1.170.9", "", { "dependencies": { "@tanstack/history": "1.162.0", "@tanstack/react-store": "^0.9.3", "@tanstack/router-core": "1.171.7", "isbot": "^5.1.22" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-rXXztp6GyXFwResQR0jdvkf52wy/sAQqze3OR08+8uNM7nHir1P46qBrwg2TL5EEtX+0WUho4BZ/nMpAgQVB6A=="],
+
+    "@tanstack/react-start": ["@tanstack/react-start@1.168.16", "", { "dependencies": { "@tanstack/react-router": "1.170.9", "@tanstack/react-start-client": "1.168.6", "@tanstack/react-start-rsc": "0.1.15", "@tanstack/react-start-server": "1.167.11", "@tanstack/router-utils": "1.162.1", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-plugin-core": "1.171.8", "@tanstack/start-server-core": "1.169.6", "pathe": "^2.0.3" }, "peerDependencies": { "@rsbuild/core": "^2.0.0", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "vite": ">=7.0.0" }, "optionalPeers": ["@rsbuild/core", "vite"] }, "sha512-ZkrGThxJG0SPg5V+VB4C+7KKx8kl1vo1lQY9FR2t6EqNKfZhl5N9qpkPOeyJNhse1pqe8Ihbv8LNL9c1/SohkQ=="],
+
+    "@tanstack/react-start-client": ["@tanstack/react-start-client@1.168.6", "", { "dependencies": { "@tanstack/react-router": "1.170.9", "@tanstack/router-core": "1.171.7", "@tanstack/start-client-core": "1.170.5" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-6G/ef89hx3yWfoHLKpDxDpgMsje889bh8tpy6SMeELrCW6ob8x0G+peoFpB5zhNVE03wCFXhImM6KkZFRwSyaQ=="],
+
+    "@tanstack/react-start-rsc": ["@tanstack/react-start-rsc@0.1.15", "", { "dependencies": { "@tanstack/react-router": "1.170.9", "@tanstack/react-start-server": "1.167.11", "@tanstack/router-core": "1.171.7", "@tanstack/router-utils": "1.162.1", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-fn-stubs": "1.162.0", "@tanstack/start-plugin-core": "1.171.8", "@tanstack/start-server-core": "1.169.6", "@tanstack/start-storage-context": "1.167.9", "pathe": "^2.0.3" }, "peerDependencies": { "@rspack/core": ">=2.0.0-0", "@vitejs/plugin-rsc": ">=0.5.20", "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0", "react-server-dom-rspack": ">=0.0.2" }, "optionalPeers": ["@rspack/core", "@vitejs/plugin-rsc", "react-server-dom-rspack"] }, "sha512-AdO+3OQicxFibsXEOIG2u2aRIAc1KIWMC98iiwaIUw/1ObP7uilZcYQynwdDeqsGKd0Ulr+tXZXebLdQwV4OeA=="],
+
+    "@tanstack/react-start-server": ["@tanstack/react-start-server@1.167.11", "", { "dependencies": { "@tanstack/history": "1.162.0", "@tanstack/react-router": "1.170.9", "@tanstack/router-core": "1.171.7", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-server-core": "1.169.6" }, "peerDependencies": { "react": ">=18.0.0 || >=19.0.0", "react-dom": ">=18.0.0 || >=19.0.0" } }, "sha512-7IOSbMJ7mvNbcI6/LAHsYbhR+oIxDfZlWSBau1E/l2tY2HSnKdtu+tj1yTY7zgwqEdn14IyGFSxpHe/eTFNB5g=="],
+
+    "@tanstack/react-store": ["@tanstack/react-store@0.9.3", "", { "dependencies": { "@tanstack/store": "0.9.3", "use-sync-external-store": "^1.6.0" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-y2iHd/N9OkoQbFJLUX1T9vbc2O9tjH0pQRgTcx1/Nz4IlwLvkgpuglXUx+mXt0g5ZDFrEeDnONPqkbfxXJKwRg=="],
+
+    "@tanstack/router-core": ["@tanstack/router-core@1.171.7", "", { "dependencies": { "@tanstack/history": "1.162.0", "cookie-es": "^3.0.0", "seroval": "^1.5.4", "seroval-plugins": "^1.5.4" } }, "sha512-AboyQD0OPIu0adJi6HeCupTU9Wx7zr4q4ceJYQdBL3mLH18m4M57XXdzJdtzOg/twl8DtWej0RGJ12ma8CV1iQ=="],
+
+    "@tanstack/router-generator": ["@tanstack/router-generator@1.167.11", "", { "dependencies": { "@babel/types": "^7.28.5", "@tanstack/router-core": "1.171.7", "@tanstack/router-utils": "1.162.1", "@tanstack/virtual-file-routes": "1.162.0", "jiti": "^2.7.0", "magic-string": "^0.30.21", "prettier": "^3.5.0", "zod": "^4.4.3" } }, "sha512-Wnom12QTx0lreBQEL3zE2N88SDIT6xferScd46dnPCEYR8u+AkBBGRzlzZEpniIm+eF3byvIKBjYQgemdadoFg=="],
+
+    "@tanstack/router-plugin": ["@tanstack/router-plugin@1.168.12", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.5", "@babel/types": "^7.28.5", "@tanstack/router-core": "1.171.7", "@tanstack/router-generator": "1.167.11", "@tanstack/router-utils": "1.162.1", "@tanstack/virtual-file-routes": "1.162.0", "chokidar": "^5.0.0", "unplugin": "^3.0.0", "zod": "^4.4.3" }, "peerDependencies": { "@rsbuild/core": ">=1.0.2 || ^2.0.0", "@tanstack/react-router": "^1.170.9", "vite": ">=5.0.0 || >=6.0.0 || >=7.0.0 || >=8.0.0", "vite-plugin-solid": "^2.11.10 || ^3.0.0-0", "webpack": ">=5.92.0" }, "optionalPeers": ["@rsbuild/core", "@tanstack/react-router", "vite", "vite-plugin-solid", "webpack"] }, "sha512-DqeJs+/LinTsTc6gIsloauHdCjePk6pmhpmcqrNWbNi8dS+QMj2UZ4HgU9JgOiYGznkd49i8BeQJFUxzASmr7Q=="],
+
+    "@tanstack/router-utils": ["@tanstack/router-utils@1.162.1", "", { "dependencies": { "@babel/core": "^7.28.5", "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "ansis": "^4.1.0", "babel-dead-code-elimination": "^1.0.12", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-62layyTGmclHDQS/eidwKRfN1hhCKwViG7iEBcVmL0MXgcAB3OOucWCEcDDGd9Cu11H6b4QQ5oOo47MWIqwz0A=="],
+
+    "@tanstack/server-functions-plugin": ["@tanstack/server-functions-plugin@1.134.5", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.27.7", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.27.7", "@babel/types": "^7.27.7", "@tanstack/directive-functions-plugin": "1.134.5", "babel-dead-code-elimination": "^1.0.9", "tiny-invariant": "^1.3.3" } }, "sha512-2sWxq70T+dOEUlE3sHlXjEPhaFZfdPYlWTSkHchWXrFGw2YOAa+hzD6L9wHMjGDQezYd03ue8tQlHG+9Jzbzgw=="],
+
+    "@tanstack/solid-router": ["@tanstack/solid-router@1.170.9", "", { "dependencies": { "@solid-devtools/logger": "^0.9.4", "@solid-primitives/refs": "^1.0.8", "@solidjs/meta": "^0.29.4", "@tanstack/history": "1.162.0", "@tanstack/router-core": "1.171.7", "isbot": "^5.1.22" }, "peerDependencies": { "solid-js": "^1.9.10" } }, "sha512-qBGERBR0pL3nv4i7eMzEeV1ZLof64+7YgtOiCGvAw6Wh6XBDRDm2mGTnGoFZMJ8A1cmTGZ+/W4+Oi5CG1IXuyg=="],
+
+    "@tanstack/solid-start": ["@tanstack/solid-start@1.168.16", "", { "dependencies": { "@tanstack/solid-router": "1.170.9", "@tanstack/solid-start-client": "1.168.6", "@tanstack/solid-start-server": "1.167.11", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-plugin-core": "1.171.8", "@tanstack/start-server-core": "1.169.6", "pathe": "^2.0.3" }, "peerDependencies": { "@rsbuild/core": "^2.0.0", "solid-js": ">=1.0.0", "vite": ">=7.0.0" }, "optionalPeers": ["@rsbuild/core", "vite"] }, "sha512-0v/m22301RYzUW+w/WD09JgMn/734+XzBpzshQtLrzQOvxFAuocJiCxpO1M1cs1CAA3mxz8bmoqm33YEY3S2dw=="],
+
+    "@tanstack/solid-start-client": ["@tanstack/solid-start-client@1.168.6", "", { "dependencies": { "@tanstack/router-core": "1.171.7", "@tanstack/solid-router": "1.170.9", "@tanstack/start-client-core": "1.170.5" }, "peerDependencies": { "solid-js": ">=1.0.0" } }, "sha512-RbFCRuvB3AplxN0kfS9ZLb4g1ySNyMwGiNWDQp1tUsUlHGTTMIncqBoRZ8bKflrtf+tOw3NCiV0z3IMX5KrILg=="],
+
+    "@tanstack/solid-start-server": ["@tanstack/solid-start-server@1.167.11", "", { "dependencies": { "@solidjs/meta": "^0.29.4", "@tanstack/history": "1.162.0", "@tanstack/router-core": "1.171.7", "@tanstack/solid-router": "1.170.9", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-server-core": "1.169.6" }, "peerDependencies": { "solid-js": "^1.0.0" } }, "sha512-kbUJQ4Sedyt5exsKliigSikF5JZ2qaUjWDWDV5QiexhN3/xlBBZzkj2P1qeYjA0DV8Z8bbbrmg2MxUUFG1TZ0Q=="],
+
+    "@tanstack/start-client-core": ["@tanstack/start-client-core@1.170.5", "", { "dependencies": { "@tanstack/router-core": "1.171.7", "@tanstack/start-fn-stubs": "1.162.0", "@tanstack/start-storage-context": "1.167.9", "seroval": "^1.5.4" } }, "sha512-rtL6JyEB7/zeylgOjwtFEtmTIwRUm4Mf4bEhp2yUVk8kB4zLlmYcpSAFbb/aIrLp/Yl9XS2dx3OxB7oIPUuplg=="],
+
+    "@tanstack/start-fn-stubs": ["@tanstack/start-fn-stubs@1.162.0", "", {}, "sha512-QWfUZ3Yo923tdQn38LyKMU8rcTw69zc+T4dAvgTWV4O56SqFRsGfS0lSWIMhJRwXIx/bvdi7nTUBDdZtTHtpTQ=="],
+
+    "@tanstack/start-plugin-core": ["@tanstack/start-plugin-core@1.171.8", "", { "dependencies": { "@babel/code-frame": "7.27.1", "@babel/core": "^7.28.5", "@babel/types": "^7.28.5", "@rolldown/pluginutils": "1.0.1", "@tanstack/router-core": "1.171.7", "@tanstack/router-generator": "1.167.11", "@tanstack/router-plugin": "1.168.12", "@tanstack/router-utils": "1.162.1", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-server-core": "1.169.6", "exsolve": "^1.0.7", "lightningcss": "^1.32.0", "pathe": "^2.0.3", "picomatch": "^4.0.3", "seroval": "^1.5.4", "source-map": "^0.7.6", "srvx": "^0.11.9", "tinyglobby": "^0.2.15", "ufo": "^1.5.4", "vitefu": "^1.1.1", "xmlbuilder2": "^4.0.3", "zod": "^4.4.3" }, "peerDependencies": { "@rsbuild/core": "^2.0.0", "vite": ">=7.0.0" }, "optionalPeers": ["@rsbuild/core", "vite"] }, "sha512-Eoe83LD3N7AQgsjb+uRq+DjUE82+e8liYqzfIVoZ03t4+XfHtTbMBB+f6XK2kUzTv4QBG7ZmZU959jWwQHfVTQ=="],
+
+    "@tanstack/start-server-core": ["@tanstack/start-server-core@1.169.6", "", { "dependencies": { "@tanstack/history": "1.162.0", "@tanstack/router-core": "1.171.7", "@tanstack/start-client-core": "1.170.5", "@tanstack/start-storage-context": "1.167.9", "fetchdts": "^0.1.6", "h3-v2": "npm:h3@2.0.1-rc.20", "seroval": "^1.5.4" } }, "sha512-Qf+Uinnc5Ak79QGD6pJsiK0IfUlWkyJNy+h9vTwOtVLBvmq/fR7GjBuf5ymidI/7jK/YQWVuw2aaEE6MHBC+iw=="],
+
+    "@tanstack/start-storage-context": ["@tanstack/start-storage-context@1.167.9", "", { "dependencies": { "@tanstack/router-core": "1.171.7" } }, "sha512-RKxJA95HgZXu2lgTCzGi7pShtgz7vyvDTEPOJfJBBMHM2S7SX/WLYTHqfHcYvbOzREXOxEbDQ8Hvtt0Klq8VKg=="],
+
+    "@tanstack/store": ["@tanstack/store@0.9.3", "", {}, "sha512-8reSzl/qGWGGVKhBoxXPMWzATSbZLZFWhwBAFO9NAyp0TxzfBP0mIrGb8CP8KrQTmvzXlR/vFPPUrHTLBGyFyw=="],
+
+    "@tanstack/virtual-file-routes": ["@tanstack/virtual-file-routes@1.162.0", "", {}, "sha512-uhOeFyxLcU41HzvrxsGpiWdcMbScY1EDgbZ5K7DVRMYInbLYWAC0EA/kx9wXAoSM8q82bUG2hRl8+EAjE6XAbA=="],
+
+    "@tootallnate/quickjs-emscripten": ["@tootallnate/quickjs-emscripten@0.23.0", "", {}, "sha512-C5Mc6rdnsaJDjO3UpGW/CQTHtCKaYlScZTly4JIu97Jxo/odCiH0ITnDXSJPTOrEKk/ycSZ0AOgTmkDtkOsvIA=="],
+
+    "@ts-morph/common": ["@ts-morph/common@0.28.1", "", { "dependencies": { "minimatch": "^10.0.1", "path-browserify": "^1.0.1", "tinyglobby": "^0.2.14" } }, "sha512-W74iWf7ILp1ZKNYXY5qbddNaml7e9Sedv5lvU1V8lftlitkc9Pq1A+jlH23ltDgWYeZFFEqGCD1Ies9hqu3O+g=="],
+
+    "@tsconfig/node24": ["@tsconfig/node24@24.0.4", "", {}, "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA=="],
+
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
+
+    "@types/aws-lambda": ["@types/aws-lambda@8.10.161", "", {}, "sha512-rUYdp+MQwSFocxIOcSsYSF3YYYC/uUpMbCY/mbO21vGqfrEYvNSoPyKYDj6RhXXpPfS0KstW9RwG3qXh9sL7FQ=="],
+
+    "@types/babel__core": ["@types/babel__core@7.20.5", "", { "dependencies": { "@babel/parser": "^7.20.7", "@babel/types": "^7.20.7", "@types/babel__generator": "*", "@types/babel__template": "*", "@types/babel__traverse": "*" } }, "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA=="],
+
+    "@types/babel__generator": ["@types/babel__generator@7.27.0", "", { "dependencies": { "@babel/types": "^7.0.0" } }, "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg=="],
+
+    "@types/babel__template": ["@types/babel__template@7.4.4", "", { "dependencies": { "@babel/parser": "^7.1.0", "@babel/types": "^7.0.0" } }, "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A=="],
+
+    "@types/babel__traverse": ["@types/babel__traverse@7.28.0", "", { "dependencies": { "@babel/types": "^7.28.2" } }, "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q=="],
+
+    "@types/braces": ["@types/braces@3.0.5", "", {}, "sha512-SQFof9H+LXeWNz8wDe7oN5zu7ket0qwMu5vZubW4GCJ8Kkeh6nBWUz87+KTz/G3Kqsrp0j/W253XJb3KMEeg3w=="],
+
+    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
+
+    "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="],
+
+    "@types/d3": ["@types/d3@7.4.3", "", { "dependencies": { "@types/d3-array": "*", "@types/d3-axis": "*", "@types/d3-brush": "*", "@types/d3-chord": "*", "@types/d3-color": "*", "@types/d3-contour": "*", "@types/d3-delaunay": "*", "@types/d3-dispatch": "*", "@types/d3-drag": "*", "@types/d3-dsv": "*", "@types/d3-ease": "*", "@types/d3-fetch": "*", "@types/d3-force": "*", "@types/d3-format": "*", "@types/d3-geo": "*", "@types/d3-hierarchy": "*", "@types/d3-interpolate": "*", "@types/d3-path": "*", "@types/d3-polygon": "*", "@types/d3-quadtree": "*", "@types/d3-random": "*", "@types/d3-scale": "*", "@types/d3-scale-chromatic": "*", "@types/d3-selection": "*", "@types/d3-shape": "*", "@types/d3-time": "*", "@types/d3-time-format": "*", "@types/d3-timer": "*", "@types/d3-transition": "*", "@types/d3-zoom": "*" } }, "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww=="],
+
+    "@types/d3-array": ["@types/d3-array@3.2.2", "", {}, "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw=="],
+
+    "@types/d3-axis": ["@types/d3-axis@3.0.6", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw=="],
+
+    "@types/d3-brush": ["@types/d3-brush@3.0.6", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A=="],
+
+    "@types/d3-chord": ["@types/d3-chord@3.0.6", "", {}, "sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg=="],
+
+    "@types/d3-color": ["@types/d3-color@3.1.3", "", {}, "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A=="],
+
+    "@types/d3-contour": ["@types/d3-contour@3.0.6", "", { "dependencies": { "@types/d3-array": "*", "@types/geojson": "*" } }, "sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg=="],
+
+    "@types/d3-delaunay": ["@types/d3-delaunay@6.0.4", "", {}, "sha512-ZMaSKu4THYCU6sV64Lhg6qjf1orxBthaC161plr5KuPHo3CNm8DTHiLw/5Eq2b6TsNP0W0iJrUOFscY6Q450Hw=="],
+
+    "@types/d3-dispatch": ["@types/d3-dispatch@3.0.7", "", {}, "sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA=="],
+
+    "@types/d3-drag": ["@types/d3-drag@3.0.7", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ=="],
+
+    "@types/d3-dsv": ["@types/d3-dsv@3.0.7", "", {}, "sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g=="],
+
+    "@types/d3-ease": ["@types/d3-ease@3.0.2", "", {}, "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA=="],
+
+    "@types/d3-fetch": ["@types/d3-fetch@3.0.7", "", { "dependencies": { "@types/d3-dsv": "*" } }, "sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA=="],
+
+    "@types/d3-force": ["@types/d3-force@3.0.10", "", {}, "sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw=="],
+
+    "@types/d3-format": ["@types/d3-format@3.0.4", "", {}, "sha512-fALi2aI6shfg7vM5KiR1wNJnZ7r6UuggVqtDA+xiEdPZQwy/trcQaHnwShLuLdta2rTymCNpxYTiMZX/e09F4g=="],
+
+    "@types/d3-geo": ["@types/d3-geo@3.1.0", "", { "dependencies": { "@types/geojson": "*" } }, "sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ=="],
+
+    "@types/d3-hierarchy": ["@types/d3-hierarchy@3.1.7", "", {}, "sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg=="],
+
+    "@types/d3-interpolate": ["@types/d3-interpolate@3.0.4", "", { "dependencies": { "@types/d3-color": "*" } }, "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA=="],
+
+    "@types/d3-path": ["@types/d3-path@3.1.1", "", {}, "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg=="],
+
+    "@types/d3-polygon": ["@types/d3-polygon@3.0.2", "", {}, "sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA=="],
+
+    "@types/d3-quadtree": ["@types/d3-quadtree@3.0.6", "", {}, "sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg=="],
+
+    "@types/d3-random": ["@types/d3-random@3.0.3", "", {}, "sha512-Imagg1vJ3y76Y2ea0871wpabqp613+8/r0mCLEBfdtqC7xMSfj9idOnmBYyMoULfHePJyxMAw3nWhJxzc+LFwQ=="],
+
+    "@types/d3-scale": ["@types/d3-scale@4.0.9", "", { "dependencies": { "@types/d3-time": "*" } }, "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw=="],
+
+    "@types/d3-scale-chromatic": ["@types/d3-scale-chromatic@3.1.0", "", {}, "sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ=="],
+
+    "@types/d3-selection": ["@types/d3-selection@3.0.11", "", {}, "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w=="],
+
+    "@types/d3-shape": ["@types/d3-shape@3.1.8", "", { "dependencies": { "@types/d3-path": "*" } }, "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w=="],
+
+    "@types/d3-time": ["@types/d3-time@3.0.4", "", {}, "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g=="],
+
+    "@types/d3-time-format": ["@types/d3-time-format@4.0.3", "", {}, "sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg=="],
+
+    "@types/d3-timer": ["@types/d3-timer@3.0.2", "", {}, "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw=="],
+
+    "@types/d3-transition": ["@types/d3-transition@3.0.9", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg=="],
+
+    "@types/d3-zoom": ["@types/d3-zoom@3.0.8", "", { "dependencies": { "@types/d3-interpolate": "*", "@types/d3-selection": "*" } }, "sha512-iqMC4/YlFCSlO8+2Ii1GGGliCAY4XdeG748w5vQUbevlbDu0zSjH/+jojorQVBK/se0j6DUFNPBGSqD3YWYnDw=="],
+
+    "@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="],
+
+    "@types/deep-eql": ["@types/deep-eql@4.0.2", "", {}, "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw=="],
+
+    "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="],
+
+    "@types/estree": ["@types/estree@1.0.8", "", {}, "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w=="],
+
+    "@types/estree-jsx": ["@types/estree-jsx@1.0.5", "", { "dependencies": { "@types/estree": "*" } }, "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg=="],
+
+    "@types/geojson": ["@types/geojson@7946.0.16", "", {}, "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg=="],
+
+    "@types/hast": ["@types/hast@3.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ=="],
+
+    "@types/js-yaml": ["@types/js-yaml@4.0.9", "", {}, "sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg=="],
+
+    "@types/jsesc": ["@types/jsesc@2.5.1", "", {}, "sha512-9VN+6yxLOPLOav+7PwjZbxiID2bVaeq0ED4qSQmdQTdjnXJSaCVKTR58t15oqH1H5t8Ng2ZX1SabJVoN9Q34bw=="],
+
+    "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="],
+
+    "@types/mdast": ["@types/mdast@4.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA=="],
+
+    "@types/mdx": ["@types/mdx@2.0.13", "", {}, "sha512-+OWZQfAYyio6YkJb3HLxDrvnx6SWWDbC0zVPfBRzUk0/nqoDyf6dNxQi3eArPe8rJ473nobTMQ/8Zk+LxJ+Yuw=="],
+
+    "@types/micromatch": ["@types/micromatch@4.0.10", "", { "dependencies": { "@types/braces": "*" } }, "sha512-5jOhFDElqr4DKTrTEbnW8DZ4Hz5LRUEmyrGpCMrD/NphYv3nUnaF08xmSLx1rGGnyEs/kFnhiw6dCgcDqMr5PQ=="],
+
+    "@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
+
+    "@types/nlcst": ["@types/nlcst@2.0.3", "", { "dependencies": { "@types/unist": "*" } }, "sha512-vSYNSDe6Ix3q+6Z7ri9lyWqgGhJTmzRjZRqyq15N0Z/1/UnVsno9G/N40NBijoYx2seFDIl0+B2mgAb9mezUCA=="],
+
+    "@types/node": ["@types/node@25.9.1", "", { "dependencies": { "undici-types": ">=7.24.0 <7.24.7" } }, "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg=="],
+
+    "@types/pg": ["@types/pg@8.20.0", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow=="],
+
+    "@types/picomatch": ["@types/picomatch@4.0.3", "", {}, "sha512-iG0T6+nYJ9FAPmx9SsUlnwcq1ZVRuCXcVEvWnntoPlrOpwtSTKNDC9uVAxTsC3PUvJ+99n4RpAcNgBbHX3JSnQ=="],
+
+    "@types/react": ["@types/react@19.2.15", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-eRwcGNHve+E8qtEQSSRl6urh+rFop4v8gm6O8rGv25CodbvFdLjA1vVQ1KkiFE0w0UPOnb8tDiFKL5lp0rtY5Q=="],
+
+    "@types/react-dom": ["@types/react-dom@19.2.3", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ=="],
+
+    "@types/resolve": ["@types/resolve@1.20.2", "", {}, "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q=="],
+
+    "@types/sax": ["@types/sax@1.2.7", "", { "dependencies": { "@types/node": "*" } }, "sha512-rO73L89PJxeYM3s3pPPjiPgVVcymqU490g0YO5n5By0k2Erzj6tay/4lr1CHAAU4JyOWd1rpQ8bCf6cZfHU96A=="],
+
+    "@types/trusted-types": ["@types/trusted-types@2.0.7", "", {}, "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw=="],
+
+    "@types/unist": ["@types/unist@3.0.3", "", {}, "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q=="],
+
+    "@types/ws": ["@types/ws@8.18.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg=="],
+
+    "@types/yauzl": ["@types/yauzl@2.10.3", "", { "dependencies": { "@types/node": "*" } }, "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q=="],
+
+    "@typescript-eslint/parser": ["@typescript-eslint/parser@8.60.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.60.0", "@typescript-eslint/types": "8.60.0", "@typescript-eslint/typescript-estree": "8.60.0", "@typescript-eslint/visitor-keys": "8.60.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-fcqpj/MyK4sxDPcbe7STNPbpQL4RLZOPWuaTmwZYuc+hJKzRf58yRxfhqGpc6PIq9ZyfSBpfHgmUHmHs0KwHwg=="],
+
+    "@typescript-eslint/project-service": ["@typescript-eslint/project-service@8.60.0", "", { "dependencies": { "@typescript-eslint/tsconfig-utils": "^8.60.0", "@typescript-eslint/types": "^8.60.0", "debug": "^4.4.3" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg=="],
+
+    "@typescript-eslint/scope-manager": ["@typescript-eslint/scope-manager@8.60.0", "", { "dependencies": { "@typescript-eslint/types": "8.60.0", "@typescript-eslint/visitor-keys": "8.60.0" } }, "sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw=="],
+
+    "@typescript-eslint/tsconfig-utils": ["@typescript-eslint/tsconfig-utils@8.60.0", "", { "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ=="],
+
+    "@typescript-eslint/types": ["@typescript-eslint/types@8.60.0", "", {}, "sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA=="],
+
+    "@typescript-eslint/typescript-estree": ["@typescript-eslint/typescript-estree@8.60.0", "", { "dependencies": { "@typescript-eslint/project-service": "8.60.0", "@typescript-eslint/tsconfig-utils": "8.60.0", "@typescript-eslint/types": "8.60.0", "@typescript-eslint/visitor-keys": "8.60.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", "tinyglobby": "^0.2.15", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "typescript": ">=4.8.4 <6.1.0" } }, "sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g=="],
+
+    "@typescript-eslint/visitor-keys": ["@typescript-eslint/visitor-keys@8.60.0", "", { "dependencies": { "@typescript-eslint/types": "8.60.0", "eslint-visitor-keys": "^5.0.0" } }, "sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg=="],
+
+    "@typescript/analyze-trace": ["@typescript/analyze-trace@0.10.1", "", { "dependencies": { "chalk": "^4.1.2", "exit": "^0.1.2", "jsonparse": "^1.3.1", "jsonstream-next": "^3.0.0", "p-limit": "^3.1.0", "split2": "^3.2.2", "treeify": "^1.1.0", "yargs": "^16.2.0" }, "bin": { "analyze-trace": "bin/analyze-trace", "print-trace-types": "bin/print-trace-types", "simplify-trace-types": "bin/simplify-trace-types" } }, "sha512-RnlSOPh14QbopGCApgkSx5UBgGda5MX1cHqp2fsqfiDyCwGL/m1jaeB9fzu7didVS81LQqGZZuxFBcg8YU8EVw=="],
+
+    "@typescript/native-preview": ["@typescript/native-preview@7.0.0-dev.20260527.2", "", { "optionalDependencies": { "@typescript/native-preview-darwin-arm64": "7.0.0-dev.20260527.2", "@typescript/native-preview-darwin-x64": "7.0.0-dev.20260527.2", "@typescript/native-preview-linux-arm": "7.0.0-dev.20260527.2", "@typescript/native-preview-linux-arm64": "7.0.0-dev.20260527.2", "@typescript/native-preview-linux-x64": "7.0.0-dev.20260527.2", "@typescript/native-preview-win32-arm64": "7.0.0-dev.20260527.2", "@typescript/native-preview-win32-x64": "7.0.0-dev.20260527.2" }, "bin": { "tsgo": "bin/tsgo.js" } }, "sha512-piqkDwikVeizCFqA1lcwI5F4wOAtBdxuliWe77ApBNRyBPPvfCJB+u/HYi9/8t5nd0sWvFs6/qt/AzJ1CCoykQ=="],
+
+    "@typescript/native-preview-darwin-arm64": ["@typescript/native-preview-darwin-arm64@7.0.0-dev.20260527.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-3LqSu4DlxkEfeC/Z/29QMCJn5jjkDtXI7LYuxfmjdmAatS6umDKqm8J17fnP/7fyrZUMBTIYRwSDpChGV3G1ew=="],
+
+    "@typescript/native-preview-darwin-x64": ["@typescript/native-preview-darwin-x64@7.0.0-dev.20260527.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-H4+sxE9qaBbLF83wMdWE0FsgfK0Pom+/O+/oxqyGzhVkDJlNt3vfpgQZMit48/Gm44AacGfBggJ9Dhbi3aeSFw=="],
+
+    "@typescript/native-preview-linux-arm": ["@typescript/native-preview-linux-arm@7.0.0-dev.20260527.2", "", { "os": "linux", "cpu": "arm" }, "sha512-6I9Cv9ozwfS9zB9vRQDPIYseLX3artEO9jl3yVgLj4ishwlSF4cWAbIsjl5IztPaEgHv8coej/6tX1D0uaBzXg=="],
+
+    "@typescript/native-preview-linux-arm64": ["@typescript/native-preview-linux-arm64@7.0.0-dev.20260527.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-BGUDMjC2Z3TTdZRkGGwhBLelkP5UYgO2rbep8aF4dS3fu7T5lFPPrnfS6EgqJgie+cF5Fsev7xEq8wWyBDM+lg=="],
+
+    "@typescript/native-preview-linux-x64": ["@typescript/native-preview-linux-x64@7.0.0-dev.20260527.2", "", { "os": "linux", "cpu": "x64" }, "sha512-vpazOu+ozlxBo8U57YJMzsOPuxAV8H7fu36KJ8ea8At/D8pdGmOAy5TuB+9OBQV9JDe0OXJMy2kmbhOpmkTAmA=="],
+
+    "@typescript/native-preview-win32-arm64": ["@typescript/native-preview-win32-arm64@7.0.0-dev.20260527.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-DBFnFE3V6AITkPO1K1VxXf3yEZKjU2FwtXlNwRqhzDu0rrL2SsJHOSrBDX+OacTxQFzZMxFcpiuhV8jHZALPEg=="],
+
+    "@typescript/native-preview-win32-x64": ["@typescript/native-preview-win32-x64@7.0.0-dev.20260527.2", "", { "os": "win32", "cpu": "x64" }, "sha512-1tBlErMvQgcMqqYwsx4tytupcjCJcOUXD3vBn1Wb/kAvus1FzWQAFE0fcKBvLfcqLQfTiiEwKKEtbLjGmakqqg=="],
+
+    "@typescript/vfs": ["@typescript/vfs@1.6.1", "", { "dependencies": { "debug": "^4.1.1" }, "peerDependencies": { "typescript": "*" } }, "sha512-JwoxboBh7Oz1v38tPbkrZ62ZXNHAk9bJ7c9x0eI5zBfBnBYGhURdbnh7Z4smN/MV48Y5OCcZb58n972UtbazsA=="],
+
+    "@ungap/structured-clone": ["@ungap/structured-clone@1.3.1", "", {}, "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ=="],
+
+    "@upsetjs/venn.js": ["@upsetjs/venn.js@2.0.0", "", { "optionalDependencies": { "d3-selection": "^3.0.0", "d3-transition": "^3.0.1" } }, "sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw=="],
+
+    "@vercel/nft": ["@vercel/nft@1.10.2", "", { "dependencies": { "@mapbox/node-pre-gyp": "^2.0.0", "@rollup/pluginutils": "^5.1.3", "acorn": "^8.6.0", "acorn-import-attributes": "^1.9.5", "async-sema": "^3.1.1", "bindings": "^1.4.0", "estree-walker": "2.0.2", "glob": "^13.0.0", "graceful-fs": "^4.2.9", "node-gyp-build": "^4.2.2", "picomatch": "^4.0.2", "resolve-from": "^5.0.0" }, "bin": { "nft": "out/cli.js" } }, "sha512-w+WyX5Ulmj4dtTZrxaulqrjaLZHSbnPzx75SJsTNYmotKsqn1JlLnDJa+lz5hn90HJofhl/2MAtw0mCrgM3qYw=="],
+
+    "@vitejs/plugin-react": ["@vitejs/plugin-react@6.0.2", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.0" }, "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", "vite": "^8.0.0" }, "optionalPeers": ["@rolldown/plugin-babel", "babel-plugin-react-compiler"] }, "sha512-DlSMqo4WhThw4vB8Mpn0Woe9J+Jfq1geJ61AKW0QEgLzGMNwtIMdxbDUzLxcun8W7NbJO0e2Jg/Nxm3cCSVzzg=="],
+
+    "@vitejs/plugin-vue": ["@vitejs/plugin-vue@6.0.7", "", { "dependencies": { "@rolldown/pluginutils": "^1.0.1" }, "peerDependencies": { "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0", "vue": "^3.2.25" } }, "sha512-km+p+XdSz9Sxm5rqUbqcSfZYaAniKxWBj1KURl+Jr7UaPvvX7BmaWMdP69I5rrFDeQGyxAG7NXdc57vz+snhWg=="],
+
+    "@vitest/expect": ["@vitest/expect@4.1.7", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.7", "@vitest/utils": "4.1.7", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-1R+tw0ortHEbZDGMymm+pN7/AFQ/RkFFdtd7EN+VBpynKmLbP8A3rpEXdshBJ7+8hQ9zBJh/i1s0yKNtxAnU7w=="],
+
+    "@vitest/mocker": ["@vitest/mocker@4.1.7", "", { "dependencies": { "@vitest/spy": "4.1.7", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-vY7nuamKgfvpA1Koa3oYIw/k7D6kZnpGyNMZW8loow2bsBYla1TFdqTaXncWdRn4pgwNs+90RhnXhJScDwQeJA=="],
+
+    "@vitest/pretty-format": ["@vitest/pretty-format@4.1.7", "", { "dependencies": { "tinyrainbow": "^3.1.0" } }, "sha512-umgCarTOYQWIaDMvGDRZij+6b9oVeLIyJzfN+AS88e0ZOU3QTgNNSTtjQOpcvWr3np1N0j4WgZj+sb3oYBDscw=="],
+
+    "@vitest/runner": ["@vitest/runner@4.1.7", "", { "dependencies": { "@vitest/utils": "4.1.7", "pathe": "^2.0.3" } }, "sha512-BapjmAQ2aI78WdMEfeUWivnfVzB+VPGwWRQcJE0OUq7qEeEcBsCSf+0T5iREBNE5nBb4wA5Ya0W6IA+sghdEFw=="],
+
+    "@vitest/snapshot": ["@vitest/snapshot@4.1.7", "", { "dependencies": { "@vitest/pretty-format": "4.1.7", "@vitest/utils": "4.1.7", "magic-string": "^0.30.21", "pathe": "^2.0.3" } }, "sha512-ZacLzja+TmJeZ1h14xW2FB/WpeimUD3haBXQPyJqxvo8jQTmfeA8zv58mtjN2C7EHXZDYVcVYdYmAxjkWVvKCw=="],
+
+    "@vitest/spy": ["@vitest/spy@4.1.7", "", {}, "sha512-kbkI5LMWakyuTIvs6fUJ5qdIVb1XVKsYJAT4OJ938cHMROYMSfmoQdZy0aaAnjbbc8F61vkoTqz/Az+/HiIu5Q=="],
+
+    "@vitest/ui": ["@vitest/ui@4.1.7", "", { "dependencies": { "@vitest/utils": "4.1.7", "fflate": "^0.8.2", "flatted": "^3.4.2", "pathe": "^2.0.3", "sirv": "^3.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0" }, "peerDependencies": { "vitest": "4.1.7" } }, "sha512-TP6utB2yX6rsJNVRo2qAlsi48i1YwFTrLV2tnTtWqJaYX7m4lRCCLirZBjU6xC5m0RsPHr+L2+N+eIPhgEzFfw=="],
+
+    "@vitest/utils": ["@vitest/utils@4.1.7", "", { "dependencies": { "@vitest/pretty-format": "4.1.7", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-T532WBu791cBxJlCl6SO+J14l81DQx6uQHm1bQbmCDY7nqlEIgkza/UFnSBNaUtSf41unldDFjdOBYEQC4b5Hw=="],
+
+    "@volar/kit": ["@volar/kit@2.4.28", "", { "dependencies": { "@volar/language-service": "2.4.28", "@volar/typescript": "2.4.28", "typesafe-path": "^0.2.2", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" }, "peerDependencies": { "typescript": "*" } }, "sha512-cKX4vK9dtZvDRaAzeoUdaAJEew6IdxHNCRrdp5Kvcl6zZOqb6jTOfk3kXkIkG3T7oTFXguEMt5+9ptyqYR84Pg=="],
+
+    "@volar/language-core": ["@volar/language-core@2.4.28", "", { "dependencies": { "@volar/source-map": "2.4.28" } }, "sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ=="],
+
+    "@volar/language-server": ["@volar/language-server@2.4.28", "", { "dependencies": { "@volar/language-core": "2.4.28", "@volar/language-service": "2.4.28", "@volar/typescript": "2.4.28", "path-browserify": "^1.0.1", "request-light": "^0.7.0", "vscode-languageserver": "^9.0.1", "vscode-languageserver-protocol": "^3.17.5", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" } }, "sha512-NqcLnE5gERKuS4PUFwlhMxf6vqYo7hXtbMFbViXcbVkbZ905AIVWhnSo0ZNBC2V127H1/2zP7RvVOVnyITFfBw=="],
+
+    "@volar/language-service": ["@volar/language-service@2.4.28", "", { "dependencies": { "@volar/language-core": "2.4.28", "vscode-languageserver-protocol": "^3.17.5", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" } }, "sha512-Rh/wYCZJrI5vCwMk9xyw/Z+MsWxlJY1rmMZPsxUoJKfzIRjS/NF1NmnuEcrMbEVGja00aVpCsInJfixQTMdvLw=="],
+
+    "@volar/source-map": ["@volar/source-map@2.4.28", "", {}, "sha512-yX2BDBqJkRXfKw8my8VarTyjv48QwxdJtvRgUpNE5erCsgEUdI2DsLbpa+rOQVAJYshY99szEcRDmyHbF10ggQ=="],
+
+    "@volar/typescript": ["@volar/typescript@2.4.28", "", { "dependencies": { "@volar/language-core": "2.4.28", "path-browserify": "^1.0.1", "vscode-uri": "^3.0.8" } }, "sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw=="],
+
+    "@vscode/emmet-helper": ["@vscode/emmet-helper@2.11.0", "", { "dependencies": { "emmet": "^2.4.3", "jsonc-parser": "^2.3.0", "vscode-languageserver-textdocument": "^1.0.1", "vscode-languageserver-types": "^3.15.1", "vscode-uri": "^3.0.8" } }, "sha512-QLxjQR3imPZPQltfbWRnHU6JecWTF1QSWhx3GAKQpslx7y3Dp6sIIXhKjiUJ/BR9FX8PVthjr9PD6pNwOJfAzw=="],
+
+    "@vscode/l10n": ["@vscode/l10n@0.0.18", "", {}, "sha512-KYSIHVmslkaCDyw013pphY+d7x1qV8IZupYfeIfzNA+nsaWHbn5uPuQRvdRFsa9zFzGeudPuoGoZ1Op4jrJXIQ=="],
+
+    "@vue-macros/common": ["@vue-macros/common@3.1.2", "", { "dependencies": { "@vue/compiler-sfc": "^3.5.22", "ast-kit": "^2.1.2", "local-pkg": "^1.1.2", "magic-string-ast": "^1.0.2", "unplugin-utils": "^0.3.0" }, "peerDependencies": { "vue": "^2.7.0 || ^3.2.25" }, "optionalPeers": ["vue"] }, "sha512-h9t4ArDdniO9ekYHAD95t9AZcAbb19lEGK+26iAjUODOIJKmObDNBSe4+6ELQAA3vtYiFPPBtHh7+cQCKi3Dng=="],
+
+    "@vue/babel-helper-vue-transform-on": ["@vue/babel-helper-vue-transform-on@1.5.0", "", {}, "sha512-0dAYkerNhhHutHZ34JtTl2czVQHUNWv6xEbkdF5W+Yrv5pCWsqjeORdOgbtW2I9gWlt+wBmVn+ttqN9ZxR5tzA=="],
+
+    "@vue/babel-plugin-jsx": ["@vue/babel-plugin-jsx@1.5.0", "", { "dependencies": { "@babel/helper-module-imports": "^7.27.1", "@babel/helper-plugin-utils": "^7.27.1", "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/template": "^7.27.2", "@babel/traverse": "^7.28.0", "@babel/types": "^7.28.2", "@vue/babel-helper-vue-transform-on": "1.5.0", "@vue/babel-plugin-resolve-type": "1.5.0", "@vue/shared": "^3.5.18" }, "peerDependencies": { "@babel/core": "^7.0.0-0" }, "optionalPeers": ["@babel/core"] }, "sha512-mneBhw1oOqCd2247O0Yw/mRwC9jIGACAJUlawkmMBiNmL4dGA2eMzuNZVNqOUfYTa6vqmND4CtOPzmEEEqLKFw=="],
+
+    "@vue/babel-plugin-resolve-type": ["@vue/babel-plugin-resolve-type@1.5.0", "", { "dependencies": { "@babel/code-frame": "^7.27.1", "@babel/helper-module-imports": "^7.27.1", "@babel/helper-plugin-utils": "^7.27.1", "@babel/parser": "^7.28.0", "@vue/compiler-sfc": "^3.5.18" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-Wm/60o+53JwJODm4Knz47dxJnLDJ9FnKnGZJbUUf8nQRAtt6P+undLUAVU3Ha33LxOJe6IPoifRQ6F/0RrU31w=="],
+
+    "@vue/compiler-core": ["@vue/compiler-core@3.6.0-beta.13", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/shared": "3.6.0-beta.13", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-axPx/FRs1Vg6XoVTrn+jIBcl46FAjnLH9/tZpNtzfUYShxY/nm8FpNaaLAKAeAqyDBsGGoljnjv+Jg9Mvl1fqA=="],
+
+    "@vue/compiler-dom": ["@vue/compiler-dom@3.6.0-beta.13", "", { "dependencies": { "@vue/compiler-core": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13" } }, "sha512-CHY4yZQ2Pw8w/YEu8H2CvEZ7upPupliOcsFa8wqFAbVbNvUn7boAWlPQcAGygmn3rPJipwq+9DfSgUeWPumlCw=="],
+
+    "@vue/compiler-sfc": ["@vue/compiler-sfc@3.6.0-beta.13", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/compiler-core": "3.6.0-beta.13", "@vue/compiler-dom": "3.6.0-beta.13", "@vue/compiler-ssr": "3.6.0-beta.13", "@vue/compiler-vapor": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.14", "source-map-js": "^1.2.1" } }, "sha512-6mYwUHmpQEZzkeTaXjnyq//W3oJmGX2OgcBGFjP121ItbKYwY00C/Q2o9FWG7FojofbUa3PuMfF+FAQVI0Buow=="],
+
+    "@vue/compiler-ssr": ["@vue/compiler-ssr@3.6.0-beta.13", "", { "dependencies": { "@vue/compiler-dom": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13" } }, "sha512-MEQIxOUuoXrlkc10Zm6Qzu2eHB+Gnhzf0Z30aptfRNbmxyswj8MTIcpcQk6KsHuCtcVQXiQ+EFl3EauZBfp2dg=="],
+
+    "@vue/compiler-vapor": ["@vue/compiler-vapor@3.6.0-beta.13", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/compiler-dom": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-n70deyGK3xUpo/xxsAJObfGEYubfbPfpMNIBUnisiVx8seCZ+qJ9gCLIJUAwiAiZWTLRVl5nblzhjikHmbx3Uw=="],
+
+    "@vue/devtools-api": ["@vue/devtools-api@8.1.2", "", { "dependencies": { "@vue/devtools-kit": "^8.1.2" } }, "sha512-vA0O112YqyDuNA1s7Yb2gCgToQ/OxOWiFDO5ThLCcDy0ldHnSd1dUTaSYhOldbqoNgumE4dxtGAoAaSUKUD1Zg=="],
+
+    "@vue/devtools-core": ["@vue/devtools-core@8.1.2", "", { "dependencies": { "@vue/devtools-kit": "^8.1.2", "@vue/devtools-shared": "^8.1.2" }, "peerDependencies": { "vue": "^3.0.0" } }, "sha512-ZGGyaSBP4/+bN2Nd9ZHNYAVDRIzMw1rv2RyXWtyZlo6mQal+IDmTvKY4V+DjAEBhaXt30mHmsgYp1yXJ/2tIWg=="],
+
+    "@vue/devtools-kit": ["@vue/devtools-kit@8.1.2", "", { "dependencies": { "@vue/devtools-shared": "^8.1.2", "birpc": "^2.6.1", "hookable": "^5.5.3", "perfect-debounce": "^2.0.0" } }, "sha512-f75/upc+GCyjXErpgPGz4582ujS0L/adAltGy+tqXMGUJpgAcfGr6CxnnhpZY8BHuMYt6KpbF8uaFrrQG66rGQ=="],
+
+    "@vue/devtools-shared": ["@vue/devtools-shared@8.1.2", "", {}, "sha512-X9RyVFYAdkBe4IUf5v48TxBF/6QPmF8CmWrDAjXzfUHrgQ/HGfTC1A6TqgXqZ03ye66l3AD51BAGD69IvKM9sw=="],
+
+    "@vue/language-core": ["@vue/language-core@3.3.2", "", { "dependencies": { "@volar/language-core": "2.4.28", "@vue/compiler-dom": "^3.5.0", "@vue/shared": "^3.5.0", "alien-signals": "^3.2.0", "muggle-string": "^0.4.1", "path-browserify": "^1.0.1", "picomatch": "^4.0.4" } }, "sha512-CLwjSfHlPLhjd2qhuS3tTFtnOIWHXAM5u4X1DxmzlQ8j5bmOYlKCsSusOP7jCRJnlVg0mCTQtHU3vwFvopZGoQ=="],
+
+    "@vue/reactivity": ["@vue/reactivity@3.6.0-beta.13", "", { "dependencies": { "@vue/shared": "3.6.0-beta.13" } }, "sha512-iR/lv+EQmWgxP1k+Gc0HXFa9jv4EZEoAGzknl69dlUt3J6lOps8aymEdRS5gbrIjNPsZGwzSBfeScwv042KmMw=="],
+
+    "@vue/runtime-core": ["@vue/runtime-core@3.6.0-beta.13", "", { "dependencies": { "@vue/reactivity": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13" } }, "sha512-ejzb81LvwHbGxhswSPKu55PeVL4/Qud8yX6fKhqQrmOcGMdI7y6kRUHPVS9WeOkI+1qhWd/ApPKigdDqTDKsRA=="],
+
+    "@vue/runtime-dom": ["@vue/runtime-dom@3.6.0-beta.13", "", { "dependencies": { "@vue/reactivity": "3.6.0-beta.13", "@vue/runtime-core": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13", "csstype": "^3.2.3" } }, "sha512-eKCSL9IvjMzhmTzNZx710OuuhpauN80RdOOdu3aLZUPuXAk2S32vmGFU5dcEFx8jF7bQAJlVLbM3BUGCYODfuw=="],
+
+    "@vue/runtime-vapor": ["@vue/runtime-vapor@3.6.0-beta.13", "", { "dependencies": { "@vue/reactivity": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13" }, "peerDependencies": { "@vue/runtime-dom": "3.6.0-beta.13" } }, "sha512-25bjquxxF7BRs7dUDuNcmPnLusOw60qDx55fo21ZpgQ4IhGhPengbENiXZp9N3gIxr7odzixZEVffg5OFEnwlg=="],
+
+    "@vue/server-renderer": ["@vue/server-renderer@3.6.0-beta.13", "", { "dependencies": { "@vue/compiler-ssr": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13" }, "peerDependencies": { "vue": "3.6.0-beta.13" } }, "sha512-x5Gjo+ad8PQMVTyCf+2yoHPXaCm2eeItAx0BVQMkRAxjpaA9P92fdczSVVUNp/QCoAFv0TbChgtWypRBoeMqXA=="],
+
+    "@vue/shared": ["@vue/shared@3.6.0-beta.13", "", {}, "sha512-OUO/GCLRQk1DJmuuAU7QT7mGp7cY2B5Ajdsy1+T1xtdSm2rCsPi2GrWK1EF/nsnFM2t+RNxCjEt3oT+Wm5P2fA=="],
+
+    "@vue/tsconfig": ["@vue/tsconfig@0.9.1", "", { "peerDependencies": { "typescript": ">= 5.8", "vue": "^3.4.0" }, "optionalPeers": ["typescript", "vue"] }, "sha512-buvjm+9NzLCJL29KY1j1991YYJ5e6275OiK+G4jtmfIb+z4POywbdm0wXusT9adVWqe0xqg70TbI7+mRx4uU9w=="],
+
+    "abbrev": ["abbrev@3.0.1", "", {}, "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg=="],
+
+    "abort-controller": ["abort-controller@3.0.0", "", { "dependencies": { "event-target-shim": "^5.0.0" } }, "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg=="],
+
+    "acorn": ["acorn@8.16.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw=="],
+
+    "acorn-import-attributes": ["acorn-import-attributes@1.9.5", "", { "peerDependencies": { "acorn": "^8" } }, "sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ=="],
+
+    "acorn-jsx": ["acorn-jsx@5.3.2", "", { "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ=="],
+
+    "agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="],
+
+    "ajv": ["ajv@6.15.0", "", { "dependencies": { "fast-deep-equal": "^3.1.1", "fast-json-stable-stringify": "^2.0.0", "json-schema-traverse": "^0.4.1", "uri-js": "^4.2.2" } }, "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw=="],
+
+    "ajv-draft-04": ["ajv-draft-04@1.0.0", "", { "peerDependencies": { "ajv": "^8.5.0" }, "optionalPeers": ["ajv"] }, "sha512-mv00Te6nmYbRp5DCwclxtt7yV/joXJPGS7nM+97GdxvuttCOfgI3K4U25zboyeX0O+myI8ERluxQe5wljMmVIw=="],
+
+    "alchemy": ["alchemy@workspace:packages/alchemy"],
+
+    "alien-signals": ["alien-signals@3.2.1", "", {}, "sha512-I8FjmltrfnDFoZedi5CG8DghVYNhzb/Ijluz7tCSJH0xpd0484Kowhbb1XDYOxfJpU1p5wnM2X54dA+IfGyD1g=="],
+
+    "ansi-align": ["ansi-align@3.0.1", "", { "dependencies": { "string-width": "^4.1.0" } }, "sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w=="],
+
+    "ansi-escapes": ["ansi-escapes@7.3.0", "", { "dependencies": { "environment": "^1.0.0" } }, "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg=="],
+
+    "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+
+    "ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
+
+    "ansis": ["ansis@4.3.0", "", {}, "sha512-44mvgtPvohuU/70DdY5Oz2AIrLJ9k6/5x4KmoSvPwO+5Moijo0+N9D0fKbbYZQWP1hNm5CpOf+E01jhxG/r8xg=="],
+
+    "anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
+
+    "archiver": ["archiver@7.0.1", "", { "dependencies": { "archiver-utils": "^5.0.2", "async": "^3.2.4", "buffer-crc32": "^1.0.0", "readable-stream": "^4.0.0", "readdir-glob": "^1.1.2", "tar-stream": "^3.0.0", "zip-stream": "^6.0.1" } }, "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ=="],
+
+    "archiver-utils": ["archiver-utils@5.0.2", "", { "dependencies": { "glob": "^10.0.0", "graceful-fs": "^4.2.0", "is-stream": "^2.0.1", "lazystream": "^1.0.0", "lodash": "^4.17.15", "normalize-path": "^3.0.0", "readable-stream": "^4.0.0" } }, "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA=="],
+
+    "arg": ["arg@5.0.2", "", {}, "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg=="],
+
+    "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
+
+    "aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
+
+    "arkregex": ["arkregex@0.0.4", "", { "dependencies": { "@ark/util": "0.56.0" } }, "sha512-biS/FkvSwQq59TZ453piUp8bxMui11pgOMV9WHAnli1F8o0ayNCZzUwQadL/bGIUic5TkS/QlPcyMuI8ZIwedQ=="],
+
+    "arktype": ["arktype@2.1.28", "", { "dependencies": { "@ark/schema": "0.56.0", "@ark/util": "0.56.0", "arkregex": "0.0.4" } }, "sha512-LVZqXl2zWRpNFnbITrtFmqeqNkPPo+KemuzbGSY6jvJwCb4v8NsDzrWOLHnQgWl26TkJeWWcUNUeBpq2Mst1/Q=="],
+
+    "array-iterate": ["array-iterate@2.0.1", "", {}, "sha512-I1jXZMjAgCMmxT4qxXfPXa6SthSoE8h6gkSI9BGGNv8mP8G/v0blc+qFnZu6K42vTOiuME596QaLO0TP3Lk0xg=="],
+
+    "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="],
+
+    "ast-kit": ["ast-kit@2.2.0", "", { "dependencies": { "@babel/parser": "^7.28.5", "pathe": "^2.0.3" } }, "sha512-m1Q/RaVOnTp9JxPX+F+Zn7IcLYMzM8kZofDImfsKZd8MbR+ikdOzTeztStWqfrqIxZnYWryyI9ePm3NGjnZgGw=="],
+
+    "ast-types": ["ast-types@0.13.4", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w=="],
+
+    "ast-walker-scope": ["ast-walker-scope@0.9.0", "", { "dependencies": { "@babel/parser": "^7.29.2", "@babel/types": "^7.29.0", "ast-kit": "^2.2.0" } }, "sha512-IJdzo2vLiElBxKzwS36VsCue/62d6IdWjnPB2v3nuPKeWGynp6FF/CYoLa5i/3jXH/z97ZDdsXz6abpgM6w07A=="],
+
+    "astring": ["astring@1.9.0", "", { "bin": { "astring": "bin/astring" } }, "sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg=="],
+
+    "astro": ["astro@5.18.2", "", { "dependencies": { "@astrojs/compiler": "^2.13.0", "@astrojs/internal-helpers": "0.7.6", "@astrojs/markdown-remark": "6.3.11", "@astrojs/telemetry": "3.3.0", "@capsizecss/unpack": "^4.0.0", "@oslojs/encoding": "^1.1.0", "@rollup/pluginutils": "^5.3.0", "acorn": "^8.15.0", "aria-query": "^5.3.2", "axobject-query": "^4.1.0", "boxen": "8.0.1", "ci-info": "^4.3.1", "clsx": "^2.1.1", "common-ancestor-path": "^1.0.1", "cookie": "^1.1.1", "cssesc": "^3.0.0", "debug": "^4.4.3", "deterministic-object-hash": "^2.0.2", "devalue": "^5.6.2", "diff": "^8.0.3", "dlv": "^1.1.3", "dset": "^3.1.4", "es-module-lexer": "^1.7.0", "esbuild": "^0.27.3", "estree-walker": "^3.0.3", "flattie": "^1.1.1", "fontace": "~0.4.0", "github-slugger": "^2.0.0", "html-escaper": "3.0.3", "http-cache-semantics": "^4.2.0", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.1", "magic-string": "^0.30.21", "magicast": "^0.5.1", "mrmime": "^2.0.1", "neotraverse": "^0.6.18", "p-limit": "^6.2.0", "p-queue": "^8.1.1", "package-manager-detector": "^1.6.0", "piccolore": "^0.1.3", "picomatch": "^4.0.3", "prompts": "^2.4.2", "rehype": "^13.0.2", "semver": "^7.7.3", "shiki": "^3.21.0", "smol-toml": "^1.6.0", "svgo": "^4.0.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tsconfck": "^3.1.6", "ultrahtml": "^1.6.0", "unifont": "~0.7.3", "unist-util-visit": "^5.0.0", "unstorage": "^1.17.4", "vfile": "^6.0.3", "vite": "^6.4.1", "vitefu": "^1.1.1", "xxhash-wasm": "^1.1.0", "yargs-parser": "^21.1.1", "yocto-spinner": "^0.2.3", "zod": "^3.25.76", "zod-to-json-schema": "^3.25.1", "zod-to-ts": "^1.2.0" }, "optionalDependencies": { "sharp": "^0.34.0" }, "bin": { "astro": "astro.js" } }, "sha512-TnFwLnAXty5MXKPDGuKXqK4AMBXG+FH6RUdK7Oyc3gyfNoFIthT+4eRbzOK43bdRlLaZuxgciDSjgtggZ3OtGQ=="],
+
+    "astro-broken-links-checker": ["astro-broken-links-checker@1.1.0", "", { "dependencies": { "fast-glob": "^3.3.3", "node-html-parser": "^7.0.1", "p-limit": "^7.2.0" } }, "sha512-TYfDUZl0iYq1dVZO+R0appTBkDmSMsOrafgWJMGqoD4xVd74imTRdzekE6tA8+6AIi+/GXMGlr/im0unLD1LRg=="],
+
+    "astro-expressive-code": ["astro-expressive-code@0.41.7", "", { "dependencies": { "rehype-expressive-code": "^0.41.7" }, "peerDependencies": { "astro": "^4.0.0-beta || ^5.0.0-beta || ^3.3.0 || ^6.0.0-beta" } }, "sha512-hUpogGc6DdAd+I7pPXsctyYPRBJDK7Q7d06s4cyP0Vz3OcbziP3FNzN0jZci1BpCvLn9675DvS7B9ctKKX64JQ=="],
+
+    "astro-remote": ["astro-remote@0.3.4", "", { "dependencies": { "entities": "^4.5.0", "marked": "^12.0.0", "marked-footnote": "^1.2.2", "marked-smartypants": "^1.1.6", "ultrahtml": "^1.5.3" } }, "sha512-jL5skNQLA0YBc1R3bVGXyHew3FqGqsT7AgLzWAVeTLzFkwVMUYvs4/lKJSmS7ygcF1GnHnoKG6++8GL9VtWwGQ=="],
+
+    "async": ["async@3.2.6", "", {}, "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA=="],
+
+    "async-sema": ["async-sema@3.1.1", "", {}, "sha512-tLRNUXati5MFePdAk8dw7Qt7DpxPB60ofAgn8WRhW6a2rcimZnYBP9oxHiv0OHy+Wz7kPMG+t4LGdt31+4EmGg=="],
+
+    "auto-bind": ["auto-bind@5.0.1", "", {}, "sha512-ooviqdwwgfIfNmDwo94wlshcdzfO64XV0Cg6oDsDYBJfITDz1EngD2z7DkbvCWn+XIMsIqW27sEVF6qcpJrRcg=="],
+
+    "aws-ec2-example": ["aws-ec2-example@workspace:examples/aws-ec2"],
+
+    "aws-ecs-example": ["aws-ecs-example@workspace:examples/aws-ecs"],
+
+    "aws-eks-example": ["aws-eks-example@workspace:examples/aws-eks"],
+
+    "aws-lambda": ["aws-lambda@workspace:examples/aws-lambda"],
+
+    "aws-lambda-httpapi": ["aws-lambda-httpapi@workspace:examples/aws-lambda-httpapi"],
+
+    "aws-lambda-rpc": ["aws-lambda-rpc@workspace:examples/aws-lambda-rpc"],
+
+    "aws-rds-example": ["aws-rds-example@workspace:examples/aws-rds"],
+
+    "aws-rest-api": ["aws-rest-api@workspace:examples/aws-rest-api"],
+
+    "aws-ssl-profiles": ["aws-ssl-profiles@1.1.2", "", {}, "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g=="],
+
+    "aws-static-site-example": ["aws-static-site-example@workspace:examples/aws-static-site"],
+
+    "aws-vite-example": ["aws-vite-example@workspace:examples/aws-vite"],
+
+    "aws4fetch": ["aws4fetch@1.0.20", "", {}, "sha512-/djoAN709iY65ETD6LKCtyyEI04XIBP5xVvfmNxsEP0uJB5tyaGBztSryRr4HqMStr9R06PisQE7m9zDTXKu6g=="],
+
+    "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="],
+
+    "b4a": ["b4a@1.8.1", "", { "peerDependencies": { "react-native-b4a": "*" }, "optionalPeers": ["react-native-b4a"] }, "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw=="],
+
+    "babel-dead-code-elimination": ["babel-dead-code-elimination@1.0.12", "", { "dependencies": { "@babel/core": "^7.23.7", "@babel/parser": "^7.23.6", "@babel/traverse": "^7.23.7", "@babel/types": "^7.23.6" } }, "sha512-GERT7L2TiYcYDtYk1IpD+ASAYXjKbLTDPhBtYj7X1NuRMDTMtAx9kyBenub1Ev41lo91OHCKdmP+egTDmfQ7Ig=="],
+
+    "babel-plugin-jsx-dom-expressions": ["babel-plugin-jsx-dom-expressions@0.40.7", "", { "dependencies": { "@babel/helper-module-imports": "7.18.6", "@babel/plugin-syntax-jsx": "^7.18.6", "@babel/types": "^7.20.7", "html-entities": "2.3.3", "parse5": "^7.1.2" }, "peerDependencies": { "@babel/core": "^7.20.12" } }, "sha512-/O6JWUmjv03OI9lL2ry9bUjpD5S3PclM55RRJEyCdcFZ5W2SEA/59d+l2hNsk3gI6kiWRdRPdOtqZmsQzFN1pQ=="],
+
+    "babel-preset-solid": ["babel-preset-solid@1.9.12", "", { "dependencies": { "babel-plugin-jsx-dom-expressions": "^0.40.6" }, "peerDependencies": { "@babel/core": "^7.0.0", "solid-js": "^1.9.12" }, "optionalPeers": ["solid-js"] }, "sha512-LLqnuKVDlKpyBlMPcH6qEvs/wmS9a+NczppxJ3ryS/c0O5IiSFOIBQi9GzyiGDSbcJpx4Gr87jyFTos1MyEuWg=="],
+
+    "bail": ["bail@2.0.2", "", {}, "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw=="],
+
+    "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
+
+    "bare-events": ["bare-events@2.8.3", "", { "peerDependencies": { "bare-abort-controller": "*" }, "optionalPeers": ["bare-abort-controller"] }, "sha512-HdUm8EMQBLaJvGUdidNNbqpA1kYkwNcb+MYxkxCLAPJGQzlv9J0C24h8V65Z4c5GLd/JEALDvpFCQgpLJqc0zw=="],
+
+    "bare-fs": ["bare-fs@4.7.1", "", { "dependencies": { "bare-events": "^2.5.4", "bare-path": "^3.0.0", "bare-stream": "^2.6.4", "bare-url": "^2.2.2", "fast-fifo": "^1.3.2" }, "peerDependencies": { "bare-buffer": "*" }, "optionalPeers": ["bare-buffer"] }, "sha512-WDRsyVN52eAx/lBamKD6uyw8H4228h/x0sGGGegOamM2cd7Pag88GfMQalobXI+HaEUxpCkbKQUDOQqt9wawRw=="],
+
+    "bare-os": ["bare-os@3.9.1", "", {}, "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ=="],
+
+    "bare-path": ["bare-path@3.0.0", "", { "dependencies": { "bare-os": "^3.0.1" } }, "sha512-tyfW2cQcB5NN8Saijrhqn0Zh7AnFNsnczRcuWODH0eYAXBsJ5gVxAUuNr7tsHSC6IZ77cA0SitzT+s47kot8Mw=="],
+
+    "bare-stream": ["bare-stream@2.13.1", "", { "dependencies": { "streamx": "^2.25.0", "teex": "^1.0.1" }, "peerDependencies": { "bare-abort-controller": "*", "bare-buffer": "*", "bare-events": "*" }, "optionalPeers": ["bare-abort-controller", "bare-buffer", "bare-events"] }, "sha512-Vp0cnjYyrEC4whYTymQ+YZi6pBpfiICZO3cfRG8sy67ZNWe951urv1x4eW1BKNngw3U+3fPYb5JQvHbCtxH7Ow=="],
+
+    "bare-url": ["bare-url@2.4.3", "", { "dependencies": { "bare-path": "^3.0.0" } }, "sha512-Kccpc7ACfXaxfeInfqKcZtW4pT5YBn1mesc4sCsun6sRwtbJ4h+sNOaksUpYEJUKfN65YWC6Bw2OJEFiKxq8nQ=="],
+
+    "base-64": ["base-64@1.0.0", "", {}, "sha512-kwDPIFCGx0NZHog36dj+tHiwP4QMzsZ3AgMViUBKI0+V5n4U0ufTCUMhnQ04diaRI8EX/QcPfql7zlhZ7j4zgg=="],
+
+    "base64-js": ["base64-js@0.0.8", "", {}, "sha512-3XSA2cR/h/73EzlXXdU6YNycmYI7+kicTxks4eJg2g39biHR84slg2+des+p7iHYhbRg/udIS4TD53WabcOUkw=="],
+
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.10.32", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-wbPvpyjJPC0zdfdKXxqEL3Ea+bOMD/87X4lftiJkkaBiuG6ALQy1SLmEd7BSmVCuwCQsBrCamgBoLyfFDD1EPg=="],
+
+    "basic-ftp": ["basic-ftp@5.3.1", "", {}, "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw=="],
+
+    "bcp-47": ["bcp-47@2.1.0", "", { "dependencies": { "is-alphabetical": "^2.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0" } }, "sha512-9IIS3UPrvIa1Ej+lVDdDwO7zLehjqsaByECw0bu2RRGP73jALm6FYbzI5gWbgHLvNdkvfXB5YrSbocZdOS0c0w=="],
+
+    "bcp-47-match": ["bcp-47-match@2.0.3", "", {}, "sha512-JtTezzbAibu8G0R9op9zb3vcWZd9JF6M0xOYGPn0fNCd7wOpRB1mU2mH9T8gaBGbAAyIIVgB2G7xG0GP98zMAQ=="],
+
+    "before-after-hook": ["before-after-hook@4.0.0", "", {}, "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="],
+
+    "better-auth": ["better-auth@1.6.12", "", { "dependencies": { "@better-auth/core": "1.6.12", "@better-auth/drizzle-adapter": "1.6.12", "@better-auth/kysely-adapter": "1.6.12", "@better-auth/memory-adapter": "1.6.12", "@better-auth/mongo-adapter": "1.6.12", "@better-auth/prisma-adapter": "1.6.12", "@better-auth/telemetry": "1.6.12", "@better-auth/utils": "0.4.1", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.5", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-vJG8hB+zcayZEJgcWGTzP2XODZuf/WKViOtam+uhhQ9879yc7fDWAV9O4jSs+R28noSXIAaB3zhIMN3DaDO3cA=="],
+
+    "better-call": ["better-call@1.3.5", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-kOFJkBP7utAQLEYrobZm3vkTH8mXq5GNgvjc5/XEST1ilVHaxXUXfeDeFlqoETMtyqS4+3/h4ONX2i++ebZrvA=="],
+
+    "binary-extensions": ["binary-extensions@2.3.0", "", {}, "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw=="],
+
+    "bindings": ["bindings@1.5.0", "", { "dependencies": { "file-uri-to-path": "1.0.0" } }, "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ=="],
+
+    "birpc": ["birpc@2.9.0", "", {}, "sha512-KrayHS5pBi69Xi9JmvoqrIgYGDkD6mcSe/i6YKi3w5kekCLzrX4+nawcXqrj2tIp50Kw/mT/s3p+GVK0A0sKxw=="],
+
+    "blake3-wasm": ["blake3-wasm@2.1.5", "", {}, "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g=="],
+
+    "boolbase": ["boolbase@1.0.0", "", {}, "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="],
+
+    "bowser": ["bowser@2.14.1", "", {}, "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg=="],
+
+    "boxen": ["boxen@8.0.1", "", { "dependencies": { "ansi-align": "^3.0.1", "camelcase": "^8.0.0", "chalk": "^5.3.0", "cli-boxes": "^3.0.0", "string-width": "^7.2.0", "type-fest": "^4.21.0", "widest-line": "^5.0.0", "wrap-ansi": "^9.0.0" } }, "sha512-F3PH5k5juxom4xktynS7MoFY+NUWH5LC4CnH11YB8NPew+HLpmBLCybSAEyb2F+4pRXhuhWqFesoQd6DAyc2hw=="],
+
+    "brace-expansion": ["brace-expansion@5.0.6", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g=="],
+
+    "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
+
+    "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
+
+    "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
+
+    "buffer-crc32": ["buffer-crc32@1.0.0", "", {}, "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w=="],
+
+    "buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
+
+    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
+
+    "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
+
+    "c12": ["c12@3.3.4", "", { "dependencies": { "chokidar": "^5.0.0", "confbox": "^0.2.4", "defu": "^6.1.6", "dotenv": "^17.3.1", "exsolve": "^1.0.8", "giget": "^3.2.0", "jiti": "^2.6.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.0", "rc9": "^3.0.1" }, "peerDependencies": { "magicast": "*" }, "optionalPeers": ["magicast"] }, "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA=="],
+
+    "cac": ["cac@6.7.14", "", {}, "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ=="],
+
+    "call-me-maybe": ["call-me-maybe@1.0.2", "", {}, "sha512-HpX65o1Hnr9HH25ojC1YGs7HCQLq0GCOibSaWER0eNpgJ/Z1MZv2mTc7+xh6WOPxbRVcmgbv4hGU+uSQ/2xFZQ=="],
+
+    "camelcase": ["camelcase@8.0.0", "", {}, "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA=="],
+
+    "camelize": ["camelize@1.0.1", "", {}, "sha512-dU+Tx2fsypxTgtLoE36npi3UqcjSSMNYfkqgmoEhtZrraP5VWq0K7FkWVTYa8eMPtnU/G2txVsfdCJTn9uzpuQ=="],
+
+    "caniuse-lite": ["caniuse-lite@1.0.30001793", "", {}, "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA=="],
+
+    "capnweb": ["capnweb@0.6.1", "", {}, "sha512-fmhV26QPd1ewf5R74h55oVZnGwIcSaRMzbfLQUy8+zOBjuTmT3KXoT8wxHvnp1m9Ht9BoUUS5ZwNLoVLfQTyBg=="],
+
+    "ccount": ["ccount@2.0.1", "", {}, "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg=="],
+
+    "chai": ["chai@6.2.2", "", {}, "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="],
+
+    "chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="],
+
+    "changelogen": ["changelogen@0.5.7", "", { "dependencies": { "c12": "^1.11.2", "colorette": "^2.0.20", "consola": "^3.2.3", "convert-gitmoji": "^0.1.5", "mri": "^1.2.0", "node-fetch-native": "^1.6.4", "ofetch": "^1.3.4", "open": "^10.1.0", "pathe": "^1.1.2", "pkg-types": "^1.2.0", "scule": "^1.3.0", "semver": "^7.6.3", "std-env": "^3.7.0", "yaml": "^2.5.1" }, "bin": { "changelogen": "dist/cli.mjs" } }, "sha512-cTZXBcJMl3pudE40WENOakXkcVtrbBpbkmSkM20NdRiUqa4+VYRdXdEsgQ0BNQ6JBE2YymTNWtPKVF7UCTN5+g=="],
+
+    "changelogithub": ["changelogithub@13.16.1", "", { "dependencies": { "ansis": "^4.2.0", "c12": "^3.3.1", "cac": "^6.7.14", "changelogen": "0.5.7", "convert-gitmoji": "^0.1.5", "execa": "^9.6.0", "ofetch": "^1.4.1", "semver": "^7.7.3", "tinyglobby": "^0.2.15" }, "bin": { "changelogithub": "cli.mjs" } }, "sha512-h4etOmEM/wtqBWKPbnHoqv2C8moRCCEGTckwwWpvRgr/t1tY0MbyjQbZKy1ETQ7gn1UTQMJkCSRQ4KxiQ+HfSQ=="],
+
+    "character-entities": ["character-entities@2.0.2", "", {}, "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ=="],
+
+    "character-entities-html4": ["character-entities-html4@2.1.0", "", {}, "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA=="],
+
+    "character-entities-legacy": ["character-entities-legacy@3.0.0", "", {}, "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ=="],
+
+    "character-reference-invalid": ["character-reference-invalid@2.0.1", "", {}, "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw=="],
+
+    "chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
+
+    "chownr": ["chownr@2.0.0", "", {}, "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ=="],
+
+    "ci-info": ["ci-info@4.4.0", "", {}, "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg=="],
+
+    "citty": ["citty@0.2.2", "", {}, "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w=="],
+
+    "cli-boxes": ["cli-boxes@3.0.0", "", {}, "sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g=="],
+
+    "cli-cursor": ["cli-cursor@4.0.0", "", { "dependencies": { "restore-cursor": "^4.0.0" } }, "sha512-VGtlMu3x/4DOtIUwEkRezxUZ2lBacNJCHash0N0WeZDBS+7Ux1dm3XWAgWYxLJFMMdOeXMHXorshEFhbMSGelg=="],
+
+    "cli-truncate": ["cli-truncate@5.2.0", "", { "dependencies": { "slice-ansi": "^8.0.0", "string-width": "^8.2.0" } }, "sha512-xRwvIOMGrfOAnM1JYtqQImuaNtDEv9v6oIYAs4LIHwTiKee8uwvIi363igssOC0O5U04i4AlENs79LQLu9tEMw=="],
+
+    "cliui": ["cliui@8.0.1", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.1", "wrap-ansi": "^7.0.0" } }, "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ=="],
+
+    "cloudflare-dev": ["cloudflare-dev@workspace:examples/cloudflare-dev"],
+
+    "cloudflare-email": ["cloudflare-email@workspace:examples/cloudflare-email"],
+
+    "cloudflare-git-artifacts": ["cloudflare-git-artifacts@workspace:examples/cloudflare-git-artifacts"],
+
+    "cloudflare-neon-drizzle": ["cloudflare-neon-drizzle@workspace:examples/cloudflare-neon-drizzle"],
+
+    "cloudflare-planetscale-mysql-drizzle": ["cloudflare-planetscale-mysql-drizzle@workspace:examples/cloudflare-planetscale-mysql-drizzle"],
+
+    "cloudflare-planetscale-postgres-drizzle": ["cloudflare-planetscale-postgres-drizzle@workspace:examples/cloudflare-planetscale-postgres-drizzle"],
+
+    "cloudflare-secrets-store": ["cloudflare-secrets-store@workspace:examples/cloudflare-secrets-store"],
+
+    "cloudflare-solid-ssr": ["cloudflare-solid-ssr@workspace:examples/cloudflare-solidjs-ssr"],
+
+    "cloudflare-tanstack-example": ["cloudflare-tanstack-example@workspace:examples/cloudflare-tanstack"],
+
+    "cloudflare-tanstack-start-solid-example": ["cloudflare-tanstack-start-solid-example@workspace:examples/cloudflare-tanstack-start-solid"],
+
+    "cloudflare-vite-example": ["cloudflare-vite-example@workspace:examples/cloudflare-static-site"],
+
+    "cloudflare-vue": ["cloudflare-vue@workspace:examples/cloudflare-vue"],
+
+    "cloudflare-worker": ["cloudflare-worker@workspace:examples/cloudflare-worker"],
+
+    "cloudflare-worker-async": ["cloudflare-worker-async@workspace:examples/cloudflare-worker-async"],
+
+    "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
+
+    "cluster-key-slot": ["cluster-key-slot@1.1.1", "", {}, "sha512-rwHwUfXL40Chm1r08yrhU3qpUvdVlgkKNeyeGPOxnW8/SyVDvgRaed/Uz54AqWNaTCAThlj6QAs3TZcKI0xDEw=="],
+
+    "code-block-writer": ["code-block-writer@13.0.3", "", {}, "sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg=="],
+
+    "code-excerpt": ["code-excerpt@4.0.0", "", { "dependencies": { "convert-to-spaces": "^2.0.1" } }, "sha512-xxodCmBen3iy2i0WtAK8FlFNrRzjUqjRsMfho58xT/wvZU1YTM3fCnRjcy1gJPMepaRlgm/0e6w8SpWHpn3/cA=="],
+
+    "collapse-white-space": ["collapse-white-space@2.1.0", "", {}, "sha512-loKTxY1zCOuG4j9f6EPnuyyYkf58RnhhWTvRoZEokgB+WbdXehfjFviyOVYkqzEWz1Q5kRiZdBYS5SwxbQYwzw=="],
+
+    "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
+
+    "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "colorette": ["colorette@2.0.20", "", {}, "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w=="],
+
+    "comma-separated-tokens": ["comma-separated-tokens@2.0.3", "", {}, "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg=="],
+
+    "commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
+
+    "common-ancestor-path": ["common-ancestor-path@1.0.1", "", {}, "sha512-L3sHRo1pXXEqX8VU28kfgUY+YGsk09hPqZiZmLacNib6XNTCM8ubYeT7ryXQw8asB1sKgcU5lkB7ONug08aB8w=="],
+
+    "commondir": ["commondir@1.0.1", "", {}, "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg=="],
+
+    "compatx": ["compatx@0.2.0", "", {}, "sha512-6gLRNt4ygsi5NyMVhceOCFv14CIdDFN7fQjX1U4+47qVE/+kjPoXMK65KWK+dWxmFzMTuKazoQ9sch6pM0p5oA=="],
+
+    "compress-commons": ["compress-commons@6.0.2", "", { "dependencies": { "crc-32": "^1.2.0", "crc32-stream": "^6.0.0", "is-stream": "^2.0.1", "normalize-path": "^3.0.0", "readable-stream": "^4.0.0" } }, "sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg=="],
+
+    "confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
+
+    "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
+
+    "content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+
+    "convert-gitmoji": ["convert-gitmoji@0.1.5", "", {}, "sha512-4wqOafJdk2tqZC++cjcbGcaJ13BZ3kwldf06PTiAQRAB76Z1KJwZNL1SaRZMi2w1FM9RYTgZ6QErS8NUl/GBmQ=="],
+
+    "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
+
+    "convert-to-spaces": ["convert-to-spaces@2.0.1", "", {}, "sha512-rcQ1bsQO9799wq24uE5AM2tAILy4gXGIK/njFWcVQkGNZ96edlpY+A7bjwvzjYvLDyzmG1MmMLZhpcsb+klNMQ=="],
+
+    "cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
+
+    "cookie-es": ["cookie-es@2.0.1", "", {}, "sha512-aVf4A4hI2w70LnF7GG+7xDQUkliwiXWXFvTjkip4+b64ygDQ2sJPRSKFDHbxn8o0xu9QzPkMuuiWIXyFSE2slA=="],
+
+    "core-util-is": ["core-util-is@1.0.3", "", {}, "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ=="],
+
+    "cose-base": ["cose-base@1.0.3", "", { "dependencies": { "layout-base": "^1.0.0" } }, "sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg=="],
+
+    "crc-32": ["crc-32@1.2.2", "", { "bin": { "crc32": "bin/crc32.njs" } }, "sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ=="],
+
+    "crc32-stream": ["crc32-stream@6.0.0", "", { "dependencies": { "crc-32": "^1.2.0", "readable-stream": "^4.0.0" } }, "sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g=="],
+
+    "croner": ["croner@10.0.1", "", {}, "sha512-ixNtAJndqh173VQ4KodSdJEI6nuioBWI0V1ITNKhZZsO0pEMoDxz539T4FTTbSZ/xIOSuDnzxLVRqBVSvPNE2g=="],
+
+    "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
+
+    "crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
+    "css-background-parser": ["css-background-parser@0.1.0", "", {}, "sha512-2EZLisiZQ+7m4wwur/qiYJRniHX4K5Tc9w93MT3AS0WS1u5kaZ4FKXlOTBhOjc+CgEgPiGY+fX1yWD8UwpEqUA=="],
+
+    "css-box-shadow": ["css-box-shadow@1.0.0-3", "", {}, "sha512-9jaqR6e7Ohds+aWwmhe6wILJ99xYQbfmK9QQB9CcMjDbTxPZjwEmUQpU91OG05Xgm8BahT5fW+svbsQGjS/zPg=="],
+
+    "css-color-keywords": ["css-color-keywords@1.0.0", "", {}, "sha512-FyyrDHZKEjXDpNJYvVsV960FiqQyXc/LlYmsxl2BcdMb2WPx0OGRVgTg55rPSyLSNMqP52R9r8geSp7apN3Ofg=="],
+
+    "css-gradient-parser": ["css-gradient-parser@0.0.17", "", {}, "sha512-w2Xy9UMMwlKtou0vlRnXvWglPAceXCTtcmVSo8ZBUvqCV5aXEFP/PC6d+I464810I9FT++UACwTD5511bmGPUg=="],
+
+    "css-js-gen": ["css-js-gen@1.1.0", "", {}, "sha512-CuPSTe6EwlrDHcMFOfcO3SwVqclVKLnqSbTGGYzfFt8z2NenGeupp47Z3wx+yhQ2pdozb3R8hc+nyECBTykooQ=="],
+
+    "css-select": ["css-select@5.2.2", "", { "dependencies": { "boolbase": "^1.0.0", "css-what": "^6.1.0", "domhandler": "^5.0.2", "domutils": "^3.0.1", "nth-check": "^2.0.1" } }, "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw=="],
+
+    "css-selector-parser": ["css-selector-parser@3.3.0", "", {}, "sha512-Y2asgMGFqJKF4fq4xHDSlFYIkeVfRsm69lQC1q9kbEsH5XtnINTMrweLkjYMeaUgiXBy/uvKeO/a1JHTNnmB2g=="],
+
+    "css-to-react-native": ["css-to-react-native@3.2.0", "", { "dependencies": { "camelize": "^1.0.0", "css-color-keywords": "^1.0.0", "postcss-value-parser": "^4.0.2" } }, "sha512-e8RKaLXMOFii+02mOlqwjbD00KSEKqblnpO9e++1aXS1fPQOpS1YoqdVHBqPjHNoxeF2mimzVqawm2KCbEdtHQ=="],
+
+    "css-tree": ["css-tree@3.2.1", "", { "dependencies": { "mdn-data": "2.27.1", "source-map-js": "^1.2.1" } }, "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA=="],
+
+    "css-what": ["css-what@6.2.2", "", {}, "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA=="],
+
+    "cssesc": ["cssesc@3.0.0", "", { "bin": { "cssesc": "bin/cssesc" } }, "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg=="],
+
+    "csso": ["csso@5.0.5", "", { "dependencies": { "css-tree": "~2.2.0" } }, "sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ=="],
+
+    "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
+
+    "cytoscape": ["cytoscape@3.33.4", "", {}, "sha512-HIN5Pmd9MrX9BkV7tDwnOcEJCSFvCpc8X97h3f508J6I5FsqAY65wKOCvgH2CuP42CaahWaz4tuh32SOOIH7ww=="],
+
+    "cytoscape-cose-bilkent": ["cytoscape-cose-bilkent@4.1.0", "", { "dependencies": { "cose-base": "^1.0.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-wgQlVIUJF13Quxiv5e1gstZ08rnZj2XaLHGoFMYXz7SkNfCDOOteKBE6SYRfA9WxxI/iBc3ajfDoc6hb/MRAHQ=="],
+
+    "cytoscape-fcose": ["cytoscape-fcose@2.2.0", "", { "dependencies": { "cose-base": "^2.2.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-ki1/VuRIHFCzxWNrsshHYPs6L7TvLu3DL+TyIGEsRcvVERmxokbf5Gdk7mFxZnTdiGtnA4cfSmjZJMviqSuZrQ=="],
+
+    "d3": ["d3@7.9.0", "", { "dependencies": { "d3-array": "3", "d3-axis": "3", "d3-brush": "3", "d3-chord": "3", "d3-color": "3", "d3-contour": "4", "d3-delaunay": "6", "d3-dispatch": "3", "d3-drag": "3", "d3-dsv": "3", "d3-ease": "3", "d3-fetch": "3", "d3-force": "3", "d3-format": "3", "d3-geo": "3", "d3-hierarchy": "3", "d3-interpolate": "3", "d3-path": "3", "d3-polygon": "3", "d3-quadtree": "3", "d3-random": "3", "d3-scale": "4", "d3-scale-chromatic": "3", "d3-selection": "3", "d3-shape": "3", "d3-time": "3", "d3-time-format": "4", "d3-timer": "3", "d3-transition": "3", "d3-zoom": "3" } }, "sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA=="],
+
+    "d3-array": ["d3-array@3.2.4", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg=="],
+
+    "d3-axis": ["d3-axis@3.0.0", "", {}, "sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw=="],
+
+    "d3-brush": ["d3-brush@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-drag": "2 - 3", "d3-interpolate": "1 - 3", "d3-selection": "3", "d3-transition": "3" } }, "sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ=="],
+
+    "d3-chord": ["d3-chord@3.0.1", "", { "dependencies": { "d3-path": "1 - 3" } }, "sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g=="],
+
+    "d3-color": ["d3-color@3.1.0", "", {}, "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA=="],
+
+    "d3-contour": ["d3-contour@4.0.2", "", { "dependencies": { "d3-array": "^3.2.0" } }, "sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA=="],
+
+    "d3-delaunay": ["d3-delaunay@6.0.4", "", { "dependencies": { "delaunator": "5" } }, "sha512-mdjtIZ1XLAM8bm/hx3WwjfHt6Sggek7qH043O8KEjDXN40xi3vx/6pYSVTwLjEgiXQTbvaouWKynLBiUZ6SK6A=="],
+
+    "d3-dispatch": ["d3-dispatch@3.0.1", "", {}, "sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg=="],
+
+    "d3-drag": ["d3-drag@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-selection": "3" } }, "sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg=="],
+
+    "d3-dsv": ["d3-dsv@3.0.1", "", { "dependencies": { "commander": "7", "iconv-lite": "0.6", "rw": "1" }, "bin": { "csv2json": "bin/dsv2json.js", "csv2tsv": "bin/dsv2dsv.js", "dsv2dsv": "bin/dsv2dsv.js", "dsv2json": "bin/dsv2json.js", "json2csv": "bin/json2dsv.js", "json2dsv": "bin/json2dsv.js", "json2tsv": "bin/json2dsv.js", "tsv2csv": "bin/dsv2dsv.js", "tsv2json": "bin/dsv2json.js" } }, "sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q=="],
+
+    "d3-ease": ["d3-ease@3.0.1", "", {}, "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w=="],
+
+    "d3-fetch": ["d3-fetch@3.0.1", "", { "dependencies": { "d3-dsv": "1 - 3" } }, "sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw=="],
+
+    "d3-force": ["d3-force@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-quadtree": "1 - 3", "d3-timer": "1 - 3" } }, "sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg=="],
+
+    "d3-format": ["d3-format@3.1.2", "", {}, "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg=="],
+
+    "d3-geo": ["d3-geo@3.1.1", "", { "dependencies": { "d3-array": "2.5.0 - 3" } }, "sha512-637ln3gXKXOwhalDzinUgY83KzNWZRKbYubaG+fGVuc/dxO64RRljtCTnf5ecMyE1RIdtqpkVcq0IbtU2S8j2Q=="],
+
+    "d3-hierarchy": ["d3-hierarchy@3.1.2", "", {}, "sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA=="],
+
+    "d3-interpolate": ["d3-interpolate@3.0.1", "", { "dependencies": { "d3-color": "1 - 3" } }, "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g=="],
+
+    "d3-path": ["d3-path@3.1.0", "", {}, "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ=="],
+
+    "d3-polygon": ["d3-polygon@3.0.1", "", {}, "sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg=="],
+
+    "d3-quadtree": ["d3-quadtree@3.0.1", "", {}, "sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw=="],
+
+    "d3-random": ["d3-random@3.0.1", "", {}, "sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ=="],
+
+    "d3-sankey": ["d3-sankey@0.12.3", "", { "dependencies": { "d3-array": "1 - 2", "d3-shape": "^1.2.0" } }, "sha512-nQhsBRmM19Ax5xEIPLMY9ZmJ/cDvd1BG3UVvt5h3WRxKg5zGRbvnteTyWAbzeSvlh3tW7ZEmq4VwR5mB3tutmQ=="],
+
+    "d3-scale": ["d3-scale@4.0.2", "", { "dependencies": { "d3-array": "2.10.0 - 3", "d3-format": "1 - 3", "d3-interpolate": "1.2.0 - 3", "d3-time": "2.1.1 - 3", "d3-time-format": "2 - 4" } }, "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ=="],
+
+    "d3-scale-chromatic": ["d3-scale-chromatic@3.1.0", "", { "dependencies": { "d3-color": "1 - 3", "d3-interpolate": "1 - 3" } }, "sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ=="],
+
+    "d3-selection": ["d3-selection@3.0.0", "", {}, "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ=="],
+
+    "d3-shape": ["d3-shape@3.2.0", "", { "dependencies": { "d3-path": "^3.1.0" } }, "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA=="],
+
+    "d3-time": ["d3-time@3.1.0", "", { "dependencies": { "d3-array": "2 - 3" } }, "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q=="],
+
+    "d3-time-format": ["d3-time-format@4.1.0", "", { "dependencies": { "d3-time": "1 - 3" } }, "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg=="],
+
+    "d3-timer": ["d3-timer@3.0.1", "", {}, "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA=="],
+
+    "d3-transition": ["d3-transition@3.0.1", "", { "dependencies": { "d3-color": "1 - 3", "d3-dispatch": "1 - 3", "d3-ease": "1 - 3", "d3-interpolate": "1 - 3", "d3-timer": "1 - 3" }, "peerDependencies": { "d3-selection": "2 - 3" } }, "sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w=="],
+
+    "d3-zoom": ["d3-zoom@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-drag": "2 - 3", "d3-interpolate": "1 - 3", "d3-selection": "2 - 3", "d3-transition": "2 - 3" } }, "sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw=="],
+
+    "dagre-d3-es": ["dagre-d3-es@7.0.14", "", { "dependencies": { "d3": "^7.9.0", "lodash-es": "^4.17.21" } }, "sha512-P4rFMVq9ESWqmOgK+dlXvOtLwYg0i7u0HBGJER0LZDJT2VHIPAMZ/riPxqJceWMStH5+E61QxFra9kIS3AqdMg=="],
+
+    "data-uri-to-buffer": ["data-uri-to-buffer@6.0.2", "", {}, "sha512-7hvf7/GW8e86rW0ptuwS3OcBGDjIi6SZva7hCyWC0yYry2cOPmLIjXAUHI6DK2HsnwJd9ifmt57i8eV2n4YNpw=="],
+
+    "dayjs": ["dayjs@1.11.21", "", {}, "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA=="],
+
+    "db0": ["db0@0.3.4", "", { "peerDependencies": { "@electric-sql/pglite": "*", "@libsql/client": "*", "better-sqlite3": "*", "drizzle-orm": "*", "mysql2": "*", "sqlite3": "*" }, "optionalPeers": ["@electric-sql/pglite", "@libsql/client", "better-sqlite3", "drizzle-orm", "mysql2", "sqlite3"] }, "sha512-RiXXi4WaNzPTHEOu8UPQKMooIbqOEyqA1t7Z6MsdxSCeb8iUC9ko3LcmsLmeUt2SM5bctfArZKkRQggKZz7JNw=="],
+
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+
+    "decode-named-character-reference": ["decode-named-character-reference@1.3.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q=="],
+
+    "decode-uri-component": ["decode-uri-component@0.4.1", "", {}, "sha512-+8VxcR21HhTy8nOt6jf20w0c9CADrw1O8d+VZ/YzzCt4bJ3uBjw+D1q2osAB8RnpwwaeYBxy0HyKQxD5JBMuuQ=="],
+
+    "deep-is": ["deep-is@0.1.4", "", {}, "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="],
+
+    "deepmerge": ["deepmerge@4.3.1", "", {}, "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="],
+
+    "default-browser": ["default-browser@5.5.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw=="],
+
+    "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],
+
+    "define-lazy-prop": ["define-lazy-prop@3.0.0", "", {}, "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg=="],
+
+    "defu": ["defu@6.1.7", "", {}, "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ=="],
+
+    "degenerator": ["degenerator@5.0.1", "", { "dependencies": { "ast-types": "^0.13.4", "escodegen": "^2.1.0", "esprima": "^4.0.1" } }, "sha512-TllpMR/t0M5sqCXfj85i4XaAzxmS5tVA16dqvdkMwGmzI+dXLXnw3J+3Vdv7VKw+ThlTMboK6i9rnZ6Nntj5CQ=="],
+
+    "delaunator": ["delaunator@5.1.0", "", { "dependencies": { "robust-predicates": "^3.0.2" } }, "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ=="],
+
+    "denque": ["denque@2.1.0", "", {}, "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw=="],
+
+    "depd": ["depd@2.0.0", "", {}, "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw=="],
+
+    "deprecation": ["deprecation@2.3.1", "", {}, "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="],
+
+    "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
+
+    "destr": ["destr@2.0.5", "", {}, "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA=="],
+
+    "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
+
+    "deterministic-object-hash": ["deterministic-object-hash@2.0.2", "", { "dependencies": { "base-64": "^1.0.0" } }, "sha512-KxektNH63SrbfUyDiwXqRb1rLwKt33AmMv+5Nhsw1kqZ13SJBRTgZHtGbE+hH3a1mVW1cz+4pqSWVPAtLVXTzQ=="],
+
+    "devalue": ["devalue@5.8.1", "", {}, "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw=="],
+
+    "devlop": ["devlop@1.1.0", "", { "dependencies": { "dequal": "^2.0.0" } }, "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA=="],
+
+    "devtools-protocol": ["devtools-protocol@0.0.1299070", "", {}, "sha512-+qtL3eX50qsJ7c+qVyagqi7AWMoQCBGNfoyJZMwm/NSXVqLYbuitrWEEIzxfUmTNy7//Xe8yhMmQ+elj3uAqSg=="],
+
+    "diff": ["diff@8.0.4", "", {}, "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw=="],
+
+    "direction": ["direction@2.0.1", "", { "bin": { "direction": "cli.js" } }, "sha512-9S6m9Sukh1cZNknO1CWAr2QAWsbKLafQiyM5gZ7VgXHeuaoUwffKN4q6NC4A/Mf9iiPlOXQEKW/Mv/mh9/3YFA=="],
+
+    "dlv": ["dlv@1.1.3", "", {}, "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA=="],
+
+    "dom-serializer": ["dom-serializer@2.0.0", "", { "dependencies": { "domelementtype": "^2.3.0", "domhandler": "^5.0.2", "entities": "^4.2.0" } }, "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg=="],
+
+    "domelementtype": ["domelementtype@2.3.0", "", {}, "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw=="],
+
+    "domhandler": ["domhandler@5.0.3", "", { "dependencies": { "domelementtype": "^2.3.0" } }, "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w=="],
+
+    "dompurify": ["dompurify@3.4.7", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-2jBxDJY4RR06tQNy4w5FlFH7kfxsQZlufd0sbv+chfHCxeJwrFw2baUDsSwvBISD4K4RDbd0PTfy3uNXsR6siA=="],
+
+    "domutils": ["domutils@3.2.2", "", { "dependencies": { "dom-serializer": "^2.0.0", "domelementtype": "^2.3.0", "domhandler": "^5.0.3" } }, "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw=="],
+
+    "dot-prop": ["dot-prop@10.1.0", "", { "dependencies": { "type-fest": "^5.0.0" } }, "sha512-MVUtAugQMOff5RnBy2d9N31iG0lNwg1qAoAOn7pOK5wf94WIaE3My2p3uwTQuvS2AcqchkcR3bHByjaM0mmi7Q=="],
+
+    "dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
+
+    "drizzle-kit": ["drizzle-kit@1.0.0-rc.1", "", { "dependencies": { "@drizzle-team/brocli": "^0.11.0", "@js-temporal/polyfill": "^0.5.1", "esbuild": "^0.25.10", "get-tsconfig": "^4.13.6", "jiti": "^2.6.1" }, "bin": { "drizzle-kit": "bin.cjs" } }, "sha512-eDvXzRhke7OwvmN7AciGOU1E2y17MKNhghGciyw1RbmmkuD/2KDXLn3rFRZcDBmfj6CQSEnyvbU+7Fqrn2JQyA=="],
+
+    "drizzle-orm": ["drizzle-orm@1.0.0-rc.1", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@effect/sql-pg": ">=4.0.0-beta.58 || >=4.0.0", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@sinclair/typebox": ">=0.34.8", "@sqlitecloud/drivers": ">=1.0.653", "@tidbcloud/serverless": "*", "@tursodatabase/database": ">=0.2.1", "@tursodatabase/database-common": ">=0.2.1", "@tursodatabase/database-wasm": ">=0.2.1", "@types/better-sqlite3": "*", "@types/mssql": "^9.1.4", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "arktype": ">=2.0.0", "better-sqlite3": ">=9.3.0", "bun-types": "*", "effect": ">=4.0.0-beta.58 || >=4.0.0", "expo-sqlite": ">=14.0.0", "mssql": "^11.0.1", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5", "typebox": ">=1.0.0", "valibot": ">=1.0.0-beta.7", "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@effect/sql-pg", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@sinclair/typebox", "@sqlitecloud/drivers", "@tidbcloud/serverless", "@tursodatabase/database", "@tursodatabase/database-common", "@tursodatabase/database-wasm", "@types/better-sqlite3", "@types/mssql", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "arktype", "better-sqlite3", "bun-types", "effect", "expo-sqlite", "mssql", "mysql2", "pg", "postgres", "sql.js", "sqlite3", "typebox", "valibot", "zod"] }, "sha512-jGCqAgxpz+OSHP2jQGooUHBxnFMTYl0TTRSfULBl52VNf7CtyNRnazUi+VdbSxvJrDP2lnIsmUh5O+HhKeSJCg=="],
+
+    "dset": ["dset@3.1.4", "", {}, "sha512-2QF/g9/zTaPDc3BjNcVTGoBbXBgYfMTTceLaYcFJ/W9kggFUkhxD/hMEeuLKbugyef9SqAx8cpgwlIP/jinUTA=="],
+
+    "dts-resolver": ["dts-resolver@2.1.3", "", { "peerDependencies": { "oxc-resolver": ">=11.0.0" }, "optionalPeers": ["oxc-resolver"] }, "sha512-bihc7jPC90VrosXNzK0LTE2cuLP6jr0Ro8jk+kMugHReJVLIpHz/xadeq3MhuwyO4TD4OA3L1Q8pBBFRc08Tsw=="],
+
+    "duplexer": ["duplexer@0.1.2", "", {}, "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg=="],
+
+    "eastasianwidth": ["eastasianwidth@0.2.0", "", {}, "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="],
+
+    "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="],
+
+    "effect": ["effect@4.0.0-beta.74", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "fast-check": "^4.8.0", "find-my-way-ts": "^0.1.6", "ini": "^7.0.0", "kubernetes-types": "^1.30.0", "msgpackr": "^2.0.1", "multipasta": "^0.2.7", "toml": "^4.1.1", "uuid": "^14.0.0", "yaml": "^2.9.0" } }, "sha512-Yx+Kh12U+i2FmjwEfKs+ePFmpMd43RPD1oGqc/VraSS9bYzvF0Ff3PojwEFEVEewp8xc92Uxu28gTspU4qyvHA=="],
+
+    "electron-to-chromium": ["electron-to-chromium@1.5.364", "", {}, "sha512-G/dYE3+AYhyHwzTwg8UbnXf7zqMERYh7l2jJ3QujhFsH8agSYwtnGAR2aZ7f0AakIKJXd5En/Hre4igIUrdlYw=="],
+
+    "emmet": ["emmet@2.4.11", "", { "dependencies": { "@emmetio/abbreviation": "^2.3.3", "@emmetio/css-abbreviation": "^2.1.8" } }, "sha512-23QPJB3moh/U9sT4rQzGgeyyGIrcM+GH5uVYg2C6wZIxAIJq7Ng3QLT79tl8FUwDXhyq9SusfknOrofAKqvgyQ=="],
+
+    "emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="],
+
+    "emoji-regex-xs": ["emoji-regex-xs@2.0.1", "", {}, "sha512-1QFuh8l7LqUcKe24LsPUNzjrzJQ7pgRwp1QMcZ5MX6mFplk2zQ08NVCM84++1cveaUUYtcCYHmeFEuNg16sU4g=="],
+
+    "empathic": ["empathic@2.0.1", "", {}, "sha512-YGRs8knHhKHVShLkFET/rWAU8kmHbOV5LwN938RHI0pljAJ1Gf6SzXsSmRaEzcXTtOOmVqJ5+WtQPL5uigY50Q=="],
+
+    "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="],
+
+    "end-of-stream": ["end-of-stream@1.4.5", "", { "dependencies": { "once": "^1.4.0" } }, "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg=="],
+
+    "enhanced-resolve": ["enhanced-resolve@5.22.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-6QEuw3zoX1SJQc7b87aBXke/no+mG2bTBgw29gWMQonLmpEkWoCAVkl+M49e48AZlWzxiDzDZzYdp6kobcyLww=="],
+
+    "entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="],
+
+    "environment": ["environment@1.1.0", "", {}, "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q=="],
+
+    "error-stack-parser": ["error-stack-parser@2.1.4", "", { "dependencies": { "stackframe": "^1.3.4" } }, "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ=="],
+
+    "error-stack-parser-es": ["error-stack-parser-es@1.0.5", "", {}, "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA=="],
+
+    "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="],
+
+    "es-module-lexer": ["es-module-lexer@2.1.0", "", {}, "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ=="],
+
+    "es-toolkit": ["es-toolkit@1.47.0", "", {}, "sha512-n1GuoD0WEQZMBk5tttoZSqwgyLx01oqa5XsBmCHwPyNe1S9jPBEmtR2pSgp2kJuWE3ciFZ6yRHmY4pM4C3OOkw=="],
+
+    "esast-util-from-estree": ["esast-util-from-estree@2.0.0", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "devlop": "^1.0.0", "estree-util-visit": "^2.0.0", "unist-util-position-from-estree": "^2.0.0" } }, "sha512-4CyanoAudUSBAn5K13H4JhsMH6L9ZP7XbLVe/dKybkxMO7eDyLsT8UHl9TRNrU2Gr9nz+FovfSIjuXWJ81uVwQ=="],
+
+    "esast-util-from-js": ["esast-util-from-js@2.0.1", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "acorn": "^8.0.0", "esast-util-from-estree": "^2.0.0", "vfile-message": "^4.0.0" } }, "sha512-8Ja+rNJ0Lt56Pcf3TAmpBZjmx8ZcK5Ts4cAzIOjsjevg9oSXJnl6SUQ2EevU8tv3h6ZLWmoKL5H4fgWvdvfETw=="],
+
+    "esbuild": ["esbuild@0.28.0", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.0", "@esbuild/android-arm": "0.28.0", "@esbuild/android-arm64": "0.28.0", "@esbuild/android-x64": "0.28.0", "@esbuild/darwin-arm64": "0.28.0", "@esbuild/darwin-x64": "0.28.0", "@esbuild/freebsd-arm64": "0.28.0", "@esbuild/freebsd-x64": "0.28.0", "@esbuild/linux-arm": "0.28.0", "@esbuild/linux-arm64": "0.28.0", "@esbuild/linux-ia32": "0.28.0", "@esbuild/linux-loong64": "0.28.0", "@esbuild/linux-mips64el": "0.28.0", "@esbuild/linux-ppc64": "0.28.0", "@esbuild/linux-riscv64": "0.28.0", "@esbuild/linux-s390x": "0.28.0", "@esbuild/linux-x64": "0.28.0", "@esbuild/netbsd-arm64": "0.28.0", "@esbuild/netbsd-x64": "0.28.0", "@esbuild/openbsd-arm64": "0.28.0", "@esbuild/openbsd-x64": "0.28.0", "@esbuild/openharmony-arm64": "0.28.0", "@esbuild/sunos-x64": "0.28.0", "@esbuild/win32-arm64": "0.28.0", "@esbuild/win32-ia32": "0.28.0", "@esbuild/win32-x64": "0.28.0" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw=="],
+
+    "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
+
+    "escape-html": ["escape-html@1.0.3", "", {}, "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="],
+
+    "escape-string-regexp": ["escape-string-regexp@2.0.0", "", {}, "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w=="],
+
+    "escodegen": ["escodegen@2.1.0", "", { "dependencies": { "esprima": "^4.0.1", "estraverse": "^5.2.0", "esutils": "^2.0.2" }, "optionalDependencies": { "source-map": "~0.6.1" }, "bin": { "esgenerate": "bin/esgenerate.js", "escodegen": "bin/escodegen.js" } }, "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w=="],
+
+    "eslint": ["eslint@10.4.1", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.2", "@eslint/config-array": "^0.23.5", "@eslint/config-helpers": "^0.6.0", "@eslint/core": "^1.2.1", "@eslint/plugin-kit": "^0.7.2", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", "@humanwhocodes/retry": "^0.4.2", "@types/estree": "^1.0.6", "ajv": "^6.14.0", "cross-spawn": "^7.0.6", "debug": "^4.3.2", "escape-string-regexp": "^4.0.0", "eslint-scope": "^9.1.2", "eslint-visitor-keys": "^5.0.1", "espree": "^11.2.0", "esquery": "^1.7.0", "esutils": "^2.0.2", "fast-deep-equal": "^3.1.3", "file-entry-cache": "^8.0.0", "find-up": "^5.0.0", "glob-parent": "^6.0.2", "ignore": "^5.2.0", "imurmurhash": "^0.1.4", "is-glob": "^4.0.0", "json-stable-stringify-without-jsonify": "^1.0.1", "minimatch": "^10.2.4", "natural-compare": "^1.4.0", "optionator": "^0.9.3" }, "peerDependencies": { "jiti": "*" }, "optionalPeers": ["jiti"], "bin": { "eslint": "bin/eslint.js" } }, "sha512-AyIKhnOBuOAdueD7RB3xB+YeAWScb9jHsJBgH2Hcde8InP5JYhqrRR6iTMHyTEwgENK54Cp44e4v8BwNhsuHuw=="],
+
+    "eslint-scope": ["eslint-scope@9.1.2", "", { "dependencies": { "@types/esrecurse": "^4.3.1", "@types/estree": "^1.0.8", "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ=="],
+
+    "eslint-visitor-keys": ["eslint-visitor-keys@5.0.1", "", {}, "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA=="],
+
+    "espree": ["espree@11.2.0", "", { "dependencies": { "acorn": "^8.16.0", "acorn-jsx": "^5.3.2", "eslint-visitor-keys": "^5.0.1" } }, "sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw=="],
+
+    "esprima": ["esprima@4.0.1", "", { "bin": { "esparse": "./bin/esparse.js", "esvalidate": "./bin/esvalidate.js" } }, "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="],
+
+    "esquery": ["esquery@1.7.0", "", { "dependencies": { "estraverse": "^5.1.0" } }, "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g=="],
+
+    "esrecurse": ["esrecurse@4.3.0", "", { "dependencies": { "estraverse": "^5.2.0" } }, "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag=="],
+
+    "estraverse": ["estraverse@5.3.0", "", {}, "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA=="],
+
+    "estree-util-attach-comments": ["estree-util-attach-comments@3.0.0", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-cKUwm/HUcTDsYh/9FgnuFqpfquUbwIqwKM26BVCGDPVgvaCl/nDCCjUfiLlx6lsEZ3Z4RFxNbOQ60pkaEwFxGw=="],
+
+    "estree-util-build-jsx": ["estree-util-build-jsx@3.0.1", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "devlop": "^1.0.0", "estree-util-is-identifier-name": "^3.0.0", "estree-walker": "^3.0.0" } }, "sha512-8U5eiL6BTrPxp/CHbs2yMgP8ftMhR5ww1eIKoWRMlqvltHF8fZn5LRDvTKuxD3DUn+shRbLGqXemcP51oFCsGQ=="],
+
+    "estree-util-is-identifier-name": ["estree-util-is-identifier-name@3.0.0", "", {}, "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg=="],
+
+    "estree-util-scope": ["estree-util-scope@1.0.0", "", { "dependencies": { "@types/estree": "^1.0.0", "devlop": "^1.0.0" } }, "sha512-2CAASclonf+JFWBNJPndcOpA8EMJwa0Q8LUFJEKqXLW6+qBvbFZuF5gItbQOs/umBUkjviCSDCbBwU2cXbmrhQ=="],
+
+    "estree-util-to-js": ["estree-util-to-js@2.0.0", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "astring": "^1.8.0", "source-map": "^0.7.0" } }, "sha512-WDF+xj5rRWmD5tj6bIqRi6CkLIXbbNQUcxQHzGysQzvHmdYG2G7p/Tf0J0gpxGgkeMZNTIjT/AoSvC9Xehcgdg=="],
+
+    "estree-util-visit": ["estree-util-visit@2.0.0", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "@types/unist": "^3.0.0" } }, "sha512-m5KgiH85xAhhW8Wta0vShLcUvOsh3LLPI2YVwcbio1l7E09NTLL1EyMZFM1OyWowoH0skScNbhOPl4kcBgzTww=="],
+
+    "estree-walker": ["estree-walker@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="],
+
+    "esutils": ["esutils@2.0.3", "", {}, "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="],
+
+    "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
+
+    "event-target-shim": ["event-target-shim@5.0.1", "", {}, "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ=="],
+
+    "eventemitter3": ["eventemitter3@5.0.4", "", {}, "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw=="],
+
+    "events": ["events@3.3.0", "", {}, "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q=="],
+
+    "events-universal": ["events-universal@1.0.1", "", { "dependencies": { "bare-events": "^2.7.0" } }, "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw=="],
+
+    "example-basic": ["example-basic@workspace:examples/cloudflare-solidstart"],
+
+    "execa": ["execa@9.6.1", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "cross-spawn": "^7.0.6", "figures": "^6.1.0", "get-stream": "^9.0.0", "human-signals": "^8.0.1", "is-plain-obj": "^4.1.0", "is-stream": "^4.0.1", "npm-run-path": "^6.0.0", "pretty-ms": "^9.2.0", "signal-exit": "^4.1.0", "strip-final-newline": "^4.0.0", "yoctocolors": "^2.1.1" } }, "sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA=="],
+
+    "exit": ["exit@0.1.2", "", {}, "sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ=="],
+
+    "expect-type": ["expect-type@1.3.0", "", {}, "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA=="],
+
+    "expressive-code": ["expressive-code@0.41.7", "", { "dependencies": { "@expressive-code/core": "^0.41.7", "@expressive-code/plugin-frames": "^0.41.7", "@expressive-code/plugin-shiki": "^0.41.7", "@expressive-code/plugin-text-markers": "^0.41.7" } }, "sha512-2wZjC8OQ3TaVEMcBtYY4Va3lo6J+Ai9jf3d4dbhURMJcU4Pbqe6EcHe424MIZI0VHUA1bR6xdpoHYi3yxokWqA=="],
+
+    "expressive-code-twoslash": ["expressive-code-twoslash@0.6.1", "", { "dependencies": { "@ec-ts/twoslash": "^1.0.0", "@ec-ts/twoslash-vue": "^1.0.0", "@typescript-eslint/parser": "^8.56.1", "css-js-gen": "^1.1.0", "mdast-util-from-markdown": "^2.0.3", "mdast-util-gfm": "^3.1.0", "mdast-util-to-hast": "^13.2.1", "twoslash-eslint": "^0.3.6" }, "peerDependencies": { "@expressive-code/core": "^0.41.7", "expressive-code": "^0.41.7", "typescript": "^5.5.0" } }, "sha512-aEeKBgqg6cF4rQPxT5BHNbRffwsA66zWkNT/Y7CcUIE8eHW6KJHPCnZrGCLxvQ5xRd+qWj7ZXq84gT2zd2ECbg=="],
+
+    "exsolve": ["exsolve@1.0.8", "", {}, "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA=="],
+
+    "extend": ["extend@3.0.2", "", {}, "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g=="],
+
+    "extract-zip": ["extract-zip@2.0.1", "", { "dependencies": { "debug": "^4.1.1", "get-stream": "^5.1.0", "yauzl": "^2.10.0" }, "optionalDependencies": { "@types/yauzl": "^2.9.1" }, "bin": { "extract-zip": "cli.js" } }, "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg=="],
+
+    "fast-check": ["fast-check@4.8.0", "", { "dependencies": { "pure-rand": "^8.0.0" } }, "sha512-GOJ158CUMnN6cSahsv4+ExARvIDuzzinFjkp0E9WtiBa5zcVeLozVkWaE4IzFcc+Y48Wp1EDlUZsXRyAztQcSg=="],
+
+    "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="],
+
+    "fast-fifo": ["fast-fifo@1.3.2", "", {}, "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ=="],
+
+    "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="],
+
+    "fast-json-stable-stringify": ["fast-json-stable-stringify@2.1.0", "", {}, "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="],
+
+    "fast-levenshtein": ["fast-levenshtein@2.0.6", "", {}, "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="],
+
+    "fast-uri": ["fast-uri@3.1.2", "", {}, "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ=="],
+
+    "fast-xml-builder": ["fast-xml-builder@1.2.0", "", { "dependencies": { "path-expression-matcher": "^1.5.0", "xml-naming": "^0.1.0" } }, "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q=="],
+
+    "fast-xml-parser": ["fast-xml-parser@5.8.0", "", { "dependencies": { "@nodable/entities": "^2.1.0", "fast-xml-builder": "^1.2.0", "path-expression-matcher": "^1.5.0", "strnum": "^2.3.0", "xml-naming": "^0.1.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-6bIM7fsJxeo3uXv7OncQYsBAMPJ7V16Slahl/6M98C/i2q+vB1+4a0MtrvYwDFEUrwDSbAmeLDRXsOBwrL7yAg=="],
+
+    "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
+
+    "fd-slicer": ["fd-slicer@1.1.0", "", { "dependencies": { "pend": "~1.2.0" } }, "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g=="],
+
+    "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="],
+
+    "fetchdts": ["fetchdts@0.1.7", "", {}, "sha512-YoZjBdafyLIop9lSxXVI33oLD5kN31q4Td+CasofLLYeLXRFeOsuOw0Uo+XNRi9PZlbfdlN2GmRtm4tCEQ9/KA=="],
+
+    "fflate": ["fflate@0.8.3", "", {}, "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA=="],
+
+    "figures": ["figures@6.1.0", "", { "dependencies": { "is-unicode-supported": "^2.0.0" } }, "sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg=="],
+
+    "file-entry-cache": ["file-entry-cache@8.0.0", "", { "dependencies": { "flat-cache": "^4.0.0" } }, "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ=="],
+
+    "file-uri-to-path": ["file-uri-to-path@1.0.0", "", {}, "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="],
+
+    "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
+
+    "filter-obj": ["filter-obj@5.1.0", "", {}, "sha512-qWeTREPoT7I0bifpPUXtxkZJ1XJzxWtfoWWkdVGqa+eCr3SHW/Ocp89o8vLvbUuQnadybJpjOKu4V+RwO6sGng=="],
+
+    "find-my-way-ts": ["find-my-way-ts@0.1.6", "", {}, "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA=="],
+
+    "find-up": ["find-up@5.0.0", "", { "dependencies": { "locate-path": "^6.0.0", "path-exists": "^4.0.0" } }, "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng=="],
+
+    "flat-cache": ["flat-cache@4.0.1", "", { "dependencies": { "flatted": "^3.2.9", "keyv": "^4.5.4" } }, "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw=="],
+
+    "flatted": ["flatted@3.4.2", "", {}, "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA=="],
+
+    "flattie": ["flattie@1.1.1", "", {}, "sha512-9UbaD6XdAL97+k/n+N7JwX46K/M6Zc6KcFYskrYL8wbBV/Uyk0CTAMY0VT+qiK5PM7AIc9aTWYtq65U7T+aCNQ=="],
+
+    "fontace": ["fontace@0.4.1", "", { "dependencies": { "fontkitten": "^1.0.2" } }, "sha512-lDMvbAzSnHmbYMTEld5qdtvNH2/pWpICOqpean9IgC7vUbUJc3k+k5Dokp85CegamqQpFbXf0rAVkbzpyTA8aw=="],
+
+    "fontkitten": ["fontkitten@1.0.3", "", { "dependencies": { "tiny-inflate": "^1.0.3" } }, "sha512-Wp1zXWPVUPBmfoa3Cqc9ctaKuzKAV6uLstRqlR56kSjplf5uAce+qeyYym7F+PHbGTk+tCEdkCW6RD7DX/gBZw=="],
+
+    "foreground-child": ["foreground-child@3.3.1", "", { "dependencies": { "cross-spawn": "^7.0.6", "signal-exit": "^4.0.1" } }, "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw=="],
+
+    "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="],
+
+    "fs-minipass": ["fs-minipass@2.1.0", "", { "dependencies": { "minipass": "^3.0.0" } }, "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg=="],
+
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="],
+
+    "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="],
+
+    "generate-function": ["generate-function@2.3.1", "", { "dependencies": { "is-property": "^1.0.2" } }, "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ=="],
+
+    "gensync": ["gensync@1.0.0-beta.2", "", {}, "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg=="],
+
+    "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="],
+
+    "get-east-asian-width": ["get-east-asian-width@1.6.0", "", {}, "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA=="],
+
+    "get-port-please": ["get-port-please@3.2.0", "", {}, "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A=="],
+
+    "get-stream": ["get-stream@9.0.1", "", { "dependencies": { "@sec-ant/readable-stream": "^0.4.1", "is-stream": "^4.0.1" } }, "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA=="],
+
+    "get-tsconfig": ["get-tsconfig@4.14.0", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA=="],
+
+    "get-uri": ["get-uri@6.0.5", "", { "dependencies": { "basic-ftp": "^5.0.2", "data-uri-to-buffer": "^6.0.2", "debug": "^4.3.4" } }, "sha512-b1O07XYq8eRuVzBNgJLstU6FYc1tS6wnMtF1I1D9lE8LxZSOGZ7LhxN54yPP6mGw5f2CkXY2BQUL9Fx41qvcIg=="],
+
+    "giget": ["giget@3.2.0", "", { "bin": { "giget": "dist/cli.mjs" } }, "sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A=="],
+
+    "github-slugger": ["github-slugger@2.0.0", "", {}, "sha512-IaOQ9puYtjrkq7Y0Ygl9KDZnrf/aiUJYUpVf89y8kyaxbRG7Y1SrX/jaumrv81vc61+kiMempujsM3Yw7w5qcw=="],
+
+    "glob": ["glob@13.0.6", "", { "dependencies": { "minimatch": "^10.2.2", "minipass": "^7.1.3", "path-scurry": "^2.0.2" } }, "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw=="],
+
+    "glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="],
+
+    "globby": ["globby@16.2.0", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" } }, "sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q=="],
+
+    "globrex": ["globrex@0.1.2", "", {}, "sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg=="],
+
+    "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
+
+    "gzip-size": ["gzip-size@7.0.0", "", { "dependencies": { "duplexer": "^0.1.2" } }, "sha512-O1Ld7Dr+nqPnmGpdhzLmMTQ4vAsD+rHwMm1NLUmoUFFymBOMKxCCrtDxqdBRYXdeEPEi3SyoR4TizJLQrnKBNA=="],
+
+    "h3": ["h3@2.0.1-rc.4", "", { "dependencies": { "rou3": "^0.7.8", "srvx": "^0.9.1" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"] }, "sha512-vZq8pEUp6THsXKXrUXX44eOqfChic2wVQ1GlSzQCBr7DeFBkfIZAo2WyNND4GSv54TAa0E4LYIK73WSPdgKUgw=="],
+
+    "h3-v2": ["h3@2.0.1-rc.20", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.13" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-28ljodXuUp0fZovdiSRq4G9OgrxCztrJe5VdYzXAB7ueRvI7pIUqLU14Xi3XqdYJ/khXjfpUOOD2EQa6CmBgsg=="],
+
+    "hachure-fill": ["hachure-fill@0.5.2", "", {}, "sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg=="],
+
+    "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
+
+    "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="],
+
+    "hast-util-embedded": ["hast-util-embedded@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-is-element": "^3.0.0" } }, "sha512-naH8sld4Pe2ep03qqULEtvYr7EjrLK2QHY8KJR6RJkTUjPGObe1vnx585uzem2hGra+s1q08DZZpfgDVYRbaXA=="],
+
+    "hast-util-format": ["hast-util-format@1.1.0", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-embedded": "^3.0.0", "hast-util-minify-whitespace": "^1.0.0", "hast-util-phrasing": "^3.0.0", "hast-util-whitespace": "^3.0.0", "html-whitespace-sensitive-tag-names": "^3.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-yY1UDz6bC9rDvCWHpx12aIBGRG7krurX0p0Fm6pT547LwDIZZiNr8a+IHDogorAdreULSEzP82Nlv5SZkHZcjA=="],
+
+    "hast-util-from-dom": ["hast-util-from-dom@5.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "hastscript": "^9.0.0", "web-namespaces": "^2.0.0" } }, "sha512-N+LqofjR2zuzTjCPzyDUdSshy4Ma6li7p/c3pA78uTwzFgENbgbUrm2ugwsOdcjI1muO+o6Dgzp9p8WHtn/39Q=="],
+
+    "hast-util-from-html": ["hast-util-from-html@2.0.3", "", { "dependencies": { "@types/hast": "^3.0.0", "devlop": "^1.1.0", "hast-util-from-parse5": "^8.0.0", "parse5": "^7.0.0", "vfile": "^6.0.0", "vfile-message": "^4.0.0" } }, "sha512-CUSRHXyKjzHov8yKsQjGOElXy/3EKpyX56ELnkHH34vDVw1N1XSQ1ZcAvTyAPtGqLTuKP/uxM+aLkSPqF/EtMw=="],
+
+    "hast-util-from-html-isomorphic": ["hast-util-from-html-isomorphic@2.0.0", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-from-dom": "^5.0.0", "hast-util-from-html": "^2.0.0", "unist-util-remove-position": "^5.0.0" } }, "sha512-zJfpXq44yff2hmE0XmwEOzdWin5xwH+QIhMLOScpX91e/NSGPsAzNCvLQDIEPyO2TXi+lBmU6hjLIhV8MwP2kw=="],
+
+    "hast-util-from-parse5": ["hast-util-from-parse5@8.0.3", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "devlop": "^1.0.0", "hastscript": "^9.0.0", "property-information": "^7.0.0", "vfile": "^6.0.0", "vfile-location": "^5.0.0", "web-namespaces": "^2.0.0" } }, "sha512-3kxEVkEKt0zvcZ3hCRYI8rqrgwtlIOFMWkbclACvjlDw8Li9S2hk/d51OI0nr/gIpdMHNepwgOKqZ/sy0Clpyg=="],
+
+    "hast-util-has-property": ["hast-util-has-property@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-MNilsvEKLFpV604hwfhVStK0usFY/QmM5zX16bo7EjnAEGofr5YyI37kzopBlZJkHD4t887i+q/C8/tr5Q94cA=="],
+
+    "hast-util-is-body-ok-link": ["hast-util-is-body-ok-link@3.0.1", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-0qpnzOBLztXHbHQenVB8uNuxTnm/QBFUOmdOSsEn7GnBtyY07+ENTWVFBAnXd/zEgd9/SUG3lRY7hSIBWRgGpQ=="],
+
+    "hast-util-is-element": ["hast-util-is-element@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-Val9mnv2IWpLbNPqc/pUem+a7Ipj2aHacCwgNfTiK0vJKl0LF+4Ba4+v1oPHFpf3bLYmreq0/l3Gud9S5OH42g=="],
+
+    "hast-util-minify-whitespace": ["hast-util-minify-whitespace@1.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-embedded": "^3.0.0", "hast-util-is-element": "^3.0.0", "hast-util-whitespace": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-L96fPOVpnclQE0xzdWb/D12VT5FabA7SnZOUMtL1DbXmYiHJMXZvFkIZfiMmTCNJHUeO2K9UYNXoVyfz+QHuOw=="],
+
+    "hast-util-parse-selector": ["hast-util-parse-selector@4.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-wkQCkSYoOGCRKERFWcxMVMOcYE2K1AaNLU8DXS9arxnLOUEWbOXKXiJUNzEpqZ3JOKpnha3jkFrumEjVliDe7A=="],
+
+    "hast-util-phrasing": ["hast-util-phrasing@3.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-embedded": "^3.0.0", "hast-util-has-property": "^3.0.0", "hast-util-is-body-ok-link": "^3.0.0", "hast-util-is-element": "^3.0.0" } }, "sha512-6h60VfI3uBQUxHqTyMymMZnEbNl1XmEGtOxxKYL7stY2o601COo62AWAYBQR9lZbYXYSBoxag8UpPRXK+9fqSQ=="],
+
+    "hast-util-raw": ["hast-util-raw@9.1.0", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "@ungap/structured-clone": "^1.0.0", "hast-util-from-parse5": "^8.0.0", "hast-util-to-parse5": "^8.0.0", "html-void-elements": "^3.0.0", "mdast-util-to-hast": "^13.0.0", "parse5": "^7.0.0", "unist-util-position": "^5.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0", "web-namespaces": "^2.0.0", "zwitch": "^2.0.0" } }, "sha512-Y8/SBAHkZGoNkpzqqfCldijcuUKh7/su31kEBp67cFY09Wy0mTRgtsLYsiIxMJxlu0f6AA5SUTbDR8K0rxnbUw=="],
+
+    "hast-util-select": ["hast-util-select@6.0.4", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "bcp-47-match": "^2.0.0", "comma-separated-tokens": "^2.0.0", "css-selector-parser": "^3.0.0", "devlop": "^1.0.0", "direction": "^2.0.0", "hast-util-has-property": "^3.0.0", "hast-util-to-string": "^3.0.0", "hast-util-whitespace": "^3.0.0", "nth-check": "^2.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "unist-util-visit": "^5.0.0", "zwitch": "^2.0.0" } }, "sha512-RqGS1ZgI0MwxLaKLDxjprynNzINEkRHY2i8ln4DDjgv9ZhcYVIHN9rlpiYsqtFwrgpYU361SyWDQcGNIBVu3lw=="],
+
+    "hast-util-to-estree": ["hast-util-to-estree@3.1.3", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "comma-separated-tokens": "^2.0.0", "devlop": "^1.0.0", "estree-util-attach-comments": "^3.0.0", "estree-util-is-identifier-name": "^3.0.0", "hast-util-whitespace": "^3.0.0", "mdast-util-mdx-expression": "^2.0.0", "mdast-util-mdx-jsx": "^3.0.0", "mdast-util-mdxjs-esm": "^2.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "style-to-js": "^1.0.0", "unist-util-position": "^5.0.0", "zwitch": "^2.0.0" } }, "sha512-48+B/rJWAp0jamNbAAf9M7Uf//UVqAoMmgXhBdxTDJLGKY+LRnZ99qcG+Qjl5HfMpYNzS5v4EAwVEF34LeAj7w=="],
+
+    "hast-util-to-html": ["hast-util-to-html@9.0.5", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "ccount": "^2.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-whitespace": "^3.0.0", "html-void-elements": "^3.0.0", "mdast-util-to-hast": "^13.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "stringify-entities": "^4.0.0", "zwitch": "^2.0.4" } }, "sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw=="],
+
+    "hast-util-to-jsx-runtime": ["hast-util-to-jsx-runtime@2.3.6", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "comma-separated-tokens": "^2.0.0", "devlop": "^1.0.0", "estree-util-is-identifier-name": "^3.0.0", "hast-util-whitespace": "^3.0.0", "mdast-util-mdx-expression": "^2.0.0", "mdast-util-mdx-jsx": "^3.0.0", "mdast-util-mdxjs-esm": "^2.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "style-to-js": "^1.0.0", "unist-util-position": "^5.0.0", "vfile-message": "^4.0.0" } }, "sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg=="],
+
+    "hast-util-to-parse5": ["hast-util-to-parse5@8.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "comma-separated-tokens": "^2.0.0", "devlop": "^1.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "web-namespaces": "^2.0.0", "zwitch": "^2.0.0" } }, "sha512-MlWT6Pjt4CG9lFCjiz4BH7l9wmrMkfkJYCxFwKQic8+RTZgWPuWxwAfjJElsXkex7DJjfSJsQIt931ilUgmwdA=="],
+
+    "hast-util-to-string": ["hast-util-to-string@3.0.1", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-XelQVTDWvqcl3axRfI0xSeoVKzyIFPwsAGSLIsKdJKQMXDYJS4WYrBNF/8J7RdhIcFI2BOHgAifggsvsxp/3+A=="],
+
+    "hast-util-to-text": ["hast-util-to-text@4.0.2", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "hast-util-is-element": "^3.0.0", "unist-util-find-after": "^5.0.0" } }, "sha512-KK6y/BN8lbaq654j7JgBydev7wuNMcID54lkRav1P0CaE1e47P72AWWPiGKXTJU271ooYzcvTAn/Zt0REnvc7A=="],
+
+    "hast-util-whitespace": ["hast-util-whitespace@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw=="],
+
+    "hastscript": ["hastscript@9.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-parse-selector": "^4.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0" } }, "sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w=="],
+
+    "he": ["he@1.2.0", "", { "bin": { "he": "bin/he" } }, "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw=="],
+
+    "hex-rgb": ["hex-rgb@4.3.0", "", {}, "sha512-Ox1pJVrDCyGHMG9CFg1tmrRUMRPRsAWYc/PinY0XzJU4K7y7vjNoLKIQ7BR5UJMCxNN8EM1MNDmHWA/B3aZUuw=="],
+
+    "hookable": ["hookable@5.5.3", "", {}, "sha512-Yc+BQe8SvoXH1643Qez1zqLRmbA5rCL+sSmk6TVos0LWVfNIB7PGncdlId77WzLGSIB5KaWgTaNTs2lNVEI6VQ=="],
+
+    "html-entities": ["html-entities@2.3.3", "", {}, "sha512-DV5Ln36z34NNTDgnz0EWGBLZENelNAtkiFA4kyNOG2tDI6Mz1uSWiq1wAKdyjnJwyDiDO7Fa2SO1CTxPXL8VxA=="],
+
+    "html-escaper": ["html-escaper@3.0.3", "", {}, "sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ=="],
+
+    "html-to-image": ["html-to-image@1.11.13", "", {}, "sha512-cuOPoI7WApyhBElTTb9oqsawRvZ0rHhaHwghRLlTuffoD1B2aDemlCruLeZrUIIdvG7gs9xeELEPm6PhuASqrg=="],
+
+    "html-void-elements": ["html-void-elements@3.0.0", "", {}, "sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg=="],
+
+    "html-whitespace-sensitive-tag-names": ["html-whitespace-sensitive-tag-names@3.0.1", "", {}, "sha512-q+310vW8zmymYHALr1da4HyXUQ0zgiIwIicEfotYPWGN0OJVEN/58IJ3A4GBYcEq3LGAZqKb+ugvP0GNB9CEAA=="],
+
+    "http-cache-semantics": ["http-cache-semantics@4.2.0", "", {}, "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ=="],
+
+    "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="],
+
+    "http-proxy-agent": ["http-proxy-agent@7.0.2", "", { "dependencies": { "agent-base": "^7.1.0", "debug": "^4.3.4" } }, "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig=="],
+
+    "http-shutdown": ["http-shutdown@1.2.2", "", {}, "sha512-S9wWkJ/VSY9/k4qcjG318bqJNruzE4HySUhFYknwmu6LBP97KLLfwNf+n4V1BHurvFNkSKLFnK/RsuUnRTf9Vw=="],
+
+    "https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="],
+
+    "httpxy": ["httpxy@0.5.3", "", {}, "sha512-SMS9V6Sn7VWaS11lYhoAr0ceoaiolTWf4jYdJn0NJhCdKMu9R2H9Fh0LBDWBHQF6HRLI1PmaePYsjanSpE5PEw=="],
+
+    "human-signals": ["human-signals@8.0.1", "", {}, "sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ=="],
+
+    "husky": ["husky@9.1.7", "", { "bin": { "husky": "bin.js" } }, "sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA=="],
+
+    "i18next": ["i18next@23.16.8", "", { "dependencies": { "@babel/runtime": "^7.23.2" } }, "sha512-06r/TitrM88Mg5FdUXAKL96dJMzgqLE5dv3ryBAra4KCwD9mJ4ndOTS95ZuymIGoE+2hzfdaMak2X11/es7ZWg=="],
+
+    "iconv-lite": ["iconv-lite@0.7.2", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw=="],
+
+    "ieee754": ["ieee754@1.2.1", "", {}, "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="],
+
+    "ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
+
+    "immediate": ["immediate@3.0.6", "", {}, "sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ=="],
+
+    "import-meta-resolve": ["import-meta-resolve@4.2.0", "", {}, "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg=="],
+
+    "imurmurhash": ["imurmurhash@0.1.4", "", {}, "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA=="],
+
+    "indent-string": ["indent-string@5.0.0", "", {}, "sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg=="],
+
+    "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
+
+    "ini": ["ini@7.0.0", "", {}, "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w=="],
+
+    "ink": ["ink@6.8.0", "", { "dependencies": { "@alcalzone/ansi-tokenize": "^0.2.4", "ansi-escapes": "^7.3.0", "ansi-styles": "^6.2.1", "auto-bind": "^5.0.1", "chalk": "^5.6.0", "cli-boxes": "^3.0.0", "cli-cursor": "^4.0.0", "cli-truncate": "^5.1.1", "code-excerpt": "^4.0.0", "es-toolkit": "^1.39.10", "indent-string": "^5.0.0", "is-in-ci": "^2.0.0", "patch-console": "^2.0.0", "react-reconciler": "^0.33.0", "scheduler": "^0.27.0", "signal-exit": "^3.0.7", "slice-ansi": "^8.0.0", "stack-utils": "^2.0.6", "string-width": "^8.1.1", "terminal-size": "^4.0.1", "type-fest": "^5.4.1", "widest-line": "^6.0.0", "wrap-ansi": "^9.0.0", "ws": "^8.18.0", "yoga-layout": "~3.2.1" }, "peerDependencies": { "@types/react": ">=19.0.0", "react": ">=19.0.0", "react-devtools-core": ">=6.1.2" }, "optionalPeers": ["@types/react", "react-devtools-core"] }, "sha512-sbl1RdLOgkO9isK42WCZlJCFN9hb++sX9dsklOvfd1YQ3bQ2AiFu12Q6tFlr0HvEUvzraJntQCCpfEoUe9DSzA=="],
+
+    "inline-style-parser": ["inline-style-parser@0.2.7", "", {}, "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA=="],
+
+    "internmap": ["internmap@1.0.1", "", {}, "sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw=="],
+
+    "ioredis": ["ioredis@5.11.0", "", { "dependencies": { "@ioredis/commands": "1.10.0", "cluster-key-slot": "1.1.1", "debug": "4.4.3", "denque": "2.1.0", "redis-errors": "1.2.0", "redis-parser": "3.0.0", "standard-as-callback": "2.1.0" } }, "sha512-EZBErytyVovD8f6pDfG3Kb37N6Y3lmDA9NNj+4+IP13CzzHGeX+OyeRM2Um13khRzoBSzzL+5lVnCX8V2RLeMg=="],
+
+    "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="],
+
+    "iron-webcrypto": ["iron-webcrypto@1.2.1", "", {}, "sha512-feOM6FaSr6rEABp/eDfVseKyTMDt+KGpeB35SkVn9Tyn0CqvVsY3EwI0v5i8nMHyJnzCIQf7nsy3p41TPkJZhg=="],
+
+    "is-alphabetical": ["is-alphabetical@2.0.1", "", {}, "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ=="],
+
+    "is-alphanumerical": ["is-alphanumerical@2.0.1", "", { "dependencies": { "is-alphabetical": "^2.0.0", "is-decimal": "^2.0.0" } }, "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw=="],
+
+    "is-binary-path": ["is-binary-path@2.1.0", "", { "dependencies": { "binary-extensions": "^2.0.0" } }, "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw=="],
+
+    "is-core-module": ["is-core-module@2.16.2", "", { "dependencies": { "hasown": "^2.0.3" } }, "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA=="],
+
+    "is-decimal": ["is-decimal@2.0.1", "", {}, "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A=="],
+
+    "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
+
+    "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
+
+    "is-fullwidth-code-point": ["is-fullwidth-code-point@5.1.0", "", { "dependencies": { "get-east-asian-width": "^1.3.1" } }, "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ=="],
+
+    "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
+
+    "is-hexadecimal": ["is-hexadecimal@2.0.1", "", {}, "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg=="],
+
+    "is-in-ci": ["is-in-ci@2.0.0", "", { "bin": { "is-in-ci": "cli.js" } }, "sha512-cFeerHriAnhrQSbpAxL37W1wcJKUUX07HyLWZCW1URJT/ra3GyUTzBgUnh24TMVfNTV2Hij2HLxkPHFZfOZy5w=="],
+
+    "is-in-ssh": ["is-in-ssh@1.0.0", "", {}, "sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw=="],
+
+    "is-inside-container": ["is-inside-container@1.0.0", "", { "dependencies": { "is-docker": "^3.0.0" }, "bin": { "is-inside-container": "cli.js" } }, "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA=="],
+
+    "is-module": ["is-module@1.0.0", "", {}, "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g=="],
+
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
+
+    "is-path-inside": ["is-path-inside@4.0.0", "", {}, "sha512-lJJV/5dYS+RcL8uQdBDW9c9uWFLLBNRyFhnAKXw5tVqLlKZ4RMGZKv+YQ/IA3OhD+RpbJa1LLFM1FQPGyIXvOA=="],
+
+    "is-plain-obj": ["is-plain-obj@4.1.0", "", {}, "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg=="],
+
+    "is-property": ["is-property@1.0.2", "", {}, "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g=="],
+
+    "is-reference": ["is-reference@1.2.1", "", { "dependencies": { "@types/estree": "*" } }, "sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ=="],
+
+    "is-stream": ["is-stream@4.0.1", "", {}, "sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A=="],
+
+    "is-unicode-supported": ["is-unicode-supported@2.1.0", "", {}, "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ=="],
+
+    "is-what": ["is-what@4.1.16", "", {}, "sha512-ZhMwEosbFJkA0YhFnNDgTM4ZxDRsS6HqTo7qsZM08fehyRYIYa0yHu5R6mgo1n/8MgaPBXiPimPD77baVFYg+A=="],
+
+    "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
+
+    "isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
+
+    "isbinaryfile": ["isbinaryfile@5.0.7", "", {}, "sha512-gnWD14Jh3FzS3CPhF0AxNOJ8CxqeblPTADzI38r0wt8ZyQl5edpy75myt08EG2oKvpyiqSqsx+Wkz9vtkbTqYQ=="],
+
+    "isbot": ["isbot@5.1.40", "", {}, "sha512-yNeeynhhtIVRBk12tBV4eHNxwB42HzR4Q3Ea7vCOiJhImGaAIdIMrbJtacQlBizGLjUPw+akkFI5Dn9T70XoVQ=="],
+
+    "isexe": ["isexe@3.1.5", "", {}, "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w=="],
+
+    "jackspeak": ["jackspeak@3.4.3", "", { "dependencies": { "@isaacs/cliui": "^8.0.2" }, "optionalDependencies": { "@pkgjs/parseargs": "^0.11.0" } }, "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw=="],
+
+    "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
+
+    "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="],
+
+    "js-base64": ["js-base64@3.7.8", "", {}, "sha512-hNngCeKxIUQiEUN3GPJOkz4wF/YvdUdbNL9hsBcMQTkKzboD7T/q3OYOuuPZLUE6dBxSGpwhk5mwuDud7JVAow=="],
+
+    "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="],
+
+    "jsbi": ["jsbi@4.3.2", "", {}, "sha512-9fqMSQbhJykSeii05nxKl4m6Eqn2P6rOlYiS+C5Dr/HPIU/7yZxu5qzbs40tgaFORiw2Amd0mirjxatXYMkIew=="],
+
+    "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
+
+    "json-buffer": ["json-buffer@3.0.1", "", {}, "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="],
+
+    "json-parse-even-better-errors": ["json-parse-even-better-errors@4.0.0", "", {}, "sha512-lR4MXjGNgkJc7tkQ97kb2nuEMnNCyU//XYVH0MKTGcXEiSudQ5MKGKen3C5QubYy0vmq+JGitUg92uuywGEwIA=="],
+
+    "json-schema-traverse": ["json-schema-traverse@0.4.1", "", {}, "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="],
+
+    "json-stable-stringify-without-jsonify": ["json-stable-stringify-without-jsonify@1.0.1", "", {}, "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw=="],
+
+    "json-with-bigint": ["json-with-bigint@3.5.8", "", {}, "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw=="],
+
+    "json5": ["json5@2.2.3", "", { "bin": { "json5": "lib/cli.js" } }, "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg=="],
+
+    "jsonc-parser": ["jsonc-parser@2.3.1", "", {}, "sha512-H8jvkz1O50L3dMZCsLqiuB2tA7muqbSg1AtGEkN0leAqGjsUzDJir3Zwr02BhqdcITPg3ei3mZ+HjMocAknhhg=="],
+
+    "jsonparse": ["jsonparse@1.3.1", "", {}, "sha512-POQXvpdL69+CluYsillJ7SUhKvytYjW9vG/GKpnf+xP8UWgYEM/RaMzHHofbALDiKbbP1W8UEYmgGl39WkPZsg=="],
+
+    "jsonstream-next": ["jsonstream-next@3.0.0", "", { "dependencies": { "jsonparse": "^1.2.0", "through2": "^4.0.2" }, "bin": { "jsonstream-next": "bin.js" } }, "sha512-aAi6oPhdt7BKyQn1SrIIGZBt0ukKuOUE1qV6kJ3GgioSOYzsRc8z9Hfr1BVmacA/jLe9nARfmgMGgn68BqIAgg=="],
+
+    "jszip": ["jszip@3.10.1", "", { "dependencies": { "lie": "~3.3.0", "pako": "~1.0.2", "readable-stream": "~2.3.6", "setimmediate": "^1.0.5" } }, "sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g=="],
+
+    "katex": ["katex@0.16.47", "", { "dependencies": { "commander": "^8.3.0" }, "bin": { "katex": "cli.js" } }, "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg=="],
+
+    "keyv": ["keyv@4.5.4", "", { "dependencies": { "json-buffer": "3.0.1" } }, "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw=="],
+
+    "khroma": ["khroma@2.1.0", "", {}, "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="],
+
+    "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
+
+    "klona": ["klona@2.0.6", "", {}, "sha512-dhG34DXATL5hSxJbIexCft8FChFXtmskoZYnoPWjXQuebWYCNkVeV3KkGegCK9CP1oswI/vQibS2GY7Em/sJJA=="],
+
+    "knitwork": ["knitwork@1.3.0", "", {}, "sha512-4LqMNoONzR43B1W0ek0fhXMsDNW/zxa1NdFAVMY+k28pgZLovR4G3PB5MrpTxCy1QaZCqNoiaKPr5w5qZHfSNw=="],
+
+    "kolorist": ["kolorist@1.8.0", "", {}, "sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ=="],
+
+    "kubernetes-types": ["kubernetes-types@1.30.0", "", {}, "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q=="],
+
+    "kysely": ["kysely@0.29.2", "", {}, "sha512-s6WVJyEZrbm6jhBpiKHsGHyePMrVQKJ85wZCFCr9W4QHv6WTjWIrdvTmO9hDEA3bNK0xkrE2DqrHsXMLWuZpQg=="],
+
+    "layout-base": ["layout-base@1.0.2", "", {}, "sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg=="],
+
+    "lazystream": ["lazystream@1.0.1", "", { "dependencies": { "readable-stream": "^2.0.5" } }, "sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw=="],
+
+    "levn": ["levn@0.4.1", "", { "dependencies": { "prelude-ls": "^1.2.1", "type-check": "~0.4.0" } }, "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ=="],
+
+    "libsodium": ["libsodium@0.8.4", "", {}, "sha512-lMcYaRi0zcs7tarATsQUYC7rstliIXZuoq0c6zXSgNtSNtdvBgkSegjWhpMJAXzKX3SUSwIp7+zEsob+j3LuRw=="],
+
+    "libsodium-wrappers": ["libsodium-wrappers@0.8.4", "", { "dependencies": { "libsodium": "^0.8.0" } }, "sha512-mu8aAWucZjTB5O/BtGXtW4e1agy7uHxNYG7zPthmmD1jU43LCDmSWZLN4JhflbdPXj3yDO4lxM1O9hLDgIOXDw=="],
+
+    "libsql": ["libsql@0.5.29", "", { "dependencies": { "@neon-rs/load": "^0.0.4", "detect-libc": "2.0.2" }, "optionalDependencies": { "@libsql/darwin-arm64": "0.5.29", "@libsql/darwin-x64": "0.5.29", "@libsql/linux-arm-gnueabihf": "0.5.29", "@libsql/linux-arm-musleabihf": "0.5.29", "@libsql/linux-arm64-gnu": "0.5.29", "@libsql/linux-arm64-musl": "0.5.29", "@libsql/linux-x64-gnu": "0.5.29", "@libsql/linux-x64-musl": "0.5.29", "@libsql/win32-x64-msvc": "0.5.29" }, "os": [ "linux", "win32", "darwin", ], "cpu": [ "arm", "x64", "arm64", ] }, "sha512-8lMP8iMgiBzzoNbAPQ59qdVcj6UaE/Vnm+fiwX4doX4Narook0a4GPKWBEv+CR8a1OwbfkgL18uBfBjWdF0Fzg=="],
+
+    "lie": ["lie@3.3.0", "", { "dependencies": { "immediate": "~3.0.5" } }, "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ=="],
+
+    "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
+
+    "lightningcss-android-arm64": ["lightningcss-android-arm64@1.32.0", "", { "os": "android", "cpu": "arm64" }, "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg=="],
+
+    "lightningcss-darwin-arm64": ["lightningcss-darwin-arm64@1.32.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ=="],
+
+    "lightningcss-darwin-x64": ["lightningcss-darwin-x64@1.32.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w=="],
+
+    "lightningcss-freebsd-x64": ["lightningcss-freebsd-x64@1.32.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig=="],
+
+    "lightningcss-linux-arm-gnueabihf": ["lightningcss-linux-arm-gnueabihf@1.32.0", "", { "os": "linux", "cpu": "arm" }, "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw=="],
+
+    "lightningcss-linux-arm64-gnu": ["lightningcss-linux-arm64-gnu@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ=="],
+
+    "lightningcss-linux-arm64-musl": ["lightningcss-linux-arm64-musl@1.32.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg=="],
+
+    "lightningcss-linux-x64-gnu": ["lightningcss-linux-x64-gnu@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA=="],
+
+    "lightningcss-linux-x64-musl": ["lightningcss-linux-x64-musl@1.32.0", "", { "os": "linux", "cpu": "x64" }, "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg=="],
+
+    "lightningcss-win32-arm64-msvc": ["lightningcss-win32-arm64-msvc@1.32.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw=="],
+
+    "lightningcss-win32-x64-msvc": ["lightningcss-win32-x64-msvc@1.32.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q=="],
+
+    "linebreak": ["linebreak@1.1.0", "", { "dependencies": { "base64-js": "0.0.8", "unicode-trie": "^2.0.0" } }, "sha512-MHp03UImeVhB7XZtjd0E4n6+3xr5Dq/9xI/5FptGk5FrbDR3zagPa2DS6U8ks/3HjbKWG9Q1M2ufOzxV2qLYSQ=="],
+
+    "listhen": ["listhen@1.10.0", "", { "dependencies": { "@parcel/watcher": "^2.5.6", "@parcel/watcher-wasm": "^2.5.6", "citty": "^0.2.2", "consola": "^3.4.2", "crossws": ">=0.2.0 <0.5.0", "defu": "^6.1.7", "get-port-please": "^3.2.0", "h3": "^1.15.11", "http-shutdown": "^1.2.2", "jiti": "^2.6.1", "mlly": "^1.8.2", "node-forge": "^1.4.0", "pathe": "^2.0.3", "std-env": "^4.1.0", "tinyclip": "^0.1.12", "ufo": "^1.6.4", "untun": "^0.1.3", "uqr": "^0.1.3" }, "bin": { "listen": "bin/listhen.mjs", "listhen": "bin/listhen.mjs" } }, "sha512-kfz4C0OrC6IpaVMtYDJtf6PFjurxe9NBBoDAh/o2p587INryFOO4DQ9OetbCdDrWFt1m1CJKvYrzkGsuPHw8nQ=="],
+
+    "local-pkg": ["local-pkg@1.2.1", "", { "dependencies": { "mlly": "^1.7.4", "pkg-types": "^2.3.0", "quansync": "^0.2.11" } }, "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q=="],
+
+    "locate-path": ["locate-path@6.0.0", "", { "dependencies": { "p-locate": "^5.0.0" } }, "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw=="],
+
+    "lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
+
+    "lodash-es": ["lodash-es@4.18.1", "", {}, "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A=="],
+
+    "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="],
+
+    "longest-streak": ["longest-streak@3.1.0", "", {}, "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g=="],
+
+    "lru-cache": ["lru-cache@11.5.1", "", {}, "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A=="],
+
+    "lru.min": ["lru.min@1.1.4", "", {}, "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA=="],
+
+    "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
+
+    "magic-string-ast": ["magic-string-ast@1.0.3", "", { "dependencies": { "magic-string": "^0.30.19" } }, "sha512-CvkkH1i81zl7mmb94DsRiFeG9V2fR2JeuK8yDgS8oiZSFa++wWLEgZ5ufEOyLHbvSbD1gTRKv9NdX69Rnvr9JA=="],
+
+    "magicast": ["magicast@0.5.3", "", { "dependencies": { "@babel/parser": "^7.29.3", "@babel/types": "^7.29.0", "source-map-js": "^1.2.1" } }, "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw=="],
+
+    "make-synchronized": ["make-synchronized@0.8.0", "", {}, "sha512-DZu4lwc0ffoFz581BSQa/BJl+1ZqIkoRQ+VejMlH0VrP4E86StAODnZujZ4sepumQj8rcP7wUnUBGM8Gu+zKUA=="],
+
+    "markdown-extensions": ["markdown-extensions@2.0.0", "", {}, "sha512-o5vL7aDWatOTX8LzaS1WMoaoxIiLRQJuIKKe2wAw6IeULDHaqbiqiggmx+pKvZDb1Sj+pE46Sn1T7lCqfFtg1Q=="],
+
+    "markdown-table": ["markdown-table@3.0.4", "", {}, "sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw=="],
+
+    "marked": ["marked@15.0.12", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA=="],
+
+    "marked-footnote": ["marked-footnote@1.4.0", "", { "peerDependencies": { "marked": ">=7.0.0" } }, "sha512-fZTxAhI1TcLEs5UOjCfYfTHpyKGaWQevbxaGTEA68B51l7i87SctPFtHETYqPkEN0ka5opvy4Dy1l/yXVC+hmg=="],
+
+    "marked-plaintify": ["marked-plaintify@1.1.1", "", { "peerDependencies": { "marked": ">=13.0.0" } }, "sha512-r3kMKArhfo2H3lD4ctFq/OJTzM0uNvXHh7FBTI1hMDpf4Ac1djjtq4g8NfTBWMxWLmaEz3KL1jCkLygik3gExA=="],
+
+    "marked-smartypants": ["marked-smartypants@1.1.12", "", { "dependencies": { "smartypants": "^0.2.2" }, "peerDependencies": { "marked": ">=4 <19" } }, "sha512-Z0QL2GpihbSeG5aaCrQxMEoqvngMftF/gq1SrdlCnbecUSrX3HYgPtCZzCW+OyNe2ideQqaFdxfGryqQX1MBDA=="],
+
+    "mdast-util-definitions": ["mdast-util-definitions@6.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "@types/unist": "^3.0.0", "unist-util-visit": "^5.0.0" } }, "sha512-scTllyX6pnYNZH/AIp/0ePz6s4cZtARxImwoPJ7kS42n+MnVsI4XbnG6d4ibehRIldYMWM2LD7ImQblVhUejVQ=="],
+
+    "mdast-util-directive": ["mdast-util-directive@3.1.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "@types/unist": "^3.0.0", "ccount": "^2.0.0", "devlop": "^1.0.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0", "parse-entities": "^4.0.0", "stringify-entities": "^4.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-I3fNFt+DHmpWCYAT7quoM6lHf9wuqtI+oCOfvILnoicNIqjh5E3dEJWiXuYME2gNe8vl1iMQwyUHa7bgFmak6Q=="],
+
+    "mdast-util-find-and-replace": ["mdast-util-find-and-replace@3.0.2", "", { "dependencies": { "@types/mdast": "^4.0.0", "escape-string-regexp": "^5.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg=="],
+
+    "mdast-util-from-markdown": ["mdast-util-from-markdown@2.0.3", "", { "dependencies": { "@types/mdast": "^4.0.0", "@types/unist": "^3.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "mdast-util-to-string": "^4.0.0", "micromark": "^4.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-decode-string": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q=="],
+
+    "mdast-util-gfm": ["mdast-util-gfm@3.1.0", "", { "dependencies": { "mdast-util-from-markdown": "^2.0.0", "mdast-util-gfm-autolink-literal": "^2.0.0", "mdast-util-gfm-footnote": "^2.0.0", "mdast-util-gfm-strikethrough": "^2.0.0", "mdast-util-gfm-table": "^2.0.0", "mdast-util-gfm-task-list-item": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ=="],
+
+    "mdast-util-gfm-autolink-literal": ["mdast-util-gfm-autolink-literal@2.0.1", "", { "dependencies": { "@types/mdast": "^4.0.0", "ccount": "^2.0.0", "devlop": "^1.0.0", "mdast-util-find-and-replace": "^3.0.0", "micromark-util-character": "^2.0.0" } }, "sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ=="],
+
+    "mdast-util-gfm-footnote": ["mdast-util-gfm-footnote@2.1.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "devlop": "^1.1.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0" } }, "sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ=="],
+
+    "mdast-util-gfm-strikethrough": ["mdast-util-gfm-strikethrough@2.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-mKKb915TF+OC5ptj5bJ7WFRPdYtuHv0yTRxK2tJvi+BDqbkiG7h7u/9SI89nRAYcmap2xHQL9D+QG/6wSrTtXg=="],
+
+    "mdast-util-gfm-table": ["mdast-util-gfm-table@2.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "devlop": "^1.0.0", "markdown-table": "^3.0.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-78UEvebzz/rJIxLvE7ZtDd/vIQ0RHv+3Mh5DR96p7cS7HsBhYIICDBCu8csTNWNO6tBWfqXPWekRuj2FNOGOZg=="],
+
+    "mdast-util-gfm-task-list-item": ["mdast-util-gfm-task-list-item@2.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "devlop": "^1.0.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ=="],
+
+    "mdast-util-mdx": ["mdast-util-mdx@3.0.0", "", { "dependencies": { "mdast-util-from-markdown": "^2.0.0", "mdast-util-mdx-expression": "^2.0.0", "mdast-util-mdx-jsx": "^3.0.0", "mdast-util-mdxjs-esm": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-JfbYLAW7XnYTTbUsmpu0kdBUVe+yKVJZBItEjwyYJiDJuZ9w4eeaqks4HQO+R7objWgS2ymV60GYpI14Ug554w=="],
+
+    "mdast-util-mdx-expression": ["mdast-util-mdx-expression@2.0.1", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "devlop": "^1.0.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ=="],
+
+    "mdast-util-mdx-jsx": ["mdast-util-mdx-jsx@3.2.0", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "@types/unist": "^3.0.0", "ccount": "^2.0.0", "devlop": "^1.1.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0", "parse-entities": "^4.0.0", "stringify-entities": "^4.0.0", "unist-util-stringify-position": "^4.0.0", "vfile-message": "^4.0.0" } }, "sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q=="],
+
+    "mdast-util-mdxjs-esm": ["mdast-util-mdxjs-esm@2.0.1", "", { "dependencies": { "@types/estree-jsx": "^1.0.0", "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "devlop": "^1.0.0", "mdast-util-from-markdown": "^2.0.0", "mdast-util-to-markdown": "^2.0.0" } }, "sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg=="],
+
+    "mdast-util-phrasing": ["mdast-util-phrasing@4.1.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "unist-util-is": "^6.0.0" } }, "sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w=="],
+
+    "mdast-util-to-hast": ["mdast-util-to-hast@13.2.1", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "@ungap/structured-clone": "^1.0.0", "devlop": "^1.0.0", "micromark-util-sanitize-uri": "^2.0.0", "trim-lines": "^3.0.0", "unist-util-position": "^5.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0" } }, "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA=="],
+
+    "mdast-util-to-markdown": ["mdast-util-to-markdown@2.1.2", "", { "dependencies": { "@types/mdast": "^4.0.0", "@types/unist": "^3.0.0", "longest-streak": "^3.0.0", "mdast-util-phrasing": "^4.0.0", "mdast-util-to-string": "^4.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-decode-string": "^2.0.0", "unist-util-visit": "^5.0.0", "zwitch": "^2.0.0" } }, "sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA=="],
+
+    "mdast-util-to-string": ["mdast-util-to-string@4.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0" } }, "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg=="],
+
+    "mdn-data": ["mdn-data@2.27.1", "", {}, "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ=="],
+
+    "memorystream": ["memorystream@0.3.1", "", {}, "sha512-S3UwM3yj5mtUSEfP41UZmt/0SCoVYUcU1rkXv+BQ5Ig8ndL4sPoJNBUJERafdPb5jjHJGuMgytgKvKIf58XNBw=="],
+
+    "merge-anything": ["merge-anything@5.1.7", "", { "dependencies": { "is-what": "^4.1.8" } }, "sha512-eRtbOb1N5iyH0tkQDAoQ4Ipsp/5qSR79Dzrz8hEPxRX10RWWR/iQXdoKmBSRCThY1Fh5EhISDtpSc93fpxUniQ=="],
+
+    "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
+
+    "mermaid": ["mermaid@11.15.0", "", { "dependencies": { "@braintree/sanitize-url": "^7.1.1", "@iconify/utils": "^3.0.2", "@mermaid-js/parser": "^1.1.1", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", "cytoscape": "^3.33.1", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", "dayjs": "^1.11.19", "dompurify": "^3.3.1", "es-toolkit": "^1.45.1", "katex": "^0.16.25", "khroma": "^2.1.0", "marked": "^16.3.0", "roughjs": "^4.6.6", "stylis": "^4.3.6", "ts-dedent": "^2.2.0", "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0" } }, "sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw=="],
+
+    "mermaid-isomorphic": ["mermaid-isomorphic@3.1.0", "", { "dependencies": { "@fortawesome/fontawesome-free": "^6.0.0", "katex": "^0.16.0", "mermaid": "^11.0.0" }, "peerDependencies": { "playwright": "1" }, "optionalPeers": ["playwright"] }, "sha512-mzrvfEVjnJIkJlEqxp3eMuR1wS0TeLCH1VK5E/T5yzWaBwI3JqjJuw70yUIThSCDJ5bRs6O3rgfp00oBAbvSeQ=="],
+
+    "micromark": ["micromark@4.0.2", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA=="],
+
+    "micromark-core-commonmark": ["micromark-core-commonmark@2.0.3", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-factory-destination": "^2.0.0", "micromark-factory-label": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-factory-title": "^2.0.0", "micromark-factory-whitespace": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-html-tag-name": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg=="],
+
+    "micromark-extension-directive": ["micromark-extension-directive@3.0.2", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-factory-whitespace": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "parse-entities": "^4.0.0" } }, "sha512-wjcXHgk+PPdmvR58Le9d7zQYWy+vKEU9Se44p2CrCDPiLr2FMyiT4Fyb5UFKFC66wGB3kPlgD7q3TnoqPS7SZA=="],
+
+    "micromark-extension-gfm": ["micromark-extension-gfm@3.0.0", "", { "dependencies": { "micromark-extension-gfm-autolink-literal": "^2.0.0", "micromark-extension-gfm-footnote": "^2.0.0", "micromark-extension-gfm-strikethrough": "^2.0.0", "micromark-extension-gfm-table": "^2.0.0", "micromark-extension-gfm-tagfilter": "^2.0.0", "micromark-extension-gfm-task-list-item": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w=="],
+
+    "micromark-extension-gfm-autolink-literal": ["micromark-extension-gfm-autolink-literal@2.1.0", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw=="],
+
+    "micromark-extension-gfm-footnote": ["micromark-extension-gfm-footnote@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw=="],
+
+    "micromark-extension-gfm-strikethrough": ["micromark-extension-gfm-strikethrough@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw=="],
+
+    "micromark-extension-gfm-table": ["micromark-extension-gfm-table@2.1.1", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg=="],
+
+    "micromark-extension-gfm-tagfilter": ["micromark-extension-gfm-tagfilter@2.0.0", "", { "dependencies": { "micromark-util-types": "^2.0.0" } }, "sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg=="],
+
+    "micromark-extension-gfm-task-list-item": ["micromark-extension-gfm-task-list-item@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw=="],
+
+    "micromark-extension-mdx-expression": ["micromark-extension-mdx-expression@3.0.1", "", { "dependencies": { "@types/estree": "^1.0.0", "devlop": "^1.0.0", "micromark-factory-mdx-expression": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-events-to-acorn": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-dD/ADLJ1AeMvSAKBwO22zG22N4ybhe7kFIZ3LsDI0GlsNr2A3KYxb0LdC1u5rj4Nw+CHKY0RVdnHX8vj8ejm4Q=="],
+
+    "micromark-extension-mdx-jsx": ["micromark-extension-mdx-jsx@3.0.2", "", { "dependencies": { "@types/estree": "^1.0.0", "devlop": "^1.0.0", "estree-util-is-identifier-name": "^3.0.0", "micromark-factory-mdx-expression": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-events-to-acorn": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "vfile-message": "^4.0.0" } }, "sha512-e5+q1DjMh62LZAJOnDraSSbDMvGJ8x3cbjygy2qFEi7HCeUT4BDKCvMozPozcD6WmOt6sVvYDNBKhFSz3kjOVQ=="],
+
+    "micromark-extension-mdx-md": ["micromark-extension-mdx-md@2.0.0", "", { "dependencies": { "micromark-util-types": "^2.0.0" } }, "sha512-EpAiszsB3blw4Rpba7xTOUptcFeBFi+6PY8VnJ2hhimH+vCQDirWgsMpz7w1XcZE7LVrSAUGb9VJpG9ghlYvYQ=="],
+
+    "micromark-extension-mdxjs": ["micromark-extension-mdxjs@3.0.0", "", { "dependencies": { "acorn": "^8.0.0", "acorn-jsx": "^5.0.0", "micromark-extension-mdx-expression": "^3.0.0", "micromark-extension-mdx-jsx": "^3.0.0", "micromark-extension-mdx-md": "^2.0.0", "micromark-extension-mdxjs-esm": "^3.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-A873fJfhnJ2siZyUrJ31l34Uqwy4xIFmvPY1oj+Ean5PHcPBYzEsvqvWGaWcfEIr11O5Dlw3p2y0tZWpKHDejQ=="],
+
+    "micromark-extension-mdxjs-esm": ["micromark-extension-mdxjs-esm@3.0.0", "", { "dependencies": { "@types/estree": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-events-to-acorn": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "unist-util-position-from-estree": "^2.0.0", "vfile-message": "^4.0.0" } }, "sha512-DJFl4ZqkErRpq/dAPyeWp15tGrcrrJho1hKK5uBS70BCtfrIFg81sqcTVu3Ta+KD1Tk5vAtBNElWxtAa+m8K9A=="],
+
+    "micromark-factory-destination": ["micromark-factory-destination@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA=="],
+
+    "micromark-factory-label": ["micromark-factory-label@2.0.1", "", { "dependencies": { "devlop": "^1.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg=="],
+
+    "micromark-factory-mdx-expression": ["micromark-factory-mdx-expression@2.0.3", "", { "dependencies": { "@types/estree": "^1.0.0", "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-events-to-acorn": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "unist-util-position-from-estree": "^2.0.0", "vfile-message": "^4.0.0" } }, "sha512-kQnEtA3vzucU2BkrIa8/VaSAsP+EJ3CKOvhMuJgOEGg9KDC6OAY6nSnNDVRiVNRqj7Y4SlSzcStaH/5jge8JdQ=="],
+
+    "micromark-factory-space": ["micromark-factory-space@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg=="],
+
+    "micromark-factory-title": ["micromark-factory-title@2.0.1", "", { "dependencies": { "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw=="],
+
+    "micromark-factory-whitespace": ["micromark-factory-whitespace@2.0.1", "", { "dependencies": { "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ=="],
+
+    "micromark-util-character": ["micromark-util-character@2.1.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q=="],
+
+    "micromark-util-chunked": ["micromark-util-chunked@2.0.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0" } }, "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA=="],
+
+    "micromark-util-classify-character": ["micromark-util-classify-character@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q=="],
+
+    "micromark-util-combine-extensions": ["micromark-util-combine-extensions@2.0.1", "", { "dependencies": { "micromark-util-chunked": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg=="],
+
+    "micromark-util-decode-numeric-character-reference": ["micromark-util-decode-numeric-character-reference@2.0.2", "", { "dependencies": { "micromark-util-symbol": "^2.0.0" } }, "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw=="],
+
+    "micromark-util-decode-string": ["micromark-util-decode-string@2.0.1", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "micromark-util-character": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-symbol": "^2.0.0" } }, "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ=="],
+
+    "micromark-util-encode": ["micromark-util-encode@2.0.1", "", {}, "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw=="],
+
+    "micromark-util-events-to-acorn": ["micromark-util-events-to-acorn@2.0.3", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/unist": "^3.0.0", "devlop": "^1.0.0", "estree-util-visit": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "vfile-message": "^4.0.0" } }, "sha512-jmsiEIiZ1n7X1Rr5k8wVExBQCg5jy4UXVADItHmNk1zkwEVhBuIUKRu3fqv+hs4nxLISi2DQGlqIOGiFxgbfHg=="],
+
+    "micromark-util-html-tag-name": ["micromark-util-html-tag-name@2.0.1", "", {}, "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA=="],
+
+    "micromark-util-normalize-identifier": ["micromark-util-normalize-identifier@2.0.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0" } }, "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q=="],
+
+    "micromark-util-resolve-all": ["micromark-util-resolve-all@2.0.1", "", { "dependencies": { "micromark-util-types": "^2.0.0" } }, "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg=="],
+
+    "micromark-util-sanitize-uri": ["micromark-util-sanitize-uri@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-symbol": "^2.0.0" } }, "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ=="],
+
+    "micromark-util-subtokenize": ["micromark-util-subtokenize@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA=="],
+
+    "micromark-util-symbol": ["micromark-util-symbol@2.0.1", "", {}, "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q=="],
+
+    "micromark-util-types": ["micromark-util-types@2.0.2", "", {}, "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA=="],
+
+    "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
+
+    "mime": ["mime@4.1.0", "", { "bin": { "mime": "bin/cli.js" } }, "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw=="],
+
+    "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="],
+
+    "mime-types": ["mime-types@3.0.2", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A=="],
+
+    "mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="],
+
+    "mini-svg-data-uri": ["mini-svg-data-uri@1.4.4", "", { "bin": { "mini-svg-data-uri": "cli.js" } }, "sha512-r9deDe9p5FJUPZAk3A59wGH7Ii9YrjjWw0jmw/liSbHl2CHiyXj6FcDXDu2K3TjVAXqiJdaw3xxwlZZr9E6nHg=="],
+
+    "miniflare": ["miniflare@4.20260526.0", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "^0.34.5", "undici": "7.24.8", "workerd": "1.20260526.1", "ws": "8.20.1", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-JYQ7jPZZWoaaj9jWHb8Ucp6Cu2SbDVqIsAJhumqdzzLkkfq0pYkDeino/sZfW1ixJWPjv/C44zjm9gVJC2izCA=="],
+
+    "minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+
+    "minimist": ["minimist@1.2.8", "", {}, "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA=="],
+
+    "minipass": ["minipass@7.1.3", "", {}, "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A=="],
+
+    "minizlib": ["minizlib@2.1.2", "", { "dependencies": { "minipass": "^3.0.0", "yallist": "^4.0.0" } }, "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg=="],
+
+    "mkdirp": ["mkdirp@1.0.4", "", { "bin": { "mkdirp": "bin/cmd.js" } }, "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw=="],
+
+    "mlly": ["mlly@1.8.2", "", { "dependencies": { "acorn": "^8.16.0", "pathe": "^2.0.3", "pkg-types": "^1.3.1", "ufo": "^1.6.3" } }, "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA=="],
+
+    "mri": ["mri@1.2.0", "", {}, "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA=="],
+
+    "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="],
+
+    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
+
+    "msgpackr": ["msgpackr@2.0.2", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.4" } }, "sha512-c5hYOXFbP79Slh6Dzd2wzk+jnV7mX1UxfMYtilnY1NmalXPqG8DGb5cYCMBrW4AsH3zekBBZd4QrKz9NhtvYLQ=="],
+
+    "msgpackr-extract": ["msgpackr-extract@3.0.4", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw=="],
+
+    "muggle-string": ["muggle-string@0.4.1", "", {}, "sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ=="],
+
+    "multipasta": ["multipasta@0.2.7", "", {}, "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA=="],
+
+    "mysql2": ["mysql2@3.22.4", "", { "dependencies": { "aws-ssl-profiles": "^1.1.2", "denque": "^2.1.0", "generate-function": "^2.3.1", "iconv-lite": "^0.7.2", "long": "^5.3.2", "lru.min": "^1.1.4", "named-placeholders": "^1.1.6", "sql-escaper": "^1.3.3" }, "peerDependencies": { "@types/node": ">= 8" } }, "sha512-CtXYlmL7ZamiYKbmqkamQHWJROUHSfm+f3kByzGfknw7kW51mcB2ouMUqYq1XfYxbXmnWo6RhPydx6OCqdgcmQ=="],
+
+    "named-placeholders": ["named-placeholders@1.1.6", "", { "dependencies": { "lru.min": "^1.1.0" } }, "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w=="],
+
+    "nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="],
+
+    "nanostores": ["nanostores@1.3.0", "", {}, "sha512-XPUa/jz+P1oJvN9VBxw4L9MtdFfaH3DAryqPssqhb2kXjmb9npz0dly6rCsgFWOPr4Yg9mTfM3MDZgZZ+7A3lA=="],
+
+    "natural-compare": ["natural-compare@1.4.0", "", {}, "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw=="],
+
+    "neotraverse": ["neotraverse@0.6.18", "", {}, "sha512-Z4SmBUweYa09+o6pG+eASabEpP6QkQ70yHj351pQoEXIs8uHbaU2DWVmzBANKgflPa47A50PtB2+NgRpQvr7vA=="],
+
+    "netmask": ["netmask@2.1.1", "", {}, "sha512-eonl3sLUha+S1GzTPxychyhnUzKyeQkZ7jLjKrBagJgPla13F+uQ71HgpFefyHgqrjEbCPkDArxYsjY8/+gLKA=="],
+
+    "nitropack": ["nitropack@2.13.4", "", { "dependencies": { "@cloudflare/kv-asset-handler": "^0.4.2", "@rollup/plugin-alias": "^6.0.0", "@rollup/plugin-commonjs": "^29.0.2", "@rollup/plugin-inject": "^5.0.5", "@rollup/plugin-json": "^6.1.0", "@rollup/plugin-node-resolve": "^16.0.3", "@rollup/plugin-replace": "^6.0.3", "@rollup/plugin-terser": "^1.0.0", "@vercel/nft": "^1.5.0", "archiver": "^7.0.1", "c12": "^3.3.4", "chokidar": "^5.0.0", "citty": "^0.2.2", "compatx": "^0.2.0", "confbox": "^0.2.4", "consola": "^3.4.2", "cookie-es": "^2.0.1", "croner": "^10.0.1", "crossws": "^0.3.5", "db0": "^0.3.4", "defu": "^6.1.7", "destr": "^2.0.5", "dot-prop": "^10.1.0", "esbuild": "^0.28.0", "escape-string-regexp": "^5.0.0", "etag": "^1.8.1", "exsolve": "^1.0.8", "globby": "^16.2.0", "gzip-size": "^7.0.0", "h3": "^1.15.11", "hookable": "^5.5.3", "httpxy": "^0.5.1", "ioredis": "^5.10.1", "jiti": "^2.6.1", "klona": "^2.0.6", "knitwork": "^1.3.0", "listhen": "^1.9.1", "magic-string": "^0.30.21", "magicast": "^0.5.2", "mime": "^4.1.0", "mlly": "^1.8.2", "node-fetch-native": "^1.6.7", "node-mock-http": "^1.0.4", "ofetch": "^1.5.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.1", "pretty-bytes": "^7.1.0", "radix3": "^1.1.2", "rollup": "^4.60.2", "rollup-plugin-visualizer": "^7.0.1", "scule": "^1.3.0", "semver": "^7.7.4", "serve-placeholder": "^2.0.2", "serve-static": "^2.2.1", "source-map": "^0.7.6", "std-env": "^4.1.0", "ufo": "^1.6.4", "ultrahtml": "^1.6.0", "uncrypto": "^0.1.3", "unctx": "^2.5.0", "unenv": "2.0.0-rc.24", "unimport": "^6.2.0", "unplugin-utils": "^0.3.1", "unstorage": "^1.17.5", "untyped": "^2.0.0", "unwasm": "^0.5.3", "youch": "^4.1.1", "youch-core": "^0.3.3" }, "peerDependencies": { "xml2js": "^0.6.2" }, "optionalPeers": ["xml2js"], "bin": { "nitro": "dist/cli/index.mjs", "nitropack": "dist/cli/index.mjs" } }, "sha512-tX7bT6zxNeMwkc6hxHiZeUoTOjVrcjoh1Z3cmxOlodIqjl4HISgqfGOmkWSayky3Nv9Z5+KQH52F8nmXJY5AAA=="],
+
+    "nlcst-to-string": ["nlcst-to-string@4.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0" } }, "sha512-YKLBCcUYKAg0FNlOBT6aI91qFmSiFKiluk655WzPF+DDMA02qIyy8uiRqI8QXtcFpEvll12LpL5MXqEmAZ+dcA=="],
+
+    "node-addon-api": ["node-addon-api@7.1.1", "", {}, "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ=="],
+
+    "node-fetch": ["node-fetch@2.7.0", "", { "dependencies": { "whatwg-url": "^5.0.0" }, "peerDependencies": { "encoding": "^0.1.0" }, "optionalPeers": ["encoding"] }, "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A=="],
+
+    "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
+
+    "node-forge": ["node-forge@1.4.0", "", {}, "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ=="],
+
+    "node-gyp-build": ["node-gyp-build@4.8.4", "", { "bin": { "node-gyp-build": "bin.js", "node-gyp-build-optional": "optional.js", "node-gyp-build-test": "build-test.js" } }, "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ=="],
+
+    "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="],
+
+    "node-html-parser": ["node-html-parser@7.1.0", "", { "dependencies": { "css-select": "^5.1.0", "he": "1.2.0" } }, "sha512-iJo8b2uYGT40Y8BTyy5ufL6IVbN8rbm/1QK2xffXU/1a/v3AAa0d1YAoqBNYqaS4R/HajkWIpIfdE6KcyFh1AQ=="],
+
+    "node-mock-http": ["node-mock-http@1.0.4", "", {}, "sha512-8DY+kFsDkNXy1sJglUfuODx1/opAGJGyrTuFqEoN90oRc2Vk0ZbD4K2qmKXBBEhZQzdKHIVfEJpDU8Ak2NJEvQ=="],
+
+    "node-releases": ["node-releases@2.0.46", "", {}, "sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ=="],
+
+    "nopt": ["nopt@8.1.0", "", { "dependencies": { "abbrev": "^3.0.0" }, "bin": { "nopt": "bin/nopt.js" } }, "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A=="],
+
+    "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
+
+    "npm-normalize-package-bin": ["npm-normalize-package-bin@4.0.0", "", {}, "sha512-TZKxPvItzai9kN9H/TkmCtx/ZN/hvr3vUycjlfmH0ootY9yFBzNOpiXAdIn1Iteqsvk4lQn6B5PTrt+n6h8k/w=="],
+
+    "npm-run-all2": ["npm-run-all2@8.0.4", "", { "dependencies": { "ansi-styles": "^6.2.1", "cross-spawn": "^7.0.6", "memorystream": "^0.3.1", "picomatch": "^4.0.2", "pidtree": "^0.6.0", "read-package-json-fast": "^4.0.0", "shell-quote": "^1.7.3", "which": "^5.0.0" }, "bin": { "run-p": "bin/run-p/index.js", "run-s": "bin/run-s/index.js", "npm-run-all": "bin/npm-run-all/index.js", "npm-run-all2": "bin/npm-run-all/index.js" } }, "sha512-wdbB5My48XKp2ZfJUlhnLVihzeuA1hgBnqB2J9ahV77wLS+/YAJAlN8I+X3DIFIPZ3m5L7nplmlbhNiFDmXRDA=="],
+
+    "npm-run-path": ["npm-run-path@6.0.0", "", { "dependencies": { "path-key": "^4.0.0", "unicorn-magic": "^0.3.0" } }, "sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA=="],
+
+    "nth-check": ["nth-check@2.1.1", "", { "dependencies": { "boolbase": "^1.0.0" } }, "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w=="],
+
+    "nypm": ["nypm@0.5.4", "", { "dependencies": { "citty": "^0.1.6", "consola": "^3.4.0", "pathe": "^2.0.3", "pkg-types": "^1.3.1", "tinyexec": "^0.3.2", "ufo": "^1.5.4" }, "bin": { "nypm": "dist/cli.mjs" } }, "sha512-X0SNNrZiGU8/e/zAB7sCTtdxWTMSIO73q+xuKgglm2Yvzwlo8UoC5FNySQFCvl84uPaeADkqHUZUkWy4aH4xOA=="],
+
+    "obuf": ["obuf@1.1.2", "", {}, "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg=="],
+
+    "obug": ["obug@2.1.1", "", {}, "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ=="],
+
+    "ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
+    "ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
+
+    "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="],
+
+    "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
+
+    "onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
+
+    "oniguruma-parser": ["oniguruma-parser@0.12.2", "", {}, "sha512-6HVa5oIrgMC6aA6WF6XyyqbhRPJrKR02L20+2+zpDtO5QAzGHAUGw5TKQvwi5vctNnRHkJYmjAhRVQF2EKdTQw=="],
+
+    "oniguruma-to-es": ["oniguruma-to-es@2.3.0", "", { "dependencies": { "emoji-regex-xs": "^1.0.0", "regex": "^5.1.1", "regex-recursion": "^5.1.1" } }, "sha512-bwALDxriqfKGfUufKGGepCzu9x7nJQuoRoAFp4AnwehhC2crqrDIAP/uN2qdlsAvSMpeRC3+Yzhqc7hLmle5+g=="],
+
+    "open": ["open@10.2.0", "", { "dependencies": { "default-browser": "^5.2.1", "define-lazy-prop": "^3.0.0", "is-inside-container": "^1.0.0", "wsl-utils": "^0.1.0" } }, "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA=="],
+
+    "optionator": ["optionator@0.9.4", "", { "dependencies": { "deep-is": "^0.1.3", "fast-levenshtein": "^2.0.6", "levn": "^0.4.1", "prelude-ls": "^1.2.1", "type-check": "^0.4.0", "word-wrap": "^1.2.5" } }, "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g=="],
+
+    "os-paths": ["os-paths@7.4.0", "", { "optionalDependencies": { "fsevents": "*" } }, "sha512-Ux1J4NUqC6tZayBqLN1kUlDAEvLiQlli/53sSddU4IN+h+3xxnv2HmRSMpVSvr1hvJzotfMs3ERvETGK+f4OwA=="],
+
+    "oxfmt": ["oxfmt@0.52.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.52.0", "@oxfmt/binding-android-arm64": "0.52.0", "@oxfmt/binding-darwin-arm64": "0.52.0", "@oxfmt/binding-darwin-x64": "0.52.0", "@oxfmt/binding-freebsd-x64": "0.52.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.52.0", "@oxfmt/binding-linux-arm-musleabihf": "0.52.0", "@oxfmt/binding-linux-arm64-gnu": "0.52.0", "@oxfmt/binding-linux-arm64-musl": "0.52.0", "@oxfmt/binding-linux-ppc64-gnu": "0.52.0", "@oxfmt/binding-linux-riscv64-gnu": "0.52.0", "@oxfmt/binding-linux-riscv64-musl": "0.52.0", "@oxfmt/binding-linux-s390x-gnu": "0.52.0", "@oxfmt/binding-linux-x64-gnu": "0.52.0", "@oxfmt/binding-linux-x64-musl": "0.52.0", "@oxfmt/binding-openharmony-arm64": "0.52.0", "@oxfmt/binding-win32-arm64-msvc": "0.52.0", "@oxfmt/binding-win32-ia32-msvc": "0.52.0", "@oxfmt/binding-win32-x64-msvc": "0.52.0" }, "peerDependencies": { "svelte": "^5.0.0", "vite-plus": "*" }, "optionalPeers": ["svelte", "vite-plus"], "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-nJlYM35F64zTDMecCNhoHNkf+D/eHv7xcjj9XDSj+bFAVtN93m7v8DQMdHd6nDG6Akf/kEYYHmDUBs2Dz27Sug=="],
+
+    "oxlint": ["oxlint@1.67.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.67.0", "@oxlint/binding-android-arm64": "1.67.0", "@oxlint/binding-darwin-arm64": "1.67.0", "@oxlint/binding-darwin-x64": "1.67.0", "@oxlint/binding-freebsd-x64": "1.67.0", "@oxlint/binding-linux-arm-gnueabihf": "1.67.0", "@oxlint/binding-linux-arm-musleabihf": "1.67.0", "@oxlint/binding-linux-arm64-gnu": "1.67.0", "@oxlint/binding-linux-arm64-musl": "1.67.0", "@oxlint/binding-linux-ppc64-gnu": "1.67.0", "@oxlint/binding-linux-riscv64-gnu": "1.67.0", "@oxlint/binding-linux-riscv64-musl": "1.67.0", "@oxlint/binding-linux-s390x-gnu": "1.67.0", "@oxlint/binding-linux-x64-gnu": "1.67.0", "@oxlint/binding-linux-x64-musl": "1.67.0", "@oxlint/binding-openharmony-arm64": "1.67.0", "@oxlint/binding-win32-arm64-msvc": "1.67.0", "@oxlint/binding-win32-ia32-msvc": "1.67.0", "@oxlint/binding-win32-x64-msvc": "1.67.0" }, "peerDependencies": { "oxlint-tsgolint": ">=0.22.1", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-blwwaHPdoH8piQ5/z0KHeoHFR7FZgl12WluKJfu4qFLPkZl6mK04PkLE45Fw1NxfBRSlh40Gu7MkxHUw++ociQ=="],
+
+    "p-limit": ["p-limit@7.3.0", "", { "dependencies": { "yocto-queue": "^1.2.1" } }, "sha512-7cIXg/Z0M5WZRblrsOla88S4wAK+zOQQWeBYfV3qJuJXMr+LnbYjaadrFaS0JILfEDPVqHyKnZ1Z/1d6J9VVUw=="],
+
+    "p-locate": ["p-locate@5.0.0", "", { "dependencies": { "p-limit": "^3.0.2" } }, "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw=="],
+
+    "p-queue": ["p-queue@8.1.1", "", { "dependencies": { "eventemitter3": "^5.0.1", "p-timeout": "^6.1.2" } }, "sha512-aNZ+VfjobsWryoiPnEApGGmf5WmNsCo9xu8dfaYamG5qaLP7ClhLN6NgsFe6SwJ2UbLEBK5dv9x8Mn5+RVhMWQ=="],
+
+    "p-timeout": ["p-timeout@6.1.4", "", {}, "sha512-MyIV3ZA/PmyBN/ud8vV9XzwTrNtR4jFrObymZYnZqMmW0zA8Z17vnT0rBgFE/TlohB+YCHqXMgZzb3Csp49vqg=="],
+
+    "pac-proxy-agent": ["pac-proxy-agent@7.2.0", "", { "dependencies": { "@tootallnate/quickjs-emscripten": "^0.23.0", "agent-base": "^7.1.2", "debug": "^4.3.4", "get-uri": "^6.0.1", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.6", "pac-resolver": "^7.0.1", "socks-proxy-agent": "^8.0.5" } }, "sha512-TEB8ESquiLMc0lV8vcd5Ql/JAKAoyzHFXaStwjkzpOpC5Yv+pIzLfHvjTSdf3vpa2bMiUQrg9i6276yn8666aA=="],
+
+    "pac-resolver": ["pac-resolver@7.0.1", "", { "dependencies": { "degenerator": "^5.0.0", "netmask": "^2.0.2" } }, "sha512-5NPgf87AT2STgwa2ntRMr45jTKrYBGkVU36yT0ig/n/GMAa3oPqhZfIQ2kMEimReg0+t9kZViDVZ83qfVUlckg=="],
+
+    "package-json-from-dist": ["package-json-from-dist@1.0.1", "", {}, "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw=="],
+
+    "package-manager-detector": ["package-manager-detector@1.6.0", "", {}, "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA=="],
+
+    "pagefind": ["pagefind@1.5.2", "", { "optionalDependencies": { "@pagefind/darwin-arm64": "1.5.2", "@pagefind/darwin-x64": "1.5.2", "@pagefind/freebsd-x64": "1.5.2", "@pagefind/linux-arm64": "1.5.2", "@pagefind/linux-x64": "1.5.2", "@pagefind/windows-arm64": "1.5.2", "@pagefind/windows-x64": "1.5.2" }, "bin": { "pagefind": "lib/runner/bin.cjs" } }, "sha512-XTUaK0hXMCu2jszWE584JGQT7y284TmMV9l/HX3rnG5uo3rHI/uHU56XTyyyPFjeWEBxECbAi0CaFDJOONtG0Q=="],
+
+    "pako": ["pako@1.0.11", "", {}, "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="],
+
+    "parse-css-color": ["parse-css-color@0.2.1", "", { "dependencies": { "color-name": "^1.1.4", "hex-rgb": "^4.1.0" } }, "sha512-bwS/GGIFV3b6KS4uwpzCFj4w297Yl3uqnSgIPsoQkx7GMLROXfMnWvxfNkL0oh8HVhZA4hvJoEoEIqonfJ3BWg=="],
+
+    "parse-entities": ["parse-entities@4.0.2", "", { "dependencies": { "@types/unist": "^2.0.0", "character-entities-legacy": "^3.0.0", "character-reference-invalid": "^2.0.0", "decode-named-character-reference": "^1.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0", "is-hexadecimal": "^2.0.0" } }, "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw=="],
+
+    "parse-latin": ["parse-latin@7.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "@types/unist": "^3.0.0", "nlcst-to-string": "^4.0.0", "unist-util-modify-children": "^4.0.0", "unist-util-visit-children": "^3.0.0", "vfile": "^6.0.0" } }, "sha512-mhHgobPPua5kZ98EF4HWiH167JWBfl4pvAIXXdbaVohtK7a6YBOy56kvhCqduqyo/f3yrHFWmqmiMg/BkBkYYQ=="],
+
+    "parse-ms": ["parse-ms@4.0.0", "", {}, "sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw=="],
+
+    "parse5": ["parse5@7.3.0", "", { "dependencies": { "entities": "^6.0.0" } }, "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw=="],
+
+    "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
+
+    "patch-console": ["patch-console@2.0.0", "", {}, "sha512-0YNdUceMdaQwoKce1gatDScmMo5pu/tfABfnzEqeG0gtTmd7mh/WcwgUjtAeOU7N8nFFlbQBnFK2gXW5fGvmMA=="],
+
+    "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],
+
+    "path-data-parser": ["path-data-parser@0.1.0", "", {}, "sha512-NOnmBpt5Y2RWbuv0LMzsayp3lVylAHLPUTut412ZA3l+C4uw4ZVkQbjShYCQ8TCpUMdPapr4YjUqLYD6v68j+w=="],
+
+    "path-exists": ["path-exists@4.0.0", "", {}, "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w=="],
+
+    "path-expression-matcher": ["path-expression-matcher@1.5.0", "", {}, "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ=="],
+
+    "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
+
+    "path-parse": ["path-parse@1.0.7", "", {}, "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="],
+
+    "path-scurry": ["path-scurry@2.0.2", "", { "dependencies": { "lru-cache": "^11.0.0", "minipass": "^7.1.2" } }, "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg=="],
+
+    "path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="],
+
+    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
+    "pend": ["pend@1.2.0", "", {}, "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg=="],
+
+    "perfect-debounce": ["perfect-debounce@2.1.0", "", {}, "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g=="],
+
+    "pg": ["pg@8.21.0", "", { "dependencies": { "pg-connection-string": "^2.13.0", "pg-pool": "^3.14.0", "pg-protocol": "^1.14.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.4.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA=="],
+
+    "pg-cloudflare": ["pg-cloudflare@1.4.0", "", {}, "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A=="],
+
+    "pg-connection-string": ["pg-connection-string@2.13.0", "", {}, "sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig=="],
+
+    "pg-cursor": ["pg-cursor@2.20.0", "", { "peerDependencies": { "pg": "^8" } }, "sha512-HP/EbUafheaUOs7DxlG6tda/rhmsX2hCTJJJ+gCnhljGyNEs6pBHddbNuomlW3DqEhP3zYD+GqBWkYnJPIZ4tA=="],
+
+    "pg-int8": ["pg-int8@1.0.1", "", {}, "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw=="],
+
+    "pg-numeric": ["pg-numeric@1.0.2", "", {}, "sha512-BM/Thnrw5jm2kKLE5uJkXqqExRUY/toLHda65XgFTBTFYZyopbKjBe29Ii3RbkvlsMoFwD+tHeGaCjjv0gHlyw=="],
+
+    "pg-pool": ["pg-pool@3.14.0", "", { "peerDependencies": { "pg": ">=8.0" } }, "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw=="],
+
+    "pg-protocol": ["pg-protocol@1.14.0", "", {}, "sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA=="],
+
+    "pg-types": ["pg-types@2.2.0", "", { "dependencies": { "pg-int8": "1.0.1", "postgres-array": "~2.0.0", "postgres-bytea": "~1.0.0", "postgres-date": "~1.0.4", "postgres-interval": "^1.1.0" } }, "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA=="],
+
+    "pgpass": ["pgpass@1.0.5", "", { "dependencies": { "split2": "^4.1.0" } }, "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug=="],
+
+    "piccolore": ["piccolore@0.1.3", "", {}, "sha512-o8bTeDWjE086iwKrROaDf31K0qC/BENdm15/uH9usSC/uZjJOKb2YGiVHfLY4GhwsERiPI1jmwI2XrA7ACOxVw=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
+
+    "pidtree": ["pidtree@0.6.0", "", { "bin": { "pidtree": "bin/pidtree.js" } }, "sha512-eG2dWTVw5bzqGRztnHExczNxt5VGsE6OwTeCG3fdUf9KBsZzO3R5OIIIzWR+iZA0NtZ+RDVdaoE2dK1cn6jH4g=="],
+
+    "pkg-pr-new": ["pkg-pr-new@0.0.62", "", { "dependencies": { "@actions/core": "^1.11.1", "@jsdevtools/ez-spawn": "^3.0.4", "@octokit/action": "^6.1.0", "ignore": "^5.3.1", "isbinaryfile": "^5.0.2", "pkg-types": "^1.1.1", "query-registry": "^3.0.1", "tinyglobby": "^0.2.9" }, "bin": { "pkg-pr-new": "bin/cli.js" } }, "sha512-K2jtf1PLCJJFDimQIpasPXDdnRTZSYPy36Ldz+QhMpLz2YN1Wi0ZQkomVt5Wi3NdBZcYuYGXekyFWfJ6fAHYjg=="],
+
+    "pkg-types": ["pkg-types@1.3.1", "", { "dependencies": { "confbox": "^0.1.8", "mlly": "^1.7.4", "pathe": "^2.0.1" } }, "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ=="],
+
+    "points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="],
+
+    "points-on-path": ["points-on-path@0.2.1", "", { "dependencies": { "path-data-parser": "0.1.0", "points-on-curve": "0.2.0" } }, "sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g=="],
+
+    "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
+
+    "postcss-nested": ["postcss-nested@6.2.0", "", { "dependencies": { "postcss-selector-parser": "^6.1.1" }, "peerDependencies": { "postcss": "^8.2.14" } }, "sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ=="],
+
+    "postcss-selector-parser": ["postcss-selector-parser@6.1.2", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg=="],
+
+    "postcss-value-parser": ["postcss-value-parser@4.2.0", "", {}, "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ=="],
+
+    "postgres-array": ["postgres-array@2.0.0", "", {}, "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA=="],
+
+    "postgres-bytea": ["postgres-bytea@1.0.1", "", {}, "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ=="],
+
+    "postgres-date": ["postgres-date@1.0.7", "", {}, "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q=="],
+
+    "postgres-interval": ["postgres-interval@1.2.0", "", { "dependencies": { "xtend": "^4.0.0" } }, "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ=="],
+
+    "postgres-range": ["postgres-range@1.1.4", "", {}, "sha512-i/hbxIE9803Alj/6ytL7UHQxRvZkI9O4Sy+J3HGc4F4oo/2eQAjTSNJ0bfxyse3bH0nuVesCk+3IRLaMtG3H6w=="],
+
+    "powershell-utils": ["powershell-utils@0.1.0", "", {}, "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A=="],
+
+    "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
+
+    "prettier": ["prettier@3.6.2", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ=="],
+
+    "pretty-bytes": ["pretty-bytes@7.1.0", "", {}, "sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw=="],
+
+    "pretty-ms": ["pretty-ms@9.3.0", "", { "dependencies": { "parse-ms": "^4.0.0" } }, "sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ=="],
+
+    "prismjs": ["prismjs@1.30.0", "", {}, "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw=="],
+
+    "process": ["process@0.11.10", "", {}, "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A=="],
+
+    "process-nextick-args": ["process-nextick-args@2.0.1", "", {}, "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="],
+
+    "progress": ["progress@2.0.3", "", {}, "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA=="],
+
+    "promise-limit": ["promise-limit@2.7.0", "", {}, "sha512-7nJ6v5lnJsXwGprnGXga4wx6d1POjvi5Qmf1ivTRxTjH4Z/9Czja/UCMLVmB9N93GeWOU93XaFaEt6jbuoagNw=="],
+
+    "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="],
+
+    "property-information": ["property-information@7.1.0", "", {}, "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ=="],
+
+    "proxy-agent": ["proxy-agent@6.5.0", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "^4.3.4", "http-proxy-agent": "^7.0.1", "https-proxy-agent": "^7.0.6", "lru-cache": "^7.14.1", "pac-proxy-agent": "^7.1.0", "proxy-from-env": "^1.1.0", "socks-proxy-agent": "^8.0.5" } }, "sha512-TmatMXdr2KlRiA2CyDu8GqR8EjahTG3aY3nXjdzFyoZbmB8hrBsTyMezhULIXKnC0jpfjlmiZ3+EaCzoInSu/A=="],
+
+    "proxy-from-env": ["proxy-from-env@1.1.0", "", {}, "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg=="],
+
+    "pump": ["pump@3.0.4", "", { "dependencies": { "end-of-stream": "^1.1.0", "once": "^1.3.1" } }, "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA=="],
+
+    "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
+
+    "pure-rand": ["pure-rand@8.4.0", "", {}, "sha512-IoM8YF/jY0hiugFo/wOWqfmarlE6J0wc6fDK1PhftMk7MGhVZl88sZimmqBBFomLOCSmcCCpsfj7wXASCpvK9A=="],
+
+    "quansync": ["quansync@1.0.0", "", {}, "sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA=="],
+
+    "query-registry": ["query-registry@3.0.1", "", { "dependencies": { "query-string": "^9.0.0", "quick-lru": "^7.0.0", "url-join": "^5.0.0", "validate-npm-package-name": "^5.0.1", "zod": "^3.23.8", "zod-package-json": "^1.0.3" } }, "sha512-M9RxRITi2mHMVPU5zysNjctUT8bAPx6ltEXo/ir9+qmiM47Y7f0Ir3+OxUO5OjYAWdicBQRew7RtHtqUXydqlg=="],
+
+    "query-string": ["query-string@9.4.0", "", { "dependencies": { "decode-uri-component": "^0.4.1", "filter-obj": "^5.1.0", "split-on-first": "^3.0.0" } }, "sha512-ivvWyHqU9K1Log4hJFhqVIIMoEi0nzmlRhvk2pPcTuQH/Y0K5iTTMxEx7R0PRHD2Z1hMVbWnjfsEWbIKIK+3IA=="],
+
+    "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
+
+    "quick-lru": ["quick-lru@7.3.0", "", {}, "sha512-k9lSsjl36EJdK7I06v7APZCbyGT2vMTsYSRX1Q2nbYmnkBqgUhRkAuzH08Ciotteu/PLJmIF2+tti7o3C/ts2g=="],
+
+    "radix3": ["radix3@1.1.2", "", {}, "sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA=="],
+
+    "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="],
+
+    "rc9": ["rc9@3.0.1", "", { "dependencies": { "defu": "^6.1.6", "destr": "^2.0.5" } }, "sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ=="],
+
+    "react": ["react@19.2.6", "", {}, "sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q=="],
+
+    "react-devtools-core": ["react-devtools-core@7.0.1", "", { "dependencies": { "shell-quote": "^1.6.1", "ws": "^7" } }, "sha512-C3yNvRHaizlpiASzy7b9vbnBGLrhvdhl1CbdU6EnZgxPNbai60szdLtl+VL76UNOt5bOoVTOz5rNWZxgGt+Gsw=="],
+
+    "react-dom": ["react-dom@19.2.6", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.6" } }, "sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g=="],
+
+    "react-icons": ["react-icons@5.6.0", "", { "peerDependencies": { "react": "*" } }, "sha512-RH93p5ki6LfOiIt0UtDyNg/cee+HLVR6cHHtW3wALfo+eOHTp8RnU2kRkI6E+H19zMIs03DyxUG/GfZMOGvmiA=="],
+
+    "react-reconciler": ["react-reconciler@0.33.0", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.0" } }, "sha512-KetWRytFv1epdpJc3J4G75I4WrplZE5jOL7Yq0p34+OVOKF4Se7WrdIdVC45XsSSmUTlht2FM/fM1FZb1mfQeA=="],
+
+    "react-refresh": ["react-refresh@0.18.0", "", {}, "sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw=="],
+
+    "read-package-json-fast": ["read-package-json-fast@4.0.0", "", { "dependencies": { "json-parse-even-better-errors": "^4.0.0", "npm-normalize-package-bin": "^4.0.0" } }, "sha512-qpt8EwugBWDw2cgE2W+/3oxC+KTez2uSVR8JU9Q36TXPAGCaozfQUs59v4j4GFpWTaw0i6hAZSvOmu1J0uOEUg=="],
+
+    "readable-stream": ["readable-stream@2.3.8", "", { "dependencies": { "core-util-is": "~1.0.0", "inherits": "~2.0.3", "isarray": "~1.0.0", "process-nextick-args": "~2.0.0", "safe-buffer": "~5.1.1", "string_decoder": "~1.1.1", "util-deprecate": "~1.0.1" } }, "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA=="],
+
+    "readdir-glob": ["readdir-glob@1.1.3", "", { "dependencies": { "minimatch": "^5.1.0" } }, "sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA=="],
+
+    "readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="],
+
+    "recma-build-jsx": ["recma-build-jsx@1.0.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-util-build-jsx": "^3.0.0", "vfile": "^6.0.0" } }, "sha512-8GtdyqaBcDfva+GUKDr3nev3VpKAhup1+RvkMvUxURHpW7QyIvk9F5wz7Vzo06CEMSilw6uArgRqhpiUcWp8ew=="],
+
+    "recma-jsx": ["recma-jsx@1.0.1", "", { "dependencies": { "acorn-jsx": "^5.0.0", "estree-util-to-js": "^2.0.0", "recma-parse": "^1.0.0", "recma-stringify": "^1.0.0", "unified": "^11.0.0" }, "peerDependencies": { "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-huSIy7VU2Z5OLv6oFLosQGGDqPqdO1iq6bWNAdhzMxSJP7RAso4fCZ1cKu8j9YHCZf3TPrq4dw3okhrylgcd7w=="],
+
+    "recma-parse": ["recma-parse@1.0.0", "", { "dependencies": { "@types/estree": "^1.0.0", "esast-util-from-js": "^2.0.0", "unified": "^11.0.0", "vfile": "^6.0.0" } }, "sha512-OYLsIGBB5Y5wjnSnQW6t3Xg7q3fQ7FWbw/vcXtORTnyaSFscOtABg+7Pnz6YZ6c27fG1/aN8CjfwoUEUIdwqWQ=="],
+
+    "recma-stringify": ["recma-stringify@1.0.0", "", { "dependencies": { "@types/estree": "^1.0.0", "estree-util-to-js": "^2.0.0", "unified": "^11.0.0", "vfile": "^6.0.0" } }, "sha512-cjwII1MdIIVloKvC9ErQ+OgAtwHBmcZ0Bg4ciz78FtbT8In39aAYbaA7zvxQ61xVMSPE8WxhLwLbhif4Js2C+g=="],
+
+    "redis-errors": ["redis-errors@1.2.0", "", {}, "sha512-1qny3OExCf0UvUV/5wpYKf2YwPcOqXzkwKKSmKHiE6ZMQs5heeE/c8eXK+PNllPvmjgAbfnsbpkGZWy8cBpn9w=="],
+
+    "redis-parser": ["redis-parser@3.0.0", "", { "dependencies": { "redis-errors": "^1.0.0" } }, "sha512-DJnGAeenTdpMEH6uAJRK/uiyEIH9WVsUmoLwzudwGJUwZPp80PDBWPHXSAGNPwNvIXAbe7MSUB1zQFugFml66A=="],
+
+    "regex": ["regex@5.1.1", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-dN5I359AVGPnwzJm2jN1k0W9LPZ+ePvoOeVMMfqIMFz53sSwXkxaJoxr50ptnsC771lK95BnTrVSZxq0b9yCGw=="],
+
+    "regex-recursion": ["regex-recursion@5.1.1", "", { "dependencies": { "regex": "^5.1.1", "regex-utilities": "^2.3.0" } }, "sha512-ae7SBCbzVNrIjgSbh7wMznPcQel1DNlDtzensnFxpiNpXt1U2ju/bHugH422r+4LAVS1FpW1YCwilmnNsjum9w=="],
+
+    "regex-utilities": ["regex-utilities@2.3.0", "", {}, "sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng=="],
+
+    "rehype": ["rehype@13.0.2", "", { "dependencies": { "@types/hast": "^3.0.0", "rehype-parse": "^9.0.0", "rehype-stringify": "^10.0.0", "unified": "^11.0.0" } }, "sha512-j31mdaRFrwFRUIlxGeuPXXKWQxet52RBQRvCmzl5eCefn/KGbomK5GMHNMsOJf55fgo3qw5tST5neDuarDYR2A=="],
+
+    "rehype-expressive-code": ["rehype-expressive-code@0.41.7", "", { "dependencies": { "expressive-code": "^0.41.7" } }, "sha512-25f8ZMSF1d9CMscX7Cft0TSQIqdwjce2gDOvQ+d/w0FovsMwrSt3ODP4P3Z7wO1jsIJ4eYyaDRnIR/27bd/EMQ=="],
+
+    "rehype-format": ["rehype-format@5.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-format": "^1.0.0" } }, "sha512-zvmVru9uB0josBVpr946OR8ui7nJEdzZobwLOOqHb/OOD88W0Vk2SqLwoVOj0fM6IPCCO6TaV9CvQvJMWwukFQ=="],
+
+    "rehype-mermaid": ["rehype-mermaid@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-from-html-isomorphic": "^2.0.0", "hast-util-to-text": "^4.0.0", "mermaid-isomorphic": "^3.0.0", "mini-svg-data-uri": "^1.0.0", "space-separated-tokens": "^2.0.0", "unified": "^11.0.0", "unist-util-visit-parents": "^6.0.0", "vfile": "^6.0.0" }, "peerDependencies": { "playwright": "1" }, "optionalPeers": ["playwright"] }, "sha512-fxrD5E4Fa1WXUjmjNDvLOMT4XB1WaxcfycFIWiYU0yEMQhcTDElc9aDFnbDFRLxG1Cfo1I3mfD5kg4sjlWaB+Q=="],
+
+    "rehype-parse": ["rehype-parse@9.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-from-html": "^2.0.0", "unified": "^11.0.0" } }, "sha512-ksCzCD0Fgfh7trPDxr2rSylbwq9iYDkSn8TCDmEJ49ljEUBxDVCzCHv7QNzZOfODanX4+bWQ4WZqLCRWYLfhag=="],
+
+    "rehype-raw": ["rehype-raw@7.0.0", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-raw": "^9.0.0", "vfile": "^6.0.0" } }, "sha512-/aE8hCfKlQeA8LmyeyQvQF3eBiLRGNlfBJEvWH7ivp9sBqs7TNqBL5X3v157rM4IFETqDnIOO+z5M/biZbo9Ww=="],
+
+    "rehype-recma": ["rehype-recma@1.0.0", "", { "dependencies": { "@types/estree": "^1.0.0", "@types/hast": "^3.0.0", "hast-util-to-estree": "^3.0.0" } }, "sha512-lqA4rGUf1JmacCNWWZx0Wv1dHqMwxzsDWYMTowuplHF3xH0N/MmrZ/G3BDZnzAkRmxDadujCjaKM2hqYdCBOGw=="],
+
+    "rehype-stringify": ["rehype-stringify@10.0.1", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-to-html": "^9.0.0", "unified": "^11.0.0" } }, "sha512-k9ecfXHmIPuFVI61B9DeLPN0qFHfawM6RsuX48hoqlaKSF61RskNjSm1lI8PhBEM0MRdLxVVm4WmTqJQccH9mA=="],
+
+    "remark-directive": ["remark-directive@3.0.1", "", { "dependencies": { "@types/mdast": "^4.0.0", "mdast-util-directive": "^3.0.0", "micromark-extension-directive": "^3.0.0", "unified": "^11.0.0" } }, "sha512-gwglrEQEZcZYgVyG1tQuA+h58EZfq5CSULw7J90AFuCTyib1thgHPoqQ+h9iFvU6R+vnZ5oNFQR5QKgGpk741A=="],
+
+    "remark-gfm": ["remark-gfm@4.0.1", "", { "dependencies": { "@types/mdast": "^4.0.0", "mdast-util-gfm": "^3.0.0", "micromark-extension-gfm": "^3.0.0", "remark-parse": "^11.0.0", "remark-stringify": "^11.0.0", "unified": "^11.0.0" } }, "sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg=="],
+
+    "remark-mdx": ["remark-mdx@3.1.1", "", { "dependencies": { "mdast-util-mdx": "^3.0.0", "micromark-extension-mdxjs": "^3.0.0" } }, "sha512-Pjj2IYlUY3+D8x00UJsIOg5BEvfMyeI+2uLPn9VO9Wg4MEtN/VTIq2NEJQfde9PnX15KgtHyl9S0BcTnWrIuWg=="],
+
+    "remark-parse": ["remark-parse@11.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "mdast-util-from-markdown": "^2.0.0", "micromark-util-types": "^2.0.0", "unified": "^11.0.0" } }, "sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA=="],
+
+    "remark-rehype": ["remark-rehype@11.1.2", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "mdast-util-to-hast": "^13.0.0", "unified": "^11.0.0", "vfile": "^6.0.0" } }, "sha512-Dh7l57ianaEoIpzbp0PC9UKAdCSVklD8E5Rpw7ETfbTl3FqcOOgq5q2LVDhgGCkaBv7p24JXikPdvhhmHvKMsw=="],
+
+    "remark-smartypants": ["remark-smartypants@3.0.2", "", { "dependencies": { "retext": "^9.0.0", "retext-smartypants": "^6.0.0", "unified": "^11.0.4", "unist-util-visit": "^5.0.0" } }, "sha512-ILTWeOriIluwEvPjv67v7Blgrcx+LZOkAUVtKI3putuhlZm84FnqDORNXPPm+HY3NdZOMhyDwZ1E+eZB/Df5dA=="],
+
+    "remark-stringify": ["remark-stringify@11.0.0", "", { "dependencies": { "@types/mdast": "^4.0.0", "mdast-util-to-markdown": "^2.0.0", "unified": "^11.0.0" } }, "sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw=="],
+
+    "request-light": ["request-light@0.7.0", "", {}, "sha512-lMbBMrDoxgsyO+yB3sDcrDuX85yYt7sS8BfQd11jtbW/z5ZWgLZRcEGLsLoYw7I0WSUGQBs8CC8ScIxkTX1+6Q=="],
+
+    "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
+
+    "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
+
+    "resolve": ["resolve@1.22.12", "", { "dependencies": { "es-errors": "^1.3.0", "is-core-module": "^2.16.1", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, "bin": { "resolve": "bin/resolve" } }, "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA=="],
+
+    "resolve-from": ["resolve-from@5.0.0", "", {}, "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw=="],
+
+    "resolve-pkg-maps": ["resolve-pkg-maps@1.0.0", "", {}, "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw=="],
+
+    "restore-cursor": ["restore-cursor@4.0.0", "", { "dependencies": { "onetime": "^5.1.0", "signal-exit": "^3.0.2" } }, "sha512-I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg=="],
+
+    "retext": ["retext@9.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "retext-latin": "^4.0.0", "retext-stringify": "^4.0.0", "unified": "^11.0.0" } }, "sha512-sbMDcpHCNjvlheSgMfEcVrZko3cDzdbe1x/e7G66dFp0Ff7Mldvi2uv6JkJQzdRcvLYE8CA8Oe8siQx8ZOgTcA=="],
+
+    "retext-latin": ["retext-latin@4.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "parse-latin": "^7.0.0", "unified": "^11.0.0" } }, "sha512-hv9woG7Fy0M9IlRQloq/N6atV82NxLGveq+3H2WOi79dtIYWN8OaxogDm77f8YnVXJL2VD3bbqowu5E3EMhBYA=="],
+
+    "retext-smartypants": ["retext-smartypants@6.2.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "nlcst-to-string": "^4.0.0", "unist-util-visit": "^5.0.0" } }, "sha512-kk0jOU7+zGv//kfjXEBjdIryL1Acl4i9XNkHxtM7Tm5lFiCog576fjNC9hjoR7LTKQ0DsPWy09JummSsH1uqfQ=="],
+
+    "retext-stringify": ["retext-stringify@4.0.0", "", { "dependencies": { "@types/nlcst": "^2.0.0", "nlcst-to-string": "^4.0.0", "unified": "^11.0.0" } }, "sha512-rtfN/0o8kL1e+78+uxPTqu1Klt0yPzKuQ2BfWwwfgIUSayyzxpM1PJzkKt4V8803uB9qSy32MvI7Xep9khTpiA=="],
+
+    "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="],
+
+    "robust-predicates": ["robust-predicates@3.0.3", "", {}, "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA=="],
+
+    "rolldown": ["rolldown@1.0.1", "", { "dependencies": { "@oxc-project/types": "=0.130.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.1", "@rolldown/binding-darwin-arm64": "1.0.1", "@rolldown/binding-darwin-x64": "1.0.1", "@rolldown/binding-freebsd-x64": "1.0.1", "@rolldown/binding-linux-arm-gnueabihf": "1.0.1", "@rolldown/binding-linux-arm64-gnu": "1.0.1", "@rolldown/binding-linux-arm64-musl": "1.0.1", "@rolldown/binding-linux-ppc64-gnu": "1.0.1", "@rolldown/binding-linux-s390x-gnu": "1.0.1", "@rolldown/binding-linux-x64-gnu": "1.0.1", "@rolldown/binding-linux-x64-musl": "1.0.1", "@rolldown/binding-openharmony-arm64": "1.0.1", "@rolldown/binding-wasm32-wasi": "1.0.1", "@rolldown/binding-win32-arm64-msvc": "1.0.1", "@rolldown/binding-win32-x64-msvc": "1.0.1" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ=="],
+
+    "rolldown-plugin-dts": ["rolldown-plugin-dts@0.17.8", "", { "dependencies": { "@babel/generator": "^7.28.5", "@babel/parser": "^7.28.5", "@babel/types": "^7.28.5", "ast-kit": "^2.2.0", "birpc": "^2.8.0", "dts-resolver": "^2.1.3", "get-tsconfig": "^4.13.0", "magic-string": "^0.30.21", "obug": "^2.0.0" }, "peerDependencies": { "@ts-macro/tsc": "^0.3.6", "@typescript/native-preview": ">=7.0.0-dev.20250601.1", "rolldown": "^1.0.0-beta.44", "typescript": "^5.0.0", "vue-tsc": "~3.1.0" }, "optionalPeers": ["@ts-macro/tsc", "@typescript/native-preview", "typescript", "vue-tsc"] }, "sha512-76EEBlhF00yeY6M7VpMkWKI4r9WjuoMiOGey7j4D6zf3m0BR+ZrrY9hvSXdueJ3ljxSLq4DJBKFpX/X9+L7EKw=="],
+
+    "rollup": ["rollup@4.60.4", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.60.4", "@rollup/rollup-android-arm64": "4.60.4", "@rollup/rollup-darwin-arm64": "4.60.4", "@rollup/rollup-darwin-x64": "4.60.4", "@rollup/rollup-freebsd-arm64": "4.60.4", "@rollup/rollup-freebsd-x64": "4.60.4", "@rollup/rollup-linux-arm-gnueabihf": "4.60.4", "@rollup/rollup-linux-arm-musleabihf": "4.60.4", "@rollup/rollup-linux-arm64-gnu": "4.60.4", "@rollup/rollup-linux-arm64-musl": "4.60.4", "@rollup/rollup-linux-loong64-gnu": "4.60.4", "@rollup/rollup-linux-loong64-musl": "4.60.4", "@rollup/rollup-linux-ppc64-gnu": "4.60.4", "@rollup/rollup-linux-ppc64-musl": "4.60.4", "@rollup/rollup-linux-riscv64-gnu": "4.60.4", "@rollup/rollup-linux-riscv64-musl": "4.60.4", "@rollup/rollup-linux-s390x-gnu": "4.60.4", "@rollup/rollup-linux-x64-gnu": "4.60.4", "@rollup/rollup-linux-x64-musl": "4.60.4", "@rollup/rollup-openbsd-x64": "4.60.4", "@rollup/rollup-openharmony-arm64": "4.60.4", "@rollup/rollup-win32-arm64-msvc": "4.60.4", "@rollup/rollup-win32-ia32-msvc": "4.60.4", "@rollup/rollup-win32-x64-gnu": "4.60.4", "@rollup/rollup-win32-x64-msvc": "4.60.4", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-WHeFSbZYsPu3+bLoNRUuAO+wavNlocOPf3wSHTP7hcFKVnJeWsYlCDbr3mTS14FCizf9ccIxXA8sGL8zKeQN3g=="],
+
+    "rollup-plugin-visualizer": ["rollup-plugin-visualizer@7.0.1", "", { "dependencies": { "open": "^11.0.0", "picomatch": "^4.0.2", "source-map": "^0.7.4", "yargs": "^18.0.0" }, "peerDependencies": { "rolldown": "1.x || ^1.0.0-beta || ^1.0.0-rc", "rollup": "2.x || 3.x || 4.x" }, "optionalPeers": ["rolldown", "rollup"], "bin": { "rollup-plugin-visualizer": "dist/bin/cli.js" } }, "sha512-UJUT4+1Ho4OcWmPYU3sYXgUqI8B8Ayfe06MX7y0qCJ1K8aGoKtR/NDd/2nZqM7ADkrzny+I99Ul7GgyoiVNAgg=="],
+
+    "rosie-skills": ["rosie-skills@0.6.4", "", { "optionalDependencies": { "rosie-skills-darwin-arm64": "0.6.4", "rosie-skills-freebsd-x64": "0.6.4", "rosie-skills-linux-x64": "0.6.4" }, "bin": { "rosie-skills": "dist/bin.js" } }, "sha512-ojfhSiQRdZ2QyWbmKAHOSAUbaLYrTc5zIH7mS1jKoP8KCFSQddwVhMyFqldckTeybTfW3zNcsZzyOTzGTN1SBA=="],
+
+    "rosie-skills-darwin-arm64": ["rosie-skills-darwin-arm64@0.6.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-rn1s5hqFKcxeiDEWWoFa1hdGPshR8TkwHLzy/cBavb9XJNAaUxbe3oQ78W9sQkRHAgRyzJYyk9tw68Qrdnizgg=="],
+
+    "rosie-skills-freebsd-x64": ["rosie-skills-freebsd-x64@0.6.4", "", { "os": "freebsd", "cpu": "x64" }, "sha512-SxCRduPBMtfjkQ+q56Yw9OLA3PyaqoALzt7kER7IDKuUVfM2O/1w8sa5xhTDiCvWkZJixnH5d5Ya6KT+/Mwcng=="],
+
+    "rosie-skills-linux-x64": ["rosie-skills-linux-x64@0.6.4", "", { "os": "linux", "cpu": "x64" }, "sha512-D9Y9mfu7goB0s0X59uU3hcFeUTef3VbpCIDwFMzyvJrAq3XhRACWBDMHQsHlyWdHxTXPX/ILyW65RXyrJlgqng=="],
+
+    "rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="],
+
+    "roughjs": ["roughjs@4.6.6", "", { "dependencies": { "hachure-fill": "^0.5.2", "path-data-parser": "^0.1.0", "points-on-curve": "^0.2.0", "points-on-path": "^0.2.1" } }, "sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ=="],
+
+    "run-applescript": ["run-applescript@7.1.0", "", {}, "sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q=="],
+
+    "run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
+
+    "rw": ["rw@1.3.3", "", {}, "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ=="],
+
+    "safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],
+
+    "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="],
+
+    "satori": ["satori@0.26.0", "", { "dependencies": { "@shuding/opentype.js": "1.4.0-beta.0", "css-background-parser": "^0.1.0", "css-box-shadow": "1.0.0-3", "css-gradient-parser": "^0.0.17", "css-to-react-native": "^3.0.0", "emoji-regex-xs": "^2.0.1", "escape-html": "^1.0.3", "linebreak": "^1.1.0", "parse-css-color": "^0.2.1", "postcss-value-parser": "^4.2.0", "yoga-layout": "^3.2.1" } }, "sha512-tkMFrfIs3l2mQ2JEcyW0ADTy3zGggFRFzi6Ef8YozQSFsFKEqaSO1Y8F9wJg4//PJGQauMalHGTUEkPrFwhVPA=="],
+
+    "sax": ["sax@1.6.0", "", {}, "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA=="],
+
+    "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
+
+    "scule": ["scule@1.3.0", "", {}, "sha512-6FtHJEvt+pVMIB9IBY+IcCJ6Z5f1iQnytgyfKMhDKgmzYG+TeH/wx1y3l27rshSbLiSanrR9ffZDrEsmjlQF2g=="],
+
+    "semver": ["semver@7.8.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg=="],
+
+    "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="],
+
+    "serialize-javascript": ["serialize-javascript@7.0.5", "", {}, "sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw=="],
+
+    "seroval": ["seroval@1.5.4", "", {}, "sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw=="],
+
+    "seroval-plugins": ["seroval-plugins@1.5.4", "", { "peerDependencies": { "seroval": "^1.0" } }, "sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw=="],
+
+    "serve-placeholder": ["serve-placeholder@2.0.2", "", { "dependencies": { "defu": "^6.1.4" } }, "sha512-/TMG8SboeiQbZJWRlfTCqMs2DD3SZgWp0kDQePz9yUuCnDfDh/92gf7/PxGhzXTKBIPASIHxFcZndoNbp6QOLQ=="],
+
+    "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="],
+
+    "set-cookie-parser": ["set-cookie-parser@3.1.0", "", {}, "sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw=="],
+
+    "setimmediate": ["setimmediate@1.0.5", "", {}, "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA=="],
+
+    "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="],
+
+    "sharp": ["sharp@0.34.5", "", { "dependencies": { "@img/colour": "^1.0.0", "detect-libc": "^2.1.2", "semver": "^7.7.3" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.34.5", "@img/sharp-darwin-x64": "0.34.5", "@img/sharp-libvips-darwin-arm64": "1.2.4", "@img/sharp-libvips-darwin-x64": "1.2.4", "@img/sharp-libvips-linux-arm": "1.2.4", "@img/sharp-libvips-linux-arm64": "1.2.4", "@img/sharp-libvips-linux-ppc64": "1.2.4", "@img/sharp-libvips-linux-riscv64": "1.2.4", "@img/sharp-libvips-linux-s390x": "1.2.4", "@img/sharp-libvips-linux-x64": "1.2.4", "@img/sharp-libvips-linuxmusl-arm64": "1.2.4", "@img/sharp-libvips-linuxmusl-x64": "1.2.4", "@img/sharp-linux-arm": "0.34.5", "@img/sharp-linux-arm64": "0.34.5", "@img/sharp-linux-ppc64": "0.34.5", "@img/sharp-linux-riscv64": "0.34.5", "@img/sharp-linux-s390x": "0.34.5", "@img/sharp-linux-x64": "0.34.5", "@img/sharp-linuxmusl-arm64": "0.34.5", "@img/sharp-linuxmusl-x64": "0.34.5", "@img/sharp-wasm32": "0.34.5", "@img/sharp-win32-arm64": "0.34.5", "@img/sharp-win32-ia32": "0.34.5", "@img/sharp-win32-x64": "0.34.5" } }, "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg=="],
+
+    "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
+
+    "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
+
+    "shell-quote": ["shell-quote@1.8.4", "", {}, "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ=="],
+
+    "shiki": ["shiki@1.29.2", "", { "dependencies": { "@shikijs/core": "1.29.2", "@shikijs/engine-javascript": "1.29.2", "@shikijs/engine-oniguruma": "1.29.2", "@shikijs/langs": "1.29.2", "@shikijs/themes": "1.29.2", "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1", "@types/hast": "^3.0.4" } }, "sha512-njXuliz/cP+67jU2hukkxCNuH1yUi4QfdZZY+sMr5PPrIyXSu5iTb/qYC4BiWWB0vZ+7TbdvYUCeL23zpwCfbg=="],
+
+    "siginfo": ["siginfo@2.0.0", "", {}, "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="],
+
+    "signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
+
+    "sirv": ["sirv@3.0.2", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g=="],
+
+    "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
+
+    "sitemap": ["sitemap@9.0.1", "", { "dependencies": { "@types/node": "^24.9.2", "@types/sax": "^1.2.1", "arg": "^5.0.0", "sax": "^1.4.1" }, "bin": { "sitemap": "dist/esm/cli.js" } }, "sha512-S6hzjGJSG3d6if0YoF5kTyeRJvia6FSTBroE5fQ0bu1QNxyJqhhinfUsXi9fH3MgtXODWvwo2BDyQSnhPQ88uQ=="],
+
+    "slash": ["slash@5.1.0", "", {}, "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg=="],
+
+    "slice-ansi": ["slice-ansi@8.0.0", "", { "dependencies": { "ansi-styles": "^6.2.3", "is-fullwidth-code-point": "^5.1.0" } }, "sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg=="],
+
+    "smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="],
+
+    "smartypants": ["smartypants@0.2.2", "", { "bin": { "smartypants": "bin/smartypants.js", "smartypantsu": "bin/smartypantsu.js" } }, "sha512-TzobUYoEft/xBtb2voRPryAUIvYguG0V7Tt3de79I1WfXgCwelqVsGuZSnu3GFGRZhXR90AeEYIM+icuB/S06Q=="],
+
+    "smob": ["smob@1.6.2", "", {}, "sha512-RQsvleCbF8cVHEv+xuDGaA4pOizFqJ0GgjtMSRo6oP8pnN7WsigHgVGey6aILRBKv4W2YOMHLqbKdnB6hpB9fw=="],
+
+    "smol-toml": ["smol-toml@1.6.1", "", {}, "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg=="],
+
+    "socks": ["socks@2.8.9", "", { "dependencies": { "ip-address": "^10.1.1", "smart-buffer": "^4.2.0" } }, "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw=="],
+
+    "socks-proxy-agent": ["socks-proxy-agent@8.0.5", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "^4.3.4", "socks": "^2.8.3" } }, "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw=="],
+
+    "solid-devtools": ["solid-devtools@0.34.5", "", { "dependencies": { "@babel/core": "^7.27.4", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/types": "^7.27.6", "@solid-devtools/debugger": "^0.28.1", "@solid-devtools/shared": "^0.20.0" }, "peerDependencies": { "solid-js": "^1.9.0", "vite": "^2.2.3 || ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["vite"] }, "sha512-KNVdS9MQzzeVS++Vmg4JeU0fM6ZMuBEmkBA7SmqPS2s5UHpRjv1PNH8gShmlN9L/tki6OUAzJP3H1aKq2AcOSg=="],
+
+    "solid-js": ["solid-js@1.9.13", "", { "dependencies": { "csstype": "^3.1.0", "seroval": "~1.5.0", "seroval-plugins": "~1.5.0" } }, "sha512-6hJeJMOcEX8ktqjpDoJZEmld3ijvcvWBDtiXBm7f4332SiFN66QeAQI1REQshvyUoISsSeJ4PHDauKYbwao9JQ=="],
+
+    "solid-refresh": ["solid-refresh@0.6.3", "", { "dependencies": { "@babel/generator": "^7.23.6", "@babel/helper-module-imports": "^7.22.15", "@babel/types": "^7.23.6" }, "peerDependencies": { "solid-js": "^1.3" } }, "sha512-F3aPsX6hVw9ttm5LYlth8Q15x6MlI/J3Dn+o3EQyRTtTxidepSTwAYdozt01/YA+7ObcciagGEyXIopGZzQtbA=="],
+
+    "solid-use": ["solid-use@0.9.1", "", { "peerDependencies": { "solid-js": "^1.7" } }, "sha512-UwvXDVPlrrbj/9ewG9ys5uL2IO4jSiwys2KPzK4zsnAcmEl7iDafZWW1Mo4BSEWOmQCGK6IvpmGHo1aou8iOFw=="],
+
+    "source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="],
+
+    "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="],
+
+    "source-map-support": ["source-map-support@0.5.21", "", { "dependencies": { "buffer-from": "^1.0.0", "source-map": "^0.6.0" } }, "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w=="],
+
+    "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
+
+    "split-on-first": ["split-on-first@3.0.0", "", {}, "sha512-qxQJTx2ryR0Dw0ITYyekNQWpz6f8dGd7vffGNflQQ3Iqj9NJ6qiZ7ELpZsJ/QBhIVAiDfXdag3+Gp8RvWa62AA=="],
+
+    "split2": ["split2@3.2.2", "", { "dependencies": { "readable-stream": "^3.0.0" } }, "sha512-9NThjpgZnifTkJpzTZ7Eue85S49QwpNhZTq6GRJwObb6jnLFNGB7Qm73V5HewTROPyxD0C29xqmaI68bQtV+hg=="],
+
+    "sql-escaper": ["sql-escaper@1.3.3", "", {}, "sha512-BsTCV265VpTp8tm1wyIm1xqQCS+Q9NHx2Sr+WcnUrgLrQ6yiDIvHYJV5gHxsj1lMBy2zm5twLaZao8Jd+S8JJw=="],
+
+    "srvx": ["srvx@0.9.8", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-RZaxTKJEE/14HYn8COLuUOJAt0U55N9l1Xf6jj+T0GoA01EUH1Xz5JtSUOI+EHn+AEgPCVn7gk6jHJffrr06fQ=="],
+
+    "stack-utils": ["stack-utils@2.0.6", "", { "dependencies": { "escape-string-regexp": "^2.0.0" } }, "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ=="],
+
+    "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="],
+
+    "stackframe": ["stackframe@1.3.4", "", {}, "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw=="],
+
+    "standard-as-callback": ["standard-as-callback@2.1.0", "", {}, "sha512-qoRRSyROncaz1z0mvYqIE4lCd9p2R90i6GxW3uZv5ucSu8tU7B5HXUP1gG8pVZsYNVaXjk8ClXHPttLyxAL48A=="],
+
+    "starlight-blog": ["starlight-blog@0.24.0", "", { "dependencies": { "@astrojs/markdown-remark": "^6.3.1", "@astrojs/mdx": "^4.0.8", "@astrojs/rss": "^4.0.11", "astro-remote": "^0.3.3", "github-slugger": "^2.0.0", "marked": "^15.0.4", "marked-plaintify": "^1.1.1", "mdast-util-mdx-expression": "^2.0.1", "ultrahtml": "^1.6.0", "unist-util-visit": "^5.0.0" }, "peerDependencies": { "@astrojs/starlight": ">=0.33.0" } }, "sha512-judPLTD+hyeKyiX//0x6adcOs4QR3EqmNxzFJNP+2sauUDA/ux1CS+wNzwMkHAadxdCir13rj9YsA3l8X0h9fQ=="],
+
+    "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="],
+
+    "std-env": ["std-env@4.1.0", "", {}, "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ=="],
+
+    "stream-replace-string": ["stream-replace-string@2.0.0", "", {}, "sha512-TlnjJ1C0QrmxRNrON00JvaFFlNh5TTG00APw23j74ET7gkQpTASi6/L2fuiav8pzK715HXtUeClpBTw2NPSn6w=="],
+
+    "streamx": ["streamx@2.26.0", "", { "dependencies": { "events-universal": "^1.0.0", "fast-fifo": "^1.3.2", "text-decoder": "^1.1.0" } }, "sha512-VvNG1K72Po/xwJzxZFnZ++Tbrv4lwSptsbkFuzXCJAYZvCK5nnxsvXU6ajqkv7chyiI1Y0YXq2Jh8Iy8Y7NF/A=="],
+
+    "string-argv": ["string-argv@0.3.2", "", {}, "sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q=="],
+
+    "string-width": ["string-width@8.2.1", "", { "dependencies": { "get-east-asian-width": "^1.5.0", "strip-ansi": "^7.1.2" } }, "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA=="],
+
+    "string-width-cjs": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "string.prototype.codepointat": ["string.prototype.codepointat@0.2.1", "", {}, "sha512-2cBVCj6I4IOvEnjgO/hWqXjqBGsY+zwPmHl12Srk9IXSZ56Jwwmy+66XO5Iut/oQVR7t5ihYdLB0GMa4alEUcg=="],
+
+    "string_decoder": ["string_decoder@1.1.1", "", { "dependencies": { "safe-buffer": "~5.1.0" } }, "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg=="],
+
+    "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
+
+    "strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],
+
+    "strip-ansi-cjs": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "strip-bom": ["strip-bom@3.0.0", "", {}, "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA=="],
+
+    "strip-final-newline": ["strip-final-newline@4.0.0", "", {}, "sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw=="],
+
+    "strip-literal": ["strip-literal@3.1.0", "", { "dependencies": { "js-tokens": "^9.0.1" } }, "sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg=="],
+
+    "strnum": ["strnum@2.3.0", "", {}, "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q=="],
+
+    "style-to-js": ["style-to-js@1.1.21", "", { "dependencies": { "style-to-object": "1.0.14" } }, "sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ=="],
+
+    "style-to-object": ["style-to-object@1.0.14", "", { "dependencies": { "inline-style-parser": "0.2.7" } }, "sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw=="],
+
+    "stylis": ["stylis@4.4.0", "", {}, "sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA=="],
+
+    "supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
+
+    "supports-preserve-symlinks-flag": ["supports-preserve-symlinks-flag@1.0.0", "", {}, "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w=="],
+
+    "svgo": ["svgo@4.0.1", "", { "dependencies": { "commander": "^11.1.0", "css-select": "^5.1.0", "css-tree": "^3.0.1", "css-what": "^6.1.0", "csso": "^5.0.5", "picocolors": "^1.1.1", "sax": "^1.5.0" }, "bin": "./bin/svgo.js" }, "sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w=="],
+
+    "tagged-tag": ["tagged-tag@1.0.0", "", {}, "sha512-yEFYrVhod+hdNyx7g5Bnkkb0G6si8HJurOoOEgC8B/O0uXLHlaey/65KRv6cuWBNhBgHKAROVpc7QyYqE5gFng=="],
+
+    "tailwindcss": ["tailwindcss@4.3.0", "", {}, "sha512-y6nxMGB1nMW9R6k96e5gdIFzcfL/gTJRNaqGes1YvkLnPVXzWgbqFF2yLC0T8G774n24cx3Pe8XrKoniCOAH+Q=="],
+
+    "tapable": ["tapable@2.3.3", "", {}, "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A=="],
+
+    "tar": ["tar@6.2.1", "", { "dependencies": { "chownr": "^2.0.0", "fs-minipass": "^2.0.0", "minipass": "^5.0.0", "minizlib": "^2.1.1", "mkdirp": "^1.0.3", "yallist": "^4.0.0" } }, "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A=="],
+
+    "tar-fs": ["tar-fs@3.1.2", "", { "dependencies": { "pump": "^3.0.0", "tar-stream": "^3.1.5" }, "optionalDependencies": { "bare-fs": "^4.0.1", "bare-path": "^3.0.0" } }, "sha512-QGxxTxxyleAdyM3kpFs14ymbYmNFrfY+pHj7Z8FgtbZ7w2//VAgLMac7sT6nRpIHjppXO2AwwEOg0bPFVRcmXw=="],
+
+    "tar-stream": ["tar-stream@3.2.0", "", { "dependencies": { "b4a": "^1.6.4", "bare-fs": "^4.5.5", "fast-fifo": "^1.2.0", "streamx": "^2.15.0" } }, "sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg=="],
+
+    "teex": ["teex@1.0.1", "", { "dependencies": { "streamx": "^2.12.5" } }, "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg=="],
+
+    "terminal-size": ["terminal-size@4.0.1", "", {}, "sha512-avMLDQpUI9I5XFrklECw1ZEUPJhqzcwSWsyyI8blhRLT+8N1jLJWLWWYQpB2q2xthq8xDvjZPISVh53T/+CLYQ=="],
+
+    "terracotta": ["terracotta@1.1.0", "", { "dependencies": { "solid-use": "^0.9.1" }, "peerDependencies": { "solid-js": "^1.8" } }, "sha512-kfQciWUBUBgYkXu7gh3CK3FAJng/iqZslAaY08C+k1Hdx17aVEpcFFb/WPaysxAfcupNH3y53s/pc53xxZauww=="],
+
+    "terser": ["terser@5.48.0", "", { "dependencies": { "@jridgewell/source-map": "^0.3.3", "acorn": "^8.15.0", "commander": "^2.20.0", "source-map-support": "~0.5.20" }, "bin": { "terser": "bin/terser" } }, "sha512-J/9An6vs9Us6wKRriSFXBWdRZapREHqFzdNUKk0pmu804EMR6dr6winwo7e5JDxN4xahxQsuysyYFwlwj4XN/Q=="],
+
+    "text-decoder": ["text-decoder@1.2.7", "", { "dependencies": { "b4a": "^1.6.4" } }, "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ=="],
+
+    "through": ["through@2.3.8", "", {}, "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg=="],
+
+    "through2": ["through2@4.0.2", "", { "dependencies": { "readable-stream": "3" } }, "sha512-iOqSav00cVxEEICeD7TjLB1sueEL+81Wpzp2bY17uZjZN0pWZPuo4suZ/61VujxmqSGFfgOcNuTZ85QJwNZQpw=="],
+
+    "tiny-inflate": ["tiny-inflate@1.0.3", "", {}, "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw=="],
+
+    "tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
+
+    "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="],
+
+    "tinyclip": ["tinyclip@0.1.13", "", {}, "sha512-8OqlXQ35euK9+e7L68u8UwcODxkHoIkjbGsgXuARKNyQ5G6xt8nw1YPeMbxMLgCPFkToU+UEK5j05t2t8edKpQ=="],
+
+    "tinyexec": ["tinyexec@1.2.3", "", {}, "sha512-g62dB+w1/OEFnPvmX0yd/HnetYITOL+1nJW7kitOycOeAvmbWC/nu0fwmmQ/kupNojqExzyC/T++pST/jRJ2mQ=="],
+
+    "tinyglobby": ["tinyglobby@0.2.16", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg=="],
+
+    "tinypool": ["tinypool@2.1.0", "", {}, "sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw=="],
+
+    "tinyrainbow": ["tinyrainbow@3.1.0", "", {}, "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw=="],
+
+    "to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
+
+    "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="],
+
+    "toml": ["toml@4.1.1", "", {}, "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw=="],
+
+    "totalist": ["totalist@3.0.1", "", {}, "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ=="],
+
+    "tr46": ["tr46@0.0.3", "", {}, "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw=="],
+
+    "tree-kill": ["tree-kill@1.2.2", "", { "bin": { "tree-kill": "cli.js" } }, "sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A=="],
+
+    "treeify": ["treeify@1.1.0", "", {}, "sha512-1m4RA7xVAJrSGrrXGs0L3YTwyvBs2S8PbRHaLZAkFw7JR8oIFwYtysxlBZhYIa7xSyiYJKZ3iGrrk55cGA3i9A=="],
+
+    "trim-lines": ["trim-lines@3.0.1", "", {}, "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg=="],
+
+    "trough": ["trough@2.2.0", "", {}, "sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw=="],
+
+    "ts-api-utils": ["ts-api-utils@2.5.0", "", { "peerDependencies": { "typescript": ">=4.8.4" } }, "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA=="],
+
+    "ts-dedent": ["ts-dedent@2.2.0", "", {}, "sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ=="],
+
+    "ts-morph": ["ts-morph@27.0.2", "", { "dependencies": { "@ts-morph/common": "~0.28.1", "code-block-writer": "^13.0.3" } }, "sha512-fhUhgeljcrdZ+9DZND1De1029PrE+cMkIP7ooqkLRTrRLTqcki2AstsyJm0vRNbTbVCNJ0idGlbBrfqc7/nA8w=="],
+
+    "tsconfck": ["tsconfck@3.1.6", "", { "peerDependencies": { "typescript": "^5.0.0" }, "optionalPeers": ["typescript"], "bin": { "tsconfck": "bin/tsconfck.js" } }, "sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w=="],
+
+    "tsconfig-paths": ["tsconfig-paths@4.2.0", "", { "dependencies": { "json5": "^2.2.2", "minimist": "^1.2.6", "strip-bom": "^3.0.0" } }, "sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg=="],
+
+    "tsdown": ["tsdown@0.15.12", "", { "dependencies": { "ansis": "^4.2.0", "cac": "^6.7.14", "chokidar": "^4.0.3", "debug": "^4.4.3", "diff": "^8.0.2", "empathic": "^2.0.0", "hookable": "^5.5.3", "rolldown": "1.0.0-beta.45", "rolldown-plugin-dts": "^0.17.2", "semver": "^7.7.3", "tinyexec": "^1.0.1", "tinyglobby": "^0.2.15", "tree-kill": "^1.2.2", "unconfig": "^7.3.3" }, "peerDependencies": { "@arethetypeswrong/core": "^0.18.1", "publint": "^0.3.0", "typescript": "^5.0.0", "unplugin-lightningcss": "^0.4.0", "unplugin-unused": "^0.5.0", "unrun": "^0.2.1" }, "optionalPeers": ["@arethetypeswrong/core", "publint", "typescript", "unplugin-lightningcss", "unplugin-unused", "unrun"], "bin": { "tsdown": "dist/run.mjs" } }, "sha512-c8VLlQm8/lFrOAg5VMVeN4NAbejZyVQkzd+ErjuaQgJFI/9MhR9ivr0H/CM7UlOF1+ELlF6YaI7sU/4itgGQ8w=="],
+
+    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "tsx": ["tsx@4.22.3", "", { "dependencies": { "esbuild": "~0.28.0" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "bin": { "tsx": "dist/cli.mjs" } }, "sha512-mdoNxBC/cSQObGGVQ5Bpn5i+yv7j68gk3Nfm3wFjcJg3Z0Mix9jzAFfP12prmm5eVGmDKtp0yyArrs0Q+8gZHg=="],
+
+    "tunnel": ["tunnel@0.0.6", "", {}, "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="],
+
+    "twoslash-eslint": ["twoslash-eslint@0.3.8", "", { "dependencies": { "twoslash-protocol": "0.3.8" }, "peerDependencies": { "eslint": ">=8.50.0" } }, "sha512-4rW6i4ALza33+95G3IOG1l2FgBb84+SYzmX/GCe2suMTvZ2P4kJUTGIlr7tIqgPU90FRzDs3iL2i6X/Chuosug=="],
+
+    "twoslash-protocol": ["twoslash-protocol@0.3.8", "", {}, "sha512-HmvAHoiEviK8LqvAQyc9/irkdvwTUiR1fHmNwH/0gq8EHxyBt4PWVPixjEXg6wJu1u6yBrILEWXGK9Kw58/8yQ=="],
+
+    "type-check": ["type-check@0.4.0", "", { "dependencies": { "prelude-ls": "^1.2.1" } }, "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew=="],
+
+    "type-detect": ["type-detect@4.1.0", "", {}, "sha512-Acylog8/luQ8L7il+geoSxhEkazvkslg7PSNKOX59mbB9cOveP5aq9h74Y7YU8yDpJwetzQQrfIwtf4Wp4LKcw=="],
+
+    "type-fest": ["type-fest@5.6.0", "", { "dependencies": { "tagged-tag": "^1.0.0" } }, "sha512-8ZiHFm91orbSAe2PSAiSVBVko18pbhbiB3U9GglSzF/zCGkR+rxpHx6sEMCUm4kxY4LjDIUGgCfUMtwfZfjfUA=="],
+
+    "typesafe-path": ["typesafe-path@0.2.2", "", {}, "sha512-OJabfkAg1WLZSqJAJ0Z6Sdt3utnbzr/jh+NAHoyWHJe8CMSy79Gm085094M9nvTPy22KzTVn5Zq5mbapCI/hPA=="],
+
+    "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="],
+
+    "typescript-auto-import-cache": ["typescript-auto-import-cache@0.3.6", "", { "dependencies": { "semver": "^7.3.8" } }, "sha512-RpuHXrknHdVdK7wv/8ug3Fr0WNsNi5l5aB8MYYuXhq2UH5lnEB1htJ1smhtD5VeCsGr2p8mUDtd83LCQDFVgjQ=="],
+
+    "ufo": ["ufo@1.6.4", "", {}, "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA=="],
+
+    "ultrahtml": ["ultrahtml@1.6.0", "", {}, "sha512-R9fBn90VTJrqqLDwyMph+HGne8eqY1iPfYhPzZrvKpIfwkWZbcYlfpsb8B9dTvBfpy1/hqAD7Wi8EKfP9e8zdw=="],
+
+    "unbzip2-stream": ["unbzip2-stream@1.4.3", "", { "dependencies": { "buffer": "^5.2.1", "through": "^2.3.8" } }, "sha512-mlExGW4w71ebDJviH16lQLtZS32VKqsSfk80GCfUlwT/4/hNRFsoscrF/c++9xinkMzECL1uL9DDwXqFWkruPg=="],
+
+    "unconfig": ["unconfig@7.5.0", "", { "dependencies": { "@quansync/fs": "^1.0.0", "defu": "^6.1.4", "jiti": "^2.6.1", "quansync": "^1.0.0", "unconfig-core": "7.5.0" } }, "sha512-oi8Qy2JV4D3UQ0PsopR28CzdQ3S/5A1zwsUwp/rosSbfhJ5z7b90bIyTwi/F7hCLD4SGcZVjDzd4XoUQcEanvA=="],
+
+    "unconfig-core": ["unconfig-core@7.5.0", "", { "dependencies": { "@quansync/fs": "^1.0.0", "quansync": "^1.0.0" } }, "sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w=="],
+
+    "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
+
+    "unctx": ["unctx@2.5.0", "", { "dependencies": { "acorn": "^8.15.0", "estree-walker": "^3.0.3", "magic-string": "^0.30.21", "unplugin": "^2.3.11" } }, "sha512-p+Rz9x0R7X+CYDkT+Xg8/GhpcShTlU8n+cf9OtOEf7zEQsNcCZO1dPKNRDqvUTaq+P32PMMkxWHwfrxkqfqAYg=="],
+
+    "undici": ["undici@7.26.0", "", {}, "sha512-3O9Tf67pGhgOv9jM35AbhkXAKi13f3oy3aE4CSgr+TckGeY+/iu97ZXN+J7DpHPzLbVApFd1IFhcnBjREYXYcg=="],
+
+    "undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="],
+
+    "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="],
+
+    "unicode-trie": ["unicode-trie@2.0.0", "", { "dependencies": { "pako": "^0.2.5", "tiny-inflate": "^1.0.0" } }, "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ=="],
+
+    "unicorn-magic": ["unicorn-magic@0.3.0", "", {}, "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA=="],
+
+    "unified": ["unified@11.0.5", "", { "dependencies": { "@types/unist": "^3.0.0", "bail": "^2.0.0", "devlop": "^1.0.0", "extend": "^3.0.0", "is-plain-obj": "^4.0.0", "trough": "^2.0.0", "vfile": "^6.0.0" } }, "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA=="],
+
+    "unifont": ["unifont@0.7.4", "", { "dependencies": { "css-tree": "^3.1.0", "ofetch": "^1.5.1", "ohash": "^2.0.11" } }, "sha512-oHeis4/xl42HUIeHuNZRGEvxj5AaIKR+bHPNegRq5LV1gdc3jundpONbjglKpihmJf+dswygdMJn3eftGIMemg=="],
+
+    "unimport": ["unimport@6.3.0", "", { "dependencies": { "acorn": "^8.16.0", "escape-string-regexp": "^5.0.0", "estree-walker": "^3.0.3", "local-pkg": "^1.1.2", "magic-string": "^0.30.21", "mlly": "^1.8.2", "pathe": "^2.0.3", "picomatch": "^4.0.4", "pkg-types": "^2.3.1", "scule": "^1.3.0", "strip-literal": "^3.1.0", "tinyglobby": "^0.2.16", "unplugin": "^3.0.0", "unplugin-utils": "^0.3.1" }, "peerDependencies": { "oxc-parser": "*", "rolldown": "^1.0.0" }, "optionalPeers": ["oxc-parser", "rolldown"] }, "sha512-M+Dxk5W9WRd+8j56W9tp8lGW/dmMc7g5zj7BWQnEjKQhryBstqsi1V0izb0zHwSkEN8cSYV7K75/bykairV2tA=="],
+
+    "unist-util-find-after": ["unist-util-find-after@5.0.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-amQa0Ep2m6hE2g72AugUItjbuM8X8cGQnFoHk0pGfrFeT9GZhzN5SW8nRsiGKK7Aif4CrACPENkA6P/Lw6fHGQ=="],
+
+    "unist-util-is": ["unist-util-is@6.0.1", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g=="],
+
+    "unist-util-modify-children": ["unist-util-modify-children@4.0.0", "", { "dependencies": { "@types/unist": "^3.0.0", "array-iterate": "^2.0.0" } }, "sha512-+tdN5fGNddvsQdIzUF3Xx82CU9sMM+fA0dLgR9vOmT0oPT2jH+P1nd5lSqfCfXAw+93NhcXNY2qqvTUtE4cQkw=="],
+
+    "unist-util-position": ["unist-util-position@5.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA=="],
+
+    "unist-util-position-from-estree": ["unist-util-position-from-estree@2.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-KaFVRjoqLyF6YXCbVLNad/eS4+OfPQQn2yOd7zF/h5T/CSL2v8NpN6a5TPvtbXthAGw5nG+PuTtq+DdIZr+cRQ=="],
+
+    "unist-util-remove-position": ["unist-util-remove-position@5.0.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-visit": "^5.0.0" } }, "sha512-Hp5Kh3wLxv0PHj9m2yZhhLt58KzPtEYKQQ4yxfYFEO7EvHwzyDYnduhHnY1mDxoqr7VUwVuHXk9RXKIiYS1N8Q=="],
+
+    "unist-util-stringify-position": ["unist-util-stringify-position@4.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ=="],
+
+    "unist-util-visit": ["unist-util-visit@5.1.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg=="],
+
+    "unist-util-visit-children": ["unist-util-visit-children@3.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-RgmdTfSBOg04sdPcpTSD1jzoNBjt9a80/ZCzp5cI9n1qPzLZWF9YdvWGN2zmTumP1HWhXKdUWexjy/Wy/lJ7tA=="],
+
+    "unist-util-visit-parents": ["unist-util-visit-parents@6.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ=="],
+
+    "universal-user-agent": ["universal-user-agent@7.0.3", "", {}, "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A=="],
+
+    "unplugin": ["unplugin@3.0.0", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-0Mqk3AT2TZCXWKdcoaufeXNukv2mTrEZExeXlHIOZXdqYoHHr4n51pymnwV8x2BOVxwXbK2HLlI7usrqMpycdg=="],
+
+    "unplugin-utils": ["unplugin-utils@0.3.1", "", { "dependencies": { "pathe": "^2.0.3", "picomatch": "^4.0.3" } }, "sha512-5lWVjgi6vuHhJ526bI4nlCOmkCIF3nnfXkCMDeMJrtdvxTs6ZFCM8oNufGTsDbKv/tJ/xj8RpvXjRuPBZJuJog=="],
+
+    "unstorage": ["unstorage@1.17.5", "", { "dependencies": { "anymatch": "^3.1.3", "chokidar": "^5.0.0", "destr": "^2.0.5", "h3": "^1.15.10", "lru-cache": "^11.2.7", "node-fetch-native": "^1.6.7", "ofetch": "^1.5.1", "ufo": "^1.6.3" }, "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1 || ^2 || ^3", "aws4fetch": "^1.0.20", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "db0", "idb-keyval", "ioredis", "uploadthing"] }, "sha512-0i3iqvRfx29hkNntHyQvJTpf5W9dQ9ZadSoRU8+xVlhVtT7jAX57fazYO9EHvcRCfBCyi5YRya7XCDOsbTgkPg=="],
+
+    "untun": ["untun@0.1.3", "", { "dependencies": { "citty": "^0.1.5", "consola": "^3.2.3", "pathe": "^1.1.1" }, "bin": { "untun": "bin/untun.mjs" } }, "sha512-4luGP9LMYszMRZwsvyUd9MrxgEGZdZuZgpVQHEEX0lCYFESasVRvZd0EYpCkOIbJKHMuv0LskpXc/8Un+MJzEQ=="],
+
+    "untyped": ["untyped@2.0.0", "", { "dependencies": { "citty": "^0.1.6", "defu": "^6.1.4", "jiti": "^2.4.2", "knitwork": "^1.2.0", "scule": "^1.3.0" }, "bin": { "untyped": "dist/cli.mjs" } }, "sha512-nwNCjxJTjNuLCgFr42fEak5OcLuB3ecca+9ksPFNvtfYSLpjf+iJqSIaSnIile6ZPbKYxI5k2AfXqeopGudK/g=="],
+
+    "unwasm": ["unwasm@0.5.3", "", { "dependencies": { "exsolve": "^1.0.8", "knitwork": "^1.3.0", "magic-string": "^0.30.21", "mlly": "^1.8.0", "pathe": "^2.0.3", "pkg-types": "^2.3.0" } }, "sha512-keBgTSfp3r6+s9ZcSma+0chwxQdmLbB5+dAD9vjtB21UTMYuKAxHXCU1K2CbCtnP09EaWeRvACnXk0EJtUx+hw=="],
+
+    "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
+
+    "uqr": ["uqr@0.1.3", "", {}, "sha512-0rjE8iEJe4YmT9TOhwsZtqCMRLc5DXZUI2UEYUUg63ikBkqqE5EYWaI0etFe/5KUcmcYwLih2RND1kq+hrUJXA=="],
+
+    "uri-js": ["uri-js@4.4.1", "", { "dependencies": { "punycode": "^2.1.0" } }, "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg=="],
+
+    "url-join": ["url-join@5.0.0", "", {}, "sha512-n2huDr9h9yzd6exQVnH/jU5mr+Pfx08LRXXZhkLLetAMESRj+anQsTAh940iMrIetKAmry9coFuZQ2jY8/p3WA=="],
+
+    "use-sync-external-store": ["use-sync-external-store@1.6.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w=="],
+
+    "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
+
+    "uuid": ["uuid@14.0.0", "", { "bin": { "uuid": "dist-node/bin/uuid" } }, "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg=="],
+
+    "validate-npm-package-name": ["validate-npm-package-name@5.0.1", "", {}, "sha512-OljLrQ9SQdOUqTaQxqL5dEfZWrXExyyWsozYlAWFawPVNuD83igl7uJD2RTkNMbniIYgt8l81eCJGIdQF7avLQ=="],
+
+    "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
+
+    "vfile-location": ["vfile-location@5.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile": "^6.0.0" } }, "sha512-5yXvWDEgqeiYiBe1lbxYF7UMAIm/IcopxMHrMQDq3nvKcjPKIhZklUKL+AE7J7uApI4kwe2snsK+eI6UTj9EHg=="],
+
+    "vfile-message": ["vfile-message@4.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw=="],
+
+    "vite": ["vite@8.0.14", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.15", "rolldown": "1.0.2", "tinyglobby": "^0.2.16" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.18", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-s4BJJ+5y1pYL6Otw51FHhVJQhPnuRinKig64g/1+EUNaJsd3gCKdD31IPFvswUgW9/60QT9oFHbZHbQK5imcxw=="],
+
+    "vite-dev-rpc": ["vite-dev-rpc@2.0.0", "", { "dependencies": { "birpc": "^4.0.0", "vite-hot-client": "^2.2.0" }, "peerDependencies": { "vite": "^2.9.0 || ^3.0.0-0 || ^4.0.0-0 || ^5.0.0-0 || ^6.0.1 || ^7.0.0-0 || ^8.0.0" } }, "sha512-yKwbTwdHKSD2k/aGqyWpPHepo45OQc8lH3/6IfT4ZqeKE26ooKvi4WIEKzqWav8v+9Is8u1k8q54hvOmqASazA=="],
+
+    "vite-hot-client": ["vite-hot-client@2.2.0", "", { "peerDependencies": { "vite": "^2.6.0 || ^3.0.0 || ^4.0.0 || ^5.0.0-0 || ^6.0.0-0 || ^7.0.0-0 || ^8.0.0" } }, "sha512-76Zs9zrHbH7M7wqeyooGQKdX+yg0pQ0xuQ1PbFp4z5a0Lzn2e5IPFoCswnmqZ4GiwqB4Jo3WcDAMO9jARTJl8w=="],
+
+    "vite-plugin-inspect": ["vite-plugin-inspect@11.4.1", "", { "dependencies": { "ansis": "^4.3.0", "error-stack-parser-es": "^1.0.5", "obug": "^2.1.1", "ohash": "^2.0.11", "open": "^11.0.0", "perfect-debounce": "^2.1.0", "sirv": "^3.0.2", "unplugin-utils": "^0.3.1", "vite-dev-rpc": "^2.0.0" }, "peerDependencies": { "vite": "^6.0.0 || ^7.0.0-0 || ^8.0.0-0" } }, "sha512-ShOFe2PURXGvRS5OrgmOLZOCwDTD7dEBVt0tMpFPKb9AsvqXKCRGM8QgKrUbRbJYFXScHvDPpGRd28rYidC0tA=="],
+
+    "vite-plugin-solid": ["vite-plugin-solid@2.11.12", "", { "dependencies": { "@babel/core": "^7.23.3", "@types/babel__core": "^7.20.4", "babel-preset-solid": "^1.8.4", "merge-anything": "^5.1.7", "solid-refresh": "^0.6.3", "vitefu": "^1.0.4" }, "peerDependencies": { "@testing-library/jest-dom": "^5.16.6 || ^5.17.0 || ^6.*", "solid-js": "^1.7.2", "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["@testing-library/jest-dom"] }, "sha512-FgjPcx2OwX9h6f28jli7A4bG7PP3te8uyakE5iqsmpq3Jqi1TWLgSroC9N6cMfGRU2zXsl4Q6ISvTr2VL0QHpA=="],
+
+    "vite-plugin-vue-devtools": ["vite-plugin-vue-devtools@8.1.2", "", { "dependencies": { "@vue/devtools-core": "^8.1.2", "@vue/devtools-kit": "^8.1.2", "@vue/devtools-shared": "^8.1.2", "sirv": "^3.0.2", "vite-plugin-inspect": "^11.3.3", "vite-plugin-vue-inspector": "^6.0.0" }, "peerDependencies": { "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-gt5h1CNryR9Hy0tvhSbqY3j0F7aj0pGxBxWLa1lXSiZVkhdWDf0vbCOZyjh8ivFGE6FDHTGy3zkcZGlMZdVHig=="],
+
+    "vite-plugin-vue-inspector": ["vite-plugin-vue-inspector@6.0.0", "", { "dependencies": { "@babel/core": "^7.23.0", "@babel/plugin-proposal-decorators": "^7.23.0", "@babel/plugin-syntax-import-attributes": "^7.22.5", "@babel/plugin-syntax-import-meta": "^7.10.4", "@babel/plugin-transform-typescript": "^7.22.15", "@vue/babel-plugin-jsx": "^1.1.5", "@vue/compiler-dom": "^3.3.4", "kolorist": "^1.8.0", "magic-string": "^0.30.4" }, "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-OpyITJLgZNibxlrik1EmRtvXHDjLRxNPsWkGFTERZs2LgMEdG4W0WoFt5GIgp3a3jRou+eJR8U1zOBk/XQgEbw=="],
+
+    "vite-tsconfig-paths": ["vite-tsconfig-paths@6.1.1", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" } }, "sha512-2cihq7zliibCCZ8P9cKJrQBkfgdvcFkOOc3Y02o3GWUDLgqjWsZudaoiuOwO/gzTzy17cS5F7ZPo4bsnS4DGkg=="],
+
+    "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="],
+
+    "vitest": ["vitest@4.1.7", "", { "dependencies": { "@vitest/expect": "4.1.7", "@vitest/mocker": "4.1.7", "@vitest/pretty-format": "4.1.7", "@vitest/runner": "4.1.7", "@vitest/snapshot": "4.1.7", "@vitest/spy": "4.1.7", "@vitest/utils": "4.1.7", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.7", "@vitest/browser-preview": "4.1.7", "@vitest/browser-webdriverio": "4.1.7", "@vitest/coverage-istanbul": "4.1.7", "@vitest/coverage-v8": "4.1.7", "@vitest/ui": "4.1.7", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-flYyaFd2CgoCoU+0UKt3pxksgC+S02iTDN0n3LtqaMeXsI9SBcdNujc2k0DeFLzUn/0k538yNjOSdwgCqcrwJA=="],
+
+    "volar-service-css": ["volar-service-css@0.0.70", "", { "dependencies": { "vscode-css-languageservice": "^6.3.0", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-K1qyOvBpE3rzdAv3e4/6Rv5yizrYPy5R/ne3IWCAzLBuMO4qBMV3kSqWzj6KUVe6S0AnN6wxF7cRkiaKfYMYJw=="],
+
+    "volar-service-emmet": ["volar-service-emmet@0.0.70", "", { "dependencies": { "@emmetio/css-parser": "^0.4.1", "@emmetio/html-matcher": "^1.3.0", "@vscode/emmet-helper": "^2.9.3", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-xi5bC4m/VyE3zy/n2CXspKeDZs3qA41tHLTw275/7dNWM/RqE2z3BnDICQybHIVp/6G1iOQj5c1qXMgQC08TNg=="],
+
+    "volar-service-html": ["volar-service-html@0.0.70", "", { "dependencies": { "vscode-html-languageservice": "^5.3.0", "vscode-languageserver-textdocument": "^1.0.11", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-eR6vCgMdmYAo4n+gcT7DSyBQbwB8S3HZZvSagTf0sxNaD4WppMCFfpqWnkrlGStPKMZvMiejRRVmqsX9dYcTvQ=="],
+
+    "volar-service-prettier": ["volar-service-prettier@0.0.70", "", { "dependencies": { "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0", "prettier": "^2.2 || ^3.0" }, "optionalPeers": ["@volar/language-service", "prettier"] }, "sha512-Z6BCFSpGVCd8BPAsZ785Kce1BGlWd5ODqmqZGVuB14MJvrR4+CYz6cDy4F+igmE1gMifqfvMhdgT8Aud4M5ngg=="],
+
+    "volar-service-typescript": ["volar-service-typescript@0.0.70", "", { "dependencies": { "path-browserify": "^1.0.1", "semver": "^7.6.2", "typescript-auto-import-cache": "^0.3.5", "vscode-languageserver-textdocument": "^1.0.11", "vscode-nls": "^5.2.0", "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-l46Bx4cokkUedTd74ojO5H/zqHZJ8SUuyZ0IB8JN4jfRqUM3bQFBHoOwlZCyZmOeO0A3RQNkMnFclxO4c++gsg=="],
+
+    "volar-service-typescript-twoslash-queries": ["volar-service-typescript-twoslash-queries@0.0.70", "", { "dependencies": { "vscode-uri": "^3.0.8" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-IdD13Z9N2Bu8EM6CM0fDV1E69olEYGHDU25X51YXmq8Y0CmJ2LNj6gOiBJgpS5JGUqFzECVhMNBW7R0sPdRTMQ=="],
+
+    "volar-service-yaml": ["volar-service-yaml@0.0.70", "", { "dependencies": { "vscode-uri": "^3.0.8", "yaml-language-server": "~1.20.0" }, "peerDependencies": { "@volar/language-service": "~2.4.0" }, "optionalPeers": ["@volar/language-service"] }, "sha512-0c8bXDBeoATF9F6iPIlOuYTuZAC4c+yi0siQo920u7eiBJk8oQmUmg9cDUbR4+Gl++bvGP4plj3fErbJuPqdcQ=="],
+
+    "vscode-css-languageservice": ["vscode-css-languageservice@6.3.10", "", { "dependencies": { "@vscode/l10n": "^0.0.18", "vscode-languageserver-textdocument": "^1.0.12", "vscode-languageserver-types": "3.17.5", "vscode-uri": "^3.1.0" } }, "sha512-eq5N9Er3fC4vA9zd9EFhyBG90wtCCuXgRSpAndaOgXMh1Wgep5lBgRIeDgjZBW9pa+332yC9+49cZMW8jcL3MA=="],
+
+    "vscode-html-languageservice": ["vscode-html-languageservice@5.6.2", "", { "dependencies": { "@vscode/l10n": "^0.0.18", "vscode-languageserver-textdocument": "^1.0.12", "vscode-languageserver-types": "^3.17.5", "vscode-uri": "^3.1.0" } }, "sha512-ulCrSnFnfQ16YzvwnYUgEbUEl/ZG7u2eV27YhvLObSHKkb8fw1Z9cgsnUwjTEeDIdJDoTDTDpxuhQwoenoLNMg=="],
+
+    "vscode-json-languageservice": ["vscode-json-languageservice@4.1.8", "", { "dependencies": { "jsonc-parser": "^3.0.0", "vscode-languageserver-textdocument": "^1.0.1", "vscode-languageserver-types": "^3.16.0", "vscode-nls": "^5.0.0", "vscode-uri": "^3.0.2" } }, "sha512-0vSpg6Xd9hfV+eZAaYN63xVVMOTmJ4GgHxXnkLCh+9RsQBkWKIghzLhW2B9ebfG+LQQg8uLtsQ2aUKjTgE+QOg=="],
+
+    "vscode-jsonrpc": ["vscode-jsonrpc@8.2.0", "", {}, "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA=="],
+
+    "vscode-languageserver": ["vscode-languageserver@9.0.1", "", { "dependencies": { "vscode-languageserver-protocol": "3.17.5" }, "bin": { "installServerIntoExtension": "bin/installServerIntoExtension" } }, "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g=="],
+
+    "vscode-languageserver-protocol": ["vscode-languageserver-protocol@3.17.5", "", { "dependencies": { "vscode-jsonrpc": "8.2.0", "vscode-languageserver-types": "3.17.5" } }, "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg=="],
+
+    "vscode-languageserver-textdocument": ["vscode-languageserver-textdocument@1.0.12", "", {}, "sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA=="],
+
+    "vscode-languageserver-types": ["vscode-languageserver-types@3.17.5", "", {}, "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg=="],
+
+    "vscode-nls": ["vscode-nls@5.2.0", "", {}, "sha512-RAaHx7B14ZU04EU31pT+rKz2/zSl7xMsfIZuo8pd+KZO6PXtQmpevpq3vxvWNcrGbdmhM/rr5Uw5Mz+NBfhVng=="],
+
+    "vscode-uri": ["vscode-uri@3.1.0", "", {}, "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ=="],
+
+    "vue": ["vue@3.6.0-beta.13", "", { "dependencies": { "@vue/compiler-dom": "3.6.0-beta.13", "@vue/compiler-sfc": "3.6.0-beta.13", "@vue/runtime-dom": "3.6.0-beta.13", "@vue/runtime-vapor": "3.6.0-beta.13", "@vue/server-renderer": "3.6.0-beta.13", "@vue/shared": "3.6.0-beta.13" }, "peerDependencies": { "typescript": "*" }, "optionalPeers": ["typescript"] }, "sha512-FVbMX/iDFIy29e0ImuIteca1IybMgecfHjKKD22p4eVPh1vaSlF/IbtwjKHDzGkhdoN1xPf5Swad4jNBnx6d3w=="],
+
+    "vue-router": ["vue-router@5.1.0", "", { "dependencies": { "@babel/generator": "^8.0.0-rc.4", "@vue-macros/common": "^3.1.1", "@vue/devtools-api": "^8.1.2", "ast-walker-scope": "^0.9.0", "chokidar": "^5.0.0", "json5": "^2.2.3", "local-pkg": "^1.1.2", "magic-string": "^0.30.21", "mlly": "^1.8.2", "muggle-string": "^0.4.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "scule": "^1.3.0", "tinyglobby": "^0.2.16", "unplugin": "^3.0.0", "unplugin-utils": "^0.3.1", "yaml": "^2.9.0" }, "peerDependencies": { "@pinia/colada": ">=0.21.2", "@vue/compiler-sfc": "^3.5.34", "pinia": "^3.0.4", "vite": "^7.0.0 || ^8.0.0", "vue": "^3.5.34" }, "optionalPeers": ["@pinia/colada", "@vue/compiler-sfc", "pinia", "vite"] }, "sha512-HAbiLzLEHQwxPgvsbOJDAwtavszEgLwri6XfyrsPECIFez8+59xc9LofWVdc/HEaSRT822lJ8H9Ns38VVond5g=="],
+
+    "vue-tsc": ["vue-tsc@3.3.2", "", { "dependencies": { "@volar/typescript": "2.4.28", "@vue/language-core": "3.3.2" }, "peerDependencies": { "typescript": ">=5.0.0" }, "bin": { "vue-tsc": "bin/vue-tsc.js" } }, "sha512-n7nQoA3YWW/eiDR8jMiv/uJvlg0uLGs+YgUrsTrf9EZaYSt3tuvMZb5V8+7Mvh/EH5pnY/hoVdgfjH+XcK+wwA=="],
+
+    "web-namespaces": ["web-namespaces@2.0.1", "", {}, "sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ=="],
+
+    "webidl-conversions": ["webidl-conversions@3.0.1", "", {}, "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ=="],
+
+    "webpack-virtual-modules": ["webpack-virtual-modules@0.6.2", "", {}, "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ=="],
+
+    "website": ["website@workspace:website"],
+
+    "whatwg-url": ["whatwg-url@5.0.0", "", { "dependencies": { "tr46": "~0.0.3", "webidl-conversions": "^3.0.0" } }, "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw=="],
+
+    "which": ["which@5.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ=="],
+
+    "which-pm-runs": ["which-pm-runs@1.1.0", "", {}, "sha512-n1brCuqClxfFfq/Rb0ICg9giSZqCS+pLtccdag6C2HyufBrh3fBOiy9nb6ggRMvWOVH5GrdJskj5iGTZNxd7SA=="],
+
+    "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="],
+
+    "widest-line": ["widest-line@6.0.0", "", { "dependencies": { "string-width": "^8.1.0" } }, "sha512-U89AsyEeAsyoF0zVJBkG9zBgekjgjK7yk9sje3F4IQpXBJ10TF6ByLlIfjMhcmHMJgHZI4KHt4rdNfktzxIAMA=="],
+
+    "word-wrap": ["word-wrap@1.2.5", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
+
+    "workerd": ["workerd@1.20260526.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260526.1", "@cloudflare/workerd-darwin-arm64": "1.20260526.1", "@cloudflare/workerd-linux-64": "1.20260526.1", "@cloudflare/workerd-linux-arm64": "1.20260526.1", "@cloudflare/workerd-windows-64": "1.20260526.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-IHzymht98p10JH1zzwdCpbViAqw97HrwKl7+KfZeASFMsYSrIsAULWdPn0LRC5FTUzBpamLNyKCCKxbgXHgRHQ=="],
+
+    "wrangler": ["wrangler@4.95.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.27.3", "miniflare": "4.20260526.0", "path-to-regexp": "6.3.0", "rosie-skills": "^0.6.3", "unenv": "2.0.0-rc.24", "workerd": "1.20260526.1" }, "optionalDependencies": { "fsevents": "~2.3.2" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260526.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-vgXzFVSCdUbeCadgVXvu8fK5tzNm8T9W+7lriyGWZMx0B1+CAdr4d8JTlZszHfgjypRAHmAxb49etZGIRD9pgg=="],
+
+    "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
+
+    "wrap-ansi-cjs": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+
+    "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
+
+    "ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="],
+
+    "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],
+
+    "xdg-app-paths": ["xdg-app-paths@8.3.0", "", { "dependencies": { "xdg-portable": "^10.6.0" }, "optionalDependencies": { "fsevents": "*" } }, "sha512-mgxlWVZw0TNWHoGmXq+NC3uhCIc55dDpAlDkMQUaIAcQzysb0kxctwv//fvuW61/nAAeUBJMQ8mnZjMmuYwOcQ=="],
+
+    "xdg-portable": ["xdg-portable@10.6.0", "", { "dependencies": { "os-paths": "^7.4.0" }, "optionalDependencies": { "fsevents": "*" } }, "sha512-xrcqhWDvtZ7WLmt8G4f3hHy37iK7D2idtosRgkeiSPZEPmBShp0VfmRBLWAPC6zLF48APJ21yfea+RfQMF4/Aw=="],
+
+    "xml-naming": ["xml-naming@0.1.0", "", {}, "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw=="],
+
+    "xmlbuilder2": ["xmlbuilder2@4.0.3", "", { "dependencies": { "@oozcitak/dom": "^2.0.2", "@oozcitak/infra": "^2.0.2", "@oozcitak/util": "^10.0.0", "js-yaml": "^4.1.1" } }, "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA=="],
+
+    "xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="],
+
+    "xxhash-wasm": ["xxhash-wasm@1.1.0", "", {}, "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA=="],
+
+    "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
+
+    "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
+
+    "yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
+
+    "yaml-language-server": ["yaml-language-server@1.20.0", "", { "dependencies": { "@vscode/l10n": "^0.0.18", "ajv": "^8.17.1", "ajv-draft-04": "^1.0.0", "prettier": "^3.5.0", "request-light": "^0.5.7", "vscode-json-languageservice": "4.1.8", "vscode-languageserver": "^9.0.0", "vscode-languageserver-textdocument": "^1.0.1", "vscode-languageserver-types": "^3.16.0", "vscode-uri": "^3.0.2", "yaml": "2.7.1" }, "bin": { "yaml-language-server": "bin/yaml-language-server" } }, "sha512-qhjK/bzSRZ6HtTvgeFvjNPJGWdZ0+x5NREV/9XZWFjIGezew2b4r5JPy66IfOhd5OA7KeFwk1JfmEbnTvev0cA=="],
+
+    "yargs": ["yargs@17.7.2", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w=="],
+
+    "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
+
+    "yauzl": ["yauzl@2.10.0", "", { "dependencies": { "buffer-crc32": "~0.2.3", "fd-slicer": "~1.1.0" } }, "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g=="],
+
+    "yocto-queue": ["yocto-queue@1.2.2", "", {}, "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ=="],
+
+    "yocto-spinner": ["yocto-spinner@0.2.3", "", { "dependencies": { "yoctocolors": "^2.1.1" } }, "sha512-sqBChb33loEnkoXte1bLg45bEBsOP9N1kzQh5JZNKj/0rik4zAPTNSAVPj3uQAdc6slYJ0Ksc403G2XgxsJQFQ=="],
+
+    "yoctocolors": ["yoctocolors@2.1.2", "", {}, "sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug=="],
+
+    "yoga-layout": ["yoga-layout@3.2.1", "", {}, "sha512-0LPOt3AxKqMdFBZA3HBAt/t/8vIKq7VaQYbuA8WxCgung+p9TVyKRYdpvCb80HcdTN2NkbIKbhNwKUfm3tQywQ=="],
+
+    "youch": ["youch@4.1.0-beta.10", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@poppinss/dumper": "^0.6.4", "@speed-highlight/core": "^1.2.7", "cookie": "^1.0.2", "youch-core": "^0.3.3" } }, "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ=="],
+
+    "youch-core": ["youch-core@0.3.3", "", { "dependencies": { "@poppinss/exception": "^1.2.2", "error-stack-parser-es": "^1.0.5" } }, "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA=="],
+
+    "zip-stream": ["zip-stream@6.0.1", "", { "dependencies": { "archiver-utils": "^5.0.0", "compress-commons": "^6.0.2", "readable-stream": "^4.0.0" } }, "sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA=="],
+
+    "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
+
+    "zod-package-json": ["zod-package-json@1.2.0", "", { "dependencies": { "zod": "^3.25.64" } }, "sha512-tamtgPM3MkP+obfO2dLr/G+nYoYkpJKmuHdYEy6IXRKfLybruoJ5NUj0lM0LxwOpC9PpoGLbll1ecoeyj43Wsg=="],
+
+    "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],
+
+    "zod-to-ts": ["zod-to-ts@1.2.0", "", { "peerDependencies": { "typescript": "^4.9.4 || ^5.0.2", "zod": "^3" } }, "sha512-x30XE43V+InwGpvTySRNz9kB7qFU8DlyEy7BsSTCHPH1R0QasMmHWZDCzYm6bVXtj/9NNJAZF3jW8rzFvH5OFA=="],
+
+    "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
+
+    "@actions/http-client/undici": ["undici@5.29.0", "", { "dependencies": { "@fastify/busboy": "^2.0.0" } }, "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg=="],
+
+    "@astrojs/internal-helpers/shiki": ["shiki@4.1.0", "", { "dependencies": { "@shikijs/core": "4.1.0", "@shikijs/engine-javascript": "4.1.0", "@shikijs/engine-oniguruma": "4.1.0", "@shikijs/langs": "4.1.0", "@shikijs/themes": "4.1.0", "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-l/ABZPUR5v70jI10EzqfMS/I96vjSGv2y0ihUV+WYFzv0EfvW4s54m0Lg8wCrrL+2IkwBzFTuxkZjPf8b2NX9Q=="],
+
+    "@astrojs/markdown-remark/@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.9.1", "", { "dependencies": { "picomatch": "^4.0.4" } }, "sha512-1pWuARqYom/TzuU3+0ZugsTrKlUydWKuULmDqSMTuonY+9IRDUEGKX/8PXQ1nBxRq3w85uGtd9q9SXfqEldMIQ=="],
+
+    "@astrojs/markdown-remark/shiki": ["shiki@4.1.0", "", { "dependencies": { "@shikijs/core": "4.1.0", "@shikijs/engine-javascript": "4.1.0", "@shikijs/engine-oniguruma": "4.1.0", "@shikijs/langs": "4.1.0", "@shikijs/themes": "4.1.0", "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-l/ABZPUR5v70jI10EzqfMS/I96vjSGv2y0ihUV+WYFzv0EfvW4s54m0Lg8wCrrL+2IkwBzFTuxkZjPf8b2NX9Q=="],
+
+    "@astrojs/react/@vitejs/plugin-react": ["@vitejs/plugin-react@5.2.0", "", { "dependencies": { "@babel/core": "^7.29.0", "@babel/plugin-transform-react-jsx-self": "^7.27.1", "@babel/plugin-transform-react-jsx-source": "^7.27.1", "@rolldown/pluginutils": "1.0.0-rc.3", "@types/babel__core": "^7.20.5", "react-refresh": "^0.18.0" }, "peerDependencies": { "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" } }, "sha512-YmKkfhOAi3wsB1PhJq5Scj3GXMn3WvtQ/JC0xoopuHoXSdmtdStOpFrYaT1kie2YgFBcIe64ROzMYRjCrYOdYw=="],
+
+    "@astrojs/react/vite": ["vite@7.3.3", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA=="],
+
+    "@astrojs/rss/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@astrojs/sitemap/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark": ["@astrojs/markdown-remark@6.3.11", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.6", "@astrojs/prism": "3.3.0", "github-slugger": "^2.0.0", "hast-util-from-html": "^2.0.3", "hast-util-to-text": "^4.0.2", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.1", "mdast-util-definitions": "^6.0.0", "rehype-raw": "^7.0.0", "rehype-stringify": "^10.0.1", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remark-smartypants": "^3.0.2", "shiki": "^3.21.0", "smol-toml": "^1.6.0", "unified": "^11.0.5", "unist-util-remove-position": "^5.0.0", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.2", "vfile": "^6.0.3" } }, "sha512-hcaxX/5aC6lQgHeGh1i+aauvSwIT6cfyFjKWvExYSxUhZZBBdvCliOtu06gbQyhbe0pGJNoNmqNlQZ5zYUuIyQ=="],
+
+    "@astrojs/starlight/@astrojs/mdx": ["@astrojs/mdx@4.3.14", "", { "dependencies": { "@astrojs/markdown-remark": "6.3.11", "@mdx-js/mdx": "^3.1.1", "acorn": "^8.15.0", "es-module-lexer": "^1.7.0", "estree-util-visit": "^2.0.0", "hast-util-to-html": "^9.0.5", "piccolore": "^0.1.3", "rehype-raw": "^7.0.0", "remark-gfm": "^4.0.1", "remark-smartypants": "^3.0.2", "source-map": "^0.7.6", "unist-util-visit": "^5.0.0", "vfile": "^6.0.3" }, "peerDependencies": { "astro": "^5.0.0" } }, "sha512-FBrqJQORVm+rkRa2TS5CjU9PBA6hkhrwLVBSS9A77gN2+iehvjq1w6yya/d0YKC7osiVorKkr3Qd9wNbl0ZkGA=="],
+
+    "@aws-sdk/xml-builder/fast-xml-parser": ["fast-xml-parser@5.7.3", "", { "dependencies": { "@nodable/entities": "^2.1.0", "fast-xml-builder": "^1.1.7", "path-expression-matcher": "^1.5.0", "strnum": "^2.2.3" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg=="],
+
+    "@babel/core/@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/generator/@babel/parser": ["@babel/parser@8.0.0-rc.6", "", { "dependencies": { "@babel/types": "^8.0.0-rc.6" }, "bin": "./bin/babel-parser.js" }, "sha512-rOS8IpdO7mQELkTPlCsTgPejO0bFuZdEDCGQJouYbYf9e1FLTym7Fei2pEjq8q7MWbX0ravcd7QQYKs1TxOuog=="],
+
+    "@babel/generator/@babel/types": ["@babel/types@8.0.0-rc.6", "", { "dependencies": { "@babel/helper-string-parser": "^8.0.0-rc.6", "@babel/helper-validator-identifier": "^8.0.0-rc.6" } }, "sha512-p7/ABylAYlexb31wtRdIfH9L9A0Z2T/9H6zAqzqndkY2PLkvNNc580wGhp/gGKN4Sp9sQvSkhc6Oga8/O+wTyw=="],
+
+    "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
+
+    "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
+
+    "@babel/traverse/@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "@better-auth/core/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@cloudflare/vite-plugin/ws": ["ws@8.20.1", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w=="],
+
+    "@cspotcode/source-map-support/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="],
+
+    "@distilled.cloud/cloudflare-runtime/capnweb": ["capnweb@0.7.0", "", {}, "sha512-zO7tt5ch2tImacaR/oMd7e1dqi/fWU7hjZdvQMv6Yo3v9uUGA8cPIUQGvfQTu2c+NgyE/j/oDmMaUlf1PXyfJw=="],
+
+    "@effect/platform-node/undici": ["undici@8.3.0", "", {}, "sha512-TkUDgb6tl7KOGZ+7e8E3d2FYgUQgF6z5YypqjWmixVQSQERFcVrVg0ySADm2LVLRh5ljAaHTCR5Fmz3Q34rB7Q=="],
+
+    "@effect/sql-pg/pg-connection-string": ["pg-connection-string@2.12.0", "", {}, "sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ=="],
+
+    "@effect/sql-pg/pg-types": ["pg-types@4.1.0", "", { "dependencies": { "pg-int8": "1.0.1", "pg-numeric": "1.0.2", "postgres-array": "~3.0.1", "postgres-bytea": "~3.0.0", "postgres-date": "~2.1.0", "postgres-interval": "^3.0.0", "postgres-range": "^1.1.1" } }, "sha512-o2XFanIMy/3+mThw69O8d4n1E5zsLhdO+OPqswezu7Z5ekP4hYDqlDjlmOpYMbzY2Br0ufCwJLdDIXeNVwcWFg=="],
+
+    "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
+
+    "@expressive-code/plugin-shiki/shiki": ["shiki@3.23.0", "", { "dependencies": { "@shikijs/core": "3.23.0", "@shikijs/engine-javascript": "3.23.0", "@shikijs/engine-oniguruma": "3.23.0", "@shikijs/langs": "3.23.0", "@shikijs/themes": "3.23.0", "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA=="],
+
+    "@isaacs/cliui/string-width": ["string-width@5.1.2", "", { "dependencies": { "eastasianwidth": "^0.2.0", "emoji-regex": "^9.2.2", "strip-ansi": "^7.0.1" } }, "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA=="],
+
+    "@isaacs/cliui/wrap-ansi": ["wrap-ansi@8.1.0", "", { "dependencies": { "ansi-styles": "^6.1.0", "string-width": "^5.0.1", "strip-ansi": "^7.0.1" } }, "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ=="],
+
+    "@mapbox/node-pre-gyp/tar": ["tar@7.5.15", "", { "dependencies": { "@isaacs/fs-minipass": "^4.0.0", "chownr": "^3.0.0", "minipass": "^7.1.2", "minizlib": "^3.1.0", "yallist": "^5.0.0" } }, "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ=="],
+
+    "@octokit/action/@octokit/core": ["@octokit/core@5.2.2", "", { "dependencies": { "@octokit/auth-token": "^4.0.0", "@octokit/graphql": "^7.1.0", "@octokit/request": "^8.4.1", "@octokit/request-error": "^5.1.1", "@octokit/types": "^13.0.0", "before-after-hook": "^2.2.0", "universal-user-agent": "^6.0.0" } }, "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg=="],
+
+    "@octokit/action/@octokit/plugin-paginate-rest": ["@octokit/plugin-paginate-rest@9.2.2", "", { "dependencies": { "@octokit/types": "^12.6.0" }, "peerDependencies": { "@octokit/core": "5" } }, "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ=="],
+
+    "@octokit/action/@octokit/plugin-rest-endpoint-methods": ["@octokit/plugin-rest-endpoint-methods@10.4.1", "", { "dependencies": { "@octokit/types": "^12.6.0" }, "peerDependencies": { "@octokit/core": "5" } }, "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg=="],
+
+    "@octokit/action/undici": ["undici@6.26.0", "", {}, "sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A=="],
+
+    "@octokit/auth-action/@octokit/auth-token": ["@octokit/auth-token@4.0.0", "", {}, "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA=="],
+
+    "@octokit/auth-action/@octokit/types": ["@octokit/types@13.10.0", "", { "dependencies": { "@octokit/openapi-types": "^24.2.0" } }, "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA=="],
+
+    "@octokit/core/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@octokit/endpoint/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@octokit/graphql/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@octokit/plugin-paginate-rest/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@octokit/plugin-rest-endpoint-methods/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@octokit/request/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@octokit/request-error/@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="],
+
+    "@parcel/watcher-wasm/napi-wasm": ["napi-wasm@1.1.3", "", { "bundled": true }, "sha512-h/4nMGsHjZDCYmQVNODIrYACVJ+I9KItbG+0si6W/jSjdA9JbWDoU4LLeMXVcEQGHjttI2tuXqDrbGF7qkUHHg=="],
+
+    "@poppinss/dumper/supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="],
+
+    "@rollup/plugin-commonjs/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@rollup/plugin-inject/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@rollup/pluginutils/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@shikijs/primitive/@shikijs/types": ["@shikijs/types@4.1.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3EQWX54fMpniOrDblzAhiwiJwpiTMW6+B9DWyUd9ska483tbayFYuw47UxwuPknI31bKnySfVQ/QW+jFL4rFdA=="],
+
+    "@shuding/opentype.js/fflate": ["fflate@0.7.4", "", {}, "sha512-5u2V/CDW15QM1XbbgS+0DfPxVB+jUKhWEKuuFuHncbk3tEEqzmoXL+2KyOFuKGqOnmdIy0/davWF1CkuwtibCw=="],
+
+    "@solidjs/start/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
+
+    "@solidjs/start/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
+
+    "@solidjs/start/vite": ["vite@7.3.3", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite": ["vite@7.3.3", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" }, "bundled": true }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.1", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.1" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" }, "bundled": true }, "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/tslib": ["tslib@2.8.1", "", { "bundled": true }, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "@tanstack/directive-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
+    "@tanstack/directive-functions-plugin/@tanstack/router-utils": ["@tanstack/router-utils@1.133.19", "", { "dependencies": { "@babel/core": "^7.27.4", "@babel/generator": "^7.27.5", "@babel/parser": "^7.27.5", "@babel/preset-typescript": "^7.27.1", "ansis": "^4.1.0", "diff": "^8.0.2", "pathe": "^2.0.3", "tinyglobby": "^0.2.15" } }, "sha512-WEp5D2gPxvlLDRXwD/fV7RXjYtqaqJNXKB/L6OyZEbT+9BG/Ib2d7oG9GSUZNNMGPGYAlhBUOi3xutySsk6rxA=="],
+
+    "@tanstack/router-core/cookie-es": ["cookie-es@3.1.1", "", {}, "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg=="],
+
+    "@tanstack/router-generator/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@tanstack/router-plugin/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "@tanstack/router-plugin/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@tanstack/router-utils/@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "@tanstack/server-functions-plugin/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
+    "@tanstack/start-plugin-core/@babel/code-frame": ["@babel/code-frame@7.27.1", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.27.1", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg=="],
+
+    "@tanstack/start-plugin-core/srvx": ["srvx@0.11.16", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-bp07zRuycfTY43IjAvvTFnmnJi8ikW0VFiHwOhhYcVW/L4xQ1XY4PAd4Nuum1rsA17C39zL7x+CDhrn5AL32Rw=="],
+
+    "@tanstack/start-plugin-core/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@typescript/analyze-trace/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
+
+    "@typescript/analyze-trace/p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
+
+    "@typescript/analyze-trace/yargs": ["yargs@16.2.0", "", { "dependencies": { "cliui": "^7.0.2", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.0", "y18n": "^5.0.5", "yargs-parser": "^20.2.2" } }, "sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw=="],
+
+    "@vercel/nft/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vue-macros/common/@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.35", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/compiler-core": "3.5.35", "@vue/compiler-dom": "3.5.35", "@vue/compiler-ssr": "3.5.35", "@vue/shared": "3.5.35", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.15", "source-map-js": "^1.2.1" } }, "sha512-G5VPMcXTSywXBgtFOZOnHKBxKSrwXUcvY1iaF5/hRcy7t0J6CH/d8ha9F4nzi00Fax1eLV0QHM7v4mQu68jydw=="],
+
+    "@vue/babel-plugin-jsx/@vue/shared": ["@vue/shared@3.5.35", "", {}, "sha512-zSbjL7gRXwks2ZQLRGCajBtBXEOXW9Ddhn/HvSdrGkE2dqGnumzW8XtusRrxrE9LvqtiqDXQ+A60Hp6mvdYxfA=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc": ["@vue/compiler-sfc@3.5.35", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/compiler-core": "3.5.35", "@vue/compiler-dom": "3.5.35", "@vue/compiler-ssr": "3.5.35", "@vue/shared": "3.5.35", "estree-walker": "^2.0.2", "magic-string": "^0.30.21", "postcss": "^8.5.15", "source-map-js": "^1.2.1" } }, "sha512-G5VPMcXTSywXBgtFOZOnHKBxKSrwXUcvY1iaF5/hRcy7t0J6CH/d8ha9F4nzi00Fax1eLV0QHM7v4mQu68jydw=="],
+
+    "@vue/compiler-core/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "@vue/compiler-core/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vue/compiler-sfc/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vue/compiler-vapor/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vue/language-core/@vue/compiler-dom": ["@vue/compiler-dom@3.5.35", "", { "dependencies": { "@vue/compiler-core": "3.5.35", "@vue/shared": "3.5.35" } }, "sha512-k+bprkXxuqhVajgTx5mUHuir7TwQzUKOWR40ng1ncAqQRPnrLngGGgqVEEhOnTMlc8btHYVKmrP8s5Qyg0hvYA=="],
+
+    "@vue/language-core/@vue/shared": ["@vue/shared@3.5.35", "", {}, "sha512-zSbjL7gRXwks2ZQLRGCajBtBXEOXW9Ddhn/HvSdrGkE2dqGnumzW8XtusRrxrE9LvqtiqDXQ+A60Hp6mvdYxfA=="],
+
+    "ansi-align/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "anymatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "archiver/readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
+
+    "archiver-utils/glob": ["glob@10.5.0", "", { "dependencies": { "foreground-child": "^3.1.0", "jackspeak": "^3.1.2", "minimatch": "^9.0.4", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^1.11.1" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg=="],
+
+    "archiver-utils/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
+
+    "archiver-utils/readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
+
+    "astro/@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.7.6", "", {}, "sha512-GOle7smBWKfMSP8osUIGOlB5kaHdQLV3foCsf+5Q9Wsuu+C6Fs3Ez/ttXmhjZ1HkSgsogcM1RXSjjOVieHq16Q=="],
+
+    "astro/@astrojs/markdown-remark": ["@astrojs/markdown-remark@6.3.11", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.6", "@astrojs/prism": "3.3.0", "github-slugger": "^2.0.0", "hast-util-from-html": "^2.0.3", "hast-util-to-text": "^4.0.2", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.1", "mdast-util-definitions": "^6.0.0", "rehype-raw": "^7.0.0", "rehype-stringify": "^10.0.1", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remark-smartypants": "^3.0.2", "shiki": "^3.21.0", "smol-toml": "^1.6.0", "unified": "^11.0.5", "unist-util-remove-position": "^5.0.0", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.2", "vfile": "^6.0.3" } }, "sha512-hcaxX/5aC6lQgHeGh1i+aauvSwIT6cfyFjKWvExYSxUhZZBBdvCliOtu06gbQyhbe0pGJNoNmqNlQZ5zYUuIyQ=="],
+
+    "astro/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
+
+    "astro/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+
+    "astro/p-limit": ["p-limit@6.2.0", "", { "dependencies": { "yocto-queue": "^1.1.1" } }, "sha512-kuUqqHNUqoIWp/c467RI4X6mmyuojY5jGutNU0wVTmEOOfcuwLqyMVoAi9MKi2Ak+5i9+nhmrK4ufZE8069kHA=="],
+
+    "astro/shiki": ["shiki@3.23.0", "", { "dependencies": { "@shikijs/core": "3.23.0", "@shikijs/engine-javascript": "3.23.0", "@shikijs/engine-oniguruma": "3.23.0", "@shikijs/langs": "3.23.0", "@shikijs/themes": "3.23.0", "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA=="],
+
+    "astro/vite": ["vite@6.4.2", "", { "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.4.4", "picomatch": "^4.0.2", "postcss": "^8.5.3", "rollup": "^4.34.9", "tinyglobby": "^0.2.13" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0", "jiti": ">=1.21.0", "less": "*", "lightningcss": "^1.21.0", "sass": "*", "sass-embedded": "*", "stylus": "*", "sugarss": "*", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ=="],
+
+    "astro-remote/marked": ["marked@12.0.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-qXUm7e/YKFoqFPYPa3Ukg9xlI5cyAtGmyEIzMfW//m6kXwCy2Ps9DYf5ioijFKQ8qyuscrHoY04iJGctu2Kg0Q=="],
+
+    "babel-plugin-jsx-dom-expressions/@babel/helper-module-imports": ["@babel/helper-module-imports@7.18.6", "", { "dependencies": { "@babel/types": "^7.18.6" } }, "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA=="],
+
+    "better-auth/zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "boxen/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "boxen/type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="],
+
+    "boxen/widest-line": ["widest-line@5.0.0", "", { "dependencies": { "string-width": "^7.0.0" } }, "sha512-c9bZp7b5YtRj2wOe6dlj32MK+Bx/M/d+9VB2SHM1OtsUHR0aV0tdP6DWh/iMt0kWi1t5g1Iudu6hQRNd1A4PVA=="],
+
+    "buffer/base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "c12/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "c12/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+
+    "changelogen/c12": ["c12@1.11.2", "", { "dependencies": { "chokidar": "^3.6.0", "confbox": "^0.1.7", "defu": "^6.1.4", "dotenv": "^16.4.5", "giget": "^1.2.3", "jiti": "^1.21.6", "mlly": "^1.7.1", "ohash": "^1.1.3", "pathe": "^1.1.2", "perfect-debounce": "^1.0.0", "pkg-types": "^1.2.0", "rc9": "^2.1.2" }, "peerDependencies": { "magicast": "^0.3.4" }, "optionalPeers": ["magicast"] }, "sha512-oBs8a4uvSDO9dm8b7OCFW7+dgtVrwmwnrVXYzLm43ta7ep2jCn/0MhoUFygIWtxhyy6+/MG7/agvpY0U1Iemew=="],
+
+    "changelogen/pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
+
+    "changelogen/std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
+
+    "cliui/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "cliui/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+
+    "cloudflare-solid-ssr/vite": ["vite@7.3.3", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA=="],
+
+    "cloudflare-tanstack-example/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+
+    "cloudflare-vue/@types/node": ["@types/node@24.12.4", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA=="],
+
+    "cloudflare-vue/oxfmt": ["oxfmt@0.42.0", "", { "dependencies": { "tinypool": "2.1.0" }, "optionalDependencies": { "@oxfmt/binding-android-arm-eabi": "0.42.0", "@oxfmt/binding-android-arm64": "0.42.0", "@oxfmt/binding-darwin-arm64": "0.42.0", "@oxfmt/binding-darwin-x64": "0.42.0", "@oxfmt/binding-freebsd-x64": "0.42.0", "@oxfmt/binding-linux-arm-gnueabihf": "0.42.0", "@oxfmt/binding-linux-arm-musleabihf": "0.42.0", "@oxfmt/binding-linux-arm64-gnu": "0.42.0", "@oxfmt/binding-linux-arm64-musl": "0.42.0", "@oxfmt/binding-linux-ppc64-gnu": "0.42.0", "@oxfmt/binding-linux-riscv64-gnu": "0.42.0", "@oxfmt/binding-linux-riscv64-musl": "0.42.0", "@oxfmt/binding-linux-s390x-gnu": "0.42.0", "@oxfmt/binding-linux-x64-gnu": "0.42.0", "@oxfmt/binding-linux-x64-musl": "0.42.0", "@oxfmt/binding-openharmony-arm64": "0.42.0", "@oxfmt/binding-win32-arm64-msvc": "0.42.0", "@oxfmt/binding-win32-ia32-msvc": "0.42.0", "@oxfmt/binding-win32-x64-msvc": "0.42.0" }, "bin": { "oxfmt": "bin/oxfmt" } }, "sha512-QhejGErLSMReNuZ6vxgFHDyGoPbjTRNi6uGHjy0cvIjOQFqD6xmr/T+3L41ixR3NIgzcNiJ6ylQKpvShTgDfqg=="],
+
+    "compress-commons/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
+
+    "compress-commons/readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
+
+    "crc32-stream/readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
+
+    "cross-spawn/which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
+
+    "csso/css-tree": ["css-tree@2.2.1", "", { "dependencies": { "mdn-data": "2.0.28", "source-map-js": "^1.0.1" } }, "sha512-OA0mILzGc1kCOCSJerOeqDxDQ4HOh+G8NbOJFOTgOCzpw7fCBubk0fEyxp8AgOL/jvLgYA/uV0cMbe43ElF1JA=="],
+
+    "cytoscape-fcose/cose-base": ["cose-base@2.2.0", "", { "dependencies": { "layout-base": "^2.0.0" } }, "sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g=="],
+
+    "d3-dsv/commander": ["commander@7.2.0", "", {}, "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw=="],
+
+    "d3-dsv/iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
+
+    "d3-sankey/d3-array": ["d3-array@2.12.1", "", { "dependencies": { "internmap": "^1.0.0" } }, "sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ=="],
+
+    "d3-sankey/d3-shape": ["d3-shape@1.3.7", "", { "dependencies": { "d3-path": "1" } }, "sha512-EUkvKjqPFUAZyOlhY5gzCxCeI0Aep04LwIRpsZ/mLFelJiUfnK56jo5JMDSE7yyP2kLSb6LtF+S5chMk7uqPqw=="],
+
+    "drizzle-kit/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
+
+    "escodegen/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
+
+    "eslint/escape-string-regexp": ["escape-string-regexp@4.0.0", "", {}, "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="],
+
+    "eslint/glob-parent": ["glob-parent@6.0.2", "", { "dependencies": { "is-glob": "^4.0.3" } }, "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A=="],
+
+    "example-basic/vite": ["vite@7.3.3", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-/4XH147Ui7OGTjg3HbdWe5arnZQSbfuRzdr9Ec7TQi5I7R+ir0Rlc9GIvD4v0XZurELqA035KVXJXpR61xhiTA=="],
+
+    "execa/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
+    "extract-zip/get-stream": ["get-stream@5.2.0", "", { "dependencies": { "pump": "^3.0.0" } }, "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA=="],
+
+    "foreground-child/signal-exit": ["signal-exit@4.1.0", "", {}, "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw=="],
+
+    "fs-minipass/minipass": ["minipass@3.3.6", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw=="],
+
+    "globby/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="],
+
+    "globby/unicorn-magic": ["unicorn-magic@0.4.0", "", {}, "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw=="],
+
+    "h3-v2/rou3": ["rou3@0.8.1", "", {}, "sha512-ePa+XGk00/3HuCqrEnK3LxJW7I0SdNg6EFzKUJG73hMAdDcOUC/i/aSz7LSDwLrGr33kal/rqOGydzwl6U7zBA=="],
+
+    "h3-v2/srvx": ["srvx@0.11.16", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-bp07zRuycfTY43IjAvvTFnmnJi8ikW0VFiHwOhhYcVW/L4xQ1XY4PAd4Nuum1rsA17C39zL7x+CDhrn5AL32Rw=="],
+
+    "katex/commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="],
+
+    "libsql/detect-libc": ["detect-libc@2.0.2", "", {}, "sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw=="],
+
+    "listhen/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "local-pkg/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+
+    "local-pkg/quansync": ["quansync@0.2.11", "", {}, "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA=="],
+
+    "mdast-util-find-and-replace/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
+
+    "mermaid/marked": ["marked@16.4.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-TI3V8YYWvkVf3KJe1dRkpnjs68JUPyEa5vjKrp1XEEJUAOaQc+Qj+L1qWbPd0SJuAdQkFU0h73sXXqwDYxsiDA=="],
+
+    "micromatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "miniflare/undici": ["undici@7.24.8", "", {}, "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ=="],
+
+    "miniflare/ws": ["ws@8.20.1", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w=="],
+
+    "minizlib/minipass": ["minipass@3.3.6", "", { "dependencies": { "yallist": "^4.0.0" } }, "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw=="],
+
+    "minizlib/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
+
+    "nitropack/@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.4.2", "", {}, "sha512-SIOD2DxrRRwQ+jgzlXCqoEFiKOFqaPjhnNTGKXSRLvp1HiOvapLaFG2kEr9dYQTYe8rKrd9uvDUzmAITeNyaHQ=="],
+
+    "nitropack/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "nitropack/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
+
+    "nitropack/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "nitropack/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+
+    "nitropack/youch": ["youch@4.1.1", "", { "dependencies": { "@poppinss/colors": "^4.1.6", "@poppinss/dumper": "^0.7.0", "@speed-highlight/core": "^1.2.14", "cookie-es": "^3.0.1", "youch-core": "^0.3.3" } }, "sha512-mxW3qiSnl+GRxXsaUMzv2Mbada1Y8CDltET9UxejDQe6DBYlSekghl5U5K0ReAikcHDi0G1vKZEmmo/NWAGKLA=="],
+
+    "npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
+
+    "nypm/citty": ["citty@0.1.6", "", { "dependencies": { "consola": "^3.2.3" } }, "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ=="],
+
+    "nypm/tinyexec": ["tinyexec@0.3.2", "", {}, "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="],
+
+    "oniguruma-to-es/emoji-regex-xs": ["emoji-regex-xs@1.0.0", "", {}, "sha512-LRlerrMYoIDrT6jgpeZ2YYl/L8EulRTt5hQcYjy5AInh7HWXKimpqx68aknBFpGL2+/IcogTcaydJEgaTmOpDg=="],
+
+    "p-locate/p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
+
+    "parse-entities/@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="],
+
+    "parse5/entities": ["entities@6.0.1", "", {}, "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g=="],
+
+    "pgpass/split2": ["split2@4.2.0", "", {}, "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg=="],
+
+    "pkg-types/confbox": ["confbox@0.1.8", "", {}, "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="],
+
+    "prompts/kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
+
+    "proxy-agent/lru-cache": ["lru-cache@7.18.3", "", {}, "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA=="],
+
+    "react-devtools-core/ws": ["ws@7.5.11", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": "^5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA=="],
+
+    "readdir-glob/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
+
+    "rolldown/@oxc-project/types": ["@oxc-project/types@0.130.0", "", {}, "sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q=="],
+
+    "rolldown-plugin-dts/@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "rollup-plugin-visualizer/open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
+
+    "rollup-plugin-visualizer/yargs": ["yargs@18.0.0", "", { "dependencies": { "cliui": "^9.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "string-width": "^7.2.0", "y18n": "^5.0.5", "yargs-parser": "^22.0.0" } }, "sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg=="],
+
+    "sitemap/@types/node": ["@types/node@24.12.4", "", { "dependencies": { "undici-types": "~7.16.0" } }, "sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA=="],
+
+    "solid-refresh/@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "source-map-support/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
+
+    "split2/readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="],
+
+    "starlight-blog/@astrojs/markdown-remark": ["@astrojs/markdown-remark@6.3.11", "", { "dependencies": { "@astrojs/internal-helpers": "0.7.6", "@astrojs/prism": "3.3.0", "github-slugger": "^2.0.0", "hast-util-from-html": "^2.0.3", "hast-util-to-text": "^4.0.2", "import-meta-resolve": "^4.2.0", "js-yaml": "^4.1.1", "mdast-util-definitions": "^6.0.0", "rehype-raw": "^7.0.0", "rehype-stringify": "^10.0.1", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remark-smartypants": "^3.0.2", "shiki": "^3.21.0", "smol-toml": "^1.6.0", "unified": "^11.0.5", "unist-util-remove-position": "^5.0.0", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.2", "vfile": "^6.0.3" } }, "sha512-hcaxX/5aC6lQgHeGh1i+aauvSwIT6cfyFjKWvExYSxUhZZBBdvCliOtu06gbQyhbe0pGJNoNmqNlQZ5zYUuIyQ=="],
+
+    "starlight-blog/@astrojs/mdx": ["@astrojs/mdx@4.3.14", "", { "dependencies": { "@astrojs/markdown-remark": "6.3.11", "@mdx-js/mdx": "^3.1.1", "acorn": "^8.15.0", "es-module-lexer": "^1.7.0", "estree-util-visit": "^2.0.0", "hast-util-to-html": "^9.0.5", "piccolore": "^0.1.3", "rehype-raw": "^7.0.0", "remark-gfm": "^4.0.1", "remark-smartypants": "^3.0.2", "source-map": "^0.7.6", "unist-util-visit": "^5.0.0", "vfile": "^6.0.3" }, "peerDependencies": { "astro": "^5.0.0" } }, "sha512-FBrqJQORVm+rkRa2TS5CjU9PBA6hkhrwLVBSS9A77gN2+iehvjq1w6yya/d0YKC7osiVorKkr3Qd9wNbl0ZkGA=="],
+
+    "string-width-cjs/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "string-width-cjs/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "string-width-cjs/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "strip-ansi-cjs/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "strip-literal/js-tokens": ["js-tokens@9.0.1", "", {}, "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ=="],
+
+    "svgo/commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
+
+    "tar/minipass": ["minipass@5.0.0", "", {}, "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ=="],
+
+    "tar/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
+
+    "through2/readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="],
+
+    "tsdown/rolldown": ["rolldown@1.0.0-beta.45", "", { "dependencies": { "@oxc-project/types": "=0.95.0", "@rolldown/pluginutils": "1.0.0-beta.45" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.0-beta.45", "@rolldown/binding-darwin-arm64": "1.0.0-beta.45", "@rolldown/binding-darwin-x64": "1.0.0-beta.45", "@rolldown/binding-freebsd-x64": "1.0.0-beta.45", "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-beta.45", "@rolldown/binding-linux-arm64-gnu": "1.0.0-beta.45", "@rolldown/binding-linux-arm64-musl": "1.0.0-beta.45", "@rolldown/binding-linux-x64-gnu": "1.0.0-beta.45", "@rolldown/binding-linux-x64-musl": "1.0.0-beta.45", "@rolldown/binding-openharmony-arm64": "1.0.0-beta.45", "@rolldown/binding-wasm32-wasi": "1.0.0-beta.45", "@rolldown/binding-win32-arm64-msvc": "1.0.0-beta.45", "@rolldown/binding-win32-ia32-msvc": "1.0.0-beta.45", "@rolldown/binding-win32-x64-msvc": "1.0.0-beta.45" }, "bin": { "rolldown": "bin/cli.mjs" } }, "sha512-iMmuD72XXLf26Tqrv1cryNYLX6NNPLhZ3AmNkSf8+xda0H+yijjGJ+wVT9UdBUHOpKzq9RjKtQKRCWoEKQQBZQ=="],
+
+    "unctx/unplugin": ["unplugin@2.3.11", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "acorn": "^8.15.0", "picomatch": "^4.0.3", "webpack-virtual-modules": "^0.6.2" } }, "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww=="],
+
+    "unicode-trie/pako": ["pako@0.2.9", "", {}, "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA=="],
+
+    "unimport/escape-string-regexp": ["escape-string-regexp@5.0.0", "", {}, "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw=="],
+
+    "unimport/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+
+    "unstorage/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "unstorage/h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
+
+    "untun/citty": ["citty@0.1.6", "", { "dependencies": { "consola": "^3.2.3" } }, "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ=="],
+
+    "untun/pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
+
+    "untyped/citty": ["citty@0.1.6", "", { "dependencies": { "consola": "^3.2.3" } }, "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ=="],
+
+    "unwasm/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+
+    "vite/rolldown": ["rolldown@1.0.2", "", { "dependencies": { "@oxc-project/types": "=0.132.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.2", "@rolldown/binding-darwin-arm64": "1.0.2", "@rolldown/binding-darwin-x64": "1.0.2", "@rolldown/binding-freebsd-x64": "1.0.2", "@rolldown/binding-linux-arm-gnueabihf": "1.0.2", "@rolldown/binding-linux-arm64-gnu": "1.0.2", "@rolldown/binding-linux-arm64-musl": "1.0.2", "@rolldown/binding-linux-ppc64-gnu": "1.0.2", "@rolldown/binding-linux-s390x-gnu": "1.0.2", "@rolldown/binding-linux-x64-gnu": "1.0.2", "@rolldown/binding-linux-x64-musl": "1.0.2", "@rolldown/binding-openharmony-arm64": "1.0.2", "@rolldown/binding-wasm32-wasi": "1.0.2", "@rolldown/binding-win32-arm64-msvc": "1.0.2", "@rolldown/binding-win32-x64-msvc": "1.0.2" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-oZx5zVDtVB44AW3eaifgDml1gWRDZGvjcfdxonE4swNPG98PrrXjaO/KrnUjzlMnztCCRVlUueA1kCXhARGk6g=="],
+
+    "vite-dev-rpc/birpc": ["birpc@4.0.0", "", {}, "sha512-LShSxJP0KTmd101b6DRyGBj57LZxSDYWKitQNW/mi8GRMvZb078Uf9+pveax1DrVL89vm7mWe+TovdI/UDOuPw=="],
+
+    "vite-plugin-inspect/open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
+
+    "vite-plugin-vue-inspector/@vue/compiler-dom": ["@vue/compiler-dom@3.5.35", "", { "dependencies": { "@vue/compiler-core": "3.5.35", "@vue/shared": "3.5.35" } }, "sha512-k+bprkXxuqhVajgTx5mUHuir7TwQzUKOWR40ng1ncAqQRPnrLngGGgqVEEhOnTMlc8btHYVKmrP8s5Qyg0hvYA=="],
+
+    "vscode-json-languageservice/jsonc-parser": ["jsonc-parser@3.3.1", "", {}, "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ=="],
+
+    "vue-router/chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
+
+    "wrangler/esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="],
+
+    "wrangler/path-to-regexp": ["path-to-regexp@6.3.0", "", {}, "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="],
+
+    "wrap-ansi/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "wrap-ansi-cjs/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "wrap-ansi-cjs/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "wrap-ansi-cjs/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "yaml-language-server/ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
+
+    "yaml-language-server/request-light": ["request-light@0.5.8", "", {}, "sha512-3Zjgh+8b5fhRJBQZoy+zbVKpAQGLyka0MPgW3zruTF4dFFJ8Fqcfu9YsAvi/rvdcaTeWG3MkbZv4WKxAn/84Lg=="],
+
+    "yaml-language-server/yaml": ["yaml@2.7.1", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ=="],
+
+    "yargs/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "yauzl/buffer-crc32": ["buffer-crc32@0.2.13", "", {}, "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ=="],
+
+    "zip-stream/readable-stream": ["readable-stream@4.7.0", "", { "dependencies": { "abort-controller": "^3.0.0", "buffer": "^6.0.3", "events": "^3.3.0", "process": "^0.11.10", "string_decoder": "^1.3.0" } }, "sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/core": ["@shikijs/core@4.1.0", "", { "dependencies": { "@shikijs/primitive": "4.1.0", "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-jLJtSJeuFffqX6/inRE1zqU5aFv2hrszvYgq3OjbAgFRZiWv7abKMDdQzYxuSDfmUPQozZvI/kuy6VMTvnvqTQ=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.6" } }, "sha512-YquhawCUgaBfhsS72e2Y/dI59gCBNPHu3fEO/tvLaXrTssxZrY5ddjtNLTwndrMgPo8b3IscE+xoICDzpTmlFQ=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-axLpjVs45YBvvINa+dJF+NPW+KtFkNXsFr4SDw2BMj9GdeMnGxVB9PQb2xXlJYovslt/nz6giedAyOANkfc7hg=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/langs": ["@shikijs/langs@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0" } }, "sha512-nwOMruEkbgdZfQ/b8CgpNBVOpvG1k0N5tbmgiFeqsan401+x3ILqlzZJowSla4Agmq4hG2Uf2wh5jLTEhR8VSg=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/themes": ["@shikijs/themes@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0" } }, "sha512-emCcTnUM7yO2wltYbaxm+yLvcCI4+h8XBKc4KmJ7EZUXoSGjcCHifkI//R4OFit9ewpg7H2/9tjOuXrT2v/Knw=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/types": ["@shikijs/types@4.1.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3EQWX54fMpniOrDblzAhiwiJwpiTMW6+B9DWyUd9ska483tbayFYuw47UxwuPknI31bKnySfVQ/QW+jFL4rFdA=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/core": ["@shikijs/core@4.1.0", "", { "dependencies": { "@shikijs/primitive": "4.1.0", "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-jLJtSJeuFffqX6/inRE1zqU5aFv2hrszvYgq3OjbAgFRZiWv7abKMDdQzYxuSDfmUPQozZvI/kuy6VMTvnvqTQ=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.6" } }, "sha512-YquhawCUgaBfhsS72e2Y/dI59gCBNPHu3fEO/tvLaXrTssxZrY5ddjtNLTwndrMgPo8b3IscE+xoICDzpTmlFQ=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-axLpjVs45YBvvINa+dJF+NPW+KtFkNXsFr4SDw2BMj9GdeMnGxVB9PQb2xXlJYovslt/nz6giedAyOANkfc7hg=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/langs": ["@shikijs/langs@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0" } }, "sha512-nwOMruEkbgdZfQ/b8CgpNBVOpvG1k0N5tbmgiFeqsan401+x3ILqlzZJowSla4Agmq4hG2Uf2wh5jLTEhR8VSg=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/themes": ["@shikijs/themes@4.1.0", "", { "dependencies": { "@shikijs/types": "4.1.0" } }, "sha512-emCcTnUM7yO2wltYbaxm+yLvcCI4+h8XBKc4KmJ7EZUXoSGjcCHifkI//R4OFit9ewpg7H2/9tjOuXrT2v/Knw=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/types": ["@shikijs/types@4.1.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3EQWX54fMpniOrDblzAhiwiJwpiTMW6+B9DWyUd9ska483tbayFYuw47UxwuPknI31bKnySfVQ/QW+jFL4rFdA=="],
+
+    "@astrojs/react/@vitejs/plugin-react/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-rc.3", "", {}, "sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q=="],
+
+    "@astrojs/react/vite/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.7.6", "", {}, "sha512-GOle7smBWKfMSP8osUIGOlB5kaHdQLV3foCsf+5Q9Wsuu+C6Fs3Ez/ttXmhjZ1HkSgsogcM1RXSjjOVieHq16Q=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/@astrojs/prism": ["@astrojs/prism@3.3.0", "", { "dependencies": { "prismjs": "^1.30.0" } }, "sha512-q8VwfU/fDZNoDOf+r7jUnMC2//H2l0TuQ6FkGJL8vD8nw/q5KiL3DS1KKBI3QhI9UQhpJ5dc7AtqfbXWuOgLCQ=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki": ["shiki@3.23.0", "", { "dependencies": { "@shikijs/core": "3.23.0", "@shikijs/engine-javascript": "3.23.0", "@shikijs/engine-oniguruma": "3.23.0", "@shikijs/langs": "3.23.0", "@shikijs/themes": "3.23.0", "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA=="],
+
+    "@astrojs/starlight/@astrojs/mdx/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
+
+    "@babel/generator/@babel/types/@babel/helper-string-parser": ["@babel/helper-string-parser@8.0.0-rc.6", "", {}, "sha512-BCkFy+zN6kXQed3YOT7aJl93NfDSzQc3pBfsvTVPs9gU9X3V0aefEF5kwBT0E+mDWH9QgKaZstYUQN9VdQZT4g=="],
+
+    "@babel/generator/@babel/types/@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@8.0.0-rc.6", "", {}, "sha512-nVJ+1JcCgntv8d78rRo++o2wuODT0Irknx2BF8Np4Ft2CRgjLqIs4qzSZ8b66yGbBdMWGmZBO9WEZv1hhNiSpg=="],
+
+    "@effect/sql-pg/pg-types/postgres-array": ["postgres-array@3.0.4", "", {}, "sha512-nAUSGfSDGOaOAEGwqsRY27GPOea7CNipJPOA7lPbdEpx5Kg3qzdP0AaWC5MlhTWV9s4hFX39nomVZ+C4tnGOJQ=="],
+
+    "@effect/sql-pg/pg-types/postgres-bytea": ["postgres-bytea@3.0.0", "", { "dependencies": { "obuf": "~1.1.2" } }, "sha512-CNd4jim9RFPkObHSjVHlVrxoVQXz7quwNFpz7RY1okNNme49+sVyiTvTRobiLV548Hx/hb1BG+iE7h9493WzFw=="],
+
+    "@effect/sql-pg/pg-types/postgres-date": ["postgres-date@2.1.0", "", {}, "sha512-K7Juri8gtgXVcDfZttFKVmhglp7epKb1K4pgrkLxehjqkrgPhfG6OO8LHLkfaqkbpjNRnra018XwAr1yQFWGcA=="],
+
+    "@effect/sql-pg/pg-types/postgres-interval": ["postgres-interval@3.0.0", "", {}, "sha512-BSNDnbyZCXSxgA+1f5UU2GmwhoI0aU5yMxRGO8CdFEcY2BQF9xm/7MqKnYoM1nJDk8nONNWDk9WeSmePFhQdlw=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/core": ["@shikijs/core@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.4" } }, "sha512-aHt9eiGFobmWR5uqJUViySI1bHMqrAgamWE1TYSUoftkAeCCAiGawPMwM+VCadylQtF4V3VNOZ5LmfItH5f3yA=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-1nWINwKXxKKLqPibT5f4pAFLej9oZzQTsby8942OTlsJzOBZ0MWKiwzMsd+jhzu8YPCHAswGnnN1YtQfirL35g=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/langs": ["@shikijs/langs@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-2Ep4W3Re5aB1/62RSYQInK9mM3HsLeB91cHqznAJMuylqjzNVAVCMnNWRHFtcNHXsoNRayP9z1qj4Sq3nMqYXg=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/themes": ["@shikijs/themes@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-5qySYa1ZgAT18HR/ypENL9cUSGOeI2x+4IvYJu4JgVJdizn6kG4ia5Q1jDEOi7gTbN4RbuYtmHh0W3eccOrjMA=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/types": ["@shikijs/types@3.23.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ=="],
+
+    "@isaacs/cliui/string-width/emoji-regex": ["emoji-regex@9.2.2", "", {}, "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="],
+
+    "@mapbox/node-pre-gyp/tar/chownr": ["chownr@3.0.0", "", {}, "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g=="],
+
+    "@mapbox/node-pre-gyp/tar/minizlib": ["minizlib@3.1.0", "", { "dependencies": { "minipass": "^7.1.2" } }, "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw=="],
+
+    "@mapbox/node-pre-gyp/tar/yallist": ["yallist@5.0.0", "", {}, "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw=="],
+
+    "@octokit/action/@octokit/core/@octokit/auth-token": ["@octokit/auth-token@4.0.0", "", {}, "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA=="],
+
+    "@octokit/action/@octokit/core/@octokit/graphql": ["@octokit/graphql@7.1.1", "", { "dependencies": { "@octokit/request": "^8.4.1", "@octokit/types": "^13.0.0", "universal-user-agent": "^6.0.0" } }, "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g=="],
+
+    "@octokit/action/@octokit/core/@octokit/request": ["@octokit/request@8.4.1", "", { "dependencies": { "@octokit/endpoint": "^9.0.6", "@octokit/request-error": "^5.1.1", "@octokit/types": "^13.1.0", "universal-user-agent": "^6.0.0" } }, "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw=="],
+
+    "@octokit/action/@octokit/core/@octokit/request-error": ["@octokit/request-error@5.1.1", "", { "dependencies": { "@octokit/types": "^13.1.0", "deprecation": "^2.0.0", "once": "^1.4.0" } }, "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g=="],
+
+    "@octokit/action/@octokit/core/@octokit/types": ["@octokit/types@13.10.0", "", { "dependencies": { "@octokit/openapi-types": "^24.2.0" } }, "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA=="],
+
+    "@octokit/action/@octokit/core/before-after-hook": ["before-after-hook@2.2.3", "", {}, "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="],
+
+    "@octokit/action/@octokit/core/universal-user-agent": ["universal-user-agent@6.0.1", "", {}, "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ=="],
+
+    "@octokit/auth-action/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@24.2.0", "", {}, "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg=="],
+
+    "@octokit/core/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@octokit/endpoint/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@octokit/graphql/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@octokit/plugin-paginate-rest/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@octokit/plugin-rest-endpoint-methods/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@octokit/request-error/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@octokit/request/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="],
+
+    "@solidjs/start/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
+
+    "@solidjs/start/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.25.12", "", { "os": "android", "cpu": "arm" }, "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg=="],
+
+    "@solidjs/start/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.25.12", "", { "os": "android", "cpu": "arm64" }, "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg=="],
+
+    "@solidjs/start/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.25.12", "", { "os": "android", "cpu": "x64" }, "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg=="],
+
+    "@solidjs/start/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.25.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg=="],
+
+    "@solidjs/start/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.25.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA=="],
+
+    "@solidjs/start/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.25.12", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg=="],
+
+    "@solidjs/start/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.25.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.25.12", "", { "os": "linux", "cpu": "arm" }, "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.25.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.25.12", "", { "os": "linux", "cpu": "ia32" }, "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.25.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.25.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg=="],
+
+    "@solidjs/start/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.25.12", "", { "os": "linux", "cpu": "x64" }, "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw=="],
+
+    "@solidjs/start/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg=="],
+
+    "@solidjs/start/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.25.12", "", { "os": "none", "cpu": "x64" }, "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ=="],
+
+    "@solidjs/start/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.25.12", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A=="],
+
+    "@solidjs/start/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.25.12", "", { "os": "openbsd", "cpu": "x64" }, "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw=="],
+
+    "@solidjs/start/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg=="],
+
+    "@solidjs/start/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.25.12", "", { "os": "sunos", "cpu": "x64" }, "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w=="],
+
+    "@solidjs/start/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.25.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg=="],
+
+    "@solidjs/start/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.25.12", "", { "os": "win32", "cpu": "ia32" }, "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ=="],
+
+    "@solidjs/start/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.25.12", "", { "os": "win32", "cpu": "x64" }, "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA=="],
+
+    "@solidjs/start/vite/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+
+    "@tanstack/directive-functions-plugin/@tanstack/router-utils/@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+
+    "@tanstack/router-plugin/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "@typescript/analyze-trace/chalk/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "@typescript/analyze-trace/p-limit/yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+
+    "@typescript/analyze-trace/yargs/cliui": ["cliui@7.0.4", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.0", "wrap-ansi": "^7.0.0" } }, "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ=="],
+
+    "@typescript/analyze-trace/yargs/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "@typescript/analyze-trace/yargs/yargs-parser": ["yargs-parser@20.2.9", "", {}, "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w=="],
+
+    "@vue-macros/common/@vue/compiler-sfc/@vue/compiler-core": ["@vue/compiler-core@3.5.35", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/shared": "3.5.35", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-BUmHaR1J+O+CKZ9uJucdVTEr1LHsdyvv7vG3eNRhK3CczEHeMd/LtsHAuD7PbrxvI2envCY2v7HI1vC1aBRzKw=="],
+
+    "@vue-macros/common/@vue/compiler-sfc/@vue/compiler-dom": ["@vue/compiler-dom@3.5.35", "", { "dependencies": { "@vue/compiler-core": "3.5.35", "@vue/shared": "3.5.35" } }, "sha512-k+bprkXxuqhVajgTx5mUHuir7TwQzUKOWR40ng1ncAqQRPnrLngGGgqVEEhOnTMlc8btHYVKmrP8s5Qyg0hvYA=="],
+
+    "@vue-macros/common/@vue/compiler-sfc/@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.35", "", { "dependencies": { "@vue/compiler-dom": "3.5.35", "@vue/shared": "3.5.35" } }, "sha512-rGhAeXgdM7/ffTJGXT69rCCdTmjDewnFuUZfBQQHTdcEBeWdT5HCGY60y2ytLJr9/Dsu7IntUi5z/w0h6Rjnzw=="],
+
+    "@vue-macros/common/@vue/compiler-sfc/@vue/shared": ["@vue/shared@3.5.35", "", {}, "sha512-zSbjL7gRXwks2ZQLRGCajBtBXEOXW9Ddhn/HvSdrGkE2dqGnumzW8XtusRrxrE9LvqtiqDXQ+A60Hp6mvdYxfA=="],
+
+    "@vue-macros/common/@vue/compiler-sfc/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc/@vue/compiler-core": ["@vue/compiler-core@3.5.35", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/shared": "3.5.35", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-BUmHaR1J+O+CKZ9uJucdVTEr1LHsdyvv7vG3eNRhK3CczEHeMd/LtsHAuD7PbrxvI2envCY2v7HI1vC1aBRzKw=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc/@vue/compiler-dom": ["@vue/compiler-dom@3.5.35", "", { "dependencies": { "@vue/compiler-core": "3.5.35", "@vue/shared": "3.5.35" } }, "sha512-k+bprkXxuqhVajgTx5mUHuir7TwQzUKOWR40ng1ncAqQRPnrLngGGgqVEEhOnTMlc8btHYVKmrP8s5Qyg0hvYA=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc/@vue/compiler-ssr": ["@vue/compiler-ssr@3.5.35", "", { "dependencies": { "@vue/compiler-dom": "3.5.35", "@vue/shared": "3.5.35" } }, "sha512-rGhAeXgdM7/ffTJGXT69rCCdTmjDewnFuUZfBQQHTdcEBeWdT5HCGY60y2ytLJr9/Dsu7IntUi5z/w0h6Rjnzw=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc/@vue/shared": ["@vue/shared@3.5.35", "", {}, "sha512-zSbjL7gRXwks2ZQLRGCajBtBXEOXW9Ddhn/HvSdrGkE2dqGnumzW8XtusRrxrE9LvqtiqDXQ+A60Hp6mvdYxfA=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "@vue/language-core/@vue/compiler-dom/@vue/compiler-core": ["@vue/compiler-core@3.5.35", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/shared": "3.5.35", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-BUmHaR1J+O+CKZ9uJucdVTEr1LHsdyvv7vG3eNRhK3CczEHeMd/LtsHAuD7PbrxvI2envCY2v7HI1vC1aBRzKw=="],
+
+    "ansi-align/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "ansi-align/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "ansi-align/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "archiver-utils/glob/minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
+
+    "archiver-utils/glob/path-scurry": ["path-scurry@1.11.1", "", { "dependencies": { "lru-cache": "^10.2.0", "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" } }, "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA=="],
+
+    "archiver-utils/readable-stream/buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
+
+    "archiver-utils/readable-stream/string_decoder": ["string_decoder@1.3.0", "", { "dependencies": { "safe-buffer": "~5.2.0" } }, "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA=="],
+
+    "archiver/readable-stream/buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
+
+    "archiver/readable-stream/string_decoder": ["string_decoder@1.3.0", "", { "dependencies": { "safe-buffer": "~5.2.0" } }, "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA=="],
+
+    "astro/@astrojs/markdown-remark/@astrojs/prism": ["@astrojs/prism@3.3.0", "", { "dependencies": { "prismjs": "^1.30.0" } }, "sha512-q8VwfU/fDZNoDOf+r7jUnMC2//H2l0TuQ6FkGJL8vD8nw/q5KiL3DS1KKBI3QhI9UQhpJ5dc7AtqfbXWuOgLCQ=="],
+
+    "astro/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+
+    "astro/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+
+    "astro/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+
+    "astro/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+
+    "astro/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+
+    "astro/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+
+    "astro/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+
+    "astro/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+
+    "astro/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+
+    "astro/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+
+    "astro/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+
+    "astro/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+
+    "astro/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+
+    "astro/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+
+    "astro/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+
+    "astro/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+
+    "astro/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+
+    "astro/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+
+    "astro/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+
+    "astro/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+
+    "astro/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+
+    "astro/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+
+    "astro/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+
+    "astro/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+
+    "astro/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+
+    "astro/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+
+    "astro/shiki/@shikijs/core": ["@shikijs/core@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA=="],
+
+    "astro/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.4" } }, "sha512-aHt9eiGFobmWR5uqJUViySI1bHMqrAgamWE1TYSUoftkAeCCAiGawPMwM+VCadylQtF4V3VNOZ5LmfItH5f3yA=="],
+
+    "astro/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-1nWINwKXxKKLqPibT5f4pAFLej9oZzQTsby8942OTlsJzOBZ0MWKiwzMsd+jhzu8YPCHAswGnnN1YtQfirL35g=="],
+
+    "astro/shiki/@shikijs/langs": ["@shikijs/langs@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-2Ep4W3Re5aB1/62RSYQInK9mM3HsLeB91cHqznAJMuylqjzNVAVCMnNWRHFtcNHXsoNRayP9z1qj4Sq3nMqYXg=="],
+
+    "astro/shiki/@shikijs/themes": ["@shikijs/themes@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-5qySYa1ZgAT18HR/ypENL9cUSGOeI2x+4IvYJu4JgVJdizn6kG4ia5Q1jDEOi7gTbN4RbuYtmHh0W3eccOrjMA=="],
+
+    "astro/shiki/@shikijs/types": ["@shikijs/types@3.23.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ=="],
+
+    "astro/vite/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
+
+    "c12/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "changelogen/c12/chokidar": ["chokidar@3.6.0", "", { "dependencies": { "anymatch": "~3.1.2", "braces": "~3.0.2", "glob-parent": "~5.1.2", "is-binary-path": "~2.1.0", "is-glob": "~4.0.1", "normalize-path": "~3.0.0", "readdirp": "~3.6.0" }, "optionalDependencies": { "fsevents": "~2.3.2" } }, "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw=="],
+
+    "changelogen/c12/confbox": ["confbox@0.1.8", "", {}, "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w=="],
+
+    "changelogen/c12/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
+
+    "changelogen/c12/giget": ["giget@1.2.5", "", { "dependencies": { "citty": "^0.1.6", "consola": "^3.4.0", "defu": "^6.1.4", "node-fetch-native": "^1.6.6", "nypm": "^0.5.4", "pathe": "^2.0.3", "tar": "^6.2.1" }, "bin": { "giget": "dist/cli.mjs" } }, "sha512-r1ekGw/Bgpi3HLV3h1MRBIlSAdHoIMklpaQ3OQLFcRw9PwAj2rqigvIbg+dBUI51OxVI2jsEtDywDBjSiuf7Ug=="],
+
+    "changelogen/c12/jiti": ["jiti@1.21.7", "", { "bin": { "jiti": "bin/jiti.js" } }, "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A=="],
+
+    "changelogen/c12/ohash": ["ohash@1.1.6", "", {}, "sha512-TBu7PtV8YkAZn0tSxobKY2n2aAQva936lhRrj6957aDaCf9IEtqsKbgMzXE/F/sjqYOwmrukeORHNLe5glk7Cg=="],
+
+    "changelogen/c12/perfect-debounce": ["perfect-debounce@1.0.0", "", {}, "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA=="],
+
+    "changelogen/c12/rc9": ["rc9@2.1.2", "", { "dependencies": { "defu": "^6.1.4", "destr": "^2.0.3" } }, "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg=="],
+
+    "cliui/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "cliui/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "cliui/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "cliui/wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "cloudflare-solid-ssr/vite/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+
+    "cloudflare-vue/@types/node/undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-android-arm-eabi": ["@oxfmt/binding-android-arm-eabi@0.42.0", "", { "os": "android", "cpu": "arm" }, "sha512-dsqPTYsozeokRjlrt/b4E7Pj0z3eS3Eg74TWQuuKbjY4VttBmA88rB7d50Xrd+TZ986qdXCNeZRPEzZHAe+jow=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-android-arm64": ["@oxfmt/binding-android-arm64@0.42.0", "", { "os": "android", "cpu": "arm64" }, "sha512-t+aAjHxcr5eOBphFHdg1ouQU9qmZZoRxnX7UOJSaTwSoKsb6TYezNKO0YbWytGXCECObRqNcUxPoPr0KaraAIg=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-darwin-arm64": ["@oxfmt/binding-darwin-arm64@0.42.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-ulpSEYMKg61C5bRMZinFHrKJYRoKGVbvMEXA5zM1puX3O9T6Q4XXDbft20yrDijpYWeuG59z3Nabt+npeTsM1A=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-darwin-x64": ["@oxfmt/binding-darwin-x64@0.42.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-ttxLKhQYPdFiM8I/Ri37cvqChE4Xa562nNOsZFcv1CKTVLeEozXjKuYClNvxkXmNlcF55nzM80P+CQkdFBu+uQ=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-freebsd-x64": ["@oxfmt/binding-freebsd-x64@0.42.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-Og7QS3yI3tdIKYZ58SXik0rADxIk2jmd+/YvuHRyKULWpG4V2fR5V4hvKm624Mc0cQET35waPXiCQWvjQEjwYQ=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-arm-gnueabihf": ["@oxfmt/binding-linux-arm-gnueabihf@0.42.0", "", { "os": "linux", "cpu": "arm" }, "sha512-jwLOw/3CW4H6Vxcry4/buQHk7zm9Ne2YsidzTL1kpiMe4qqrRCwev3dkyWe2YkFmP+iZCQ7zku4KwjcLRoh8ew=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-arm-musleabihf": ["@oxfmt/binding-linux-arm-musleabihf@0.42.0", "", { "os": "linux", "cpu": "arm" }, "sha512-XwXu2vkMtiq2h7tfvN+WA/9/5/1IoGAVCFPiiQUvcAuG3efR97KNcRGM8BetmbYouFotQ2bDal3yyjUx6IPsTg=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-arm64-gnu": ["@oxfmt/binding-linux-arm64-gnu@0.42.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-ea7s/XUJoT7ENAtUQDudFe3nkSM3e3Qpz4nJFRdzO2wbgXEcjnchKLEsV3+t4ev3r8nWxIYr9NRjPWtnyIFJVA=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-arm64-musl": ["@oxfmt/binding-linux-arm64-musl@0.42.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-+JA0YMlSdDqmacygGi2REp57c3fN+tzARD8nwsukx9pkCHK+6DkbAA9ojS4lNKsiBjIW8WWa0pBrBWhdZEqfuw=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-ppc64-gnu": ["@oxfmt/binding-linux-ppc64-gnu@0.42.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-VfnET0j4Y5mdfCzh5gBt0NK28lgn5DKx+8WgSMLYYeSooHhohdbzwAStLki9pNuGy51y4I7IoW8bqwAaCMiJQg=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-riscv64-gnu": ["@oxfmt/binding-linux-riscv64-gnu@0.42.0", "", { "os": "linux", "cpu": "none" }, "sha512-gVlCbmBkB0fxBWbhBj9rcxezPydsQHf4MFKeHoTSPicOQ+8oGeTQgQ8EeesSybWeiFPVRx3bgdt4IJnH6nOjAA=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-riscv64-musl": ["@oxfmt/binding-linux-riscv64-musl@0.42.0", "", { "os": "linux", "cpu": "none" }, "sha512-zN5OfstL0avgt/IgvRu0zjQzVh/EPkcLzs33E9LMAzpqlLWiPWeMDZyMGFlSRGOdDjuNmlZBCgj0pFnK5u32TQ=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-s390x-gnu": ["@oxfmt/binding-linux-s390x-gnu@0.42.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-9X6+H2L0qMc2sCAgO9HS03bkGLMKvOFjmEdchaFlany3vNZOjnVui//D8k/xZAtQv2vaCs1reD5KAgPoIU4msA=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-x64-gnu": ["@oxfmt/binding-linux-x64-gnu@0.42.0", "", { "os": "linux", "cpu": "x64" }, "sha512-BajxJ6KQvMMdpXGPWhBGyjb2Jvx4uec0w+wi6TJZ6Tv7+MzPwe0pO8g5h1U0jyFgoaF7mDl6yKPW3ykWcbUJRw=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-linux-x64-musl": ["@oxfmt/binding-linux-x64-musl@0.42.0", "", { "os": "linux", "cpu": "x64" }, "sha512-0wV284I6vc5f0AqAhgAbHU2935B4bVpncPoe5n/WzVZY/KnHgqxC8iSFGeSyLWEgstFboIcWkOPck7tqbdHkzA=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-openharmony-arm64": ["@oxfmt/binding-openharmony-arm64@0.42.0", "", { "os": "none", "cpu": "arm64" }, "sha512-p4BG6HpGnhfgHk1rzZfyR6zcWkE7iLrWxyehHfXUy4Qa5j3e0roglFOdP/Nj5cJJ58MA3isQ5dlfkW2nNEpolw=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-win32-arm64-msvc": ["@oxfmt/binding-win32-arm64-msvc@0.42.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-mn//WV60A+IetORDxYieYGAoQso4KnVRRjORDewMcod4irlRe0OSC7YPhhwaexYNPQz/GCFk+v9iUcZ2W22yxQ=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-win32-ia32-msvc": ["@oxfmt/binding-win32-ia32-msvc@0.42.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-3gWltUrvuz4LPJXWivoAxZ28Of2O4N7OGuM5/X3ubPXCEV8hmgECLZzjz7UYvSDUS3grfdccQwmjynm+51EFpw=="],
+
+    "cloudflare-vue/oxfmt/@oxfmt/binding-win32-x64-msvc": ["@oxfmt/binding-win32-x64-msvc@0.42.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Wg4TMAfQRL9J9AZevJ/ZNy3uyyDztDYQtGr4P8UyyzIhLhFrdSmz1J/9JT+rv0fiCDLaFOBQnj3f3K3+a5PzDQ=="],
+
+    "compress-commons/readable-stream/buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
+
+    "compress-commons/readable-stream/string_decoder": ["string_decoder@1.3.0", "", { "dependencies": { "safe-buffer": "~5.2.0" } }, "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA=="],
+
+    "crc32-stream/readable-stream/buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
+
+    "crc32-stream/readable-stream/string_decoder": ["string_decoder@1.3.0", "", { "dependencies": { "safe-buffer": "~5.2.0" } }, "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA=="],
+
+    "cross-spawn/which/isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
+
+    "csso/css-tree/mdn-data": ["mdn-data@2.0.28", "", {}, "sha512-aylIc7Z9y4yzHYAJNuESG3hfhC+0Ibp/MAMiaOZgNv4pmEdFyfZhhhny4MNiAfWdBQ1RQ2mfDWmM1x8SvGyp8g=="],
+
+    "cytoscape-fcose/cose-base/layout-base": ["layout-base@2.0.1", "", {}, "sha512-dp3s92+uNI1hWIpPGH3jK2kxE2lMjdXdr+DH8ynZHpd6PUlH6x6cbuXnoMmiNumznqaNO31xu9e79F0uuZ0JFg=="],
+
+    "d3-sankey/d3-shape/d3-path": ["d3-path@1.0.9", "", {}, "sha512-VLaYcn81dtHVTjEHd8B+pbe9yHWpXKZUC87PzoFmsFrJqgFwDe/qxfp5MlfsfM1V5E/iVt0MmEbWQ7FVIXh/bg=="],
+
+    "drizzle-kit/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
+
+    "drizzle-kit/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.25.12", "", { "os": "android", "cpu": "arm" }, "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg=="],
+
+    "drizzle-kit/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.25.12", "", { "os": "android", "cpu": "arm64" }, "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg=="],
+
+    "drizzle-kit/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.25.12", "", { "os": "android", "cpu": "x64" }, "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg=="],
+
+    "drizzle-kit/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.25.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg=="],
+
+    "drizzle-kit/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.25.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA=="],
+
+    "drizzle-kit/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.25.12", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg=="],
+
+    "drizzle-kit/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.25.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.25.12", "", { "os": "linux", "cpu": "arm" }, "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.25.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.25.12", "", { "os": "linux", "cpu": "ia32" }, "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.25.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.25.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg=="],
+
+    "drizzle-kit/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.25.12", "", { "os": "linux", "cpu": "x64" }, "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw=="],
+
+    "drizzle-kit/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg=="],
+
+    "drizzle-kit/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.25.12", "", { "os": "none", "cpu": "x64" }, "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ=="],
+
+    "drizzle-kit/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.25.12", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A=="],
+
+    "drizzle-kit/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.25.12", "", { "os": "openbsd", "cpu": "x64" }, "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw=="],
+
+    "drizzle-kit/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg=="],
+
+    "drizzle-kit/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.25.12", "", { "os": "sunos", "cpu": "x64" }, "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w=="],
+
+    "drizzle-kit/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.25.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg=="],
+
+    "drizzle-kit/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.25.12", "", { "os": "win32", "cpu": "ia32" }, "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ=="],
+
+    "drizzle-kit/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.25.12", "", { "os": "win32", "cpu": "x64" }, "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA=="],
+
+    "example-basic/vite/esbuild": ["esbuild@0.27.7", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.7", "@esbuild/android-arm": "0.27.7", "@esbuild/android-arm64": "0.27.7", "@esbuild/android-x64": "0.27.7", "@esbuild/darwin-arm64": "0.27.7", "@esbuild/darwin-x64": "0.27.7", "@esbuild/freebsd-arm64": "0.27.7", "@esbuild/freebsd-x64": "0.27.7", "@esbuild/linux-arm": "0.27.7", "@esbuild/linux-arm64": "0.27.7", "@esbuild/linux-ia32": "0.27.7", "@esbuild/linux-loong64": "0.27.7", "@esbuild/linux-mips64el": "0.27.7", "@esbuild/linux-ppc64": "0.27.7", "@esbuild/linux-riscv64": "0.27.7", "@esbuild/linux-s390x": "0.27.7", "@esbuild/linux-x64": "0.27.7", "@esbuild/netbsd-arm64": "0.27.7", "@esbuild/netbsd-x64": "0.27.7", "@esbuild/openbsd-arm64": "0.27.7", "@esbuild/openbsd-x64": "0.27.7", "@esbuild/openharmony-arm64": "0.27.7", "@esbuild/sunos-x64": "0.27.7", "@esbuild/win32-arm64": "0.27.7", "@esbuild/win32-ia32": "0.27.7", "@esbuild/win32-x64": "0.27.7" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w=="],
+
+    "fs-minipass/minipass/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="],
+
+    "listhen/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "nitropack/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "nitropack/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "nitropack/youch/@poppinss/dumper": ["@poppinss/dumper@0.7.0", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@sindresorhus/is": "^7.0.2", "supports-color": "^10.0.0" } }, "sha512-0UTYalzk2t6S4rA2uHOz5bSSW2CHdv4vggJI6Alg90yvl0UgXs6XSXpH96OH+bRkX4J/06djv29pqXJ0lq5Kag=="],
+
+    "nitropack/youch/cookie-es": ["cookie-es@3.1.1", "", {}, "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg=="],
+
+    "p-locate/p-limit/yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+
+    "readdir-glob/minimatch/brace-expansion": ["brace-expansion@2.1.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA=="],
+
+    "rollup-plugin-visualizer/open/wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
+
+    "rollup-plugin-visualizer/yargs/cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
+
+    "rollup-plugin-visualizer/yargs/string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="],
+
+    "rollup-plugin-visualizer/yargs/yargs-parser": ["yargs-parser@22.0.0", "", {}, "sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw=="],
+
+    "sitemap/@types/node/undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
+
+    "starlight-blog/@astrojs/markdown-remark/@astrojs/internal-helpers": ["@astrojs/internal-helpers@0.7.6", "", {}, "sha512-GOle7smBWKfMSP8osUIGOlB5kaHdQLV3foCsf+5Q9Wsuu+C6Fs3Ez/ttXmhjZ1HkSgsogcM1RXSjjOVieHq16Q=="],
+
+    "starlight-blog/@astrojs/markdown-remark/@astrojs/prism": ["@astrojs/prism@3.3.0", "", { "dependencies": { "prismjs": "^1.30.0" } }, "sha512-q8VwfU/fDZNoDOf+r7jUnMC2//H2l0TuQ6FkGJL8vD8nw/q5KiL3DS1KKBI3QhI9UQhpJ5dc7AtqfbXWuOgLCQ=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki": ["shiki@3.23.0", "", { "dependencies": { "@shikijs/core": "3.23.0", "@shikijs/engine-javascript": "3.23.0", "@shikijs/engine-oniguruma": "3.23.0", "@shikijs/langs": "3.23.0", "@shikijs/themes": "3.23.0", "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-55Dj73uq9ZXL5zyeRPzHQsK7Nbyt6Y10k5s7OjuFZGMhpp4r/rsLBH0o/0fstIzX1Lep9VxefWljK/SKCzygIA=="],
+
+    "starlight-blog/@astrojs/mdx/es-module-lexer": ["es-module-lexer@1.7.0", "", {}, "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA=="],
+
+    "string-width-cjs/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "tsdown/rolldown/@oxc-project/types": ["@oxc-project/types@0.95.0", "", {}, "sha512-vACy7vhpMPhjEJhULNxrdR0D943TkA/MigMpJCHmBHvMXxRStRi/dPtTlfQ3uDwWSzRpT8z+7ImjZVf8JWBocQ=="],
+
+    "tsdown/rolldown/@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.0-beta.45", "", { "os": "android", "cpu": "arm64" }, "sha512-bfgKYhFiXJALeA/riil908+2vlyWGdwa7Ju5S+JgWZYdR4jtiPOGdM6WLfso1dojCh+4ZWeiTwPeV9IKQEX+4g=="],
+
+    "tsdown/rolldown/@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.0-beta.45", "", { "os": "darwin", "cpu": "arm64" }, "sha512-xjCv4CRVsSnnIxTuyH1RDJl5OEQ1c9JYOwfDAHddjJDxCw46ZX9q80+xq7Eok7KC4bRSZudMJllkvOKv0T9SeA=="],
+
+    "tsdown/rolldown/@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.0-beta.45", "", { "os": "darwin", "cpu": "x64" }, "sha512-ddcO9TD3D/CLUa/l8GO8LHzBOaZqWg5ClMy3jICoxwCuoz47h9dtqPsIeTiB6yR501LQTeDsjA4lIFd7u3Ljfw=="],
+
+    "tsdown/rolldown/@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.0-beta.45", "", { "os": "freebsd", "cpu": "x64" }, "sha512-MBTWdrzW9w+UMYDUvnEuh0pQvLENkl2Sis15fHTfHVW7ClbGuez+RWopZudIDEGkpZXdeI4CkRXk+vdIIebrmg=="],
+
+    "tsdown/rolldown/@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.0-beta.45", "", { "os": "linux", "cpu": "arm" }, "sha512-4YgoCFiki1HR6oSg+GxxfzfnVCesQxLF1LEnw9uXS/MpBmuog0EOO2rYfy69rWP4tFZL9IWp6KEfGZLrZ7aUog=="],
+
+    "tsdown/rolldown/@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.0-beta.45", "", { "os": "linux", "cpu": "arm64" }, "sha512-LE1gjAwQRrbCOorJJ7LFr10s5vqYf5a00V5Ea9wXcT2+56n5YosJkcp8eQ12FxRBv2YX8dsdQJb+ZTtYJwb6XQ=="],
+
+    "tsdown/rolldown/@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.0-beta.45", "", { "os": "linux", "cpu": "arm64" }, "sha512-tdy8ThO/fPp40B81v0YK3QC+KODOmzJzSUOO37DinQxzlTJ026gqUSOM8tzlVixRbQJltgVDCTYF8HNPRErQTA=="],
+
+    "tsdown/rolldown/@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.0-beta.45", "", { "os": "linux", "cpu": "x64" }, "sha512-lS082ROBWdmOyVY/0YB3JmsiClaWoxvC+dA8/rbhyB9VLkvVEaihLEOr4CYmrMse151C4+S6hCw6oa1iewox7g=="],
+
+    "tsdown/rolldown/@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.0-beta.45", "", { "os": "linux", "cpu": "x64" }, "sha512-Hi73aYY0cBkr1/SvNQqH8Cd+rSV6S9RB5izCv0ySBcRnd/Wfn5plguUoGYwBnhHgFbh6cPw9m2dUVBR6BG1gxA=="],
+
+    "tsdown/rolldown/@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.0-beta.45", "", { "os": "none", "cpu": "arm64" }, "sha512-fljEqbO7RHHogNDxYtTzr+GNjlfOx21RUyGmF+NrkebZ8emYYiIqzPxsaMZuRx0rgZmVmliOzEp86/CQFDKhJQ=="],
+
+    "tsdown/rolldown/@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.0-beta.45", "", { "dependencies": { "@napi-rs/wasm-runtime": "^1.0.7" }, "cpu": "none" }, "sha512-ZJDB7lkuZE9XUnWQSYrBObZxczut+8FZ5pdanm8nNS1DAo8zsrPuvGwn+U3fwU98WaiFsNrA4XHngesCGr8tEQ=="],
+
+    "tsdown/rolldown/@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.0-beta.45", "", { "os": "win32", "cpu": "arm64" }, "sha512-zyzAjItHPUmxg6Z8SyRhLdXlJn3/D9KL5b9mObUrBHhWS/GwRH4665xCiFqeuktAhhWutqfc+rOV2LjK4VYQGQ=="],
+
+    "tsdown/rolldown/@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.0-beta.45", "", { "os": "win32", "cpu": "x64" }, "sha512-wiU40G1nQo9rtfvF9jLbl79lUgjfaD/LTyUEw2Wg/gdF5OhjzpKMVugZQngO+RNdwYaNj+Fs+kWBWfp4VXPMHA=="],
+
+    "tsdown/rolldown/@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.0-beta.45", "", {}, "sha512-Le9ulGCrD8ggInzWw/k2J8QcbPz7eGIOWqfJ2L+1R0Opm7n6J37s2hiDWlh6LJN0Lk9L5sUzMvRHKW7UxBZsQA=="],
+
+    "unstorage/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "unstorage/h3/cookie-es": ["cookie-es@1.2.3", "", {}, "sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw=="],
+
+    "vite-plugin-inspect/open/wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
+
+    "vite-plugin-vue-inspector/@vue/compiler-dom/@vue/compiler-core": ["@vue/compiler-core@3.5.35", "", { "dependencies": { "@babel/parser": "^7.29.3", "@vue/shared": "3.5.35", "entities": "^7.0.1", "estree-walker": "^2.0.2", "source-map-js": "^1.2.1" } }, "sha512-BUmHaR1J+O+CKZ9uJucdVTEr1LHsdyvv7vG3eNRhK3CczEHeMd/LtsHAuD7PbrxvI2envCY2v7HI1vC1aBRzKw=="],
+
+    "vite-plugin-vue-inspector/@vue/compiler-dom/@vue/shared": ["@vue/shared@3.5.35", "", {}, "sha512-zSbjL7gRXwks2ZQLRGCajBtBXEOXW9Ddhn/HvSdrGkE2dqGnumzW8XtusRrxrE9LvqtiqDXQ+A60Hp6mvdYxfA=="],
+
+    "vite/rolldown/@oxc-project/types": ["@oxc-project/types@0.132.0", "", {}, "sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ=="],
+
+    "vite/rolldown/@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.2", "", { "os": "android", "cpu": "arm64" }, "sha512-ZS4D1JPGn/MYQN/SYDWftIE/nVsM8j/AFOYEzAoOE2O3NktQOZru+/vYXGbR/qtdLdIfGCP0lcoJiYVzsEz+iQ=="],
+
+    "vite/rolldown/@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-vdFA9+C/rekyGce7WqHs/xoT0ioZEWaOFyZLIV1mEeNFaFDUQrPIo8Vs2GvJ6eetb3rzDUtUBgzto3ExpXJB3w=="],
+
+    "vite/rolldown/@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.0.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-BewSOwTHazv77DTYiAZXSqqKZ4KP/KonFisDMVU7PImxoWfB2aepnPhd2E4SWz3zDzYgDNbs6jBmTdgNnF02GA=="],
+
+    "vite/rolldown/@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.0.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-m41o7M0YWtUdqk61Tb+jnKb2rN++iRdIASlExkUoKfIAH30DOHCB8fVLzSUpbWHHU8esmEioY62PxzexE8MBuA=="],
+
+    "vite/rolldown/@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.0.2", "", { "os": "linux", "cpu": "arm" }, "sha512-jcojB9H7W/jS29pMKWAK1N+fU99vXodHDTatS3b3y/XSOCiHo0kkA74pL3jJmkoQtYpOCxDvaKs1fo2Ij/1X5w=="],
+
+    "vite/rolldown/@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.0.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-1jn6qDU5iiOgFgygDzKUuKP0maTi0/f1+sBLgvij/76C77Nm3ts6ufz9Bjg5q5dduxiUIxtq86JIoBvo1xQ4Ig=="],
+
+    "vite/rolldown/@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.0.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-QVLO/czFMdoMFSqlX3bcswcJNm/23r+qoa/jgtmFc/qEp6/jXmIkDjF/XIo8dPfGaiwy1xfQn8o77L79GeXFgw=="],
+
+    "vite/rolldown/@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.0.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-hgO5Abm0w5UL6FEa2iFnZqo2KlK7TQ5QhV5x09hujBf7t5KzHQ1VmfPuTpqRy/rNlSxua3eWH374xxiVrP+lcA=="],
+
+    "vite/rolldown/@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.0.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-fy8rXxuYEu602abC8MUNaPjYLIFzReOaEIEMKMUa0rFEUxNpVXhs15KSSQ4qlqSaM7B6rcj9rDZgADh/IGDzLQ=="],
+
+    "vite/rolldown/@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.0.2", "", { "os": "linux", "cpu": "x64" }, "sha512-0+bOkiQ779+r1WpoHOWHqncvyySci0vKph+myNDYb+im6meJAzHQXay6oEgnkHuUGouM1LKTZwqKpBow6Kj7CQ=="],
+
+    "vite/rolldown/@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.0.2", "", { "os": "linux", "cpu": "x64" }, "sha512-mjSkrzZK5Qsl0a9d1JgILOiuZOSDTVdKENcSXBoqbzSrspLR/4/IRVDo5wd2GgZjNss/viBFJdeq+j7qH2nypw=="],
+
+    "vite/rolldown/@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.0.2", "", { "os": "none", "cpu": "arm64" }, "sha512-1v5vHasdfQAZoEHakBV72LIFAC9JjnymsiKxp+GEr/ma3+NJCPSaYK+qavInOovJkgwFrs7GccX2d6IgDA3Z5w=="],
+
+    "vite/rolldown/@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.0.2", "", { "dependencies": { "@emnapi/core": "1.10.0", "@emnapi/runtime": "1.10.0", "@napi-rs/wasm-runtime": "^1.1.4" }, "cpu": "none" }, "sha512-mb1VobWn6NheziTk5/WEaR6AKVbrwT5sOi6C7zk3gy/pD1qtJfU1j4PgTo2NJnOtbL9Dl3Aeei8w9jJ7qC2jZQ=="],
+
+    "vite/rolldown/@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.0.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-SqKonF56vA/L2yHwHYcEp2P34URpOZ7d1fS635cTkpDnUtEGdUbhI6NzsPdqeSWvAAeGDrxjWjNmibDIdFf9/A=="],
+
+    "vite/rolldown/@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.0.2", "", { "os": "win32", "cpu": "x64" }, "sha512-v7qRI7gXLRINcOGXt+7YmAZ6iFuyZVMIoXAxhd8oP+DR9dLfL9GfNIx7PLMxmhZdvq8waUJBQiWN9EKNy+TRBQ=="],
+
+    "vue-router/chokidar/readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+
+    "wrangler/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.3", "", { "os": "aix", "cpu": "ppc64" }, "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg=="],
+
+    "wrangler/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.3", "", { "os": "android", "cpu": "arm" }, "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA=="],
+
+    "wrangler/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.3", "", { "os": "android", "cpu": "arm64" }, "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg=="],
+
+    "wrangler/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.3", "", { "os": "android", "cpu": "x64" }, "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ=="],
+
+    "wrangler/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg=="],
+
+    "wrangler/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg=="],
+
+    "wrangler/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.3", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w=="],
+
+    "wrangler/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.3", "", { "os": "freebsd", "cpu": "x64" }, "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA=="],
+
+    "wrangler/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.3", "", { "os": "linux", "cpu": "arm" }, "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw=="],
+
+    "wrangler/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg=="],
+
+    "wrangler/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.3", "", { "os": "linux", "cpu": "ia32" }, "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg=="],
+
+    "wrangler/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA=="],
+
+    "wrangler/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw=="],
+
+    "wrangler/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA=="],
+
+    "wrangler/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.3", "", { "os": "linux", "cpu": "none" }, "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ=="],
+
+    "wrangler/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw=="],
+
+    "wrangler/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.3", "", { "os": "linux", "cpu": "x64" }, "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA=="],
+
+    "wrangler/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA=="],
+
+    "wrangler/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.3", "", { "os": "none", "cpu": "x64" }, "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA=="],
+
+    "wrangler/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.3", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw=="],
+
+    "wrangler/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.3", "", { "os": "openbsd", "cpu": "x64" }, "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ=="],
+
+    "wrangler/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.3", "", { "os": "none", "cpu": "arm64" }, "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g=="],
+
+    "wrangler/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.3", "", { "os": "sunos", "cpu": "x64" }, "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA=="],
+
+    "wrangler/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA=="],
+
+    "wrangler/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q=="],
+
+    "wrangler/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="],
+
+    "wrap-ansi-cjs/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "wrap-ansi-cjs/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "wrap-ansi-cjs/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "yaml-language-server/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
+
+    "yargs/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "yargs/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "yargs/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "zip-stream/readable-stream/buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
+
+    "zip-stream/readable-stream/string_decoder": ["string_decoder@1.3.0", "", { "dependencies": { "safe-buffer": "~5.2.0" } }, "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/engine-javascript/oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+
+    "@astrojs/react/vite/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/core": ["@shikijs/core@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.4" } }, "sha512-aHt9eiGFobmWR5uqJUViySI1bHMqrAgamWE1TYSUoftkAeCCAiGawPMwM+VCadylQtF4V3VNOZ5LmfItH5f3yA=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-1nWINwKXxKKLqPibT5f4pAFLej9oZzQTsby8942OTlsJzOBZ0MWKiwzMsd+jhzu8YPCHAswGnnN1YtQfirL35g=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/langs": ["@shikijs/langs@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-2Ep4W3Re5aB1/62RSYQInK9mM3HsLeB91cHqznAJMuylqjzNVAVCMnNWRHFtcNHXsoNRayP9z1qj4Sq3nMqYXg=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/themes": ["@shikijs/themes@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-5qySYa1ZgAT18HR/ypENL9cUSGOeI2x+4IvYJu4JgVJdizn6kG4ia5Q1jDEOi7gTbN4RbuYtmHh0W3eccOrjMA=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/types": ["@shikijs/types@3.23.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/engine-javascript/oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "@octokit/action/@octokit/core/@octokit/request/@octokit/endpoint": ["@octokit/endpoint@9.0.6", "", { "dependencies": { "@octokit/types": "^13.1.0", "universal-user-agent": "^6.0.0" } }, "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw=="],
+
+    "@octokit/action/@octokit/core/@octokit/types/@octokit/openapi-types": ["@octokit/openapi-types@24.2.0", "", {}, "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+
+    "@solidjs/start/vite/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+
+    "@solidjs/vite-plugin-nitro-2/vite/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+
+    "@typescript/analyze-trace/yargs/cliui/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "@typescript/analyze-trace/yargs/cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+
+    "@typescript/analyze-trace/yargs/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "@typescript/analyze-trace/yargs/string-width/is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "@typescript/analyze-trace/yargs/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "@vue-macros/common/@vue/compiler-sfc/@vue/compiler-core/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "@vue/babel-plugin-resolve-type/@vue/compiler-sfc/@vue/compiler-core/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "@vue/language-core/@vue/compiler-dom/@vue/compiler-core/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "@vue/language-core/@vue/compiler-dom/@vue/compiler-core/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "ansi-align/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "archiver-utils/glob/minimatch/brace-expansion": ["brace-expansion@2.1.1", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA=="],
+
+    "archiver-utils/glob/path-scurry/lru-cache": ["lru-cache@10.4.3", "", {}, "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="],
+
+    "archiver-utils/readable-stream/buffer/base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "archiver-utils/readable-stream/string_decoder/safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
+
+    "archiver/readable-stream/buffer/base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "archiver/readable-stream/string_decoder/safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
+
+    "astro/shiki/@shikijs/engine-javascript/oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "astro/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
+
+    "astro/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.25.12", "", { "os": "android", "cpu": "arm" }, "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg=="],
+
+    "astro/vite/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.25.12", "", { "os": "android", "cpu": "arm64" }, "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg=="],
+
+    "astro/vite/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.25.12", "", { "os": "android", "cpu": "x64" }, "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg=="],
+
+    "astro/vite/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.25.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg=="],
+
+    "astro/vite/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.25.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA=="],
+
+    "astro/vite/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.25.12", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg=="],
+
+    "astro/vite/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.25.12", "", { "os": "freebsd", "cpu": "x64" }, "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ=="],
+
+    "astro/vite/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.25.12", "", { "os": "linux", "cpu": "arm" }, "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw=="],
+
+    "astro/vite/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.25.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ=="],
+
+    "astro/vite/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.25.12", "", { "os": "linux", "cpu": "ia32" }, "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA=="],
+
+    "astro/vite/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng=="],
+
+    "astro/vite/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw=="],
+
+    "astro/vite/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.25.12", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA=="],
+
+    "astro/vite/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.25.12", "", { "os": "linux", "cpu": "none" }, "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w=="],
+
+    "astro/vite/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.25.12", "", { "os": "linux", "cpu": "s390x" }, "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg=="],
+
+    "astro/vite/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.25.12", "", { "os": "linux", "cpu": "x64" }, "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw=="],
+
+    "astro/vite/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg=="],
+
+    "astro/vite/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.25.12", "", { "os": "none", "cpu": "x64" }, "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ=="],
+
+    "astro/vite/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.25.12", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A=="],
+
+    "astro/vite/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.25.12", "", { "os": "openbsd", "cpu": "x64" }, "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw=="],
+
+    "astro/vite/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.25.12", "", { "os": "none", "cpu": "arm64" }, "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg=="],
+
+    "astro/vite/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.25.12", "", { "os": "sunos", "cpu": "x64" }, "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w=="],
+
+    "astro/vite/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.25.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg=="],
+
+    "astro/vite/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.25.12", "", { "os": "win32", "cpu": "ia32" }, "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ=="],
+
+    "astro/vite/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.25.12", "", { "os": "win32", "cpu": "x64" }, "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA=="],
+
+    "changelogen/c12/chokidar/readdirp": ["readdirp@3.6.0", "", { "dependencies": { "picomatch": "^2.2.1" } }, "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA=="],
+
+    "changelogen/c12/giget/citty": ["citty@0.1.6", "", { "dependencies": { "consola": "^3.2.3" } }, "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ=="],
+
+    "changelogen/c12/giget/pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+
+    "cloudflare-solid-ssr/vite/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+
+    "compress-commons/readable-stream/buffer/base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "compress-commons/readable-stream/string_decoder/safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
+
+    "crc32-stream/readable-stream/buffer/base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "crc32-stream/readable-stream/string_decoder/safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.27.7", "", { "os": "aix", "cpu": "ppc64" }, "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg=="],
+
+    "example-basic/vite/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.27.7", "", { "os": "android", "cpu": "arm" }, "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.27.7", "", { "os": "android", "cpu": "arm64" }, "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.27.7", "", { "os": "android", "cpu": "x64" }, "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg=="],
+
+    "example-basic/vite/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.7", "", { "os": "darwin", "cpu": "arm64" }, "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw=="],
+
+    "example-basic/vite/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.27.7", "", { "os": "darwin", "cpu": "x64" }, "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.27.7", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w=="],
+
+    "example-basic/vite/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.27.7", "", { "os": "freebsd", "cpu": "x64" }, "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.27.7", "", { "os": "linux", "cpu": "arm" }, "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.27.7", "", { "os": "linux", "cpu": "arm64" }, "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.27.7", "", { "os": "linux", "cpu": "ia32" }, "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.27.7", "", { "os": "linux", "cpu": "ppc64" }, "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.27.7", "", { "os": "linux", "cpu": "none" }, "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.27.7", "", { "os": "linux", "cpu": "s390x" }, "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw=="],
+
+    "example-basic/vite/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.27.7", "", { "os": "linux", "cpu": "x64" }, "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA=="],
+
+    "example-basic/vite/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w=="],
+
+    "example-basic/vite/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.27.7", "", { "os": "none", "cpu": "x64" }, "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw=="],
+
+    "example-basic/vite/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.27.7", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A=="],
+
+    "example-basic/vite/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.27.7", "", { "os": "openbsd", "cpu": "x64" }, "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg=="],
+
+    "example-basic/vite/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.27.7", "", { "os": "none", "cpu": "arm64" }, "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw=="],
+
+    "example-basic/vite/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.27.7", "", { "os": "sunos", "cpu": "x64" }, "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA=="],
+
+    "example-basic/vite/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.27.7", "", { "os": "win32", "cpu": "arm64" }, "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA=="],
+
+    "example-basic/vite/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.27.7", "", { "os": "win32", "cpu": "ia32" }, "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw=="],
+
+    "example-basic/vite/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.7", "", { "os": "win32", "cpu": "x64" }, "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg=="],
+
+    "nitropack/youch/@poppinss/dumper/supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="],
+
+    "readdir-glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/core": ["@shikijs/core@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.5" } }, "sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript": ["@shikijs/engine-javascript@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.4" } }, "sha512-aHt9eiGFobmWR5uqJUViySI1bHMqrAgamWE1TYSUoftkAeCCAiGawPMwM+VCadylQtF4V3VNOZ5LmfItH5f3yA=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-1nWINwKXxKKLqPibT5f4pAFLej9oZzQTsby8942OTlsJzOBZ0MWKiwzMsd+jhzu8YPCHAswGnnN1YtQfirL35g=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/langs": ["@shikijs/langs@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-2Ep4W3Re5aB1/62RSYQInK9mM3HsLeB91cHqznAJMuylqjzNVAVCMnNWRHFtcNHXsoNRayP9z1qj4Sq3nMqYXg=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/themes": ["@shikijs/themes@3.23.0", "", { "dependencies": { "@shikijs/types": "3.23.0" } }, "sha512-5qySYa1ZgAT18HR/ypENL9cUSGOeI2x+4IvYJu4JgVJdizn6kG4ia5Q1jDEOi7gTbN4RbuYtmHh0W3eccOrjMA=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/types": ["@shikijs/types@3.23.0", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.4" } }, "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ=="],
+
+    "vite-plugin-vue-inspector/@vue/compiler-dom/@vue/compiler-core/entities": ["entities@7.0.1", "", {}, "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA=="],
+
+    "vite-plugin-vue-inspector/@vue/compiler-dom/@vue/compiler-core/estree-walker": ["estree-walker@2.0.2", "", {}, "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="],
+
+    "yargs/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "zip-stream/readable-stream/buffer/base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
+
+    "zip-stream/readable-stream/string_decoder/safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "@astrojs/internal-helpers/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "@expressive-code/plugin-shiki/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+
+    "@typescript/analyze-trace/yargs/cliui/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "@typescript/analyze-trace/yargs/cliui/wrap-ansi/ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "@typescript/analyze-trace/yargs/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "archiver-utils/glob/minimatch/brace-expansion/balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
+
+    "astro/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "astro/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+
+    "changelogen/c12/chokidar/readdirp/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "@astrojs/starlight/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex": ["regex@6.1.0", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-6VwtthbV4o/7+OaAF9I5L5V3llLEsoPyq9P1JVXkedTP33c7MfCG0/5NOPcSJn0TzXcG9YUrR0gQSWioew3LDg=="],
+
+    "starlight-blog/@astrojs/markdown-remark/shiki/@shikijs/engine-javascript/oniguruma-to-es/regex-recursion": ["regex-recursion@6.0.2", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg=="],
+  }
+}
diff --git a/.repos/alchemy-effect/examples/aws-ec2/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-ec2/alchemy.run.ts
new file mode 100644
index 00000000000..af4cf02dc0e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ec2/alchemy.run.ts
@@ -0,0 +1,23 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import { NetworkLive } from "./src/Network.ts";
+import Server from "./src/Server.ts";
+
+const aws = AWS.providers();
+
+export default Alchemy.Stack(
+  "AwsEc2Example",
+  { providers: aws, state: Alchemy.localState() },
+  Effect.gen(function* () {
+    const instance = yield* Server;
+
+    return {
+      instanceId: instance.instanceId,
+      publicIpAddress: instance.publicIpAddress,
+      instanceUrl: Output.interpolate`http://${instance.publicIpAddress}:3000`,
+      enqueueExample: Output.interpolate`http://${instance.publicIpAddress}:3000/enqueue?message=hello`,
+    };
+  }).pipe(Effect.provide(NetworkLive)),
+);
diff --git a/.repos/alchemy-effect/examples/aws-ec2/package.json b/.repos/alchemy-effect/examples/aws-ec2/package.json
new file mode 100644
index 00000000000..5f040f52f29
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ec2/package.json
@@ -0,0 +1,23 @@
+{
+  "name": "aws-ec2-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-ec2"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-ec2/src/Network.ts b/.repos/alchemy-effect/examples/aws-ec2/src/Network.ts
new file mode 100644
index 00000000000..d8a1516e0d8
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ec2/src/Network.ts
@@ -0,0 +1,45 @@
+import * as AWS from "alchemy/AWS";
+import type { Output } from "alchemy/Output";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export interface ExampleNetwork {
+  network: AWS.EC2.Network;
+  publicSubnetIds: Output<AWS.EC2.SubnetId>[];
+  appSecurityGroupId: Output<AWS.EC2.SecurityGroupId>;
+}
+
+export class Network extends Context.Service<Network, ExampleNetwork>()(
+  "Network",
+) {}
+
+export const NetworkLive = Layer.effect(
+  Network,
+  Effect.gen(function* () {
+    const network = yield* AWS.EC2.Network("Network", {
+      cidrBlock: "10.42.0.0/16",
+      availabilityZones: 2,
+      nat: "single",
+    });
+
+    const appSecurityGroup = yield* AWS.EC2.SecurityGroup("AppSecurityGroup", {
+      vpcId: network.vpcId,
+      description: "Security group for the EC2 application instance",
+      ingress: [
+        {
+          ipProtocol: "tcp",
+          fromPort: 3000,
+          toPort: 3000,
+          cidrIpv4: "0.0.0.0/0",
+        },
+      ],
+    });
+
+    return {
+      network,
+      publicSubnetIds: network.publicSubnetIds,
+      appSecurityGroupId: appSecurityGroup.groupId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-ec2/src/Server.ts b/.repos/alchemy-effect/examples/aws-ec2/src/Server.ts
new file mode 100644
index 00000000000..6fc80675933
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ec2/src/Server.ts
@@ -0,0 +1,89 @@
+import * as AWS from "alchemy/AWS";
+import { SQSQueueEventSource } from "alchemy/Server/SQSQueueEventSource";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Network, NetworkLive } from "./Network.ts";
+
+export default class Server extends AWS.EC2.Instance<Server>()(
+  "ServerInstance",
+  Effect.gen(function* () {
+    const imageId = yield* AWS.EC2.amazonLinux();
+    const network = yield* Network;
+
+    return {
+      main: import.meta.filename,
+      imageId,
+      instanceType: "t3.small",
+      subnetId: network.publicSubnetIds[0],
+      securityGroupIds: [network.appSecurityGroupId],
+      associatePublicIpAddress: true,
+      port: 3000,
+    };
+  }),
+  Effect.gen(function* () {
+    const queue = yield* AWS.SQS.Queue("JobsQueue", {
+      receiveMessageWaitTimeSeconds: 20,
+      visibilityTimeout: 60,
+    });
+
+    yield* AWS.SQS.messages(queue).subscribe((stream) =>
+      stream.pipe(Stream.mapEffect(Effect.logInfo), Stream.runDrain),
+    );
+
+    const sendMessage = yield* AWS.SQS.SendMessage.bind(queue);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const url = new URL(request.originalUrl);
+
+        if (request.method === "GET" && url.pathname === "/") {
+          return yield* HttpServerResponse.json({
+            ok: true,
+            routes: ["GET /", "GET /enqueue?message=hello"],
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/enqueue") {
+          const message = url.searchParams.get("message") ?? "hello from EC2";
+          const body = JSON.stringify({
+            message,
+            enqueuedAt: new Date().toISOString(),
+          });
+
+          const result = yield* sendMessage({
+            MessageBody: body,
+          });
+
+          return yield* HttpServerResponse.json({
+            ok: true,
+            message,
+            messageId: result.MessageId,
+          });
+        }
+
+        return HttpServerResponse.text("Not found", { status: 404 });
+      }).pipe(
+        Effect.catch(() =>
+          Effect.succeed(
+            HttpServerResponse.text("Internal server error", { status: 500 }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(NetworkLive, SQSQueueEventSource),
+        Layer.mergeAll(
+          AWS.SQS.DeleteMessageBatchLive,
+          AWS.SQS.ReceiveMessageLive,
+          AWS.SQS.SendMessageLive,
+        ),
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-ec2/tsconfig.json b/.repos/alchemy-effect/examples/aws-ec2/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ec2/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-ecs/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-ecs/alchemy.run.ts
new file mode 100644
index 00000000000..78e98e0b503
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ecs/alchemy.run.ts
@@ -0,0 +1,80 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import QueueConsumerTask from "./src/QueueConsumerTask.ts";
+import ApiTask from "./src/Task.ts";
+
+const aws = AWS.providers();
+
+export default Alchemy.Stack(
+  "AwsEcsExample",
+  {
+    providers: aws,
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const network = yield* AWS.EC2.Network("ExampleNetwork", {
+      cidrBlock: "10.42.0.0/16",
+      availabilityZones: 2,
+    });
+
+    const serviceSecurityGroup = yield* AWS.EC2.SecurityGroup(
+      "ExampleServiceSecurityGroup",
+      {
+        vpcId: network.vpcId,
+        description: "Security group for the ECS example services",
+        ingress: [
+          {
+            ipProtocol: "tcp",
+            fromPort: 80,
+            toPort: 80,
+            cidrIpv4: "0.0.0.0/0",
+          },
+          {
+            ipProtocol: "tcp",
+            fromPort: 3000,
+            toPort: 3000,
+            cidrIpv4: "0.0.0.0/0",
+          },
+        ],
+      },
+    );
+
+    const queue = yield* AWS.SQS.Queue("ExampleJobsQueue", {
+      receiveMessageWaitTimeSeconds: 20,
+      visibilityTimeout: 60,
+    });
+
+    const cluster = yield* AWS.ECS.Cluster("ExampleCluster", {});
+    const apiTask = yield* ApiTask;
+    const queuePollerTask = yield* QueueConsumerTask;
+
+    const apiService = yield* AWS.ECS.Service("ExampleApiService", {
+      cluster,
+      task: apiTask,
+      vpcId: network.vpcId,
+      subnets: network.publicSubnetIds,
+      securityGroups: [serviceSecurityGroup.groupId],
+      assignPublicIp: true,
+      public: true,
+      healthCheckPath: "/",
+    });
+
+    yield* AWS.ECS.Service("ExampleQueuePollerService", {
+      cluster,
+      task: queuePollerTask,
+      vpcId: network.vpcId,
+      subnets: network.publicSubnetIds,
+      securityGroups: [serviceSecurityGroup.groupId],
+      assignPublicIp: true,
+      desiredCount: 1,
+    });
+
+    return {
+      url: apiService.url,
+      queueUrl: queue.queueUrl,
+      enqueueExample: Output.interpolate`${apiService.url}/enqueue?message=hello`,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-ecs/package.json b/.repos/alchemy-effect/examples/aws-ecs/package.json
new file mode 100644
index 00000000000..a5b313d4a76
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ecs/package.json
@@ -0,0 +1,23 @@
+{
+  "name": "aws-ecs-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-ecs"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-ecs/src/JobsQueue.ts b/.repos/alchemy-effect/examples/aws-ecs/src/JobsQueue.ts
new file mode 100644
index 00000000000..da588816dbb
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ecs/src/JobsQueue.ts
@@ -0,0 +1,16 @@
+import * as AWS from "alchemy/AWS";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+
+/**
+ * Deploy-time binding for the ECS example’s jobs queue. Provide with
+ * `Layer.succeed(ExampleJobsQueue, queue)` from the stack after the queue exists.
+ */
+export class JobsQueue extends Context.Service<JobsQueue, AWS.SQS.Queue>()(
+  "JobsQueue",
+) {}
+
+export const JobsQueueLive = Layer.effect(
+  JobsQueue,
+  AWS.SQS.Queue("JobsQueue"),
+);
diff --git a/.repos/alchemy-effect/examples/aws-ecs/src/QueueConsumerTask.ts b/.repos/alchemy-effect/examples/aws-ecs/src/QueueConsumerTask.ts
new file mode 100644
index 00000000000..3154ff749fc
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ecs/src/QueueConsumerTask.ts
@@ -0,0 +1,41 @@
+import * as AWS from "alchemy/AWS";
+import * as Server from "alchemy/Server";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { JobsQueue, JobsQueueLive } from "./JobsQueue.ts";
+
+export default class QueueConsumerTask extends AWS.ECS.Task<QueueConsumerTask>()(
+  "QueueConsumerTask",
+  {
+    main: import.meta.filename,
+    cpu: 256,
+    memory: 512,
+    taskRoleManagedPolicyArns: ["arn:aws:iam::aws:policy/AmazonSQSFullAccess"],
+  },
+  Effect.gen(function* () {
+    const queue = yield* JobsQueue;
+    yield* AWS.SQS.messages(queue, {
+      batchSize: 10,
+      maximumBatchingWindowInSeconds: 20,
+    }).subscribe((stream) =>
+      stream.pipe(
+        Stream.runForEach((record) =>
+          Effect.logInfo(
+            `processed SQS message ${record.messageId}: ${record.body ?? ""}`,
+          ),
+        ),
+      ),
+    );
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(Server.SQSQueueEventSource, JobsQueueLive),
+        Layer.mergeAll(
+          AWS.SQS.ReceiveMessageLive,
+          AWS.SQS.DeleteMessageBatchLive,
+        ),
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-ecs/src/Task.ts b/.repos/alchemy-effect/examples/aws-ecs/src/Task.ts
new file mode 100644
index 00000000000..1d8b080bad6
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ecs/src/Task.ts
@@ -0,0 +1,67 @@
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { JobsQueue, JobsQueueLive } from "./JobsQueue.ts";
+
+export default class ApiTask extends AWS.ECS.Task<ApiTask>()(
+  "ApiTask",
+  {
+    main: import.meta.filename,
+    cpu: 512,
+    memory: 1024,
+    port: 3000,
+  },
+  Effect.gen(function* () {
+    const queue = yield* JobsQueue;
+    const sendMessage = yield* AWS.SQS.SendMessage.bind(queue);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const url = new URL(request.originalUrl);
+        if (request.method === "GET" && url.pathname === "/") {
+          return yield* HttpServerResponse.json({
+            ok: true,
+            routes: ["GET /", "GET /enqueue?message=hello"],
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/enqueue") {
+          const message = url.searchParams.get("message") ?? "hello from ECS";
+          const body = JSON.stringify({
+            message,
+            enqueuedAt: new Date().toISOString(),
+          });
+
+          const result = yield* sendMessage({
+            MessageBody: body,
+          });
+
+          return yield* HttpServerResponse.json({
+            ok: true,
+            message,
+            messageId: result.MessageId,
+          });
+        }
+
+        return HttpServerResponse.text("Not found", { status: 404 });
+      }).pipe(
+        Effect.catch(() =>
+          Effect.succeed(
+            HttpServerResponse.text("Internal server error", { status: 500 }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        JobsQueueLive,
+        AWS.SQS.SendMessageLive,
+        AWS.SQS.DeleteMessageBatchLive,
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-ecs/tsconfig.json b/.repos/alchemy-effect/examples/aws-ecs/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-ecs/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-eks/README.md b/.repos/alchemy-effect/examples/aws-eks/README.md
new file mode 100644
index 00000000000..bc96e80e28f
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-eks/README.md
@@ -0,0 +1,55 @@
+# AWS EKS Auto Mode Example
+
+This example is fully TypeScript-driven. It provisions:
+
+- `AWS.EC2.Network`
+- `AWS.EKS.AutoCluster`
+- `AWS.EKS.AccessEntry` for cluster-admin access
+- `AWS.EKS.Addon` for `metrics-server` and `snapshot-controller`
+- `AWS.EKS.LoadBalancedWorkload` for deployment + public service composition
+- `AWS.EKS.PodIdentityWorkload` for workload identity + deployment composition
+- `Kubernetes.Namespace`
+- `Kubernetes.Job`
+
+There is no YAML or `kubectl apply` step. The workloads are declared in
+[`alchemy.run.ts`](./alchemy.run.ts) and reconciled by the EKS cluster resource.
+
+## Commands
+
+```sh
+bun install
+bun run --filter aws-eks-example deploy
+bun run --filter aws-eks-example destroy
+```
+
+## Cluster Access
+
+By default, the example grants cluster-admin access to the IAM principal that is
+running the deploy. If your current caller is not a normal IAM user or IAM role,
+set this before deploy:
+
+```sh
+export EKS_ADMIN_PRINCIPAL_ARN=arn:aws:iam::123456789012:role/YourAdminRole
+```
+
+## What Gets Deployed
+
+The example creates these in-cluster workloads in code:
+
+- a `demo` namespace
+- an `echo-server` workload created with `AWS.EKS.LoadBalancedWorkload`
+- a `pod-identity-demo` workload created with `AWS.EKS.PodIdentityWorkload`
+- a `cluster-info` job
+
+The pod identity workload creates the Kubernetes service account, IAM role,
+`AWS.EKS.PodIdentityAssociation`, and deployment together.
+
+## Optional Inspection
+
+If you want to inspect the cluster manually after deploy, you can still use your
+normal kubeconfig flow, for example:
+
+```sh
+aws eks update-kubeconfig --name alchemy-eks-auto-example --region "$AWS_REGION"
+kubectl get pods -n demo
+```
diff --git a/.repos/alchemy-effect/examples/aws-eks/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-eks/alchemy.run.ts
new file mode 100644
index 00000000000..eaa29061a22
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-eks/alchemy.run.ts
@@ -0,0 +1,251 @@
+import * as STS from "@distilled.cloud/aws/sts";
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as EC2 from "alchemy/AWS/EC2";
+import * as EKS from "alchemy/AWS/EKS";
+import * as Kubernetes from "alchemy/Kubernetes";
+import * as Output from "alchemy/Output";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+
+const aws = AWS.providers();
+
+const EKS_ADMIN_PRINCIPAL_ARN = Config.string("EKS_ADMIN_PRINCIPAL_ARN").pipe(
+  Config.option,
+  Config.map(Option.getOrUndefined),
+);
+
+const clusterName = "alchemy-eks-auto-example";
+const namespace = "demo";
+const serviceAccount = "pod-identity-demo";
+
+const toIamPrincipalArn = (arn: string): string | undefined => {
+  const assumedRole = arn.match(
+    /^arn:([^:]+):sts::([0-9]{12}):assumed-role\/(.+)\/[^/]+$/,
+  );
+  if (assumedRole) {
+    const [, partition, accountId, rolePath] = assumedRole;
+    return `arn:${partition}:iam::${accountId}:role/${rolePath}`;
+  }
+
+  if (arn.includes(":role/") || arn.includes(":user/")) {
+    return arn;
+  }
+
+  return undefined;
+};
+
+const resolveClusterAdminPrincipalArn = Effect.gen(function* () {
+  const configured = yield* EKS_ADMIN_PRINCIPAL_ARN;
+  if (configured) {
+    return configured;
+  }
+
+  const caller = yield* STS.getCallerIdentity({});
+  const principalArn =
+    typeof caller.Arn === "string" ? toIamPrincipalArn(caller.Arn) : undefined;
+
+  if (!principalArn) {
+    return yield* Effect.fail(
+      new Error(
+        "Unable to infer an IAM principal ARN for cluster access. Set EKS_ADMIN_PRINCIPAL_ARN before deploy.",
+      ),
+    );
+  }
+
+  return principalArn;
+});
+
+export default Alchemy.Stack(
+  "AwsEksExample",
+  {
+    providers: aws,
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const tags = {
+      Example: "aws-eks",
+      Surface: "eks",
+      Mode: "auto",
+    };
+
+    const clusterAdminPrincipalArn = yield* resolveClusterAdminPrincipalArn;
+
+    const network = yield* EC2.Network("Network", {
+      cidrBlock: "10.42.0.0/16",
+      availabilityZones: 2,
+      nat: "single",
+      tags,
+    });
+
+    const cluster = yield* EKS.AutoCluster("Cluster", {
+      clusterName,
+      network,
+      tags,
+    });
+
+    const clusterAdmin = yield* EKS.AccessEntry("ClusterAdmin", {
+      clusterName: cluster.cluster.clusterName,
+      principalArn: clusterAdminPrincipalArn,
+      accessPolicies: [
+        {
+          policyArn:
+            "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy",
+          accessScope: {
+            type: "cluster",
+          },
+        },
+      ],
+      tags,
+    });
+
+    const metricsServer = yield* EKS.Addon("MetricsServer", {
+      clusterName: cluster.cluster.clusterName,
+      addonName: "metrics-server",
+      tags,
+    });
+
+    const snapshotController = yield* EKS.Addon("SnapshotController", {
+      clusterName: cluster.cluster.clusterName,
+      addonName: "snapshot-controller",
+      tags,
+    });
+
+    const demoNamespace = yield* Kubernetes.Namespace("DemoNamespace", {
+      cluster: cluster.cluster,
+      name: namespace,
+      labels: {
+        "app.kubernetes.io/part-of": "aws-eks-example",
+      },
+    });
+
+    const echoServer = yield* EKS.LoadBalancedWorkload("EchoServer", {
+      cluster: cluster.cluster,
+      namespace: demoNamespace,
+      name: "echo-server",
+      labels: {
+        "app.kubernetes.io/name": "echo-server",
+        "app.kubernetes.io/part-of": "aws-eks-example",
+      },
+      replicas: 2,
+      containers: [
+        {
+          name: "echo-server",
+          image: "registry.k8s.io/echoserver:1.10",
+          ports: [
+            {
+              containerPort: 8080,
+              name: "http",
+            },
+          ],
+          resources: {
+            requests: {
+              cpu: "50m",
+              memory: "64Mi",
+            },
+            limits: {
+              cpu: "250m",
+              memory: "128Mi",
+            },
+          },
+        },
+      ],
+      ports: [
+        {
+          name: "http",
+          port: 80,
+          targetPort: 8080,
+        },
+      ],
+    });
+
+    const podIdentityWorkload = yield* EKS.PodIdentityWorkload(
+      "PodIdentityDemo",
+      {
+        cluster: cluster.cluster,
+        namespace: demoNamespace,
+        name: "pod-identity-demo",
+        serviceAccountName: serviceAccount,
+        tags,
+        serviceAccountLabels: {
+          "app.kubernetes.io/name": serviceAccount,
+          "app.kubernetes.io/part-of": "aws-eks-example",
+        },
+        labels: {
+          "app.kubernetes.io/name": "pod-identity-demo",
+          "app.kubernetes.io/part-of": "aws-eks-example",
+        },
+        containers: [
+          {
+            name: "aws-cli",
+            image: "public.ecr.aws/aws-cli/aws-cli:2.17.37",
+            command: ["/bin/sh", "-lc"],
+            args: [
+              [
+                "while true; do",
+                "  date;",
+                "  aws sts get-caller-identity;",
+                "  sleep 60;",
+                "done",
+              ].join(" "),
+            ],
+            resources: {
+              requests: {
+                cpu: "50m",
+                memory: "64Mi",
+              },
+              limits: {
+                cpu: "250m",
+                memory: "128Mi",
+              },
+            },
+          },
+        ],
+      },
+    );
+
+    const clusterInfoJob = yield* Kubernetes.Job("ClusterInfoJob", {
+      cluster: cluster.cluster,
+      namespace: demoNamespace,
+      name: "cluster-info",
+      labels: {
+        "app.kubernetes.io/name": "cluster-info",
+        "app.kubernetes.io/part-of": "aws-eks-example",
+      },
+      containers: [
+        {
+          name: "cluster-info",
+          image: "public.ecr.aws/docker/library/busybox:1.36",
+          command: ["/bin/sh", "-lc"],
+          args: [
+            [
+              'echo "demo workload is running on EKS Auto Mode";',
+              "nslookup echo-server.demo.svc.cluster.local || true;",
+            ].join(" "),
+          ],
+        },
+      ],
+    });
+
+    return {
+      clusterName: cluster.cluster.clusterName,
+      clusterArn: cluster.cluster.clusterArn,
+      endpoint: cluster.cluster.endpoint,
+      adminPrincipalArn: clusterAdmin.principalArn,
+      namespace: demoNamespace.name,
+      serviceAccount: podIdentityWorkload.serviceAccount.name,
+      podIdentityAssociationArn:
+        podIdentityWorkload.podIdentityAssociation.associationArn,
+      workloadRoleArn: podIdentityWorkload.roleArn,
+      metricsServerAddonArn: metricsServer.addonArn,
+      snapshotControllerAddonArn: snapshotController.addonArn,
+      echoDeploymentName: echoServer.deployment.name,
+      echoServiceName: echoServer.service?.name,
+      podIdentityDeploymentName: podIdentityWorkload.deployment.name,
+      clusterInfoJobName: clusterInfoJob.name,
+      accessSummary: Output.interpolate`Granted cluster-admin access on ${cluster.cluster.clusterName} to ${clusterAdmin.principalArn}.`,
+      workloadSummary: Output.interpolate`Demo workloads are declared in TypeScript and reconciled into namespace ${demoNamespace.name} on ${cluster.cluster.clusterName}.`,
+    };
+  }).pipe(Effect.orDie),
+);
diff --git a/.repos/alchemy-effect/examples/aws-eks/package.json b/.repos/alchemy-effect/examples/aws-eks/package.json
new file mode 100644
index 00000000000..9d3892cc424
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-eks/package.json
@@ -0,0 +1,23 @@
+{
+  "name": "aws-eks-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-eks"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-eks/tsconfig.json b/.repos/alchemy-effect/examples/aws-eks/tsconfig.json
new file mode 100644
index 00000000000..beb7b1841e1
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-eks/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "../..",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "paths": {
+      "alchemy": ["../../packages/alchemy/src/index.ts"],
+      "alchemy/*": ["../../packages/alchemy/src/*"]
+    }
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-lambda-httpapi/alchemy.run.ts
new file mode 100644
index 00000000000..6f61dc9b0af
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/alchemy.run.ts
@@ -0,0 +1,87 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import JobFunction from "./src/JobFunction.ts";
+
+const aws = AWS.providers();
+const dashboardRegion = process.env.AWS_REGION ?? "us-west-2";
+
+export default Alchemy.Stack(
+  "JobLambdaHttpApi",
+  {
+    providers: Layer.mergeAll(
+      // Fully configured cloud provider Layers go here:
+      aws,
+    ),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const func = yield* JobFunction;
+    const dashboard = yield* AWS.CloudWatch.Dashboard("JobDashboard", {
+      DashboardBody: func.functionName.pipe(
+        Output.map((functionName) => ({
+          widgets: [
+            {
+              type: "metric",
+              x: 0,
+              y: 0,
+              width: 12,
+              height: 6,
+              properties: {
+                title: "Lambda Invocations and Errors",
+                region: dashboardRegion,
+                stat: "Sum",
+                period: 300,
+                metrics: [
+                  ["AWS/Lambda", "Invocations", "FunctionName", functionName],
+                  ["AWS/Lambda", "Errors", "FunctionName", functionName],
+                ],
+              },
+            },
+            {
+              type: "metric",
+              x: 12,
+              y: 0,
+              width: 12,
+              height: 6,
+              properties: {
+                title: "Lambda Duration",
+                region: dashboardRegion,
+                stat: "Average",
+                period: 300,
+                metrics: [
+                  ["AWS/Lambda", "Duration", "FunctionName", functionName],
+                ],
+              },
+            },
+          ],
+        })),
+      ),
+    });
+    const alarm = yield* AWS.CloudWatch.Alarm("JobFunctionErrorsAlarm", {
+      AlarmDescription:
+        "Alerts when the example Lambda function reports errors.",
+      MetricName: "Errors",
+      Namespace: "AWS/Lambda",
+      Statistic: "Sum",
+      Period: 300,
+      EvaluationPeriods: 1,
+      Threshold: 1,
+      ComparisonOperator: "GreaterThanOrEqualToThreshold",
+      TreatMissingData: "notBreaching",
+      Dimensions: [
+        {
+          Name: "FunctionName",
+          Value: func.functionName,
+        },
+      ],
+    });
+    return {
+      url: Output.interpolate`${func.functionUrl}?jobId=foo`,
+      dashboardName: dashboard.dashboardName,
+      alarmName: alarm.alarmName,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/package.json b/.repos/alchemy-effect/examples/aws-lambda-httpapi/package.json
new file mode 100644
index 00000000000..c7f539b5dfd
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/package.json
@@ -0,0 +1,23 @@
+{
+  "name": "aws-lambda-httpapi",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-lambda-httpapi"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/Job.ts b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/Job.ts
new file mode 100644
index 00000000000..5a5424a5c1e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/Job.ts
@@ -0,0 +1,13 @@
+import * as S from "effect/Schema";
+
+export type JobId = S.Schema.Type<typeof JobId>;
+export const JobId = S.String.annotate({
+  description: "The ID of the job",
+});
+
+export class Job extends S.Class<Job>("Job")({
+  id: JobId,
+  content: S.String,
+}) {}
+
+export const decodeJob = S.decodeEffect(Job);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobApi.ts b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobApi.ts
new file mode 100644
index 00000000000..d2b4caf408e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobApi.ts
@@ -0,0 +1,106 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import { Job, JobId } from "./Job.ts";
+import { JobNotifications, NotifyJobError } from "./JobNotifications.ts";
+import { GetJobError, JobStorage, PutJobError } from "./JobStorage.ts";
+
+export const getJob = HttpApiEndpoint.get("getJob", "/", {
+  success: Job,
+  query: {
+    jobId: JobId.pipe(Schema.optional),
+  },
+});
+
+export const createJob = HttpApiEndpoint.post("createJob", "/", {
+  success: JobId,
+  payload: Schema.Struct({
+    content: Schema.String,
+  }),
+});
+
+export const JobApi = HttpApi.make("JobApi").add(
+  HttpApiGroup.make("Jobs").add(getJob, createJob),
+);
+
+export const JobApiLive = HttpApiBuilder.layer(JobApi).pipe(
+  Layer.provide(
+    HttpApiBuilder.group(JobApi, "Jobs", (handlers) =>
+      Effect.gen(function* () {
+        const jobService = yield* JobStorage;
+        const notifications = yield* JobNotifications;
+
+        return handlers
+          .handle(
+            "getJob",
+            Effect.fn(function* (req) {
+              if (!req.query.jobId) {
+                return HttpServerResponse.text("Job ID is required", {
+                  status: 400,
+                });
+              }
+              const job = yield* jobService.getJob(req.query.jobId).pipe(
+                Effect.catchTag("GetJobError", (error) =>
+                  Effect.succeed(
+                    HttpServerResponse.text(error.message, {
+                      status: 500,
+                    }),
+                  ),
+                ),
+              );
+              if (job instanceof GetJobError) {
+                return HttpServerResponse.text(job.message, {
+                  status: 500,
+                });
+              }
+              if (!job) {
+                return HttpServerResponse.text("Job not found", {
+                  status: 404,
+                });
+              }
+              return job!;
+            }),
+          )
+          .handle(
+            "createJob",
+            Effect.fn(function* (req) {
+              const jobId = crypto.randomUUID();
+              const job = yield* jobService
+                .putJob({
+                  id: jobId,
+                  content: req.payload.content,
+                })
+                .pipe(
+                  Effect.catchTag("PutJobError", (error) =>
+                    Effect.succeed(error),
+                  ),
+                );
+              if (job instanceof PutJobError) {
+                return HttpServerResponse.text(job.message, {
+                  status: 500,
+                });
+              }
+              const notificationResult = yield* notifications
+                .notifyJobCreated(job)
+                .pipe(
+                  Effect.catchTag("NotifyJobError", (error) =>
+                    Effect.succeed(error),
+                  ),
+                );
+              if (notificationResult instanceof NotifyJobError) {
+                return HttpServerResponse.text(notificationResult.message, {
+                  status: 500,
+                });
+              }
+              return job.id;
+            }),
+          );
+      }),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobFunction.ts b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobFunction.ts
new file mode 100644
index 00000000000..82d2f1f5363
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobFunction.ts
@@ -0,0 +1,29 @@
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import { JobApiLive } from "./JobApi.ts";
+import { JobNotificationsSNS } from "./JobNotifications.ts";
+import { JobStorageDynamoDB } from "./JobStorage.ts";
+
+export default class JobFunction extends AWS.Lambda.Function<JobFunction>()(
+  "JobFunction",
+  {
+    main: import.meta.filename,
+    url: true,
+  },
+  HttpRouter.toHttpEffect(JobApiLive).pipe(
+    Effect.map((fetch) => ({ fetch })),
+    Effect.provide(
+      Layer.mergeAll(
+        JobStorageDynamoDB,
+        JobNotificationsSNS,
+        // TODO(sam): these should be provided to us automatically
+        HttpPlatform.layer,
+        Etag.layer,
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobNotifications.ts b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobNotifications.ts
new file mode 100644
index 00000000000..897257dd564
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobNotifications.ts
@@ -0,0 +1,89 @@
+import * as AWS from "alchemy/AWS";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import type { Job } from "./Job.ts";
+
+export class NotifyJobError extends Data.TaggedError("NotifyJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+type JobNotification = {
+  type: "job.created";
+  job: Job;
+};
+
+export class JobNotifications extends Context.Service<
+  JobNotifications,
+  {
+    notifyJobCreated(job: Job): Effect.Effect<void, NotifyJobError>;
+  }
+>()("JobNotifications") {}
+
+export const JobNotificationsSNS = Layer.provideMerge(
+  Layer.effect(
+    JobNotifications,
+    Effect.gen(function* () {
+      const topic = yield* AWS.SNS.Topic("JobNotificationsTopic", {
+        attributes: {
+          DisplayName: "job-notifications",
+        },
+      });
+
+      const publish = yield* AWS.SNS.Publish.bind(topic);
+
+      yield* AWS.SNS.notifications(topic).subscribe((stream) =>
+        stream.pipe(
+          Stream.mapEffect((notification) =>
+            Effect.try({
+              try: () => JSON.parse(notification.Message) as JobNotification,
+              catch: (cause) =>
+                new NotifyJobError({
+                  message: "Failed to parse SNS job notification",
+                  cause,
+                }),
+            }).pipe(
+              Effect.flatMap((payload) =>
+                Effect.logInfo(
+                  `Job notification received: ${payload.type} (${payload.job.id})`,
+                ),
+              ),
+              // Keep the example resilient to malformed demo messages.
+              Effect.catchTag("NotifyJobError", (error) =>
+                Effect.logWarning(error.message),
+              ),
+            ),
+          ),
+          Stream.runDrain,
+        ),
+      );
+
+      const notifyJobCreated = (job: Job) =>
+        publish({
+          Subject: "JobCreated",
+          Message: JSON.stringify({
+            type: "job.created",
+            job,
+          } satisfies JobNotification),
+        }).pipe(
+          Effect.asVoid,
+          Effect.mapError(
+            (cause) =>
+              new NotifyJobError({
+                message: `Failed to publish job notification for "${job.id}"`,
+                cause,
+              }),
+          ),
+        );
+
+      return JobNotifications.of({
+        notifyJobCreated,
+      });
+    }),
+  ),
+  Layer.mergeAll(AWS.Lambda.TopicEventSource, AWS.SNS.PublishLive),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobStorage.ts b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobStorage.ts
new file mode 100644
index 00000000000..15d42ae9fde
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/src/JobStorage.ts
@@ -0,0 +1,230 @@
+import * as DynamoDB from "alchemy/AWS/DynamoDB";
+import * as Lambda from "alchemy/AWS/Lambda";
+import * as S3 from "alchemy/AWS/S3";
+import * as SQS from "alchemy/AWS/SQS";
+import * as RemovalPolicy from "alchemy/RemovalPolicy";
+import { Stack } from "alchemy/Stack";
+import * as Console from "effect/Console";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import type { Job } from "./Job.ts";
+
+export class PutJobError extends Data.TaggedError("PutJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class GetJobError extends Data.TaggedError("GetJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class JobStorage extends Context.Service<
+  JobStorage,
+  {
+    putJob(job: Job): Effect.Effect<Job, PutJobError>;
+    getJob(jobId: string): Effect.Effect<Job | undefined, GetJobError>;
+  }
+>()("JobStorage") {}
+
+export const JobStorageDynamoDB = Layer.provideMerge(
+  Layer.effect(
+    JobStorage,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const table = yield* DynamoDB.Table("JobsTable", {
+        partitionKey: "id",
+        attributes: {
+          id: "S",
+        },
+      });
+      const queue = yield* SQS.Queue("JobsQueue").pipe(
+        RemovalPolicy.retain(stack.stage === "prod"),
+      );
+
+      const getItem = yield* DynamoDB.GetItem.bind(table);
+      const putItem = yield* DynamoDB.PutItem.bind(table);
+      const sink = yield* SQS.QueueSink.bind(queue);
+
+      yield* DynamoDB.stream(table, {
+        streamViewType: "NEW_AND_OLD_IMAGES",
+        startingPosition: "LATEST",
+        batchSize: 10,
+      }).process((stream) =>
+        stream.pipe(
+          Stream.map((record) =>
+            JSON.stringify({
+              eventName: record.eventName,
+              keys: record.dynamodb.Keys,
+              newImage: record.dynamodb.NewImage,
+              oldImage: record.dynamodb.OldImage,
+            }),
+          ),
+          Stream.run(sink),
+        ),
+      );
+
+      const putJob = (job: Job) =>
+        putItem({
+          Item: {
+            id: { S: job.id },
+            content: { S: job.content },
+          },
+        }).pipe(
+          Effect.map(() => job),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new PutJobError({
+                message: `Failed to store job "${job.id}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      const getJob = (jobId: string) =>
+        getItem({
+          Key: {
+            id: { S: jobId },
+          },
+        }).pipe(
+          Effect.flatMap((item) =>
+            item.Item
+              ? Effect.try({
+                  try: () =>
+                    ({
+                      id: item.Item?.id?.S ?? jobId,
+                      content: item.Item?.content?.S ?? "",
+                    }) as Job,
+                  catch: (cause) =>
+                    new GetJobError({
+                      message: `Failed to parse job "${jobId}": ${cause}`,
+                      cause,
+                    }),
+                })
+              : Effect.succeed(undefined),
+          ),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new GetJobError({
+                message: `Failed to load job "${jobId}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      return JobStorage.of({
+        putJob,
+        getJob,
+      });
+    }),
+  ),
+  Layer.mergeAll(Lambda.TableEventSource, SQS.QueueSinkLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        DynamoDB.GetItemLive,
+        DynamoDB.PutItemLive,
+        SQS.SendMessageBatchLive,
+      ),
+    ),
+  ),
+);
+
+export const JobStorageS3 = Layer.provideMerge(
+  Layer.effect(
+    JobStorage,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const bucket = yield* S3.Bucket("JobsBucket");
+      const queue = yield* SQS.Queue("JobsQueue").pipe(
+        RemovalPolicy.retain(stack.stage === "prod"),
+      );
+
+      const getObject = yield* S3.GetObject.bind(bucket);
+      const putObject = yield* S3.PutObject.bind(bucket);
+      const sink = yield* SQS.QueueSink.bind(queue);
+
+      const putJob = (job: Job) =>
+        putObject({
+          Key: job.id,
+          Body: JSON.stringify(job),
+        }).pipe(
+          Effect.map(() => job),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new PutJobError({
+                message: `Failed to store job "${job.id}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      const getJob = (jobId: string) =>
+        getObject({
+          Key: jobId,
+        }).pipe(
+          Effect.catchTag("NoSuchKey", () => Effect.succeed(undefined)),
+          Effect.flatMap(
+            (item) =>
+              item?.Body?.pipe(
+                Stream.decodeText,
+                Stream.mkString,
+                Effect.flatMap((body) =>
+                  Effect.try({
+                    try: () => JSON.parse(body) as Job,
+                    catch: (cause) =>
+                      new GetJobError({
+                        message: `Failed to parse job "${jobId}": ${cause}`,
+                        cause,
+                      }),
+                  }),
+                ),
+              ) ?? Effect.succeed(undefined),
+          ),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new GetJobError({
+                message: `Failed to load job "${jobId}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      yield* S3.notifications(bucket).subscribe((stream) =>
+        stream.pipe(
+          Stream.flatMap((item) =>
+            Stream.fromEffect(getJob(item.key).pipe(Effect.orDie)),
+          ),
+          Stream.filter((job): job is Job => job !== undefined),
+          Stream.map((job) => JSON.stringify(job)),
+          Stream.run(sink),
+        ),
+      );
+
+      return JobStorage.of({
+        putJob,
+        getJob,
+      });
+    }),
+  ),
+  Layer.mergeAll(Lambda.BucketEventSource, SQS.QueueSinkLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        S3.GetObjectLive,
+        S3.PutObjectLive,
+        SQS.SendMessageBatchLive,
+      ),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-httpapi/tsconfig.json b/.repos/alchemy-effect/examples/aws-lambda-httpapi/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-httpapi/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-lambda-rpc/alchemy.run.ts
new file mode 100644
index 00000000000..a19bc4b39ce
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/alchemy.run.ts
@@ -0,0 +1,87 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import JobFunction from "./src/JobFunction.ts";
+
+const aws = AWS.providers();
+const dashboardRegion = process.env.AWS_REGION ?? "us-west-2";
+
+export default Alchemy.Stack(
+  "JobLambdaRpc",
+  {
+    providers: Layer.mergeAll(
+      // Fully configured cloud provider Layers go here:
+      aws,
+    ),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const func = yield* JobFunction;
+    const dashboard = yield* AWS.CloudWatch.Dashboard("JobDashboard", {
+      DashboardBody: func.functionName.pipe(
+        Output.map((functionName) => ({
+          widgets: [
+            {
+              type: "metric",
+              x: 0,
+              y: 0,
+              width: 12,
+              height: 6,
+              properties: {
+                title: "Lambda Invocations and Errors",
+                region: dashboardRegion,
+                stat: "Sum",
+                period: 300,
+                metrics: [
+                  ["AWS/Lambda", "Invocations", "FunctionName", functionName],
+                  ["AWS/Lambda", "Errors", "FunctionName", functionName],
+                ],
+              },
+            },
+            {
+              type: "metric",
+              x: 12,
+              y: 0,
+              width: 12,
+              height: 6,
+              properties: {
+                title: "Lambda Duration",
+                region: dashboardRegion,
+                stat: "Average",
+                period: 300,
+                metrics: [
+                  ["AWS/Lambda", "Duration", "FunctionName", functionName],
+                ],
+              },
+            },
+          ],
+        })),
+      ),
+    });
+    const alarm = yield* AWS.CloudWatch.Alarm("JobFunctionErrorsAlarm", {
+      AlarmDescription:
+        "Alerts when the example Lambda function reports errors.",
+      MetricName: "Errors",
+      Namespace: "AWS/Lambda",
+      Statistic: "Sum",
+      Period: 300,
+      EvaluationPeriods: 1,
+      Threshold: 1,
+      ComparisonOperator: "GreaterThanOrEqualToThreshold",
+      TreatMissingData: "notBreaching",
+      Dimensions: [
+        {
+          Name: "FunctionName",
+          Value: func.functionName,
+        },
+      ],
+    });
+    return {
+      url: func.functionUrl,
+      dashboardName: dashboard.dashboardName,
+      alarmName: alarm.alarmName,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/package.json b/.repos/alchemy-effect/examples/aws-lambda-rpc/package.json
new file mode 100644
index 00000000000..51a641345ec
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/package.json
@@ -0,0 +1,23 @@
+{
+  "name": "aws-lambda-rpc",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-lambda-rpc"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/src/Job.ts b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/Job.ts
new file mode 100644
index 00000000000..5a5424a5c1e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/Job.ts
@@ -0,0 +1,13 @@
+import * as S from "effect/Schema";
+
+export type JobId = S.Schema.Type<typeof JobId>;
+export const JobId = S.String.annotate({
+  description: "The ID of the job",
+});
+
+export class Job extends S.Class<Job>("Job")({
+  id: JobId,
+  content: S.String,
+}) {}
+
+export const decodeJob = S.decodeEffect(Job);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobFunction.ts b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobFunction.ts
new file mode 100644
index 00000000000..352f471f93a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobFunction.ts
@@ -0,0 +1,18 @@
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { JobNotificationsSNS } from "./JobNotifications.ts";
+import { JobRpcHttpEffect } from "./JobRpcApi.ts";
+import { JobStorageDynamoDB } from "./JobStorage.ts";
+
+export default class JobFunction extends AWS.Lambda.Function<JobFunction>()(
+  "JobFunction",
+  {
+    main: import.meta.filename,
+    url: true,
+  },
+  JobRpcHttpEffect.pipe(
+    Effect.map((fetch) => ({ fetch })),
+    Effect.provide(Layer.mergeAll(JobStorageDynamoDB, JobNotificationsSNS)),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobNotifications.ts b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobNotifications.ts
new file mode 100644
index 00000000000..897257dd564
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobNotifications.ts
@@ -0,0 +1,89 @@
+import * as AWS from "alchemy/AWS";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import type { Job } from "./Job.ts";
+
+export class NotifyJobError extends Data.TaggedError("NotifyJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+type JobNotification = {
+  type: "job.created";
+  job: Job;
+};
+
+export class JobNotifications extends Context.Service<
+  JobNotifications,
+  {
+    notifyJobCreated(job: Job): Effect.Effect<void, NotifyJobError>;
+  }
+>()("JobNotifications") {}
+
+export const JobNotificationsSNS = Layer.provideMerge(
+  Layer.effect(
+    JobNotifications,
+    Effect.gen(function* () {
+      const topic = yield* AWS.SNS.Topic("JobNotificationsTopic", {
+        attributes: {
+          DisplayName: "job-notifications",
+        },
+      });
+
+      const publish = yield* AWS.SNS.Publish.bind(topic);
+
+      yield* AWS.SNS.notifications(topic).subscribe((stream) =>
+        stream.pipe(
+          Stream.mapEffect((notification) =>
+            Effect.try({
+              try: () => JSON.parse(notification.Message) as JobNotification,
+              catch: (cause) =>
+                new NotifyJobError({
+                  message: "Failed to parse SNS job notification",
+                  cause,
+                }),
+            }).pipe(
+              Effect.flatMap((payload) =>
+                Effect.logInfo(
+                  `Job notification received: ${payload.type} (${payload.job.id})`,
+                ),
+              ),
+              // Keep the example resilient to malformed demo messages.
+              Effect.catchTag("NotifyJobError", (error) =>
+                Effect.logWarning(error.message),
+              ),
+            ),
+          ),
+          Stream.runDrain,
+        ),
+      );
+
+      const notifyJobCreated = (job: Job) =>
+        publish({
+          Subject: "JobCreated",
+          Message: JSON.stringify({
+            type: "job.created",
+            job,
+          } satisfies JobNotification),
+        }).pipe(
+          Effect.asVoid,
+          Effect.mapError(
+            (cause) =>
+              new NotifyJobError({
+                message: `Failed to publish job notification for "${job.id}"`,
+                cause,
+              }),
+          ),
+        );
+
+      return JobNotifications.of({
+        notifyJobCreated,
+      });
+    }),
+  ),
+  Layer.mergeAll(AWS.Lambda.TopicEventSource, AWS.SNS.PublishLive),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobRpcApi.ts b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobRpcApi.ts
new file mode 100644
index 00000000000..2c86d1b4db2
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobRpcApi.ts
@@ -0,0 +1,86 @@
+import { Effect, Layer, Schema } from "effect";
+import {
+  Rpc,
+  RpcGroup,
+  RpcSerialization,
+  RpcServer,
+} from "effect/unstable/rpc";
+import { Job, JobId } from "./Job.ts";
+import { JobNotifications } from "./JobNotifications.ts";
+import { JobStorage } from "./JobStorage.ts";
+
+export class JobNotFound extends Schema.TaggedClass<JobNotFound>()(
+  "JobNotFound",
+  { jobId: JobId },
+) {}
+
+export class GetJobFailed extends Schema.TaggedClass<GetJobFailed>()(
+  "GetJobFailed",
+  { message: Schema.String },
+) {}
+
+export class PutJobFailed extends Schema.TaggedClass<PutJobFailed>()(
+  "PutJobFailed",
+  { message: Schema.String },
+) {}
+
+const getJob = Rpc.make("getJob", {
+  success: Job,
+  error: Schema.Union([JobNotFound, GetJobFailed]),
+  payload: {
+    jobId: JobId,
+  },
+});
+
+const createJob = Rpc.make("createJob", {
+  success: JobId,
+  error: PutJobFailed,
+  payload: {
+    content: Schema.String,
+  },
+});
+
+export class JobRpcs extends RpcGroup.make(getJob, createJob) {}
+
+export const JobRpcsLive = JobRpcs.toLayer(
+  Effect.gen(function* () {
+    const jobService = yield* JobStorage;
+    const notifications = yield* JobNotifications;
+
+    return {
+      getJob: ({ jobId }) =>
+        jobService.getJob(jobId).pipe(
+          Effect.mapError(
+            (error) =>
+              new GetJobFailed({
+                message: error.message,
+              }),
+          ),
+          Effect.flatMap((job) =>
+            job ? Effect.succeed(job) : Effect.fail(new JobNotFound({ jobId })),
+          ),
+        ),
+      createJob: ({ content }) =>
+        Effect.gen(function* () {
+          const jobId = crypto.randomUUID();
+          const job = yield* jobService.putJob({
+            id: jobId,
+            content,
+          });
+          yield* notifications.notifyJobCreated(job);
+          return job.id;
+        }).pipe(
+          Effect.mapError(
+            (error) =>
+              new PutJobFailed({
+                message: error.message,
+              }),
+          ),
+        ),
+    };
+  }),
+);
+
+export const JobRpcHttpEffect = RpcServer.toHttpEffect(JobRpcs).pipe(
+  Effect.provide(Layer.mergeAll(JobRpcsLive, RpcSerialization.layerJson)),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobStorage.ts b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobStorage.ts
new file mode 100644
index 00000000000..15d42ae9fde
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/src/JobStorage.ts
@@ -0,0 +1,230 @@
+import * as DynamoDB from "alchemy/AWS/DynamoDB";
+import * as Lambda from "alchemy/AWS/Lambda";
+import * as S3 from "alchemy/AWS/S3";
+import * as SQS from "alchemy/AWS/SQS";
+import * as RemovalPolicy from "alchemy/RemovalPolicy";
+import { Stack } from "alchemy/Stack";
+import * as Console from "effect/Console";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import type { Job } from "./Job.ts";
+
+export class PutJobError extends Data.TaggedError("PutJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class GetJobError extends Data.TaggedError("GetJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class JobStorage extends Context.Service<
+  JobStorage,
+  {
+    putJob(job: Job): Effect.Effect<Job, PutJobError>;
+    getJob(jobId: string): Effect.Effect<Job | undefined, GetJobError>;
+  }
+>()("JobStorage") {}
+
+export const JobStorageDynamoDB = Layer.provideMerge(
+  Layer.effect(
+    JobStorage,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const table = yield* DynamoDB.Table("JobsTable", {
+        partitionKey: "id",
+        attributes: {
+          id: "S",
+        },
+      });
+      const queue = yield* SQS.Queue("JobsQueue").pipe(
+        RemovalPolicy.retain(stack.stage === "prod"),
+      );
+
+      const getItem = yield* DynamoDB.GetItem.bind(table);
+      const putItem = yield* DynamoDB.PutItem.bind(table);
+      const sink = yield* SQS.QueueSink.bind(queue);
+
+      yield* DynamoDB.stream(table, {
+        streamViewType: "NEW_AND_OLD_IMAGES",
+        startingPosition: "LATEST",
+        batchSize: 10,
+      }).process((stream) =>
+        stream.pipe(
+          Stream.map((record) =>
+            JSON.stringify({
+              eventName: record.eventName,
+              keys: record.dynamodb.Keys,
+              newImage: record.dynamodb.NewImage,
+              oldImage: record.dynamodb.OldImage,
+            }),
+          ),
+          Stream.run(sink),
+        ),
+      );
+
+      const putJob = (job: Job) =>
+        putItem({
+          Item: {
+            id: { S: job.id },
+            content: { S: job.content },
+          },
+        }).pipe(
+          Effect.map(() => job),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new PutJobError({
+                message: `Failed to store job "${job.id}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      const getJob = (jobId: string) =>
+        getItem({
+          Key: {
+            id: { S: jobId },
+          },
+        }).pipe(
+          Effect.flatMap((item) =>
+            item.Item
+              ? Effect.try({
+                  try: () =>
+                    ({
+                      id: item.Item?.id?.S ?? jobId,
+                      content: item.Item?.content?.S ?? "",
+                    }) as Job,
+                  catch: (cause) =>
+                    new GetJobError({
+                      message: `Failed to parse job "${jobId}": ${cause}`,
+                      cause,
+                    }),
+                })
+              : Effect.succeed(undefined),
+          ),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new GetJobError({
+                message: `Failed to load job "${jobId}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      return JobStorage.of({
+        putJob,
+        getJob,
+      });
+    }),
+  ),
+  Layer.mergeAll(Lambda.TableEventSource, SQS.QueueSinkLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        DynamoDB.GetItemLive,
+        DynamoDB.PutItemLive,
+        SQS.SendMessageBatchLive,
+      ),
+    ),
+  ),
+);
+
+export const JobStorageS3 = Layer.provideMerge(
+  Layer.effect(
+    JobStorage,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const bucket = yield* S3.Bucket("JobsBucket");
+      const queue = yield* SQS.Queue("JobsQueue").pipe(
+        RemovalPolicy.retain(stack.stage === "prod"),
+      );
+
+      const getObject = yield* S3.GetObject.bind(bucket);
+      const putObject = yield* S3.PutObject.bind(bucket);
+      const sink = yield* SQS.QueueSink.bind(queue);
+
+      const putJob = (job: Job) =>
+        putObject({
+          Key: job.id,
+          Body: JSON.stringify(job),
+        }).pipe(
+          Effect.map(() => job),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new PutJobError({
+                message: `Failed to store job "${job.id}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      const getJob = (jobId: string) =>
+        getObject({
+          Key: jobId,
+        }).pipe(
+          Effect.catchTag("NoSuchKey", () => Effect.succeed(undefined)),
+          Effect.flatMap(
+            (item) =>
+              item?.Body?.pipe(
+                Stream.decodeText,
+                Stream.mkString,
+                Effect.flatMap((body) =>
+                  Effect.try({
+                    try: () => JSON.parse(body) as Job,
+                    catch: (cause) =>
+                      new GetJobError({
+                        message: `Failed to parse job "${jobId}": ${cause}`,
+                        cause,
+                      }),
+                  }),
+                ),
+              ) ?? Effect.succeed(undefined),
+          ),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new GetJobError({
+                message: `Failed to load job "${jobId}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      yield* S3.notifications(bucket).subscribe((stream) =>
+        stream.pipe(
+          Stream.flatMap((item) =>
+            Stream.fromEffect(getJob(item.key).pipe(Effect.orDie)),
+          ),
+          Stream.filter((job): job is Job => job !== undefined),
+          Stream.map((job) => JSON.stringify(job)),
+          Stream.run(sink),
+        ),
+      );
+
+      return JobStorage.of({
+        putJob,
+        getJob,
+      });
+    }),
+  ),
+  Layer.mergeAll(Lambda.BucketEventSource, SQS.QueueSinkLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        S3.GetObjectLive,
+        S3.PutObjectLive,
+        SQS.SendMessageBatchLive,
+      ),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda-rpc/tsconfig.json b/.repos/alchemy-effect/examples/aws-lambda-rpc/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda-rpc/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-lambda/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-lambda/alchemy.run.ts
new file mode 100644
index 00000000000..5f63ddcc845
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/alchemy.run.ts
@@ -0,0 +1,86 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import JobFunction from "./src/JobFunction.ts";
+
+// AWS.providers() already provides AWSEnvironment from the SSO profile
+// named by $AWS_PROFILE (defaults to "default"). To pin a different
+// profile per stage, wrap with `Layer.provide(AWS.makeEnvironment({...}))`.
+const aws = AWS.providers();
+const dashboardRegion = process.env.AWS_REGION ?? "us-west-2";
+
+export default Alchemy.Stack(
+  "JobLambda",
+  {
+    providers: aws,
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const func = yield* JobFunction;
+    const dashboard = yield* AWS.CloudWatch.Dashboard("JobDashboard", {
+      DashboardBody: func.functionName.pipe(
+        Output.map((functionName) => ({
+          widgets: [
+            {
+              type: "metric",
+              x: 0,
+              y: 0,
+              width: 12,
+              height: 6,
+              properties: {
+                title: "Lambda Invocations and Errors",
+                region: dashboardRegion,
+                stat: "Sum",
+                period: 300,
+                metrics: [
+                  ["AWS/Lambda", "Invocations", "FunctionName", functionName],
+                  ["AWS/Lambda", "Errors", "FunctionName", functionName],
+                ],
+              },
+            },
+            {
+              type: "metric",
+              x: 12,
+              y: 0,
+              width: 12,
+              height: 6,
+              properties: {
+                title: "Lambda Duration",
+                region: dashboardRegion,
+                stat: "Average",
+                period: 300,
+                metrics: [
+                  ["AWS/Lambda", "Duration", "FunctionName", functionName],
+                ],
+              },
+            },
+          ],
+        })),
+      ),
+    });
+    const alarm = yield* AWS.CloudWatch.Alarm("JobFunctionErrorsAlarm", {
+      AlarmDescription:
+        "Alerts when the example Lambda function reports errors.",
+      MetricName: "Errors",
+      Namespace: "AWS/Lambda",
+      Statistic: "Sum",
+      Period: 300,
+      EvaluationPeriods: 1,
+      Threshold: 1,
+      ComparisonOperator: "GreaterThanOrEqualToThreshold",
+      TreatMissingData: "notBreaching",
+      Dimensions: [
+        {
+          Name: "FunctionName",
+          Value: func.functionName,
+        },
+      ],
+    });
+    return {
+      url: Output.interpolate`${func.functionUrl}?jobId=foo`,
+      dashboardName: dashboard.dashboardName,
+      alarmName: alarm.alarmName,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda/package.json b/.repos/alchemy-effect/examples/aws-lambda/package.json
new file mode 100644
index 00000000000..b56343c2247
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "aws-lambda",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-lambda"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-lambda/src/Job.ts b/.repos/alchemy-effect/examples/aws-lambda/src/Job.ts
new file mode 100644
index 00000000000..5a5424a5c1e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/src/Job.ts
@@ -0,0 +1,13 @@
+import * as S from "effect/Schema";
+
+export type JobId = S.Schema.Type<typeof JobId>;
+export const JobId = S.String.annotate({
+  description: "The ID of the job",
+});
+
+export class Job extends S.Class<Job>("Job")({
+  id: JobId,
+  content: S.String,
+}) {}
+
+export const decodeJob = S.decodeEffect(Job);
diff --git a/.repos/alchemy-effect/examples/aws-lambda/src/JobFunction.ts b/.repos/alchemy-effect/examples/aws-lambda/src/JobFunction.ts
new file mode 100644
index 00000000000..e835ec03120
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/src/JobFunction.ts
@@ -0,0 +1,119 @@
+import * as AWS from "alchemy/AWS";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import {
+  JobNotifications,
+  JobNotificationsSNS,
+  NotifyJobError,
+} from "./JobNotifications.ts";
+import {
+  GetJobError,
+  JobStorage,
+  JobStorageDynamoDB,
+  PutJobError,
+} from "./JobStorage.ts";
+
+export default class JobFunction extends AWS.Lambda.Function<JobFunction>()(
+  "JobFunction",
+  Stack.useSync((stack) => ({
+    main: import.meta.filename,
+    memory: stack.stage === "prod" ? 1024 : 512,
+    url: true,
+  })),
+  Effect.gen(function* () {
+    const jobStorage = yield* JobStorage;
+    const notifications = yield* JobNotifications;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+
+        if (request.method === "GET" && url.pathname === "/") {
+          const jobId = url.searchParams.get("jobId");
+          if (!jobId) {
+            return HttpServerResponse.text("Job ID is required", {
+              status: 400,
+            });
+          }
+
+          const job = yield* jobStorage.getJob(jobId).pipe(
+            Effect.match({
+              onFailure: (error) => error,
+              onSuccess: (job) => job,
+            }),
+          );
+
+          if (job instanceof GetJobError) {
+            return HttpServerResponse.text(job.message, { status: 500 });
+          }
+
+          if (!job) {
+            return HttpServerResponse.text("Job not found", { status: 404 });
+          }
+
+          return yield* HttpServerResponse.json(job);
+        }
+
+        if (request.method === "POST" && url.pathname === "/") {
+          const content = yield* request.text;
+          if (!content) {
+            return HttpServerResponse.text("Job content is required", {
+              status: 400,
+            });
+          }
+
+          const job = yield* jobStorage
+            .putJob({
+              id: crypto.randomUUID(),
+              content,
+            })
+            .pipe(
+              Effect.match({
+                onFailure: (error) => error,
+                onSuccess: (job) => job,
+              }),
+            );
+
+          if (job instanceof PutJobError) {
+            return HttpServerResponse.text(job.message, { status: 500 });
+          }
+
+          const notificationResult = yield* notifications
+            .notifyJobCreated(job)
+            .pipe(
+              Effect.match({
+                onFailure: (error) => error,
+                onSuccess: () => undefined,
+              }),
+            );
+
+          if (notificationResult instanceof NotifyJobError) {
+            return HttpServerResponse.text(notificationResult.message, {
+              status: 500,
+            });
+          }
+
+          return yield* HttpServerResponse.json(
+            { jobId: job.id },
+            { status: 201 },
+          );
+        }
+
+        return HttpServerResponse.text("Not found", { status: 404 });
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        // Services go here
+        JobStorageDynamoDB,
+        JobNotificationsSNS,
+        // JobStorageS3,
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-lambda/src/JobNotifications.ts b/.repos/alchemy-effect/examples/aws-lambda/src/JobNotifications.ts
new file mode 100644
index 00000000000..28a8959cdee
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/src/JobNotifications.ts
@@ -0,0 +1,90 @@
+import * as AWS from "alchemy/AWS";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import type { Job } from "./Job.ts";
+
+export class NotifyJobError extends Data.TaggedError("NotifyJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+type JobNotification = {
+  type: "job.created";
+  job: Job;
+};
+
+export class JobNotifications extends Context.Service<
+  JobNotifications,
+  {
+    notifyJobCreated(job: Job): Effect.Effect<void, NotifyJobError>;
+  }
+>()("JobNotifications") {}
+
+export const JobNotificationsSNS = Layer.effect(
+  JobNotifications,
+  Effect.gen(function* () {
+    const topic = yield* AWS.SNS.Topic("JobNotificationsTopic", {
+      attributes: {
+        DisplayName: "job-notifications",
+      },
+    });
+
+    const publish = yield* AWS.SNS.Publish.bind(topic);
+
+    yield* AWS.SNS.notifications(topic).subscribe((stream) =>
+      stream.pipe(
+        Stream.mapEffect((notification) =>
+          Effect.try({
+            try: () => JSON.parse(notification.Message) as JobNotification,
+            catch: (cause) =>
+              new NotifyJobError({
+                message: "Failed to parse SNS job notification",
+                cause,
+              }),
+          }).pipe(
+            Effect.flatMap((payload) =>
+              Effect.logInfo(
+                `Job notification received: ${payload.type} (${payload.job.id})`,
+              ),
+            ),
+            // Keep the example resilient to malformed demo messages.
+            Effect.catchTag("NotifyJobError", (error) =>
+              Effect.logWarning(error.message),
+            ),
+          ),
+        ),
+        Stream.runDrain,
+      ),
+    );
+
+    const notifyJobCreated = (job: Job) =>
+      publish({
+        Subject: "JobCreated",
+        Message: JSON.stringify({
+          type: "job.created",
+          job,
+        } satisfies JobNotification),
+      }).pipe(
+        Effect.asVoid,
+        Effect.mapError(
+          (cause) =>
+            new NotifyJobError({
+              message: `Failed to publish job notification for "${job.id}"`,
+              cause,
+            }),
+        ),
+      );
+
+    return JobNotifications.of({
+      notifyJobCreated,
+    });
+  }),
+).pipe(
+  Layer.provideMerge(
+    Layer.mergeAll(AWS.Lambda.TopicEventSource, AWS.SNS.PublishLive),
+  ),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda/src/JobStorage.ts b/.repos/alchemy-effect/examples/aws-lambda/src/JobStorage.ts
new file mode 100644
index 00000000000..15d42ae9fde
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/src/JobStorage.ts
@@ -0,0 +1,230 @@
+import * as DynamoDB from "alchemy/AWS/DynamoDB";
+import * as Lambda from "alchemy/AWS/Lambda";
+import * as S3 from "alchemy/AWS/S3";
+import * as SQS from "alchemy/AWS/SQS";
+import * as RemovalPolicy from "alchemy/RemovalPolicy";
+import { Stack } from "alchemy/Stack";
+import * as Console from "effect/Console";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import type { Job } from "./Job.ts";
+
+export class PutJobError extends Data.TaggedError("PutJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class GetJobError extends Data.TaggedError("GetJobError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class JobStorage extends Context.Service<
+  JobStorage,
+  {
+    putJob(job: Job): Effect.Effect<Job, PutJobError>;
+    getJob(jobId: string): Effect.Effect<Job | undefined, GetJobError>;
+  }
+>()("JobStorage") {}
+
+export const JobStorageDynamoDB = Layer.provideMerge(
+  Layer.effect(
+    JobStorage,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const table = yield* DynamoDB.Table("JobsTable", {
+        partitionKey: "id",
+        attributes: {
+          id: "S",
+        },
+      });
+      const queue = yield* SQS.Queue("JobsQueue").pipe(
+        RemovalPolicy.retain(stack.stage === "prod"),
+      );
+
+      const getItem = yield* DynamoDB.GetItem.bind(table);
+      const putItem = yield* DynamoDB.PutItem.bind(table);
+      const sink = yield* SQS.QueueSink.bind(queue);
+
+      yield* DynamoDB.stream(table, {
+        streamViewType: "NEW_AND_OLD_IMAGES",
+        startingPosition: "LATEST",
+        batchSize: 10,
+      }).process((stream) =>
+        stream.pipe(
+          Stream.map((record) =>
+            JSON.stringify({
+              eventName: record.eventName,
+              keys: record.dynamodb.Keys,
+              newImage: record.dynamodb.NewImage,
+              oldImage: record.dynamodb.OldImage,
+            }),
+          ),
+          Stream.run(sink),
+        ),
+      );
+
+      const putJob = (job: Job) =>
+        putItem({
+          Item: {
+            id: { S: job.id },
+            content: { S: job.content },
+          },
+        }).pipe(
+          Effect.map(() => job),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new PutJobError({
+                message: `Failed to store job "${job.id}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      const getJob = (jobId: string) =>
+        getItem({
+          Key: {
+            id: { S: jobId },
+          },
+        }).pipe(
+          Effect.flatMap((item) =>
+            item.Item
+              ? Effect.try({
+                  try: () =>
+                    ({
+                      id: item.Item?.id?.S ?? jobId,
+                      content: item.Item?.content?.S ?? "",
+                    }) as Job,
+                  catch: (cause) =>
+                    new GetJobError({
+                      message: `Failed to parse job "${jobId}": ${cause}`,
+                      cause,
+                    }),
+                })
+              : Effect.succeed(undefined),
+          ),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new GetJobError({
+                message: `Failed to load job "${jobId}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      return JobStorage.of({
+        putJob,
+        getJob,
+      });
+    }),
+  ),
+  Layer.mergeAll(Lambda.TableEventSource, SQS.QueueSinkLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        DynamoDB.GetItemLive,
+        DynamoDB.PutItemLive,
+        SQS.SendMessageBatchLive,
+      ),
+    ),
+  ),
+);
+
+export const JobStorageS3 = Layer.provideMerge(
+  Layer.effect(
+    JobStorage,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const bucket = yield* S3.Bucket("JobsBucket");
+      const queue = yield* SQS.Queue("JobsQueue").pipe(
+        RemovalPolicy.retain(stack.stage === "prod"),
+      );
+
+      const getObject = yield* S3.GetObject.bind(bucket);
+      const putObject = yield* S3.PutObject.bind(bucket);
+      const sink = yield* SQS.QueueSink.bind(queue);
+
+      const putJob = (job: Job) =>
+        putObject({
+          Key: job.id,
+          Body: JSON.stringify(job),
+        }).pipe(
+          Effect.map(() => job),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new PutJobError({
+                message: `Failed to store job "${job.id}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      const getJob = (jobId: string) =>
+        getObject({
+          Key: jobId,
+        }).pipe(
+          Effect.catchTag("NoSuchKey", () => Effect.succeed(undefined)),
+          Effect.flatMap(
+            (item) =>
+              item?.Body?.pipe(
+                Stream.decodeText,
+                Stream.mkString,
+                Effect.flatMap((body) =>
+                  Effect.try({
+                    try: () => JSON.parse(body) as Job,
+                    catch: (cause) =>
+                      new GetJobError({
+                        message: `Failed to parse job "${jobId}": ${cause}`,
+                        cause,
+                      }),
+                  }),
+                ),
+              ) ?? Effect.succeed(undefined),
+          ),
+          Effect.tapError(Console.log),
+          Effect.catchCause((cause) =>
+            Effect.fail(
+              new GetJobError({
+                message: `Failed to load job "${jobId}": ${cause}`,
+                cause,
+              }),
+            ),
+          ),
+        );
+
+      yield* S3.notifications(bucket).subscribe((stream) =>
+        stream.pipe(
+          Stream.flatMap((item) =>
+            Stream.fromEffect(getJob(item.key).pipe(Effect.orDie)),
+          ),
+          Stream.filter((job): job is Job => job !== undefined),
+          Stream.map((job) => JSON.stringify(job)),
+          Stream.run(sink),
+        ),
+      );
+
+      return JobStorage.of({
+        putJob,
+        getJob,
+      });
+    }),
+  ),
+  Layer.mergeAll(Lambda.BucketEventSource, SQS.QueueSinkLive).pipe(
+    Layer.provideMerge(
+      Layer.mergeAll(
+        S3.GetObjectLive,
+        S3.PutObjectLive,
+        SQS.SendMessageBatchLive,
+      ),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda/test/integ.test.ts b/.repos/alchemy-effect/examples/aws-lambda/test/integ.test.ts
new file mode 100644
index 00000000000..cba63151b21
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/test/integ.test.ts
@@ -0,0 +1,23 @@
+import * as AWS from "alchemy/AWS";
+import * as Alchemy from "alchemy";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: AWS.providers(),
+  state: Alchemy.localState(),
+});
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deploys and exposes a url",
+  Effect.gen(function* () {
+    const out = (yield* stack) as unknown;
+    const url = typeof out === "string" ? out : (out as { url: string }).url;
+    expect(url).toBeString();
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-lambda/tsconfig.json b/.repos/alchemy-effect/examples/aws-lambda/tsconfig.json
new file mode 100644
index 00000000000..0cf8c32afd6
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-lambda/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "test/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-rds/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-rds/alchemy.run.ts
new file mode 100644
index 00000000000..ba39d17db6c
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rds/alchemy.run.ts
@@ -0,0 +1,17 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+import ServiceFunction from "./src/ServiceFunction.ts";
+
+const aws = AWS.providers();
+
+export default Alchemy.Stack(
+  "AwsRdsExample",
+  { providers: aws, state: Alchemy.localState() },
+  Effect.gen(function* () {
+    const service = yield* ServiceFunction;
+    return {
+      url: service.functionUrl,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-rds/package.json b/.repos/alchemy-effect/examples/aws-rds/package.json
new file mode 100644
index 00000000000..f34b01b25ad
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rds/package.json
@@ -0,0 +1,25 @@
+{
+  "name": "aws-rds-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-rds"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@types/pg": "^8.18.0",
+    "alchemy": "workspace:*",
+    "effect": "catalog:",
+    "pg": "^8.20.0"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-rds/src/Database.ts b/.repos/alchemy-effect/examples/aws-rds/src/Database.ts
new file mode 100644
index 00000000000..83587f73771
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rds/src/Database.ts
@@ -0,0 +1,89 @@
+import * as AWS from "alchemy/AWS";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { Client } from "pg";
+import { Network } from "./Network.ts";
+
+export class SqlError extends Data.TaggedError("SqlError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class Database extends Context.Service<
+  Database,
+  {
+    query<Row extends Record<string, unknown> = Record<string, unknown>>(
+      statement: string,
+      values?: ReadonlyArray<unknown>,
+    ): Effect.Effect<ReadonlyArray<Row>, SqlError>;
+  }
+>()("Sql") {}
+
+export const DatabaseAurora = Layer.effect(
+  Database,
+  Effect.gen(function* () {
+    const { vpc, databaseSecurityGroup } = yield* Network;
+    const database = yield* AWS.RDS.Aurora("Database", {
+      subnetIds: vpc.privateSubnetIds,
+      securityGroupIds: [databaseSecurityGroup.groupId],
+    });
+
+    const connect = yield* AWS.RDS.Connect.bind(database.cluster, {
+      secret: database.secret,
+      subnetIds: vpc.privateSubnetIds,
+      securityGroupIds: [databaseSecurityGroup.groupId],
+    });
+
+    return Database.of({
+      query: <Row extends Record<string, unknown>>(
+        statement: string,
+        values: ReadonlyArray<unknown> = [],
+      ): Effect.Effect<ReadonlyArray<Row>, SqlError> =>
+        connect.pipe(
+          Effect.catch((cause) =>
+            Effect.fail(
+              new SqlError({
+                message: "Failed to resolve Aurora connection settings",
+                cause,
+              }),
+            ),
+          ),
+          Effect.flatMap((connection: AWS.RDS.ConnectionInfo) =>
+            Effect.tryPromise({
+              try: async () => {
+                const client = new Client({
+                  host: connection.host,
+                  port: connection.port,
+                  database: connection.database,
+                  user: connection.username,
+                  password: connection.password,
+                  // Example-only SSL posture for private Aurora connections.
+                  ssl: connection.ssl
+                    ? { rejectUnauthorized: false }
+                    : undefined,
+                });
+
+                await client.connect();
+                try {
+                  const result = await client.query<Row>({
+                    text: statement,
+                    values: [...values],
+                  });
+                  return result.rows as ReadonlyArray<Row>;
+                } finally {
+                  await client.end();
+                }
+              },
+              catch: (cause) =>
+                new SqlError({
+                  message: `Failed to execute SQL statement: ${statement}`,
+                  cause,
+                }),
+            }),
+          ),
+        ),
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-rds/src/Network.ts b/.repos/alchemy-effect/examples/aws-rds/src/Network.ts
new file mode 100644
index 00000000000..227fdb5f395
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rds/src/Network.ts
@@ -0,0 +1,58 @@
+import * as AWS from "alchemy/AWS";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export interface ExampleNetwork {
+  vpc: AWS.EC2.Network;
+  functionSecurityGroup: AWS.EC2.SecurityGroup;
+  databaseSecurityGroup: AWS.EC2.SecurityGroup;
+  privateSecurityGroups: AWS.EC2.SecurityGroup[];
+}
+
+export class Network extends Context.Service<Network, ExampleNetwork>()(
+  "Network",
+) {}
+
+export const NetworkLive = Layer.effect(
+  Network,
+  Effect.gen(function* () {
+    const network = yield* AWS.EC2.Network("Network", {
+      cidrBlock: "10.0.0.0/16",
+      availabilityZones: 2,
+      nat: "single",
+    });
+
+    const functionSecurityGroup = yield* AWS.EC2.SecurityGroup(
+      "FunctionSecurityGroup",
+      {
+        vpcId: network.vpcId,
+        description: "Security group for the RDS example Lambda function",
+      },
+    );
+
+    const databaseSecurityGroup = yield* AWS.EC2.SecurityGroup(
+      "DatabaseSecurityGroup",
+      {
+        vpcId: network.vpcId,
+        description: "Security group for the RDS example Aurora cluster",
+        ingress: [
+          {
+            ipProtocol: "tcp",
+            fromPort: 5432,
+            toPort: 5432,
+            referencedGroupId: functionSecurityGroup.groupId,
+            description: "Allow Lambda to reach Aurora PostgreSQL",
+          },
+        ],
+      },
+    );
+
+    return {
+      vpc: network,
+      functionSecurityGroup,
+      databaseSecurityGroup,
+      privateSecurityGroups: [functionSecurityGroup],
+    } satisfies ExampleNetwork;
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-rds/src/ServiceFunction.ts b/.repos/alchemy-effect/examples/aws-rds/src/ServiceFunction.ts
new file mode 100644
index 00000000000..9d07ec4f616
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rds/src/ServiceFunction.ts
@@ -0,0 +1,71 @@
+import * as AWS from "alchemy/AWS";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Database, DatabaseAurora } from "./Database.ts";
+import { NetworkLive } from "./Network.ts";
+
+export default class ServiceFunction extends AWS.Lambda.Function<ServiceFunction>()(
+  "ServiceFunction",
+  Stack.useSync((stack) => ({
+    main: import.meta.filename,
+    memory: stack.stage === "prod" ? 1024 : 512,
+    runtime: "nodejs24.x",
+  })),
+  Effect.gen(function* () {
+    const db = yield* Database;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        if (
+          request.method === "GET" &&
+          new URL(request.originalUrl).pathname === "/"
+        ) {
+          const response = yield* db
+            .query<{
+              database: string;
+              current_time: string;
+              current_user: string;
+            }>(
+              "select current_database() as database, now()::text as current_time, current_user::text as current_user",
+            )
+            .pipe(
+              Effect.match({
+                onFailure: (error) => ({
+                  status: 500 as const,
+                  body: {
+                    ok: false,
+                    error: error.message,
+                  },
+                }),
+                onSuccess: (rows) => ({
+                  status: 200 as const,
+                  body: {
+                    ok: true,
+                    connection: rows[0] ?? null,
+                  },
+                }),
+              }),
+            );
+
+          return yield* HttpServerResponse.json(response.body, {
+            status: response.status,
+          });
+        }
+
+        return HttpServerResponse.text("Not found", { status: 404 });
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(DatabaseAurora),
+        Layer.mergeAll(NetworkLive, AWS.RDS.ConnectLive),
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-rds/tsconfig.json b/.repos/alchemy-effect/examples/aws-rds/tsconfig.json
new file mode 100644
index 00000000000..e98040aede0
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rds/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "customConditions": ["bun"],
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-rest-api/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-rest-api/alchemy.run.ts
new file mode 100644
index 00000000000..79400366052
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rest-api/alchemy.run.ts
@@ -0,0 +1,84 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import JobFunction from "./src/JobFunction.ts";
+
+const aws = AWS.providers();
+
+export default Alchemy.Stack(
+  "AwsRestApiProxy",
+  {
+    providers: aws,
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const { region, accountId } = yield* AWS.AWSEnvironment;
+
+    const fn = yield* JobFunction;
+
+    const api = yield* AWS.ApiGateway.RestApi("PublicApi", {
+      name: "alchemy-example-rest-api",
+      endpointConfiguration: { types: ["REGIONAL"] },
+    });
+
+    const proxyResource = yield* AWS.ApiGateway.Resource("Proxy", {
+      restApiId: api.restApiId,
+      parentId: api.rootResourceId,
+      pathPart: "{proxy+}",
+    });
+
+    const invokeUri = Output.interpolate`arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/${fn.functionArn}/invocations`;
+
+    yield* AWS.ApiGateway.Method("RootAny", {
+      restApiId: api.restApiId,
+      resourceId: api.rootResourceId,
+      httpMethod: "ANY",
+      authorizationType: "NONE",
+      integration: {
+        type: "AWS_PROXY",
+        integrationHttpMethod: "POST",
+        uri: invokeUri,
+      },
+    });
+
+    yield* AWS.ApiGateway.Method("ProxyAny", {
+      restApiId: api.restApiId,
+      resourceId: proxyResource.resourceId,
+      httpMethod: "ANY",
+      authorizationType: "NONE",
+      integration: {
+        type: "AWS_PROXY",
+        integrationHttpMethod: "POST",
+        uri: invokeUri,
+      },
+    });
+
+    const deployment = yield* AWS.ApiGateway.Deployment("Release", {
+      restApiId: api.restApiId,
+      description: "initial",
+      triggers: {
+        rootMethod: "ANY",
+        proxyMethod: "ANY",
+      },
+    });
+
+    const stage = yield* AWS.ApiGateway.Stage("ProdStage", {
+      restApiId: api.restApiId,
+      stageName: "prod",
+      deploymentId: deployment.deploymentId,
+    });
+
+    yield* AWS.Lambda.Permission("ApiGatewayInvoke", {
+      action: "lambda:InvokeFunction",
+      functionName: fn.functionName,
+      principal: "apigateway.amazonaws.com",
+      sourceArn: Output.interpolate`arn:aws:execute-api:${region}:${accountId}:${api.restApiId}/*/*/*`,
+    });
+
+    return {
+      invokeUrl: Output.interpolate`https://${api.restApiId}.execute-api.${region}.amazonaws.com/${stage.stageName}/`,
+      restApiId: api.restApiId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-rest-api/package.json b/.repos/alchemy-effect/examples/aws-rest-api/package.json
new file mode 100644
index 00000000000..afa92a0669e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rest-api/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "aws-rest-api",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-rest-api"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/aws-rest-api/src/JobFunction.ts b/.repos/alchemy-effect/examples/aws-rest-api/src/JobFunction.ts
new file mode 100644
index 00000000000..7a48f093a64
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rest-api/src/JobFunction.ts
@@ -0,0 +1,22 @@
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+const main = import.meta.filename;
+
+/**
+ * Minimal Lambda for API Gateway `AWS_PROXY` — returns plain text.
+ */
+export default class JobFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "JobFunction",
+  {
+    main,
+  },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello from REST API + Lambda");
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/aws-rest-api/tsconfig.json b/.repos/alchemy-effect/examples/aws-rest-api/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-rest-api/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-static-site/README.md b/.repos/alchemy-effect/examples/aws-static-site/README.md
new file mode 100644
index 00000000000..6575d03f8da
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/README.md
@@ -0,0 +1,34 @@
+# AWS Static Site Example
+
+This example deploys a static website from the local `site/` directory using:
+
+- `AWS.Website.StaticSite`
+- private S3 origin
+- CloudFront distribution
+- optional ACM certificate in `us-east-1`
+- optional Route 53 alias records
+
+## Commands
+
+```sh
+bun install
+bun run --filter aws-static-site-example deploy
+```
+
+## Optional Custom Domain
+
+Set these environment variables before deploy:
+
+```sh
+export WEBSITE_DOMAIN=www.example.com
+export WEBSITE_ZONE_ID=Z1234567890
+export WEBSITE_ALIASES=example.com,static.example.com
+```
+
+When `WEBSITE_DOMAIN` and `WEBSITE_ZONE_ID` are provided, the example will:
+
+- request an ACM certificate
+- create Route 53 validation records
+- create Route 53 alias records to CloudFront
+
+Without them, the example still deploys and returns the CloudFront URL.
diff --git a/.repos/alchemy-effect/examples/aws-static-site/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-static-site/alchemy.run.ts
new file mode 100644
index 00000000000..b1c745b1a58
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/alchemy.run.ts
@@ -0,0 +1,29 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "AwsStaticSiteExample",
+  {
+    providers: AWS.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const site = yield* AWS.Website.StaticSite("MarketingSite", {
+      path: "./site",
+      // domain: "your.domain.com",
+      forceDestroy: true,
+      invalidation: {
+        paths: "all",
+      },
+      tags: {
+        Example: "aws-static-site",
+        Surface: "website",
+      },
+    });
+
+    return {
+      url: site.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/aws-static-site/package.json b/.repos/alchemy-effect/examples/aws-static-site/package.json
new file mode 100644
index 00000000000..355f7815215
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "aws-static-site-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-static-site"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-static-site/site/docs/index.html b/.repos/alchemy-effect/examples/aws-static-site/site/docs/index.html
new file mode 100644
index 00000000000..5f93bbe1250
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/site/docs/index.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Static Site Docs</title>
+    <link rel="stylesheet" href="/styles.css" />
+  </head>
+  <body>
+    <main class="page">
+      <p class="eyebrow">docs route</p>
+      <h1>Static hosting can ship multiple pages too.</h1>
+      <p class="lede">
+        This page is just another file in the deployed folder and is cached by
+        CloudFront as a normal static asset.
+      </p>
+      <div class="actions">
+        <a href="/">Back home</a>
+      </div>
+    </main>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/aws-static-site/site/index.html b/.repos/alchemy-effect/examples/aws-static-site/site/index.html
new file mode 100644
index 00000000000..ecbcda0690a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/site/index.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Alchemy AWS Static Site</title>
+    <link rel="stylesheet" href="/styles.css" />
+  </head>
+  <body>
+    <main class="page">
+      <p class="eyebrow">alchemy example</p>
+      <h1>AWS static site with CloudFront, ACM, and Route 53</h1>
+      <p class="lede">
+        This site is deployed from a plain folder using
+        <code>AWS.Website.StaticSite</code>.
+      </p>
+      <div class="actions">
+        <a href="/docs/">Read the docs page</a>
+        <a href="https://github.com/alchemy-run/alchemy-effect"
+          >View the repo</a
+        >
+      </div>
+    </main>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/aws-static-site/site/styles.css b/.repos/alchemy-effect/examples/aws-static-site/site/styles.css
new file mode 100644
index 00000000000..933f3357492
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/site/styles.css
@@ -0,0 +1,56 @@
+html,
+body {
+  margin: 0;
+  min-height: 100%;
+  font-family:
+    Inter,
+    ui-sans-serif,
+    system-ui,
+    -apple-system,
+    BlinkMacSystemFont,
+    "Segoe UI",
+    sans-serif;
+  background: linear-gradient(180deg, #0f172a 0%, #111827 100%);
+  color: #e5e7eb;
+}
+
+.page {
+  max-width: 48rem;
+  margin: 0 auto;
+  padding: 6rem 1.5rem;
+}
+
+.eyebrow {
+  text-transform: uppercase;
+  letter-spacing: 0.14em;
+  color: #93c5fd;
+  font-size: 0.875rem;
+}
+
+h1 {
+  font-size: clamp(2.5rem, 6vw, 4.5rem);
+  line-height: 1.05;
+  margin: 0.5rem 0 1rem;
+}
+
+.lede {
+  font-size: 1.125rem;
+  line-height: 1.7;
+  color: #cbd5e1;
+}
+
+.actions {
+  display: flex;
+  gap: 1rem;
+  flex-wrap: wrap;
+  margin-top: 2rem;
+}
+
+.actions a {
+  color: #0f172a;
+  background: #f8fafc;
+  text-decoration: none;
+  padding: 0.85rem 1.1rem;
+  border-radius: 999px;
+  font-weight: 600;
+}
diff --git a/.repos/alchemy-effect/examples/aws-static-site/tsconfig.json b/.repos/alchemy-effect/examples/aws-static-site/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-static-site/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-vite/README.md b/.repos/alchemy-effect/examples/aws-vite/README.md
new file mode 100644
index 00000000000..08ba6c988cb
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/README.md
@@ -0,0 +1,33 @@
+# AWS Vite Example
+
+This example builds a Vite app and deploys it with:
+
+- `Build.Build` for the frontend build step
+- `AWS.Website.StaticSite` for S3 + CloudFront hosting
+- optional ACM + Route 53 custom-domain wiring
+
+## Commands
+
+```sh
+bun install
+bun run --filter aws-vite-example build
+bun run --filter aws-vite-example deploy
+```
+
+For local frontend development:
+
+```sh
+bun run --filter aws-vite-example dev:vite
+```
+
+## Optional Custom Domain
+
+Set these environment variables before deploy:
+
+```sh
+export WEBSITE_DOMAIN=app.example.com
+export WEBSITE_ZONE_ID=Z1234567890
+export WEBSITE_ALIASES=www.app.example.com
+```
+
+Without them, the example still deploys and returns the CloudFront URL.
diff --git a/.repos/alchemy-effect/examples/aws-vite/alchemy.run.ts b/.repos/alchemy-effect/examples/aws-vite/alchemy.run.ts
new file mode 100644
index 00000000000..c863000acb9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/alchemy.run.ts
@@ -0,0 +1,103 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Output from "alchemy/Output";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+
+const aws = AWS.providers();
+
+const WEBSITE_DOMAIN = Config.string("WEBSITE_DOMAIN").pipe(
+  Config.option,
+  Config.map(Option.getOrUndefined),
+  (config) => config.asEffect(),
+);
+
+const WEBSITE_ZONE_ID = Config.string("WEBSITE_ZONE_ID").pipe(
+  Config.option,
+  Config.map(Option.getOrUndefined),
+  (config) => config.asEffect(),
+);
+
+const WEBSITE_ALIASES = Config.string("WEBSITE_ALIASES").pipe(
+  Config.option,
+  Config.map(Option.getOrUndefined),
+  Config.map((value) =>
+    value
+      ?.split(",")
+      .map((part) => part.trim())
+      .filter(Boolean),
+  ),
+  (config) => config.asEffect(),
+);
+
+export default Alchemy.Stack(
+  "AwsViteExample",
+  { providers: aws, state: Alchemy.localState() },
+  Effect.gen(function* () {
+    /**
+     * Optional Route 53 / ACM config.
+     *
+     * Set these before deploying if you want a custom domain:
+     * - WEBSITE_DOMAIN=app.example.com
+     * - WEBSITE_ZONE_ID=Z1234567890
+     * - WEBSITE_ALIASES=www.app.example.com
+     */
+    const websiteDomainName = yield* WEBSITE_DOMAIN;
+    const websiteZoneId = yield* WEBSITE_ZONE_ID;
+    const websiteAliases = yield* WEBSITE_ALIASES;
+    const websiteDomain =
+      websiteDomainName && websiteZoneId
+        ? {
+            name: websiteDomainName,
+            hostedZoneId: websiteZoneId,
+            aliases: websiteAliases,
+          }
+        : undefined;
+
+    const site = yield* AWS.Website.StaticSite("FrontendSite", {
+      path: ".",
+      build: {
+        command: "bun run build",
+        output: "dist",
+      },
+      environment: {
+        VITE_STAGE: "test",
+      },
+      spa: true,
+      cdn: false,
+      tags: {
+        Example: "aws-vite",
+        Surface: "website",
+      },
+    });
+
+    const router = yield* AWS.Website.Router("FrontendRouter", {
+      domain: websiteDomain,
+      routes: {
+        "/*": site.routeTarget,
+      },
+      invalidation: {
+        paths: "all",
+      },
+      tags: {
+        Example: "aws-vite",
+        Surface: "website",
+        Mode: "router",
+      },
+    });
+
+    return {
+      url: router.url,
+      cloudFrontDomain: router.distribution.domainName,
+      distributionId: router.distribution.distributionId,
+      bucketName: site.bucket.bucketName,
+      buildHash: site.build?.hash,
+      assetVersion: site.files.version,
+      certificateArn: router.certificate?.certificateArn as any,
+      customDomain: websiteDomain?.name,
+      aliasRecordNames: router.records.map((record) => record.name),
+      previewHint: Output.interpolate`Run bun run dev:vite for local frontend iteration, then deploy to publish ${router.distribution.domainName}`,
+    };
+  }) as any,
+);
diff --git a/.repos/alchemy-effect/examples/aws-vite/index.html b/.repos/alchemy-effect/examples/aws-vite/index.html
new file mode 100644
index 00000000000..8d58e614109
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/index.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>AWS Vite Example</title>
+    <script type="module" src="/src/main.ts"></script>
+  </head>
+  <body>
+    <div id="app"></div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/aws-vite/package.json b/.repos/alchemy-effect/examples/aws-vite/package.json
new file mode 100644
index 00000000000..372bde03e52
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "aws-vite-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/aws-vite"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "dev:vite": "vite",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@cloudflare/vite-plugin": "catalog:",
+    "@distilled.cloud/aws": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "devDependencies": {
+    "typescript": "catalog:",
+    "vite": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/aws-vite/src/main.ts b/.repos/alchemy-effect/examples/aws-vite/src/main.ts
new file mode 100644
index 00000000000..9ddf3e2dc36
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/src/main.ts
@@ -0,0 +1,24 @@
+import "./style.css";
+
+const app = document.querySelector<HTMLDivElement>("#app");
+
+if (!app) {
+  throw new Error("Missing #app root element");
+}
+
+app.innerHTML = `
+  <main class="page">
+    <p class="eyebrow">alchemy + vite</p>
+    <h1>Deploy a Vite SPA to AWS with CloudFront, ACM, and Route 53.</h1>
+    <p class="lede">
+      This example runs a Vite build and publishes the generated assets with
+      <code>AWS.Website.StaticSite</code> behind a shared
+      <code>AWS.Website.Router</code>.
+    </p>
+    <ul class="highlights">
+      <li>Build artifacts uploaded to a private S3 bucket</li>
+      <li>CloudFront Router in front of the site</li>
+      <li>Optional custom domain with ACM validation and Route 53 alias records</li>
+    </ul>
+  </main>
+`;
diff --git a/.repos/alchemy-effect/examples/aws-vite/src/style.css b/.repos/alchemy-effect/examples/aws-vite/src/style.css
new file mode 100644
index 00000000000..edc2347439c
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/src/style.css
@@ -0,0 +1,51 @@
+html,
+body {
+  margin: 0;
+  min-height: 100%;
+  font-family:
+    Inter,
+    ui-sans-serif,
+    system-ui,
+    -apple-system,
+    BlinkMacSystemFont,
+    "Segoe UI",
+    sans-serif;
+  background: #020617;
+  color: #e2e8f0;
+}
+
+#app {
+  min-height: 100vh;
+}
+
+.page {
+  max-width: 56rem;
+  margin: 0 auto;
+  padding: 6rem 1.5rem;
+}
+
+.eyebrow {
+  text-transform: uppercase;
+  letter-spacing: 0.16em;
+  color: #60a5fa;
+  font-size: 0.875rem;
+}
+
+h1 {
+  margin: 0.75rem 0 1rem;
+  font-size: clamp(2.5rem, 6vw, 4.25rem);
+  line-height: 1.05;
+}
+
+.lede {
+  font-size: 1.125rem;
+  line-height: 1.7;
+  color: #cbd5e1;
+}
+
+.highlights {
+  margin: 2rem 0 0;
+  padding-left: 1.25rem;
+  color: #bfdbfe;
+  line-height: 1.9;
+}
diff --git a/.repos/alchemy-effect/examples/aws-vite/tsconfig.json b/.repos/alchemy-effect/examples/aws-vite/tsconfig.json
new file mode 100644
index 00000000000..9e1b6430561
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/tsconfig.json
@@ -0,0 +1,18 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "vite.config.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    // TODO(sam): remove this once we have a proper implementation
+    "noCheck": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/aws-vite/vite.config.ts b/.repos/alchemy-effect/examples/aws-vite/vite.config.ts
new file mode 100644
index 00000000000..dbd8cc94be4
--- /dev/null
+++ b/.repos/alchemy-effect/examples/aws-vite/vite.config.ts
@@ -0,0 +1,6 @@
+import { cloudflare } from "@cloudflare/vite-plugin";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [cloudflare()],
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/.gitignore b/.repos/alchemy-effect/examples/cloudflare-dev/.gitignore
new file mode 100644
index 00000000000..532db46c01b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/.gitignore
@@ -0,0 +1 @@
+!src/modules/modules.d.ts
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-dev/alchemy.run.ts
new file mode 100644
index 00000000000..b070f57499f
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/alchemy.run.ts
@@ -0,0 +1,44 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { Counter as CounterClass } from "./src/AsyncWorker.ts";
+import EffectWorker from "./src/EffectWorker.ts";
+
+export const Counter = Cloudflare.DurableObjectNamespace<CounterClass>(
+  "Counter",
+  {
+    className: "Counter",
+  },
+);
+
+export type AsyncWorkerEnv = Cloudflare.InferEnv<typeof AsyncWorker>;
+
+export const AsyncWorker = Cloudflare.Worker("AsyncWorker", {
+  main: "./src/AsyncWorker.ts",
+  env: {
+    COUNTER: Counter,
+    MY_VARIABLE: "my-variable-abc123",
+    MY_SECRET: Config.redacted("MY_SECRET").pipe(
+      Config.withDefault(Redacted.make("my-secret-abc123")),
+    ),
+  },
+});
+
+export default Alchemy.Stack(
+  "CloudflareDev",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const asyncWorker = yield* AsyncWorker;
+    const effectWorker = yield* EffectWorker;
+
+    return {
+      asyncWorker: asyncWorker.url,
+      effectWorker: effectWorker.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/package.json b/.repos/alchemy-effect/examples/cloudflare-dev/package.json
new file mode 100644
index 00000000000..7d226cf5dd4
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/package.json
@@ -0,0 +1,27 @@
+{
+  "name": "cloudflare-dev",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-dev"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/src/AsyncWorker.ts b/.repos/alchemy-effect/examples/cloudflare-dev/src/AsyncWorker.ts
new file mode 100644
index 00000000000..0a8d51a30e7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/src/AsyncWorker.ts
@@ -0,0 +1,40 @@
+import { DurableObject } from "cloudflare:workers";
+import type { AsyncWorkerEnv } from "../alchemy.run.ts";
+import wasm from "./modules/wasm-example.wasm";
+
+interface AddInstance {
+  exports: {
+    add(a: number, b: number): number;
+  };
+}
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    switch (url.pathname) {
+      case "/env":
+        return Response.json(env);
+      case "/wasm":
+        const instance = (await WebAssembly.instantiate(wasm)) as AddInstance;
+        return Response.json({ result: instance.exports.add(3, 4) });
+      default:
+        const counter = env.COUNTER.getByName("my-counter");
+        const count = await counter.increment();
+        return new Response(`Hello, world! ${count}`);
+    }
+  },
+} satisfies ExportedHandler<AsyncWorkerEnv>;
+
+export class Counter extends DurableObject {
+  async increment() {
+    return ++this.counter;
+  }
+
+  get counter() {
+    return this.ctx.storage.kv.get<number>("counter") ?? 0;
+  }
+
+  set counter(value: number) {
+    this.ctx.storage.kv.put("counter", value);
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/src/EffectWorker.ts b/.repos/alchemy-effect/examples/cloudflare-dev/src/EffectWorker.ts
new file mode 100644
index 00000000000..541e40b6aca
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/src/EffectWorker.ts
@@ -0,0 +1,65 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { KV } from "./KV.ts";
+import NotifyWorkflow from "./NotifyWorkflow.ts";
+
+interface AddInstance {
+  exports: {
+    add(a: number, b: number): number;
+  };
+}
+
+export default class EffectWorker extends Cloudflare.Worker<EffectWorker>()(
+  "EffectWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+    const workflow = yield* NotifyWorkflow;
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const url = new URL(request.url, "http://internal");
+        if (url.pathname === "/wasm") {
+          const instance = yield* Effect.promise(async () => {
+            // This is dynamically imported so that the WASM import doesn't occur at deploy-time, which works in Bun but fails in Node.
+            const wasm = await import("./modules/wasm-example.wasm");
+            return (await WebAssembly.instantiate(wasm.default)) as AddInstance;
+          });
+          return yield* HttpServerResponse.json({
+            result: instance.exports.add(3, 4),
+          });
+        } else if (url.pathname.startsWith("/workflow/start/")) {
+          const roomId = url.pathname.split("/workflow/start/")[1];
+          if (!roomId) {
+            return yield* HttpServerResponse.json(
+              { error: "roomId is required" },
+              { status: 400 },
+            );
+          }
+          const instance = yield* workflow.create({
+            roomId,
+            message: "hello from workflow",
+          });
+          return yield* HttpServerResponse.json({ instanceId: instance.id });
+        } else if (url.pathname.startsWith("/workflow/status/")) {
+          const instanceId = url.pathname.split("/workflow/status/")[1];
+          if (!instanceId) {
+            return yield* HttpServerResponse.json(
+              { error: "instanceId is required" },
+              { status: 400 },
+            );
+          }
+          const instance = yield* workflow.get(instanceId);
+          const status = yield* instance.status();
+          return yield* HttpServerResponse.json(status);
+        }
+        const value = yield* kv.list().pipe(Effect.orDie);
+        return yield* HttpServerResponse.json(value);
+      }),
+    };
+  }).pipe(Effect.provide([Cloudflare.KVNamespaceBindingLive])),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/src/KV.ts b/.repos/alchemy-effect/examples/cloudflare-dev/src/KV.ts
new file mode 100644
index 00000000000..a423af5f86b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/src/KV.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const KV = Cloudflare.KVNamespace("KV");
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/src/NotifyWorkflow.ts b/.repos/alchemy-effect/examples/cloudflare-dev/src/NotifyWorkflow.ts
new file mode 100644
index 00000000000..be3701d86ff
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/src/NotifyWorkflow.ts
@@ -0,0 +1,83 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { KV } from "./KV.ts";
+
+/**
+ * Hard-coded value the integ test asserts on to prove the secret was
+ * bound at plantime and read at runtime through the `Redacted` accessor.
+ */
+export const WORKFLOW_SECRET_VALUE = "wf-secret-abc123";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    // Bind a `secret_text` on the workflow at plantime. Using a literal
+    // (instead of `Config.redacted("WORKFLOW_SECRET")`) keeps the integ
+    // test self-contained — no `.env` setup required.
+    const secret = yield* Config.redacted("WORKFLOW_SECRET").pipe(
+      Config.withDefault(Redacted.make(WORKFLOW_SECRET_VALUE)),
+    );
+    // Regression guard for https://github.com/alchemy-run/alchemy-effect/pull/71
+    //
+    // The kv binding internally yields `Cloudflare.WorkerEnvironment` —
+    // before that PR, accessing `WorkerEnvironment` inside a workflow body
+    // crashed because `provideService(WorkerEnvironment, env)` was applied
+    // to the outer `Effect.succeed(body)` wrapper (a no-op) instead of
+    // `body` itself in `Workflow.ts`. Exercising `kv.put` / `kv.get` from
+    // inside a `task` keeps the integ test catching any future regression.
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+
+      const stored = yield* Cloudflare.task(
+        "kv-roundtrip",
+        Effect.gen(function* () {
+          const key = `workflow:smoke:${roomId}`;
+          yield* kv.put(key, message);
+          const got = yield* kv.get(key);
+          if (got !== message) {
+            return yield* Effect.die(
+              new Error(
+                `KV roundtrip mismatch: expected "${message}", got "${got ?? "null"}"`,
+              ),
+            );
+          }
+          return got;
+        }).pipe(Effect.orDie),
+      );
+
+      // Resolve the bound secret inside the workflow body. The accessor
+      // returns `Redacted<string>`; unwrap only where the value needs to
+      // leave the workflow (here, in the broadcast + the returned output
+      // so the integ test can assert end-to-end propagation).
+      const secretValue = Redacted.value(secret);
+
+      const processed = yield* Cloudflare.task(
+        "process",
+        Effect.succeed({
+          text: `Processed: ${stored}`,
+          secret: secretValue,
+          ts: Date.now(),
+        }),
+      );
+
+      // const room = rooms.getByName(roomId);
+      // yield* Cloudflare.task(
+      //   "broadcast",
+      //   room.broadcast(`[workflow] ${processed.text} secret=${secretValue}`),
+      // );
+
+      // yield* Cloudflare.sleep("cooldown", "2 seconds");
+
+      // yield* Cloudflare.task(
+      //   "finalize",
+      //   room.broadcast(`[workflow] complete for ${roomId}`),
+      // );
+
+      return processed;
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/src/modules/modules.d.ts b/.repos/alchemy-effect/examples/cloudflare-dev/src/modules/modules.d.ts
new file mode 100644
index 00000000000..d3e824fde93
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/src/modules/modules.d.ts
@@ -0,0 +1,4 @@
+declare module "*.wasm" {
+  const content: Uint8Array;
+  export default content;
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/src/modules/wasm-example.wasm b/.repos/alchemy-effect/examples/cloudflare-dev/src/modules/wasm-example.wasm
new file mode 100644
index 00000000000..357f72da7a0
Binary files /dev/null and b/.repos/alchemy-effect/examples/cloudflare-dev/src/modules/wasm-example.wasm differ
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-dev/test/integ.test.ts
new file mode 100644
index 00000000000..1e17faa6808
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/test/integ.test.ts
@@ -0,0 +1,190 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+import { WORKFLOW_SECRET_VALUE } from "../src/NotifyWorkflow.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+  dev: true,
+});
+
+const stack = beforeAll(deploy(Stack));
+
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deploys all workers with URLs",
+  Effect.gen(function* () {
+    const { asyncWorker, effectWorker } = yield* stack;
+
+    expect(asyncWorker).toBeString();
+    expect(effectWorker).toBeString();
+  }),
+);
+
+/**
+ * AsyncWorker exports a default fetch handler that calls the `Counter`
+ * Durable Object's `increment()` and returns `Hello, world! <n>`.
+ *
+ * Hitting the worker twice exercises the DO end-to-end and proves
+ * persistent state across requests — if the DO binding is missing or
+ * the class export is wrong, the first request fails outright.
+ */
+test(
+  "AsyncWorker increments the Counter Durable Object across requests",
+  Effect.gen(function* () {
+    const { asyncWorker } = yield* stack;
+    const url = asyncWorker!;
+
+    const first = yield* HttpClient.get(url);
+    expect(first.status).toBe(200);
+    const firstBody = yield* first.text;
+    const firstMatch = firstBody.match(/^Hello, world! (\d+)$/);
+    expect(firstMatch).not.toBeNull();
+    const firstCount = Number(firstMatch![1]);
+
+    const second = yield* HttpClient.get(url);
+    expect(second.status).toBe(200);
+    const secondBody = yield* second.text;
+    const secondMatch = secondBody.match(/^Hello, world! (\d+)$/);
+    expect(secondMatch).not.toBeNull();
+    const secondCount = Number(secondMatch![1]);
+
+    expect(secondCount).toBe(firstCount + 1);
+  }),
+);
+
+test(
+  "AsyncWorker receives bindings, including variables and secrets",
+  Effect.gen(function* () {
+    const { asyncWorker } = yield* stack;
+    const response = yield* HttpClient.get(new URL("/env", asyncWorker!));
+    expect(response.status).toBe(200);
+    const body = yield* response.json;
+    expect(body).toMatchObject({
+      MY_SECRET: "my-secret-abc123",
+      MY_VARIABLE: "my-variable-abc123",
+      COUNTER: {},
+    });
+  }),
+);
+
+/**
+ * EffectWorker binds a KV namespace via `Cloudflare.KVNamespace.bind(KV)`
+ * and returns the result of `kv.list()` as JSON. A successful response
+ * proves the Effect-style binding wired the runtime SDK and the
+ * `WorkerEnvironment` service was provisioned for the fetch handler.
+ */
+test(
+  "EffectWorker returns a KV list result via the Effect KV binding",
+  Effect.gen(function* () {
+    const { effectWorker } = yield* stack;
+
+    const response = yield* HttpClient.get(effectWorker!);
+    expect(response.status).toBe(200);
+
+    const body = (yield* response.json) as {
+      keys: Array<{ name: string }>;
+      list_complete: boolean;
+    };
+    expect(Array.isArray(body.keys)).toBe(true);
+    expect(typeof body.list_complete).toBe("boolean");
+  }),
+);
+
+/**
+ * Both workers import `./modules/wasm-example.wasm`, which exports a
+ * single `add(a: number, b: number): number` function. Hitting `/wasm`
+ * instantiates the module and returns `add(3, 4)` as JSON, proving that
+ * the bundler ships the wasm asset to workerd and that runtime
+ * `WebAssembly.instantiate` works for both the raw async-handler and
+ * Effect-style entrypoints.
+ */
+test(
+  "AsyncWorker /wasm instantiates the wasm module and returns add(3, 4)",
+  Effect.gen(function* () {
+    const { asyncWorker } = yield* stack;
+
+    const response = yield* HttpClient.get(new URL("/wasm", asyncWorker!));
+    expect(response.status).toBe(200);
+    const body = (yield* response.json) as { result: number };
+    expect(body.result).toBe(7);
+  }),
+);
+
+test(
+  "EffectWorker /wasm instantiates the wasm module and returns add(3, 4)",
+  Effect.gen(function* () {
+    const { effectWorker } = yield* stack;
+
+    const response = yield* HttpClient.get(new URL("/wasm", effectWorker!));
+    expect(response.status).toBe(200);
+    const body = (yield* response.json) as { result: number };
+    expect(body.result).toBe(7);
+  }),
+);
+
+interface WorkflowStatus {
+  status: string;
+  output?: { text?: string; secret?: string; ts?: number };
+  error?: { name: string; message: string } | null;
+}
+
+/**
+ * Start a `NotifyWorkflow` instance through `workerUrl` and poll its status
+ * until the instance reaches a terminal state. Asserts the workflow ran the
+ * KV roundtrip task (`Processed: <message>`) and resolved the plantime-bound
+ * `Alchemy.Secret` at runtime (`output.secret === WORKFLOW_SECRET_VALUE`).
+ */
+const exerciseWorkflow = (workerUrl: string, label: string) =>
+  Effect.gen(function* () {
+    const roomId = `${label}-${Math.random().toString(36).slice(2, 10)}`;
+
+    const startResponse = yield* HttpClient.post(
+      new URL(`/workflow/start/${roomId}`, workerUrl),
+    );
+    expect(startResponse.status).toBe(200);
+    const { instanceId } = (yield* startResponse.json) as {
+      instanceId: string;
+    };
+    expect(instanceId).toBeString();
+
+    const statusUrl = new URL(`/workflow/status/${instanceId}`, workerUrl);
+    const fetchStatus = HttpClient.get(statusUrl).pipe(
+      Effect.flatMap((res) => res.json),
+      Effect.map((json) => json as unknown as WorkflowStatus),
+    );
+    const status = yield* fetchStatus.pipe(
+      Effect.repeat({
+        schedule: Schedule.spaced("2 seconds"),
+        until: (s: WorkflowStatus) =>
+          s.status === "complete" || s.status === "errored",
+        times: 60,
+      }),
+    );
+
+    expect(status.error).toBeFalsy();
+    expect(status.status).toBe("complete");
+    expect(status.output?.secret).toBe(WORKFLOW_SECRET_VALUE);
+    expect(status.output?.text).toBe("Processed: hello from workflow");
+  });
+
+/**
+ * EffectWorker `/workflow/start/:roomId` kicks off `NotifyWorkflow`, which
+ * does a KV roundtrip task and resolves the `WORKFLOW_SECRET` `Alchemy.Secret`
+ * at runtime. The status route surfaces the workflow output so we can assert
+ * the workflow actually executed end-to-end (not just that it was scheduled).
+ */
+test(
+  "EffectWorker drives NotifyWorkflow to completion with secret + KV roundtrip",
+  Effect.gen(function* () {
+    const { effectWorker } = yield* stack;
+    yield* exerciseWorkflow(effectWorker!, "effect");
+  }),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-dev/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-dev/tsconfig.json
new file mode 100644
index 00000000000..11462becb0a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-dev/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "src/**/*.d.ts", "test/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "types": ["bun", "@cloudflare/workers-types"]
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-email/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-email/alchemy.run.ts
new file mode 100644
index 00000000000..9ae01e6030e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-email/alchemy.run.ts
@@ -0,0 +1,29 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+import Api from "./src/Api.ts";
+import { Destination, InboxRule, Routing } from "./src/Email.ts";
+
+export default Alchemy.Stack(
+  "CloudflareEmailExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const routing = yield* Routing;
+    const destination = yield* Destination;
+    const rule = yield* InboxRule;
+    const api = yield* Api;
+
+    return {
+      url: api.url.as<string>(),
+      zoneId: routing.zoneId,
+      routingEnabled: routing.enabled,
+      destinationEmail: destination.email,
+      destinationVerified: destination.verified,
+      ruleId: rule.ruleId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-email/package.json b/.repos/alchemy-effect/examples/cloudflare-email/package.json
new file mode 100644
index 00000000000..15338650cf5
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-email/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "cloudflare-email",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/alchemy-run/alchemy-effect"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-email/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-email/src/Api.ts
new file mode 100644
index 00000000000..b4bd06b9e8e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-email/src/Api.ts
@@ -0,0 +1,67 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { DESTINATION, SendEmail, SENDER } from "./Email.ts";
+
+/**
+ * Minimal email service Worker.
+ *
+ * - `GET /healthz` — liveness probe.
+ * - `POST /send` body `{ subject, text }` — sends mail from the bound
+ *   sender to the bound destination via the Worker's `send_email`
+ *   binding. Returns `{ ok: true }` on success or `{ ok: false, message }`
+ *   on a Cloudflare-side rejection (e.g. unverified destination).
+ */
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const email = yield* Cloudflare.SendEmail.bind(SendEmail);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (url.pathname === "/healthz") {
+          return yield* HttpServerResponse.json({
+            ok: true,
+            from: SENDER,
+            to: DESTINATION,
+          });
+        }
+
+        if (url.pathname === "/send" && request.method === "POST") {
+          const body = (yield* request.json) as {
+            subject?: string;
+            text?: string;
+          };
+          const result = yield* email
+            .send({
+              from: SENDER,
+              to: DESTINATION,
+              subject: body.subject ?? "alchemy email example",
+              text: body.text ?? `sent at ${new Date().toISOString()}`,
+            })
+            .pipe(
+              Effect.match({
+                onSuccess: () => ({ ok: true as const }),
+                onFailure: (err) => ({
+                  ok: false as const,
+                  message: err.message,
+                }),
+              }),
+            );
+          return yield* HttpServerResponse.json(result);
+        }
+
+        return HttpServerResponse.text("not found", { status: 404 });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.SendEmailBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-email/src/Email.ts b/.repos/alchemy-effect/examples/cloudflare-email/src/Email.ts
new file mode 100644
index 00000000000..0a69f2e6343
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-email/src/Email.ts
@@ -0,0 +1,60 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+/**
+ * Cloudflare zone the example operates on. The same zone is used for
+ * inbound (Email Routing) and outbound (`send_email` sender domain).
+ */
+export const ZONE = "alchemy-test-2.us";
+
+/**
+ * `from:` address the Worker is allowed to send mail as. Must live on a
+ * sender domain with Email Routing enabled (the `Routing` resource below
+ * takes care of that).
+ */
+export const SENDER = process.env.CLOUDFLARE_EMAIL_FROM ?? `bot@${ZONE}`;
+
+/**
+ * Destination the rules forward inbound mail to and that the Worker is
+ * pinned to send to. Cloudflare requires this address to be verified
+ * (recipient clicks a confirmation link) before any rule will deliver.
+ */
+export const DESTINATION = process.env.CLOUDFLARE_EMAIL_TO ?? "sam@alchemy.run";
+
+/**
+ * Enable Email Routing on the zone. This is the prerequisite for both
+ * receiving mail (rules) and sending mail from a Worker (`send_email`
+ * sender domain).
+ */
+export const Routing = Cloudflare.EmailRouting("Routing", {
+  zone: ZONE,
+});
+
+/**
+ * Register the destination address on the account. Cloudflare emails a
+ * verification link the first time this address is added; until the
+ * recipient clicks it, rules forwarding here will silently drop.
+ */
+export const Destination = Cloudflare.EmailAddress("Destination", {
+  email: DESTINATION,
+});
+
+/**
+ * Forward inbound `inbox@<ZONE>` mail to the verified destination. The
+ * matcher is a literal `to:` match; everything else falls through to
+ * whatever catch-all rule (if any) is configured on the zone.
+ */
+export const InboxRule = Cloudflare.EmailRule("InboxRule", {
+  zone: ZONE,
+  name: "Forward inbox to destination",
+  matchers: [{ type: "literal", field: "to", value: `inbox@${ZONE}` }],
+  actions: [{ type: "forward", value: [DESTINATION] }],
+});
+
+/**
+ * `send_email` Worker binding restricted to the sender/destination pair
+ * above so the Worker can't be tricked into emailing arbitrary recipients.
+ */
+export const SendEmail = Cloudflare.SendEmail("Email", {
+  allowedSenderAddresses: [SENDER],
+  destinationAddress: DESTINATION,
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-email/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-email/test/integ.test.ts
new file mode 100644
index 00000000000..bbdbbecc172
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-email/test/integ.test.ts
@@ -0,0 +1,95 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// workers.dev URLs take a few seconds to propagate after first enable.
+const getOnce = (url: string) =>
+  Effect.gen(function* () {
+    const response = yield* HttpClient.get(url);
+    if (response.status === 404) {
+      return yield* Effect.fail(new Error("workers.dev not yet propagated"));
+    }
+    return response;
+  }).pipe(Effect.retry({ schedule: Schedule.spaced("1 second"), times: 30 }));
+
+test(
+  "stack outputs reflect the deployed email infrastructure",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    expect(out.url).toBeString();
+    expect(out.zoneId).toBeString();
+    expect(out.routingEnabled).toBe(true);
+    expect(out.destinationEmail).toBeString();
+    expect(out.ruleId).toBeString();
+  }),
+);
+
+test(
+  "worker exposes the configured sender/destination on /healthz",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const response = yield* getOnce(`${url.replace(/\/+$/, "")}/healthz`);
+    expect(response.status).toBe(200);
+    const body = (yield* response.json) as {
+      ok: boolean;
+      from: string;
+      to: string;
+    };
+    expect(body.ok).toBe(true);
+    expect(body.from).toBeString();
+    expect(body.to).toBeString();
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "worker sends an email via the send_email binding",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    yield* getOnce(baseUrl);
+
+    const response = yield* HttpClient.execute(
+      HttpClientRequest.post(`${baseUrl}/send`).pipe(
+        HttpClientRequest.setBody(
+          HttpBody.text(
+            JSON.stringify({
+              subject: `alchemy integ ${Date.now()}`,
+              text: "hello from cloudflare-email integ.test.ts",
+            }),
+            "application/json",
+          ),
+        ),
+      ),
+    );
+    expect(response.status).toBe(200);
+    const body = (yield* response.json) as {
+      ok: boolean;
+      message?: string;
+    };
+    if (!body.ok) {
+      // Surface the Cloudflare-side error so the failure is debuggable.
+      // Most often: "destination address not verified" until a human
+      // clicks the link sent by EmailAddress.
+      throw new Error(`send_email rejected the message: ${body.message}`);
+    }
+    expect(body.ok).toBe(true);
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-email/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-email/tsconfig.json
new file mode 100644
index 00000000000..0cf8c32afd6
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-email/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "test/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/alchemy.run.ts
new file mode 100644
index 00000000000..14eb7a4c9ef
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/alchemy.run.ts
@@ -0,0 +1,20 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+import Api from "./src/Worker.ts";
+
+export default Alchemy.Stack(
+  "CloudflareGitArtifacts",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const api = yield* Api;
+
+    return {
+      url: api.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/package.json b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/package.json
new file mode 100644
index 00000000000..a11fc3bcb86
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/package.json
@@ -0,0 +1,26 @@
+{
+  "name": "cloudflare-git-artifacts",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-git-artifacts"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Api.ts
new file mode 100644
index 00000000000..cafde83861e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Api.ts
@@ -0,0 +1,129 @@
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
+
+// ─── Domain types ────────────────────────────────────────────────────
+
+export class Metadata extends Schema.Class<Metadata>("Metadata")({
+  description: Schema.String,
+  topics: Schema.Array(Schema.String),
+  stars: Schema.Number,
+  createdAt: Schema.Number,
+}) {}
+
+export class RepoInfo extends Schema.Class<RepoInfo>("RepoInfo")({
+  id: Schema.String,
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  defaultBranch: Schema.String,
+  remote: Schema.String,
+  status: Schema.String,
+  readOnly: Schema.Boolean,
+  createdAt: Schema.String,
+  updatedAt: Schema.String,
+  lastPushAt: Schema.NullOr(Schema.String),
+  metadata: Schema.NullOr(Metadata),
+}) {}
+
+export class CreateRepoResponse extends Schema.Class<CreateRepoResponse>(
+  "CreateRepoResponse",
+)({
+  name: Schema.String,
+  remote: Schema.String,
+  token: Schema.String,
+  defaultBranch: Schema.String,
+}) {}
+
+export class CloneToken extends Schema.Class<CloneToken>("CloneToken")({
+  id: Schema.String,
+  plaintext: Schema.String,
+  scope: Schema.Literals(["read", "write"]),
+  expiresAt: Schema.String,
+}) {}
+
+// ─── Errors ─────────────────────────────────────────────────────────
+
+export class RepoNotFound extends Schema.TaggedErrorClass<RepoNotFound>()(
+  "RepoNotFound",
+  { name: Schema.String },
+) {}
+
+export class RepoConflict extends Schema.TaggedErrorClass<RepoConflict>()(
+  "RepoConflict",
+  { message: Schema.String },
+) {}
+
+// ─── Path / payload schemas ──────────────────────────────────────────
+
+const RepoNameParam = Schema.Struct({ name: Schema.String });
+
+const CreateRepoPayload = Schema.Struct({
+  name: Schema.String,
+  description: Schema.optional(Schema.String),
+});
+
+const UpdateRepoPayload = Schema.Struct({
+  description: Schema.optional(Schema.String),
+  topics: Schema.optional(Schema.Array(Schema.String)),
+});
+
+const CloneTokenPayload = Schema.Struct({
+  scope: Schema.optional(Schema.Literals(["read", "write"])),
+  ttl: Schema.optional(Schema.Number),
+});
+
+// ─── Endpoints ──────────────────────────────────────────────────────
+
+export const createRepo = HttpApiEndpoint.post("createRepo", "/repos", {
+  payload: CreateRepoPayload,
+  success: CreateRepoResponse,
+  error: RepoConflict,
+});
+
+export const getRepo = HttpApiEndpoint.get("getRepo", "/repos/:name", {
+  params: RepoNameParam,
+  success: RepoInfo,
+  error: RepoNotFound,
+});
+
+export const updateRepo = HttpApiEndpoint.patch("updateRepo", "/repos/:name", {
+  params: RepoNameParam,
+  payload: UpdateRepoPayload,
+  success: Metadata,
+  error: RepoNotFound,
+});
+
+export const deleteRepo = HttpApiEndpoint.delete("deleteRepo", "/repos/:name", {
+  params: RepoNameParam,
+  success: HttpApiSchema.NoContent,
+  error: RepoNotFound,
+});
+
+export const starRepo = HttpApiEndpoint.post("starRepo", "/repos/:name/star", {
+  params: RepoNameParam,
+  success: Metadata,
+  error: RepoNotFound,
+});
+
+export const cloneToken = HttpApiEndpoint.post(
+  "cloneToken",
+  "/repos/:name/clone-token",
+  {
+    params: RepoNameParam,
+    payload: CloneTokenPayload,
+    success: CloneToken,
+    error: RepoNotFound,
+  },
+);
+
+export class ReposGroup extends HttpApiGroup.make("repos")
+  .add(createRepo)
+  .add(getRepo)
+  .add(updateRepo)
+  .add(deleteRepo)
+  .add(starRepo)
+  .add(cloneToken) {}
+
+export class RepoApi extends HttpApi.make("RepoApi").add(ReposGroup) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Repo.ts b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Repo.ts
new file mode 100644
index 00000000000..2a1c746243e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Repo.ts
@@ -0,0 +1,56 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export type Metadata = {
+  description: string;
+  topics: string[];
+  stars: number;
+  createdAt: number;
+};
+
+export default class Repo extends Cloudflare.DurableObjectNamespace<Repo>()(
+  "Repo",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      let meta = (yield* state.storage.get<Metadata>("meta")) ?? null;
+
+      const ensure = Effect.gen(function* () {
+        if (meta === null) {
+          return yield* Effect.fail(new Error("repo not initialized"));
+        }
+        return meta;
+      });
+
+      return {
+        init: (description: string) =>
+          Effect.gen(function* () {
+            if (meta !== null) return meta;
+            meta = {
+              description,
+              topics: [],
+              stars: 0,
+              createdAt: Date.now(),
+            };
+            yield* state.storage.put("meta", meta);
+            return meta;
+          }),
+        get: () => ensure,
+        update: (patch: Partial<Pick<Metadata, "description" | "topics">>) =>
+          Effect.gen(function* () {
+            const current = yield* ensure;
+            meta = { ...current, ...patch };
+            yield* state.storage.put("meta", meta);
+            return meta;
+          }),
+        star: () =>
+          Effect.gen(function* () {
+            const current = yield* ensure;
+            meta = { ...current, stars: current.stars + 1 };
+            yield* state.storage.put("meta", meta);
+            return meta;
+          }),
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Repos.ts b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Repos.ts
new file mode 100644
index 00000000000..2ed940cd088
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Repos.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Repos = Cloudflare.Artifacts("Repos");
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Worker.ts b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Worker.ts
new file mode 100644
index 00000000000..37b032d037c
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/src/Worker.ts
@@ -0,0 +1,174 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import {
+  CloneToken,
+  CreateRepoResponse,
+  Metadata,
+  RepoApi,
+  RepoConflict,
+  RepoInfo,
+  RepoNotFound,
+} from "./Api.ts";
+import Repo from "./Repo.ts";
+import { Repos } from "./Repos.ts";
+
+// Workers don't have a FileSystem, so HttpPlatform's file-response surface
+// is stubbed. The repo API never serves files.
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+  fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+  fileWebResponse: () =>
+    Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+
+export default class Worker extends Cloudflare.Worker<Worker>()(
+  "Api",
+  {
+    main: import.meta.filename,
+    observability: { enabled: true },
+    compatibility: {
+      flags: ["nodejs_compat"],
+      date: "2026-03-17",
+    },
+  },
+  Effect.gen(function* () {
+    const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
+    const repos = yield* Repo;
+
+    const findRepo = (name: string) =>
+      artifacts.list({ limit: 100 }).pipe(
+        Effect.flatMap((res) => {
+          const found = res.repos.find(
+            (r: { name: string }) => r.name === name,
+          );
+          return found
+            ? Effect.succeed(found)
+            : Effect.fail(new RepoNotFound({ name }));
+        }),
+        Effect.catchTag("ArtifactsError", () =>
+          Effect.fail(new RepoNotFound({ name })),
+        ),
+      );
+
+    const handlers = HttpApiBuilder.group(RepoApi, "repos", (h) =>
+      h
+        .handle("createRepo", ({ payload }) =>
+          artifacts
+            .create(payload.name, {
+              description: payload.description,
+              setDefaultBranch: "main",
+            })
+            .pipe(
+              Effect.tap(() =>
+                repos
+                  .getByName(payload.name)
+                  .init(payload.description ?? "")
+                  .pipe(Effect.orDie),
+              ),
+              Effect.map(
+                (c) =>
+                  new CreateRepoResponse({
+                    name: c.name,
+                    remote: c.remote,
+                    token: c.token,
+                    defaultBranch: c.defaultBranch,
+                  }),
+              ),
+              Effect.catchTag("ArtifactsError", (err) =>
+                Effect.fail(new RepoConflict({ message: err.message })),
+              ),
+            ),
+        )
+        .handle("getRepo", ({ params }) =>
+          findRepo(params.name).pipe(
+            Effect.flatMap((found) =>
+              repos
+                .getByName(params.name)
+                .get()
+                .pipe(
+                  Effect.catch(() => Effect.succeed(null)),
+                  Effect.map(
+                    (meta) =>
+                      new RepoInfo({
+                        id: found.id,
+                        name: found.name,
+                        description: found.description ?? null,
+                        defaultBranch: found.defaultBranch,
+                        remote: found.remote,
+                        status: found.status,
+                        readOnly: found.readOnly,
+                        createdAt: found.createdAt,
+                        updatedAt: found.updatedAt,
+                        lastPushAt: found.lastPushAt ?? null,
+                        metadata: meta ? new Metadata(meta) : null,
+                      }),
+                  ),
+                ),
+            ),
+          ),
+        )
+        .handle("updateRepo", ({ params, payload }) =>
+          findRepo(params.name).pipe(
+            Effect.flatMap(() =>
+              repos
+                .getByName(params.name)
+                .update({
+                  description: payload.description,
+                  topics: payload.topics ? [...payload.topics] : undefined,
+                })
+                .pipe(Effect.orDie),
+            ),
+            Effect.map((m) => new Metadata(m)),
+          ),
+        )
+        .handle("deleteRepo", ({ params }) =>
+          artifacts.delete(params.name).pipe(
+            Effect.asVoid,
+            Effect.catchTag("ArtifactsError", () =>
+              Effect.fail(new RepoNotFound({ name: params.name })),
+            ),
+          ),
+        )
+        .handle("starRepo", ({ params }) =>
+          findRepo(params.name).pipe(
+            Effect.flatMap(() =>
+              repos.getByName(params.name).star().pipe(Effect.orDie),
+            ),
+            Effect.map((m) => new Metadata(m)),
+          ),
+        )
+        .handle("cloneToken", ({ params, payload }) =>
+          artifacts.get(params.name).pipe(
+            Effect.flatMap((handle) =>
+              handle.createToken(payload.scope ?? "read", payload.ttl ?? 3600),
+            ),
+            Effect.map(
+              (t) =>
+                new CloneToken({
+                  id: t.id,
+                  plaintext: t.plaintext,
+                  scope: t.scope as "read" | "write",
+                  expiresAt: t.expiresAt,
+                }),
+            ),
+            Effect.catchTag("ArtifactsError", () =>
+              Effect.fail(new RepoNotFound({ name: params.name })),
+            ),
+          ),
+        ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(RepoApi).pipe(
+        Layer.provide(handlers),
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(Cloudflare.ArtifactsBindingLive))),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/test/integ.test.ts
new file mode 100644
index 00000000000..6b9311c343d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/test/integ.test.ts
@@ -0,0 +1,60 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { RepoApi } from "../src/Api.ts";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+const repoName = `tutorial-${Date.now().toString(36)}`;
+
+test(
+  "repo lifecycle",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpApiClient.make(RepoApi, { baseUrl: url });
+
+    const created = yield* client.repos.createRepo({
+      payload: { name: repoName, description: "tutorial repo" },
+    });
+    expect(created.name).toBe(repoName);
+    expect(created.remote).toBeString();
+    expect(created.token).toBeString();
+
+    const info = yield* client.repos.getRepo({ params: { name: repoName } });
+    expect(info.name).toBe(repoName);
+    expect(info.defaultBranch).toBe("main");
+    expect(info.metadata?.description).toBe("tutorial repo");
+    expect(info.metadata?.stars).toBe(0);
+
+    const token = yield* client.repos.cloneToken({
+      params: { name: repoName },
+      payload: { scope: "read", ttl: 600 },
+    });
+    expect(token.plaintext).toBeString();
+    expect(token.scope).toBe("read");
+
+    const updated = yield* client.repos.updateRepo({
+      params: { name: repoName },
+      payload: { description: "now with stars", topics: ["demo", "alchemy"] },
+    });
+    expect(updated.description).toBe("now with stars");
+    expect(updated.topics).toEqual(["demo", "alchemy"]);
+
+    const starred = yield* client.repos.starRepo({
+      params: { name: repoName },
+    });
+    expect(starred.stars).toBe(1);
+
+    yield* client.repos.deleteRepo({ params: { name: repoName } });
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-git-artifacts/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/tsconfig.json
new file mode 100644
index 00000000000..0cf8c32afd6
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-git-artifacts/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "test/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/alchemy.run.ts
new file mode 100644
index 00000000000..c8ee9fea832
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/alchemy.run.ts
@@ -0,0 +1,32 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import Api from "./src/Api.ts";
+import { Hyperdrive, NeonDb } from "./src/Db.ts";
+
+export default Alchemy.Stack(
+  "CloudflareNeonDrizzleExample",
+  {
+    providers: Layer.mergeAll(
+      Cloudflare.providers(),
+      Drizzle.providers(),
+      Neon.providers(),
+    ),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const { branch } = yield* NeonDb;
+    const hd = yield* Hyperdrive;
+    const api = yield* Api;
+
+    return {
+      url: api.url.as<string>(),
+      branchId: branch.branchId,
+      hyperdriveId: hd.hyperdriveId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/migrations/20260504073935_migration/migration.sql b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/migrations/20260504073935_migration/migration.sql
new file mode 100644
index 00000000000..73388003512
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/migrations/20260504073935_migration/migration.sql
@@ -0,0 +1,18 @@
+CREATE TABLE "posts" (
+	"id" serial PRIMARY KEY,
+	"user_id" integer NOT NULL,
+	"title" text NOT NULL,
+	"body" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+--> statement-breakpoint
+CREATE TABLE "users" (
+	"id" serial PRIMARY KEY,
+	"email" text NOT NULL UNIQUE,
+	"name" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+--> statement-breakpoint
+ALTER TABLE "posts" ADD CONSTRAINT "posts_user_id_users_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/migrations/20260504073935_migration/snapshot.json b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/migrations/20260504073935_migration/snapshot.json
new file mode 100644
index 00000000000..08028870b8a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/migrations/20260504073935_migration/snapshot.json
@@ -0,0 +1,176 @@
+{
+  "dialect": "postgres",
+  "id": "2e3d1fe8-2425-4248-b808-e2055d532265",
+  "prevIds": ["00000000-0000-0000-0000-000000000000"],
+  "version": "8",
+  "ddl": [
+    {
+      "isRlsEnabled": false,
+      "name": "posts",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "users",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "type": "serial",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "title",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "body",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "timestamp with time zone",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "now()",
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "serial",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "email",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "name",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "type": "timestamp with time zone",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "now()",
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "nameExplicit": false,
+      "columns": ["user_id"],
+      "schemaTo": "public",
+      "tableTo": "users",
+      "columnsTo": ["id"],
+      "onUpdate": "NO ACTION",
+      "onDelete": "CASCADE",
+      "name": "posts_user_id_users_id_fkey",
+      "entityType": "fks",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "columns": ["id"],
+      "nameExplicit": false,
+      "name": "posts_pkey",
+      "schema": "public",
+      "table": "posts",
+      "entityType": "pks"
+    },
+    {
+      "columns": ["id"],
+      "nameExplicit": false,
+      "name": "users_pkey",
+      "schema": "public",
+      "table": "users",
+      "entityType": "pks"
+    },
+    {
+      "nameExplicit": false,
+      "columns": ["email"],
+      "nullsNotDistinct": false,
+      "name": "users_email_key",
+      "schema": "public",
+      "table": "users",
+      "entityType": "uniques"
+    }
+  ],
+  "renames": []
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/package.json b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/package.json
new file mode 100644
index 00000000000..51e2b8afc14
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "cloudflare-neon-drizzle",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-neon-drizzle"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@effect/sql-pg": "catalog:",
+    "alchemy": "workspace:*",
+    "drizzle-orm": "1.0.0-rc.1",
+    "effect": "catalog:",
+    "pg": "^8.13.0"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.11.0",
+    "drizzle-kit": "1.0.0-rc.1"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/Api.ts
new file mode 100644
index 00000000000..67c32797600
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/Api.ts
@@ -0,0 +1,92 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import { eq } from "drizzle-orm";
+import { Layer } from "effect";
+import * as Effect from "effect/Effect";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Hyperdrive } from "./Db.ts";
+import { relations, Users } from "./schema.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const conn = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+    const db = yield* Drizzle.postgres(conn.connectionString, {
+      relations,
+    });
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        switch (request.method) {
+          case "GET": {
+            if (request.url === "/") {
+              const users = yield* db.select().from(Users);
+              return yield* HttpServerResponse.json({ users });
+            }
+            const id = Number(request.url.split("/").pop());
+            if (Number.isNaN(id)) {
+              return yield* HttpServerResponse.json(
+                { error: "Invalid user ID" },
+                { status: 400 },
+              );
+            }
+            const user = yield* db.query.Users.findFirst({
+              where: { id },
+              with: { posts: true },
+            });
+            return yield* HttpServerResponse.json({ user });
+          }
+          case "POST": {
+            const user = yield* db
+              .insert(Users)
+              .values({
+                name: crypto.randomUUID(),
+                email: crypto.randomUUID(),
+              })
+              .returning();
+            return yield* HttpServerResponse.json({ user });
+          }
+          case "DELETE": {
+            const id = Number(request.url.split("/").pop());
+            if (Number.isNaN(id)) {
+              return yield* HttpServerResponse.json(
+                { error: "Invalid user ID" },
+                { status: 400 },
+              );
+            }
+            const [user] = yield* db
+              .delete(Users)
+              .where(eq(Users.id, id))
+              .returning();
+            return yield* HttpServerResponse.json({ user });
+          }
+          default: {
+            return yield* HttpServerResponse.json(
+              { error: "Method not allowed" },
+              { status: 405 },
+            );
+          }
+        }
+      }).pipe(
+        Effect.catch((cause: any) => {
+          const peel = (e: any): any => (e?.cause ? peel(e.cause) : e);
+          const root = peel(cause);
+          return HttpServerResponse.json(
+            {
+              ok: false,
+              error: String(cause),
+              rootError: root?.message ?? String(root),
+              rootCode: root?.code,
+            },
+            { status: 500 },
+          );
+        }),
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(Cloudflare.HyperdriveBindingLive))),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/Db.ts b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/Db.ts
new file mode 100644
index 00000000000..d18d0b1b5b5
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/Db.ts
@@ -0,0 +1,43 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+/**
+ * A Drizzle schema + Neon project + feature branch. The branch's
+ * `migrationsDir` is wired to the schema resource's `out` output, so the
+ * provider order becomes:
+ *
+ *   1. `Drizzle.Schema` regenerates pending migration SQL files.
+ *   2. `Neon.Branch` scans the directory and applies any new migrations
+ *      transactionally.
+ */
+export const NeonDb = Effect.gen(function* () {
+  const { stage } = yield* Alchemy.Stack;
+
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  const project = stage.startsWith("pr-")
+    ? yield* Neon.Project.ref("app-db", { stage: `staging-${stage}` })
+    : yield* Neon.Project("app-db", {
+        region: "aws-us-east-1",
+      });
+
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+    migrationsDir: schema.out,
+  });
+
+  return { project, branch, schema };
+});
+
+export const Hyperdrive = Effect.gen(function* () {
+  const { branch } = yield* NeonDb;
+  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+    origin: branch.origin,
+  });
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/schema.ts b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/schema.ts
new file mode 100644
index 00000000000..7c3633eedda
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/src/schema.ts
@@ -0,0 +1,37 @@
+import { defineRelations } from "drizzle-orm";
+import { integer, pgTable, serial, text, timestamp } from "drizzle-orm/pg-core";
+
+export const Users = pgTable("users", {
+  id: serial("id").primaryKey(),
+  email: text("email").notNull().unique(),
+  name: text("name").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+export type User = typeof Users.$inferSelect;
+
+export const Posts = pgTable("posts", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => Users.id, { onDelete: "cascade" }),
+  title: text("title").notNull(),
+  body: text("body").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+export type Post = typeof Posts.$inferSelect;
+
+export const relations = defineRelations({ Users, Posts }, (t) => ({
+  Users: {
+    posts: t.many.Posts(),
+  },
+  Posts: {
+    user: t.one.Users({
+      from: t.Posts.userId,
+      to: t.Users.id,
+    }),
+  },
+}));
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/test/integ.test.ts
new file mode 100644
index 00000000000..c0ea4a1c3e2
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/test/integ.test.ts
@@ -0,0 +1,164 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+import type { Post, User } from "../src/schema.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Layer.mergeAll(
+    Cloudflare.providers(),
+    Drizzle.providers(),
+    Neon.providers(),
+  ),
+  state: Alchemy.localState(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "worker exposes a URL, hyperdrive id, and neon branch id",
+  Effect.gen(function* () {
+    const { url, branchId, hyperdriveId } = yield* stack;
+
+    expect(url).toBeString();
+    expect(branchId).toBeString();
+    expect(hyperdriveId).toBeString();
+  }),
+);
+
+// workers.dev subdomain takes a few seconds to propagate after first
+// enable; retry until the worker actually answers.
+const getOnce = (url: string) =>
+  Effect.gen(function* () {
+    const response = yield* HttpClient.get(url);
+    if (response.status === 404) {
+      return yield* Effect.fail(new Error("workers.dev not yet propagated"));
+    }
+    return response;
+  }).pipe(
+    Effect.tapError((err) =>
+      Effect.logError(`${url} not available: ${err.message}`),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("1 second"), times: 30 }),
+  );
+
+test(
+  "worker exposes user CRUD through Drizzle / Hyperdrive / Neon",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const initialResponse = yield* getOnce(baseUrl);
+    expect(initialResponse.status).toBe(200);
+
+    const initialBody = (yield* initialResponse.json) as unknown as {
+      users: User[];
+    };
+    expect(Array.isArray(initialBody.users)).toBe(true);
+
+    const createResponse = yield* HttpClient.execute(
+      HttpClientRequest.post(baseUrl),
+    );
+    expect(createResponse.status).toBe(200);
+
+    const createBody = (yield* createResponse.json) as unknown as {
+      user: User[];
+    };
+    expect(createBody.user).toHaveLength(1);
+
+    const [createdUser] = createBody.user;
+    expect(createdUser.id).toBeNumber();
+    expect(createdUser.email).toBeString();
+    expect(createdUser.name).toBeString();
+    expect(createdUser.createdAt).toBeString();
+
+    const readResponse = yield* HttpClient.get(`${baseUrl}/${createdUser.id}`);
+    expect(readResponse.status).toBe(200);
+
+    const readBody = (yield* readResponse.json) as unknown as {
+      user: User & { posts: Post[] };
+    };
+    expect(readBody.user).toMatchObject({
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
+      posts: [],
+    });
+
+    const invalidReadResponse = yield* HttpClient.get(`${baseUrl}/not-a-user`);
+    expect(invalidReadResponse.status).toBe(400);
+    expect(yield* invalidReadResponse.json).toEqual({
+      error: "Invalid user ID",
+    });
+
+    const methodResponse = yield* HttpClient.execute(
+      HttpClientRequest.patch(baseUrl),
+    );
+    expect(methodResponse.status).toBe(405);
+    expect(yield* methodResponse.json).toEqual({
+      error: "Method not allowed",
+    });
+
+    const deleteResponse = yield* HttpClient.execute(
+      HttpClientRequest.delete(`${baseUrl}/${createdUser.id}`),
+    );
+    expect(deleteResponse.status).toBe(200);
+
+    const deleteBody = (yield* deleteResponse.json) as unknown as {
+      user: User;
+    };
+    expect(deleteBody.user).toMatchObject({
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
+    });
+
+    const finalResponse = yield* HttpClient.get(baseUrl);
+    expect(finalResponse.status).toBe(200);
+    const finalBody = (yield* finalResponse.json) as unknown as {
+      users: User[];
+    };
+    expect(finalBody.users.some((user) => user.id === createdUser.id)).toBe(
+      false,
+    );
+  }),
+  { timeout: 20_000 },
+);
+
+test(
+  "worker handles 100 sequential queries spaced 100-500ms apart",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    yield* getOnce(baseUrl);
+
+    const queryOnce = Effect.gen(function* () {
+      const response = yield* HttpClient.get(baseUrl);
+      expect(response.status).toBe(200);
+      const body = (yield* response.json) as unknown as { users: User[] };
+      expect(Array.isArray(body.users)).toBe(true);
+    });
+
+    const jitter = Effect.sync(
+      () => Math.floor(Math.random() * 401) + 100,
+    ).pipe(Effect.flatMap((ms) => Effect.sleep(Duration.millis(ms))));
+
+    yield* queryOnce.pipe(
+      Effect.zip(jitter),
+      Effect.repeat(Schedule.recurs(99)),
+    );
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/tsconfig.json
new file mode 100644
index 00000000000..fc740bccbce
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-neon-drizzle/tsconfig.json
@@ -0,0 +1,21 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": [
+    "alchemy.run.ts",
+    "src/**/*.ts",
+    "scripts/**/*.ts",
+    "test/**/*.ts"
+  ],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/alchemy.run.ts
new file mode 100644
index 00000000000..1a06c343879
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/alchemy.run.ts
@@ -0,0 +1,28 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import Api from "./src/Api.ts";
+import { Hyperdrive, PlanetscaleDb } from "./src/Db.ts";
+
+export default Alchemy.Stack(
+  "CloudflarePlanetscaleMySQLDrizzleExample",
+  {
+    providers: Layer.mergeAll(Cloudflare.providers(), Planetscale.providers()),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const { database, branch } = yield* PlanetscaleDb;
+    const hd = yield* Hyperdrive;
+    const api = yield* Api;
+
+    return {
+      url: api.url.as<string>(),
+      databaseId: database.id,
+      branchName: branch.name,
+      hyperdriveId: hd.hyperdriveId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/drizzle.config.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/drizzle.config.ts
new file mode 100644
index 00000000000..be71282ee76
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/drizzle.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./src/schema.ts",
+  out: "./migrations",
+  dialect: "mysql",
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/migrations/20260519110126_dazzling_may_parker/migration.sql b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/migrations/20260519110126_dazzling_may_parker/migration.sql
new file mode 100644
index 00000000000..00781153d1d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/migrations/20260519110126_dazzling_may_parker/migration.sql
@@ -0,0 +1,15 @@
+CREATE TABLE `posts` (
+	`id` int AUTO_INCREMENT PRIMARY KEY,
+	`user_id` int NOT NULL,
+	`title` varchar(255) NOT NULL,
+	`body` varchar(4096) NOT NULL,
+	`created_at` timestamp NOT NULL DEFAULT (now())
+);
+--> statement-breakpoint
+CREATE TABLE `users` (
+	`id` int AUTO_INCREMENT PRIMARY KEY,
+	`email` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`created_at` timestamp NOT NULL DEFAULT (now()),
+	CONSTRAINT `email_unique` UNIQUE INDEX(`email`)
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/migrations/20260519110126_dazzling_may_parker/snapshot.json b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/migrations/20260519110126_dazzling_may_parker/snapshot.json
new file mode 100644
index 00000000000..286bb796710
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/migrations/20260519110126_dazzling_may_parker/snapshot.json
@@ -0,0 +1,171 @@
+{
+  "version": "6",
+  "dialect": "mysql",
+  "id": "34f6e5bd-9164-4ff3-b298-bf82949627f3",
+  "prevIds": ["00000000-0000-0000-0000-000000000000"],
+  "ddl": [
+    {
+      "name": "posts",
+      "entityType": "tables"
+    },
+    {
+      "name": "users",
+      "entityType": "tables"
+    },
+    {
+      "type": "int",
+      "notNull": true,
+      "autoIncrement": true,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "id",
+      "entityType": "columns",
+      "table": "posts"
+    },
+    {
+      "type": "int",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "table": "posts"
+    },
+    {
+      "type": "varchar(255)",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "title",
+      "entityType": "columns",
+      "table": "posts"
+    },
+    {
+      "type": "varchar(4096)",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "body",
+      "entityType": "columns",
+      "table": "posts"
+    },
+    {
+      "type": "timestamp",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": "(now())",
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "table": "posts"
+    },
+    {
+      "type": "int",
+      "notNull": true,
+      "autoIncrement": true,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "id",
+      "entityType": "columns",
+      "table": "users"
+    },
+    {
+      "type": "varchar(255)",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "email",
+      "entityType": "columns",
+      "table": "users"
+    },
+    {
+      "type": "varchar(255)",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": null,
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "name",
+      "entityType": "columns",
+      "table": "users"
+    },
+    {
+      "type": "timestamp",
+      "notNull": true,
+      "autoIncrement": false,
+      "default": "(now())",
+      "onUpdateNow": false,
+      "onUpdateNowFsp": null,
+      "charSet": null,
+      "collation": null,
+      "generated": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "table": "users"
+    },
+    {
+      "columns": ["id"],
+      "name": "PRIMARY",
+      "table": "posts",
+      "entityType": "pks"
+    },
+    {
+      "columns": ["id"],
+      "name": "PRIMARY",
+      "table": "users",
+      "entityType": "pks"
+    },
+    {
+      "columns": [
+        {
+          "value": "email",
+          "isExpression": false
+        }
+      ],
+      "isUnique": true,
+      "using": null,
+      "algorithm": null,
+      "lock": null,
+      "nameExplicit": false,
+      "name": "email_unique",
+      "table": "users",
+      "entityType": "indexes"
+    }
+  ],
+  "renames": []
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/package.json b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/package.json
new file mode 100644
index 00000000000..ca2cf229241
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "cloudflare-planetscale-mysql-drizzle",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-planetscale-mysql-drizzle"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "generate:migrations": "drizzle-kit generate",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "drizzle-orm": "1.0.0-rc.1",
+    "effect": "catalog:",
+    "mysql2": "^3.15.3"
+  },
+  "devDependencies": {
+    "drizzle-kit": "1.0.0-rc.1"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/Api.ts
new file mode 100644
index 00000000000..027871f005d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/Api.ts
@@ -0,0 +1,129 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import { eq } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/mysql2";
+import { Layer } from "effect";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Hyperdrive } from "./Db.ts";
+import * as schema from "./schema.ts";
+import { relations, Users } from "./schema.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+    compatibility: {
+      date: "2026-03-17",
+      flags: ["nodejs_compat"],
+    },
+  },
+  Effect.gen(function* () {
+    const conn = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const connectionString = yield* conn.connectionString;
+        const db = drizzle(Redacted.value(connectionString), {
+          schema,
+          relations,
+          mode: "default",
+        });
+
+        const close = Effect.tryPromise({
+          try: () => db.$client.end(),
+          catch: (cause) => cause,
+        }).pipe(Effect.catch(() => Effect.void));
+
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        return yield* Effect.gen(function* () {
+          switch (request.method) {
+            case "GET": {
+              if (request.url === "/") {
+                const users = yield* Effect.tryPromise({
+                  try: () => db.select().from(Users),
+                  catch: (cause) => cause,
+                });
+                return yield* HttpServerResponse.json({ users });
+              }
+              const id = Number(request.url.split("/").pop());
+              if (Number.isNaN(id)) {
+                return yield* HttpServerResponse.json(
+                  { error: "Invalid user ID" },
+                  { status: 400 },
+                );
+              }
+              const user = yield* Effect.tryPromise({
+                try: () =>
+                  db.query.Users.findFirst({
+                    where: { id },
+                    with: { posts: true },
+                  }),
+                catch: (cause) => cause,
+              });
+              return yield* HttpServerResponse.json({ user });
+            }
+            case "POST": {
+              const [created] = yield* Effect.tryPromise({
+                try: () =>
+                  db
+                    .insert(Users)
+                    .values({
+                      name: crypto.randomUUID(),
+                      email: crypto.randomUUID(),
+                    })
+                    .$returningId(),
+                catch: (cause) => cause,
+              });
+              const user = yield* Effect.tryPromise({
+                try: () =>
+                  db.select().from(Users).where(eq(Users.id, created.id)),
+                catch: (cause) => cause,
+              });
+              return yield* HttpServerResponse.json({ user });
+            }
+            case "DELETE": {
+              const id = Number(request.url.split("/").pop());
+              if (Number.isNaN(id)) {
+                return yield* HttpServerResponse.json(
+                  { error: "Invalid user ID" },
+                  { status: 400 },
+                );
+              }
+              const [user] = yield* Effect.tryPromise({
+                try: () => db.select().from(Users).where(eq(Users.id, id)),
+                catch: (cause) => cause,
+              });
+              yield* Effect.tryPromise({
+                try: () => db.delete(Users).where(eq(Users.id, id)),
+                catch: (cause) => cause,
+              });
+              return yield* HttpServerResponse.json({ user });
+            }
+            default: {
+              return yield* HttpServerResponse.json(
+                { error: "Method not allowed" },
+                { status: 405 },
+              );
+            }
+          }
+        }).pipe(Effect.ensuring(close));
+      }).pipe(
+        Effect.catch((cause: any) => {
+          const peel = (e: any): any => (e?.cause ? peel(e.cause) : e);
+          const root = peel(cause);
+          return HttpServerResponse.json(
+            {
+              ok: false,
+              error: String(cause),
+              rootError: root?.message ?? String(root),
+              rootCode: root?.code,
+            },
+            { status: 500 },
+          );
+        }),
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(Cloudflare.HyperdriveBindingLive))),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/Db.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/Db.ts
new file mode 100644
index 00000000000..8036369945a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/Db.ts
@@ -0,0 +1,53 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+/**
+ * A Drizzle schema + PlanetScale MySQL database + feature branch. Generate
+ * migrations with `bun generate:migrations`; the branch scans the checked-in
+ * migration directory and applies new files transactionally.
+ */
+export const PlanetscaleDb = Effect.gen(function* () {
+  const { stage } = yield* Alchemy.Stack;
+
+  // Stages are organised in two tiers:
+  //
+  //   - `staging-*` stages own the long-lived PlanetScale database.
+  //   - `pr-*` stages reference the parallel `staging-pr-*` database
+  //     and only own ephemeral compute (branch + role + Hyperdrive + Worker).
+  //
+  // Deriving `staging-${stage}` instead of a single global "staging"
+  // keeps each test / PR isolated. Locally (`dev_<user>`, etc.) we create
+  // a fresh database.
+  const database = stage.startsWith("pr-")
+    ? yield* Planetscale.MySQLDatabase.ref("app-db", {
+        stage: `staging-${stage}`,
+      })
+    : yield* Planetscale.MySQLDatabase("app-db", {
+        region: { slug: "us-east" },
+        clusterSize: "PS_10",
+      });
+
+  const branch = yield* Planetscale.MySQLBranch("app-branch", {
+    database,
+    isProduction: false,
+    migrationsDir: "./migrations",
+  });
+
+  const password = yield* Planetscale.MySQLPassword("app-password", {
+    database,
+    branch,
+    role: "readwriter",
+  });
+
+  return { database, branch, password };
+});
+
+export const Hyperdrive: Effect.Effect<Cloudflare.Hyperdrive, never, any> =
+  Effect.gen(function* () {
+    const { password } = yield* PlanetscaleDb;
+    return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+      origin: password.origin,
+    });
+  });
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/schema.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/schema.ts
new file mode 100644
index 00000000000..dd5d96f6175
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/src/schema.ts
@@ -0,0 +1,31 @@
+import { defineRelations } from "drizzle-orm";
+import { int, mysqlTable, timestamp, varchar } from "drizzle-orm/mysql-core";
+
+export const Users = mysqlTable("users", {
+  id: int("id").primaryKey().autoincrement(),
+  email: varchar("email", { length: 255 }).notNull().unique(),
+  name: varchar("name", { length: 255 }).notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+export type User = typeof Users.$inferSelect;
+
+export const Posts = mysqlTable("posts", {
+  id: int("id").primaryKey().autoincrement(),
+  userId: int("user_id").notNull(),
+  title: varchar("title", { length: 255 }).notNull(),
+  body: varchar("body", { length: 4096 }).notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+export type Post = typeof Posts.$inferSelect;
+
+export const relations = defineRelations({ Users, Posts }, (t) => ({
+  Users: {
+    posts: t.many.Posts(),
+  },
+  Posts: {
+    user: t.one.Users({
+      from: t.Posts.userId,
+      to: t.Users.id,
+    }),
+  },
+}));
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/test/integ.test.ts
new file mode 100644
index 00000000000..861aac56ed9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/test/integ.test.ts
@@ -0,0 +1,160 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+import type { Post, User } from "../src/schema.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Layer.mergeAll(Cloudflare.providers(), Planetscale.providers()),
+  state: Alchemy.localState(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "worker exposes a URL, hyperdrive id, and planetscale identifiers",
+  Effect.gen(function* () {
+    const { url, databaseId, branchName, hyperdriveId } = yield* stack;
+
+    expect(url).toBeString();
+    expect(databaseId).toBeString();
+    expect(branchName).toBeString();
+    expect(hyperdriveId).toBeString();
+  }),
+);
+
+// workers.dev subdomain takes a few seconds to propagate after first
+// enable; retry until the worker actually answers.
+const getOnce = (url: string) =>
+  Effect.gen(function* () {
+    const response = yield* HttpClient.get(url);
+    if (response.status === 404) {
+      return yield* Effect.fail(new Error("workers.dev not yet propagated"));
+    }
+    return response;
+  }).pipe(
+    Effect.tapError((err) =>
+      Effect.logError(`${url} not available: ${err.message}`),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("1 second"), times: 30 }),
+  );
+
+test(
+  "worker exposes user CRUD through Drizzle / Hyperdrive / PlanetScale",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const initialResponse = yield* getOnce(baseUrl);
+    expect(initialResponse.status).toBe(200);
+
+    const initialBody = (yield* initialResponse.json) as unknown as {
+      users: User[];
+    };
+    expect(Array.isArray(initialBody.users)).toBe(true);
+
+    const createResponse = yield* HttpClient.execute(
+      HttpClientRequest.post(baseUrl),
+    );
+    expect(createResponse.status).toBe(200);
+
+    const createBody = (yield* createResponse.json) as unknown as {
+      user: User[];
+    };
+    expect(createBody.user).toHaveLength(1);
+
+    const [createdUser] = createBody.user;
+    expect(createdUser.id).toBeNumber();
+    expect(createdUser.email).toBeString();
+    expect(createdUser.name).toBeString();
+    expect(createdUser.createdAt).toBeString();
+
+    const readResponse = yield* HttpClient.get(`${baseUrl}/${createdUser.id}`);
+    expect(readResponse.status).toBe(200);
+
+    const readBody = (yield* readResponse.json) as unknown as {
+      user: User & { posts: Post[] };
+    };
+    expect(readBody.user).toMatchObject({
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
+      posts: [],
+    });
+
+    const invalidReadResponse = yield* HttpClient.get(`${baseUrl}/not-a-user`);
+    expect(invalidReadResponse.status).toBe(400);
+    expect(yield* invalidReadResponse.json).toEqual({
+      error: "Invalid user ID",
+    });
+
+    const methodResponse = yield* HttpClient.execute(
+      HttpClientRequest.patch(baseUrl),
+    );
+    expect(methodResponse.status).toBe(405);
+    expect(yield* methodResponse.json).toEqual({
+      error: "Method not allowed",
+    });
+
+    const deleteResponse = yield* HttpClient.execute(
+      HttpClientRequest.delete(`${baseUrl}/${createdUser.id}`),
+    );
+    expect(deleteResponse.status).toBe(200);
+
+    const deleteBody = (yield* deleteResponse.json) as unknown as {
+      user: User;
+    };
+    expect(deleteBody.user).toMatchObject({
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
+    });
+
+    const finalResponse = yield* HttpClient.get(baseUrl);
+    expect(finalResponse.status).toBe(200);
+    const finalBody = (yield* finalResponse.json) as unknown as {
+      users: User[];
+    };
+    expect(finalBody.users.some((user) => user.id === createdUser.id)).toBe(
+      false,
+    );
+  }),
+  { timeout: 20_000 },
+);
+
+test(
+  "worker handles 100 sequential queries spaced 100-500ms apart",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    yield* getOnce(baseUrl);
+
+    const queryOnce = Effect.gen(function* () {
+      const response = yield* HttpClient.get(baseUrl);
+      expect(response.status).toBe(200);
+      const body = (yield* response.json) as unknown as { users: User[] };
+      expect(Array.isArray(body.users)).toBe(true);
+    });
+
+    const jitter = Effect.sync(
+      () => Math.floor(Math.random() * 401) + 100,
+    ).pipe(Effect.flatMap((ms) => Effect.sleep(Duration.millis(ms))));
+
+    yield* queryOnce.pipe(
+      Effect.zip(jitter),
+      Effect.repeat(Schedule.recurs(99)),
+    );
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/tsconfig.json
new file mode 100644
index 00000000000..bb339a5b2dd
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-mysql-drizzle/tsconfig.json
@@ -0,0 +1,24 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": [
+    "alchemy.run.ts",
+    "drizzle.config.ts",
+    "src/**/*.ts",
+    "scripts/**/*.ts",
+    "test/**/*.ts"
+  ],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "declaration": false,
+    "declarationMap": false
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/alchemy.run.ts
new file mode 100644
index 00000000000..5d01b182093
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/alchemy.run.ts
@@ -0,0 +1,33 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import Api from "./src/Api.ts";
+import { Hyperdrive, PlanetscaleDb } from "./src/Db.ts";
+
+export default Alchemy.Stack(
+  "CloudflarePlanetscalePostgresDrizzleExample",
+  {
+    providers: Layer.mergeAll(
+      Cloudflare.providers(),
+      Drizzle.providers(),
+      Planetscale.providers(),
+    ),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const { database, branch } = yield* PlanetscaleDb;
+    const hd = yield* Hyperdrive;
+    const api = yield* Api;
+
+    return {
+      url: api.url.as<string>(),
+      databaseId: database.id,
+      branchName: branch.name,
+      hyperdriveId: hd.hyperdriveId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/migrations/20260504073935_migration/migration.sql b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/migrations/20260504073935_migration/migration.sql
new file mode 100644
index 00000000000..73388003512
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/migrations/20260504073935_migration/migration.sql
@@ -0,0 +1,18 @@
+CREATE TABLE "posts" (
+	"id" serial PRIMARY KEY,
+	"user_id" integer NOT NULL,
+	"title" text NOT NULL,
+	"body" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+--> statement-breakpoint
+CREATE TABLE "users" (
+	"id" serial PRIMARY KEY,
+	"email" text NOT NULL UNIQUE,
+	"name" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+
+--> statement-breakpoint
+ALTER TABLE "posts" ADD CONSTRAINT "posts_user_id_users_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/migrations/20260504073935_migration/snapshot.json b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/migrations/20260504073935_migration/snapshot.json
new file mode 100644
index 00000000000..08028870b8a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/migrations/20260504073935_migration/snapshot.json
@@ -0,0 +1,176 @@
+{
+  "dialect": "postgres",
+  "id": "2e3d1fe8-2425-4248-b808-e2055d532265",
+  "prevIds": ["00000000-0000-0000-0000-000000000000"],
+  "version": "8",
+  "ddl": [
+    {
+      "isRlsEnabled": false,
+      "name": "posts",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "isRlsEnabled": false,
+      "name": "users",
+      "entityType": "tables",
+      "schema": "public"
+    },
+    {
+      "type": "serial",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "integer",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "user_id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "title",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "body",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "timestamp with time zone",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "now()",
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "type": "serial",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "id",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "email",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "type": "text",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": null,
+      "generated": null,
+      "identity": null,
+      "name": "name",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "type": "timestamp with time zone",
+      "typeSchema": null,
+      "notNull": true,
+      "dimensions": 0,
+      "default": "now()",
+      "generated": null,
+      "identity": null,
+      "name": "created_at",
+      "entityType": "columns",
+      "schema": "public",
+      "table": "users"
+    },
+    {
+      "nameExplicit": false,
+      "columns": ["user_id"],
+      "schemaTo": "public",
+      "tableTo": "users",
+      "columnsTo": ["id"],
+      "onUpdate": "NO ACTION",
+      "onDelete": "CASCADE",
+      "name": "posts_user_id_users_id_fkey",
+      "entityType": "fks",
+      "schema": "public",
+      "table": "posts"
+    },
+    {
+      "columns": ["id"],
+      "nameExplicit": false,
+      "name": "posts_pkey",
+      "schema": "public",
+      "table": "posts",
+      "entityType": "pks"
+    },
+    {
+      "columns": ["id"],
+      "nameExplicit": false,
+      "name": "users_pkey",
+      "schema": "public",
+      "table": "users",
+      "entityType": "pks"
+    },
+    {
+      "nameExplicit": false,
+      "columns": ["email"],
+      "nullsNotDistinct": false,
+      "name": "users_email_key",
+      "schema": "public",
+      "table": "users",
+      "entityType": "uniques"
+    }
+  ],
+  "renames": []
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/package.json b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/package.json
new file mode 100644
index 00000000000..76da4069c42
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "cloudflare-planetscale-postgres-drizzle",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-planetscale-postgres-drizzle"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@effect/sql-pg": "catalog:",
+    "alchemy": "workspace:*",
+    "drizzle-orm": "1.0.0-rc.1",
+    "effect": "catalog:",
+    "pg": "^8.13.0"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.11.0",
+    "drizzle-kit": "1.0.0-rc.1"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/Api.ts
new file mode 100644
index 00000000000..67c32797600
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/Api.ts
@@ -0,0 +1,92 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import { eq } from "drizzle-orm";
+import { Layer } from "effect";
+import * as Effect from "effect/Effect";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Hyperdrive } from "./Db.ts";
+import { relations, Users } from "./schema.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const conn = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+    const db = yield* Drizzle.postgres(conn.connectionString, {
+      relations,
+    });
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        switch (request.method) {
+          case "GET": {
+            if (request.url === "/") {
+              const users = yield* db.select().from(Users);
+              return yield* HttpServerResponse.json({ users });
+            }
+            const id = Number(request.url.split("/").pop());
+            if (Number.isNaN(id)) {
+              return yield* HttpServerResponse.json(
+                { error: "Invalid user ID" },
+                { status: 400 },
+              );
+            }
+            const user = yield* db.query.Users.findFirst({
+              where: { id },
+              with: { posts: true },
+            });
+            return yield* HttpServerResponse.json({ user });
+          }
+          case "POST": {
+            const user = yield* db
+              .insert(Users)
+              .values({
+                name: crypto.randomUUID(),
+                email: crypto.randomUUID(),
+              })
+              .returning();
+            return yield* HttpServerResponse.json({ user });
+          }
+          case "DELETE": {
+            const id = Number(request.url.split("/").pop());
+            if (Number.isNaN(id)) {
+              return yield* HttpServerResponse.json(
+                { error: "Invalid user ID" },
+                { status: 400 },
+              );
+            }
+            const [user] = yield* db
+              .delete(Users)
+              .where(eq(Users.id, id))
+              .returning();
+            return yield* HttpServerResponse.json({ user });
+          }
+          default: {
+            return yield* HttpServerResponse.json(
+              { error: "Method not allowed" },
+              { status: 405 },
+            );
+          }
+        }
+      }).pipe(
+        Effect.catch((cause: any) => {
+          const peel = (e: any): any => (e?.cause ? peel(e.cause) : e);
+          const root = peel(cause);
+          return HttpServerResponse.json(
+            {
+              ok: false,
+              error: String(cause),
+              rootError: root?.message ?? String(root),
+              rootCode: root?.code,
+            },
+            { status: 500 },
+          );
+        }),
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(Cloudflare.HyperdriveBindingLive))),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/Db.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/Db.ts
new file mode 100644
index 00000000000..b537cb7ec27
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/Db.ts
@@ -0,0 +1,62 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+/**
+ * A Drizzle schema + PlanetScale Postgres database + feature branch. The
+ * branch's `migrationsDir` is wired to the schema resource's `out` output, so
+ * the provider order becomes:
+ *
+ *   1. `Drizzle.Schema` regenerates pending migration SQL files.
+ *   2. `Planetscale.PostgresBranch` scans the directory and applies new
+ *      migrations transactionally.
+ */
+export const PlanetscaleDb = Effect.gen(function* () {
+  const { stage } = yield* Alchemy.Stack;
+
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  // Stages are organised in two tiers:
+  //
+  //   - `staging-*` stages own the long-lived PlanetScale database.
+  //   - `pr-*` stages reference the parallel `staging-pr-*` database
+  //     and only own ephemeral compute (branch + role + Hyperdrive + Worker).
+  //
+  // Deriving `staging-${stage}` instead of a single global "staging"
+  // keeps each test / PR isolated. Locally (`dev_<user>`, etc.) we create
+  // a fresh database.
+  const database = stage.startsWith("pr-")
+    ? yield* Planetscale.PostgresDatabase.ref("app-db", {
+        stage: `staging-${stage}`,
+      })
+    : yield* Planetscale.PostgresDatabase("app-db", {
+        region: { slug: "us-east" },
+        clusterSize: "PS_10",
+      });
+
+  const branch = yield* Planetscale.PostgresBranch("app-branch", {
+    database,
+    migrationsDir: schema.out,
+  });
+
+  const role = yield* Planetscale.PostgresRole("app-role", {
+    database,
+    branch,
+    inheritedRoles: ["postgres"],
+  });
+
+  return { database, branch, role, schema };
+});
+
+export const Hyperdrive: Effect.Effect<Cloudflare.Hyperdrive, never, any> =
+  Effect.gen(function* () {
+    const { role } = yield* PlanetscaleDb;
+    return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+      origin: role.origin,
+    });
+  });
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/schema.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/schema.ts
new file mode 100644
index 00000000000..7c3633eedda
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/src/schema.ts
@@ -0,0 +1,37 @@
+import { defineRelations } from "drizzle-orm";
+import { integer, pgTable, serial, text, timestamp } from "drizzle-orm/pg-core";
+
+export const Users = pgTable("users", {
+  id: serial("id").primaryKey(),
+  email: text("email").notNull().unique(),
+  name: text("name").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+export type User = typeof Users.$inferSelect;
+
+export const Posts = pgTable("posts", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => Users.id, { onDelete: "cascade" }),
+  title: text("title").notNull(),
+  body: text("body").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+export type Post = typeof Posts.$inferSelect;
+
+export const relations = defineRelations({ Users, Posts }, (t) => ({
+  Users: {
+    posts: t.many.Posts(),
+  },
+  Posts: {
+    user: t.one.Users({
+      from: t.Posts.userId,
+      to: t.Users.id,
+    }),
+  },
+}));
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/test/integ.test.ts
new file mode 100644
index 00000000000..648ac232ed9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/test/integ.test.ts
@@ -0,0 +1,165 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+import type { Post, User } from "../src/schema.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Layer.mergeAll(
+    Cloudflare.providers(),
+    Drizzle.providers(),
+    Planetscale.providers(),
+  ),
+  state: Alchemy.localState(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "worker exposes a URL, hyperdrive id, and planetscale identifiers",
+  Effect.gen(function* () {
+    const { url, databaseId, branchName, hyperdriveId } = yield* stack;
+
+    expect(url).toBeString();
+    expect(databaseId).toBeString();
+    expect(branchName).toBeString();
+    expect(hyperdriveId).toBeString();
+  }),
+);
+
+// workers.dev subdomain takes a few seconds to propagate after first
+// enable; retry until the worker actually answers.
+const getOnce = (url: string) =>
+  Effect.gen(function* () {
+    const response = yield* HttpClient.get(url);
+    if (response.status === 404) {
+      return yield* Effect.fail(new Error("workers.dev not yet propagated"));
+    }
+    return response;
+  }).pipe(
+    Effect.tapError((err) =>
+      Effect.logError(`${url} not available: ${err.message}`),
+    ),
+    Effect.retry({ schedule: Schedule.spaced("1 second"), times: 30 }),
+  );
+
+test(
+  "worker exposes user CRUD through Drizzle / Hyperdrive / PlanetScale",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const initialResponse = yield* getOnce(baseUrl);
+    expect(initialResponse.status).toBe(200);
+
+    const initialBody = (yield* initialResponse.json) as unknown as {
+      users: User[];
+    };
+    expect(Array.isArray(initialBody.users)).toBe(true);
+
+    const createResponse = yield* HttpClient.execute(
+      HttpClientRequest.post(baseUrl),
+    );
+    expect(createResponse.status).toBe(200);
+
+    const createBody = (yield* createResponse.json) as unknown as {
+      user: User[];
+    };
+    expect(createBody.user).toHaveLength(1);
+
+    const [createdUser] = createBody.user;
+    expect(createdUser.id).toBeNumber();
+    expect(createdUser.email).toBeString();
+    expect(createdUser.name).toBeString();
+    expect(createdUser.createdAt).toBeString();
+
+    const readResponse = yield* HttpClient.get(`${baseUrl}/${createdUser.id}`);
+    expect(readResponse.status).toBe(200);
+
+    const readBody = (yield* readResponse.json) as unknown as {
+      user: User & { posts: Post[] };
+    };
+    expect(readBody.user).toMatchObject({
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
+      posts: [],
+    });
+
+    const invalidReadResponse = yield* HttpClient.get(`${baseUrl}/not-a-user`);
+    expect(invalidReadResponse.status).toBe(400);
+    expect(yield* invalidReadResponse.json).toEqual({
+      error: "Invalid user ID",
+    });
+
+    const methodResponse = yield* HttpClient.execute(
+      HttpClientRequest.patch(baseUrl),
+    );
+    expect(methodResponse.status).toBe(405);
+    expect(yield* methodResponse.json).toEqual({
+      error: "Method not allowed",
+    });
+
+    const deleteResponse = yield* HttpClient.execute(
+      HttpClientRequest.delete(`${baseUrl}/${createdUser.id}`),
+    );
+    expect(deleteResponse.status).toBe(200);
+
+    const deleteBody = (yield* deleteResponse.json) as unknown as {
+      user: User;
+    };
+    expect(deleteBody.user).toMatchObject({
+      id: createdUser.id,
+      email: createdUser.email,
+      name: createdUser.name,
+    });
+
+    const finalResponse = yield* HttpClient.get(baseUrl);
+    expect(finalResponse.status).toBe(200);
+    const finalBody = (yield* finalResponse.json) as unknown as {
+      users: User[];
+    };
+    expect(finalBody.users.some((user) => user.id === createdUser.id)).toBe(
+      false,
+    );
+  }),
+  { timeout: 20_000 },
+);
+
+test(
+  "worker handles 100 sequential queries spaced 100-500ms apart",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    yield* getOnce(baseUrl);
+
+    const queryOnce = Effect.gen(function* () {
+      const response = yield* HttpClient.get(baseUrl);
+      expect(response.status).toBe(200);
+      const body = (yield* response.json) as unknown as { users: User[] };
+      expect(Array.isArray(body.users)).toBe(true);
+    });
+
+    const jitter = Effect.sync(
+      () => Math.floor(Math.random() * 401) + 100,
+    ).pipe(Effect.flatMap((ms) => Effect.sleep(Duration.millis(ms))));
+
+    yield* queryOnce.pipe(
+      Effect.zip(jitter),
+      Effect.repeat(Schedule.recurs(99)),
+    );
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/tsconfig.json
new file mode 100644
index 00000000000..00212290cd7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-planetscale-postgres-drizzle/tsconfig.json
@@ -0,0 +1,23 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": [
+    "alchemy.run.ts",
+    "src/**/*.ts",
+    "scripts/**/*.ts",
+    "test/**/*.ts"
+  ],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "declaration": false,
+    "declarationMap": false
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-secrets-store/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-secrets-store/alchemy.run.ts
new file mode 100644
index 00000000000..1dac38d35c6
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-secrets-store/alchemy.run.ts
@@ -0,0 +1,23 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+import Api from "./src/Api.ts";
+import { Store } from "./src/Store.ts";
+
+export default Alchemy.Stack(
+  "CloudflareSecretsStoreExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const store = yield* Store;
+    const api = yield* Api;
+
+    return {
+      url: api.url.as<string>(),
+      storeId: store.storeId,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-secrets-store/package.json b/.repos/alchemy-effect/examples/cloudflare-secrets-store/package.json
new file mode 100644
index 00000000000..ed81c75ac1d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-secrets-store/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "cloudflare-secrets-store",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-secrets-store"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/Api.ts
new file mode 100644
index 00000000000..7500b1b9133
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/Api.ts
@@ -0,0 +1,40 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { ApiKey } from "./ApiKey.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const apiKey = yield* Cloudflare.Secret.bind(ApiKey);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        if (request.url === "/secret") {
+          const value = Redacted.value(yield* apiKey);
+          const masked = value.slice(0, 4) + "****";
+          return HttpServerResponse.text(`Secret (masked): ${masked}`);
+        }
+
+        return HttpServerResponse.text(
+          "Hello from Cloudflare Secrets Store example!",
+        );
+      }).pipe(
+        Effect.catchTag("SecretError", (err) =>
+          Effect.succeed(
+            HttpServerResponse.text(`Failed to read secret: ${err.message}`, {
+              status: 500,
+            }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.SecretBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/ApiKey.ts b/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/ApiKey.ts
new file mode 100644
index 00000000000..007b9abe11a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/ApiKey.ts
@@ -0,0 +1,20 @@
+import { Random } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Store } from "./Store.ts";
+
+/**
+ * An API key secret in the Secrets Store.
+ *
+ * Uses `Random` to generate a stable random value that persists
+ * across deploys (only regenerated if the resource is replaced).
+ */
+export const ApiKey = Effect.gen(function* () {
+  const store = yield* Store;
+  const secret = yield* Random("ApiKeyValue");
+
+  return yield* Cloudflare.Secret("ApiKey", {
+    store,
+    value: secret.text,
+  });
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/Store.ts b/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/Store.ts
new file mode 100644
index 00000000000..54158bd44b8
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-secrets-store/src/Store.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Store = Cloudflare.SecretsStore("SecretStore");
diff --git a/.repos/alchemy-effect/examples/cloudflare-secrets-store/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-secrets-store/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-secrets-store/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/.gitignore b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/.gitignore
new file mode 100644
index 00000000000..751513ce1b7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/.gitignore
@@ -0,0 +1,28 @@
+dist
+.wrangler
+.output
+.vercel
+.netlify
+.vinxi
+app.config.timestamp_*.js
+
+# Environment
+.env
+.env*.local
+
+# dependencies
+/node_modules
+
+# IDEs and editors
+/.idea
+.project
+.classpath
+*.launch
+.settings/
+
+# Temp
+gitignore
+
+# System Files
+.DS_Store
+Thumbs.db
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/README.md b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/README.md
new file mode 100644
index 00000000000..b4ba3d38ff2
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/README.md
@@ -0,0 +1,43 @@
+## Usage
+
+Those templates dependencies are maintained via [pnpm](https://pnpm.io) via `pnpm up -Lri`.
+
+This is the reason you see a `pnpm-lock.yaml`. That being said, any package manager will work. This file can be safely be removed once you clone a template.
+
+```bash
+$ npm install # or pnpm install or yarn install
+```
+
+## Exploring the template
+
+This template's goal is to showcase the routing features of Solid.
+It also showcase how the router and Suspense work together to parallelize data fetching tied to a route via the `.data.ts` pattern.
+
+You can learn more about it on the [`@solidjs/router` repository](https://github.com/solidjs/solid-router)
+
+### Learn more on the [Solid Website](https://solidjs.com) and come chat with us on our [Discord](https://discord.com/invite/solidjs)
+
+## Available Scripts
+
+In the project directory, you can run:
+
+### `npm run dev` or `npm start`
+
+Runs the app in the development mode.<br>
+Open [http://localhost:3000](http://localhost:3000) to view it in the browser.
+
+The page will reload if you make edits.<br>
+
+### `npm run build`
+
+Builds the app for production to the `dist` folder.<br>
+It correctly bundles Solid in production mode and optimizes the build for the best performance.
+
+The build is minified and the filenames include the hashes.<br>
+Your app is ready to be deployed!
+
+## Deployment
+
+You can deploy the `dist` folder to any static host provider (netlify, surge, now, etc.)
+
+## This project was created with the [Solid CLI](https://github.com/solidjs-community/solid-cli)
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/alchemy.run.ts
new file mode 100644
index 00000000000..7eb402e6615
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/alchemy.run.ts
@@ -0,0 +1,27 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "CloudflareSolidJSSSRExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* Cloudflare.Vite("SolidJSSrr", {
+      compatibility: {
+        flags: ["nodejs_compat"],
+      },
+      assets: {
+        config: {
+          runWorkerFirst: true,
+        },
+      },
+    });
+
+    return {
+      url: worker.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/index.html b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/index.html
new file mode 100644
index 00000000000..f7c1723533a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/index.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="theme-color" content="#000000" />
+    <title>Solid App</title>
+    <!--ssr-head-->
+  </head>
+  <body>
+    <div id="root"><!--ssr-outlet--></div>
+    <script src="/src/entry-client.tsx" type="module"></script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/package.json b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/package.json
new file mode 100644
index 00000000000..3b5e0b90b38
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "cloudflare-solid-ssr",
+  "version": "0.0.0",
+  "description": "",
+  "type": "module",
+  "scripts": {
+    "dev": "vite dev --port 3000",
+    "build": "vite build",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "destroy": "alchemy destroy"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4.1.13",
+    "postcss": "^8.4.49",
+    "solid-devtools": "^0.34.3",
+    "tailwindcss": "^4.1.13",
+    "vite": "^7.1.4",
+    "alchemy": "workspace:*",
+    "effect": "catalog:",
+    "vite-plugin-solid": "^2.11.8"
+  },
+  "dependencies": {
+    "@solidjs/router": "^0.15.1",
+    "solid-js": "^1.9.5"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-solidjs-ssr"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/app.tsx b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/app.tsx
new file mode 100644
index 00000000000..1fe135deefd
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/app.tsx
@@ -0,0 +1,46 @@
+import { Suspense, type Component } from "solid-js";
+import { A, useLocation } from "@solidjs/router";
+
+const App: Component<{ children: Element }> = (props) => {
+  const location = useLocation();
+
+  return (
+    <>
+      <nav class="bg-gray-200 text-gray-900 px-4">
+        <ul class="flex items-center">
+          <li class="py-2 px-4">
+            <A href="/" class="no-underline hover:underline">
+              Home
+            </A>
+          </li>
+          <li class="py-2 px-4">
+            <A href="/about" class="no-underline hover:underline">
+              About
+            </A>
+          </li>
+          <li class="py-2 px-4">
+            <A href="/error" class="no-underline hover:underline">
+              Error
+            </A>
+          </li>
+
+          <li class="text-sm flex items-center space-x-1 ml-auto">
+            <span>URL:</span>
+            <input
+              class="w-75px p-1 bg-white text-sm rounded-lg"
+              type="text"
+              readOnly
+              value={location.pathname}
+            />
+          </li>
+        </ul>
+      </nav>
+
+      <main>
+        <Suspense>{props.children}</Suspense>
+      </main>
+    </>
+  );
+};
+
+export default App;
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/entry-client.tsx b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/entry-client.tsx
new file mode 100644
index 00000000000..81a0454467e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/entry-client.tsx
@@ -0,0 +1,22 @@
+/* @refresh reload */
+import "solid-devtools";
+import "./index.css";
+
+import { hydrate, render } from "solid-js/web";
+
+import App from "./app";
+import { Router } from "@solidjs/router";
+import { routes } from "./routes";
+
+const root = document.getElementById("root")!;
+
+const app = () => (
+  <Router root={(props) => <App>{props.children}</App>}>{routes}</Router>
+);
+
+// Use hydrate when server-rendered content is present, otherwise render (dev mode)
+if (root.children.length > 0) {
+  hydrate(app, root);
+} else {
+  render(app, root);
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/entry-server.tsx b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/entry-server.tsx
new file mode 100644
index 00000000000..58e9d733bf2
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/entry-server.tsx
@@ -0,0 +1,72 @@
+import { renderToStringAsync, generateHydrationScript } from "solid-js/web";
+import { StaticRouter } from "@solidjs/router";
+import App from "./app";
+import { routes } from "./routes";
+
+const FALLBACK_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Solid App</title>
+<!--ssr-head-->
+</head>
+<body>
+<div id="root"><!--ssr-outlet--></div>
+</body>
+</html>`;
+
+async function getTemplate(
+  env: { ASSETS: Fetcher },
+  origin: string,
+): Promise<string> {
+  try {
+    const res = await env.ASSETS.fetch(new Request(origin + "/index.html"));
+    if (res.ok) {
+      const text = await res.text();
+      if (text.length > 0) return text;
+    }
+  } catch {}
+  return FALLBACK_HTML;
+}
+
+export default {
+  async fetch(request: Request, env: { ASSETS: Fetcher }): Promise<Response> {
+    try {
+      const url = new URL(request.url);
+      const pathname = url.pathname;
+
+      // Serve static assets via the assets binding
+      if (pathname.startsWith("/assets/") || pathname.endsWith(".ico")) {
+        return env.ASSETS.fetch(request);
+      }
+
+      // Get the HTML template (from assets if available, fallback to bare HTML)
+      const template = await getTemplate(env, url.origin);
+
+      // Render the SolidJS app to HTML on the server
+      const appHtml = await renderToStringAsync(() => (
+        <StaticRouter
+          url={pathname}
+          root={(props) => <App>{props.children}</App>}
+        >
+          {routes}
+        </StaticRouter>
+      ));
+
+      // Inject the server-rendered HTML and hydration script
+      const html = template
+        .replace("<!--ssr-head-->", generateHydrationScript())
+        .replace("<!--ssr-outlet-->", appHtml);
+
+      return new Response(html, {
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+    } catch (e: any) {
+      return new Response(`SSR Error: ${e.message}\n\n${e.stack}`, {
+        status: 500,
+        headers: { "Content-Type": "text/plain" },
+      });
+    }
+  },
+};
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/errors/404.tsx b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/errors/404.tsx
new file mode 100644
index 00000000000..56e5ad5e3be
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/errors/404.tsx
@@ -0,0 +1,8 @@
+export default function NotFound() {
+  return (
+    <section class="text-gray-700 p-8">
+      <h1 class="text-2xl font-bold">404: Not Found</h1>
+      <p class="mt-4">It's gone 😞</p>
+    </section>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/index.css b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/index.css
new file mode 100644
index 00000000000..e654b3ec6b2
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/index.css
@@ -0,0 +1,19 @@
+@import "tailwindcss";
+
+/*
+  The default border color has changed to `currentcolor` in Tailwind CSS v4,
+  so we've added these compatibility styles to make sure everything still
+  looks the same as it did with Tailwind CSS v3.
+
+  If we ever want to remove these styles, we need to add an explicit border
+  color utility to any element that depends on these defaults.
+*/
+@layer base {
+  *,
+  ::after,
+  ::before,
+  ::backdrop,
+  ::file-selector-button {
+    border-color: var(--color-gray-200, currentcolor);
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/about.data.ts b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/about.data.ts
new file mode 100644
index 00000000000..4650d38c0c7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/about.data.ts
@@ -0,0 +1,18 @@
+import { createAsync, query } from "@solidjs/router";
+
+function wait<T>(ms: number, data: T): Promise<T> {
+  return new Promise((resolve) => setTimeout(resolve, ms, data));
+}
+
+function random(min: number, max: number): number {
+  return Math.floor(Math.random() * (max - min + 1)) + min;
+}
+
+const getName = query(() => wait(random(500, 1000), "Solid"), "aboutName");
+
+const AboutData = () => {
+  return createAsync(() => getName());
+};
+
+export default AboutData;
+export type AboutDataType = typeof AboutData;
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/about.tsx b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/about.tsx
new file mode 100644
index 00000000000..2619a31f48c
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/about.tsx
@@ -0,0 +1,25 @@
+import { createEffect, Suspense } from "solid-js";
+import AboutData from "./about.data";
+
+export default function About() {
+  const name = AboutData();
+
+  createEffect(() => {
+    console.log(name());
+  });
+
+  return (
+    <section class="bg-pink-100 text-gray-700 p-8">
+      <h1 class="text-2xl font-bold">About</h1>
+
+      <p class="mt-4">A page all about this website.</p>
+
+      <p>
+        <span>We love</span>
+        <Suspense fallback={<span>...</span>}>
+          <span>&nbsp;{name()}</span>
+        </Suspense>
+      </p>
+    </section>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/home.tsx b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/home.tsx
new file mode 100644
index 00000000000..c773d38b0c0
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/pages/home.tsx
@@ -0,0 +1,32 @@
+import { createSignal } from "solid-js";
+
+export default function Home() {
+  const [count, setCount] = createSignal(0);
+
+  return (
+    <section class="bg-gray-100 text-gray-700 p-8">
+      <h1 class="text-2xl font-bold">Home</h1>
+      <p class="mt-4">This is the home page.</p>
+
+      <div class="flex items-center space-x-2">
+        <button
+          type="button"
+          class="border rounded-lg px-2 border-gray-900"
+          onClick={() => setCount(count() - 1)}
+        >
+          -
+        </button>
+
+        <output class="p-10px">Count: {count()}</output>
+
+        <button
+          type="button"
+          class="border rounded-lg px-2 border-gray-900"
+          onClick={() => setCount(count() + 1)}
+        >
+          +
+        </button>
+      </div>
+    </section>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/routes.ts b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/routes.ts
new file mode 100644
index 00000000000..a1b05b52e57
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/src/routes.ts
@@ -0,0 +1,21 @@
+import { lazy } from "solid-js";
+import type { RouteDefinition } from "@solidjs/router";
+
+import Home from "./pages/home";
+import AboutData from "./pages/about.data";
+
+export const routes: RouteDefinition[] = [
+  {
+    path: "/",
+    component: Home,
+  },
+  {
+    path: "/about",
+    component: lazy(() => import("./pages/about")),
+    data: AboutData,
+  },
+  {
+    path: "**",
+    component: lazy(() => import("./errors/404")),
+  },
+];
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/tsconfig.json
new file mode 100644
index 00000000000..58cbbc56bfc
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/tsconfig.json
@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    // General
+    "jsx": "preserve",
+    "jsxImportSource": "solid-js",
+    "target": "ESNext",
+    // Modules
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "isolatedModules": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "noEmit": true,
+    // Type Checking & Safety
+    "strict": true,
+    "types": ["vite/client"]
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/vite.config.ts b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/vite.config.ts
new file mode 100644
index 00000000000..81b6252077a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidjs-ssr/vite.config.ts
@@ -0,0 +1,20 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+import solidPlugin from "vite-plugin-solid";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+export default defineConfig({
+  plugins: [solidPlugin({ ssr: true })],
+  environments: {
+    ssr: {
+      build: {
+        emptyOutDir: false,
+        rolldownOptions: {
+          input: resolve(__dirname, "src/entry-server.tsx"),
+        },
+      },
+    },
+  },
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/.gitignore b/.repos/alchemy-effect/examples/cloudflare-solidstart/.gitignore
new file mode 100644
index 00000000000..751513ce1b7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/.gitignore
@@ -0,0 +1,28 @@
+dist
+.wrangler
+.output
+.vercel
+.netlify
+.vinxi
+app.config.timestamp_*.js
+
+# Environment
+.env
+.env*.local
+
+# dependencies
+/node_modules
+
+# IDEs and editors
+/.idea
+.project
+.classpath
+*.launch
+.settings/
+
+# Temp
+gitignore
+
+# System Files
+.DS_Store
+Thumbs.db
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-solidstart/alchemy.run.ts
new file mode 100644
index 00000000000..c866573c232
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/alchemy.run.ts
@@ -0,0 +1,22 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "CloudflareSolidStartExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* Cloudflare.Vite("CloudflareSolidStart", {
+      compatibility: {
+        flags: ["nodejs_compat"],
+      },
+    });
+
+    return {
+      url: worker.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/package.json b/.repos/alchemy-effect/examples/cloudflare-solidstart/package.json
new file mode 100644
index 00000000000..896935a57e7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "example-basic",
+  "type": "module",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build",
+    "start": "vite start",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@solidjs/meta": "^0.29.4",
+    "@solidjs/router": "^0.15.0",
+    "@solidjs/start": "2.0.0-alpha.2",
+    "solid-js": "^1.9.5",
+    "alchemy": "workspace:*",
+    "effect": "catalog:",
+    "vite": "^7.0.0",
+    "@solidjs/vite-plugin-nitro-2": "^0.1.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-solidstart"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/public/favicon.ico b/.repos/alchemy-effect/examples/cloudflare-solidstart/public/favicon.ico
new file mode 100644
index 00000000000..fb282da0719
Binary files /dev/null and b/.repos/alchemy-effect/examples/cloudflare-solidstart/public/favicon.ico differ
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/app.css b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/app.css
new file mode 100644
index 00000000000..0bd39a2a149
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/app.css
@@ -0,0 +1,41 @@
+body {
+  font-family:
+    Gordita, Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue",
+    sans-serif;
+}
+
+a {
+  margin-right: 1rem;
+}
+
+main {
+  text-align: center;
+  padding: 1em;
+  margin: 0 auto;
+}
+
+h1 {
+  color: #335d92;
+  text-transform: uppercase;
+  font-size: 4rem;
+  font-weight: 100;
+  line-height: 1.1;
+  margin: 4rem auto;
+  max-width: 14rem;
+}
+
+p {
+  max-width: 14rem;
+  margin: 2rem auto;
+  line-height: 1.35;
+}
+
+@media (min-width: 480px) {
+  h1 {
+    max-width: none;
+  }
+
+  p {
+    max-width: none;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/app.tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/app.tsx
new file mode 100644
index 00000000000..21381656c95
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/app.tsx
@@ -0,0 +1,22 @@
+import { MetaProvider, Title } from "@solidjs/meta";
+import { Router } from "@solidjs/router";
+import { FileRoutes } from "@solidjs/start/router";
+import { Suspense } from "solid-js";
+import "./app.css";
+
+export default function App() {
+  return (
+    <Router
+      root={(props) => (
+        <MetaProvider>
+          <Title>SolidStart - Basic</Title>
+          <a href="/">Index</a>
+          <a href="/about">About</a>
+          <Suspense>{props.children}</Suspense>
+        </MetaProvider>
+      )}
+    >
+      <FileRoutes />
+    </Router>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/components/Counter.css b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/components/Counter.css
new file mode 100644
index 00000000000..308965720fc
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/components/Counter.css
@@ -0,0 +1,21 @@
+.increment {
+  font-family: inherit;
+  font-size: inherit;
+  padding: 1em 2em;
+  color: #335d92;
+  background-color: rgba(68, 107, 158, 0.1);
+  border-radius: 2em;
+  border: 2px solid rgba(68, 107, 158, 0);
+  outline: none;
+  width: 200px;
+  font-variant-numeric: tabular-nums;
+  cursor: pointer;
+}
+
+.increment:focus {
+  border: 2px solid #335d92;
+}
+
+.increment:active {
+  background-color: rgba(68, 107, 158, 0.2);
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/components/Counter.tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/components/Counter.tsx
new file mode 100644
index 00000000000..954d5563ee5
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/components/Counter.tsx
@@ -0,0 +1,15 @@
+import { createSignal } from "solid-js";
+import "./Counter.css";
+
+export default function Counter() {
+  const [count, setCount] = createSignal(0);
+  return (
+    <button
+      class="increment"
+      onClick={() => setCount(count() + 1)}
+      type="button"
+    >
+      Clicks: {count()}
+    </button>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/entry-client.tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/entry-client.tsx
new file mode 100644
index 00000000000..0ca4e3c3000
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/entry-client.tsx
@@ -0,0 +1,4 @@
+// @refresh reload
+import { mount, StartClient } from "@solidjs/start/client";
+
+mount(() => <StartClient />, document.getElementById("app")!);
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/entry-server.tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/entry-server.tsx
new file mode 100644
index 00000000000..401eff83fdf
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/entry-server.tsx
@@ -0,0 +1,21 @@
+// @refresh reload
+import { createHandler, StartServer } from "@solidjs/start/server";
+
+export default createHandler(() => (
+  <StartServer
+    document={({ assets, children, scripts }) => (
+      <html lang="en">
+        <head>
+          <meta charset="utf-8" />
+          <meta name="viewport" content="width=device-width, initial-scale=1" />
+          <link rel="icon" href="/favicon.ico" />
+          {assets}
+        </head>
+        <body>
+          <div id="app">{children}</div>
+          {scripts}
+        </body>
+      </html>
+    )}
+  />
+));
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/[...404].tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/[...404].tsx
new file mode 100644
index 00000000000..4ea71ec7fee
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/[...404].tsx
@@ -0,0 +1,19 @@
+import { Title } from "@solidjs/meta";
+import { HttpStatusCode } from "@solidjs/start";
+
+export default function NotFound() {
+  return (
+    <main>
+      <Title>Not Found</Title>
+      <HttpStatusCode code={404} />
+      <h1>Page Not Found</h1>
+      <p>
+        Visit{" "}
+        <a href="https://start.solidjs.com" target="_blank">
+          start.solidjs.com
+        </a>{" "}
+        to learn how to build SolidStart apps.
+      </p>
+    </main>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/about.tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/about.tsx
new file mode 100644
index 00000000000..c1c2dcf5ad0
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/about.tsx
@@ -0,0 +1,10 @@
+import { Title } from "@solidjs/meta";
+
+export default function About() {
+  return (
+    <main>
+      <Title>About</Title>
+      <h1>About</h1>
+    </main>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/index.tsx b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/index.tsx
new file mode 100644
index 00000000000..5d557d819fb
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/src/routes/index.tsx
@@ -0,0 +1,19 @@
+import { Title } from "@solidjs/meta";
+import Counter from "~/components/Counter";
+
+export default function Home() {
+  return (
+    <main>
+      <Title>Hello World</Title>
+      <h1>Hello world!</h1>
+      <Counter />
+      <p>
+        Visit{" "}
+        <a href="https://start.solidjs.com" target="_blank">
+          start.solidjs.com
+        </a>{" "}
+        to learn how to build SolidStart apps.
+      </p>
+    </main>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-solidstart/tsconfig.json
new file mode 100644
index 00000000000..7692957ff26
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "jsx": "preserve",
+    "jsxImportSource": "solid-js",
+    "allowJs": true,
+    "strict": true,
+    "noEmit": true,
+    "types": ["vite/client"],
+    "isolatedModules": true,
+    "paths": {
+      "~/*": ["./src/*"]
+    }
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-solidstart/vite.config.ts b/.repos/alchemy-effect/examples/cloudflare-solidstart/vite.config.ts
new file mode 100644
index 00000000000..d0128701e17
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-solidstart/vite.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from "vite";
+
+import { solidStart } from "@solidjs/start/config";
+
+export default defineConfig({
+  plugins: [solidStart()],
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-static-site/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-static-site/alchemy.run.ts
new file mode 100644
index 00000000000..6ce07133d56
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-static-site/alchemy.run.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "CloudflareVite",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* Cloudflare.Vite("Website");
+
+    return {
+      url: worker.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-static-site/index.html b/.repos/alchemy-effect/examples/cloudflare-static-site/index.html
new file mode 100644
index 00000000000..065aecab3f3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-static-site/index.html
@@ -0,0 +1,68 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Alchemy + Vite + Cloudflare</title>
+    <style>
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
+      body {
+        font-family:
+          -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu,
+          sans-serif;
+        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+      }
+      .container {
+        text-align: center;
+        padding: 2rem;
+        background: rgba(255, 255, 255, 0.95);
+        border-radius: 16px;
+        box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);
+        max-width: 500px;
+      }
+      h1 {
+        color: #333;
+        margin-bottom: 1rem;
+        font-size: 2rem;
+      }
+      p {
+        color: #666;
+        margin-bottom: 1.5rem;
+        line-height: 1.6;
+      }
+      .badge {
+        display: inline-block;
+        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+        color: white;
+        padding: 0.5rem 1rem;
+        border-radius: 20px;
+        font-size: 0.875rem;
+        font-weight: 500;
+      }
+      #app {
+        margin-top: 1.5rem;
+        padding: 1rem;
+        background: #f5f5f5;
+        border-radius: 8px;
+        font-family: monospace;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <h1>Alchemy Effect</h1>
+      <p>This Vite app was built and deployed to Cloudflare Workers</p>
+      <span class="badge">Deployed with Alchemy</span>
+      <div id="app"></div>
+    </div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/cloudflare-static-site/package.json b/.repos/alchemy-effect/examples/cloudflare-static-site/package.json
new file mode 100644
index 00000000000..d6a83f3307d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-static-site/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "cloudflare-vite-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-static-site"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "dev:vite": "vite",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "@distilled.cloud/cloudflare": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "devDependencies": {
+    "typescript": "catalog:",
+    "vite": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-static-site/src/main.ts b/.repos/alchemy-effect/examples/cloudflare-static-site/src/main.ts
new file mode 100644
index 00000000000..dd42d633bad
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-static-site/src/main.ts
@@ -0,0 +1,5 @@
+const app = document.getElementById("app");
+if (app) {
+  const now = new Date();
+  app.innerHTML = `Built at: ${now.toISOString()}`;
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-static-site/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-static-site/tsconfig.json
new file mode 100644
index 00000000000..586e7d22291
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-static-site/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/.gitignore b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/.gitignore
new file mode 100644
index 00000000000..457ac857ecb
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/.gitignore
@@ -0,0 +1,6 @@
+node_modules
+.tanstack
+.nitro
+.output
+.alchemy
+dist
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/alchemy.run.ts
new file mode 100644
index 00000000000..259648b1863
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/alchemy.run.ts
@@ -0,0 +1,23 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export const Website = Cloudflare.Vite("Website", {
+  compatibility: {
+    flags: ["nodejs_compat"],
+  },
+});
+
+export default Alchemy.Stack(
+  "CloudflareTanstackStartSolidExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const website = yield* Website;
+    return {
+      websiteUrl: website.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/package.json b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/package.json
new file mode 100644
index 00000000000..ab44b5da119
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/package.json
@@ -0,0 +1,34 @@
+{
+  "name": "cloudflare-tanstack-start-solid-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-tanstack-start-solid"
+  },
+  "type": "module",
+  "scripts": {
+    "dev": "alchemy dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "destroy": "alchemy destroy",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@tanstack/solid-router": "^1.170.4",
+    "@tanstack/solid-start": "^1.168.6",
+    "alchemy": "workspace:*",
+    "effect": "catalog:",
+    "solid-js": "^1.9.12"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@types/bun": "latest",
+    "typescript": "catalog:",
+    "vite": "catalog:",
+    "vite-plugin-solid": "^2.11.12"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routeTree.gen.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routeTree.gen.ts
new file mode 100644
index 00000000000..0a8322c6860
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routeTree.gen.ts
@@ -0,0 +1,68 @@
+/* eslint-disable */
+
+// @ts-nocheck
+
+// noinspection JSUnusedGlobalSymbols
+
+// This file was automatically generated by TanStack Router.
+// You should NOT make any changes in this file as it will be overwritten.
+// Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified.
+
+import { Route as rootRouteImport } from "./routes/__root";
+import { Route as IndexRouteImport } from "./routes/index";
+
+const IndexRoute = IndexRouteImport.update({
+  id: "/",
+  path: "/",
+  getParentRoute: () => rootRouteImport,
+} as any);
+
+export interface FileRoutesByFullPath {
+  "/": typeof IndexRoute;
+}
+export interface FileRoutesByTo {
+  "/": typeof IndexRoute;
+}
+export interface FileRoutesById {
+  __root__: typeof rootRouteImport;
+  "/": typeof IndexRoute;
+}
+export interface FileRouteTypes {
+  fileRoutesByFullPath: FileRoutesByFullPath;
+  fullPaths: "/";
+  fileRoutesByTo: FileRoutesByTo;
+  to: "/";
+  id: "__root__" | "/";
+  fileRoutesById: FileRoutesById;
+}
+export interface RootRouteChildren {
+  IndexRoute: typeof IndexRoute;
+}
+
+declare module "@tanstack/solid-router" {
+  interface FileRoutesByPath {
+    "/": {
+      id: "/";
+      path: "/";
+      fullPath: "/";
+      preLoaderRoute: typeof IndexRouteImport;
+      parentRoute: typeof rootRouteImport;
+    };
+  }
+}
+
+const rootRouteChildren: RootRouteChildren = {
+  IndexRoute: IndexRoute,
+};
+export const routeTree = rootRouteImport
+  ._addFileChildren(rootRouteChildren)
+  ._addFileTypes<FileRouteTypes>();
+
+import type { getRouter } from "./router.tsx";
+import type { createStart } from "@tanstack/solid-start";
+declare module "@tanstack/solid-start" {
+  interface Register {
+    ssr: true;
+    router: Awaited<ReturnType<typeof getRouter>>;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/router.tsx b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/router.tsx
new file mode 100644
index 00000000000..8b441765594
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/router.tsx
@@ -0,0 +1,15 @@
+import { createRouter } from "@tanstack/solid-router";
+import { routeTree } from "./routeTree.gen.ts";
+
+export function getRouter() {
+  return createRouter({
+    routeTree,
+    scrollRestoration: true,
+  });
+}
+
+declare module "@tanstack/solid-router" {
+  interface Register {
+    router: ReturnType<typeof getRouter>;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routes/__root.tsx b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routes/__root.tsx
new file mode 100644
index 00000000000..1cf905b4e15
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routes/__root.tsx
@@ -0,0 +1,40 @@
+/// <reference types="vite/client" />
+import { HeadContent, Scripts, createRootRoute } from "@tanstack/solid-router";
+import type * as Solid from "solid-js";
+import { HydrationScript } from "solid-js/web";
+
+export const Route = createRootRoute({
+  head: () => ({
+    meta: [
+      { charSet: "utf-8" },
+      {
+        name: "viewport",
+        content: "width=device-width, initial-scale=1",
+      },
+      { title: "TanStack Start Solid on Cloudflare" },
+    ],
+  }),
+  shellComponent: RootDocument,
+});
+
+function RootDocument(props: Readonly<{ children: Solid.JSX.Element }>) {
+  return (
+    <html lang="en">
+      <head>
+        <HydrationScript />
+        <HeadContent />
+      </head>
+      <body
+        style={{
+          margin: 0,
+          "font-family": "ui-sans-serif, system-ui, sans-serif",
+          background: "#f8fafc",
+          color: "#0f172a",
+        }}
+      >
+        {props.children}
+        <Scripts />
+      </body>
+    </html>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routes/index.tsx b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routes/index.tsx
new file mode 100644
index 00000000000..a5f998938f9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/src/routes/index.tsx
@@ -0,0 +1,44 @@
+import { createFileRoute } from "@tanstack/solid-router";
+import { createServerFn } from "@tanstack/solid-start";
+import { createSignal } from "solid-js";
+
+export const getServerGreeting = createServerFn({
+  method: "GET",
+}).handler(() => ({
+  message: "Hello from TanStack Start Solid on Cloudflare.Vite.",
+}));
+
+export const Route = createFileRoute("/")({
+  loader: () => getServerGreeting(),
+  component: Home,
+});
+
+function Home() {
+  const initial = Route.useLoaderData();
+  const [message, setMessage] = createSignal(initial().message);
+
+  return (
+    <main
+      style={{
+        "max-width": "720px",
+        margin: "0 auto",
+        padding: "4rem 1.5rem",
+      }}
+    >
+      <h1 style={{ margin: 0, "font-size": "2.5rem" }}>TanStack Start Solid</h1>
+      <p style={{ "margin-top": "1rem", "font-size": "1.125rem" }}>
+        This app is served by <code>Cloudflare.Vite</code>.
+      </p>
+      <p data-testid="server-greeting">{message()}</p>
+      <button
+        type="button"
+        onClick={async () => {
+          const next = await getServerGreeting();
+          setMessage(next.message);
+        }}
+      >
+        Refresh from server
+      </button>
+    </main>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/test/integ.test.ts
new file mode 100644
index 00000000000..f2e153527e4
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/test/integ.test.ts
@@ -0,0 +1,46 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+  stage: "test",
+});
+
+const stack = beforeAll(deploy(Stack).pipe(Effect.tap(Console.log)));
+afterAll(
+  Effect.gen(function* () {
+    if (!process.env.NO_DESTROY) {
+      yield* destroy(Stack);
+    }
+  }),
+);
+
+const coldStartRetry = Effect.retry({
+  schedule: Schedule.exponential("500 millis").pipe(
+    Schedule.both(Schedule.recurs(20)),
+  ),
+});
+
+test(
+  "serves the TanStack Start Solid app shell",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* client.get(websiteUrl).pipe(coldStartRetry);
+    expect(res.status).toBe(200);
+    const html = yield* res.text;
+    expect(html).toContain("TanStack Start Solid");
+    expect(html).toContain(
+      "Hello from TanStack Start Solid on Cloudflare.Vite",
+    );
+  }),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/tsconfig.json
new file mode 100644
index 00000000000..5b4fe7838b7
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/tsconfig.json
@@ -0,0 +1,36 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": [
+    "alchemy.run.ts",
+    "src/**/*.ts",
+    "src/**/*.tsx",
+    "test/**/*.ts",
+    "vite.config.ts"
+  ],
+  "compilerOptions": {
+    "rootDir": ".",
+    "strict": true,
+    "esModuleInterop": true,
+    "jsx": "preserve",
+    "jsxImportSource": "solid-js",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["DOM", "DOM.Iterable", "ES2022"],
+    "isolatedModules": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "target": "ES2022",
+    "allowJs": true,
+    "forceConsistentCasingInFileNames": true,
+    "paths": {
+      "~/*": ["./src/*"]
+    },
+    "noEmit": true,
+    "types": ["bun", "vite/client", "@cloudflare/workers-types"]
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/vite.config.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/vite.config.ts
new file mode 100644
index 00000000000..39b205142c0
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack-start-solid/vite.config.ts
@@ -0,0 +1,10 @@
+import { tanstackStart } from "@tanstack/solid-start/plugin/vite";
+import { defineConfig } from "vite";
+import viteSolid from "vite-plugin-solid";
+
+export default defineConfig({
+  resolve: {
+    tsconfigPaths: true,
+  },
+  plugins: [tanstackStart(), viteSolid({ ssr: true })],
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/.gitignore b/.repos/alchemy-effect/examples/cloudflare-tanstack/.gitignore
new file mode 100644
index 00000000000..3be7d630918
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/.gitignore
@@ -0,0 +1,5 @@
+node_modules
+.tanstack
+.nitro
+.output
+dist
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/alchemy.run.ts
new file mode 100644
index 00000000000..b1198de3019
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/alchemy.run.ts
@@ -0,0 +1,32 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Backend, { Bucket } from "./src/backend.ts";
+
+export const Website = Cloudflare.Vite("Website", {
+  compatibility: {
+    flags: ["nodejs_compat"],
+  },
+  env: {
+    BUCKET: Bucket,
+    BACKEND: Backend,
+  },
+});
+
+export type WebsiteEnv = Cloudflare.InferEnv<typeof Website>;
+
+export default Alchemy.Stack(
+  "CloudflareTanstackExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const backend = yield* Backend;
+    const website = yield* Website;
+    return {
+      backendUrl: backend.url.as<string>(),
+      websiteUrl: website.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/package.json b/.repos/alchemy-effect/examples/cloudflare-tanstack/package.json
new file mode 100644
index 00000000000..1f8b9229163
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/package.json
@@ -0,0 +1,36 @@
+{
+  "name": "cloudflare-tanstack-example",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-tanstack"
+  },
+  "type": "module",
+  "scripts": {
+    "dev": "alchemy dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "destroy": "alchemy destroy",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@tanstack/react-router": "^1.167.4",
+    "@tanstack/react-start": "^1.166.15",
+    "alchemy": "workspace:*",
+    "effect": "catalog:",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "catalog:",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.1",
+    "typescript": "^5.9.3",
+    "vite": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/backend.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/backend.ts
new file mode 100644
index 00000000000..238a5971c6f
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/backend.ts
@@ -0,0 +1,65 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+
+export default class Backend extends Cloudflare.Worker<Backend>()(
+  "Backend",
+  {
+    main: import.meta.path,
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      // RPC method — read an object from R2 by key, returning the body as
+      // text or `null` if the key is missing. Other workers can call this
+      // directly via the service binding (option 3 in `api.hello.ts`).
+      hello: Effect.fn("Backend.hello")(function* (key: string) {
+        const object = yield* bucket.get(key);
+        if (object === null) return null;
+        return yield* object.text();
+      }),
+
+      // HTTP handler — supports `GET` and `PUT` against R2 by `?key=...`.
+      // Other workers can call this via `env.BACKEND.fetch(...)` (option 2
+      // in `api.hello.ts`).
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = new URL(request.url, "http://backend").searchParams.get(
+          "key",
+        );
+        if (!key) {
+          return HttpServerResponse.text("Missing 'key' query parameter", {
+            status: 400,
+          });
+        }
+
+        if (request.method === "GET") {
+          const object = yield* bucket.get(key);
+          if (object === null) {
+            return HttpServerResponse.text("Not found", { status: 404 });
+          }
+          return HttpServerResponse.stream(object.body);
+        }
+
+        if (request.method === "PUT") {
+          yield* bucket.put(key, request.stream, {
+            contentLength: Number(request.headers["content-length"] ?? 0),
+          });
+          return HttpServerResponse.empty({ status: 204 });
+        }
+
+        return HttpServerResponse.text("Method not allowed", { status: 405 });
+      }).pipe(
+        Effect.catchTag("R2Error", (error) =>
+          Effect.succeed(
+            HttpServerResponse.text(error.message, { status: 500 }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/env.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/env.ts
new file mode 100644
index 00000000000..3f7f56db6e0
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/env.ts
@@ -0,0 +1,10 @@
+import * as cf from "cloudflare:workers";
+import type { WebsiteEnv } from "../alchemy.run.ts";
+
+// In development mode with TanStack Start, `import { env } from "cloudflare:workers"` does not work at the top level.
+// As a workaround, we use a proxy to access the env object.
+export const env = new Proxy({} as WebsiteEnv, {
+  get(_, prop) {
+    return cf.env[prop as keyof typeof cf.env];
+  },
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routeTree.gen.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routeTree.gen.ts
new file mode 100644
index 00000000000..626c6d302e3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routeTree.gen.ts
@@ -0,0 +1,86 @@
+/* eslint-disable */
+
+// @ts-nocheck
+
+// noinspection JSUnusedGlobalSymbols
+
+// This file was automatically generated by TanStack Router.
+// You should NOT make any changes in this file as it will be overwritten.
+// Additionally, you should also exclude this file from your linter and/or formatter to prevent it from being checked or modified.
+
+import { Route as rootRouteImport } from "./routes/__root";
+import { Route as IndexRouteImport } from "./routes/index";
+import { Route as ApiHelloRouteImport } from "./routes/api.hello";
+
+const IndexRoute = IndexRouteImport.update({
+  id: "/",
+  path: "/",
+  getParentRoute: () => rootRouteImport,
+} as any);
+const ApiHelloRoute = ApiHelloRouteImport.update({
+  id: "/api/hello",
+  path: "/api/hello",
+  getParentRoute: () => rootRouteImport,
+} as any);
+
+export interface FileRoutesByFullPath {
+  "/": typeof IndexRoute;
+  "/api/hello": typeof ApiHelloRoute;
+}
+export interface FileRoutesByTo {
+  "/": typeof IndexRoute;
+  "/api/hello": typeof ApiHelloRoute;
+}
+export interface FileRoutesById {
+  __root__: typeof rootRouteImport;
+  "/": typeof IndexRoute;
+  "/api/hello": typeof ApiHelloRoute;
+}
+export interface FileRouteTypes {
+  fileRoutesByFullPath: FileRoutesByFullPath;
+  fullPaths: "/" | "/api/hello";
+  fileRoutesByTo: FileRoutesByTo;
+  to: "/" | "/api/hello";
+  id: "__root__" | "/" | "/api/hello";
+  fileRoutesById: FileRoutesById;
+}
+export interface RootRouteChildren {
+  IndexRoute: typeof IndexRoute;
+  ApiHelloRoute: typeof ApiHelloRoute;
+}
+
+declare module "@tanstack/react-router" {
+  interface FileRoutesByPath {
+    "/": {
+      id: "/";
+      path: "/";
+      fullPath: "/";
+      preLoaderRoute: typeof IndexRouteImport;
+      parentRoute: typeof rootRouteImport;
+    };
+    "/api/hello": {
+      id: "/api/hello";
+      path: "/api/hello";
+      fullPath: "/api/hello";
+      preLoaderRoute: typeof ApiHelloRouteImport;
+      parentRoute: typeof rootRouteImport;
+    };
+  }
+}
+
+const rootRouteChildren: RootRouteChildren = {
+  IndexRoute: IndexRoute,
+  ApiHelloRoute: ApiHelloRoute,
+};
+export const routeTree = rootRouteImport
+  ._addFileChildren(rootRouteChildren)
+  ._addFileTypes<FileRouteTypes>();
+
+import type { getRouter } from "./router.tsx";
+import type { createStart } from "@tanstack/react-start";
+declare module "@tanstack/react-start" {
+  interface Register {
+    ssr: true;
+    router: Awaited<ReturnType<typeof getRouter>>;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/router.tsx b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/router.tsx
new file mode 100644
index 00000000000..6f7766f8cb3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/router.tsx
@@ -0,0 +1,15 @@
+import { createRouter } from "@tanstack/react-router";
+import { routeTree } from "./routeTree.gen";
+
+export function getRouter() {
+  return createRouter({
+    routeTree,
+    scrollRestoration: true,
+  });
+}
+
+declare module "@tanstack/react-router" {
+  interface Register {
+    router: ReturnType<typeof getRouter>;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/__root.tsx b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/__root.tsx
new file mode 100644
index 00000000000..920d199d23e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/__root.tsx
@@ -0,0 +1,54 @@
+import type { ReactNode } from "react";
+import {
+  HeadContent,
+  Outlet,
+  Scripts,
+  createRootRoute,
+} from "@tanstack/react-router";
+
+export const Route = createRootRoute({
+  head: () => ({
+    meta: [
+      {
+        charSet: "utf-8",
+      },
+      {
+        name: "viewport",
+        content: "width=device-width, initial-scale=1",
+      },
+      {
+        title: "TanStack Start",
+      },
+    ],
+  }),
+  component: RootComponent,
+});
+
+function RootComponent() {
+  return (
+    <Document>
+      <Outlet />
+    </Document>
+  );
+}
+
+function Document(props: Readonly<{ children: ReactNode }>) {
+  return (
+    <html lang="en">
+      <head>
+        <HeadContent />
+      </head>
+      <body
+        style={{
+          margin: 0,
+          fontFamily: "ui-sans-serif, system-ui, sans-serif",
+          background: "#f8fafc",
+          color: "#0f172a",
+        }}
+      >
+        {props.children}
+        <Scripts />
+      </body>
+    </html>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/api.hello.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/api.hello.ts
new file mode 100644
index 00000000000..c36773592d2
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/api.hello.ts
@@ -0,0 +1,128 @@
+import { createFileRoute } from "@tanstack/react-router";
+import * as Cloudflare from "alchemy/Cloudflare/Bridge";
+import type Backend from "../backend.ts";
+import { env } from "../env.ts";
+
+const VIAS = ["binding", "fetch", "rpc"] as const;
+type Via = (typeof VIAS)[number];
+
+const parseRequest = (request: Request): { via: Via; key: string | null } => {
+  const url = new URL(request.url);
+  const raw = url.searchParams.get("via") ?? "binding";
+  const via = (VIAS as readonly string[]).includes(raw)
+    ? (raw as Via)
+    : "binding";
+  return { via, key: url.searchParams.get("key") };
+};
+
+// Surface the actual error in BOTH the response body and the worker logs —
+// otherwise TanStack Start's outer boundary swallows it and you only ever
+// see "HTTPError" in `bun alchemy logs`.
+const trace = async (label: string, fn: () => Promise<Response>) => {
+  try {
+    return await fn();
+  } catch (err) {
+    const message =
+      err instanceof Error ? (err.stack ?? err.message) : String(err);
+    console.error(`[api.hello] ${label} failed:`, message);
+    return new Response(`${label} failed: ${message}`, { status: 500 });
+  }
+};
+
+export const Route = createFileRoute("/api/hello")({
+  server: {
+    handlers: {
+      // GET /api/hello?key=<key>&via=binding|fetch|rpc
+      GET: async ({ request }) => {
+        const { via, key } = parseRequest(request);
+        if (!key) {
+          return new Response("Missing 'key' query parameter", { status: 400 });
+        }
+
+        switch (via) {
+          // option 1 — use the async binding directly
+          case "binding":
+            return trace("GET option 1 (env.BUCKET.get)", async () => {
+              const object = await env.BUCKET.get(key);
+              if (!object) return new Response("Not found", { status: 404 });
+              return new Response(object.body);
+            });
+
+          // option 2 — bind to your effect worker and call fetch
+          case "fetch":
+            return trace("GET option 2 (env.BACKEND.fetch)", async () => {
+              const res = await env.BACKEND.fetch(
+                `https://backend/?key=${encodeURIComponent(key)}`,
+              );
+              return new Response(res.body, {
+                status: res.status,
+                headers: res.headers,
+              });
+            });
+
+          // option 3 — bind to your effect worker and call rpc method
+          case "rpc":
+            return trace("GET option 3 (backend.hello rpc)", async () => {
+              // Wrap the raw wire-shape binding into a Promise<T> view that
+              // throws on Effect.fail and unwraps stream envelopes.
+              const backend = Cloudflare.toRpcAsync<Backend>(env.BACKEND);
+              const value = await backend.hello(key);
+              if (value === null)
+                return new Response("Not found", { status: 404 });
+              return new Response(value);
+            });
+        }
+      },
+
+      // PUT /api/hello?key=<key>&via=binding|fetch
+      // (option 3 is GET-only — `hello` is a read RPC for demonstration.)
+      PUT: async ({ request }) => {
+        const { via, key } = parseRequest(request);
+        if (!key) {
+          return new Response("Missing 'key' query parameter", { status: 400 });
+        }
+        if (!request.body) {
+          return new Response("Missing request body", { status: 400 });
+        }
+
+        switch (via) {
+          // option 1 — use the async binding directly
+          case "binding":
+            return trace("PUT option 1 (env.BUCKET.put)", async () => {
+              await env.BUCKET.put(key, request.body, {
+                httpMetadata: {
+                  contentType:
+                    request.headers.get("content-type") ??
+                    "application/octet-stream",
+                },
+              });
+              return new Response(null, { status: 204 });
+            });
+
+          // option 2 — bind to your effect worker and call fetch
+          case "fetch":
+            return trace("PUT option 2 (env.BACKEND.fetch)", async () => {
+              const res = await env.BACKEND.fetch(
+                `https://backend/?key=${encodeURIComponent(key)}`,
+                {
+                  method: "PUT",
+                  body: request.body,
+                  headers: request.headers,
+                },
+              );
+              return new Response(res.body, {
+                status: res.status,
+                headers: res.headers,
+              });
+            });
+
+          // option 3 — RPC `hello` is read-only
+          case "rpc":
+            return new Response("PUT is not supported via=rpc", {
+              status: 400,
+            });
+        }
+      },
+    },
+  },
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/index.tsx b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/index.tsx
new file mode 100644
index 00000000000..1ab51f0c148
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/src/routes/index.tsx
@@ -0,0 +1,63 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { createServerFn } from "@tanstack/react-start";
+import { useState } from "react";
+
+export const getServerTime = createServerFn({
+  method: "GET",
+}).handler(() => ({
+  message: "Hello from a TanStack Start server function.",
+  time: new Date().toISOString(),
+}));
+
+export const Route = createFileRoute("/")({
+  loader: () => getServerTime(),
+  component: Home,
+});
+
+function Home() {
+  const initialData = Route.useLoaderData();
+  const [data, setData] = useState(initialData);
+
+  return (
+    <main
+      style={{
+        maxWidth: 720,
+        margin: "0 auto",
+        padding: "4rem 1.5rem",
+      }}
+    >
+      <h1 style={{ margin: 0, fontSize: "2.5rem" }}>TanStack Start</h1>
+      <p style={{ marginTop: "1rem", fontSize: "1.125rem", lineHeight: 1.6 }}>
+        This is the minimal app scaffold in{" "}
+        <code>examples/cloudflare-tanstack</code>.
+      </p>
+      <p style={{ marginTop: "1rem", lineHeight: 1.6 }}>{data.message}</p>
+      <p
+        style={{
+          padding: "0.75rem 1rem",
+          background: "#e2e8f0",
+          borderRadius: 8,
+          fontFamily: "ui-monospace, SFMono-Regular, monospace",
+        }}
+      >
+        {data.time}
+      </p>
+      <button
+        type="button"
+        onClick={async () => {
+          setData(await getServerTime());
+        }}
+        style={{
+          padding: "0.75rem 1rem",
+          border: "none",
+          borderRadius: 8,
+          background: "#0f172a",
+          color: "#fff",
+          cursor: "pointer",
+        }}
+      >
+        Refresh from server
+      </button>
+    </main>
+  );
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/test/integ.test.ts
new file mode 100644
index 00000000000..ffe1a978795
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/test/integ.test.ts
@@ -0,0 +1,158 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+  stage: "test",
+});
+
+const stack = beforeAll(deploy(Stack).pipe(Effect.tap(Console.log)));
+afterAll(
+  Effect.gen(function* () {
+    if (!process.env.NO_DESTROY) {
+      yield* destroy(Stack);
+    }
+  }),
+);
+
+const route = (url: string, params: Record<string, string>) =>
+  `${url}/api/hello?${new URLSearchParams(params).toString()}`;
+
+// Stable per-option keys so re-runs (e.g. NO_DESTROY=1) overwrite cleanly
+// instead of leaving stale objects behind.
+const KEYS = {
+  binding: "integ:via-binding",
+  fetch: "integ:via-fetch",
+  rpc: "integ:via-rpc",
+};
+
+// Cold-start retry — fresh `workers.dev` URLs take a few seconds to start
+// answering, so the very first PUT in each test rides this schedule.
+const coldStartRetry = Effect.retry({
+  schedule: Schedule.exponential("500 millis").pipe(
+    Schedule.both(Schedule.recurs(20)),
+  ),
+});
+
+test(
+  "deploys and exposes a url",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    expect(websiteUrl).toBeString();
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "option 1 — direct R2 binding round-trips through PUT and GET",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+    const key = KEYS.binding;
+
+    const put = yield* HttpClient.execute(
+      HttpClientRequest.put(route(websiteUrl, { key, via: "binding" })).pipe(
+        HttpClientRequest.bodyText("hello-binding", "text/plain"),
+      ),
+    ).pipe(coldStartRetry);
+    expect(put.status).toBe(204);
+
+    const get = yield* client.get(route(websiteUrl, { key, via: "binding" }));
+    expect(get.status).toBe(200);
+    expect(yield* get.text).toBe("hello-binding");
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "option 2 — service-binding fetch into the Backend worker",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+    const key = KEYS.fetch;
+
+    // Write through option 2's PUT path (Backend's fetch handler stores it
+    // in R2), then read it back through option 2's GET (also Backend.fetch).
+    const put = yield* HttpClient.execute(
+      HttpClientRequest.put(route(websiteUrl, { key, via: "fetch" })).pipe(
+        HttpClientRequest.bodyText("hello-fetch", "text/plain"),
+      ),
+    ).pipe(coldStartRetry);
+    expect(put.status).toBe(204);
+
+    const get = yield* client.get(route(websiteUrl, { key, via: "fetch" }));
+    expect(get.status).toBe(200);
+    expect(yield* get.text).toBe("hello-fetch");
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "option 3 — service-binding RPC method via toPromiseApi",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+    const key = KEYS.rpc;
+
+    // Seed the bucket via option 1 (direct binding) so the RPC `hello`
+    // method has something to read.
+    const seed = yield* HttpClient.execute(
+      HttpClientRequest.put(route(websiteUrl, { key, via: "binding" })).pipe(
+        HttpClientRequest.bodyText("hello-rpc", "text/plain"),
+      ),
+    ).pipe(coldStartRetry);
+    expect(seed.status).toBe(204);
+
+    // RPC GET reads through Backend.hello — exercises toPromiseApi.
+    const get = yield* client.get(route(websiteUrl, { key, via: "rpc" }));
+    expect(get.status).toBe(200);
+    expect(yield* get.text).toBe("hello-rpc");
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "missing `key` returns 400",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* client.get(route(websiteUrl, { via: "binding" }));
+    expect(res.status).toBe(400);
+  }),
+);
+
+test(
+  "RPC for a non-existent key returns 404",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* client.get(
+      route(websiteUrl, { key: "integ:does-not-exist", via: "rpc" }),
+    );
+    expect(res.status).toBe(404);
+  }),
+);
+
+test(
+  "PUT via=rpc returns 400 (RPC `hello` is read-only)",
+  Effect.gen(function* () {
+    const { websiteUrl } = yield* stack;
+
+    const res = yield* HttpClient.execute(
+      HttpClientRequest.put(
+        route(websiteUrl, { key: "integ:via-options", via: "rpc" }),
+      ).pipe(HttpClientRequest.bodyText("nope")),
+    );
+    expect(res.status).toBe(400);
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-tanstack/tsconfig.json
new file mode 100644
index 00000000000..910a43e8f47
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/tsconfig.json
@@ -0,0 +1,26 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": [
+    "alchemy.run.ts",
+    "src/**/*.ts",
+    "src/**/*.tsx",
+    "test/**/*.ts",
+    "vite.config.ts"
+  ],
+  "compilerOptions": {
+    "rootDir": ".",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "target": "ES2022",
+    "jsx": "react-jsx",
+    "noEmit": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "types": ["bun", "vite/client", "@cloudflare/workers-types"]
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-tanstack/vite.config.ts b/.repos/alchemy-effect/examples/cloudflare-tanstack/vite.config.ts
new file mode 100644
index 00000000000..d37915e1c6d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-tanstack/vite.config.ts
@@ -0,0 +1,7 @@
+import { tanstackStart } from "@tanstack/react-start/plugin/vite";
+import viteReact from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [tanstackStart(), viteReact()],
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/.gitignore b/.repos/alchemy-effect/examples/cloudflare-vue/.gitignore
new file mode 100644
index 00000000000..cd68f14023e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/.gitignore
@@ -0,0 +1,39 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+.DS_Store
+dist
+dist-ssr
+coverage
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+*.tsbuildinfo
+
+.eslintcache
+
+# Cypress
+/cypress/videos/
+/cypress/screenshots/
+
+# Vitest
+__screenshots__/
+
+# Vite
+*.timestamp-*-*.mjs
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/README.md b/.repos/alchemy-effect/examples/cloudflare-vue/README.md
new file mode 100644
index 00000000000..f5e3b4cd6f1
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/README.md
@@ -0,0 +1,42 @@
+# ./
+
+This template should help get you started developing with Vue 3 in Vite.
+
+## Recommended IDE Setup
+
+[VS Code](https://code.visualstudio.com/) + [Vue (Official)](https://marketplace.visualstudio.com/items?itemName=Vue.volar) (and disable Vetur).
+
+## Recommended Browser Setup
+
+- Chromium-based browsers (Chrome, Edge, Brave, etc.):
+  - [Vue.js devtools](https://chromewebstore.google.com/detail/vuejs-devtools/nhdogjmejiglipccpnnnanhbledajbpd)
+  - [Turn on Custom Object Formatter in Chrome DevTools](http://bit.ly/object-formatters)
+- Firefox:
+  - [Vue.js devtools](https://addons.mozilla.org/en-US/firefox/addon/vue-js-devtools/)
+  - [Turn on Custom Object Formatter in Firefox DevTools](https://fxdx.dev/firefox-devtools-custom-object-formatters/)
+
+## Type Support for `.vue` Imports in TS
+
+TypeScript cannot handle type information for `.vue` imports by default, so we replace the `tsc` CLI with `vue-tsc` for type checking. In editors, we need [Volar](https://marketplace.visualstudio.com/items?itemName=Vue.volar) to make the TypeScript language service aware of `.vue` types.
+
+## Customize configuration
+
+See [Vite Configuration Reference](https://vite.dev/config/).
+
+## Project Setup
+
+```sh
+bun install
+```
+
+### Compile and Hot-Reload for Development
+
+```sh
+bun dev
+```
+
+### Type-Check, Compile and Minify for Production
+
+```sh
+bun run build
+```
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-vue/alchemy.run.ts
new file mode 100644
index 00000000000..4f390e156c9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/alchemy.run.ts
@@ -0,0 +1,23 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "CloudflareVueExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* Cloudflare.Vite("Vue", {
+      compatibility: {
+        flags: ["nodejs_compat"],
+      },
+      memo: {},
+    });
+
+    return {
+      url: worker.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/index.html b/.repos/alchemy-effect/examples/cloudflare-vue/index.html
new file mode 100644
index 00000000000..9d30802cd87
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/index.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" href="/favicon.ico" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Vite App</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/package.json b/.repos/alchemy-effect/examples/cloudflare-vue/package.json
new file mode 100644
index 00000000000..2850d00971f
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/package.json
@@ -0,0 +1,54 @@
+{
+  "name": "cloudflare-vue",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "alchemy dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "deploy": "alchemy deploy",
+    "destroy": "alchemy destroy"
+  },
+  "dependencies": {
+    "vue": "beta",
+    "vue-router": "^5.0.4"
+  },
+  "devDependencies": {
+    "@tsconfig/node24": "^24.0.4",
+    "@types/node": "^24.12.0",
+    "@vitejs/plugin-vue": "^6.0.5",
+    "@vue/tsconfig": "^0.9.1",
+    "npm-run-all2": "^8.0.4",
+    "oxfmt": "^0.42.0",
+    "typescript": "~6.0.0",
+    "vite": "^8.0.3",
+    "vite-plugin-vue-devtools": "^8.1.1",
+    "alchemy": "workspace:*",
+    "effect": "catalog:",
+    "vue-tsc": "^3.2.6"
+  },
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
+  },
+  "overrides": {
+    "vue": "beta",
+    "@vue/compiler-core": "beta",
+    "@vue/compiler-dom": "beta",
+    "@vue/compiler-sfc": "beta",
+    "@vue/compiler-ssr": "beta",
+    "@vue/compiler-vapor": "beta",
+    "@vue/reactivity": "beta",
+    "@vue/runtime-core": "beta",
+    "@vue/runtime-dom": "beta",
+    "@vue/runtime-vapor": "beta",
+    "@vue/server-renderer": "beta",
+    "@vue/shared": "beta",
+    "@vue/compat": "beta"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-vue"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/public/favicon.ico b/.repos/alchemy-effect/examples/cloudflare-vue/public/favicon.ico
new file mode 100644
index 00000000000..df36fcfb725
Binary files /dev/null and b/.repos/alchemy-effect/examples/cloudflare-vue/public/favicon.ico differ
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/App.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/App.vue
new file mode 100644
index 00000000000..540829f1f50
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/App.vue
@@ -0,0 +1,91 @@
+<script setup lang="ts">
+import { RouterLink, RouterView } from "vue-router";
+import HelloWorld from "./components/HelloWorld.vue";
+</script>
+
+<template>
+  <header>
+    <img
+      alt="Vue logo"
+      class="logo"
+      src="@/assets/logo.svg"
+      width="125"
+      height="125"
+    />
+
+    <div class="wrapper">
+      <HelloWorld msg="You did it!" />
+
+      <nav>
+        <RouterLink to="/">Home</RouterLink>
+        <RouterLink to="/about">About</RouterLink>
+      </nav>
+    </div>
+  </header>
+
+  <RouterView />
+</template>
+
+<style scoped>
+header {
+  line-height: 1.5;
+  max-height: 100vh;
+}
+
+.logo {
+  display: block;
+  margin: 0 auto 2rem;
+}
+
+nav {
+  width: 100%;
+  font-size: 12px;
+  text-align: center;
+  margin-top: 2rem;
+}
+
+nav a.router-link-exact-active {
+  color: var(--color-text);
+}
+
+nav a.router-link-exact-active:hover {
+  background-color: transparent;
+}
+
+nav a {
+  display: inline-block;
+  padding: 0 1rem;
+  border-left: 1px solid var(--color-border);
+}
+
+nav a:first-of-type {
+  border: 0;
+}
+
+@media (min-width: 1024px) {
+  header {
+    display: flex;
+    place-items: center;
+    padding-right: calc(var(--section-gap) / 2);
+  }
+
+  .logo {
+    margin: 0 2rem 0 0;
+  }
+
+  header .wrapper {
+    display: flex;
+    place-items: flex-start;
+    flex-wrap: wrap;
+  }
+
+  nav {
+    text-align: left;
+    margin-left: -1rem;
+    font-size: 1rem;
+
+    padding: 1rem 0;
+    margin-top: 1rem;
+  }
+}
+</style>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/base.css b/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/base.css
new file mode 100644
index 00000000000..4d16fc24679
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/base.css
@@ -0,0 +1,86 @@
+/* color palette from <https://github.com/vuejs/theme> */
+:root {
+  --vt-c-white: #ffffff;
+  --vt-c-white-soft: #f8f8f8;
+  --vt-c-white-mute: #f2f2f2;
+
+  --vt-c-black: #181818;
+  --vt-c-black-soft: #222222;
+  --vt-c-black-mute: #282828;
+
+  --vt-c-indigo: #2c3e50;
+
+  --vt-c-divider-light-1: rgba(60, 60, 60, 0.29);
+  --vt-c-divider-light-2: rgba(60, 60, 60, 0.12);
+  --vt-c-divider-dark-1: rgba(84, 84, 84, 0.65);
+  --vt-c-divider-dark-2: rgba(84, 84, 84, 0.48);
+
+  --vt-c-text-light-1: var(--vt-c-indigo);
+  --vt-c-text-light-2: rgba(60, 60, 60, 0.66);
+  --vt-c-text-dark-1: var(--vt-c-white);
+  --vt-c-text-dark-2: rgba(235, 235, 235, 0.64);
+}
+
+/* semantic color variables for this project */
+:root {
+  --color-background: var(--vt-c-white);
+  --color-background-soft: var(--vt-c-white-soft);
+  --color-background-mute: var(--vt-c-white-mute);
+
+  --color-border: var(--vt-c-divider-light-2);
+  --color-border-hover: var(--vt-c-divider-light-1);
+
+  --color-heading: var(--vt-c-text-light-1);
+  --color-text: var(--vt-c-text-light-1);
+
+  --section-gap: 160px;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --color-background: var(--vt-c-black);
+    --color-background-soft: var(--vt-c-black-soft);
+    --color-background-mute: var(--vt-c-black-mute);
+
+    --color-border: var(--vt-c-divider-dark-2);
+    --color-border-hover: var(--vt-c-divider-dark-1);
+
+    --color-heading: var(--vt-c-text-dark-1);
+    --color-text: var(--vt-c-text-dark-2);
+  }
+}
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+  margin: 0;
+  font-weight: normal;
+}
+
+body {
+  min-height: 100vh;
+  color: var(--color-text);
+  background: var(--color-background);
+  transition:
+    color 0.5s,
+    background-color 0.5s;
+  line-height: 1.6;
+  font-family:
+    Inter,
+    -apple-system,
+    BlinkMacSystemFont,
+    "Segoe UI",
+    Roboto,
+    Oxygen,
+    Ubuntu,
+    Cantarell,
+    "Fira Sans",
+    "Droid Sans",
+    "Helvetica Neue",
+    sans-serif;
+  font-size: 15px;
+  text-rendering: optimizeLegibility;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/logo.svg b/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/logo.svg
new file mode 100644
index 00000000000..7565660356e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/logo.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 261.76 226.69"><path d="M161.096.001l-30.225 52.351L100.647.001H-.005l130.877 226.688L261.749.001z" fill="#41b883"/><path d="M161.096.001l-30.225 52.351L100.647.001H52.346l78.526 136.01L209.398.001z" fill="#34495e"/></svg>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/main.css b/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/main.css
new file mode 100644
index 00000000000..cdbdca294d5
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/assets/main.css
@@ -0,0 +1,35 @@
+@import "./base.css";
+
+#app {
+  max-width: 1280px;
+  margin: 0 auto;
+  padding: 2rem;
+  font-weight: normal;
+}
+
+a,
+.green {
+  text-decoration: none;
+  color: hsla(160, 100%, 37%, 1);
+  transition: 0.4s;
+  padding: 3px;
+}
+
+@media (hover: hover) {
+  a:hover {
+    background-color: hsla(160, 100%, 37%, 0.2);
+  }
+}
+
+@media (min-width: 1024px) {
+  body {
+    display: flex;
+    place-items: center;
+  }
+
+  #app {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    padding: 0 2rem;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/HelloWorld.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/HelloWorld.vue
new file mode 100644
index 00000000000..fe7b5bc7fea
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/HelloWorld.vue
@@ -0,0 +1,42 @@
+<script setup lang="ts">
+defineProps<{
+  msg: string;
+}>();
+</script>
+
+<template>
+  <div class="greetings">
+    <h1 class="green">{{ msg }}</h1>
+    <h3>
+      You’ve successfully created a project with
+      <a href="https://vite.dev/" target="_blank" rel="noopener">Vite</a> +
+      <a href="https://vuejs.org/" target="_blank" rel="noopener">Vue 3</a>.
+      What's next?
+    </h3>
+  </div>
+</template>
+
+<style scoped>
+h1 {
+  font-weight: 500;
+  font-size: 2.6rem;
+  position: relative;
+  top: -10px;
+}
+
+h3 {
+  font-size: 1.2rem;
+}
+
+.greetings h1,
+.greetings h3 {
+  text-align: center;
+}
+
+@media (min-width: 1024px) {
+  .greetings h1,
+  .greetings h3 {
+    text-align: left;
+  }
+}
+</style>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/TheWelcome.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/TheWelcome.vue
new file mode 100644
index 00000000000..e936a05b80f
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/TheWelcome.vue
@@ -0,0 +1,126 @@
+<script setup lang="ts">
+import WelcomeItem from "./WelcomeItem.vue";
+import DocumentationIcon from "./icons/IconDocumentation.vue";
+import ToolingIcon from "./icons/IconTooling.vue";
+import EcosystemIcon from "./icons/IconEcosystem.vue";
+import CommunityIcon from "./icons/IconCommunity.vue";
+import SupportIcon from "./icons/IconSupport.vue";
+
+const openReadmeInEditor = () => fetch("/__open-in-editor?file=README.md");
+</script>
+
+<template>
+  <WelcomeItem>
+    <template #icon>
+      <DocumentationIcon />
+    </template>
+    <template #heading>Documentation</template>
+
+    Vue’s
+    <a href="https://vuejs.org/" target="_blank" rel="noopener"
+      >official documentation</a
+    >
+    provides you with all information you need to get started.
+  </WelcomeItem>
+
+  <WelcomeItem>
+    <template #icon>
+      <ToolingIcon />
+    </template>
+    <template #heading>Tooling</template>
+
+    This project is served and bundled with
+    <a
+      href="https://vite.dev/guide/features.html"
+      target="_blank"
+      rel="noopener"
+      >Vite</a
+    >. The recommended IDE setup is
+    <a href="https://code.visualstudio.com/" target="_blank" rel="noopener"
+      >VSCode</a
+    >
+    +
+    <a
+      href="https://github.com/vuejs/language-tools"
+      target="_blank"
+      rel="noopener"
+      >Vue - Official</a
+    >. If you need to test your components and web pages, check out
+    <a href="https://vitest.dev/" target="_blank" rel="noopener">Vitest</a>
+    and
+    <a href="https://www.cypress.io/" target="_blank" rel="noopener">Cypress</a>
+    /
+    <a href="https://playwright.dev/" target="_blank" rel="noopener"
+      >Playwright</a
+    >.
+
+    <br />
+
+    More instructions are available in
+    <a href="javascript:void(0)" @click="openReadmeInEditor"
+      ><code>README.md</code></a
+    >.
+  </WelcomeItem>
+
+  <WelcomeItem>
+    <template #icon>
+      <EcosystemIcon />
+    </template>
+    <template #heading>Ecosystem</template>
+
+    Get official tools and libraries for your project:
+    <a href="https://pinia.vuejs.org/" target="_blank" rel="noopener">Pinia</a>,
+    <a href="https://router.vuejs.org/" target="_blank" rel="noopener"
+      >Vue Router</a
+    >,
+    <a href="https://test-utils.vuejs.org/" target="_blank" rel="noopener"
+      >Vue Test Utils</a
+    >, and
+    <a href="https://github.com/vuejs/devtools" target="_blank" rel="noopener"
+      >Vue Dev Tools</a
+    >. If you need more resources, we suggest paying
+    <a
+      href="https://github.com/vuejs/awesome-vue"
+      target="_blank"
+      rel="noopener"
+      >Awesome Vue</a
+    >
+    a visit.
+  </WelcomeItem>
+
+  <WelcomeItem>
+    <template #icon>
+      <CommunityIcon />
+    </template>
+    <template #heading>Community</template>
+
+    Got stuck? Ask your question on
+    <a href="https://chat.vuejs.org" target="_blank" rel="noopener">Vue Land</a>
+    (our official Discord server), or
+    <a
+      href="https://stackoverflow.com/questions/tagged/vue.js"
+      target="_blank"
+      rel="noopener"
+      >StackOverflow</a
+    >. You should also follow the official
+    <a href="https://bsky.app/profile/vuejs.org" target="_blank" rel="noopener"
+      >@vuejs.org</a
+    >
+    Bluesky account or the
+    <a href="https://x.com/vuejs" target="_blank" rel="noopener">@vuejs</a>
+    X account for latest news in the Vue world.
+  </WelcomeItem>
+
+  <WelcomeItem>
+    <template #icon>
+      <SupportIcon />
+    </template>
+    <template #heading>Support Vue</template>
+
+    As an independent project, Vue relies on community backing for its
+    sustainability. You can help us by
+    <a href="https://vuejs.org/sponsor/" target="_blank" rel="noopener"
+      >becoming a sponsor</a
+    >.
+  </WelcomeItem>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/WelcomeItem.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/WelcomeItem.vue
new file mode 100644
index 00000000000..d40a319c0da
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/WelcomeItem.vue
@@ -0,0 +1,87 @@
+<template>
+  <div class="item">
+    <i>
+      <slot name="icon"></slot>
+    </i>
+    <div class="details">
+      <h3>
+        <slot name="heading"></slot>
+      </h3>
+      <slot></slot>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.item {
+  margin-top: 2rem;
+  display: flex;
+  position: relative;
+}
+
+.details {
+  flex: 1;
+  margin-left: 1rem;
+}
+
+i {
+  display: flex;
+  place-items: center;
+  place-content: center;
+  width: 32px;
+  height: 32px;
+
+  color: var(--color-text);
+}
+
+h3 {
+  font-size: 1.2rem;
+  font-weight: 500;
+  margin-bottom: 0.4rem;
+  color: var(--color-heading);
+}
+
+@media (min-width: 1024px) {
+  .item {
+    margin-top: 0;
+    padding: 0.4rem 0 1rem calc(var(--section-gap) / 2);
+  }
+
+  i {
+    top: calc(50% - 25px);
+    left: -26px;
+    position: absolute;
+    border: 1px solid var(--color-border);
+    background: var(--color-background);
+    border-radius: 8px;
+    width: 50px;
+    height: 50px;
+  }
+
+  .item:before {
+    content: " ";
+    border-left: 1px solid var(--color-border);
+    position: absolute;
+    left: 0;
+    bottom: calc(50% + 25px);
+    height: calc(50% - 25px);
+  }
+
+  .item:after {
+    content: " ";
+    border-left: 1px solid var(--color-border);
+    position: absolute;
+    left: 0;
+    top: calc(50% + 25px);
+    height: calc(50% - 25px);
+  }
+
+  .item:first-of-type:before {
+    display: none;
+  }
+
+  .item:last-of-type:after {
+    display: none;
+  }
+}
+</style>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconCommunity.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconCommunity.vue
new file mode 100644
index 00000000000..ea8ddefb973
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconCommunity.vue
@@ -0,0 +1,12 @@
+<template>
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    width="20"
+    height="20"
+    fill="currentColor"
+  >
+    <path
+      d="M15 4a1 1 0 1 0 0 2V4zm0 11v-1a1 1 0 0 0-1 1h1zm0 4l-.707.707A1 1 0 0 0 16 19h-1zm-4-4l.707-.707A1 1 0 0 0 11 14v1zm-4.707-1.293a1 1 0 0 0-1.414 1.414l1.414-1.414zm-.707.707l-.707-.707.707.707zM9 11v-1a1 1 0 0 0-.707.293L9 11zm-4 0h1a1 1 0 0 0-1-1v1zm0 4H4a1 1 0 0 0 1.707.707L5 15zm10-9h2V4h-2v2zm2 0a1 1 0 0 1 1 1h2a3 3 0 0 0-3-3v2zm1 1v6h2V7h-2zm0 6a1 1 0 0 1-1 1v2a3 3 0 0 0 3-3h-2zm-1 1h-2v2h2v-2zm-3 1v4h2v-4h-2zm1.707 3.293l-4-4-1.414 1.414 4 4 1.414-1.414zM11 14H7v2h4v-2zm-4 0c-.276 0-.525-.111-.707-.293l-1.414 1.414C5.42 15.663 6.172 16 7 16v-2zm-.707 1.121l3.414-3.414-1.414-1.414-3.414 3.414 1.414 1.414zM9 12h4v-2H9v2zm4 0a3 3 0 0 0 3-3h-2a1 1 0 0 1-1 1v2zm3-3V3h-2v6h2zm0-6a3 3 0 0 0-3-3v2a1 1 0 0 1 1 1h2zm-3-3H3v2h10V0zM3 0a3 3 0 0 0-3 3h2a1 1 0 0 1 1-1V0zM0 3v6h2V3H0zm0 6a3 3 0 0 0 3 3v-2a1 1 0 0 1-1-1H0zm3 3h2v-2H3v2zm1-1v4h2v-4H4zm1.707 4.707l.586-.586-1.414-1.414-.586.586 1.414 1.414z"
+    />
+  </svg>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconDocumentation.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconDocumentation.vue
new file mode 100644
index 00000000000..63a85340aae
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconDocumentation.vue
@@ -0,0 +1,12 @@
+<template>
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    width="20"
+    height="17"
+    fill="currentColor"
+  >
+    <path
+      d="M11 2.253a1 1 0 1 0-2 0h2zm-2 13a1 1 0 1 0 2 0H9zm.447-12.167a1 1 0 1 0 1.107-1.666L9.447 3.086zM1 2.253L.447 1.42A1 1 0 0 0 0 2.253h1zm0 13H0a1 1 0 0 0 1.553.833L1 15.253zm8.447.833a1 1 0 1 0 1.107-1.666l-1.107 1.666zm0-14.666a1 1 0 1 0 1.107 1.666L9.447 1.42zM19 2.253h1a1 1 0 0 0-.447-.833L19 2.253zm0 13l-.553.833A1 1 0 0 0 20 15.253h-1zm-9.553-.833a1 1 0 1 0 1.107 1.666L9.447 14.42zM9 2.253v13h2v-13H9zm1.553-.833C9.203.523 7.42 0 5.5 0v2c1.572 0 2.961.431 3.947 1.086l1.107-1.666zM5.5 0C3.58 0 1.797.523.447 1.42l1.107 1.666C2.539 2.431 3.928 2 5.5 2V0zM0 2.253v13h2v-13H0zm1.553 13.833C2.539 15.431 3.928 15 5.5 15v-2c-1.92 0-3.703.523-5.053 1.42l1.107 1.666zM5.5 15c1.572 0 2.961.431 3.947 1.086l1.107-1.666C9.203 13.523 7.42 13 5.5 13v2zm5.053-11.914C11.539 2.431 12.928 2 14.5 2V0c-1.92 0-3.703.523-5.053 1.42l1.107 1.666zM14.5 2c1.573 0 2.961.431 3.947 1.086l1.107-1.666C18.203.523 16.421 0 14.5 0v2zm3.5.253v13h2v-13h-2zm1.553 12.167C18.203 13.523 16.421 13 14.5 13v2c1.573 0 2.961.431 3.947 1.086l1.107-1.666zM14.5 13c-1.92 0-3.703.523-5.053 1.42l1.107 1.666C11.539 15.431 12.928 15 14.5 15v-2z"
+    />
+  </svg>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconEcosystem.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconEcosystem.vue
new file mode 100644
index 00000000000..385a2029d7b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconEcosystem.vue
@@ -0,0 +1,12 @@
+<template>
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    width="18"
+    height="20"
+    fill="currentColor"
+  >
+    <path
+      d="M11.447 8.894a1 1 0 1 0-.894-1.789l.894 1.789zm-2.894-.789a1 1 0 1 0 .894 1.789l-.894-1.789zm0 1.789a1 1 0 1 0 .894-1.789l-.894 1.789zM7.447 7.106a1 1 0 1 0-.894 1.789l.894-1.789zM10 9a1 1 0 1 0-2 0h2zm-2 2.5a1 1 0 1 0 2 0H8zm9.447-5.606a1 1 0 1 0-.894-1.789l.894 1.789zm-2.894-.789a1 1 0 1 0 .894 1.789l-.894-1.789zm2 .789a1 1 0 1 0 .894-1.789l-.894 1.789zm-1.106-2.789a1 1 0 1 0-.894 1.789l.894-1.789zM18 5a1 1 0 1 0-2 0h2zm-2 2.5a1 1 0 1 0 2 0h-2zm-5.447-4.606a1 1 0 1 0 .894-1.789l-.894 1.789zM9 1l.447-.894a1 1 0 0 0-.894 0L9 1zm-2.447.106a1 1 0 1 0 .894 1.789l-.894-1.789zm-6 3a1 1 0 1 0 .894 1.789L.553 4.106zm2.894.789a1 1 0 1 0-.894-1.789l.894 1.789zm-2-.789a1 1 0 1 0-.894 1.789l.894-1.789zm1.106 2.789a1 1 0 1 0 .894-1.789l-.894 1.789zM2 5a1 1 0 1 0-2 0h2zM0 7.5a1 1 0 1 0 2 0H0zm8.553 12.394a1 1 0 1 0 .894-1.789l-.894 1.789zm-1.106-2.789a1 1 0 1 0-.894 1.789l.894-1.789zm1.106 1a1 1 0 1 0 .894 1.789l-.894-1.789zm2.894.789a1 1 0 1 0-.894-1.789l.894 1.789zM8 19a1 1 0 1 0 2 0H8zm2-2.5a1 1 0 1 0-2 0h2zm-7.447.394a1 1 0 1 0 .894-1.789l-.894 1.789zM1 15H0a1 1 0 0 0 .553.894L1 15zm1-2.5a1 1 0 1 0-2 0h2zm12.553 2.606a1 1 0 1 0 .894 1.789l-.894-1.789zM17 15l.447.894A1 1 0 0 0 18 15h-1zm1-2.5a1 1 0 1 0-2 0h2zm-7.447-5.394l-2 1 .894 1.789 2-1-.894-1.789zm-1.106 1l-2-1-.894 1.789 2 1 .894-1.789zM8 9v2.5h2V9H8zm8.553-4.894l-2 1 .894 1.789 2-1-.894-1.789zm.894 0l-2-1-.894 1.789 2 1 .894-1.789zM16 5v2.5h2V5h-2zm-4.553-3.894l-2-1-.894 1.789 2 1 .894-1.789zm-2.894-1l-2 1 .894 1.789 2-1L8.553.106zM1.447 5.894l2-1-.894-1.789-2 1 .894 1.789zm-.894 0l2 1 .894-1.789-2-1-.894 1.789zM0 5v2.5h2V5H0zm9.447 13.106l-2-1-.894 1.789 2 1 .894-1.789zm0 1.789l2-1-.894-1.789-2 1 .894 1.789zM10 19v-2.5H8V19h2zm-6.553-3.894l-2-1-.894 1.789 2 1 .894-1.789zM2 15v-2.5H0V15h2zm13.447 1.894l2-1-.894-1.789-2 1 .894 1.789zM18 15v-2.5h-2V15h2z"
+    />
+  </svg>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconSupport.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconSupport.vue
new file mode 100644
index 00000000000..7db961e4d45
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconSupport.vue
@@ -0,0 +1,12 @@
+<template>
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    width="20"
+    height="20"
+    fill="currentColor"
+  >
+    <path
+      d="M10 3.22l-.61-.6a5.5 5.5 0 0 0-7.666.105 5.5 5.5 0 0 0-.114 7.665L10 18.78l8.39-8.4a5.5 5.5 0 0 0-.114-7.665 5.5 5.5 0 0 0-7.666-.105l-.61.61z"
+    />
+  </svg>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconTooling.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconTooling.vue
new file mode 100644
index 00000000000..660598d7c76
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/components/icons/IconTooling.vue
@@ -0,0 +1,19 @@
+<!-- This icon is from <https://github.com/Templarian/MaterialDesign>, distributed under Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0) license-->
+<template>
+  <svg
+    xmlns="http://www.w3.org/2000/svg"
+    xmlns:xlink="http://www.w3.org/1999/xlink"
+    aria-hidden="true"
+    role="img"
+    class="iconify iconify--mdi"
+    width="24"
+    height="24"
+    preserveAspectRatio="xMidYMid meet"
+    viewBox="0 0 24 24"
+  >
+    <path
+      d="M20 18v-4h-3v1h-2v-1H9v1H7v-1H4v4h16M6.33 8l-1.74 4H7v-1h2v1h6v-1h2v1h2.41l-1.74-4H6.33M9 5v1h6V5H9m12.84 7.61c.1.22.16.48.16.8V18c0 .53-.21 1-.6 1.41c-.4.4-.85.59-1.4.59H4c-.55 0-1-.19-1.4-.59C2.21 19 2 18.53 2 18v-4.59c0-.32.06-.58.16-.8L4.5 7.22C4.84 6.41 5.45 6 6.33 6H7V5c0-.55.18-1 .57-1.41C7.96 3.2 8.44 3 9 3h6c.56 0 1.04.2 1.43.59c.39.41.57.86.57 1.41v1h.67c.88 0 1.49.41 1.83 1.22l2.34 5.39z"
+      fill="currentColor"
+    ></path>
+  </svg>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/main.ts b/.repos/alchemy-effect/examples/cloudflare-vue/src/main.ts
new file mode 100644
index 00000000000..7a9c7a853e3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/main.ts
@@ -0,0 +1,11 @@
+import "./assets/main.css";
+
+import { createApp } from "vue";
+import App from "./App.vue";
+import router from "./router";
+
+const app = createApp(App);
+
+app.use(router);
+
+app.mount("#app");
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/router/index.ts b/.repos/alchemy-effect/examples/cloudflare-vue/src/router/index.ts
new file mode 100644
index 00000000000..35612dc5636
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/router/index.ts
@@ -0,0 +1,23 @@
+import { createRouter, createWebHistory } from "vue-router";
+import HomeView from "../views/HomeView.vue";
+
+const router = createRouter({
+  history: createWebHistory(import.meta.env.BASE_URL),
+  routes: [
+    {
+      path: "/",
+      name: "home",
+      component: HomeView,
+    },
+    {
+      path: "/about",
+      name: "about",
+      // route level code-splitting
+      // this generates a separate chunk (About.[hash].js) for this route
+      // which is lazy-loaded when the route is visited.
+      component: () => import("../views/AboutView.vue"),
+    },
+  ],
+});
+
+export default router;
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/views/AboutView.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/views/AboutView.vue
new file mode 100644
index 00000000000..756ad2a1790
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/views/AboutView.vue
@@ -0,0 +1,15 @@
+<template>
+  <div class="about">
+    <h1>This is an about page</h1>
+  </div>
+</template>
+
+<style>
+@media (min-width: 1024px) {
+  .about {
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+  }
+}
+</style>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/src/views/HomeView.vue b/.repos/alchemy-effect/examples/cloudflare-vue/src/views/HomeView.vue
new file mode 100644
index 00000000000..23a53cd1bf3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/src/views/HomeView.vue
@@ -0,0 +1,9 @@
+<script setup lang="ts">
+import TheWelcome from "../components/TheWelcome.vue";
+</script>
+
+<template>
+  <main>
+    <TheWelcome />
+  </main>
+</template>
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.app.json b/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.app.json
new file mode 100644
index 00000000000..c0f2d86707e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.app.json
@@ -0,0 +1,18 @@
+{
+  "extends": "@vue/tsconfig/tsconfig.dom.json",
+  "include": ["env.d.ts", "src/**/*", "src/**/*.vue"],
+  "exclude": ["src/**/__tests__/*"],
+  "compilerOptions": {
+    // Extra safety for array and object lookups, but may have false positives.
+    "noUncheckedIndexedAccess": true,
+
+    // Path mapping for cleaner imports.
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+
+    // `vue-tsc --build` produces a .tsbuildinfo file for incremental type-checking.
+    // Specified here to keep it out of the root directory.
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.json
new file mode 100644
index 00000000000..66b5e5703e8
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.json
@@ -0,0 +1,11 @@
+{
+  "files": [],
+  "references": [
+    {
+      "path": "./tsconfig.node.json"
+    },
+    {
+      "path": "./tsconfig.app.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.node.json b/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.node.json
new file mode 100644
index 00000000000..c9b2badc953
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/tsconfig.node.json
@@ -0,0 +1,27 @@
+// TSConfig for modules that run in Node.js environment via either transpilation or type-stripping.
+{
+  "extends": "@tsconfig/node24/tsconfig.json",
+  "include": [
+    "vite.config.*",
+    "vitest.config.*",
+    "cypress.config.*",
+    "playwright.config.*",
+    "eslint.config.*"
+  ],
+  "compilerOptions": {
+    // Most tools use transpilation instead of Node.js's native type-stripping.
+    // Bundler mode provides a smoother developer experience.
+    "module": "preserve",
+    "moduleResolution": "bundler",
+
+    // Include Node.js types and avoid accidentally including other `@types/*` packages.
+    "types": ["node"],
+
+    // Disable emitting output during `vue-tsc --build`, which is used for type-checking only.
+    "noEmit": true,
+
+    // `vue-tsc --build` produces a .tsbuildinfo file for incremental type-checking.
+    // Specified here to keep it out of the root directory.
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-vue/vite.config.ts b/.repos/alchemy-effect/examples/cloudflare-vue/vite.config.ts
new file mode 100644
index 00000000000..74831822399
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-vue/vite.config.ts
@@ -0,0 +1,15 @@
+import { fileURLToPath, URL } from "node:url";
+
+import { defineConfig } from "vite";
+import vue from "@vitejs/plugin-vue";
+import vueDevTools from "vite-plugin-vue-devtools";
+
+// https://vite.dev/config/
+export default defineConfig({
+  plugins: [vue(), vueDevTools()],
+  resolve: {
+    alias: {
+      "@": fileURLToPath(new URL("./src", import.meta.url)),
+    },
+  },
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-worker-async/alchemy.run.ts
new file mode 100644
index 00000000000..94b0be1ccc8
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/alchemy.run.ts
@@ -0,0 +1,70 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Config } from "effect";
+import * as Effect from "effect/Effect";
+import type { Counter as CounterClass } from "./src/worker.ts";
+
+export const DB = Cloudflare.D1Database("DB");
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+
+// Queue producer + consumer wiring (both sides exercised by the same worker).
+// The Worker sends a message via `env.QUEUE.send(...)` from POST /queue/send,
+// then receives and persists it via its `queue(batch)` handler — end-to-end
+// regression guard for the Queue, QueueBinding, and QueueConsumer resources.
+export const Queue = Cloudflare.Queue("Queue");
+
+export const Counter = Cloudflare.DurableObjectNamespace<CounterClass>(
+  "Counter",
+  {
+    className: "Counter",
+  },
+);
+
+export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  assets: {
+    directory: "./public",
+  },
+  env: {
+    // Self-contained default so the example deploys without external secrets;
+    // the integ test asserts this value round-trips through env.API_KEY.
+    API_KEY: Config.redacted("SOME_API_KEY").pipe(
+      Config.withDefault("SOME_API_KEY"),
+    ),
+    DB,
+    Bucket,
+    Queue,
+    Counter,
+  },
+});
+
+export default Alchemy.Stack(
+  "CloudflareWorker",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const queue = yield* Queue;
+    const worker = yield* Worker;
+    // create a random resource to test redacted storage
+    yield* Alchemy.Random("Random");
+
+    // Register the same worker script as a consumer of Queue. The worker's
+    // `queue(batch)` handler (see src/worker.ts) receives each message batch.
+    yield* Cloudflare.QueueConsumer("QueueConsumer", {
+      queueId: queue.queueId,
+      scriptName: worker.workerName,
+      settings: {
+        batchSize: 10,
+        maxRetries: 3,
+        maxWaitTimeMs: 5000,
+      },
+    });
+
+    return worker.url;
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/package.json b/.repos/alchemy-effect/examples/cloudflare-worker-async/package.json
new file mode 100644
index 00000000000..545fbc02980
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/package.json
@@ -0,0 +1,29 @@
+{
+  "name": "cloudflare-worker-async",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-worker-async"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@alchemy.run/better-auth": "workspace:*",
+    "@cloudflare/workers-types": "catalog:",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "better-auth": "catalog:",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/public/file.json b/.repos/alchemy-effect/examples/cloudflare-worker-async/public/file.json
new file mode 100644
index 00000000000..77f77415ac0
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/public/file.json
@@ -0,0 +1,3 @@
+{
+  "message": "Hello, World!"
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/src/rpc-worker.ts b/.repos/alchemy-effect/examples/cloudflare-worker-async/src/rpc-worker.ts
new file mode 100644
index 00000000000..77da1bb4f0c
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/src/rpc-worker.ts
@@ -0,0 +1,67 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as Rpc from "effect/unstable/rpc/Rpc";
+import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+import * as RpcSchema from "effect/unstable/rpc/RpcSchema";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+
+export const API = RpcGroup.make(
+  Rpc.make("Ping", {
+    payload: Schema.Void,
+    success: Schema.String,
+  }),
+  Rpc.make("Stream", {
+    payload: { upto: Schema.Number },
+    success: RpcSchema.Stream(Schema.Number, Schema.Never),
+  }),
+);
+
+const httpEffect = RpcServer.toHttpEffect(API).pipe(
+  Effect.provide(
+    Layer.mergeAll(
+      API.toLayer({
+        Ping: () => Effect.succeed("pong"),
+        Stream: ({ upto }) =>
+          Stream.fromIterable(Array.from({ length: upto }, (_, i) => i)),
+      }),
+      RpcSerialization.layerNdjson,
+    ),
+  ),
+);
+
+export default {
+  fetch(request: Request) {
+    return httpEffect.pipe(
+      Effect.flatMap((eff) => eff),
+      Effect.provide([
+        Layer.succeed(
+          HttpServerRequest.HttpServerRequest,
+          HttpServerRequest.fromWeb(request as any).modify({
+            remoteAddress: Option.fromUndefinedOr(
+              request.headers.get("cf-connecting-ip") ?? undefined,
+            ),
+          }),
+        ),
+        FetchHttpClient.layer,
+      ]),
+      Effect.flatMap((response) =>
+        Effect.context().pipe(
+          Effect.map((context) =>
+            HttpServerResponse.toWeb(response as any, {
+              context,
+            }),
+          ),
+        ),
+      ),
+      Effect.scoped,
+      Effect.runPromise,
+    );
+  },
+};
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/src/worker.ts b/.repos/alchemy-effect/examples/cloudflare-worker-async/src/worker.ts
new file mode 100644
index 00000000000..2b807841706
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/src/worker.ts
@@ -0,0 +1,88 @@
+import { DurableObject } from "cloudflare:workers";
+import type { WorkerEnv } from "../alchemy.run.ts";
+
+/**
+ * Type of messages we send on the queue — kept minimal so the example stays
+ * self-contained. Both producer (`env.Queue.send(...)`) and consumer (the
+ * `queue()` handler below) use this shape.
+ */
+interface QueueMessage {
+  id: string;
+  text: string;
+  sentAt: number;
+}
+
+export default {
+  async fetch(request: Request, env: WorkerEnv) {
+    const url = new URL(request.url);
+    const path = url.pathname;
+
+    // Echo back env.API_KEY so the integ test can verify the env round-trip.
+    if (request.method === "GET" && path === "/api-key") {
+      return new Response(env.API_KEY, {
+        headers: { "content-type": "text/plain" },
+      });
+    }
+
+    // Queue producer — POST /queue/send?text=...
+    //
+    // Exercises Cloudflare.QueueBinding by calling `env.Queue.send(...)`.
+    // The message is persisted by the consumer handler into R2 at /queue/<id>
+    // so the integ test can read it back and assert the full round-trip.
+    if (request.method === "POST" && path === "/queue/send") {
+      const text = url.searchParams.get("text") ?? "hello queue";
+      const msg: QueueMessage = {
+        id: crypto.randomUUID(),
+        text,
+        sentAt: Date.now(),
+      };
+      await env.Queue.send(msg);
+      return new Response(JSON.stringify({ sent: msg }), {
+        status: 202,
+        headers: { "content-type": "application/json" },
+      });
+    }
+
+    if (request.method === "GET") {
+      return new Response((await env.Bucket.get(path))?.body ?? null);
+    } else if (request.method === "PUT") {
+      const object = (await env.Bucket.put(path, request.body))!;
+      return new Response(
+        JSON.stringify({
+          key: object.key,
+          size: object.size,
+        }),
+        { status: 201 },
+      );
+    } else if (request.method === "POST") {
+      const counter = env.Counter.getByName("counter");
+      return new Response(JSON.stringify({ count: await counter.increment() }));
+    }
+    return env.ASSETS.fetch(request);
+  },
+
+  /**
+   * Queue consumer handler — invoked by Cloudflare when messages accumulate
+   * on the Queue registered as a QueueConsumer for this worker.
+   *
+   * Persists each message body into R2 under `/queue/<id>` so the integ test
+   * (or a manual `GET /queue/<id>`) can verify the round-trip succeeded.
+   * `msg.ack()` marks the message as consumed so it isn't redelivered.
+   */
+  async queue(batch: MessageBatch<QueueMessage>, env: WorkerEnv) {
+    for (const msg of batch.messages) {
+      await env.Bucket.put(`/queue/${msg.body.id}`, JSON.stringify(msg.body), {
+        httpMetadata: { contentType: "application/json" },
+      });
+      msg.ack();
+    }
+  },
+};
+
+export class Counter extends DurableObject {
+  private counter = 0;
+
+  async increment() {
+    return ++this.counter;
+  }
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-worker-async/test/integ.test.ts
new file mode 100644
index 00000000000..19928155f22
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/test/integ.test.ts
@@ -0,0 +1,86 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deploys and exposes a url",
+  Effect.gen(function* () {
+    const out = (yield* stack) as unknown;
+    const url = typeof out === "string" ? out : (out as { url: string }).url;
+    expect(url).toBeString();
+  }),
+);
+
+test(
+  "echoes env.API_KEY",
+  Effect.gen(function* () {
+    const out = (yield* stack) as unknown;
+    const url = typeof out === "string" ? out : (out as { url: string }).url;
+
+    const response = yield* HttpClient.get(`${url}/api-key`);
+    expect(response.status).toBe(200);
+    const body = yield* response.text;
+    expect(body).toBe("SOME_API_KEY");
+  }),
+);
+
+/**
+ * Native (async) queue handler round-trip. The async worker exports
+ * a plain `queue(batch, env)` handler that writes each message body
+ * to R2 at `/queue/<id>`. POST /queue/send enqueues a message;
+ * GET /<path> reads from R2, so we read /queue/<id> back.
+ *
+ * Pairs with the cloudflare-worker example, which exercises the
+ * Effect-style `Cloudflare.messages(Queue).subscribe(...)` path
+ * against the same producer/consumer round-trip.
+ */
+test(
+  "native queue() handler round-trip",
+  Effect.gen(function* () {
+    const out = (yield* stack) as unknown;
+    const url = typeof out === "string" ? out : (out as { url: string }).url;
+    const text = `hello-${Date.now()}`;
+
+    const sendResponse = yield* HttpClient.execute(
+      HttpClientRequest.post(
+        `${url}/queue/send?text=${encodeURIComponent(text)}`,
+      ),
+    );
+    expect(sendResponse.status).toBe(202);
+    const { sent } = (yield* sendResponse.json) as {
+      sent: { id: string; text: string; sentAt: number };
+    };
+    expect(sent.id).toBeTypeOf("string");
+
+    const deadline = Date.now() + 60_000;
+    let consumed: { id: string; text: string; sentAt: number } | undefined;
+    while (Date.now() < deadline) {
+      const resultResponse = yield* HttpClient.get(`${url}/queue/${sent.id}`);
+      if (resultResponse.status === 200) {
+        const body = yield* resultResponse.text;
+        if (body) {
+          consumed = JSON.parse(body);
+          break;
+        }
+      }
+      yield* Effect.sleep("2 seconds");
+    }
+
+    expect(consumed).toBeDefined();
+    expect(consumed!.id).toBe(sent.id);
+    expect(consumed!.text).toBe(text);
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker-async/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-worker-async/tsconfig.json
new file mode 100644
index 00000000000..d69b08a7992
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker-async/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "test/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "types": ["bun", "@cloudflare/workers-types"]
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    },
+    {
+      "path": "../../packages/better-auth/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/alchemy.run.ts b/.repos/alchemy-effect/examples/cloudflare-worker/alchemy.run.ts
new file mode 100644
index 00000000000..de2eb8bcecd
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/alchemy.run.ts
@@ -0,0 +1,56 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+import { Gateway } from "./src/AiGateway.ts";
+import Api from "./src/Api.ts";
+import { Bucket } from "./src/Bucket.ts";
+import SecondaryApiLive, { SecondaryApi } from "./src/SecondaryApi.ts";
+import WorkerTagLive, { WorkerTag } from "./src/WorkerTag.ts";
+
+// Demo Action — runs at deploy time when its input (the resolved deployed
+// URL) changes. Logs the new URL and returns a tiny manifest used as the
+// stack output. Re-deploys with no changes skip the body.
+const AnnounceDeploy = Alchemy.Action(
+  "AnnounceDeploy",
+  (input: { url: string; bucket: string }) =>
+    Effect.gen(function* () {
+      yield* Effect.log(`Deployed ${input.url} (bucket: ${input.bucket})`);
+      return { deployedAt: new Date().toISOString(), url: input.url };
+    }),
+);
+
+export default Alchemy.Stack(
+  "CloudflareWorkerExample",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const api = yield* Api;
+    const bucket = yield* Bucket;
+    const gateway = yield* Gateway;
+    const workerTag = yield* WorkerTag;
+    // Two Workers binding the same Agent DO triggers the regression where
+    // a single Container DO namespace appears in multiple bindings on the
+    // Sandbox ContainerApplication. See SecondaryApi.ts for details.
+    const secondaryApi = yield* SecondaryApi;
+    // The Queue consumer is wired automatically by
+    // `Cloudflare.messages(Queue).subscribe(...)` inside src/Api.ts —
+    // no explicit `Cloudflare.QueueConsumer(...)` is needed here.
+
+    const announcement = yield* AnnounceDeploy({
+      url: api.url.as<string>(),
+      bucket: bucket.bucketName,
+    });
+
+    return {
+      url: api.url.as<string>(),
+      bucket: bucket.bucketName,
+      gatewayId: gateway.gatewayId,
+      workerTagUrl: workerTag.url.as<string>(),
+      secondaryApiUrl: secondaryApi.url.as<string>(),
+      deployedAt: announcement.deployedAt,
+    };
+  }).pipe(Effect.provide(WorkerTagLive), Effect.provide(SecondaryApiLive)),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/assets/index.html b/.repos/alchemy-effect/examples/cloudflare-worker/assets/index.html
new file mode 100644
index 00000000000..657c6f85362
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/assets/index.html
@@ -0,0 +1,1023 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Room Chat</title>
+    <style>
+      *,
+      *::before,
+      *::after {
+        box-sizing: border-box;
+        margin: 0;
+        padding: 0;
+      }
+      body {
+        font-family:
+          system-ui,
+          -apple-system,
+          sans-serif;
+        background: #0f172a;
+        color: #e2e8f0;
+        height: 100vh;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
+        padding: 1rem;
+      }
+      .container {
+        width: 100%;
+        max-width: 560px;
+        display: flex;
+        flex-direction: column;
+        gap: 0.75rem;
+        height: 90vh;
+      }
+      h1 {
+        font-size: 1.25rem;
+        font-weight: 600;
+        color: #94a3b8;
+      }
+      #status {
+        font-size: 0.8rem;
+        padding: 0.35rem 0.75rem;
+        border-radius: 999px;
+        display: inline-block;
+        align-self: flex-start;
+      }
+      #status.connected {
+        background: #065f46;
+        color: #6ee7b7;
+      }
+      #status.disconnected {
+        background: #7f1d1d;
+        color: #fca5a5;
+      }
+      #status.connecting {
+        background: #78350f;
+        color: #fcd34d;
+      }
+      #messages {
+        flex: 1;
+        overflow-y: auto;
+        background: #1e293b;
+        border-radius: 0.5rem;
+        padding: 0.75rem;
+        display: flex;
+        flex-direction: column;
+        gap: 0.35rem;
+        font-size: 0.9rem;
+        font-family: "SF Mono", "Fira Code", monospace;
+      }
+      .msg {
+        padding: 0.25rem 0;
+        border-bottom: 1px solid #334155;
+        word-break: break-word;
+      }
+      .msg.system {
+        color: #64748b;
+        font-style: italic;
+      }
+      #form {
+        display: flex;
+        gap: 0.5rem;
+      }
+      #input {
+        flex: 1;
+        padding: 0.6rem 0.75rem;
+        border-radius: 0.375rem;
+        border: 1px solid #334155;
+        background: #1e293b;
+        color: #e2e8f0;
+        font-size: 0.9rem;
+        outline: none;
+      }
+      #input:focus {
+        border-color: #3b82f6;
+      }
+      button {
+        padding: 0.6rem 1.25rem;
+        border-radius: 0.375rem;
+        border: none;
+        background: #3b82f6;
+        color: #fff;
+        font-weight: 600;
+        cursor: pointer;
+        font-size: 0.9rem;
+      }
+      button:hover {
+        background: #2563eb;
+      }
+      button:disabled {
+        opacity: 0.4;
+        cursor: not-allowed;
+      }
+      .header {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+      }
+      .header-right {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+      }
+      #avatar-btn {
+        width: 2.25rem;
+        height: 2.25rem;
+        border-radius: 50%;
+        background: #334155;
+        border: 2px solid #475569;
+        color: #94a3b8;
+        font-size: 1rem;
+        cursor: pointer;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 0;
+        transition:
+          border-color 0.15s,
+          background 0.15s;
+        position: relative;
+      }
+      #avatar-btn:hover {
+        border-color: #3b82f6;
+        background: #1e293b;
+      }
+      #avatar-btn.active {
+        border-color: #3b82f6;
+        background: #1e293b;
+      }
+      #avatar-btn svg {
+        width: 1.1rem;
+        height: 1.1rem;
+        fill: currentColor;
+      }
+      #toggle {
+        background: #dc2626;
+        font-size: 0.8rem;
+        padding: 0.35rem 0.75rem;
+      }
+      #toggle:hover {
+        background: #b91c1c;
+      }
+      #toggle.off {
+        background: #16a34a;
+      }
+      #toggle.off:hover {
+        background: #15803d;
+      }
+      #actions {
+        display: flex;
+        gap: 0.5rem;
+      }
+      #increment {
+        background: #7c3aed;
+      }
+      #increment:hover {
+        background: #6d28d9;
+      }
+      #increment:disabled {
+        opacity: 0.4;
+        cursor: not-allowed;
+      }
+      #workflow-run {
+        background: #0ea5e9;
+      }
+      #workflow-run:hover {
+        background: #0284c7;
+      }
+      #workflow-run:disabled {
+        opacity: 0.4;
+        cursor: not-allowed;
+      }
+      #workflow-panel {
+        display: flex;
+        flex-direction: column;
+        gap: 0.5rem;
+        padding: 0.75rem;
+        background: #1e293b;
+        border-radius: 0.5rem;
+        border: 1px solid #334155;
+      }
+      #workflow-panel h2 {
+        font-size: 0.75rem;
+        font-weight: 600;
+        color: #94a3b8;
+        text-transform: uppercase;
+        letter-spacing: 0.04em;
+      }
+      #workflow-status {
+        font-size: 0.75rem;
+        font-family: "SF Mono", "Fira Code", monospace;
+        color: #cbd5e1;
+        white-space: pre-wrap;
+        word-break: break-word;
+        min-height: 2.5rem;
+        line-height: 1.4;
+      }
+      #artifacts-panel {
+        display: flex;
+        flex-direction: column;
+        gap: 0.5rem;
+        padding: 0.75rem;
+        background: #1e293b;
+        border-radius: 0.5rem;
+        border: 1px solid #334155;
+      }
+      #artifacts-panel h2 {
+        font-size: 0.75rem;
+        font-weight: 600;
+        color: #94a3b8;
+        text-transform: uppercase;
+        letter-spacing: 0.04em;
+      }
+      #artifacts-status {
+        font-size: 0.75rem;
+        font-family: "SF Mono", "Fira Code", monospace;
+        color: #cbd5e1;
+        white-space: pre-wrap;
+        word-break: break-word;
+        min-height: 2.5rem;
+        line-height: 1.4;
+      }
+      #ai-panel {
+        display: flex;
+        flex-direction: column;
+        gap: 0.5rem;
+        padding: 0.75rem;
+        background: #1e293b;
+        border-radius: 0.5rem;
+        border: 1px solid #334155;
+      }
+      #ai-panel h2 {
+        font-size: 0.75rem;
+        font-weight: 600;
+        color: #94a3b8;
+        text-transform: uppercase;
+        letter-spacing: 0.04em;
+      }
+      #ai-status {
+        font-size: 0.75rem;
+        font-family: "SF Mono", "Fira Code", monospace;
+        color: #cbd5e1;
+        white-space: pre-wrap;
+        word-break: break-word;
+        min-height: 2.5rem;
+        line-height: 1.4;
+      }
+      #auth-panel {
+        display: none;
+        flex-direction: column;
+        gap: 0.75rem;
+        padding: 0.75rem;
+        background: #1e293b;
+        border-radius: 0.5rem;
+        border: 1px solid #334155;
+      }
+      #auth-panel.visible {
+        display: flex;
+      }
+      #auth-panel h2 {
+        font-size: 0.75rem;
+        font-weight: 600;
+        color: #94a3b8;
+        text-transform: uppercase;
+        letter-spacing: 0.04em;
+      }
+      #auth-fields {
+        display: grid;
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+        gap: 0.5rem;
+      }
+      #auth-fields input {
+        width: 100%;
+        padding: 0.6rem 0.75rem;
+        border-radius: 0.375rem;
+        border: 1px solid #334155;
+        background: #0f172a;
+        color: #e2e8f0;
+        font-size: 0.9rem;
+        outline: none;
+      }
+      #auth-fields input:focus {
+        border-color: #3b82f6;
+      }
+      #auth-email {
+        grid-column: 1 / -1;
+      }
+      #auth-name {
+        grid-column: 1 / -1;
+      }
+      #auth-actions {
+        display: flex;
+        gap: 0.5rem;
+      }
+      #auth-signup {
+        background: #2563eb;
+      }
+      #auth-signin {
+        background: #059669;
+      }
+      #auth-signin:hover {
+        background: #047857;
+      }
+      #auth-status {
+        font-size: 0.75rem;
+        font-family: "SF Mono", "Fira Code", monospace;
+        color: #cbd5e1;
+        white-space: pre-wrap;
+        word-break: break-word;
+        min-height: 2.5rem;
+        line-height: 1.4;
+      }
+      @media (max-width: 640px) {
+        #auth-fields {
+          grid-template-columns: 1fr;
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <div class="container">
+      <div class="header">
+        <h1>Room Chat</h1>
+        <div class="header-right">
+          <button
+            id="clear-chat"
+            title="Clear chat"
+            style="
+              background: #475569;
+              font-size: 0.8rem;
+              padding: 0.35rem 0.75rem;
+            "
+          >
+            Clear
+          </button>
+          <button id="toggle">Disconnect</button>
+          <button id="avatar-btn" title="Account">
+            <svg viewBox="0 0 24 24">
+              <path
+                d="M12 12c2.7 0 4.8-2.1 4.8-4.8S14.7 2.4 12 2.4 7.2 4.5 7.2 7.2 9.3 12 12 12zm0 2.4c-3.2 0-9.6 1.6-9.6 4.8v2.4h19.2v-2.4c0-3.2-6.4-4.8-9.6-4.8z"
+              />
+            </svg>
+          </button>
+        </div>
+      </div>
+      <span id="status" class="disconnected">disconnected</span>
+      <div id="auth-panel">
+        <h2>Auth</h2>
+        <div id="auth-fields">
+          <input
+            id="auth-email"
+            type="email"
+            placeholder="Email"
+            autocomplete="email"
+          />
+          <input
+            id="auth-password"
+            type="password"
+            placeholder="Password"
+            autocomplete="current-password"
+          />
+          <input
+            id="auth-name"
+            type="text"
+            placeholder="Display name"
+            autocomplete="name"
+          />
+        </div>
+        <div id="auth-actions">
+          <button id="auth-signup" type="button">Sign Up</button>
+          <button id="auth-signin" type="button">Sign In</button>
+        </div>
+        <div id="auth-status">Idle.</div>
+      </div>
+      <div id="messages"></div>
+      <div id="actions">
+        <button id="increment">Increment Counter</button>
+      </div>
+      <div id="reminder-panel">
+        <h2>Scheduled Reminders</h2>
+        <div style="display: flex; gap: 0.5rem">
+          <input
+            id="reminder-delay"
+            type="number"
+            min="1"
+            value="5"
+            style="
+              width: 4rem;
+              padding: 0.6rem 0.75rem;
+              border-radius: 0.375rem;
+              border: 1px solid #334155;
+              background: #0f172a;
+              color: #e2e8f0;
+              font-size: 0.9rem;
+              outline: none;
+            "
+          />
+          <span style="align-self: center; color: #94a3b8; font-size: 0.8rem"
+            >seconds</span
+          >
+          <input
+            id="reminder-msg"
+            type="text"
+            placeholder="Reminder message…"
+            style="
+              flex: 1;
+              padding: 0.6rem 0.75rem;
+              border-radius: 0.375rem;
+              border: 1px solid #334155;
+              background: #0f172a;
+              color: #e2e8f0;
+              font-size: 0.9rem;
+              outline: none;
+            "
+          />
+          <button
+            id="reminder-send"
+            type="button"
+            style="background: #f59e0b; padding: 0.6rem 1rem"
+          >
+            Schedule
+          </button>
+        </div>
+        <div
+          id="reminder-status"
+          style="
+            font-size: 0.75rem;
+            font-family: &quot;SF Mono&quot;, &quot;Fira Code&quot;, monospace;
+            color: #cbd5e1;
+            min-height: 1.2rem;
+            line-height: 1.4;
+          "
+        >
+          Type /remind &lt;seconds&gt; &lt;message&gt; in chat, or use the form
+          above.
+        </div>
+      </div>
+      <div id="artifacts-panel">
+        <h2>Artifacts (Git for Agents)</h2>
+        <div style="display: flex; gap: 0.5rem; flex-wrap: wrap">
+          <input
+            id="artifacts-name"
+            type="text"
+            placeholder="repo name (e.g. starter-1234)"
+            style="
+              flex: 1;
+              min-width: 12rem;
+              padding: 0.6rem 0.75rem;
+              border-radius: 0.375rem;
+              border: 1px solid #334155;
+              background: #0f172a;
+              color: #e2e8f0;
+              font-size: 0.9rem;
+              outline: none;
+            "
+          />
+          <button
+            id="artifacts-create"
+            type="button"
+            style="background: #10b981"
+          >
+            Create
+          </button>
+          <button id="artifacts-info" type="button" style="background: #6366f1">
+            Info
+          </button>
+          <button
+            id="artifacts-token"
+            type="button"
+            style="background: #eab308; color: #1f2937"
+          >
+            New token
+          </button>
+          <button id="artifacts-list" type="button" style="background: #475569">
+            List
+          </button>
+        </div>
+        <div id="artifacts-status">
+          Create a repo, then mint scoped tokens for git clone/push.
+        </div>
+      </div>
+      <div id="ai-panel">
+        <h2>AI Gateway</h2>
+        <div style="display: flex; gap: 0.5rem; flex-wrap: wrap">
+          <input
+            id="ai-prompt"
+            type="text"
+            placeholder="Ask the model anything…"
+            style="
+              flex: 1;
+              min-width: 12rem;
+              padding: 0.6rem 0.75rem;
+              border-radius: 0.375rem;
+              border: 1px solid #334155;
+              background: #0f172a;
+              color: #e2e8f0;
+              font-size: 0.9rem;
+              outline: none;
+            "
+          />
+          <button id="ai-send" type="button" style="background: #f43f5e">
+            Ask
+          </button>
+        </div>
+        <div id="ai-status">
+          Routes Workers AI calls through Cloudflare AI Gateway for caching,
+          rate limiting and observability.
+        </div>
+      </div>
+      <div id="workflow-panel">
+        <h2>NotifyWorkflow</h2>
+        <button id="workflow-run" type="button">
+          Run workflow (broadcasts to this room)
+        </button>
+        <div id="workflow-status">
+          Idle — messages will appear in the chat above.
+        </div>
+      </div>
+      <form id="form">
+        <input
+          id="input"
+          type="text"
+          placeholder="Type a message…"
+          autocomplete="off"
+        />
+        <button type="submit">Send</button>
+      </form>
+    </div>
+
+    <script>
+      const proto = location.protocol === "https:" ? "wss:" : "ws:";
+      const BASE = `${proto}//${location.host}`;
+      const roomId =
+        new URLSearchParams(location.search).get("room") || "default";
+
+      const statusEl = document.getElementById("status");
+      const messagesEl = document.getElementById("messages");
+      const form = document.getElementById("form");
+      const input = document.getElementById("input");
+      const authEmailEl = document.getElementById("auth-email");
+      const authPasswordEl = document.getElementById("auth-password");
+      const authNameEl = document.getElementById("auth-name");
+      const authSignUpBtn = document.getElementById("auth-signup");
+      const authSignInBtn = document.getElementById("auth-signin");
+      const authStatusEl = document.getElementById("auth-status");
+
+      function setStatus(s) {
+        statusEl.textContent = s;
+        statusEl.className = s;
+      }
+
+      function addMessage(text, system = false) {
+        const div = document.createElement("div");
+        div.className = "msg" + (system ? " system" : "");
+        div.textContent = text;
+        messagesEl.appendChild(div);
+        messagesEl.scrollTop = messagesEl.scrollHeight;
+      }
+
+      function setAuthStatus(text) {
+        authStatusEl.textContent = text;
+      }
+
+      async function readResponseBody(response) {
+        const text = await response.text();
+        try {
+          return JSON.stringify(JSON.parse(text), null, 2);
+        } catch {
+          return text || "(empty)";
+        }
+      }
+
+      function getAuthPayload() {
+        return {
+          email: authEmailEl.value.trim(),
+          password: authPasswordEl.value,
+          name: authNameEl.value.trim() || "Room Chat User",
+        };
+      }
+
+      async function submitAuth(path, body, buttonLabel) {
+        authSignUpBtn.disabled = true;
+        authSignInBtn.disabled = true;
+        setAuthStatus(`${buttonLabel}…`);
+        try {
+          const response = await fetch(path, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+            },
+            credentials: "include",
+            body: JSON.stringify(body),
+          });
+          const payload = await readResponseBody(response);
+          setAuthStatus(`status: ${response.status}\n${payload}`);
+          addMessage(`${buttonLabel} -> HTTP ${response.status}`, true);
+        } catch (error) {
+          const message =
+            error instanceof Error ? error.message : String(error);
+          setAuthStatus(`request failed: ${message}`);
+          addMessage(`${buttonLabel} failed: ${message}`, true);
+        } finally {
+          authSignUpBtn.disabled = false;
+          authSignInBtn.disabled = false;
+        }
+      }
+
+      authSignUpBtn.addEventListener("click", async () => {
+        const { email, password, name } = getAuthPayload();
+        if (!email || !password) {
+          setAuthStatus("Email and password are required.");
+          return;
+        }
+        await submitAuth(
+          "/auth/sign-up/email",
+          { email, password, name },
+          "Sign Up",
+        );
+      });
+
+      authSignInBtn.addEventListener("click", async () => {
+        const { email, password } = getAuthPayload();
+        if (!email || !password) {
+          setAuthStatus("Email and password are required.");
+          return;
+        }
+        await submitAuth("/auth/sign-in/email", { email, password }, "Sign In");
+      });
+
+      document.getElementById("clear-chat").addEventListener("click", () => {
+        messagesEl.innerHTML = "";
+      });
+
+      const avatarBtn = document.getElementById("avatar-btn");
+      const authPanel = document.getElementById("auth-panel");
+      avatarBtn.addEventListener("click", () => {
+        authPanel.classList.toggle("visible");
+        avatarBtn.classList.toggle("active");
+      });
+
+      const toggleBtn = document.getElementById("toggle");
+      let ws;
+      let autoReconnect = true;
+      let reconnectTimer;
+
+      function connect() {
+        setStatus("connecting");
+        addMessage(`Connecting to room "${roomId}"…`, true);
+
+        ws = new WebSocket(`${BASE}/room/${roomId}`);
+
+        ws.addEventListener("open", () => {
+          setStatus("connected");
+          addMessage("Connected.", true);
+        });
+
+        ws.addEventListener("message", (e) => {
+          addMessage(e.data);
+        });
+
+        ws.addEventListener("close", (e) => {
+          setStatus("disconnected");
+          addMessage(`Disconnected (code ${e.code}).`, true);
+          if (autoReconnect) {
+            reconnectTimer = setTimeout(connect, 2000);
+          }
+        });
+
+        ws.addEventListener("error", () => {
+          setStatus("disconnected");
+          addMessage("WebSocket error.", true);
+        });
+      }
+
+      toggleBtn.addEventListener("click", () => {
+        if (autoReconnect) {
+          autoReconnect = false;
+          toggleBtn.textContent = "Connect";
+          toggleBtn.className = "off";
+          clearTimeout(reconnectTimer);
+          if (ws && ws.readyState === WebSocket.OPEN) {
+            ws.close();
+          }
+        } else {
+          autoReconnect = true;
+          toggleBtn.textContent = "Disconnect";
+          toggleBtn.className = "";
+          if (!ws || ws.readyState !== WebSocket.OPEN) {
+            connect();
+          }
+        }
+      });
+
+      const incrementBtn = document.getElementById("increment");
+      incrementBtn.addEventListener("click", async () => {
+        incrementBtn.disabled = true;
+        incrementBtn.textContent = "Incrementing…";
+        try {
+          const resp = await fetch("/sandbox/increment", { method: "POST" });
+          const data = await resp.json();
+          addMessage(`Counter incremented to ${data.counter}`, true);
+        } catch (err) {
+          addMessage(`Increment failed: ${err.message}`, true);
+        } finally {
+          incrementBtn.disabled = false;
+          incrementBtn.textContent = "Increment Counter";
+        }
+      });
+
+      const workflowRunBtn = document.getElementById("workflow-run");
+      const workflowStatusEl = document.getElementById("workflow-status");
+
+      function isWorkflowTerminal(status) {
+        if (!status || typeof status.status !== "string") return false;
+        const s = status.status.toLowerCase();
+        return (
+          s === "complete" ||
+          s === "completed" ||
+          s === "errored" ||
+          s === "failed" ||
+          s === "terminated" ||
+          s === "canceled" ||
+          s === "cancelled" ||
+          (status.error != null && status.error !== undefined)
+        );
+      }
+
+      function formatWorkflowStatus(status) {
+        const lines = [
+          `status: ${status.status ?? "(none)"}`,
+          status.output !== undefined
+            ? `output: ${JSON.stringify(status.output)}`
+            : null,
+          status.error ? `error: ${JSON.stringify(status.error)}` : null,
+        ].filter(Boolean);
+        return lines.join("\n");
+      }
+
+      let workflowPollTimer = null;
+
+      workflowRunBtn.addEventListener("click", async () => {
+        if (workflowPollTimer) {
+          clearTimeout(workflowPollTimer);
+          workflowPollTimer = null;
+        }
+        workflowRunBtn.disabled = true;
+        workflowStatusEl.textContent = "Starting workflow…";
+        addMessage(
+          `Starting NotifyWorkflow for room "${roomId}" (watch for [workflow] lines)…`,
+          true,
+        );
+        try {
+          const startResp = await fetch(
+            `/workflow/start/${encodeURIComponent(roomId)}`,
+            { method: "POST" },
+          );
+          if (!startResp.ok) {
+            const errText = await startResp.text();
+            throw new Error(errText || `HTTP ${startResp.status}`);
+          }
+          const { instanceId } = await startResp.json();
+          if (!instanceId) {
+            throw new Error("No instanceId in response");
+          }
+          workflowStatusEl.textContent = `instance: ${instanceId}\npolling…`;
+
+          let pollCount = 0;
+          const maxPolls = 120;
+
+          const poll = async () => {
+            try {
+              pollCount += 1;
+              if (pollCount > maxPolls) {
+                workflowStatusEl.textContent = `instance: ${instanceId}\n(stopped polling after ${maxPolls} attempts — check logs)`;
+                workflowRunBtn.disabled = false;
+                addMessage("Workflow status polling timed out.", true);
+                return;
+              }
+              const stResp = await fetch(
+                `/workflow/status/${encodeURIComponent(instanceId)}`,
+              );
+              if (!stResp.ok) {
+                workflowStatusEl.textContent = `status fetch failed: HTTP ${stResp.status}`;
+                workflowRunBtn.disabled = false;
+                return;
+              }
+              const st = await stResp.json();
+              workflowStatusEl.textContent =
+                `instance: ${instanceId}\n` + formatWorkflowStatus(st);
+              if (isWorkflowTerminal(st)) {
+                workflowRunBtn.disabled = false;
+                addMessage(
+                  `Workflow finished: ${st.status}` +
+                    (st.output !== undefined
+                      ? ` — ${JSON.stringify(st.output)}`
+                      : ""),
+                  true,
+                );
+                return;
+              }
+              workflowPollTimer = setTimeout(poll, 600);
+            } catch (e) {
+              workflowStatusEl.textContent = `poll error: ${e.message}`;
+              workflowRunBtn.disabled = false;
+            }
+          };
+          await poll();
+        } catch (err) {
+          workflowStatusEl.textContent = `Error: ${err.message}`;
+          addMessage(`Workflow start failed: ${err.message}`, true);
+          workflowRunBtn.disabled = false;
+        }
+      });
+
+      const artifactsNameEl = document.getElementById("artifacts-name");
+      const artifactsStatusEl = document.getElementById("artifacts-status");
+      const artifactsCreateBtn = document.getElementById("artifacts-create");
+      const artifactsInfoBtn = document.getElementById("artifacts-info");
+      const artifactsTokenBtn = document.getElementById("artifacts-token");
+      const artifactsListBtn = document.getElementById("artifacts-list");
+
+      function setArtifactsStatus(label, payload) {
+        const body =
+          typeof payload === "string"
+            ? payload
+            : JSON.stringify(payload, null, 2);
+        artifactsStatusEl.textContent = `${label}\n${body}`;
+      }
+
+      async function callArtifacts(method, path, body) {
+        const init = { method };
+        if (body !== undefined) {
+          init.headers = { "content-type": "application/json" };
+          init.body = JSON.stringify(body);
+        }
+        const resp = await fetch(path, init);
+        const text = await resp.text();
+        let parsed;
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+        return { status: resp.status, body: parsed };
+      }
+
+      function getRepoName() {
+        const name = artifactsNameEl.value.trim();
+        if (!name) {
+          setArtifactsStatus("error", "repo name is required");
+          return null;
+        }
+        return name;
+      }
+
+      artifactsCreateBtn.addEventListener("click", async () => {
+        const name = getRepoName();
+        if (!name) return;
+        artifactsCreateBtn.disabled = true;
+        setArtifactsStatus(`POST /repos/create ${name}`, "...");
+        try {
+          const { status, body } = await callArtifacts(
+            "POST",
+            "/repos/create",
+            { name, description: "Created from Room Chat" },
+          );
+          setArtifactsStatus(`HTTP ${status}`, body);
+          addMessage(
+            `Artifacts: created repo "${name}" -> HTTP ${status}`,
+            true,
+          );
+        } catch (e) {
+          setArtifactsStatus("request failed", e.message);
+        } finally {
+          artifactsCreateBtn.disabled = false;
+        }
+      });
+
+      artifactsInfoBtn.addEventListener("click", async () => {
+        const name = getRepoName();
+        if (!name) return;
+        artifactsInfoBtn.disabled = true;
+        setArtifactsStatus(`GET /repos/info?name=${name}`, "...");
+        try {
+          const { status, body } = await callArtifacts(
+            "GET",
+            `/repos/info?name=${encodeURIComponent(name)}`,
+          );
+          setArtifactsStatus(`HTTP ${status}`, body);
+        } catch (e) {
+          setArtifactsStatus("request failed", e.message);
+        } finally {
+          artifactsInfoBtn.disabled = false;
+        }
+      });
+
+      artifactsTokenBtn.addEventListener("click", async () => {
+        const name = getRepoName();
+        if (!name) return;
+        artifactsTokenBtn.disabled = true;
+        setArtifactsStatus(`POST /repos/token ${name}`, "...");
+        try {
+          const { status, body } = await callArtifacts("POST", "/repos/token", {
+            name,
+            scope: "write",
+            ttl: 3600,
+          });
+          setArtifactsStatus(`HTTP ${status}`, body);
+        } catch (e) {
+          setArtifactsStatus("request failed", e.message);
+        } finally {
+          artifactsTokenBtn.disabled = false;
+        }
+      });
+
+      artifactsListBtn.addEventListener("click", async () => {
+        artifactsListBtn.disabled = true;
+        setArtifactsStatus("GET /repos/list", "...");
+        try {
+          const { status, body } = await callArtifacts("GET", "/repos/list");
+          setArtifactsStatus(`HTTP ${status}`, body);
+        } catch (e) {
+          setArtifactsStatus("request failed", e.message);
+        } finally {
+          artifactsListBtn.disabled = false;
+        }
+      });
+
+      const aiPromptEl = document.getElementById("ai-prompt");
+      const aiSendBtn = document.getElementById("ai-send");
+      const aiStatusEl = document.getElementById("ai-status");
+
+      aiSendBtn.addEventListener("click", async () => {
+        const prompt = aiPromptEl.value.trim();
+        if (!prompt) {
+          aiStatusEl.textContent = "Enter a prompt first.";
+          return;
+        }
+        aiSendBtn.disabled = true;
+        aiStatusEl.textContent = `> ${prompt}\n…`;
+        try {
+          const resp = await fetch("/ai", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ prompt }),
+          });
+          const text = await resp.text();
+          let parsed;
+          try {
+            parsed = JSON.parse(text);
+          } catch {
+            parsed = text;
+          }
+          const out =
+            typeof parsed === "object" && parsed && "response" in parsed
+              ? parsed.response
+              : typeof parsed === "string"
+                ? parsed
+                : JSON.stringify(parsed, null, 2);
+          aiStatusEl.textContent = `> ${prompt}\n${out}`;
+          addMessage(`AI Gateway -> HTTP ${resp.status}`, true);
+        } catch (e) {
+          aiStatusEl.textContent = `Error: ${e.message}`;
+        } finally {
+          aiSendBtn.disabled = false;
+        }
+      });
+
+      const reminderSendBtn = document.getElementById("reminder-send");
+      const reminderDelayEl = document.getElementById("reminder-delay");
+      const reminderMsgEl = document.getElementById("reminder-msg");
+      const reminderStatusEl = document.getElementById("reminder-status");
+
+      reminderSendBtn.addEventListener("click", () => {
+        const delay = parseInt(reminderDelayEl.value, 10);
+        const msg = reminderMsgEl.value.trim() || "ping!";
+        if (!delay || delay < 1) {
+          reminderStatusEl.textContent = "Delay must be at least 1 second.";
+          return;
+        }
+        if (!ws || ws.readyState !== WebSocket.OPEN) {
+          reminderStatusEl.textContent = "Not connected.";
+          return;
+        }
+        ws.send(`/remind ${delay} ${msg}`);
+        reminderStatusEl.textContent = `Sent: /remind ${delay} ${msg}`;
+        reminderMsgEl.value = "";
+      });
+
+      form.addEventListener("submit", (e) => {
+        e.preventDefault();
+        const text = input.value.trim();
+        if (!text || !ws || ws.readyState !== WebSocket.OPEN) return;
+        ws.send(text);
+        input.value = "";
+      });
+
+      connect();
+    </script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/package.json b/.repos/alchemy-effect/examples/cloudflare-worker/package.json
new file mode 100644
index 00000000000..0b13905f0f3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/package.json
@@ -0,0 +1,28 @@
+{
+  "name": "cloudflare-worker",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/cloudflare-worker"
+  },
+  "type": "module",
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@alchemy.run/better-auth": "workspace:*",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "better-auth": "catalog:",
+    "effect": "catalog:"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Agent.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Agent.ts
new file mode 100644
index 00000000000..c1f2d93c150
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Agent.ts
@@ -0,0 +1,81 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { Sandbox } from "./Sandbox.ts";
+
+export default class Agent extends Cloudflare.DurableObjectNamespace<Agent>()(
+  "Agents",
+  Effect.gen(function* () {
+    const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      const container = yield* Cloudflare.start(sandbox, {
+        enableInternet: true,
+      });
+
+      const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
+      for (const socket of yield* state.getWebSockets()) {
+        const session = socket.deserializeAttachment<{ id: string }>();
+        if (session) {
+          sessions.set(session.id, socket);
+        }
+      }
+
+      return {
+        exec: (command: string) => container.exec(command),
+        hello: () =>
+          Effect.gen(function* () {
+            const { fetch } = yield* container.getTcpPort(3000);
+            const response = yield* fetch(
+              HttpClientRequest.get("http://container/"),
+            );
+            return yield* response.text;
+          }),
+        increment: () =>
+          Effect.gen(function* () {
+            const { fetch } = yield* container.getTcpPort(3000);
+            const response = yield* fetch(
+              HttpClientRequest.post("http://container/increment"),
+            );
+            return yield* response.text;
+          }),
+        fetch: Effect.gen(function* () {
+          const [response, socket] = yield* Cloudflare.upgrade();
+          const id = "TODO";
+          socket.serializeAttachment({ id });
+          sessions.set(id, socket);
+          return response;
+        }),
+        webSocketMessage: Effect.fnUntraced(function* (
+          socket: Cloudflare.DurableWebSocket,
+          message: string | Uint8Array,
+        ) {
+          const session = socket.deserializeAttachment<{ id: string }>();
+          if (!session) return;
+          const text =
+            typeof message === "string"
+              ? message
+              : new TextDecoder().decode(message);
+          for (const peer of sessions.values()) {
+            yield* peer.send(`[${session.id}] ${text}`);
+          }
+        }),
+        webSocketClose: Effect.fnUntraced(function* (
+          ws: Cloudflare.DurableWebSocket,
+          code: number,
+          reason: string,
+          _wasClean: boolean,
+        ) {
+          const session = ws.deserializeAttachment<{ id: string }>();
+          if (session) {
+            sessions.delete(session.id);
+          }
+          yield* ws.close(code, reason);
+        }),
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/AiGateway.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/AiGateway.ts
new file mode 100644
index 00000000000..348f0850fa3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/AiGateway.ts
@@ -0,0 +1,6 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Gateway = Cloudflare.AiGateway("Gateway", {
+  cacheTtl: 60,
+  collectLogs: true,
+});
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Api.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Api.ts
new file mode 100644
index 00000000000..b3041797f2c
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Api.ts
@@ -0,0 +1,458 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import Agent from "./Agent.ts";
+import { Gateway } from "./AiGateway.ts";
+import { Bucket } from "./Bucket.ts";
+import { KV } from "./KV.ts";
+import NotifyWorkflow from "./NotifyWorkflow.ts";
+import { Queue } from "./Queue.ts";
+import { Repos } from "./Repos.ts";
+import Room from "./Room.ts";
+
+interface QueueMessageBody {
+  id: string;
+  text: string;
+  sentAt: number;
+}
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+    observability: {
+      enabled: true,
+    },
+    assets: "./assets",
+    build: {
+      bundleAnalyzer: true,
+    },
+  },
+  Effect.gen(function* () {
+    // const betterAuth = yield* BetterAuth.BetterAuth;
+    const agents = yield* Agent;
+    const rooms = yield* Room;
+    const notifier = yield* NotifyWorkflow;
+    const loader = yield* Cloudflare.DynamicWorkerLoader("Loader");
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+    const queueResource = yield* Queue;
+    const queue = yield* Cloudflare.QueueBinding.bind(queueResource);
+    const repos = yield* Cloudflare.Artifacts.bind(Repos);
+    const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+    // Effect-style queue consumer. Each batch is piped through the
+    // handler; success ack()s every message in the batch, failure
+    // retry()s. The persisted JSON at /queue/<id> on R2 lets the
+    // integ test verify the producer→consumer round-trip.
+    yield* Cloudflare.messages<QueueMessageBody>(queueResource).subscribe(
+      (stream) =>
+        Stream.runForEach(stream, (msg) =>
+          bucket
+            .put(`/queue/${msg.body.id}`, JSON.stringify(msg.body), {
+              httpMetadata: { contentType: "application/json" },
+            })
+            .pipe(Effect.asVoid),
+        ),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        if (request.url.startsWith("/auth/")) {
+          // return yield* betterAuth.fetch;
+        } else if (request.url.startsWith("/kv/")) {
+          if (request.method === "GET") {
+            const key = request.url.split("/").pop()!;
+            return yield* kv.get(key).pipe(
+              Effect.map((value) =>
+                value
+                  ? HttpServerResponse.text(value)
+                  : HttpServerResponse.empty({ status: 404 }),
+              ),
+              Effect.catch(() =>
+                Effect.succeed(HttpServerResponse.empty({ status: 404 })),
+              ),
+            );
+          } else if (request.method === "POST") {
+            const key = request.url.split("/").pop()!;
+            const value = yield* request.text;
+            return yield* kv.put(key, value).pipe(
+              Effect.map(() => HttpServerResponse.empty({ status: 200 })),
+              Effect.catch(() =>
+                Effect.succeed(HttpServerResponse.empty({ status: 500 })),
+              ),
+            );
+          }
+        } else if (request.url.startsWith("/object/")) {
+          if (request.method === "GET") {
+            return yield* bucket.get(request.url.split("/").pop()!).pipe(
+              Effect.flatMap((object) =>
+                object === null
+                  ? Effect.succeed(
+                      HttpServerResponse.text("Object not found", {
+                        status: 404,
+                      }),
+                    )
+                  : object.text().pipe(
+                      Effect.map((text) =>
+                        HttpServerResponse.text(text, {
+                          headers: { "content-type": "application/json" },
+                        }),
+                      ),
+                    ),
+              ),
+              Effect.catchTag("R2Error", (error) =>
+                Effect.succeed(
+                  HttpServerResponse.text(error.message, {
+                    status: 500,
+                    statusText: error.message,
+                  }),
+                ),
+              ),
+            );
+          } else if (request.method === "POST" || request.method === "PUT") {
+            // const request = yield* Cloudflare.Request
+            const key = request.url.split("/").pop()!;
+            return yield* bucket
+              .put(key, request.stream, {
+                contentLength: Number(request.headers["content-length"] ?? 0),
+              })
+              .pipe(
+                Effect.map(() => HttpServerResponse.empty({ status: 201 })),
+                Effect.catch((err) =>
+                  HttpServerResponse.json(
+                    {
+                      error: err.message,
+                      headers: request.headers,
+                    },
+                    { status: 500 },
+                  ),
+                ),
+              );
+          } else {
+            return HttpServerResponse.text("Method not allowed", {
+              status: 405,
+            });
+          }
+        } else if (request.url === "/sandbox/increment") {
+          const agent = agents.getByName("sandbox-test");
+          const body = yield* agent.increment().pipe(Effect.orDie);
+          const room = rooms.getByName("default");
+          yield* room.broadcast(`[container] ${body}`);
+          return HttpServerResponse.text(body, {
+            headers: { "content-type": "application/json" },
+          });
+        } else if (request.url.startsWith("/sandbox")) {
+          const agent = agents.getByName("sandbox-test");
+          const body = yield* agent.hello().pipe(Effect.orDie);
+          return HttpServerResponse.text(body);
+        } else if (request.url.startsWith("/workflow/start/")) {
+          const roomId = request.url.split("/workflow/start/")[1];
+          if (!roomId) {
+            return yield* HttpServerResponse.json(
+              { error: "roomId is required" },
+              { status: 400 },
+            );
+          }
+          const instance = yield* notifier.create({
+            roomId,
+            message: "hello from workflow",
+          });
+          return yield* HttpServerResponse.json({ instanceId: instance.id });
+        } else if (request.url.startsWith("/workflow/status/")) {
+          const instanceId = request.url.split("/workflow/status/")[1];
+          if (!instanceId) {
+            return yield* HttpServerResponse.json(
+              { error: "instanceId is required" },
+              { status: 400 },
+            );
+          }
+          const instance = yield* notifier.get(instanceId);
+          const status = yield* instance.status();
+          return yield* HttpServerResponse.json(status);
+        } else if (request.url.startsWith("/eval")) {
+          if (request.method === "POST") {
+            const code = yield* request.text;
+            const worker = loader.load({
+              compatibilityDate: "2026-01-28",
+              mainModule: "worker.js",
+              modules: {
+                "worker.js": `
+                  export default {
+                    async fetch(request) {
+                      try {
+                        const result = (0, eval)(${"`${await request.text()}`"});
+                        return new Response(String(result), { status: 200 });
+                      } catch (e) {
+                        return new Response(e.message, { status: 500 });
+                      }
+                    }
+                  }
+                `,
+              },
+              globalOutbound: null,
+            });
+            return yield* worker
+              .fetch(
+                HttpClientRequest.post("https://worker/").pipe(
+                  HttpClientRequest.setBody(HttpBody.text(code)),
+                ),
+              )
+              .pipe(
+                Effect.map(HttpServerResponse.fromClientResponse),
+                Effect.orDie,
+              );
+          }
+        } else if (request.url.startsWith("/connect/")) {
+          const agentId = request.url.split("/").pop()!;
+          const agent = agents.getByName(agentId);
+          const response = yield* agent.fetch(request);
+          return response;
+        } else if (request.url.startsWith("/room/")) {
+          const upgradeHeader = request.headers.upgrade;
+          const roomId = request.url.split("/").pop()!;
+          if (!upgradeHeader || upgradeHeader !== "websocket") {
+            return HttpServerResponse.text(
+              "Worker expected Upgrade: websocket",
+              { status: 426 },
+            );
+          } else if (request.method !== "GET") {
+            return HttpServerResponse.text("Method not allowed", {
+              status: 405,
+            });
+          }
+          const room = rooms.getByName(roomId);
+          const response = yield* room.fetch(request);
+          return response;
+        }
+        // Cloudflare Artifacts — Git-compatible versioned repos.
+        // Exercises Cloudflare.ArtifactsConnection by creating a repo,
+        // looking it up, and minting short-lived clone tokens.
+        if (
+          request.url.startsWith("/repos/create") &&
+          request.method === "POST"
+        ) {
+          const text = yield* request.text;
+          const body = JSON.parse(text || "{}") as {
+            name?: string;
+            description?: string;
+          };
+          const name = body.name?.trim();
+          if (!name) {
+            return yield* HttpServerResponse.json(
+              { error: "name is required" },
+              { status: 400 },
+            );
+          }
+          return yield* repos
+            .create(name, {
+              description: body.description,
+              setDefaultBranch: "main",
+            })
+            .pipe(
+              Effect.flatMap((created) =>
+                HttpServerResponse.json({
+                  id: created.id,
+                  name: created.name,
+                  remote: created.remote,
+                  token: created.token,
+                  tokenExpiresAt: created.tokenExpiresAt,
+                  defaultBranch: created.defaultBranch,
+                }),
+              ),
+              Effect.catchTag("ArtifactsError", (err) =>
+                HttpServerResponse.json(
+                  { error: err.message },
+                  { status: 409 },
+                ),
+              ),
+            );
+        }
+        if (request.url.startsWith("/repos/list") && request.method === "GET") {
+          return yield* repos.list({ limit: 50 }).pipe(
+            Effect.flatMap((res) => HttpServerResponse.json(res)),
+            Effect.catchTag("ArtifactsError", (err) =>
+              HttpServerResponse.json({ error: err.message }, { status: 500 }),
+            ),
+          );
+        }
+        if (request.url.startsWith("/repos/info") && request.method === "GET") {
+          const name = new URL(request.url, "http://x").searchParams.get(
+            "name",
+          );
+          if (!name) {
+            return yield* HttpServerResponse.json(
+              { error: "name is required" },
+              { status: 400 },
+            );
+          }
+          return yield* repos.get(name).pipe(
+            Effect.flatMap((repo) =>
+              HttpServerResponse.json({
+                id: repo.raw.id,
+                name: repo.raw.name,
+                description: repo.raw.description,
+                defaultBranch: repo.raw.defaultBranch,
+                remote: repo.raw.remote,
+                createdAt: repo.raw.createdAt,
+                updatedAt: repo.raw.updatedAt,
+                lastPushAt: repo.raw.lastPushAt,
+                readOnly: repo.raw.readOnly,
+              }),
+            ),
+            Effect.catchTag("ArtifactsError", (err) =>
+              HttpServerResponse.json(
+                { name, error: err.message },
+                { status: 404 },
+              ),
+            ),
+          );
+        }
+        if (
+          request.url.startsWith("/repos/token") &&
+          request.method === "POST"
+        ) {
+          const text = yield* request.text;
+          const body = JSON.parse(text || "{}") as {
+            name?: string;
+            scope?: "read" | "write";
+            ttl?: number;
+          };
+          const name = body.name?.trim();
+          if (!name) {
+            return yield* HttpServerResponse.json(
+              { error: "name is required" },
+              { status: 400 },
+            );
+          }
+          return yield* repos.get(name).pipe(
+            Effect.flatMap((repo) =>
+              repo.createToken(body.scope ?? "read", body.ttl ?? 3600),
+            ),
+            Effect.flatMap((token) =>
+              HttpServerResponse.json({ name, ...token }),
+            ),
+            Effect.catchTag("ArtifactsError", (err) =>
+              HttpServerResponse.json(
+                { name, error: err.message },
+                { status: 404 },
+              ),
+            ),
+          );
+        }
+        // Queue producer + consumer smoke test.
+        //
+        // POST /queue/send       sends a message with a generated id.
+        // GET  /queue/result/:id reads the bucket entry the consumer
+        //                        wrote when it processed that message.
+        //
+        // Producer side: `Cloudflare.QueueBinding`. Consumer side:
+        // `Cloudflare.messages(Queue).subscribe(...)` registered in
+        // the init phase (above), with `QueueEventSourceLive` on the
+        // worker layer.
+        // AI Gateway smoke test — POST /ai with { prompt }.
+        //
+        // Routes a Workers AI inference call through the gateway resource so
+        // every request is observable in the Cloudflare AI Gateway UI and
+        // benefits from caching/rate limiting configured on the resource.
+        if (request.url.startsWith("/ai") && request.method === "POST") {
+          const text = yield* request.text;
+          const body = (() => {
+            try {
+              return JSON.parse(text || "{}") as { prompt?: string };
+            } catch {
+              return {} as { prompt?: string };
+            }
+          })();
+          const prompt =
+            body.prompt?.trim() || "Say hello in one short sentence.";
+          const response = yield* aiGateway.run({
+            provider: "workers-ai",
+            endpoint: "@cf/meta/llama-3.1-8b-instruct",
+            headers: { "content-type": "application/json" },
+            query: { prompt },
+          });
+          return HttpServerResponse.fromWeb(response);
+        }
+        if (request.url === "/queue/send" && request.method === "POST") {
+          const text = yield* request.text;
+          const msg: QueueMessageBody = {
+            id: crypto.randomUUID(),
+            text,
+            sentAt: Date.now(),
+          };
+          yield* queue.send(msg).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ sent: msg }, { status: 202 });
+        }
+        if (request.url.startsWith("/queue/result/")) {
+          const id = request.url.split("/queue/result/")[1];
+          if (!id) {
+            return HttpServerResponse.text("missing id", { status: 400 });
+          }
+          if (request.method === "GET") {
+            return yield* bucket.get(`/queue/${id}`).pipe(
+              Effect.flatMap((object) =>
+                object === null
+                  ? Effect.succeed(
+                      HttpServerResponse.text("not yet", { status: 404 }),
+                    )
+                  : object.text().pipe(
+                      Effect.map((body) =>
+                        HttpServerResponse.text(body, {
+                          headers: { "content-type": "application/json" },
+                        }),
+                      ),
+                    ),
+              ),
+              Effect.catchTag("R2Error", (error) =>
+                Effect.succeed(
+                  HttpServerResponse.text(error.message, { status: 500 }),
+                ),
+              ),
+            );
+          }
+          // DELETE — used by the integ test to clear consumed
+          // entries before stack.destroy(), so R2Bucket delete
+          // doesn't fail with "bucket not empty".
+          if (request.method === "DELETE") {
+            return yield* bucket.delete(`/queue/${id}`).pipe(
+              Effect.map(() => HttpServerResponse.empty({ status: 204 })),
+              Effect.catchTag("R2Error", (error) =>
+                Effect.succeed(
+                  HttpServerResponse.text(error.message, { status: 500 }),
+                ),
+              ),
+            );
+          }
+        }
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }).pipe(
+        Effect.catch(() =>
+          Effect.succeed(
+            HttpServerResponse.text("Internal Server Error", {
+              status: 500,
+            }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        Cloudflare.R2BucketBindingLive,
+        Cloudflare.KVNamespaceBindingLive,
+        Cloudflare.QueueBindingLive,
+        Cloudflare.QueueEventSourceLive,
+        Cloudflare.ArtifactsBindingLive,
+        Cloudflare.AiGatewayBindingLive,
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Bucket.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Bucket.ts
new file mode 100644
index 00000000000..23edbf011de
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Bucket.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/KV.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/KV.ts
new file mode 100644
index 00000000000..a423af5f86b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/KV.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const KV = Cloudflare.KVNamespace("KV");
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/NotifyWorkflow.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/NotifyWorkflow.ts
new file mode 100644
index 00000000000..846c3ffc50d
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/NotifyWorkflow.ts
@@ -0,0 +1,84 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Config } from "effect";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { KV } from "./KV.ts";
+import Room from "./Room.ts";
+
+/**
+ * Hard-coded value the integ test asserts on to prove the secret was
+ * bound at plantime and read at runtime through the `Redacted` accessor.
+ */
+export const WORKFLOW_SECRET_VALUE = Redacted.make("wf-secret-abc123");
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
+
+    const secret = yield* Config.redacted("WORKFLOW_SECRET").pipe(
+      Config.withDefault(WORKFLOW_SECRET_VALUE),
+    );
+
+    // Regression guard for https://github.com/alchemy-run/alchemy-effect/pull/71
+    //
+    // The kv binding internally yields `Cloudflare.WorkerEnvironment` —
+    // before that PR, accessing `WorkerEnvironment` inside a workflow body
+    // crashed because `provideService(WorkerEnvironment, env)` was applied
+    // to the outer `Effect.succeed(body)` wrapper (a no-op) instead of
+    // `body` itself in `Workflow.ts`. Exercising `kv.put` / `kv.get` from
+    // inside a `task` keeps the integ test catching any future regression.
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+
+      const stored = yield* Cloudflare.task(
+        "kv-roundtrip",
+        Effect.gen(function* () {
+          const key = `workflow:smoke:${roomId}`;
+          yield* kv.put(key, message);
+          const got = yield* kv.get(key);
+          if (got !== message) {
+            return yield* Effect.die(
+              new Error(
+                `KV roundtrip mismatch: expected "${message}", got "${got ?? "null"}"`,
+              ),
+            );
+          }
+          return got;
+        }).pipe(Effect.orDie),
+      );
+
+      // Resolve the bound secret inside the workflow body. The accessor
+      // returns `Redacted<string>`; unwrap only where the value needs to
+      // leave the workflow (here, in the broadcast + the returned output
+      // so the integ test can assert end-to-end propagation).
+      const secretValue = Redacted.value(secret);
+
+      const processed = yield* Cloudflare.task(
+        "process",
+        Effect.succeed({
+          text: `Processed: ${stored}`,
+          secret: secretValue,
+          ts: Date.now(),
+        }),
+      );
+
+      const room = rooms.getByName(roomId);
+      yield* Cloudflare.task(
+        "broadcast",
+        room.broadcast(`[workflow] ${processed.text} secret=${secretValue}`),
+      );
+
+      yield* Cloudflare.sleep("cooldown", "2 seconds");
+
+      yield* Cloudflare.task(
+        "finalize",
+        room.broadcast(`[workflow] complete for ${roomId}`),
+      );
+
+      return processed;
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Queue.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Queue.ts
new file mode 100644
index 00000000000..08ad52e247e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Queue.ts
@@ -0,0 +1,13 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+/**
+ * Queue resource used by the Api worker as a producer (via
+ * `Cloudflare.QueueBinding.bind(Queue)`). Exercises the Queue + QueueBinding
+ * resources end-to-end in the Effect-based example.
+ *
+ * The async example (`examples/cloudflare-worker-async`) demonstrates the
+ * consumer side via a native `queue()` handler on the default export — the
+ * Effect worker's `Main` type currently only exposes a `fetch` handler, so
+ * consumer-side wiring on Effect workers is a follow-up.
+ */
+export const Queue = Cloudflare.Queue("Queue");
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Repos.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Repos.ts
new file mode 100644
index 00000000000..2ed940cd088
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Repos.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Repos = Cloudflare.Artifacts("Repos");
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Room.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Room.ts
new file mode 100644
index 00000000000..30ef1242a95
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Room.ts
@@ -0,0 +1,94 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+/**
+ * Ephemeral chat room: broadcasts each text message to every connected client.
+ * Uses Durable Object storage of WebSocket attachments so sessions survive hibernation.
+ *
+ * Also demonstrates scheduled events: send `/remind <seconds> <message>` to
+ * schedule a broadcast that fires after the given delay.
+ */
+export default class Room extends Cloudflare.DurableObjectNamespace<Room>()(
+  "Rooms",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
+      for (const socket of yield* state.getWebSockets()) {
+        const attachment = socket.deserializeAttachment<{ id: string }>();
+        if (attachment) {
+          sessions.set(attachment.id, socket);
+        }
+      }
+
+      const broadcast = (text: string) =>
+        Effect.gen(function* () {
+          for (const peer of sessions.values()) {
+            yield* peer.send(text);
+          }
+        });
+
+      return {
+        fetch: Effect.gen(function* () {
+          const [response, socket] = yield* Cloudflare.upgrade();
+          const id = crypto.randomUUID();
+          socket.serializeAttachment({ id });
+          sessions.set(id, socket);
+          return response;
+        }),
+        broadcast,
+        alarm: () =>
+          Effect.gen(function* () {
+            const fired = yield* Cloudflare.processScheduledEvents;
+            for (const event of fired) {
+              const payload = event.payload as { message: string };
+              yield* broadcast(`[reminder] ${payload.message}`);
+            }
+          }),
+        webSocketMessage: Effect.fnUntraced(function* (
+          socket: Cloudflare.DurableWebSocket,
+          message: string | ArrayBuffer,
+        ) {
+          const attachment = socket.deserializeAttachment<{ id: string }>();
+          if (!attachment) return;
+          const text =
+            typeof message === "string"
+              ? message
+              : new TextDecoder().decode(message);
+
+          const remindMatch = text.match(/^\/remind\s+(\d+)\s+(.+)$/);
+          if (remindMatch) {
+            const delaySec = parseInt(remindMatch[1], 10);
+            const msg = remindMatch[2];
+            const id = crypto.randomUUID();
+            const runAt = new Date(Date.now() + delaySec * 1000);
+            yield* Cloudflare.scheduleEvent(id, runAt, { message: msg });
+            yield* socket.send(
+              `[system] Reminder scheduled in ${delaySec}s: "${msg}"`,
+            );
+            return;
+          }
+
+          const label = attachment.id.slice(0, 8);
+          for (const peer of sessions.values()) {
+            yield* peer.send(`[${label}] ${text}`);
+          }
+        }),
+        webSocketClose: Effect.fnUntraced(function* (
+          ws: Cloudflare.DurableWebSocket,
+          code: number,
+          reason: string,
+          _wasClean: boolean,
+        ) {
+          const attachment = ws.deserializeAttachment<{ id: string }>();
+          if (attachment) {
+            sessions.delete(attachment.id);
+          }
+          yield* ws.close(code, reason);
+        }),
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/Sandbox.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/Sandbox.ts
new file mode 100644
index 00000000000..64e46d292db
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/Sandbox.ts
@@ -0,0 +1,87 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import type { PlatformError } from "effect/PlatformError";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+
+export class Sandbox extends Cloudflare.Container<
+  Sandbox,
+  {
+    /**
+     * Execute a command in a sandbox.
+     */
+    exec: (command: string) => Effect.Effect<
+      {
+        exitCode: number;
+        stdout: string;
+        stderr: string;
+      },
+      PlatformError
+    >;
+  }
+>()(
+  "Sandbox",
+  Stack.useSync((stack) => ({
+    main: import.meta.filename,
+    instanceType: stack.stage === "prod" ? "standard-1" : "dev",
+    observability: {
+      logs: {
+        enabled: true,
+      },
+    },
+  })),
+) {}
+
+export const SandboxLive = /* @__PURE__ */ Sandbox.make(
+  Effect.gen(function* () {
+    //
+    const cp = yield* ChildProcessSpawner;
+
+    let counter = 0;
+
+    return Sandbox.of({
+      exec: (command) =>
+        cp
+          .spawn(
+            ChildProcess.make(command, {
+              shell: true,
+            }),
+          )
+          .pipe(
+            Effect.flatMap((handle) =>
+              Effect.all(
+                [
+                  handle.exitCode,
+                  handle.stdout.pipe(Stream.decodeText, Stream.mkString),
+                  handle.stderr.pipe(Stream.decodeText, Stream.mkString),
+                ],
+                { concurrency: "unbounded" },
+              ),
+            ),
+            Effect.map(([exitCode, stdout, stderr]) => ({
+              exitCode,
+              stdout,
+              stderr,
+            })),
+            Effect.scoped,
+          ),
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://localhost");
+
+        if (url.pathname === "/increment") {
+          counter++;
+          return yield* HttpServerResponse.json({ counter });
+        }
+
+        return HttpServerResponse.text("Hello from Sandbox container!");
+      }),
+    });
+  }),
+);
+
+export default SandboxLive;
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/SecondaryApi.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/SecondaryApi.ts
new file mode 100644
index 00000000000..b99e4c66363
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/SecondaryApi.ts
@@ -0,0 +1,34 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import Agent from "./Agent.ts";
+
+// A second Worker that binds the same `Agent` Durable Object as `Api`. Each
+// `yield* Agent` runs the DO's outer init, which calls
+// `Cloudflare.Container.bind(Sandbox)` and pushes a binding onto the Sandbox
+// ContainerApplication carrying the Agent namespace. With two Workers binding
+// the same DO, the Sandbox ends up with two bindings that share a single
+// `namespaceId` — the regression case for the dedupe fix in this PR.
+export class SecondaryApi extends Cloudflare.Worker<SecondaryApi>()(
+  "SecondaryApi",
+  {
+    main: import.meta.filename,
+    observability: { enabled: true },
+  },
+) {}
+
+export default SecondaryApi.make(
+  Effect.gen(function* () {
+    const agents = yield* Agent;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const body = yield* agents
+          .getByName("sandbox-test")
+          .hello()
+          .pipe(Effect.orDie);
+        return HttpServerResponse.text(body);
+      }),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/src/WorkerTag.ts b/.repos/alchemy-effect/examples/cloudflare-worker/src/WorkerTag.ts
new file mode 100644
index 00000000000..7c20ef7e08b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/src/WorkerTag.ts
@@ -0,0 +1,29 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+// Tagged Worker DX: declare the class first (lightweight identifier),
+// then provide the runtime implementation in a second `.make()` call.
+// This mirrors the pattern in the README/docstring on Cloudflare.Worker.
+export class WorkerTag extends Cloudflare.Worker<WorkerTag>()("WorkerTag", {
+  main: import.meta.filename,
+  compatibility: {
+    flags: ["nodejs_compat"],
+    date: "2026-04-26",
+  },
+  observability: {
+    enabled: true,
+  },
+}) {}
+
+export default WorkerTag.make(
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello from WorkerTag", {
+          status: 200,
+        });
+      }),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/test/integ.test.ts b/.repos/alchemy-effect/examples/cloudflare-worker/test/integ.test.ts
new file mode 100644
index 00000000000..a5e40cac15f
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/test/integ.test.ts
@@ -0,0 +1,193 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "../alchemy.run.ts";
+import { WORKFLOW_SECRET_VALUE } from "../src/NotifyWorkflow.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+  stage: "test",
+  // dev: true,
+});
+
+// This stack deploys a Container (Sandbox) whose image build + push can take
+// well over the default 120s hook budget, so give deploy/destroy more room.
+const stack = beforeAll(deploy(Stack), { timeout: 600_000 });
+
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack), {
+  timeout: 600_000,
+});
+
+test(
+  "integ",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    expect(url).toBeString();
+  }),
+);
+
+/**
+ * Regression guard for https://github.com/alchemy-run/alchemy-effect/pull/172
+ *
+ * The stack now includes two Workers (`Api` and `SecondaryApi`) that both
+ * bind the same `Agent` Durable Object, which in turn binds the `Sandbox`
+ * Container. Each `yield* Agent` runs the DO's outer init, calling
+ * `Cloudflare.Container.bind(Sandbox)` once per Worker, so the Sandbox
+ * ContainerApplication receives two bindings sharing one `namespaceId`.
+ *
+ * Before the dedupe fix, `getDurableObjects` counted those as two distinct
+ * namespaces and the deploy in `beforeAll` died with:
+ *
+ *   "A Container can only be bound to one Durable Object namespace.
+ *    Found 2 namespaces in bindings: <id>, <id>"
+ *
+ * If the deploy ever starts failing again, the whole suite stops at
+ * `beforeAll` — that is the regression signal. This case just asserts the
+ * second Worker showed up with a URL so a silent regression that drops the
+ * binding still surfaces here.
+ */
+test(
+  "two workers binding the same container deploy without dedup error",
+  Effect.gen(function* () {
+    const { secondaryApiUrl } = yield* stack;
+    expect(secondaryApiUrl).toBeString();
+  }),
+);
+
+/**
+ * Regression guard for https://github.com/alchemy-run/alchemy-effect/pull/71
+ *
+ * `NotifyWorkflow` accesses `Cloudflare.WorkerEnvironment` inside its body and
+ * performs a KV roundtrip via `env.KV.put` / `env.KV.get`. If the fix from #71
+ * is ever reverted, the body Effect loses the `WorkerEnvironment` service and
+ * dies with `Service not found: Cloudflare.Workers.WorkerEnvironment` on the
+ * first `yield* Cloudflare.WorkerEnvironment` — the workflow instance never
+ * reaches `complete`, and this test times out or surfaces the `errored` status.
+ */
+test(
+  "workflow body can access WorkerEnvironment and exercise env bindings",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const roomId = `smoke-${Date.now()}`;
+
+    // Start the workflow instance.
+    const startResponse = yield* Effect.tryPromise({
+      try: () => fetch(`${url}/workflow/start/${roomId}`, { method: "POST" }),
+      catch: (cause) =>
+        cause instanceof Error ? cause : new Error(String(cause)),
+    });
+    expect(startResponse.status).toBe(200);
+
+    const { instanceId } = yield* Effect.tryPromise({
+      try: () => startResponse.json() as Promise<{ instanceId: string }>,
+      catch: (cause) =>
+        cause instanceof Error ? cause : new Error(String(cause)),
+    });
+    expect(instanceId).toBeString();
+
+    // Poll status until complete / errored / timeout (~60s).
+    const deadline = Date.now() + 60_000;
+    let lastStatus:
+      | { status: string; output?: unknown; error?: unknown }
+      | undefined;
+    while (Date.now() < deadline) {
+      const statusResponse = yield* Effect.tryPromise({
+        try: () => fetch(`${url}/workflow/status/${instanceId}`),
+        catch: (cause) =>
+          cause instanceof Error ? cause : new Error(String(cause)),
+      });
+      expect(statusResponse.status).toBe(200);
+      lastStatus = yield* Effect.tryPromise({
+        try: () =>
+          statusResponse.json() as Promise<{
+            status: string;
+            output?: unknown;
+            error?: unknown;
+          }>,
+        catch: (cause) =>
+          cause instanceof Error ? cause : new Error(String(cause)),
+      });
+      if (lastStatus.status === "complete" || lastStatus.status === "errored") {
+        break;
+      }
+      yield* Effect.sleep("2 seconds");
+    }
+
+    // The workflow must have completed — if WorkerEnvironment provision breaks,
+    // the body dies on the first yield and the instance never reaches complete.
+    expect(lastStatus).toBeDefined();
+    expect(lastStatus!.status).toBe("complete");
+    expect(lastStatus!.error).toBeFalsy();
+
+    // Prove the `Alchemy.Secret(...)` bound at plantime made it all the
+    // way through to the workflow body's runtime read. The workflow body
+    // unwraps `Redacted.value(secret)` and embeds it in the returned
+    // `processed` payload.
+    const output = lastStatus!.output as { secret?: string } | undefined;
+    expect(output?.secret).toBe(Redacted.value(WORKFLOW_SECRET_VALUE));
+  }),
+  { timeout: 120_000 },
+);
+
+/**
+ * Queue producer→consumer round-trip via the Effect-style
+ * `Cloudflare.messages(Queue).subscribe(...)` API.
+ *
+ * Producer: `POST /queue/send` returns `{ sent: { id, text, sentAt } }`
+ * after enqueuing a message.
+ *
+ * Consumer: the worker's queue() handler (registered via subscribe in
+ * src/Api.ts) writes the message body to R2 at `/queue/<id>`. The
+ * route `GET /queue/result/<id>` reads it back. Cloudflare's queue
+ * dispatch is async and best-effort, so we poll for up to 60s.
+ */
+test(
+  "queue producer→consumer round-trip via messages().subscribe()",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const text = `hello-${Date.now()}`;
+
+    const sendResponse = yield* HttpClient.execute(
+      HttpClientRequest.post(`${url}/queue/send`).pipe(
+        HttpClientRequest.setBody(HttpBody.text(text)),
+      ),
+    );
+    expect(sendResponse.status).toBe(202);
+    const { sent } = (yield* sendResponse.json) as {
+      sent: { id: string; text: string; sentAt: number };
+    };
+    expect(sent.id).toBeTypeOf("string");
+
+    const deadline = Date.now() + 60_000;
+    let consumed: { id: string; text: string; sentAt: number } | undefined;
+    while (Date.now() < deadline) {
+      const resultResponse = yield* HttpClient.get(
+        `${url}/queue/result/${sent.id}`,
+      );
+      if (resultResponse.status === 200) {
+        consumed = (yield* resultResponse.json) as typeof consumed;
+        break;
+      }
+      yield* Effect.sleep("2 seconds");
+    }
+
+    expect(consumed).toBeDefined();
+    expect(consumed!.id).toBe(sent.id);
+    expect(consumed!.text).toBe(text);
+
+    // Clean up the consumed R2 entry so afterAll's stack.destroy()
+    // can delete the bucket — otherwise Cloudflare rejects the
+    // bucket delete with "bucket is not empty".
+    yield* HttpClient.execute(
+      HttpClientRequest.make("DELETE")(`${url}/queue/result/${sent.id}`),
+    );
+  }),
+  { timeout: 120_000 },
+);
diff --git a/.repos/alchemy-effect/examples/cloudflare-worker/tsconfig.json b/.repos/alchemy-effect/examples/cloudflare-worker/tsconfig.json
new file mode 100644
index 00000000000..484e2f0a26a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/cloudflare-worker/tsconfig.json
@@ -0,0 +1,19 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["alchemy.run.ts", "src/**/*.ts", "test/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext"
+  },
+  "references": [
+    {
+      "path": "../../packages/alchemy/tsconfig.json"
+    },
+    {
+      "path": "../../packages/better-auth/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/.gitignore b/.repos/alchemy-effect/examples/monorepo-multi-stack/.gitignore
new file mode 100644
index 00000000000..ac24b669bab
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/.gitignore
@@ -0,0 +1,6 @@
+node_modules/
+dist/
+lib/
+.alchemy/
+.wrangler/
+*.tsbuildinfo
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/_package.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/_package.json
new file mode 100644
index 00000000000..7070585c88b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/_package.json
@@ -0,0 +1,30 @@
+{
+  "name": "example-monorepo-multi-stack",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/alchemy-run/alchemy-effect"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "devDependencies": {
+    "@types/bun": "catalog:",
+    "typescript": "catalog:"
+  },
+  "workspaces": {
+    "packages": ["frontend", "backend"],
+    "catalog": {
+      "@effect/platform-bun": "4.0.0-beta.60",
+      "@effect/platform-node": "4.0.0-beta.60",
+      "@types/bun": "latest",
+      "alchemy": "file:../packages/alchemy",
+      "effect": "4.0.0-beta.60",
+      "typescript": "^6.0.3",
+      "vite": "^8.0.7"
+    }
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/alchemy.run.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/alchemy.run.ts
new file mode 100644
index 00000000000..149c9654260
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/alchemy.run.ts
@@ -0,0 +1,17 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Service from "./src/Service.ts";
+import { Backend } from "./src/Stack.ts";
+
+export default Backend.make(
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const api = yield* Service;
+    return {
+      url: api.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/package.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/package.json
new file mode 100644
index 00000000000..b26a336e86b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/package.json
@@ -0,0 +1,42 @@
+{
+  "name": "@monorepo-multi-stack/backend",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/monorepo-multi-stack/backend"
+  },
+  "dependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js",
+      "default": "./lib/index.js"
+    },
+    "./Client": {
+      "bun": "./src/Client.ts",
+      "types": "./lib/Client.d.ts",
+      "import": "./lib/Client.js",
+      "default": "./lib/Client.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Client.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Client.ts
new file mode 100644
index 00000000000..943115e7254
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Client.ts
@@ -0,0 +1,5 @@
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { BackendApi } from "./Spec.ts";
+
+export const BackendClient = (baseUrl: string) =>
+  HttpApiClient.make(BackendApi, { baseUrl });
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Service.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Service.ts
new file mode 100644
index 00000000000..97b11d4aa0a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Service.ts
@@ -0,0 +1,30 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { BackendApi, Greeting } from "./Spec.ts";
+
+export default class Service extends Cloudflare.Worker<Service>()(
+  "Service",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const helloGroup = HttpApiBuilder.group(BackendApi, "Hello", (handlers) =>
+      handlers.handle("hello", () =>
+        Effect.succeed(new Greeting({ message: "Hello World" })),
+      ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(BackendApi).pipe(
+        Layer.provide(helloGroup),
+        Layer.provide([HttpPlatform.layer, Etag.layer]),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Spec.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Spec.ts
new file mode 100644
index 00000000000..60dc73b60e9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Spec.ts
@@ -0,0 +1,16 @@
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
+export class Greeting extends Schema.Class<Greeting>("Greeting")({
+  message: Schema.String,
+}) {}
+
+export const hello = HttpApiEndpoint.get("hello", "/", {
+  success: Greeting,
+});
+
+export class HelloGroup extends HttpApiGroup.make("Hello").add(hello) {}
+
+export class BackendApi extends HttpApi.make("BackendApi").add(HelloGroup) {}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Stack.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Stack.ts
new file mode 100644
index 00000000000..4493b51f675
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/Stack.ts
@@ -0,0 +1,8 @@
+import * as Alchemy from "alchemy";
+
+export class Backend extends Alchemy.Stack<
+  Backend,
+  {
+    url: string;
+  }
+>()("Backend") {}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/index.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/index.ts
new file mode 100644
index 00000000000..166885251bf
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/src/index.ts
@@ -0,0 +1,3 @@
+export * from "./Client.ts";
+export * from "./Spec.ts";
+export * from "./Stack.ts";
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/tsconfig.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/tsconfig.json
new file mode 100644
index 00000000000..1a6405a5f99
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/backend/tsconfig.json
@@ -0,0 +1,11 @@
+{
+  "extends": "../tsconfig.base.json",
+  "include": ["src"],
+  "compilerOptions": {
+    "types": ["bun"],
+    "composite": true,
+    "noEmit": false,
+    "outDir": "./lib",
+    "rootDir": "./src"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/alchemy.run.ts b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/alchemy.run.ts
new file mode 100644
index 00000000000..715e3354875
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/alchemy.run.ts
@@ -0,0 +1,26 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Backend } from "@monorepo-multi-stack/backend";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "Frontend",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    // reference the prod stage of the backend
+    const backend = yield* Backend;
+
+    const website = yield* Cloudflare.Vite("Website", {
+      env: {
+        VITE_API_URL: backend.url,
+      },
+    });
+
+    return {
+      url: website.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/index.html b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/index.html
new file mode 100644
index 00000000000..26fad4c8c6b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/index.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>Frontend</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/package.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/package.json
new file mode 100644
index 00000000000..6874e88f8cf
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/package.json
@@ -0,0 +1,31 @@
+{
+  "name": "@monorepo-multi-stack/frontend",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/monorepo-multi-stack/frontend"
+  },
+  "dependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.2.14",
+    "alchemy": "workspace:*",
+    "@monorepo-multi-stack/backend": "workspace:*",
+    "effect": "catalog:",
+    "react-dom": "^19.2.6",
+    "react": "^19.2.6",
+    "vite": "catalog:"
+  },
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/src/main.tsx b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/src/main.tsx
new file mode 100644
index 00000000000..3af84f43917
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/src/main.tsx
@@ -0,0 +1,40 @@
+import { BackendClient } from "@monorepo-multi-stack/backend/Client";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import React from "react";
+import ReactDOM from "react-dom/client";
+
+const API_URL = import.meta.env.VITE_API_URL ?? "http://localhost:8787";
+
+const client = BackendClient(API_URL).pipe(
+  Effect.provide(FetchHttpClient.layer),
+);
+
+function App() {
+  const [message, setMessage] = React.useState<string>("loading…");
+
+  React.useEffect(() => {
+    client
+      .pipe(
+        Effect.flatMap((client) => client.Hello.hello()),
+        Effect.map((greeting) => greeting.message),
+        Effect.runPromise,
+      )
+      .then(setMessage, (err) => setMessage(`error: ${String(err)}`));
+  }, []);
+
+  return (
+    <main>
+      <h1>{message}</h1>
+      <p>
+        Edit <code>src/main.tsx</code> and redeploy.
+      </p>
+    </main>
+  );
+}
+
+ReactDOM.createRoot(document.getElementById("root")!).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>,
+);
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/tsconfig.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/tsconfig.json
new file mode 100644
index 00000000000..6a5669c3973
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/frontend/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../tsconfig.base.json",
+  "include": ["src"],
+  "references": [{ "path": "../backend" }],
+  "compilerOptions": {
+    "types": ["bun", "vite/client"],
+    "composite": true,
+    "noEmit": true
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/tsconfig.base.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/tsconfig.base.json
new file mode 100644
index 00000000000..6ed87e427e5
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/tsconfig.base.json
@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": ["ESNext", "DOM"],
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "moduleDetection": "force",
+    "jsx": "react-jsx",
+    "allowJs": true,
+    "allowImportingTsExtensions": true,
+    "rewriteRelativeImportExtensions": true,
+    "verbatimModuleSyntax": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-multi-stack/tsconfig.json b/.repos/alchemy-effect/examples/monorepo-multi-stack/tsconfig.json
new file mode 100644
index 00000000000..f763d3b3dd3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-multi-stack/tsconfig.json
@@ -0,0 +1,4 @@
+{
+  "files": [],
+  "references": [{ "path": "./backend" }, { "path": "./frontend" }]
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/.gitignore b/.repos/alchemy-effect/examples/monorepo-single-stack/.gitignore
new file mode 100644
index 00000000000..ac24b669bab
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/.gitignore
@@ -0,0 +1,6 @@
+node_modules/
+dist/
+lib/
+.alchemy/
+.wrangler/
+*.tsbuildinfo
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/_package.json b/.repos/alchemy-effect/examples/monorepo-single-stack/_package.json
new file mode 100644
index 00000000000..e6d6c3f2230
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/_package.json
@@ -0,0 +1,36 @@
+{
+  "name": "example-monorepo-single-stack",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/alchemy-run/alchemy-effect"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "catalog:",
+    "effect": "catalog:"
+  },
+  "devDependencies": {
+    "@types/bun": "catalog:",
+    "typescript": "catalog:"
+  },
+  "workspaces": {
+    "packages": ["frontend", "backend"],
+    "catalog": {
+      "@effect/platform-bun": "4.0.0-beta.60",
+      "@effect/platform-node": "4.0.0-beta.60",
+      "@types/bun": "latest",
+      "alchemy": "file:../packages/alchemy",
+      "effect": "4.0.0-beta.60",
+      "typescript": "^6.0.3",
+      "vite": "^8.0.7"
+    }
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/alchemy.run.ts b/.repos/alchemy-effect/examples/monorepo-single-stack/alchemy.run.ts
new file mode 100644
index 00000000000..1123a15d9a3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/alchemy.run.ts
@@ -0,0 +1,28 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Path } from "effect/Path";
+import Service from "./backend/src/Service.ts";
+
+export default Alchemy.Stack(
+  "Monorepo",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const backend = yield* Service;
+    const path = yield* Path;
+
+    const website = yield* Cloudflare.Vite("Website", {
+      rootDir: path.resolve(import.meta.dirname, "frontend"),
+      env: {
+        VITE_API_URL: backend.url.as<string>(),
+      },
+    });
+    return {
+      backendUrl: backend.url.as<string>(),
+      websiteUrl: website.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/backend/package.json b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/package.json
new file mode 100644
index 00000000000..17f45eb758e
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/package.json
@@ -0,0 +1,42 @@
+{
+  "name": "@monorepo-single-stack/backend",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/monorepo-single-stack/backend"
+  },
+  "dependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js",
+      "default": "./lib/index.js"
+    },
+    "./Client": {
+      "bun": "./src/Client.ts",
+      "types": "./lib/Client.d.ts",
+      "import": "./lib/Client.js",
+      "default": "./lib/Client.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Client.ts b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Client.ts
new file mode 100644
index 00000000000..943115e7254
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Client.ts
@@ -0,0 +1,5 @@
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { BackendApi } from "./Spec.ts";
+
+export const BackendClient = (baseUrl: string) =>
+  HttpApiClient.make(BackendApi, { baseUrl });
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Service.ts b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Service.ts
new file mode 100644
index 00000000000..97b11d4aa0a
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Service.ts
@@ -0,0 +1,30 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { BackendApi, Greeting } from "./Spec.ts";
+
+export default class Service extends Cloudflare.Worker<Service>()(
+  "Service",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const helloGroup = HttpApiBuilder.group(BackendApi, "Hello", (handlers) =>
+      handlers.handle("hello", () =>
+        Effect.succeed(new Greeting({ message: "Hello World" })),
+      ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(BackendApi).pipe(
+        Layer.provide(helloGroup),
+        Layer.provide([HttpPlatform.layer, Etag.layer]),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Spec.ts b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Spec.ts
new file mode 100644
index 00000000000..60dc73b60e9
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/Spec.ts
@@ -0,0 +1,16 @@
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
+export class Greeting extends Schema.Class<Greeting>("Greeting")({
+  message: Schema.String,
+}) {}
+
+export const hello = HttpApiEndpoint.get("hello", "/", {
+  success: Greeting,
+});
+
+export class HelloGroup extends HttpApiGroup.make("Hello").add(hello) {}
+
+export class BackendApi extends HttpApi.make("BackendApi").add(HelloGroup) {}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/index.ts b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/index.ts
new file mode 100644
index 00000000000..c0b2e2b15ba
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/src/index.ts
@@ -0,0 +1,2 @@
+export * from "./Client.ts";
+export * from "./Spec.ts";
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/backend/tsconfig.json b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/tsconfig.json
new file mode 100644
index 00000000000..1a6405a5f99
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/backend/tsconfig.json
@@ -0,0 +1,11 @@
+{
+  "extends": "../tsconfig.base.json",
+  "include": ["src"],
+  "compilerOptions": {
+    "types": ["bun"],
+    "composite": true,
+    "noEmit": false,
+    "outDir": "./lib",
+    "rootDir": "./src"
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/index.html b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/index.html
new file mode 100644
index 00000000000..26fad4c8c6b
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/index.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>Frontend</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/package.json b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/package.json
new file mode 100644
index 00000000000..914de6eb052
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/package.json
@@ -0,0 +1,29 @@
+{
+  "name": "@monorepo-single-stack/frontend",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "examples/monorepo-single-stack/frontend"
+  },
+  "dependencies": {
+    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.2.14",
+    "alchemy": "workspace:*",
+    "@monorepo-single-stack/backend": "workspace:*",
+    "effect": "catalog:",
+    "react-dom": "^19.2.6",
+    "react": "^19.2.6",
+    "vite": "catalog:"
+  },
+  "scripts": {
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "logs": "alchemy logs",
+    "tail": "alchemy tail",
+    "test": "bun test"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/src/main.tsx b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/src/main.tsx
new file mode 100644
index 00000000000..8b817fb8c64
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/src/main.tsx
@@ -0,0 +1,40 @@
+import { BackendClient } from "@monorepo-single-stack/backend/Client";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import React from "react";
+import ReactDOM from "react-dom/client";
+
+const API_URL = import.meta.env.VITE_API_URL ?? "http://localhost:8787";
+
+const client = BackendClient(API_URL).pipe(
+  Effect.provide(FetchHttpClient.layer),
+);
+
+function App() {
+  const [message, setMessage] = React.useState<string>("loading…");
+
+  React.useEffect(() => {
+    client
+      .pipe(
+        Effect.flatMap((client) => client.Hello.hello()),
+        Effect.map((greeting) => greeting.message),
+        Effect.runPromise,
+      )
+      .then(setMessage, (err) => setMessage(`error: ${String(err)}`));
+  }, []);
+
+  return (
+    <main>
+      <h1>{message}</h1>
+      <p>
+        Edit <code>src/main.tsx</code> and redeploy.
+      </p>
+    </main>
+  );
+}
+
+ReactDOM.createRoot(document.getElementById("root")!).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>,
+);
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/tsconfig.json b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/tsconfig.json
new file mode 100644
index 00000000000..6a5669c3973
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/frontend/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../tsconfig.base.json",
+  "include": ["src"],
+  "references": [{ "path": "../backend" }],
+  "compilerOptions": {
+    "types": ["bun", "vite/client"],
+    "composite": true,
+    "noEmit": true
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/tsconfig.base.json b/.repos/alchemy-effect/examples/monorepo-single-stack/tsconfig.base.json
new file mode 100644
index 00000000000..6ed87e427e5
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/tsconfig.base.json
@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": ["ESNext", "DOM"],
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "moduleDetection": "force",
+    "jsx": "react-jsx",
+    "allowJs": true,
+    "allowImportingTsExtensions": true,
+    "rewriteRelativeImportExtensions": true,
+    "verbatimModuleSyntax": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  }
+}
diff --git a/.repos/alchemy-effect/examples/monorepo-single-stack/tsconfig.json b/.repos/alchemy-effect/examples/monorepo-single-stack/tsconfig.json
new file mode 100644
index 00000000000..f763d3b3dd3
--- /dev/null
+++ b/.repos/alchemy-effect/examples/monorepo-single-stack/tsconfig.json
@@ -0,0 +1,4 @@
+{
+  "files": [],
+  "references": [{ "path": "./backend" }, { "path": "./frontend" }]
+}
diff --git a/.repos/alchemy-effect/images/alchemy-effect-layers.png b/.repos/alchemy-effect/images/alchemy-effect-layers.png
new file mode 100644
index 00000000000..01051ed5719
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-layers.png differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect-output.png b/.repos/alchemy-effect/images/alchemy-effect-output.png
new file mode 100644
index 00000000000..37c805a9390
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-output.png differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect-plan-type.png b/.repos/alchemy-effect/images/alchemy-effect-plan-type.png
new file mode 100644
index 00000000000..c6f94608694
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-plan-type.png differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect-plan.gif b/.repos/alchemy-effect/images/alchemy-effect-plan.gif
new file mode 100644
index 00000000000..4efd152aab5
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-plan.gif differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect-policy-error.png b/.repos/alchemy-effect/images/alchemy-effect-policy-error.png
new file mode 100644
index 00000000000..80be88e5031
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-policy-error.png differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect-triad.png b/.repos/alchemy-effect/images/alchemy-effect-triad.png
new file mode 100644
index 00000000000..d82b2c53fcd
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-triad.png differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect-triple.png b/.repos/alchemy-effect/images/alchemy-effect-triple.png
new file mode 100644
index 00000000000..f791fa78e0b
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect-triple.png differ
diff --git a/.repos/alchemy-effect/images/alchemy-effect.gif b/.repos/alchemy-effect/images/alchemy-effect.gif
new file mode 100644
index 00000000000..95ea4db3f64
Binary files /dev/null and b/.repos/alchemy-effect/images/alchemy-effect.gif differ
diff --git a/.repos/alchemy-effect/images/readme-hero.png b/.repos/alchemy-effect/images/readme-hero.png
new file mode 100644
index 00000000000..9ece6546ffd
Binary files /dev/null and b/.repos/alchemy-effect/images/readme-hero.png differ
diff --git a/.repos/alchemy-effect/package.json b/.repos/alchemy-effect/package.json
new file mode 100644
index 00000000000..47b537ed46e
--- /dev/null
+++ b/.repos/alchemy-effect/package.json
@@ -0,0 +1,142 @@
+{
+  "name": "alchemy-monorepo",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/alchemy-run/alchemy-effect"
+  },
+  "type": "module",
+  "module": "./lib/index.js",
+  "scripts": {
+    "audit:service": "bun scripts/audit-service.ts",
+    "build:clean": "bun clean . && bun i && bun run build && bun download:env",
+    "build:clean:shallow": "bun clean:shallow . && bun run build",
+    "build": "bun tsc -b && bun run --filter ./website --filter './packages/*' build",
+    "build:packages": "bun tsc -b && bun run --filter './packages/*' build",
+    "bump": "bun ./scripts/release/bump.ts",
+    "clean:shallow": "rm -rf alchemy/*.tgz && bun tsc -b --clean",
+    "clean": "git clean -fqdx -e .env",
+    "dev": "tsc -b -w & bun run --filter alchemy dev",
+    "dev:website": "cd ./website && bun astro dev",
+    "deploy:website": "cd ./website && bun run build:reference && bun alchemy deploy",
+    "deploy:website:prod": "bun deploy:website --stage prod --profile prod",
+    "destroy:website": "cd ./website && bun alchemy destroy",
+    "destroy:website:prod": "bun destroy:website --stage prod --profile prod",
+    "deploy:github": "doppler run -c dev --project alchemy-v2 -- bun alchemy deploy ./stacks/github.ts --profile admin",
+    "logs:otel": "doppler run -c dev --project alchemy-v2 -- bun alchemy logs ./stacks/otel.ts",
+    "logs:otel:prod": "bun logs:otel --profile prod --stage prod",
+    "deploy:otel": "doppler run -c dev --project alchemy-v2 -- bun alchemy deploy ./stacks/otel.ts",
+    "deploy:otel:prod": "bun deploy:otel --profile prod --stage prod",
+    "destroy:github": "doppler run -c dev --project alchemy-v2 -- bun alchemy destroy ./stacks/github.ts --profile admin",
+    "destroy:otel": "doppler run -c dev --project alchemy-v2 -- bun alchemy destroy ./stacks/otel.ts --profile admin",
+    "destroy:otel:prod": "bun destroy:otel --profile prod --stage prod",
+    "download:cfn": "bun scripts/generate-cfn-docs.ts",
+    "download:env": "doppler secrets download --project alchemy-v2 --config dev --no-file --format env > .env",
+    "download:external": "bun download:env && bun download:cfn && bun download:terraform",
+    "format:check": "bun run format -- --check",
+    "format": "oxfmt '.'",
+    "generate:api-reference": "bun scripts/generate-api-reference.ts",
+    "generate:docs": "bun scripts/generate-docs.ts",
+    "install:clean": "rm -rf node_modules examples/**/node_modules alchemy/node_modules && bun i",
+    "nuke:aws:run": "bash scripts/nuke-aws.sh --no-dry-run --no-prompt --prompt-delay 3",
+    "nuke:aws": "bash scripts/nuke-aws.sh",
+    "opencode": "OPENCODE_EXPERIMENTAL_OXFMT=true opencode",
+    "publish:npm": "bun run build && bun run --filter alchemy publish:npm",
+    "setup": "effect-language-service patch && bun run download:external",
+    "sync:submodules": "git submodule sync --recursive && git submodule update --init --recursive",
+    "test:benchmark": "bun run --filter alchemy test:benchmark",
+    "test:examples": "bun run --filter ./examples/cloudflare-worker --filter ./examples/cloudflare-worker-async --filter ./examples/cloudflare-tanstack --filter ./examples/cloudflare-tanstack-start-solid --filter ./examples/aws-lambda test && bun format",
+    "test:smoke": "bun test --only-failures ./test/smoke.test.ts",
+    "test:canary": "SMOKE_CANARY=1 bun test --only-failures ./test/smoke.test.ts",
+    "test:fast": "FAST=1 bun run test:live",
+    "test:live": "bun ./scripts/test.ts",
+    "test:local": "LOCAL=1 bun ./scripts/test.ts",
+    "test": "bun run test:live",
+    "prepare": "husky"
+  },
+  "workspaces": {
+    "packages": [
+      "website",
+      "packages/*",
+      "examples/*",
+      "examples/monorepo-single-stack/*",
+      "examples/monorepo-multi-stack/*"
+    ],
+    "catalog": {
+      "@alchemy.run/node-utils": "0.0.4",
+      "@aws-sdk/credential-providers": "^3.0.0",
+      "@cloudflare/containers": "^0.1.1",
+      "@cloudflare/vite-plugin": "^1.13.12",
+      "@cloudflare/workers-types": "^4.20250805.0",
+      "@distilled.cloud/aws": "^0.22.4",
+      "@distilled.cloud/axiom": "^0.22.4",
+      "@distilled.cloud/cloudflare-rolldown-plugin": "0.10.1",
+      "@distilled.cloud/cloudflare-runtime": "0.10.1",
+      "@distilled.cloud/cloudflare-vite-plugin": "0.10.1",
+      "@distilled.cloud/cloudflare": "^0.22.4",
+      "@distilled.cloud/core": "^0.22.4",
+      "@distilled.cloud/neon": "^0.22.4",
+      "@distilled.cloud/planetscale": "^0.22.4",
+      "@effect/language-service": ">=4.0.0-beta.74 || >=4.0.0",
+      "@effect/platform-bun": ">=4.0.0-beta.74 || >=4.0.0",
+      "@effect/platform-node-shared": ">=4.0.0-beta.74 || >=4.0.0",
+      "@effect/platform-node": ">=4.0.0-beta.74 || >=4.0.0",
+      "@effect/sql-pg": ">=4.0.0-beta.74 || >=4.0.0",
+      "@effect/vitest": ">=4.0.0-beta.74 || >=4.0.0",
+      "@libsql/client": "^0.17.0",
+      "@opentui/core": "latest",
+      "@opentui/solid": "latest",
+      "@smithy/node-config-provider": "^4.0.0",
+      "@smithy/shared-ini-file-loader": "^4.3.4",
+      "@smithy/types": "^4.8.1",
+      "@types/aws-lambda": "^8.10.152",
+      "@types/bun": "latest",
+      "@types/node": "latest",
+      "@typescript/native-preview": "latest",
+      "ai": "^6.0.62",
+      "aws4fetch": "^1.0.20",
+      "better-auth": "^1.6.2",
+      "drizzle-kit": ">=1.0.0-rc.1",
+      "drizzle-orm": ">=1.0.0-rc.1",
+      "effect": ">=4.0.0-beta.74 || >=4.0.0",
+      "fast-xml-parser": "^5.3.4",
+      "rolldown": "1.0.1",
+      "solid-js": "latest",
+      "sonda": "^0.11.1",
+      "typescript": "^6.0.3",
+      "vite": "^8.0.7",
+      "web-tree-sitter": "0.25.10",
+      "ws": "^8.20.0",
+      "yaml": "^2.0.0"
+    }
+  },
+  "devDependencies": {
+    "@alchemy.run/pr-package": "workspace:*",
+    "@ark/attest": "^0.56.0",
+    "@cloudflare/puppeteer": "^1.1.0",
+    "@distilled.cloud/cloudflare": "catalog:",
+    "@effect/language-service": "^0.77.0",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@types/bun": "latest",
+    "@types/node": "latest",
+    "@typescript/native-preview": "^7.0.0-dev.20260317.1",
+    "@vitest/ui": "^4.1.0",
+    "alchemy": "workspace:*",
+    "bun-types": "^1.3.8",
+    "changelogithub": "^13.16.1",
+    "dotenv": "^17.2.3",
+    "effect": "catalog:",
+    "husky": "^9.1.7",
+    "oxfmt": "latest",
+    "oxlint": "latest",
+    "pkg-pr-new": "^0.0.62",
+    "ts-morph": "^27.0.2",
+    "typescript": "latest",
+    "vite-tsconfig-paths": "^6.1.1",
+    "vitest": "^4.0.18",
+    "yaml": "^2.8.2"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/packages/alchemy/.gitignore b/.repos/alchemy-effect/packages/alchemy/.gitignore
new file mode 100644
index 00000000000..d36977dc476
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/.gitignore
@@ -0,0 +1 @@
+.tmp
diff --git a/.repos/alchemy-effect/packages/alchemy/bin/alchemy.sh b/.repos/alchemy-effect/packages/alchemy/bin/alchemy.sh
new file mode 100755
index 00000000000..255fb685c20
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/bin/alchemy.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Auto-generated by scripts/hoist-alchemy-bin.ts. Do not edit.
+# Dev-only shim: runs alchemy.ts under bun, falls back to alchemy.js under node.
+RUNTIME=node
+case "$npm_execpath" in
+  *bun*) RUNTIME=bun ;;
+esac
+if [ "$RUNTIME" = "node" ] && command -v bun >/dev/null 2>&1; then
+  RUNTIME=bun
+fi
+if [ "$RUNTIME" = "bun" ]; then
+  exec bun "/Users/samgoodwin/workspaces/alchemy-effect/packages/alchemy/bin/alchemy.ts" "$@"
+else
+  exec node "/Users/samgoodwin/workspaces/alchemy-effect/packages/alchemy/bin/alchemy.js" "$@"
+fi
diff --git a/.repos/alchemy-effect/packages/alchemy/bin/alchemy.ts b/.repos/alchemy-effect/packages/alchemy/bin/alchemy.ts
new file mode 100644
index 00000000000..e5eeb041967
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/bin/alchemy.ts
@@ -0,0 +1,5 @@
+import { runMain } from "alchemy/Util/PlatformServices";
+
+import { main } from "alchemy/Cli";
+
+main.pipe(runMain);
diff --git a/.repos/alchemy-effect/packages/alchemy/bin/cli.js b/.repos/alchemy-effect/packages/alchemy/bin/cli.js
new file mode 100755
index 00000000000..19392f61101
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/bin/cli.js
@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// alchemy CLI launcher
+//
+// Resolves the alchemy CLI entrypoint via node module resolution and execs it
+// under whichever runtime the user invoked us with. The shebang forces this
+// launcher to run as node even when bun was the invoker, but bun forwards
+// signals about itself via env vars on every child it spawns:
+//
+//   - `npm_execpath`           → path to bun (set for `bun run <script>`)
+//   - `npm_config_user_agent`  → "bun/<version> ..." (set for `bun run`,
+//                                `bunx`, and direct bun-launched bins)
+//
+// Either signal is enough to know bun is the outer runtime.
+//
+// Dev vs published: when this launcher runs out of an alchemy checkout
+// (i.e. *not* from inside a `node_modules/` tree) and bun is available, we
+// run the .ts source directly so dev iteration is edit → reload, no rebuild.
+// The published tarball ships the .ts files as well (alchemy's `bun`/`worker`
+// exports point at .ts source), but consumers install into `node_modules/`,
+// so the path check sends them to the bundled `alchemy.js` regardless.
+//
+// We use @alchemy.run/node-utils' foreground-child so we can pipe the
+// child's stderr through a filter — upstream hardcodes stdio = [0, 1, 2],
+// so the only way to drop bun's hard-coded watcher warning ("warn: File
+// <path> is not in the project directory and will not be watched", which is
+// noise in our monorepo and has no bun flag to silence) is to own the spawn
+// call. Everything else — signal proxying, watchdog, IPC bridging, exit-code
+// forwarding — matches upstream.
+import { fileURLToPath } from "node:url";
+import path from "pathe";
+import { foregroundChild } from "@alchemy.run/node-utils";
+
+const execpath = (process.env.npm_execpath ?? "").toLowerCase();
+const userAgent = (process.env.npm_config_user_agent ?? "").toLowerCase();
+const invokedByBun = execpath.includes("bun") || userAgent.startsWith("bun/");
+
+// Derive the bin dir from this launcher's own location rather than
+// require.resolve("alchemy/bin/alchemy.js"). The bundled alchemy.js is a
+// build artifact (tsdown output) and may not exist in a fresh checkout
+// (e.g. CI before `bun run build`); resolving it would throw
+// MODULE_NOT_FOUND before we get a chance to fall back to the .ts source.
+const binDir = path.dirname(fileURLToPath(import.meta.url));
+const jsEntry = path.join(binDir, "alchemy.js");
+const tsEntry = path.join(binDir, "alchemy.ts");
+
+// Treat any install-tree path as published.
+const isDev = !(
+  binDir.includes("/node_modules/") || binDir.includes("\\node_modules\\")
+);
+
+// We no longer force bun in dev when node is the invoker because this prevents us from testing in node.
+const runtime = invokedByBun ? "bun" : "node";
+
+const args = [];
+
+if (runtime === "bun" && isDev) {
+  // Pin bun's tsconfig to alchemy's, not whatever happens to be in the
+  // invoking workspace's cwd. Bun's default is `$cwd/tsconfig.json`, which
+  // means invoking `alchemy` from e.g. `examples/cloudflare-solidstart`
+  // would transpile alchemy's own .tsx files with that example's JSX
+  // settings (jsx: "preserve", jsxImportSource: "solid-js"), breaking the
+  // React files inside the alchemy CLI.
+  args.push(`--tsconfig-override=${path.join(binDir, "..", "tsconfig.json")}`);
+}
+
+// .ts only runs under bun.
+args.push(runtime === "bun" ? tsEntry : jsEntry, ...process.argv.slice(2));
+
+process.on("uncaughtException", (error) => {
+  // STATUS_CONTROL_C_EXIT on Windows — the watchdog inherits Ctrl-C from the
+  // console and exits with this code instead of a SIGINT signal.
+  const WIN_CTRL_C = 3221225786;
+  if (
+    error.message.includes(
+      "foreground-child watchdog process died unexpectedly!",
+    ) &&
+    typeof error.cause === "object" &&
+    error.cause !== null &&
+    "watchedProcess" in error.cause &&
+    error.cause.watchedProcess !== null &&
+    "cmd" in error.cause.watchedProcess &&
+    (error.cause.signal === "SIGINT" || error.cause.code === WIN_CTRL_C)
+  ) {
+    console.log("Interrupted.");
+    process.exit(0);
+  }
+  console.error(error);
+});
+
+// Substring match (not regex) — bun may wrap the line in ANSI color codes
+// when stderr is piped to a TTY-aware parent, so anchored regex is fragile.
+foregroundChild(runtime, args, {
+  stderrFilter: (line) =>
+    !line.includes("is not in the project directory and will not be watched"),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/bin/exec.ts b/.repos/alchemy-effect/packages/alchemy/bin/exec.ts
new file mode 100644
index 00000000000..28723af66d8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/bin/exec.ts
@@ -0,0 +1,4 @@
+import { exec } from "alchemy/Cli";
+import { runMain } from "alchemy/Util/PlatformServices";
+
+exec().pipe(runMain);
diff --git a/.repos/alchemy-effect/packages/alchemy/package.json b/.repos/alchemy-effect/packages/alchemy/package.json
new file mode 100644
index 00000000000..85a158da1e5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/package.json
@@ -0,0 +1,385 @@
+{
+  "name": "alchemy",
+  "version": "2.0.0-beta.49",
+  "homepage": "https://alchemy.run",
+  "license": "Apache-2.0",
+  "author": "Sam Goodwin <sam@alchemy.run>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "packages/alchemy"
+  },
+  "bin": {
+    "alchemy": "./bin/cli.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "scripts": {
+    "dev": "tsdown --watch",
+    "build": "bun bundle",
+    "bundle": "tsdown",
+    "bundle:watch": "tsdown --watch",
+    "publish:npm": "cp ../README.md . && bun publish && rm README.md",
+    "test:benchmark": "tsx --tsconfig tsconfig.test.json test/types.benchmark.ts"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "import": "./lib/index.js"
+    },
+    "./*": {
+      "types": "./lib/*.d.ts",
+      "bun": "./src/*.ts",
+      "worker": "./src/*.ts",
+      "import": "./lib/*.js"
+    },
+    "./Auth": {
+      "types": "./lib/Auth/index.d.ts",
+      "bun": "./src/Auth/index.ts",
+      "worker": "./src/Auth/index.ts",
+      "import": "./lib/Auth/index.js"
+    },
+    "./AWS": {
+      "types": "./lib/AWS/index.d.ts",
+      "bun": "./src/AWS/index.ts",
+      "worker": "./src/AWS/index.ts",
+      "import": "./lib/AWS/index.js"
+    },
+    "./AWS/*": {
+      "types": "./lib/AWS/*/index.d.ts",
+      "bun": "./src/AWS/*/index.ts",
+      "worker": "./src/AWS/*/index.ts",
+      "import": "./lib/AWS/*/index.js"
+    },
+    "./AWS/Credentials": {
+      "types": "./lib/AWS/Credentials/index.d.ts",
+      "bun": "./src/AWS/Credentials/index.ts",
+      "worker": "./src/AWS/Credentials/index.ts",
+      "import": "./lib/AWS/Credentials/index.js"
+    },
+    "./AWS/Endpoint": {
+      "types": "./lib/AWS/Endpoint/index.d.ts",
+      "bun": "./src/AWS/Endpoint/index.ts",
+      "worker": "./src/AWS/Endpoint/index.ts",
+      "import": "./lib/AWS/Endpoint/index.js"
+    },
+    "./AWS/Region": {
+      "types": "./lib/AWS/Region/index.d.ts",
+      "bun": "./src/AWS/Region/index.ts",
+      "worker": "./src/AWS/Region/index.ts",
+      "import": "./lib/AWS/Region/index.js"
+    },
+    "./AWS/Profile": {
+      "types": "./lib/AWS/Profile/index.d.ts",
+      "bun": "./src/AWS/Profile/index.ts",
+      "worker": "./src/AWS/Profile/index.ts",
+      "import": "./lib/AWS/Profile/index.js"
+    },
+    "./AWS/Lambda/*": {
+      "types": "./lib/AWS/Lambda/*.d.ts",
+      "bun": "./src/AWS/Lambda/*.ts",
+      "worker": "./src/AWS/Lambda/*.ts",
+      "import": "./lib/AWS/Lambda/*.js"
+    },
+    "./Build": {
+      "types": "./lib/Build/index.d.ts",
+      "bun": "./src/Build/index.ts",
+      "worker": "./src/Build/index.ts",
+      "import": "./lib/Build/index.js"
+    },
+    "./Construct": {
+      "types": "./lib/Construct/index.d.ts",
+      "bun": "./src/Construct/index.ts",
+      "worker": "./src/Construct/index.ts",
+      "import": "./lib/Construct/index.js"
+    },
+    "./Bundle": {
+      "types": "./lib/Bundle/index.d.ts",
+      "bun": "./src/Bundle/index.ts",
+      "worker": "./src/Bundle/index.ts",
+      "import": "./lib/Bundle/index.js"
+    },
+    "./ContentType": {
+      "types": "./lib/ContentType.d.ts",
+      "bun": "./src/ContentType.ts",
+      "worker": "./src/ContentType.ts",
+      "import": "./lib/ContentType.js"
+    },
+    "./Cli": {
+      "types": "./lib/Cli/index.d.ts",
+      "bun": "./src/Cli/index.ts",
+      "worker": "./src/Cli/index.ts",
+      "import": "./lib/Cli/index.js"
+    },
+    "./Cli/InkCLI": {
+      "types": "./lib/Cli/InkCLI.d.ts",
+      "bun": "./src/Cli/InkCLI.tsx",
+      "worker": "./src/Cli/InkCLI.tsx",
+      "import": "./lib/Cli/InkCLI.js"
+    },
+    "./Cloudflare": {
+      "types": "./lib/Cloudflare/index.d.ts",
+      "bun": "./src/Cloudflare/index.ts",
+      "worker": "./src/Cloudflare/index.ts",
+      "import": "./lib/Cloudflare/index.js"
+    },
+    "./Cloudflare/Bridge": {
+      "types": "./lib/Cloudflare/Bridge.d.ts",
+      "bun": "./src/Cloudflare/Bridge.ts",
+      "worker": "./src/Cloudflare/Bridge.ts",
+      "import": "./lib/Cloudflare/Bridge.js"
+    },
+    "./Cloudflare/Live": {
+      "types": "./lib/Cloudflare/Live.d.ts",
+      "bun": "./src/Cloudflare/Live.ts",
+      "worker": "./src/Cloudflare/Live.ts",
+      "import": "./lib/Cloudflare/Live.js"
+    },
+    "./Cloudflare/*": {
+      "types": "./lib/Cloudflare/*/index.d.ts",
+      "bun": "./src/Cloudflare/*/index.ts",
+      "worker": "./src/Cloudflare/*/index.ts",
+      "import": "./lib/Cloudflare/*/index.js"
+    },
+    "./Drizzle": {
+      "types": "./lib/Drizzle/index.d.ts",
+      "bun": "./src/Drizzle/index.ts",
+      "worker": "./src/Drizzle/index.ts",
+      "import": "./lib/Drizzle/index.js"
+    },
+    "./Axiom": {
+      "types": "./lib/Axiom/index.d.ts",
+      "bun": "./src/Axiom/index.ts",
+      "worker": "./src/Axiom/index.ts",
+      "import": "./lib/Axiom/index.js"
+    },
+    "./GitHub": {
+      "types": "./lib/GitHub/index.d.ts",
+      "bun": "./src/GitHub/index.ts",
+      "worker": "./src/GitHub/index.ts",
+      "import": "./lib/GitHub/index.js"
+    },
+    "./Endpoint": {
+      "types": "./lib/Endpoint/index.d.ts",
+      "bun": "./src/Endpoint/index.ts",
+      "worker": "./src/Endpoint/index.ts",
+      "import": "./lib/Endpoint/index.js"
+    },
+    "./Kubernetes": {
+      "types": "./lib/Kubernetes/index.d.ts",
+      "bun": "./src/Kubernetes/index.ts",
+      "worker": "./src/Kubernetes/index.ts",
+      "import": "./lib/Kubernetes/index.js"
+    },
+    "./Neon": {
+      "types": "./lib/Neon/index.d.ts",
+      "bun": "./src/Neon/index.ts",
+      "worker": "./src/Neon/index.ts",
+      "import": "./lib/Neon/index.js"
+    },
+    "./Neon/*": {
+      "types": "./lib/Neon/*/index.d.ts",
+      "bun": "./src/Neon/*/index.ts",
+      "worker": "./src/Neon/*/index.ts",
+      "import": "./lib/Neon/*/index.js"
+    },
+    "./Output": {
+      "types": "./lib/Output.d.ts",
+      "bun": "./src/Output.ts",
+      "worker": "./src/Output.ts",
+      "import": "./lib/Output.js"
+    },
+    "./Planetscale": {
+      "types": "./lib/Planetscale/index.d.ts",
+      "bun": "./src/Planetscale/index.ts",
+      "worker": "./src/Planetscale/index.ts",
+      "import": "./lib/Planetscale/index.js"
+    },
+    "./Planetscale/*": {
+      "types": "./lib/Planetscale/*/index.d.ts",
+      "bun": "./src/Planetscale/*/index.ts",
+      "worker": "./src/Planetscale/*/index.ts",
+      "import": "./lib/Planetscale/*/index.js"
+    },
+    "./Runtime": {
+      "types": "./lib/Runtime.d.ts",
+      "bun": "./src/Runtime.ts",
+      "worker": "./src/Runtime.ts",
+      "import": "./lib/Runtime.js"
+    },
+    "./Process": {
+      "types": "./lib/Process/index.d.ts",
+      "bun": "./src/Process/index.ts",
+      "worker": "./src/Process/index.ts",
+      "import": "./lib/Process/index.js"
+    },
+    "./SQLite": {
+      "types": "./lib/SQLite/index.d.ts",
+      "bun": "./src/SQLite/index.ts",
+      "worker": "./src/SQLite/index.ts",
+      "import": "./lib/SQLite/index.js"
+    },
+    "./TUI": {
+      "types": "./lib/TUI/index.d.ts",
+      "bun": "./src/TUI/index.ts",
+      "worker": "./src/TUI/index.ts",
+      "import": "./lib/TUI/index.js"
+    },
+    "./Server": {
+      "types": "./lib/Server/index.d.ts",
+      "bun": "./src/Server/index.ts",
+      "worker": "./src/Server/index.ts",
+      "import": "./lib/Server/index.js"
+    },
+    "./Stack": {
+      "types": "./lib/Stack.d.ts",
+      "bun": "./src/Stack.ts",
+      "worker": "./src/Stack.ts",
+      "import": "./lib/Stack.js"
+    },
+    "./State": {
+      "types": "./lib/State/index.d.ts",
+      "bun": "./src/State/index.ts",
+      "worker": "./src/State/index.ts",
+      "import": "./lib/State/index.js"
+    },
+    "./State/*": {
+      "types": "./lib/State/*.d.ts",
+      "bun": "./src/State/*.ts",
+      "worker": "./src/State/*.ts",
+      "import": "./lib/State/*.js"
+    },
+    "./Test/Bun": {
+      "types": "./lib/Test/Bun.d.ts",
+      "bun": "./src/Test/Bun.ts",
+      "worker": "./src/Test/Bun.ts",
+      "import": "./lib/Test/Bun.js"
+    },
+    "./Util": {
+      "types": "./lib/Util/index.d.ts",
+      "bun": "./src/Util/index.ts",
+      "worker": "./src/Util/index.ts",
+      "import": "./lib/Util/index.js"
+    },
+    "./Util/Clank": {
+      "types": "./lib/Util/Clank.d.ts",
+      "bun": "./src/Util/Clank.ts",
+      "worker": "./src/Util/Clank.ts",
+      "import": "./lib/Util/Clank.js"
+    },
+    "./Util/PlatformServices": {
+      "types": "./lib/Util/PlatformServices.d.ts",
+      "bun": "./src/Util/PlatformServices.ts",
+      "worker": "./src/Util/PlatformServices.ts",
+      "import": "./lib/Util/PlatformServices.js"
+    },
+    "./bin/alchemy.js": "./bin/alchemy.js",
+    "./bin/exec.ts": "./bin/exec.ts",
+    "./bin/exec.js": "./bin/exec.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@alchemy.run/node-utils": "catalog:",
+    "@aws-sdk/credential-providers": "catalog:",
+    "@clack/prompts": "^0.11.0",
+    "@distilled.cloud/aws": "catalog:",
+    "@distilled.cloud/axiom": "catalog:",
+    "@distilled.cloud/cloudflare": "catalog:",
+    "@distilled.cloud/cloudflare-rolldown-plugin": "catalog:",
+    "@distilled.cloud/cloudflare-runtime": "catalog:",
+    "@distilled.cloud/cloudflare-vite-plugin": "catalog:",
+    "@distilled.cloud/core": "catalog:",
+    "@distilled.cloud/neon": "catalog:",
+    "@distilled.cloud/planetscale": "catalog:",
+    "@effect/vitest": "catalog:",
+    "@libsql/client": "catalog:",
+    "@octokit/rest": "^22.0.1",
+    "@smithy/node-config-provider": "catalog:",
+    "@smithy/shared-ini-file-loader": "catalog:",
+    "@smithy/types": "catalog:",
+    "@types/aws-lambda": "catalog:",
+    "aws4fetch": "catalog:",
+    "capnweb": "^0.6.1",
+    "fast-glob": "^3.3.2",
+    "fast-xml-parser": "catalog:",
+    "ink": "^6.3.1",
+    "jszip": "^3.10.1",
+    "libsodium-wrappers": "^0.8.3",
+    "magic-string": "^0.30.21",
+    "mysql2": "^3.15.3",
+    "pathe": "^2.0.3",
+    "pg": "^8.13.0",
+    "picomatch": "^4.0.4",
+    "react": "^19.2.0",
+    "rolldown": "catalog:",
+    "undici": "^7.16.0",
+    "yaml": "catalog:"
+  },
+  "devDependencies": {
+    "@clack/prompts": "^0.11.0",
+    "@cloudflare/workers-types": "catalog:",
+    "@cloudflare/puppeteer": "^1.1.0",
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@effect/platform-node-shared": "catalog:",
+    "@oxc-project/types": "^0.127.0",
+    "@types/pg": "^8.11.0",
+    "@types/aws-lambda": "catalog:",
+    "@types/bun": "catalog:",
+    "@types/node": "catalog:",
+    "@types/picomatch": "^4.0.0",
+    "@types/react": "^19.2.2",
+    "@types/ws": "^8.18.1",
+    "better-auth": "catalog:",
+    "effect": "catalog:",
+    "react-devtools-core": "^7.0.1",
+    "solid-js": "catalog:",
+    "tsconfig-paths": "^4.2.0",
+    "tsdown": "^0.15.4",
+    "tsx": "^4.20.6",
+    "typescript": "catalog:",
+    "ws": "catalog:"
+  },
+  "peerDependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@effect/sql-pg": "catalog:",
+    "drizzle-kit": "catalog:",
+    "drizzle-orm": "catalog:",
+    "effect": "catalog:",
+    "vite": "catalog:",
+    "ws": "catalog:"
+  },
+  "peerDependenciesMeta": {
+    "@effect/platform-node": {
+      "optional": true
+    },
+    "@effect/platform-bun": {
+      "optional": true
+    },
+    "@effect/sql-pg": {
+      "optional": true
+    },
+    "drizzle-kit": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "vite": {
+      "optional": true
+    },
+    "ws": {
+      "optional": true
+    }
+  }
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/scripts/clean-aws.ts b/.repos/alchemy-effect/packages/alchemy/scripts/clean-aws.ts
new file mode 100644
index 00000000000..a8f9ea3cb1b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/scripts/clean-aws.ts
@@ -0,0 +1,780 @@
+#!/usr/bin/env bun
+
+// @ts-nocheck
+
+import * as Credentials from "@distilled.cloud/aws/Credentials";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import { NodeServices } from "@effect/platform-node";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { parseArgs } from "node:util";
+
+const { values } = parseArgs({
+  args: Bun.argv.slice(2),
+  options: {
+    region: { type: "string", short: "r" },
+    profile: { type: "string", short: "p" },
+    execute: { type: "boolean" },
+    "include-default-vpcs": { type: "boolean" },
+    passes: { type: "string" },
+    help: { type: "boolean", short: "h" },
+  },
+  strict: true,
+});
+
+const usage = `
+Best-effort EC2 regional cleanup using @distilled.cloud/aws.
+
+Usage:
+  bun alchemy/scripts/clean-aws.ts --region us-east-1 [--profile dev]
+  bun alchemy/scripts/clean-aws.ts --region us-east-1 --execute
+
+Options:
+  --region, -r              AWS region to clean
+  --profile, -p             Optional AWS profile
+  --execute                 Perform deletions (default is dry-run)
+  --include-default-vpcs    Also attempt to delete default VPC resources
+  --passes                  Cleanup passes to run (default: 1 dry-run, 4 execute)
+  --help, -h                Show this help
+`;
+
+if (values.help) {
+  console.log(usage.trim());
+  process.exit(0);
+}
+
+const region =
+  values.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+if (!region) {
+  console.error("Missing --region. Set it explicitly or via AWS_REGION.");
+  console.error(usage.trim());
+  process.exit(1);
+}
+
+if (values.profile) {
+  process.env.AWS_PROFILE = values.profile;
+}
+
+const execute = values.execute ?? false;
+const includeDefaultVpcs = values["include-default-vpcs"] ?? false;
+const maxPasses = Number(values.passes ?? (execute ? "4" : "1"));
+
+if (!Number.isFinite(maxPasses) || maxPasses < 1) {
+  console.error("--passes must be a positive integer.");
+  process.exit(1);
+}
+
+const credentialsLayer = values.profile
+  ? Layer.provideMerge(
+      Credentials.fromSSO(values.profile),
+      Layer.mergeAll(NodeServices.layer, FetchHttpClient.layer),
+    )
+  : Credentials.fromChain();
+
+const runtime = Layer.mergeAll(
+  NodeServices.layer,
+  FetchHttpClient.layer,
+  credentialsLayer,
+  Layer.succeed(Region, region),
+);
+
+const formatError = (error: unknown) => {
+  if (typeof error === "object" && error && "_tag" in error) {
+    const tagged = error as { _tag: string; message?: string };
+    return tagged.message ? `${tagged._tag}: ${tagged.message}` : tagged._tag;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  try {
+    return JSON.stringify(error);
+  } catch {
+    return String(error);
+  }
+};
+
+const log = (message: string) => Effect.sync(() => console.log(message));
+const warn = (message: string) => Effect.sync(() => console.warn(message));
+
+const isNotFoundError = (error: unknown) =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  String((error as { _tag: string })._tag).includes("NotFound");
+
+const uniq = <T>(items: ReadonlyArray<T | null | undefined>) => [
+  ...new Set(
+    items.filter((item): item is T => item !== null && item !== undefined),
+  ),
+];
+
+const chunk = <T>(items: ReadonlyArray<T>, size: number) => {
+  const groups: T[][] = [];
+  for (let index = 0; index < items.length; index += size) {
+    groups.push(items.slice(index, index + size));
+  }
+  return groups;
+};
+
+const preview = (label: string, ids: ReadonlyArray<string>) =>
+  ids.length === 0
+    ? Effect.void
+    : log(`Found ${ids.length} ${label}: ${ids.join(", ")}`);
+
+const ignoreFailure = <A, E, R>(
+  label: string,
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<void, E, R> =>
+  effect.pipe(
+    Effect.asVoid,
+    Effect.catch((error) =>
+      isNotFoundError(error)
+        ? warn(`Already gone ${label}: ${formatError(error)}`)
+        : Effect.fail(error as E),
+    ),
+  );
+
+const deleteEach = <R>(
+  label: string,
+  ids: ReadonlyArray<string>,
+  remove: (id: string) => Effect.Effect<any, any, R>,
+) =>
+  Effect.gen(function* () {
+    if (ids.length === 0) {
+      return;
+    }
+
+    yield* preview(label, ids);
+    if (!execute) {
+      return;
+    }
+
+    yield* Effect.forEach(
+      ids,
+      (id) => ignoreFailure(`${label} ${id}`, remove(id)),
+      {
+        concurrency: 1,
+        discard: true,
+      },
+    );
+  });
+
+const repeatUntil = <A, E, R>(
+  label: string,
+  effect: Effect.Effect<A, E, R>,
+  done: (value: A) => boolean,
+  attempts: number,
+  delayMs: number,
+): Effect.Effect<void, E, R> =>
+  Effect.gen(function* () {
+    const value = yield* effect;
+    if (done(value)) {
+      return;
+    }
+    if (attempts <= 1) {
+      yield* warn(`Timed out waiting for ${label}.`);
+      return;
+    }
+    yield* log(`Waiting for ${label}...`);
+    yield* Effect.sleep(delayMs);
+    yield* repeatUntil(label, effect, done, attempts - 1, delayMs);
+  });
+
+const terminateInstances = Effect.gen(function* () {
+  const response = yield* ec2.describeInstances({} as any);
+  const ids = uniq(
+    (response.Reservations ?? []).flatMap((reservation: any) =>
+      (reservation.Instances ?? [])
+        .filter((instance: any) => {
+          const state = instance.State?.Name;
+          return state !== "shutting-down" && state !== "terminated";
+        })
+        .map((instance: any) => instance.InstanceId),
+    ),
+  );
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("instance(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  for (const group of chunk(ids, 100)) {
+    yield* ignoreFailure(
+      `instances ${group.join(", ")}`,
+      ec2.terminateInstances({ InstanceIds: group } as any),
+    );
+  }
+
+  yield* repeatUntil(
+    "instances to terminate",
+    ec2
+      .describeInstances({} as any)
+      .pipe(
+        Effect.map((result) =>
+          uniq(
+            (result.Reservations ?? []).flatMap((reservation: any) =>
+              (reservation.Instances ?? [])
+                .filter((instance: any) => ids.includes(instance.InstanceId))
+                .map((instance: any) => instance.State?.Name),
+            ),
+          ),
+        ),
+      ),
+    (states) => states.every((state) => state === "terminated"),
+    40,
+    5_000,
+  );
+});
+
+const deleteVpcEndpoints = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeVpcEndpoints({} as any)).VpcEndpoints?.map(
+      (endpoint: any) => endpoint.VpcEndpointId,
+    ),
+  );
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("VPC endpoint(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  for (const group of chunk(ids, 25)) {
+    yield* ignoreFailure(
+      `VPC endpoints ${group.join(", ")}`,
+      ec2.deleteVpcEndpoints({ VpcEndpointIds: group } as any),
+    );
+  }
+
+  yield* repeatUntil(
+    "VPC endpoints to delete",
+    ec2.describeVpcEndpoints({ VpcEndpointIds: ids } as any).pipe(
+      Effect.map((result) =>
+        uniq(
+          (result.VpcEndpoints ?? []).map(
+            (endpoint: any) => endpoint.VpcEndpointId,
+          ),
+        ),
+      ),
+      Effect.catch((error) =>
+        isNotFoundError(error)
+          ? Effect.succeed([] as string[])
+          : Effect.fail(error),
+      ),
+    ),
+    (remainingIds) => remainingIds.length === 0,
+    30,
+    5_000,
+  );
+});
+
+const deleteNatGateways = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeNatGateways({} as any)).NatGateways?.filter(
+      (natGateway: any) => natGateway.State !== "deleted",
+    ).map((natGateway: any) => natGateway.NatGatewayId),
+  );
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("NAT gateway(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  yield* Effect.forEach(
+    ids,
+    (id) =>
+      ignoreFailure(
+        `NAT gateway ${id}`,
+        ec2.deleteNatGateway({ NatGatewayId: id } as any),
+      ),
+    { concurrency: 1, discard: true },
+  );
+
+  yield* repeatUntil(
+    "NAT gateways to delete",
+    ec2
+      .describeNatGateways({} as any)
+      .pipe(
+        Effect.map((result) =>
+          uniq(
+            (result.NatGateways ?? [])
+              .filter((natGateway: any) =>
+                ids.includes(natGateway.NatGatewayId),
+              )
+              .map((natGateway: any) => natGateway.State),
+          ),
+        ),
+      ),
+    (states) => states.every((state) => state === "deleted"),
+    30,
+    10_000,
+  );
+});
+
+const deleteNetworkInterfaces = Effect.gen(function* () {
+  const interfaces =
+    (yield* ec2.describeNetworkInterfaces({} as any)).NetworkInterfaces ?? [];
+
+  const blocked = interfaces.filter(
+    (networkInterface: any) =>
+      networkInterface.Attachment ||
+      networkInterface.RequesterManaged ||
+      networkInterface.Status !== "available",
+  );
+
+  if (blocked.length > 0) {
+    return yield* Effect.fail(
+      new Error(
+        `Network interfaces still in use: ${blocked
+          .map(
+            (networkInterface: any) =>
+              `${networkInterface.NetworkInterfaceId}(status=${networkInterface.Status ?? "unknown"}, requesterManaged=${networkInterface.RequesterManaged ?? false}, attachment=${networkInterface.Attachment?.AttachmentId ?? "none"})`,
+          )
+          .join(", ")}`,
+      ),
+    );
+  }
+
+  const ids = uniq(
+    interfaces.map(
+      (networkInterface: any) => networkInterface.NetworkInterfaceId,
+    ),
+  );
+
+  yield* deleteEach("network interface(s)", ids, (id) =>
+    ec2.deleteNetworkInterface({ NetworkInterfaceId: id } as any),
+  );
+});
+
+const releaseElasticIps = Effect.gen(function* () {
+  const addresses = (yield* ec2.describeAddresses({} as any)).Addresses ?? [];
+  const ids = uniq(
+    addresses.map((address: any) => address.AllocationId ?? address.PublicIp),
+  );
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("elastic IP(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  yield* Effect.forEach(
+    addresses,
+    (address: any) =>
+      Effect.gen(function* () {
+        if (address.AssociationId) {
+          yield* ignoreFailure(
+            `elastic IP association ${address.AssociationId}`,
+            ec2.disassociateAddress({
+              AssociationId: address.AssociationId,
+            } as any),
+          );
+        }
+        yield* ignoreFailure(
+          `elastic IP ${address.AllocationId ?? address.PublicIp}`,
+          ec2.releaseAddress(
+            address.AllocationId
+              ? ({ AllocationId: address.AllocationId } as any)
+              : ({ PublicIp: address.PublicIp } as any),
+          ),
+        );
+      }),
+    { concurrency: 1, discard: true },
+  );
+});
+
+const deleteVpcPeeringConnections = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeVpcPeeringConnections(
+      {} as any,
+    )).VpcPeeringConnections?.filter(
+      (connection: any) => connection.Status?.Code !== "deleted",
+    ).map((connection: any) => connection.VpcPeeringConnectionId),
+  );
+
+  yield* deleteEach("VPC peering connection(s)", ids, (id) =>
+    ec2.deleteVpcPeeringConnection({ VpcPeeringConnectionId: id } as any),
+  );
+});
+
+const deleteVpnConnections = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeVpnConnections({} as any)).VpnConnections?.filter(
+      (connection: any) => connection.State !== "deleted",
+    ).map((connection: any) => connection.VpnConnectionId),
+  );
+
+  yield* deleteEach("VPN connection(s)", ids, (id) =>
+    ec2.deleteVpnConnection({ VpnConnectionId: id } as any),
+  );
+});
+
+const deleteVpnGateways = Effect.gen(function* () {
+  const gateways =
+    (yield* ec2.describeVpnGateways({} as any)).VpnGateways ?? [];
+  const ids = uniq(
+    gateways
+      .filter((gateway: any) => gateway.State !== "deleted")
+      .map((gateway: any) => gateway.VpnGatewayId),
+  );
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("VPN gateway(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  yield* Effect.forEach(
+    gateways,
+    (gateway: any) =>
+      Effect.gen(function* () {
+        for (const attachment of gateway.VpcAttachments ?? []) {
+          if (attachment.VpcId && attachment.State !== "detached") {
+            yield* ignoreFailure(
+              `VPN gateway attachment ${gateway.VpnGatewayId}`,
+              ec2.detachVpnGateway({
+                VpcId: attachment.VpcId,
+                VpnGatewayId: gateway.VpnGatewayId,
+              } as any),
+            );
+          }
+        }
+
+        yield* ignoreFailure(
+          `VPN gateway ${gateway.VpnGatewayId}`,
+          ec2.deleteVpnGateway({ VpnGatewayId: gateway.VpnGatewayId } as any),
+        );
+      }),
+    { concurrency: 1, discard: true },
+  );
+});
+
+const deleteCustomerGateways = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeCustomerGateways({} as any)).CustomerGateways?.map(
+      (gateway: any) => gateway.CustomerGatewayId,
+    ),
+  );
+
+  yield* deleteEach("customer gateway(s)", ids, (id) =>
+    ec2.deleteCustomerGateway({ CustomerGatewayId: id } as any),
+  );
+});
+
+const deleteInternetGateways = Effect.gen(function* () {
+  const gateways =
+    (yield* ec2.describeInternetGateways({} as any)).InternetGateways ?? [];
+  const ids = uniq(gateways.map((gateway: any) => gateway.InternetGatewayId));
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("internet gateway(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  yield* Effect.forEach(
+    gateways,
+    (gateway: any) =>
+      Effect.gen(function* () {
+        for (const attachment of gateway.Attachments ?? []) {
+          if (attachment.VpcId) {
+            yield* ignoreFailure(
+              `internet gateway attachment ${gateway.InternetGatewayId}`,
+              ec2.detachInternetGateway({
+                InternetGatewayId: gateway.InternetGatewayId,
+                VpcId: attachment.VpcId,
+              } as any),
+            );
+          }
+        }
+
+        yield* ignoreFailure(
+          `internet gateway ${gateway.InternetGatewayId}`,
+          ec2.deleteInternetGateway({
+            InternetGatewayId: gateway.InternetGatewayId,
+          } as any),
+        );
+      }),
+    { concurrency: 1, discard: true },
+  );
+});
+
+const deleteEgressOnlyInternetGateways = Effect.gen(function* () {
+  const gateways =
+    (yield* ec2.describeEgressOnlyInternetGateways({} as any))
+      .EgressOnlyInternetGateways ?? [];
+  const ids = uniq(
+    gateways.map((gateway: any) => gateway.EgressOnlyInternetGatewayId),
+  );
+
+  yield* deleteEach("egress-only internet gateway(s)", ids, (id) =>
+    ec2.deleteEgressOnlyInternetGateway({
+      EgressOnlyInternetGatewayId: id,
+    } as any),
+  );
+});
+
+const deleteRouteTables = Effect.gen(function* () {
+  const routeTables =
+    (yield* ec2.describeRouteTables({} as any)).RouteTables?.filter(
+      (routeTable: any) =>
+        !(routeTable.Associations ?? []).some(
+          (association: any) => association.Main,
+        ),
+    ) ?? [];
+
+  const ids = uniq(
+    routeTables.map((routeTable: any) => routeTable.RouteTableId),
+  );
+
+  if (ids.length === 0) {
+    return;
+  }
+
+  yield* preview("non-main route table(s)", ids);
+  if (!execute) {
+    return;
+  }
+
+  yield* Effect.forEach(
+    routeTables,
+    (routeTable: any) =>
+      Effect.gen(function* () {
+        for (const association of routeTable.Associations ?? []) {
+          if (!association.Main && association.RouteTableAssociationId) {
+            yield* ignoreFailure(
+              `route table association ${association.RouteTableAssociationId}`,
+              ec2.disassociateRouteTable({
+                AssociationId: association.RouteTableAssociationId,
+              } as any),
+            );
+          }
+        }
+
+        yield* ignoreFailure(
+          `route table ${routeTable.RouteTableId}`,
+          ec2.deleteRouteTable({
+            RouteTableId: routeTable.RouteTableId,
+          } as any),
+        );
+      }),
+    { concurrency: 1, discard: true },
+  );
+});
+
+const deleteSubnets = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeSubnets({} as any)).Subnets?.filter((subnet: any) =>
+      includeDefaultVpcs ? true : !subnet.DefaultForAz,
+    ).map((subnet: any) => subnet.SubnetId),
+  );
+
+  yield* deleteEach("subnet(s)", ids, (id) =>
+    ec2.deleteSubnet({ SubnetId: id } as any),
+  );
+});
+
+const deleteSecurityGroups = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeSecurityGroups({} as any)).SecurityGroups?.filter(
+      (group: any) => group.GroupName !== "default",
+    ).map((group: any) => group.GroupId),
+  );
+
+  yield* deleteEach("security group(s)", ids, (id) =>
+    ec2.deleteSecurityGroup({ GroupId: id } as any),
+  );
+});
+
+const deleteNetworkAcls = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeNetworkAcls({} as any)).NetworkAcls?.filter(
+      (acl: any) => !acl.IsDefault,
+    ).map((acl: any) => acl.NetworkAclId),
+  );
+
+  yield* deleteEach("network ACL(s)", ids, (id) =>
+    ec2.deleteNetworkAcl({ NetworkAclId: id } as any),
+  );
+});
+
+const deleteAvailableVolumes = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeVolumes({} as any)).Volumes?.filter(
+      (volume: any) => volume.State === "available",
+    ).map((volume: any) => volume.VolumeId),
+  );
+
+  yield* deleteEach("available volume(s)", ids, (id) =>
+    ec2.deleteVolume({ VolumeId: id } as any),
+  );
+});
+
+const deregisterImages = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeImages({ Owners: ["self"] } as any)).Images?.map(
+      (image: any) => image.ImageId,
+    ),
+  );
+
+  yield* deleteEach("AMI(s)", ids, (id) =>
+    ec2.deregisterImage({ ImageId: id } as any),
+  );
+});
+
+const deleteSnapshots = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeSnapshots({
+      OwnerIds: ["self"],
+    } as any)).Snapshots?.map((snapshot: any) => snapshot.SnapshotId),
+  );
+
+  yield* deleteEach("snapshot(s)", ids, (id) =>
+    ec2.deleteSnapshot({ SnapshotId: id } as any),
+  );
+});
+
+const deleteLaunchTemplates = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeLaunchTemplates({} as any)).LaunchTemplates?.map(
+      (template: any) => template.LaunchTemplateId,
+    ),
+  );
+
+  yield* deleteEach("launch template(s)", ids, (id) =>
+    ec2.deleteLaunchTemplate({ LaunchTemplateId: id } as any),
+  );
+});
+
+const deletePlacementGroups = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describePlacementGroups({} as any)).PlacementGroups?.map(
+      (group: any) => group.GroupName,
+    ),
+  );
+
+  yield* deleteEach("placement group(s)", ids, (id) =>
+    ec2.deletePlacementGroup({ GroupName: id } as any),
+  );
+});
+
+const deleteKeyPairs = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeKeyPairs({} as any)).KeyPairs?.map(
+      (keyPair: any) => keyPair.KeyPairId,
+    ),
+  );
+
+  yield* deleteEach("key pair(s)", ids, (id) =>
+    ec2.deleteKeyPair({ KeyPairId: id } as any),
+  );
+});
+
+const deleteVpcs = Effect.gen(function* () {
+  const ids = uniq(
+    (yield* ec2.describeVpcs({} as any)).Vpcs?.filter((vpc: any) =>
+      includeDefaultVpcs ? true : !vpc.IsDefault,
+    ).map((vpc: any) => vpc.VpcId),
+  );
+
+  yield* deleteEach("VPC(s)", ids, (id) => ec2.deleteVpc({ VpcId: id } as any));
+});
+
+const deleteDhcpOptions = Effect.gen(function* () {
+  const associatedDhcpOptionsIds = new Set(
+    uniq(
+      (yield* ec2.describeVpcs({} as any)).Vpcs?.map(
+        (vpc: any) => vpc.DhcpOptionsId,
+      ),
+    ),
+  );
+
+  const ids = uniq(
+    (yield* ec2.describeDhcpOptions({} as any)).DhcpOptions?.map(
+      (dhcpOptions: any) => dhcpOptions.DhcpOptionsId,
+    ).filter(
+      (id: string) => id !== "default" && !associatedDhcpOptionsIds.has(id),
+    ),
+  );
+
+  yield* deleteEach("DHCP options set(s)", ids, (id) =>
+    ec2.deleteDhcpOptions({ DhcpOptionsId: id } as any),
+  );
+});
+
+const main = Effect.gen(function* () {
+  yield* log(
+    [
+      `Mode=${execute ? "execute" : "dry-run"}`,
+      `Region=${region}`,
+      values.profile ? `Profile=${values.profile}` : undefined,
+      includeDefaultVpcs ? "Including default VPCs" : "Skipping default VPCs",
+    ]
+      .filter((value): value is string => !!value)
+      .join(" | "),
+  );
+
+  for (let pass = 1; pass <= maxPasses; pass++) {
+    yield* log(`\n=== Cleanup pass ${pass}/${maxPasses} ===`);
+
+    yield* terminateInstances;
+    yield* deleteVpcEndpoints;
+    yield* deleteNatGateways;
+    yield* deleteNetworkInterfaces;
+    yield* releaseElasticIps;
+    yield* deleteVpnConnections;
+    yield* deleteVpnGateways;
+    yield* deleteCustomerGateways;
+    yield* deleteVpcPeeringConnections;
+    yield* deleteInternetGateways;
+    yield* deleteEgressOnlyInternetGateways;
+    yield* deleteRouteTables;
+    yield* deleteSubnets;
+    yield* deleteSecurityGroups;
+    yield* deleteNetworkAcls;
+    yield* deleteAvailableVolumes;
+    yield* deregisterImages;
+    yield* deleteSnapshots;
+    yield* deleteLaunchTemplates;
+    yield* deletePlacementGroups;
+    yield* deleteKeyPairs;
+    yield* deleteVpcs;
+    yield* deleteDhcpOptions;
+
+    if (!execute) {
+      yield* log(
+        "\nDry-run complete. Re-run with --execute to perform deletions.",
+      );
+      return;
+    }
+  }
+
+  yield* log("\nCleanup passes complete.");
+});
+
+Effect.runPromise(main.pipe(Effect.provide(runtime))).catch((error) => {
+  console.error(formatError(error));
+  process.exit(1);
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/scripts/cleanup-neon-projects.ts b/.repos/alchemy-effect/packages/alchemy/scripts/cleanup-neon-projects.ts
new file mode 100644
index 00000000000..9e145600747
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/scripts/cleanup-neon-projects.ts
@@ -0,0 +1,96 @@
+#!/usr/bin/env bun
+/**
+ * Delete every Neon project visible to `NEON_API_KEY`.
+ *
+ * Usage:
+ *   doppler run -c dev --project alchemy-v2 -- bun packages/alchemy/scripts/cleanup-neon-projects.ts
+ *   DRY_RUN=1 doppler run -c dev --project alchemy-v2 -- bun packages/alchemy/scripts/cleanup-neon-projects.ts
+ *   CONCURRENCY=4 doppler run -c dev --project alchemy-v2 -- bun packages/alchemy/scripts/cleanup-neon-projects.ts
+ *
+ * Environment:
+ *   NEON_API_KEY   Required. Injected by Doppler (`alchemy-v2` / `dev`) or `.env` via `bun download:env`.
+ *   DRY_RUN        Set to `1` to list projects without deleting.
+ *   CONCURRENCY    Parallel deletes (default 4).
+ */
+import {
+  CredentialsFromEnv,
+  deleteProject,
+  listProjects,
+  Retry,
+} from "@distilled.cloud/neon";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+
+const DRY_RUN = process.env.DRY_RUN === "1";
+const CONCURRENCY = Math.max(1, Number(process.env.CONCURRENCY ?? 4));
+
+if (!process.env.NEON_API_KEY) {
+  console.error("NEON_API_KEY is not set");
+  process.exit(1);
+}
+
+console.log(
+  `→ neon cleanup dryRun=${DRY_RUN} concurrency=${CONCURRENCY} (listing projects…)`,
+);
+
+let total = 0;
+let ok = 0;
+let fail = 0;
+
+const program = listProjects.pages({ limit: 400 }).pipe(
+  Stream.tap((page) =>
+    Effect.sync(() => console.log(`→ page: ${page.projects.length} projects`)),
+  ),
+  Stream.flatMap((page) => Stream.fromIterable(page.projects)),
+  Stream.tap((p: { id: string; name: string }) =>
+    Effect.sync(() => {
+      total += 1;
+      console.log(`   - ${p.name} (${p.id})`);
+    }),
+  ),
+  Stream.mapEffect(
+    (p) =>
+      DRY_RUN
+        ? Effect.void
+        : deleteProject({ project_id: p.id }).pipe(
+            Effect.tap(() =>
+              Effect.sync(() => {
+                ok += 1;
+                console.log(`✓ deleted ${p.name} (${ok})`);
+              }),
+            ),
+            Effect.catchTag("NotFound", () =>
+              Effect.sync(() => {
+                ok += 1;
+                console.log(`✓ already gone ${p.name}`);
+              }),
+            ),
+            Effect.catch((e) =>
+              Effect.sync(() => {
+                fail += 1;
+                console.error(`✗ ${p.name} (${p.id}): ${String(e)}`);
+              }),
+            ),
+          ),
+    { concurrency: CONCURRENCY },
+  ),
+  Stream.runDrain,
+  Effect.tap(() =>
+    Effect.sync(() =>
+      console.log(`→ done: total=${total} deleted=${ok} failed=${fail}`),
+    ),
+  ),
+);
+
+const runtime = Layer.mergeAll(
+  CredentialsFromEnv,
+  FetchHttpClient.layer,
+  Layer.succeed(Retry.Retry, { while: () => false }),
+);
+
+Effect.runPromise(program.pipe(Effect.provide(runtime))).catch((error) => {
+  console.error(error);
+  process.exit(1);
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ACM/Certificate.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ACM/Certificate.ts
new file mode 100644
index 00000000000..4821a8963c9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ACM/Certificate.ts
@@ -0,0 +1,510 @@
+import { Region as AwsRegion } from "@distilled.cloud/aws/Region";
+import * as acm from "@distilled.cloud/aws/acm";
+import * as route53 from "@distilled.cloud/aws/route-53";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasAlchemyTags,
+} from "../../Tags.ts";
+
+export interface CertificateProps {
+  /**
+   * Primary domain name for the certificate.
+   */
+  domainName: string;
+  /**
+   * Additional domain names to include on the certificate.
+   */
+  subjectAlternativeNames?: string[];
+  /**
+   * Validation method for the certificate request.
+   * @default "DNS"
+   */
+  validationMethod?: acm.ValidationMethod;
+  /**
+   * Route 53 hosted zone used to auto-create DNS validation records.
+   *
+   * When provided together with `validationMethod: "DNS"`, the certificate
+   * provider will upsert the validation records and wait for issuance.
+   */
+  hostedZoneId?: string;
+  /**
+   * Requested key algorithm.
+   */
+  keyAlgorithm?: acm.KeyAlgorithm;
+  /**
+   * Certificate transparency logging preference.
+   */
+  certificateTransparencyLoggingPreference?: "ENABLED" | "DISABLED" | undefined;
+  /**
+   * User-defined tags to apply to the certificate.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Certificate extends Resource<
+  "AWS.ACM.Certificate",
+  CertificateProps,
+  {
+    /**
+     * ARN of the certificate.
+     */
+    certificateArn: string;
+    /**
+     * Primary domain name of the certificate.
+     */
+    domainName: string;
+    /**
+     * Additional subject alternative names on the certificate.
+     */
+    subjectAlternativeNames: string[];
+    /**
+     * Current ACM certificate status.
+     */
+    status: acm.CertificateStatus | undefined;
+    /**
+     * ACM-managed domain validation details, including DNS validation records.
+     */
+    domainValidationOptions: acm.DomainValidation[];
+    /**
+     * Requested validation method.
+     */
+    validationMethod: acm.ValidationMethod | undefined;
+    /**
+     * Requested key algorithm.
+     */
+    keyAlgorithm: acm.KeyAlgorithm | undefined;
+    /**
+     * Route 53 hosted zone used for automatic DNS validation, when configured.
+     */
+    hostedZoneId: string | undefined;
+    /**
+     * Current tags on the certificate.
+     */
+    tags: Record<string, string>;
+    /**
+     * Certificate issue timestamp, when issued.
+     */
+    issuedAt: Date | undefined;
+    /**
+     * Certificate expiration timestamp, when issued.
+     */
+    notAfter: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An ACM certificate for CloudFront and other AWS endpoints.
+ *
+ * `Certificate` requests an ACM certificate in `us-east-1`, which is the
+ * region required for CloudFront viewer certificates. When `hostedZoneId` is
+ * provided for DNS validation, the provider creates or updates the Route 53
+ * validation records and waits for the certificate to be issued.
+ *
+ * @section Requesting Certificates
+ * @example DNS-Validated Certificate
+ * ```typescript
+ * const cert = yield* Certificate("WebsiteCertificate", {
+ *   domainName: "www.example.com",
+ *   hostedZoneId: "Z1234567890",
+ * });
+ * ```
+ *
+ * @example Certificate With SANs
+ * ```typescript
+ * const cert = yield* Certificate("WebsiteCertificate", {
+ *   domainName: "example.com",
+ *   subjectAlternativeNames: ["www.example.com"],
+ *   hostedZoneId: "Z1234567890",
+ * });
+ * ```
+ */
+export const Certificate = Resource<Certificate>("AWS.ACM.Certificate");
+
+export const CertificateProvider = () =>
+  Provider.effect(
+    Certificate,
+    Effect.gen(function* () {
+      const describeCertificate = Effect.fn(function* (certificateArn: string) {
+        return yield* withAcmRegion(
+          acm.describeCertificate({ CertificateArn: certificateArn }).pipe(
+            Effect.map((response) => response.Certificate),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          ),
+        );
+      });
+
+      const listCertificateTags = Effect.fn(function* (certificateArn: string) {
+        return yield* withAcmRegion(
+          acm.listTagsForCertificate({ CertificateArn: certificateArn }).pipe(
+            Effect.map((response) => toTagRecord(response.Tags)),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed({}),
+            ),
+          ),
+        );
+      });
+
+      const findManagedCertificate = Effect.fn(function* (
+        id: string,
+        props: CertificateProps,
+      ) {
+        const listed = yield* withAcmRegion(
+          acm.listCertificates({
+            Includes: {
+              keyTypes: props.keyAlgorithm ? [props.keyAlgorithm] : undefined,
+            },
+          } as any),
+        );
+
+        const summaries =
+          listed.CertificateSummaryList?.filter(
+            (summary) => summary.DomainName === props.domainName,
+          ) ?? [];
+
+        for (const summary of summaries) {
+          if (!summary.CertificateArn) {
+            continue;
+          }
+          const detail = yield* describeCertificate(summary.CertificateArn);
+          if (!detail?.CertificateArn) {
+            continue;
+          }
+          if (
+            detail.DomainName !== props.domainName ||
+            JSON.stringify(normalizeSanList(detail.SubjectAlternativeNames)) !==
+              JSON.stringify(normalizeSanList(props.subjectAlternativeNames))
+          ) {
+            continue;
+          }
+          const tags = yield* listCertificateTags(detail.CertificateArn);
+          if (yield* hasAlchemyTags(id, tags)) {
+            return detail;
+          }
+        }
+
+        return undefined;
+      });
+
+      const waitForValidationRecords = Effect.fn(function* (
+        certificateArn: string,
+      ) {
+        return yield* describeCertificate(certificateArn).pipe(
+          Effect.flatMap((detail) => {
+            const validations = detail?.DomainValidationOptions ?? [];
+            if (
+              validations.length === 0 ||
+              validations.some((option) => option.ResourceRecord === undefined)
+            ) {
+              return Effect.fail(
+                new Error("CertificateValidationRecordPending"),
+              );
+            }
+            return Effect.succeed(detail!);
+          }),
+          Effect.retry({
+            while: (error) =>
+              error instanceof Error &&
+              error.message === "CertificateValidationRecordPending",
+            schedule: Schedule.fixed("2 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      const waitForIssued = Effect.fn(function* (certificateArn: string) {
+        return yield* describeCertificate(certificateArn).pipe(
+          Effect.flatMap((detail) => {
+            if (!detail?.CertificateArn) {
+              return Effect.fail(new Error("CertificateNotFound"));
+            }
+            if (detail.Status === "ISSUED") {
+              return Effect.succeed(detail);
+            }
+            if (isTerminalFailure(detail.Status)) {
+              return Effect.fail(
+                new Error(
+                  `Certificate issuance failed with status ${detail.Status}${detail.FailureReason ? ` (${detail.FailureReason})` : ""}`,
+                ),
+              );
+            }
+            return Effect.fail(new Error("CertificatePendingValidation"));
+          }),
+          Effect.retry({
+            while: (error) =>
+              error instanceof Error &&
+              error.message === "CertificatePendingValidation",
+            schedule: Schedule.fixed("10 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      const waitForChange = Effect.fn(function* (changeId: string) {
+        return yield* route53.getChange({ Id: changeId }).pipe(
+          Effect.map((response) => response.ChangeInfo),
+          Effect.flatMap((changeInfo) =>
+            changeInfo.Status === "INSYNC"
+              ? Effect.succeed(changeInfo)
+              : Effect.fail(new Error("Route53ChangePending")),
+          ),
+          Effect.retry({
+            while: (error) =>
+              error instanceof Error &&
+              error.message === "Route53ChangePending",
+            schedule: Schedule.fixed("2 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      const upsertValidationRecords = Effect.fn(function* (
+        hostedZoneId: string,
+        certificate: acm.CertificateDetail,
+      ) {
+        const changes = (certificate.DomainValidationOptions ?? [])
+          .flatMap((option) =>
+            option.ResourceRecord ? [option.ResourceRecord] : [],
+          )
+          .map((record) => ({
+            Action: "UPSERT" as const,
+            ResourceRecordSet: {
+              Name: record.Name,
+              Type: record.Type,
+              TTL: 60,
+              ResourceRecords: [{ Value: record.Value }],
+            },
+          }));
+
+        if (changes.length === 0) {
+          return;
+        }
+
+        const response = yield* route53.changeResourceRecordSets({
+          HostedZoneId: normalizeHostedZoneId(hostedZoneId),
+          ChangeBatch: {
+            Comment: "Alchemy ACM DNS validation",
+            Changes: changes,
+          },
+        });
+
+        yield* waitForChange(response.ChangeInfo.Id);
+      });
+
+      return {
+        stables: ["certificateArn"],
+        diff: Effect.fn(function* ({ olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          if (
+            olds.domainName !== news.domainName ||
+            !deepEqual(
+              normalizeSanList(olds.subjectAlternativeNames),
+              normalizeSanList(news.subjectAlternativeNames),
+            ) ||
+            (olds.validationMethod ?? defaultValidationMethod) !==
+              (news.validationMethod ?? defaultValidationMethod) ||
+            olds.hostedZoneId !== news.hostedZoneId ||
+            olds.keyAlgorithm !== news.keyAlgorithm ||
+            olds.certificateTransparencyLoggingPreference !==
+              news.certificateTransparencyLoggingPreference
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const certificate = output?.certificateArn
+            ? yield* describeCertificate(output.certificateArn)
+            : yield* findManagedCertificate(id, olds!);
+
+          if (!certificate?.CertificateArn) {
+            return undefined;
+          }
+
+          const tags = yield* listCertificateTags(certificate.CertificateArn);
+          return toAttrs(olds!, certificate, tags);
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          instanceId,
+          news,
+          output,
+          session,
+        }) {
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — find the live certificate. Domain + SAN combo plus
+          // alchemy-owned tags identify a certificate uniquely; if we have
+          // a cached ARN, prefer that as the fast path. ACM certificates
+          // can't be renamed, and most fields trigger replace via diff,
+          // so the only real ensure path is "request if no managed
+          // certificate exists".
+          let certificate = output?.certificateArn
+            ? yield* describeCertificate(output.certificateArn)
+            : undefined;
+          if (!certificate?.CertificateArn) {
+            certificate = yield* findManagedCertificate(id, news);
+          }
+
+          // Ensure — request a new certificate if none exists. The
+          // `IdempotencyToken` (derived from `instanceId`) makes the
+          // request safe to retry.
+          if (!certificate?.CertificateArn) {
+            certificate = yield* withAcmRegion(
+              acm
+                .requestCertificate({
+                  DomainName: news.domainName,
+                  SubjectAlternativeNames: news.subjectAlternativeNames,
+                  ValidationMethod:
+                    news.validationMethod ?? defaultValidationMethod,
+                  KeyAlgorithm: news.keyAlgorithm,
+                  Options: news.certificateTransparencyLoggingPreference
+                    ? {
+                        CertificateTransparencyLoggingPreference:
+                          news.certificateTransparencyLoggingPreference,
+                      }
+                    : undefined,
+                  IdempotencyToken: instanceId
+                    .replaceAll(/[^a-zA-Z0-9]/g, "")
+                    .slice(0, 32),
+                  Tags: createTagsList(desiredTags),
+                })
+                .pipe(
+                  Effect.flatMap((response) =>
+                    response.CertificateArn
+                      ? describeCertificate(response.CertificateArn).pipe(
+                          Effect.map((detail) => detail!),
+                        )
+                      : Effect.fail(
+                          new Error(
+                            "requestCertificate returned no certificate ARN",
+                          ),
+                        ),
+                  ),
+                ),
+            );
+          }
+
+          if (!certificate?.CertificateArn) {
+            return yield* Effect.fail(
+              new Error("Failed to obtain ACM certificate"),
+            );
+          }
+
+          const certificateArn = certificate.CertificateArn;
+          yield* session.note(certificateArn);
+
+          // Sync DNS validation. If the user wired a hostedZoneId, ensure
+          // validation records are upserted and the cert reaches `ISSUED`.
+          // For an already-issued cert this is mostly a fast-path: we only
+          // wait for validation records when the cert isn't already issued.
+          const shouldAutoValidate =
+            (news.validationMethod ?? defaultValidationMethod) === "DNS" &&
+            news.hostedZoneId !== undefined;
+
+          if (shouldAutoValidate && certificate.Status !== "ISSUED") {
+            const withRecords = yield* waitForValidationRecords(certificateArn);
+            yield* upsertValidationRecords(news.hostedZoneId!, withRecords);
+            certificate = yield* waitForIssued(certificateArn);
+          }
+
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption rewrites ownership tags correctly.
+          const observedTags = yield* listCertificateTags(certificateArn);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (upsert.length > 0) {
+            yield* withAcmRegion(
+              acm.addTagsToCertificate({
+                CertificateArn: certificateArn,
+                Tags: upsert,
+              }),
+            );
+          }
+          if (removed.length > 0) {
+            yield* withAcmRegion(
+              acm.removeTagsFromCertificate({
+                CertificateArn: certificateArn,
+                Tags: removed.map((Key) => ({ Key })),
+              }),
+            );
+          }
+
+          // Re-read so the returned attributes reflect any tag mutation.
+          const finalTags = yield* listCertificateTags(certificateArn);
+          return toAttrs(news, certificate, finalTags);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* withAcmRegion(
+            acm
+              .deleteCertificate({
+                CertificateArn: output.certificateArn,
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const ACM_REGION = "us-east-1" as const;
+const defaultValidationMethod = "DNS" as const;
+
+const withAcmRegion = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(Effect.provideService(AwsRegion, ACM_REGION as any));
+
+const normalizeHostedZoneId = (hostedZoneId: string) =>
+  hostedZoneId.replace(/^\/hostedzone\//, "");
+
+const normalizeSanList = (names: string[] | undefined) =>
+  [...(names ?? [])].sort((a, b) => a.localeCompare(b));
+
+const toTagRecord = (tags: acm.Tag[] | undefined) =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const toAttrs = (
+  props: CertificateProps,
+  detail: acm.CertificateDetail,
+  tags: Record<string, string>,
+) => ({
+  certificateArn: detail.CertificateArn!,
+  domainName: detail.DomainName ?? props.domainName,
+  subjectAlternativeNames: detail.SubjectAlternativeNames ?? [],
+  status: detail.Status,
+  domainValidationOptions: detail.DomainValidationOptions ?? [],
+  validationMethod: props.validationMethod ?? defaultValidationMethod,
+  keyAlgorithm: detail.KeyAlgorithm ?? props.keyAlgorithm,
+  hostedZoneId: props.hostedZoneId
+    ? normalizeHostedZoneId(props.hostedZoneId)
+    : undefined,
+  tags,
+  issuedAt: detail.IssuedAt,
+  notAfter: detail.NotAfter,
+});
+
+const isTerminalFailure = (status: acm.CertificateStatus | undefined) =>
+  status === "FAILED" || status === "VALIDATION_TIMED_OUT";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ACM/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ACM/index.ts
new file mode 100644
index 00000000000..d99699c010c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ACM/index.ts
@@ -0,0 +1 @@
+export { Certificate, CertificateProvider } from "./Certificate.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/AGENTS.md b/.repos/alchemy-effect/packages/alchemy/src/AWS/AGENTS.md
new file mode 100644
index 00000000000..c8cc250ea8a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/AGENTS.md
@@ -0,0 +1,505 @@
+# AWS Service Bring-Up Process
+
+This document describes the process for going from zero to full Alchemy coverage for a single AWS service:
+
+- all canonical resources
+- all bindings
+- all event sources
+- all ergonomic helpers
+- deterministic audit and test coverage checks
+
+Use this process whenever adding a brand new AWS service or finishing an incomplete one.
+
+## Goal
+
+For a given AWS service, the end state should include:
+
+1. Every canonical Alchemy resource for that service.
+2. Every important AWS API operation represented either as:
+   - a binding,
+   - a resource lifecycle provider,
+   - an event source surface,
+   - or an intentional helper abstraction.
+3. Runtime-specific event-source implementations where applicable.
+4. End-to-end tests covering the implemented binding and event-source surface.
+5. Deterministic audit checks that report what is still missing.
+
+## Source Of Truth
+
+Start from the distilled spec in:
+
+- `.vendor/distilled/@distilled.cloud/aws/src/services/<service>.ts`
+
+Never start from ad-hoc memory of the AWS service. The distilled spec is the source of truth for operations.
+
+## Core Concepts
+
+Every distilled operation must be classified into one of these buckets:
+
+### 1. Binding
+
+Use a binding when the operation is a runtime capability.
+
+Examples:
+
+- `GetItem(table)`
+- `PutItem(table)`
+- `ListTables()`
+- `DescribeTable(table)`
+
+Bindings are:
+
+- one file per operation
+- `Binding.Service` + `Binding.Policy`
+- usually named `alchemy/src/AWS/<Service>/<Operation>.ts`
+
+### 2. Resource
+
+Use a resource when the operation set implies lifecycle ownership of infrastructure.
+
+Examples:
+
+- `createTable` / `updateTable` / `deleteTable` -> `Table`
+- `createBucket` / `deleteBucket` -> `Bucket`
+
+Resources are:
+
+- canonical Alchemy infrastructure entities
+- implemented as `Resource` contract + provider in a single file
+
+### 3. Event Source
+
+Use an event source when the service can push records/events into a runtime.
+
+This always has two layers:
+
+1. Service-level abstraction in `alchemy/src/AWS/<Service>/...`
+2. Runtime-specific implementation in places like:
+   - `alchemy/src/AWS/Lambda/...`
+   - `alchemy/src/Process/...`
+
+Examples:
+
+- `notifications(bucket)`
+- `messages(queue)`
+- `changes(table)` for DynamoDB-style change streams
+
+### 4. Helper
+
+Use a helper when multiple raw operations should collapse into a more ergonomic surface.
+
+Examples:
+
+- `notifications(bucket)`
+- `messages(queue)`
+- batch or transaction wrappers
+
+Helpers should not hide missing low-level primitives. Implement the primitives first.
+
+## Resource Arity
+
+Classify each binding by resource arity:
+
+- `0`: service/account scoped
+  - example: `ListTables`
+- `1`: one resource
+  - example: `GetItem(table)`
+- `2+`: multiple resources
+  - example: `RestoreTableToPointInTime(fromTable, toTable)`
+  - example: copy, batch, or transaction style operations
+
+This classification helps decide:
+
+- binding shape
+- helper shape
+- policy shape
+- whether the operation belongs on a resource or service surface
+
+Arity should be modeled in terms of canonical resources whenever possible.
+
+- good: a `2`-arity binding accepts `<From extends Table, To extends Table>`
+- bad: a `2`-resource operation accepts one `Table` plus a raw `string` target name
+- only fall back to raw identifiers when there is no real canonical resource to bind against
+- when there's a missing canonical resource, that might suggest we need to add one
+
+### Case Study: `ExecuteTransaction`
+
+Use `ExecuteTransaction` as the reference pattern for bindings that touch `1..*` canonical resources.
+
+The ambiguity we want to avoid is:
+
+- bad: `ExecuteTransaction.bind()` with IAM `Resource: ["*"]`
+- bad: `ExecuteTransaction.bind(tableNames: string[])`
+- bad: a SID like `AWS.DynamoDB.ExecuteTransaction(2 table(s))` that hides which resources were bound
+
+The required pattern is:
+
+- good: `ExecuteTransaction.bind(tableA, tableB, ...)`
+- good: the binding type requires at least one table
+- good: the policy enumerates exactly those table ARNs
+- good: the SID is deterministic and names the participating resources
+
+Runbook for any `1..*` resource-bound binding:
+
+1. Model the binding arguments as a non-empty tuple of canonical resources.
+2. Call `.bind(resourceA, resourceB, ...)`, never `.bind()` with hidden resource discovery.
+3. Before constructing the SID, sort the resources by `LogicalId` so equivalent calls produce the same binding identity.
+4. Pass the sorted resource array into the `host.bind` template so the SID renders each resource name explicitly, for example `AWS.DynamoDB.ExecuteTransaction(TableA, TableB)`.
+5. Build IAM `Resource` from those same sorted resources, for example `sortedTables.map((table) => table.tableArn)`.
+6. Only use `Resource: ["*"]` if the operation is truly service-scoped or AWS IAM does not support resource-level scoping for that API.
+
+Reference shape:
+
+```ts
+type ExecuteTransactionTables = [Table, ...Table[]];
+
+const sortedTables = [...tables].sort((a, b) =>
+  a.LogicalId.localeCompare(b.LogicalId),
+);
+
+yield *
+  host.bind`Allow(${host}, AWS.DynamoDB.ExecuteTransaction(${sortedTables}))`({
+    policyStatements: [
+      {
+        Effect: "Allow",
+        Action: [
+          "dynamodb:PartiQLSelect",
+          "dynamodb:PartiQLInsert",
+          "dynamodb:PartiQLUpdate",
+          "dynamodb:PartiQLDelete",
+        ],
+        Resource: sortedTables.map((table) => table.tableArn),
+      },
+    ],
+  });
+```
+
+## Full Bring-Up Loop
+
+Follow this loop until audit is clean or only intentionally deferred items remain.
+
+### Step 1: Run Audit
+
+Run:
+
+```bash
+bun audit:service dynamodb
+```
+
+The audit should report:
+
+- implemented bindings
+- missing bindings
+- resource lifecycle ops
+- event source ops
+- helper candidates
+- registration gaps
+- missing binding tests
+
+### Step 2: Build The Service Model
+
+Before coding, explicitly answer:
+
+1. What are the canonical resources?
+2. What bindings belong to each resource?
+3. What service-scoped bindings exist?
+4. What event-source surfaces exist?
+5. What helpers should exist?
+6. Which items are intentionally deferred?
+
+For DynamoDB, for example:
+
+- canonical resource: `Table`
+- folded table-owned surface: local/global secondary indexes live on `Table`, not a standalone `SecondaryIndex` resource
+- bindings: item/table/admin operations
+- event source: Kinesis streaming destination / change stream surface
+- helper: `streams(table)`
+
+### Step 3: Implement Missing Bindings
+
+Implement the smallest coherent slice first.
+
+Good order:
+
+1. read/admin bindings
+2. write/update bindings
+3. transaction/batch bindings
+4. restore or special-case bindings
+
+Binding conventions:
+
+- one file per operation
+- no auto-marshalling
+- user passes raw AWS SDK/distilled types
+- the binding should mostly inject resource identifiers like `TableName`
+- policies should be explicit and minimal
+- if an operation is `2+`-arity, the binding should capture all participating resources so the policy can stay least-privilege
+- never use `Resource: ["*"]` for a resource-bound binding if it can be avoided by passing canonical resources to `.bind(...)`
+- if an operation touches `1..*` canonical resources, model the binding to accept those resources explicitly so the policy can enumerate only those ARNs
+- `Resource: ["*"]` is only acceptable when the operation is truly service-scoped or AWS does not support narrower resource-level IAM for that API
+- do not add IAM `Sid` fields in `Binding.Policy` statements unless there is a demonstrated AWS requirement for one
+
+Example:
+
+- good: `GetItemRequest extends Omit<GetItemInput, "TableName">`
+- bad: replacing AWS input types with custom marshalled `Record<string, any>`
+
+### Step 4: Register Everything
+
+After each binding/resource implementation, update:
+
+1. `alchemy/src/AWS/<Service>/index.ts`
+2. `alchemy/src/AWS/Providers.ts`
+
+If registration is missing, audit should flag it.
+
+### Step 5: Add Binding Tests Immediately
+
+Every implemented binding should have a corresponding `describe("<BindingName>")` block in:
+
+- `alchemy/test/AWS/<Service>/Bindings.test.ts`
+
+Examples:
+
+```ts
+describe("GetItem", () => {
+  test("gets an existing item", ...);
+  test("returns undefined for missing item", ...);
+});
+```
+
+```ts
+describe("PutItem", () => {
+  test("puts an item into the table", ...);
+});
+```
+
+Deterministic rule:
+
+- if a binding exists, audit should warn if the matching `describe("<BindingName>")` block is missing
+
+### Step 6: Use A Real Lambda Fixture
+
+Use a real Lambda fixture in:
+
+- `alchemy/test/AWS/<Service>/handler.ts`
+
+Pattern:
+
+1. create resource(s)
+2. bind operations
+3. expose HTTP endpoints for each tested operation
+4. use those endpoints from the E2E test
+
+This keeps tests end-to-end while still giving fine-grained per-binding coverage.
+
+Layer provisioning rule:
+
+- when a Lambda fixture provides both composite layers and foundational binding layers, do not put them all in one flat `Layer.mergeAll(...)`
+- composite layers include event sources, sinks, and higher-level helpers that themselves depend on lower-level bindings
+- foundational layers include the binding/capability implementations such as `GetItemLive`, `PutObjectLive`, `PublishLive`, `PublishBatchLive`, and similar
+- use `Effect.provide(Layer.provideMerge(...))` so the foundational layer group is provided to the composite layer group
+- otherwise `Layer.mergeAll(...)` only unions outputs and requirements, and sibling layers do not satisfy each other's requirements
+
+Required shape:
+
+```ts
+Effect.provide(
+  Layer.provideMerge(
+    Layer
+      .mergeAll
+      // composite services: event sources, sinks, helpers
+      (),
+    Layer
+      .mergeAll
+      // foundational bindings/capabilities they depend on
+      (),
+  ),
+);
+```
+
+Example failure mode:
+
+- `TopicSinkLive` depends on `PublishBatch`
+- if `TopicSinkLive` and `PublishBatchLive` are only siblings in the same `Layer.mergeAll(...)`, the final Lambda effect still requires `PublishBatch`
+- grouping them with `Layer.provideMerge(...)` removes that leaked requirement
+
+### Step 7: Make Setup Observable
+
+Fixture setup must log clearly:
+
+- destroying previous resources
+- deploying fixture
+- function URL
+- readiness probe URL
+- readiness retries
+- readiness success
+
+If setup is confusing, add logs before adding retries.
+
+### Step 8: Keep Readiness Failure Fast
+
+Do not wait minutes for a function to become ready.
+
+Current convention:
+
+- if the function is not ready in about 20 seconds, fail the setup
+
+Use a short retry budget and log each failed readiness attempt.
+
+### Step 9: Implement Missing Resource Surface
+
+Once bindings are in good shape, fill missing resource-level gaps:
+
+- missing resource providers
+- placeholder resources
+- resource update/delete gaps
+- missing nested infrastructure surfaces such as indexes or replicas
+
+Important:
+
+- audit may only recognize canonical resources implied directly by lifecycle operations
+- you must still inspect the service for real resource-shaped gaps not fully inferred by the script
+
+Example:
+
+- a placeholder like `SecondaryIndex.ts` still counts as incomplete coverage until it is either removed or folded into the canonical resource model
+
+### Step 10: Implement Event Sources
+
+For stream/notification services:
+
+1. define a service-level abstraction
+2. add runtime-specific implementation(s)
+3. add helper surface
+4. add tests
+
+When the event source needs an intermediate canonical resource, the binding should
+create that resource automatically instead of forcing user code to instantiate it.
+SNS is the reference case:
+
+- the public binding is `notifications(topic).subscribe(...)`
+- the Lambda runtime policy creates the `Subscription` resource automatically
+- any service-to-Lambda invoke permission stays in the runtime policy layer that
+  wires the event source, not in user code
+- the canonical resource still exists and can be used directly when needed; the
+  helper just creates it on behalf of the user
+
+For DynamoDB-style changes this likely means:
+
+1. table-side stream/destination surface
+2. Lambda runtime integration
+3. `streams(table)` helper
+4. E2E coverage
+
+### Step 11: Implement Helpers
+
+After low-level primitives exist, add ergonomic helpers for:
+
+- stream subscriptions
+- batch operations
+- transactions
+
+Helpers should feel native to Alchemy and match established service patterns.
+
+### Case Study: DynamoDB Streams
+
+DynamoDB Streams is the reference pattern for mutable event-source configuration that belongs to a canonical resource but still needs binding-based composition.
+
+Required shape:
+
+- the canonical resource remains `Table`
+- `Table` keeps stream state in its attributes, but does not accept `streamSpecification` as a plain input prop
+- stream enablement is requested through the table binding contract
+- the public helper is `streams(table).process(...)`
+- the service-level abstraction lives in `alchemy/src/AWS/DynamoDB/Stream.ts`
+- the Lambda runtime implementation lives in `alchemy/src/AWS/Lambda/TableEventSource.ts`
+
+Why this pattern exists:
+
+- stream enablement mutates the table itself
+- the consumer is another resource, usually a Lambda Function
+- prop-driven stream configuration makes circular composition awkward
+- bindings let the consumer request the mutation while `Table` stays the canonical owner of stream state
+
+Implementation rules:
+
+1. The helper attaches stream requirements to `Table` through bindings.
+2. The `Table` provider derives the effective stream configuration from bindings during `create` and `update`.
+3. Zero stream bindings means the table stream should be disabled.
+4. Multiple bindings may coexist only when they request the same `StreamViewType`.
+5. Conflicting `StreamViewType` requests must fail deterministically before AWS calls are made.
+6. Runtime-specific layers handle IAM, host wiring, and event-source mapping resources; they do not move stream ownership out of `Table`.
+
+Lambda-first slice:
+
+- implement `streams(table).process(...)` first for Lambda
+- the Lambda layer binds the table stream requirement, grants stream-read IAM, and creates `AWS.Lambda.EventSourceMapping`
+- Process or other runtimes can be added later without changing `Table` back to a prop-driven stream model
+
+### Step 12: Re-Run Tests And Audit
+
+After every meaningful slice:
+
+1. run the service-specific E2E tests
+2. rerun `bun audit:service <service>`
+3. use the updated output to choose the next slice
+
+Repeat until:
+
+- no important missing bindings remain
+- resource surface is complete
+- event-source surface is complete
+- tests are in place
+
+## Deterministic Checks We Want
+
+The audit should help enforce:
+
+1. Missing bindings from distilled operations.
+2. Missing registration in `index.ts`.
+3. Missing registration in `Providers.ts`.
+4. Missing `describe("<BindingName>")` blocks in `Bindings.test.ts`.
+5. Avoidable `Resource: ["*"]` usage in non-zero-arity bindings.
+
+Over time it should also grow to flag:
+
+6. placeholder resources with no provider
+7. missing event-source surface for detected stream operations
+8. missing helper surface for known event-source patterns
+
+## AWS-Specific Conventions Learned
+
+### No Auto-Marshalling
+
+Bindings do not auto-marshall request/response payloads for DynamoDB-style operations.
+
+User responsibility:
+
+- pass raw AWS/distilled input types
+- marshal/unmarshal attribute values themselves
+
+### `Output.interpolate`
+
+Only use `Output.interpolate` when actually composing a string.
+
+Examples:
+
+- good: `table.tableArn`
+- good: `Output.interpolate\`${table.tableArn}/index/\*\``
+- bad: `Output.interpolate\`${table.tableArn}\``
+
+### `Effect.orDie`
+
+For Lambda test fixtures, apply `Effect.orDie` once at the outer request handler layer, not repeatedly per route.
+
+### Binding Test Structure
+
+Use one `describe("<BindingName>")` block per binding.
+
+Inside that block:
+
+- happy path
+- relevant unhappy paths
+
+Do not lump all bindings into one large undifferentiated test block.
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Account.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Account.ts
new file mode 100644
index 00000000000..0c2b9a76a09
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Account.ts
@@ -0,0 +1,146 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { retryOnApiStatusUpdating } from "./common.ts";
+
+export interface AccountProps {
+  /**
+   * IAM role ARN for API Gateway to push logs to CloudWatch.
+   */
+  cloudwatchRoleArn?: string;
+}
+
+export interface Account extends Resource<
+  "AWS.ApiGateway.Account",
+  AccountProps,
+  {
+    cloudwatchRoleArn: string | undefined;
+    /**
+     * True when this stack last applied a desired `cloudwatchRoleArn` (including clearing it).
+     * Used so destroy does not remove a role the stack never configured.
+     */
+    managesCloudwatchRoleArn: boolean;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Account-level settings for Amazon API Gateway in the current region
+ * (CloudWatch logging role, etc.).
+ *
+ * @section Account settings
+ * @example Set logging role
+ * ```typescript
+ * yield* ApiGateway.Account("Account", {
+ *   cloudwatchRoleArn: role.roleArn,
+ * });
+ * ```
+ */
+const AccountResource = Resource<Account>("AWS.ApiGateway.Account");
+
+export { AccountResource as Account };
+
+export const AccountProvider = () =>
+  Provider.effect(
+    AccountResource,
+    Effect.gen(function* () {
+      return {
+        diff: Effect.fn(function* ({ news: newsIn, olds, output }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as AccountProps;
+          const prevManages = output?.managesCloudwatchRoleArn ?? false;
+          const nextManages = news.cloudwatchRoleArn !== undefined;
+          if (nextManages) {
+            if (news.cloudwatchRoleArn !== olds.cloudwatchRoleArn) {
+              return { action: "update" } as const;
+            }
+          } else if (prevManages) {
+            return { action: "update" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          const a = yield* ag
+            .getAccount({})
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          return {
+            cloudwatchRoleArn: a?.cloudwatchRoleArn,
+            managesCloudwatchRoleArn: output?.managesCloudwatchRoleArn ?? false,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("Account props were not resolved");
+          }
+          const news = newsIn as AccountProps;
+
+          // Observe — read the current account-level CloudWatch role from
+          // API Gateway. The account settings resource is a singleton per
+          // region, so there is no `ensure` step: we always sync.
+          const observed = yield* ag
+            .getAccount({})
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const observedRoleArn = observed?.cloudwatchRoleArn;
+
+          // Sync the cloudwatchRoleArn — observed ↔ desired. We treat
+          // `undefined` desired as "do not manage the field" so the user
+          // can opt out without us clobbering whatever was already set
+          // out of band.
+          const manages = news.cloudwatchRoleArn !== undefined;
+          if (manages) {
+            const desired = news.cloudwatchRoleArn;
+            if (desired !== observedRoleArn) {
+              yield* retryOnApiStatusUpdating(
+                ag.updateAccount({
+                  patchOperations: desired
+                    ? [
+                        {
+                          op: "replace",
+                          path: "/cloudwatchRoleArn",
+                          value: desired,
+                        },
+                      ]
+                    : [{ op: "remove", path: "/cloudwatchRoleArn" }],
+                }),
+              );
+              yield* session.note("Updated API Gateway account settings");
+            }
+          }
+
+          const final = yield* ag.getAccount({});
+          return {
+            cloudwatchRoleArn: final.cloudwatchRoleArn,
+            managesCloudwatchRoleArn: manages,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          if (output.managesCloudwatchRoleArn) {
+            yield* retryOnApiStatusUpdating(
+              ag
+                .updateAccount({
+                  patchOperations: [
+                    { op: "remove", path: "/cloudwatchRoleArn" },
+                  ],
+                })
+                .pipe(
+                  Effect.catchTag("BadRequestException", () => Effect.void),
+                ),
+            );
+            yield* session.note("Cleared API Gateway account CloudWatch role");
+          }
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/ApiKey.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/ApiKey.ts
new file mode 100644
index 00000000000..7ed8b4f743a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/ApiKey.ts
@@ -0,0 +1,276 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, hasAlchemyTags, tagRecord } from "../../Tags.ts";
+
+import { apiKeyArn, syncTags } from "./common.ts";
+
+export interface ApiKeyProps {
+  /**
+   * Friendly name for the API key.
+   *
+   * If omitted, Alchemy generates a deterministic physical name from the
+   * stack, stage, logical ID, and instance ID.
+   */
+  name?: string;
+  /**
+   * Human-readable description shown in API Gateway.
+   */
+  description?: string;
+  /**
+   * Whether clients can use the key.
+   *
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Appends a distinct suffix to the generated key value when AWS generates it.
+   */
+  generateDistinctId?: boolean;
+  /**
+   * Write-only value when creating; never stored in resource state or outputs.
+   * Wrap with `Redacted.make` so state encoding preserves redaction.
+   */
+  value?: Redacted.Redacted<string>;
+  /**
+   * Stage associations to attach directly to this API key.
+   */
+  stageKeys?: ag.StageKey[];
+  /**
+   * External customer identifier associated with the key.
+   */
+  customerId?: string;
+  /**
+   * User-defined tags. Alchemy internal tags are merged automatically.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface ApiKey extends Resource<
+  "AWS.ApiGateway.ApiKey",
+  ApiKeyProps,
+  {
+    id: string;
+    name: string | undefined;
+    enabled: boolean | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * API Gateway API key for usage plans and `apiKeyRequired` methods.
+ *
+ * @section API keys
+ * @example Generated key
+ * ```typescript
+ * const key = yield* ApiGateway.ApiKey("PartnerKey", {
+ *   generateDistinctId: true,
+ * });
+ * ```
+ */
+const ApiKeyResource = Resource<ApiKey>("AWS.ApiGateway.ApiKey");
+
+export { ApiKeyResource as ApiKey };
+
+const resolvedValue = (value: Redacted.Redacted<string> | undefined) =>
+  value ? Redacted.value(value) : undefined;
+
+const generatedName = (id: string, props: ApiKeyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 128,
+      });
+
+const readByName = Effect.fn(function* (id: string, name: string) {
+  const keys = yield* ag.getApiKeys
+    .items({ nameQuery: name, limit: 500, includeValues: false })
+    .pipe(Stream.runCollect);
+
+  for (const key of keys) {
+    if (key.name !== name || !key.id) continue;
+    if (yield* hasAlchemyTags(id, key.tags)) {
+      return key;
+    }
+  }
+  return undefined;
+});
+
+export const ApiKeyProvider = () =>
+  Provider.effect(
+    ApiKeyResource,
+    Effect.gen(function* () {
+      const awsRegion = yield* Region;
+
+      return {
+        stables: ["id"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as ApiKeyProps;
+          if (
+            // API Gateway never returns the key value after create, so rotating
+            // a user-supplied value is modeled as replacement instead of patch.
+            resolvedValue(news.value) !== resolvedValue(olds.value) ||
+            news.customerId !== olds.customerId
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          const k = yield* ag
+            .getApiKey({ apiKey: output.id, includeValue: false })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!k?.id) return undefined;
+          return {
+            id: k.id,
+            name: k.name,
+            enabled: k.enabled,
+            tags: tagRecord(k.tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("ApiKey props were not resolved");
+          }
+          const news = newsIn as ApiKeyProps;
+          const name = yield* generatedName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...news.tags, ...internalTags };
+
+          // Observe — find the API key. We try the cached id first, fall
+          // back to scanning by name with the alchemy ownership filter so
+          // the reconciler converges after an out-of-band recreate or an
+          // adoption that bypassed our id cache.
+          let observed = output?.id
+            ? yield* ag
+                .getApiKey({ apiKey: output.id, includeValue: false })
+                .pipe(
+                  Effect.catchTag("NotFoundException", () =>
+                    Effect.succeed(undefined),
+                  ),
+                )
+            : undefined;
+          if (!observed?.id) {
+            observed = yield* readByName(id, name);
+          }
+
+          // Ensure — create if missing. Tolerate `ConflictException` as a
+          // race with a peer reconciler or a stray key with the same name:
+          // re-look up by name and treat the alchemy-owned hit as observed.
+          if (!observed?.id) {
+            const created = yield* ag
+              .createApiKey({
+                name,
+                description: news.description,
+                enabled: news.enabled,
+                generateDistinctId: news.generateDistinctId,
+                value: resolvedValue(news.value),
+                stageKeys: news.stageKeys,
+                customerId: news.customerId,
+                tags: desiredTags,
+              })
+              .pipe(
+                Effect.catchTag("ConflictException", () =>
+                  Effect.gen(function* () {
+                    const existing = yield* readByName(id, name);
+                    if (existing) return existing;
+                    return yield* Effect.fail(
+                      new ag.ConflictException({
+                        message: `API key '${name}' already exists and is not managed by alchemy`,
+                      }),
+                    );
+                  }),
+                ),
+              );
+            if (!created.id)
+              return yield* Effect.die("createApiKey missing id");
+            yield* session.note(`Created API key ${created.id}`);
+            observed = yield* ag.getApiKey({
+              apiKey: created.id,
+              includeValue: false,
+            });
+          }
+
+          const apiKeyId = observed.id!;
+
+          // Sync mutable scalar fields — observed ↔ desired patch list.
+          const patches: ag.PatchOperation[] = [];
+          if (news.name !== undefined && news.name !== observed.name) {
+            patches.push({
+              op: "replace",
+              path: "/name",
+              value: news.name,
+            });
+          }
+          if (
+            news.description !== undefined &&
+            news.description !== observed.description
+          ) {
+            patches.push({
+              op: "replace",
+              path: "/description",
+              value: news.description,
+            });
+          }
+          if (news.enabled !== undefined && news.enabled !== observed.enabled) {
+            patches.push({
+              op: "replace",
+              path: "/enabled",
+              value: String(news.enabled),
+            });
+          }
+          if (patches.length > 0) {
+            yield* ag.updateApiKey({
+              apiKey: apiKeyId,
+              patchOperations: patches,
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired so adoption
+          // converges without fighting whatever tag set was already there.
+          const observedTags = tagRecord(observed.tags);
+          if (!deepEqual(observedTags, desiredTags)) {
+            yield* syncTags({
+              resourceArn: apiKeyArn(awsRegion, apiKeyId),
+              oldTags: observedTags,
+              newTags: desiredTags,
+            });
+          }
+
+          yield* session.note(`Reconciled API key ${apiKeyId}`);
+          const final = yield* ag.getApiKey({
+            apiKey: apiKeyId,
+            includeValue: false,
+          });
+          if (!final.id) return yield* Effect.die("getApiKey missing id");
+          return {
+            id: final.id,
+            name: final.name,
+            enabled: final.enabled,
+            tags: tagRecord(final.tags),
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag
+            .deleteApiKey({ apiKey: output.id })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+          yield* session.note(`Deleted API key ${output.id}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Authorizer.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Authorizer.ts
new file mode 100644
index 00000000000..21ed9083d71
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Authorizer.ts
@@ -0,0 +1,274 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface AuthorizerProps {
+  /**
+   * REST API identifier that owns the authorizer.
+   */
+  restApiId: Input<string>;
+  /**
+   * Authorizer name.
+   *
+   * If omitted, Alchemy generates a deterministic physical name.
+   */
+  name?: string;
+  /**
+   * Authorizer type.
+   */
+  type: ag.AuthorizerType;
+  /**
+   * Cognito user pool ARNs for `COGNITO_USER_POOLS` authorizers.
+   */
+  providerARNs?: string[];
+  /**
+   * Custom authorization type label.
+   */
+  authType?: string;
+  /**
+   * Lambda invocation URI for `TOKEN` or `REQUEST` authorizers.
+   */
+  authorizerUri?: string;
+  /**
+   * IAM role ARN used by API Gateway to invoke the authorizer.
+   *
+   * This is not secret key material; API Gateway stores the role ARN.
+   */
+  authorizerCredentials?: string;
+  /**
+   * Identity source expression, e.g. `method.request.header.Authorization`.
+   */
+  identitySource?: string;
+  /**
+   * Validation regex for token authorizers.
+   */
+  identityValidationExpression?: string;
+  /**
+   * Cache TTL for authorizer results, in seconds.
+   */
+  authorizerResultTtlInSeconds?: number;
+}
+
+export interface Authorizer extends Resource<
+  "AWS.ApiGateway.Authorizer",
+  AuthorizerProps,
+  {
+    authorizerId: string;
+    restApiId: string;
+    name: string;
+    type: ag.AuthorizerType;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * REST API Lambda, Cognito, or gateway authorizer.
+ *
+ * @section Authorizers
+ * @example Lambda TOKEN authorizer
+ * ```typescript
+ * const authorizer = yield* ApiGateway.Authorizer("Auth", {
+ *   restApiId: api.restApiId,
+ *   type: "TOKEN",
+ *   authorizerUri: authorizerInvokeArn,
+ *   identitySource: "method.request.header.Authorization",
+ * });
+ * ```
+ */
+const AuthorizerResource = Resource<Authorizer>("AWS.ApiGateway.Authorizer");
+
+export { AuthorizerResource as Authorizer };
+
+const generatedName = (id: string, props: AuthorizerProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 128,
+      });
+
+export const AuthorizerProvider = () =>
+  Provider.effect(
+    AuthorizerResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["authorizerId", "restApiId"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as AuthorizerProps;
+          if (
+            // These fields define the authorizer identity and kind; replacement
+            // avoids patching a different authorizer shape in place.
+            news.restApiId !== olds.restApiId ||
+            (news.name !== undefined && news.name !== olds.name) ||
+            news.type !== olds.type
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (!deepEqual(news.providerARNs, olds.providerARNs)) {
+            return { action: "replace" } as const;
+          }
+          if (news.authType !== olds.authType) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.authorizerId) return undefined;
+          const a = yield* ag
+            .getAuthorizer({
+              restApiId: output.restApiId,
+              authorizerId: output.authorizerId,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!a?.id) return undefined;
+          return {
+            authorizerId: a.id,
+            restApiId: output.restApiId,
+            name: a.name!,
+            type: a.type!,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("Authorizer props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<AuthorizerProps>;
+          const name = yield* generatedName(id, news);
+          const restApiId = (output?.restApiId ?? news.restApiId) as string;
+
+          // Observe — fetch the live authorizer if we have a cached id.
+          // The cached id is the only way to find the resource; on a stale
+          // delete out of band we re-create.
+          let observed = output?.authorizerId
+            ? yield* ag
+                .getAuthorizer({
+                  restApiId,
+                  authorizerId: output.authorizerId,
+                })
+                .pipe(
+                  Effect.catchTag("NotFoundException", () =>
+                    Effect.succeed(undefined),
+                  ),
+                )
+            : undefined;
+
+          // Ensure — create if missing.
+          if (!observed?.id) {
+            const created = yield* ag.createAuthorizer({
+              restApiId: news.restApiId as string,
+              name,
+              type: news.type,
+              providerARNs: news.providerARNs,
+              authType: news.authType,
+              authorizerUri: news.authorizerUri,
+              authorizerCredentials: news.authorizerCredentials,
+              identitySource: news.identitySource,
+              identityValidationExpression: news.identityValidationExpression,
+              authorizerResultTtlInSeconds: news.authorizerResultTtlInSeconds,
+            });
+            if (!created.id)
+              return yield* Effect.die("createAuthorizer missing id");
+            yield* session.note(`Created authorizer ${created.id}`);
+            observed = yield* ag.getAuthorizer({
+              restApiId: news.restApiId as string,
+              authorizerId: created.id,
+            });
+          }
+
+          const authorizerId = observed.id!;
+
+          // Sync mutable fields — diff observed cloud state against desired.
+          const patches: ag.PatchOperation[] = [];
+          if (news.authorizerUri !== observed.authorizerUri) {
+            patches.push({
+              op: news.authorizerUri === undefined ? "remove" : "replace",
+              path: "/authorizerUri",
+              value: news.authorizerUri,
+            });
+          }
+          if (news.identitySource !== observed.identitySource) {
+            patches.push({
+              op: news.identitySource === undefined ? "remove" : "replace",
+              path: "/identitySource",
+              value: news.identitySource,
+            });
+          }
+          if (news.authorizerCredentials !== observed.authorizerCredentials) {
+            patches.push({
+              op:
+                news.authorizerCredentials === undefined ? "remove" : "replace",
+              path: "/authorizerCredentials",
+              value: news.authorizerCredentials,
+            });
+          }
+          if (
+            news.identityValidationExpression !==
+            observed.identityValidationExpression
+          ) {
+            patches.push({
+              op:
+                news.identityValidationExpression === undefined
+                  ? "remove"
+                  : "replace",
+              path: "/identityValidationExpression",
+              value: news.identityValidationExpression,
+            });
+          }
+          if (
+            news.authorizerResultTtlInSeconds !==
+            observed.authorizerResultTtlInSeconds
+          ) {
+            patches.push({
+              op:
+                news.authorizerResultTtlInSeconds === undefined
+                  ? "remove"
+                  : "replace",
+              path: "/authorizerResultTtlInSeconds",
+              value:
+                news.authorizerResultTtlInSeconds === undefined
+                  ? undefined
+                  : String(news.authorizerResultTtlInSeconds),
+            });
+          }
+          if (patches.length > 0) {
+            yield* ag.updateAuthorizer({
+              restApiId,
+              authorizerId,
+              patchOperations: patches,
+            });
+          }
+
+          yield* session.note(`Reconciled authorizer ${authorizerId}`);
+          const final = yield* ag.getAuthorizer({
+            restApiId,
+            authorizerId,
+          });
+          return {
+            authorizerId,
+            restApiId,
+            name: final.name!,
+            type: final.type!,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag
+            .deleteAuthorizer({
+              restApiId: output.restApiId,
+              authorizerId: output.authorizerId,
+            })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+          yield* session.note(`Deleted authorizer ${output.authorizerId}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/BasePathMapping.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/BasePathMapping.ts
new file mode 100644
index 00000000000..c0afe393b4a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/BasePathMapping.ts
@@ -0,0 +1,190 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+const normalizeBasePath = (basePath: string | undefined) =>
+  basePath === undefined || basePath === "" ? "(none)" : basePath;
+
+export interface BasePathMappingProps {
+  domainName: string;
+  domainNameId?: string;
+  /**
+   * Base path segment; omit or empty string for root mapping (`(none)` in API Gateway).
+   */
+  basePath?: string;
+  restApiId: Input<string>;
+  stage?: string;
+}
+
+export interface BasePathMapping extends Resource<
+  "AWS.ApiGateway.BasePathMapping",
+  BasePathMappingProps,
+  {
+    domainName: string;
+    domainNameId: string | undefined;
+    basePath: string;
+    restApiId: string;
+    stage: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Maps a custom domain name path to a REST API stage.
+ *
+ * @section Custom domain
+ * @example Root mapping
+ * ```typescript
+ * yield* ApiGateway.BasePathMapping("Root", {
+ *   domainName: domain.domainName,
+ *   restApiId: api.restApiId,
+ *   stage: stage.stageName,
+ * });
+ * ```
+ */
+const BasePathMappingResource = Resource<BasePathMapping>(
+  "AWS.ApiGateway.BasePathMapping",
+);
+
+export { BasePathMappingResource as BasePathMapping };
+
+export const BasePathMappingProvider = () =>
+  Provider.effect(
+    BasePathMappingResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["domainName", "domainNameId", "basePath"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as Input.ResolveProps<BasePathMappingProps>;
+          if (
+            news.domainName !== olds.domainName ||
+            normalizeBasePath(news.basePath) !==
+              normalizeBasePath(olds.basePath)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const b = yield* ag
+            .getBasePathMapping({
+              domainName: output.domainName,
+              basePath: output.basePath,
+              domainNameId: output.domainNameId,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!b?.restApiId) return undefined;
+          return {
+            domainName: output.domainName,
+            basePath: output.basePath,
+            domainNameId: output.domainNameId,
+            restApiId: b.restApiId,
+            stage: b.stage,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("BasePathMapping props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<BasePathMappingProps>;
+          const domainName = output?.domainName ?? news.domainName;
+          const domainNameId = output?.domainNameId ?? news.domainNameId;
+          const basePath = output?.basePath ?? normalizeBasePath(news.basePath);
+
+          // Observe — basePathmappings are keyed by (domainName, basePath).
+          // We never trust `output.restApiId`/`output.stage` for diffing; we
+          // re-read the live mapping every time.
+          let observed = yield* ag
+            .getBasePathMapping({
+              domainName,
+              basePath,
+              domainNameId,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the mapping if it isn't there.
+          if (!observed?.restApiId) {
+            yield* ag.createBasePathMapping({
+              domainName: news.domainName,
+              domainNameId: news.domainNameId,
+              basePath: basePath === "(none)" ? undefined : news.basePath,
+              restApiId: news.restApiId as string,
+              stage: news.stage,
+            });
+            yield* session.note(
+              `Created base path mapping ${news.domainName} / ${basePath}`,
+            );
+            observed = yield* ag.getBasePathMapping({
+              domainName,
+              basePath,
+              domainNameId,
+            });
+          }
+
+          // Sync mutable fields — diff observed cloud state against desired.
+          const desiredRestApiId = news.restApiId as string;
+          const patches: ag.PatchOperation[] = [];
+          if (desiredRestApiId !== observed.restApiId) {
+            patches.push({
+              op: "replace" as const,
+              path: "/restApiId",
+              value: desiredRestApiId,
+            });
+          }
+          if ((news.stage ?? "") !== (observed.stage ?? "")) {
+            patches.push({
+              op: "replace" as const,
+              path: "/stage",
+              value: news.stage ?? "",
+            });
+          }
+          if (patches.length > 0) {
+            yield* ag.updateBasePathMapping({
+              domainName,
+              basePath,
+              domainNameId,
+              patchOperations: patches,
+            });
+          }
+
+          yield* session.note(`Reconciled base path mapping`);
+          const final = yield* ag.getBasePathMapping({
+            domainName,
+            basePath,
+            domainNameId,
+          });
+          return {
+            domainName,
+            domainNameId,
+            basePath,
+            restApiId: final.restApiId!,
+            stage: final.stage,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag
+            .deleteBasePathMapping({
+              domainName: output.domainName,
+              basePath: output.basePath,
+              domainNameId: output.domainNameId,
+            })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+          yield* session.note(`Deleted base path mapping`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Deployment.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Deployment.ts
new file mode 100644
index 00000000000..6c73f1cf395
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Deployment.ts
@@ -0,0 +1,351 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { createHash } from "node:crypto";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Output from "../../Output.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { Stack } from "../../Stack.ts";
+import type { Providers } from "../Providers.ts";
+import { retryOnApiStatusUpdating } from "./common.ts";
+import type { RestApi, RestApiBinding } from "./RestApi.ts";
+
+export interface DeploymentProps {
+  /**
+   * The `RestApi` to deploy. When supplied, the Deployment reads every
+   * `RestApiBinding` already registered on the API (each `Method`,
+   * `Resource`, etc. that was declared with `restApi: api`) and pulls
+   * those into its dependency graph. Adding a new `Method` automatically
+   * causes the next apply to produce a fresh deployment — no user-authored
+   * `DependsOn` or `triggers` hash required.
+   */
+  restApi?: RestApi;
+  /**
+   * ID of the REST API. Usually derived from `restApi.restApiId`; supply
+   * explicitly only when not using `restApi`.
+   */
+  restApiId?: Input<string>;
+  description?: string;
+  stageName?: string;
+  stageDescription?: string;
+  cacheClusterEnabled?: boolean;
+  cacheClusterSize?: ag.CacheClusterSize;
+  variables?: { [key: string]: string | undefined };
+  canarySettings?: ag.DeploymentCanarySettings;
+  tracingEnabled?: boolean;
+  /**
+   * Opaque key/value map; when any value changes, a replacement deployment
+   * is planned. Each value may be a literal string or an `Input<string>`
+   * (such as a resource output) — output references create real dependency
+   * edges, which is how Alchemy ensures a new deployment runs after the
+   * resources it references are updated.
+   *
+   * You rarely need to set this manually: when you pass `restApi`, the
+   * deployment already depends on every bound `Method` and redeploys
+   * automatically when any of them change. Reach for `triggers` only when
+   * you want to force a redeploy on some other signal (e.g. a config hash,
+   * a manual version bump).
+   */
+  triggers?: Record<string, Input<string>>;
+}
+
+export interface DeploymentType extends Resource<
+  "AWS.ApiGateway.Deployment",
+  DeploymentProps,
+  {
+    deploymentId: string;
+    restApiId: string;
+    description: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A point-in-time snapshot of a REST API, ready to be served through a
+ * `Stage`.
+ *
+ * @section Creating a deployment
+ * A Deployment captures whatever methods, integrations, resources, and
+ * authorizers currently exist on the REST API and produces an immutable
+ * `deploymentId` that a `Stage` can point at. Pass the `RestApi` value on
+ * `restApi` and Alchemy handles all the ordering for you — the deployment
+ * will run after every method bound to the API.
+ *
+ * @example Deployment of a REST API
+ * ```typescript
+ * const api = yield* ApiGateway.RestApi("Api", {
+ *   endpointConfiguration: { types: ["REGIONAL"] },
+ * });
+ *
+ * yield* ApiGateway.Method("GetRoot", {
+ *   restApi: api,
+ *   httpMethod: "GET",
+ *   authorizationType: "NONE",
+ *   integration: { type: "MOCK" },
+ * });
+ *
+ * const deployment = yield* ApiGateway.Deployment("Release", {
+ *   restApi: api,
+ *   description: "v1",
+ * });
+ * ```
+ *
+ * @section Forcing a redeploy
+ * Usually you do not have to: `restApi` already makes the Deployment
+ * depend on every method, so any change to a method re-plans a new
+ * deployment. Use `triggers` when you want to couple the deployment to a
+ * signal Alchemy cannot see — for example, a manual version bump or a
+ * hash of configuration computed outside the stack.
+ *
+ * @example Force redeploy on a version bump
+ * ```typescript
+ * const deployment = yield* ApiGateway.Deployment("Release", {
+ *   restApi: api,
+ *   triggers: { version: "2026-05-01" },
+ * });
+ * ```
+ *
+ * @section Why no DependsOn?
+ * CloudFormation's `AWS::ApiGateway::Deployment` famously requires a
+ * hand-written `DependsOn: [Method1, Method2, ...]` listing every method.
+ * Alchemy derives that list automatically from the bindings registered on
+ * the `RestApi`, so adding a method never requires editing the deployment.
+ */
+export const DeploymentResource = Resource<DeploymentType>(
+  "AWS.ApiGateway.Deployment",
+);
+
+interface DeploymentInputProps {
+  restApi?: RestApi;
+  restApiId?: Input<string>;
+  description?: Input<string>;
+  stageName?: Input<string>;
+  stageDescription?: Input<string>;
+  cacheClusterEnabled?: Input<boolean>;
+  cacheClusterSize?: Input<ag.CacheClusterSize>;
+  variables?: Input<{ [key: string]: string | undefined }>;
+  canarySettings?: Input<ag.DeploymentCanarySettings>;
+  tracingEnabled?: Input<boolean>;
+  triggers?: Record<string, Input<string>>;
+}
+
+/**
+ * User-facing wrapper that adds a dependency edge from the Deployment to
+ * every resource bound to the supplied `restApi`. Implementation detail:
+ * each binding's output references get copied into the deployment's
+ * `triggers` map so `resolveUpstream` sees them as real upstream dependencies.
+ */
+export const Deployment = (id: string, props: DeploymentInputProps) =>
+  Effect.gen(function* () {
+    const { restApi, ...rest } = props;
+    const restApiId = rest.restApiId ?? restApi?.restApiId;
+    if (!restApiId) {
+      return yield* Effect.die(
+        "Deployment requires either `restApi` (preferred) or explicit " +
+          "`restApiId`.",
+      );
+    }
+    let triggers: Record<string, Input<string>> | undefined = rest.triggers;
+    if (restApi) {
+      const stack = yield* Stack;
+      const bindings = stack.bindings[restApi.FQN] ?? [];
+      const autoTriggers: Record<string, Input<string>> = {};
+      for (const b of bindings) {
+        autoTriggers[`@alchemy:binding:${b.sid}`] = bindingDigest(b.data);
+      }
+      triggers = { ...autoTriggers, ...(triggers ?? {}) };
+    }
+    return yield* DeploymentResource(id, {
+      ...rest,
+      restApiId,
+      triggers,
+    } as any);
+  });
+
+/**
+ * Serializes a binding payload down to a deterministic `Input<string>` so
+ * it can ride along as a trigger value. The inner `Output.all` is what
+ * surfaces the underlying resource FQNs to the dependency resolver.
+ */
+const bindingDigest = (data: RestApiBinding): Input<string> => {
+  const entries = Object.entries(data as Record<string, unknown>).filter(
+    ([k]) => k !== "kind",
+  );
+  const values = entries.map(([, v]) =>
+    Output.asOutput(v as string | Output.Output<string>),
+  );
+  return Output.map(Output.all(...values), (parts) =>
+    [data.kind, ...(parts as unknown as unknown[]).map(String)].join("|"),
+  );
+};
+
+const embedTriggers = (
+  description: string | undefined,
+  triggers?: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    if (!triggers || Object.keys(triggers).length === 0) {
+      return description;
+    }
+    const fp = yield* Effect.sync(() =>
+      createHash("sha256")
+        .update(JSON.stringify(triggers))
+        .digest("hex")
+        .slice(0, 24),
+    );
+    const suffix = `@alchemy:triggers:${fp}`;
+    return description ? `${description}\n${suffix}` : suffix;
+  });
+
+export const DeploymentProvider = () =>
+  Provider.effect(
+    DeploymentResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["deploymentId", "restApiId"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as Input.ResolveProps<DeploymentProps>;
+          const oldsP = olds as Input.ResolveProps<DeploymentProps>;
+          if (news.restApiId !== oldsP.restApiId) {
+            return { action: "replace" } as const;
+          }
+          if (!deepEqual(news.triggers, oldsP.triggers)) {
+            return { action: "replace" } as const;
+          }
+          if (
+            news.stageName !== oldsP.stageName ||
+            news.stageDescription !== oldsP.stageDescription ||
+            news.cacheClusterEnabled !== oldsP.cacheClusterEnabled ||
+            news.cacheClusterSize !== oldsP.cacheClusterSize ||
+            !deepEqual(news.variables, oldsP.variables) ||
+            !deepEqual(news.canarySettings, oldsP.canarySettings) ||
+            news.tracingEnabled !== oldsP.tracingEnabled
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (news.description !== oldsP.description) {
+            return { action: "update" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.deploymentId) return undefined;
+          const d = yield* ag
+            .getDeployment({
+              restApiId: output.restApiId,
+              deploymentId: output.deploymentId,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!d?.id) return undefined;
+          return {
+            deploymentId: d.id,
+            restApiId: output.restApiId,
+            description: d.description,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("Deployment props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<DeploymentProps>;
+          const description = yield* embedTriggers(
+            news.description,
+            news.triggers as Record<string, string> | undefined,
+          );
+          const restApiId = (output?.restApiId ?? news.restApiId) as string;
+
+          // Observe — fetch the live deployment if we have a cached id.
+          // A Deployment is immutable apart from `description`, so we never
+          // trust a stale `output.description` for diffing.
+          let observed = output?.deploymentId
+            ? yield* ag
+                .getDeployment({
+                  restApiId,
+                  deploymentId: output.deploymentId,
+                })
+                .pipe(
+                  Effect.catchTag("NotFoundException", () =>
+                    Effect.succeed(undefined),
+                  ),
+                )
+            : undefined;
+
+          // Ensure — create a new deployment if there isn't one yet.
+          // `createDeployment` always produces a fresh deploymentId, so we
+          // only call it when missing; any change that should produce a new
+          // deployment is modeled as `replace` in `diff`.
+          if (!observed?.id) {
+            const created = yield* retryOnApiStatusUpdating(
+              ag.createDeployment({
+                restApiId: news.restApiId as string,
+                stageName: news.stageName,
+                stageDescription: news.stageDescription,
+                description,
+                cacheClusterEnabled: news.cacheClusterEnabled,
+                cacheClusterSize: news.cacheClusterSize,
+                variables: news.variables,
+                canarySettings: news.canarySettings,
+                tracingEnabled: news.tracingEnabled,
+              }),
+            );
+            if (!created.id)
+              return yield* Effect.die("createDeployment missing id");
+            yield* session.note(`Created deployment ${created.id}`);
+            observed = yield* ag.getDeployment({
+              restApiId: news.restApiId as string,
+              deploymentId: created.id,
+            });
+          }
+
+          const deploymentId = observed.id!;
+
+          // Sync description — observed ↔ desired.
+          if (description !== observed.description) {
+            yield* retryOnApiStatusUpdating(
+              ag.updateDeployment({
+                restApiId,
+                deploymentId,
+                patchOperations: description
+                  ? [
+                      {
+                        op: "replace",
+                        path: "/description",
+                        value: description,
+                      },
+                    ]
+                  : [{ op: "remove", path: "/description" }],
+              }),
+            );
+          }
+
+          yield* session.note(`Reconciled deployment ${deploymentId}`);
+          const final = yield* ag.getDeployment({
+            restApiId,
+            deploymentId,
+          });
+          return {
+            deploymentId,
+            restApiId,
+            description: final?.description,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* retryOnApiStatusUpdating(
+            ag
+              .deleteDeployment({
+                restApiId: output.restApiId,
+                deploymentId: output.deploymentId,
+              })
+              .pipe(Effect.catchTag("NotFoundException", () => Effect.void)),
+          );
+          yield* session.note(`Deleted deployment ${output.deploymentId}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/DomainName.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/DomainName.ts
new file mode 100644
index 00000000000..1b732669404
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/DomainName.ts
@@ -0,0 +1,263 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, tagRecord } from "../../Tags.ts";
+
+import { syncTags } from "./common.ts";
+
+export interface DomainNameProps {
+  domainName: string;
+  certificateName?: string;
+  certificateBody?: string;
+  certificatePrivateKey?: string;
+  certificateChain?: string;
+  certificateArn?: string;
+  regionalCertificateName?: string;
+  regionalCertificateArn?: string;
+  endpointConfiguration?: ag.EndpointConfiguration;
+  securityPolicy?: ag.SecurityPolicy;
+  endpointAccessMode?: ag.EndpointAccessMode;
+  mutualTlsAuthentication?: ag.MutualTlsAuthenticationInput;
+  ownershipVerificationCertificateArn?: string;
+  policy?: string;
+  routingMode?: ag.RoutingMode;
+  tags?: Record<string, string>;
+}
+
+export interface DomainName extends Resource<
+  "AWS.ApiGateway.DomainName",
+  DomainNameProps,
+  {
+    domainName: string;
+    regionalDomainName: string | undefined;
+    regionalHostedZoneId: string | undefined;
+    distributionDomainName: string | undefined;
+    distributionHostedZoneId: string | undefined;
+    domainNameArn: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Custom domain name for an Amazon API Gateway REST API.
+ *
+ * @section Custom domain
+ * @example Regional custom domain
+ * ```typescript
+ * const domain = yield* ApiGateway.DomainName("ApiDomain", {
+ *   domainName: "api.example.com",
+ *   regionalCertificateArn: cert.certificateArn,
+ *   endpointConfiguration: { types: ["REGIONAL"] },
+ *   securityPolicy: "TLS_1_2",
+ * });
+ * ```
+ */
+const DomainNameResource = Resource<DomainName>("AWS.ApiGateway.DomainName");
+
+export { DomainNameResource as DomainName };
+
+const retryDomainNameMutation = Effect.retry({
+  while: (e: any) =>
+    e._tag === "ConflictException" || e._tag === "TooManyRequestsException",
+  schedule: Schedule.spaced("1 second"),
+  times: 8,
+});
+
+export const DomainNameProvider = () =>
+  Provider.effect(
+    DomainNameResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["domainName"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as DomainNameProps;
+          if (news.domainName !== olds.domainName) {
+            return { action: "replace" } as const;
+          }
+          if (
+            !deepEqual(news.endpointConfiguration, olds.endpointConfiguration)
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (news.endpointAccessMode !== olds.endpointAccessMode) {
+            return { action: "replace" } as const;
+          }
+          if (news.certificateBody !== olds.certificateBody) {
+            return { action: "replace" } as const;
+          }
+          if (news.certificatePrivateKey !== olds.certificatePrivateKey) {
+            return { action: "replace" } as const;
+          }
+          if (news.certificateChain !== olds.certificateChain) {
+            return { action: "replace" } as const;
+          }
+          if (news.certificateName !== olds.certificateName) {
+            return { action: "replace" } as const;
+          }
+          if (news.regionalCertificateName !== olds.regionalCertificateName) {
+            return { action: "replace" } as const;
+          }
+          if (
+            !deepEqual(
+              news.mutualTlsAuthentication,
+              olds.mutualTlsAuthentication,
+            )
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (news.policy !== olds.policy) {
+            return { action: "replace" } as const;
+          }
+          if (news.routingMode !== olds.routingMode) {
+            return { action: "replace" } as const;
+          }
+          if (
+            news.ownershipVerificationCertificateArn !==
+            olds.ownershipVerificationCertificateArn
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.domainName) return undefined;
+          const d = yield* ag
+            .getDomainName({ domainName: output.domainName })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!d?.domainName) return undefined;
+          return {
+            domainName: d.domainName,
+            regionalDomainName: d.regionalDomainName,
+            regionalHostedZoneId: d.regionalHostedZoneId,
+            distributionDomainName: d.distributionDomainName,
+            distributionHostedZoneId: d.distributionHostedZoneId,
+            domainNameArn: d.domainNameArn,
+            tags: tagRecord(d.tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("DomainName props were not resolved");
+          }
+          const news = newsIn as DomainNameProps;
+          const domainName = output?.domainName ?? news.domainName;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...news.tags, ...internalTags };
+
+          // Observe — fetch the live domain name. Domain names are
+          // user-supplied physical names so the lookup key is stable; we
+          // never trust `output.tags`/`output.securityPolicy` etc. for
+          // diffing, only re-read the cloud state.
+          let observed = yield* ag
+            .getDomainName({ domainName })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the domain name if it's missing.
+          if (!observed?.domainName) {
+            yield* ag.createDomainName({
+              domainName: news.domainName,
+              certificateName: news.certificateName,
+              certificateBody: news.certificateBody,
+              certificatePrivateKey: news.certificatePrivateKey,
+              certificateChain: news.certificateChain,
+              certificateArn: news.certificateArn,
+              regionalCertificateName: news.regionalCertificateName,
+              regionalCertificateArn: news.regionalCertificateArn,
+              endpointConfiguration: news.endpointConfiguration,
+              tags: desiredTags,
+              securityPolicy: news.securityPolicy,
+              endpointAccessMode: news.endpointAccessMode,
+              mutualTlsAuthentication: news.mutualTlsAuthentication,
+              ownershipVerificationCertificateArn:
+                news.ownershipVerificationCertificateArn,
+              policy: news.policy,
+              routingMode: news.routingMode,
+            });
+            yield* session.note(`Created domain name ${news.domainName}`);
+            observed = yield* ag.getDomainName({ domainName });
+          }
+
+          // Sync mutable scalar fields — observed ↔ desired patch list.
+          const patches: ag.PatchOperation[] = [];
+          if (news.securityPolicy !== observed.securityPolicy) {
+            patches.push({
+              op: news.securityPolicy === undefined ? "remove" : "replace",
+              path: "/securityPolicy",
+              value: news.securityPolicy,
+            });
+          }
+          if (news.regionalCertificateArn !== observed.regionalCertificateArn) {
+            patches.push({
+              op:
+                news.regionalCertificateArn === undefined
+                  ? "remove"
+                  : "replace",
+              path: "/regionalCertificateArn",
+              value: news.regionalCertificateArn,
+            });
+          }
+          if (news.certificateArn !== observed.certificateArn) {
+            patches.push({
+              op: news.certificateArn === undefined ? "remove" : "replace",
+              path: "/certificateArn",
+              value: news.certificateArn,
+            });
+          }
+          if (patches.length > 0) {
+            // Domain name mutations can briefly conflict while API Gateway
+            // propagates certificate, policy, or routing changes.
+            yield* ag
+              .updateDomainName({
+                domainName,
+                patchOperations: patches,
+              })
+              .pipe(retryDomainNameMutation);
+          }
+
+          // Sync tags — diff observed cloud tags against desired so adoption
+          // converges without fighting whatever was already there.
+          const observedTags = tagRecord(observed.tags);
+          if (!deepEqual(observedTags, desiredTags) && observed.domainNameArn) {
+            yield* syncTags({
+              resourceArn: observed.domainNameArn,
+              oldTags: observedTags,
+              newTags: desiredTags,
+            });
+          }
+
+          yield* session.note(`Reconciled domain name ${domainName}`);
+          const final = yield* ag.getDomainName({ domainName });
+          return {
+            domainName: final.domainName!,
+            regionalDomainName: final.regionalDomainName,
+            regionalHostedZoneId: final.regionalHostedZoneId,
+            distributionDomainName: final.distributionDomainName,
+            distributionHostedZoneId: final.distributionHostedZoneId,
+            domainNameArn: final.domainNameArn,
+            tags: tagRecord(final.tags),
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag.deleteDomainName({ domainName: output.domainName }).pipe(
+            Effect.catchTag("NotFoundException", () => Effect.void),
+            retryDomainNameMutation,
+          );
+          yield* session.note(`Deleted domain name ${output.domainName}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/GatewayResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/GatewayResource.ts
new file mode 100644
index 00000000000..23666717c78
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/GatewayResource.ts
@@ -0,0 +1,237 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import {
+  Resource as ResourceFactory,
+  type Resource as ResourceType,
+} from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { RestApi } from "./RestApi.ts";
+
+export interface ApiGatewayResourceProps {
+  /**
+   * The `RestApi` this path segment belongs to. Binding via `restApi`
+   * registers this resource on the API so that any `Deployment` of the
+   * same API waits for it — and for the methods attached to it — before
+   * snapshotting.
+   */
+  restApi?: RestApi;
+  /**
+   * Identifier of the parent REST API. Usually derived from `restApi.restApiId`.
+   */
+  restApiId?: Input<string>;
+  /**
+   * Parent resource id (use `api.rootResourceId` for top-level paths, or
+   * the `resourceId` of another `ApiGateway.Resource` to nest deeper).
+   */
+  parentId: Input<string>;
+  /**
+   * Path segment (e.g. `items` or `{proxy+}`).
+   */
+  pathPart: string;
+}
+
+export interface ApiGatewayResource extends ResourceType<
+  "AWS.ApiGateway.Resource",
+  ApiGatewayResourceProps,
+  {
+    resourceId: string;
+    restApiId: string;
+    parentId: string;
+    pathPart: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A path segment under a REST API resource tree.
+ *
+ * Resources form the URL hierarchy of a REST API: every path segment
+ * (`/items`, `/items/{id}`, `/{proxy+}`) is a `Resource` whose `parentId`
+ * points either at `api.rootResourceId` (for top-level paths) or at
+ * another `Resource`'s `resourceId` (for nested paths). Attach methods
+ * to a resource by passing its `resourceId` to `ApiGateway.Method`.
+ *
+ * @section Path resources
+ * @example Top-level path
+ * ```typescript
+ * const items = yield* ApiGateway.Resource("Items", {
+ *   restApi: api,
+ *   parentId: api.rootResourceId,
+ *   pathPart: "items",
+ * });
+ * ```
+ *
+ * @example Nested path with a greedy proxy
+ * ```typescript
+ * const items = yield* ApiGateway.Resource("Items", {
+ *   restApi: api,
+ *   parentId: api.rootResourceId,
+ *   pathPart: "items",
+ * });
+ *
+ * const anyItem = yield* ApiGateway.Resource("AnyItem", {
+ *   restApi: api,
+ *   parentId: items.resourceId,
+ *   pathPart: "{proxy+}",
+ * });
+ * ```
+ */
+export const GatewayResource = ResourceFactory<ApiGatewayResource>(
+  "AWS.ApiGateway.Resource",
+);
+
+interface ApiGatewayResourceInputProps {
+  restApi?: RestApi;
+  restApiId?: Input<string>;
+  parentId: Input<string>;
+  pathPart: Input<string>;
+}
+
+/**
+ * User-facing wrapper. Accepts `restApi: RestApi` to register this resource
+ * as a binding on the API (so deployments wait for it transitively).
+ */
+const ResourceImpl = (id: string, props: ApiGatewayResourceInputProps) =>
+  Effect.gen(function* () {
+    const { restApi, ...rest } = props;
+    const restApiId = rest.restApiId ?? restApi?.restApiId;
+    if (!restApiId) {
+      return yield* Effect.die(
+        "ApiGateway.Resource requires either `restApi` (preferred) or " +
+          "explicit `restApiId`.",
+      );
+    }
+    const resource = yield* GatewayResource(id, {
+      ...rest,
+      restApiId,
+    } as any);
+    if (restApi) {
+      yield* restApi.bind`${resource}`({
+        kind: "resource",
+        resourceId: resource.resourceId,
+        parentId: resource.parentId,
+        pathPart: resource.pathPart,
+      });
+    }
+    return resource;
+  });
+
+export const Resource = ResourceImpl;
+
+export const ResourceProvider = () =>
+  Provider.effect(
+    GatewayResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["resourceId", "restApiId", "parentId"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as Input.ResolveProps<ApiGatewayResourceProps>;
+          if (
+            news.restApiId !== olds.restApiId ||
+            news.pathPart !== olds.pathPart ||
+            news.parentId !== olds.parentId
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.resourceId) return undefined;
+          const r = yield* ag
+            .getResource({
+              restApiId: output.restApiId,
+              resourceId: output.resourceId,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!r?.id) return undefined;
+          return {
+            resourceId: r.id,
+            restApiId: output.restApiId,
+            parentId: r.parentId!,
+            pathPart: r.pathPart!,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("Resource props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<ApiGatewayResourceProps>;
+          const restApiId = (output?.restApiId ?? news.restApiId) as string;
+
+          // Observe — fetch the live resource if we have a cached id. We
+          // never trust `output.pathPart` for diffing; we re-read the
+          // pathPart from cloud state every reconcile.
+          let observed = output?.resourceId
+            ? yield* ag
+                .getResource({
+                  restApiId,
+                  resourceId: output.resourceId,
+                })
+                .pipe(
+                  Effect.catchTag("NotFoundException", () =>
+                    Effect.succeed(undefined),
+                  ),
+                )
+            : undefined;
+
+          // Ensure — create the resource if missing.
+          if (!observed?.id) {
+            const created = yield* ag.createResource({
+              restApiId: news.restApiId as string,
+              parentId: news.parentId as string,
+              pathPart: news.pathPart,
+            });
+            if (!created.id) {
+              return yield* Effect.die("createResource missing id");
+            }
+            yield* session.note(
+              `Created API Gateway resource ${created.id} (${news.pathPart})`,
+            );
+            observed = yield* ag.getResource({
+              restApiId: news.restApiId as string,
+              resourceId: created.id,
+            });
+          }
+
+          const resourceId = observed.id!;
+
+          // Sync pathPart — observed ↔ desired. parentId moves are modeled
+          // as `replace` in `diff`, so we don't try to patch them here.
+          if (news.pathPart !== observed.pathPart) {
+            yield* ag.updateResource({
+              restApiId,
+              resourceId,
+              patchOperations: [
+                { op: "replace", path: "/pathPart", value: news.pathPart },
+              ],
+            });
+            yield* session.note(`Updated resource ${resourceId}`);
+          }
+
+          return {
+            resourceId,
+            restApiId,
+            parentId: observed.parentId!,
+            pathPart: news.pathPart,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag
+            .deleteResource({
+              restApiId: output.restApiId,
+              resourceId: output.resourceId,
+            })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+          yield* session.note(`Deleted resource ${output.resourceId}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/GatewayResponse.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/GatewayResponse.ts
new file mode 100644
index 00000000000..87f95585d7e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/GatewayResponse.ts
@@ -0,0 +1,130 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { retryOnApiStatusUpdating } from "./common.ts";
+
+export interface GatewayResponseProps {
+  restApiId: Input<string>;
+  responseType: ag.GatewayResponseType;
+  statusCode?: string;
+  responseParameters?: { [key: string]: string | undefined };
+  responseTemplates?: { [key: string]: string | undefined };
+}
+
+export interface GatewayResponse extends Resource<
+  "AWS.ApiGateway.GatewayResponse",
+  GatewayResponseProps,
+  {
+    restApiId: string;
+    responseType: ag.GatewayResponseType;
+    statusCode: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Gateway response mapping for a REST API (e.g. DEFAULT_4XX, DEFAULT_5XX).
+ *
+ * @section Gateway responses
+ * @example Default 4xx JSON body
+ * ```typescript
+ * yield* ApiGateway.GatewayResponse("Default4xx", {
+ *   restApiId: api.restApiId,
+ *   responseType: "DEFAULT_4XX",
+ *   responseTemplates: { "application/json": '{"message":$context.error.messageString}' },
+ * });
+ * ```
+ */
+const GatewayResponseResource = Resource<GatewayResponse>(
+  "AWS.ApiGateway.GatewayResponse",
+);
+
+export { GatewayResponseResource as GatewayResponse };
+
+export const GatewayResponseProvider = () =>
+  Provider.effect(
+    GatewayResponseResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["restApiId", "responseType"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as Input.ResolveProps<GatewayResponseProps>;
+          if (
+            news.restApiId !== olds.restApiId ||
+            news.responseType !== olds.responseType
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const g = yield* ag
+            .getGatewayResponse({
+              restApiId: output.restApiId,
+              responseType: output.responseType,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!g?.responseType) return undefined;
+          return {
+            restApiId: output.restApiId,
+            responseType: g.responseType!,
+            statusCode: g.statusCode,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("GatewayResponse props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<GatewayResponseProps>;
+          const restApiId = (output?.restApiId ?? news.restApiId) as string;
+          const responseType = output?.responseType ?? news.responseType;
+
+          // Observe + Ensure + Sync as one atomic op.
+          // `putGatewayResponse` is an upsert: it creates the response if
+          // missing, replaces it if present. The reconciler is therefore a
+          // single put against the desired state regardless of whether
+          // `output` exists.
+          yield* retryOnApiStatusUpdating(
+            ag.putGatewayResponse({
+              restApiId,
+              responseType,
+              statusCode: news.statusCode,
+              responseParameters: news.responseParameters,
+              responseTemplates: news.responseTemplates,
+            }),
+          );
+          yield* session.note(
+            `Reconciled gateway response ${responseType} on ${restApiId}`,
+          );
+          return {
+            restApiId,
+            responseType,
+            statusCode: news.statusCode,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* retryOnApiStatusUpdating(
+            ag
+              .deleteGatewayResponse({
+                restApiId: output.restApiId,
+                responseType: output.responseType,
+              })
+              .pipe(Effect.catchTag("NotFoundException", () => Effect.void)),
+          );
+          yield* session.note(
+            `Deleted gateway response ${output.responseType}`,
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Method.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Method.ts
new file mode 100644
index 00000000000..9ffed4a4991
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Method.ts
@@ -0,0 +1,547 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { RestApi } from "./RestApi.ts";
+
+/**
+ * Integration configuration for an API Gateway method (passed to `putIntegration`).
+ */
+export interface MethodIntegrationProps {
+  type: ag.IntegrationType;
+  integrationHttpMethod?: string;
+  uri?: Input<string>;
+  connectionType?: ag.ConnectionType;
+  connectionId?: string;
+  /**
+   * IAM role ARN used by API Gateway for integration credentials.
+   *
+   * This is not a secret value; API Gateway stores an ARN or passthrough marker.
+   */
+  credentials?: string;
+  requestParameters?: { [key: string]: string | undefined };
+  requestTemplates?: { [key: string]: string | undefined };
+  passthroughBehavior?: string;
+  cacheNamespace?: string;
+  cacheKeyParameters?: string[];
+  contentHandling?: ag.ContentHandlingStrategy;
+  timeoutInMillis?: number;
+  tlsConfig?: ag.TlsConfig;
+  responseTransferMode?: ag.ResponseTransferMode;
+  integrationTarget?: string;
+}
+
+export interface MethodProps {
+  /**
+   * The `RestApi` this method lives on. When supplied, the method auto-binds
+   * itself to the API so that any `Deployment` of this API waits for the
+   * method to be created before snapshotting.
+   *
+   * When `restApi` is provided, `resourceId` defaults to `restApi.rootResourceId`,
+   * which is the common case for methods on the API root (`/`). Pass an
+   * explicit `resourceId` when targeting a sub-path defined by
+   * `ApiGateway.Resource`.
+   *
+   * Passing a raw `restApiId` instead is still supported but opts out of
+   * automatic deployment ordering — you must then manage `Deployment.triggers`
+   * yourself.
+   */
+  restApi?: RestApi;
+  /**
+   * ID of the REST API. Usually derived from `restApi.restApiId`; supply
+   * explicitly only when not using `restApi`.
+   */
+  restApiId?: Input<string>;
+  /**
+   * ID of the API Gateway Resource this method attaches to. Defaults to
+   * `restApi.rootResourceId` when `restApi` is provided.
+   */
+  resourceId?: Input<string>;
+  /** HTTP verb, e.g. `GET`, `POST`, `ANY`. */
+  httpMethod: string;
+  /**
+   * Authorization type (`NONE`, `IAM`, `CUSTOM`, `COGNITO_USER_POOLS`, etc.).
+   * @default "NONE"
+   */
+  authorizationType?: string;
+  authorizerId?: string;
+  apiKeyRequired?: boolean;
+  operationName?: string;
+  requestParameters?: { [key: string]: boolean | undefined };
+  requestModels?: { [key: string]: string | undefined };
+  requestValidatorId?: string;
+  authorizationScopes?: string[];
+  /** When set, `putIntegration` is applied after `putMethod`. */
+  integration?: MethodIntegrationProps;
+}
+
+export interface MethodType extends Resource<
+  "AWS.ApiGateway.Method",
+  MethodProps,
+  {
+    restApiId: string;
+    resourceId: string;
+    httpMethod: string;
+    authorizationType: string;
+    authorizerId: string | undefined;
+    apiKeyRequired: boolean | undefined;
+    operationName: string | undefined;
+    requestParameters: { [key: string]: boolean | undefined } | undefined;
+    requestModels: { [key: string]: string | undefined } | undefined;
+    requestValidatorId: string | undefined;
+    authorizationScopes: string[] | undefined;
+    integration: MethodIntegrationProps | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An HTTP method on an API Gateway Resource.
+ *
+ * A `Method` is a single HTTP verb (`GET`, `POST`, `ANY`, …) attached to a
+ * REST API resource path. Most methods also carry an `integration` — the
+ * downstream target that actually handles the request (a Lambda function,
+ * an HTTP endpoint, a mock response, etc.).
+ *
+ * @section Binding to a RestApi
+ * Pass the `RestApi` value on `restApi`. This threads the API id through
+ * and registers the method as a `RestApiBinding` on the API, so that any
+ * `Deployment` of the same API is automatically ordered after this method
+ * completes. You do not need to manage `Deployment.triggers` yourself.
+ *
+ * @example GET on the API root with a mock integration
+ * ```typescript
+ * yield* ApiGateway.Method("GetRoot", {
+ *   restApi: api,
+ *   httpMethod: "GET",
+ *   authorizationType: "NONE",
+ *   integration: { type: "MOCK" },
+ * });
+ * ```
+ *
+ * @section Lambda proxy integration
+ * For Lambda-backed APIs, the integration `uri` follows the
+ * `arn:aws:apigateway:<region>:lambda:path/2015-03-31/functions/<function-arn>/invocations`
+ * shape. Use `Output.map` to resolve the function ARN before building the
+ * URI, since the function's ARN is only known at deploy time.
+ *
+ * @example ANY method with Lambda AWS_PROXY integration
+ * ```typescript
+ * import * as Output from "alchemy/Output";
+ *
+ * const invokeUri = Output.map(
+ *   fn.functionArn,
+ *   (arn) =>
+ *     `arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/${arn}/invocations`,
+ * );
+ *
+ * yield* ApiGateway.Method("RootAny", {
+ *   restApi: api,
+ *   httpMethod: "ANY",
+ *   authorizationType: "NONE",
+ *   integration: {
+ *     type: "AWS_PROXY",
+ *     integrationHttpMethod: "POST",
+ *     uri: invokeUri,
+ *   },
+ * });
+ * ```
+ *
+ * @section Methods on sub-paths
+ * Attach a method to a nested path by creating an `ApiGateway.Resource` and
+ * passing its `resourceId` explicitly. `restApi` is still required so the
+ * method binds for deployment ordering.
+ *
+ * @example Method on `/items`
+ * ```typescript
+ * const items = yield* ApiGateway.Resource("Items", {
+ *   restApi: api,
+ *   parentId: api.rootResourceId,
+ *   pathPart: "items",
+ * });
+ *
+ * yield* ApiGateway.Method("ListItems", {
+ *   restApi: api,
+ *   resourceId: items.resourceId,
+ *   httpMethod: "GET",
+ *   authorizationType: "NONE",
+ *   integration: { type: "MOCK" },
+ * });
+ * ```
+ */
+export const MethodResource = Resource<MethodType>("AWS.ApiGateway.Method");
+
+export interface MethodInputProps {
+  restApi?: RestApi;
+  restApiId?: Input<string>;
+  resourceId?: Input<string>;
+  httpMethod: Input<string>;
+  authorizationType?: Input<string>;
+  authorizerId?: Input<string>;
+  apiKeyRequired?: Input<boolean>;
+  operationName?: Input<string>;
+  requestParameters?: Input<MethodProps["requestParameters"]>;
+  requestModels?: Input<MethodProps["requestModels"]>;
+  requestValidatorId?: Input<string>;
+  authorizationScopes?: Input<string[]>;
+  integration?: Input<MethodIntegrationProps>;
+}
+
+const MethodImpl = (id: string, props: MethodInputProps) =>
+  Effect.gen(function* () {
+    const { restApi, ...rest } = props;
+    const restApiId = rest.restApiId ?? restApi?.restApiId;
+    const resourceId = rest.resourceId ?? restApi?.rootResourceId;
+    if (!restApiId || !resourceId) {
+      return yield* Effect.die(
+        "Method requires either `restApi` (preferred) or explicit " +
+          "`restApiId` and `resourceId`.",
+      );
+    }
+    const method = yield* MethodResource(id, {
+      ...rest,
+      restApiId,
+      resourceId,
+    } as any);
+    if (restApi) {
+      yield* restApi.bind`${method}`({
+        kind: "method",
+        methodId: method.LogicalId,
+        restApiId: method.restApiId,
+        resourceId: method.resourceId,
+        httpMethod: method.httpMethod,
+      });
+    }
+    return method;
+  });
+
+/**
+ * User-facing wrapper for the Method resource. Accepts `restApi: RestApi`
+ * as the idiomatic way to attach a method — this both forwards the API id
+ * and registers the method as a binding on the RestApi so the scheduler
+ * orders `Deployment` after it.
+ */
+export const Method = MethodImpl;
+
+const putIntegrationRequest = (
+  restApiId: string,
+  resourceId: string,
+  httpMethod: string,
+  integration: MethodIntegrationProps,
+): ag.PutIntegrationRequest => ({
+  restApiId,
+  resourceId,
+  httpMethod,
+  type: integration.type,
+  integrationHttpMethod: integration.integrationHttpMethod,
+  uri: integration.uri as string,
+  connectionType: integration.connectionType,
+  connectionId: integration.connectionId,
+  credentials: integration.credentials,
+  requestParameters: integration.requestParameters,
+  requestTemplates: integration.requestTemplates,
+  passthroughBehavior: integration.passthroughBehavior,
+  cacheNamespace: integration.cacheNamespace,
+  cacheKeyParameters: integration.cacheKeyParameters,
+  contentHandling: integration.contentHandling,
+  timeoutInMillis: integration.timeoutInMillis,
+  tlsConfig: integration.tlsConfig,
+  responseTransferMode: integration.responseTransferMode,
+  integrationTarget: integration.integrationTarget,
+});
+
+const putMethod = (news: Input.ResolveProps<MethodProps>) =>
+  ag.putMethod({
+    restApiId: news.restApiId as string,
+    resourceId: news.resourceId as string,
+    httpMethod: news.httpMethod,
+    authorizationType: news.authorizationType ?? "NONE",
+    authorizerId: news.authorizerId,
+    apiKeyRequired: news.apiKeyRequired,
+    operationName: news.operationName,
+    requestParameters: news.requestParameters,
+    requestModels: news.requestModels,
+    requestValidatorId: news.requestValidatorId,
+    authorizationScopes: news.authorizationScopes,
+  });
+
+const deleteIntegrationSafe = (p: {
+  restApiId: string;
+  resourceId: string;
+  httpMethod: string;
+}) =>
+  ag
+    .deleteIntegration({
+      restApiId: p.restApiId,
+      resourceId: p.resourceId,
+      httpMethod: p.httpMethod,
+    })
+    .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+
+const deleteMethodSafe = (p: {
+  restApiId: string;
+  resourceId: string;
+  httpMethod: string;
+}) =>
+  ag
+    .deleteMethod({
+      restApiId: p.restApiId,
+      resourceId: p.resourceId,
+      httpMethod: p.httpMethod,
+    })
+    .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+
+const readMethodSnapshot = (p: {
+  restApiId: string;
+  resourceId: string;
+  httpMethod: string;
+}) =>
+  Effect.gen(function* () {
+    const method = yield* ag
+      .getMethod({
+        restApiId: p.restApiId,
+        resourceId: p.resourceId,
+        httpMethod: p.httpMethod,
+      })
+      .pipe(
+        Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+      );
+    if (!method?.httpMethod) return undefined;
+
+    const integ = yield* ag
+      .getIntegration({
+        restApiId: p.restApiId,
+        resourceId: p.resourceId,
+        httpMethod: p.httpMethod,
+      })
+      .pipe(
+        Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+      );
+
+    const integration: MethodIntegrationProps | undefined = integ?.type
+      ? {
+          type: integ.type!,
+          integrationHttpMethod: integ.httpMethod,
+          uri: integ.uri,
+          connectionType: integ.connectionType,
+          connectionId: integ.connectionId,
+          credentials: integ.credentials,
+          requestParameters: integ.requestParameters,
+          requestTemplates: integ.requestTemplates,
+          passthroughBehavior: integ.passthroughBehavior,
+          cacheNamespace: integ.cacheNamespace,
+          cacheKeyParameters: integ.cacheKeyParameters,
+          contentHandling: integ.contentHandling,
+          timeoutInMillis: integ.timeoutInMillis,
+          tlsConfig: integ.tlsConfig,
+          responseTransferMode: integ.responseTransferMode,
+          integrationTarget: integ.integrationTarget,
+        }
+      : undefined;
+
+    return {
+      restApiId: p.restApiId,
+      resourceId: p.resourceId,
+      httpMethod: p.httpMethod,
+      authorizationType: method.authorizationType ?? "NONE",
+      authorizerId: method.authorizerId,
+      apiKeyRequired: method.apiKeyRequired,
+      operationName: method.operationName,
+      requestParameters: method.requestParameters,
+      requestModels: method.requestModels,
+      requestValidatorId: method.requestValidatorId,
+      authorizationScopes: method.authorizationScopes,
+      integration,
+    };
+  });
+
+export const MethodProvider = () =>
+  Provider.effect(
+    MethodResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["restApiId", "resourceId", "httpMethod"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as Input.ResolveProps<MethodProps>;
+          if (
+            news.restApiId !== olds.restApiId ||
+            news.resourceId !== olds.resourceId ||
+            news.httpMethod !== olds.httpMethod
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          return yield* readMethodSnapshot({
+            restApiId: output.restApiId,
+            resourceId: output.resourceId,
+            httpMethod: output.httpMethod,
+          });
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("Method props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<MethodProps>;
+          const authType = news.authorizationType ?? "NONE";
+          // Methods are keyed by (restApiId, resourceId, httpMethod). All
+          // three are stable across the resource's lifetime, so we read
+          // them out of `output` when present and fall back to `news`.
+          const restApiId = (output?.restApiId ?? news.restApiId) as string;
+          const resourceId = (output?.resourceId ?? news.resourceId) as string;
+          const httpMethod = output?.httpMethod ?? news.httpMethod;
+
+          // Observe — read live method + integration as a single snapshot.
+          // `output.*` fields are never trusted as proxies for cloud state;
+          // they're at most a cache for the natural-key tuple above.
+          let observed = yield* readMethodSnapshot({
+            restApiId,
+            resourceId,
+            httpMethod,
+          });
+
+          // Ensure — putMethod creates the method shape (auth type,
+          // request models, scopes, etc.). Some of those fields cannot be
+          // patched in place by `updateMethod`, so on a "recreate-needed"
+          // diff we drop the existing method and re-put. This is also the
+          // path used on first reconcile when nothing exists.
+          const needsRecreate =
+            observed !== undefined &&
+            (news.operationName !== observed.operationName ||
+              !deepEqual(news.requestParameters, observed.requestParameters) ||
+              !deepEqual(news.requestModels, observed.requestModels) ||
+              news.requestValidatorId !== observed.requestValidatorId ||
+              !deepEqual(
+                news.authorizationScopes,
+                observed.authorizationScopes,
+              ));
+
+          if (observed === undefined || needsRecreate) {
+            if (needsRecreate) {
+              yield* deleteIntegrationSafe({
+                restApiId,
+                resourceId,
+                httpMethod,
+              });
+              yield* deleteMethodSafe({ restApiId, resourceId, httpMethod });
+            }
+            yield* putMethod({
+              ...news,
+              restApiId,
+              resourceId,
+              httpMethod,
+            });
+            if (news.integration) {
+              yield* ag.putIntegration(
+                putIntegrationRequest(
+                  restApiId,
+                  resourceId,
+                  httpMethod,
+                  news.integration,
+                ),
+              );
+            }
+            yield* session.note(
+              needsRecreate
+                ? `Recreated method ${httpMethod}`
+                : `Put method ${httpMethod} on resource ${resourceId}`,
+            );
+            // Re-read to get the canonical observed state for the rest of
+            // the reconciler. After a recreate everything matches `news`,
+            // so the patch step below becomes a no-op.
+            observed = yield* readMethodSnapshot({
+              restApiId,
+              resourceId,
+              httpMethod,
+            });
+            if (!observed) {
+              return yield* Effect.die("getMethod missing after put");
+            }
+          }
+
+          // Sync patchable scalar fields — observed ↔ desired.
+          const patches: ag.PatchOperation[] = [];
+          if (authType !== observed.authorizationType) {
+            patches.push({
+              op: "replace",
+              path: "/authorizationType",
+              value: authType,
+            });
+          }
+          if (news.authorizerId !== observed.authorizerId) {
+            patches.push({
+              op: "replace",
+              path: "/authorizerId",
+              value: news.authorizerId ?? "",
+            });
+          }
+          if (news.apiKeyRequired !== observed.apiKeyRequired) {
+            patches.push({
+              op: "replace",
+              path: "/apiKeyRequired",
+              value: String(news.apiKeyRequired ?? false),
+            });
+          }
+          if (patches.length > 0) {
+            yield* ag.updateMethod({
+              restApiId,
+              resourceId,
+              httpMethod,
+              patchOperations: patches,
+            });
+          }
+
+          // Sync integration — putIntegration is an upsert; deleteIntegration
+          // tolerates missing integrations.
+          if (!deepEqual(news.integration, observed.integration)) {
+            if (news.integration) {
+              yield* ag.putIntegration(
+                putIntegrationRequest(
+                  restApiId,
+                  resourceId,
+                  httpMethod,
+                  news.integration,
+                ),
+              );
+            } else {
+              yield* deleteIntegrationSafe({
+                restApiId,
+                resourceId,
+                httpMethod,
+              });
+            }
+          }
+
+          yield* session.note(`Reconciled method ${httpMethod}`);
+          const snap = yield* readMethodSnapshot({
+            restApiId,
+            resourceId,
+            httpMethod,
+          });
+          if (!snap) {
+            return yield* Effect.die("getMethod missing after reconcile");
+          }
+          return snap;
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* deleteIntegrationSafe({
+            restApiId: output.restApiId,
+            resourceId: output.resourceId,
+            httpMethod: output.httpMethod,
+          });
+          yield* deleteMethodSafe({
+            restApiId: output.restApiId,
+            resourceId: output.resourceId,
+            httpMethod: output.httpMethod,
+          });
+          yield* session.note(`Deleted method ${output.httpMethod}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/RestApi.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/RestApi.ts
new file mode 100644
index 00000000000..a40b3fced32
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/RestApi.ts
@@ -0,0 +1,465 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, tagRecord } from "../../Tags.ts";
+
+import { restApiArn, retryOnApiStatusUpdating, syncTags } from "./common.ts";
+
+export interface RestApiProps {
+  /**
+   * Name of the REST API.
+   *
+   * If omitted, Alchemy generates a deterministic physical name.
+   */
+  name?: string;
+  description?: string;
+  version?: string;
+  cloneFrom?: string;
+  binaryMediaTypes?: string[];
+  minimumCompressionSize?: number;
+  apiKeySource?: ag.ApiKeySourceType;
+  endpointConfiguration?: ag.EndpointConfiguration;
+  /** Resource policy document as a JSON string. */
+  policy?: string;
+  disableExecuteApiEndpoint?: boolean;
+  securityPolicy?: ag.SecurityPolicy;
+  endpointAccessMode?: ag.EndpointAccessMode;
+  /** User-defined tags (Alchemy internal tags are merged automatically). */
+  tags?: Record<string, string>;
+}
+
+/**
+ * Structured metadata a child resource attaches to its RestApi via `.bind`.
+ *
+ * These bindings are the mechanism by which Methods, Resources, Authorizers,
+ * and other REST-API-scoped children declare a reverse dependency on the API
+ * itself. The presence of any such binding is what forces `RestApi.create` to
+ * run *after* every child has been created — which is exactly the ordering
+ * CloudFormation asks users to write manually via `DependsOn`.
+ *
+ * Consumers should not construct these directly; the child resource
+ * constructors (e.g. `Method`, `Resource`) handle binding on behalf of the
+ * user.
+ */
+export type RestApiBinding =
+  | {
+      kind: "method";
+      methodId: Input<string>;
+      restApiId: Input<string>;
+      resourceId: Input<string>;
+      httpMethod: Input<string>;
+    }
+  | {
+      kind: "resource";
+      resourceId: Input<string>;
+      parentId: Input<string>;
+      pathPart: Input<string>;
+    }
+  | {
+      kind: "authorizer";
+      authorizerId: Input<string>;
+    };
+
+export interface RestApi extends Resource<
+  "AWS.ApiGateway.RestApi",
+  RestApiProps,
+  {
+    restApiId: string;
+    rootResourceId: string;
+    name: string;
+    description: string | undefined;
+    version: string | undefined;
+    binaryMediaTypes: string[] | undefined;
+    minimumCompressionSize: number | undefined;
+    apiKeySource: ag.ApiKeySourceType | undefined;
+    endpointConfiguration: ag.EndpointConfiguration | undefined;
+    policy: string | undefined;
+    disableExecuteApiEndpoint: boolean | undefined;
+    securityPolicy: ag.SecurityPolicy | undefined;
+    endpointAccessMode: ag.EndpointAccessMode | undefined;
+    tags: Record<string, string>;
+  },
+  RestApiBinding,
+  Providers
+> {}
+
+/**
+ * An Amazon API Gateway REST API (v1).
+ *
+ * `RestApi` is the root of an API Gateway v1 stack. Every other ApiGateway
+ * resource — `Resource`, `Method`, `Authorizer`, `Deployment`, `Stage` —
+ * hangs off a `RestApi`. The only identity you need to thread through your
+ * stack is the `RestApi` value itself: child resources accept `restApi: api`
+ * and register themselves back onto the API so that deployments and stages
+ * wait for them without any user-authored dependency lists.
+ *
+ * @section Getting started
+ * A minimal API Gateway stack is four pieces: the `RestApi`, one or more
+ * `Method`s, a `Deployment` that snapshots those methods, and a `Stage` that
+ * exposes the deployment at a URL.
+ *
+ * @example Mock HTTP GET on the root path
+ * ```typescript
+ * import * as ApiGateway from "alchemy/AWS/ApiGateway";
+ *
+ * const api = yield* ApiGateway.RestApi("Api", {
+ *   endpointConfiguration: { types: ["REGIONAL"] },
+ * });
+ *
+ * yield* ApiGateway.Method("GetRoot", {
+ *   restApi: api,
+ *   httpMethod: "GET",
+ *   authorizationType: "NONE",
+ *   integration: { type: "MOCK" },
+ * });
+ *
+ * const deployment = yield* ApiGateway.Deployment("Release", {
+ *   restApi: api,
+ * });
+ *
+ * const stage = yield* ApiGateway.Stage("Prod", {
+ *   restApi: api,
+ *   stageName: "prod",
+ *   deploymentId: deployment.deploymentId,
+ * });
+ * ```
+ *
+ * @section How dependencies flow
+ * Writing `restApi: api` on a child (rather than `restApiId: api.restApiId`)
+ * does two things: it threads the restApi id through, and it registers a
+ * `RestApiBinding` back onto the API. The Alchemy scheduler sees those
+ * bindings as reverse edges from children into the API, and `Deployment`
+ * reads them to express a transitive dependency on every child. You never
+ * have to write a `DependsOn` list or a `triggers` hash — adding a new
+ * `Method` automatically orders it before the next `Deployment`.
+ *
+ * @section Private REST APIs
+ * @example Private REST API
+ * ```typescript
+ * const api = yield* ApiGateway.RestApi("PrivateApi", {
+ *   endpointConfiguration: {
+ *     types: ["PRIVATE"],
+ *     vpcEndpointIds: [endpoint.vpcEndpointId],
+ *   },
+ *   policy: JSON.stringify({
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: "*",
+ *       Action: "execute-api:Invoke",
+ *       Resource: "*",
+ *     }],
+ *   }),
+ * });
+ * ```
+ *
+ * @section Binary payloads
+ * @example Enable binary media types
+ * ```typescript
+ * const api = yield* ApiGateway.RestApi("BinaryApi", {
+ *   binaryMediaTypes: ["application/octet-stream", "image/png"],
+ *   minimumCompressionSize: 1024,
+ * });
+ * ```
+ *
+ * @section Endpoint hardening
+ * @example Disable the default execute-api endpoint
+ * ```typescript
+ * const api = yield* ApiGateway.RestApi("CustomDomainOnlyApi", {
+ *   endpointConfiguration: { types: ["REGIONAL"] },
+ *   disableExecuteApiEndpoint: true,
+ * });
+ * ```
+ */
+export const RestApi = Resource<RestApi>("AWS.ApiGateway.RestApi");
+
+const generatedName = (id: string, props: RestApiProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 128,
+      });
+
+const snapshotFromApi = (api: ag.RestApi) => ({
+  restApiId: api.id!,
+  rootResourceId: api.rootResourceId!,
+  name: api.name ?? "",
+  description: api.description,
+  version: api.version,
+  binaryMediaTypes: api.binaryMediaTypes,
+  minimumCompressionSize: api.minimumCompressionSize,
+  apiKeySource: api.apiKeySource,
+  endpointConfiguration: api.endpointConfiguration,
+  policy: api.policy,
+  disableExecuteApiEndpoint: api.disableExecuteApiEndpoint,
+  securityPolicy: api.securityPolicy,
+  endpointAccessMode: api.endpointAccessMode,
+  tags: tagRecord(api.tags),
+});
+
+const patchReplace = (path: string, value: string): ag.PatchOperation => ({
+  op: "replace",
+  path,
+  value,
+});
+
+const encodeJsonPointerSegment = (s: string) =>
+  s.replace(/~/g, "~0").replace(/\//g, "~1");
+
+const binaryMediaTypePath = (mediaType: string) =>
+  `/binaryMediaTypes/${encodeJsonPointerSegment(mediaType)}`;
+
+const buildBinaryMediaTypePatches = (
+  prev: string[] | undefined,
+  next: string[] | undefined,
+): ag.PatchOperation[] => {
+  const prevSet = [...new Set(prev ?? [])];
+  const nextSet = [...new Set(next ?? [])];
+  const patches: ag.PatchOperation[] = [];
+  for (const m of prevSet) {
+    if (!nextSet.includes(m)) {
+      patches.push({ op: "remove", path: binaryMediaTypePath(m) });
+    }
+  }
+  for (const m of nextSet) {
+    if (!prevSet.includes(m)) {
+      patches.push({
+        op: "add",
+        path: binaryMediaTypePath(m),
+        value: m,
+      });
+    }
+  }
+  return patches;
+};
+
+const buildUpdatePatches = (
+  news: RestApiProps,
+  prev: RestApi["Attributes"],
+): ag.PatchOperation[] => {
+  const patches: ag.PatchOperation[] = [];
+  if (news.name !== undefined && news.name !== prev.name) {
+    patches.push(patchReplace("/name", news.name));
+  }
+  if (news.description !== prev.description) {
+    patches.push(patchReplace("/description", news.description ?? ""));
+  }
+  if (news.version !== prev.version) {
+    patches.push(patchReplace("/version", news.version ?? ""));
+  }
+  patches.push(
+    ...buildBinaryMediaTypePatches(
+      prev.binaryMediaTypes,
+      news.binaryMediaTypes,
+    ),
+  );
+  if (news.minimumCompressionSize !== prev.minimumCompressionSize) {
+    patches.push(
+      patchReplace(
+        "/minimumCompressionSize",
+        String(news.minimumCompressionSize ?? ""),
+      ),
+    );
+  }
+  if (news.apiKeySource !== prev.apiKeySource) {
+    patches.push(patchReplace("/apiKeySource", news.apiKeySource ?? "HEADER"));
+  }
+  if (news.policy !== prev.policy) {
+    patches.push(patchReplace("/policy", news.policy ?? ""));
+  }
+  if (news.disableExecuteApiEndpoint !== prev.disableExecuteApiEndpoint) {
+    patches.push(
+      patchReplace(
+        "/disableExecuteApiEndpoint",
+        String(!!news.disableExecuteApiEndpoint),
+      ),
+    );
+  }
+  if (news.securityPolicy !== prev.securityPolicy) {
+    patches.push(
+      patchReplace("/securityPolicy", news.securityPolicy ?? "TLS_1_0"),
+    );
+  }
+  if (news.endpointAccessMode !== prev.endpointAccessMode) {
+    patches.push(
+      patchReplace("/endpointAccessMode", news.endpointAccessMode ?? ""),
+    );
+  }
+  return patches;
+};
+
+export const RestApiProvider = () =>
+  Provider.effect(
+    RestApi,
+    Effect.gen(function* () {
+      const awsRegion = yield* Region;
+
+      return {
+        stables: ["restApiId", "rootResourceId"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as RestApiProps;
+          if (
+            // Endpoint type, private endpoint IDs, and IP address type are part
+            // of the REST API endpoint shape; replacing avoids partial endpoint
+            // drift that API Gateway cannot consistently patch in place.
+            !deepEqual(
+              news.endpointConfiguration?.types,
+              olds.endpointConfiguration?.types,
+            ) ||
+            !deepEqual(
+              news.endpointConfiguration?.vpcEndpointIds,
+              olds.endpointConfiguration?.vpcEndpointIds,
+            ) ||
+            !deepEqual(
+              news.endpointConfiguration?.ipAddressType,
+              olds.endpointConfiguration?.ipAddressType,
+            )
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.restApiId) return undefined;
+          const api = yield* ag
+            .getRestApi({ restApiId: output.restApiId })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!api?.id) return undefined;
+          return snapshotFromApi(api);
+        }),
+        // The REST API is brought up in two phases. `precreate` creates the
+        // REST API in full so child resources (`Method`, `Resource`, etc.)
+        // can resolve `api.restApiId` and start their own creates — this is
+        // the cycle-breaker that lets children register themselves back onto
+        // the API via `restApi.bind`. `create` then runs last — after every
+        // bound child — and is effectively a no-op that re-reads the API to
+        // publish the final snapshot. The key property is that any
+        // `Deployment` referencing `api.*` outputs will see a value produced
+        // only after every bound child has settled, because the bindings on
+        // the API force `create` to wait for them before returning.
+        precreate: Effect.fn(function* ({ id, news: newsIn, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("RestApi props were not resolved");
+          }
+          const news = newsIn as RestApiProps;
+          const name = yield* generatedName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const allTags = { ...(news.tags ?? {}), ...internalTags };
+          const created = yield* retryOnApiStatusUpdating(
+            ag.createRestApi({
+              name,
+              description: news.description,
+              version: news.version,
+              cloneFrom: news.cloneFrom,
+              binaryMediaTypes: news.binaryMediaTypes,
+              minimumCompressionSize: news.minimumCompressionSize,
+              apiKeySource: news.apiKeySource,
+              endpointConfiguration: news.endpointConfiguration,
+              policy: news.policy,
+              tags: allTags,
+              disableExecuteApiEndpoint: news.disableExecuteApiEndpoint,
+              securityPolicy: news.securityPolicy,
+              endpointAccessMode: news.endpointAccessMode,
+            }),
+          );
+          if (!created.id || !created.rootResourceId) {
+            return yield* Effect.die(
+              "createRestApi missing id or rootResourceId",
+            );
+          }
+          yield* session.note(`Created REST API ${created.id}`);
+          const full = yield* ag.getRestApi({ restApiId: created.id });
+          return snapshotFromApi(full);
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("RestApi props were not resolved");
+          }
+          const news = newsIn as RestApiProps;
+
+          // RestApi has a `precreate` that always runs before `reconcile`
+          // for greenfield deployments — it creates the REST API in full
+          // so that `restApi.restApiId` is resolvable and child resources
+          // (Method, Resource, Authorizer) can register themselves back on
+          // the API via `restApi.bind`. By the time `reconcile` runs the id
+          // is populated; we never expect `output === undefined` here, but
+          // we still handle it defensively.
+          if (!output?.restApiId) {
+            return yield* Effect.die(
+              "RestApi reconcile reached without a precreate output",
+            );
+          }
+
+          // Observe — fetch live cloud state. `output` is treated as a
+          // cache for the stable id only.
+          const observed = yield* ag
+            .getRestApi({ restApiId: output.restApiId })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!observed?.id) {
+            return yield* Effect.die(
+              `RestApi ${output.restApiId} disappeared between precreate and reconcile`,
+            );
+          }
+          const observedSnapshot = snapshotFromApi(observed);
+
+          // Sync mutable scalar fields — diff observed cloud state against
+          // desired and emit only the delta as PATCH operations.
+          const patches = buildUpdatePatches(news, observedSnapshot);
+          if (patches.length > 0) {
+            yield* retryOnApiStatusUpdating(
+              ag.updateRestApi({
+                restApiId: output.restApiId,
+                patchOperations: patches,
+              }),
+            );
+          }
+
+          // Sync tags — observed ↔ desired so adoption converges without
+          // fighting the existing tag set.
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...news.tags, ...internalTags };
+          if (!deepEqual(observedSnapshot.tags, desiredTags)) {
+            const arn = restApiArn(awsRegion, output.restApiId);
+            yield* syncTags({
+              resourceArn: arn,
+              oldTags: observedSnapshot.tags,
+              newTags: desiredTags,
+            });
+          }
+
+          yield* session.note(`Reconciled REST API ${output.restApiId}`);
+
+          // Re-read so the returned attributes reflect what's actually in
+          // the cloud after all sync steps.
+          const final = yield* ag.getRestApi({ restApiId: output.restApiId });
+          if (!final.id) {
+            return yield* Effect.die("getRestApi missing id after reconcile");
+          }
+          return snapshotFromApi(final);
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* retryOnApiStatusUpdating(
+            ag
+              .deleteRestApi({ restApiId: output.restApiId })
+              .pipe(Effect.catchTag("NotFoundException", () => Effect.void)),
+          );
+          yield* session.note(`Deleted REST API ${output.restApiId}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Stage.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Stage.ts
new file mode 100644
index 00000000000..b6c34ff0007
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/Stage.ts
@@ -0,0 +1,654 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags } from "../../Tags.ts";
+
+import type { RestApi } from "./RestApi.ts";
+import { retryOnApiStatusUpdating, stageArn, syncTags } from "./common.ts";
+
+export interface StageProps {
+  /**
+   * The `RestApi` this stage belongs to. When supplied, `restApiId` is
+   * derived from `restApi.restApiId` automatically.
+   */
+  restApi?: RestApi;
+  /**
+   * ID of the REST API. Usually derived from `restApi.restApiId`.
+   */
+  restApiId?: Input<string>;
+  stageName: string;
+  /**
+   * The `deploymentId` this stage points at. Pass `deployment.deploymentId`
+   * — Alchemy will automatically wait for the deployment to be created
+   * before creating the stage.
+   */
+  deploymentId: Input<string>;
+  description?: string;
+  cacheClusterEnabled?: boolean;
+  cacheClusterSize?: ag.CacheClusterSize;
+  variables?: { [key: string]: string | undefined };
+  documentationVersion?: string;
+  canarySettings?: ag.CanarySettings;
+  tracingEnabled?: boolean;
+  /**
+   * Map of resource path pattern to method settings; keys use `{resourcePath}/{httpMethod}`.
+   */
+  methodSettings?: { [key: string]: ag.MethodSetting | undefined };
+  accessLogSettings?: ag.AccessLogSettings;
+  webAclArn?: string;
+  tags?: Record<string, string>;
+}
+
+export interface ApiGatewayStage extends Resource<
+  "AWS.ApiGateway.Stage",
+  StageProps,
+  {
+    restApiId: string;
+    stageName: string;
+    deploymentId: string;
+    description: string | undefined;
+    cacheClusterEnabled: boolean | undefined;
+    cacheClusterSize: ag.CacheClusterSize | undefined;
+    variables: { [key: string]: string | undefined } | undefined;
+    documentationVersion: string | undefined;
+    canarySettings: ag.CanarySettings | undefined;
+    tracingEnabled: boolean | undefined;
+    methodSettings: { [key: string]: ag.MethodSetting | undefined } | undefined;
+    accessLogSettings: ag.AccessLogSettings | undefined;
+    webAclArn: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A stage for a REST API deployment.
+ *
+ * A Stage is what clients actually call. It binds a name (`dev`, `prod`,
+ * `v2`) to a specific `Deployment` of a `RestApi` and exposes it at a
+ * stable URL:
+ *
+ * ```
+ * https://<restApiId>.execute-api.<region>.amazonaws.com/<stageName>/
+ * ```
+ *
+ * @section Stages
+ * @example A dev stage pointing at the latest deployment
+ * ```typescript
+ * const stage = yield* ApiGateway.Stage("Dev", {
+ *   restApi: api,
+ *   stageName: "dev",
+ *   deploymentId: deployment.deploymentId,
+ * });
+ * ```
+ *
+ * @section Stage variables
+ * @example Override values per stage
+ * ```typescript
+ * const stage = yield* ApiGateway.Stage("Prod", {
+ *   restApi: api,
+ *   stageName: "prod",
+ *   deploymentId: deployment.deploymentId,
+ *   variables: {
+ *     logLevel: "info",
+ *     featureFlag: "on",
+ *   },
+ * });
+ * ```
+ *
+ * @section Canary deployments
+ * Point `canarySettings` at a different `Deployment` to split traffic
+ * between the stable and canary versions. `percentTraffic` is the
+ * percent of requests routed to the canary deployment.
+ *
+ * @example Shift 10% of traffic to a canary deployment
+ * ```typescript
+ * const stage = yield* ApiGateway.Stage("Prod", {
+ *   restApi: api,
+ *   stageName: "prod",
+ *   deploymentId: stableDeployment.deploymentId,
+ *   canarySettings: {
+ *     percentTraffic: 10,
+ *     deploymentId: canaryDeployment.deploymentId,
+ *   },
+ * });
+ * ```
+ */
+export const StageResource = Resource<ApiGatewayStage>("AWS.ApiGateway.Stage");
+
+interface StageInputProps {
+  restApi?: RestApi;
+  restApiId?: Input<string>;
+  stageName: Input<string>;
+  deploymentId: Input<string>;
+  description?: Input<string>;
+  cacheClusterEnabled?: Input<boolean>;
+  cacheClusterSize?: Input<ag.CacheClusterSize>;
+  variables?: Input<{ [key: string]: string | undefined }>;
+  documentationVersion?: Input<string>;
+  canarySettings?: Input<ag.CanarySettings>;
+  tracingEnabled?: Input<boolean>;
+  methodSettings?: Input<{ [key: string]: ag.MethodSetting | undefined }>;
+  accessLogSettings?: Input<ag.AccessLogSettings>;
+  webAclArn?: Input<string>;
+  tags?: Input<Record<string, string>>;
+}
+
+/**
+ * User-facing wrapper that derives `restApiId` from `restApi` when supplied.
+ */
+const StageImpl = (id: string, props: StageInputProps) =>
+  Effect.gen(function* () {
+    const { restApi, ...rest } = props;
+    const restApiId = rest.restApiId ?? restApi?.restApiId;
+    if (!restApiId) {
+      return yield* Effect.die(
+        "Stage requires either `restApi` (preferred) or explicit `restApiId`.",
+      );
+    }
+    return yield* StageResource(id, { ...rest, restApiId } as any);
+  });
+
+export const Stage = StageImpl;
+
+const toTagRecord = (tags: ag.Stage["tags"]) =>
+  Object.fromEntries(
+    Object.entries(tags ?? {}).filter(
+      (e): e is [string, string] => e[1] !== undefined,
+    ),
+  );
+
+const encodeJsonPointerSegment = (s: string) =>
+  s.replace(/~/g, "~0").replace(/\//g, "~1");
+
+const snapshotStage = (s: ag.Stage, restApiId: string, stageName: string) => ({
+  restApiId,
+  stageName,
+  deploymentId: s.deploymentId!,
+  description: s.description,
+  cacheClusterEnabled: s.cacheClusterEnabled,
+  cacheClusterSize: s.cacheClusterSize,
+  variables: s.variables,
+  documentationVersion: s.documentationVersion,
+  canarySettings: s.canarySettings,
+  tracingEnabled: s.tracingEnabled,
+  methodSettings: s.methodSettings,
+  accessLogSettings: s.accessLogSettings,
+  webAclArn: s.webAclArn,
+  tags: toTagRecord(s.tags),
+});
+
+const parseMethodSettingKey = (key: string) => {
+  const idx = key.lastIndexOf("/");
+  if (idx <= 0) {
+    return { resourcePath: key, httpMethod: "*" };
+  }
+  return {
+    resourcePath: key.slice(0, idx),
+    httpMethod: key.slice(idx + 1),
+  };
+};
+
+/**
+ * API Gateway `updateStage` rejects patch paths that use the raw schema
+ * field name (e.g. `/*\/*\/throttlingBurstLimit`). Each field maps to a
+ * slashed path under a category (`throttling`, `caching`, `metrics`,
+ * `logging`). The accepted forms are documented at:
+ * https://docs.aws.amazon.com/apigateway/latest/api/API_UpdateStage.html
+ */
+const methodSettingFieldToPath: Record<keyof ag.MethodSetting, string> = {
+  metricsEnabled: "metrics/enabled",
+  loggingLevel: "logging/loglevel",
+  dataTraceEnabled: "logging/dataTrace",
+  throttlingBurstLimit: "throttling/burstLimit",
+  throttlingRateLimit: "throttling/rateLimit",
+  cachingEnabled: "caching/enabled",
+  cacheTtlInSeconds: "caching/ttlInSeconds",
+  cacheDataEncrypted: "caching/dataEncrypted",
+  requireAuthorizationForCacheControl:
+    "caching/requireAuthorizationForCacheControl",
+  unauthorizedCacheControlHeaderStrategy:
+    "caching/unauthorizedCacheControlHeaderStrategy",
+};
+
+function methodSettingScalarPatch(
+  base: string,
+  field: keyof ag.MethodSetting,
+  prev: ag.MethodSetting | undefined,
+  next: ag.MethodSetting | undefined,
+): ag.PatchOperation | undefined {
+  const pv = prev?.[field];
+  const nv = next?.[field];
+  if (pv === nv) return undefined;
+  const segment = methodSettingFieldToPath[field];
+  if (nv === undefined) {
+    // Only emit `remove` if the field was actually set upstream; AWS
+    // rejects removes against fields that have no existing setting with
+    // `Cannot remove method setting ... because there is no method setting
+    // for this method`.
+    if (pv === undefined) return undefined;
+    return { op: "remove", path: `${base}/${segment}` };
+  }
+  return {
+    op: "replace",
+    path: `${base}/${segment}`,
+    value: typeof nv === "boolean" ? String(nv) : String(nv),
+  };
+}
+
+/**
+ * AWS API Gateway's `getStage` response populates `methodSettings` with
+ * every field defaulted (e.g. `metricsEnabled: false`, `loggingLevel: "OFF"`),
+ * even when the user only set one field like `throttlingBurstLimit`. This
+ * makes round-tripping tricky: we cannot tell which fields the user
+ * actually set versus which AWS defaulted. If we naively diff the full
+ * object and emit a `remove` op for every field that's missing from the
+ * user's next spec, AWS rejects with "Cannot remove method setting ...
+ * because there is no method setting for this method".
+ *
+ * The pragmatic policy is additive: for each `(resourcePath, httpMethod)`
+ * key that appears in the user's `next` spec, emit `replace` ops only
+ * for fields the user explicitly set (own-property on `next[key]`).
+ * Fields the user never specified are left alone, matching the
+ * "fields default to whatever AWS chose" semantic the API itself uses.
+ *
+ * To *clear* a field, the user can explicitly set it to `undefined` on
+ * `next[key]`; that path still produces a `remove` op, and `remove`s are
+ * only emitted when `prev[key][field]` was actually set (see
+ * `methodSettingScalarPatch`).
+ *
+ * To drop a whole `(resourcePath, httpMethod)` key, we walk the fields
+ * present on `prev[key]` and emit `remove`s for each — but again only
+ * if that field was actually set upstream.
+ */
+const buildMethodSettingPatches = (
+  prev: { [key: string]: ag.MethodSetting | undefined } | undefined,
+  next: { [key: string]: ag.MethodSetting | undefined } | undefined,
+): ag.PatchOperation[] => {
+  const keys = new Set([
+    ...Object.keys(prev ?? {}),
+    ...Object.keys(next ?? {}),
+  ]);
+  const patches: ag.PatchOperation[] = [];
+  for (const key of keys) {
+    const p = prev?.[key];
+    const n = next?.[key];
+    if (!n && !p) continue;
+    const { resourcePath, httpMethod } = parseMethodSettingKey(key);
+    const rp = encodeJsonPointerSegment(resourcePath);
+    const hm = encodeJsonPointerSegment(httpMethod);
+    const base = `/${rp}/${hm}`;
+    if (!n) {
+      // Key removed entirely: try to clear each field that was explicitly
+      // set on the prior spec. `methodSettingScalarPatch` will drop the
+      // remove if the field wasn't actually present on `p`.
+      for (const f of Object.keys(p ?? {}) as (keyof ag.MethodSetting)[]) {
+        const op = methodSettingScalarPatch(base, f, p, undefined);
+        if (op) patches.push(op);
+      }
+      continue;
+    }
+    if (p && deepEqual(p, n)) continue;
+    // Iterate only the fields the user actually specified on `n`. This
+    // intentionally ignores AWS-default fields that leaked into `p` via
+    // `getStage`, so we never emit phantom `remove` ops for defaults.
+    for (const f of Object.keys(n) as (keyof ag.MethodSetting)[]) {
+      const op = methodSettingScalarPatch(base, f, p, n);
+      if (op) patches.push(op);
+    }
+  }
+  return patches;
+};
+
+const buildVariablePatches = (
+  prev: { [key: string]: string | undefined } | undefined,
+  next: { [key: string]: string | undefined } | undefined,
+): ag.PatchOperation[] => {
+  const keys = new Set([
+    ...Object.keys(prev ?? {}),
+    ...Object.keys(next ?? {}),
+  ]);
+  const patches: ag.PatchOperation[] = [];
+  for (const k of keys) {
+    const pv = prev?.[k];
+    const nv = next?.[k];
+    if (pv === nv) continue;
+    const enc = encodeJsonPointerSegment(k);
+    if (nv === undefined) {
+      patches.push({ op: "remove", path: `/variables/${enc}` });
+    } else {
+      patches.push({ op: "replace", path: `/variables/${enc}`, value: nv });
+    }
+  }
+  return patches;
+};
+
+const buildAccessLogPatches = (
+  prev: ag.AccessLogSettings | undefined,
+  next: ag.AccessLogSettings | undefined,
+): ag.PatchOperation[] => {
+  const patches: ag.PatchOperation[] = [];
+  if (prev?.destinationArn !== next?.destinationArn) {
+    if (
+      next?.destinationArn === undefined &&
+      prev?.destinationArn !== undefined
+    ) {
+      patches.push({ op: "remove", path: "/accessLogSettings/destinationArn" });
+    } else if (next?.destinationArn !== undefined) {
+      patches.push({
+        op: "replace",
+        path: "/accessLogSettings/destinationArn",
+        value: next.destinationArn,
+      });
+    }
+  }
+  if (prev?.format !== next?.format) {
+    if (next?.format === undefined && prev?.format !== undefined) {
+      patches.push({ op: "remove", path: "/accessLogSettings/format" });
+    } else if (next?.format !== undefined) {
+      patches.push({
+        op: "replace",
+        path: "/accessLogSettings/format",
+        value: next.format,
+      });
+    }
+  }
+  return patches;
+};
+
+const buildCanaryOverridePatches = (
+  prev: { [key: string]: string | undefined } | undefined,
+  next: { [key: string]: string | undefined } | undefined,
+): ag.PatchOperation[] => {
+  const keys = new Set([
+    ...Object.keys(prev ?? {}),
+    ...Object.keys(next ?? {}),
+  ]);
+  const patches: ag.PatchOperation[] = [];
+  for (const k of keys) {
+    const pv = prev?.[k];
+    const nv = next?.[k];
+    if (pv === nv) continue;
+    const enc = encodeJsonPointerSegment(k);
+    if (nv === undefined) {
+      patches.push({
+        op: "remove",
+        path: `/canarySettings/stageVariableOverrides/${enc}`,
+      });
+    } else {
+      patches.push({
+        op: "replace",
+        path: `/canarySettings/stageVariableOverrides/${enc}`,
+        value: nv,
+      });
+    }
+  }
+  return patches;
+};
+
+const buildCanaryPatches = (
+  prev: ag.CanarySettings | undefined,
+  next: ag.CanarySettings | undefined,
+): ag.PatchOperation[] => {
+  const patches: ag.PatchOperation[] = [];
+  if (prev?.percentTraffic !== next?.percentTraffic) {
+    if (
+      next?.percentTraffic === undefined &&
+      prev?.percentTraffic !== undefined
+    ) {
+      patches.push({ op: "remove", path: "/canarySettings/percentTraffic" });
+    } else if (next?.percentTraffic !== undefined) {
+      patches.push({
+        op: "replace",
+        path: "/canarySettings/percentTraffic",
+        value: String(next.percentTraffic),
+      });
+    }
+  }
+  if (prev?.deploymentId !== next?.deploymentId) {
+    if (next?.deploymentId === undefined && prev?.deploymentId !== undefined) {
+      patches.push({ op: "remove", path: "/canarySettings/deploymentId" });
+    } else if (next?.deploymentId !== undefined) {
+      patches.push({
+        op: "replace",
+        path: "/canarySettings/deploymentId",
+        value: next.deploymentId,
+      });
+    }
+  }
+  if (prev?.useStageCache !== next?.useStageCache) {
+    if (next?.useStageCache === undefined) {
+      patches.push({ op: "remove", path: "/canarySettings/useStageCache" });
+    } else {
+      patches.push({
+        op: "replace",
+        path: "/canarySettings/useStageCache",
+        value: String(next.useStageCache),
+      });
+    }
+  }
+  patches.push(
+    ...buildCanaryOverridePatches(
+      prev?.stageVariableOverrides,
+      next?.stageVariableOverrides,
+    ),
+  );
+  return patches;
+};
+
+const buildStagePatches = (
+  prev: ApiGatewayStage["Attributes"],
+  news: Input.ResolveProps<StageProps>,
+): ag.PatchOperation[] => {
+  const patches: ag.PatchOperation[] = [];
+  if (news.deploymentId !== prev.deploymentId) {
+    patches.push({
+      op: "replace",
+      path: "/deploymentId",
+      value: news.deploymentId as string,
+    });
+  }
+  if (news.description !== prev.description) {
+    patches.push({
+      op: "replace",
+      path: "/description",
+      value: news.description ?? "",
+    });
+  }
+  if (news.cacheClusterEnabled !== prev.cacheClusterEnabled) {
+    patches.push({
+      op: "replace",
+      path: "/cacheClusterEnabled",
+      value: String(news.cacheClusterEnabled ?? false),
+    });
+  }
+  if (news.cacheClusterSize !== prev.cacheClusterSize) {
+    if (news.cacheClusterSize === undefined) {
+      patches.push({ op: "remove", path: "/cacheClusterSize" });
+    } else {
+      patches.push({
+        op: "replace",
+        path: "/cacheClusterSize",
+        value: news.cacheClusterSize,
+      });
+    }
+  }
+  if (news.documentationVersion !== prev.documentationVersion) {
+    if (news.documentationVersion === undefined) {
+      patches.push({ op: "remove", path: "/documentationVersion" });
+    } else {
+      patches.push({
+        op: "replace",
+        path: "/documentationVersion",
+        value: news.documentationVersion,
+      });
+    }
+  }
+  if (news.tracingEnabled !== prev.tracingEnabled) {
+    patches.push({
+      op: "replace",
+      path: "/tracingEnabled",
+      value: String(news.tracingEnabled ?? false),
+    });
+  }
+  if (news.webAclArn !== prev.webAclArn) {
+    if (news.webAclArn === undefined || news.webAclArn === "") {
+      patches.push({ op: "remove", path: "/webAclArn" });
+    } else {
+      patches.push({
+        op: "replace",
+        path: "/webAclArn",
+        value: news.webAclArn,
+      });
+    }
+  }
+  patches.push(...buildVariablePatches(prev.variables, news.variables));
+  patches.push(
+    ...buildMethodSettingPatches(prev.methodSettings, news.methodSettings),
+  );
+  patches.push(
+    ...buildAccessLogPatches(prev.accessLogSettings, news.accessLogSettings),
+  );
+  if (!deepEqual(news.canarySettings, prev.canarySettings)) {
+    patches.push(
+      ...buildCanaryPatches(prev.canarySettings, news.canarySettings),
+    );
+  }
+  return patches;
+};
+
+export const StageProvider = () =>
+  Provider.effect(
+    StageResource,
+    Effect.gen(function* () {
+      const awsRegion = yield* Region;
+
+      return {
+        stables: ["restApiId", "stageName"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as Input.ResolveProps<StageProps>;
+          if (
+            news.restApiId !== olds.restApiId ||
+            news.stageName !== olds.stageName
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const s = yield* ag
+            .getStage({
+              restApiId: output.restApiId,
+              stageName: output.stageName,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!s?.stageName) return undefined;
+          return snapshotStage(s, output.restApiId, s.stageName);
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("Stage props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<StageProps>;
+          const restApiId = (output?.restApiId ?? news.restApiId) as string;
+          const stageName = output?.stageName ?? news.stageName;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...news.tags, ...internalTags };
+
+          // Observe — fetch live stage state. `output` is at most a cache
+          // for the natural-key tuple (restApiId, stageName); the actual
+          // mutable settings come from the cloud read on every reconcile.
+          let observed = yield* ag
+            .getStage({ restApiId, stageName })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the stage if missing. `createStage` only sets
+          // a subset of the configurable surface; the rest is applied via
+          // updateStage in the sync step below.
+          if (!observed?.stageName) {
+            yield* retryOnApiStatusUpdating(
+              ag.createStage({
+                restApiId: news.restApiId as string,
+                stageName: news.stageName,
+                deploymentId: news.deploymentId as string,
+                description: news.description,
+                cacheClusterEnabled: news.cacheClusterEnabled,
+                cacheClusterSize: news.cacheClusterSize,
+                variables: news.variables,
+                documentationVersion: news.documentationVersion,
+                canarySettings: news.canarySettings,
+                tracingEnabled: news.tracingEnabled,
+                tags: desiredTags,
+              }),
+            );
+            yield* session.note(`Created stage ${news.stageName}`);
+            observed = yield* ag.getStage({
+              restApiId: news.restApiId as string,
+              stageName: news.stageName,
+            });
+          }
+
+          // Sync stage settings — diff observed cloud state against desired
+          // and emit only the delta as PATCH operations. `buildStagePatches`
+          // already handles every mutable aspect (deploymentId, description,
+          // cache, variables, methodSettings, accessLog, canary, tracing,
+          // webAcl).
+          const observedSnapshot = snapshotStage(
+            observed,
+            restApiId,
+            stageName,
+          );
+          const patches = buildStagePatches(observedSnapshot, news);
+          if (patches.length > 0) {
+            yield* retryOnApiStatusUpdating(
+              ag.updateStage({
+                restApiId,
+                stageName,
+                patchOperations: patches,
+              }),
+            );
+          }
+
+          // Sync tags — observed ↔ desired.
+          if (!deepEqual(observedSnapshot.tags, desiredTags)) {
+            const arn = stageArn(awsRegion, restApiId, stageName);
+            yield* syncTags({
+              resourceArn: arn,
+              oldTags: observedSnapshot.tags,
+              newTags: desiredTags,
+            });
+          }
+
+          yield* session.note(`Reconciled stage ${stageName}`);
+          const final = yield* ag.getStage({ restApiId, stageName });
+          return snapshotStage(final, restApiId, stageName);
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* retryOnApiStatusUpdating(
+            ag
+              .deleteStage({
+                restApiId: output.restApiId,
+                stageName: output.stageName,
+              })
+              .pipe(Effect.catchTag("NotFoundException", () => Effect.void)),
+          );
+          yield* session.note(`Deleted stage ${output.stageName}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/UsagePlan.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/UsagePlan.ts
new file mode 100644
index 00000000000..5fb76bb0bc2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/UsagePlan.ts
@@ -0,0 +1,362 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, tagRecord } from "../../Tags.ts";
+
+import { syncTags, usagePlanArn } from "./common.ts";
+
+export interface UsagePlanProps {
+  /**
+   * Friendly name for the usage plan.
+   *
+   * If omitted, Alchemy generates a deterministic physical name.
+   */
+  name?: string;
+  /**
+   * Human-readable description for operators.
+   */
+  description?: string;
+  /**
+   * API stages associated with this plan.
+   */
+  apiStages?: ag.ApiStage[];
+  /**
+   * Default request throttle applied by the plan.
+   */
+  throttle?: ag.ThrottleSettings;
+  /**
+   * Quota limit and period applied by the plan.
+   */
+  quota?: ag.QuotaSettings;
+  /**
+   * User-defined tags. Alchemy internal tags are merged automatically.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface UsagePlan extends Resource<
+  "AWS.ApiGateway.UsagePlan",
+  UsagePlanProps,
+  {
+    id: string;
+    name: string | undefined;
+    description: string | undefined;
+    apiStages: ag.ApiStage[] | undefined;
+    throttle: ag.ThrottleSettings | undefined;
+    quota: ag.QuotaSettings | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Usage plan for API stages, throttling, and quotas.
+ *
+ * @section Usage plans
+ * @example Usage plan with stage
+ * ```typescript
+ * const plan = yield* ApiGateway.UsagePlan("Standard", {
+ *   apiStages: [{ apiId: api.restApiId, stage: stage.stageName }],
+ * });
+ * ```
+ */
+const UsagePlanResource = Resource<UsagePlan>("AWS.ApiGateway.UsagePlan");
+
+export { UsagePlanResource as UsagePlan };
+
+const generatedName = (id: string, props: UsagePlanProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 128,
+      });
+
+const encodeJsonPointerSegment = (s: string) =>
+  s.replace(/~/g, "~0").replace(/\//g, "~1");
+
+const apiStageKey = (stage: ag.ApiStage) => `${stage.apiId}:${stage.stage}`;
+
+const parseThrottleKey = (key: string) => {
+  const idx = key.lastIndexOf("/");
+  if (idx <= 0) return { resourcePath: key, httpMethod: "*" };
+  return {
+    resourcePath: key.slice(0, idx),
+    httpMethod: key.slice(idx + 1),
+  };
+};
+
+const buildApiStageThrottlePatches = (
+  stageKey: string,
+  prev: { [key: string]: ag.ThrottleSettings | undefined } | undefined,
+  next: { [key: string]: ag.ThrottleSettings | undefined } | undefined,
+): ag.PatchOperation[] => {
+  const keys = new Set([
+    ...Object.keys(prev ?? {}),
+    ...Object.keys(next ?? {}),
+  ]);
+  const patches: ag.PatchOperation[] = [];
+  for (const key of keys) {
+    const old = prev?.[key];
+    const current = next?.[key];
+    const { resourcePath, httpMethod } = parseThrottleKey(key);
+    const base = `/apiStages/${encodeJsonPointerSegment(stageKey)}/throttle/${encodeJsonPointerSegment(resourcePath)}/${encodeJsonPointerSegment(httpMethod)}`;
+    if (current?.burstLimit !== old?.burstLimit) {
+      patches.push(
+        current?.burstLimit === undefined
+          ? { op: "remove", path: `${base}/burstLimit` }
+          : {
+              op: "replace",
+              path: `${base}/burstLimit`,
+              value: String(current.burstLimit),
+            },
+      );
+    }
+    if (current?.rateLimit !== old?.rateLimit) {
+      patches.push(
+        current?.rateLimit === undefined
+          ? { op: "remove", path: `${base}/rateLimit` }
+          : {
+              op: "replace",
+              path: `${base}/rateLimit`,
+              value: String(current.rateLimit),
+            },
+      );
+    }
+  }
+  return patches;
+};
+
+const buildApiStagePatches = (
+  prev: ag.ApiStage[] | undefined,
+  next: ag.ApiStage[] | undefined,
+): ag.PatchOperation[] => {
+  const prevMap = new Map((prev ?? []).map((s) => [apiStageKey(s), s]));
+  const nextMap = new Map((next ?? []).map((s) => [apiStageKey(s), s]));
+  const patches: ag.PatchOperation[] = [];
+  for (const [key] of prevMap) {
+    if (!nextMap.has(key)) {
+      patches.push({ op: "remove", path: "/apiStages", value: key });
+    }
+  }
+  for (const [key, stage] of nextMap) {
+    const old = prevMap.get(key);
+    if (!old) {
+      patches.push({ op: "add", path: "/apiStages", value: key });
+      patches.push(
+        ...buildApiStageThrottlePatches(key, undefined, stage.throttle),
+      );
+      continue;
+    }
+    if (!deepEqual(stage.throttle, old.throttle)) {
+      patches.push(
+        ...buildApiStageThrottlePatches(key, old.throttle, stage.throttle),
+      );
+    }
+  }
+  return patches;
+};
+
+const buildThrottlePatches = (
+  prev: ag.ThrottleSettings | undefined,
+  next: ag.ThrottleSettings | undefined,
+) => {
+  const patches: ag.PatchOperation[] = [];
+  if (next?.burstLimit !== prev?.burstLimit) {
+    patches.push(
+      next?.burstLimit === undefined
+        ? { op: "remove", path: "/throttle/burstLimit" }
+        : {
+            op: "replace",
+            path: "/throttle/burstLimit",
+            value: String(next.burstLimit),
+          },
+    );
+  }
+  if (next?.rateLimit !== prev?.rateLimit) {
+    patches.push(
+      next?.rateLimit === undefined
+        ? { op: "remove", path: "/throttle/rateLimit" }
+        : {
+            op: "replace",
+            path: "/throttle/rateLimit",
+            value: String(next.rateLimit),
+          },
+    );
+  }
+  return patches;
+};
+
+const buildQuotaPatches = (
+  prev: ag.QuotaSettings | undefined,
+  next: ag.QuotaSettings | undefined,
+) => {
+  const patches: ag.PatchOperation[] = [];
+  if (next?.limit !== prev?.limit) {
+    patches.push(
+      next?.limit === undefined
+        ? { op: "remove", path: "/quota/limit" }
+        : {
+            op: "replace",
+            path: "/quota/limit",
+            value: String(next.limit),
+          },
+    );
+  }
+  if (next?.offset !== prev?.offset) {
+    patches.push(
+      next?.offset === undefined
+        ? { op: "remove", path: "/quota/offset" }
+        : {
+            op: "replace",
+            path: "/quota/offset",
+            value: String(next.offset),
+          },
+    );
+  }
+  if (next?.period !== prev?.period) {
+    patches.push(
+      next?.period === undefined
+        ? { op: "remove", path: "/quota/period" }
+        : { op: "replace", path: "/quota/period", value: next.period },
+    );
+  }
+  return patches;
+};
+
+export const UsagePlanProvider = () =>
+  Provider.effect(
+    UsagePlanResource,
+    Effect.gen(function* () {
+      const awsRegion = yield* Region;
+
+      return {
+        stables: ["id"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as UsagePlanProps;
+          if (news.name !== undefined && news.name !== olds.name) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          const p = yield* ag
+            .getUsagePlan({ usagePlanId: output.id })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!p?.id) return undefined;
+          return {
+            id: p.id,
+            name: p.name,
+            description: p.description,
+            apiStages: p.apiStages,
+            throttle: p.throttle,
+            quota: p.quota,
+            tags: tagRecord(p.tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("UsagePlan props were not resolved");
+          }
+          const news = newsIn as UsagePlanProps;
+          const name = yield* generatedName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...news.tags, ...internalTags };
+
+          // Observe — fetch live usage plan if we have a cached id. We
+          // never trust `output.apiStages`/`output.throttle`/etc. for
+          // diffing; we re-read every reconcile so adoption converges.
+          let observed = output?.id
+            ? yield* ag
+                .getUsagePlan({ usagePlanId: output.id })
+                .pipe(
+                  Effect.catchTag("NotFoundException", () =>
+                    Effect.succeed(undefined),
+                  ),
+                )
+            : undefined;
+
+          // Ensure — create the usage plan if missing.
+          if (!observed?.id) {
+            const created = yield* ag.createUsagePlan({
+              name,
+              description: news.description,
+              apiStages: news.apiStages,
+              throttle: news.throttle,
+              quota: news.quota,
+              tags: desiredTags,
+            });
+            if (!created.id)
+              return yield* Effect.die("createUsagePlan missing id");
+            yield* session.note(`Created usage plan ${created.id}`);
+            observed = yield* ag.getUsagePlan({ usagePlanId: created.id });
+          }
+
+          const planId = observed.id!;
+
+          // Sync mutable plan fields — diff observed cloud state against
+          // desired and emit only the delta as PATCH operations.
+          const patches: ag.PatchOperation[] = [];
+          if (news.description !== observed.description) {
+            patches.push({
+              op: "replace",
+              path: "/description",
+              value: news.description ?? "",
+            });
+          }
+          patches.push(
+            ...buildApiStagePatches(observed.apiStages, news.apiStages),
+          );
+          patches.push(
+            ...buildThrottlePatches(observed.throttle, news.throttle),
+          );
+          patches.push(...buildQuotaPatches(observed.quota, news.quota));
+          if (patches.length > 0) {
+            yield* ag.updateUsagePlan({
+              usagePlanId: planId,
+              patchOperations: patches,
+            });
+          }
+
+          // Sync tags — observed ↔ desired.
+          const observedTags = tagRecord(observed.tags);
+          if (!deepEqual(observedTags, desiredTags)) {
+            yield* syncTags({
+              resourceArn: usagePlanArn(awsRegion, planId),
+              oldTags: observedTags,
+              newTags: desiredTags,
+            });
+          }
+
+          yield* session.note(`Reconciled usage plan ${planId}`);
+          const final = yield* ag.getUsagePlan({ usagePlanId: planId });
+          return {
+            id: planId,
+            name: final.name,
+            description: final.description,
+            apiStages: final.apiStages,
+            throttle: final.throttle,
+            quota: final.quota,
+            tags: tagRecord(final.tags),
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag
+            .deleteUsagePlan({ usagePlanId: output.id })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+          yield* session.note(`Deleted usage plan ${output.id}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/UsagePlanKey.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/UsagePlanKey.ts
new file mode 100644
index 00000000000..65fa6781574
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/UsagePlanKey.ts
@@ -0,0 +1,140 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface UsagePlanKeyProps {
+  usagePlanId: Input<string>;
+  keyId: Input<string>;
+  /**
+   * @default "API_KEY"
+   */
+  keyType?: string;
+}
+
+export interface UsagePlanKey extends Resource<
+  "AWS.ApiGateway.UsagePlanKey",
+  UsagePlanKeyProps,
+  {
+    usagePlanId: string;
+    keyId: string;
+    keyType: string;
+    name: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Associates an API key with a usage plan.
+ *
+ * @section Usage plan keys
+ * @example Associate key with plan
+ * ```typescript
+ * yield* ApiGateway.UsagePlanKey("PlanKey", {
+ *   usagePlanId: plan.id,
+ *   keyId: key.id,
+ * });
+ * ```
+ */
+const UsagePlanKeyResource = Resource<UsagePlanKey>(
+  "AWS.ApiGateway.UsagePlanKey",
+);
+
+export { UsagePlanKeyResource as UsagePlanKey };
+
+export const UsagePlanKeyProvider = () =>
+  Provider.effect(
+    UsagePlanKeyResource,
+    Effect.gen(function* () {
+      return {
+        stables: ["usagePlanId", "keyId"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as UsagePlanKeyProps;
+          if (
+            news.usagePlanId !== olds.usagePlanId ||
+            news.keyId !== olds.keyId
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const k = yield* ag
+            .getUsagePlanKey({
+              usagePlanId: output.usagePlanId,
+              keyId: output.keyId,
+            })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!k?.id) return undefined;
+          return {
+            usagePlanId: output.usagePlanId,
+            keyId: k.id,
+            keyType: k.type ?? "API_KEY",
+            name: k.name,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("UsagePlanKey props were not resolved");
+          }
+          const news = newsIn as Input.ResolveProps<UsagePlanKeyProps>;
+          const usagePlanId = (output?.usagePlanId ??
+            news.usagePlanId) as string;
+          const keyId = (output?.keyId ?? news.keyId) as string;
+
+          // Observe — fetch the live link. UsagePlanKey is a pure
+          // association (no patchable fields apart from the natural-key
+          // tuple, which is modeled as `replace` in `diff`), so once it
+          // exists there's nothing to sync.
+          let observed = yield* ag
+            .getUsagePlanKey({ usagePlanId, keyId })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the link if missing.
+          if (!observed?.id) {
+            const created = yield* ag.createUsagePlanKey({
+              usagePlanId: news.usagePlanId as string,
+              keyId: news.keyId as string,
+              keyType: news.keyType ?? "API_KEY",
+            });
+            yield* session.note(
+              `Linked key ${news.keyId} to usage plan ${news.usagePlanId}`,
+            );
+            observed = yield* ag.getUsagePlanKey({
+              usagePlanId,
+              keyId: created.id ?? keyId,
+            });
+          }
+
+          return {
+            usagePlanId,
+            keyId: observed.id!,
+            keyType: observed.type ?? "API_KEY",
+            name: observed.name,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag
+            .deleteUsagePlanKey({
+              usagePlanId: output.usagePlanId,
+              keyId: output.keyId,
+            })
+            .pipe(Effect.catchTag("NotFoundException", () => Effect.void));
+          yield* session.note(`Removed key from usage plan`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/VpcLink.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/VpcLink.ts
new file mode 100644
index 00000000000..c093b78ab42
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/VpcLink.ts
@@ -0,0 +1,212 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, tagRecord } from "../../Tags.ts";
+
+import { syncTags, vpcLinkArn } from "./common.ts";
+
+export interface VpcLinkProps {
+  /**
+   * Name of the VPC link.
+   *
+   * If omitted, Alchemy generates a deterministic physical name.
+   */
+  name?: string;
+  /**
+   * Target ARNs for the integration (e.g. load balancer ARNs).
+   */
+  targetArns: string[];
+  description?: string;
+  tags?: Record<string, string>;
+}
+
+export interface VpcLink extends Resource<
+  "AWS.ApiGateway.VpcLink",
+  VpcLinkProps,
+  {
+    vpcLinkId: string;
+    name: string | undefined;
+    description: string | undefined;
+    targetArns: string[] | undefined;
+    status: ag.VpcLinkStatus | undefined;
+    statusMessage: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * VPC link for private integrations (`connectionType: "VPC_LINK"` on a method integration).
+ *
+ * @section Private integrations
+ * @example Create a VPC link
+ * ```typescript
+ * const link = yield* ApiGateway.VpcLink("NlbLink", {
+ *   description: "Link to internal NLB",
+ *   targetArns: [nlb.loadBalancerArn],
+ * });
+ *
+ * yield* ApiGateway.Method("PrivateGet", {
+ *   restApiId: api.restApiId,
+ *   resourceId: resource.resourceId,
+ *   httpMethod: "GET",
+ *   integration: {
+ *     type: "HTTP_PROXY",
+ *     integrationHttpMethod: "GET",
+ *     uri: "https://api.internal.example.com/hello",
+ *     connectionType: "VPC_LINK",
+ *     connectionId: link.vpcLinkId,
+ *   },
+ * });
+ * ```
+ */
+const VpcLinkResource = Resource<VpcLink>("AWS.ApiGateway.VpcLink");
+
+export { VpcLinkResource as VpcLink };
+
+const generatedName = (id: string, props: VpcLinkProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 128,
+      });
+
+const snapshotFromVpcLink = (
+  v: ag.VpcLink,
+  tags: Record<string, string>,
+): VpcLink["Attributes"] => ({
+  vpcLinkId: v.id!,
+  name: v.name,
+  description: v.description,
+  targetArns: v.targetArns,
+  status: v.status,
+  statusMessage: v.statusMessage,
+  tags,
+});
+
+export const VpcLinkProvider = () =>
+  Provider.effect(
+    VpcLinkResource,
+    Effect.gen(function* () {
+      const awsRegion = yield* Region;
+
+      return {
+        stables: ["vpcLinkId"] as const,
+        diff: Effect.fn(function* ({ news: newsIn, olds }) {
+          if (!isResolved(newsIn)) return;
+          const news = newsIn as VpcLinkProps;
+          if (!deepEqual(news.targetArns, olds.targetArns)) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.vpcLinkId) return undefined;
+          const v = yield* ag
+            .getVpcLink({ vpcLinkId: output.vpcLinkId })
+            .pipe(
+              Effect.catchTag("NotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!v?.id) return undefined;
+          return snapshotFromVpcLink(v, tagRecord(v.tags));
+        }),
+        reconcile: Effect.fn(function* ({ id, news: newsIn, output, session }) {
+          if (!isResolved(newsIn)) {
+            return yield* Effect.die("VpcLink props were not resolved");
+          }
+          const news = newsIn as VpcLinkProps;
+          const name = yield* generatedName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...news.tags, ...internalTags };
+
+          // Observe — fetch the live VPC link if we have a cached id.
+          // We never trust `output.description`/etc. for diffing; the
+          // observed cloud state drives every sync below.
+          let observed = output?.vpcLinkId
+            ? yield* ag
+                .getVpcLink({ vpcLinkId: output.vpcLinkId })
+                .pipe(
+                  Effect.catchTag("NotFoundException", () =>
+                    Effect.succeed(undefined),
+                  ),
+                )
+            : undefined;
+
+          // Ensure — create the VPC link if missing.
+          if (!observed?.id) {
+            const created = yield* ag.createVpcLink({
+              name,
+              description: news.description,
+              targetArns: news.targetArns,
+              tags: desiredTags,
+            });
+            if (!created.id) {
+              return yield* Effect.die("createVpcLink missing id");
+            }
+            yield* session.note(`Created VPC link ${created.id}`);
+            observed = yield* ag.getVpcLink({ vpcLinkId: created.id });
+          }
+
+          const vpcLinkId = observed.id!;
+
+          // Sync mutable scalar fields — observed ↔ desired patch list.
+          const patches: ag.PatchOperation[] = [];
+          if (news.description !== observed.description) {
+            patches.push({
+              op: "replace",
+              path: "/description",
+              value: news.description ?? "",
+            });
+          }
+          if (news.name !== undefined && news.name !== observed.name) {
+            patches.push({
+              op: "replace",
+              path: "/name",
+              value: news.name,
+            });
+          }
+          if (patches.length > 0) {
+            yield* ag.updateVpcLink({
+              vpcLinkId,
+              patchOperations: patches,
+            });
+          }
+
+          // Sync tags — observed ↔ desired so adoption converges without
+          // fighting the existing tag set.
+          const observedTags = tagRecord(observed.tags);
+          if (!deepEqual(observedTags, desiredTags)) {
+            yield* syncTags({
+              resourceArn: vpcLinkArn(awsRegion, vpcLinkId),
+              oldTags: observedTags,
+              newTags: desiredTags,
+            });
+          }
+
+          yield* session.note(`Reconciled VPC link ${vpcLinkId}`);
+          const final = yield* ag.getVpcLink({ vpcLinkId });
+          return snapshotFromVpcLink(final, tagRecord(final.tags));
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ag.deleteVpcLink({ vpcLinkId: output.vpcLinkId }).pipe(
+            Effect.retry({
+              while: (e) => e._tag === "ConflictException",
+              schedule: Schedule.spaced("1 second"),
+              times: 8,
+            }),
+            Effect.catchTag("NotFoundException", () => Effect.void),
+          );
+          yield* session.note(`Deleted VPC link ${output.vpcLinkId}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/common.ts
new file mode 100644
index 00000000000..39400b06ea9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/common.ts
@@ -0,0 +1,140 @@
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import * as Schedule from "effect/Schedule";
+import { diffTags, normalizeTags } from "../../Tags.ts";
+
+/**
+ * API Gateway serializes mutations to a single RestApi at the control-plane
+ * level: while the API is transitioning between states it responds with a
+ * `BadRequestException` whose message matches one of:
+ *
+ * - `You cannot deploy a RestApi while the apiStatus is UPDATING or FAILED.`
+ * - `There is already an update in progress.`
+ *
+ * These are fundamentally transient — the retry window is short (seconds)
+ * and the only correct response is to wait and try again. Because the
+ * exception is a 4xx, the generic `Retry.transient` policy applied to the
+ * AWS SDK will not retry it, so we apply a targeted retry here for
+ * operations that race with concurrent mutations on the same RestApi
+ * (typically `createDeployment`, `updateStage`, `deleteStage`).
+ */
+const isApiStatusUpdatingError = (error: unknown): boolean => {
+  if (!error || typeof error !== "object") return false;
+  if ((error as { _tag?: string })._tag !== "BadRequestException") return false;
+  const message = (error as { message?: string }).message ?? "";
+  return (
+    message.includes("apiStatus is UPDATING") ||
+    message.includes("already an update in progress")
+  );
+};
+
+/**
+ * `Create/Update/DeleteRestApi` (and a few sibling operations) are governed
+ * by a hard account-wide quota of one request every 30 seconds. The
+ * blanket SDK retry policy caps at 5 attempts with sub-second backoff, so
+ * tests and parallel deploys see `TooManyRequestsException` bubble out as
+ * the SDK gives up well inside the throttle window.
+ */
+const isThrottlingError = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  (error as { _tag?: string })._tag === "TooManyRequestsException";
+
+/**
+ * Schedule covering both fast (`apiStatus is UPDATING`) and slow
+ * (throttle) recoverable conditions. Exponential 2s base capped at 35s,
+ * with up to 12 attempts (~5 minutes total). The fast cases settle in the
+ * first few iterations; throttle waits ride the cap until a token is
+ * available.
+ */
+const apiGatewayMutationSchedule = pipe(
+  Schedule.exponential(Duration.seconds(2), 2),
+  Schedule.modifyDelay((d: Duration.Duration) =>
+    Effect.succeed(
+      Duration.isGreaterThan(d, Duration.seconds(35))
+        ? Duration.seconds(35)
+        : d,
+    ),
+  ),
+  Schedule.both(Schedule.recurs(12)),
+  Schedule.addDelay(() =>
+    Effect.succeed(Duration.millis(Math.random() * 1000)),
+  ),
+);
+
+/**
+ * Wraps an API Gateway mutation so that recoverable 4xx responses are
+ * retried with backoff:
+ *
+ * - `BadRequestException` with `apiStatus is UPDATING` or
+ *   `already an update in progress` (transient, clears in seconds)
+ * - `TooManyRequestsException` (account-wide throttle, ~30s window)
+ *
+ * Drop-in usage:
+ *
+ * ```ts
+ * yield* retryOnApiStatusUpdating(
+ *   ag.createDeployment({ ... }),
+ * );
+ * ```
+ */
+export const retryOnApiStatusUpdating = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  Effect.retry(effect, {
+    schedule: apiGatewayMutationSchedule,
+    while: (error: unknown) =>
+      isApiStatusUpdatingError(error) || isThrottlingError(error),
+  }) as Effect.Effect<A, E, R>;
+
+export const restApiArn = (region: string, restApiId: string) =>
+  `arn:aws:apigateway:${region}::/restapis/${restApiId}`;
+
+export const stageArn = (
+  region: string,
+  restApiId: string,
+  stageName: string,
+) => `arn:aws:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
+
+export const apiKeyArn = (region: string, apiKeyId: string) =>
+  `arn:aws:apigateway:${region}::/apikeys/${apiKeyId}`;
+
+export const usagePlanArn = (region: string, usagePlanId: string) =>
+  `arn:aws:apigateway:${region}::/usageplans/${usagePlanId}`;
+
+export const domainNameArn = (region: string, domainName: string) =>
+  `arn:aws:apigateway:${region}::/domainnames/${domainName}`;
+
+export const vpcLinkArn = (region: string, vpcLinkId: string) =>
+  `arn:aws:apigateway:${region}::/vpclinks/${vpcLinkId}`;
+
+export const syncTags = Effect.fn(function* ({
+  resourceArn,
+  oldTags,
+  newTags,
+}: {
+  resourceArn: string;
+  oldTags: Record<string, string>;
+  newTags: Record<string, string>;
+}) {
+  const { removed, upsert } = diffTags(oldTags, newTags);
+  if (removed.length > 0) {
+    yield* ag
+      .untagResource({
+        resourceArn,
+        tagKeys: removed,
+      })
+      .pipe(
+        Effect.catchTag("NotFoundException", () => Effect.void),
+        Effect.catchTag("BadRequestException", () => Effect.void),
+      );
+  }
+  if (upsert.length > 0) {
+    yield* ag.tagResource({
+      resourceArn,
+      tags: normalizeTags(upsert),
+    });
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/index.ts
new file mode 100644
index 00000000000..6ffd894610f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ApiGateway/index.ts
@@ -0,0 +1,76 @@
+export { Account, AccountProvider, type AccountProps } from "./Account.ts";
+export { ApiKey, ApiKeyProvider, type ApiKeyProps } from "./ApiKey.ts";
+export {
+  BasePathMapping,
+  BasePathMappingProvider,
+  type BasePathMappingProps,
+} from "./BasePathMapping.ts";
+export {
+  Deployment,
+  DeploymentResource,
+  DeploymentProvider,
+  type DeploymentProps,
+  type DeploymentType,
+} from "./Deployment.ts";
+export {
+  DomainName,
+  DomainNameProvider,
+  type DomainNameProps,
+} from "./DomainName.ts";
+export {
+  GatewayResponse,
+  GatewayResponseProvider,
+  type GatewayResponseProps,
+} from "./GatewayResponse.ts";
+export {
+  Resource,
+  GatewayResource,
+  ResourceProvider,
+  type ApiGatewayResource,
+  type ApiGatewayResourceProps,
+} from "./GatewayResource.ts";
+export {
+  Method,
+  MethodResource,
+  MethodProvider,
+  type MethodIntegrationProps,
+  type MethodProps,
+  type MethodType,
+} from "./Method.ts";
+export {
+  RestApi,
+  RestApiProvider,
+  type RestApiProps,
+  type RestApiBinding,
+} from "./RestApi.ts";
+export {
+  Stage,
+  StageResource,
+  StageProvider,
+  type StageProps,
+} from "./Stage.ts";
+export {
+  UsagePlan,
+  UsagePlanProvider,
+  type UsagePlanProps,
+} from "./UsagePlan.ts";
+export {
+  UsagePlanKey,
+  UsagePlanKeyProvider,
+  type UsagePlanKeyProps,
+} from "./UsagePlanKey.ts";
+export {
+  Authorizer,
+  AuthorizerProvider,
+  type AuthorizerProps,
+} from "./Authorizer.ts";
+export {
+  restApiArn,
+  stageArn,
+  apiKeyArn,
+  usagePlanArn,
+  domainNameArn,
+  vpcLinkArn,
+  syncTags,
+} from "./common.ts";
+export { VpcLink, VpcLinkProvider, type VpcLinkProps } from "./VpcLink.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Arn.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Arn.ts
new file mode 100644
index 00000000000..68fe7d1a45b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Arn.ts
@@ -0,0 +1 @@
+export type Arn = string;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Assets.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Assets.ts
new file mode 100644
index 00000000000..f7af9d71ab7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Assets.ts
@@ -0,0 +1,182 @@
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+
+import { lookupAssetsBucket } from "./Bootstrap.ts";
+
+/**
+ * Error type for Assets service operations.
+ */
+export type AssetsError =
+  | {
+      readonly _tag: "AssetsUploadError";
+      readonly message: string;
+      readonly cause?: unknown;
+    }
+  | {
+      readonly _tag: "AssetsCheckError";
+      readonly message: string;
+      readonly cause?: unknown;
+    };
+
+/**
+ * Requirements for Assets operations (S3 operations need these).
+ */
+export type AssetsRequirements = Region | Credentials | HttpClient;
+
+export class Assets extends Context.Service<
+  Assets,
+  {
+    /**
+     * The name of the assets bucket.
+     */
+    readonly bucketName: string;
+
+    /**
+     * Upload an asset to the assets bucket.
+     * Uses content-addressed storage: `lambda/{hash}.zip`
+     *
+     * @param hash - The content hash of the asset
+     * @param content - The asset content (zip file)
+     * @returns The S3 key where the asset was uploaded
+     */
+    readonly uploadAsset: (
+      hash: string,
+      content: Uint8Array,
+    ) => Effect.Effect<string, AssetsError, AssetsRequirements>;
+
+    /**
+     * Check if an asset already exists in the assets bucket.
+     *
+     * @param hash - The content hash to check
+     * @returns true if the asset exists
+     */
+    readonly hasAsset: (
+      hash: string,
+    ) => Effect.Effect<boolean, AssetsError, AssetsRequirements>;
+  }
+>()("AWS::Assets") {}
+
+/**
+ * S3 key prefix for Lambda function code assets.
+ */
+const LAMBDA_PREFIX = "lambda";
+
+/**
+ * Generate the S3 key for a Lambda asset.
+ */
+const getLambdaAssetKey = (hash: string) => `${LAMBDA_PREFIX}/${hash}.zip`;
+
+/**
+ * Look up the assets bucket by scanning for the bootstrap tags.
+ * Returns Option.some(bucketName) if found, Option.none() otherwise.
+ */
+export { lookupAssetsBucket };
+
+/**
+ * Create the Assets service implementation for a given bucket.
+ */
+const createAssetsService = (bucketName: string): typeof Assets.Service => ({
+  bucketName,
+  uploadAsset: (hash: string, content: Uint8Array) => {
+    const key = getLambdaAssetKey(hash);
+
+    return Effect.gen(function* () {
+      // Check if asset already exists
+      const exists = yield* s3
+        .headObject({ Bucket: bucketName, Key: key })
+        .pipe(
+          Effect.map(() => true),
+          Effect.catchTag("NotFound", () => Effect.succeed(false)),
+        );
+
+      if (exists) {
+        yield* Effect.logDebug(
+          `Asset already exists: s3://${bucketName}/${key}`,
+        );
+        return key;
+      }
+
+      // Upload the asset
+      yield* s3.putObject({
+        Bucket: bucketName,
+        Key: key,
+        Body: content,
+        ContentType: "application/zip",
+      });
+
+      yield* Effect.logDebug(`Uploaded asset: s3://${bucketName}/${key}`);
+      return key;
+    }).pipe(
+      Effect.mapError(
+        (err): AssetsError => ({
+          _tag: "AssetsUploadError",
+          message: `Failed to upload asset ${key}`,
+          cause: err,
+        }),
+      ),
+    );
+  },
+  hasAsset: (hash: string) => {
+    const key = getLambdaAssetKey(hash);
+
+    return s3.headObject({ Bucket: bucketName, Key: key }).pipe(
+      Effect.map(() => true),
+      Effect.catchTag("NotFound", () => Effect.succeed(false)),
+      Effect.mapError(
+        (err): AssetsError => ({
+          _tag: "AssetsCheckError",
+          message: `Failed to check asset ${key}`,
+          cause: err,
+        }),
+      ),
+    );
+  },
+});
+
+/**
+ * Layer that provides the Assets service.
+ * Looks up the assets bucket on initialization.
+ * If the bucket doesn't exist, the layer will fail - use `assetsLayerWithFallback` for graceful fallback.
+ */
+export const assetsLayer = Layer.effect(
+  Assets,
+  Effect.gen(function* () {
+    const maybeBucket = yield* lookupAssetsBucket;
+
+    if (Option.isNone(maybeBucket)) {
+      return yield* Effect.fail(
+        new Error(
+          "Assets bucket not found. Run 'alchemy bootstrap' to create it.",
+        ),
+      );
+    }
+
+    return createAssetsService(maybeBucket.value);
+  }),
+);
+
+/**
+ * Try to create the assets layer, but don't fail if the bucket doesn't exist.
+ * Returns Layer.empty if the bucket is not found.
+ */
+export const AssetsProvider = () =>
+  Layer.unwrap(
+    Effect.gen(function* () {
+      const maybeBucket = yield* lookupAssetsBucket;
+
+      if (Option.isNone(maybeBucket)) {
+        yield* Effect.logDebug(
+          "Assets bucket not found. Lambda will use inline ZipFile deployment.",
+        );
+        return Layer.empty;
+      }
+
+      return Layer.succeed(Assets, createAssetsService(maybeBucket.value));
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/AuthProvider.ts
new file mode 100644
index 00000000000..77916cc4036
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/AuthProvider.ts
@@ -0,0 +1,402 @@
+import * as DistilledAuth from "@distilled.cloud/aws/Auth";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Match from "effect/Match";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import { ChildProcess } from "effect/unstable/process";
+import * as NodeCrypto from "node:crypto";
+import * as NodeOs from "node:os";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import {
+  getEnv,
+  getEnvRedacted,
+  getEnvRedactedRequired,
+  retryOnce,
+} from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+export const AWS_AUTH_PROVIDER_NAME = "AWS";
+
+export type AwsAuthConfig =
+  | { method: "sso"; ssoProfile: string }
+  | { method: "stored" }
+  | { method: "env" };
+
+const options: Array<{
+  value: AwsAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "sso",
+    label: "SSO",
+    hint: "aws sso login — credentials loaded from AWS SSO cache",
+  },
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY",
+  },
+  {
+    value: "stored",
+    label: "Stored",
+    hint: "stored in ~/.alchemy/credentials",
+  },
+];
+
+export interface AwsStoredCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  region?: string;
+}
+
+export interface AwsResolvedCredentials {
+  accessKeyId: Redacted.Redacted<string>;
+  secretAccessKey: Redacted.Redacted<string>;
+  sessionToken?: Redacted.Redacted<string>;
+  region?: string;
+  source: {
+    type: AwsAuthConfig["method"];
+    details?: string;
+  };
+}
+
+const runSsoCommand = (command: "login" | "logout", ssoProfile: string) =>
+  Effect.gen(function* () {
+    const handle = yield* ChildProcess.make(
+      "aws",
+      ["sso", command, "--profile", ssoProfile],
+      {
+        shell: false,
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+      },
+    );
+    const exit = yield* handle.exitCode;
+    if (exit !== 0) {
+      yield* Effect.fail(
+        new AuthError({
+          message: `aws sso ${command} exited with code ${exit}`,
+        }),
+      );
+    }
+  }).pipe(Effect.scoped);
+
+const loginSSO = (config: Extract<AwsAuthConfig, { method: "sso" }>) =>
+  Clank.info(
+    `AWS SSO: running 'aws sso login --profile ${config.ssoProfile}'...`,
+  ).pipe(
+    Effect.andThen(runSsoCommand("login", config.ssoProfile)),
+    Effect.matchEffect({
+      onSuccess: () => Clank.success("AWS SSO: login complete"),
+      onFailure: (e) => Clank.warn(`AWS SSO: login faield: \`${e.message}\``),
+    }),
+  );
+
+/**
+ * `aws sso logout` only clears AWS CLI's own caches — it does not know about the
+ * `<sha1(sso_session)>.credentials.json` file that `@distilled.cloud/aws`
+ * writes alongside the SSO token. Without this cleanup, `loadProfileCredentials`
+ * short-circuits on the stale distilled cache file after logout and appears to
+ * stay logged in until the role creds hit their TTL.
+ */
+const clearDistilledSsoCache = (ssoProfile: string) =>
+  Effect.gen(function* () {
+    const auth = yield* DistilledAuth.Default;
+    const profile = yield* auth.loadProfile(ssoProfile);
+    const ssoSession = (profile as { sso_session?: string }).sso_session;
+    if (!ssoSession) return;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const hash = NodeCrypto.createHash("sha1").update(ssoSession).digest("hex");
+    const cacheFile = path.join(
+      NodeOs.homedir(),
+      ".aws",
+      "sso",
+      "cache",
+      `${hash}.credentials.json`,
+    );
+    yield* fs.remove(cacheFile).pipe(Effect.catch(() => Effect.void));
+  }).pipe(Effect.catch(() => Effect.void));
+
+/**
+ * Layer that registers the AWS {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the AWS
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const AwsAuth = AuthProviderLayer<
+  AwsAuthConfig,
+  AwsResolvedCredentials
+>()(
+  AWS_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const accessKeyId = yield* Clank.text({
+        message: "AWS Access Key ID",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      const secretAccessKey = yield* Clank.password({
+        message: "AWS Secret Access Key",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      const sessionToken = yield* Clank.text({
+        message: "AWS Session Token (optional — press Enter or Esc to skip)",
+        placeholder: "(none)",
+      }).pipe(Effect.catch(() => Effect.succeed("")));
+
+      const region = yield* Clank.text({
+        message: "AWS Region",
+        placeholder: "us-east-1",
+        defaultValue: "us-east-1",
+      }).pipe(retryOnce);
+
+      yield* store.write<AwsStoredCredentials>(profileName, "aws", {
+        accessKeyId,
+        secretAccessKey,
+        sessionToken,
+        region,
+      });
+      yield* Clank.success("AWS credentials saved.");
+
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "AWS authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("sso", () =>
+              Effect.gen(function* () {
+                const ssoProfile = yield* Clank.text({
+                  message: "AWS profile name (from ~/.aws/config)",
+                  placeholder: "default",
+                  defaultValue: "default",
+                });
+
+                const config = {
+                  method: "sso" as const,
+                  ssoProfile: ssoProfile ?? "default",
+                };
+
+                yield* loginSSO(config);
+
+                return config;
+              }),
+            ),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (profileName: string, config: AwsAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when(
+            { method: "env" },
+            Effect.fnUntraced(function* () {
+              const accessKeyId =
+                yield* getEnvRedactedRequired("AWS_ACCESS_KEY_ID");
+              const secretAccessKey = yield* getEnvRedactedRequired(
+                "AWS_SECRET_ACCESS_KEY",
+              );
+              const sessionToken = yield* getEnvRedacted("AWS_SESSION_TOKEN");
+              const region = yield* (
+                getEnv("AWS_REGION") ??
+                  getEnv("AWS_DEFAULT_REGION") ??
+                  undefined
+              );
+              return {
+                accessKeyId,
+                secretAccessKey,
+                sessionToken,
+                region,
+                source: { type: "env" as const },
+              };
+            }),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store.read<AwsStoredCredentials>(profileName, "aws").pipe(
+              Effect.flatMap((creds) =>
+                creds == null
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          "AWS stored credentials not found. Run: alchemy-effect login --configure",
+                      }),
+                    )
+                  : Effect.succeed({
+                      accessKeyId: Redacted.make(creds.accessKeyId),
+                      secretAccessKey: Redacted.make(creds.secretAccessKey),
+                      sessionToken: creds.sessionToken
+                        ? Redacted.make(creds.sessionToken)
+                        : undefined,
+                      region: creds.region,
+                      source: { type: "stored" as const },
+                    }),
+              ),
+            ),
+          ),
+          Match.when({ method: "sso" }, (config) =>
+            Effect.gen(function* () {
+              const auth = yield* DistilledAuth.Default;
+              const creds = yield* auth
+                .loadProfileCredentials(config.ssoProfile)
+                .pipe(
+                  Effect.mapError(
+                    (e) =>
+                      new AuthError({
+                        message: "failed to load credentials",
+                        cause: e,
+                      }),
+                  ),
+                );
+              const profile = yield* auth
+                .loadProfile(config.ssoProfile)
+                .pipe(Effect.catch(() => Effect.succeed(undefined)));
+              return {
+                accessKeyId: creds.accessKeyId,
+                secretAccessKey: creds.secretAccessKey,
+                sessionToken: creds.sessionToken,
+                region: profile?.region,
+                source: { type: "sso" as const, details: config.ssoProfile },
+              };
+            }),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: AwsAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) =>
+          Effect.all([
+            Console.log(
+              `  accessKeyId:     ${displayRedacted(creds.accessKeyId)}`,
+            ),
+            Console.log(
+              `  secretAccessKey: ${displayRedacted(creds.secretAccessKey)}`,
+            ),
+            creds.sessionToken
+              ? Console.log(
+                  `  sessionToken:    ${displayRedacted(creds.sessionToken)}`,
+                )
+              : Effect.void,
+            creds.region
+              ? Console.log(`  region:          ${creds.region}`)
+              : Effect.void,
+            Console.log(
+              //@ts-expect-error
+              `  source: ${creds.source.details ? `${creds.source.type} - ${creds.source.details}` : creds.source.type}`,
+            ),
+          ]),
+        ),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    const logout = (profileName: string, config: AwsAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "sso" }, (config) =>
+          Clank.info(
+            `AWS: running 'aws sso logout --profile ${config.ssoProfile}'...`,
+          ).pipe(
+            Effect.zip(runSsoCommand("logout", config.ssoProfile)),
+            Effect.zip(clearDistilledSsoCache(config.ssoProfile)),
+            Effect.match({
+              onSuccess: () => Clank.success("AWS: SSO logout complete"),
+              onFailure: (e) =>
+                Clank.warn(`AWS: SSO logout failed: \`${e.message}\``),
+            }),
+          ),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "aws")
+            .pipe(
+              Effect.andThen(Clank.success("AWS: stored credentials removed")),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: AwsAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "sso" }, (config) =>
+            DistilledAuth.loadProfileCredentials(config.ssoProfile).pipe(
+              Effect.matchEffect({
+                onSuccess: () =>
+                  Clank.info(
+                    `AWS: SSO profile '${config.ssoProfile}' already has valid credentials`,
+                  ),
+                onFailure: () => loginSSO(config),
+              }),
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<AwsStoredCredentials>(profileName, "aws")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    return {
+      configure: configureCredentials,
+      login,
+      logout,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/AutoScalingGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/AutoScalingGroup.ts
new file mode 100644
index 00000000000..5cc3bfead71
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/AutoScalingGroup.ts
@@ -0,0 +1,426 @@
+import * as autoscaling from "@distilled.cloud/aws/auto-scaling";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import type { SubnetId } from "../EC2/Subnet.ts";
+import type {
+  LaunchTemplateId,
+  LaunchTemplateName,
+  LaunchTemplate as LaunchTemplateResource,
+} from "./LaunchTemplate.ts";
+
+export type AutoScalingGroupName = string;
+
+export interface LaunchTemplateReference {
+  launchTemplateId?: Input<LaunchTemplateId>;
+  launchTemplateName?: Input<LaunchTemplateName>;
+  version?: Input<string | number>;
+}
+
+export interface AutoScalingGroupProps {
+  /**
+   * Auto Scaling Group name. If omitted, a deterministic name is generated.
+   */
+  autoScalingGroupName?: string;
+  /**
+   * Launch template used for instances in the fleet.
+   */
+  launchTemplate: Input<LaunchTemplateReference> | LaunchTemplateResource;
+  /**
+   * Subnets to place the fleet into.
+   */
+  subnetIds: Input<SubnetId[]>;
+  /**
+   * Minimum number of instances.
+   */
+  minSize: number;
+  /**
+   * Maximum number of instances.
+   */
+  maxSize: number;
+  /**
+   * Desired number of instances.
+   * @default minSize
+   */
+  desiredCapacity?: number;
+  /**
+   * Target groups to attach to the fleet.
+   */
+  targetGroupArns?: Input<string[]>;
+  /**
+   * Health check type.
+   * @default "ELB" when target groups are present, otherwise "EC2"
+   */
+  healthCheckType?: "EC2" | "ELB";
+  /**
+   * Grace period in seconds before health checks start.
+   */
+  healthCheckGracePeriod?: number;
+  /**
+   * Default cooldown in seconds.
+   */
+  defaultCooldown?: number;
+  /**
+   * Termination policies for scale-in.
+   */
+  terminationPolicies?: string[];
+  /**
+   * Tags to apply to the Auto Scaling Group itself.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface AutoScalingGroup extends Resource<
+  "AWS.AutoScaling.AutoScalingGroup",
+  AutoScalingGroupProps,
+  {
+    autoScalingGroupArn: string;
+    autoScalingGroupName: AutoScalingGroupName;
+    launchTemplateId?: string;
+    launchTemplateName?: string;
+    launchTemplateVersion?: string;
+    subnetIds: string[];
+    minSize: number;
+    maxSize: number;
+    desiredCapacity: number;
+    targetGroupArns: string[];
+    healthCheckType?: string;
+    healthCheckGracePeriod?: number;
+    defaultCooldown?: number;
+    terminationPolicies?: string[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An EC2 Auto Scaling Group that manages a fleet of instances from a launch
+ * template and can register that fleet with one or more load balancer target
+ * groups.
+ */
+export const AutoScalingGroup = Resource<AutoScalingGroup>(
+  "AWS.AutoScaling.AutoScalingGroup",
+);
+
+const isLaunchTemplateResource = (
+  value: unknown,
+): value is LaunchTemplateResource =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  (value as { Type?: string }).Type === "AWS.AutoScaling.LaunchTemplate";
+
+const sortStrings = (values: readonly string[] = []) =>
+  [...values].sort((a, b) => a.localeCompare(b));
+
+export const AutoScalingGroupProvider = () =>
+  Provider.effect(
+    AutoScalingGroup,
+    Effect.gen(function* () {
+      const toName = (
+        id: string,
+        props: { autoScalingGroupName?: string } = {},
+      ) =>
+        props.autoScalingGroupName
+          ? Effect.succeed(props.autoScalingGroupName)
+          : createPhysicalName({ id, maxLength: 255, lowercase: true });
+
+      const toLaunchTemplateSpec = (
+        input: AutoScalingGroupProps["launchTemplate"],
+      ) => {
+        const spec = isLaunchTemplateResource(input)
+          ? {
+              launchTemplateId: input.launchTemplateId,
+              launchTemplateName: input.launchTemplateName,
+              version: input.defaultVersionNumber,
+            }
+          : ((input ?? {}) as LaunchTemplateReference);
+
+        return {
+          LaunchTemplateId: spec.launchTemplateId as string | undefined,
+          LaunchTemplateName: spec.launchTemplateName as string | undefined,
+          Version:
+            spec.version === undefined ? "$Default" : String(spec.version),
+        };
+      };
+
+      const describeGroup = (autoScalingGroupName: string) =>
+        autoscaling
+          .describeAutoScalingGroups({
+            AutoScalingGroupNames: [autoScalingGroupName],
+          })
+          .pipe(Effect.map((result) => result.AutoScalingGroups?.[0]));
+
+      const toTags = (name: string, tags: Record<string, string>) =>
+        Object.entries(tags).map(([Key, Value]) => ({
+          ResourceId: name,
+          ResourceType: "auto-scaling-group",
+          Key,
+          Value,
+          PropagateAtLaunch: false,
+        }));
+
+      const syncTargetGroups = Effect.fn(function* ({
+        autoScalingGroupName,
+        oldTargetGroupArns,
+        newTargetGroupArns,
+      }: {
+        autoScalingGroupName: string;
+        oldTargetGroupArns: string[];
+        newTargetGroupArns: string[];
+      }) {
+        const oldSet = new Set(oldTargetGroupArns);
+        const newSet = new Set(newTargetGroupArns);
+
+        const detached = oldTargetGroupArns.filter((arn) => !newSet.has(arn));
+        const attached = newTargetGroupArns.filter((arn) => !oldSet.has(arn));
+
+        if (detached.length > 0) {
+          yield* autoscaling.detachLoadBalancerTargetGroups({
+            AutoScalingGroupName: autoScalingGroupName,
+            TargetGroupARNs: detached,
+          } as any);
+        }
+
+        if (attached.length > 0) {
+          yield* autoscaling.attachLoadBalancerTargetGroups({
+            AutoScalingGroupName: autoScalingGroupName,
+            TargetGroupARNs: attached,
+          } as any);
+        }
+      });
+
+      const syncTags = Effect.fn(function* ({
+        autoScalingGroupName,
+        oldTags,
+        newTags,
+      }: {
+        autoScalingGroupName: string;
+        oldTags: Record<string, string>;
+        newTags: Record<string, string>;
+      }) {
+        const { removed, upsert } = diffTags(oldTags, newTags);
+
+        if (removed.length > 0) {
+          yield* autoscaling.deleteTags({
+            Tags: removed.map((Key) => ({
+              ResourceId: autoScalingGroupName,
+              ResourceType: "auto-scaling-group",
+              Key,
+            })),
+          } as any);
+        }
+
+        if (upsert.length > 0) {
+          yield* autoscaling.createOrUpdateTags({
+            Tags: upsert.map(({ Key, Value }) => ({
+              ResourceId: autoScalingGroupName,
+              ResourceType: "auto-scaling-group",
+              Key,
+              Value,
+              PropagateAtLaunch: false,
+            })),
+          } as any);
+        }
+      });
+
+      const toAttributes = (
+        group: autoscaling.AutoScalingGroup,
+      ): AutoScalingGroup["Attributes"] => ({
+        autoScalingGroupArn: group.AutoScalingGroupARN!,
+        autoScalingGroupName: group.AutoScalingGroupName!,
+        launchTemplateId: group.LaunchTemplate?.LaunchTemplateId,
+        launchTemplateName: group.LaunchTemplate?.LaunchTemplateName,
+        launchTemplateVersion: group.LaunchTemplate?.Version,
+        subnetIds: String(group.VPCZoneIdentifier ?? "")
+          .split(",")
+          .filter(Boolean),
+        minSize: group.MinSize ?? 0,
+        maxSize: group.MaxSize ?? 0,
+        desiredCapacity: group.DesiredCapacity ?? 0,
+        targetGroupArns: sortStrings(group.TargetGroupARNs ?? []),
+        healthCheckType: group.HealthCheckType,
+        healthCheckGracePeriod: group.HealthCheckGracePeriod,
+        defaultCooldown: group.DefaultCooldown,
+        terminationPolicies: group.TerminationPolicies ?? [],
+        tags: Object.fromEntries(
+          (group.Tags ?? [])
+            .filter((tag): tag is { Key: string; Value: string } =>
+              Boolean(tag.Key && tag.Value !== undefined),
+            )
+            .map((tag) => [tag.Key, tag.Value]),
+        ),
+      });
+
+      return {
+        stables: ["autoScalingGroupArn", "autoScalingGroupName"],
+        diff: Effect.fn(function* ({ id, olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news ?? {});
+          if (oldName !== newName) {
+            return { action: "replace", deleteFirst: true } as const;
+          }
+
+          if (!deepEqual(olds, news)) {
+            return {
+              action: "update",
+              stables: ["autoScalingGroupArn", "autoScalingGroupName"],
+            } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.autoScalingGroupName ?? (yield* toName(id, olds ?? {}));
+          const group = yield* describeGroup(name);
+          return group ? toAttributes(group) : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const autoScalingGroupName =
+            output?.autoScalingGroupName ?? (yield* toName(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const targetGroupArns = sortStrings(
+            (news.targetGroupArns ?? []) as string[],
+          );
+          const launchTemplate = toLaunchTemplateSpec(news.launchTemplate);
+          const healthCheckType =
+            news.healthCheckType ??
+            (targetGroupArns.length > 0 ? "ELB" : "EC2");
+
+          // Observe — fetch live state. `describeAutoScalingGroups` returns
+          // an empty list when the ASG is missing; we never trust `output`
+          // alone since the ASG may have been deleted out of band.
+          let existing = yield* describeGroup(autoScalingGroupName);
+
+          // Ensure — create the ASG if missing. `createAutoScalingGroup`
+          // raises `AlreadyExistsFault` on a race; we fall through to the
+          // sync path on that case.
+          if (!existing) {
+            yield* autoscaling
+              .createAutoScalingGroup({
+                AutoScalingGroupName: autoScalingGroupName,
+                MinSize: news.minSize,
+                MaxSize: news.maxSize,
+                DesiredCapacity: news.desiredCapacity ?? news.minSize,
+                LaunchTemplate: launchTemplate,
+                VPCZoneIdentifier: (news.subnetIds as string[]).join(","),
+                TargetGroupARNs: targetGroupArns,
+                HealthCheckType: healthCheckType,
+                HealthCheckGracePeriod: news.healthCheckGracePeriod,
+                DefaultCooldown: news.defaultCooldown,
+                TerminationPolicies: news.terminationPolicies,
+                Tags: toTags(autoScalingGroupName, desiredTags),
+              } as any)
+              .pipe(
+                Effect.catch((error: any) =>
+                  error?._tag === "AlreadyExistsFault"
+                    ? Effect.void
+                    : Effect.fail(error),
+                ),
+              );
+
+            existing = yield* describeGroup(autoScalingGroupName).pipe(
+              Effect.filterOrFail(
+                Boolean,
+                () =>
+                  new Error(
+                    `Auto Scaling Group '${autoScalingGroupName}' was not readable after create`,
+                  ),
+              ),
+              Effect.retry({
+                while: () => true,
+                schedule: Schedule.recurs(8).pipe(
+                  Schedule.both(Schedule.exponential("250 millis")),
+                ),
+              }),
+            );
+          }
+
+          // Sync core ASG configuration — `updateAutoScalingGroup`
+          // overwrites min/max/desired/template/subnets/health-check
+          // settings in one call, so we issue it unconditionally
+          // (idempotent for matching values).
+          yield* autoscaling.updateAutoScalingGroup({
+            AutoScalingGroupName: autoScalingGroupName,
+            MinSize: news.minSize,
+            MaxSize: news.maxSize,
+            DesiredCapacity: news.desiredCapacity ?? news.minSize,
+            LaunchTemplate: launchTemplate,
+            VPCZoneIdentifier: (news.subnetIds as string[]).join(","),
+            HealthCheckType: healthCheckType,
+            HealthCheckGracePeriod: news.healthCheckGracePeriod,
+            DefaultCooldown: news.defaultCooldown,
+            TerminationPolicies: news.terminationPolicies,
+          } as any);
+
+          // Sync target groups — observed cloud attachments vs desired.
+          const observedAttrs = toAttributes(existing);
+          yield* syncTargetGroups({
+            autoScalingGroupName,
+            oldTargetGroupArns: sortStrings(existing.TargetGroupARNs ?? []),
+            newTargetGroupArns: targetGroupArns,
+          });
+
+          // Sync tags — observed cloud tags vs desired. Adoption brings
+          // tags through `existing.Tags`; we converge regardless of what
+          // was there before.
+          yield* syncTags({
+            autoScalingGroupName,
+            oldTags: observedAttrs.tags,
+            newTags: desiredTags,
+          });
+
+          // Re-read final state so attributes reflect post-sync cloud
+          // state.
+          const group = yield* describeGroup(autoScalingGroupName).pipe(
+            Effect.filterOrFail(
+              Boolean,
+              () =>
+                new Error(
+                  `Auto Scaling Group '${autoScalingGroupName}' was not readable after reconcile`,
+                ),
+            ),
+          );
+          yield* session.note(autoScalingGroupName);
+          return toAttributes(group);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const existing = yield* describeGroup(output.autoScalingGroupName);
+          if (!existing) {
+            return;
+          }
+
+          yield* autoscaling.deleteAutoScalingGroup({
+            AutoScalingGroupName: output.autoScalingGroupName,
+            ForceDelete: true,
+          } as any);
+
+          yield* describeGroup(output.autoScalingGroupName).pipe(
+            Effect.flatMap((group) =>
+              group
+                ? Effect.fail(new Error("AutoScalingGroupStillExists"))
+                : Effect.void,
+            ),
+            Effect.retry({
+              while: (error) =>
+                (error as Error).message === "AutoScalingGroupStillExists",
+              schedule: Schedule.recurs(12).pipe(
+                Schedule.both(Schedule.exponential("250 millis")),
+              ),
+            }),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/LaunchTemplate.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/LaunchTemplate.ts
new file mode 100644
index 00000000000..6c59bfbc066
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/LaunchTemplate.ts
@@ -0,0 +1,516 @@
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import type * as rolldown from "rolldown";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
+import { Assets } from "../Assets.ts";
+import type { SecurityGroupId } from "../EC2/SecurityGroup.ts";
+import {
+  createEc2HostRuntimeContext,
+  createEc2HostedSupport,
+  type Ec2HostRuntimeContext,
+} from "../EC2/hosted.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+
+export type LaunchTemplateId = `lt-${string}`;
+export type LaunchTemplateName = string;
+export type LaunchTemplateArn =
+  `arn:aws:ec2:${RegionID}:${AccountID}:launch-template/${LaunchTemplateId}`;
+
+export interface LaunchTemplateProps extends PlatformProps {
+  /**
+   * Launch template name. If omitted, a deterministic name is generated.
+   */
+  launchTemplateName?: string;
+  /**
+   * AMI ID to launch.
+   */
+  imageId: string;
+  /**
+   * EC2 instance type, such as `t3.micro`.
+   */
+  instanceType: string;
+  /**
+   * Security groups to attach to the primary network interface.
+   */
+  securityGroupIds?: Input<SecurityGroupId>[];
+  /**
+   * Optional EC2 key pair name for SSH access.
+   */
+  keyName?: string;
+  /**
+   * Optional IAM instance profile name to attach at launch.
+   */
+  instanceProfileName?: string;
+  /**
+   * User data script to provide at launch time.
+   */
+  userData?: string;
+  /**
+   * Whether to associate a public IPv4 address on launch.
+   */
+  associatePublicIpAddress?: boolean;
+  /**
+   * User-defined tags to apply to the launch template and launched instances.
+   */
+  tags?: Record<string, string>;
+  /**
+   * Module entrypoint for the bundled instance program.
+   * When omitted, the launch template behaves as a low-level EC2 primitive.
+   */
+  main?: string;
+  /**
+   * Named export to load from `main`.
+   * @default "default"
+   */
+  handler?: string;
+  /**
+   * Port exposed by the process, if any.
+   * @default 3000
+   */
+  port?: number;
+  /**
+   * Additional environment variables for the hosted process.
+   */
+  env?: Record<string, any>;
+  /**
+   * Bundler configuration for the hosted process entrypoint.
+   */
+  build?: {
+    input?: Partial<rolldown.InputOptions>;
+    output?: Partial<rolldown.OutputOptions>;
+  };
+  /**
+   * Additional managed policy ARNs for the managed instance role.
+   * This can only be used when Alchemy manages the instance profile.
+   */
+  roleManagedPolicyArns?: string[];
+}
+
+export interface LaunchTemplate extends Resource<
+  "AWS.AutoScaling.LaunchTemplate",
+  LaunchTemplateProps,
+  {
+    launchTemplateId: LaunchTemplateId;
+    launchTemplateArn: LaunchTemplateArn;
+    launchTemplateName: LaunchTemplateName;
+    defaultVersionNumber: number;
+    latestVersionNumber: number;
+    tags: Record<string, string>;
+    roleArn?: string;
+    roleName?: string;
+    policyName?: string;
+    managedIam?: boolean;
+    runtimeUnitName?: string;
+    assetPrefix?: string;
+    code?: {
+      hash: string;
+    };
+  },
+  {
+    env?: Record<string, any>;
+    policyStatements?: PolicyStatement[];
+  },
+  Providers
+> {}
+
+export type LaunchTemplateServices = Credentials | Region;
+
+export type LaunchTemplateShape = Main<LaunchTemplateServices>;
+
+export type LaunchTemplateRuntimeContext = Ec2HostRuntimeContext;
+
+/**
+ * A launch template that preserves the `Host` authoring model used by
+ * `AWS.EC2.Instance`, but packages that host configuration for use with an
+ * Auto Scaling Group.
+ *
+ * @section Hosting Processes
+ * @example Hosted HTTP Launch Template
+ * ```typescript
+ * const template = yield* Effect.gen(function* () {
+ *   yield* Http.serve(HttpServerResponse.json({ ok: true }));
+ *
+ *   return {
+ *     main: import.meta.filename,
+ *     imageId,
+ *     instanceType: "t3.small",
+ *     securityGroupIds: [securityGroup.groupId],
+ *     port: 3000,
+ *   };
+ * }).pipe(
+ *   Effect.provide(AWS.EC2.HttpServer),
+ *   AWS.AutoScaling.LaunchTemplate("ApiTemplate"),
+ * );
+ * ```
+ */
+export const LaunchTemplate: Platform<
+  LaunchTemplate,
+  LaunchTemplateServices,
+  LaunchTemplateShape,
+  LaunchTemplateRuntimeContext
+> = Platform("AWS.AutoScaling.LaunchTemplate", {
+  createRuntimeContext: createEc2HostRuntimeContext(
+    "AWS.AutoScaling.LaunchTemplate",
+  ),
+});
+
+export const LaunchTemplateProvider = () =>
+  Provider.effect(
+    LaunchTemplate,
+    Effect.gen(function* () {
+      const { accountId } = yield* AWSEnvironment;
+      const region = yield* Region;
+      const stack = yield* Stack;
+      const stage = yield* Stage;
+      const fs = yield* FileSystem.FileSystem;
+      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+      const assets = (yield* Effect.serviceOption(Assets)).pipe(
+        Option.getOrUndefined,
+      );
+
+      const hosted = createEc2HostedSupport({
+        accountId,
+        region,
+        stackName: stack.name,
+        stage,
+        fs,
+        virtualEntryPlugin,
+        assets,
+        resourceType: "AWS.AutoScaling.LaunchTemplate",
+      });
+
+      const toName = (
+        id: string,
+        props: { launchTemplateName?: string } = {},
+      ) =>
+        props.launchTemplateName
+          ? Effect.succeed(props.launchTemplateName)
+          : createPhysicalName({ id, maxLength: 128, lowercase: true });
+
+      const toArn = (launchTemplateId: LaunchTemplateId) =>
+        `arn:aws:ec2:${region}:${accountId}:launch-template/${launchTemplateId}` as LaunchTemplateArn;
+
+      const describeById = (launchTemplateId: string) =>
+        ec2
+          .describeLaunchTemplates({
+            LaunchTemplateIds: [launchTemplateId],
+          } as any)
+          .pipe(
+            Effect.map((result) => result.LaunchTemplates?.[0]),
+            Effect.catch((error) =>
+              isLaunchTemplateNotFound(error)
+                ? Effect.succeed(undefined)
+                : Effect.fail(error),
+            ),
+          );
+
+      const describeByName = (launchTemplateName: string) =>
+        ec2
+          .describeLaunchTemplates({
+            LaunchTemplateNames: [launchTemplateName],
+          } as any)
+          .pipe(
+            Effect.map((result) => result.LaunchTemplates?.[0]),
+            Effect.catch((error) =>
+              isLaunchTemplateNotFound(error)
+                ? Effect.succeed(undefined)
+                : Effect.fail(error),
+            ),
+          );
+
+      const syncTemplateTags = Effect.fn(function* ({
+        launchTemplateId,
+        oldTags,
+        newTags,
+      }: {
+        launchTemplateId: LaunchTemplateId;
+        oldTags: Record<string, string>;
+        newTags: Record<string, string>;
+      }) {
+        const { removed, upsert } = diffTags(oldTags, newTags);
+        if (removed.length > 0) {
+          yield* ec2.deleteTags({
+            Resources: [launchTemplateId],
+            Tags: removed.map((key) => ({ Key: key })),
+          });
+        }
+        if (upsert.length > 0) {
+          yield* ec2.createTags({
+            Resources: [launchTemplateId],
+            Tags: upsert,
+          });
+        }
+      });
+
+      const createVersion = Effect.fn(function* ({
+        launchTemplateId,
+        news,
+        runtime,
+      }: {
+        launchTemplateId: LaunchTemplateId;
+        news: LaunchTemplateProps;
+        runtime: {
+          userData?: string;
+          instanceProfileName?: string;
+          code?: {
+            hash: string;
+          };
+        };
+      }) {
+        const created = yield* ec2.createLaunchTemplateVersion({
+          LaunchTemplateId: launchTemplateId,
+          VersionDescription: runtime.code?.hash ?? "alchemy-update",
+          LaunchTemplateData: hosted.buildLaunchTemplateData(
+            {
+              imageId: news.imageId,
+              instanceType: news.instanceType,
+              keyName: news.keyName,
+              securityGroupIds: news.securityGroupIds as string[] | undefined,
+              associatePublicIpAddress: news.associatePublicIpAddress,
+              tags: news.tags,
+            },
+            runtime,
+          ),
+        } as any);
+
+        const versionNumber = created.LaunchTemplateVersion?.VersionNumber;
+        if (versionNumber === undefined) {
+          return yield* Effect.fail(
+            new Error(
+              `createLaunchTemplateVersion returned no version for '${launchTemplateId}'`,
+            ),
+          );
+        }
+
+        yield* ec2.modifyLaunchTemplate({
+          LaunchTemplateId: launchTemplateId,
+          DefaultVersion: String(versionNumber),
+        } as any);
+
+        return Number(versionNumber);
+      });
+
+      const toAttributes = (
+        template: ec2.LaunchTemplate,
+        runtime: Partial<LaunchTemplate["Attributes"]> = {},
+      ): LaunchTemplate["Attributes"] => ({
+        launchTemplateId: template.LaunchTemplateId as LaunchTemplateId,
+        launchTemplateArn: toArn(template.LaunchTemplateId as LaunchTemplateId),
+        launchTemplateName: template.LaunchTemplateName!,
+        defaultVersionNumber: Number(template.DefaultVersionNumber ?? 1),
+        latestVersionNumber: Number(
+          template.LatestVersionNumber ?? template.DefaultVersionNumber ?? 1,
+        ),
+        tags: toTagRecord(template.Tags),
+        roleArn: runtime.roleArn,
+        roleName: runtime.roleName,
+        policyName: runtime.policyName,
+        managedIam: runtime.managedIam,
+        runtimeUnitName: runtime.runtimeUnitName,
+        assetPrefix: runtime.assetPrefix,
+        code: runtime.code,
+      });
+
+      return {
+        stables: [
+          "launchTemplateId",
+          "launchTemplateArn",
+          "launchTemplateName",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news ?? {});
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+
+          if (!deepEqual(olds, news)) {
+            return {
+              action: "update",
+              stables: [
+                "launchTemplateId",
+                "launchTemplateArn",
+                "launchTemplateName",
+              ],
+            } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const template =
+            (output?.launchTemplateId &&
+              (yield* describeById(output.launchTemplateId))) ??
+            (yield* describeByName(yield* toName(id, olds ?? {})));
+
+          return template
+            ? toAttributes(template, {
+                roleArn: output?.roleArn,
+                roleName: output?.roleName,
+                policyName: output?.policyName,
+                managedIam: output?.managedIam,
+                runtimeUnitName: output?.runtimeUnitName,
+                assetPrefix: output?.assetPrefix,
+                code: output?.code,
+              })
+            : undefined;
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          output,
+          bindings,
+          session,
+        }) {
+          const launchTemplateName =
+            output?.launchTemplateName ?? (yield* toName(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const runtime = yield* hosted.resolveHostedRuntime({
+            id,
+            news,
+            bindings,
+            output,
+          });
+
+          // Observe — fetch live cloud state. We try both lookup paths
+          // (id from output, name from desired) so the reconciler
+          // converges whether `output` is fresh, stale, or missing.
+          let existing =
+            (output?.launchTemplateId &&
+              (yield* describeById(output.launchTemplateId))) ||
+            (yield* describeByName(launchTemplateName));
+
+          // Ensure — create the launch template if missing. We must
+          // verify alchemy ownership via tags here (since this resource
+          // does not implement `read` adoption gating).
+          if (!existing) {
+            const created = yield* ec2.createLaunchTemplate({
+              LaunchTemplateName: launchTemplateName,
+              VersionDescription: runtime.code?.hash ?? "alchemy-create",
+              TagSpecifications: [
+                {
+                  ResourceType: "launch-template",
+                  Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                  })),
+                },
+              ],
+              LaunchTemplateData: hosted.buildLaunchTemplateData(
+                {
+                  imageId: news.imageId,
+                  instanceType: news.instanceType,
+                  keyName: news.keyName,
+                  securityGroupIds: news.securityGroupIds as
+                    | string[]
+                    | undefined,
+                  associatePublicIpAddress: news.associatePublicIpAddress,
+                  tags: desiredTags,
+                },
+                runtime,
+              ),
+            } as any);
+            const template = created.LaunchTemplate;
+            if (!template?.LaunchTemplateId || !template.LaunchTemplateName) {
+              return yield* Effect.fail(
+                new Error(
+                  `createLaunchTemplate returned no launch template for '${id}'`,
+                ),
+              );
+            }
+            yield* session.note(template.LaunchTemplateId);
+            return toAttributes(template as ec2.LaunchTemplate, runtime);
+          }
+
+          if (!hasTags(desiredTags, toTagRecord(existing.Tags))) {
+            return yield* Effect.fail(
+              new Error(
+                `Launch template '${launchTemplateName}' already exists and is not managed by alchemy`,
+              ),
+            );
+          }
+
+          // Sync version — each reconcile creates a new version pinned as
+          // the default. ASGs that reference `$Default` automatically
+          // pick up the new version.
+          yield* createVersion({
+            launchTemplateId: existing.LaunchTemplateId as LaunchTemplateId,
+            news,
+            runtime,
+          });
+
+          // Sync tags — diff observed cloud tags against desired.
+          yield* syncTemplateTags({
+            launchTemplateId: existing.LaunchTemplateId as LaunchTemplateId,
+            oldTags: toTagRecord(existing.Tags),
+            newTags: desiredTags,
+          });
+
+          const refreshed = yield* describeById(existing.LaunchTemplateId!);
+          if (!refreshed) {
+            return yield* Effect.fail(
+              new Error(
+                `Launch template '${launchTemplateName}' was not readable after reconcile`,
+              ),
+            );
+          }
+          yield* session.note(refreshed.LaunchTemplateId!);
+          return toAttributes(refreshed, runtime);
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ec2
+            .deleteLaunchTemplate({
+              LaunchTemplateId: output.launchTemplateId,
+            } as any)
+            .pipe(
+              Effect.catch((error) =>
+                isLaunchTemplateNotFound(error)
+                  ? Effect.void
+                  : Effect.fail(error),
+              ),
+            );
+
+          yield* hosted.cleanupHostedRuntime({ output, session });
+        }),
+      };
+    }),
+  );
+
+const isLaunchTemplateNotFound = (error: unknown) => {
+  const tag = (error as { _tag?: string })?._tag;
+  return (
+    tag === "InvalidLaunchTemplateNameNotFoundException" ||
+    tag === "InvalidLaunchTemplateIdNotFoundException" ||
+    tag === "InvalidLaunchTemplateId.Malformed" ||
+    tag === "InvalidLaunchTemplateId.NotFound"
+  );
+};
+
+const toTagRecord = (tags?: Array<{ Key?: string; Value?: string }>) =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter((tag): tag is { Key: string; Value: string } =>
+        Boolean(tag.Key && tag.Value !== undefined),
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/ScalingPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/ScalingPolicy.ts
new file mode 100644
index 00000000000..5db6b6aeb74
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/ScalingPolicy.ts
@@ -0,0 +1,216 @@
+import * as autoscaling from "@distilled.cloud/aws/auto-scaling";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { AutoScalingGroup as AutoScalingGroupResource } from "./AutoScalingGroup.ts";
+
+export type ScalingPolicyName = string;
+
+export interface ScalingPolicyProps {
+  /**
+   * Policy name. If omitted, a deterministic name is generated.
+   */
+  policyName?: string;
+  /**
+   * Auto Scaling Group to attach the policy to.
+   */
+  autoScalingGroup: Input<string> | AutoScalingGroupResource;
+  /**
+   * Policy type.
+   * @default "TargetTrackingScaling"
+   */
+  policyType?: "TargetTrackingScaling";
+  /**
+   * Predefined scaling metric to track.
+   */
+  predefinedMetricType:
+    | "ASGAverageCPUUtilization"
+    | "ASGAverageNetworkIn"
+    | "ASGAverageNetworkOut"
+    | "ALBRequestCountPerTarget";
+  /**
+   * Desired target value for the metric.
+   */
+  targetValue: number;
+  /**
+   * Disable scale-in while target tracking is active.
+   */
+  disableScaleIn?: boolean;
+  /**
+   * Estimated warmup time for new instances.
+   */
+  estimatedInstanceWarmup?: number;
+}
+
+export interface ScalingPolicy extends Resource<
+  "AWS.AutoScaling.ScalingPolicy",
+  ScalingPolicyProps,
+  {
+    policyArn: string;
+    policyName: ScalingPolicyName;
+    autoScalingGroupName: string;
+    policyType: string;
+    targetValue: number;
+    predefinedMetricType: string;
+    alarms: string[];
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A target-tracking scaling policy for an Auto Scaling Group.
+ */
+export const ScalingPolicy = Resource<ScalingPolicy>(
+  "AWS.AutoScaling.ScalingPolicy",
+);
+
+const isAutoScalingGroupResource = (
+  value: unknown,
+): value is AutoScalingGroupResource =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  (value as { Type?: string }).Type === "AWS.AutoScaling.AutoScalingGroup";
+
+export const ScalingPolicyProvider = () =>
+  Provider.effect(
+    ScalingPolicy,
+    Effect.gen(function* () {
+      const toName = (id: string, props: { policyName?: string } = {}) =>
+        props.policyName
+          ? Effect.succeed(props.policyName)
+          : createPhysicalName({ id, maxLength: 255, lowercase: true });
+
+      const toAutoScalingGroupName = (
+        input: ScalingPolicyProps["autoScalingGroup"],
+      ) =>
+        isAutoScalingGroupResource(input)
+          ? (input.autoScalingGroupName as unknown as string)
+          : (input as unknown as string);
+
+      const describePolicy = ({
+        autoScalingGroupName,
+        policyName,
+      }: {
+        autoScalingGroupName: string;
+        policyName: string;
+      }) =>
+        autoscaling
+          .describePolicies({
+            AutoScalingGroupName: autoScalingGroupName,
+            PolicyNames: [policyName],
+          })
+          .pipe(Effect.map((result) => result.ScalingPolicies?.[0]));
+
+      const toAttributes = (
+        policy: autoscaling.ScalingPolicy,
+      ): ScalingPolicy["Attributes"] => ({
+        policyArn: policy.PolicyARN!,
+        policyName: policy.PolicyName!,
+        autoScalingGroupName: policy.AutoScalingGroupName!,
+        policyType: policy.PolicyType!,
+        targetValue:
+          policy.TargetTrackingConfiguration?.TargetValue ??
+          policy.StepAdjustments?.[0]?.MetricIntervalLowerBound ??
+          0,
+        predefinedMetricType:
+          policy.TargetTrackingConfiguration?.PredefinedMetricSpecification
+            ?.PredefinedMetricType ?? "",
+        alarms: (policy.Alarms ?? [])
+          .map((alarm) => alarm.AlarmName)
+          .filter((alarm): alarm is string => Boolean(alarm)),
+      });
+
+      return {
+        stables: ["policyArn", "policyName", "autoScalingGroupName"],
+        diff: Effect.fn(function* ({ id, olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news ?? {});
+          if (
+            oldName !== newName ||
+            toAutoScalingGroupName(olds.autoScalingGroup) !==
+              toAutoScalingGroupName(news.autoScalingGroup)
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          if (!deepEqual(olds, news)) {
+            return {
+              action: "update",
+              stables: ["policyArn", "policyName", "autoScalingGroupName"],
+            } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const autoScalingGroupName =
+            output?.autoScalingGroupName ??
+            toAutoScalingGroupName(olds!.autoScalingGroup);
+          const policyName =
+            output?.policyName ?? (yield* toName(id, olds ?? {}));
+          const policy = yield* describePolicy({
+            autoScalingGroupName,
+            policyName,
+          });
+          return policy ? toAttributes(policy) : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const autoScalingGroupName =
+            output?.autoScalingGroupName ??
+            toAutoScalingGroupName(news.autoScalingGroup);
+          const policyName = output?.policyName ?? (yield* toName(id, news));
+
+          // Ensure + Sync — `putScalingPolicy` is the single
+          // create-or-update API for a scaling policy. It's idempotent on
+          // matching params and overwrites policy type / target tracking
+          // config / estimated warmup on differences, so we issue it
+          // unconditionally.
+          yield* autoscaling.putScalingPolicy({
+            AutoScalingGroupName: autoScalingGroupName,
+            PolicyName: policyName,
+            PolicyType: news.policyType ?? "TargetTrackingScaling",
+            TargetTrackingConfiguration: {
+              PredefinedMetricSpecification: {
+                PredefinedMetricType: news.predefinedMetricType,
+              },
+              TargetValue: news.targetValue,
+              DisableScaleIn: news.disableScaleIn,
+            },
+            EstimatedInstanceWarmup: news.estimatedInstanceWarmup,
+          } as any);
+
+          // Observe final state — re-read so the returned attributes
+          // reflect the live cloud state (including the generated
+          // policyArn and any associated alarm names).
+          const policy = yield* describePolicy({
+            autoScalingGroupName,
+            policyName,
+          }).pipe(
+            Effect.flatMap((policy) =>
+              policy
+                ? Effect.succeed(policy)
+                : Effect.fail(
+                    new Error(
+                      `Scaling policy '${policyName}' was not readable after reconcile`,
+                    ),
+                  ),
+            ),
+          );
+          yield* session.note(policyName);
+          return toAttributes(policy);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* autoscaling.deletePolicy({
+            AutoScalingGroupName: output.autoScalingGroupName,
+            PolicyName: output.policyName,
+          } as any);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/index.ts
new file mode 100644
index 00000000000..f75e440cb62
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/AutoScaling/index.ts
@@ -0,0 +1,3 @@
+export * from "./AutoScalingGroup.ts";
+export * from "./LaunchTemplate.ts";
+export * from "./ScalingPolicy.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Bootstrap.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Bootstrap.ts
new file mode 100644
index 00000000000..2d0741c3101
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Bootstrap.ts
@@ -0,0 +1,276 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import type { BucketLocationConstraint } from "@distilled.cloud/aws/s3";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import { AWSEnvironment } from "./Environment.ts";
+
+/**
+ * Tag key used to identify the alchemy assets bucket.
+ */
+export const ASSETS_BUCKET_TAG = "alchemy::assets-bucket";
+
+/**
+ * Tag key used to scope the alchemy assets bucket to an AWS region.
+ */
+export const ASSETS_BUCKET_REGION_TAG = "alchemy::assets-bucket-region";
+
+/**
+ * Build an account-regional namespace bucket name.
+ *
+ * Account-regional buckets must follow the naming convention:
+ *   `<prefix>-<accountId>-<region>-an`
+ *
+ * @see https://docs.aws.amazon.com/AmazonS3/latest/userguide/gpbucketnamespaces.html#account-regional-gp-buckets
+ */
+const createAssetsBucketName = (accountId: string, region: string) =>
+  `alchemy-assets-${accountId}-${region}-an`.toLowerCase();
+
+const createAssetsBucketTags = (region: string) => [
+  { Key: ASSETS_BUCKET_TAG, Value: "true" },
+  { Key: ASSETS_BUCKET_REGION_TAG, Value: region },
+];
+
+const getBucketTags = (bucketName: string) =>
+  s3.getBucketTagging({ Bucket: bucketName }).pipe(
+    Effect.map((response) => response.TagSet ?? []),
+    Effect.catchTag("NoSuchTagSet", () =>
+      Effect.succeed<Array<{ Key?: string; Value?: string }>>([]),
+    ),
+  );
+
+const hasAssetsBucketTag = (tags: Array<{ Key?: string; Value?: string }>) =>
+  tags.some((tag) => tag.Key === ASSETS_BUCKET_TAG && tag.Value === "true");
+
+const normalizeBucketRegion = (location: string | undefined) => {
+  if (!location) {
+    return "us-east-1";
+  }
+  if (location === "EU") {
+    return "eu-west-1";
+  }
+  return location;
+};
+
+const bucketMatchesRegion = (
+  tags: Array<{ Key?: string; Value?: string }>,
+  region: string,
+) => {
+  const taggedRegion = tags.find(
+    (tag) => tag.Key === ASSETS_BUCKET_REGION_TAG,
+  )?.Value;
+  return taggedRegion === undefined ? undefined : taggedRegion === region;
+};
+
+export const lookupAssetsBuckets = Effect.gen(function* () {
+  const region = yield* Region;
+  const buckets = (yield* s3.listBuckets({})).Buckets ?? [];
+  const matchingBuckets: string[] = [];
+
+  for (const bucket of buckets) {
+    const bucketName = bucket.Name;
+    if (!bucketName) {
+      continue;
+    }
+
+    const tags = yield* getBucketTags(bucketName).pipe(
+      Effect.catch(() =>
+        Effect.succeed<Array<{ Key?: string; Value?: string }>>([]),
+      ),
+    );
+
+    if (!hasAssetsBucketTag(tags)) {
+      continue;
+    }
+
+    const taggedRegionMatch = bucketMatchesRegion(tags, region);
+    if (taggedRegionMatch === true) {
+      matchingBuckets.push(bucketName);
+      continue;
+    }
+
+    if (taggedRegionMatch === false) {
+      continue;
+    }
+
+    const location = yield* s3.getBucketLocation({ Bucket: bucketName }).pipe(
+      Effect.map((response) =>
+        normalizeBucketRegion(response.LocationConstraint),
+      ),
+      Effect.catch(() => Effect.succeed<string | undefined>(undefined)),
+    );
+
+    if (location === region) {
+      matchingBuckets.push(bucketName);
+    }
+  }
+
+  return matchingBuckets;
+});
+
+export const lookupAssetsBucket = Effect.gen(function* () {
+  const matchingBuckets = yield* lookupAssetsBuckets;
+  for (const bucketName of matchingBuckets) {
+    return Option.some(bucketName);
+  }
+  return Option.none<string>();
+});
+
+const ensureAssetsBucketTags = Effect.fn(function* (
+  bucketName: string,
+  region: string,
+) {
+  const existingTags = yield* getBucketTags(bucketName);
+  const tagSet = [
+    ...existingTags.filter(
+      (tag) =>
+        tag.Key !== ASSETS_BUCKET_TAG && tag.Key !== ASSETS_BUCKET_REGION_TAG,
+    ),
+    ...createAssetsBucketTags(region),
+  ];
+
+  yield* s3.putBucketTagging({
+    Bucket: bucketName,
+    Tagging: {
+      TagSet: tagSet.map((tag) => ({
+        Key: tag.Key!,
+        Value: tag.Value!,
+      })),
+    },
+  });
+});
+
+const deleteAllObjects = Effect.fn(function* (bucketName: string) {
+  let continuationToken: string | undefined;
+  do {
+    const listResponse = yield* s3.listObjectsV2({
+      Bucket: bucketName,
+      ContinuationToken: continuationToken,
+    });
+
+    if (listResponse.Contents && listResponse.Contents.length > 0) {
+      yield* s3.deleteObjects({
+        Bucket: bucketName,
+        Delete: {
+          Objects: listResponse.Contents.map((obj) => ({
+            Key: obj.Key!,
+          })),
+          Quiet: true,
+        },
+      });
+    }
+
+    continuationToken = listResponse.NextContinuationToken;
+  } while (continuationToken);
+
+  let keyMarker: string | undefined;
+  let versionIdMarker: string | undefined;
+  do {
+    const listVersionsResponse = yield* s3.listObjectVersions({
+      Bucket: bucketName,
+      KeyMarker: keyMarker,
+      VersionIdMarker: versionIdMarker,
+    });
+
+    const objectsToDelete = [
+      ...(listVersionsResponse.Versions ?? []).map((v) => ({
+        Key: v.Key!,
+        VersionId: v.VersionId,
+      })),
+      ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
+        Key: dm.Key!,
+        VersionId: dm.VersionId,
+      })),
+    ];
+
+    if (objectsToDelete.length > 0) {
+      yield* s3.deleteObjects({
+        Bucket: bucketName,
+        Delete: {
+          Objects: objectsToDelete,
+          Quiet: true,
+        },
+      });
+    }
+
+    keyMarker = listVersionsResponse.NextKeyMarker;
+    versionIdMarker = listVersionsResponse.NextVersionIdMarker;
+  } while (keyMarker);
+});
+
+/**
+ * Bootstrap the AWS environment by creating the assets bucket.
+ *
+ * This is idempotent - running it multiple times is safe.
+ * The bucket is tagged and later discovered by tag lookup instead of by name.
+ */
+export const bootstrap = Effect.fn(function* () {
+  const region = yield* Region;
+  const existingBucket = yield* lookupAssetsBucket;
+
+  if (Option.isSome(existingBucket)) {
+    yield* ensureAssetsBucketTags(existingBucket.value, region);
+    yield* Effect.logInfo(
+      `Assets bucket already exists: ${existingBucket.value}`,
+    );
+    return { bucketName: existingBucket.value, created: false };
+  }
+
+  const { accountId } = yield* AWSEnvironment;
+  const bucketName = createAssetsBucketName(accountId, region);
+  yield* s3
+    .createBucket({
+      Bucket: bucketName,
+      BucketNamespace: "account-regional",
+      CreateBucketConfiguration: {
+        Tags: createAssetsBucketTags(region),
+        ...(region === "us-east-1"
+          ? {}
+          : { LocationConstraint: region as BucketLocationConstraint }),
+      },
+    })
+    .pipe(
+      Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void),
+      Effect.retry({
+        while: (e) =>
+          e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+        schedule: Schedule.exponential(100),
+      }),
+    );
+
+  yield* s3.headBucket({ Bucket: bucketName }).pipe(
+    Effect.retry({
+      schedule: Schedule.exponential(100).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
+
+  yield* Effect.logInfo(`Created assets bucket: ${bucketName}`);
+
+  return { bucketName, created: true };
+});
+
+export const destroyBootstrap = Effect.fn(function* () {
+  const bucketNames = yield* lookupAssetsBuckets;
+
+  for (const bucketName of bucketNames) {
+    yield* Effect.logInfo(`Destroying assets bucket: ${bucketName}`);
+    yield* deleteAllObjects(bucketName);
+    yield* s3.deleteBucket({ Bucket: bucketName }).pipe(
+      Effect.retry({
+        while: (e) =>
+          e._tag === "OperationAborted" || e._tag === "ServiceUnavailable",
+        schedule: Schedule.exponential(100).pipe(
+          Schedule.both(Schedule.recurs(10)),
+        ),
+      }),
+    );
+  }
+
+  return {
+    bucketNames,
+    destroyed: bucketNames.length,
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/CachePolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/CachePolicy.ts
new file mode 100644
index 00000000000..015ae499fe0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/CachePolicy.ts
@@ -0,0 +1,296 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface CachePolicyProps {
+  /**
+   * Name of the cache policy. If omitted, a deterministic name is generated.
+   *
+   * Names must be unique per AWS account. Changing the name triggers
+   * a replacement.
+   */
+  name?: string;
+  /**
+   * Optional comment describing the policy.
+   */
+  comment?: string;
+  /**
+   * Minimum amount of time, in seconds, that objects stay in the cache.
+   */
+  minTTL: number;
+  /**
+   * Default amount of time, in seconds, that objects stay in the cache when
+   * the origin does not send `Cache-Control` or `Expires` headers.
+   */
+  defaultTTL?: number;
+  /**
+   * Maximum amount of time, in seconds, that objects stay in the cache.
+   */
+  maxTTL?: number;
+  /**
+   * Controls which request values become part of the cache key and which
+   * additional headers/cookies/query strings CloudFront forwards to the origin.
+   */
+  parametersInCacheKeyAndForwardedToOrigin?: cloudfront.ParametersInCacheKeyAndForwardedToOrigin;
+}
+
+export interface CachePolicy extends Resource<
+  "AWS.CloudFront.CachePolicy",
+  CachePolicyProps,
+  {
+    /**
+     * CloudFront-assigned cache policy identifier.
+     */
+    cachePolicyId: string;
+    /**
+     * Name of the cache policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current minimum TTL.
+     */
+    minTTL: number;
+    /**
+     * Current default TTL.
+     */
+    defaultTTL: number | undefined;
+    /**
+     * Current maximum TTL.
+     */
+    maxTTL: number | undefined;
+    /**
+     * Current cache-key/forwarded-value configuration.
+     */
+    parametersInCacheKeyAndForwardedToOrigin:
+      | cloudfront.ParametersInCacheKeyAndForwardedToOrigin
+      | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront cache policy.
+ *
+ * Cache policies determine the values CloudFront includes in the cache key,
+ * the headers, cookies and query strings it forwards to the origin, and the
+ * TTL bounds for cached responses. Policies are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * For AWS-managed policies (CachingOptimized, CachingDisabled,
+ * AllViewerExceptHostHeader) reference them by ID via the constants in
+ * {@link ManagedPolicies} instead of creating a custom policy.
+ *
+ * @section Creating Cache Policies
+ * @example Cache by query string and Authorization header
+ * ```typescript
+ * const cachePolicy = yield* CachePolicy("ApiCachePolicy", {
+ *   comment: "Cache GETs by query string + Authorization",
+ *   minTTL: 0,
+ *   defaultTTL: 60,
+ *   maxTTL: 3600,
+ *   parametersInCacheKeyAndForwardedToOrigin: {
+ *     EnableAcceptEncodingGzip: true,
+ *     EnableAcceptEncodingBrotli: true,
+ *     HeadersConfig: {
+ *       HeaderBehavior: "whitelist",
+ *       Headers: { Quantity: 1, Items: ["Authorization"] },
+ *     },
+ *     CookiesConfig: { CookieBehavior: "none" },
+ *     QueryStringsConfig: { QueryStringBehavior: "all" },
+ *   },
+ * });
+ * ```
+ */
+export const CachePolicy = Resource<CachePolicy>("AWS.CloudFront.CachePolicy");
+
+export const CachePolicyProvider = () =>
+  Provider.effect(
+    CachePolicy,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getCachePolicyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchCachePolicy", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (!config?.CachePolicyConfig) return undefined;
+        return { config: config.CachePolicyConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listCachePolicies({ Type: "custom" });
+        const summary = listed.CachePolicyList?.Items?.find(
+          (item) => item.CachePolicy?.CachePolicyConfig?.Name === name,
+        );
+        if (!summary?.CachePolicy?.Id) return undefined;
+        return yield* getById(summary.CachePolicy.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.CachePolicy.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        props: CachePolicyProps,
+      ): cloudfront.CachePolicyConfig => ({
+        Name: name,
+        Comment: props.comment,
+        MinTTL: props.minTTL,
+        DefaultTTL: props.defaultTTL,
+        MaxTTL: props.maxTTL,
+        ParametersInCacheKeyAndForwardedToOrigin:
+          props.parametersInCacheKeyAndForwardedToOrigin,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.CachePolicyConfig,
+        etag: string | undefined,
+      ) => ({
+        cachePolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        minTTL: config.MinTTL,
+        defaultTTL: config.DefaultTTL,
+        maxTTL: config.MaxTTL,
+        parametersInCacheKeyAndForwardedToOrigin:
+          config.ParametersInCacheKeyAndForwardedToOrigin,
+      });
+
+      return {
+        stables: ["cachePolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.cachePolicyId) {
+            const found = yield* getById(output.cachePolicyId);
+            if (found)
+              return toAttrs(output.cachePolicyId, found.config, found.etag);
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* createName(id, news);
+
+          // Observe — locate the policy by id (cached on `output`) or by
+          // name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.cachePolicyId
+            ? yield* getById(output.cachePolicyId).pipe(
+                Effect.map((found) =>
+                  found ? { id: output.cachePolicyId, ...found } : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the policy if it's missing. Tolerate
+          // `CachePolicyAlreadyExists` as a race with a peer reconciler:
+          // re-read by name and continue with the sync path.
+          if (!observed) {
+            const created = yield* cloudfront
+              .createCachePolicy({
+                CachePolicyConfig: buildConfig(name, news),
+              })
+              .pipe(
+                Effect.catchTag("CachePolicyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            CachePolicy: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              CachePolicyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Cache policy '${name}' already exists but could not be recovered`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            if (!created.CachePolicy?.Id) {
+              return yield* Effect.fail(
+                new Error("createCachePolicy returned no identifier"),
+              );
+            }
+            yield* session.note(created.CachePolicy.Id);
+            return toAttrs(
+              created.CachePolicy.Id,
+              created.CachePolicy.CachePolicyConfig,
+              created.ETag,
+            );
+          }
+
+          // Sync — diff observed config against desired and patch via
+          // `updateCachePolicy` with the freshly observed ETag.
+          const desired = buildConfig(observed.config.Name, news);
+          const updated = yield* cloudfront.updateCachePolicy({
+            Id: observed.id,
+            IfMatch: observed.etag,
+            CachePolicyConfig: desired,
+          });
+          if (!updated.CachePolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("updateCachePolicy returned no identifier"),
+            );
+          }
+          yield* session.note(observed.id);
+          return toAttrs(
+            updated.CachePolicy.Id,
+            updated.CachePolicy.CachePolicyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.cachePolicyId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteCachePolicy({
+              Id: output.cachePolicyId,
+              IfMatch: current.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchCachePolicy", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: CachePolicyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Distribution.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Distribution.ts
new file mode 100644
index 00000000000..91513552d69
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Distribution.ts
@@ -0,0 +1,963 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+
+const CLOUDFRONT_HOSTED_ZONE_ID = "Z2FDTNDATAQYW2" as const;
+
+class DistributionFunctionAssociationPending extends Data.TaggedError(
+  "DistributionFunctionAssociationPending",
+)<{
+  message: string;
+}> {}
+
+class DistributionPendingDeployment extends Data.TaggedError(
+  "DistributionPendingDeployment",
+)<{
+  message: string;
+}> {}
+
+export interface DistributionOrigin {
+  /**
+   * Unique origin identifier inside the distribution.
+   */
+  id: string;
+  /**
+   * Origin domain name.
+   */
+  domainName: Input<string>;
+  /**
+   * Optional origin path prefix.
+   */
+  originPath?: Input<string>;
+  /**
+   * CloudFront Origin Access Control identifier.
+   */
+  originAccessControlId?: Input<string>;
+  /**
+   * Whether the origin should be modeled as an S3 origin.
+   * @default false
+   */
+  s3Origin?: boolean;
+  /**
+   * Optional custom origin settings.
+   */
+  customOriginConfig?: {
+    httpPort?: number;
+    httpsPort?: number;
+    originProtocolPolicy?: cloudfront.OriginProtocolPolicy;
+    originReadTimeout?: number;
+    originKeepaliveTimeout?: number;
+    originSslProtocols?: cloudfront.SslProtocol[];
+  };
+}
+
+export interface DistributionBehavior {
+  targetOriginId: string;
+  viewerProtocolPolicy?: cloudfront.ViewerProtocolPolicy;
+  allowedMethods?: cloudfront.Method[];
+  cachedMethods?: cloudfront.Method[];
+  compress?: boolean;
+  cachePolicyId?: string;
+  originRequestPolicyId?: string;
+  responseHeadersPolicyId?: string;
+  forwardedValues?: cloudfront.ForwardedValues;
+  minTtl?: number;
+  defaultTtl?: number;
+  maxTtl?: number;
+  functionAssociations?: {
+    functionArn: string;
+    eventType: cloudfront.EventType;
+  }[];
+  lambdaFunctionAssociations?: {
+    lambdaFunctionArn: string;
+    eventType: cloudfront.EventType;
+    includeBody?: boolean;
+  }[];
+}
+
+export interface DistributionViewerCertificate {
+  cloudFrontDefaultCertificate?: boolean;
+  acmCertificateArn?: string;
+  sslSupportMethod?: cloudfront.SSLSupportMethod;
+  minimumProtocolVersion?: cloudfront.MinimumProtocolVersion;
+}
+
+const isFunctionAssociationPending = (error: cloudfront.InvalidArgument) => {
+  const message = error.Message ?? "";
+  return (
+    message.includes("FunctionAssociationArn") &&
+    message.includes("not found or is not published")
+  );
+};
+
+export interface DistributionProps {
+  /**
+   * Alternate domain names routed to this distribution.
+   */
+  aliases?: string[];
+  /**
+   * Default root object served for `/`.
+   */
+  defaultRootObject?: string;
+  /**
+   * CloudFront origin definitions.
+   */
+  origins: Input<DistributionOrigin[]>;
+  /**
+   * Default cache behavior.
+   */
+  defaultCacheBehavior: Input<DistributionBehavior>;
+  /**
+   * Ordered cache behaviors.
+   */
+  orderedCacheBehaviors?: Input<
+    Array<
+      DistributionBehavior & {
+        pathPattern: string;
+      }
+    >
+  >;
+  /**
+   * Custom error response rules.
+   */
+  customErrorResponses?: Input<cloudfront.CustomErrorResponse[]>;
+  /**
+   * Human-readable distribution comment.
+   * @default ""
+   */
+  comment?: string;
+  /**
+   * Whether the distribution should serve traffic.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Viewer certificate configuration.
+   */
+  viewerCertificate?: Input<DistributionViewerCertificate>;
+  /**
+   * CloudFront price class.
+   */
+  priceClass?: cloudfront.PriceClass;
+  /**
+   * Optional AWS WAF web ACL association.
+   */
+  webAclId?: string;
+  /**
+   * Preferred HTTP version support.
+   */
+  httpVersion?: cloudfront.HttpVersion;
+  /**
+   * Whether IPv6 should be enabled.
+   * @default true
+   */
+  isIpv6Enabled?: boolean;
+  /**
+   * User-defined tags to apply to the distribution.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Distribution extends Resource<
+  "AWS.CloudFront.Distribution",
+  DistributionProps,
+  {
+    /**
+     * CloudFront distribution identifier.
+     */
+    distributionId: string;
+    /**
+     * ARN of the distribution.
+     */
+    distributionArn: string;
+    /**
+     * CloudFront-assigned domain name.
+     */
+    domainName: string;
+    /**
+     * Route 53 hosted zone ID for CloudFront aliases.
+     */
+    hostedZoneId: string;
+    /**
+     * Current deployment status.
+     */
+    status: string;
+    /**
+     * Configured alternate domain names.
+     */
+    aliases: string[];
+    /**
+     * Current comment.
+     */
+    comment: string;
+    /**
+     * Whether the distribution is enabled.
+     */
+    enabled: boolean;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Number of invalidation batches still in progress.
+     */
+    inProgressInvalidationBatches: number;
+    /**
+     * Last CloudFront modification timestamp.
+     */
+    lastModifiedTime: Date | undefined;
+    /**
+     * Current tags on the distribution.
+     */
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront distribution.
+ *
+ * `Distribution` manages the CDN layer for static sites and HTTP origins such
+ * as Lambda Function URLs and ALBs. It exposes the distribution domain and
+ * hosted zone ID needed for Route 53 alias records.
+ *
+ * @section Creating Distributions
+ * @example Private S3 Origin
+ * ```typescript
+ * const distribution = yield* Distribution("WebsiteCdn", {
+ *   aliases: ["www.example.com"],
+ *   origins: [
+ *     {
+ *       id: "site",
+ *       domainName: bucket.bucketRegionalDomainName,
+ *       s3Origin: true,
+ *       originAccessControlId: oac.originAccessControlId,
+ *     },
+ *   ],
+ *   defaultCacheBehavior: {
+ *     targetOriginId: "site",
+ *     viewerProtocolPolicy: "redirect-to-https",
+ *     compress: true,
+ *   },
+ *   viewerCertificate: {
+ *     acmCertificateArn: certificate.certificateArn,
+ *     sslSupportMethod: "sni-only",
+ *     minimumProtocolVersion: "TLSv1.2_2021",
+ *   },
+ * });
+ * ```
+ */
+export const Distribution = Resource<Distribution>(
+  "AWS.CloudFront.Distribution",
+);
+
+export const DistributionProvider = () =>
+  Provider.effect(
+    Distribution,
+    Effect.gen(function* () {
+      const waitForDeployment = Effect.fn(function* (distributionId: string) {
+        yield* Effect.logInfo(
+          `CloudFront Distribution wait: polling deployment for ${distributionId}`,
+        );
+        return yield* cloudfront.getDistribution({ Id: distributionId }).pipe(
+          Effect.map((response) => response.Distribution),
+          Effect.flatMap((distribution) =>
+            distribution?.Status === "Deployed"
+              ? Effect.gen(function* () {
+                  yield* Effect.logInfo(
+                    `CloudFront Distribution wait: ${distributionId} deployed`,
+                  );
+                  return distribution;
+                })
+              : Effect.gen(function* () {
+                  yield* Effect.logInfo(
+                    `CloudFront Distribution wait: ${distributionId} status=${distribution?.Status ?? "unknown"}`,
+                  );
+                  return yield* Effect.fail(
+                    new DistributionPendingDeployment({
+                      message: `Distribution ${distributionId} is not yet deployed`,
+                    }),
+                  );
+                }),
+          ),
+          Effect.retry({
+            while: (error) => error._tag === "DistributionPendingDeployment",
+            schedule: Schedule.fixed("10 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      const getCurrent = Effect.fn(function* (distributionId: string) {
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: loading distribution ${distributionId}`,
+        );
+        const distribution = yield* cloudfront
+          .getDistribution({ Id: distributionId })
+          .pipe(
+            Effect.map((response) => response.Distribution),
+            Effect.catchTag("NoSuchDistribution", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!distribution?.Id) {
+          yield* Effect.logInfo(
+            `CloudFront Distribution read: distribution ${distributionId} not found`,
+          );
+          return undefined;
+        }
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: loading config and tags for ${distributionId}`,
+        );
+        const config = yield* cloudfront.getDistributionConfig({
+          Id: distributionId,
+        });
+        const tags = yield* cloudfront
+          .listTagsForResource({
+            Resource: distribution.ARN,
+          })
+          .pipe(Effect.map((response) => toTagsRecord(response.Tags.Items)));
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: loaded ${distributionId} status=${distribution.Status} enabled=${config.DistributionConfig?.Enabled ?? "unknown"} etag=${config.ETag ?? "missing"} tags=${Object.keys(tags).length}`,
+        );
+        return {
+          distribution,
+          config: config.DistributionConfig!,
+          etag: config.ETag,
+          tags,
+        };
+      });
+
+      const getByCallerReference = Effect.fn(function* (
+        callerReference: string,
+      ) {
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: searching for callerReference=${callerReference}`,
+        );
+        let marker: string | undefined;
+
+        do {
+          const listed = yield* cloudfront.listDistributions({
+            Marker: marker,
+          });
+
+          for (const item of listed.DistributionList?.Items ?? []) {
+            if (!item.Id) continue;
+
+            const config = yield* cloudfront
+              .getDistributionConfig({
+                Id: item.Id,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchDistribution", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+
+            if (
+              config?.DistributionConfig?.CallerReference === callerReference
+            ) {
+              yield* Effect.logInfo(
+                `CloudFront Distribution read: recovered ${item.Id} for callerReference=${callerReference}`,
+              );
+              return yield* getCurrent(item.Id);
+            }
+          }
+
+          marker = listed.DistributionList?.IsTruncated
+            ? listed.DistributionList.NextMarker
+            : undefined;
+        } while (marker);
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: no distribution found for callerReference=${callerReference}`,
+        );
+        return undefined;
+      });
+
+      const waitForDeletionReady = Effect.fn(function* (
+        distributionId: string,
+      ) {
+        class DistributionPendingDeletionReadiness extends Data.TaggedError(
+          "DistributionPendingDeletionReadiness",
+        )<{
+          message: string;
+        }> {}
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution delete: waiting for ${distributionId} to become disabled and deployed`,
+        );
+        return yield* Effect.logInfo(
+          `CloudFront Distribution delete: waiting for ${distributionId} to become disabled and deployed`,
+        ).pipe(
+          Effect.andThen(() => getCurrent(distributionId)),
+          Effect.flatMap(
+            Effect.fnUntraced(function* (current) {
+              if (!current) {
+                yield* Effect.logInfo(
+                  `CloudFront Distribution delete: ${distributionId} already absent while waiting`,
+                );
+                return undefined;
+              }
+
+              if (
+                current.config.Enabled ||
+                current.distribution.Status !== "Deployed"
+              ) {
+                yield* Effect.logInfo(
+                  `CloudFront Distribution delete: ${distributionId} not ready enabled=${current.config.Enabled} status=${current.distribution.Status}`,
+                );
+                return yield* Effect.fail(
+                  new DistributionPendingDeletionReadiness({
+                    message: `Distribution ${distributionId} is not yet ready for deletion`,
+                  }),
+                );
+              }
+
+              yield* Effect.logInfo(
+                `CloudFront Distribution delete: ${distributionId} ready for delete with etag=${current.etag ?? "missing"}`,
+              );
+              return current;
+            }),
+          ),
+          Effect.retry({
+            while: (error) =>
+              error._tag === "DistributionPendingDeletionReadiness",
+            schedule: Schedule.fixed("10 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      return {
+        stables: [
+          "distributionId",
+          "distributionArn",
+          "domainName",
+          "hostedZoneId",
+        ],
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.distributionId) {
+            return undefined;
+          }
+
+          const current = yield* getCurrent(output.distributionId);
+          if (!current) {
+            return undefined;
+          }
+
+          return toAttrs(current.distribution, current.etag, current.tags);
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          instanceId,
+          news,
+          output,
+          session,
+        }) {
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const callerReference = instanceId;
+
+          // Observe — locate an existing distribution by id (cached on
+          // `output`) or by caller reference, which lets us recover from a
+          // create that succeeded in the cloud but failed to persist its
+          // attributes locally.
+          let observed = output?.distributionId
+            ? yield* getCurrent(output.distributionId)
+            : undefined;
+          if (!observed) {
+            observed = yield* getByCallerReference(callerReference);
+          }
+
+          // Ensure — create the distribution if it's missing. Tolerate
+          // `DistributionAlreadyExists` (race with a peer reconciler) by
+          // re-reading via caller reference. Tags are applied at create
+          // time when permissions allow; otherwise we fall back to
+          // create-then-tag and the sync path below converges them.
+          if (!observed) {
+            const config = toConfig(callerReference, news);
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: callerReference=${callerReference} aliases=${news.aliases?.length ?? 0} origins=${(news.origins as DistributionOrigin[]).length} tags=${Object.keys(desiredTags).length}`,
+            );
+            const created = yield* cloudfront
+              .createDistributionWithTags({
+                DistributionConfigWithTags: {
+                  DistributionConfig: config,
+                  Tags: {
+                    Items: createTagsList(desiredTags),
+                  },
+                },
+              })
+              .pipe(
+                Effect.catch((error) =>
+                  isAccessDenied(error)
+                    ? Effect.gen(function* () {
+                        yield* Effect.logInfo(
+                          `CloudFront Distribution reconcile: createDistributionWithTags denied, retrying without tags for callerReference=${callerReference}`,
+                        );
+                        const created = yield* cloudfront.createDistribution({
+                          DistributionConfig: config,
+                        });
+
+                        if (
+                          created.Distribution?.ARN &&
+                          Object.keys(desiredTags).length > 0
+                        ) {
+                          yield* Effect.logInfo(
+                            `CloudFront Distribution reconcile: tagging distribution ${created.Distribution.Id} after fallback`,
+                          );
+                          yield* cloudfront.tagResource({
+                            Resource: created.Distribution.ARN,
+                            Tags: {
+                              Items: createTagsList(desiredTags),
+                            },
+                          });
+                        }
+
+                        return created;
+                      })
+                    : Effect.gen(function* () {
+                        yield* Effect.logInfo(
+                          `CloudFront Distribution reconcile: createDistributionWithTags failed for callerReference=${callerReference} error=${String(error)}`,
+                        );
+                        return yield* Effect.fail(error);
+                      }),
+                ),
+              )
+              .pipe(
+                Effect.map((created) => ({
+                  distributionId: created.Distribution?.Id,
+                  etag: created.ETag,
+                  tags: desiredTags,
+                })),
+                Effect.catchTag("DistributionAlreadyExists", () =>
+                  Effect.gen(function* () {
+                    yield* Effect.logInfo(
+                      `CloudFront Distribution reconcile: callerReference=${callerReference} already exists, attempting recovery`,
+                    );
+                    const recovered =
+                      yield* getByCallerReference(callerReference);
+                    if (!recovered?.distribution.Id) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `CloudFront distribution with caller reference '${callerReference}' already exists but could not be recovered`,
+                        ),
+                      );
+                    }
+                    return {
+                      distributionId: recovered.distribution.Id,
+                      etag: recovered.etag,
+                      tags: recovered.tags,
+                    };
+                  }),
+                ),
+                Effect.catchTag(
+                  "InvalidArgument",
+                  (
+                    error,
+                  ): Effect.Effect<
+                    never,
+                    | cloudfront.InvalidArgument
+                    | DistributionFunctionAssociationPending
+                  > =>
+                    isFunctionAssociationPending(error)
+                      ? Effect.logInfo(
+                          "CloudFront Distribution reconcile: function association not yet ready, retrying",
+                        ).pipe(
+                          Effect.andThen(
+                            Effect.fail(
+                              new DistributionFunctionAssociationPending({
+                                message:
+                                  error.Message ??
+                                  "CloudFront function association pending",
+                              }),
+                            ),
+                          ),
+                        )
+                      : Effect.fail(error),
+                ),
+                Effect.retry({
+                  while: (error) =>
+                    error instanceof DistributionFunctionAssociationPending,
+                  schedule: Schedule.fixed("5 seconds").pipe(
+                    Schedule.both(Schedule.recurs(24)),
+                  ),
+                }),
+              );
+
+            if (!created.distributionId) {
+              return yield* Effect.fail(
+                new Error("createDistribution returned no distribution"),
+              );
+            }
+
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: created ${created.distributionId} etag=${created.etag ?? "missing"}, waiting for deployment`,
+            );
+            const deployed = yield* waitForDeployment(created.distributionId);
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: deployed ${created.distributionId} domain=${deployed.DomainName}`,
+            );
+            yield* session.note(created.distributionId);
+            return toAttrs(deployed, created.etag, created.tags);
+          }
+
+          // Sync config — diff observed config against desired and patch
+          // via `updateDistribution` with the freshly observed ETag. We
+          // keep the observed `CallerReference` because CloudFront does
+          // not allow it to change.
+          yield* Effect.logInfo(
+            `CloudFront Distribution reconcile: updating config for ${observed.distribution.Id} with etag=${observed.etag ?? "missing"}`,
+          );
+          const updated = yield* cloudfront
+            .updateDistribution({
+              Id: observed.distribution.Id,
+              IfMatch: observed.etag,
+              DistributionConfig: toConfig(
+                observed.config.CallerReference,
+                news,
+              ),
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidArgument",
+                (
+                  error,
+                ): Effect.Effect<
+                  never,
+                  | cloudfront.InvalidArgument
+                  | DistributionFunctionAssociationPending
+                > =>
+                  isFunctionAssociationPending(error)
+                    ? Effect.logInfo(
+                        "CloudFront Distribution reconcile: function association not yet ready, retrying",
+                      ).pipe(
+                        Effect.andThen(
+                          Effect.fail(
+                            new DistributionFunctionAssociationPending({
+                              message:
+                                error.Message ??
+                                "CloudFront function association pending",
+                            }),
+                          ),
+                        ),
+                      )
+                    : Effect.fail(error),
+              ),
+              Effect.retry({
+                while: (error) =>
+                  error instanceof DistributionFunctionAssociationPending,
+                schedule: Schedule.fixed("5 seconds").pipe(
+                  Schedule.both(Schedule.recurs(24)),
+                ),
+              }),
+            );
+
+          if (!updated.Distribution?.Id) {
+            return yield* Effect.fail(
+              new Error("updateDistribution returned no distribution"),
+            );
+          }
+
+          // Sync tags — diff observed cloud tags against desired and apply
+          // only the delta. `observed.tags` is fetched fresh, so we don't
+          // rely on stale `olds.tags`.
+          const { removed, upsert } = diffTags(observed.tags, desiredTags);
+          yield* Effect.logInfo(
+            `CloudFront Distribution reconcile: distribution=${observed.distribution.Id} upsertTags=${upsert.length} removedTags=${removed.length}`,
+          );
+
+          if (upsert.length > 0) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: tagging ${observed.distribution.Id} with ${upsert.length} tag(s)`,
+            );
+            yield* cloudfront.tagResource({
+              Resource: observed.distribution.ARN,
+              Tags: {
+                Items: upsert,
+              },
+            });
+          }
+
+          if (removed.length > 0) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution reconcile: removing ${removed.length} tag(s) from ${observed.distribution.Id}`,
+            );
+            yield* cloudfront.untagResource({
+              Resource: observed.distribution.ARN,
+              TagKeys: {
+                Items: removed,
+              },
+            });
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution reconcile: updated ${observed.distribution.Id} etag=${updated.ETag ?? "missing"}, waiting for deployment`,
+          );
+          const deployed = yield* waitForDeployment(updated.Distribution.Id);
+          yield* Effect.logInfo(
+            `CloudFront Distribution reconcile: deployed ${observed.distribution.Id} domain=${deployed.DomainName}`,
+          );
+          yield* session.note(observed.distribution.Id);
+          return toAttrs(deployed, updated.ETag, desiredTags);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* Effect.logInfo(
+            `CloudFront Distribution delete: distribution=${output.distributionId}`,
+          );
+          const current = yield* getCurrent(output.distributionId);
+          if (!current) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution delete: ${output.distributionId} already absent`,
+            );
+            return;
+          }
+
+          if (current.config.Enabled) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution delete: disabling ${output.distributionId} before delete`,
+            );
+            yield* cloudfront.updateDistribution({
+              Id: output.distributionId,
+              IfMatch: current.etag,
+              DistributionConfig: {
+                ...current.config,
+                Enabled: false,
+              },
+            });
+          }
+
+          const latest = yield* waitForDeletionReady(output.distributionId);
+          if (!latest) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution delete: ${output.distributionId} disappeared before delete`,
+            );
+            return;
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution delete: deleting ${output.distributionId} with etag=${latest.etag ?? "missing"}`,
+          );
+          yield* cloudfront
+            .deleteDistribution({
+              Id: output.distributionId,
+              IfMatch: latest.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchDistribution", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const toTagsRecord = (tags: cloudfront.Tag[] | undefined) =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const isAccessDenied = (error: unknown) => {
+  const tag = (error as { _tag?: string; name?: string })?._tag;
+  const name = (error as { _tag?: string; name?: string })?.name;
+  const text = String(error);
+  return (
+    tag === "AccessDenied" ||
+    tag === "AccessDeniedException" ||
+    name === "AccessDenied" ||
+    name === "AccessDeniedException" ||
+    text.includes("AccessDenied")
+  );
+};
+
+const toBehavior = (
+  behavior: DistributionBehavior & {
+    pathPattern?: string;
+  },
+): cloudfront.CacheBehavior | cloudfront.DefaultCacheBehavior => ({
+  ...(behavior.pathPattern ? { PathPattern: behavior.pathPattern } : undefined),
+  TargetOriginId: behavior.targetOriginId,
+  ViewerProtocolPolicy: behavior.viewerProtocolPolicy ?? "redirect-to-https",
+  AllowedMethods: behavior.allowedMethods
+    ? {
+        Quantity: behavior.allowedMethods.length,
+        Items: behavior.allowedMethods,
+        CachedMethods: behavior.cachedMethods
+          ? {
+              Quantity: behavior.cachedMethods.length,
+              Items: behavior.cachedMethods,
+            }
+          : undefined,
+      }
+    : undefined,
+  Compress: behavior.compress ?? true,
+  CachePolicyId: behavior.cachePolicyId,
+  OriginRequestPolicyId: behavior.originRequestPolicyId,
+  ResponseHeadersPolicyId: behavior.responseHeadersPolicyId,
+  ForwardedValues: behavior.forwardedValues,
+  MinTTL: behavior.minTtl,
+  DefaultTTL: behavior.defaultTtl,
+  MaxTTL: behavior.maxTtl,
+  FunctionAssociations: behavior.functionAssociations
+    ? {
+        Quantity: behavior.functionAssociations.length,
+        Items: behavior.functionAssociations.map((association) => ({
+          FunctionARN: association.functionArn,
+          EventType: association.eventType,
+        })),
+      }
+    : undefined,
+  LambdaFunctionAssociations: behavior.lambdaFunctionAssociations
+    ? {
+        Quantity: behavior.lambdaFunctionAssociations.length,
+        Items: behavior.lambdaFunctionAssociations.map((association) => ({
+          LambdaFunctionARN: association.lambdaFunctionArn,
+          EventType: association.eventType,
+          IncludeBody: association.includeBody,
+        })),
+      }
+    : undefined,
+});
+
+const toOrigin = (origin: DistributionOrigin): cloudfront.Origin => ({
+  Id: origin.id,
+  DomainName: origin.domainName as string,
+  OriginPath: origin.originPath as string | undefined,
+  OriginAccessControlId: origin.originAccessControlId as string | undefined,
+  S3OriginConfig: origin.s3Origin ? { OriginAccessIdentity: "" } : undefined,
+  CustomOriginConfig: origin.s3Origin
+    ? undefined
+    : {
+        HTTPPort: origin.customOriginConfig?.httpPort ?? 80,
+        HTTPSPort: origin.customOriginConfig?.httpsPort ?? 443,
+        OriginProtocolPolicy:
+          origin.customOriginConfig?.originProtocolPolicy ?? "https-only",
+        OriginSslProtocols: {
+          Quantity: (
+            origin.customOriginConfig?.originSslProtocols ?? ["TLSv1.2"]
+          ).length,
+          Items: origin.customOriginConfig?.originSslProtocols ?? ["TLSv1.2"],
+        },
+        OriginReadTimeout: origin.customOriginConfig?.originReadTimeout,
+        OriginKeepaliveTimeout:
+          origin.customOriginConfig?.originKeepaliveTimeout,
+      },
+});
+
+const toConfig = (
+  callerReference: string,
+  props: DistributionProps,
+): cloudfront.DistributionConfig => ({
+  CallerReference: callerReference,
+  Aliases: props.aliases
+    ? {
+        Quantity: props.aliases.length,
+        Items: props.aliases,
+      }
+    : undefined,
+  DefaultRootObject: props.defaultRootObject,
+  Origins: {
+    Quantity: (props.origins as DistributionOrigin[]).length,
+    Items: (props.origins as DistributionOrigin[]).map(toOrigin),
+  },
+  DefaultCacheBehavior: toBehavior(
+    props.defaultCacheBehavior as DistributionBehavior,
+  ) as cloudfront.DefaultCacheBehavior,
+  CacheBehaviors: props.orderedCacheBehaviors
+    ? {
+        Quantity: (
+          props.orderedCacheBehaviors as Array<
+            DistributionBehavior & { pathPattern: string }
+          >
+        ).length,
+        Items: (
+          props.orderedCacheBehaviors as Array<
+            DistributionBehavior & { pathPattern: string }
+          >
+        ).map((behavior) =>
+          toBehavior(
+            behavior as DistributionBehavior & { pathPattern: string },
+          ),
+        ) as cloudfront.CacheBehavior[],
+      }
+    : undefined,
+  CustomErrorResponses: props.customErrorResponses
+    ? {
+        Quantity: (
+          props.customErrorResponses as cloudfront.CustomErrorResponse[]
+        ).length,
+        Items: props.customErrorResponses as cloudfront.CustomErrorResponse[],
+      }
+    : undefined,
+  Comment: props.comment ?? "",
+  Enabled: props.enabled ?? true,
+  ViewerCertificate: props.viewerCertificate
+    ? {
+        CloudFrontDefaultCertificate: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).cloudFrontDefaultCertificate,
+        ACMCertificateArn: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).acmCertificateArn,
+        SSLSupportMethod: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).sslSupportMethod,
+        MinimumProtocolVersion: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).minimumProtocolVersion,
+      }
+    : props.aliases && props.aliases.length > 0
+      ? undefined
+      : {
+          CloudFrontDefaultCertificate: true,
+        },
+  Restrictions: {
+    GeoRestriction: {
+      RestrictionType: "none",
+      Quantity: 0,
+    },
+  },
+  PriceClass: props.priceClass,
+  WebACLId: props.webAclId,
+  HttpVersion: props.httpVersion ?? "http2",
+  IsIPV6Enabled: props.isIpv6Enabled ?? true,
+});
+
+const toAttrs = (
+  distribution: cloudfront.Distribution,
+  etag: string | undefined,
+  tags: Record<string, string>,
+): Distribution["Attributes"] => ({
+  distributionId: distribution.Id,
+  distributionArn: distribution.ARN,
+  domainName: distribution.DomainName,
+  hostedZoneId: CLOUDFRONT_HOSTED_ZONE_ID,
+  status: distribution.Status,
+  aliases: distribution.DistributionConfig.Aliases?.Items ?? [],
+  comment:
+    typeof distribution.DistributionConfig.Comment === "string"
+      ? distribution.DistributionConfig.Comment
+      : "",
+  enabled: distribution.DistributionConfig.Enabled,
+  etag,
+  inProgressInvalidationBatches: distribution.InProgressInvalidationBatches,
+  lastModifiedTime: distribution.LastModifiedTime,
+  tags,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Function.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Function.ts
new file mode 100644
index 00000000000..2ea0bf50499
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Function.ts
@@ -0,0 +1,371 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface FunctionProps {
+  /**
+   * CloudFront Function name. If omitted, a deterministic name is generated.
+   */
+  name?: string;
+  /**
+   * CloudFront Function runtime.
+   * @default "cloudfront-js-2.0"
+   */
+  runtime?: cloudfront.FunctionRuntime;
+  /**
+   * Optional function comment.
+   */
+  comment?: string;
+  /**
+   * JavaScript source code for the function.
+   */
+  code: string;
+  /**
+   * Optional associated KeyValueStore ARNs.
+   */
+  keyValueStoreArns?: string[];
+}
+
+export interface Function extends Resource<
+  "AWS.CloudFront.Function",
+  FunctionProps,
+  {
+    /**
+     * CloudFront function ARN.
+     */
+    functionArn: string;
+    /**
+     * Function name.
+     */
+    functionName: string;
+    /**
+     * Runtime currently configured for the function.
+     */
+    runtime: cloudfront.FunctionRuntime;
+    /**
+     * Current comment.
+     */
+    comment: string;
+    /**
+     * Deployment stage for the function.
+     */
+    stage: cloudfront.FunctionStage;
+    /**
+     * Current status.
+     */
+    status: string;
+    /**
+     * Last modified time.
+     */
+    lastModifiedTime: Date | undefined;
+    /**
+     * Latest entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Associated KeyValueStore ARNs.
+     */
+    keyValueStoreArns: string[];
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront Function for viewer request and response customization.
+ *
+ * CloudFront Functions are lightweight JavaScript handlers that run at the
+ * edge and can be attached to distribution cache behaviors.
+ *
+ * @section Creating Functions
+ * @example Viewer Request Function
+ * ```typescript
+ * const fn = yield* Function("RouterRequestFunction", {
+ *   code: `
+ * async function handler(event) {
+ *   event.request.headers["x-forwarded-host"] = {
+ *     value: event.request.headers.host.value,
+ *   };
+ *   return event.request;
+ * }
+ * `,
+ * });
+ * ```
+ */
+export const Function = Resource<Function>("AWS.CloudFront.Function");
+
+export const FunctionProvider = () =>
+  Provider.effect(
+    Function,
+    Effect.gen(function* () {
+      const describe = Effect.fn(function* (
+        name: string,
+        stage?: cloudfront.FunctionStage,
+      ) {
+        return yield* cloudfront
+          .describeFunction({
+            Name: name,
+            Stage: stage,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchFunctionExists", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      });
+
+      const getCurrent = Effect.fn(function* (name: string) {
+        const live = yield* describe(name, "LIVE");
+        if (live?.FunctionSummary) {
+          return live;
+        }
+        return yield* describe(name, "DEVELOPMENT");
+      });
+
+      const getDevelopmentEtag = Effect.fn(function* (name: string) {
+        const current = yield* describe(name, "DEVELOPMENT");
+        return current?.ETag;
+      });
+
+      const publish = Effect.fn(function* (
+        name: string,
+        etag: string | undefined,
+      ) {
+        if (!etag) {
+          return yield* Effect.fail(
+            new Error(
+              `CloudFront Function '${name}' is missing an ETag for publish`,
+            ),
+          );
+        }
+        yield* cloudfront.publishFunction({
+          Name: name,
+          IfMatch: etag,
+        });
+        return yield* describe(name, "LIVE");
+      });
+
+      return {
+        stables: ["functionArn", "functionName"],
+        diff: Effect.fn(function* ({ id, olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.functionName ?? (yield* createName(id, olds ?? {}));
+          const current = yield* getCurrent(name);
+          if (!current?.FunctionSummary) {
+            return undefined;
+          }
+          return toAttrs(current.FunctionSummary, current.ETag, name);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = output?.functionName ?? (yield* createName(id, news));
+
+          // Observe — describe the function (LIVE stage preferred,
+          // DEVELOPMENT fallback). We don't trust `output` because the
+          // function may have been deleted out-of-band.
+          const observedDevelopment = yield* describe(name, "DEVELOPMENT");
+
+          // Ensure — create the function if it's missing. Tolerate
+          // `FunctionAlreadyExists` as a race with a peer reconciler. The
+          // newly created function lives in DEVELOPMENT; we publish it to
+          // LIVE below, in the same flow that handles already-existing
+          // functions.
+          const developmentEtag = observedDevelopment
+            ? observedDevelopment.ETag
+            : yield* Effect.gen(function* () {
+                const created = yield* cloudfront
+                  .createFunction({
+                    Name: name,
+                    FunctionConfig: {
+                      Comment: news.comment ?? "",
+                      Runtime: news.runtime ?? "cloudfront-js-2.0",
+                      KeyValueStoreAssociations: toKvAssociations(
+                        news.keyValueStoreArns,
+                      ),
+                    },
+                    FunctionCode: new TextEncoder().encode(news.code),
+                  })
+                  .pipe(
+                    Effect.catchTag("FunctionAlreadyExists", () =>
+                      describe(name, "DEVELOPMENT").pipe(
+                        Effect.flatMap((existing) =>
+                          existing
+                            ? Effect.succeed(existing)
+                            : Effect.die(
+                                `CloudFront Function '${name}' already exists but could not be recovered`,
+                              ),
+                        ),
+                      ),
+                    ),
+                    Effect.retry({
+                      while: (error) =>
+                        error._tag === "InvalidArgument" &&
+                        isKeyValueStoreAssociationPending(
+                          error as { Message?: string },
+                        ),
+                      schedule: cappedCloudFrontRetrySchedule,
+                    }),
+                  );
+                return created.ETag;
+              });
+
+          // Sync — push desired config/code to DEVELOPMENT when the
+          // function already existed. Skip when we just created it (the
+          // creation already used the desired config).
+          let etagToPublish = developmentEtag;
+          if (observedDevelopment) {
+            const updated = yield* cloudfront
+              .updateFunction({
+                Name: name,
+                IfMatch: observedDevelopment.ETag!,
+                FunctionConfig: {
+                  Comment: news.comment ?? "",
+                  Runtime:
+                    news.runtime ??
+                    observedDevelopment.FunctionSummary?.FunctionConfig
+                      .Runtime ??
+                    "cloudfront-js-2.0",
+                  KeyValueStoreAssociations: toKvAssociations(
+                    news.keyValueStoreArns,
+                  ),
+                },
+                FunctionCode: new TextEncoder().encode(news.code),
+              })
+              .pipe(
+                Effect.retry({
+                  while: (error) =>
+                    error._tag === "InvalidArgument" &&
+                    isKeyValueStoreAssociationPending(
+                      error as { Message?: string },
+                    ),
+                  schedule: cappedCloudFrontRetrySchedule,
+                }),
+              );
+            etagToPublish = updated.ETag;
+          }
+
+          // Publish DEVELOPMENT → LIVE so consumers see the desired code.
+          const live = yield* publish(name, etagToPublish);
+          if (!live?.FunctionSummary) {
+            return yield* Effect.die(
+              "publishFunction returned no function summary",
+            );
+          }
+
+          yield* session.note(name);
+          return toAttrs(live.FunctionSummary, live.ETag, name);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* Effect.gen(function* () {
+            const developmentEtag = yield* getDevelopmentEtag(
+              output.functionName,
+            );
+            if (!developmentEtag) {
+              yield* Effect.logInfo(
+                `CloudFront Function delete: ${output.functionName} already absent`,
+              );
+              return;
+            }
+
+            yield* Effect.logInfo(
+              `CloudFront Function delete: deleting ${output.functionName} stage=DEVELOPMENT etag=${developmentEtag}`,
+            );
+            yield* cloudfront.deleteFunction({
+              Name: output.functionName,
+              IfMatch: developmentEtag,
+            });
+          }).pipe(
+            Effect.catchTag("NoSuchFunctionExists", () => Effect.void),
+            Effect.tapError((error) =>
+              isFunctionDeletePending(error)
+                ? Effect.logInfo(
+                    `CloudFront Function delete: ${output.functionName} not ready yet (${error._tag}), retrying with capped exponential backoff`,
+                  )
+                : Effect.logError(
+                    `CloudFront Function delete: ${output.functionName} failed with ${String(error)}`,
+                  ),
+            ),
+            Effect.retry({
+              while: isFunctionDeletePending,
+              schedule: cappedCloudFrontRetrySchedule,
+            }),
+          );
+        }),
+      };
+    }),
+  );
+
+const isFunctionDeletePending = (error: {
+  _tag?: string;
+}): error is cloudfront.FunctionInUse | cloudfront.PreconditionFailed =>
+  error._tag === "FunctionInUse" || error._tag === "PreconditionFailed";
+
+const isKeyValueStoreAssociationPending = (error: { Message?: string }) => {
+  const message = error.Message ?? "";
+  return (
+    message.includes("KeyValueStoreAssociationArn") &&
+    message.includes("cannot be associated before the resource is provisioned")
+  );
+};
+
+const cappedCloudFrontRetrySchedule = Schedule.exponential("100 millis").pipe(
+  Schedule.both(Schedule.recurs(24)),
+  Schedule.map(([duration]) =>
+    Duration.isGreaterThan(duration, Duration.seconds(2))
+      ? Duration.seconds(2)
+      : duration,
+  ),
+);
+
+const createName = (id: string, props: FunctionProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 64,
+        lowercase: true,
+      });
+
+const toKvAssociations = (
+  arns: string[] | undefined,
+): cloudfront.KeyValueStoreAssociations | undefined =>
+  arns && arns.length > 0
+    ? {
+        Quantity: arns.length,
+        Items: arns.map((KeyValueStoreARN) => ({ KeyValueStoreARN })),
+      }
+    : undefined;
+
+const toAttrs = (
+  summary: cloudfront.FunctionSummary,
+  etag: string | undefined,
+  fallbackName: string,
+): Function["Attributes"] => ({
+  functionArn: summary.FunctionMetadata.FunctionARN,
+  functionName: summary.Name || fallbackName,
+  runtime: summary.FunctionConfig.Runtime,
+  comment: summary.FunctionConfig.Comment,
+  stage: summary.FunctionMetadata.Stage ?? "DEVELOPMENT",
+  status: summary.Status ?? "UNKNOWN",
+  lastModifiedTime: summary.FunctionMetadata.LastModifiedTime,
+  etag,
+  keyValueStoreArns:
+    summary.FunctionConfig.KeyValueStoreAssociations?.Items?.flatMap((item) =>
+      item.KeyValueStoreARN ? [item.KeyValueStoreARN] : [],
+    ) ?? [],
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Invalidation.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Invalidation.ts
new file mode 100644
index 00000000000..c3fe5716f72
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/Invalidation.ts
@@ -0,0 +1,205 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface InvalidationProps {
+  /**
+   * Distribution to invalidate.
+   */
+  distributionId: string;
+  /**
+   * Version string used as the invalidation caller reference. Change this value
+   * to trigger a new invalidation.
+   */
+  version: string;
+  /**
+   * Paths to invalidate.
+   * @default ["/*"]
+   */
+  paths?: string[];
+  /**
+   * Wait for the invalidation to complete.
+   * @default false
+   */
+  wait?: boolean;
+}
+
+export interface Invalidation extends Resource<
+  "AWS.CloudFront.Invalidation",
+  InvalidationProps,
+  {
+    invalidationId: string;
+    distributionId: string;
+    version: string;
+    status: string;
+    paths: string[];
+    createTime: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront cache invalidation request.
+ *
+ * `Invalidation` is a helper resource for website deployments that need to
+ * clear selected CloudFront cache paths after asset updates.
+ *
+ * @section Creating Invalidations
+ * @example Invalidate The Entire Distribution
+ * ```typescript
+ * const invalidation = yield* Invalidation("WebsiteInvalidation", {
+ *   distributionId: distribution.distributionId,
+ *   version: files.version,
+ * });
+ * ```
+ */
+export const Invalidation = Resource<Invalidation>(
+  "AWS.CloudFront.Invalidation",
+);
+
+const defaultPaths = ["/*"];
+
+class InvalidationInProgress extends Data.TaggedError(
+  "InvalidationInProgress",
+)<{
+  message: string;
+}> {}
+
+export const InvalidationProvider = () =>
+  Provider.effect(
+    Invalidation,
+    Effect.gen(function* () {
+      const waitForCompletion = Effect.fn(function* (
+        distributionId: string,
+        invalidationId: string,
+      ) {
+        yield* Effect.logInfo(
+          `CloudFront Invalidation wait: polling ${invalidationId} for distribution ${distributionId}`,
+        );
+        return yield* cloudfront
+          .getInvalidation({
+            DistributionId: distributionId,
+            Id: invalidationId,
+          })
+          .pipe(
+            Effect.map((response) => response.Invalidation),
+            Effect.flatMap((invalidation) =>
+              invalidation?.Status === "Completed"
+                ? Effect.gen(function* () {
+                    yield* Effect.logInfo(
+                      `CloudFront Invalidation wait: ${invalidationId} completed`,
+                    );
+                    return invalidation;
+                  })
+                : Effect.gen(function* () {
+                    yield* Effect.logInfo(
+                      `CloudFront Invalidation wait: ${invalidationId} status=${invalidation?.Status ?? "unknown"}`,
+                    );
+                    return yield* Effect.fail(
+                      new InvalidationInProgress({
+                        message: `Invalidation ${invalidationId} is still in progress`,
+                      }),
+                    );
+                  }),
+            ),
+            Effect.retry({
+              while: (error) => error._tag === "InvalidationInProgress",
+              schedule: Schedule.fixed("2 seconds").pipe(
+                Schedule.both(Schedule.recurs(120)),
+              ),
+            }),
+          );
+      });
+
+      const createInvalidation = Effect.fn(function* (
+        props: InvalidationProps,
+      ) {
+        yield* Effect.logInfo(
+          `CloudFront Invalidation create: distribution=${props.distributionId} version=${props.version} paths=${(props.paths ?? defaultPaths).length} wait=${props.wait ?? false}`,
+        );
+        const response = yield* cloudfront.createInvalidation({
+          DistributionId: props.distributionId,
+          InvalidationBatch: {
+            CallerReference: props.version,
+            Paths: {
+              Quantity: (props.paths ?? defaultPaths).length,
+              Items: props.paths ?? defaultPaths,
+            },
+          },
+        });
+
+        yield* Effect.logInfo(
+          `CloudFront Invalidation create: created ${response.Invalidation?.Id ?? "missing"} status=${response.Invalidation?.Status ?? "unknown"}`,
+        );
+        const invalidation = props.wait
+          ? yield* waitForCompletion(
+              props.distributionId,
+              response.Invalidation?.Id!,
+            )
+          : response.Invalidation;
+
+        if (!invalidation?.Id) {
+          return yield* Effect.fail(
+            new Error("createInvalidation returned no invalidation"),
+          );
+        }
+
+        return invalidation;
+      });
+
+      return {
+        stables: ["distributionId", "version"],
+        diff: Effect.fn(function* ({ olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          yield* Effect.logInfo(
+            `CloudFront Invalidation diff: oldDistribution=${olds.distributionId} newDistribution=${news.distributionId} oldVersion=${olds.version} newVersion=${news.version}`,
+          );
+          if (
+            olds.distributionId !== news.distributionId ||
+            olds.version !== news.version
+          ) {
+            yield* Effect.logInfo(
+              `CloudFront Invalidation diff: replacing invalidation for distribution=${news.distributionId}`,
+            );
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // An invalidation is an immutable ledger entry, not a mutable
+          // resource. If we already issued one for this logical id and
+          // version, return its attributes unchanged. The `diff` above
+          // forces a `replace` whenever `distributionId` or `version`
+          // changes, so the engine creates a fresh invalidation that way.
+          if (output?.invalidationId) {
+            yield* session.note(output.invalidationId);
+            return output;
+          }
+
+          // Ensure — issue the invalidation. CloudFront uses
+          // `CallerReference` (= `version`) for idempotency: the same
+          // version submitted twice returns the same invalidation.
+          const invalidation = yield* createInvalidation(news);
+          yield* Effect.logInfo(
+            `CloudFront Invalidation reconcile: storing ${invalidation.Id} for distribution=${news.distributionId}`,
+          );
+          yield* session.note(invalidation.Id);
+          return {
+            invalidationId: invalidation.Id,
+            distributionId: news.distributionId,
+            version: news.version,
+            status: invalidation.Status ?? "InProgress",
+            paths: news.paths ?? defaultPaths,
+            createTime: invalidation.CreateTime,
+          };
+        }),
+        delete: Effect.fn(function* () {}),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KeyGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KeyGroup.ts
new file mode 100644
index 00000000000..133524d1fdc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KeyGroup.ts
@@ -0,0 +1,255 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface KeyGroupProps {
+  /**
+   * Name of the key group. If omitted, a deterministic name is generated.
+   *
+   * Names must be unique per AWS account. Changing the name triggers
+   * a replacement.
+   */
+  name?: string;
+  /**
+   * Public key IDs that belong to the group. Order is preserved.
+   */
+  items: Input<string>[];
+  /**
+   * Optional comment describing the group.
+   */
+  comment?: string;
+}
+
+export interface KeyGroup extends Resource<
+  "AWS.CloudFront.KeyGroup",
+  KeyGroupProps,
+  {
+    /**
+     * CloudFront-assigned key group identifier. Used by Distributions in
+     * `TrustedKeyGroups` to authorize signed URLs/cookies.
+     */
+    keyGroupId: string;
+    /**
+     * Name of the key group.
+     */
+    name: string;
+    /**
+     * Public key IDs that belong to the group.
+     */
+    items: string[];
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the group.
+     */
+    comment: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront key group.
+ *
+ * Key groups bundle one or more {@link PublicKey} resources for use as
+ * `TrustedKeyGroups` on a Distribution's cache behavior. CloudFront uses
+ * the keys in the group to verify the signatures on signed URLs and
+ * signed cookies for that behavior.
+ *
+ * @section Creating Key Groups
+ * @example Group two public keys for signed URL verification
+ * ```typescript
+ * const primary = yield* PublicKey("PrimarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./primary.pem"),
+ * });
+ * const secondary = yield* PublicKey("SecondarySigningKey", {
+ *   encodedKey: yield* fs.readFileString("./secondary.pem"),
+ * });
+ *
+ * const keyGroup = yield* KeyGroup("SignedUrlKeys", {
+ *   comment: "Trusted signers for /private",
+ *   items: [primary.publicKeyId, secondary.publicKeyId],
+ * });
+ * ```
+ */
+export const KeyGroup = Resource<KeyGroup>("AWS.CloudFront.KeyGroup");
+
+export const KeyGroupProvider = () =>
+  Provider.effect(
+    KeyGroup,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getKeyGroupConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchResource", () => Effect.succeed(undefined)),
+          );
+        if (!config?.KeyGroupConfig) return undefined;
+        return { config: config.KeyGroupConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listKeyGroups({});
+        const summary = listed.KeyGroupList?.Items?.find(
+          (item) => item.KeyGroup?.KeyGroupConfig?.Name === name,
+        );
+        if (!summary?.KeyGroup?.Id) return undefined;
+        return yield* getById(summary.KeyGroup.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.KeyGroup.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        items: string[],
+        comment: string | undefined,
+      ): cloudfront.KeyGroupConfig => ({
+        Name: name,
+        Items: items,
+        Comment: comment,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.KeyGroupConfig,
+        etag: string | undefined,
+      ) => ({
+        keyGroupId: id,
+        name: config.Name,
+        items: config.Items,
+        etag,
+        comment: config.Comment,
+      });
+
+      return {
+        stables: ["keyGroupId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.keyGroupId) {
+            const found = yield* getById(output.keyGroupId);
+            if (found)
+              return toAttrs(output.keyGroupId, found.config, found.etag);
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* createName(id, news);
+          const items = news.items as string[];
+
+          // Observe — locate the key group by id (cached on `output`) or
+          // by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.keyGroupId
+            ? yield* getById(output.keyGroupId).pipe(
+                Effect.map((found) =>
+                  found ? { id: output.keyGroupId, ...found } : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the key group if it's missing. Tolerate
+          // `KeyGroupAlreadyExists` (race with a peer reconciler).
+          if (!observed) {
+            const created = yield* cloudfront
+              .createKeyGroup({
+                KeyGroupConfig: buildConfig(name, items, news.comment),
+              })
+              .pipe(
+                Effect.catchTag("KeyGroupAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            KeyGroup: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              KeyGroupConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Key group '${name}' already exists but could not be recovered`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            if (!created.KeyGroup?.Id) {
+              return yield* Effect.fail(
+                new Error("createKeyGroup returned no identifier"),
+              );
+            }
+            yield* session.note(created.KeyGroup.Id);
+            return toAttrs(
+              created.KeyGroup.Id,
+              created.KeyGroup.KeyGroupConfig,
+              created.ETag,
+            );
+          }
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
+          const updated = yield* cloudfront.updateKeyGroup({
+            Id: observed.id,
+            IfMatch: observed.etag,
+            KeyGroupConfig: buildConfig(
+              observed.config.Name,
+              items,
+              news.comment,
+            ),
+          });
+          if (!updated.KeyGroup?.Id) {
+            return yield* Effect.fail(
+              new Error("updateKeyGroup returned no identifier"),
+            );
+          }
+          yield* session.note(observed.id);
+          return toAttrs(
+            updated.KeyGroup.Id,
+            updated.KeyGroup.KeyGroupConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.keyGroupId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteKeyGroup({
+              Id: output.keyGroupId,
+              IfMatch: current.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchResource", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: { name?: string }) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KeyValueStore.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KeyValueStore.ts
new file mode 100644
index 00000000000..32f25d472df
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KeyValueStore.ts
@@ -0,0 +1,234 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface KeyValueStoreProps {
+  /**
+   * KeyValueStore name. If omitted, a deterministic name is generated.
+   */
+  name?: string;
+  /**
+   * Optional store comment.
+   */
+  comment?: string;
+}
+
+export interface KeyValueStore extends Resource<
+  "AWS.CloudFront.KeyValueStore",
+  KeyValueStoreProps,
+  {
+    /**
+     * KeyValueStore ID.
+     */
+    keyValueStoreId: string;
+    /**
+     * Store ARN.
+     */
+    keyValueStoreArn: string;
+    /**
+     * Store name.
+     */
+    keyValueStoreName: string;
+    /**
+     * Current comment.
+     */
+    comment: string;
+    /**
+     * Current status.
+     */
+    status: string;
+    /**
+     * Last modified time.
+     */
+    lastModifiedTime: Date | undefined;
+    /**
+     * Latest entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront KeyValueStore for edge metadata.
+ *
+ * KeyValueStores can be associated with CloudFront Functions and are useful for
+ * routing metadata or other small edge-time lookup tables.
+ *
+ * @section Creating KeyValueStores
+ * @example Basic Store
+ * ```typescript
+ * const store = yield* KeyValueStore("RouterStore", {
+ *   comment: "Route metadata",
+ * });
+ * ```
+ */
+export const KeyValueStore = Resource<KeyValueStore>(
+  "AWS.CloudFront.KeyValueStore",
+);
+
+export const KeyValueStoreProvider = () =>
+  Provider.effect(
+    KeyValueStore,
+    Effect.gen(function* () {
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listKeyValueStores({});
+        const store =
+          listed.KeyValueStoreList?.Items?.find((item) => item.Name === name) ??
+          undefined;
+        if (!store?.Name) {
+          return undefined;
+        }
+        return yield* cloudfront
+          .describeKeyValueStore({
+            Name: store.Name,
+          })
+          .pipe(
+            Effect.catchTag("EntityNotFound", () => Effect.succeed(undefined)),
+          );
+      });
+
+      return {
+        stables: ["keyValueStoreId", "keyValueStoreArn", "keyValueStoreName"],
+        diff: Effect.fn(function* ({ id, olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.keyValueStoreName ?? (yield* createName(id, olds ?? {}));
+          const current = yield* cloudfront
+            .describeKeyValueStore({
+              Name: name,
+            })
+            .pipe(Effect.catchTag("EntityNotFound", () => getByName(name)));
+          if (!current?.KeyValueStore) {
+            return undefined;
+          }
+          return toAttrs(current.KeyValueStore, current.ETag, name);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name =
+            output?.keyValueStoreName ?? (yield* createName(id, news));
+
+          // Observe — describe the store, falling back to a list lookup
+          // by name. Trust live state, not stale `olds`.
+          const observed = yield* cloudfront
+            .describeKeyValueStore({ Name: name })
+            .pipe(Effect.catchTag("EntityNotFound", () => getByName(name)));
+
+          // Ensure — create the store if it's missing. Tolerate
+          // `EntityAlreadyExists` (race with a peer reconciler).
+          if (!observed?.KeyValueStore) {
+            const created = yield* cloudfront
+              .createKeyValueStore({
+                Name: name,
+                Comment: news.comment,
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed(existing)
+                        : Effect.die(
+                            `CloudFront KeyValueStore '${name}' already exists but could not be recovered`,
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            if (!created.KeyValueStore) {
+              return yield* Effect.die(
+                "createKeyValueStore returned no key value store",
+              );
+            }
+            yield* session.note(created.KeyValueStore.Id);
+            return toAttrs(created.KeyValueStore, created.ETag, name);
+          }
+
+          // Sync — patch the observed comment via `updateKeyValueStore`
+          // using the freshly observed ETag.
+          const updated = yield* cloudfront.updateKeyValueStore({
+            Name: observed.KeyValueStore.Name,
+            Comment: news.comment ?? "",
+            IfMatch: observed.ETag!,
+          });
+          if (!updated.KeyValueStore) {
+            return yield* Effect.die(
+              "updateKeyValueStore returned no key value store",
+            );
+          }
+          yield* session.note(updated.KeyValueStore.Id);
+          return toAttrs(
+            updated.KeyValueStore,
+            updated.ETag,
+            observed.KeyValueStore.Name,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* cloudfront
+            .describeKeyValueStore({
+              Name: output.keyValueStoreName,
+            })
+            .pipe(
+              Effect.catchTag("EntityNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          const etag = current?.ETag;
+          if (!etag) {
+            yield* Effect.logInfo(
+              `CloudFront KeyValueStore delete: ${output.keyValueStoreName} already absent`,
+            );
+            return;
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront KeyValueStore delete: deleting ${output.keyValueStoreName} with etag=${etag}`,
+          );
+          yield* cloudfront
+            .deleteKeyValueStore({
+              Name: output.keyValueStoreName,
+              IfMatch: etag,
+            })
+            .pipe(Effect.catchTag("EntityNotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: KeyValueStoreProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 64,
+        lowercase: true,
+      });
+
+const toAttrs = (
+  store: cloudfront.KeyValueStore,
+  etag: string | undefined,
+  fallbackName: string,
+): KeyValueStore["Attributes"] => ({
+  keyValueStoreId: store.Id,
+  keyValueStoreArn: store.ARN,
+  keyValueStoreName: store.Name || fallbackName,
+  comment: store.Comment ?? "",
+  status: store.Status ?? "UNKNOWN",
+  lastModifiedTime: store.LastModifiedTime,
+  etag,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KvEntries.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KvEntries.ts
new file mode 100644
index 00000000000..847e1d13d38
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KvEntries.ts
@@ -0,0 +1,254 @@
+import * as kvs from "@distilled.cloud/aws/cloudfront-keyvaluestore";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  extractValue,
+  getKvsEtag,
+  isKvsPreconditionFailed,
+  retryForKvsReadiness,
+  withKvsRegionFn,
+} from "./common.ts";
+
+export interface KvEntriesProps {
+  /** ARN of the CloudFront KeyValueStore. */
+  store: string;
+  /** Namespace prefix for all keys. Keys are stored as `{namespace}:{key}`. */
+  namespace: string;
+  /** Map of key → value entries to manage. */
+  entries: Record<string, Input<string>>;
+  /** Whether to delete keys under this namespace that are not in `entries`. @default false */
+  purge?: boolean;
+}
+
+export interface KvEntries extends Resource<
+  "AWS.CloudFront.KvEntries",
+  KvEntriesProps,
+  {
+    /** ARN of the CloudFront KeyValueStore. */
+    store: string;
+    /** Namespace prefix used for keys. */
+    namespace: string;
+    /** Current entries managed under the namespace. */
+    entries: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Manages namespaced key-value entries in a CloudFront KeyValueStore.
+ *
+ * Entries are stored with a `{namespace}:{key}` prefix to allow multiple
+ * logical groups within a single store. Updates use batched optimistic
+ * concurrency with automatic ETag retry.
+ *
+ * @section Managing Entries
+ * @example Basic Entries
+ * ```typescript
+ * const entries = yield* KvEntries("Routes", {
+ *   store: store.keyValueStoreArn,
+ *   namespace: "routes",
+ *   entries: {
+ *     "/": "/index.html",
+ *     "/about": "/about.html",
+ *   },
+ * });
+ * ```
+ *
+ * @example Purge Stale Keys
+ * ```typescript
+ * const entries = yield* KvEntries("Routes", {
+ *   store: store.keyValueStoreArn,
+ *   namespace: "routes",
+ *   entries: { "/": "/index.html" },
+ *   purge: true,
+ * });
+ * ```
+ */
+export const KvEntries = Resource<KvEntries>("AWS.CloudFront.KvEntries");
+
+const BATCH_SIZE = 50;
+type ResolvedEntries = {
+  [key: string]: Input.Resolve<KvEntriesProps["entries"][string]>;
+};
+
+const resolveEntries = (entries: KvEntriesProps["entries"]): ResolvedEntries =>
+  Object.fromEntries(
+    Object.entries(entries).map(([key, value]) => [key, value]),
+  ) as ResolvedEntries;
+
+export const KvEntriesProvider = () =>
+  Provider.effect(
+    KvEntries,
+    // @ts-expect-error
+    Effect.gen(function* () {
+      const collectAllKeys = Effect.fn(function* (store: string) {
+        const keys: { Key: string; Value: string }[] = [];
+        let nextToken: string | undefined;
+        do {
+          const resp = yield* kvs.listKeys({
+            KvsARN: store,
+            NextToken: nextToken,
+          });
+          for (const item of resp.Items ?? []) {
+            keys.push({
+              Key: item.Key,
+              Value: extractValue(item.Value),
+            });
+          }
+          nextToken = resp.NextToken;
+        } while (nextToken);
+        return keys;
+      });
+
+      const sendBatch = Effect.fn(function* (
+        store: string,
+        etag: string,
+        puts: kvs.PutKeyRequestListItem[],
+        deletes: kvs.DeleteKeyRequestListItem[],
+      ) {
+        return yield* kvs.updateKeys({
+          KvsARN: store,
+          IfMatch: etag,
+          Puts: puts.length > 0 ? puts : undefined,
+          Deletes: deletes.length > 0 ? deletes : undefined,
+        });
+      });
+
+      const batchUpdateKeys = Effect.fn(function* (
+        store: string,
+        etag: string | undefined,
+        puts: kvs.PutKeyRequestListItem[],
+        deletes: kvs.DeleteKeyRequestListItem[],
+      ) {
+        let remainingPuts = puts;
+        let remainingDeletes = deletes;
+        let currentEtag = etag ?? (yield* getKvsEtag(store));
+
+        while (remainingPuts.length > 0 || remainingDeletes.length > 0) {
+          const batchPuts = remainingPuts.slice(0, BATCH_SIZE);
+          const batchDeletes = remainingDeletes.slice(
+            0,
+            BATCH_SIZE - batchPuts.length,
+          );
+
+          const resp = yield* sendBatch(
+            store,
+            currentEtag,
+            batchPuts,
+            batchDeletes,
+          ).pipe(
+            Effect.retry({
+              while: (error) =>
+                error._tag === "ValidationException" &&
+                isKvsPreconditionFailed(error),
+              schedule: Schedule.exponential("100 millis").pipe(
+                Schedule.both(Schedule.recurs(24)),
+              ),
+            }),
+          );
+
+          currentEtag = resp.ETag;
+          remainingPuts = remainingPuts.slice(batchPuts.length);
+          remainingDeletes = remainingDeletes.slice(batchDeletes.length);
+        }
+      });
+
+      const upload = Effect.fn(function* (
+        store: string,
+        namespace: string,
+        entries: ResolvedEntries,
+        oldEntries: ResolvedEntries | undefined,
+      ) {
+        const puts: kvs.PutKeyRequestListItem[] = [];
+        for (const [key, value] of Object.entries(entries)) {
+          if (oldEntries === undefined || oldEntries[key] !== value) {
+            puts.push({ Key: `${namespace}:${key}`, Value: value as any });
+          }
+        }
+        if (puts.length > 0) {
+          yield* batchUpdateKeys(store, undefined, puts, []);
+        }
+      });
+
+      const purge = Effect.fn(function* (
+        store: string,
+        namespace: string,
+        keepEntries: ResolvedEntries | undefined,
+      ) {
+        const allKeys = yield* collectAllKeys(store);
+        const prefix = `${namespace}:`;
+        const deletes: kvs.DeleteKeyRequestListItem[] = [];
+        for (const item of allKeys) {
+          if (!item.Key.startsWith(prefix)) continue;
+          const unprefixed = item.Key.slice(prefix.length);
+          if (keepEntries && unprefixed in keepEntries) continue;
+          deletes.push({ Key: item.Key });
+        }
+        if (deletes.length > 0) {
+          yield* batchUpdateKeys(store, undefined, [], deletes);
+        }
+      });
+
+      return {
+        read: withKvsRegionFn(
+          Effect.fn(function* ({ output }) {
+            return output;
+          }),
+        ),
+        reconcile: withKvsRegionFn(
+          Effect.fn(function* ({ news, output }) {
+            return yield* retryForKvsReadiness(
+              Effect.gen(function* () {
+                const entries = resolveEntries(news.entries);
+
+                // Observe — diff against the prior persisted entries so
+                // we only `Put` keys whose values actually changed. When
+                // the store identity changes (or there's no prior
+                // output), treat every key as new.
+                const priorEntries =
+                  output && output.store === news.store
+                    ? resolveEntries(output.entries)
+                    : undefined;
+
+                // Sync entries — push the changed keys.
+                yield* upload(
+                  news.store,
+                  news.namespace,
+                  entries,
+                  priorEntries,
+                );
+
+                // Sync stale keys — when `purge` is set, list every key
+                // under the namespace and delete anything not in the
+                // desired set. This converges adopted/drifted state.
+                if (news.purge) {
+                  yield* purge(news.store, news.namespace, entries);
+                }
+
+                return {
+                  store: news.store,
+                  namespace: news.namespace,
+                  entries,
+                };
+              }),
+            );
+          }),
+        ),
+        delete: withKvsRegionFn(
+          Effect.fn(function* ({ output }) {
+            if (!output.store) return;
+            yield* retryForKvsReadiness(
+              purge(output.store, output.namespace, undefined),
+            ).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+          }),
+        ),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KvRoutesUpdate.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KvRoutesUpdate.ts
new file mode 100644
index 00000000000..461281ff6bd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/KvRoutesUpdate.ts
@@ -0,0 +1,296 @@
+import * as kvs from "@distilled.cloud/aws/cloudfront-keyvaluestore";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { Credentials } from "../Credentials.ts";
+import type { Region } from "../Region.ts";
+import {
+  extractValue,
+  getKvsEtag,
+  isKvsPreconditionFailed,
+  retryForKvsReadiness,
+  withKvsRegionFn,
+} from "./common.ts";
+
+export interface KvRoutesUpdateProps {
+  /** ARN of the CloudFront KeyValueStore. */
+  store: string;
+  /** Namespace prefix. The full key is `{namespace}:{key}`. */
+  namespace: string;
+  /** Key within the namespace (typically "routes"). */
+  key: string;
+  /** The route entry string to add/manage (format: "type,namespace,hostPattern,pathPrefix"). */
+  entry: string;
+}
+
+export interface KvRoutesUpdate extends Resource<
+  "AWS.CloudFront.KvRoutesUpdate",
+  KvRoutesUpdateProps,
+  {
+    store: string;
+    namespace: string;
+    key: string;
+    entry: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Manages a single route entry in a JSON array stored in a CloudFront KeyValueStore.
+ *
+ * The routes array is stored at key `{namespace}:{key}` and supports automatic
+ * chunking when the serialized array exceeds 1000 characters.
+ *
+ * @section Managing Routes
+ * @example Add A Route Entry
+ * ```typescript
+ * const update = yield* KvRoutesUpdate("MyRoute", {
+ *   store: store.keyValueStoreArn,
+ *   namespace: "app",
+ *   key: "routes",
+ *   entry: "site,mysite,*,/",
+ * });
+ * ```
+ */
+export const KvRoutesUpdate = Resource<KvRoutesUpdate>(
+  "AWS.CloudFront.KvRoutesUpdate",
+);
+
+const CHUNK_SIZE = 1000;
+
+export const KvRoutesUpdateProvider = () =>
+  Provider.effect(
+    KvRoutesUpdate,
+    Effect.gen(function* () {
+      const getRoutes = Effect.fn(function* (store: string, fullKey: string) {
+        const res = yield* kvs
+          .getKey({ KvsARN: store, Key: fullKey })
+          .pipe(
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!res) {
+          return { routes: [] as string[], chunkNum: 1 };
+        }
+
+        const raw = extractValue(res.Value);
+        const parsed = JSON.parse(raw);
+
+        if (parsed && typeof parsed === "object" && "parts" in parsed) {
+          const parts: number = parsed.parts;
+          const chunks: string[] = [];
+          for (let i = 0; i < parts; i++) {
+            const chunkRes = yield* kvs.getKey({
+              KvsARN: store,
+              Key: `${fullKey}:${i}`,
+            });
+            chunks.push(extractValue(chunkRes.Value));
+          }
+          return {
+            routes: JSON.parse(chunks.join("")) as string[],
+            chunkNum: parts,
+          };
+        }
+
+        return { routes: parsed as string[], chunkNum: 1 };
+      });
+
+      const setRoutes = Effect.fn(function* (
+        store: string,
+        etag: string,
+        fullKey: string,
+        routes: string[],
+        oldChunkNum: number,
+      ) {
+        const serialized = JSON.stringify(routes);
+        const puts: kvs.PutKeyRequestListItem[] = [];
+        const deletes: kvs.DeleteKeyRequestListItem[] = [];
+
+        if (serialized.length > CHUNK_SIZE) {
+          const chunkCount = Math.ceil(serialized.length / CHUNK_SIZE);
+          puts.push({
+            Key: fullKey,
+            Value: JSON.stringify({ parts: chunkCount }),
+          });
+          for (let i = 0; i < chunkCount; i++) {
+            puts.push({
+              Key: `${fullKey}:${i}`,
+              Value: serialized.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE),
+            });
+          }
+          if (oldChunkNum > chunkCount) {
+            for (let i = chunkCount; i < oldChunkNum; i++) {
+              deletes.push({ Key: `${fullKey}:${i}` });
+            }
+          }
+        } else {
+          puts.push({ Key: fullKey, Value: serialized });
+          if (oldChunkNum > 1) {
+            for (let i = 0; i < oldChunkNum; i++) {
+              deletes.push({ Key: `${fullKey}:${i}` });
+            }
+          }
+        }
+
+        yield* kvs.updateKeys({
+          KvsARN: store,
+          IfMatch: etag,
+          Puts: puts.length > 0 ? puts : undefined,
+          Deletes: deletes.length > 0 ? deletes : undefined,
+        });
+      });
+
+      const deleteKey = Effect.fn(function* (
+        store: string,
+        etag: string,
+        fullKey: string,
+        oldChunkNum: number,
+      ) {
+        const deletes: kvs.DeleteKeyRequestListItem[] = [{ Key: fullKey }];
+        if (oldChunkNum > 1) {
+          for (let i = 0; i < oldChunkNum; i++) {
+            deletes.push({ Key: `${fullKey}:${i}` });
+          }
+        }
+        yield* kvs.updateKeys({
+          KvsARN: store,
+          IfMatch: etag,
+          Deletes: deletes,
+        });
+      });
+
+      const deleteOp = (
+        props: KvRoutesUpdateProps,
+      ): Effect.Effect<
+        void,
+        kvs.UpdateKeysError,
+        Credentials | Region | HttpClient
+      > =>
+        Effect.gen(function* () {
+          const fullKey = `${props.namespace}:${props.key}`;
+          const etag = yield* getKvsEtag(props.store);
+          const { routes, chunkNum } = yield* getRoutes(props.store, fullKey);
+          const filtered = routes.filter((r) => r !== props.entry);
+          if (filtered.length === 0) {
+            yield* deleteKey(props.store, etag, fullKey, chunkNum);
+          } else {
+            yield* setRoutes(props.store, etag, fullKey, filtered, chunkNum);
+          }
+        }).pipe(
+          Effect.retry({
+            while: (error) =>
+              error._tag === "ValidationException" &&
+              isKvsPreconditionFailed(error),
+            schedule: Schedule.exponential("100 millis").pipe(
+              Schedule.both(Schedule.recurs(24)),
+            ),
+          }),
+        );
+
+      const upsertEntry = (
+        store: string,
+        fullKey: string,
+        entryToAdd: string,
+        entryToRemove: string | undefined,
+      ): Effect.Effect<
+        void,
+        kvs.UpdateKeysError,
+        HttpClient | Region | Credentials
+      > =>
+        Effect.gen(function* () {
+          const etag = yield* getKvsEtag(store);
+          const { routes, chunkNum } = yield* getRoutes(store, fullKey);
+          const filtered =
+            entryToRemove !== undefined
+              ? routes.filter((r) => r !== entryToRemove)
+              : routes.slice();
+          if (!filtered.includes(entryToAdd)) {
+            filtered.push(entryToAdd);
+          }
+          yield* setRoutes(store, etag, fullKey, filtered, chunkNum);
+        }).pipe(
+          Effect.retry({
+            while: (error) =>
+              error._tag === "ValidationException" &&
+              isKvsPreconditionFailed(error),
+            schedule: Schedule.exponential("100 millis").pipe(
+              Schedule.both(Schedule.recurs(24)),
+            ),
+          }),
+        );
+
+      return {
+        read: withKvsRegionFn(
+          Effect.fn(function* ({ output }) {
+            return output;
+          }),
+        ),
+        reconcile: withKvsRegionFn(
+          Effect.fn(function* ({ news, output }) {
+            return yield* retryForKvsReadiness(
+              Effect.gen(function* () {
+                // Observe — figure out whether the prior entry lived at a
+                // different location. When location changes (or this is
+                // the first reconcile), we strip the old entry from the
+                // old routes array first, then add the new one to the
+                // new array.
+                const movedLocation =
+                  output !== undefined &&
+                  (output.store !== news.store ||
+                    output.namespace !== news.namespace ||
+                    output.key !== news.key);
+
+                if (movedLocation) {
+                  yield* deleteOp(output);
+                }
+
+                // Sync — append the desired entry to the routes array at
+                // the new location. If the entry was previously at the
+                // same location, drop the old value from the in-memory
+                // array before re-appending so a value change is treated
+                // as upsert-by-replace.
+                const fullKey = `${news.namespace}:${news.key}`;
+                const previousEntry =
+                  !movedLocation && output !== undefined
+                    ? output.entry
+                    : undefined;
+                yield* upsertEntry(
+                  news.store,
+                  fullKey,
+                  news.entry,
+                  previousEntry,
+                );
+
+                return {
+                  store: news.store,
+                  namespace: news.namespace,
+                  key: news.key,
+                  entry: news.entry,
+                };
+              }),
+            );
+          }),
+        ),
+        delete: withKvsRegionFn(
+          Effect.fn(function* ({ output }) {
+            yield* retryForKvsReadiness(
+              deleteOp({
+                store: output.store,
+                namespace: output.namespace,
+                key: output.key,
+                entry: output.entry,
+              }),
+            ).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+          }),
+        ),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/ManagedPolicies.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/ManagedPolicies.ts
new file mode 100644
index 00000000000..bec8454a005
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/ManagedPolicies.ts
@@ -0,0 +1,20 @@
+/**
+ * AWS-managed CloudFront cache policy for dynamic origins.
+ * Disables caching so requests always reach the origin.
+ */
+export const MANAGED_CACHING_DISABLED_POLICY_ID =
+  "4135ea2d-6df8-44a3-9df3-4b5a84be39ad" as const;
+
+/**
+ * AWS-managed CloudFront cache policy for immutable/static assets.
+ */
+export const MANAGED_CACHING_OPTIMIZED_POLICY_ID =
+  "658327ea-f89d-4fab-a63d-7e88639e58f6" as const;
+
+/**
+ * AWS-managed CloudFront origin request policy that forwards all viewer values
+ * except the `Host` header. This is the standard policy for proxying dynamic
+ * origins behind CloudFront.
+ */
+export const MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_POLICY_ID =
+  "b689b0a8-53d0-40ab-baf2-68738e2966ac" as const;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/OriginAccessControl.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/OriginAccessControl.ts
new file mode 100644
index 00000000000..fefc77c2136
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/OriginAccessControl.ts
@@ -0,0 +1,293 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface OriginAccessControlProps {
+  /**
+   * Name of the origin access control. If omitted, a deterministic name is generated.
+   */
+  name?: string;
+  /**
+   * Optional description of the origin access control.
+   */
+  description?: string;
+  /**
+   * The origin type this OAC signs for.
+   * @default "s3"
+   */
+  originType?: cloudfront.OriginAccessControlOriginTypes;
+  /**
+   * How CloudFront should apply signing.
+   * @default "always"
+   */
+  signingBehavior?: cloudfront.OriginAccessControlSigningBehaviors;
+  /**
+   * Signing protocol used by CloudFront.
+   * @default "sigv4"
+   */
+  signingProtocol?: cloudfront.OriginAccessControlSigningProtocols;
+}
+
+export interface OriginAccessControl extends Resource<
+  "AWS.CloudFront.OriginAccessControl",
+  OriginAccessControlProps,
+  {
+    /**
+     * CloudFront-assigned OAC identifier.
+     */
+    originAccessControlId: string;
+    /**
+     * Name of the OAC.
+     */
+    name: string;
+    /**
+     * Current description of the OAC.
+     */
+    description: string | undefined;
+    /**
+     * Origin type configured for the OAC.
+     */
+    originType: cloudfront.OriginAccessControlOriginTypes;
+    /**
+     * Signing behavior configured for the OAC.
+     */
+    signingBehavior: cloudfront.OriginAccessControlSigningBehaviors;
+    /**
+     * Signing protocol configured for the OAC.
+     */
+    signingProtocol: cloudfront.OriginAccessControlSigningProtocols;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront Origin Access Control for private origins.
+ *
+ * `OriginAccessControl` is the recommended CloudFront access model for private
+ * S3 origins and newer signed-origin integrations.
+ *
+ * @section Creating Origin Access Controls
+ * @example S3 Origin Access Control
+ * ```typescript
+ * const oac = yield* OriginAccessControl("SiteOriginAccess", {
+ *   originType: "s3",
+ * });
+ * ```
+ */
+export const OriginAccessControl = Resource<OriginAccessControl>(
+  "AWS.CloudFront.OriginAccessControl",
+);
+
+export const OriginAccessControlProvider = () =>
+  Provider.effect(
+    OriginAccessControl,
+    Effect.gen(function* () {
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listOriginAccessControls({});
+        const summary =
+          listed.OriginAccessControlList?.Items?.find(
+            (item) => item.Name === name,
+          ) ?? undefined;
+        if (!summary?.Id) {
+          return undefined;
+        }
+        const config = yield* cloudfront.getOriginAccessControlConfig({
+          Id: summary.Id,
+        });
+        return {
+          OriginAccessControl: {
+            Id: summary.Id,
+            OriginAccessControlConfig: config.OriginAccessControlConfig,
+          },
+          ETag: config.ETag,
+        };
+      });
+
+      const getCurrent = Effect.fn(function* (
+        output: OriginAccessControl["Attributes"] | undefined,
+      ) {
+        if (!output?.originAccessControlId) {
+          return undefined;
+        }
+        const config = yield* cloudfront
+          .getOriginAccessControlConfig({
+            Id: output.originAccessControlId,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchOriginAccessControl", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!config?.OriginAccessControlConfig) {
+          return undefined;
+        }
+
+        return {
+          OriginAccessControl: {
+            Id: output.originAccessControlId,
+            OriginAccessControlConfig: config.OriginAccessControlConfig,
+          },
+          ETag: config.ETag,
+        };
+      });
+
+      return {
+        stables: ["originAccessControlId"],
+        diff: Effect.fn(function* ({ id, olds, news: _news }) {
+          if (!isResolved(_news)) return undefined;
+          const news = _news as typeof olds;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const existing =
+            (yield* getCurrent(output)) ??
+            (yield* getByName(yield* createName(id, olds ?? {})));
+
+          if (!existing?.OriginAccessControl?.Id) {
+            return undefined;
+          }
+
+          return toAttrs(
+            existing.OriginAccessControl,
+            existing.ETag,
+            yield* createName(id, olds ?? {}),
+          );
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* createName(id, news);
+
+          // Observe — locate the OAC by id (cached on `output`) or by
+          // name. Trust observed cloud state, not stale `olds`.
+          const observed =
+            (yield* getCurrent(output)) ?? (yield* getByName(name));
+
+          // Ensure — create the OAC if it's missing. Tolerate
+          // `OriginAccessControlAlreadyExists` (race with a peer
+          // reconciler).
+          if (!observed?.OriginAccessControl?.Id) {
+            const created = yield* cloudfront
+              .createOriginAccessControl({
+                OriginAccessControlConfig: {
+                  Name: name,
+                  Description: news.description,
+                  OriginAccessControlOriginType: news.originType ?? "s3",
+                  SigningBehavior: news.signingBehavior ?? "always",
+                  SigningProtocol: news.signingProtocol ?? "sigv4",
+                },
+              })
+              .pipe(
+                Effect.catchTag("OriginAccessControlAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed(existing)
+                        : Effect.fail(
+                            new Error(
+                              `Origin access control '${name}' already exists but could not be recovered`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+
+            if (!created.OriginAccessControl?.Id) {
+              return yield* Effect.fail(
+                new Error("createOriginAccessControl returned no identifier"),
+              );
+            }
+
+            yield* session.note(created.OriginAccessControl.Id);
+            return toAttrs(created.OriginAccessControl, created.ETag, name);
+          }
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
+          const observedConfig =
+            observed.OriginAccessControl.OriginAccessControlConfig;
+          const updated = yield* cloudfront.updateOriginAccessControl({
+            Id: observed.OriginAccessControl.Id,
+            IfMatch: observed.ETag,
+            OriginAccessControlConfig: {
+              Name: observedConfig?.Name ?? name,
+              Description: news.description,
+              OriginAccessControlOriginType:
+                news.originType ??
+                observedConfig?.OriginAccessControlOriginType ??
+                "s3",
+              SigningBehavior:
+                news.signingBehavior ??
+                observedConfig?.SigningBehavior ??
+                "always",
+              SigningProtocol:
+                news.signingProtocol ??
+                observedConfig?.SigningProtocol ??
+                "sigv4",
+            },
+          });
+
+          if (!updated.OriginAccessControl?.Id) {
+            return yield* Effect.fail(
+              new Error("updateOriginAccessControl returned no identifier"),
+            );
+          }
+
+          yield* session.note(observed.OriginAccessControl.Id);
+          return toAttrs(
+            updated.OriginAccessControl,
+            updated.ETag,
+            observedConfig?.Name ?? name,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* cloudfront
+            .deleteOriginAccessControl({
+              Id: output.originAccessControlId,
+              IfMatch: output.etag,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchOriginAccessControl", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: OriginAccessControlProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({
+        id,
+        maxLength: 64,
+        lowercase: true,
+      });
+
+const toAttrs = (
+  oac: cloudfront.OriginAccessControl,
+  etag: string | undefined,
+  fallbackName: string,
+) => ({
+  originAccessControlId: oac.Id,
+  name: oac.OriginAccessControlConfig?.Name ?? fallbackName,
+  description: oac.OriginAccessControlConfig?.Description,
+  originType:
+    oac.OriginAccessControlConfig?.OriginAccessControlOriginType ?? "s3",
+  signingBehavior: oac.OriginAccessControlConfig?.SigningBehavior ?? "always",
+  signingProtocol: oac.OriginAccessControlConfig?.SigningProtocol ?? "sigv4",
+  etag,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/OriginRequestPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/OriginRequestPolicy.ts
new file mode 100644
index 00000000000..5f6b9f7e59e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/OriginRequestPolicy.ts
@@ -0,0 +1,283 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface OriginRequestPolicyProps {
+  /**
+   * Name of the origin request policy. If omitted, a deterministic name is
+   * generated. Names must be unique per AWS account. Changing the name
+   * triggers a replacement.
+   */
+  name?: string;
+  /**
+   * Optional comment describing the policy.
+   */
+  comment?: string;
+  /**
+   * Headers to forward to the origin (in addition to the cache key).
+   */
+  headersConfig: cloudfront.OriginRequestPolicyHeadersConfig;
+  /**
+   * Cookies to forward to the origin (in addition to the cache key).
+   */
+  cookiesConfig: cloudfront.OriginRequestPolicyCookiesConfig;
+  /**
+   * Query strings to forward to the origin (in addition to the cache key).
+   */
+  queryStringsConfig: cloudfront.OriginRequestPolicyQueryStringsConfig;
+}
+
+export interface OriginRequestPolicy extends Resource<
+  "AWS.CloudFront.OriginRequestPolicy",
+  OriginRequestPolicyProps,
+  {
+    /**
+     * CloudFront-assigned origin request policy identifier.
+     */
+    originRequestPolicyId: string;
+    /**
+     * Name of the origin request policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current headers configuration.
+     */
+    headersConfig: cloudfront.OriginRequestPolicyHeadersConfig;
+    /**
+     * Current cookies configuration.
+     */
+    cookiesConfig: cloudfront.OriginRequestPolicyCookiesConfig;
+    /**
+     * Current query strings configuration.
+     */
+    queryStringsConfig: cloudfront.OriginRequestPolicyQueryStringsConfig;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront origin request policy.
+ *
+ * Origin request policies control which values from the viewer request (in
+ * addition to those used in the cache key) CloudFront includes when sending
+ * a request to the origin. They are referenced by ID on a Distribution's
+ * default behavior or per-path cache behaviors.
+ *
+ * @section Creating Origin Request Policies
+ * @example Forward all viewer headers and cookies
+ * ```typescript
+ * const originRequestPolicy = yield* OriginRequestPolicy("AppOriginRequest", {
+ *   comment: "Forward auth + locale",
+ *   headersConfig: {
+ *     HeaderBehavior: "whitelist",
+ *     Headers: { Quantity: 2, Items: ["Authorization", "Accept-Language"] },
+ *   },
+ *   cookiesConfig: { CookieBehavior: "all" },
+ *   queryStringsConfig: { QueryStringBehavior: "all" },
+ * });
+ * ```
+ */
+export const OriginRequestPolicy = Resource<OriginRequestPolicy>(
+  "AWS.CloudFront.OriginRequestPolicy",
+);
+
+export const OriginRequestPolicyProvider = () =>
+  Provider.effect(
+    OriginRequestPolicy,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getOriginRequestPolicyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchOriginRequestPolicy", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (!config?.OriginRequestPolicyConfig) return undefined;
+        return { config: config.OriginRequestPolicyConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listOriginRequestPolicies({
+          Type: "custom",
+        });
+        const summary = listed.OriginRequestPolicyList?.Items?.find(
+          (item) =>
+            item.OriginRequestPolicy?.OriginRequestPolicyConfig?.Name === name,
+        );
+        if (!summary?.OriginRequestPolicy?.Id) return undefined;
+        return yield* getById(summary.OriginRequestPolicy.Id).pipe(
+          Effect.map((found) =>
+            found
+              ? { id: summary.OriginRequestPolicy.Id, ...found }
+              : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        props: OriginRequestPolicyProps,
+      ): cloudfront.OriginRequestPolicyConfig => ({
+        Name: name,
+        Comment: props.comment,
+        HeadersConfig: props.headersConfig,
+        CookiesConfig: props.cookiesConfig,
+        QueryStringsConfig: props.queryStringsConfig,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.OriginRequestPolicyConfig,
+        etag: string | undefined,
+      ) => ({
+        originRequestPolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        headersConfig: config.HeadersConfig,
+        cookiesConfig: config.CookiesConfig,
+        queryStringsConfig: config.QueryStringsConfig,
+      });
+
+      return {
+        stables: ["originRequestPolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.originRequestPolicyId) {
+            const found = yield* getById(output.originRequestPolicyId);
+            if (found) {
+              return toAttrs(
+                output.originRequestPolicyId,
+                found.config,
+                found.etag,
+              );
+            }
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* createName(id, news);
+
+          // Observe — locate the policy by id (cached on `output`) or
+          // by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.originRequestPolicyId
+            ? yield* getById(output.originRequestPolicyId).pipe(
+                Effect.map((found) =>
+                  found
+                    ? { id: output.originRequestPolicyId, ...found }
+                    : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the policy if it's missing. Tolerate
+          // `OriginRequestPolicyAlreadyExists` (race with a peer
+          // reconciler).
+          if (!observed) {
+            const created = yield* cloudfront
+              .createOriginRequestPolicy({
+                OriginRequestPolicyConfig: buildConfig(name, news),
+              })
+              .pipe(
+                Effect.catchTag("OriginRequestPolicyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            OriginRequestPolicy: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              OriginRequestPolicyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Origin request policy '${name}' already exists but could not be recovered`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            if (!created.OriginRequestPolicy?.Id) {
+              return yield* Effect.fail(
+                new Error("createOriginRequestPolicy returned no identifier"),
+              );
+            }
+            yield* session.note(created.OriginRequestPolicy.Id);
+            return toAttrs(
+              created.OriginRequestPolicy.Id,
+              created.OriginRequestPolicy.OriginRequestPolicyConfig,
+              created.ETag,
+            );
+          }
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
+          const updated = yield* cloudfront.updateOriginRequestPolicy({
+            Id: observed.id,
+            IfMatch: observed.etag,
+            OriginRequestPolicyConfig: buildConfig(observed.config.Name, news),
+          });
+          if (!updated.OriginRequestPolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("updateOriginRequestPolicy returned no identifier"),
+            );
+          }
+          yield* session.note(observed.id);
+          return toAttrs(
+            updated.OriginRequestPolicy.Id,
+            updated.OriginRequestPolicy.OriginRequestPolicyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.originRequestPolicyId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteOriginRequestPolicy({
+              Id: output.originRequestPolicyId,
+              IfMatch: current.etag,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: OriginRequestPolicyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/PublicKey.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/PublicKey.ts
new file mode 100644
index 00000000000..c69a7dc69fa
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/PublicKey.ts
@@ -0,0 +1,267 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { extractValue } from "./common.ts";
+
+export interface PublicKeyProps {
+  /**
+   * Name of the public key. If omitted, a deterministic name is generated.
+   *
+   * Names must be unique per AWS account. Changing the name triggers
+   * a replacement.
+   */
+  name?: string;
+  /**
+   * PEM-encoded public key body. Changing the key material triggers a
+   * replacement (CloudFront does not allow rotating an existing public
+   * key in place).
+   */
+  encodedKey: Redacted.Redacted<string> | string;
+  /**
+   * Optional comment describing the key.
+   */
+  comment?: string;
+}
+
+export interface PublicKey extends Resource<
+  "AWS.CloudFront.PublicKey",
+  PublicKeyProps,
+  {
+    /**
+     * CloudFront-assigned public key identifier. Used by KeyGroups to
+     * reference the key.
+     */
+    publicKeyId: string;
+    /**
+     * Name of the public key.
+     */
+    name: string;
+    /**
+     * PEM-encoded public key body.
+     */
+    encodedKey: string;
+    /**
+     * Caller reference used at create time. Stable across updates.
+     */
+    callerReference: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the key.
+     */
+    comment: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront public key.
+ *
+ * Public keys are uploaded ahead of being grouped into a {@link KeyGroup} and
+ * used by Distributions for signed URL or signed cookie verification.
+ *
+ * The key body is immutable after creation — changing `encodedKey` triggers
+ * a replacement (CloudFront returns no API to rotate a key in place).
+ *
+ * @section Creating Public Keys
+ * @example PEM-encoded RSA public key
+ * ```typescript
+ * const key = yield* PublicKey("SignedUrlKey", {
+ *   encodedKey: Redacted.make(yield* fs.readFileString("./public_key.pem")),
+ *   comment: "RSA-2048 signed URL key for /private",
+ * });
+ * ```
+ */
+export const PublicKey = Resource<PublicKey>("AWS.CloudFront.PublicKey");
+
+export const PublicKeyProvider = () =>
+  Provider.effect(
+    PublicKey,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getPublicKeyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchPublicKey", () => Effect.succeed(undefined)),
+          );
+        if (!config?.PublicKeyConfig) return undefined;
+        return { config: config.PublicKeyConfig, etag: config.ETag };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listPublicKeys({});
+        const summary = listed.PublicKeyList?.Items?.find(
+          (item) => item.Name === name,
+        );
+        if (!summary?.Id) return undefined;
+        return yield* getById(summary.Id).pipe(
+          Effect.map((found) =>
+            found ? { id: summary.Id, ...found } : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        callerReference: string,
+        props: PublicKeyProps,
+      ): cloudfront.PublicKeyConfig => ({
+        Name: name,
+        CallerReference: callerReference,
+        EncodedKey: extractValue(props.encodedKey),
+        Comment: props.comment,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.PublicKeyConfig,
+        etag: string | undefined,
+      ) => ({
+        publicKeyId: id,
+        name: config.Name,
+        encodedKey: config.EncodedKey,
+        callerReference: config.CallerReference,
+        etag,
+        comment: config.Comment,
+      });
+
+      return {
+        stables: ["publicKeyId", "callerReference"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            isResolved(olds.encodedKey) &&
+            extractValue(olds.encodedKey) !== extractValue(news.encodedKey)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.publicKeyId) {
+            const found = yield* getById(output.publicKeyId);
+            if (found)
+              return toAttrs(output.publicKeyId, found.config, found.etag);
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* createName(id, news);
+
+          // Observe — locate the public key by id (cached on `output`)
+          // or by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.publicKeyId
+            ? yield* getById(output.publicKeyId).pipe(
+                Effect.map((found) =>
+                  found ? { id: output.publicKeyId, ...found } : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the public key if it's missing. Tolerate
+          // `PublicKeyAlreadyExists` (race with a peer reconciler).
+          if (!observed) {
+            const callerReference = name;
+            const created = yield* cloudfront
+              .createPublicKey({
+                PublicKeyConfig: buildConfig(name, callerReference, news),
+              })
+              .pipe(
+                Effect.catchTag("PublicKeyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            PublicKey: {
+                              Id: existing.id,
+                              CreatedTime: new Date(),
+                              PublicKeyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Public key '${name}' already exists but could not be recovered`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            if (!created.PublicKey?.Id) {
+              return yield* Effect.fail(
+                new Error("createPublicKey returned no identifier"),
+              );
+            }
+            yield* session.note(created.PublicKey.Id);
+            return toAttrs(
+              created.PublicKey.Id,
+              created.PublicKey.PublicKeyConfig,
+              created.ETag,
+            );
+          }
+
+          // Sync — patch the comment via `updatePublicKey`. The key body
+          // is immutable (replacement is forced in `diff`), and the
+          // CallerReference is observed from the live config rather than
+          // re-derived. The freshly observed ETag handles optimistic
+          // concurrency.
+          const updated = yield* cloudfront.updatePublicKey({
+            Id: observed.id,
+            IfMatch: observed.etag,
+            PublicKeyConfig: buildConfig(
+              observed.config.Name,
+              observed.config.CallerReference,
+              news,
+            ),
+          });
+          if (!updated.PublicKey?.Id) {
+            return yield* Effect.fail(
+              new Error("updatePublicKey returned no identifier"),
+            );
+          }
+          yield* session.note(observed.id);
+          return toAttrs(
+            updated.PublicKey.Id,
+            updated.PublicKey.PublicKeyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.publicKeyId);
+          if (!current) return;
+          yield* cloudfront
+            .deletePublicKey({
+              Id: output.publicKeyId,
+              IfMatch: current.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchPublicKey", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: PublicKeyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/ResponseHeadersPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/ResponseHeadersPolicy.ts
new file mode 100644
index 00000000000..be08c1f670f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/ResponseHeadersPolicy.ts
@@ -0,0 +1,332 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface ResponseHeadersPolicyProps {
+  /**
+   * Name of the response headers policy. If omitted, a deterministic name is
+   * generated. Names must be unique per AWS account. Changing the name
+   * triggers a replacement.
+   */
+  name?: string;
+  /**
+   * Optional comment describing the policy.
+   */
+  comment?: string;
+  /**
+   * CORS configuration applied to viewer responses.
+   */
+  corsConfig?: cloudfront.ResponseHeadersPolicyCorsConfig;
+  /**
+   * Standard security headers (HSTS, X-Frame-Options, etc.) added to
+   * viewer responses.
+   */
+  securityHeadersConfig?: cloudfront.ResponseHeadersPolicySecurityHeadersConfig;
+  /**
+   * Server-Timing header configuration for measuring CloudFront performance.
+   */
+  serverTimingHeadersConfig?: cloudfront.ResponseHeadersPolicyServerTimingHeadersConfig;
+  /**
+   * Custom headers to add to viewer responses.
+   */
+  customHeadersConfig?: cloudfront.ResponseHeadersPolicyCustomHeadersConfig;
+  /**
+   * Headers to remove from viewer responses.
+   */
+  removeHeadersConfig?: cloudfront.ResponseHeadersPolicyRemoveHeadersConfig;
+}
+
+export interface ResponseHeadersPolicy extends Resource<
+  "AWS.CloudFront.ResponseHeadersPolicy",
+  ResponseHeadersPolicyProps,
+  {
+    /**
+     * CloudFront-assigned response headers policy identifier.
+     */
+    responseHeadersPolicyId: string;
+    /**
+     * Name of the response headers policy.
+     */
+    name: string;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Current comment on the policy.
+     */
+    comment: string | undefined;
+    /**
+     * Current CORS configuration.
+     */
+    corsConfig: cloudfront.ResponseHeadersPolicyCorsConfig | undefined;
+    /**
+     * Current security headers configuration.
+     */
+    securityHeadersConfig:
+      | cloudfront.ResponseHeadersPolicySecurityHeadersConfig
+      | undefined;
+    /**
+     * Current Server-Timing configuration.
+     */
+    serverTimingHeadersConfig:
+      | cloudfront.ResponseHeadersPolicyServerTimingHeadersConfig
+      | undefined;
+    /**
+     * Current custom headers configuration.
+     */
+    customHeadersConfig:
+      | cloudfront.ResponseHeadersPolicyCustomHeadersConfig
+      | undefined;
+    /**
+     * Current remove-headers configuration.
+     */
+    removeHeadersConfig:
+      | cloudfront.ResponseHeadersPolicyRemoveHeadersConfig
+      | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudFront response headers policy.
+ *
+ * Response headers policies add or remove headers in viewer responses,
+ * including CORS, standard security headers (HSTS, X-Frame-Options,
+ * X-Content-Type-Options, Referrer-Policy, etc.), Server-Timing, custom
+ * headers and explicit header removal. They are referenced by ID on a
+ * Distribution's default behavior or per-path cache behaviors.
+ *
+ * @section Creating Response Headers Policies
+ * @example Standard security + CORS
+ * ```typescript
+ * const responseHeadersPolicy = yield* ResponseHeadersPolicy("AppResponseHeaders", {
+ *   comment: "Default app security + CORS",
+ *   corsConfig: {
+ *     AccessControlAllowOrigins: { Quantity: 1, Items: ["https://app.example.com"] },
+ *     AccessControlAllowMethods: { Quantity: 2, Items: ["GET", "OPTIONS"] },
+ *     AccessControlAllowHeaders: { Quantity: 1, Items: ["Authorization"] },
+ *     AccessControlAllowCredentials: false,
+ *     OriginOverride: true,
+ *   },
+ *   securityHeadersConfig: {
+ *     StrictTransportSecurity: {
+ *       AccessControlMaxAgeSec: 31536000,
+ *       IncludeSubdomains: true,
+ *       Preload: true,
+ *       Override: true,
+ *     },
+ *     ContentTypeOptions: { Override: true },
+ *     FrameOptions: { FrameOption: "DENY", Override: true },
+ *     ReferrerPolicy: { ReferrerPolicy: "no-referrer", Override: true },
+ *   },
+ * });
+ * ```
+ */
+export const ResponseHeadersPolicy = Resource<ResponseHeadersPolicy>(
+  "AWS.CloudFront.ResponseHeadersPolicy",
+);
+
+export const ResponseHeadersPolicyProvider = () =>
+  Provider.effect(
+    ResponseHeadersPolicy,
+    Effect.gen(function* () {
+      const getById = Effect.fn(function* (id: string) {
+        const config = yield* cloudfront
+          .getResponseHeadersPolicyConfig({ Id: id })
+          .pipe(
+            Effect.catchTag("NoSuchResponseHeadersPolicy", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (!config?.ResponseHeadersPolicyConfig) return undefined;
+        return {
+          config: config.ResponseHeadersPolicyConfig,
+          etag: config.ETag,
+        };
+      });
+
+      const getByName = Effect.fn(function* (name: string) {
+        const listed = yield* cloudfront.listResponseHeadersPolicies({
+          Type: "custom",
+        });
+        const summary = listed.ResponseHeadersPolicyList?.Items?.find(
+          (item) =>
+            item.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.Name ===
+            name,
+        );
+        if (!summary?.ResponseHeadersPolicy?.Id) return undefined;
+        return yield* getById(summary.ResponseHeadersPolicy.Id).pipe(
+          Effect.map((found) =>
+            found
+              ? { id: summary.ResponseHeadersPolicy.Id, ...found }
+              : undefined,
+          ),
+        );
+      });
+
+      const buildConfig = (
+        name: string,
+        props: ResponseHeadersPolicyProps,
+      ): cloudfront.ResponseHeadersPolicyConfig => ({
+        Name: name,
+        Comment: props.comment,
+        CorsConfig: props.corsConfig,
+        SecurityHeadersConfig: props.securityHeadersConfig,
+        ServerTimingHeadersConfig: props.serverTimingHeadersConfig,
+        CustomHeadersConfig: props.customHeadersConfig,
+        RemoveHeadersConfig: props.removeHeadersConfig,
+      });
+
+      const toAttrs = (
+        id: string,
+        config: cloudfront.ResponseHeadersPolicyConfig,
+        etag: string | undefined,
+      ) => ({
+        responseHeadersPolicyId: id,
+        name: config.Name,
+        etag,
+        comment: config.Comment,
+        corsConfig: config.CorsConfig,
+        securityHeadersConfig: config.SecurityHeadersConfig,
+        serverTimingHeadersConfig: config.ServerTimingHeadersConfig,
+        customHeadersConfig: config.CustomHeadersConfig,
+        removeHeadersConfig: config.RemoveHeadersConfig,
+      });
+
+      return {
+        stables: ["responseHeadersPolicyId"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* createName(id, olds ?? {})) !==
+            (yield* createName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.responseHeadersPolicyId) {
+            const found = yield* getById(output.responseHeadersPolicyId);
+            if (found) {
+              return toAttrs(
+                output.responseHeadersPolicyId,
+                found.config,
+                found.etag,
+              );
+            }
+          }
+          const name = yield* createName(id, olds ?? {});
+          const found = yield* getByName(name);
+          if (!found) return undefined;
+          return toAttrs(found.id, found.config, found.etag);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* createName(id, news);
+
+          // Observe — locate the policy by id (cached on `output`) or
+          // by name. Trust observed cloud state, not stale `olds`.
+          let observed = output?.responseHeadersPolicyId
+            ? yield* getById(output.responseHeadersPolicyId).pipe(
+                Effect.map((found) =>
+                  found
+                    ? { id: output.responseHeadersPolicyId, ...found }
+                    : undefined,
+                ),
+              )
+            : undefined;
+          if (!observed) {
+            observed = yield* getByName(name);
+          }
+
+          // Ensure — create the policy if it's missing. Tolerate
+          // `ResponseHeadersPolicyAlreadyExists` (race with a peer
+          // reconciler).
+          if (!observed) {
+            const created = yield* cloudfront
+              .createResponseHeadersPolicy({
+                ResponseHeadersPolicyConfig: buildConfig(name, news),
+              })
+              .pipe(
+                Effect.catchTag("ResponseHeadersPolicyAlreadyExists", () =>
+                  getByName(name).pipe(
+                    Effect.flatMap((existing) =>
+                      existing
+                        ? Effect.succeed({
+                            ResponseHeadersPolicy: {
+                              Id: existing.id,
+                              LastModifiedTime: new Date(),
+                              ResponseHeadersPolicyConfig: existing.config,
+                            },
+                            ETag: existing.etag,
+                            Location: undefined,
+                          })
+                        : Effect.fail(
+                            new Error(
+                              `Response headers policy '${name}' already exists but could not be recovered`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            if (!created.ResponseHeadersPolicy?.Id) {
+              return yield* Effect.fail(
+                new Error("createResponseHeadersPolicy returned no identifier"),
+              );
+            }
+            yield* session.note(created.ResponseHeadersPolicy.Id);
+            return toAttrs(
+              created.ResponseHeadersPolicy.Id,
+              created.ResponseHeadersPolicy.ResponseHeadersPolicyConfig,
+              created.ETag,
+            );
+          }
+
+          // Sync — patch the observed config to the desired state. The
+          // freshly observed ETag handles optimistic concurrency.
+          const updated = yield* cloudfront.updateResponseHeadersPolicy({
+            Id: observed.id,
+            IfMatch: observed.etag,
+            ResponseHeadersPolicyConfig: buildConfig(
+              observed.config.Name,
+              news,
+            ),
+          });
+          if (!updated.ResponseHeadersPolicy?.Id) {
+            return yield* Effect.fail(
+              new Error("updateResponseHeadersPolicy returned no identifier"),
+            );
+          }
+          yield* session.note(observed.id);
+          return toAttrs(
+            updated.ResponseHeadersPolicy.Id,
+            updated.ResponseHeadersPolicy.ResponseHeadersPolicyConfig,
+            updated.ETag,
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const current = yield* getById(output.responseHeadersPolicyId);
+          if (!current) return;
+          yield* cloudfront
+            .deleteResponseHeadersPolicy({
+              Id: output.responseHeadersPolicyId,
+              IfMatch: current.etag,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchResponseHeadersPolicy", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
+
+const createName = (id: string, props: ResponseHeadersPolicyProps) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128, lowercase: true });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/common.ts
new file mode 100644
index 00000000000..d1e94f937a6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/common.ts
@@ -0,0 +1,55 @@
+import { Region as AwsRegion } from "@distilled.cloud/aws/Region";
+import * as kvs from "@distilled.cloud/aws/cloudfront-keyvaluestore";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+
+// CloudFront KeyValueStore APIs are only available from us-east-1, even when
+// the distribution using the store lives elsewhere.
+export const KVS_REGION = "us-east-1" as const;
+
+export const extractValue = (v: string | Redacted.Redacted<string>): string =>
+  typeof v === "string" ? v : Redacted.value(v);
+
+export const withKvsRegion = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(Effect.provideService(AwsRegion, KVS_REGION as any));
+
+export const withKvsRegionFn =
+  <Args extends any[], A, E, R>(
+    fn: (...args: Args) => Effect.Effect<A, E, R>,
+  ) =>
+  (...args: Args) =>
+    withKvsRegion(fn(...args));
+
+const isKvsNotReady = (error: unknown) => {
+  const tag = (error as { _tag?: string })._tag;
+  return tag === "ResourceNotFoundException" || tag === "ConflictException";
+};
+
+const cappedKvsRetrySchedule = Schedule.exponential("100 millis").pipe(
+  Schedule.both(Schedule.recurs(24)),
+  Schedule.map(([duration]) =>
+    Duration.isGreaterThan(duration, Duration.seconds(2))
+      ? Duration.seconds(2)
+      : duration,
+  ),
+);
+
+export const retryForKvsReadiness = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.retry({
+      while: isKvsNotReady,
+      schedule: cappedKvsRetrySchedule,
+    }),
+  );
+
+export const getKvsEtag = Effect.fn(function* (store: string) {
+  const response = yield* kvs.describeKeyValueStore({ KvsARN: store });
+  return response.ETag;
+});
+
+export const isKvsPreconditionFailed = (err: kvs.ValidationException) =>
+  "Message" in err &&
+  typeof err.Message === "string" &&
+  err.Message.includes("Pre-Condition failed");
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/index.ts
new file mode 100644
index 00000000000..572e5e09ef2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudFront/index.ts
@@ -0,0 +1,26 @@
+export { CachePolicy, CachePolicyProvider } from "./CachePolicy.ts";
+export { Distribution, DistributionProvider } from "./Distribution.ts";
+export { Function, FunctionProvider } from "./Function.ts";
+export { Invalidation, InvalidationProvider } from "./Invalidation.ts";
+export { KeyGroup, KeyGroupProvider } from "./KeyGroup.ts";
+export { KeyValueStore, KeyValueStoreProvider } from "./KeyValueStore.ts";
+export { KvEntries, KvEntriesProvider } from "./KvEntries.ts";
+export { KvRoutesUpdate, KvRoutesUpdateProvider } from "./KvRoutesUpdate.ts";
+export {
+  MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_POLICY_ID,
+  MANAGED_CACHING_DISABLED_POLICY_ID,
+  MANAGED_CACHING_OPTIMIZED_POLICY_ID,
+} from "./ManagedPolicies.ts";
+export {
+  OriginAccessControl,
+  OriginAccessControlProvider,
+} from "./OriginAccessControl.ts";
+export {
+  OriginRequestPolicy,
+  OriginRequestPolicyProvider,
+} from "./OriginRequestPolicy.ts";
+export { PublicKey, PublicKeyProvider } from "./PublicKey.ts";
+export {
+  ResponseHeadersPolicy,
+  ResponseHeadersPolicyProvider,
+} from "./ResponseHeadersPolicy.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/Alarm.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/Alarm.ts
new file mode 100644
index 00000000000..36202d6513d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/Alarm.ts
@@ -0,0 +1,184 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import {
+  createName,
+  readResourceTags,
+  retryConcurrent,
+  updateResourceTags,
+} from "./common.ts";
+
+export type AlarmName = string;
+export type AlarmArn =
+  `arn:aws:cloudwatch:${RegionID}:${AccountID}:alarm:${string}`;
+export type AlarmStateValue = cloudwatch.StateValue;
+
+export interface AlarmProps extends Omit<
+  cloudwatch.PutMetricAlarmInput,
+  "AlarmName" | "Tags"
+> {
+  /**
+   * Name of the alarm. If omitted, a unique name is generated.
+   */
+  name?: AlarmName;
+  /**
+   * Optional tags to apply to the alarm.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Alarm extends Resource<
+  "AWS.CloudWatch.Alarm",
+  AlarmProps,
+  {
+    alarmName: AlarmName;
+    alarmArn: AlarmArn;
+    stateValue: AlarmStateValue | undefined;
+    stateReason: string | undefined;
+    metricAlarm: cloudwatch.MetricAlarm;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch metric alarm.
+ *
+ * @section Creating Alarms
+ * @example Threshold Alarm
+ * ```typescript
+ * const alarm = yield* Alarm("HighErrors", {
+ *   MetricName: "Errors",
+ *   Namespace: "AWS/Lambda",
+ *   Statistic: "Sum",
+ *   Period: 60,
+ *   EvaluationPeriods: 1,
+ *   Threshold: 1,
+ *   ComparisonOperator: "GreaterThanOrEqualToThreshold",
+ * });
+ * ```
+ */
+export const Alarm = Resource<Alarm>("AWS.CloudWatch.Alarm");
+
+export const AlarmProvider = () =>
+  Provider.effect(
+    Alarm,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createAlarmName = (id: string, props: { name?: string } = {}) =>
+        createName(id, props.name, 255);
+
+      const alarmArn = (alarmName: string) =>
+        `arn:aws:cloudwatch:${region}:${accountId}:alarm:${alarmName}` as AlarmArn;
+
+      const readAlarm = Effect.fn(function* (alarmName: string) {
+        const described = yield* cloudwatch.describeAlarms({
+          AlarmNames: [alarmName],
+          AlarmTypes: ["MetricAlarm"],
+        });
+        const metricAlarm = described.MetricAlarms?.find(
+          (candidate) => candidate.AlarmName === alarmName,
+        );
+
+        if (!metricAlarm?.AlarmName || !metricAlarm.AlarmArn) {
+          return undefined;
+        }
+
+        const tags = yield* readResourceTags(metricAlarm.AlarmArn).pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed({}),
+          ),
+        );
+
+        return {
+          alarmName: metricAlarm.AlarmName,
+          alarmArn: metricAlarm.AlarmArn as AlarmArn,
+          stateValue: metricAlarm.StateValue,
+          stateReason: metricAlarm.StateReason,
+          metricAlarm,
+          tags,
+        };
+      });
+
+      return {
+        stables: ["alarmName", "alarmArn"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {} }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = yield* createAlarmName(id, olds);
+          const newName = yield* createAlarmName(id, news);
+
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.alarmName ?? (yield* createAlarmName(id, olds ?? {}));
+          const state = yield* readAlarm(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — derive the alarm name and read whatever is currently
+          // in CloudWatch under that name. `output.alarmName` wins when
+          // present so an existing physical resource is never renamed.
+          const name = output?.alarmName ?? (yield* createAlarmName(id, news));
+          const existing = yield* readAlarm(name);
+
+          // Ensure — `putMetricAlarm` is an upsert; we always send the full
+          // desired config so the cloud converges to `news` regardless of
+          // whether the alarm pre-existed.
+          yield* retryConcurrent(
+            cloudwatch.putMetricAlarm({
+              ...news,
+              AlarmName: name,
+            }),
+          );
+
+          // Sync tags — diff observed (or prior) tags against desired and
+          // apply only the delta. On adoption `olds` is undefined, so we
+          // fall back to whatever we just observed.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceArn: alarmArn(name),
+            olds: olds?.tags ?? existing?.tags,
+            news: news.tags,
+          });
+
+          yield* session.note(alarmArn(name));
+
+          const state = yield* readAlarm(name);
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled alarm '${name}'`),
+            );
+          }
+
+          return {
+            ...state,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryConcurrent(
+            cloudwatch.deleteAlarms({
+              AlarmNames: [output.alarmName],
+            }),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/AlarmMuteRule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/AlarmMuteRule.ts
new file mode 100644
index 00000000000..25d31089bcd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/AlarmMuteRule.ts
@@ -0,0 +1,165 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import { createManagedTags, createName, retryConcurrent } from "./common.ts";
+
+export type AlarmMuteRuleName = string;
+export type AlarmMuteRuleArn =
+  `arn:aws:cloudwatch:${RegionID}:${AccountID}:alarm-mute-rule:${string}`;
+
+export interface AlarmMuteRuleProps extends Omit<
+  cloudwatch.PutAlarmMuteRuleInput,
+  "Name" | "Tags"
+> {
+  /**
+   * Name of the mute rule. If omitted, a unique name is generated.
+   */
+  name?: AlarmMuteRuleName;
+  /**
+   * Optional tags to apply to the mute rule.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface AlarmMuteRule extends Resource<
+  "AWS.CloudWatch.AlarmMuteRule",
+  AlarmMuteRuleProps,
+  {
+    alarmMuteRuleName: AlarmMuteRuleName;
+    alarmMuteRuleArn: AlarmMuteRuleArn;
+    status: string | undefined;
+    muteType: string | undefined;
+    alarmMuteRule: cloudwatch.GetAlarmMuteRuleOutput;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch alarm mute rule.
+ *
+ * @section Creating Mute Rules
+ * @example Scheduled Mute
+ * ```typescript
+ * const rule = yield* AlarmMuteRule("NightlyMute", {
+ *   Rule: {
+ *     Schedule: {
+ *       Expression: "cron(0 2 * * ? *)",
+ *       Duration: "PT1H",
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export const AlarmMuteRule = Resource<AlarmMuteRule>(
+  "AWS.CloudWatch.AlarmMuteRule",
+);
+
+export const AlarmMuteRuleProvider = () =>
+  Provider.effect(
+    AlarmMuteRule,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createMuteRuleName = (id: string, props: { name?: string } = {}) =>
+        createName(id, props.name, 255);
+
+      const alarmMuteRuleArn = (name: string) =>
+        `arn:aws:cloudwatch:${region}:${accountId}:alarm-mute-rule:${name}` as AlarmMuteRuleArn;
+
+      const readAlarmMuteRule = Effect.fn(function* (name: string) {
+        const output = yield* cloudwatch
+          .getAlarmMuteRule({
+            AlarmMuteRuleName: name,
+          })
+          .pipe(
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!output?.Name || !output.AlarmMuteRuleArn) {
+          return undefined;
+        }
+
+        return {
+          alarmMuteRuleName: output.Name,
+          alarmMuteRuleArn: output.AlarmMuteRuleArn as AlarmMuteRuleArn,
+          status: output.Status,
+          muteType: output.MuteType,
+          alarmMuteRule: output,
+          tags: {},
+        };
+      });
+
+      return {
+        stables: ["alarmMuteRuleName", "alarmMuteRuleArn"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {} }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = yield* createMuteRuleName(id, olds);
+          const newName = yield* createMuteRuleName(id, news);
+
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.alarmMuteRuleName ??
+            (yield* createMuteRuleName(id, olds ?? {}));
+          return yield* readAlarmMuteRule(name);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — pin the physical name from `output` if we already
+          // have one; otherwise derive it from desired props.
+          const name =
+            output?.alarmMuteRuleName ?? (yield* createMuteRuleName(id, news));
+
+          // Ensure — `putAlarmMuteRule` is an upsert. The CloudWatch API
+          // accepts `Tags` on every put, so we send the full managed tag
+          // set every reconcile and let the API converge it.
+          const tags = yield* createManagedTags(id, news.tags);
+
+          yield* retryConcurrent(
+            cloudwatch.putAlarmMuteRule({
+              ...news,
+              Name: name,
+              Tags: Object.entries(tags).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
+            }),
+          );
+
+          yield* session.note(alarmMuteRuleArn(name));
+
+          const state = yield* readAlarmMuteRule(name);
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled alarm mute rule '${name}'`),
+            );
+          }
+
+          return {
+            ...state,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryConcurrent(
+            cloudwatch.deleteAlarmMuteRule({
+              AlarmMuteRuleName: output.alarmMuteRuleName,
+            }),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/AnomalyDetector.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/AnomalyDetector.ts
new file mode 100644
index 00000000000..fec4eb6e353
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/AnomalyDetector.ts
@@ -0,0 +1,218 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  detectorIdentity,
+  matchesDetectorIdentity,
+  retryConcurrent,
+} from "./common.ts";
+
+class AnomalyDetectorNotVisible extends Data.TaggedError(
+  "AnomalyDetectorNotVisible",
+)<{
+  message: string;
+}> {}
+
+export interface AnomalyDetectorProps
+  extends cloudwatch.PutAnomalyDetectorInput {}
+
+export interface AnomalyDetector extends Resource<
+  "AWS.CloudWatch.AnomalyDetector",
+  AnomalyDetectorProps,
+  {
+    detectorId: string;
+    anomalyDetector: cloudwatch.AnomalyDetector;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch anomaly detector.
+ *
+ * @section Creating Detectors
+ * @example Single Metric Detector
+ * ```typescript
+ * const detector = yield* AnomalyDetector("ErrorsDetector", {
+ *   Namespace: "AWS/Lambda",
+ *   MetricName: "Errors",
+ *   Stat: "Sum",
+ * });
+ * ```
+ */
+export const AnomalyDetector = Resource<AnomalyDetector>(
+  "AWS.CloudWatch.AnomalyDetector",
+);
+
+const toDescribeRequest = (
+  input: cloudwatch.PutAnomalyDetectorInput,
+): cloudwatch.DescribeAnomalyDetectorsInput => {
+  if (input.MetricMathAnomalyDetector) {
+    return {
+      AnomalyDetectorTypes: ["METRIC_MATH"],
+    };
+  }
+
+  return {
+    Namespace: input.Namespace,
+    MetricName: input.MetricName,
+    Dimensions: input.Dimensions,
+    AnomalyDetectorTypes: ["SINGLE_METRIC"],
+  };
+};
+
+const toDeleteRequest = (
+  input: Pick<
+    cloudwatch.AnomalyDetector,
+    | "Namespace"
+    | "MetricName"
+    | "Dimensions"
+    | "Stat"
+    | "SingleMetricAnomalyDetector"
+    | "MetricMathAnomalyDetector"
+  >,
+): cloudwatch.DeleteAnomalyDetectorInput => {
+  if (input.MetricMathAnomalyDetector) {
+    return {
+      MetricMathAnomalyDetector: input.MetricMathAnomalyDetector,
+    };
+  }
+
+  if (input.SingleMetricAnomalyDetector) {
+    return {
+      SingleMetricAnomalyDetector: input.SingleMetricAnomalyDetector,
+    };
+  }
+
+  return {
+    Namespace: input.Namespace,
+    MetricName: input.MetricName,
+    Dimensions: input.Dimensions,
+    Stat: input.Stat,
+  };
+};
+
+const detectorReadinessSchedule = Schedule.exponential(200).pipe(
+  Schedule.both(Schedule.recurs(8)),
+);
+
+const describeDetector = Effect.fn(function* (
+  props: cloudwatch.PutAnomalyDetectorInput,
+  options?: {
+    resourceId?: string;
+    attempt?: number;
+    logMisses?: boolean;
+  },
+) {
+  const request = toDescribeRequest(props);
+  const response = yield* cloudwatch.describeAnomalyDetectors(request);
+  const detectors = response.AnomalyDetectors ?? [];
+  const detector = detectors.find((candidate) =>
+    matchesDetectorIdentity(candidate, props),
+  );
+
+  if (!detector && options?.logMisses) {
+    const prefix = options.resourceId
+      ? `${options.resourceId}: anomaly detector not yet visible`
+      : "anomaly detector not yet visible";
+    const attempt =
+      options.attempt === undefined ? "" : ` (attempt ${options.attempt})`;
+
+    yield* Effect.logInfo(
+      `${prefix}${attempt}; request=${JSON.stringify(request)} candidates=${JSON.stringify(
+        detectors.map((candidate) => ({
+          identity: detectorIdentity(candidate),
+          Namespace: candidate.Namespace,
+          MetricName: candidate.MetricName,
+          Stat: candidate.Stat,
+          SingleMetricAnomalyDetector: candidate.SingleMetricAnomalyDetector,
+          MetricMathAnomalyDetector: candidate.MetricMathAnomalyDetector,
+        })),
+      )}`,
+    );
+  }
+
+  return detector;
+});
+
+export const AnomalyDetectorProvider = () =>
+  Provider.succeed(AnomalyDetector, {
+    stables: ["detectorId"],
+    diff: Effect.fn(function* ({ olds = {}, news = {} }) {
+      if (!isResolved(news)) return undefined;
+      if (detectorIdentity(olds) !== detectorIdentity(news)) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ olds, output }) {
+      const props = output?.anomalyDetector ?? olds;
+      if (!props) {
+        return undefined;
+      }
+
+      const detector = yield* describeDetector(props);
+
+      if (!detector) {
+        return undefined;
+      }
+
+      return {
+        detectorId: detectorIdentity(props),
+        anomalyDetector: detector,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, session }) {
+      // Ensure — `putAnomalyDetector` is an upsert keyed by the detector's
+      // identity (Namespace+MetricName+Dimensions+Stat or MetricMath
+      // expression). Sending desired props every reconcile converges the
+      // cloud regardless of whether this is first-create or an update.
+      yield* retryConcurrent(cloudwatch.putAnomalyDetector(news));
+      const detectorId = detectorIdentity(news);
+      yield* session.note(detectorId);
+
+      // Sync — describe the detector after the put. CloudWatch is
+      // eventually consistent for `DescribeAnomalyDetectors`, so we retry
+      // until the detector matching our identity is visible.
+      let attempt = 0;
+      const state = yield* Effect.suspend(() => {
+        attempt += 1;
+        return describeDetector(news, {
+          resourceId: "AnomalyDetector",
+          attempt,
+          logMisses: true,
+        }).pipe(
+          Effect.flatMap((state) =>
+            state
+              ? Effect.succeed(state)
+              : Effect.fail(
+                  new AnomalyDetectorNotVisible({
+                    message: "Anomaly detector not yet visible",
+                  }),
+                ),
+          ),
+        );
+      }).pipe(
+        Effect.retry({
+          while: (error) => error._tag === "AnomalyDetectorNotVisible",
+          schedule: detectorReadinessSchedule,
+        }),
+      );
+
+      return {
+        detectorId,
+        anomalyDetector: state,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* retryConcurrent(
+        cloudwatch.deleteAnomalyDetector(
+          toDeleteRequest(output.anomalyDetector),
+        ),
+      ).pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/CompositeAlarm.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/CompositeAlarm.ts
new file mode 100644
index 00000000000..c21cc5a50ef
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/CompositeAlarm.ts
@@ -0,0 +1,177 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { AlarmArn } from "./Alarm.ts";
+import {
+  createName,
+  readResourceTags,
+  retryConcurrent,
+  updateResourceTags,
+} from "./common.ts";
+
+export type CompositeAlarmName = string;
+
+export interface CompositeAlarmProps extends Omit<
+  cloudwatch.PutCompositeAlarmInput,
+  "AlarmName" | "Tags"
+> {
+  /**
+   * Name of the composite alarm. If omitted, a unique name is generated.
+   */
+  name?: CompositeAlarmName;
+  /**
+   * Optional tags to apply to the composite alarm.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface CompositeAlarm extends Resource<
+  "AWS.CloudWatch.CompositeAlarm",
+  CompositeAlarmProps,
+  {
+    alarmName: CompositeAlarmName;
+    alarmArn: AlarmArn;
+    stateValue: cloudwatch.StateValue | undefined;
+    stateReason: string | undefined;
+    compositeAlarm: cloudwatch.CompositeAlarm;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch composite alarm.
+ *
+ * @section Creating Composite Alarms
+ * @example Composite Rule
+ * ```typescript
+ * const composite = yield* CompositeAlarm("HighSeverity", {
+ *   AlarmRule: 'ALARM("HighErrors") OR ALARM("HighLatency")',
+ * });
+ * ```
+ */
+export const CompositeAlarm = Resource<CompositeAlarm>(
+  "AWS.CloudWatch.CompositeAlarm",
+);
+
+export const CompositeAlarmProvider = () =>
+  Provider.effect(
+    CompositeAlarm,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createAlarmName = (id: string, props: { name?: string } = {}) =>
+        createName(id, props.name, 255);
+
+      const alarmArn = (alarmName: string) =>
+        `arn:aws:cloudwatch:${region}:${accountId}:alarm:${alarmName}` as AlarmArn;
+
+      const readCompositeAlarm = Effect.fn(function* (alarmName: string) {
+        const described = yield* cloudwatch.describeAlarms({
+          AlarmNames: [alarmName],
+          AlarmTypes: ["CompositeAlarm"],
+        });
+        const compositeAlarm = described.CompositeAlarms?.find(
+          (candidate) => candidate.AlarmName === alarmName,
+        );
+
+        if (!compositeAlarm?.AlarmName || !compositeAlarm.AlarmArn) {
+          return undefined;
+        }
+
+        const tags = yield* readResourceTags(compositeAlarm.AlarmArn).pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed({}),
+          ),
+        );
+
+        return {
+          alarmName: compositeAlarm.AlarmName,
+          alarmArn: compositeAlarm.AlarmArn as AlarmArn,
+          stateValue: compositeAlarm.StateValue,
+          stateReason: compositeAlarm.StateReason,
+          compositeAlarm,
+          tags,
+        };
+      });
+
+      return {
+        stables: ["alarmName", "alarmArn"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {} }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = yield* createAlarmName(id, olds);
+          const newName = yield* createAlarmName(id, news);
+
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.alarmName ?? (yield* createAlarmName(id, olds ?? {}));
+          const state = yield* readCompositeAlarm(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — pin the physical name from `output` if present so we
+          // never rename an existing alarm; otherwise derive from desired
+          // props.
+          const name = output?.alarmName ?? (yield* createAlarmName(id, news));
+          const existing = yield* readCompositeAlarm(name);
+
+          // Ensure — `putCompositeAlarm` is an upsert. We always send the
+          // full desired config so the cloud converges to `news` whether
+          // the alarm pre-existed or not.
+          yield* retryConcurrent(
+            cloudwatch.putCompositeAlarm({
+              ...news,
+              AlarmName: name,
+            }),
+          );
+
+          // Sync tags — diff observed (or prior) tags against desired.
+          // `olds` is undefined on adoption, so fall back to what we just
+          // observed.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceArn: alarmArn(name),
+            olds: olds?.tags ?? existing?.tags,
+            news: news.tags,
+          });
+
+          yield* session.note(alarmArn(name));
+
+          const state = yield* readCompositeAlarm(name);
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled composite alarm '${name}'`),
+            );
+          }
+
+          return {
+            ...state,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryConcurrent(
+            cloudwatch.deleteAlarms({
+              AlarmNames: [output.alarmName],
+            }),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/Dashboard.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/Dashboard.ts
new file mode 100644
index 00000000000..1da2d2be16b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/Dashboard.ts
@@ -0,0 +1,260 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import { createName, retryConcurrent } from "./common.ts";
+
+export type DashboardName = string;
+export type DashboardArn =
+  `arn:aws:cloudwatch::${AccountID}:dashboard/${string}`;
+
+export type DashboardPeriodOverride = "inherit" | "auto";
+export type DashboardMetricRow = (string | number | boolean | null)[];
+
+export interface DashboardMetricWidgetProperties {
+  title?: string;
+  region?: string;
+  stat?: string;
+  period?: number;
+  view?: "timeSeries" | "singleValue" | "gauge" | "bar" | "pie";
+  stacked?: boolean;
+  metrics: DashboardMetricRow[];
+  annotations?: Record<string, unknown>;
+  yAxis?: Record<string, unknown>;
+  legend?: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+export interface DashboardTextWidgetProperties {
+  markdown: string;
+  [key: string]: unknown;
+}
+
+export interface DashboardAlarmStatusWidgetProperties {
+  alarms: string[];
+  title?: string;
+  sortBy?: string;
+  states?: string[];
+  [key: string]: unknown;
+}
+
+export interface DashboardLogWidgetProperties {
+  query: string;
+  region?: string;
+  title?: string;
+  view?: "table" | "timeSeries" | "bar" | "pie";
+  [key: string]: unknown;
+}
+
+export interface DashboardMetricWidget {
+  type: "metric";
+  x?: number;
+  y?: number;
+  width?: number;
+  height?: number;
+  properties: DashboardMetricWidgetProperties;
+}
+
+export interface DashboardTextWidget {
+  type: "text";
+  x?: number;
+  y?: number;
+  width?: number;
+  height?: number;
+  properties: DashboardTextWidgetProperties;
+}
+
+export interface DashboardAlarmStatusWidget {
+  type: "alarm";
+  x?: number;
+  y?: number;
+  width?: number;
+  height?: number;
+  properties: DashboardAlarmStatusWidgetProperties;
+}
+
+export interface DashboardLogWidget {
+  type: "log";
+  x?: number;
+  y?: number;
+  width?: number;
+  height?: number;
+  properties: DashboardLogWidgetProperties;
+}
+
+export type DashboardWidget =
+  | DashboardMetricWidget
+  | DashboardTextWidget
+  | DashboardAlarmStatusWidget
+  | DashboardLogWidget;
+
+export interface DashboardBody {
+  start?: string;
+  end?: string;
+  periodOverride?: DashboardPeriodOverride;
+  widgets: DashboardWidget[];
+  variables?: Record<string, unknown>[];
+}
+
+export interface DashboardProps extends Omit<
+  cloudwatch.PutDashboardInput,
+  "DashboardName" | "DashboardBody"
+> {
+  /**
+   * Name of the dashboard. If omitted, a unique name is generated.
+   */
+  name?: DashboardName;
+  /**
+   * Structured dashboard document. The provider serializes it to the JSON
+   * string expected by the CloudWatch API.
+   */
+  DashboardBody: DashboardBody;
+  /**
+   * Optional tags to apply to the dashboard.
+   *
+   * CloudWatch dashboards do not currently support the generic CloudWatch
+   * tagging APIs, so these values are accepted for API consistency but are not
+   * persisted remotely.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Dashboard extends Resource<
+  "AWS.CloudWatch.Dashboard",
+  DashboardProps,
+  {
+    dashboardName: DashboardName;
+    dashboardArn: DashboardArn;
+    dashboardBody: DashboardBody | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon CloudWatch dashboard.
+ *
+ * @section Creating Dashboards
+ * @example Basic Dashboard
+ * ```typescript
+ * const dashboard = yield* Dashboard("OpsDashboard", {
+ *   DashboardBody: {
+ *     widgets: [],
+ *   },
+ * });
+ * ```
+ */
+export const Dashboard = Resource<Dashboard>("AWS.CloudWatch.Dashboard");
+
+const serializeDashboardBody = (body: DashboardBody) => JSON.stringify(body);
+
+const parseDashboardBody = (body: string | undefined) => {
+  if (!body) {
+    return undefined;
+  }
+  return JSON.parse(body) as DashboardBody;
+};
+
+export const DashboardProvider = () =>
+  Provider.effect(
+    Dashboard,
+    Effect.gen(function* () {
+      const { accountId } = yield* AWSEnvironment;
+
+      const createDashboardName = (id: string, props: { name?: string } = {}) =>
+        createName(id, props.name, 255);
+
+      const dashboardArn = (dashboardName: string) =>
+        `arn:aws:cloudwatch::${accountId}:dashboard/${dashboardName}` as DashboardArn;
+
+      const readDashboard = Effect.fn(function* (dashboardName: string) {
+        const output = yield* cloudwatch
+          .getDashboard({
+            DashboardName: dashboardName,
+          })
+          .pipe(
+            Effect.catchTag("DashboardNotFoundError", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!output?.DashboardName) {
+          return undefined;
+        }
+
+        return {
+          dashboardName: output.DashboardName,
+          dashboardArn: dashboardArn(output.DashboardName),
+          dashboardBody: parseDashboardBody(output.DashboardBody),
+          tags: {},
+        };
+      });
+
+      return {
+        stables: ["dashboardName", "dashboardArn"],
+        diff: Effect.fn(function* ({
+          id,
+          olds = {},
+          news = {} as DashboardProps,
+        }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = yield* createDashboardName(id, olds);
+          const newName = yield* createDashboardName(id, news);
+
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.dashboardName ??
+            (yield* createDashboardName(id, olds ?? {}));
+          return yield* readDashboard(name);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — pin the physical name from `output` if present so we
+          // never rename an existing dashboard; otherwise derive from
+          // desired props.
+          const name =
+            output?.dashboardName ?? (yield* createDashboardName(id, news));
+
+          // Ensure — `putDashboard` is a pure upsert. The CloudWatch
+          // dashboard API has no separate update path, so we always send
+          // the full body and let the API converge.
+          yield* retryConcurrent(
+            cloudwatch.putDashboard({
+              DashboardName: name,
+              DashboardBody: serializeDashboardBody(news.DashboardBody),
+            }),
+          );
+
+          yield* session.note(dashboardArn(name));
+
+          const state = yield* readDashboard(name);
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled dashboard '${name}'`),
+            );
+          }
+
+          // Dashboards do not support the generic CloudWatch tagging APIs,
+          // so `tags` is always returned as an empty record.
+          return {
+            ...state,
+            tags: {},
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryConcurrent(
+            cloudwatch.deleteDashboards({
+              DashboardNames: [output.dashboardName],
+            }),
+          ).pipe(Effect.catchTag("DashboardNotFoundError", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmContributors.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmContributors.ts
new file mode 100644
index 00000000000..58f8efcf822
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmContributors.ts
@@ -0,0 +1,79 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { AlarmResource } from "./binding-common.ts";
+
+export interface DescribeAlarmContributorsRequest extends Omit<
+  cloudwatch.DescribeAlarmContributorsInput,
+  "AlarmName"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:DescribeAlarmContributors`.
+ */
+export class DescribeAlarmContributors extends Binding.Service<
+  DescribeAlarmContributors,
+  (
+    alarm: AlarmResource,
+  ) => Effect.Effect<
+    (
+      request?: DescribeAlarmContributorsRequest,
+    ) => Effect.Effect<
+      cloudwatch.DescribeAlarmContributorsOutput,
+      cloudwatch.DescribeAlarmContributorsError
+    >
+  >
+>()("AWS.CloudWatch.DescribeAlarmContributors") {}
+
+export const DescribeAlarmContributorsLive = Layer.effect(
+  DescribeAlarmContributors,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeAlarmContributorsPolicy;
+    const describeAlarmContributors =
+      yield* cloudwatch.describeAlarmContributors;
+
+    return Effect.fn(function* (alarm: AlarmResource) {
+      const AlarmName = yield* alarm.alarmName;
+      yield* Policy(alarm);
+
+      return Effect.fn(function* (
+        request: DescribeAlarmContributorsRequest = {},
+      ) {
+        return yield* describeAlarmContributors({
+          ...request,
+          AlarmName: yield* AlarmName,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeAlarmContributorsPolicy extends Binding.Policy<
+  DescribeAlarmContributorsPolicy,
+  (alarm: AlarmResource) => Effect.Effect<void>
+>()("AWS.CloudWatch.DescribeAlarmContributors") {}
+
+export const DescribeAlarmContributorsPolicyLive =
+  DescribeAlarmContributorsPolicy.layer.succeed(
+    Effect.fn(function* (host, alarm) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DescribeAlarmContributors(${alarm}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DescribeAlarmContributors"],
+                Resource: [alarm.alarmArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeAlarmContributorsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmHistory.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmHistory.ts
new file mode 100644
index 00000000000..4abb84b62d1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmHistory.ts
@@ -0,0 +1,66 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface DescribeAlarmHistoryRequest
+  extends cloudwatch.DescribeAlarmHistoryInput {}
+
+/**
+ * Runtime binding for `cloudwatch:DescribeAlarmHistory`.
+ */
+export class DescribeAlarmHistory extends Binding.Service<
+  DescribeAlarmHistory,
+  () => Effect.Effect<
+    (
+      request?: DescribeAlarmHistoryRequest,
+    ) => Effect.Effect<
+      cloudwatch.DescribeAlarmHistoryOutput,
+      cloudwatch.DescribeAlarmHistoryError
+    >
+  >
+>()("AWS.CloudWatch.DescribeAlarmHistory") {}
+
+export const DescribeAlarmHistoryLive = Layer.effect(
+  DescribeAlarmHistory,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeAlarmHistoryPolicy;
+    const describeAlarmHistory = yield* cloudwatch.describeAlarmHistory;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: DescribeAlarmHistoryRequest = {}) {
+        return yield* describeAlarmHistory(request);
+      });
+    });
+  }),
+);
+
+export class DescribeAlarmHistoryPolicy extends Binding.Policy<
+  DescribeAlarmHistoryPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.DescribeAlarmHistory") {}
+
+export const DescribeAlarmHistoryPolicyLive =
+  DescribeAlarmHistoryPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DescribeAlarmHistory())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DescribeAlarmHistory"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeAlarmHistoryPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarms.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarms.ts
new file mode 100644
index 00000000000..042dfe287e4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarms.ts
@@ -0,0 +1,94 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { type AlarmResource, sortAlarmResources } from "./binding-common.ts";
+
+export interface DescribeAlarmsRequest extends Omit<
+  cloudwatch.DescribeAlarmsInput,
+  "AlarmNames"
+> {}
+
+type AlarmResources = [AlarmResource, ...AlarmResource[]];
+
+const getAlarmTypes = (alarms: AlarmResources) =>
+  [
+    ...new Set(
+      alarms.map((alarm) =>
+        alarm.Type === "AWS.CloudWatch.CompositeAlarm"
+          ? "CompositeAlarm"
+          : "MetricAlarm",
+      ),
+    ),
+  ] as cloudwatch.AlarmType[];
+
+/**
+ * Runtime binding for `cloudwatch:DescribeAlarms`.
+ */
+export class DescribeAlarms extends Binding.Service<
+  DescribeAlarms,
+  (
+    ...alarms: AlarmResources
+  ) => Effect.Effect<
+    (
+      request?: DescribeAlarmsRequest,
+    ) => Effect.Effect<cloudwatch.DescribeAlarmsOutput, any>
+  >
+>()("AWS.CloudWatch.DescribeAlarms") {}
+
+export const DescribeAlarmsLive = Layer.effect(
+  DescribeAlarms,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeAlarmsPolicy;
+    const describeAlarms = yield* cloudwatch.describeAlarms;
+
+    return Effect.fn(function* (...alarms: AlarmResources) {
+      const sorted = sortAlarmResources(alarms);
+      const AlarmNames = yield* Effect.forEach(sorted, (alarm) =>
+        alarm.alarmName.asEffect(),
+      );
+      yield* Policy(...sorted);
+
+      return Effect.fn(function* (request: DescribeAlarmsRequest = {}) {
+        return yield* describeAlarms({
+          ...request,
+          AlarmTypes: getAlarmTypes(sorted),
+          AlarmNames: yield* Effect.forEach(
+            AlarmNames,
+            (alarmName) => alarmName,
+          ),
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeAlarmsPolicy extends Binding.Policy<
+  DescribeAlarmsPolicy,
+  (...alarms: AlarmResources) => Effect.Effect<void>
+>()("AWS.CloudWatch.DescribeAlarms") {}
+
+export const DescribeAlarmsPolicyLive = DescribeAlarmsPolicy.layer.succeed(
+  Effect.fn(function* (host, ...alarms: AlarmResources) {
+    const sorted = sortAlarmResources(alarms);
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.DescribeAlarms(${sorted}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:DescribeAlarms"],
+              // AWS requires "*" here to return composite alarms.
+              Resource: ["*"],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `DescribeAlarmsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmsForMetric.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmsForMetric.ts
new file mode 100644
index 00000000000..32f80b9b08c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAlarmsForMetric.ts
@@ -0,0 +1,66 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface DescribeAlarmsForMetricRequest
+  extends cloudwatch.DescribeAlarmsForMetricInput {}
+
+/**
+ * Runtime binding for `cloudwatch:DescribeAlarmsForMetric`.
+ */
+export class DescribeAlarmsForMetric extends Binding.Service<
+  DescribeAlarmsForMetric,
+  () => Effect.Effect<
+    (
+      request: DescribeAlarmsForMetricRequest,
+    ) => Effect.Effect<
+      cloudwatch.DescribeAlarmsForMetricOutput,
+      cloudwatch.DescribeAlarmsForMetricError
+    >
+  >
+>()("AWS.CloudWatch.DescribeAlarmsForMetric") {}
+
+export const DescribeAlarmsForMetricLive = Layer.effect(
+  DescribeAlarmsForMetric,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeAlarmsForMetricPolicy;
+    const describeAlarmsForMetric = yield* cloudwatch.describeAlarmsForMetric;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: DescribeAlarmsForMetricRequest) {
+        return yield* describeAlarmsForMetric(request);
+      });
+    });
+  }),
+);
+
+export class DescribeAlarmsForMetricPolicy extends Binding.Policy<
+  DescribeAlarmsForMetricPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.DescribeAlarmsForMetric") {}
+
+export const DescribeAlarmsForMetricPolicyLive =
+  DescribeAlarmsForMetricPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DescribeAlarmsForMetric())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DescribeAlarmsForMetric"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeAlarmsForMetricPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAnomalyDetectors.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAnomalyDetectors.ts
new file mode 100644
index 00000000000..d705e310807
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeAnomalyDetectors.ts
@@ -0,0 +1,68 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface DescribeAnomalyDetectorsRequest
+  extends cloudwatch.DescribeAnomalyDetectorsInput {}
+
+/**
+ * Runtime binding for `cloudwatch:DescribeAnomalyDetectors`.
+ */
+export class DescribeAnomalyDetectors extends Binding.Service<
+  DescribeAnomalyDetectors,
+  () => Effect.Effect<
+    (
+      request?: DescribeAnomalyDetectorsRequest,
+    ) => Effect.Effect<
+      cloudwatch.DescribeAnomalyDetectorsOutput,
+      cloudwatch.DescribeAnomalyDetectorsError
+    >
+  >
+>()("AWS.CloudWatch.DescribeAnomalyDetectors") {}
+
+export const DescribeAnomalyDetectorsLive = Layer.effect(
+  DescribeAnomalyDetectors,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeAnomalyDetectorsPolicy;
+    const describeAnomalyDetectors = yield* cloudwatch.describeAnomalyDetectors;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (
+        request: DescribeAnomalyDetectorsRequest = {},
+      ) {
+        return yield* describeAnomalyDetectors(request);
+      });
+    });
+  }),
+);
+
+export class DescribeAnomalyDetectorsPolicy extends Binding.Policy<
+  DescribeAnomalyDetectorsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.DescribeAnomalyDetectors") {}
+
+export const DescribeAnomalyDetectorsPolicyLive =
+  DescribeAnomalyDetectorsPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DescribeAnomalyDetectors())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DescribeAnomalyDetectors"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeAnomalyDetectorsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeInsightRules.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeInsightRules.ts
new file mode 100644
index 00000000000..532124eaf5c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DescribeInsightRules.ts
@@ -0,0 +1,66 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface DescribeInsightRulesRequest
+  extends cloudwatch.DescribeInsightRulesInput {}
+
+/**
+ * Runtime binding for `cloudwatch:DescribeInsightRules`.
+ */
+export class DescribeInsightRules extends Binding.Service<
+  DescribeInsightRules,
+  () => Effect.Effect<
+    (
+      request?: DescribeInsightRulesRequest,
+    ) => Effect.Effect<
+      cloudwatch.DescribeInsightRulesOutput,
+      cloudwatch.DescribeInsightRulesError
+    >
+  >
+>()("AWS.CloudWatch.DescribeInsightRules") {}
+
+export const DescribeInsightRulesLive = Layer.effect(
+  DescribeInsightRules,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeInsightRulesPolicy;
+    const describeInsightRules = yield* cloudwatch.describeInsightRules;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: DescribeInsightRulesRequest = {}) {
+        return yield* describeInsightRules(request);
+      });
+    });
+  }),
+);
+
+export class DescribeInsightRulesPolicy extends Binding.Policy<
+  DescribeInsightRulesPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.DescribeInsightRules") {}
+
+export const DescribeInsightRulesPolicyLive =
+  DescribeInsightRulesPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DescribeInsightRules())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DescribeInsightRules"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeInsightRulesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DisableAlarmActions.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DisableAlarmActions.ts
new file mode 100644
index 00000000000..24ec27760bf
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DisableAlarmActions.ts
@@ -0,0 +1,74 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { type AlarmResource, sortAlarmResources } from "./binding-common.ts";
+
+type AlarmResources = [AlarmResource, ...AlarmResource[]];
+
+/**
+ * Runtime binding for `cloudwatch:DisableAlarmActions`.
+ */
+export class DisableAlarmActions extends Binding.Service<
+  DisableAlarmActions,
+  (
+    ...alarms: AlarmResources
+  ) => Effect.Effect<
+    () => Effect.Effect<cloudwatch.DisableAlarmActionsResponse, any>
+  >
+>()("AWS.CloudWatch.DisableAlarmActions") {}
+
+export const DisableAlarmActionsLive = Layer.effect(
+  DisableAlarmActions,
+  Effect.gen(function* () {
+    const Policy = yield* DisableAlarmActionsPolicy;
+    const disableAlarmActions = yield* cloudwatch.disableAlarmActions;
+
+    return Effect.fn(function* (...alarms: AlarmResources) {
+      const sorted = sortAlarmResources(alarms);
+      const AlarmNames = yield* Effect.forEach(sorted, (alarm) =>
+        alarm.alarmName.asEffect(),
+      );
+      yield* Policy(...sorted);
+
+      return Effect.fn(function* () {
+        return yield* disableAlarmActions({
+          AlarmNames: yield* Effect.forEach(
+            AlarmNames,
+            (alarmName) => alarmName,
+          ),
+        });
+      });
+    });
+  }),
+);
+
+export class DisableAlarmActionsPolicy extends Binding.Policy<
+  DisableAlarmActionsPolicy,
+  (...alarms: AlarmResources) => Effect.Effect<void>
+>()("AWS.CloudWatch.DisableAlarmActions") {}
+
+export const DisableAlarmActionsPolicyLive =
+  DisableAlarmActionsPolicy.layer.succeed(
+    Effect.fn(function* (host, ...alarms: AlarmResources) {
+      const sorted = sortAlarmResources(alarms);
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DisableAlarmActions(${sorted}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DisableAlarmActions"],
+                Resource: sorted.map((alarm) => alarm.alarmArn),
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DisableAlarmActionsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DisableInsightRules.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DisableInsightRules.ts
new file mode 100644
index 00000000000..de0c1ab6074
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/DisableInsightRules.ts
@@ -0,0 +1,74 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import {
+  sortInsightRuleResources,
+  type InsightRuleResource,
+} from "./binding-common.ts";
+
+type InsightRules = [InsightRuleResource, ...InsightRuleResource[]];
+
+/**
+ * Runtime binding for `cloudwatch:DisableInsightRules`.
+ */
+export class DisableInsightRules extends Binding.Service<
+  DisableInsightRules,
+  (
+    ...rules: InsightRules
+  ) => Effect.Effect<
+    () => Effect.Effect<cloudwatch.DisableInsightRulesOutput, any>
+  >
+>()("AWS.CloudWatch.DisableInsightRules") {}
+
+export const DisableInsightRulesLive = Layer.effect(
+  DisableInsightRules,
+  Effect.gen(function* () {
+    const Policy = yield* DisableInsightRulesPolicy;
+    const disableInsightRules = yield* cloudwatch.disableInsightRules;
+
+    return Effect.fn(function* (...rules: InsightRules) {
+      const sorted = sortInsightRuleResources(rules);
+      const RuleNames = yield* Effect.forEach(sorted, (rule) =>
+        rule.ruleName.asEffect(),
+      );
+      yield* Policy(...sorted);
+
+      return Effect.fn(function* () {
+        return yield* disableInsightRules({
+          RuleNames: yield* Effect.forEach(RuleNames, (ruleName) => ruleName),
+        });
+      });
+    });
+  }),
+);
+
+export class DisableInsightRulesPolicy extends Binding.Policy<
+  DisableInsightRulesPolicy,
+  (...rules: InsightRules) => Effect.Effect<void>
+>()("AWS.CloudWatch.DisableInsightRules") {}
+
+export const DisableInsightRulesPolicyLive =
+  DisableInsightRulesPolicy.layer.succeed(
+    Effect.fn(function* (host, ...rules: InsightRules) {
+      const sorted = sortInsightRuleResources(rules);
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.DisableInsightRules(${sorted}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:DisableInsightRules"],
+                Resource: sorted.map((rule) => rule.ruleArn),
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DisableInsightRulesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/EnableAlarmActions.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/EnableAlarmActions.ts
new file mode 100644
index 00000000000..22dfd69b056
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/EnableAlarmActions.ts
@@ -0,0 +1,74 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { type AlarmResource, sortAlarmResources } from "./binding-common.ts";
+
+type AlarmResources = [AlarmResource, ...AlarmResource[]];
+
+/**
+ * Runtime binding for `cloudwatch:EnableAlarmActions`.
+ */
+export class EnableAlarmActions extends Binding.Service<
+  EnableAlarmActions,
+  (
+    ...alarms: AlarmResources
+  ) => Effect.Effect<
+    () => Effect.Effect<cloudwatch.EnableAlarmActionsResponse, any>
+  >
+>()("AWS.CloudWatch.EnableAlarmActions") {}
+
+export const EnableAlarmActionsLive = Layer.effect(
+  EnableAlarmActions,
+  Effect.gen(function* () {
+    const Policy = yield* EnableAlarmActionsPolicy;
+    const enableAlarmActions = yield* cloudwatch.enableAlarmActions;
+
+    return Effect.fn(function* (...alarms: AlarmResources) {
+      const sorted = sortAlarmResources(alarms);
+      const AlarmNames = yield* Effect.forEach(sorted, (alarm) =>
+        alarm.alarmName.asEffect(),
+      );
+      yield* Policy(...sorted);
+
+      return Effect.fn(function* () {
+        return yield* enableAlarmActions({
+          AlarmNames: yield* Effect.forEach(
+            AlarmNames,
+            (alarmName) => alarmName,
+          ),
+        });
+      });
+    });
+  }),
+);
+
+export class EnableAlarmActionsPolicy extends Binding.Policy<
+  EnableAlarmActionsPolicy,
+  (...alarms: AlarmResources) => Effect.Effect<void>
+>()("AWS.CloudWatch.EnableAlarmActions") {}
+
+export const EnableAlarmActionsPolicyLive =
+  EnableAlarmActionsPolicy.layer.succeed(
+    Effect.fn(function* (host, ...alarms: AlarmResources) {
+      const sorted = sortAlarmResources(alarms);
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.EnableAlarmActions(${sorted}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:EnableAlarmActions"],
+                Resource: sorted.map((alarm) => alarm.alarmArn),
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `EnableAlarmActionsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetAlarmMuteRule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetAlarmMuteRule.ts
new file mode 100644
index 00000000000..fd2391e5b43
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetAlarmMuteRule.ts
@@ -0,0 +1,75 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { AlarmMuteRule } from "./AlarmMuteRule.ts";
+
+export interface GetAlarmMuteRuleRequest extends Omit<
+  cloudwatch.GetAlarmMuteRuleInput,
+  "AlarmMuteRuleName"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:GetAlarmMuteRule`.
+ */
+export class GetAlarmMuteRule extends Binding.Service<
+  GetAlarmMuteRule,
+  (
+    rule: AlarmMuteRule,
+  ) => Effect.Effect<
+    (
+      request?: GetAlarmMuteRuleRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetAlarmMuteRuleOutput,
+      cloudwatch.GetAlarmMuteRuleError
+    >
+  >
+>()("AWS.CloudWatch.GetAlarmMuteRule") {}
+
+export const GetAlarmMuteRuleLive = Layer.effect(
+  GetAlarmMuteRule,
+  Effect.gen(function* () {
+    const Policy = yield* GetAlarmMuteRulePolicy;
+    const getAlarmMuteRule = yield* cloudwatch.getAlarmMuteRule;
+
+    return Effect.fn(function* (rule: AlarmMuteRule) {
+      const AlarmMuteRuleName = yield* rule.alarmMuteRuleName;
+      yield* Policy(rule);
+
+      return Effect.fn(function* (request: GetAlarmMuteRuleRequest = {}) {
+        return yield* getAlarmMuteRule({
+          ...request,
+          AlarmMuteRuleName: yield* AlarmMuteRuleName,
+        });
+      });
+    });
+  }),
+);
+
+export class GetAlarmMuteRulePolicy extends Binding.Policy<
+  GetAlarmMuteRulePolicy,
+  (rule: AlarmMuteRule) => Effect.Effect<void>
+>()("AWS.CloudWatch.GetAlarmMuteRule") {}
+
+export const GetAlarmMuteRulePolicyLive = GetAlarmMuteRulePolicy.layer.succeed(
+  Effect.fn(function* (host, rule) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.GetAlarmMuteRule(${rule}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:GetAlarmMuteRule"],
+              Resource: [rule.alarmMuteRuleArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `GetAlarmMuteRulePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetDashboard.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetDashboard.ts
new file mode 100644
index 00000000000..de7eeee6210
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetDashboard.ts
@@ -0,0 +1,75 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Dashboard } from "./Dashboard.ts";
+
+export interface GetDashboardRequest extends Omit<
+  cloudwatch.GetDashboardInput,
+  "DashboardName"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:GetDashboard`.
+ */
+export class GetDashboard extends Binding.Service<
+  GetDashboard,
+  (
+    dashboard: Dashboard,
+  ) => Effect.Effect<
+    (
+      request?: GetDashboardRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetDashboardOutput,
+      cloudwatch.GetDashboardError
+    >
+  >
+>()("AWS.CloudWatch.GetDashboard") {}
+
+export const GetDashboardLive = Layer.effect(
+  GetDashboard,
+  Effect.gen(function* () {
+    const Policy = yield* GetDashboardPolicy;
+    const getDashboard = yield* cloudwatch.getDashboard;
+
+    return Effect.fn(function* (dashboard: Dashboard) {
+      const DashboardName = yield* dashboard.dashboardName;
+      yield* Policy(dashboard);
+
+      return Effect.fn(function* (request: GetDashboardRequest = {}) {
+        return yield* getDashboard({
+          ...request,
+          DashboardName: yield* DashboardName,
+        });
+      });
+    });
+  }),
+);
+
+export class GetDashboardPolicy extends Binding.Policy<
+  GetDashboardPolicy,
+  (dashboard: Dashboard) => Effect.Effect<void>
+>()("AWS.CloudWatch.GetDashboard") {}
+
+export const GetDashboardPolicyLive = GetDashboardPolicy.layer.succeed(
+  Effect.fn(function* (host, dashboard) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.GetDashboard(${dashboard}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:GetDashboard"],
+              Resource: [dashboard.dashboardArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `GetDashboardPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetInsightRuleReport.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetInsightRuleReport.ts
new file mode 100644
index 00000000000..ecd346f82a6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetInsightRuleReport.ts
@@ -0,0 +1,76 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { InsightRule } from "./InsightRule.ts";
+
+export interface GetInsightRuleReportRequest extends Omit<
+  cloudwatch.GetInsightRuleReportInput,
+  "RuleName"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:GetInsightRuleReport`.
+ */
+export class GetInsightRuleReport extends Binding.Service<
+  GetInsightRuleReport,
+  (
+    rule: InsightRule,
+  ) => Effect.Effect<
+    (
+      request: GetInsightRuleReportRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetInsightRuleReportOutput,
+      cloudwatch.GetInsightRuleReportError
+    >
+  >
+>()("AWS.CloudWatch.GetInsightRuleReport") {}
+
+export const GetInsightRuleReportLive = Layer.effect(
+  GetInsightRuleReport,
+  Effect.gen(function* () {
+    const Policy = yield* GetInsightRuleReportPolicy;
+    const getInsightRuleReport = yield* cloudwatch.getInsightRuleReport;
+
+    return Effect.fn(function* (rule: InsightRule) {
+      const RuleName = yield* rule.ruleName;
+      yield* Policy(rule);
+
+      return Effect.fn(function* (request: GetInsightRuleReportRequest) {
+        return yield* getInsightRuleReport({
+          ...request,
+          RuleName: yield* RuleName,
+        });
+      });
+    });
+  }),
+);
+
+export class GetInsightRuleReportPolicy extends Binding.Policy<
+  GetInsightRuleReportPolicy,
+  (rule: InsightRule) => Effect.Effect<void>
+>()("AWS.CloudWatch.GetInsightRuleReport") {}
+
+export const GetInsightRuleReportPolicyLive =
+  GetInsightRuleReportPolicy.layer.succeed(
+    Effect.fn(function* (host, rule) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.GetInsightRuleReport(${rule}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:GetInsightRuleReport"],
+                Resource: [rule.ruleArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `GetInsightRuleReportPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricData.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricData.ts
new file mode 100644
index 00000000000..ccc28fcf95c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricData.ts
@@ -0,0 +1,62 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface GetMetricDataRequest extends cloudwatch.GetMetricDataInput {}
+
+/**
+ * Runtime binding for `cloudwatch:GetMetricData`.
+ */
+export class GetMetricData extends Binding.Service<
+  GetMetricData,
+  () => Effect.Effect<
+    (
+      request: GetMetricDataRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetMetricDataOutput,
+      cloudwatch.GetMetricDataError
+    >
+  >
+>()("AWS.CloudWatch.GetMetricData") {}
+
+export const GetMetricDataLive = Layer.effect(
+  GetMetricData,
+  Effect.gen(function* () {
+    const Policy = yield* GetMetricDataPolicy;
+    const getMetricData = yield* cloudwatch.getMetricData;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: GetMetricDataRequest) {
+        return yield* getMetricData(request);
+      });
+    });
+  }),
+);
+
+export class GetMetricDataPolicy extends Binding.Policy<
+  GetMetricDataPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.GetMetricData") {}
+
+export const GetMetricDataPolicyLive = GetMetricDataPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.GetMetricData())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["cloudwatch:GetMetricData"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `GetMetricDataPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricStatistics.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricStatistics.ts
new file mode 100644
index 00000000000..2784af63297
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricStatistics.ts
@@ -0,0 +1,64 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface GetMetricStatisticsRequest
+  extends cloudwatch.GetMetricStatisticsInput {}
+
+/**
+ * Runtime binding for `cloudwatch:GetMetricStatistics`.
+ */
+export class GetMetricStatistics extends Binding.Service<
+  GetMetricStatistics,
+  () => Effect.Effect<
+    (
+      request: GetMetricStatisticsRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetMetricStatisticsOutput,
+      cloudwatch.GetMetricStatisticsError
+    >
+  >
+>()("AWS.CloudWatch.GetMetricStatistics") {}
+
+export const GetMetricStatisticsLive = Layer.effect(
+  GetMetricStatistics,
+  Effect.gen(function* () {
+    const Policy = yield* GetMetricStatisticsPolicy;
+    const getMetricStatistics = yield* cloudwatch.getMetricStatistics;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: GetMetricStatisticsRequest) {
+        return yield* getMetricStatistics(request);
+      });
+    });
+  }),
+);
+
+export class GetMetricStatisticsPolicy extends Binding.Policy<
+  GetMetricStatisticsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.GetMetricStatistics") {}
+
+export const GetMetricStatisticsPolicyLive =
+  GetMetricStatisticsPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.GetMetricStatistics())`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:GetMetricStatistics"],
+              Resource: ["*"],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `GetMetricStatisticsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricStream.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricStream.ts
new file mode 100644
index 00000000000..bbe9566394b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricStream.ts
@@ -0,0 +1,75 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { MetricStream } from "./MetricStream.ts";
+
+export interface GetMetricStreamRequest extends Omit<
+  cloudwatch.GetMetricStreamInput,
+  "Name"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:GetMetricStream`.
+ */
+export class GetMetricStream extends Binding.Service<
+  GetMetricStream,
+  (
+    metricStream: MetricStream,
+  ) => Effect.Effect<
+    (
+      request?: GetMetricStreamRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetMetricStreamOutput,
+      cloudwatch.GetMetricStreamError
+    >
+  >
+>()("AWS.CloudWatch.GetMetricStream") {}
+
+export const GetMetricStreamLive = Layer.effect(
+  GetMetricStream,
+  Effect.gen(function* () {
+    const Policy = yield* GetMetricStreamPolicy;
+    const getMetricStream = yield* cloudwatch.getMetricStream;
+
+    return Effect.fn(function* (metricStream: MetricStream) {
+      const Name = yield* metricStream.metricStreamName;
+      yield* Policy(metricStream);
+
+      return Effect.fn(function* (request: GetMetricStreamRequest = {}) {
+        return yield* getMetricStream({
+          ...request,
+          Name: yield* Name,
+        });
+      });
+    });
+  }),
+);
+
+export class GetMetricStreamPolicy extends Binding.Policy<
+  GetMetricStreamPolicy,
+  (metricStream: MetricStream) => Effect.Effect<void>
+>()("AWS.CloudWatch.GetMetricStream") {}
+
+export const GetMetricStreamPolicyLive = GetMetricStreamPolicy.layer.succeed(
+  Effect.fn(function* (host, metricStream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.GetMetricStream(${metricStream}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:GetMetricStream"],
+              Resource: [metricStream.metricStreamArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `GetMetricStreamPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricWidgetImage.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricWidgetImage.ts
new file mode 100644
index 00000000000..41939092496
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/GetMetricWidgetImage.ts
@@ -0,0 +1,66 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface GetMetricWidgetImageRequest
+  extends cloudwatch.GetMetricWidgetImageInput {}
+
+/**
+ * Runtime binding for `cloudwatch:GetMetricWidgetImage`.
+ */
+export class GetMetricWidgetImage extends Binding.Service<
+  GetMetricWidgetImage,
+  () => Effect.Effect<
+    (
+      request: GetMetricWidgetImageRequest,
+    ) => Effect.Effect<
+      cloudwatch.GetMetricWidgetImageOutput,
+      cloudwatch.GetMetricWidgetImageError
+    >
+  >
+>()("AWS.CloudWatch.GetMetricWidgetImage") {}
+
+export const GetMetricWidgetImageLive = Layer.effect(
+  GetMetricWidgetImage,
+  Effect.gen(function* () {
+    const Policy = yield* GetMetricWidgetImagePolicy;
+    const getMetricWidgetImage = yield* cloudwatch.getMetricWidgetImage;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: GetMetricWidgetImageRequest) {
+        return yield* getMetricWidgetImage(request);
+      });
+    });
+  }),
+);
+
+export class GetMetricWidgetImagePolicy extends Binding.Policy<
+  GetMetricWidgetImagePolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.GetMetricWidgetImage") {}
+
+export const GetMetricWidgetImagePolicyLive =
+  GetMetricWidgetImagePolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.GetMetricWidgetImage())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:GetMetricWidgetImage"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `GetMetricWidgetImagePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/InsightRule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/InsightRule.ts
new file mode 100644
index 00000000000..ed9e11aee1c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/InsightRule.ts
@@ -0,0 +1,255 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import {
+  createName,
+  readResourceTags,
+  retryConcurrent,
+  updateResourceTags,
+} from "./common.ts";
+
+export type InsightRuleName = string;
+export type InsightRuleArn =
+  `arn:aws:cloudwatch:${RegionID}:${AccountID}:insight-rule/${string}`;
+
+export interface CloudWatchLogRuleFilter {
+  Match: string;
+  In: string[];
+}
+
+export interface CloudWatchLogRuleDefinition {
+  Schema: {
+    Name: "CloudWatchLogRule";
+    Version: 1;
+  };
+  LogGroupNames?: string[];
+  LogGroupARNs?: string[];
+  LogFormat: "JSON" | "CLF" | (string & {});
+  Contribution: {
+    Keys: string[];
+    ValueOf?: string;
+    Filters?: CloudWatchLogRuleFilter[];
+  };
+  AggregateOn: "Count" | "Sum" | (string & {});
+}
+
+export interface InsightRuleProps extends Omit<
+  cloudwatch.PutInsightRuleInput,
+  "RuleDefinition" | "RuleName" | "Tags"
+> {
+  /**
+   * Name of the insight rule. If omitted, a unique name is generated.
+   */
+  name?: InsightRuleName;
+  /**
+   * Optional tags to apply to the insight rule.
+   */
+  tags?: Record<string, string>;
+  /**
+   * Typed Contributor Insights rule definition. The provider serializes this
+   * object to the JSON string expected by the CloudWatch API.
+   */
+  RuleDefinition?: CloudWatchLogRuleDefinition;
+}
+
+export interface InsightRule extends Resource<
+  "AWS.CloudWatch.InsightRule",
+  InsightRuleProps,
+  {
+    ruleName: InsightRuleName;
+    ruleArn: InsightRuleArn;
+    state: string | undefined;
+    insightRule: cloudwatch.InsightRule;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch Contributor Insights rule.
+ *
+ * @section Creating Insight Rules
+ * @example Rule Definition
+ * ```typescript
+ * const rule = yield* InsightRule("TopContributors", {
+ *   RuleState: "ENABLED",
+ *   RuleDefinition: {
+ *     Schema: {
+ *       Name: "CloudWatchLogRule",
+ *       Version: 1,
+ *     },
+ *     LogFormat: "JSON",
+ *     Contribution: {
+ *       Keys: ["$.ip"],
+ *     },
+ *     AggregateOn: "Count",
+ *   },
+ * });
+ * ```
+ */
+export const InsightRule = Resource<InsightRule>("AWS.CloudWatch.InsightRule");
+
+const failureMessage = (failures: cloudwatch.PartialFailure[] | undefined) =>
+  (failures ?? [])
+    .map(
+      (failure) =>
+        `${failure.FailureResource ?? "unknown"}: ${failure.FailureCode ?? failure.ExceptionType ?? "failed"}`,
+    )
+    .join(", ");
+
+const toPutInsightRuleInput = ({
+  RuleDefinition,
+  ...input
+}: InsightRuleProps): cloudwatch.PutInsightRuleInput => ({
+  ...input,
+  RuleDefinition: RuleDefinition ? JSON.stringify(RuleDefinition) : undefined,
+});
+
+export const InsightRuleProvider = () =>
+  Provider.effect(
+    InsightRule,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createRuleName = (id: string, props: { name?: string } = {}) =>
+        createName(id, props.name, 255);
+
+      const ruleArn = (name: string) =>
+        `arn:aws:cloudwatch:${region}:${accountId}:insight-rule/${name}` as InsightRuleArn;
+
+      const readInsightRule = Effect.fn(function* (name: string) {
+        const insightRule = yield* cloudwatch.describeInsightRules
+          .pages({})
+          .pipe(
+            Stream.mapEffect(
+              Effect.fn(function* (page) {
+                return page.InsightRules?.find(
+                  (candidate) => candidate.Name === name,
+                );
+              }),
+            ),
+            Stream.filter((candidate) => candidate !== undefined),
+            Stream.runHead,
+            Effect.map(Option.getOrUndefined),
+          );
+
+        if (!insightRule?.Name) {
+          return undefined;
+        }
+
+        const arn = ruleArn(insightRule.Name);
+        const tags = yield* readResourceTags(arn).pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed({}),
+          ),
+        );
+
+        return {
+          ruleName: insightRule.Name,
+          ruleArn: arn,
+          state: insightRule.State,
+          insightRule,
+          tags,
+        };
+      });
+
+      return {
+        stables: ["ruleName", "ruleArn"],
+        diff: Effect.fn(function* ({
+          id,
+          olds = {},
+          news = {} as Input<InsightRuleProps>,
+        }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = yield* createRuleName(id, olds);
+          const newName = yield* createRuleName(id, news);
+
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.ruleName ?? (yield* createRuleName(id, olds ?? {}));
+          const state = yield* readInsightRule(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — pin the physical name from `output` if present;
+          // otherwise derive from desired props. Read whatever exists in
+          // CloudWatch so we have a baseline for tag-diffing on adoption.
+          const name = output?.ruleName ?? (yield* createRuleName(id, news));
+          const existing = yield* readInsightRule(name);
+
+          // Ensure — `putInsightRule` is an upsert; sending the full
+          // desired config every reconcile converges the cloud.
+          yield* retryConcurrent(
+            cloudwatch.putInsightRule({
+              ...toPutInsightRuleInput(news),
+              RuleName: name,
+            }),
+          );
+
+          // Sync tags — diff against `olds.tags` when we have prior state,
+          // otherwise fall back to what we observed. Adoption flows take
+          // the latter path.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceArn: ruleArn(name),
+            olds: olds?.tags ?? existing?.tags,
+            news: news.tags,
+          });
+
+          yield* session.note(ruleArn(name));
+
+          const state = yield* readInsightRule(name);
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled insight rule '${name}'`),
+            );
+          }
+
+          return {
+            ...state,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const existing = yield* readInsightRule(output.ruleName);
+          if (!existing) {
+            return;
+          }
+
+          const response = yield* retryConcurrent(
+            cloudwatch.deleteInsightRules({
+              RuleNames: [output.ruleName],
+            }),
+          );
+
+          if ((response.Failures?.length ?? 0) > 0) {
+            return yield* Effect.fail(
+              new Error(
+                `failed to delete insight rule '${output.ruleName}': ${failureMessage(response.Failures)}`,
+              ),
+            );
+          }
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListAlarmMuteRules.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListAlarmMuteRules.ts
new file mode 100644
index 00000000000..b783b818e61
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListAlarmMuteRules.ts
@@ -0,0 +1,64 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListAlarmMuteRulesRequest
+  extends cloudwatch.ListAlarmMuteRulesInput {}
+
+/**
+ * Runtime binding for `cloudwatch:ListAlarmMuteRules`.
+ */
+export class ListAlarmMuteRules extends Binding.Service<
+  ListAlarmMuteRules,
+  () => Effect.Effect<
+    (
+      request?: ListAlarmMuteRulesRequest,
+    ) => Effect.Effect<
+      cloudwatch.ListAlarmMuteRulesOutput,
+      cloudwatch.ListAlarmMuteRulesError
+    >
+  >
+>()("AWS.CloudWatch.ListAlarmMuteRules") {}
+
+export const ListAlarmMuteRulesLive = Layer.effect(
+  ListAlarmMuteRules,
+  Effect.gen(function* () {
+    const Policy = yield* ListAlarmMuteRulesPolicy;
+    const listAlarmMuteRules = yield* cloudwatch.listAlarmMuteRules;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: ListAlarmMuteRulesRequest = {}) {
+        return yield* listAlarmMuteRules(request);
+      });
+    });
+  }),
+);
+
+export class ListAlarmMuteRulesPolicy extends Binding.Policy<
+  ListAlarmMuteRulesPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.ListAlarmMuteRules") {}
+
+export const ListAlarmMuteRulesPolicyLive =
+  ListAlarmMuteRulesPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.ListAlarmMuteRules())`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:ListAlarmMuteRules"],
+              Resource: ["*"],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `ListAlarmMuteRulesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListDashboards.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListDashboards.ts
new file mode 100644
index 00000000000..772d16f58b2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListDashboards.ts
@@ -0,0 +1,62 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListDashboardsRequest extends cloudwatch.ListDashboardsInput {}
+
+/**
+ * Runtime binding for `cloudwatch:ListDashboards`.
+ */
+export class ListDashboards extends Binding.Service<
+  ListDashboards,
+  () => Effect.Effect<
+    (
+      request?: ListDashboardsRequest,
+    ) => Effect.Effect<
+      cloudwatch.ListDashboardsOutput,
+      cloudwatch.ListDashboardsError
+    >
+  >
+>()("AWS.CloudWatch.ListDashboards") {}
+
+export const ListDashboardsLive = Layer.effect(
+  ListDashboards,
+  Effect.gen(function* () {
+    const Policy = yield* ListDashboardsPolicy;
+    const listDashboards = yield* cloudwatch.listDashboards;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: ListDashboardsRequest = {}) {
+        return yield* listDashboards(request);
+      });
+    });
+  }),
+);
+
+export class ListDashboardsPolicy extends Binding.Policy<
+  ListDashboardsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.ListDashboards") {}
+
+export const ListDashboardsPolicyLive = ListDashboardsPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.ListDashboards())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["cloudwatch:ListDashboards"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListDashboardsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListManagedInsightRules.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListManagedInsightRules.ts
new file mode 100644
index 00000000000..7daf5673f8d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListManagedInsightRules.ts
@@ -0,0 +1,68 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListManagedInsightRulesRequest
+  extends cloudwatch.ListManagedInsightRulesInput {}
+
+/**
+ * Runtime binding for `cloudwatch:ListManagedInsightRules`.
+ */
+export class ListManagedInsightRules extends Binding.Service<
+  ListManagedInsightRules,
+  () => Effect.Effect<
+    (
+      request?: ListManagedInsightRulesRequest,
+    ) => Effect.Effect<
+      cloudwatch.ListManagedInsightRulesOutput,
+      cloudwatch.ListManagedInsightRulesError
+    >
+  >
+>()("AWS.CloudWatch.ListManagedInsightRules") {}
+
+export const ListManagedInsightRulesLive = Layer.effect(
+  ListManagedInsightRules,
+  Effect.gen(function* () {
+    const Policy = yield* ListManagedInsightRulesPolicy;
+    const listManagedInsightRules = yield* cloudwatch.listManagedInsightRules;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (
+        request: ListManagedInsightRulesRequest = {},
+      ) {
+        return yield* listManagedInsightRules(request);
+      });
+    });
+  }),
+);
+
+export class ListManagedInsightRulesPolicy extends Binding.Policy<
+  ListManagedInsightRulesPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.ListManagedInsightRules") {}
+
+export const ListManagedInsightRulesPolicyLive =
+  ListManagedInsightRulesPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.ListManagedInsightRules())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:ListManagedInsightRules"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListManagedInsightRulesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListMetricStreams.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListMetricStreams.ts
new file mode 100644
index 00000000000..0e503cfef74
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListMetricStreams.ts
@@ -0,0 +1,64 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListMetricStreamsRequest
+  extends cloudwatch.ListMetricStreamsInput {}
+
+/**
+ * Runtime binding for `cloudwatch:ListMetricStreams`.
+ */
+export class ListMetricStreams extends Binding.Service<
+  ListMetricStreams,
+  () => Effect.Effect<
+    (
+      request?: ListMetricStreamsRequest,
+    ) => Effect.Effect<
+      cloudwatch.ListMetricStreamsOutput,
+      cloudwatch.ListMetricStreamsError
+    >
+  >
+>()("AWS.CloudWatch.ListMetricStreams") {}
+
+export const ListMetricStreamsLive = Layer.effect(
+  ListMetricStreams,
+  Effect.gen(function* () {
+    const Policy = yield* ListMetricStreamsPolicy;
+    const listMetricStreams = yield* cloudwatch.listMetricStreams;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: ListMetricStreamsRequest = {}) {
+        return yield* listMetricStreams(request);
+      });
+    });
+  }),
+);
+
+export class ListMetricStreamsPolicy extends Binding.Policy<
+  ListMetricStreamsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.ListMetricStreams") {}
+
+export const ListMetricStreamsPolicyLive =
+  ListMetricStreamsPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.ListMetricStreams())`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["cloudwatch:ListMetricStreams"],
+              Resource: ["*"],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `ListMetricStreamsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListMetrics.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListMetrics.ts
new file mode 100644
index 00000000000..4c98111174e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListMetrics.ts
@@ -0,0 +1,62 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListMetricsRequest extends cloudwatch.ListMetricsInput {}
+
+/**
+ * Runtime binding for `cloudwatch:ListMetrics`.
+ */
+export class ListMetrics extends Binding.Service<
+  ListMetrics,
+  () => Effect.Effect<
+    (
+      request?: ListMetricsRequest,
+    ) => Effect.Effect<
+      cloudwatch.ListMetricsOutput,
+      cloudwatch.ListMetricsError
+    >
+  >
+>()("AWS.CloudWatch.ListMetrics") {}
+
+export const ListMetricsLive = Layer.effect(
+  ListMetrics,
+  Effect.gen(function* () {
+    const Policy = yield* ListMetricsPolicy;
+    const listMetrics = yield* cloudwatch.listMetrics;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: ListMetricsRequest = {}) {
+        return yield* listMetrics(request);
+      });
+    });
+  }),
+);
+
+export class ListMetricsPolicy extends Binding.Policy<
+  ListMetricsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.ListMetrics") {}
+
+export const ListMetricsPolicyLive = ListMetricsPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.ListMetrics())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["cloudwatch:ListMetrics"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListMetricsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListTagsForResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListTagsForResource.ts
new file mode 100644
index 00000000000..593ff60ace7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/ListTagsForResource.ts
@@ -0,0 +1,79 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import {
+  getTaggableResourceArn,
+  type TaggableResource,
+} from "./binding-common.ts";
+
+export interface ListTagsForResourceRequest extends Omit<
+  cloudwatch.ListTagsForResourceInput,
+  "ResourceARN"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:ListTagsForResource`.
+ */
+export class ListTagsForResource extends Binding.Service<
+  ListTagsForResource,
+  (
+    resource: TaggableResource,
+  ) => Effect.Effect<
+    (
+      request?: ListTagsForResourceRequest,
+    ) => Effect.Effect<
+      cloudwatch.ListTagsForResourceOutput,
+      cloudwatch.ListTagsForResourceError
+    >
+  >
+>()("AWS.CloudWatch.ListTagsForResource") {}
+
+export const ListTagsForResourceLive = Layer.effect(
+  ListTagsForResource,
+  Effect.gen(function* () {
+    const Policy = yield* ListTagsForResourcePolicy;
+    const listTagsForResource = yield* cloudwatch.listTagsForResource;
+
+    return Effect.fn(function* (resource: TaggableResource) {
+      const ResourceARN = yield* getTaggableResourceArn(resource);
+      yield* Policy(resource);
+
+      return Effect.fn(function* (request: ListTagsForResourceRequest = {}) {
+        return yield* listTagsForResource({
+          ...request,
+          ResourceARN: yield* ResourceARN,
+        });
+      });
+    });
+  }),
+);
+
+export class ListTagsForResourcePolicy extends Binding.Policy<
+  ListTagsForResourcePolicy,
+  (resource: TaggableResource) => Effect.Effect<void>
+>()("AWS.CloudWatch.ListTagsForResource") {}
+
+export const ListTagsForResourcePolicyLive =
+  ListTagsForResourcePolicy.layer.succeed(
+    Effect.fn(function* (host, resource) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.CloudWatch.ListTagsForResource(${resource}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["cloudwatch:ListTagsForResource"],
+                Resource: [getTaggableResourceArn(resource)],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListTagsForResourcePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/MetricStream.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/MetricStream.ts
new file mode 100644
index 00000000000..39c84cd945a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/MetricStream.ts
@@ -0,0 +1,239 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import {
+  createName,
+  readResourceTags,
+  retryConcurrent,
+  updateResourceTags,
+} from "./common.ts";
+
+export type MetricStreamName = string;
+export type MetricStreamArn =
+  `arn:aws:cloudwatch:${RegionID}:${AccountID}:metric-stream/${string}`;
+
+export interface MetricStreamProps extends Omit<
+  cloudwatch.PutMetricStreamInput,
+  "Name" | "Tags"
+> {
+  /**
+   * Name of the metric stream. If omitted, a unique name is generated.
+   */
+  name?: MetricStreamName;
+  /**
+   * Whether the stream should be running after deployment.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Optional tags to apply to the metric stream.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface MetricStream extends Resource<
+  "AWS.CloudWatch.MetricStream",
+  MetricStreamProps,
+  {
+    metricStreamName: MetricStreamName;
+    metricStreamArn: MetricStreamArn;
+    state: string | undefined;
+    metricStream: cloudwatch.GetMetricStreamOutput;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch metric stream.
+ *
+ * @section Creating Metric Streams
+ * @example Firehose Delivery Stream
+ * ```typescript
+ * const stream = yield* MetricStream("MetricsExport", {
+ *   FirehoseArn: "arn:aws:firehose:us-east-1:123456789012:deliverystream/example",
+ *   RoleArn: "arn:aws:iam::123456789012:role/example",
+ *   OutputFormat: "json",
+ * });
+ * ```
+ */
+export const MetricStream = Resource<MetricStream>(
+  "AWS.CloudWatch.MetricStream",
+);
+
+export const MetricStreamProvider = () =>
+  Provider.effect(
+    MetricStream,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+      const createMetricStreamName = (
+        id: string,
+        props: { name?: string } = {},
+      ) => createName(id, props.name, 255);
+
+      const metricStreamArn = (name: string) =>
+        `arn:aws:cloudwatch:${region}:${accountId}:metric-stream/${name}` as MetricStreamArn;
+
+      const readMetricStream = Effect.fn(function* (name: string) {
+        const output = yield* cloudwatch
+          .getMetricStream({
+            Name: name,
+          })
+          .pipe(
+            Effect.catchTag("InvalidParameterValueException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!output?.Name || !output.Arn) {
+          return undefined;
+        }
+
+        const tags = yield* readResourceTags(output.Arn).pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed({}),
+          ),
+          Effect.catchTag("InvalidParameterValueException", () =>
+            Effect.succeed({}),
+          ),
+        );
+
+        return {
+          metricStreamName: output.Name,
+          metricStreamArn: output.Arn as MetricStreamArn,
+          state: output.State,
+          metricStream: output,
+          tags,
+        };
+      });
+
+      const syncMetricStreamState = Effect.fn(function* ({
+        name,
+        enabled,
+      }: {
+        name: string;
+        enabled: boolean | undefined;
+      }) {
+        if (enabled === false) {
+          yield* retryConcurrent(
+            cloudwatch.stopMetricStreams({
+              Names: [name],
+            }),
+          );
+          return;
+        }
+
+        yield* retryConcurrent(
+          cloudwatch.startMetricStreams({
+            Names: [name],
+          }),
+        );
+      });
+
+      return {
+        stables: ["metricStreamName", "metricStreamArn"],
+        diff: Effect.fn(function* ({
+          id,
+          olds = {},
+          news = {} as Input<MetricStreamProps>,
+        }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = yield* createMetricStreamName(id, olds);
+          const newName = yield* createMetricStreamName(id, news);
+
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.metricStreamName ??
+            (yield* createMetricStreamName(id, olds ?? {}));
+          const state = yield* readMetricStream(name);
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, output, session }) {
+          // Observe — pin the physical name from `output` if present;
+          // otherwise derive from desired props. Read existing so we have
+          // a baseline for tag-diffing on adoption.
+          const name =
+            output?.metricStreamName ??
+            (yield* createMetricStreamName(id, news));
+          const existing = yield* readMetricStream(name);
+
+          // Ensure — `putMetricStream` is an upsert; we send the full
+          // desired config every reconcile.
+          yield* retryConcurrent(
+            cloudwatch.putMetricStream({
+              ...news,
+              Name: name,
+            }),
+          );
+
+          // Sync running state — `enabled` drives start/stop independently
+          // of the put call.
+          yield* syncMetricStreamState({
+            name,
+            enabled: news.enabled,
+          });
+
+          // Sync tags — diff against `olds.tags` when we have prior state,
+          // otherwise fall back to what we observed (adoption path).
+          const tags = yield* updateResourceTags({
+            id,
+            resourceArn: metricStreamArn(name),
+            olds: olds?.tags ?? existing?.tags,
+            news: news.tags,
+          });
+
+          yield* session.note(metricStreamArn(name));
+
+          const state = yield* readMetricStream(name);
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled metric stream '${name}'`),
+            );
+          }
+
+          return {
+            ...state,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const existing = yield* readMetricStream(output.metricStreamName);
+          if (!existing) {
+            return;
+          }
+
+          yield* retryConcurrent(
+            cloudwatch.deleteMetricStream({
+              Name: output.metricStreamName,
+            }),
+          ).pipe(
+            Effect.catchTag(
+              "InvalidParameterValueException",
+              () => Effect.void,
+            ),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/PutMetricData.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/PutMetricData.ts
new file mode 100644
index 00000000000..252eb961d3a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/PutMetricData.ts
@@ -0,0 +1,62 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface PutMetricDataRequest extends cloudwatch.PutMetricDataInput {}
+
+/**
+ * Runtime binding for `cloudwatch:PutMetricData`.
+ */
+export class PutMetricData extends Binding.Service<
+  PutMetricData,
+  () => Effect.Effect<
+    (
+      request: PutMetricDataRequest,
+    ) => Effect.Effect<
+      cloudwatch.PutMetricDataResponse,
+      cloudwatch.PutMetricDataError
+    >
+  >
+>()("AWS.CloudWatch.PutMetricData") {}
+
+export const PutMetricDataLive = Layer.effect(
+  PutMetricData,
+  Effect.gen(function* () {
+    const Policy = yield* PutMetricDataPolicy;
+    const putMetricData = yield* cloudwatch.putMetricData;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: PutMetricDataRequest) {
+        return yield* putMetricData(request);
+      });
+    });
+  }),
+);
+
+export class PutMetricDataPolicy extends Binding.Policy<
+  PutMetricDataPolicy,
+  () => Effect.Effect<void>
+>()("AWS.CloudWatch.PutMetricData") {}
+
+export const PutMetricDataPolicyLive = PutMetricDataPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.PutMetricData())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["cloudwatch:PutMetricData"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PutMetricDataPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/SetAlarmState.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/SetAlarmState.ts
new file mode 100644
index 00000000000..aaf3cbe7e48
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/SetAlarmState.ts
@@ -0,0 +1,73 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { AlarmResource } from "./binding-common.ts";
+
+export interface SetAlarmStateRequest extends Omit<
+  cloudwatch.SetAlarmStateInput,
+  "AlarmName"
+> {}
+
+/**
+ * Runtime binding for `cloudwatch:SetAlarmState`.
+ */
+export class SetAlarmState extends Binding.Service<
+  SetAlarmState,
+  (
+    alarm: AlarmResource,
+  ) => Effect.Effect<
+    (
+      request: SetAlarmStateRequest,
+    ) => Effect.Effect<
+      cloudwatch.SetAlarmStateResponse,
+      cloudwatch.SetAlarmStateError
+    >
+  >
+>()("AWS.CloudWatch.SetAlarmState") {}
+
+export const SetAlarmStateLive = Layer.effect(
+  SetAlarmState,
+  Effect.gen(function* () {
+    const Policy = yield* SetAlarmStatePolicy;
+    const setAlarmState = yield* cloudwatch.setAlarmState;
+
+    return Effect.fn(function* (alarm: AlarmResource) {
+      const AlarmName = yield* alarm.alarmName;
+      yield* Policy(alarm);
+
+      return Effect.fn(function* (request: SetAlarmStateRequest) {
+        return yield* setAlarmState({
+          ...request,
+          AlarmName: yield* AlarmName,
+        });
+      });
+    });
+  }),
+);
+
+export class SetAlarmStatePolicy extends Binding.Policy<
+  SetAlarmStatePolicy,
+  (alarm: AlarmResource) => Effect.Effect<void>
+>()("AWS.CloudWatch.SetAlarmState") {}
+
+export const SetAlarmStatePolicyLive = SetAlarmStatePolicy.layer.succeed(
+  Effect.fn(function* (host, alarm) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.CloudWatch.SetAlarmState(${alarm}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["cloudwatch:SetAlarmState"],
+            Resource: [alarm.alarmArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `SetAlarmStatePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/alarmStateChanges.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/alarmStateChanges.ts
new file mode 100644
index 00000000000..2ca2a41d8ef
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/alarmStateChanges.ts
@@ -0,0 +1,24 @@
+import type { StateValue } from "@distilled.cloud/aws/cloudwatch";
+
+export interface AlarmStateChangesOptions {
+  alarmNames?: string[];
+  states?: StateValue[];
+  previousStates?: StateValue[];
+}
+
+/**
+ * Builds an EventBridge event pattern for CloudWatch alarm state changes.
+ */
+export const alarmStateChanges = ({
+  alarmNames,
+  states,
+  previousStates,
+}: AlarmStateChangesOptions = {}) => ({
+  source: ["aws.cloudwatch"],
+  "detail-type": ["CloudWatch Alarm State Change"],
+  detail: {
+    ...(alarmNames ? { alarmName: alarmNames } : {}),
+    ...(states ? { state: { value: states } } : {}),
+    ...(previousStates ? { previousState: { value: previousStates } } : {}),
+  },
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/binding-common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/binding-common.ts
new file mode 100644
index 00000000000..b12dc89e7f7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/binding-common.ts
@@ -0,0 +1,42 @@
+import type { Alarm } from "./Alarm.ts";
+import type { AlarmMuteRule } from "./AlarmMuteRule.ts";
+import type { CompositeAlarm } from "./CompositeAlarm.ts";
+import type { Dashboard } from "./Dashboard.ts";
+import type { InsightRule } from "./InsightRule.ts";
+import type { MetricStream } from "./MetricStream.ts";
+import { sortByLogicalId } from "./common.ts";
+
+export type AlarmResource = Alarm | CompositeAlarm;
+
+export type InsightRuleResource = InsightRule;
+
+export type TaggableResource =
+  | AlarmResource
+  | Dashboard
+  | MetricStream
+  | InsightRule
+  | AlarmMuteRule;
+
+export const sortAlarmResources = (
+  alarms: [AlarmResource, ...AlarmResource[]],
+) => sortByLogicalId(alarms) as [AlarmResource, ...AlarmResource[]];
+
+export const sortInsightRuleResources = (
+  rules: [InsightRuleResource, ...InsightRuleResource[]],
+) => sortByLogicalId(rules) as [InsightRuleResource, ...InsightRuleResource[]];
+
+export const getTaggableResourceArn = (resource: TaggableResource) => {
+  switch (resource.Type) {
+    case "AWS.CloudWatch.Alarm":
+    case "AWS.CloudWatch.CompositeAlarm":
+      return resource.alarmArn;
+    case "AWS.CloudWatch.Dashboard":
+      return resource.dashboardArn;
+    case "AWS.CloudWatch.MetricStream":
+      return resource.metricStreamArn;
+    case "AWS.CloudWatch.InsightRule":
+      return resource.ruleArn;
+    case "AWS.CloudWatch.AlarmMuteRule":
+      return resource.alarmMuteRuleArn;
+  }
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/common.ts
new file mode 100644
index 00000000000..553c5fd400b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/common.ts
@@ -0,0 +1,148 @@
+import * as cloudwatch from "@distilled.cloud/aws/cloudwatch";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+
+export type CloudWatchTags = Record<string, string>;
+
+export const createName = (
+  id: string,
+  providedName: string | undefined,
+  maxLength: number,
+) =>
+  providedName
+    ? Effect.succeed(providedName)
+    : createPhysicalName({
+        id,
+        maxLength,
+      });
+
+export const toTagRecord = (
+  tags: cloudwatch.Tag[] | undefined,
+): CloudWatchTags =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+export const createManagedTags = Effect.fn(function* (
+  id: string,
+  tags: Record<string, string> | undefined,
+) {
+  return {
+    ...(yield* createInternalTags(id)),
+    ...(tags ?? {}),
+  };
+});
+
+export const updateResourceTags = Effect.fn(function* ({
+  id,
+  resourceArn,
+  olds,
+  news,
+}: {
+  id: string;
+  resourceArn: string;
+  olds: Record<string, string> | undefined;
+  news: Record<string, string> | undefined;
+}) {
+  const oldTags = olds ? yield* createManagedTags(id, olds) : {};
+  const newTags = yield* createManagedTags(id, news);
+  const { removed, upsert } = diffTags(oldTags, newTags);
+
+  if (removed.length > 0) {
+    yield* cloudwatch.untagResource({
+      ResourceARN: resourceArn,
+      TagKeys: removed,
+    });
+  }
+
+  if (upsert.length > 0) {
+    yield* cloudwatch.tagResource({
+      ResourceARN: resourceArn,
+      Tags: upsert,
+    });
+  }
+
+  return newTags;
+});
+
+export const readResourceTags = (resourceArn: string) =>
+  cloudwatch
+    .listTagsForResource({
+      ResourceARN: resourceArn,
+    })
+    .pipe(Effect.map((response) => toTagRecord(response.Tags)));
+
+export const createTagList = (tags: Record<string, string>) =>
+  createTagsList(tags);
+
+export const retryConcurrent = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.retry({
+      while: (error: any) =>
+        error?._tag === "ConcurrentModificationException" ||
+        error?._tag === "ConflictException" ||
+        error?._tag === "LimitExceededException",
+      schedule: Schedule.exponential(200).pipe(
+        Schedule.both(Schedule.recurs(8)),
+      ),
+    }),
+  );
+
+const normalizeDimensions = (dimensions: cloudwatch.Dimension[] | undefined) =>
+  [...(dimensions ?? [])].sort((a, b) =>
+    `${a.Name ?? ""}:${a.Value ?? ""}`.localeCompare(
+      `${b.Name ?? ""}:${b.Value ?? ""}`,
+    ),
+  );
+
+const normalizeSingleMetricDetector = (
+  input: Pick<
+    cloudwatch.PutAnomalyDetectorInput,
+    | "Namespace"
+    | "MetricName"
+    | "Dimensions"
+    | "Stat"
+    | "SingleMetricAnomalyDetector"
+  >,
+) => {
+  const singleMetric = input.SingleMetricAnomalyDetector;
+  return {
+    Namespace: singleMetric?.Namespace ?? input.Namespace,
+    MetricName: singleMetric?.MetricName ?? input.MetricName,
+    Dimensions: normalizeDimensions(
+      singleMetric?.Dimensions ?? input.Dimensions,
+    ),
+    Stat: singleMetric?.Stat ?? input.Stat,
+  };
+};
+
+export const detectorIdentity = (
+  input: Pick<
+    cloudwatch.PutAnomalyDetectorInput,
+    | "Namespace"
+    | "MetricName"
+    | "Dimensions"
+    | "Stat"
+    | "SingleMetricAnomalyDetector"
+    | "MetricMathAnomalyDetector"
+  >,
+) =>
+  JSON.stringify({
+    SingleMetric: normalizeSingleMetricDetector(input),
+    MetricMathAnomalyDetector: input.MetricMathAnomalyDetector,
+  });
+
+export const matchesDetectorIdentity = (
+  detector: cloudwatch.AnomalyDetector,
+  input: cloudwatch.PutAnomalyDetectorInput,
+) => detectorIdentity(detector) === detectorIdentity(input);
+
+export const sortByLogicalId = <T extends { LogicalId: string }>(items: T[]) =>
+  [...items].sort((a, b) => a.LogicalId.localeCompare(b.LogicalId));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/index.ts
new file mode 100644
index 00000000000..80f50e31bc6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/CloudWatch/index.ts
@@ -0,0 +1,32 @@
+export * from "./Alarm.ts";
+export * from "./AlarmMuteRule.ts";
+export * from "./alarmStateChanges.ts";
+export * from "./AnomalyDetector.ts";
+export * from "./CompositeAlarm.ts";
+export * from "./Dashboard.ts";
+export * from "./DescribeAlarmContributors.ts";
+export * from "./DescribeAlarmHistory.ts";
+export * from "./DescribeAlarms.ts";
+export * from "./DescribeAlarmsForMetric.ts";
+export * from "./DescribeAnomalyDetectors.ts";
+export * from "./DescribeInsightRules.ts";
+export * from "./DisableAlarmActions.ts";
+export * from "./DisableInsightRules.ts";
+export * from "./EnableAlarmActions.ts";
+export * from "./GetAlarmMuteRule.ts";
+export * from "./GetDashboard.ts";
+export * from "./GetInsightRuleReport.ts";
+export * from "./GetMetricData.ts";
+export * from "./GetMetricStatistics.ts";
+export * from "./GetMetricStream.ts";
+export * from "./GetMetricWidgetImage.ts";
+export * from "./InsightRule.ts";
+export * from "./ListAlarmMuteRules.ts";
+export * from "./ListDashboards.ts";
+export * from "./ListManagedInsightRules.ts";
+export * from "./ListMetrics.ts";
+export * from "./ListMetricStreams.ts";
+export * from "./ListTagsForResource.ts";
+export * from "./MetricStream.ts";
+export * from "./PutMetricData.ts";
+export * from "./SetAlarmState.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Context.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Context.ts
new file mode 100644
index 00000000000..f1fda027cb6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Context.ts
@@ -0,0 +1,30 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import { HttpClient } from "effect/unstable/http/HttpClient";
+
+export const withContext = Effect.fn(function* <
+  Input,
+  A,
+  Err = never,
+  Req = never,
+>(fn: (request: Input) => Effect.Effect<A, Err, Req>) {
+  const ctx = yield* context();
+  return (
+    request: Input,
+  ): Effect.Effect<A, Err, Exclude<Req, Credentials | Region | HttpClient>> =>
+    fn(request).pipe(Effect.provide(ctx));
+});
+
+export const context = Effect.fn(function* () {
+  const credentials = yield* Credentials;
+  const region = yield* Region;
+  const httpClient = yield* HttpClient;
+  return Layer.mergeAll(
+    Layer.succeed(Credentials, credentials),
+    Layer.succeed(Region, region),
+    Layer.succeed(HttpClient, httpClient),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Credentials.ts
new file mode 100644
index 00000000000..fddd1ad7d84
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Credentials.ts
@@ -0,0 +1,15 @@
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import * as Layer from "effect/Layer";
+import { AWSEnvironment } from "./Environment.ts";
+
+export { Credentials } from "@distilled.cloud/aws/Credentials";
+
+/**
+ * Lazy `Credentials` layer derived from the surrounding {@link AWSEnvironment}.
+ * Credentials are resolved on first access (not during layer construction),
+ * matching the existing @distilled.cloud/aws semantics.
+ */
+export const fromEnvironment = Layer.effect(
+  Credentials,
+  AWSEnvironment.useSync((env) => env.credentials),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/AttributeValue.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/AttributeValue.ts
new file mode 100644
index 00000000000..7091b887619
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/AttributeValue.ts
@@ -0,0 +1,250 @@
+import type {
+  AttributeValue,
+  ScalarAttributeType,
+} from "@distilled.cloud/aws/dynamodb";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as S from "effect/Schema";
+import * as AST from "effect/SchemaAST";
+import {
+  getSetValueAST,
+  isClassSchema,
+  isListSchema,
+  isMapSchema,
+  isNumberSchema,
+  isRecordLikeSchema,
+  isRecordSchema,
+  isSetSchema,
+  isStringSchema,
+  isStructSchema,
+} from "../../Schema.ts";
+
+// this seems important for handling S.Struct.Fields https://effect.website/docs/schema/classes/#recursive-types-with-different-encoded-and-type
+// interface CategoryEncoded extends Schema.Struct.Encoded<typeof fields> { .. }
+
+export class InvalidAttributeValue extends Data.TaggedError(
+  "InvalidAttributeValue",
+)<{
+  message: string;
+  value: any;
+}> {}
+
+export const toAttributeValue: (
+  value: any,
+) => Effect.Effect<AttributeValue, InvalidAttributeValue, never> = Effect.fn(
+  function* (value: any) {
+    if (value === undefined) {
+      return {
+        NULL: false,
+      };
+    } else if (value === null) {
+      return {
+        NULL: true,
+      };
+    } else if (typeof value === "boolean") {
+      return {
+        BOOL: value,
+      };
+    } else if (typeof value === "string") {
+      return {
+        S: value,
+      };
+    } else if (typeof value === "number") {
+      return {
+        N: value.toString(10),
+      };
+    } else if (Array.isArray(value)) {
+      return {
+        L: yield* Effect.all(value.map(toAttributeValue)),
+      };
+    } else if (value instanceof Set) {
+      const setType = getType(value);
+      if (setType === "EMPTY_SET") {
+        return {
+          SS: [],
+        };
+      } else if (Array.isArray(setType)) {
+        return {
+          L: yield* Effect.all(setType.map(toAttributeValue)),
+        };
+      } else if (setType === "SS") {
+        return {
+          SS: Array.from(value.values()),
+        };
+      } else if (setType === "NS") {
+        return {
+          NS: Array.from(value.values()).map((value) => value.toString(10)),
+        };
+      } else if (setType === "BS") {
+        return {
+          BS: Array.from(value.values()),
+        };
+      } else {
+        return {
+          L: yield* Effect.all(
+            Array.from(value.values()).map(toAttributeValue),
+          ),
+        };
+      }
+    } else if (Buffer.isBuffer(value)) {
+      return {
+        B: new Uint8Array(value),
+      };
+    } else if (value instanceof File) {
+      return {
+        B: new Uint8Array(yield* Effect.promise(() => value.arrayBuffer())),
+      };
+    } else if (value instanceof Uint8Array) {
+      return {
+        B: value,
+      };
+    } else if (value instanceof ArrayBuffer) {
+      return {
+        B: new Uint8Array(value),
+      };
+    } else if (typeof value === "object") {
+      return {
+        M: Object.fromEntries(
+          yield* Effect.all(
+            Object.entries(value).map(([key, value]) =>
+              toAttributeValue(value).pipe(Effect.map((value) => [key, value])),
+            ),
+          ),
+        ),
+      };
+    }
+
+    return yield* Effect.fail(
+      new InvalidAttributeValue({
+        message: `Unknown value type: ${typeof value}`,
+        value,
+      }),
+    );
+  },
+);
+
+export const fromAttributeValue = (value: AttributeValue): any => {
+  if (value.NULL) {
+    return null;
+  } else if (typeof value.BOOL === "boolean") {
+    return value.BOOL;
+  } else if (value.L) {
+    return value.L.map(fromAttributeValue);
+  } else if (value.M) {
+    return Object.fromEntries(
+      Object.entries(value.M).map(([key, value]) => [
+        key,
+        fromAttributeValue(value!),
+      ]),
+    );
+  } else if (value.N) {
+    return parseFloat(value.N);
+  } else if (value.S) {
+    // how do we know if this is a date?
+    return value.S;
+  } else if (value.SS) {
+    return new Set(value.SS);
+  } else if (value.NS) {
+    return new Set(value.NS);
+  } else if (value.BS) {
+    return new Set(value.BS);
+  } else {
+    throw new Error(`Unknown attribute value: ${JSON.stringify(value)}`);
+  }
+};
+
+type ValueType =
+  | "L"
+  | "BOOL"
+  | "EMPTY_SET"
+  | "M"
+  | "NULL"
+  | "N"
+  | "M"
+  | "S"
+  | "SS"
+  | "BS"
+  | "NS"
+  | "undefined";
+
+const getType = (value: any): ValueType | ValueType[] => {
+  if (value === undefined) {
+    return "undefined";
+  } else if (value === null) {
+    return "NULL";
+  } else if (typeof value === "boolean") {
+    return "BOOL";
+  } else if (typeof value === "string") {
+    return "S";
+  } else if (typeof value === "number") {
+    return "N";
+  } else if (Array.isArray(value)) {
+    return "L";
+  } else if (value instanceof Set) {
+    return value.size === 0
+      ? "EMPTY_SET"
+      : (() => {
+          const types = Array.from(value.values())
+            .flatMap(getType)
+            .filter((type, i, arr) => arr.indexOf(type) === i);
+
+          return types.length === 1
+            ? types[0] === "S"
+              ? "SS"
+              : types[0] === "N"
+                ? "NS"
+                : types[0] === "BOOL"
+                  ? "BS"
+                  : types[0]
+            : "L";
+        })();
+  } else if (value instanceof Map) {
+    return "M";
+  } else if (typeof value === "object") {
+    return "M";
+  } else {
+    throw new Error(`Unknown value type: ${typeof value}`);
+  }
+};
+
+export const isScalarAttributeType = (
+  type: string,
+): type is ScalarAttributeType => {
+  return type === "S" || type === "N" || type === "B";
+};
+
+export const toAttributeType = (schema: S.Schema<any>) => {
+  if (isStringSchema(schema)) {
+    return "S";
+  } else if (isNumberSchema(schema)) {
+    return "N";
+  } else if (isRecordLikeSchema(schema)) {
+    return "M";
+  } else if (isStringSetSchema(schema)) {
+    return "SS";
+  } else if (isNumberSetSchema(schema)) {
+    return "NS";
+  } else if (isListSchema(schema)) {
+    return "L";
+  }
+  return "S";
+};
+
+export const isMapSchemaType = (schema: S.Schema<any>) =>
+  isMapSchema(schema) ||
+  isRecordSchema(schema) ||
+  isStructSchema(schema) ||
+  isClassSchema(schema) ||
+  false;
+
+export const isStringSetSchema = (schema: S.Schema<any>) => {
+  if (!isSetSchema(schema)) return false;
+  const valueAST = getSetValueAST(schema);
+  return valueAST !== undefined && AST.isString(valueAST);
+};
+
+export const isNumberSetSchema = (schema: S.Schema<any>) => {
+  if (!isSetSchema(schema)) return false;
+  const valueAST = getSetValueAST(schema);
+  return valueAST !== undefined && AST.isNumber(valueAST);
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchExecuteStatement.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchExecuteStatement.ts
new file mode 100644
index 00000000000..24e5d155cb2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchExecuteStatement.ts
@@ -0,0 +1,113 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+type BatchExecuteStatementTables = [Table, ...Table[]];
+
+const sortTables = (tables: BatchExecuteStatementTables) =>
+  [
+    ...new Map(
+      tables.map((table) => [table.LogicalId, table] as const),
+    ).values(),
+  ].sort((a, b) =>
+    a.LogicalId.localeCompare(b.LogicalId),
+  ) as BatchExecuteStatementTables;
+
+export interface BatchExecuteStatementRequest
+  extends DynamoDB.BatchExecuteStatementInput {}
+
+/**
+ * Runtime binding for DynamoDB PartiQL `BatchExecuteStatement`.
+ *
+ * The request is passed through unchanged, but IAM is scoped to the explicitly
+ * bound tables and their indexes.
+ *
+ * @section PartiQL
+ * @example Execute a Batch of Statements
+ * ```typescript
+ * const batchExecuteStatement = yield* BatchExecuteStatement.bind(
+ *   sourceTable,
+ *   archiveTable,
+ * );
+ *
+ * const response = yield* batchExecuteStatement({
+ *   Statements: [
+ *     {
+ *       Statement: `SELECT * FROM "${yield* sourceTable.tableName}" WHERE pk=?`,
+ *       Parameters: [{ S: "user#1" }],
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export class BatchExecuteStatement extends Binding.Service<
+  BatchExecuteStatement,
+  (
+    ...tables: BatchExecuteStatementTables
+  ) => Effect.Effect<
+    (
+      request: BatchExecuteStatementRequest,
+    ) => Effect.Effect<
+      DynamoDB.BatchExecuteStatementOutput,
+      DynamoDB.BatchExecuteStatementError
+    >
+  >
+>()("AWS.DynamoDB.BatchExecuteStatement") {}
+
+export const BatchExecuteStatementLive = Layer.effect(
+  BatchExecuteStatement,
+  Effect.gen(function* () {
+    const Policy = yield* BatchExecuteStatementPolicy;
+    const batchExecuteStatement = yield* DynamoDB.batchExecuteStatement;
+
+    return Effect.fn(function* (...tables: BatchExecuteStatementTables) {
+      const sortedTables = sortTables(tables);
+      yield* Policy(...sortedTables);
+      return Effect.fn(function* (request: BatchExecuteStatementRequest) {
+        return yield* batchExecuteStatement(request);
+      });
+    });
+  }),
+);
+
+export class BatchExecuteStatementPolicy extends Binding.Policy<
+  BatchExecuteStatementPolicy,
+  (...tables: BatchExecuteStatementTables) => Effect.Effect<void>
+>()("AWS.DynamoDB.BatchExecuteStatement") {}
+
+export const BatchExecuteStatementPolicyLive =
+  BatchExecuteStatementPolicy.layer.succeed(
+    Effect.fn(function* (host, ...tables: BatchExecuteStatementTables) {
+      const sortedTables = sortTables(tables);
+
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.BatchExecuteStatement(${sortedTables}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "dynamodb:PartiQLDelete",
+                  "dynamodb:PartiQLInsert",
+                  "dynamodb:PartiQLSelect",
+                  "dynamodb:PartiQLUpdate",
+                ],
+                Resource: sortedTables.flatMap((table) => [
+                  table.tableArn,
+                  Output.interpolate`${table.tableArn}/index/*`,
+                ]),
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `BatchExecuteStatementPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchGetItem.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchGetItem.ts
new file mode 100644
index 00000000000..ccf8938e77b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchGetItem.ts
@@ -0,0 +1,138 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+type BatchGetItemTables = [Table, ...Table[]];
+
+type BatchGetItemKeysAndAttributes = NonNullable<
+  DynamoDB.BatchGetItemInput["RequestItems"]
+>[string];
+
+const sortTables = (tables: BatchGetItemTables) =>
+  [
+    ...new Map(
+      tables.map((table) => [table.LogicalId, table] as const),
+    ).values(),
+  ].sort((a, b) =>
+    a.LogicalId.localeCompare(b.LogicalId),
+  ) as BatchGetItemTables;
+
+export interface BatchGetItemRequest extends Omit<
+  DynamoDB.BatchGetItemInput,
+  "RequestItems"
+> {
+  RequestItems: Record<string, BatchGetItemKeysAndAttributes>;
+}
+
+/**
+ * Runtime binding for `dynamodb:BatchGetItem`.
+ *
+ * Bind this operation to one or more tables and key the request by each bound
+ * table's `LogicalId`. The binding resolves those logical IDs to physical table
+ * names at runtime.
+ *
+ * @section Reading Data
+ * @example Read Items Across Multiple Tables
+ * ```typescript
+ * const batchGetItem = yield* BatchGetItem.bind(sourceTable, archiveTable);
+ *
+ * const response = yield* batchGetItem({
+ *   RequestItems: {
+ *     [sourceTable.LogicalId]: {
+ *       Keys: [{ pk: { S: "user#1" }, sk: { S: "profile" } }],
+ *     },
+ *     [archiveTable.LogicalId]: {
+ *       Keys: [{ pk: { S: "user#1" }, sk: { S: "profile" } }],
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export class BatchGetItem extends Binding.Service<
+  BatchGetItem,
+  (
+    ...tables: BatchGetItemTables
+  ) => Effect.Effect<
+    (
+      request: BatchGetItemRequest,
+    ) => Effect.Effect<DynamoDB.BatchGetItemOutput, DynamoDB.BatchGetItemError>
+  >
+>()("AWS.DynamoDB.BatchGetItem") {}
+
+export const BatchGetItemLive = Layer.effect(
+  BatchGetItem,
+  Effect.gen(function* () {
+    const Policy = yield* BatchGetItemPolicy;
+    const batchGetItem = yield* DynamoDB.batchGetItem;
+
+    return Effect.fn(function* (...tables: BatchGetItemTables) {
+      const sortedTables = sortTables(tables);
+      const tableNames = new Map(
+        yield* Effect.forEach(sortedTables, (table) =>
+          Effect.gen(function* () {
+            return [table.LogicalId, yield* table.tableName] as const;
+          }),
+        ),
+      );
+
+      const getTableName = (tableId: string) => {
+        const TableName = tableNames.get(tableId);
+        if (!TableName) {
+          throw new Error(
+            `BatchGetItem request references unbound table '${tableId}'`,
+          );
+        }
+        return TableName;
+      };
+
+      yield* Policy(...sortedTables);
+
+      return Effect.fn(function* (request: BatchGetItemRequest) {
+        const requestItems = yield* Effect.forEach(
+          Object.entries(request.RequestItems),
+          ([tableId, keys]) =>
+            Effect.gen(function* () {
+              return [yield* getTableName(tableId), keys] as const;
+            }),
+        );
+
+        return yield* batchGetItem({
+          ...request,
+          RequestItems: Object.fromEntries(requestItems),
+        });
+      });
+    });
+  }),
+);
+
+export class BatchGetItemPolicy extends Binding.Policy<
+  BatchGetItemPolicy,
+  (...tables: BatchGetItemTables) => Effect.Effect<void>
+>()("AWS.DynamoDB.BatchGetItem") {}
+
+export const BatchGetItemPolicyLive = BatchGetItemPolicy.layer.succeed(
+  Effect.fn(function* (host, ...tables: BatchGetItemTables) {
+    const sortedTables = sortTables(tables);
+
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.BatchGetItem(${sortedTables}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["dynamodb:BatchGetItem"],
+              Resource: sortedTables.map((table) => table.tableArn),
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `BatchGetItemPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchWriteItem.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchWriteItem.ts
new file mode 100644
index 00000000000..ece8f4f26c5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/BatchWriteItem.ts
@@ -0,0 +1,144 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+type BatchWriteItemTables = [Table, ...Table[]];
+
+type BatchWriteRequests = NonNullable<
+  DynamoDB.BatchWriteItemInput["RequestItems"]
+>[string];
+
+const sortTables = (tables: BatchWriteItemTables) =>
+  [
+    ...new Map(
+      tables.map((table) => [table.LogicalId, table] as const),
+    ).values(),
+  ].sort((a, b) =>
+    a.LogicalId.localeCompare(b.LogicalId),
+  ) as BatchWriteItemTables;
+
+export interface BatchWriteItemRequest extends Omit<
+  DynamoDB.BatchWriteItemInput,
+  "RequestItems"
+> {
+  RequestItems: Record<string, BatchWriteRequests>;
+}
+
+/**
+ * Runtime binding for `dynamodb:BatchWriteItem`.
+ *
+ * Bind this operation to one or more tables and key the request by each bound
+ * table's `LogicalId`.
+ *
+ * @section Writing Data
+ * @example Write Items Across Multiple Tables
+ * ```typescript
+ * const batchWriteItem = yield* BatchWriteItem.bind(sourceTable, archiveTable);
+ *
+ * const response = yield* batchWriteItem({
+ *   RequestItems: {
+ *     [sourceTable.LogicalId]: [
+ *       {
+ *         PutRequest: {
+ *           Item: {
+ *             pk: { S: "user#1" },
+ *             sk: { S: "profile" },
+ *           },
+ *         },
+ *       },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export class BatchWriteItem extends Binding.Service<
+  BatchWriteItem,
+  (
+    ...tables: BatchWriteItemTables
+  ) => Effect.Effect<
+    (
+      request: BatchWriteItemRequest,
+    ) => Effect.Effect<
+      DynamoDB.BatchWriteItemOutput,
+      DynamoDB.BatchWriteItemError
+    >
+  >
+>()("AWS.DynamoDB.BatchWriteItem") {}
+
+export const BatchWriteItemLive = Layer.effect(
+  BatchWriteItem,
+  Effect.gen(function* () {
+    const Policy = yield* BatchWriteItemPolicy;
+    const batchWriteItem = yield* DynamoDB.batchWriteItem;
+
+    return Effect.fn(function* (...tables: BatchWriteItemTables) {
+      const sortedTables = sortTables(tables);
+      const tableNames = new Map(
+        yield* Effect.forEach(sortedTables, (table) =>
+          Effect.gen(function* () {
+            return [table.LogicalId, yield* table.tableName] as const;
+          }),
+        ),
+      );
+
+      const getTableName = (tableId: string) => {
+        const TableName = tableNames.get(tableId);
+        if (!TableName) {
+          throw new Error(
+            `BatchWriteItem request references unbound table '${tableId}'`,
+          );
+        }
+        return TableName;
+      };
+
+      yield* Policy(...sortedTables);
+
+      return Effect.fn(function* (request: BatchWriteItemRequest) {
+        const requestItems = yield* Effect.forEach(
+          Object.entries(request.RequestItems),
+          ([tableId, writes]) =>
+            Effect.gen(function* () {
+              return [yield* getTableName(tableId), writes] as const;
+            }),
+        );
+
+        return yield* batchWriteItem({
+          ...request,
+          RequestItems: Object.fromEntries(requestItems),
+        });
+      });
+    });
+  }),
+);
+
+export class BatchWriteItemPolicy extends Binding.Policy<
+  BatchWriteItemPolicy,
+  (...tables: BatchWriteItemTables) => Effect.Effect<void>
+>()("AWS.DynamoDB.BatchWriteItem") {}
+
+export const BatchWriteItemPolicyLive = BatchWriteItemPolicy.layer.succeed(
+  Effect.fn(function* (host, ...tables: BatchWriteItemTables) {
+    const sortedTables = sortTables(tables);
+
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.BatchWriteItem(${sortedTables}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["dynamodb:BatchWriteItem"],
+              Resource: sortedTables.map((table) => table.tableArn),
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `BatchWriteItemPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DeleteItem.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DeleteItem.ts
new file mode 100644
index 00000000000..e66acf65e22
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DeleteItem.ts
@@ -0,0 +1,67 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface DeleteItemRequest extends Omit<
+  DynamoDB.DeleteItemInput,
+  "TableName"
+> {}
+
+export class DeleteItem extends Binding.Service<
+  DeleteItem,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: DeleteItemRequest,
+    ) => Effect.Effect<DynamoDB.DeleteItemOutput, DynamoDB.DeleteItemError>
+  >
+>()("AWS.DynamoDB.DeleteItem") {}
+
+export const DeleteItemLive = Layer.effect(
+  DeleteItem,
+  Effect.gen(function* () {
+    const Policy = yield* DeleteItemPolicy;
+    const deleteItem = yield* DynamoDB.deleteItem;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request: DeleteItemRequest) {
+        const tableName = yield* TableName;
+        return yield* deleteItem({
+          ...request,
+          TableName: tableName,
+        });
+      });
+    });
+  }),
+);
+
+export class DeleteItemPolicy extends Binding.Policy<
+  DeleteItemPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.DeleteItem") {}
+
+export const DeleteItemPolicyLive = DeleteItemPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.DeleteItem(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:DeleteItem"],
+            Resource: [table.tableArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DeleteItemPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DescribeTable.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DescribeTable.ts
new file mode 100644
index 00000000000..4ef9a55a746
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DescribeTable.ts
@@ -0,0 +1,69 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface DescribeTableRequest extends Omit<
+  DynamoDB.DescribeTableInput,
+  "TableName"
+> {}
+
+export class DescribeTable extends Binding.Service<
+  DescribeTable,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request?: DescribeTableRequest,
+    ) => Effect.Effect<
+      DynamoDB.DescribeTableOutput,
+      DynamoDB.DescribeTableError
+    >
+  >
+>()("AWS.DynamoDB.DescribeTable") {}
+
+export const DescribeTableLive = Layer.effect(
+  DescribeTable,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeTablePolicy;
+    const describeTable = yield* DynamoDB.describeTable;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request?: DescribeTableRequest) {
+        return yield* describeTable({
+          ...request,
+          TableName: yield* TableName,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeTablePolicy extends Binding.Policy<
+  DescribeTablePolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.DescribeTable") {}
+
+export const DescribeTablePolicyLive = DescribeTablePolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.DescribeTable(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:DescribeTable"],
+            Resource: [table.tableArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DescribeTablePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DescribeTimeToLive.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DescribeTimeToLive.ts
new file mode 100644
index 00000000000..103ecebffb0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/DescribeTimeToLive.ts
@@ -0,0 +1,72 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface DescribeTimeToLiveRequest extends Omit<
+  DynamoDB.DescribeTimeToLiveInput,
+  "TableName"
+> {}
+
+export class DescribeTimeToLive extends Binding.Service<
+  DescribeTimeToLive,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request?: DescribeTimeToLiveRequest,
+    ) => Effect.Effect<
+      DynamoDB.DescribeTimeToLiveOutput,
+      DynamoDB.DescribeTimeToLiveError
+    >
+  >
+>()("AWS.DynamoDB.DescribeTimeToLive") {}
+
+export const DescribeTimeToLiveLive = Layer.effect(
+  DescribeTimeToLive,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeTimeToLivePolicy;
+    const describeTimeToLive = yield* DynamoDB.describeTimeToLive;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request?: DescribeTimeToLiveRequest) {
+        return yield* describeTimeToLive({
+          ...request,
+          TableName: yield* TableName,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeTimeToLivePolicy extends Binding.Policy<
+  DescribeTimeToLivePolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.DescribeTimeToLive") {}
+
+export const DescribeTimeToLivePolicyLive =
+  DescribeTimeToLivePolicy.layer.succeed(
+    Effect.fn(function* (host, table) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.DescribeTimeToLive(${table}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["dynamodb:DescribeTimeToLive"],
+                Resource: [table.tableArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeTimeToLivePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ExecuteStatement.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ExecuteStatement.ts
new file mode 100644
index 00000000000..c60efbda1cc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ExecuteStatement.ts
@@ -0,0 +1,91 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface ExecuteStatementRequest
+  extends DynamoDB.ExecuteStatementInput {}
+
+/**
+ * Runtime binding for DynamoDB PartiQL `ExecuteStatement`.
+ *
+ * This binding scopes IAM to a specific table, but the statement text is still
+ * user-provided. Statements must only reference the bound table or its indexes.
+ *
+ * @section PartiQL
+ * @example Execute a Statement Against One Table
+ * ```typescript
+ * const executeStatement = yield* ExecuteStatement.bind(table);
+ *
+ * const response = yield* executeStatement({
+ *   Statement: `SELECT * FROM "${yield* table.tableName}" WHERE pk=?`,
+ *   Parameters: [{ S: "user#1" }],
+ * });
+ * ```
+ */
+export class ExecuteStatement extends Binding.Service<
+  ExecuteStatement,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: ExecuteStatementRequest,
+    ) => Effect.Effect<
+      DynamoDB.ExecuteStatementOutput,
+      DynamoDB.ExecuteStatementError
+    >
+  >
+>()("AWS.DynamoDB.ExecuteStatement") {}
+
+export const ExecuteStatementLive = Layer.effect(
+  ExecuteStatement,
+  Effect.gen(function* () {
+    const Policy = yield* ExecuteStatementPolicy;
+    const executeStatement = yield* DynamoDB.executeStatement;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      yield* Policy(table);
+      return Effect.fn(function* (request: ExecuteStatementRequest) {
+        return yield* executeStatement(request);
+      });
+    });
+  }),
+);
+
+export class ExecuteStatementPolicy extends Binding.Policy<
+  ExecuteStatementPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.ExecuteStatement") {}
+
+export const ExecuteStatementPolicyLive = ExecuteStatementPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.ExecuteStatement(${table}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: [
+                "dynamodb:PartiQLDelete",
+                "dynamodb:PartiQLInsert",
+                "dynamodb:PartiQLSelect",
+                "dynamodb:PartiQLUpdate",
+              ],
+              Resource: [
+                table.tableArn,
+                Output.interpolate`${table.tableArn}/index/*`,
+              ],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `ExecuteStatementPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ExecuteTransaction.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ExecuteTransaction.ts
new file mode 100644
index 00000000000..fbd42950d85
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ExecuteTransaction.ts
@@ -0,0 +1,77 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface ExecuteTransactionRequest
+  extends DynamoDB.ExecuteTransactionInput {}
+
+type ExecuteTransactionTables = [Table, ...Table[]];
+
+export class ExecuteTransaction extends Binding.Service<
+  ExecuteTransaction,
+  (
+    ...tables: ExecuteTransactionTables
+  ) => Effect.Effect<
+    (
+      request: ExecuteTransactionRequest,
+    ) => Effect.Effect<
+      DynamoDB.ExecuteTransactionOutput,
+      DynamoDB.ExecuteTransactionError
+    >
+  >
+>()("AWS.DynamoDB.ExecuteTransaction") {}
+
+export const ExecuteTransactionLive = Layer.effect(
+  ExecuteTransaction,
+  Effect.gen(function* () {
+    const Policy = yield* ExecuteTransactionPolicy;
+    const executeTransaction = yield* DynamoDB.executeTransaction;
+
+    return Effect.fn(function* (...tables: ExecuteTransactionTables) {
+      yield* Policy(...tables);
+      return Effect.fn(function* (request: ExecuteTransactionRequest) {
+        return yield* executeTransaction(request);
+      });
+    });
+  }),
+);
+
+export class ExecuteTransactionPolicy extends Binding.Policy<
+  ExecuteTransactionPolicy,
+  (...tables: ExecuteTransactionTables) => Effect.Effect<void>
+>()("AWS.DynamoDB.ExecuteTransaction") {}
+
+export const ExecuteTransactionPolicyLive =
+  ExecuteTransactionPolicy.layer.succeed(
+    Effect.fn(function* (host, ...tables: ExecuteTransactionTables) {
+      const sortedTables = [...tables].sort((a, b) =>
+        a.LogicalId.localeCompare(b.LogicalId),
+      );
+
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.ExecuteTransaction(${sortedTables}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "dynamodb:PartiQLSelect",
+                  "dynamodb:PartiQLInsert",
+                  "dynamodb:PartiQLUpdate",
+                  "dynamodb:PartiQLDelete",
+                ],
+                Resource: sortedTables.map((table) => table.tableArn),
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ExecuteTransactionPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Expr.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Expr.ts
new file mode 100644
index 00000000000..998f6d8de6c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Expr.ts
@@ -0,0 +1,90 @@
+export type Expr =
+  | ArrayIndex
+  | Identifier
+  | NumberLiteral
+  | OperatorExpr
+  | NameRef
+  | PropRef
+  | ValueRef;
+//
+
+export interface NameRef<Name extends string = string> {
+  kind: "name-ref";
+  name: Name;
+}
+export interface ValueRef<Name extends string = string> {
+  kind: "value-ref";
+  name: Name;
+}
+export interface Identifier<I extends string = string> {
+  kind: "identifier";
+  name: I;
+}
+
+export interface NumberLiteral<N extends string = string> {
+  kind: "index";
+  number: N;
+}
+export interface PropRef<Ex extends Expr = any, Id extends Identifier = any> {
+  kind: "prop-ref";
+  expr: Ex;
+  name: Id;
+}
+export interface ArrayIndex<
+  List extends Expr = any,
+  Number extends NumberLiteral | ValueRef = NumberLiteral | ValueRef,
+> {
+  kind: "array-index";
+  list: List;
+  number: Number;
+}
+
+export type Operator = "and" | "or" | "=" | "<" | "<=" | ">=" | ">";
+export interface OperatorExpr<
+  Left extends Expr = any,
+  Op extends Operator = Operator,
+  Right extends Expr = any,
+> {
+  kind: "op";
+  left: Left;
+  op: Op;
+  right: Right;
+}
+
+export type LowercaseLetter =
+  | "a"
+  | "b"
+  | "c"
+  | "d"
+  | "e"
+  | "f"
+  | "g"
+  | "h"
+  | "i"
+  | "j"
+  | "k"
+  | "l"
+  | "m"
+  | "n"
+  | "o"
+  | "p"
+  | "q"
+  | "r"
+  | "s"
+  | "t"
+  | "u"
+  | "v"
+  | "w"
+  | "x"
+  | "y"
+  | "z";
+
+export type UppercaseLetter = Uppercase<LowercaseLetter>;
+
+export type Letter = LowercaseLetter | UppercaseLetter;
+
+export type Digit = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9";
+
+export type SpecialCharacter = "_";
+
+export type Word = Digit | Letter | SpecialCharacter;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/GetItem.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/GetItem.ts
new file mode 100644
index 00000000000..da60b1a4d7c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/GetItem.ts
@@ -0,0 +1,85 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface GetItemRequest extends Omit<
+  DynamoDB.GetItemInput,
+  "TableName"
+> {}
+
+/**
+ * Runtime binding for `dynamodb:GetItem`.
+ *
+ * Bind this operation to a `Table` inside a function runtime to get a callable
+ * that automatically injects the table name.
+ *
+ * @section Reading Data
+ * @example Read a Single Item
+ * ```typescript
+ * const getItem = yield* GetItem.bind(table);
+ *
+ * const response = yield* getItem({
+ *   Key: {
+ *     pk: { S: "user#123" },
+ *   },
+ * });
+ * ```
+ */
+export class GetItem extends Binding.Service<
+  GetItem,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: GetItemRequest,
+    ) => Effect.Effect<DynamoDB.GetItemOutput, DynamoDB.GetItemError>
+  >
+>()("AWS.DynamoDB.GetItem") {}
+
+export const GetItemLive = Layer.effect(
+  GetItem,
+  Effect.gen(function* () {
+    const Policy = yield* GetItemPolicy;
+    const getItem = yield* DynamoDB.getItem;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request: GetItemRequest) {
+        const tableName = yield* TableName;
+        return yield* getItem({
+          ...request,
+          TableName: tableName,
+        });
+      });
+    });
+  }),
+);
+
+export class GetItemPolicy extends Binding.Policy<
+  GetItemPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.GetItem") {}
+
+export const GetItemPolicyLive = GetItemPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.GetItem(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:GetItem"],
+            Resource: [table.tableArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `GetItemPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ListTables.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ListTables.ts
new file mode 100644
index 00000000000..e29aa14f7d6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ListTables.ts
@@ -0,0 +1,56 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListTablesRequest extends DynamoDB.ListTablesInput {}
+
+export class ListTables extends Binding.Service<
+  ListTables,
+  () => Effect.Effect<
+    (
+      request?: ListTablesRequest,
+    ) => Effect.Effect<DynamoDB.ListTablesOutput, DynamoDB.ListTablesError>
+  >
+>()("AWS.DynamoDB.ListTables") {}
+
+export const ListTablesLive = Layer.effect(
+  ListTables,
+  Effect.gen(function* () {
+    const Policy = yield* ListTablesPolicy;
+    const listTables = yield* DynamoDB.listTables;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: ListTablesRequest) {
+        return yield* listTables(request ?? {});
+      });
+    });
+  }),
+);
+
+export class ListTablesPolicy extends Binding.Policy<
+  ListTablesPolicy,
+  () => Effect.Effect<void>
+>()("AWS.DynamoDB.ListTables") {}
+
+export const ListTablesPolicyLive = ListTablesPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.ListTables())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:ListTables"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListTablesPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ListTagsOfResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ListTagsOfResource.ts
new file mode 100644
index 00000000000..0a2e41cc44a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ListTagsOfResource.ts
@@ -0,0 +1,72 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface ListTagsOfResourceRequest extends Omit<
+  DynamoDB.ListTagsOfResourceInput,
+  "ResourceArn"
+> {}
+
+export class ListTagsOfResource extends Binding.Service<
+  ListTagsOfResource,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request?: ListTagsOfResourceRequest,
+    ) => Effect.Effect<
+      DynamoDB.ListTagsOfResourceOutput,
+      DynamoDB.ListTagsOfResourceError
+    >
+  >
+>()("AWS.DynamoDB.ListTagsOfResource") {}
+
+export const ListTagsOfResourceLive = Layer.effect(
+  ListTagsOfResource,
+  Effect.gen(function* () {
+    const Policy = yield* ListTagsOfResourcePolicy;
+    const listTagsOfResource = yield* DynamoDB.listTagsOfResource;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const ResourceArn = yield* table.tableArn;
+      yield* Policy(table);
+      return Effect.fn(function* (request?: ListTagsOfResourceRequest) {
+        return yield* listTagsOfResource({
+          ...request,
+          ResourceArn: yield* ResourceArn,
+        });
+      });
+    });
+  }),
+);
+
+export class ListTagsOfResourcePolicy extends Binding.Policy<
+  ListTagsOfResourcePolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.ListTagsOfResource") {}
+
+export const ListTagsOfResourcePolicyLive =
+  ListTagsOfResourcePolicy.layer.succeed(
+    Effect.fn(function* (host, table) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.ListTagsOfResource(${table}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["dynamodb:ListTagsOfResource"],
+                Resource: [table.tableArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListTagsOfResourcePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ProjectionExpression.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ProjectionExpression.ts
new file mode 100644
index 00000000000..b4a3453de27
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/ProjectionExpression.ts
@@ -0,0 +1,159 @@
+import type {
+  ArrayIndex,
+  Expr,
+  Identifier,
+  NameRef,
+  NumberLiteral,
+  PropRef,
+  ValueRef,
+  Word,
+} from "./Expr.ts";
+
+export type ParseProjectionExpression<Text extends string> = Parse<
+  Text,
+  [],
+  undefined
+>;
+
+type AsExpr<T> = Extract<T, Expr>;
+
+type Parse<
+  Text extends string,
+  Expressions extends Expr[],
+  Exp extends Expr | undefined,
+> = Text extends `.${infer Rest}`
+  ? Exp extends Expr
+    ? Parse<Rest, Expressions, PropRef<Exp, Identifier<"">>>
+    : never
+  : Text extends `[:${infer Rest}`
+    ? Parse<Rest, Expressions, ArrayIndex<AsExpr<Exp>, ValueRef<"">>>
+    : Text extends `[${infer Rest}`
+      ? Parse<Rest, Expressions, ArrayIndex<AsExpr<Exp>, NumberLiteral<"">>>
+      : Text extends `]${infer Rest}`
+        ? Parse<Rest, Expressions, Exp>
+        : Text extends `]`
+          ? Concat<Expressions, Exp>
+          : Text extends `${"," | " "}${infer Rest}`
+            ? Parse<Rest, Concat<Expressions, Exp>, undefined>
+            : Text extends `#${infer Rest}`
+              ? Parse<Rest, Concat<Expressions, Exp>, NameRef<Rest>>
+              : Text extends `:${infer Rest}`
+                ? Parse<Rest, Concat<Expressions, Exp>, ValueRef<Rest>>
+                : Text extends `${Word}${string}`
+                  ? Text extends `${infer char}${infer Rest}`
+                    ? Parse<Rest, Expressions, Append<Exp, char>>
+                    : never
+                  : Text extends `${Word}${string}`
+                    ? Text extends `${infer char}${infer Rest}`
+                      ? Parse<Rest, Expressions, Append<Exp, char>>
+                      : never
+                    : Concat<Expressions, Exp>;
+
+type Concat<
+  Expressions extends Expr[],
+  CurrentExpr extends Expr | undefined,
+> = undefined extends CurrentExpr
+  ? Expressions
+  : [...Expressions, Extract<CurrentExpr, Expr>];
+
+type Append<
+  Exp extends Expr | undefined,
+  char extends string,
+> = Exp extends undefined
+  ? Identifier<char>
+  : Exp extends Identifier<infer Name>
+    ? Identifier<`${Name}${char}`>
+    : Exp extends NumberLiteral<infer Name>
+      ? NumberLiteral<`${Name}${char}`>
+      : Exp extends NameRef<infer Name>
+        ? NameRef<`${Name}${char}`>
+        : Exp extends ValueRef<infer Name>
+          ? ValueRef<`${Name}${char}`>
+          : Exp extends PropRef<infer expr, infer name>
+            ? PropRef<expr, Extract<Append<name, char>, Identifier>>
+            : Exp extends ArrayIndex<infer expr, infer idx>
+              ? ArrayIndex<expr, Extract<Append<idx, char>, NumberLiteral>>
+              : never;
+
+export type ApplyProjection<T, Expr extends string> = Flatten<
+  UnionToIntersection<
+    ApplyProjectionExpr<T, ParseProjectionExpression<Expr>[number]>
+  >
+>;
+
+type ApplyProjectionExpr<T, Exp extends Expr> = T extends undefined
+  ? never
+  : Exp extends PropRef<infer expr, infer i>
+    ? {
+        [p in keyof ApplyProjectionExpr<T, expr>]: ApplyProjectionExpr<
+          ApplyProjectionExpr<T, expr>[p],
+          i
+        >;
+      }
+    : Exp extends ArrayIndex<infer expr, infer i>
+      ? {
+          [p in keyof ApplyProjectionExpr<T, expr>]: ApplyProjectionExpr<
+            ApplyProjectionExpr<T, expr>[keyof ApplyProjectionExpr<T, expr>],
+            i
+          >;
+        }
+      : Exp extends Identifier<infer I>
+        ? I extends keyof T
+          ? Pick<T, I>
+          : never
+        : Exp extends NumberLiteral<infer I>
+          ? ParseInt<I> extends keyof T
+            ? Pick<T, ParseInt<I>>
+            : never
+          : never;
+
+type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends (
+  k: infer I,
+) => void
+  ? I
+  : never;
+
+type Flatten<T> = T extends object
+  ? keyof T extends number
+    ? FlattenArray<Extract<T, Record<number, any>>>
+    : {
+        [k in keyof T]: Flatten<T[k]>;
+      }
+  : T;
+
+type FlattenArray<
+  T extends { [i in number]: any },
+  i extends number = 0,
+> = i extends keyof T
+  ? [T[i], ...FlattenArray<T, Inc<i>>]
+  : number extends i
+    ? []
+    : FlattenArray<T, Inc<i>>;
+
+type BuildTuple<N extends number, T extends any[] = []> = T["length"] extends N
+  ? T
+  : BuildTuple<N, [...T, any]>;
+
+type Inc<N extends number> = Extract<[...BuildTuple<N>, any]["length"], number>;
+
+type ParseInt<N extends string> = N extends "0"
+  ? 0
+  : N extends "1"
+    ? 1
+    : N extends "2"
+      ? 2
+      : N extends "3"
+        ? 3
+        : N extends "4"
+          ? 4
+          : N extends "5"
+            ? 5
+            : N extends "6"
+              ? 6
+              : N extends "7"
+                ? 7
+                : N extends "8"
+                  ? 8
+                  : N extends "9"
+                    ? 9
+                    : number;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/PutItem.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/PutItem.ts
new file mode 100644
index 00000000000..a92fabbc0ae
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/PutItem.ts
@@ -0,0 +1,67 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface PutItemRequest extends Omit<
+  DynamoDB.PutItemInput,
+  "TableName"
+> {}
+
+export class PutItem extends Binding.Service<
+  PutItem,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: PutItemRequest,
+    ) => Effect.Effect<DynamoDB.PutItemOutput, DynamoDB.PutItemError>
+  >
+>()("AWS.DynamoDB.PutItem") {}
+
+export const PutItemLive = Layer.effect(
+  PutItem,
+  Effect.gen(function* () {
+    const bind = yield* PutItemPolicy;
+    const putItem = yield* DynamoDB.putItem;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* bind(table);
+      return Effect.fn(function* (request: PutItemRequest) {
+        const tableName = yield* TableName;
+        return yield* putItem({
+          ...request,
+          TableName: tableName,
+        });
+      });
+    });
+  }),
+);
+
+export class PutItemPolicy extends Binding.Policy<
+  PutItemPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.PutItem") {}
+
+export const PutItemPolicyLive = PutItemPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.PutItem(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:PutItem"],
+            Resource: [table.tableArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PutItemPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Query.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Query.ts
new file mode 100644
index 00000000000..f5898db14d6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Query.ts
@@ -0,0 +1,68 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface QueryRequest extends Omit<DynamoDB.QueryInput, "TableName"> {}
+
+export class Query extends Binding.Service<
+  Query,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: QueryRequest,
+    ) => Effect.Effect<DynamoDB.QueryOutput, DynamoDB.QueryError>
+  >
+>()("AWS.DynamoDB.Query") {}
+
+export const QueryLive = Layer.effect(
+  Query,
+  Effect.gen(function* () {
+    const Policy = yield* QueryPolicy;
+    const query = yield* DynamoDB.query;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request: QueryRequest) {
+        const tableName = yield* TableName;
+        return yield* query({
+          ...request,
+          TableName: tableName,
+        });
+      });
+    });
+  }),
+);
+
+export class QueryPolicy extends Binding.Policy<
+  QueryPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.Query") {}
+
+export const QueryPolicyLive = QueryPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.Query(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:Query"],
+            Resource: [
+              table.tableArn,
+              Output.interpolate`${table.tableArn}/index/*`,
+            ],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `QueryPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/RestoreTableToPointInTime.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/RestoreTableToPointInTime.ts
new file mode 100644
index 00000000000..51ef6426786
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/RestoreTableToPointInTime.ts
@@ -0,0 +1,94 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface RestoreTableToPointInTimeRequest extends Omit<
+  DynamoDB.RestoreTableToPointInTimeInput,
+  "SourceTableArn" | "SourceTableName" | "TargetTableName"
+> {}
+
+export class RestoreTableToPointInTime extends Binding.Service<
+  RestoreTableToPointInTime,
+  <From extends Table, To extends Table>(
+    from: From,
+    to: To,
+  ) => Effect.Effect<
+    (
+      request: RestoreTableToPointInTimeRequest,
+    ) => Effect.Effect<
+      DynamoDB.RestoreTableToPointInTimeOutput,
+      DynamoDB.RestoreTableToPointInTimeError
+    >
+  >
+>()("AWS.DynamoDB.RestoreTableToPointInTime") {}
+
+export const RestoreTableToPointInTimeLive = Layer.effect(
+  RestoreTableToPointInTime,
+  Effect.gen(function* () {
+    const Policy = yield* RestoreTableToPointInTimePolicy;
+    const restoreTableToPointInTime = yield* DynamoDB.restoreTableToPointInTime;
+
+    return Effect.fn(function* <From extends Table, To extends Table>(
+      from: From,
+      to: To,
+    ) {
+      const SourceTableName = yield* from.tableName;
+      const TargetTableName = yield* to.tableName;
+      yield* Policy(from, to);
+      return Effect.fn(function* (request: RestoreTableToPointInTimeRequest) {
+        return yield* restoreTableToPointInTime({
+          ...request,
+          SourceTableName: yield* SourceTableName,
+          TargetTableName: yield* TargetTableName,
+        });
+      });
+    });
+  }),
+);
+
+export class RestoreTableToPointInTimePolicy extends Binding.Policy<
+  RestoreTableToPointInTimePolicy,
+  <From extends Table, To extends Table>(
+    from: From,
+    to: To,
+  ) => Effect.Effect<void>
+>()("AWS.DynamoDB.RestoreTableToPointInTime") {}
+
+export const RestoreTableToPointInTimePolicyLive =
+  RestoreTableToPointInTimePolicy.layer.succeed(
+    Effect.fn(function* (host, from, to) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.RestoreTableToPointInTime(${from}, ${to}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["dynamodb:RestoreTableToPointInTime"],
+                Resource: [from.tableArn],
+              },
+              {
+                Effect: "Allow",
+                Action: [
+                  "dynamodb:PutItem",
+                  "dynamodb:UpdateItem",
+                  "dynamodb:DeleteItem",
+                  "dynamodb:GetItem",
+                  "dynamodb:Query",
+                  "dynamodb:Scan",
+                  "dynamodb:BatchWriteItem",
+                ],
+                Resource: [to.tableArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `RestoreTableToPointInTimePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Scan.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Scan.ts
new file mode 100644
index 00000000000..2111e827e0a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Scan.ts
@@ -0,0 +1,68 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface ScanRequest extends Omit<DynamoDB.ScanInput, "TableName"> {}
+
+export class Scan extends Binding.Service<
+  Scan,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: ScanRequest,
+    ) => Effect.Effect<DynamoDB.ScanOutput, DynamoDB.ScanError>
+  >
+>()("AWS.DynamoDB.Scan") {}
+
+export const ScanLive = Layer.effect(
+  Scan,
+  Effect.gen(function* () {
+    const Policy = yield* ScanPolicy;
+    const scan = yield* DynamoDB.scan;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request: ScanRequest) {
+        const tableName = yield* TableName;
+        return yield* scan({
+          ...request,
+          TableName: tableName,
+        });
+      });
+    });
+  }),
+);
+
+export class ScanPolicy extends Binding.Policy<
+  ScanPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.Scan") {}
+
+export const ScanPolicyLive = ScanPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.Scan(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:Scan"],
+            Resource: [
+              table.tableArn,
+              Output.interpolate`${table.tableArn}/index/*`,
+            ],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ScanPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Stream.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Stream.ts
new file mode 100644
index 00000000000..d896e34aa95
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Stream.ts
@@ -0,0 +1,91 @@
+import type * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { Table, TableEvent, TableRecord } from "./Table.ts";
+
+export type StreamRecord<Data> = TableRecord<Data>;
+
+export type StreamEvent<Data> = TableEvent<Data>;
+
+export class TableEventSource extends Binding.Service<
+  TableEventSource,
+  TableEventSourceService
+>()("AWS.DynamoDB.TableEventSource") {}
+
+export type TableEventSourceService = <
+  Data = unknown,
+  StreamReq = never,
+  Req = never,
+>(
+  table: Table,
+  props: StreamsProps,
+  process: (
+    stream: Stream.Stream<StreamRecord<Data>, never, StreamReq>,
+  ) => Effect.Effect<void, never, Req>,
+) => Effect.Effect<void, never, never>;
+
+export interface TableEventSourceProps {
+  /**
+   * The maximum number of records in each batch that Lambda pulls from the stream.
+   * @default 100
+   */
+  batchSize?: number;
+  /**
+   * The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.
+   * @default 0
+   */
+  maximumBatchingWindowInSeconds?: number;
+  /**
+   * The position in the stream from which to start reading.
+   * @default "LATEST"
+   */
+  startingPosition?: "TRIM_HORIZON" | "LATEST" | "AT_TIMESTAMP";
+  /**
+   * The timestamp to start reading from when `startingPosition` is `AT_TIMESTAMP`.
+   */
+  startingPositionTimestamp?: Date;
+  /**
+   * The number of batches to process from each shard concurrently.
+   * @default 1
+   */
+  parallelizationFactor?: number;
+  /**
+   * Split the batch in two and retry if the function returns an error.
+   * @default false
+   */
+  bisectBatchOnFunctionError?: boolean;
+  /**
+   * Discard records older than the specified age in seconds.
+   * @default -1
+   */
+  maximumRecordAgeInSeconds?: number;
+  /**
+   * Discard records after the specified number of retries.
+   * @default -1
+   */
+  maximumRetryAttempts?: number;
+  /**
+   * The duration in seconds of a processing window for tumbling windows.
+   */
+  tumblingWindowInSeconds?: number;
+}
+
+export interface StreamsProps extends TableEventSourceProps {
+  /**
+   * The DynamoDB stream view type to enable on the table.
+   * @default "NEW_AND_OLD_IMAGES"
+   */
+  streamViewType?: DynamoDB.StreamViewType;
+}
+
+export const stream = <T extends Table>(
+  table: T,
+  props: StreamsProps = {},
+) => ({
+  process: <Data = unknown, Req = never, StreamReq = never>(
+    process: (
+      stream: Stream.Stream<StreamRecord<Data>, never, StreamReq>,
+    ) => Effect.Effect<void, never, Req>,
+  ) => TableEventSource.use((source) => source(table, props, process)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Table.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Table.ts
new file mode 100644
index 00000000000..9c8369034f2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/Table.ts
@@ -0,0 +1,1377 @@
+import type * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import type {
+  PointInTimeRecoverySpecification,
+  TimeToLiveSpecification,
+} from "@distilled.cloud/aws/dynamodb";
+import * as dynamodb from "@distilled.cloud/aws/dynamodb";
+import type * as lambda from "aws-lambda";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import { havePropsChanged, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { Unowned } from "../../AdoptPolicy.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasAlchemyTags,
+} from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type TableName = string;
+
+export type TableArn =
+  `arn:aws:dynamodb:${RegionID}:${AccountID}:table/${TableName}`;
+
+export type TableRecord<Data> = Omit<lambda.DynamoDBRecord, "dynamodb"> & {
+  dynamodb: Omit<lambda.StreamRecord, "NewImage" | "OldImage"> & {
+    NewImage?: Data;
+    OldImage?: Data;
+  };
+};
+
+export type TableEvent<Data> = Omit<lambda.DynamoDBStreamEvent, "Records"> & {
+  Records: TableRecord<Data>[];
+};
+
+export type ScalarAttributeType = "S" | "N" | "B";
+
+export type TableProps = {
+  /**
+   * Name of the table. If omitted, Alchemy generates a deterministic physical
+   * name from the stack, stage, and logical ID.
+   */
+  tableName?: string;
+  /**
+   * Partition key attribute name for the table.
+   */
+  partitionKey: string;
+  /**
+   * Optional sort key attribute name for the table.
+   */
+  sortKey?: string;
+  /**
+   * Attribute definitions used by the primary key and any secondary indexes.
+   */
+  attributes: Record<string, ScalarAttributeType>;
+  localSecondaryIndexes?: DynamoDB.LocalSecondaryIndex[];
+  globalSecondaryIndexes?: DynamoDB.GlobalSecondaryIndex[];
+  billingMode?: DynamoDB.BillingMode;
+  deletionProtectionEnabled?: boolean;
+  onDemandThroughput?: DynamoDB.OnDemandThroughput;
+  pointInTimeRecoverySpecification?: DynamoDB.PointInTimeRecoverySpecification;
+  provisionedThroughput?: DynamoDB.ProvisionedThroughput;
+  sseSpecification?: DynamoDB.SSESpecification;
+  tags?: Record<string, string>;
+  timeToLiveSpecification?: DynamoDB.TimeToLiveSpecification;
+  warmThroughput?: DynamoDB.WarmThroughput;
+  tableClass?: DynamoDB.TableClass;
+};
+
+export type TableBinding = {
+  streamSpecification?: DynamoDB.StreamSpecification;
+};
+
+export interface Table extends Resource<
+  "AWS.DynamoDB.Table",
+  TableProps,
+  {
+    tableId: string;
+    tableName: TableName;
+    tableArn: TableArn;
+    partitionKey: string;
+    sortKey: string | undefined;
+    latestStreamArn: string | undefined;
+    streamSpecification: DynamoDB.StreamSpecification | undefined;
+    localSecondaryIndexes:
+      | DynamoDB.LocalSecondaryIndexDescription[]
+      | undefined;
+    globalSecondaryIndexes:
+      | DynamoDB.GlobalSecondaryIndexDescription[]
+      | undefined;
+    pointInTimeRecoveryDescription:
+      | DynamoDB.PointInTimeRecoveryDescription
+      | undefined;
+    tags: Record<string, string> | undefined;
+  },
+  TableBinding,
+  Providers
+> {}
+
+/**
+ * An Amazon DynamoDB table with optional indexes, PITR, TTL, and stream-aware
+ * binding support.
+ *
+ * `Table` owns the lifecycle of the physical table while the binding contract
+ * allows runtime-specific integrations such as Lambda table event sources to
+ * request stream configuration without forcing a circular input prop.
+ *
+ * @section Creating Tables
+ * @example Basic Table
+ * ```typescript
+ * import * as DynamoDB from "alchemy/AWS/DynamoDB";
+ *
+ * const table = yield* DynamoDB.Table("UsersTable", {
+ *   partitionKey: "pk",
+ *   attributes: {
+ *     pk: "S",
+ *   },
+ * });
+ * ```
+ *
+ * @example Table with Sort Key and TTL
+ * ```typescript
+ * const table = yield* DynamoDB.Table("SessionsTable", {
+ *   partitionKey: "userId",
+ *   sortKey: "sessionId",
+ *   attributes: {
+ *     userId: "S",
+ *     sessionId: "S",
+ *     expiresAt: "N",
+ *   },
+ *   timeToLiveSpecification: {
+ *     Enabled: true,
+ *     AttributeName: "expiresAt",
+ *   },
+ * });
+ * ```
+ *
+ * @example Table with Global Secondary Index
+ * ```typescript
+ * const table = yield* DynamoDB.Table("OrdersTable", {
+ *   partitionKey: "pk",
+ *   sortKey: "sk",
+ *   attributes: {
+ *     pk: "S",
+ *     sk: "S",
+ *     gsi1pk: "S",
+ *     gsi1sk: "S",
+ *   },
+ *   globalSecondaryIndexes: [{
+ *     IndexName: "GSI1",
+ *     KeySchema: [
+ *       { AttributeName: "gsi1pk", KeyType: "HASH" },
+ *       { AttributeName: "gsi1sk", KeyType: "RANGE" },
+ *     ],
+ *     Projection: { ProjectionType: "ALL" },
+ *   }],
+ * });
+ * ```
+ *
+ * @section Runtime Operations
+ * Bind DynamoDB operations in the init phase and use them in runtime
+ * handlers. Bindings inject the table name and grant scoped IAM
+ * permissions automatically.
+ *
+ * @example Read and write items
+ * ```typescript
+ * // init
+ * const getItem = yield* DynamoDB.GetItem.bind(table);
+ * const putItem = yield* DynamoDB.PutItem.bind(table);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* putItem({
+ *       Item: { pk: { S: "user#123" }, name: { S: "Alice" } },
+ *     });
+ *     const result = yield* getItem({
+ *       Key: { pk: { S: "user#123" } },
+ *     });
+ *     return yield* HttpServerResponse.json(result.Item);
+ *   }),
+ * };
+ * ```
+ *
+ * @section DynamoDB Streams
+ * Process change data capture events from a DynamoDB table using a
+ * Lambda event source mapping. The stream is enabled automatically
+ * through the binding contract.
+ *
+ * @example Process table changes
+ * ```typescript
+ * // init
+ * yield* DynamoDB.streams(table, {
+ *   StreamViewType: "NEW_AND_OLD_IMAGES",
+ * }).process(
+ *   Effect.fn(function* (record) {
+ *     yield* Effect.log(`${record.eventName}: ${JSON.stringify(record.dynamodb)}`);
+ *   }),
+ * );
+ * ```
+ */
+export const Table = Resource<Table>("AWS.DynamoDB.Table");
+
+export const TableProvider = () =>
+  Provider.effect(
+    Table,
+    Effect.gen(function* () {
+      const createTableName = (
+        id: string,
+        props: Input.ResolveProps<TableProps>,
+      ) =>
+        Effect.gen(function* () {
+          return (
+            props.tableName ??
+            (yield* createPhysicalName({
+              id,
+              // see: https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_TableDescription.html#DDB-Type-TableDescription-TableName
+              maxLength: 255,
+            }))
+          );
+        });
+
+      const toKeySchema = (props: Input.ResolveProps<TableProps>) => [
+        {
+          AttributeName: props.partitionKey,
+          KeyType: "HASH" as const,
+        },
+        ...(props.sortKey
+          ? [
+              {
+                AttributeName: props.sortKey,
+                KeyType: "RANGE" as const,
+              },
+            ]
+          : []),
+      ];
+
+      const toAttributeDefinitions = (
+        attrs: Record<string, ScalarAttributeType>,
+      ) =>
+        Object.entries(attrs)
+          .map(([name, type]) => ({
+            AttributeName: name,
+            AttributeType: type,
+          }))
+          .sort((a, b) => a.AttributeName.localeCompare(b.AttributeName));
+
+      const adoptExistingTable = (tableName: string) =>
+        // The engine has cleared us via `read` (foreign-tagged tables are
+        // surfaced as `Unowned`). On a race between read and create, just
+        // describe the existing table and continue.
+        dynamodb
+          .describeTable({ TableName: tableName })
+          .pipe(Effect.map((r) => r.Table!));
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const normalizeStreamSpecification = (
+        streamSpecification: DynamoDB.StreamSpecification | undefined,
+      ) =>
+        streamSpecification?.StreamEnabled === true
+          ? ({
+              StreamEnabled: true,
+              StreamViewType: streamSpecification.StreamViewType,
+            } satisfies DynamoDB.StreamSpecification)
+          : undefined;
+
+      const resolveStreamSpecification = (
+        bindings: ReadonlyArray<TableBinding | { data?: TableBinding }>,
+      ) =>
+        Effect.gen(function* () {
+          const requested = bindings
+            .flatMap((binding) =>
+              (binding as { data?: TableBinding }).data?.streamSpecification
+                ?.StreamEnabled === true
+                ? [
+                    normalizeStreamSpecification(
+                      (binding as { data?: TableBinding }).data
+                        ?.streamSpecification,
+                    ),
+                  ]
+                : (binding as TableBinding).streamSpecification
+                      ?.StreamEnabled === true
+                  ? [
+                      normalizeStreamSpecification(
+                        (binding as TableBinding).streamSpecification,
+                      ),
+                    ]
+                  : [],
+            )
+            .filter((spec) => spec !== undefined);
+
+          if (requested.length === 0) {
+            return undefined;
+          }
+
+          const [first, ...rest] = requested;
+          if (!first?.StreamViewType) {
+            return yield* Effect.fail(new MissingStreamViewType());
+          }
+
+          for (const spec of rest) {
+            if (spec.StreamViewType !== first.StreamViewType) {
+              return yield* Effect.fail(
+                new ConflictingStreamViewTypes({
+                  requested: requested.map((item) => item.StreamViewType),
+                }),
+              );
+            }
+          }
+
+          return first;
+        });
+
+      const isRetryableControlPlaneError = (error: { _tag?: string }) =>
+        error._tag === "InternalServerError" ||
+        error._tag === "LimitExceededException" ||
+        error._tag === "ResourceInUseException" ||
+        error._tag === "ResourceNotFoundException";
+
+      const waitForControlPlaneConvergence = Schedule.fixed("1 second").pipe(
+        Schedule.both(Schedule.recurs(120)),
+      );
+
+      const waitForTableActivationConvergence = Schedule.fixed(
+        "10 seconds",
+      ).pipe(Schedule.both(Schedule.recurs(180)));
+
+      const waitForGlobalSecondaryIndexesConvergence = Schedule.fixed(
+        "10 seconds",
+      ).pipe(Schedule.both(Schedule.recurs(180)));
+
+      const waitForDeletionConvergence = Schedule.fixed("1 second").pipe(
+        Schedule.both(Schedule.recurs(90)),
+      );
+
+      const formatPollingElapsed = (elapsedSeconds: number) =>
+        `${elapsedSeconds}s elapsed`;
+
+      const formatGlobalSecondaryIndexStatuses = (
+        indexes:
+          | readonly DynamoDB.GlobalSecondaryIndexDescription[]
+          | undefined,
+      ) =>
+        JSON.stringify(
+          (indexes ?? []).map((index) => ({
+            name: index.IndexName,
+            status: index.IndexStatus,
+            backfilling: index.Backfilling,
+          })),
+        );
+
+      const updateTimeToLive = (
+        tableName: string,
+        timeToLiveSpecification: TimeToLiveSpecification,
+      ) =>
+        dynamodb
+          .updateTimeToLive({
+            TableName: tableName,
+            TimeToLiveSpecification: timeToLiveSpecification!,
+          })
+          .pipe(
+            Effect.retry({
+              while: isRetryableControlPlaneError,
+              schedule: Schedule.exponential(100).pipe(
+                Schedule.both(Schedule.recurs(30)),
+              ),
+            }),
+          );
+
+      const updateContinuousBackups = (
+        tableName: string,
+        pointInTimeRecoverySpecification: PointInTimeRecoverySpecification,
+      ) =>
+        dynamodb
+          .updateContinuousBackups({
+            TableName: tableName,
+            PointInTimeRecoverySpecification: pointInTimeRecoverySpecification,
+          })
+          .pipe(
+            Effect.retry({
+              while: (e) =>
+                e._tag === "ContinuousBackupsUnavailableException" ||
+                isRetryableControlPlaneError(e),
+              schedule: Schedule.exponential(250).pipe(
+                Schedule.both(Schedule.recurs(30)),
+              ),
+            }),
+          );
+
+      const waitForTableActive = (
+        session: {
+          note: (message: string) => Effect.Effect<void, never, never>;
+        },
+        tableName: string,
+      ) => {
+        let elapsedSeconds = 0;
+        let progressMessage = `DynamoDB Table provider: waiting for table ${tableName} to become ACTIVE`;
+
+        return Effect.gen(function* () {
+          const response = yield* dynamodb.describeTable({
+            TableName: tableName,
+          });
+          if (response.Table?.TableStatus !== "ACTIVE") {
+            progressMessage = `DynamoDB Table provider: table ${tableName} not active yet (status=${response.Table?.TableStatus ?? "undefined"} gsiStatuses=${formatGlobalSecondaryIndexStatuses(response.Table?.GlobalSecondaryIndexes)})`;
+            return yield* Effect.fail(new TableNotActive());
+          }
+          yield* session.note(
+            `DynamoDB Table provider: table ${tableName} is ACTIVE (${formatPollingElapsed(elapsedSeconds)})`,
+          );
+          return response.Table;
+        }).pipe(
+          Effect.retry({
+            while: (error) =>
+              error._tag === "TableNotActive" ||
+              isRetryableControlPlaneError(error),
+            schedule: waitForTableActivationConvergence.pipe(
+              Schedule.tapOutput(([, attempt]) => {
+                elapsedSeconds = (attempt + 1) * 10;
+                return session.note(
+                  `${progressMessage} (${formatPollingElapsed(elapsedSeconds)})`,
+                );
+              }),
+            ),
+          }),
+        );
+      };
+
+      const waitForGlobalSecondaryIndexesStable = (
+        session: {
+          note: (message: string) => Effect.Effect<void, never, never>;
+        },
+        tableName: string,
+        expectedIndexNames: readonly string[],
+      ) => {
+        let elapsedSeconds = 0;
+        let progressMessage = `DynamoDB Table provider: waiting for GSIs on ${tableName} to stabilize`;
+
+        return Effect.gen(function* () {
+          const response = yield* dynamodb.describeTable({
+            TableName: tableName,
+          });
+          const table = response.Table;
+          const actualIndexNames = [...(table?.GlobalSecondaryIndexes ?? [])]
+            .map((index) => index.IndexName!)
+            .sort();
+          const expected = [...expectedIndexNames].sort();
+          const allActive = (table?.GlobalSecondaryIndexes ?? []).every(
+            (index) => index.IndexStatus === "ACTIVE",
+          );
+
+          if (
+            JSON.stringify(actualIndexNames) !== JSON.stringify(expected) ||
+            !allActive
+          ) {
+            progressMessage = `DynamoDB Table provider: GSIs for ${tableName} not stable yet (expected=${JSON.stringify(expected)} actual=${JSON.stringify(actualIndexNames)} statuses=${JSON.stringify((table?.GlobalSecondaryIndexes ?? []).map((index) => ({ name: index.IndexName, status: index.IndexStatus })))} tableStatus=${table?.TableStatus ?? "undefined"})`;
+            return yield* Effect.fail(new TableIndexesNotStable());
+          }
+
+          yield* session.note(
+            `DynamoDB Table provider: GSIs for ${tableName} stabilized (${JSON.stringify(actualIndexNames)}) (${formatPollingElapsed(elapsedSeconds)})`,
+          );
+          return table;
+        }).pipe(
+          Effect.retry({
+            while: (error) =>
+              error._tag === "TableIndexesNotStable" ||
+              isRetryableControlPlaneError(error),
+            schedule: waitForGlobalSecondaryIndexesConvergence.pipe(
+              Schedule.tapOutput(([, attempt]) => {
+                elapsedSeconds = (attempt + 1) * 10;
+                return session.note(
+                  `${progressMessage} (${formatPollingElapsed(elapsedSeconds)})`,
+                );
+              }),
+            ),
+          }),
+        );
+      };
+
+      const waitForTableDeleted = (
+        session: {
+          note: (message: string) => Effect.Effect<void, never, never>;
+        },
+        tableName: string,
+      ) => {
+        let elapsedSeconds = 0;
+        let progressMessage = `DynamoDB Table provider: waiting for deletion of ${tableName}`;
+
+        return Effect.gen(function* () {
+          const response = yield* dynamodb.describeTable({
+            TableName: tableName,
+          });
+          progressMessage = `DynamoDB Table provider: table ${tableName} still deleting (status=${response.Table?.TableStatus ?? "undefined"})`;
+          return yield* Effect.fail(new TableStillDeleting());
+        }).pipe(
+          Effect.catchTag("ResourceNotFoundException", () => {
+            return session.note(
+              `DynamoDB Table provider: table ${tableName} deletion confirmed (${formatPollingElapsed(elapsedSeconds)})`,
+            );
+          }),
+          Effect.retry({
+            while: (error) =>
+              error._tag === "TableStillDeleting" ||
+              isRetryableControlPlaneError(error),
+            schedule: waitForDeletionConvergence.pipe(
+              Schedule.tapOutput(([, attempt]) => {
+                elapsedSeconds = attempt + 1;
+                return session.note(
+                  `${progressMessage} (${formatPollingElapsed(elapsedSeconds)})`,
+                );
+              }),
+            ),
+          }),
+        );
+      };
+
+      const deleteGlobalSecondaryIndexes = (
+        session: {
+          note: (message: string) => Effect.Effect<void, never, never>;
+        },
+        tableName: string,
+      ) =>
+        Effect.gen(function* () {
+          const response = yield* dynamodb
+            .describeTable({
+              TableName: tableName,
+            })
+            .pipe(
+              Effect.retry({
+                while: isRetryableControlPlaneError,
+                schedule: waitForControlPlaneConvergence,
+              }),
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed({ Table: undefined }),
+              ),
+            );
+
+          const indexNames = [...(response.Table?.GlobalSecondaryIndexes ?? [])]
+            .map((index) => index.IndexName!)
+            .sort();
+
+          if (indexNames.length === 0) {
+            yield* session.note(
+              `DynamoDB Table provider: no GSIs remain on ${tableName}; retrying table deletion`,
+            );
+            return;
+          }
+
+          yield* session.note(
+            `DynamoDB Table provider: deleting GSIs before deleting table ${tableName} (${indexNames.join(", ")})`,
+          );
+
+          yield* waitForGlobalSecondaryIndexesStable(
+            session,
+            tableName,
+            indexNames,
+          );
+
+          const remainingIndexNames = [...indexNames];
+          for (const indexName of indexNames) {
+            let elapsedSeconds = 0;
+            let progressMessage = `DynamoDB Table provider: waiting to delete GSI ${indexName} from ${tableName}`;
+
+            yield* session.note(
+              `DynamoDB Table provider: deleting GSI ${indexName} from ${tableName}`,
+            );
+
+            yield* dynamodb
+              .updateTable({
+                TableName: tableName,
+                GlobalSecondaryIndexUpdates: [
+                  {
+                    Delete: {
+                      IndexName: indexName,
+                    },
+                  },
+                ],
+              })
+              .pipe(
+                Effect.timeout(1000),
+                Effect.tap(() =>
+                  session.note(
+                    `DynamoDB Table provider: delete accepted for GSI ${indexName} on ${tableName} (${formatPollingElapsed(elapsedSeconds)})`,
+                  ),
+                ),
+                Effect.retry({
+                  while: (error) => {
+                    if (error._tag === "ResourceInUseException") {
+                      progressMessage = `DynamoDB Table provider: delete for GSI ${indexName} on ${tableName} is blocked while the table or indexes are still transitioning`;
+                      return true;
+                    }
+                    if (error._tag === "TimeoutError") {
+                      progressMessage = `DynamoDB Table provider: delete for GSI ${indexName} on ${tableName} timed out`;
+                      return true;
+                    }
+                    if (
+                      error._tag === "InternalServerError" ||
+                      error._tag === "LimitExceededException"
+                    ) {
+                      progressMessage = `DynamoDB Table provider: delete for GSI ${indexName} on ${tableName} hit ${error._tag}`;
+                      return true;
+                    }
+                    return false;
+                  },
+                  schedule: waitForGlobalSecondaryIndexesConvergence.pipe(
+                    Schedule.tapOutput(([, attempt]) => {
+                      elapsedSeconds = (attempt + 1) * 10;
+                      return session.note(
+                        `${progressMessage} (${formatPollingElapsed(elapsedSeconds)})`,
+                      );
+                    }),
+                  ),
+                }),
+              );
+
+            remainingIndexNames.splice(
+              remainingIndexNames.indexOf(indexName),
+              1,
+            );
+
+            yield* waitForGlobalSecondaryIndexesStable(
+              session,
+              tableName,
+              remainingIndexNames,
+            );
+          }
+        });
+
+      // For read, we want `ResourceNotFoundException` to propagate immediately
+      // (the table doesn't exist — this is the cold-start adoption "no
+      // resource" signal). Only retry on transient control-plane errors.
+      const isRetryableReadError = (error: { _tag?: string }) =>
+        error._tag === "InternalServerError" ||
+        error._tag === "LimitExceededException";
+
+      const readTableState = (tableName: string) =>
+        Effect.gen(function* () {
+          const response = yield* dynamodb
+            .describeTable({
+              TableName: tableName,
+            })
+            .pipe(
+              Effect.retry({
+                while: isRetryableReadError,
+                schedule: Schedule.exponential(250).pipe(
+                  Schedule.both(Schedule.recurs(30)),
+                ),
+              }),
+            );
+          const table = response.Table;
+          if (!table?.TableArn) {
+            return yield* Effect.fail(
+              new Error(`Table ${tableName} not found`),
+            );
+          }
+
+          const [tagsResult, continuousBackupsResult, ttlResult] =
+            yield* Effect.all([
+              dynamodb
+                .listTagsOfResource({
+                  ResourceArn: table.TableArn,
+                })
+                .pipe(
+                  Effect.retry({
+                    while: isRetryableReadError,
+                    schedule: Schedule.exponential(250).pipe(
+                      Schedule.both(Schedule.recurs(30)),
+                    ),
+                  }),
+                ),
+              dynamodb
+                .describeContinuousBackups({
+                  TableName: tableName,
+                })
+                .pipe(
+                  Effect.retry({
+                    while: (e) => e._tag === "InternalServerError",
+                    schedule: Schedule.exponential(250).pipe(
+                      Schedule.both(Schedule.recurs(30)),
+                    ),
+                  }),
+                  Effect.catchTag("TableNotFoundException", () =>
+                    Effect.succeed({ ContinuousBackupsDescription: undefined }),
+                  ),
+                ),
+              dynamodb
+                .describeTimeToLive({
+                  TableName: tableName,
+                })
+                .pipe(
+                  Effect.retry({
+                    while: isRetryableReadError,
+                    schedule: Schedule.exponential(250).pipe(
+                      Schedule.both(Schedule.recurs(30)),
+                    ),
+                  }),
+                  Effect.catchTag("ResourceNotFoundException", () =>
+                    Effect.succeed({ TimeToLiveDescription: undefined }),
+                  ),
+                ),
+            ]);
+
+          return {
+            table,
+            tags: Object.fromEntries(
+              (tagsResult.Tags ?? []).map((tag) => [tag.Key!, tag.Value!]),
+            ) as Record<string, string>,
+            pointInTimeRecoveryDescription:
+              continuousBackupsResult.ContinuousBackupsDescription
+                ?.PointInTimeRecoveryDescription,
+            timeToLiveDescription: ttlResult.TimeToLiveDescription,
+          };
+        }).pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+
+      const toAttrs = (state: {
+        table: DynamoDB.TableDescription;
+        tags: Record<string, string>;
+        pointInTimeRecoveryDescription:
+          | DynamoDB.PointInTimeRecoveryDescription
+          | undefined;
+      }) => ({
+        tableId: state.table.TableId!,
+        tableName: state.table.TableName!,
+        tableArn: state.table.TableArn! as TableArn,
+        partitionKey:
+          state.table.KeySchema?.find((key) => key.KeyType === "HASH")
+            ?.AttributeName ?? "",
+        sortKey: state.table.KeySchema?.find((key) => key.KeyType === "RANGE")
+          ?.AttributeName,
+        latestStreamArn: state.table.LatestStreamArn,
+        streamSpecification: state.table.StreamSpecification,
+        localSecondaryIndexes: state.table.LocalSecondaryIndexes,
+        globalSecondaryIndexes: state.table.GlobalSecondaryIndexes,
+        pointInTimeRecoveryDescription: state.pointInTimeRecoveryDescription,
+        tags: state.tags,
+      });
+
+      const indexesByName = <T extends { IndexName?: string }>(
+        indexes: readonly T[] | undefined,
+      ) =>
+        Object.fromEntries(
+          (indexes ?? []).map((index) => [index.IndexName!, index]),
+        ) as Record<string, T>;
+
+      const sortKeySchema = (
+        keySchema: readonly DynamoDB.KeySchemaElement[] | undefined,
+      ) =>
+        [...(keySchema ?? [])].sort((a, b) =>
+          `${a.KeyType}:${a.AttributeName}`.localeCompare(
+            `${b.KeyType}:${b.AttributeName}`,
+          ),
+        );
+
+      const normalizeProjection = (
+        projection: DynamoDB.Projection | undefined,
+      ) => ({
+        ...projection,
+        NonKeyAttributes: [...(projection?.NonKeyAttributes ?? [])].sort(),
+      });
+
+      const isSameGsiDefinition = (
+        left: DynamoDB.GlobalSecondaryIndex,
+        right: DynamoDB.GlobalSecondaryIndex,
+      ) =>
+        JSON.stringify(sortKeySchema(left.KeySchema)) ===
+          JSON.stringify(sortKeySchema(right.KeySchema)) &&
+        JSON.stringify(normalizeProjection(left.Projection)) ===
+          JSON.stringify(normalizeProjection(right.Projection));
+
+      // The describe response includes server-side bookkeeping fields
+      // (`NumberOfDecreasesToday`, `LastIncreaseDateTime`, etc.) that the
+      // request shape doesn't. For PAY_PER_REQUEST tables it also reports
+      // a zero-throughput object. Normalize both sides to the user-settable
+      // fields so we don't fire a phantom UpdateGlobalSecondaryIndex with
+      // `ProvisionedThroughput: undefined` (which AWS rejects with
+      // ValidationException).
+      const normalizeProvisioned = (
+        pt:
+          | { ReadCapacityUnits?: number; WriteCapacityUnits?: number }
+          | undefined,
+      ) => {
+        if (
+          !pt ||
+          ((pt.ReadCapacityUnits ?? 0) === 0 &&
+            (pt.WriteCapacityUnits ?? 0) === 0)
+        ) {
+          return undefined;
+        }
+        return {
+          ReadCapacityUnits: pt.ReadCapacityUnits,
+          WriteCapacityUnits: pt.WriteCapacityUnits,
+        };
+      };
+
+      const normalizeOnDemand = (
+        od:
+          | {
+              MaxReadRequestUnits?: number;
+              MaxWriteRequestUnits?: number;
+            }
+          | undefined,
+      ) => {
+        if (
+          !od ||
+          ((od.MaxReadRequestUnits ?? -1) < 0 &&
+            (od.MaxWriteRequestUnits ?? -1) < 0)
+        ) {
+          return undefined;
+        }
+        return {
+          MaxReadRequestUnits: od.MaxReadRequestUnits,
+          MaxWriteRequestUnits: od.MaxWriteRequestUnits,
+        };
+      };
+
+      const normalizeWarm = (
+        wt:
+          | { ReadUnitsPerSecond?: number; WriteUnitsPerSecond?: number }
+          | undefined,
+      ) => {
+        if (
+          !wt ||
+          ((wt.ReadUnitsPerSecond ?? 0) === 0 &&
+            (wt.WriteUnitsPerSecond ?? 0) === 0)
+        ) {
+          return undefined;
+        }
+        return {
+          ReadUnitsPerSecond: wt.ReadUnitsPerSecond,
+          WriteUnitsPerSecond: wt.WriteUnitsPerSecond,
+        };
+      };
+
+      const diffGlobalSecondaryIndexes = (
+        olds: readonly DynamoDB.GlobalSecondaryIndex[] | undefined,
+        news: readonly DynamoDB.GlobalSecondaryIndex[] | undefined,
+      ) => {
+        const oldByName = indexesByName(olds);
+        const newByName = indexesByName(news);
+        const updates: DynamoDB.GlobalSecondaryIndexUpdate[] = [];
+        let requiresReplacement = false;
+
+        for (const [indexName, oldIndex] of Object.entries(oldByName)) {
+          const newIndex = newByName[indexName];
+          if (!newIndex) {
+            updates.push({
+              Delete: {
+                IndexName: indexName,
+              },
+            });
+            continue;
+          }
+
+          if (!isSameGsiDefinition(oldIndex, newIndex)) {
+            requiresReplacement = true;
+            continue;
+          }
+
+          // Only emit an Update when the user has explicitly set a
+          // throughput value AND it differs from observed. Cloud-side
+          // defaults (AWS auto-assigns ProvisionedThroughput/WarmThroughput
+          // values for PAY_PER_REQUEST tables) should not trigger phantom
+          // updates against an undefined desired value.
+          const provDiff =
+            newIndex.ProvisionedThroughput !== undefined &&
+            JSON.stringify(
+              normalizeProvisioned(oldIndex.ProvisionedThroughput),
+            ) !==
+              JSON.stringify(
+                normalizeProvisioned(newIndex.ProvisionedThroughput),
+              );
+          const odDiff =
+            newIndex.OnDemandThroughput !== undefined &&
+            JSON.stringify(normalizeOnDemand(oldIndex.OnDemandThroughput)) !==
+              JSON.stringify(normalizeOnDemand(newIndex.OnDemandThroughput));
+          const wtDiff =
+            newIndex.WarmThroughput !== undefined &&
+            JSON.stringify(normalizeWarm(oldIndex.WarmThroughput)) !==
+              JSON.stringify(normalizeWarm(newIndex.WarmThroughput));
+          if (provDiff || odDiff || wtDiff) {
+            updates.push({
+              Update: {
+                IndexName: indexName,
+                ProvisionedThroughput: newIndex.ProvisionedThroughput,
+                OnDemandThroughput: newIndex.OnDemandThroughput,
+                WarmThroughput: newIndex.WarmThroughput,
+              },
+            });
+          }
+        }
+
+        for (const [indexName, newIndex] of Object.entries(newByName)) {
+          if (!oldByName[indexName]) {
+            updates.push({
+              Create: {
+                IndexName: indexName,
+                KeySchema: newIndex.KeySchema,
+                Projection: newIndex.Projection,
+                ProvisionedThroughput: newIndex.ProvisionedThroughput,
+                OnDemandThroughput: newIndex.OnDemandThroughput,
+                WarmThroughput: newIndex.WarmThroughput,
+              },
+            });
+          }
+        }
+
+        return {
+          updates,
+          requiresReplacement,
+        };
+      };
+
+      return Table.Provider.of({
+        stables: ["tableName", "tableId", "tableArn"],
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const tableName =
+            output?.tableName ??
+            (olds ? yield* createTableName(id, olds) : undefined);
+          if (!tableName) return undefined;
+          const state = yield* readTableState(tableName).pipe(
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          if (!state) return undefined;
+          const attrs = toAttrs(state);
+          return (yield* hasAlchemyTags(id, state.tags as any))
+            ? attrs
+            : Unowned(attrs);
+        }),
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            // TODO(sam): if the name is hard-coded, REPLACE is impossible - we need a suffix
+            news.tableName !== olds.tableName ||
+            olds.partitionKey !== news.partitionKey ||
+            olds.sortKey !== news.sortKey
+          ) {
+            return { action: "replace" } as const;
+          }
+          for (const [name, type] of Object.entries(olds.attributes)) {
+            if (news.attributes[name] !== type) {
+              return { action: "replace" } as const;
+            }
+          }
+          if (
+            havePropsChanged(
+              { localSecondaryIndexes: olds.localSecondaryIndexes ?? [] },
+              { localSecondaryIndexes: news.localSecondaryIndexes ?? [] },
+            )
+          ) {
+            return { action: "replace" } as const;
+          }
+          const { requiresReplacement } = diffGlobalSecondaryIndexes(
+            olds.globalSecondaryIndexes,
+            news.globalSecondaryIndexes,
+          );
+          if (requiresReplacement) {
+            return { action: "replace" } as const;
+          }
+          // TODO(sam):
+          // Replacements:
+          // 1. if you change ImportSourceSpecification
+        }),
+
+        reconcile: Effect.fn(function* ({
+          id,
+          output,
+          news,
+          session,
+          bindings,
+        }) {
+          const tableName =
+            output?.tableName ?? (yield* createTableName(id, news));
+          const desiredTags = yield* createTags(id, news.tags);
+          const desiredStreamSpecification =
+            yield* resolveStreamSpecification(bindings);
+
+          // Observe cloud state. `output` is treated as a cache for the table
+          // name; the table's actual existence and configuration are fetched
+          // fresh so the reconciler converges regardless of drift, adoption,
+          // or a partially-completed prior run.
+          let state = yield* readTableState(tableName);
+
+          if (state === undefined) {
+            yield* session.note(
+              `Table ${tableName}: creating with stream specification ${JSON.stringify(desiredStreamSpecification)}`,
+            );
+            yield* dynamodb
+              .createTable({
+                TableName: tableName,
+                TableClass: news.tableClass,
+                KeySchema: toKeySchema(news),
+                AttributeDefinitions: toAttributeDefinitions(news.attributes),
+                LocalSecondaryIndexes: news.localSecondaryIndexes,
+                GlobalSecondaryIndexes: news.globalSecondaryIndexes,
+                BillingMode: news.billingMode ?? "PAY_PER_REQUEST",
+                SSESpecification: news.sseSpecification,
+                StreamSpecification: desiredStreamSpecification,
+                WarmThroughput: news.warmThroughput,
+                DeletionProtectionEnabled: news.deletionProtectionEnabled,
+                OnDemandThroughput: news.onDemandThroughput,
+                ProvisionedThroughput: news.provisionedThroughput,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) =>
+                    e._tag === "LimitExceededException" ||
+                    e._tag === "InternalServerError",
+                  schedule: Schedule.exponential(100),
+                }),
+                // A peer reconciler created the table between our observe and
+                // create; describe it and continue with the sync path.
+                Effect.catchTag("ResourceInUseException", () =>
+                  adoptExistingTable(tableName),
+                ),
+              );
+
+            yield* waitForTableActive(session, tableName);
+
+            if ((news.globalSecondaryIndexes?.length ?? 0) > 0) {
+              yield* waitForGlobalSecondaryIndexesStable(
+                session,
+                tableName,
+                news.globalSecondaryIndexes?.map((index) => index.IndexName) ??
+                  [],
+              );
+            }
+
+            state = yield* readTableState(tableName);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(`Failed to read created table ${tableName}`),
+              );
+            }
+          }
+
+          // Sync stream specification — observed ↔ desired.
+          //
+          // SQL of stream changes: changing the StreamViewType requires a
+          // disable→enable sequence; AWS rejects an in-place view-type change.
+          const currentStreamSpecification = normalizeStreamSpecification(
+            state.table.StreamSpecification,
+          );
+          const streamViewTypeChanged =
+            currentStreamSpecification?.StreamEnabled === true &&
+            desiredStreamSpecification?.StreamEnabled === true &&
+            currentStreamSpecification.StreamViewType !==
+              desiredStreamSpecification.StreamViewType;
+
+          if (streamViewTypeChanged) {
+            yield* dynamodb.updateTable({
+              TableName: tableName,
+              StreamSpecification: { StreamEnabled: false },
+            });
+            yield* waitForTableActive(session, tableName);
+          }
+
+          if (
+            havePropsChanged(
+              { streamSpecification: currentStreamSpecification },
+              { streamSpecification: desiredStreamSpecification },
+            )
+          ) {
+            yield* session.note(
+              `Table ${tableName}: updating stream configuration`,
+            );
+            yield* dynamodb.updateTable({
+              TableName: tableName,
+              StreamSpecification: desiredStreamSpecification ?? {
+                StreamEnabled: false,
+              },
+            });
+            yield* waitForTableActive(session, tableName);
+          }
+
+          // Sync GSIs — diff observed cloud state against desired and apply
+          // each delta serially. AWS only accepts one GSI change per
+          // updateTable call. The diff function only reads fields shared
+          // between `GlobalSecondaryIndex` and `GlobalSecondaryIndexDescription`
+          // (IndexName, KeySchema, Projection, throughputs), so the cast is safe.
+          const { updates: globalSecondaryIndexUpdates } =
+            diffGlobalSecondaryIndexes(
+              state.table.GlobalSecondaryIndexes as
+                | readonly DynamoDB.GlobalSecondaryIndex[]
+                | undefined,
+              news.globalSecondaryIndexes,
+            );
+
+          for (const globalSecondaryIndexUpdate of globalSecondaryIndexUpdates) {
+            const action = globalSecondaryIndexUpdate.Create
+              ? `create ${globalSecondaryIndexUpdate.Create.IndexName}`
+              : globalSecondaryIndexUpdate.Update
+                ? `update ${globalSecondaryIndexUpdate.Update.IndexName}`
+                : `delete ${globalSecondaryIndexUpdate.Delete!.IndexName}`;
+            yield* session.note(
+              `Table ${tableName}: applying GSI update (${action})`,
+            );
+            yield* dynamodb.updateTable({
+              TableName: tableName,
+              AttributeDefinitions: toAttributeDefinitions(news.attributes),
+              GlobalSecondaryIndexUpdates: [globalSecondaryIndexUpdate],
+            });
+            yield* waitForTableActive(session, tableName);
+          }
+
+          if (globalSecondaryIndexUpdates.length > 0) {
+            const expectedNames =
+              news.globalSecondaryIndexes?.map((index) => index.IndexName) ??
+              [];
+            yield* session.note(
+              `Table ${tableName}: waiting for GSIs to stabilize (${expectedNames.join(", ") || "none"})`,
+            );
+            yield* waitForGlobalSecondaryIndexesStable(
+              session,
+              tableName,
+              expectedNames,
+            );
+            yield* session.note(`Table ${tableName}: GSIs stabilized`);
+          }
+
+          // Sync base attributes — observed ↔ desired.
+          const desiredBillingMode = news.billingMode ?? "PAY_PER_REQUEST";
+          const observedBillingMode =
+            state.table.BillingModeSummary?.BillingMode ?? "PAY_PER_REQUEST";
+          const observedProvisionedThroughput = state.table
+            .ProvisionedThroughput
+            ? {
+                ReadCapacityUnits:
+                  state.table.ProvisionedThroughput.ReadCapacityUnits,
+                WriteCapacityUnits:
+                  state.table.ProvisionedThroughput.WriteCapacityUnits,
+              }
+            : undefined;
+          const baseChanged = havePropsChanged(
+            {
+              tableClass: state.table.TableClassSummary?.TableClass,
+              billingMode: observedBillingMode,
+              deletionProtectionEnabled:
+                state.table.DeletionProtectionEnabled ?? false,
+              provisionedThroughput:
+                desiredBillingMode === "PROVISIONED"
+                  ? observedProvisionedThroughput
+                  : undefined,
+            },
+            {
+              tableClass: news.tableClass,
+              billingMode: desiredBillingMode,
+              deletionProtectionEnabled:
+                news.deletionProtectionEnabled ?? false,
+              provisionedThroughput:
+                desiredBillingMode === "PROVISIONED"
+                  ? news.provisionedThroughput
+                  : undefined,
+            },
+          );
+
+          if (baseChanged) {
+            yield* dynamodb.updateTable({
+              TableName: tableName,
+              TableClass: news.tableClass,
+              AttributeDefinitions: toAttributeDefinitions(news.attributes),
+              BillingMode: desiredBillingMode,
+              SSESpecification: news.sseSpecification,
+              WarmThroughput: news.warmThroughput,
+              DeletionProtectionEnabled: news.deletionProtectionEnabled,
+              OnDemandThroughput: news.onDemandThroughput,
+              ProvisionedThroughput: news.provisionedThroughput,
+            });
+            yield* waitForTableActive(session, tableName);
+          }
+
+          // Sync TTL — observed ↔ desired.
+          //
+          // updateTimeToLive rejects calls that would not change anything
+          // (e.g. enabling TTL on the same attribute name), so we have to
+          // diff against the current TimeToLiveDescription before calling.
+          const currentTtl = state.timeToLiveDescription;
+          const currentTtlEnabled =
+            currentTtl?.TimeToLiveStatus === "ENABLED" ||
+            currentTtl?.TimeToLiveStatus === "ENABLING";
+          const currentTtlAttribute = currentTtl?.AttributeName;
+          const desiredTtl = news.timeToLiveSpecification;
+          const desiredTtlEnabled = desiredTtl?.Enabled === true;
+          const desiredTtlAttribute = desiredTtl?.AttributeName;
+
+          if (
+            desiredTtlEnabled !== currentTtlEnabled ||
+            (desiredTtlEnabled && desiredTtlAttribute !== currentTtlAttribute)
+          ) {
+            if (desiredTtlEnabled) {
+              if (
+                currentTtlEnabled &&
+                currentTtlAttribute !== desiredTtlAttribute
+              ) {
+                // AWS only allows one TTL attribute. We must disable first
+                // before re-enabling on a different attribute.
+                yield* updateTimeToLive(tableName, {
+                  AttributeName: currentTtlAttribute!,
+                  Enabled: false,
+                });
+              }
+              yield* updateTimeToLive(tableName, {
+                AttributeName: desiredTtlAttribute!,
+                Enabled: true,
+              });
+            } else if (currentTtlEnabled && currentTtlAttribute) {
+              yield* updateTimeToLive(tableName, {
+                AttributeName: currentTtlAttribute,
+                Enabled: false,
+              });
+            }
+          }
+
+          // Sync PITR — observed ↔ desired.
+          const currentPitrEnabled =
+            state.pointInTimeRecoveryDescription?.PointInTimeRecoveryStatus ===
+            "ENABLED";
+          const desiredPitrEnabled =
+            news.pointInTimeRecoverySpecification?.PointInTimeRecoveryEnabled ??
+            false;
+          const currentPitrPeriod =
+            state.pointInTimeRecoveryDescription?.RecoveryPeriodInDays;
+          const desiredPitrPeriod =
+            news.pointInTimeRecoverySpecification?.RecoveryPeriodInDays;
+          if (
+            currentPitrEnabled !== desiredPitrEnabled ||
+            (desiredPitrEnabled && currentPitrPeriod !== desiredPitrPeriod)
+          ) {
+            yield* updateContinuousBackups(tableName, {
+              PointInTimeRecoveryEnabled: desiredPitrEnabled,
+              RecoveryPeriodInDays: desiredPitrPeriod,
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          //
+          // Adoption may bring us a table that already has its own tag set;
+          // diffing against `state.tags` (fetched fresh) lets the reconciler
+          // converge ownership without fighting whatever was there before.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
+          if (removed.length > 0) {
+            yield* dynamodb.untagResource({
+              ResourceArn: state.table.TableArn!,
+              TagKeys: removed,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* dynamodb.tagResource({
+              ResourceArn: state.table.TableArn!,
+              Tags: upsert,
+            });
+          }
+
+          // Re-read final state after all sync steps so the returned
+          // attributes reflect the post-reconcile cloud state.
+          const final = yield* readTableState(tableName);
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(`Failed to read reconciled table ${tableName}`),
+            );
+          }
+
+          yield* session.note(final.table.TableArn!);
+
+          return {
+            ...toAttrs(final),
+            tags: desiredTags,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          let deleteAttempt = 0;
+
+          while (true) {
+            deleteAttempt += 1;
+            yield* session.note(
+              `Table ${output.tableName}: deleting (attempt ${deleteAttempt})`,
+            );
+
+            const deleteResult = yield* dynamodb
+              .deleteTable({
+                TableName: output.tableName,
+              })
+              .pipe(
+                Effect.timeout(1000),
+                Effect.as("accepted" as const),
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed("already-deleted" as const),
+                ),
+                Effect.catchTag("ResourceInUseException", () =>
+                  Effect.succeed("delete-gsis-first" as const),
+                ),
+                Effect.retry({
+                  while: (error) =>
+                    error._tag === "InternalServerError" ||
+                    error._tag === "TimeoutError",
+                  schedule: waitForDeletionConvergence.pipe(
+                    Schedule.tapOutput(([, attempt]) =>
+                      session.note(
+                        `DynamoDB Table provider: deleteTable transient failure for ${output.tableName} on attempt ${deleteAttempt} (${formatPollingElapsed(attempt + 1)})`,
+                      ),
+                    ),
+                  ),
+                }),
+              );
+
+            if (deleteResult === "accepted") {
+              yield* session.note(
+                `DynamoDB Table provider: deleteTable accepted for ${output.tableName}`,
+              );
+              break;
+            }
+
+            if (deleteResult === "already-deleted") {
+              yield* session.note(
+                `DynamoDB Table provider: table ${output.tableName} already deleted`,
+              );
+              return;
+            }
+
+            yield* session.note(
+              `DynamoDB Table provider: deleteTable blocked for ${output.tableName}; deleting GSIs first`,
+            );
+            yield* deleteGlobalSecondaryIndexes(session, output.tableName);
+            yield* waitForGlobalSecondaryIndexesStable(
+              session,
+              output.tableName,
+              [],
+            );
+            yield* waitForTableActive(session, output.tableName);
+          }
+
+          yield* session.note(
+            `Table ${output.tableName}: waiting for deletion`,
+          );
+          yield* waitForTableDeleted(session, output.tableName);
+        }),
+      });
+    }),
+  );
+
+class TableNotActive extends Data.TaggedError("TableNotActive") {}
+
+class TableIndexesNotStable extends Data.TaggedError("TableIndexesNotStable") {}
+
+class TableStillDeleting extends Data.TaggedError("TableStillDeleting") {}
+
+class MissingStreamViewType extends Data.TaggedError("MissingStreamViewType") {}
+
+class ConflictingStreamViewTypes extends Data.TaggedError(
+  "ConflictingStreamViewTypes",
+)<{
+  requested: readonly (DynamoDB.StreamViewType | undefined)[];
+}> {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/TransactGetItems.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/TransactGetItems.ts
new file mode 100644
index 00000000000..dae8a7a1ed5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/TransactGetItems.ts
@@ -0,0 +1,154 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+type TransactGetItemsTables = [Table, ...Table[]];
+
+type NativeTransactGet = NonNullable<
+  NonNullable<DynamoDB.TransactGetItemsInput["TransactItems"]>[number]["Get"]
+>;
+
+const sortTables = (tables: TransactGetItemsTables) =>
+  [
+    ...new Map(
+      tables.map((table) => [table.LogicalId, table] as const),
+    ).values(),
+  ].sort((a, b) =>
+    a.LogicalId.localeCompare(b.LogicalId),
+  ) as TransactGetItemsTables;
+
+export interface TransactGet extends Omit<NativeTransactGet, "TableName"> {
+  Table: string;
+}
+
+export interface TransactGetItemsRequest extends Omit<
+  DynamoDB.TransactGetItemsInput,
+  "TransactItems"
+> {
+  TransactItems: Array<{
+    Get: TransactGet;
+  }>;
+}
+
+/**
+ * Runtime binding for `dynamodb:TransactGetItems`.
+ *
+ * Bind this operation to one or more tables and identify each table in the
+ * request with the bound table's `LogicalId`.
+ *
+ * @section Reading Data
+ * @example Read Items Transactionally
+ * ```typescript
+ * const transactGetItems = yield* TransactGetItems.bind(
+ *   sourceTable,
+ *   archiveTable,
+ * );
+ *
+ * const response = yield* transactGetItems({
+ *   TransactItems: [
+ *     {
+ *       Get: {
+ *         Table: sourceTable.LogicalId,
+ *         Key: { pk: { S: "user#1" }, sk: { S: "profile" } },
+ *       },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export class TransactGetItems extends Binding.Service<
+  TransactGetItems,
+  (
+    ...tables: TransactGetItemsTables
+  ) => Effect.Effect<
+    (
+      request: TransactGetItemsRequest,
+    ) => Effect.Effect<
+      DynamoDB.TransactGetItemsOutput,
+      DynamoDB.TransactGetItemsError
+    >
+  >
+>()("AWS.DynamoDB.TransactGetItems") {}
+
+export const TransactGetItemsLive = Layer.effect(
+  TransactGetItems,
+  Effect.gen(function* () {
+    const Policy = yield* TransactGetItemsPolicy;
+    const transactGetItems = yield* DynamoDB.transactGetItems;
+
+    return Effect.fn(function* (...tables: TransactGetItemsTables) {
+      const sortedTables = sortTables(tables);
+      const tableNames = new Map(
+        yield* Effect.forEach(sortedTables, (table) =>
+          Effect.gen(function* () {
+            return [table.LogicalId, yield* table.tableName] as const;
+          }),
+        ),
+      );
+
+      const getTableName = (tableId: string) => {
+        const TableName = tableNames.get(tableId);
+        if (!TableName) {
+          throw new Error(
+            `TransactGetItems request references unbound table '${tableId}'`,
+          );
+        }
+        return TableName;
+      };
+
+      yield* Policy(...sortedTables);
+
+      return Effect.fn(function* (request: TransactGetItemsRequest) {
+        const transactItems = yield* Effect.forEach(
+          request.TransactItems,
+          ({ Get }) =>
+            Effect.gen(function* () {
+              return {
+                Get: {
+                  ...Get,
+                  TableName: yield* getTableName(Get.Table),
+                },
+              };
+            }),
+        );
+
+        return yield* transactGetItems({
+          ...request,
+          TransactItems: transactItems,
+        });
+      });
+    });
+  }),
+);
+
+export class TransactGetItemsPolicy extends Binding.Policy<
+  TransactGetItemsPolicy,
+  (...tables: TransactGetItemsTables) => Effect.Effect<void>
+>()("AWS.DynamoDB.TransactGetItems") {}
+
+export const TransactGetItemsPolicyLive = TransactGetItemsPolicy.layer.succeed(
+  Effect.fn(function* (host, ...tables: TransactGetItemsTables) {
+    const sortedTables = sortTables(tables);
+
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.TransactGetItems(${sortedTables}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["dynamodb:GetItem"],
+              Resource: sortedTables.map((table) => table.tableArn),
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `TransactGetItemsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/TransactWriteItems.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/TransactWriteItems.ts
new file mode 100644
index 00000000000..5b36f0bd4d3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/TransactWriteItems.ts
@@ -0,0 +1,216 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+type TransactWriteItemsTables = [Table, ...Table[]];
+
+type NativeTransactWriteItem = NonNullable<
+  DynamoDB.TransactWriteItemsInput["TransactItems"]
+>[number];
+
+type NativeConditionCheck = NonNullable<
+  NativeTransactWriteItem["ConditionCheck"]
+>;
+type NativeDelete = NonNullable<NativeTransactWriteItem["Delete"]>;
+type NativePut = NonNullable<NativeTransactWriteItem["Put"]>;
+type NativeUpdate = NonNullable<NativeTransactWriteItem["Update"]>;
+
+const sortTables = (tables: TransactWriteItemsTables) =>
+  [
+    ...new Map(
+      tables.map((table) => [table.LogicalId, table] as const),
+    ).values(),
+  ].sort((a, b) =>
+    a.LogicalId.localeCompare(b.LogicalId),
+  ) as TransactWriteItemsTables;
+
+export interface BoundConditionCheck extends Omit<
+  NativeConditionCheck,
+  "TableName"
+> {
+  Table: string;
+}
+
+export interface BoundDelete extends Omit<NativeDelete, "TableName"> {
+  Table: string;
+}
+
+export interface BoundPut extends Omit<NativePut, "TableName"> {
+  Table: string;
+}
+
+export interface BoundUpdate extends Omit<NativeUpdate, "TableName"> {
+  Table: string;
+}
+
+export interface BoundTransactWriteItem {
+  ConditionCheck?: BoundConditionCheck;
+  Delete?: BoundDelete;
+  Put?: BoundPut;
+  Update?: BoundUpdate;
+}
+
+export interface TransactWriteItemsRequest extends Omit<
+  DynamoDB.TransactWriteItemsInput,
+  "TransactItems"
+> {
+  TransactItems: Array<BoundTransactWriteItem>;
+}
+
+/**
+ * Runtime binding for `dynamodb:TransactWriteItems`.
+ *
+ * Bind this operation to one or more tables and identify each item's target
+ * table by the bound table's `LogicalId`.
+ *
+ * @section Writing Data
+ * @example Write Items Transactionally
+ * ```typescript
+ * const transactWriteItems = yield* TransactWriteItems.bind(
+ *   sourceTable,
+ *   archiveTable,
+ * );
+ *
+ * yield* transactWriteItems({
+ *   TransactItems: [
+ *     {
+ *       Put: {
+ *         Table: sourceTable.LogicalId,
+ *         Item: { pk: { S: "user#1" }, sk: { S: "profile" } },
+ *       },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export class TransactWriteItems extends Binding.Service<
+  TransactWriteItems,
+  (
+    ...tables: TransactWriteItemsTables
+  ) => Effect.Effect<
+    (
+      request: TransactWriteItemsRequest,
+    ) => Effect.Effect<
+      DynamoDB.TransactWriteItemsOutput,
+      DynamoDB.TransactWriteItemsError
+    >
+  >
+>()("AWS.DynamoDB.TransactWriteItems") {}
+
+export const TransactWriteItemsLive = Layer.effect(
+  TransactWriteItems,
+  Effect.gen(function* () {
+    const Policy = yield* TransactWriteItemsPolicy;
+    const transactWriteItems = yield* DynamoDB.transactWriteItems;
+
+    return Effect.fn(function* (...tables: TransactWriteItemsTables) {
+      const sortedTables = sortTables(tables);
+      const tableNames = new Map(
+        yield* Effect.forEach(sortedTables, (table) =>
+          Effect.gen(function* () {
+            return [table.LogicalId, yield* table.tableName] as const;
+          }),
+        ),
+      );
+
+      const getTableName = (tableId: string) => {
+        const TableName = tableNames.get(tableId);
+        if (!TableName) {
+          throw new Error(
+            `TransactWriteItems request references unbound table '${tableId}'`,
+          );
+        }
+        return TableName;
+      };
+
+      yield* Policy(...sortedTables);
+
+      return Effect.fn(function* (request: TransactWriteItemsRequest) {
+        const transactItems = yield* Effect.forEach(
+          request.TransactItems,
+          (item) =>
+            Effect.gen(function* () {
+              if (item.ConditionCheck) {
+                return {
+                  ConditionCheck: {
+                    ...item.ConditionCheck,
+                    TableName: yield* getTableName(item.ConditionCheck.Table),
+                  },
+                };
+              }
+              if (item.Delete) {
+                return {
+                  Delete: {
+                    ...item.Delete,
+                    TableName: yield* getTableName(item.Delete.Table),
+                  },
+                };
+              }
+              if (item.Put) {
+                return {
+                  Put: {
+                    ...item.Put,
+                    TableName: yield* getTableName(item.Put.Table),
+                  },
+                };
+              }
+              if (item.Update) {
+                return {
+                  Update: {
+                    ...item.Update,
+                    TableName: yield* getTableName(item.Update.Table),
+                  },
+                };
+              }
+              throw new Error(
+                "TransactWriteItems request item must include one DynamoDB operation",
+              );
+            }),
+        );
+
+        return yield* transactWriteItems({
+          ...request,
+          TransactItems: transactItems,
+        });
+      });
+    });
+  }),
+);
+
+export class TransactWriteItemsPolicy extends Binding.Policy<
+  TransactWriteItemsPolicy,
+  (...tables: TransactWriteItemsTables) => Effect.Effect<void>
+>()("AWS.DynamoDB.TransactWriteItems") {}
+
+export const TransactWriteItemsPolicyLive =
+  TransactWriteItemsPolicy.layer.succeed(
+    Effect.fn(function* (host, ...tables: TransactWriteItemsTables) {
+      const sortedTables = sortTables(tables);
+
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.TransactWriteItems(${sortedTables}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "dynamodb:ConditionCheckItem",
+                  "dynamodb:DeleteItem",
+                  "dynamodb:PutItem",
+                  "dynamodb:UpdateItem",
+                ],
+                Resource: sortedTables.map((table) => table.tableArn),
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `TransactWriteItemsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/UpdateItem.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/UpdateItem.ts
new file mode 100644
index 00000000000..6691a9c730b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/UpdateItem.ts
@@ -0,0 +1,67 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface UpdateItemRequest extends Omit<
+  DynamoDB.UpdateItemInput,
+  "TableName"
+> {}
+
+export class UpdateItem extends Binding.Service<
+  UpdateItem,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: UpdateItemRequest,
+    ) => Effect.Effect<DynamoDB.UpdateItemOutput, DynamoDB.UpdateItemError>
+  >
+>()("AWS.DynamoDB.UpdateItem") {}
+
+export const UpdateItemLive = Layer.effect(
+  UpdateItem,
+  Effect.gen(function* () {
+    const Policy = yield* UpdateItemPolicy;
+    const updateItem = yield* DynamoDB.updateItem;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request: UpdateItemRequest) {
+        const tableName = yield* TableName;
+        return yield* updateItem({
+          ...request,
+          TableName: tableName,
+        });
+      });
+    });
+  }),
+);
+
+export class UpdateItemPolicy extends Binding.Policy<
+  UpdateItemPolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.UpdateItem") {}
+
+export const UpdateItemPolicyLive = UpdateItemPolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.UpdateItem(${table}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["dynamodb:UpdateItem"],
+            Resource: [table.tableArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `UpdateItemPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/UpdateTimeToLive.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/UpdateTimeToLive.ts
new file mode 100644
index 00000000000..ea0045ba7e4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/UpdateTimeToLive.ts
@@ -0,0 +1,71 @@
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Table } from "./Table.ts";
+
+export interface UpdateTimeToLiveRequest extends Omit<
+  DynamoDB.UpdateTimeToLiveInput,
+  "TableName"
+> {}
+
+export class UpdateTimeToLive extends Binding.Service<
+  UpdateTimeToLive,
+  <T extends Table>(
+    table: T,
+  ) => Effect.Effect<
+    (
+      request: UpdateTimeToLiveRequest,
+    ) => Effect.Effect<
+      DynamoDB.UpdateTimeToLiveOutput,
+      DynamoDB.UpdateTimeToLiveError
+    >
+  >
+>()("AWS.DynamoDB.UpdateTimeToLive") {}
+
+export const UpdateTimeToLiveLive = Layer.effect(
+  UpdateTimeToLive,
+  Effect.gen(function* () {
+    const Policy = yield* UpdateTimeToLivePolicy;
+    const updateTimeToLive = yield* DynamoDB.updateTimeToLive;
+
+    return Effect.fn(function* <T extends Table>(table: T) {
+      const TableName = yield* table.tableName;
+      yield* Policy(table);
+      return Effect.fn(function* (request: UpdateTimeToLiveRequest) {
+        return yield* updateTimeToLive({
+          ...request,
+          TableName: yield* TableName,
+        });
+      });
+    });
+  }),
+);
+
+export class UpdateTimeToLivePolicy extends Binding.Policy<
+  UpdateTimeToLivePolicy,
+  <T extends Table>(table: T) => Effect.Effect<void>
+>()("AWS.DynamoDB.UpdateTimeToLive") {}
+
+export const UpdateTimeToLivePolicyLive = UpdateTimeToLivePolicy.layer.succeed(
+  Effect.fn(function* (host, table) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.DynamoDB.UpdateTimeToLive(${table}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["dynamodb:UpdateTimeToLive"],
+              Resource: [table.tableArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `UpdateTimeToLivePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/index.ts
new file mode 100644
index 00000000000..f5f526e5fc9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/DynamoDB/index.ts
@@ -0,0 +1,24 @@
+export * from "./AttributeValue.ts";
+export * from "./BatchExecuteStatement.ts";
+export * from "./BatchGetItem.ts";
+export * from "./BatchWriteItem.ts";
+export * from "./DeleteItem.ts";
+export * from "./DescribeTable.ts";
+export * from "./DescribeTimeToLive.ts";
+export * from "./ExecuteStatement.ts";
+export * from "./ExecuteTransaction.ts";
+export * as Expr from "./Expr.ts";
+export * from "./GetItem.ts";
+export * from "./ListTables.ts";
+export * from "./ListTagsOfResource.ts";
+export * from "./ProjectionExpression.ts";
+export * from "./PutItem.ts";
+export * from "./Query.ts";
+export * from "./RestoreTableToPointInTime.ts";
+export * from "./Scan.ts";
+export * from "./Stream.ts";
+export * from "./Table.ts";
+export * from "./TransactGetItems.ts";
+export * from "./TransactWriteItems.ts";
+export * from "./UpdateItem.ts";
+export * from "./UpdateTimeToLive.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/EIP.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/EIP.ts
new file mode 100644
index 00000000000..60123e2a730
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/EIP.ts
@@ -0,0 +1,294 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type EIPArn =
+  `arn:aws:ec2:${RegionID}:${AccountID}:elastic-ip/${AllocationId}`;
+
+export type AllocationId<ID extends string = string> = `eipalloc-${ID}`;
+export const AllocationId = <ID extends string>(
+  id: ID,
+): ID & AllocationId<ID> => `eipalloc-${id}` as ID & AllocationId<ID>;
+
+export interface EIPProps {
+  /**
+   * Indicates whether the Elastic IP address is for use with instances in a VPC or EC2-Classic.
+   * @default "vpc"
+   */
+  domain?: "vpc" | "standard";
+
+  /**
+   * The ID of an address pool that you own.
+   * Use this parameter to let Amazon EC2 select an address from the address pool.
+   */
+  publicIpv4Pool?: string;
+
+  /**
+   * A unique set of Availability Zones, Local Zones, or Wavelength Zones
+   * from which AWS advertises IP addresses.
+   */
+  networkBorderGroup?: string;
+
+  /**
+   * The ID of a customer-owned address pool.
+   * Use this parameter to let Amazon EC2 select an address from the address pool.
+   */
+  customerOwnedIpv4Pool?: string;
+
+  /**
+   * Tags to assign to the Elastic IP.
+   * These will be merged with alchemy auto-tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface EIP extends Resource<
+  "AWS.EC2.EIP",
+  EIPProps,
+  {
+    /**
+     * The allocation ID for the Elastic IP address.
+     */
+    allocationId: AllocationId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the Elastic IP.
+     */
+    eipArn: `arn:aws:ec2:${RegionID}:${AccountID}:elastic-ip/${string}`;
+
+    /**
+     * The Elastic IP address.
+     */
+    publicIp: string;
+
+    /**
+     * The ID of an address pool.
+     */
+    publicIpv4Pool?: string;
+
+    /**
+     * Indicates whether the Elastic IP address is for use with instances in a VPC or EC2-Classic.
+     */
+    domain: "vpc" | "standard";
+
+    /**
+     * The network border group.
+     */
+    networkBorderGroup?: string;
+
+    /**
+     * The customer-owned IP address.
+     */
+    customerOwnedIp?: string;
+
+    /**
+     * The ID of the customer-owned address pool.
+     */
+    customerOwnedIpv4Pool?: string;
+
+    /**
+     * The carrier IP address associated with the network interface.
+     */
+    carrierIp?: string;
+  },
+  never,
+  Providers
+> {}
+export const EIP = Resource<EIP>("AWS.EC2.EIP");
+
+export const EIPProvider = () =>
+  Provider.effect(
+    EIP,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      return {
+        stables: ["allocationId", "eipArn", "publicIp"],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const result = yield* ec2.describeAddresses({
+            AllocationIds: [output.allocationId],
+          });
+
+          const address = result.Addresses?.[0];
+          if (!address) {
+            return yield* Effect.fail(
+              new Error(`EIP ${output.allocationId} not found`),
+            );
+          }
+
+          return {
+            allocationId: address.AllocationId as AllocationId,
+            eipArn:
+              `arn:aws:ec2:${region}:${accountId}:elastic-ip/${address.AllocationId}` as EIPArn,
+            publicIp: address.PublicIp!,
+            publicIpv4Pool: address.PublicIpv4Pool,
+            domain: (address.Domain as "vpc" | "standard") ?? "vpc",
+            networkBorderGroup: address.NetworkBorderGroup,
+            customerOwnedIp: address.CustomerOwnedIp,
+            customerOwnedIpv4Pool: address.CustomerOwnedIpv4Pool,
+            carrierIp: address.CarrierIp,
+          } satisfies EIP["Attributes"];
+        }),
+
+        diff: Effect.fn(function* ({ news = {}, olds = {} }) {
+          if (!isResolved(news)) return;
+          // EIPs are immutable - any change to core properties requires replacement
+          if (
+            news.publicIpv4Pool !== olds.publicIpv4Pool ||
+            news.networkBorderGroup !== olds.networkBorderGroup ||
+            news.customerOwnedIpv4Pool !== olds.customerOwnedIpv4Pool
+          ) {
+            return { action: "replace" };
+          }
+          // Tags can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — try to find an existing EIP via the cached allocationId.
+          // If it was released out-of-band, fall through to allocate.
+          let address: ec2.Address | undefined;
+          if (output?.allocationId) {
+            const lookup = yield* ec2
+              .describeAddresses({ AllocationIds: [output.allocationId] })
+              .pipe(
+                Effect.catchTag("InvalidAllocationID.NotFound", () =>
+                  Effect.succeed({ Addresses: [] }),
+                ),
+              );
+            address = lookup.Addresses?.[0];
+          }
+
+          // Ensure — allocate a new EIP when none was observed.
+          if (address === undefined) {
+            yield* session.note("Allocating Elastic IP address...");
+            const result = yield* ec2.allocateAddress({
+              Domain: news.domain ?? "vpc",
+              PublicIpv4Pool: news.publicIpv4Pool,
+              NetworkBorderGroup: news.networkBorderGroup,
+              CustomerOwnedIpv4Pool: news.customerOwnedIpv4Pool,
+              TagSpecifications: [
+                {
+                  ResourceType: "elastic-ip",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const allocationId = result.AllocationId! as AllocationId;
+            yield* session.note(`Elastic IP allocated: ${allocationId}`);
+            const lookup = yield* ec2.describeAddresses({
+              AllocationIds: [allocationId],
+            });
+            address = lookup.Addresses?.[0];
+            if (!address) {
+              return yield* Effect.fail(
+                new Error(`EIP ${allocationId} disappeared after allocation`),
+              );
+            }
+          }
+
+          const allocationId = address.AllocationId! as AllocationId;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (address.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [allocationId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [allocationId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          return {
+            allocationId,
+            eipArn:
+              `arn:aws:ec2:${region}:${accountId}:elastic-ip/${allocationId}` as EIPArn,
+            publicIp: address.PublicIp!,
+            publicIpv4Pool: address.PublicIpv4Pool,
+            domain: (address.Domain as "vpc" | "standard") ?? "vpc",
+            networkBorderGroup: address.NetworkBorderGroup,
+            customerOwnedIp: address.CustomerOwnedIp,
+            customerOwnedIpv4Pool: address.CustomerOwnedIpv4Pool,
+            carrierIp: address.CarrierIp,
+          } satisfies EIP["Attributes"];
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const allocationId = output.allocationId;
+
+          yield* session.note(`Releasing Elastic IP: ${allocationId}`);
+
+          yield* ec2
+            .releaseAddress({
+              AllocationId: allocationId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidAllocationID.NotFound",
+                () => Effect.void,
+              ),
+              Effect.catchTag("AuthFailure", () => Effect.void),
+              Effect.tapError(Effect.logDebug),
+              // Retry when EIP is still in use (e.g., NAT Gateway being deleted)
+              Effect.retry({
+                while: (e) => {
+                  return (
+                    // TODO(sam): not sure if the API will actually throw this
+                    // e._tag === "DependencyViolation" ||
+                    // this throws if the address hasn't been disassociated from all resources
+                    // we will retry it assuming that another resource provider is dissassociating it (e.g. a NAT Gateway resource is being deleted)
+                    e._tag === "InvalidIPAddress.InUse"
+                  );
+                },
+                schedule: Schedule.exponential(1000, 1.5).pipe(
+                  Schedule.both(Schedule.recurs(20)),
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `EIP still in use, waiting for release... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          yield* session.note(`Elastic IP ${allocationId} released`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/EgressOnlyInternetGateway.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/EgressOnlyInternetGateway.ts
new file mode 100644
index 00000000000..334de08a53b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/EgressOnlyInternetGateway.ts
@@ -0,0 +1,266 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type EgressOnlyInternetGatewayId<ID extends string = string> =
+  `eigw-${ID}`;
+export const EgressOnlyInternetGatewayId = <ID extends string>(
+  id: ID,
+): ID & EgressOnlyInternetGatewayId<ID> =>
+  `eigw-${id}` as ID & EgressOnlyInternetGatewayId<ID>;
+
+export type EgressOnlyInternetGatewayArn<
+  ID extends EgressOnlyInternetGatewayId = EgressOnlyInternetGatewayId,
+> = `arn:aws:ec2:${RegionID}:${AccountID}:egress-only-internet-gateway/${ID}`;
+
+export interface EgressOnlyInternetGatewayProps {
+  /**
+   * The VPC for which to create the egress-only internet gateway.
+   */
+  vpcId: VpcId;
+
+  /**
+   * Tags to assign to the egress-only internet gateway.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface EgressOnlyInternetGateway extends Resource<
+  "AWS.EC2.EgressOnlyInternetGateway",
+  EgressOnlyInternetGatewayProps,
+  {
+    /**
+     * The ID of the egress-only internet gateway.
+     */
+    egressOnlyInternetGatewayId: EgressOnlyInternetGatewayId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the egress-only internet gateway.
+     */
+    egressOnlyInternetGatewayArn: EgressOnlyInternetGatewayArn;
+
+    /**
+     * Information about the attachment of the egress-only internet gateway.
+     */
+    attachments?: Array<{
+      /**
+       * The current state of the attachment.
+       */
+      state: "attaching" | "attached" | "detaching" | "detached";
+      /**
+       * The ID of the VPC.
+       */
+      vpcId: VpcId;
+    }>;
+  },
+  never,
+  Providers
+> {}
+export const EgressOnlyInternetGateway = Resource<EgressOnlyInternetGateway>(
+  "AWS.EC2.EgressOnlyInternetGateway",
+);
+
+export const EgressOnlyInternetGatewayProvider = () =>
+  Provider.effect(
+    EgressOnlyInternetGateway,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const describeEgressOnlyInternetGateway = (eigwId: string) =>
+        ec2
+          .describeEgressOnlyInternetGateways({
+            EgressOnlyInternetGatewayIds: [eigwId],
+          })
+          .pipe(
+            Effect.map((r) => r.EgressOnlyInternetGateways?.[0]),
+            Effect.flatMap((gw) =>
+              gw
+                ? Effect.succeed(gw)
+                : Effect.fail(
+                    new Error(
+                      `Egress-Only Internet Gateway ${eigwId} not found`,
+                    ),
+                  ),
+            ),
+          );
+
+      const toAttrs = (gw: ec2.EgressOnlyInternetGateway) => ({
+        egressOnlyInternetGatewayId:
+          gw.EgressOnlyInternetGatewayId as EgressOnlyInternetGatewayId,
+        egressOnlyInternetGatewayArn:
+          `arn:aws:ec2:${region}:${accountId}:egress-only-internet-gateway/${gw.EgressOnlyInternetGatewayId}` as EgressOnlyInternetGatewayArn,
+        attachments: gw.Attachments?.map((a) => ({
+          state: a.State as "attaching" | "attached" | "detaching" | "detached",
+          vpcId: a.VpcId as VpcId,
+        })),
+      });
+
+      return {
+        stables: [
+          "egressOnlyInternetGatewayId",
+          "egressOnlyInternetGatewayArn",
+        ],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const gw = yield* describeEgressOnlyInternetGateway(
+            output.egressOnlyInternetGatewayId,
+          );
+          return toAttrs(gw);
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // VPC change requires replacement
+          if (news.vpcId !== olds.vpcId) {
+            return { action: "replace" };
+          }
+          // Tags can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the EIGW via cached id, else fall through to create.
+          let gw: ec2.EgressOnlyInternetGateway | undefined;
+          if (output?.egressOnlyInternetGatewayId) {
+            const lookup = yield* ec2
+              .describeEgressOnlyInternetGateways({
+                EgressOnlyInternetGatewayIds: [
+                  output.egressOnlyInternetGatewayId,
+                ],
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidEgressOnlyInternetGatewayId.NotFound",
+                  () => Effect.succeed({ EgressOnlyInternetGateways: [] }),
+                ),
+              );
+            gw = lookup.EgressOnlyInternetGateways?.[0];
+          }
+
+          // Ensure — create the EIGW if it isn't there yet.
+          if (gw === undefined) {
+            yield* session.note("Creating Egress-Only Internet Gateway...");
+            const result = yield* ec2.createEgressOnlyInternetGateway({
+              VpcId: news.vpcId as string,
+              TagSpecifications: [
+                {
+                  ResourceType: "egress-only-internet-gateway",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newGwId =
+              result.EgressOnlyInternetGateway!.EgressOnlyInternetGatewayId!;
+            yield* session.note(
+              `Egress-Only Internet Gateway created: ${newGwId}`,
+            );
+            gw = yield* describeEgressOnlyInternetGateway(newGwId);
+          }
+
+          const eigwId = gw.EgressOnlyInternetGatewayId!;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags =
+            (yield* ec2
+              .describeTags({
+                Filters: [
+                  { Name: "resource-id", Values: [eigwId] },
+                  {
+                    Name: "resource-type",
+                    Values: ["egress-only-internet-gateway"],
+                  },
+                ],
+              })
+              .pipe(
+                Effect.map(
+                  (r) =>
+                    Object.fromEntries(
+                      r.Tags?.map((t) => [t.Key!, t.Value!]) ?? [],
+                    ) as Record<string, string>,
+                ),
+              )) ?? {};
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [eigwId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [eigwId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read to reflect current cloud state in the returned attributes.
+          const final = yield* describeEgressOnlyInternetGateway(eigwId);
+          return toAttrs(final);
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const eigwId = output.egressOnlyInternetGatewayId;
+
+          yield* session.note(
+            `Deleting Egress-Only Internet Gateway: ${eigwId}`,
+          );
+
+          yield* ec2
+            .deleteEgressOnlyInternetGateway({
+              EgressOnlyInternetGatewayId: eigwId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.catchTag("InvalidGatewayID.NotFound", () => Effect.void),
+              Effect.catchTag(
+                "InvalidEgressOnlyInternetGatewayId.NotFound",
+                () => Effect.void,
+              ),
+              // Retry on dependency violations (e.g., routes still using the EIGW)
+              Effect.retry({
+                while: (e: { _tag: string }) =>
+                  e._tag === "DependencyViolation",
+                schedule: Schedule.fixed(5000).pipe(
+                  Schedule.both(Schedule.recurs(30)), // Up to ~2.5 minutes
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          yield* session.note(`Egress-Only Internet Gateway ${eigwId} deleted`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Image.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Image.ts
new file mode 100644
index 00000000000..fbe86a6d03b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Image.ts
@@ -0,0 +1,108 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+
+export type ImageArchitecture = "x86_64" | "arm64";
+
+export interface FindImageOptions {
+  owners: string[];
+  name: [string, ...string[]];
+  architecture?: ImageArchitecture;
+  description?: string;
+  rootDeviceType?: "ebs" | "instance-store";
+  virtualizationType?: "hvm" | "paravirtual";
+}
+
+const findLatestImage = Effect.fnUntraced(function* ({
+  owners,
+  name,
+  architecture = "x86_64",
+  // description = "public image",
+  rootDeviceType = "ebs",
+  virtualizationType = "hvm",
+}: FindImageOptions) {
+  const response = yield* ec2
+    .describeImages({
+      Owners: owners,
+      Filters: [
+        { Name: "name", Values: [...name] },
+        { Name: "architecture", Values: [architecture] },
+        { Name: "state", Values: ["available"] },
+        { Name: "root-device-type", Values: [rootDeviceType] },
+        { Name: "virtualization-type", Values: [virtualizationType] },
+      ],
+    })
+    .pipe(Effect.orDie);
+
+  const latest = (response.Images ?? [])
+    .slice()
+    .sort((a: ec2.Image, b: ec2.Image) =>
+      String(b.CreationDate ?? "").localeCompare(String(a.CreationDate ?? "")),
+    )[0];
+
+  if (!latest?.ImageId) {
+    return undefined;
+  }
+
+  return latest.ImageId;
+});
+
+const findFirstImage = Effect.fnUntraced(function* <Req = never>(
+  lookups: ReadonlyArray<Effect.Effect<string | undefined, never, Req>>,
+  errorMessage: string,
+) {
+  for (const lookup of lookups) {
+    const result = yield* lookup;
+    if (result) {
+      return result;
+    }
+  }
+  return yield* Effect.die(new Error(errorMessage));
+});
+
+export const image = (options: FindImageOptions) => findLatestImage(options);
+
+export const amazonLinux2023 = (options?: {
+  architecture?: ImageArchitecture;
+}) =>
+  findLatestImage({
+    owners: ["amazon"],
+    name: ["al2023-ami-*-*"],
+    architecture: options?.architecture,
+    description: "Amazon Linux 2023",
+  });
+
+export const amazonLinux2 = (options?: { architecture?: ImageArchitecture }) =>
+  findLatestImage({
+    owners: ["amazon"],
+    name: ["amzn2-ami-hvm-*-*-gp2"],
+    architecture: options?.architecture,
+    description: "Amazon Linux 2",
+  });
+
+export const amazonLinux = (options?: { architecture?: ImageArchitecture }) =>
+  findFirstImage(
+    [amazonLinux2023(options), amazonLinux2(options)],
+    "Could not resolve a public Amazon Linux AMI",
+  );
+
+export const ubuntu2404 = (options?: { architecture?: ImageArchitecture }) =>
+  findLatestImage({
+    owners: ["099720109477"],
+    name: [
+      "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-*-server-*",
+      "ubuntu/images/hvm-ssd/ubuntu-noble-24.04-*-server-*",
+    ],
+    architecture: options?.architecture,
+    description: "Ubuntu 24.04 LTS",
+  });
+
+export const ubuntu2204 = (options?: { architecture?: ImageArchitecture }) =>
+  findLatestImage({
+    owners: ["099720109477"],
+    name: [
+      "ubuntu/images/hvm-ssd-gp3/ubuntu-jammy-22.04-*-server-*",
+      "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-*-server-*",
+    ],
+    architecture: options?.architecture,
+    description: "Ubuntu 22.04 LTS",
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Instance.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Instance.ts
new file mode 100644
index 00000000000..993dc0db617
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Instance.ts
@@ -0,0 +1,859 @@
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import type * as rolldown from "rolldown";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { ServerHost } from "../../Server/Process.ts";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import {
+  createAlchemyTagFilters,
+  createInternalTags,
+  diffTags,
+} from "../../Tags.ts";
+import { Assets } from "../Assets.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+import {
+  createEc2HostRuntimeContext,
+  createEc2HostedSupport,
+  type Ec2HostRuntimeContext,
+} from "./hosted.ts";
+import type { SecurityGroupId } from "./SecurityGroup.ts";
+import type { SubnetId } from "./Subnet.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type InstanceId<ID extends string = string> = `i-${ID}`;
+export const InstanceId = <ID extends string>(id: ID): ID & InstanceId<ID> =>
+  `i-${id}` as ID & InstanceId<ID>;
+
+export type InstanceArn<ID extends InstanceId = InstanceId> =
+  `arn:aws:ec2:${RegionID}:${AccountID}:instance/${ID}`;
+
+export const isInstance = (value: any): value is Instance => {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "Type" in value &&
+    value.Type === "AWS.EC2.Instance"
+  );
+};
+
+export interface InstanceProps extends PlatformProps {
+  /**
+   * AMI ID to launch.
+   */
+  imageId: string;
+  /**
+   * EC2 instance type, such as `t3.micro`.
+   */
+  instanceType: string;
+  /**
+   * Optional subnet to launch into.
+   */
+  subnetId?: Input<SubnetId>;
+  /**
+   * Security groups to attach to the primary network interface.
+   */
+  securityGroupIds?: Input<SecurityGroupId>[];
+  /**
+   * Optional EC2 key pair name for SSH access.
+   */
+  keyName?: string;
+  /**
+   * Optional IAM instance profile name to attach at launch.
+   */
+  instanceProfileName?: string;
+  /**
+   * User data script to provide at launch time.
+   */
+  userData?: string;
+  /**
+   * Whether to associate a public IPv4 address on launch.
+   */
+  associatePublicIpAddress?: boolean;
+  /**
+   * Optional private IPv4 address for the primary interface.
+   */
+  privateIpAddress?: string;
+  /**
+   * Optional availability zone override.
+   */
+  availabilityZone?: string;
+  /**
+   * Whether source/destination checking is enabled.
+   * @default true
+   */
+  sourceDestCheck?: boolean;
+  /**
+   * User-defined tags to apply to the instance.
+   */
+  tags?: Record<string, string>;
+  /**
+   * Module entrypoint for the bundled instance program.
+   * When omitted, the instance behaves as a low-level EC2 resource.
+   */
+  main?: string;
+  /**
+   * Named export to load from `main`.
+   * @default "default"
+   */
+  handler?: string;
+  /**
+   * Port exposed by the process, if any.
+   * @default 3000
+   */
+  port?: number;
+  /**
+   * Additional environment variables for the hosted process.
+   */
+  env?: Record<string, any>;
+  /**
+   * Bundler configuration for the hosted process entrypoint.
+   */
+  build?: {
+    input?: Partial<rolldown.InputOptions>;
+    output?: Partial<rolldown.OutputOptions>;
+  };
+  /**
+   * Additional managed policy ARNs for the managed instance role.
+   * This can only be used when Alchemy manages the instance profile.
+   */
+  roleManagedPolicyArns?: string[];
+}
+
+export interface Instance extends Resource<
+  "AWS.EC2.Instance",
+  InstanceProps,
+  {
+    /**
+     * The ID of the instance.
+     */
+    instanceId: InstanceId;
+    /**
+     * The Amazon Resource Name (ARN) of the instance.
+     */
+    instanceArn: InstanceArn;
+    /**
+     * The AMI ID the instance launched from.
+     */
+    imageId: string;
+    /**
+     * The instance type.
+     */
+    instanceType: string;
+    /**
+     * The current instance state.
+     */
+    state: string;
+    /**
+     * The VPC the instance belongs to, if any.
+     */
+    vpcId?: VpcId;
+    /**
+     * The subnet the instance belongs to, if any.
+     */
+    subnetId?: SubnetId;
+    /**
+     * The availability zone of the instance.
+     */
+    availabilityZone?: string;
+    /**
+     * The attached security group IDs.
+     */
+    securityGroupIds: string[];
+    /**
+     * The primary private IPv4 address.
+     */
+    privateIpAddress?: string;
+    /**
+     * The public IPv4 address, if assigned.
+     */
+    publicIpAddress?: string;
+    /**
+     * The private DNS name.
+     */
+    privateDnsName?: string;
+    /**
+     * The public DNS name, if assigned.
+     */
+    publicDnsName?: string;
+    /**
+     * The key pair name used for SSH access.
+     */
+    keyName?: string;
+    /**
+     * The IAM instance profile ARN attached to the instance, if any.
+     */
+    instanceProfileArn?: string;
+    /**
+     * The IAM instance profile ID attached to the instance, if any.
+     */
+    instanceProfileId?: string;
+    /**
+     * The IAM instance profile name attached to the instance, if known.
+     */
+    instanceProfileName?: string;
+    /**
+     * Whether source/destination checking is enabled.
+     */
+    sourceDestCheck?: boolean;
+    /**
+     * When the instance was launched.
+     */
+    launchTime?: string;
+    /**
+     * Current tags on the instance.
+     */
+    tags: Record<string, string>;
+    /**
+     * Role attached by the hosted runtime, if any.
+     */
+    roleArn?: string;
+    /**
+     * Role name attached by the hosted runtime, if any.
+     */
+    roleName?: string;
+    /**
+     * Inline policy name used for bindings/runtime sync, if any.
+     */
+    policyName?: string;
+    /**
+     * Whether the role/profile were created and owned by Alchemy.
+     */
+    managedIam?: boolean;
+    /**
+     * Deterministic runtime unit name for hosted instances.
+     */
+    runtimeUnitName?: string;
+    /**
+     * Asset prefix for hosted bundles and env files.
+     */
+    assetPrefix?: string;
+    /**
+     * Bundle hash for hosted instances.
+     */
+    code?: {
+      hash: string;
+    };
+  },
+  {
+    env?: Record<string, any>;
+    policyStatements?: PolicyStatement[];
+  },
+  Providers
+> {}
+
+export type InstanceServices = ServerHost | Credentials | Region;
+
+export type InstanceShape = Main<InstanceServices>;
+
+export type InstanceRuntimeContext = Ec2HostRuntimeContext;
+
+/**
+ * An EC2 instance that can either act as a low-level compute primitive or run
+ * a bundled long-lived Effect program directly on the machine.
+ *
+ * @section Launching Instances
+ * @example Basic Instance
+ * ```typescript
+ * const instance = yield* AWS.EC2.Instance("AppInstance", {
+ *   imageId,
+ *   instanceType: "t3.micro",
+ *   subnetId: subnet.subnetId,
+ * });
+ * ```
+ *
+ * @section Hosting Processes
+ * @example HTTP Server on an Instance
+ * ```typescript
+ * const api = yield* Effect.gen(function* () {
+ *   yield* Http.serve(
+ *     HttpServerResponse.json({ ok: true }),
+ *   );
+ *
+ *   return {
+ *     main: import.meta.filename,
+ *     imageId,
+ *     instanceType: "t3.small",
+ *     subnetId: subnet.subnetId,
+ *     securityGroupIds: [securityGroup.groupId],
+ *     associatePublicIpAddress: true,
+ *     port: 3000,
+ *   };
+ * }).pipe(
+ *   Effect.provide(AWS.EC2.HttpServer),
+ *   AWS.EC2.Instance("ApiInstance"),
+ * );
+ * ```
+ */
+export const Instance: Platform<
+  Instance,
+  InstanceServices,
+  InstanceShape,
+  InstanceRuntimeContext
+> = Platform("AWS.EC2.Instance", {
+  createRuntimeContext: createEc2HostRuntimeContext("AWS.EC2.Instance"),
+});
+
+export const InstanceProvider = () =>
+  Provider.effect(
+    Instance,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+      const stack = yield* Stack;
+      const stage = yield* Stage;
+      const fs = yield* FileSystem.FileSystem;
+      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+      const assets = (yield* Effect.serviceOption(Assets)).pipe(
+        Option.getOrUndefined,
+      );
+
+      const toInstanceArn = (instanceId: InstanceId) =>
+        `arn:aws:ec2:${region}:${accountId}:instance/${instanceId}` as InstanceArn;
+
+      const hosted = createEc2HostedSupport({
+        accountId,
+        region,
+        stackName: stack.name,
+        stage,
+        fs,
+        virtualEntryPlugin,
+        assets,
+        resourceType: "EC2.Instance",
+      });
+
+      const isPendingInstanceProfileError = (error: unknown) => {
+        const tag = (error as { _tag?: string })?._tag;
+        if (
+          tag === "InvalidIAMInstanceProfile.NotFound" ||
+          tag === "InvalidParameterValue"
+        ) {
+          return true;
+        }
+        if (tag !== "UnknownAwsError") {
+          return false;
+        }
+        const unknown = error as {
+          errorTag?: string;
+          message?: string;
+          errorData?: {
+            message?: string;
+            Message?: string;
+          };
+        };
+        const message =
+          unknown.message ??
+          unknown.errorData?.message ??
+          unknown.errorData?.Message ??
+          "";
+        return (
+          unknown.errorTag === "InvalidParameterValue" &&
+          message.includes("iamInstanceProfile.name") &&
+          message.includes("Invalid IAM Instance Profile name")
+        );
+      };
+
+      const isPendingInstanceLookupError = (error: unknown) => {
+        const tag = (error as { _tag?: string })?._tag;
+        return (
+          error instanceof InstanceNotFound ||
+          tag === "InvalidInstanceID.NotFound"
+        );
+      };
+
+      const toTagRecord = (tags?: Array<{ Key?: string; Value?: string }>) =>
+        Object.fromEntries(
+          (tags ?? [])
+            .filter((tag): tag is { Key: string; Value: string } =>
+              Boolean(tag.Key && tag.Value !== undefined),
+            )
+            .map((tag) => [tag.Key, tag.Value]),
+        );
+
+      const toAttributes = (
+        instance: ec2.Instance,
+      ): Instance["Attributes"] => ({
+        instanceId: instance.InstanceId as InstanceId,
+        instanceArn: toInstanceArn(instance.InstanceId as InstanceId),
+        imageId: instance.ImageId!,
+        instanceType: String(instance.InstanceType ?? ""),
+        state: instance.State?.Name ?? "unknown",
+        vpcId: instance.VpcId as VpcId | undefined,
+        subnetId: instance.SubnetId as SubnetId | undefined,
+        availabilityZone: instance.Placement?.AvailabilityZone,
+        securityGroupIds: (instance.SecurityGroups ?? [])
+          .map((group) => group.GroupId)
+          .filter((value): value is string => Boolean(value)),
+        privateIpAddress: instance.PrivateIpAddress,
+        publicIpAddress: instance.PublicIpAddress,
+        privateDnsName: instance.PrivateDnsName,
+        publicDnsName: instance.PublicDnsName,
+        keyName: instance.KeyName,
+        instanceProfileArn: instance.IamInstanceProfile?.Arn,
+        instanceProfileId: instance.IamInstanceProfile?.Id,
+        instanceProfileName: undefined,
+        sourceDestCheck: instance.SourceDestCheck,
+        launchTime:
+          instance.LaunchTime instanceof Date
+            ? instance.LaunchTime.toISOString()
+            : (instance.LaunchTime as string | undefined),
+        tags: toTagRecord(instance.Tags),
+      });
+
+      const describeInstance = (instanceId: string) =>
+        ec2
+          .describeInstances({
+            InstanceIds: [instanceId],
+          })
+          .pipe(
+            Effect.map(
+              (result) =>
+                (result.Reservations ?? []).flatMap(
+                  (reservation) => reservation.Instances ?? [],
+                )[0],
+            ),
+            Effect.flatMap((instance) =>
+              instance
+                ? Effect.succeed(instance)
+                : Effect.fail(new InstanceNotFound({ instanceId })),
+            ),
+          );
+
+      const findInstanceByTags = Effect.fn(function* (id: string) {
+        const filters = yield* createAlchemyTagFilters(id);
+        return yield* ec2.describeInstances
+          .items({
+            Filters: filters,
+          })
+          .pipe(
+            Stream.flatMap((reservation) =>
+              Stream.fromArray(reservation.Instances ?? []),
+            ),
+            Stream.filter((instance) => {
+              const state = instance.State?.Name;
+              return (
+                state === "pending" ||
+                state === "running" ||
+                state === "stopping" ||
+                state === "stopped"
+              );
+            }),
+            Stream.runCollect,
+            Effect.map(
+              (instances) =>
+                [...instances].sort((a, b) => {
+                  const aTime =
+                    a.LaunchTime instanceof Date
+                      ? a.LaunchTime.getTime()
+                      : Date.parse(String(a.LaunchTime ?? 0));
+                  const bTime =
+                    b.LaunchTime instanceof Date
+                      ? b.LaunchTime.getTime()
+                      : Date.parse(String(b.LaunchTime ?? 0));
+                  return bTime - aTime;
+                })[0],
+            ),
+          );
+      });
+
+      const waitForState = Effect.fn(function* ({
+        instanceId,
+        states,
+        session,
+      }: {
+        instanceId: string;
+        states: string[];
+        session: Pick<ScopedPlanStatusSession, "note">;
+      }) {
+        return yield* describeInstance(instanceId).pipe(
+          Effect.tap((instance) =>
+            session.note(
+              `Waiting for instance ${instanceId}: ${instance.State?.Name ?? "unknown"}`,
+            ),
+          ),
+          Effect.filterOrFail(
+            (instance) => states.includes(instance.State?.Name ?? ""),
+            (instance) =>
+              new InstanceStateMismatch({
+                instanceId,
+                actual: instance.State?.Name ?? "unknown",
+                expected: states,
+              }),
+          ),
+          Effect.retry({
+            while: (error) =>
+              error instanceof InstanceStateMismatch ||
+              isPendingInstanceLookupError(error),
+            schedule: Schedule.exponential("250 millis").pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+        );
+      });
+
+      const waitForDeleted = Effect.fn(function* ({
+        instanceId,
+        session,
+      }: {
+        instanceId: string;
+        session: Pick<ScopedPlanStatusSession, "note">;
+      }) {
+        yield* describeInstance(instanceId).pipe(
+          Effect.tap((instance) =>
+            session.note(
+              `Waiting for instance deletion ${instanceId}: ${instance.State?.Name ?? "unknown"}`,
+            ),
+          ),
+          Effect.flatMap((instance) =>
+            instance.State?.Name === "terminated"
+              ? Effect.succeed(undefined)
+              : Effect.fail(new InstanceStillExists({ instanceId })),
+          ),
+          Effect.retry({
+            while: (error) => error instanceof InstanceStillExists,
+            schedule: Schedule.exponential("250 millis").pipe(
+              Schedule.both(Schedule.recurs(8)),
+            ),
+          }),
+          Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.void),
+          Effect.catchTag("InstanceNotFound", () => Effect.void),
+        );
+      });
+
+      const resolvedSecurityGroups = (
+        groups?: InstanceProps["securityGroupIds"],
+      ) => hosted.normalizeSecurityGroups(groups as string[] | undefined);
+
+      const buildRunInstancesRequest = (
+        news: InstanceProps,
+        runtime: {
+          userData?: string;
+          instanceProfileName?: string;
+        },
+        tags: Record<string, string>,
+      ): ec2.RunInstancesRequest => {
+        return {
+          ...hosted.buildLaunchTemplateData(
+            {
+              imageId: news.imageId,
+              instanceType: news.instanceType,
+              keyName: news.keyName,
+              subnetId: news.subnetId as string | undefined,
+              securityGroupIds: news.securityGroupIds as string[] | undefined,
+              associatePublicIpAddress: news.associatePublicIpAddress,
+              privateIpAddress: news.privateIpAddress,
+              availabilityZone: news.availabilityZone,
+              tags,
+            },
+            runtime,
+          ),
+          MinCount: 1,
+          MaxCount: 1,
+        };
+      };
+
+      return {
+        stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          const hostModeChanged = Boolean(olds.main) !== Boolean(news.main);
+          if (
+            hostModeChanged ||
+            olds.imageId !== news.imageId ||
+            olds.subnetId !== news.subnetId ||
+            olds.keyName !== news.keyName ||
+            olds.instanceProfileName !== news.instanceProfileName ||
+            olds.userData !== news.userData ||
+            olds.associatePublicIpAddress !== news.associatePublicIpAddress ||
+            olds.privateIpAddress !== news.privateIpAddress ||
+            olds.availabilityZone !== news.availabilityZone
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          if (
+            olds.instanceType !== news.instanceType ||
+            olds.sourceDestCheck !== news.sourceDestCheck ||
+            olds.main !== news.main ||
+            olds.handler !== news.handler ||
+            olds.port !== news.port ||
+            !deepEqual(olds.env ?? {}, news.env ?? {}) ||
+            !deepEqual(olds.build ?? {}, news.build ?? {}) ||
+            !deepEqual(
+              olds.roleManagedPolicyArns ?? [],
+              news.roleManagedPolicyArns ?? [],
+            ) ||
+            !deepEqual(
+              resolvedSecurityGroups(olds.securityGroupIds),
+              resolvedSecurityGroups(news.securityGroupIds),
+            ) ||
+            !deepEqual(olds.tags ?? {}, news.tags ?? {})
+          ) {
+            return {
+              action: "update",
+              stables: ["instanceId", "instanceArn", "vpcId", "subnetId"],
+            } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, output }) {
+          const instance = output?.instanceId
+            ? yield* describeInstance(output.instanceId).pipe(
+                Effect.catchTag("InvalidInstanceID.NotFound", () =>
+                  Effect.succeed(undefined),
+                ),
+                Effect.catchTag("InstanceNotFound", () =>
+                  Effect.succeed(undefined),
+                ),
+              )
+            : yield* findInstanceByTags(id);
+          return instance
+            ? {
+                ...toAttributes(instance),
+                instanceProfileName: output?.instanceProfileName,
+                roleArn: output?.roleArn,
+                roleName: output?.roleName,
+                policyName: output?.policyName,
+                managedIam: output?.managedIam,
+                runtimeUnitName: output?.runtimeUnitName,
+                assetPrefix: output?.assetPrefix,
+                code: output?.code,
+              }
+            : undefined;
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          output,
+          bindings,
+          session,
+        }) {
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const runtime = yield* hosted.resolveHostedRuntime({
+            id,
+            news,
+            bindings,
+            output,
+          });
+
+          // Observe — try the cached instanceId first, then fall back to the
+          // alchemy-tag search for recovery from interrupted creates. EC2
+          // assigns instance IDs server-side so we always read the live
+          // record before deciding whether to launch a new one.
+          let instance: ec2.Instance | undefined = output?.instanceId
+            ? yield* describeInstance(output.instanceId).pipe(
+                Effect.catchTag("InvalidInstanceID.NotFound", () =>
+                  Effect.succeed(undefined),
+                ),
+                Effect.catchTag("InstanceNotFound", () =>
+                  Effect.succeed(undefined),
+                ),
+              )
+            : yield* findInstanceByTags(id);
+
+          // A terminated instance is a tombstone; treat as missing so we
+          // launch a fresh one.
+          if (instance && instance.State?.Name === "terminated") {
+            instance = undefined;
+          }
+
+          // Ensure — RunInstances when no live instance was observed. The
+          // initial sourceDestCheck is set here because RunInstances itself
+          // doesn't accept it.
+          if (instance === undefined) {
+            const created = yield* ec2
+              .runInstances(
+                buildRunInstancesRequest(news, runtime, desiredTags),
+              )
+              .pipe(
+                Effect.retry({
+                  while: isPendingInstanceProfileError,
+                  schedule: Schedule.exponential("500 millis").pipe(
+                    Schedule.both(Schedule.recurs(8)),
+                  ),
+                }),
+              );
+            const newInstanceId = created.Instances?.[0]?.InstanceId as
+              | InstanceId
+              | undefined;
+            if (!newInstanceId) {
+              return yield* Effect.fail(
+                new Error(`RunInstances returned no instance ID for '${id}'`),
+              );
+            }
+            yield* session.note(newInstanceId);
+            instance = yield* waitForState({
+              instanceId: newInstanceId,
+              states: ["running"],
+              session,
+            });
+            if (news.sourceDestCheck !== undefined) {
+              yield* ec2.modifyInstanceAttribute({
+                InstanceId: newInstanceId,
+                SourceDestCheck: { Value: news.sourceDestCheck },
+              });
+            }
+          }
+
+          const instanceId = instance.InstanceId as InstanceId;
+          let restarted = false;
+
+          // Sync security groups — observed primary-ENI groups vs desired.
+          const observedSecurityGroups = (instance.SecurityGroups ?? [])
+            .map((g) => g.GroupId)
+            .filter((g): g is string => Boolean(g));
+          const desiredSecurityGroups = resolvedSecurityGroups(
+            news.securityGroupIds,
+          );
+          if (
+            desiredSecurityGroups &&
+            JSON.stringify([...observedSecurityGroups].sort()) !==
+              JSON.stringify([...desiredSecurityGroups].sort())
+          ) {
+            yield* ec2.modifyInstanceAttribute({
+              InstanceId: instanceId,
+              Groups: desiredSecurityGroups,
+            });
+          }
+
+          // Sync source/dest check — observed flag vs desired (default true).
+          const desiredSourceDestCheck = news.sourceDestCheck ?? true;
+          if ((instance.SourceDestCheck ?? true) !== desiredSourceDestCheck) {
+            yield* ec2.modifyInstanceAttribute({
+              InstanceId: instanceId,
+              SourceDestCheck: { Value: desiredSourceDestCheck },
+            });
+          }
+
+          // Sync instance type — observed type vs desired. Type changes need
+          // the instance stopped, then we restart it if it was running.
+          if (
+            news.instanceType &&
+            String(instance.InstanceType ?? "") !== news.instanceType
+          ) {
+            const wasRunning = instance.State?.Name === "running";
+            if (wasRunning) {
+              yield* ec2.stopInstances({ InstanceIds: [instanceId] });
+              yield* waitForState({
+                instanceId,
+                states: ["stopped"],
+                session,
+              });
+            }
+            yield* ec2.modifyInstanceAttribute({
+              InstanceId: instanceId,
+              InstanceType: {
+                Value: news.instanceType as ec2.InstanceType,
+              },
+            });
+            if (wasRunning) {
+              yield* ec2.startInstances({ InstanceIds: [instanceId] });
+              yield* waitForState({
+                instanceId,
+                states: ["running"],
+                session,
+              });
+              restarted = true;
+            }
+          }
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (instance.Tags ?? [])
+              .filter((t): t is { Key: string; Value: string } =>
+                Boolean(t.Key && t.Value !== undefined),
+              )
+              .map((t) => [t.Key, t.Value]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [instanceId],
+              Tags: removed.map((key) => ({ Key: key })),
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [instanceId],
+              Tags: upsert,
+            });
+          }
+
+          // Hosted-runtime reboot — picks up new bundle/env without an
+          // explicit instance-type cycle. Skip if the type-change path
+          // already restarted us.
+          if (news.main && !restarted) {
+            yield* ec2.rebootInstances({ InstanceIds: [instanceId] });
+            yield* waitForState({
+              instanceId,
+              states: ["running"],
+              session,
+            });
+          }
+
+          // Re-read final state so attributes reflect the post-sync cloud.
+          const final = yield* describeInstance(instanceId);
+          return {
+            ...toAttributes(final),
+            instanceProfileName:
+              runtime.instanceProfileName ?? output?.instanceProfileName,
+            roleArn: runtime.roleArn ?? output?.roleArn,
+            roleName: runtime.roleName ?? output?.roleName,
+            policyName: runtime.policyName ?? output?.policyName,
+            managedIam: runtime.managedIam ?? output?.managedIam,
+            runtimeUnitName: runtime.runtimeUnitName ?? output?.runtimeUnitName,
+            assetPrefix: runtime.assetPrefix ?? output?.assetPrefix,
+            code: runtime.code ?? output?.code,
+          };
+        }),
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* ec2
+            .terminateInstances({
+              InstanceIds: [output.instanceId],
+            })
+            .pipe(
+              Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.void),
+            );
+          yield* waitForDeleted({
+            instanceId: output.instanceId,
+            session,
+          });
+
+          yield* hosted.cleanupHostedRuntime({ output });
+        }),
+      };
+    }),
+  );
+
+class InstanceNotFound extends Data.TaggedError("InstanceNotFound")<{
+  instanceId: string;
+}> {}
+
+class InstanceStillExists extends Data.TaggedError("InstanceStillExists")<{
+  instanceId: string;
+}> {}
+
+class InstanceStateMismatch extends Data.TaggedError("InstanceStateMismatch")<{
+  instanceId: string;
+  actual: string;
+  expected: string[];
+}> {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/InternetGateway.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/InternetGateway.ts
new file mode 100644
index 00000000000..541eab5802f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/InternetGateway.ts
@@ -0,0 +1,341 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type InternetGatewayId<ID extends string = string> = `igw-${ID}`;
+export const InternetGatewayId = <ID extends string>(
+  id: ID,
+): ID & InternetGatewayId<ID> => `igw-${id}` as ID & InternetGatewayId<ID>;
+
+export interface InternetGatewayProps {
+  /**
+   * The VPC to attach the internet gateway to.
+   * If provided, the internet gateway will be automatically attached to the VPC.
+   * Optional - you can create an unattached internet gateway and attach it later.
+   */
+  vpcId?: VpcId;
+
+  /**
+   * Tags to assign to the internet gateway.
+   * These will be merged with alchemy auto-tags (alchemy::stack, alchemy::stage, alchemy::id).
+   */
+  tags?: Record<string, string>;
+}
+
+export interface InternetGateway extends Resource<
+  "AWS.EC2.InternetGateway",
+  InternetGatewayProps,
+  {
+    /**
+     * The ID of the internet gateway.
+     */
+    internetGatewayId: InternetGatewayId;
+    /**
+     * The Amazon Resource Name (ARN) of the internet gateway.
+     */
+    internetGatewayArn: `arn:aws:ec2:${RegionID}:${AccountID}:internet-gateway/${string}`;
+    /**
+     * The ID of the VPC the internet gateway is attached to (if any).
+     */
+    vpcId?: VpcId;
+    /**
+     * The ID of the AWS account that owns the internet gateway.
+     */
+    ownerId?: string;
+    /**
+     * The attachments for the internet gateway.
+     */
+    attachments?: Array<{
+      state: "attaching" | "available" | "detaching" | "detached";
+      vpcId: string;
+    }>;
+  },
+  never,
+  Providers
+> {}
+export const InternetGateway = Resource<InternetGateway>(
+  "AWS.EC2.InternetGateway",
+);
+
+export const InternetGatewayProvider = () =>
+  Provider.effect(
+    InternetGateway,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      return {
+        stables: ["internetGatewayId", "internetGatewayArn", "ownerId"],
+
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const alchemyTags = yield* createInternalTags(id);
+          const desiredTags = { ...alchemyTags, ...(news.tags ?? {}) };
+
+          // Observe — find the IGW via cached id, else fall through to create.
+          let igw: ec2.InternetGateway | undefined;
+          if (output?.internetGatewayId) {
+            const lookup = yield* ec2
+              .describeInternetGateways({
+                InternetGatewayIds: [output.internetGatewayId],
+              })
+              .pipe(
+                Effect.catchTag("InvalidInternetGatewayID.NotFound", () =>
+                  Effect.succeed({ InternetGateways: [] }),
+                ),
+              );
+            igw = lookup.InternetGateways?.[0];
+          }
+
+          // Ensure — create the IGW if missing.
+          if (igw === undefined) {
+            const createResult = yield* ec2.createInternetGateway({
+              TagSpecifications: [
+                {
+                  ResourceType: "internet-gateway",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newIgwId = createResult.InternetGateway!
+              .InternetGatewayId! as InternetGatewayId;
+            yield* session.note(`Internet gateway created: ${newIgwId}`);
+            igw = yield* describeInternetGateway(newIgwId, session);
+          }
+
+          const internetGatewayId = igw.InternetGatewayId! as InternetGatewayId;
+
+          // Sync VPC attachment — observed attachment vs desired.
+          const attachedVpcId = igw.Attachments?.find(
+            (a) => a.State === "available" || a.State === "attaching",
+          )?.VpcId;
+          if (attachedVpcId !== news.vpcId) {
+            if (attachedVpcId) {
+              yield* ec2
+                .detachInternetGateway({
+                  InternetGatewayId: internetGatewayId,
+                  VpcId: attachedVpcId,
+                })
+                .pipe(
+                  Effect.catchTag("Gateway.NotAttached", () => Effect.void),
+                );
+              yield* session.note(`Detached from VPC: ${attachedVpcId}`);
+            }
+            if (news.vpcId) {
+              yield* ec2
+                .attachInternetGateway({
+                  InternetGatewayId: internetGatewayId,
+                  VpcId: news.vpcId,
+                })
+                .pipe(
+                  Effect.retry({
+                    while: (e) => e._tag === "InvalidVpcID.NotFound",
+                    schedule: Schedule.exponential(100),
+                  }),
+                );
+              yield* session.note(`Attached to VPC: ${news.vpcId}`);
+            }
+          }
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (igw.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [internetGatewayId],
+              Tags: removed.map((key) => ({ Key: key })),
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [internetGatewayId],
+              Tags: upsert,
+            });
+          }
+
+          // Re-read final state.
+          const final = yield* describeInternetGateway(
+            internetGatewayId,
+            session,
+          );
+          return {
+            internetGatewayId,
+            internetGatewayArn: `arn:aws:ec2:${region}:${accountId}:internet-gateway/${internetGatewayId}`,
+            vpcId: news.vpcId,
+            ownerId: final.OwnerId,
+            attachments: final.Attachments?.map((a) => ({
+              state: a.State! as
+                | "attaching"
+                | "available"
+                | "detaching"
+                | "detached",
+              vpcId: a.VpcId!,
+            })),
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const internetGatewayId = output.internetGatewayId;
+
+          yield* session.note(
+            `Deleting internet gateway: ${internetGatewayId}`,
+          );
+
+          // Re-describe to get current attachments from AWS (don't rely on stored state)
+          // This handles cases where state is incomplete from a previous crashed run
+          const igw = yield* describeInternetGateway(
+            internetGatewayId,
+            session,
+          ).pipe(Effect.catch(() => Effect.succeed({ Attachments: [] })));
+          const attachments = igw.Attachments ?? [];
+
+          // 1. Detach from all VPCs first
+          if (attachments.length > 0) {
+            for (const attachment of attachments) {
+              yield* ec2
+                .detachInternetGateway({
+                  InternetGatewayId: internetGatewayId,
+                  VpcId: attachment.VpcId!,
+                })
+                .pipe(
+                  Effect.tapError(Effect.logDebug),
+                  Effect.catchTag("Gateway.NotAttached", () => Effect.void),
+                  Effect.catchTag(
+                    "InvalidInternetGatewayID.NotFound",
+                    () => Effect.void,
+                  ),
+                  // Retry on dependency violations (e.g., NAT Gateway with EIP still attached)
+                  Effect.retry({
+                    while: (e) => {
+                      return e._tag === "DependencyViolation";
+                    },
+                    schedule: Schedule.fixed(5000).pipe(
+                      Schedule.both(Schedule.recurs(60)), // Up to 5 minutes
+                      Schedule.tapOutput(([, attempt]) =>
+                        session.note(
+                          `Waiting for VPC dependencies to clear before detaching... (attempt ${attempt + 1})`,
+                        ),
+                      ),
+                    ),
+                  }),
+                );
+              yield* session.note(`Detached from VPC: ${attachment.VpcId}`);
+            }
+          }
+
+          // 2. Delete the internet gateway
+          yield* ec2
+            .deleteInternetGateway({
+              InternetGatewayId: internetGatewayId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.catchTag(
+                "InvalidInternetGatewayID.NotFound",
+                () => Effect.void,
+              ),
+              // Retry on dependency violations
+              Effect.retry({
+                while: (e) => {
+                  return (
+                    e._tag === "DependencyViolation" ||
+                    (e._tag === "ValidationError" &&
+                      e.message?.includes("DependencyViolation"))
+                  );
+                },
+                schedule: Schedule.fixed(5000).pipe(
+                  Schedule.both(Schedule.recurs(60)), // Up to 5 minutes
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          // 3. Wait for internet gateway to be fully deleted
+          yield* waitForInternetGatewayDeleted(internetGatewayId, session);
+
+          yield* session.note(
+            `Internet gateway ${internetGatewayId} deleted successfully`,
+          );
+        }),
+      };
+    }),
+  );
+
+/**
+ * Describe an internet gateway by ID
+ */
+const describeInternetGateway = (
+  internetGatewayId: string,
+  _session?: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeInternetGateways({ InternetGatewayIds: [internetGatewayId] })
+      .pipe(
+        Effect.catchTag("InvalidInternetGatewayID.NotFound", () =>
+          Effect.succeed({ InternetGateways: [] }),
+        ),
+      );
+
+    const igw = result.InternetGateways?.[0];
+    if (!igw) {
+      return yield* Effect.fail(new Error("Internet gateway not found"));
+    }
+    return igw;
+  });
+
+/**
+ * Wait for internet gateway to be deleted
+ */
+const waitForInternetGatewayDeleted = (
+  internetGatewayId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    yield* Effect.retry(
+      Effect.gen(function* () {
+        const result = yield* ec2
+          .describeInternetGateways({ InternetGatewayIds: [internetGatewayId] })
+          .pipe(
+            Effect.tapError(Effect.logDebug),
+            Effect.catchTag("InvalidInternetGatewayID.NotFound", () =>
+              Effect.succeed({ InternetGateways: [] }),
+            ),
+          );
+
+        if (!result.InternetGateways || result.InternetGateways.length === 0) {
+          return; // Successfully deleted
+        }
+
+        // Still exists, fail to trigger retry
+        return yield* Effect.fail(new Error("Internet gateway still exists"));
+      }),
+      {
+        schedule: Schedule.fixed(2000).pipe(
+          Schedule.both(Schedule.recurs(15)),
+          Schedule.tapOutput(([, attempt]) =>
+            session.note(
+              `Waiting for internet gateway deletion... (${(attempt + 1) * 2}s)`,
+            ),
+          ),
+        ),
+      },
+    );
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NatGateway.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NatGateway.ts
new file mode 100644
index 00000000000..df944cdbd30
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NatGateway.ts
@@ -0,0 +1,501 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createAlchemyTagFilters,
+  createInternalTags,
+  createTagsList,
+  diffTags,
+} from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { AllocationId } from "./EIP.ts";
+import type { SubnetId } from "./Subnet.ts";
+
+export type NatGatewayId<ID extends string = string> = `nat-${ID}`;
+export const NatGatewayId = <ID extends string>(
+  id: ID,
+): ID & NatGatewayId<ID> => `nat-${id}` as ID & NatGatewayId<ID>;
+
+export type NatGatewayArn =
+  `arn:aws:ec2:${RegionID}:${AccountID}:natgateway/${NatGatewayId}`;
+
+export interface NatGatewayProps {
+  /**
+   * The subnet in which to create the NAT gateway.
+   * For public NAT gateways, this must be a public subnet.
+   */
+  subnetId: SubnetId;
+
+  /**
+   * The allocation ID of the Elastic IP address for the gateway.
+   * Required for public NAT gateways.
+   */
+  allocationId?: AllocationId;
+
+  /**
+   * Indicates whether the NAT gateway supports public or private connectivity.
+   * @default "public"
+   */
+  connectivityType?: ec2.ConnectivityType;
+
+  /**
+   * The private IPv4 address to assign to the NAT gateway.
+   * If you don't provide an address, a private IPv4 address will be automatically assigned.
+   */
+  privateIpAddress?: string;
+
+  /**
+   * Secondary allocation IDs for additional private IP addresses.
+   * Only valid for private NAT gateways.
+   */
+  secondaryAllocationIds?: AllocationId[];
+
+  /**
+   * Secondary private IPv4 addresses.
+   * Only valid for private NAT gateways.
+   */
+  secondaryPrivateIpAddresses?: string[];
+
+  /**
+   * The number of secondary private IPv4 addresses to assign.
+   * Only valid for private NAT gateways.
+   */
+  secondaryPrivateIpAddressCount?: number;
+
+  /**
+   * Tags to assign to the NAT gateway.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface NatGateway extends Resource<
+  "AWS.EC2.NatGateway",
+  NatGatewayProps,
+  {
+    /**
+     * The ID of the NAT gateway.
+     */
+    natGatewayId: NatGatewayId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the NAT gateway.
+     */
+    natGatewayArn: `arn:aws:ec2:${RegionID}:${AccountID}:natgateway/${string}`;
+
+    /**
+     * The ID of the subnet in which the NAT gateway is located.
+     */
+    subnetId: SubnetId;
+
+    /**
+     * The ID of the VPC in which the NAT gateway is located.
+     */
+    vpcId: string;
+
+    /**
+     * The current state of the NAT gateway.
+     */
+    state: ec2.NatGatewayState;
+
+    /**
+     * The connectivity type of the NAT gateway.
+     */
+    connectivityType: ec2.ConnectivityType;
+
+    /**
+     * The Elastic IP address associated with the NAT gateway (for public NAT gateways).
+     */
+    publicIp?: string;
+
+    /**
+     * The private IP address associated with the NAT gateway.
+     */
+    privateIp?: string;
+
+    /**
+     * Information about the IP addresses and network interface associated with the NAT gateway.
+     */
+    natGatewayAddresses?: Array<{
+      allocationId?: string;
+      networkInterfaceId?: string;
+      privateIp?: string;
+      publicIp?: string;
+      associationId?: string;
+      isPrimary?: boolean;
+      failureMessage?: string;
+      status?: ec2.NatGatewayAddressStatus;
+    }>;
+
+    /**
+     * If the NAT gateway could not be created, specifies the error code for the failure.
+     */
+    failureCode?: string;
+
+    /**
+     * If the NAT gateway could not be created, specifies the error message for the failure.
+     */
+    failureMessage?: string;
+
+    /**
+     * The date and time the NAT gateway was created.
+     */
+    createTime?: string;
+
+    /**
+     * The date and time the NAT gateway was deleted, if applicable.
+     */
+    deleteTime?: string;
+  },
+  never,
+  Providers
+> {}
+export const NatGateway = Resource<NatGateway>("AWS.EC2.NatGateway");
+
+export const NatGatewayProvider = () =>
+  Provider.effect(
+    NatGateway,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const describeNatGateway = (natGatewayId: string) =>
+        ec2.describeNatGateways({ NatGatewayIds: [natGatewayId] }).pipe(
+          Effect.map((r) => r.NatGateways?.[0]),
+          Effect.flatMap((gw) =>
+            gw
+              ? Effect.succeed(gw)
+              : Effect.fail(new Error(`NAT Gateway ${natGatewayId} not found`)),
+          ),
+        );
+
+      const toAttrs = (gw: ec2.NatGateway): NatGateway["Attributes"] => {
+        const primaryAddress =
+          gw.NatGatewayAddresses?.find((a) => a.IsPrimary) ??
+          gw.NatGatewayAddresses?.[0];
+        return {
+          natGatewayId: gw.NatGatewayId as NatGatewayId,
+          natGatewayArn:
+            `arn:aws:ec2:${region}:${accountId}:natgateway/${gw.NatGatewayId}` as NatGatewayArn,
+          subnetId: gw.SubnetId as SubnetId,
+          vpcId: gw.VpcId!,
+          state: gw.State!,
+          connectivityType: gw.ConnectivityType!,
+          publicIp: primaryAddress?.PublicIp,
+          privateIp: primaryAddress?.PrivateIp,
+          natGatewayAddresses: gw.NatGatewayAddresses?.map((a) => ({
+            allocationId: a.AllocationId,
+            networkInterfaceId: a.NetworkInterfaceId,
+            privateIp: a.PrivateIp,
+            publicIp: a.PublicIp,
+            associationId: a.AssociationId,
+            isPrimary: a.IsPrimary,
+            failureMessage: a.FailureMessage,
+            status: a.Status,
+          })),
+          failureCode: gw.FailureCode,
+          failureMessage: gw.FailureMessage,
+          createTime:
+            gw.CreateTime instanceof Date
+              ? gw.CreateTime.toISOString()
+              : (gw.CreateTime as string | undefined),
+          deleteTime:
+            gw.DeleteTime instanceof Date
+              ? gw.DeleteTime.toISOString()
+              : (gw.DeleteTime as string | undefined),
+        };
+      };
+
+      // Find NAT Gateway by alchemy tags when we don't have the ID
+      const findNatGatewayByTags = Effect.fn(function* (id: string) {
+        const filters = yield* createAlchemyTagFilters(id);
+        const result = yield* ec2.describeNatGateways({ Filter: filters });
+
+        // Find a NAT Gateway that's not deleted and has matching tags
+        for (const gw of result.NatGateways ?? []) {
+          return gw;
+        }
+        return undefined;
+      });
+
+      return {
+        stables: ["natGatewayId", "natGatewayArn", "vpcId"],
+
+        read: Effect.fn(function* ({ id, output }) {
+          if (output) {
+            // We have the NAT Gateway ID, use it directly
+            return toAttrs(yield* describeNatGateway(output.natGatewayId));
+          }
+
+          // No output - try to find by tags (recovery from incomplete create)
+          const gw = yield* findNatGatewayByTags(id);
+          if (gw) {
+            return toAttrs(gw);
+          }
+
+          // Not found
+          return undefined;
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // NAT Gateway is mostly immutable - any change to core properties requires replacement
+          if (
+            news.subnetId !== olds.subnetId ||
+            news.connectivityType !== olds.connectivityType ||
+            news.allocationId !== olds.allocationId
+          ) {
+            return { action: "replace" };
+          }
+          // Tags can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — try the cached id first; if missing, search by alchemy
+          // tags so an interrupted create can recover before re-running the
+          // API. We treat a non-deleted match as ours because diff/replace
+          // already covers immutable property changes upstream.
+          let gw: ec2.NatGateway | undefined;
+          if (output?.natGatewayId) {
+            const lookup = yield* ec2
+              .describeNatGateways({ NatGatewayIds: [output.natGatewayId] })
+              .pipe(
+                Effect.catchTag("NatGatewayNotFound", () =>
+                  Effect.succeed({ NatGateways: [] }),
+                ),
+              );
+            gw = lookup.NatGateways?.[0];
+          } else {
+            gw = yield* findNatGatewayByTags(id);
+          }
+
+          // Treat a deleted/deleting NAT as if it doesn't exist so we recreate.
+          if (
+            gw &&
+            (gw.State === "deleted" ||
+              gw.State === "deleting" ||
+              gw.State === "failed")
+          ) {
+            gw = undefined;
+          }
+
+          // Ensure — create the NAT gateway when missing.
+          if (gw === undefined) {
+            yield* session.note("Creating NAT Gateway...");
+            const result = yield* ec2.createNatGateway({
+              SubnetId: news.subnetId as string,
+              AllocationId: news.allocationId as string | undefined,
+              ConnectivityType: news.connectivityType ?? "public",
+              PrivateIpAddress: news.privateIpAddress,
+              SecondaryAllocationIds: news.secondaryAllocationIds as
+                | string[]
+                | undefined,
+              SecondaryPrivateIpAddresses: news.secondaryPrivateIpAddresses,
+              SecondaryPrivateIpAddressCount:
+                news.secondaryPrivateIpAddressCount,
+              TagSpecifications: [
+                {
+                  ResourceType: "natgateway",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const natGatewayId = result.NatGateway!.NatGatewayId!;
+            yield* session.note(`NAT Gateway created: ${natGatewayId}`);
+            gw = yield* waitForNatGatewayAvailable(natGatewayId, session);
+          }
+
+          const natGatewayId = gw.NatGatewayId!;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags =
+            (yield* ec2
+              .describeTags({
+                Filters: [
+                  { Name: "resource-id", Values: [natGatewayId] },
+                  { Name: "resource-type", Values: ["natgateway"] },
+                ],
+              })
+              .pipe(
+                Effect.map(
+                  (r) =>
+                    Object.fromEntries(
+                      r.Tags?.map((t) => [t.Key!, t.Value!]) ?? [],
+                    ) as Record<string, string>,
+                ),
+              )) ?? {};
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [natGatewayId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [natGatewayId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state.
+          const final = yield* describeNatGateway(natGatewayId);
+          return toAttrs(final);
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const natGatewayId = output.natGatewayId;
+
+          yield* session.note(`Deleting NAT Gateway: ${natGatewayId}`);
+
+          yield* ec2
+            .deleteNatGateway({
+              NatGatewayId: natGatewayId,
+              DryRun: false,
+            })
+            .pipe(Effect.catchTag("NatGatewayNotFound", () => Effect.void));
+
+          // Wait for NAT Gateway to be deleted
+          yield* waitForNatGatewayDeleted(natGatewayId, session);
+
+          yield* session.note(`NAT Gateway ${natGatewayId} deleted`);
+        }),
+      };
+    }),
+  );
+
+// Retryable error: NAT Gateway is still pending
+class NatGatewayPending extends Data.TaggedError("NatGatewayPending")<{
+  natGatewayId: string;
+  state: string;
+}> {}
+
+// Terminal error: NAT Gateway creation failed
+class NatGatewayFailed extends Data.TaggedError("NatGatewayFailed")<{
+  natGatewayId: string;
+  failureCode?: string;
+  failureMessage?: string;
+}> {}
+
+// Terminal error: NAT Gateway not found
+class NatGatewayNotFound extends Data.TaggedError("NatGatewayNotFound")<{
+  natGatewayId: string;
+}> {}
+
+/**
+ * Wait for NAT Gateway to be in available state
+ */
+const waitForNatGatewayAvailable = (
+  natGatewayId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2.describeNatGateways({
+      NatGatewayIds: [natGatewayId],
+    });
+    const gw = result.NatGateways?.[0];
+
+    if (!gw) {
+      return yield* new NatGatewayNotFound({ natGatewayId });
+    }
+
+    if (gw.State === "available") {
+      return gw;
+    }
+
+    if (gw.State === "failed") {
+      return yield* new NatGatewayFailed({
+        natGatewayId,
+        failureCode: gw.FailureCode,
+        failureMessage: gw.FailureMessage,
+      });
+    }
+
+    // Still pending - this is the only retryable case
+    return yield* new NatGatewayPending({ natGatewayId, state: gw.State! });
+  }).pipe(
+    Effect.tapError(Effect.logDebug),
+    Effect.retry({
+      while: (e) => e._tag === "NatGatewayPending",
+      schedule: Schedule.fixed(5000).pipe(
+        Schedule.both(Schedule.recurs(60)), // Max 5 minutes
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for NAT Gateway to be available... (${(attempt + 1) * 5}s)`,
+          ),
+        ),
+      ),
+    }),
+  );
+
+// Retryable error: NAT Gateway is still deleting
+class NatGatewayDeleting extends Data.TaggedError("NatGatewayDeleting")<{
+  natGatewayId: string;
+  state: string;
+}> {}
+
+/**
+ * Wait for NAT Gateway to be deleted
+ */
+const waitForNatGatewayDeleted = (
+  natGatewayId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeNatGateways({ NatGatewayIds: [natGatewayId] })
+      .pipe(
+        Effect.catchTag("NatGatewayNotFound", () =>
+          Effect.succeed({ NatGateways: [] }),
+        ),
+      );
+
+    const gw = result.NatGateways?.[0];
+
+    if (!gw || gw.State === "deleted") {
+      return; // Successfully deleted
+    }
+
+    yield* Effect.logDebug(gw);
+
+    // Still deleting - this is the only retryable case
+    return yield* new NatGatewayDeleting({ natGatewayId, state: gw.State! });
+  }).pipe(
+    Effect.tapError(Effect.logDebug),
+    Effect.retry({
+      while: (e) => e._tag === "NatGatewayDeleting",
+      schedule: Schedule.fixed(5000).pipe(
+        Schedule.both(Schedule.recurs(60)), // Max 5 minutes
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for NAT Gateway deletion... (${(attempt + 1) * 5}s)`,
+          ),
+        ),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Network.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Network.ts
new file mode 100644
index 00000000000..312f8d629ba
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Network.ts
@@ -0,0 +1,459 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Namespace from "../../Namespace.ts";
+import type { EIP as EIPResource } from "./EIP.ts";
+import { EIP } from "./EIP.ts";
+import type { InternetGateway as InternetGatewayResource } from "./InternetGateway.ts";
+import { InternetGateway } from "./InternetGateway.ts";
+import type { NatGateway as NatGatewayResource } from "./NatGateway.ts";
+import { NatGateway } from "./NatGateway.ts";
+import type { Route as RouteResource } from "./Route.ts";
+import { Route } from "./Route.ts";
+import type { RouteTable as RouteTableResource } from "./RouteTable.ts";
+import { RouteTable } from "./RouteTable.ts";
+import type { RouteTableAssociation as RouteTableAssociationResource } from "./RouteTableAssociation.ts";
+import { RouteTableAssociation } from "./RouteTableAssociation.ts";
+import type { Subnet as SubnetResource } from "./Subnet.ts";
+import { Subnet } from "./Subnet.ts";
+import type { Vpc as VpcResource } from "./Vpc.ts";
+import { Vpc } from "./Vpc.ts";
+import type { VpcEndpoint as VpcEndpointResource } from "./VpcEndpoint.ts";
+import { VpcEndpoint } from "./VpcEndpoint.ts";
+
+export type NetworkNat = "none" | "single" | "per-az";
+
+export type NetworkGatewayEndpoint = "s3" | "dynamodb";
+
+export interface NetworkProps {
+  /**
+   * IPv4 CIDR block for the VPC.
+   * @example "10.42.0.0/16"
+   */
+  cidrBlock: string;
+
+  /**
+   * Number of Availability Zones to span or an explicit ordered list of zone names.
+   * Defaults to 2 available zones.
+   */
+  availabilityZones?: number | string[];
+
+  /**
+   * NAT strategy for private subnets.
+   * - `"none"` keeps private subnets isolated
+   * - `"single"` creates one shared NAT gateway
+   * - `"per-az"` creates one NAT gateway per Availability Zone
+   * @default "none"
+   */
+  nat?: NetworkNat;
+
+  /**
+   * Gateway endpoints to attach to the private route tables.
+   * Supported in v1: S3 and DynamoDB.
+   */
+  gatewayEndpoints?: NetworkGatewayEndpoint[];
+
+  /**
+   * Whether DNS resolution is supported for the VPC.
+   * @default true
+   */
+  enableDnsSupport?: boolean;
+
+  /**
+   * Whether instances launched in the VPC receive DNS hostnames.
+   * @default true
+   */
+  enableDnsHostnames?: boolean;
+
+  /**
+   * Tags to apply to all created resources.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface NetworkResources {
+  availabilityZones: string[];
+  vpc: VpcResource;
+  internetGateway?: InternetGatewayResource;
+  elasticIps: EIPResource[];
+  natGateways: NatGatewayResource[];
+  publicSubnets: SubnetResource[];
+  privateSubnets: SubnetResource[];
+  publicRouteTables: RouteTableResource[];
+  privateRouteTables: RouteTableResource[];
+  publicRoutes: RouteResource[];
+  privateRoutes: RouteResource[];
+  publicRouteAssociations: RouteTableAssociationResource[];
+  privateRouteAssociations: RouteTableAssociationResource[];
+  gatewayEndpoints: VpcEndpointResource[];
+  vpcId: VpcResource["vpcId"];
+  publicSubnetIds: Array<SubnetResource["subnetId"]>;
+  privateSubnetIds: Array<SubnetResource["subnetId"]>;
+}
+
+export type Network = Effect.Success<ReturnType<typeof Network>>;
+
+/**
+ * Creates a production-shaped VPC network from the low-level EC2 primitives.
+ *
+ * `Network` is the ergonomic entry point for users who want a ready-to-use VPC
+ * layout without manually creating route tables, internet gateways, NAT
+ * gateways, and subnet associations by hand.
+ *
+ * The helper still returns the underlying canonical resources so callers can
+ * keep composing with raw `AWS.EC2.*` APIs when they need more control.
+ *
+ * @example Minimal network
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ * });
+ * ```
+ *
+ * @example ECS-ready network with shared NAT
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ *   availabilityZones: 2,
+ *   nat: "single",
+ *   gatewayEndpoints: ["s3"],
+ * });
+ *
+ * yield* AWS.ECS.Service("ApiService", {
+ *   cluster,
+ *   task: apiTask,
+ *   vpcId: network.vpcId,
+ *   subnets: network.publicSubnetIds,
+ *   assignPublicIp: true,
+ * });
+ * ```
+ */
+export const Network = (id: string, props: NetworkProps) =>
+  Namespace.push(
+    id,
+    Effect.gen(function* () {
+      const availabilityZones = yield* resolveAvailabilityZones(
+        props.availabilityZones,
+      );
+      const subnetCidrs = deriveSubnetCidrs(
+        props.cidrBlock,
+        availabilityZones.length,
+      );
+      const tags = props.tags;
+
+      const vpc = yield* Vpc("Vpc", {
+        cidrBlock: props.cidrBlock,
+        enableDnsSupport: props.enableDnsSupport ?? true,
+        enableDnsHostnames: props.enableDnsHostnames ?? true,
+        tags,
+      });
+
+      const internetGateway = yield* InternetGateway("InternetGateway", {
+        vpcId: vpc.vpcId,
+        tags,
+      });
+
+      const publicSubnets: SubnetResource[] = [];
+      const privateSubnets: SubnetResource[] = [];
+
+      for (const [index, availabilityZone] of availabilityZones.entries()) {
+        const publicSubnet = yield* Subnet(`PublicSubnet${index + 1}`, {
+          vpcId: vpc.vpcId,
+          cidrBlock: subnetCidrs.public[index],
+          availabilityZone,
+          mapPublicIpOnLaunch: true,
+          tags: {
+            ...tags,
+            Tier: "public",
+          },
+        });
+        publicSubnets.push(publicSubnet);
+
+        const privateSubnet = yield* Subnet(`PrivateSubnet${index + 1}`, {
+          vpcId: vpc.vpcId,
+          cidrBlock: subnetCidrs.private[index],
+          availabilityZone,
+          tags: {
+            ...tags,
+            Tier: "private",
+          },
+        });
+        privateSubnets.push(privateSubnet);
+      }
+
+      const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+        vpcId: vpc.vpcId,
+        tags: {
+          ...tags,
+          Tier: "public",
+        },
+      });
+
+      const publicInternetRoute = yield* Route("PublicInternetRoute", {
+        routeTableId: publicRouteTable.routeTableId,
+        destinationCidrBlock: "0.0.0.0/0",
+        gatewayId: internetGateway.internetGatewayId,
+      });
+
+      const publicRouteAssociations: RouteTableAssociationResource[] = [];
+
+      for (const [index, subnet] of publicSubnets.entries()) {
+        publicRouteAssociations.push(
+          yield* RouteTableAssociation(`PublicSubnetAssociation${index + 1}`, {
+            routeTableId: publicRouteTable.routeTableId,
+            subnetId: subnet.subnetId,
+          }),
+        );
+      }
+
+      const nat = props.nat ?? "none";
+      const elasticIps: EIPResource[] = [];
+      const natGateways: NatGatewayResource[] = [];
+      const privateRouteTables: RouteTableResource[] = [];
+      const privateRoutes: RouteResource[] = [];
+      const privateRouteAssociations: RouteTableAssociationResource[] = [];
+
+      if (nat === "per-az") {
+        for (const [index, subnet] of publicSubnets.entries()) {
+          const eip = yield* EIP(`NatEip${index + 1}`, {
+            domain: "vpc",
+            tags,
+          });
+          elasticIps.push(eip);
+
+          const natGateway = yield* NatGateway(`NatGateway${index + 1}`, {
+            subnetId: subnet.subnetId,
+            allocationId: eip.allocationId,
+            connectivityType: "public",
+            tags,
+          });
+          natGateways.push(natGateway);
+
+          const privateRouteTable = yield* RouteTable(
+            `PrivateRouteTable${index + 1}`,
+            {
+              vpcId: vpc.vpcId,
+              tags: {
+                ...tags,
+                Tier: "private",
+              },
+            },
+          );
+          privateRouteTables.push(privateRouteTable);
+
+          privateRoutes.push(
+            yield* Route(`PrivateInternetRoute${index + 1}`, {
+              routeTableId: privateRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              natGatewayId: natGateway.natGatewayId,
+            }),
+          );
+
+          privateRouteAssociations.push(
+            yield* RouteTableAssociation(
+              `PrivateSubnetAssociation${index + 1}`,
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnets[index].subnetId,
+              },
+            ),
+          );
+        }
+      } else {
+        const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+          vpcId: vpc.vpcId,
+          tags: {
+            ...tags,
+            Tier: "private",
+          },
+        });
+        privateRouteTables.push(privateRouteTable);
+
+        if (nat === "single") {
+          const eip = yield* EIP("NatEip", {
+            domain: "vpc",
+            tags,
+          });
+          elasticIps.push(eip);
+
+          const natGateway = yield* NatGateway("NatGateway", {
+            subnetId: publicSubnets[0].subnetId,
+            allocationId: eip.allocationId,
+            connectivityType: "public",
+            tags,
+          });
+          natGateways.push(natGateway);
+
+          privateRoutes.push(
+            yield* Route("PrivateInternetRoute", {
+              routeTableId: privateRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              natGatewayId: natGateway.natGatewayId,
+            }),
+          );
+        }
+
+        for (const [index, subnet] of privateSubnets.entries()) {
+          privateRouteAssociations.push(
+            yield* RouteTableAssociation(
+              `PrivateSubnetAssociation${index + 1}`,
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: subnet.subnetId,
+              },
+            ),
+          );
+        }
+      }
+
+      const region = yield* Region;
+      const gatewayEndpoints: VpcEndpointResource[] = [];
+      for (const service of uniqueGatewayEndpoints(props.gatewayEndpoints)) {
+        gatewayEndpoints.push(
+          yield* VpcEndpoint(`${toEndpointId(service)}Endpoint`, {
+            vpcId: vpc.vpcId,
+            serviceName: `com.amazonaws.${region}.${service}`,
+            vpcEndpointType: "Gateway",
+            routeTableIds: privateRouteTables.map(
+              (table) => table.routeTableId,
+            ),
+            tags,
+          }),
+        );
+      }
+
+      return {
+        availabilityZones,
+        vpc,
+        internetGateway,
+        elasticIps,
+        natGateways,
+        publicSubnets,
+        privateSubnets,
+        publicRouteTables: [publicRouteTable],
+        privateRouteTables,
+        publicRoutes: [publicInternetRoute],
+        privateRoutes,
+        publicRouteAssociations,
+        privateRouteAssociations,
+        gatewayEndpoints,
+        vpcId: vpc.vpcId,
+        publicSubnetIds: publicSubnets.map((subnet) => subnet.subnetId),
+        privateSubnetIds: privateSubnets.map((subnet) => subnet.subnetId),
+      } satisfies NetworkResources;
+    }).pipe(Effect.orDie),
+  );
+
+const resolveAvailabilityZones = (input?: number | string[]) =>
+  Effect.gen(function* () {
+    if (Array.isArray(input)) {
+      if (input.length === 0) {
+        return yield* Effect.fail(
+          new Error("EC2.Network requires at least one availability zone"),
+        );
+      }
+      if (new Set(input).size !== input.length) {
+        return yield* Effect.fail(
+          new Error(
+            "EC2.Network availabilityZones must not contain duplicates",
+          ),
+        );
+      }
+      return input;
+    }
+
+    const desiredCount = input ?? 2;
+    if (!Number.isInteger(desiredCount) || desiredCount <= 0) {
+      return yield* Effect.fail(
+        new Error(
+          "EC2.Network availabilityZones count must be a positive integer",
+        ),
+      );
+    }
+
+    const result = yield* ec2.describeAvailabilityZones({});
+    const zones = (result.AvailabilityZones ?? [])
+      .filter((zone) => zone.State === "available" && zone.ZoneName)
+      .map((zone) => zone.ZoneName!)
+      .sort((a, b) => a.localeCompare(b));
+
+    if (zones.length < desiredCount) {
+      return yield* Effect.fail(
+        new Error(
+          `EC2.Network requested ${desiredCount} availability zones, but only ${zones.length} are available`,
+        ),
+      );
+    }
+
+    return zones.slice(0, desiredCount);
+  });
+
+const deriveSubnetCidrs = (cidrBlock: string, azCount: number) => {
+  const [baseAddress, prefixText] = cidrBlock.split("/");
+  const prefix = Number(prefixText);
+  if (!baseAddress || !Number.isInteger(prefix) || prefix < 0 || prefix > 28) {
+    throw new Error(
+      `EC2.Network requires a valid IPv4 CIDR block, got '${cidrBlock}'`,
+    );
+  }
+
+  const totalSubnets = azCount * 2;
+  const additionalBits = Math.ceil(Math.log2(totalSubnets));
+  const subnetPrefix = Math.max(prefix + additionalBits, 24);
+
+  if (subnetPrefix > 28) {
+    throw new Error(
+      `EC2.Network CIDR block '${cidrBlock}' is too small for ${totalSubnets} subnets`,
+    );
+  }
+
+  const subnetSize = 2 ** (32 - subnetPrefix);
+  const base = toNetworkAddress(baseAddress, prefix);
+
+  return {
+    public: Array.from({ length: azCount }, (_, index) =>
+      toCidr(base + subnetSize * index, subnetPrefix),
+    ),
+    private: Array.from({ length: azCount }, (_, index) =>
+      toCidr(base + subnetSize * (index + azCount), subnetPrefix),
+    ),
+  };
+};
+
+const toNetworkAddress = (ip: string, prefix: number) => {
+  const value = ipv4ToNumber(ip);
+  const blockSize = 2 ** (32 - prefix);
+  return Math.floor(value / blockSize) * blockSize;
+};
+
+const ipv4ToNumber = (ip: string) => {
+  const octets = ip.split(".").map((part) => Number(part));
+  if (
+    octets.length !== 4 ||
+    octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)
+  ) {
+    throw new Error(`Invalid IPv4 address '${ip}'`);
+  }
+
+  return (
+    octets[0] * 256 ** 3 + octets[1] * 256 ** 2 + octets[2] * 256 + octets[3]
+  );
+};
+
+const numberToIpv4 = (value: number) =>
+  [
+    Math.floor(value / 256 ** 3) % 256,
+    Math.floor(value / 256 ** 2) % 256,
+    Math.floor(value / 256) % 256,
+    value % 256,
+  ].join(".");
+
+const toCidr = (value: number, prefix: number) =>
+  `${numberToIpv4(value)}/${prefix}`;
+
+const uniqueGatewayEndpoints = (services: NetworkGatewayEndpoint[] = []) => [
+  ...new Set(services),
+];
+
+const toEndpointId = (service: NetworkGatewayEndpoint) =>
+  service === "s3" ? "S3" : "DynamoDb";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAcl.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAcl.ts
new file mode 100644
index 00000000000..c4e1faa3f16
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAcl.ts
@@ -0,0 +1,248 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type NetworkAclId<ID extends string = string> = `acl-${ID}`;
+export const NetworkAclId = <ID extends string>(
+  id: ID,
+): ID & NetworkAclId<ID> => `acl-${id}` as ID & NetworkAclId<ID>;
+
+export type NetworkAclArn<ID extends NetworkAclId = NetworkAclId> =
+  `arn:aws:ec2:${RegionID}:${AccountID}:network-acl/${ID}`;
+
+export interface NetworkAclProps {
+  /**
+   * The VPC to create the network ACL in.
+   */
+  vpcId: VpcId;
+
+  /**
+   * Tags to assign to the network ACL.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface NetworkAcl extends Resource<
+  "AWS.EC2.NetworkAcl",
+  NetworkAclProps,
+  {
+    networkAclId: NetworkAclId;
+    networkAclArn: NetworkAclArn;
+    vpcId: VpcId;
+    isDefault: boolean;
+    ownerId: string;
+    entries?: Array<{
+      ruleNumber: number;
+      protocol: string;
+      ruleAction: ec2.RuleAction;
+      egress: boolean;
+      cidrBlock?: string;
+      ipv6CidrBlock?: string;
+      icmpTypeCode?: {
+        code?: number;
+        type?: number;
+      };
+      portRange?: {
+        from?: number;
+        to?: number;
+      };
+    }>;
+    associations?: Array<{
+      networkAclAssociationId: string;
+      networkAclId: string;
+      subnetId: string;
+    }>;
+  },
+  never,
+  Providers
+> {}
+export const NetworkAcl = Resource<NetworkAcl>("AWS.EC2.NetworkAcl");
+
+export const NetworkAclProvider = () =>
+  Provider.effect(
+    NetworkAcl,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const describeNetworkAcl = (networkAclId: string) =>
+        ec2.describeNetworkAcls({ NetworkAclIds: [networkAclId] }).pipe(
+          Effect.map((r) => r.NetworkAcls?.[0]),
+          Effect.flatMap((acl) =>
+            acl
+              ? Effect.succeed(acl)
+              : Effect.fail(new Error(`Network ACL ${networkAclId} not found`)),
+          ),
+        );
+
+      const toAttrs = (acl: ec2.NetworkAcl) => ({
+        networkAclId: acl.NetworkAclId as NetworkAclId,
+        networkAclArn:
+          `arn:aws:ec2:${region}:${accountId}:network-acl/${acl.NetworkAclId}` as NetworkAclArn,
+        vpcId: acl.VpcId as VpcId,
+        isDefault: acl.IsDefault ?? false,
+        ownerId: acl.OwnerId!,
+        entries: acl.Entries?.map((e) => ({
+          ruleNumber: e.RuleNumber!,
+          protocol: e.Protocol!,
+          ruleAction: e.RuleAction!,
+          egress: e.Egress!,
+          cidrBlock: e.CidrBlock,
+          ipv6CidrBlock: e.Ipv6CidrBlock,
+          icmpTypeCode: e.IcmpTypeCode
+            ? {
+                code: e.IcmpTypeCode.Code,
+                type: e.IcmpTypeCode.Type,
+              }
+            : undefined,
+          portRange: e.PortRange
+            ? {
+                from: e.PortRange.From,
+                to: e.PortRange.To,
+              }
+            : undefined,
+        })),
+        associations: acl.Associations?.map((a) => ({
+          networkAclAssociationId: a.NetworkAclAssociationId!,
+          networkAclId: a.NetworkAclId!,
+          subnetId: a.SubnetId!,
+        })),
+      });
+
+      return {
+        stables: ["networkAclId", "networkAclArn", "ownerId", "isDefault"],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const acl = yield* describeNetworkAcl(output.networkAclId);
+          return toAttrs(acl);
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // VPC change requires replacement
+          if (news.vpcId !== olds.vpcId) {
+            return { action: "replace" };
+          }
+          // Tags can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the NACL via cached id, else fall through to create.
+          let acl: ec2.NetworkAcl | undefined;
+          if (output?.networkAclId) {
+            const lookup = yield* ec2
+              .describeNetworkAcls({ NetworkAclIds: [output.networkAclId] })
+              .pipe(
+                Effect.catchTag("InvalidNetworkAclID.NotFound", () =>
+                  Effect.succeed({ NetworkAcls: [] }),
+                ),
+              );
+            acl = lookup.NetworkAcls?.[0];
+          }
+
+          // Ensure — create the NACL when missing.
+          if (acl === undefined) {
+            yield* session.note("Creating Network ACL...");
+            const result = yield* ec2.createNetworkAcl({
+              VpcId: news.vpcId as string,
+              TagSpecifications: [
+                {
+                  ResourceType: "network-acl",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newAclId = result.NetworkAcl!.NetworkAclId!;
+            yield* session.note(`Network ACL created: ${newAclId}`);
+            acl = yield* describeNetworkAcl(newAclId);
+          }
+
+          const networkAclId = acl.NetworkAclId!;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (acl.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [networkAclId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [networkAclId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state.
+          const final = yield* describeNetworkAcl(networkAclId);
+          return toAttrs(final);
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const networkAclId = output.networkAclId;
+
+          yield* session.note(`Deleting Network ACL: ${networkAclId}`);
+
+          yield* ec2
+            .deleteNetworkAcl({
+              NetworkAclId: networkAclId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidNetworkAclID.NotFound",
+                () => Effect.void,
+              ),
+              // Retry on dependency violations (e.g., associations still being removed)
+              Effect.retry({
+                while: (e) => {
+                  return e._tag === "DependencyViolation";
+                },
+                schedule: Schedule.exponential(1000, 1.5).pipe(
+                  Schedule.both(Schedule.recurs(15)),
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          yield* session.note(`Network ACL ${networkAclId} deleted`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAclAssociation.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAclAssociation.ts
new file mode 100644
index 00000000000..d4499511c55
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAclAssociation.ts
@@ -0,0 +1,197 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { NetworkAclId } from "./NetworkAcl.ts";
+import type { SubnetId } from "./Subnet.ts";
+
+export type NetworkAclAssociationId<ID extends string = string> =
+  `aclassoc-${ID}`;
+export const NetworkAclAssociationId = <ID extends string>(
+  id: ID,
+): ID & NetworkAclAssociationId<ID> =>
+  `aclassoc-${id}` as ID & NetworkAclAssociationId<ID>;
+
+export interface NetworkAclAssociationProps {
+  /**
+   * The ID of the new network ACL to associate with the subnet.
+   */
+  networkAclId: NetworkAclId;
+
+  /**
+   * The ID of the subnet to associate with the network ACL.
+   */
+  subnetId: SubnetId;
+}
+
+export interface NetworkAclAssociation extends Resource<
+  "AWS.EC2.NetworkAclAssociation",
+  NetworkAclAssociationProps,
+  {
+    associationId: NetworkAclAssociationId;
+    networkAclId: NetworkAclId;
+    subnetId: SubnetId;
+  },
+  never,
+  Providers
+> {}
+export const NetworkAclAssociation = Resource<NetworkAclAssociation>(
+  "AWS.EC2.NetworkAclAssociation",
+);
+
+export const NetworkAclAssociationProvider = () =>
+  Provider.effect(
+    NetworkAclAssociation,
+    Effect.gen(function* () {
+      const findAssociation = (subnetId: string) =>
+        ec2
+          .describeNetworkAcls({
+            Filters: [{ Name: "association.subnet-id", Values: [subnetId] }],
+          })
+          .pipe(
+            Effect.map((r) => {
+              const acl = r.NetworkAcls?.[0];
+              const assoc = acl?.Associations?.find(
+                (a) => a.SubnetId === subnetId,
+              );
+              return assoc
+                ? {
+                    associationId: assoc.NetworkAclAssociationId!,
+                    networkAclId: assoc.NetworkAclId!,
+                    subnetId: assoc.SubnetId!,
+                  }
+                : undefined;
+            }),
+          );
+
+      return NetworkAclAssociation.Provider.of({
+        stables: ["subnetId"],
+
+        read: Effect.fn(function* ({ olds }) {
+          if (!olds) return undefined;
+          const assoc = yield* findAssociation(olds.subnetId as string);
+          if (!assoc) {
+            return yield* Effect.fail(
+              new Error(
+                `Network ACL Association not found for subnet ${olds.subnetId}`,
+              ),
+            );
+          }
+          return {
+            associationId: assoc.associationId as NetworkAclAssociationId,
+            networkAclId: assoc.networkAclId as NetworkAclId,
+            subnetId: assoc.subnetId as SubnetId,
+          };
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // Subnet change requires replacement
+          if (news.subnetId !== olds.subnetId) {
+            return { action: "replace" };
+          }
+          // Network ACL change can be done via replaceNetworkAclAssociation
+        }),
+
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — find the subnet's current association. EC2 guarantees
+          // every subnet always has exactly one NACL association, so the
+          // lookup always returns something for a live subnet.
+          const currentAssoc = yield* findAssociation(news.subnetId as string);
+          if (!currentAssoc) {
+            return yield* Effect.fail(
+              new Error(
+                `No existing Network ACL Association found for subnet ${news.subnetId}`,
+              ),
+            );
+          }
+
+          // Sync — if the subnet already points at the desired NACL, the
+          // association is already correct and we just report it. Otherwise
+          // ReplaceNetworkAclAssociation atomically swaps it.
+          if (currentAssoc.networkAclId === (news.networkAclId as string)) {
+            return {
+              associationId:
+                currentAssoc.associationId as NetworkAclAssociationId,
+              networkAclId: news.networkAclId as NetworkAclId,
+              subnetId: news.subnetId as SubnetId,
+            };
+          }
+
+          yield* session.note(
+            `Associating subnet ${news.subnetId} with NACL ${news.networkAclId}...`,
+          );
+          const result = yield* ec2.replaceNetworkAclAssociation({
+            AssociationId: currentAssoc.associationId,
+            NetworkAclId: news.networkAclId as string,
+            DryRun: false,
+          });
+          const newAssociationId = result.NewAssociationId!;
+          yield* session.note(`Network ACL Association: ${newAssociationId}`);
+          return {
+            associationId: newAssociationId as NetworkAclAssociationId,
+            networkAclId: news.networkAclId as NetworkAclId,
+            subnetId: news.subnetId as SubnetId,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ olds, output, session }) {
+          yield* session.note(`Deleting Network ACL Association...`);
+
+          // When deleting, we need to associate the subnet back to the default NACL
+          // Find the default NACL for the VPC
+          const subnetResult = yield* ec2
+            .describeSubnets({
+              SubnetIds: [olds.subnetId as string],
+            })
+            .pipe(
+              // If subnet is already deleted, association is gone too
+              Effect.catchTag("InvalidSubnetID.NotFound", () =>
+                Effect.succeed({ Subnets: [] }),
+              ),
+            );
+          const vpcId = subnetResult.Subnets?.[0]?.VpcId;
+
+          if (!vpcId) {
+            // Subnet is already deleted, so the association is gone
+            yield* session.note(`Subnet already deleted, association is gone`);
+            return;
+          }
+
+          const defaultAclResult = yield* ec2.describeNetworkAcls({
+            Filters: [
+              { Name: "vpc-id", Values: [vpcId] },
+              { Name: "default", Values: ["true"] },
+            ],
+          });
+
+          const defaultAclId = defaultAclResult.NetworkAcls?.[0]?.NetworkAclId;
+
+          if (defaultAclId && defaultAclId !== (olds.networkAclId as string)) {
+            // Replace with default NACL
+            yield* ec2
+              .replaceNetworkAclAssociation({
+                AssociationId: output.associationId,
+                NetworkAclId: defaultAclId,
+                DryRun: false,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidAssociationID.NotFound",
+                  () => Effect.void,
+                ),
+              );
+
+            yield* session.note(`Network ACL Association reverted to default`);
+          } else {
+            yield* session.note(
+              `Already using default Network ACL, nothing to do`,
+            );
+          }
+        }),
+      });
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAclEntry.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAclEntry.ts
new file mode 100644
index 00000000000..15c199a1210
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/NetworkAclEntry.ts
@@ -0,0 +1,281 @@
+import type * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { NetworkAclId } from "./NetworkAcl.ts";
+
+export interface NetworkAclEntryProps {
+  /**
+   * The ID of the network ACL.
+   */
+  networkAclId: NetworkAclId;
+  /**
+   * The rule number for the entry (1-32766).
+   * Rules are evaluated in order from lowest to highest.
+   */
+  ruleNumber: number;
+  /**
+   * The protocol number.
+   * A value of "-1" means all protocols.
+   * Common values: 6 (TCP), 17 (UDP), 1 (ICMP)
+   */
+  protocol: string;
+  /**
+   * Whether to allow or deny the traffic that matches the rule.
+   */
+  ruleAction: EC2.RuleAction;
+  /**
+   * Whether this is an egress (outbound) rule.
+   * @default false
+   */
+  egress?: boolean;
+  /**
+   * The IPv4 CIDR block.
+   * Either cidrBlock or ipv6CidrBlock must be specified.
+   */
+  cidrBlock?: string;
+  /**
+   * The IPv6 CIDR block.
+   * Either cidrBlock or ipv6CidrBlock must be specified.
+   */
+  ipv6CidrBlock?: string;
+  /**
+   * ICMP type and code. Required if protocol is 1 (ICMP) or 58 (ICMPv6).
+   */
+  icmpTypeCode?: {
+    /** The ICMP code. Use -1 to specify all codes. */
+    code?: number;
+    /** The ICMP type. Use -1 to specify all types. */
+    type?: number;
+  };
+  /**
+   * The port range for TCP/UDP protocols.
+   */
+  portRange?: {
+    /** The first port in the range. */
+    from?: number;
+    /** The last port in the range. */
+    to?: number;
+  };
+}
+
+export interface NetworkAclEntry extends Resource<
+  "AWS.EC2.NetworkAclEntry",
+  NetworkAclEntryProps,
+  {
+    /** The ID of the network ACL. */
+    networkAclId: NetworkAclId;
+    /** The rule number. */
+    ruleNumber: number;
+    /** Whether this is an egress rule. */
+    egress: boolean;
+    /** The protocol. */
+    protocol: string;
+    /** The rule action (allow or deny). */
+    ruleAction: EC2.RuleAction;
+    /** The IPv4 CIDR block. */
+    cidrBlock?: string;
+    /** The IPv6 CIDR block. */
+    ipv6CidrBlock?: string;
+    /** The ICMP type and code. */
+    icmpTypeCode?: {
+      code?: number;
+      type?: number;
+    };
+    /** The port range. */
+    portRange?: {
+      from?: number;
+      to?: number;
+    };
+  },
+  never,
+  Providers
+> {}
+export const NetworkAclEntry = Resource<NetworkAclEntry>(
+  "AWS.EC2.NetworkAclEntry",
+);
+
+export const NetworkAclEntryProvider = () =>
+  Provider.effect(
+    NetworkAclEntry,
+    Effect.gen(function* () {
+      const findEntry = (
+        networkAclId: string,
+        ruleNumber: number,
+        egress: boolean,
+      ) =>
+        ec2
+          .describeNetworkAcls({ NetworkAclIds: [networkAclId] })
+          .pipe(
+            Effect.map((r) =>
+              r.NetworkAcls?.[0]?.Entries?.find(
+                (e) => e.RuleNumber === ruleNumber && e.Egress === egress,
+              ),
+            ),
+          );
+
+      const toAttrs = (
+        props: NetworkAclEntryProps,
+        entry: NonNullable<
+          Awaited<
+            ReturnType<
+              typeof findEntry extends (
+                ...args: any
+              ) => Effect.Effect<infer R, any, any>
+                ? () => Promise<R>
+                : never
+            >
+          >
+        >,
+      ) => ({
+        networkAclId: props.networkAclId as NetworkAclId,
+        ruleNumber: entry.RuleNumber!,
+        egress: entry.Egress!,
+        protocol: entry.Protocol!,
+        ruleAction: entry.RuleAction!,
+        cidrBlock: entry.CidrBlock,
+        ipv6CidrBlock: entry.Ipv6CidrBlock,
+        icmpTypeCode: entry.IcmpTypeCode
+          ? {
+              code: entry.IcmpTypeCode.Code,
+              type: entry.IcmpTypeCode.Type,
+            }
+          : undefined,
+        portRange: entry.PortRange
+          ? {
+              from: entry.PortRange.From,
+              to: entry.PortRange.To,
+            }
+          : undefined,
+      });
+
+      return {
+        stables: [],
+
+        read: Effect.fn(function* ({ olds, output }) {
+          if (!output) return undefined;
+          const entry = yield* findEntry(
+            olds.networkAclId as string,
+            output.ruleNumber,
+            output.egress,
+          );
+          if (!entry) {
+            return yield* Effect.fail(
+              new Error(
+                `Network ACL Entry not found: ${output.networkAclId} rule ${output.ruleNumber} egress=${output.egress}`,
+              ),
+            );
+          }
+          return toAttrs(olds, entry);
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // If network ACL, rule number, or egress changes, need to replace
+          if (
+            news.networkAclId !== olds.networkAclId ||
+            news.ruleNumber !== olds.ruleNumber ||
+            news.egress !== olds.egress
+          ) {
+            return { action: "replace" };
+          }
+          // Other properties can be updated by replacing the entry
+        }),
+
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const entryParams = {
+            NetworkAclId: news.networkAclId as string,
+            RuleNumber: news.ruleNumber,
+            Protocol: news.protocol,
+            RuleAction: news.ruleAction,
+            Egress: news.egress ?? false,
+            CidrBlock: news.cidrBlock,
+            Ipv6CidrBlock: news.ipv6CidrBlock,
+            IcmpTypeCode: news.icmpTypeCode
+              ? {
+                  Code: news.icmpTypeCode.code,
+                  Type: news.icmpTypeCode.type,
+                }
+              : undefined,
+            PortRange: news.portRange
+              ? {
+                  From: news.portRange.from,
+                  To: news.portRange.to,
+                }
+              : undefined,
+            DryRun: false,
+          };
+
+          // Observe — entries are identified by (networkAclId, ruleNumber,
+          // egress); look up the live entry to decide between create and
+          // replace.
+          const observed = yield* findEntry(
+            news.networkAclId as string,
+            news.ruleNumber,
+            news.egress ?? false,
+          );
+
+          // Ensure / Sync — if the entry doesn't exist, create it; otherwise
+          // ReplaceNetworkAclEntry overwrites its mutable properties in place.
+          if (observed === undefined) {
+            yield* session.note(
+              `Creating Network ACL Entry (rule ${news.ruleNumber})...`,
+            );
+            yield* ec2.createNetworkAclEntry(entryParams);
+            yield* session.note(
+              `Network ACL Entry created: rule ${news.ruleNumber}`,
+            );
+          } else {
+            yield* session.note(
+              `Updating Network ACL Entry (rule ${news.ruleNumber})...`,
+            );
+            yield* ec2.replaceNetworkAclEntry(entryParams);
+            yield* session.note(
+              `Network ACL Entry updated: rule ${news.ruleNumber}`,
+            );
+          }
+
+          // Re-read final state.
+          const entry = yield* findEntry(
+            news.networkAclId as string,
+            news.ruleNumber,
+            news.egress ?? false,
+          );
+          if (!entry) {
+            return yield* Effect.fail(
+              new Error("Network ACL Entry not found after reconcile"),
+            );
+          }
+          return toAttrs(news, entry);
+        }),
+
+        delete: Effect.fn(function* ({ olds, output, session }) {
+          yield* session.note(
+            `Deleting Network ACL Entry (rule ${output.ruleNumber})...`,
+          );
+
+          yield* ec2
+            .deleteNetworkAclEntry({
+              NetworkAclId: olds.networkAclId as string,
+              RuleNumber: output.ruleNumber,
+              Egress: output.egress,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidNetworkAclEntry.NotFound",
+                () => Effect.void,
+              ),
+            );
+
+          yield* session.note(
+            `Network ACL Entry deleted: rule ${output.ruleNumber}`,
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Route.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Route.ts
new file mode 100644
index 00000000000..7a8abc3be3a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Route.ts
@@ -0,0 +1,296 @@
+import type * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import { isResolved, somePropsAreDifferent } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { RouteTableId } from "./RouteTable.ts";
+
+export interface RouteProps {
+  /**
+   * The ID of the route table where the route will be added.
+   * Required.
+   */
+  routeTableId: RouteTableId;
+
+  /**
+   * The IPv4 CIDR block used for the destination match.
+   * Either destinationCidrBlock, destinationIpv6CidrBlock, or destinationPrefixListId is required.
+   * @example "0.0.0.0/0"
+   */
+  destinationCidrBlock?: string;
+
+  /**
+   * The IPv6 CIDR block used for the destination match.
+   * Either destinationCidrBlock, destinationIpv6CidrBlock, or destinationPrefixListId is required.
+   * @example "::/0"
+   */
+  destinationIpv6CidrBlock?: string;
+
+  /**
+   * The ID of a prefix list used for the destination match.
+   * Either destinationCidrBlock, destinationIpv6CidrBlock, or destinationPrefixListId is required.
+   */
+  destinationPrefixListId?: string;
+
+  // ---- Target properties (exactly one required) ----
+
+  /**
+   * The ID of an internet gateway or virtual private gateway.
+   */
+  gatewayId?: string;
+
+  /**
+   * The ID of a NAT gateway.
+   */
+  natGatewayId?: string;
+
+  /**
+   * The ID of a NAT instance in your VPC.
+   * This operation fails unless exactly one network interface is attached.
+   */
+  instanceId?: string;
+
+  /**
+   * The ID of a network interface.
+   */
+  networkInterfaceId?: string;
+
+  /**
+   * The ID of a VPC peering connection.
+   */
+  vpcPeeringConnectionId?: string;
+
+  /**
+   * The ID of a transit gateway.
+   */
+  transitGatewayId?: string;
+
+  /**
+   * The ID of a local gateway.
+   */
+  localGatewayId?: string;
+
+  /**
+   * The ID of a carrier gateway.
+   * Use for Wavelength Zones only.
+   */
+  carrierGatewayId?: string;
+
+  /**
+   * The ID of an egress-only internet gateway.
+   * IPv6 traffic only.
+   */
+  egressOnlyInternetGatewayId?: string;
+
+  /**
+   * The Amazon Resource Name (ARN) of the core network.
+   */
+  coreNetworkArn?: string;
+
+  /**
+   * The ID of a VPC endpoint for Gateway Load Balancer.
+   */
+  vpcEndpointId?: string;
+}
+
+export interface Route extends Resource<
+  "AWS.EC2.Route",
+  RouteProps,
+  {
+    routeTableId: RouteTableId;
+    destinationCidrBlock?: string | undefined;
+    destinationIpv6CidrBlock?: string | undefined;
+    destinationPrefixListId?: string | undefined;
+    origin: EC2.RouteOrigin;
+    state: EC2.RouteState;
+    gatewayId?: string;
+    natGatewayId?: string;
+    instanceId?: string;
+    networkInterfaceId?: string;
+    vpcPeeringConnectionId?: string;
+    transitGatewayId?: string;
+    localGatewayId?: string;
+    carrierGatewayId?: string;
+    egressOnlyInternetGatewayId?: string;
+    coreNetworkArn?: string;
+  },
+  never,
+  Providers
+> {}
+export const Route = Resource<Route>("AWS.EC2.Route");
+
+export const RouteProvider = () =>
+  Provider.effect(
+    Route,
+    Effect.gen(function* () {
+      return {
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // Route table change requires replacement
+          if (olds.routeTableId !== news.routeTableId) {
+            return { action: "replace" };
+          }
+
+          // Destination change requires replacement
+          if (
+            somePropsAreDifferent(olds, news, [
+              "destinationCidrBlock",
+              "destinationIpv6CidrBlock",
+              "destinationPrefixListId",
+            ])
+          ) {
+            return { action: "replace" };
+          }
+
+          // Target change can be done via ReplaceRoute (update)
+        }),
+
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const dest =
+            news.destinationCidrBlock ||
+            news.destinationIpv6CidrBlock ||
+            news.destinationPrefixListId ||
+            "unknown";
+
+          const targetParams = {
+            RouteTableId: news.routeTableId,
+            DestinationCidrBlock: news.destinationCidrBlock,
+            DestinationIpv6CidrBlock: news.destinationIpv6CidrBlock,
+            DestinationPrefixListId: news.destinationPrefixListId,
+            GatewayId: news.gatewayId,
+            NatGatewayId: news.natGatewayId,
+            InstanceId: news.instanceId,
+            NetworkInterfaceId: news.networkInterfaceId,
+            VpcPeeringConnectionId: news.vpcPeeringConnectionId,
+            TransitGatewayId: news.transitGatewayId,
+            LocalGatewayId: news.localGatewayId,
+            CarrierGatewayId: news.carrierGatewayId,
+            EgressOnlyInternetGatewayId: news.egressOnlyInternetGatewayId,
+            CoreNetworkArn: news.coreNetworkArn,
+            DryRun: false,
+          } as const;
+
+          // Observe — Routes are identified by (routeTableId, destination).
+          // Look the route up in the route table to decide between create
+          // (missing) and replaceRoute (target drift).
+          const observed = yield* describeRoute(news.routeTableId, news);
+
+          // Ensure / Sync — CreateRoute when missing, ReplaceRoute swaps the
+          // target on an existing route in-place.
+          if (observed === undefined) {
+            yield* ec2
+              .createRoute({
+                ...targetParams,
+                VpcEndpointId: news.vpcEndpointId,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "InvalidRouteTableID.NotFound",
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+            yield* session.note(`Route created: ${dest}`);
+          } else {
+            yield* ec2.replaceRoute(targetParams).pipe(
+              Effect.tapError(Effect.log),
+              Effect.retry({
+                while: (e) => e._tag === "InvalidRouteTableID.NotFound",
+                schedule: Schedule.exponential(100),
+              }),
+            );
+            yield* session.note(`Route target updated: ${dest}`);
+          }
+
+          // Re-read final state.
+          const route = yield* describeRoute(news.routeTableId, news);
+          return {
+            routeTableId: news.routeTableId,
+            destinationCidrBlock: news.destinationCidrBlock,
+            destinationIpv6CidrBlock: news.destinationIpv6CidrBlock,
+            destinationPrefixListId: news.destinationPrefixListId,
+            origin: route?.Origin ?? "CreateRoute",
+            state: route?.State ?? "active",
+            gatewayId: route?.GatewayId,
+            natGatewayId: route?.NatGatewayId,
+            instanceId: route?.InstanceId,
+            networkInterfaceId: route?.NetworkInterfaceId,
+            vpcPeeringConnectionId: route?.VpcPeeringConnectionId,
+            transitGatewayId: route?.TransitGatewayId,
+            localGatewayId: route?.LocalGatewayId,
+            carrierGatewayId: route?.CarrierGatewayId,
+            egressOnlyInternetGatewayId: route?.EgressOnlyInternetGatewayId,
+            coreNetworkArn: route?.CoreNetworkArn,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const dest =
+            output.destinationCidrBlock ||
+            output.destinationIpv6CidrBlock ||
+            output.destinationPrefixListId ||
+            "unknown";
+
+          yield* session.note(`Deleting route: ${dest}`);
+
+          // Delete the route
+          yield* ec2
+            .deleteRoute({
+              RouteTableId: output.routeTableId,
+              DestinationCidrBlock: output.destinationCidrBlock,
+              DestinationIpv6CidrBlock: output.destinationIpv6CidrBlock,
+              DestinationPrefixListId: output.destinationPrefixListId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.catchTag("InvalidRoute.NotFound", () => Effect.void),
+              Effect.catchTag(
+                "InvalidRouteTableID.NotFound",
+                () => Effect.void,
+              ),
+            );
+
+          yield* session.note(`Route ${dest} deleted successfully`);
+        }),
+      };
+    }),
+  );
+
+/**
+ * Find a specific route in a route table
+ */
+const describeRoute = (routeTableId: string, props: RouteProps) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeRouteTables({ RouteTableIds: [routeTableId] })
+      .pipe(
+        Effect.catchTag("InvalidRouteTableID.NotFound", () =>
+          Effect.succeed({ RouteTables: [] }),
+        ),
+      );
+
+    const routeTable = result.RouteTables?.[0];
+    if (!routeTable) {
+      return undefined;
+    }
+
+    // Find the matching route
+    const route = routeTable.Routes?.find((r) => {
+      if (props.destinationCidrBlock) {
+        return r.DestinationCidrBlock === props.destinationCidrBlock;
+      }
+      if (props.destinationIpv6CidrBlock) {
+        return r.DestinationIpv6CidrBlock === props.destinationIpv6CidrBlock;
+      }
+      if (props.destinationPrefixListId) {
+        return r.DestinationPrefixListId === props.destinationPrefixListId;
+      }
+      return false;
+    });
+
+    return route;
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/RouteTable.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/RouteTable.ts
new file mode 100644
index 00000000000..f600ccbe708
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/RouteTable.ts
@@ -0,0 +1,408 @@
+import type * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type RouteTableId<ID extends string = string> = `rtb-${ID}`;
+export const RouteTableId = <ID extends string>(
+  id: ID,
+): ID & RouteTableId<ID> => `rtb-${id}` as ID & RouteTableId<ID>;
+
+export interface RouteTableProps {
+  /**
+   * The VPC to create the route table in.
+   * Required.
+   */
+  vpcId: VpcId;
+
+  /**
+   * Tags to assign to the route table.
+   * These will be merged with alchemy auto-tags (alchemy::stack, alchemy::stage, alchemy::id).
+   */
+  tags?: Record<string, string>;
+}
+
+export interface RouteTable extends Resource<
+  "AWS.EC2.RouteTable",
+  RouteTableProps,
+  {
+    /**
+     * The ID of the VPC the route table is in.
+     */
+    vpcId: VpcId;
+
+    /**
+     * The ID of the route table.
+     */
+    routeTableId: RouteTableId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the route table.
+     */
+    routeTableArn: `arn:aws:ec2:${RegionID}:${AccountID}:route-table/${string}`;
+
+    /**
+     * The ID of the AWS account that owns the route table.
+     */
+    ownerId?: string;
+
+    /**
+     * The associations between the route table and subnets or gateways.
+     */
+    associations?: Array<{
+      /**
+       * Whether this is the main route table for the VPC.
+       */
+      main: boolean;
+      /**
+       * The ID of the association.
+       */
+      routeTableAssociationId?: string;
+      /**
+       * The ID of the route table.
+       */
+      routeTableId?: string;
+      /**
+       * The ID of the subnet (if the association is with a subnet).
+       */
+      subnetId?: string;
+      /**
+       * The ID of the gateway (if the association is with a gateway).
+       */
+      gatewayId?: string;
+      /**
+       * The state of the association.
+       */
+      associationState?: {
+        state: EC2.RouteTableAssociationStateCode;
+        statusMessage?: string;
+      };
+    }>;
+
+    /**
+     * The routes in the route table.
+     */
+    routes?: Array<{
+      /**
+       * The IPv4 CIDR block used for the destination match.
+       */
+      destinationCidrBlock?: string;
+      /**
+       * The IPv6 CIDR block used for the destination match.
+       */
+      destinationIpv6CidrBlock?: string;
+      /**
+       * The prefix of the AWS service.
+       */
+      destinationPrefixListId?: string;
+      /**
+       * The ID of the egress-only internet gateway.
+       */
+      egressOnlyInternetGatewayId?: string;
+      /**
+       * The ID of the gateway (internet gateway or virtual private gateway).
+       */
+      gatewayId?: string;
+      /**
+       * The ID of the NAT instance.
+       */
+      instanceId?: string;
+      /**
+       * The ID of AWS account that owns the NAT instance.
+       */
+      instanceOwnerId?: string;
+      /**
+       * The ID of the NAT gateway.
+       */
+      natGatewayId?: string;
+      /**
+       * The ID of the transit gateway.
+       */
+      transitGatewayId?: string;
+      /**
+       * The ID of the local gateway.
+       */
+      localGatewayId?: string;
+      /**
+       * The ID of the carrier gateway.
+       */
+      carrierGatewayId?: string;
+      /**
+       * The ID of the network interface.
+       */
+      networkInterfaceId?: string;
+      /**
+       * Describes how the route was created.
+       */
+      origin: EC2.RouteOrigin;
+      /**
+       * The state of the route.
+       */
+      state: EC2.RouteState;
+      /**
+       * The ID of the VPC peering connection.
+       */
+      vpcPeeringConnectionId?: string;
+      /**
+       * The Amazon Resource Name (ARN) of the core network.
+       */
+      coreNetworkArn?: string;
+    }>;
+
+    /**
+     * Any virtual private gateway (VGW) propagating routes.
+     */
+    propagatingVgws?: Array<{
+      gatewayId: string;
+    }>;
+  },
+  never,
+  Providers
+> {}
+export const RouteTable = Resource<RouteTable>("AWS.EC2.RouteTable");
+
+export const RouteTableProvider = () =>
+  Provider.effect(
+    RouteTable,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      return {
+        stables: ["routeTableId", "ownerId", "routeTableArn", "vpcId"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // VpcId change requires replacement
+          if (olds.vpcId !== news.vpcId) {
+            return { action: "replace" };
+          }
+          // Tags can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const alchemyTags = yield* createInternalTags(id);
+          const desiredTags = { ...alchemyTags, ...(news.tags ?? {}) };
+
+          // Observe — find the route table via cached id, else fall through
+          // to create.
+          let routeTable: ec2.RouteTable | undefined;
+          if (output?.routeTableId) {
+            const lookup = yield* ec2
+              .describeRouteTables({ RouteTableIds: [output.routeTableId] })
+              .pipe(
+                Effect.catchTag("InvalidRouteTableID.NotFound", () =>
+                  Effect.succeed({ RouteTables: [] }),
+                ),
+              );
+            routeTable = lookup.RouteTables?.[0];
+          }
+
+          // Ensure — create the route table when missing.
+          if (routeTable === undefined) {
+            const createResult = yield* ec2
+              .createRouteTable({
+                VpcId: news.vpcId,
+                TagSpecifications: [
+                  {
+                    ResourceType: "route-table",
+                    Tags: createTagsList(desiredTags),
+                  },
+                ],
+                DryRun: false,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "InvalidVpcID.NotFound",
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+            const newId = createResult.RouteTable!
+              .RouteTableId! as RouteTableId;
+            yield* session.note(`Route table created: ${newId}`);
+            routeTable = yield* describeRouteTable(newId, session);
+          }
+
+          const routeTableId = routeTable.RouteTableId! as RouteTableId;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (routeTable.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [routeTableId],
+              Tags: removed.map((key) => ({ Key: key })),
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [routeTableId],
+              Tags: upsert,
+            });
+          }
+
+          // Re-read final state.
+          const final = yield* describeRouteTable(routeTableId, session);
+          return {
+            routeTableId,
+            routeTableArn:
+              `arn:aws:ec2:${region}:${accountId}:route-table/${routeTableId}` as `arn:aws:ec2:${RegionID}:${AccountID}:route-table/${string}`,
+            vpcId: news.vpcId as VpcId,
+            ownerId: final.OwnerId,
+            associations: final.Associations?.map((assoc) => ({
+              main: assoc.Main ?? false,
+              routeTableAssociationId: assoc.RouteTableAssociationId,
+              routeTableId: assoc.RouteTableId,
+              subnetId: assoc.SubnetId,
+              gatewayId: assoc.GatewayId,
+              associationState: assoc.AssociationState
+                ? {
+                    state: assoc.AssociationState.State!,
+                    statusMessage: assoc.AssociationState.StatusMessage,
+                  }
+                : undefined,
+            })),
+            routes: final.Routes?.map((route) => ({
+              destinationCidrBlock: route.DestinationCidrBlock,
+              destinationIpv6CidrBlock: route.DestinationIpv6CidrBlock,
+              destinationPrefixListId: route.DestinationPrefixListId,
+              egressOnlyInternetGatewayId: route.EgressOnlyInternetGatewayId,
+              gatewayId: route.GatewayId,
+              instanceId: route.InstanceId,
+              instanceOwnerId: route.InstanceOwnerId,
+              natGatewayId: route.NatGatewayId,
+              transitGatewayId: route.TransitGatewayId,
+              localGatewayId: route.LocalGatewayId,
+              carrierGatewayId: route.CarrierGatewayId,
+              networkInterfaceId: route.NetworkInterfaceId,
+              origin: route.Origin!,
+              state: route.State!,
+              vpcPeeringConnectionId: route.VpcPeeringConnectionId,
+              coreNetworkArn: route.CoreNetworkArn,
+            })),
+            propagatingVgws: final.PropagatingVgws?.map((vgw) => ({
+              gatewayId: vgw.GatewayId!,
+            })),
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const routeTableId = output.routeTableId;
+
+          yield* session.note(`Deleting route table: ${routeTableId}`);
+
+          // 1. Attempt to delete route table
+          yield* ec2
+            .deleteRouteTable({
+              RouteTableId: routeTableId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.catchTag(
+                "InvalidRouteTableID.NotFound",
+                () => Effect.void,
+              ),
+              // Retry on dependency violations (associations still being deleted)
+              Effect.retry({
+                // DependencyViolation means there are still dependent resources
+                while: (e) => {
+                  return e._tag === "DependencyViolation";
+                },
+                schedule: Schedule.exponential(1000, 1.5).pipe(
+                  Schedule.both(Schedule.recurs(10)), // Try up to 10 times
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          // 2. Wait for route table to be fully deleted
+          yield* waitForRouteTableDeleted(routeTableId, session);
+
+          yield* session.note(
+            `Route table ${routeTableId} deleted successfully`,
+          );
+        }),
+      };
+    }),
+  );
+
+/**
+ * Describe a route table by ID
+ */
+const describeRouteTable = (
+  routeTableId: string,
+  _session?: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeRouteTables({ RouteTableIds: [routeTableId] })
+      .pipe(
+        Effect.catchTag("InvalidRouteTableID.NotFound", () =>
+          Effect.succeed({ RouteTables: [] }),
+        ),
+      );
+
+    const routeTable = result.RouteTables?.[0];
+    if (!routeTable) {
+      return yield* Effect.fail(new Error("Route table not found"));
+    }
+    return routeTable;
+  });
+
+/**
+ * Wait for route table to be deleted
+ */
+const waitForRouteTableDeleted = (
+  routeTableId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    yield* Effect.retry(
+      Effect.gen(function* () {
+        const result = yield* ec2
+          .describeRouteTables({ RouteTableIds: [routeTableId] })
+          .pipe(
+            Effect.tapError(Effect.logDebug),
+            Effect.catchTag("InvalidRouteTableID.NotFound", () =>
+              Effect.succeed({ RouteTables: [] }),
+            ),
+          );
+
+        if (!result.RouteTables || result.RouteTables.length === 0) {
+          return; // Successfully deleted
+        }
+
+        // Still exists, fail to trigger retry
+        return yield* Effect.fail(new Error("Route table still exists"));
+      }),
+      {
+        schedule: Schedule.fixed(2000).pipe(
+          // Check every 2 seconds
+          Schedule.both(Schedule.recurs(15)), // Max 30 seconds
+          Schedule.tapOutput(([, attempt]) =>
+            session.note(
+              `Waiting for route table deletion... (${(attempt + 1) * 2}s)`,
+            ),
+          ),
+        ),
+      },
+    );
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/RouteTableAssociation.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/RouteTableAssociation.ts
new file mode 100644
index 00000000000..e5c89710ab0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/RouteTableAssociation.ts
@@ -0,0 +1,325 @@
+import type * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { RouteTableId } from "./RouteTable.ts";
+import type { SubnetId } from "./Subnet.ts";
+
+export type RouteTableAssociationId<ID extends string = string> =
+  `rtbassoc-${ID}`;
+export const RouteTableAssociationId = <ID extends string>(
+  id: ID,
+): ID & RouteTableAssociationId<ID> =>
+  `rtbassoc-${id}` as ID & RouteTableAssociationId<ID>;
+
+export interface RouteTableAssociationProps {
+  /**
+   * The ID of the route table.
+   * Required.
+   */
+  routeTableId: RouteTableId;
+
+  /**
+   * The ID of the subnet to associate with the route table.
+   * Either subnetId or gatewayId is required, but not both.
+   */
+  subnetId?: SubnetId;
+
+  /**
+   * The ID of the gateway (internet gateway or virtual private gateway) to associate with the route table.
+   * Either subnetId or gatewayId is required, but not both.
+   */
+  gatewayId?: string;
+}
+
+export interface RouteTableAssociation extends Resource<
+  "AWS.EC2.RouteTableAssociation",
+  RouteTableAssociationProps,
+  {
+    /**
+     * The ID of the association.
+     */
+    associationId: RouteTableAssociationId;
+
+    /**
+     * The ID of the route table.
+     */
+    routeTableId: RouteTableId;
+
+    /**
+     * The ID of the subnet (if the association is with a subnet).
+     */
+    subnetId?: SubnetId | undefined;
+
+    /**
+     * The ID of the gateway (if the association is with a gateway).
+     */
+    gatewayId?: string | undefined;
+
+    /**
+     * The state of the association.
+     */
+    associationState: {
+      state: EC2.RouteTableAssociationStateCode;
+      statusMessage?: string;
+    };
+  },
+  never,
+  Providers
+> {}
+export const RouteTableAssociation = Resource<RouteTableAssociation>(
+  "AWS.EC2.RouteTableAssociation",
+);
+
+export const RouteTableAssociationProvider = () =>
+  Provider.effect(
+    RouteTableAssociation,
+    Effect.gen(function* () {
+      return {
+        stables: ["associationId", "subnetId", "gatewayId"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // Subnet/Gateway change requires replacement (use ReplaceRouteTableAssociation internally)
+          if (olds.subnetId !== news.subnetId) {
+            return { action: "replace" };
+          }
+          if (olds.gatewayId !== news.gatewayId) {
+            return { action: "replace" };
+          }
+          // Route table change can be done via ReplaceRouteTableAssociation
+        }),
+
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // Observe — try the cached associationId first; if the association
+          // was disassociated out-of-band, fall through to AssociateRouteTable.
+          let observed:
+            | {
+                associationId: string;
+                routeTableId: string;
+                subnetId?: string;
+                gatewayId?: string;
+                state?: EC2.RouteTableAssociationStateCode;
+                statusMessage?: string;
+              }
+            | undefined;
+          if (output?.associationId) {
+            const lookup = yield* ec2
+              .describeRouteTables({
+                Filters: [
+                  {
+                    Name: "association.route-table-association-id",
+                    Values: [output.associationId],
+                  },
+                ],
+              })
+              .pipe(
+                Effect.catchTag("InvalidRouteTableID.NotFound", () =>
+                  Effect.succeed({ RouteTables: [] }),
+                ),
+              );
+            for (const rt of lookup.RouteTables ?? []) {
+              const assoc = rt.Associations?.find(
+                (a) => a.RouteTableAssociationId === output.associationId,
+              );
+              if (assoc) {
+                observed = {
+                  associationId: assoc.RouteTableAssociationId!,
+                  routeTableId: assoc.RouteTableId!,
+                  subnetId: assoc.SubnetId,
+                  gatewayId: assoc.GatewayId,
+                  state: assoc.AssociationState?.State,
+                  statusMessage: assoc.AssociationState?.StatusMessage,
+                };
+                break;
+              }
+            }
+          }
+
+          // Ensure — no existing association ⇒ AssociateRouteTable.
+          if (observed === undefined) {
+            const result = yield* ec2
+              .associateRouteTable({
+                RouteTableId: news.routeTableId,
+                SubnetId: news.subnetId,
+                GatewayId: news.gatewayId,
+                DryRun: false,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) =>
+                    e._tag === "InvalidRouteTableID.NotFound" ||
+                    e._tag === "InvalidSubnetID.NotFound",
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+            const associationId =
+              result.AssociationId! as RouteTableAssociationId;
+            yield* session.note(
+              `Route table association created: ${associationId}`,
+            );
+            yield* waitForAssociationState(
+              news.routeTableId,
+              associationId,
+              "associated",
+              session,
+            );
+            return {
+              associationId,
+              routeTableId: news.routeTableId as RouteTableId,
+              subnetId: news.subnetId as SubnetId | undefined,
+              gatewayId: news.gatewayId as string | undefined,
+              associationState: {
+                state: result.AssociationState?.State ?? "associated",
+                statusMessage: result.AssociationState?.StatusMessage,
+              },
+            };
+          }
+
+          // Sync — drift in routeTableId is patched in place by
+          // ReplaceRouteTableAssociation. Subnet/gateway changes are
+          // intercepted upstream by `diff` as a replacement.
+          if (observed.routeTableId !== (news.routeTableId as string)) {
+            const result = yield* ec2.replaceRouteTableAssociation({
+              AssociationId: observed.associationId,
+              RouteTableId: news.routeTableId,
+              DryRun: false,
+            });
+            const newAssociationId =
+              result.NewAssociationId! as RouteTableAssociationId;
+            yield* session.note(
+              `Route table association replaced: ${newAssociationId}`,
+            );
+            yield* waitForAssociationState(
+              news.routeTableId,
+              newAssociationId,
+              "associated",
+              session,
+            );
+            return {
+              associationId: newAssociationId,
+              routeTableId: news.routeTableId as RouteTableId,
+              subnetId: news.subnetId as SubnetId | undefined,
+              gatewayId: news.gatewayId as string | undefined,
+              associationState: {
+                state: result.AssociationState?.State ?? "associated",
+                statusMessage: result.AssociationState?.StatusMessage,
+              },
+            };
+          }
+
+          // Already in the desired state — just report it.
+          return {
+            associationId: observed.associationId as RouteTableAssociationId,
+            routeTableId: observed.routeTableId as RouteTableId,
+            subnetId: observed.subnetId as SubnetId | undefined,
+            gatewayId: observed.gatewayId,
+            associationState: {
+              state: observed.state ?? "associated",
+              statusMessage: observed.statusMessage,
+            },
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          yield* session.note(
+            `Deleting route table association: ${output.associationId}`,
+          );
+
+          // Disassociate the route table
+          yield* ec2
+            .disassociateRouteTable({
+              AssociationId: output.associationId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.log),
+              Effect.catchTag(
+                "InvalidAssociationID.NotFound",
+                () => Effect.void,
+              ),
+            );
+
+          yield* session.note(
+            `Route table association ${output.associationId} deleted successfully`,
+          );
+        }),
+      };
+    }),
+  );
+
+/**
+ * Wait for association to reach a specific state
+ */
+const waitForAssociationState = (
+  routeTableId: string,
+  associationId: string,
+  targetState:
+    | "associating"
+    | "associated"
+    | "disassociating"
+    | "disassociated",
+  session?: ScopedPlanStatusSession,
+) =>
+  Effect.retry(
+    Effect.gen(function* () {
+      const result = yield* ec2
+        .describeRouteTables({ RouteTableIds: [routeTableId] })
+        .pipe(
+          Effect.catchTag("InvalidRouteTableID.NotFound", () =>
+            Effect.succeed({
+              RouteTables: [],
+            } as ec2.DescribeRouteTablesResult),
+          ),
+        );
+
+      const routeTable = result.RouteTables?.[0];
+      if (!routeTable) {
+        return yield* Effect.fail(new Error("Route table not found"));
+      }
+
+      const association = routeTable.Associations?.find(
+        (a) => a.RouteTableAssociationId === associationId,
+      );
+
+      if (!association) {
+        // Association might not exist yet, retry
+        return yield* Effect.fail(new Error("Association not found"));
+      }
+
+      if (association.AssociationState?.State === targetState) {
+        return;
+      }
+
+      if (association.AssociationState?.State === "failed") {
+        return yield* Effect.fail(
+          new Error(
+            `Association failed: ${association.AssociationState.StatusMessage}`,
+          ),
+        );
+      }
+
+      // Still in progress, fail to trigger retry
+      return yield* Effect.fail(
+        new Error(`Association state: ${association.AssociationState?.State}`),
+      );
+    }),
+    {
+      schedule: Schedule.fixed(1000).pipe(
+        // Check every second
+        Schedule.both(Schedule.recurs(30)), // Max 30 seconds
+        Schedule.tapOutput(([, attempt]) =>
+          session
+            ? session.note(
+                `Waiting for association to be ${targetState}... (${attempt + 1}s)`,
+              )
+            : Effect.void,
+        ),
+      ),
+    },
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/SecurityGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/SecurityGroup.ts
new file mode 100644
index 00000000000..a265f043b50
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/SecurityGroup.ts
@@ -0,0 +1,492 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type SecurityGroupId<ID extends string = string> = `sg-${ID}`;
+export const SecurityGroupId = <ID extends string>(
+  id: ID,
+): ID & SecurityGroupId<ID> => `sg-${id}` as ID & SecurityGroupId<ID>;
+
+export type SecurityGroupArn<
+  GroupId extends SecurityGroupId = SecurityGroupId,
+> = `arn:aws:ec2:${RegionID}:${AccountID}:security-group/${GroupId}`;
+
+/**
+ * Ingress or egress rule for a security group.
+ */
+export interface SecurityGroupRuleData {
+  /**
+   * The IP protocol name or number.
+   * Use -1 to specify all protocols.
+   */
+  ipProtocol: string;
+
+  /**
+   * The start of the port range.
+   * For ICMP, use the ICMP type number.
+   */
+  fromPort?: number;
+
+  /**
+   * The end of the port range.
+   * For ICMP, use the ICMP code.
+   */
+  toPort?: number;
+
+  /**
+   * IPv4 CIDR ranges to allow.
+   */
+  cidrIpv4?: string;
+
+  /**
+   * IPv6 CIDR ranges to allow.
+   */
+  cidrIpv6?: string;
+
+  /**
+   * ID of a security group to allow traffic from/to.
+   */
+  referencedGroupId?: SecurityGroupId;
+
+  /**
+   * ID of a prefix list.
+   */
+  prefixListId?: string;
+
+  /**
+   * Description for the rule.
+   */
+  description?: string;
+}
+
+export interface SecurityGroupProps {
+  /**
+   * The VPC to create the security group in.
+   */
+  vpcId: VpcId;
+
+  /**
+   * The name of the security group.
+   * If not provided, a name will be generated.
+   */
+  groupName?: string;
+
+  /**
+   * A description for the security group.
+   * @default "Managed by Alchemy"
+   */
+  description?: string;
+
+  /**
+   * Inbound rules for the security group.
+   */
+  ingress?: SecurityGroupRuleData[];
+
+  /**
+   * Outbound rules for the security group.
+   * If not specified, allows all outbound traffic by default.
+   */
+  egress?: SecurityGroupRuleData[];
+
+  /**
+   * Tags to assign to the security group.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface SecurityGroup extends Resource<
+  "AWS.EC2.SecurityGroup",
+  SecurityGroupProps,
+  {
+    /**
+     * The ID of the security group.
+     */
+    groupId: SecurityGroupId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the security group.
+     */
+    groupArn: SecurityGroupArn;
+
+    /**
+     * The name of the security group.
+     */
+    groupName: string;
+
+    /**
+     * The description of the security group.
+     */
+    description: string;
+
+    /**
+     * The ID of the VPC for the security group.
+     */
+    vpcId: VpcId;
+
+    /**
+     * The ID of the AWS account that owns the security group.
+     */
+    ownerId: string;
+
+    /**
+     * The inbound rules associated with the security group.
+     */
+    ingressRules?: Array<{
+      securityGroupRuleId: string;
+      ipProtocol: string;
+      fromPort?: number;
+      toPort?: number;
+      cidrIpv4?: string;
+      cidrIpv6?: string;
+      referencedGroupId?: string;
+      prefixListId?: string;
+      description?: string;
+      isEgress: false;
+    }>;
+
+    /**
+     * The outbound rules associated with the security group.
+     */
+    egressRules?: Array<{
+      securityGroupRuleId: string;
+      ipProtocol: string;
+      fromPort?: number;
+      toPort?: number;
+      cidrIpv4?: string;
+      cidrIpv6?: string;
+      referencedGroupId?: string;
+      prefixListId?: string;
+      description?: string;
+      isEgress: true;
+    }>;
+  },
+  never,
+  Providers
+> {}
+export const SecurityGroup = Resource<SecurityGroup>("AWS.EC2.SecurityGroup");
+
+export const SecurityGroupProvider = () =>
+  Provider.effect(
+    SecurityGroup,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const createGroupName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          if (name) return name;
+          return yield* createPhysicalName({ id, maxLength: 255 });
+        });
+
+      const describeSecurityGroup = (groupId: string) =>
+        ec2.describeSecurityGroups({ GroupIds: [groupId] }).pipe(
+          Effect.map((r) => r.SecurityGroups?.[0]),
+          Effect.flatMap((sg) =>
+            sg
+              ? Effect.succeed(sg)
+              : Effect.fail(new Error(`Security Group ${groupId} not found`)),
+          ),
+        );
+
+      const describeSecurityGroupRules = (groupId: string) =>
+        ec2.describeSecurityGroupRules({
+          Filters: [{ Name: "group-id", Values: [groupId] }],
+        });
+
+      const toAttrs = (
+        sg: ec2.SecurityGroup,
+        rules: ec2.SecurityGroupRule[],
+      ): SecurityGroup["Attributes"] => ({
+        groupId: sg.GroupId as SecurityGroupId,
+        groupArn:
+          `arn:aws:ec2:${region}:${accountId}:security-group/${sg.GroupId as SecurityGroupId}` as SecurityGroupArn,
+        groupName: sg.GroupName!,
+        description: sg.Description!,
+        vpcId: sg.VpcId as VpcId,
+        ownerId: sg.OwnerId!,
+        ingressRules: rules
+          .filter((r) => !r.IsEgress)
+          .map((r) => ({
+            securityGroupRuleId: r.SecurityGroupRuleId!,
+            ipProtocol: r.IpProtocol!,
+            fromPort: r.FromPort,
+            toPort: r.ToPort,
+            cidrIpv4: r.CidrIpv4,
+            cidrIpv6: r.CidrIpv6,
+            referencedGroupId: r.ReferencedGroupInfo?.GroupId,
+            prefixListId: r.PrefixListId,
+            description: r.Description,
+            isEgress: false as const,
+          })),
+        egressRules: rules
+          .filter((r) => r.IsEgress)
+          .map((r) => ({
+            securityGroupRuleId: r.SecurityGroupRuleId!,
+            ipProtocol: r.IpProtocol!,
+            fromPort: r.FromPort,
+            toPort: r.ToPort,
+            cidrIpv4: r.CidrIpv4,
+            cidrIpv6: r.CidrIpv6,
+            referencedGroupId: r.ReferencedGroupInfo?.GroupId,
+            prefixListId: r.PrefixListId,
+            description: r.Description,
+            isEgress: true as const,
+          })),
+      });
+
+      const toIpPermission = (
+        rule: SecurityGroupRuleData,
+      ): ec2.IpPermission => ({
+        IpProtocol: rule.ipProtocol,
+        FromPort: rule.fromPort,
+        ToPort: rule.toPort,
+        IpRanges: rule.cidrIpv4
+          ? [{ CidrIp: rule.cidrIpv4, Description: rule.description }]
+          : undefined,
+        Ipv6Ranges: rule.cidrIpv6
+          ? [{ CidrIpv6: rule.cidrIpv6, Description: rule.description }]
+          : undefined,
+        UserIdGroupPairs: rule.referencedGroupId
+          ? [
+              {
+                GroupId: rule.referencedGroupId as string,
+                Description: rule.description,
+              },
+            ]
+          : undefined,
+        PrefixListIds: rule.prefixListId
+          ? [
+              {
+                PrefixListId: rule.prefixListId as string,
+                Description: rule.description,
+              },
+            ]
+          : undefined,
+      });
+
+      return {
+        stables: ["groupId", "groupArn", "ownerId"],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const sg = yield* describeSecurityGroup(output.groupId);
+          const rulesResult = yield* describeSecurityGroupRules(output.groupId);
+          return toAttrs(sg, rulesResult.SecurityGroupRules ?? []);
+        }),
+
+        diff: Effect.fn(function* ({ id, news, olds, output }) {
+          if (!isResolved(news)) return;
+          // VPC change requires replacement
+          if (news.vpcId !== olds.vpcId) {
+            return { action: "replace" };
+          }
+
+          // Group name change requires replacement
+          const newGroupName = yield* createGroupName(id, news.groupName);
+          const oldGroupName = output?.groupName
+            ? output.groupName
+            : yield* createGroupName(id, olds.groupName);
+          if (newGroupName !== oldGroupName) {
+            return { action: "replace" };
+          }
+
+          // Other changes can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const groupName = yield* createGroupName(id, news.groupName);
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the SG via cached id, else fall through to create.
+          let sg: ec2.SecurityGroup | undefined;
+          if (output?.groupId) {
+            const lookup = yield* ec2
+              .describeSecurityGroups({ GroupIds: [output.groupId] })
+              .pipe(
+                Effect.catchTag("InvalidGroup.NotFound", () =>
+                  Effect.succeed({ SecurityGroups: [] }),
+                ),
+              );
+            sg = lookup.SecurityGroups?.[0];
+          }
+
+          // Ensure — create the SG when missing.
+          if (sg === undefined) {
+            yield* session.note(`Creating Security Group: ${groupName}`);
+            const result = yield* ec2.createSecurityGroup({
+              GroupName: groupName,
+              Description: news.description ?? "Managed by Alchemy",
+              VpcId: news.vpcId as string,
+              TagSpecifications: [
+                {
+                  ResourceType: "security-group",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newGroupId = result.GroupId! as SecurityGroupId;
+            yield* session.note(`Security Group created: ${newGroupId}`);
+            sg = yield* describeSecurityGroup(newGroupId);
+          }
+
+          const groupId = sg.GroupId! as SecurityGroupId;
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (sg.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed: removedTags, upsert: upsertTags } = diffTags(
+            currentTags,
+            desiredTags,
+          );
+          if (removedTags.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [groupId],
+              Tags: removedTags.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsertTags.length > 0) {
+            yield* ec2.createTags({
+              Resources: [groupId],
+              Tags: upsertTags,
+              DryRun: false,
+            });
+          }
+
+          // Sync ingress + egress rules — revoke whatever is observed and
+          // reapply the desired set. SG rule diffing on this SDK is non-
+          // trivial because each rule has many possible source shapes
+          // (cidr/group ref/prefix list), so the simplest convergent strategy
+          // is full-replace each reconcile. Default egress (-1, 0.0.0.0/0)
+          // is restored when no explicit egress is desired.
+          const currentRulesResult = yield* describeSecurityGroupRules(groupId);
+          const currentRules = currentRulesResult.SecurityGroupRules ?? [];
+          const currentIngress = currentRules.filter((r) => !r.IsEgress);
+          const currentEgress = currentRules.filter((r) => r.IsEgress);
+          if (currentIngress.length > 0) {
+            yield* ec2
+              .revokeSecurityGroupIngress({
+                GroupId: groupId,
+                SecurityGroupRuleIds: currentIngress.map(
+                  (r) => r.SecurityGroupRuleId!,
+                ),
+                DryRun: false,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidPermission.NotFound",
+                  () => Effect.void,
+                ),
+              );
+          }
+          if (currentEgress.length > 0) {
+            yield* ec2
+              .revokeSecurityGroupEgress({
+                GroupId: groupId,
+                SecurityGroupRuleIds: currentEgress.map(
+                  (r) => r.SecurityGroupRuleId!,
+                ),
+                DryRun: false,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidPermission.NotFound",
+                  () => Effect.void,
+                ),
+              );
+          }
+          if (news.ingress && news.ingress.length > 0) {
+            yield* ec2.authorizeSecurityGroupIngress({
+              GroupId: groupId,
+              IpPermissions: news.ingress.map(toIpPermission),
+              DryRun: false,
+            });
+            yield* session.note(`Applied ${news.ingress.length} ingress rules`);
+          }
+          if (news.egress && news.egress.length > 0) {
+            yield* ec2.authorizeSecurityGroupEgress({
+              GroupId: groupId,
+              IpPermissions: news.egress.map(toIpPermission),
+              DryRun: false,
+            });
+            yield* session.note(`Applied ${news.egress.length} egress rules`);
+          } else {
+            yield* ec2.authorizeSecurityGroupEgress({
+              GroupId: groupId,
+              IpPermissions: [
+                {
+                  IpProtocol: "-1",
+                  IpRanges: [{ CidrIp: "0.0.0.0/0" }],
+                },
+              ],
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state.
+          const finalSg = yield* describeSecurityGroup(groupId);
+          const finalRules = yield* describeSecurityGroupRules(groupId);
+          return toAttrs(finalSg, finalRules.SecurityGroupRules ?? []);
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const groupId = output.groupId;
+
+          yield* session.note(`Deleting Security Group: ${groupId}`);
+
+          yield* ec2
+            .deleteSecurityGroup({
+              GroupId: groupId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.catchTag("InvalidGroup.NotFound", () => Effect.void),
+              // Retry on dependency violations (e.g., ENIs still using the security group)
+              Effect.retry({
+                while: (e) => {
+                  return (
+                    e._tag === "DependencyViolation" ||
+                    (e._tag === "ValidationError" &&
+                      e.message?.includes("DependencyViolation"))
+                  );
+                },
+                schedule: Schedule.fixed(5000).pipe(
+                  Schedule.both(Schedule.recurs(30)), // Up to ~2.5 minutes
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          yield* session.note(`Security Group ${groupId} deleted`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/SecurityGroupRule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/SecurityGroupRule.ts
new file mode 100644
index 00000000000..839b190b1ce
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/SecurityGroupRule.ts
@@ -0,0 +1,392 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { SecurityGroupId } from "./SecurityGroup.ts";
+
+export type SecurityGroupRuleId<ID extends string = string> = `sgr-${ID}`;
+export const SecurityGroupRuleId = <ID extends string>(
+  id: ID,
+): ID & SecurityGroupRuleId<ID> => `sgr-${id}` as ID & SecurityGroupRuleId<ID>;
+
+export interface SecurityGroupRuleProps {
+  /**
+   * The ID of the security group.
+   */
+  groupId: SecurityGroupId;
+
+  /**
+   * Whether this is an ingress (inbound) or egress (outbound) rule.
+   */
+  type: "ingress" | "egress";
+
+  /**
+   * The IP protocol name or number.
+   * Use -1 to specify all protocols.
+   */
+  ipProtocol: string;
+
+  /**
+   * The start of the port range.
+   * For ICMP, use the ICMP type number.
+   */
+  fromPort?: number;
+
+  /**
+   * The end of the port range.
+   * For ICMP, use the ICMP code.
+   */
+  toPort?: number;
+
+  /**
+   * IPv4 CIDR range to allow.
+   */
+  cidrIpv4?: string;
+
+  /**
+   * IPv6 CIDR range to allow.
+   */
+  cidrIpv6?: string;
+
+  /**
+   * ID of a security group to allow traffic from/to.
+   */
+  referencedGroupId?: SecurityGroupId;
+
+  /**
+   * ID of a prefix list.
+   */
+  prefixListId?: string;
+
+  /**
+   * Description for the rule.
+   */
+  description?: string;
+
+  /**
+   * Tags to assign to the security group rule.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface SecurityGroupRule extends Resource<
+  "AWS.EC2.SecurityGroupRule",
+  SecurityGroupRuleProps,
+  {
+    /**
+     * The ID of the security group rule.
+     */
+    securityGroupRuleId: SecurityGroupRuleId;
+
+    /**
+     * The ID of the security group.
+     */
+    groupId: SecurityGroupId;
+
+    /**
+     * The ID of the AWS account that owns the security group.
+     */
+    groupOwnerId: string;
+
+    /**
+     * Whether this is an egress rule.
+     */
+    isEgress: boolean;
+
+    /**
+     * The IP protocol.
+     */
+    ipProtocol: string;
+
+    /**
+     * The start of the port range.
+     */
+    fromPort?: number;
+
+    /**
+     * The end of the port range.
+     */
+    toPort?: number;
+
+    /**
+     * The IPv4 CIDR range.
+     */
+    cidrIpv4?: string | undefined;
+
+    /**
+     * The IPv6 CIDR range.
+     */
+    cidrIpv6?: string | undefined;
+
+    /**
+     * The ID of the referenced security group.
+     */
+    referencedGroupId?: string;
+
+    /**
+     * The ID of the prefix list.
+     */
+    prefixListId?: string;
+
+    /**
+     * The description.
+     */
+    description?: string | undefined;
+  },
+  never,
+  Providers
+> {}
+export const SecurityGroupRule = Resource<SecurityGroupRule>(
+  "AWS.EC2.SecurityGroupRule",
+);
+
+export const SecurityGroupRuleProvider = () =>
+  Provider.effect(
+    SecurityGroupRule,
+    Effect.gen(function* () {
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const describeRule = (ruleId: string) =>
+        ec2.describeSecurityGroupRules({ SecurityGroupRuleIds: [ruleId] }).pipe(
+          Effect.map((r) => r.SecurityGroupRules?.[0]),
+          Effect.flatMap((rule) =>
+            rule
+              ? Effect.succeed(rule)
+              : Effect.fail(
+                  new Error(`Security Group Rule ${ruleId} not found`),
+                ),
+          ),
+        );
+
+      const toAttrs = (
+        rule: Awaited<
+          ReturnType<
+            typeof describeRule extends (
+              ...args: any
+            ) => Effect.Effect<infer R, any, any>
+              ? () => Promise<R>
+              : never
+          >
+        >,
+      ): SecurityGroupRule["Attributes"] => ({
+        securityGroupRuleId: rule.SecurityGroupRuleId as SecurityGroupRuleId,
+        groupId: rule.GroupId as SecurityGroupId,
+        groupOwnerId: rule.GroupOwnerId!,
+        isEgress: rule.IsEgress as boolean,
+        ipProtocol: rule.IpProtocol!,
+        fromPort: rule.FromPort,
+        toPort: rule.ToPort,
+        cidrIpv4: rule.CidrIpv4,
+        cidrIpv6: rule.CidrIpv6,
+        referencedGroupId: rule.ReferencedGroupInfo?.GroupId,
+        prefixListId: rule.PrefixListId,
+        description: rule.Description,
+      });
+
+      return {
+        stables: ["securityGroupRuleId", "groupOwnerId"],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const rule = yield* describeRule(output.securityGroupRuleId);
+          return toAttrs(rule);
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // Most properties require replacement
+          if (
+            news.groupId !== olds.groupId ||
+            news.type !== olds.type ||
+            news.ipProtocol !== olds.ipProtocol ||
+            news.fromPort !== olds.fromPort ||
+            news.toPort !== olds.toPort ||
+            news.cidrIpv4 !== olds.cidrIpv4 ||
+            news.cidrIpv6 !== olds.cidrIpv6 ||
+            news.referencedGroupId !== olds.referencedGroupId ||
+            news.prefixListId !== olds.prefixListId
+          ) {
+            return { action: "replace" };
+          }
+          // Description and tags can be updated
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          const ipPermission = {
+            IpProtocol: news.ipProtocol,
+            FromPort: news.fromPort,
+            ToPort: news.toPort,
+            IpRanges: news.cidrIpv4
+              ? [{ CidrIp: news.cidrIpv4, Description: news.description }]
+              : undefined,
+            Ipv6Ranges: news.cidrIpv6
+              ? [{ CidrIpv6: news.cidrIpv6, Description: news.description }]
+              : undefined,
+            UserIdGroupPairs: news.referencedGroupId
+              ? [
+                  {
+                    GroupId: news.referencedGroupId as string,
+                    Description: news.description,
+                  },
+                ]
+              : undefined,
+            PrefixListIds: news.prefixListId
+              ? [
+                  {
+                    PrefixListId: news.prefixListId as string,
+                    Description: news.description,
+                  },
+                ]
+              : undefined,
+          };
+
+          // Observe — find the rule via cached id, else fall through to
+          // create. SG rule identity is the SecurityGroupRuleId.
+          let observed: ec2.SecurityGroupRule | undefined;
+          if (output?.securityGroupRuleId) {
+            const lookup = yield* ec2
+              .describeSecurityGroupRules({
+                SecurityGroupRuleIds: [output.securityGroupRuleId],
+              })
+              .pipe(
+                Effect.catchTag("InvalidSecurityGroupRuleId.NotFound", () =>
+                  Effect.succeed({ SecurityGroupRules: [] }),
+                ),
+              );
+            observed = lookup.SecurityGroupRules?.[0];
+          }
+
+          // Ensure — Authorize{Ingress,Egress} when missing.
+          if (observed === undefined) {
+            yield* session.note("Creating Security Group Rule...");
+            const tagSpec = [
+              {
+                ResourceType: "security-group-rule" as const,
+                Tags: createTagsList(desiredTags),
+              },
+            ];
+            const result =
+              news.type === "ingress"
+                ? yield* ec2.authorizeSecurityGroupIngress({
+                    GroupId: news.groupId as string,
+                    IpPermissions: [ipPermission],
+                    TagSpecifications: tagSpec,
+                    DryRun: false,
+                  })
+                : yield* ec2.authorizeSecurityGroupEgress({
+                    GroupId: news.groupId as string,
+                    IpPermissions: [ipPermission],
+                    TagSpecifications: tagSpec,
+                    DryRun: false,
+                  });
+            const newRuleId =
+              result.SecurityGroupRules?.[0]?.SecurityGroupRuleId!;
+            yield* session.note(`Security Group Rule created: ${newRuleId}`);
+            observed = yield* describeRule(newRuleId);
+          }
+
+          const ruleId = observed.SecurityGroupRuleId!;
+
+          // Sync description — modifySecurityGroupRules patches the
+          // mutable description in place when it drifts.
+          if ((observed.Description ?? undefined) !== news.description) {
+            yield* ec2.modifySecurityGroupRules({
+              GroupId: news.groupId as string,
+              SecurityGroupRules: [
+                {
+                  SecurityGroupRuleId: ruleId,
+                  SecurityGroupRule: {
+                    IpProtocol: news.ipProtocol,
+                    FromPort: news.fromPort,
+                    ToPort: news.toPort,
+                    CidrIpv4: news.cidrIpv4,
+                    CidrIpv6: news.cidrIpv6,
+                    ReferencedGroupId: news.referencedGroupId as
+                      | string
+                      | undefined,
+                    PrefixListId: news.prefixListId as string | undefined,
+                    Description: news.description,
+                  },
+                },
+              ],
+            });
+          }
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (observed.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [ruleId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [ruleId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state.
+          const final = yield* describeRule(ruleId);
+          return toAttrs(final);
+        }),
+
+        delete: Effect.fn(function* ({ olds, output, session }) {
+          const ruleId = output.securityGroupRuleId;
+
+          yield* session.note(`Deleting Security Group Rule: ${ruleId}`);
+
+          if (olds.type === "ingress") {
+            yield* ec2
+              .revokeSecurityGroupIngress({
+                GroupId: olds.groupId as string,
+                SecurityGroupRuleIds: [ruleId],
+                DryRun: false,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidPermission.NotFound",
+                  () => Effect.void,
+                ),
+              );
+          } else {
+            yield* ec2
+              .revokeSecurityGroupEgress({
+                GroupId: olds.groupId as string,
+                SecurityGroupRuleIds: [ruleId],
+                DryRun: false,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "InvalidPermission.NotFound",
+                  () => Effect.void,
+                ),
+              );
+          }
+
+          yield* session.note(`Security Group Rule ${ruleId} deleted`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Subnet.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Subnet.ts
new file mode 100644
index 00000000000..1715ef4f69d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Subnet.ts
@@ -0,0 +1,553 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved, somePropsAreDifferent } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type SubnetId<ID extends string = string> = `subnet-${ID}`;
+export const SubnetId = <ID extends string>(id: ID): ID & SubnetId<ID> =>
+  `subnet-${id}` as ID & SubnetId<ID>;
+
+export type SubnetArn =
+  `arn:aws:ec2:${RegionID}:${AccountID}:subnet/${SubnetId}`;
+
+export interface SubnetProps {
+  /**
+   * The VPC to create the subnet in.
+   */
+  vpcId: VpcId;
+
+  /**
+   * The IPv4 network range for the subnet, in CIDR notation.
+   * Required unless using IPAM.
+   * @example "10.0.1.0/24"
+   */
+  cidrBlock?: string;
+
+  /**
+   * The IPv6 network range for the subnet, in CIDR notation.
+   */
+  ipv6CidrBlock?: string;
+
+  /**
+   * The Availability Zone for the subnet.
+   * @example "us-east-1a"
+   */
+  availabilityZone?: string;
+
+  /**
+   * The ID of the Availability Zone for the subnet.
+   */
+  availabilityZoneId?: string;
+
+  /**
+   * The ID of an IPv4 IPAM pool you want to use for allocating this subnet's CIDR.
+   */
+  ipv4IpamPoolId?: string;
+
+  /**
+   * The netmask length of the IPv4 CIDR you want to allocate to this subnet from an IPAM pool.
+   */
+  ipv4NetmaskLength?: number;
+
+  /**
+   * The ID of an IPv6 IPAM pool which will be used to allocate this subnet an IPv6 CIDR.
+   */
+  ipv6IpamPoolId?: string;
+
+  /**
+   * The netmask length of the IPv6 CIDR you want to allocate to this subnet from an IPAM pool.
+   */
+  ipv6NetmaskLength?: number;
+
+  /**
+   * Whether instances launched in the subnet get public IPv4 addresses.
+   * @default false
+   */
+  mapPublicIpOnLaunch?: boolean;
+
+  /**
+   * Whether instances launched in the subnet get IPv6 addresses.
+   * @default false
+   */
+  assignIpv6AddressOnCreation?: boolean;
+
+  /**
+   * Whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return
+   * synthetic IPv6 addresses for IPv4-only destinations.
+   * @default false
+   */
+  enableDns64?: boolean;
+
+  /**
+   * Whether to enable resource name DNS A record on launch.
+   * @default false
+   */
+  enableResourceNameDnsARecordOnLaunch?: boolean;
+
+  /**
+   * Whether to enable resource name DNS AAAA record on launch.
+   * @default false
+   */
+  enableResourceNameDnsAAAARecordOnLaunch?: boolean;
+
+  /**
+   * The hostname type for EC2 instances launched into this subnet.
+   */
+  hostnameType?: ec2.HostnameType;
+
+  /**
+   * Tags to assign to the subnet.
+   * These will be merged with alchemy auto-tags (alchemy::stack, alchemy::stage, alchemy::id).
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Subnet extends Resource<
+  "AWS.EC2.Subnet",
+  SubnetProps,
+  {
+    /**
+     * The ID of the VPC the subnet is in.
+     */
+    vpcId: VpcId;
+
+    /**
+     * The ID of the subnet.
+     */
+    subnetId: SubnetId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the subnet.
+     */
+    subnetArn: SubnetArn;
+
+    /**
+     * The IPv4 CIDR block for the subnet.
+     */
+    cidrBlock: string;
+
+    /**
+     * The Availability Zone of the subnet.
+     */
+    availabilityZone: string;
+
+    /**
+     * The ID of the Availability Zone of the subnet.
+     */
+    availabilityZoneId?: string;
+
+    /**
+     * The current state of the subnet.
+     */
+    state: ec2.SubnetState;
+
+    /**
+     * The number of available IPv4 addresses in the subnet.
+     */
+    availableIpAddressCount: number;
+
+    /**
+     * Whether instances launched in the subnet get public IPv4 addresses.
+     */
+    mapPublicIpOnLaunch: boolean;
+
+    /**
+     * Whether instances launched in the subnet get IPv6 addresses.
+     */
+    assignIpv6AddressOnCreation: boolean | undefined;
+
+    /**
+     * Whether the subnet is the default subnet for the Availability Zone.
+     */
+    defaultForAz: boolean;
+
+    /**
+     * The ID of the AWS account that owns the subnet.
+     */
+    ownerId?: string;
+
+    /**
+     * Information about the IPv6 CIDR blocks associated with the subnet.
+     */
+    ipv6CidrBlockAssociationSet?: Array<{
+      associationId: string;
+      ipv6CidrBlock: string;
+      ipv6CidrBlockState: {
+        state: ec2.SubnetCidrBlockStateCode;
+        statusMessage?: string;
+      };
+    }>;
+
+    /**
+     * Whether DNS64 is enabled for the subnet.
+     */
+    enableDns64?: boolean;
+
+    /**
+     * Whether this is an IPv6-only subnet.
+     */
+    ipv6Native?: boolean;
+
+    /**
+     * The private DNS name options on launch.
+     */
+    privateDnsNameOptionsOnLaunch?: {
+      hostnameType?: ec2.HostnameType;
+      enableResourceNameDnsARecord?: boolean;
+      enableResourceNameDnsAAAARecord?: boolean;
+    };
+  },
+  never,
+  Providers
+> {}
+export const Subnet = Resource<Subnet>("AWS.EC2.Subnet");
+
+export const SubnetProvider = () =>
+  Provider.effect(
+    Subnet,
+    Effect.gen(function* () {
+      return {
+        stables: ["subnetId", "subnetArn", "ownerId", "vpcId"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          if (
+            somePropsAreDifferent(olds, news, [
+              "vpcId",
+              "cidrBlock",
+              "availabilityZone",
+              "availabilityZoneId",
+              "ipv6CidrBlock",
+              "ipv4IpamPoolId",
+              "ipv6IpamPoolId",
+            ])
+          ) {
+            return { action: "replace" };
+          }
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const alchemyTags = yield* createInternalTags(id);
+          const desiredTags = { ...alchemyTags, ...(news.tags ?? {}) };
+
+          // Observe — find the subnet via cached id, else fall through to
+          // create.
+          let subnet: ec2.Subnet | undefined;
+          if (output?.subnetId) {
+            const lookup = yield* ec2
+              .describeSubnets({ SubnetIds: [output.subnetId] })
+              .pipe(
+                Effect.catchTag("InvalidSubnetID.NotFound", () =>
+                  Effect.succeed({ Subnets: [] }),
+                ),
+              );
+            subnet = lookup.Subnets?.[0];
+          }
+
+          // Ensure — create the subnet when missing.
+          if (subnet === undefined) {
+            const createResult = yield* ec2
+              .createSubnet({
+                VpcId: news.vpcId,
+                CidrBlock: news.cidrBlock,
+                Ipv6CidrBlock: news.ipv6CidrBlock,
+                AvailabilityZone: news.availabilityZone,
+                AvailabilityZoneId: news.availabilityZoneId,
+                Ipv4IpamPoolId: news.ipv4IpamPoolId,
+                Ipv4NetmaskLength: news.ipv4NetmaskLength,
+                Ipv6IpamPoolId: news.ipv6IpamPoolId,
+                Ipv6NetmaskLength: news.ipv6NetmaskLength,
+                Ipv6Native: false,
+                TagSpecifications: [
+                  {
+                    ResourceType: "subnet",
+                    Tags: createTagsList(desiredTags),
+                  },
+                ],
+                DryRun: false,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "InvalidVpcID.NotFound",
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+            const newSubnetId = createResult.Subnet!.SubnetId! as SubnetId;
+            yield* session.note(`Subnet created: ${newSubnetId}`);
+            subnet = yield* waitForSubnetAvailable(newSubnetId, session);
+          }
+
+          const subnetId = subnet.SubnetId! as SubnetId;
+
+          // Sync subnet attributes — diff observed cloud state against desired
+          // and only call modifySubnetAttribute on real drift.
+          const desiredMapPublicIp = news.mapPublicIpOnLaunch ?? false;
+          if ((subnet.MapPublicIpOnLaunch ?? false) !== desiredMapPublicIp) {
+            yield* ec2.modifySubnetAttribute({
+              SubnetId: subnetId,
+              MapPublicIpOnLaunch: { Value: desiredMapPublicIp },
+            });
+            yield* session.note(
+              `Updated map public IP on launch: ${desiredMapPublicIp}`,
+            );
+          }
+
+          const desiredAssignIpv6 = news.assignIpv6AddressOnCreation ?? false;
+          if (
+            (subnet.AssignIpv6AddressOnCreation ?? false) !== desiredAssignIpv6
+          ) {
+            yield* ec2.modifySubnetAttribute({
+              SubnetId: subnetId,
+              AssignIpv6AddressOnCreation: { Value: desiredAssignIpv6 },
+            });
+            yield* session.note(
+              `Updated assign IPv6 address on creation: ${desiredAssignIpv6}`,
+            );
+          }
+
+          const desiredEnableDns64 = news.enableDns64 ?? false;
+          if ((subnet.EnableDns64 ?? false) !== desiredEnableDns64) {
+            yield* ec2.modifySubnetAttribute({
+              SubnetId: subnetId,
+              EnableDns64: { Value: desiredEnableDns64 },
+            });
+            yield* session.note(`Updated DNS64 setting: ${desiredEnableDns64}`);
+          }
+
+          const observedHostnameType =
+            subnet.PrivateDnsNameOptionsOnLaunch?.HostnameType;
+          const observedDnsA =
+            subnet.PrivateDnsNameOptionsOnLaunch?.EnableResourceNameDnsARecord;
+          const observedDnsAAAA =
+            subnet.PrivateDnsNameOptionsOnLaunch
+              ?.EnableResourceNameDnsAAAARecord;
+          if (
+            observedHostnameType !== news.hostnameType ||
+            observedDnsA !== news.enableResourceNameDnsARecordOnLaunch ||
+            observedDnsAAAA !== news.enableResourceNameDnsAAAARecordOnLaunch
+          ) {
+            if (
+              news.enableResourceNameDnsARecordOnLaunch !== undefined ||
+              news.enableResourceNameDnsAAAARecordOnLaunch !== undefined ||
+              news.hostnameType !== undefined
+            ) {
+              yield* ec2.modifySubnetAttribute({
+                SubnetId: subnetId,
+                PrivateDnsHostnameTypeOnLaunch: news.hostnameType,
+                EnableResourceNameDnsARecordOnLaunch:
+                  news.enableResourceNameDnsARecordOnLaunch !== undefined
+                    ? { Value: news.enableResourceNameDnsARecordOnLaunch }
+                    : undefined,
+                EnableResourceNameDnsAAAARecordOnLaunch:
+                  news.enableResourceNameDnsAAAARecordOnLaunch !== undefined
+                    ? { Value: news.enableResourceNameDnsAAAARecordOnLaunch }
+                    : undefined,
+              });
+              yield* session.note("Updated private DNS hostname settings");
+            }
+          }
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (subnet.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [subnetId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [subnetId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state.
+          const finalLookup = yield* ec2.describeSubnets({
+            SubnetIds: [subnetId],
+          });
+          const final = finalLookup.Subnets?.[0];
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(`Subnet ${subnetId} disappeared during reconcile`),
+            );
+          }
+          return {
+            subnetId,
+            subnetArn: final.SubnetArn! as SubnetArn,
+            cidrBlock: final.CidrBlock!,
+            vpcId: news.vpcId,
+            availabilityZone: final.AvailabilityZone!,
+            availabilityZoneId: final.AvailabilityZoneId,
+            state: final.State!,
+            availableIpAddressCount: final.AvailableIpAddressCount ?? 0,
+            mapPublicIpOnLaunch: final.MapPublicIpOnLaunch ?? false,
+            assignIpv6AddressOnCreation:
+              final.AssignIpv6AddressOnCreation ?? false,
+            defaultForAz: final.DefaultForAz ?? false,
+            ownerId: final.OwnerId,
+            ipv6CidrBlockAssociationSet: final.Ipv6CidrBlockAssociationSet?.map(
+              (assoc) => ({
+                associationId: assoc.AssociationId!,
+                ipv6CidrBlock: assoc.Ipv6CidrBlock!,
+                ipv6CidrBlockState: {
+                  state: assoc.Ipv6CidrBlockState!.State!,
+                  statusMessage: assoc.Ipv6CidrBlockState!.StatusMessage,
+                },
+              }),
+            ),
+            enableDns64: final.EnableDns64,
+            ipv6Native: final.Ipv6Native,
+            privateDnsNameOptionsOnLaunch: final.PrivateDnsNameOptionsOnLaunch
+              ? {
+                  hostnameType:
+                    final.PrivateDnsNameOptionsOnLaunch.HostnameType,
+                  enableResourceNameDnsARecord:
+                    final.PrivateDnsNameOptionsOnLaunch
+                      .EnableResourceNameDnsARecord,
+                  enableResourceNameDnsAAAARecord:
+                    final.PrivateDnsNameOptionsOnLaunch
+                      .EnableResourceNameDnsAAAARecord,
+                }
+              : undefined,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const subnetId = output.subnetId;
+
+          yield* session.note(`Deleting subnet: ${subnetId}`);
+
+          // 1. Attempt to delete subnet
+          yield* ec2
+            .deleteSubnet({
+              SubnetId: subnetId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.catchTag("InvalidSubnetID.NotFound", () => Effect.void),
+              // Retry on dependency violations (resources still being deleted)
+              Effect.retry({
+                while: (e) => {
+                  // DependencyViolation means there are still dependent resources
+                  // This can happen if ENIs/instances are being deleted concurrently
+                  return e._tag === "DependencyViolation";
+                },
+                schedule: Schedule.exponential(1000, 1.5).pipe(
+                  Schedule.both(Schedule.recurs(10)), // Try up to 10 times
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+            );
+
+          // 2. Wait for subnet to be fully deleted
+          yield* waitForSubnetDeleted(subnetId, session);
+
+          yield* session.note(`Subnet ${subnetId} deleted successfully`);
+        }),
+      };
+    }),
+  );
+
+// Retryable error: Subnet is still pending
+class SubnetPending extends Data.TaggedError("SubnetPending")<{
+  subnetId: string;
+  state: string;
+}> {}
+
+// Retryable error: Subnet still exists during deletion
+class SubnetStillExists extends Data.TaggedError("SubnetStillExists")<{
+  subnetId: string;
+}> {}
+
+/**
+ * Wait for subnet to be in available state
+ */
+const waitForSubnetAvailable = (
+  subnetId: string,
+  session?: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2.describeSubnets({ SubnetIds: [subnetId] });
+    const subnet = result.Subnets?.[0];
+
+    if (!subnet) {
+      return yield* Effect.fail(new Error(`Subnet ${subnetId} not found`));
+    }
+
+    if (subnet.State === "available") {
+      return subnet;
+    }
+
+    // Still pending - this is the only retryable case
+    return yield* new SubnetPending({ subnetId, state: subnet.State! });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e instanceof SubnetPending,
+      schedule: Schedule.fixed(2000).pipe(
+        Schedule.both(Schedule.recurs(30)), // Max 60 seconds
+        Schedule.tapOutput(([, attempt]) =>
+          session
+            ? session.note(
+                `Waiting for subnet to be available... (${(attempt + 1) * 2}s)`,
+              )
+            : Effect.void,
+        ),
+      ),
+    }),
+  );
+
+/**
+ * Wait for subnet to be deleted
+ */
+const waitForSubnetDeleted = (
+  subnetId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeSubnets({ SubnetIds: [subnetId] })
+      .pipe(
+        Effect.catchTag("InvalidSubnetID.NotFound", () =>
+          Effect.succeed({ Subnets: [] }),
+        ),
+      );
+
+    if (!result.Subnets || result.Subnets.length === 0) {
+      return; // Successfully deleted
+    }
+
+    // Still exists - this is the only retryable case
+    return yield* new SubnetStillExists({ subnetId });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e instanceof SubnetStillExists,
+      schedule: Schedule.fixed(2000).pipe(
+        Schedule.both(Schedule.recurs(15)), // Max 30 seconds
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for subnet deletion... (${(attempt + 1) * 2}s)`,
+          ),
+        ),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Vpc.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Vpc.ts
new file mode 100644
index 00000000000..d81d1eee15d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/Vpc.ts
@@ -0,0 +1,479 @@
+import * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved, somePropsAreDifferent } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type VpcId = `vpc-${string}`;
+export const VpcId = <const S extends string>(value: S): S & VpcId =>
+  value as S & VpcId;
+
+export type VpcArn = `arn:aws:ec2:${RegionID}:${AccountID}:vpc/${VpcId}`;
+
+export interface VpcProps {
+  /**
+   * The IPv4 network range for the VPC, in CIDR notation.
+   * Required unless using IPAM.
+   * @example "10.0.0.0/16"
+   */
+  cidrBlock?: string;
+
+  /**
+   * The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR.
+   */
+  ipv4IpamPoolId?: string;
+
+  /**
+   * The netmask length of the IPv4 CIDR you want to allocate to this VPC from an IPAM pool.
+   */
+  ipv4NetmaskLength?: number;
+
+  /**
+   * The ID of an IPv6 IPAM pool which will be used to allocate this VPC an IPv6 CIDR.
+   */
+  ipv6IpamPoolId?: string;
+
+  /**
+   * The netmask length of the IPv6 CIDR you want to allocate to this VPC from an IPAM pool.
+   */
+  ipv6NetmaskLength?: number;
+
+  /**
+   * Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC.
+   */
+  ipv6CidrBlock?: string;
+
+  /**
+   * The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block.
+   */
+  ipv6Pool?: string;
+
+  /**
+   * The Availability Zone or Local Zone Group name for the IPv6 CIDR block.
+   */
+  ipv6CidrBlockNetworkBorderGroup?: string;
+
+  /**
+   * The tenancy options for instances launched into the VPC.
+   * @default "default"
+   */
+  instanceTenancy?: EC2.Tenancy;
+
+  /**
+   * Whether DNS resolution is supported for the VPC.
+   * @default true
+   */
+  enableDnsSupport?: boolean;
+
+  /**
+   * Whether instances launched in the VPC get DNS hostnames.
+   * @default true
+   */
+  enableDnsHostnames?: boolean;
+
+  /**
+   * Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC.
+   */
+  amazonProvidedIpv6CidrBlock?: boolean;
+
+  /**
+   * Tags to assign to the VPC.
+   * These will be merged with alchemy auto-tags (alchemy::stack, alchemy::stage, alchemy::id).
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Vpc extends Resource<
+  "AWS.EC2.VPC",
+  VpcProps,
+  {
+    /**
+     * The ID of the VPC.
+     */
+    vpcId: VpcId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the VPC.
+     */
+    vpcArn: VpcArn;
+
+    /**
+     * The primary IPv4 CIDR block for the VPC.
+     */
+    cidrBlock: string;
+
+    /**
+     * The ID of the set of DHCP options associated with the VPC.
+     */
+    dhcpOptionsId: string;
+
+    /**
+     * The current state of the VPC.
+     */
+    state: EC2.VpcState;
+
+    /**
+     * Whether the VPC is the default VPC.
+     */
+    isDefault: boolean;
+
+    /**
+     * The ID of the AWS account that owns the VPC.
+     */
+    ownerId?: string;
+
+    /**
+     * Information about the IPv4 CIDR blocks associated with the VPC.
+     */
+    cidrBlockAssociationSet?: Array<{
+      associationId: string;
+      cidrBlock: string;
+      cidrBlockState: {
+        state: EC2.VpcCidrBlockStateCode;
+        statusMessage?: string;
+      };
+    }>;
+
+    /**
+     * Information about the IPv6 CIDR blocks associated with the VPC.
+     */
+    ipv6CidrBlockAssociationSet?: Array<{
+      associationId: string;
+      ipv6CidrBlock: string;
+      ipv6CidrBlockState: {
+        state: EC2.VpcCidrBlockStateCode;
+        statusMessage?: string;
+      };
+      networkBorderGroup?: string;
+      ipv6Pool?: string;
+    }>;
+
+    tags?: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+export const Vpc = Resource<Vpc>("AWS.EC2.VPC");
+
+export const VpcProvider = () =>
+  Provider.effect(
+    Vpc,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      return {
+        stables: ["vpcId", "vpcArn", "ownerId", "isDefault"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          if (
+            somePropsAreDifferent(olds, news, [
+              "cidrBlock",
+              "instanceTenancy",
+              "ipv4IpamPoolId",
+              "ipv6IpamPoolId",
+              "ipv6CidrBlock",
+            ])
+          ) {
+            return { action: "replace" };
+          }
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the VPC if we already have its id, else describe
+          // returns empty and we fall through to create. We don't trust
+          // `output.vpcId` blindly: a VPC deleted out of band shows up as
+          // missing and we recreate.
+          let vpc: EC2.Vpc | undefined;
+
+          if (output?.vpcId) {
+            const lookup = yield* ec2
+              .describeVpcs({ VpcIds: [output.vpcId] })
+              .pipe(
+                Effect.catchTag("InvalidVpcID.NotFound", () =>
+                  Effect.succeed({ Vpcs: [] }),
+                ),
+              );
+            vpc = lookup.Vpcs?.[0];
+          }
+
+          if (vpc === undefined) {
+            const createResult = yield* ec2.createVpc({
+              // TODO(sam): add all properties
+              AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
+              InstanceTenancy: news.instanceTenancy,
+              CidrBlock: news.cidrBlock,
+              Ipv4IpamPoolId: news.ipv4IpamPoolId,
+              Ipv4NetmaskLength: news.ipv4NetmaskLength,
+              Ipv6Pool: news.ipv6Pool,
+              Ipv6CidrBlock: news.ipv6CidrBlock,
+              Ipv6IpamPoolId: news.ipv6IpamPoolId,
+              Ipv6NetmaskLength: news.ipv6NetmaskLength,
+              Ipv6CidrBlockNetworkBorderGroup:
+                news.ipv6CidrBlockNetworkBorderGroup,
+              TagSpecifications: [
+                {
+                  ResourceType: "vpc",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newVpcId = createResult.Vpc!.VpcId! as VpcId;
+            yield* session.note(`VPC created: ${newVpcId}`);
+            vpc = yield* waitForVpcAvailable(newVpcId, session);
+          }
+
+          const vpcId = vpc.VpcId! as VpcId;
+
+          // Sync DNS attributes — observed cloud state vs desired. The default
+          // values DNS support/hostnames default to differ across new vs
+          // existing VPCs, so we always read first and only modify on a real
+          // delta to avoid pointless API calls.
+          const desiredDnsSupport = news.enableDnsSupport ?? true;
+          const desiredDnsHostnames = news.enableDnsHostnames ?? false;
+
+          const dnsSupportResult = yield* ec2.describeVpcAttribute({
+            VpcId: vpcId,
+            Attribute: "enableDnsSupport",
+          });
+          const currentDnsSupport =
+            dnsSupportResult.EnableDnsSupport?.Value ?? true;
+          if (currentDnsSupport !== desiredDnsSupport) {
+            yield* ec2.modifyVpcAttribute({
+              VpcId: vpcId,
+              EnableDnsSupport: { Value: desiredDnsSupport },
+            });
+            yield* session.note(`Updated DNS support: ${desiredDnsSupport}`);
+          }
+
+          const dnsHostnamesResult = yield* ec2.describeVpcAttribute({
+            VpcId: vpcId,
+            Attribute: "enableDnsHostnames",
+          });
+          const currentDnsHostnames =
+            dnsHostnamesResult.EnableDnsHostnames?.Value ?? false;
+          if (currentDnsHostnames !== desiredDnsHostnames) {
+            yield* ec2.modifyVpcAttribute({
+              VpcId: vpcId,
+              EnableDnsHostnames: { Value: desiredDnsHostnames },
+            });
+            yield* session.note(
+              `Updated DNS hostnames: ${desiredDnsHostnames}`,
+            );
+          }
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (vpc.Tags ?? []).map((tag: EC2.Tag) => [tag.Key!, tag.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [vpcId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [vpcId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state so the returned attributes reflect what's
+          // actually in the cloud after all sync steps.
+          const final = yield* ec2.describeVpcs({ VpcIds: [vpcId] });
+          const finalVpc = final.Vpcs?.[0];
+          if (!finalVpc) {
+            return yield* Effect.fail(
+              new Error(`VPC ${vpcId} disappeared during reconcile`),
+            );
+          }
+
+          return {
+            vpcId,
+            vpcArn: `arn:aws:ec2:${region}:${accountId}:vpc/${vpcId}` as VpcArn,
+            cidrBlock: finalVpc.CidrBlock!,
+            dhcpOptionsId: finalVpc.DhcpOptionsId!,
+            state: finalVpc.State!,
+            isDefault: finalVpc.IsDefault ?? false,
+            ownerId: finalVpc.OwnerId,
+            cidrBlockAssociationSet: finalVpc.CidrBlockAssociationSet?.map(
+              (assoc) => ({
+                associationId: assoc.AssociationId!,
+                cidrBlock: assoc.CidrBlock!,
+                cidrBlockState: {
+                  state: assoc.CidrBlockState!.State!,
+                  statusMessage: assoc.CidrBlockState!.StatusMessage,
+                },
+              }),
+            ),
+            ipv6CidrBlockAssociationSet:
+              finalVpc.Ipv6CidrBlockAssociationSet?.map((assoc) => ({
+                associationId: assoc.AssociationId!,
+                ipv6CidrBlock: assoc.Ipv6CidrBlock!,
+                ipv6CidrBlockState: {
+                  state: assoc.Ipv6CidrBlockState!.State!,
+                  statusMessage: assoc.Ipv6CidrBlockState!.StatusMessage,
+                },
+                networkBorderGroup: assoc.NetworkBorderGroup,
+                ipv6Pool: assoc.Ipv6Pool,
+              })),
+            tags: desiredTags,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const vpcId = output.vpcId;
+
+          yield* session.note(`Deleting VPC: ${vpcId}`);
+
+          // 1. Attempt to delete VPC
+          yield* ec2
+            .deleteVpc({
+              VpcId: vpcId,
+              DryRun: false,
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.catchTag("InvalidVpcID.NotFound", () => Effect.void),
+              // Retry on dependency violations (resources still being deleted)
+              Effect.retry({
+                while: (e) => {
+                  // DependencyViolation means there are still dependent resources
+                  // This can happen if subnets/IGW are being deleted concurrently
+                  return (
+                    e._tag === "DependencyViolation" ||
+                    (e._tag === "ValidationError" &&
+                      e.message?.includes("DependencyViolation"))
+                  );
+                },
+                // Use fixed 5s delay instead of exponential to avoid very long waits
+                schedule: Schedule.fixed(5000).pipe(
+                  Schedule.both(Schedule.recurs(60)), // Up to 5 minutes total
+                  Schedule.tapOutput(([, attempt]) =>
+                    session.note(
+                      `Waiting for dependencies to clear... (attempt ${attempt + 1})`,
+                    ),
+                  ),
+                ),
+              }),
+              // Log the actual error for debugging
+              Effect.tapError((e) =>
+                session.note(`VPC delete failed: ${e._tag} - ${e.message}`),
+              ),
+            );
+
+          // 2. Wait for VPC to be fully deleted
+          yield* waitForVpcDeleted(vpcId, session);
+
+          yield* session.note(`VPC ${vpcId} deleted successfully`);
+        }),
+      };
+    }),
+  );
+
+// Retryable error: VPC is still pending
+class VpcPending extends Data.TaggedError("VpcPending")<{
+  vpcId: string;
+  state: string;
+}> {}
+
+// Retryable error: VPC still exists during deletion
+class VpcStillExists extends Data.TaggedError("VpcStillExists")<{
+  vpcId: string;
+}> {}
+
+/**
+ * Wait for VPC to be in available state
+ */
+const waitForVpcAvailable = (
+  vpcId: string,
+  session?: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2.describeVpcs({ VpcIds: [vpcId] });
+    const vpc = result.Vpcs?.[0];
+
+    if (!vpc) {
+      return yield* Effect.fail(new Error(`VPC ${vpcId} not found`));
+    }
+
+    if (vpc.State === "available") {
+      return vpc;
+    }
+
+    // Still pending - this is the only retryable case
+    return yield* new VpcPending({ vpcId, state: vpc.State! });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e instanceof VpcPending,
+      schedule: Schedule.fixed(2000).pipe(
+        Schedule.both(Schedule.recurs(30)), // Max 60 seconds
+        Schedule.tapOutput(([, attempt]) =>
+          session
+            ? session.note(
+                `Waiting for VPC to be available... (${(attempt + 1) * 2}s)`,
+              )
+            : Effect.void,
+        ),
+      ),
+    }),
+  );
+
+/**
+ * Wait for VPC to be deleted
+ */
+const waitForVpcDeleted = (vpcId: string, session: ScopedPlanStatusSession) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeVpcs({ VpcIds: [vpcId] })
+      .pipe(
+        Effect.catchTag("InvalidVpcID.NotFound", () =>
+          Effect.succeed({ Vpcs: [] }),
+        ),
+      );
+
+    if (!result.Vpcs || result.Vpcs.length === 0) {
+      return; // Successfully deleted
+    }
+
+    // Still exists - this is the only retryable case
+    return yield* new VpcStillExists({ vpcId });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e instanceof VpcStillExists,
+      schedule: Schedule.fixed(2000).pipe(
+        Schedule.both(Schedule.recurs(15)), // Max 30 seconds
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(`Waiting for VPC deletion... (${(attempt + 1) * 2}s)`),
+        ),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/VpcEndpoint.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/VpcEndpoint.ts
new file mode 100644
index 00000000000..73a059681e5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/VpcEndpoint.ts
@@ -0,0 +1,657 @@
+import type * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+import type { RouteTableId } from "./RouteTable.ts";
+import type { SecurityGroupId } from "./SecurityGroup.ts";
+import type { SubnetId } from "./Subnet.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type VpcEndpointId<ID extends string = string> = `vpce-${ID}`;
+export const VpcEndpointId = <ID extends string>(
+  id: ID,
+): ID & VpcEndpointId<ID> => `vpce-${id}` as ID & VpcEndpointId<ID>;
+
+export type VpcEndpointArn =
+  `arn:aws:ec2:${RegionID}:${AccountID}:vpc-endpoint/${VpcEndpointId}`;
+
+export interface VpcEndpointProps {
+  /**
+   * The VPC to create the endpoint in.
+   */
+  vpcId: VpcId;
+
+  /**
+   * The service name.
+   * For AWS services, use the format: com.amazonaws.<region>.<service>
+   * @example "com.amazonaws.us-east-1.s3"
+   */
+  serviceName: string;
+
+  /**
+   * The type of endpoint.
+   * - Gateway: For S3 and DynamoDB (route table based)
+   * - Interface: For most other AWS services (ENI based)
+   * - GatewayLoadBalancer: For Gateway Load Balancer endpoints
+   * @default "Gateway"
+   */
+  vpcEndpointType?: EC2.VpcEndpointType;
+
+  /**
+   * The IDs of route tables for a Gateway endpoint.
+   * Required for Gateway endpoints.
+   */
+  routeTableIds?: RouteTableId[];
+
+  /**
+   * The IDs of subnets for an Interface endpoint.
+   * Required for Interface endpoints.
+   */
+  subnetIds?: SubnetId[];
+
+  /**
+   * The IDs of security groups for an Interface endpoint.
+   * Required for Interface endpoints.
+   */
+  securityGroupIds?: SecurityGroupId[];
+
+  /**
+   * Whether to associate a private hosted zone with the VPC.
+   * Only applicable for Interface endpoints.
+   * @default true
+   */
+  privateDnsEnabled?: boolean;
+
+  /**
+   * A policy to attach to the endpoint that controls access to the service.
+   * The policy document must be in JSON format.
+   */
+  policyDocument?: string;
+
+  /**
+   * The IP address type for the endpoint.
+   */
+  ipAddressType?: EC2.IpAddressType;
+
+  /**
+   * The DNS options for the endpoint.
+   */
+  dnsOptions?: {
+    dnsRecordIpType?: EC2.DnsRecordIpType;
+    privateDnsOnlyForInboundResolverEndpoint?: boolean;
+  };
+
+  /**
+   * Tags to assign to the VPC endpoint.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface VpcEndpoint extends Resource<
+  "AWS.EC2.VpcEndpoint",
+  VpcEndpointProps,
+  {
+    /**
+     * The ID of the VPC endpoint.
+     */
+    vpcEndpointId: VpcEndpointId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the VPC endpoint.
+     */
+    vpcEndpointArn: VpcEndpointArn;
+
+    /**
+     * The type of endpoint.
+     */
+    vpcEndpointType: EC2.VpcEndpointType;
+
+    /**
+     * The ID of the VPC.
+     */
+    vpcId: VpcId;
+
+    /**
+     * The service name.
+     */
+    serviceName: string;
+
+    /**
+     * The current state of the VPC endpoint.
+     */
+    state: EC2.State;
+
+    /**
+     * The policy document associated with the endpoint.
+     */
+    policyDocument?: string;
+
+    /**
+     * The IDs of the route tables associated with the endpoint.
+     */
+    routeTableIds?: string[];
+
+    /**
+     * The IDs of the subnets associated with the endpoint.
+     */
+    subnetIds?: string[];
+
+    /**
+     * Information about the security groups associated with the network interfaces.
+     */
+    groups?: Array<{
+      groupId: string;
+      groupName: string;
+    }>;
+
+    /**
+     * Whether private DNS is enabled.
+     */
+    privateDnsEnabled?: boolean;
+
+    /**
+     * Whether the VPC endpoint is being managed by its service.
+     */
+    requesterManaged?: boolean;
+
+    /**
+     * The IDs of the network interfaces for the endpoint.
+     */
+    networkInterfaceIds?: string[];
+
+    /**
+     * The DNS entries for the endpoint.
+     */
+    dnsEntries?: Array<{
+      dnsName?: string;
+      hostedZoneId?: string;
+    }>;
+
+    /**
+     * The date and time the VPC endpoint was created.
+     */
+    creationTimestamp?: string;
+
+    /**
+     * The ID of the AWS account that owns the VPC endpoint.
+     */
+    ownerId?: string;
+
+    /**
+     * The IP address type for the endpoint.
+     */
+    ipAddressType?: EC2.IpAddressType;
+
+    /**
+     * The DNS options for the endpoint.
+     */
+    dnsOptions?: {
+      dnsRecordIpType?: EC2.DnsRecordIpType;
+      privateDnsOnlyForInboundResolverEndpoint?: boolean;
+    };
+
+    /**
+     * The last error that occurred for VPC endpoint.
+     */
+    lastError?: {
+      code?: string;
+      message?: string;
+    };
+  },
+  never,
+  Providers
+> {}
+export const VpcEndpoint = Resource<VpcEndpoint>("AWS.EC2.VpcEndpoint");
+
+export const VpcEndpointProvider = () =>
+  Provider.effect(
+    VpcEndpoint,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const describeVpcEndpoint = (vpcEndpointId: string) =>
+        ec2.describeVpcEndpoints({ VpcEndpointIds: [vpcEndpointId] }).pipe(
+          Effect.map((r) => r.VpcEndpoints?.[0]),
+          Effect.flatMap((ep) =>
+            ep
+              ? Effect.succeed(ep)
+              : Effect.fail(
+                  new Error(`VPC Endpoint ${vpcEndpointId} not found`),
+                ),
+          ),
+        );
+
+      const toAttrs = (ep: ec2.VpcEndpoint): VpcEndpoint["Attributes"] => ({
+        vpcEndpointId: ep.VpcEndpointId as VpcEndpointId,
+        vpcEndpointArn:
+          `arn:aws:ec2:${region}:${accountId}:vpc-endpoint/${ep.VpcEndpointId}` as VpcEndpointArn,
+        vpcEndpointType: ep.VpcEndpointType!,
+        vpcId: ep.VpcId as VpcId,
+        serviceName: ep.ServiceName!,
+        state: ep.State!,
+        policyDocument: ep.PolicyDocument,
+        routeTableIds: ep.RouteTableIds,
+        subnetIds: ep.SubnetIds,
+        groups: ep.Groups?.map((g) => ({
+          groupId: g.GroupId!,
+          groupName: g.GroupName!,
+        })),
+        privateDnsEnabled: ep.PrivateDnsEnabled,
+        requesterManaged: ep.RequesterManaged,
+        networkInterfaceIds: ep.NetworkInterfaceIds,
+        dnsEntries: ep.DnsEntries?.map((d) => ({
+          dnsName: d.DnsName,
+          hostedZoneId: d.HostedZoneId,
+        })),
+        creationTimestamp:
+          ep.CreationTimestamp instanceof Date
+            ? ep.CreationTimestamp.toISOString()
+            : (ep.CreationTimestamp as string | undefined),
+        ownerId: ep.OwnerId,
+        ipAddressType: ep.IpAddressType,
+        dnsOptions: ep.DnsOptions
+          ? {
+              dnsRecordIpType: ep.DnsOptions.DnsRecordIpType,
+              privateDnsOnlyForInboundResolverEndpoint:
+                ep.DnsOptions.PrivateDnsOnlyForInboundResolverEndpoint,
+            }
+          : undefined,
+        lastError: ep.LastError
+          ? {
+              code: ep.LastError.Code,
+              message: ep.LastError.Message,
+            }
+          : undefined,
+      });
+
+      return {
+        stables: ["vpcEndpointId", "vpcEndpointArn", "ownerId"],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const ep = yield* describeVpcEndpoint(output.vpcEndpointId);
+          return toAttrs(ep);
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // Core properties require replacement
+          if (
+            news.vpcId !== olds.vpcId ||
+            news.serviceName !== olds.serviceName ||
+            news.vpcEndpointType !== olds.vpcEndpointType
+          ) {
+            return { action: "replace" };
+          }
+          // Other properties can be updated in-place
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the VPC endpoint via cached id, else fall through
+          // to create.
+          let ep: ec2.VpcEndpoint | undefined;
+          if (output?.vpcEndpointId) {
+            const lookup = yield* ec2
+              .describeVpcEndpoints({
+                VpcEndpointIds: [output.vpcEndpointId],
+              })
+              .pipe(
+                Effect.catchTag("InvalidVpcEndpointId.NotFound", () =>
+                  Effect.succeed({ VpcEndpoints: [] }),
+                ),
+              );
+            ep = lookup.VpcEndpoints?.[0];
+            if (ep && (ep.State === "deleted" || ep.State === "deleting")) {
+              ep = undefined;
+            }
+          }
+
+          // Ensure — create the endpoint when missing.
+          if (ep === undefined) {
+            yield* session.note(
+              `Creating VPC Endpoint for ${news.serviceName}...`,
+            );
+            const result = yield* ec2.createVpcEndpoint({
+              VpcId: news.vpcId as string,
+              ServiceName: news.serviceName,
+              VpcEndpointType: news.vpcEndpointType ?? "Gateway",
+              RouteTableIds: news.routeTableIds as string[] | undefined,
+              SubnetIds: news.subnetIds as string[] | undefined,
+              SecurityGroupIds: news.securityGroupIds as string[] | undefined,
+              PrivateDnsEnabled: news.privateDnsEnabled,
+              PolicyDocument: news.policyDocument,
+              IpAddressType: news.ipAddressType,
+              DnsOptions: news.dnsOptions
+                ? {
+                    DnsRecordIpType: news.dnsOptions.dnsRecordIpType,
+                    PrivateDnsOnlyForInboundResolverEndpoint:
+                      news.dnsOptions.privateDnsOnlyForInboundResolverEndpoint,
+                  }
+                : undefined,
+              TagSpecifications: [
+                {
+                  ResourceType: "vpc-endpoint",
+                  Tags: createTagsList(desiredTags),
+                },
+              ],
+              DryRun: false,
+            });
+            const newEpId = result.VpcEndpoint!.VpcEndpointId!;
+            yield* session.note(`VPC Endpoint created: ${newEpId}`);
+            if (
+              news.vpcEndpointType === "Interface" ||
+              news.vpcEndpointType === "GatewayLoadBalancer"
+            ) {
+              yield* waitForVpcEndpointAvailable(newEpId, session);
+            }
+            ep = yield* describeVpcEndpoint(newEpId);
+          }
+
+          const vpcEndpointId = ep.VpcEndpointId!;
+          const observedType = ep.VpcEndpointType ?? news.vpcEndpointType;
+
+          // Sync mutable configuration — diff observed cloud state against
+          // desired, then issue a single modifyVpcEndpoint call carrying only
+          // the deltas.
+          const modifications: Parameters<typeof ec2.modifyVpcEndpoint>[0] = {
+            VpcEndpointId: vpcEndpointId,
+            DryRun: false,
+          };
+          let hasModifications = false;
+
+          if (observedType === "Gateway") {
+            const observedRtIds = new Set(ep.RouteTableIds ?? []);
+            const desiredRtIds = new Set(
+              (news.routeTableIds as string[] | undefined) ?? [],
+            );
+            const addRouteTableIds = [...desiredRtIds].filter(
+              (rt) => !observedRtIds.has(rt),
+            );
+            const removeRouteTableIds = [...observedRtIds].filter(
+              (rt) => !desiredRtIds.has(rt),
+            );
+            if (addRouteTableIds.length > 0) {
+              modifications.AddRouteTableIds = addRouteTableIds;
+              hasModifications = true;
+            }
+            if (removeRouteTableIds.length > 0) {
+              modifications.RemoveRouteTableIds = removeRouteTableIds;
+              hasModifications = true;
+            }
+          }
+
+          if (
+            observedType === "Interface" ||
+            observedType === "GatewayLoadBalancer"
+          ) {
+            const observedSubnetIds = new Set(ep.SubnetIds ?? []);
+            const desiredSubnetIds = new Set(
+              (news.subnetIds as string[] | undefined) ?? [],
+            );
+            const addSubnetIds = [...desiredSubnetIds].filter(
+              (s) => !observedSubnetIds.has(s),
+            );
+            const removeSubnetIds = [...observedSubnetIds].filter(
+              (s) => !desiredSubnetIds.has(s),
+            );
+            if (addSubnetIds.length > 0) {
+              modifications.AddSubnetIds = addSubnetIds;
+              hasModifications = true;
+            }
+            if (removeSubnetIds.length > 0) {
+              modifications.RemoveSubnetIds = removeSubnetIds;
+              hasModifications = true;
+            }
+
+            const observedSgIds = new Set(
+              (ep.Groups ?? [])
+                .map((g) => g.GroupId)
+                .filter((g): g is string => Boolean(g)),
+            );
+            const desiredSgIds = new Set(
+              (news.securityGroupIds as string[] | undefined) ?? [],
+            );
+            const addSecurityGroupIds = [...desiredSgIds].filter(
+              (g) => !observedSgIds.has(g),
+            );
+            const removeSecurityGroupIds = [...observedSgIds].filter(
+              (g) => !desiredSgIds.has(g),
+            );
+            if (addSecurityGroupIds.length > 0) {
+              modifications.AddSecurityGroupIds = addSecurityGroupIds;
+              hasModifications = true;
+            }
+            if (removeSecurityGroupIds.length > 0) {
+              modifications.RemoveSecurityGroupIds = removeSecurityGroupIds;
+              hasModifications = true;
+            }
+
+            if (ep.PrivateDnsEnabled !== news.privateDnsEnabled) {
+              modifications.PrivateDnsEnabled = news.privateDnsEnabled;
+              hasModifications = true;
+            }
+          }
+
+          if ((ep.PolicyDocument ?? undefined) !== news.policyDocument) {
+            modifications.PolicyDocument = news.policyDocument ?? "";
+            modifications.ResetPolicy = !news.policyDocument;
+            hasModifications = true;
+          }
+
+          if (ep.IpAddressType !== news.ipAddressType) {
+            modifications.IpAddressType = news.ipAddressType;
+            hasModifications = true;
+          }
+
+          const observedDnsRecordIpType = ep.DnsOptions?.DnsRecordIpType;
+          const observedPrivateDnsOnly =
+            ep.DnsOptions?.PrivateDnsOnlyForInboundResolverEndpoint;
+          if (
+            observedDnsRecordIpType !== news.dnsOptions?.dnsRecordIpType ||
+            observedPrivateDnsOnly !==
+              news.dnsOptions?.privateDnsOnlyForInboundResolverEndpoint
+          ) {
+            modifications.DnsOptions = news.dnsOptions
+              ? {
+                  DnsRecordIpType: news.dnsOptions.dnsRecordIpType,
+                  PrivateDnsOnlyForInboundResolverEndpoint:
+                    news.dnsOptions.privateDnsOnlyForInboundResolverEndpoint,
+                }
+              : undefined;
+            hasModifications = true;
+          }
+
+          if (hasModifications) {
+            yield* ec2.modifyVpcEndpoint(modifications);
+            yield* session.note("Updated VPC Endpoint configuration");
+            if (
+              observedType === "Interface" ||
+              observedType === "GatewayLoadBalancer"
+            ) {
+              yield* waitForVpcEndpointAvailable(vpcEndpointId, session);
+            }
+          }
+
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (ep.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [vpcEndpointId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [vpcEndpointId],
+              Tags: upsert,
+              DryRun: false,
+            });
+          }
+
+          // Re-read final state.
+          const final = yield* describeVpcEndpoint(vpcEndpointId);
+          return toAttrs(final);
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const vpcEndpointId = output.vpcEndpointId;
+
+          yield* session.note(`Deleting VPC Endpoint: ${vpcEndpointId}`);
+
+          yield* ec2
+            .deleteVpcEndpoints({
+              VpcEndpointIds: [vpcEndpointId],
+              DryRun: false,
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidVpcEndpointId.NotFound",
+                () => Effect.void,
+              ),
+            );
+
+          // Wait for deletion
+          yield* waitForVpcEndpointDeleted(vpcEndpointId, session);
+
+          yield* session.note(`VPC Endpoint ${vpcEndpointId} deleted`);
+        }),
+      };
+    }),
+  );
+
+// Retryable error: VPC Endpoint is still pending
+class VpcEndpointPending extends Data.TaggedError("VpcEndpointPending")<{
+  vpcEndpointId: string;
+  state: string;
+}> {}
+
+// Terminal error: VPC Endpoint creation failed
+class VpcEndpointFailed extends Data.TaggedError("VpcEndpointFailed")<{
+  vpcEndpointId: string;
+  errorCode?: string;
+  errorMessage?: string;
+}> {}
+
+// Terminal error: VPC Endpoint not found
+class VpcEndpointNotFound extends Data.TaggedError("VpcEndpointNotFound")<{
+  vpcEndpointId: string;
+}> {}
+
+// Retryable error: VPC Endpoint is still deleting
+class VpcEndpointDeleting extends Data.TaggedError("VpcEndpointDeleting")<{
+  vpcEndpointId: string;
+  state: string;
+}> {}
+
+/**
+ * Wait for VPC Endpoint to be in available state
+ */
+const waitForVpcEndpointAvailable = (
+  vpcEndpointId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2.describeVpcEndpoints({
+      VpcEndpointIds: [vpcEndpointId],
+    });
+    const ep = result.VpcEndpoints?.[0];
+
+    if (!ep) {
+      return yield* new VpcEndpointNotFound({ vpcEndpointId });
+    }
+
+    if (ep.State === "available") {
+      return ep;
+    }
+
+    if (ep.State === "failed" || ep.State === "rejected") {
+      return yield* new VpcEndpointFailed({
+        vpcEndpointId,
+        errorCode: ep.LastError?.Code,
+        errorMessage: ep.LastError?.Message,
+      });
+    }
+
+    // Still pending - this is the only retryable case
+    return yield* new VpcEndpointPending({ vpcEndpointId, state: ep.State! });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "VpcEndpointPending",
+      schedule: Schedule.fixed(3000).pipe(
+        Schedule.both(Schedule.recurs(60)), // Max 3 minutes
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for VPC Endpoint to be available... (${(attempt + 1) * 3}s)`,
+          ),
+        ),
+      ),
+    }),
+  );
+
+/**
+ * Wait for VPC Endpoint to be deleted
+ */
+const waitForVpcEndpointDeleted = (
+  vpcEndpointId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeVpcEndpoints({ VpcEndpointIds: [vpcEndpointId] })
+      .pipe(
+        Effect.catchTag("InvalidVpcEndpointId.NotFound", () =>
+          Effect.succeed({ VpcEndpoints: [] }),
+        ),
+      );
+
+    const ep = result.VpcEndpoints?.[0];
+
+    if (!ep || ep.State === "deleted") {
+      return; // Successfully deleted
+    }
+
+    // Still deleting - this is the only retryable case
+    return yield* new VpcEndpointDeleting({ vpcEndpointId, state: ep.State! });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "VpcEndpointDeleting",
+      schedule: Schedule.fixed(3000).pipe(
+        Schedule.both(Schedule.recurs(60)), // Max 3 minutes
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for VPC Endpoint deletion... (${(attempt + 1) * 3}s)`,
+          ),
+        ),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/hosted.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/hosted.ts
new file mode 100644
index 00000000000..24eadf76155
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/hosted.ts
@@ -0,0 +1,889 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import type * as rolldown from "rolldown";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import * as Output from "../../Output.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import type { PlatformProps } from "../../Platform.ts";
+import type { ResourceBinding } from "../../Resource.ts";
+import type { ProcessContext } from "../../Server/Process.ts";
+import { createInternalTags, createTagsList, hasTags } from "../../Tags.ts";
+import { sha256 } from "../../Util/sha256.ts";
+import { zipCode } from "../../Util/zip.ts";
+import { Assets } from "../Assets.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+
+export interface Ec2HostedBinding {
+  env?: Record<string, any>;
+  policyStatements?: PolicyStatement[];
+}
+
+export interface Ec2HostedProps extends PlatformProps {
+  imageId: string;
+  instanceType: string;
+  keyName?: string;
+  instanceProfileName?: string;
+  userData?: string;
+  subnetId?: any;
+  securityGroupIds?: readonly any[];
+  associatePublicIpAddress?: boolean;
+  privateIpAddress?: string;
+  availabilityZone?: string;
+  tags?: Record<string, string>;
+  main?: string;
+  handler?: string;
+  port?: number;
+  env?: Record<string, any>;
+  build?: {
+    input?: Partial<rolldown.InputOptions>;
+    output?: Partial<rolldown.OutputOptions>;
+  };
+  roleManagedPolicyArns?: string[];
+}
+
+export interface Ec2HostedRuntimeState {
+  userData?: string;
+  roleName?: string;
+  roleArn?: string;
+  policyName?: string;
+  instanceProfileName?: string;
+  instanceProfileArn?: string;
+  managedIam?: boolean;
+  runtimeUnitName?: string;
+  assetPrefix?: string;
+  code?: {
+    hash: string;
+  };
+}
+
+export interface Ec2HostedCleanupState {
+  roleName?: string;
+  policyName?: string;
+  instanceProfileName?: string;
+  managedIam?: boolean;
+  assetPrefix?: string;
+}
+
+/**
+ * Deploy-time / plan-time host context for EC2-backed platforms that bundle a
+ * long-lived program (`exports.program`) and collect background work via `run`.
+ */
+export interface Ec2HostRuntimeContext extends ProcessContext {
+  exports: Effect.Effect<{
+    readonly program: Effect.Effect<void, never, any>;
+  }>;
+}
+
+export const createEc2HostRuntimeContext =
+  (type: string) =>
+  (id: string): Ec2HostRuntimeContext => {
+    const runners: Effect.Effect<void, never, any>[] = [];
+    const env: Record<string, any> = {};
+
+    return {
+      Type: type,
+      id,
+      env,
+      set: (bindingId: string, output: Output.Output) =>
+        Effect.sync(() => {
+          const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
+          env[key] = output.pipe(Output.map((value) => JSON.stringify(value)));
+          return key;
+        }),
+      get: <T>(key: string) =>
+        Config.string(key).pipe(
+          Effect.flatMap((value) =>
+            Effect.try({
+              try: () => JSON.parse(value) as T,
+              catch: (error) => error as Error,
+            }),
+          ),
+          Effect.catch((cause) =>
+            Effect.die(
+              new Error(`Failed to get environment variable: ${key}`, {
+                cause,
+              }),
+            ),
+          ),
+        ),
+      run: (effect: Effect.Effect<void, never, any>) =>
+        Effect.sync(() => {
+          runners.push(effect);
+        }),
+      exports: Effect.sync(() => ({
+        program: Effect.all(runners, { concurrency: "unbounded" }),
+      })),
+    } satisfies Ec2HostRuntimeContext;
+  };
+
+export const createEc2HostedSupport = ({
+  accountId,
+  region,
+  stackName,
+  stage,
+  fs,
+  virtualEntryPlugin,
+  assets,
+  resourceType,
+}: {
+  accountId: string;
+  region: string;
+  stackName: string;
+  stage: string;
+  fs: FileSystem.FileSystem;
+  virtualEntryPlugin: (
+    content: (importPath: string) => string,
+  ) => rolldown.Plugin;
+  assets: typeof Assets.Service | undefined;
+  resourceType: string;
+}) => {
+  const alchemyEnv = {
+    ALCHEMY_STACK_NAME: stackName,
+    ALCHEMY_STAGE: stage,
+    ALCHEMY_PHASE: "runtime",
+  };
+
+  const createRoleName = (id: string) =>
+    createPhysicalName({
+      id: `${id}-role`,
+      maxLength: 64,
+    });
+
+  const createPolicyName = (id: string) =>
+    createPhysicalName({
+      id: `${id}-policy`,
+      maxLength: 128,
+    });
+
+  const createManagedProfileName = (id: string) =>
+    createPhysicalName({
+      id: `${id}-profile`,
+      maxLength: 128,
+    });
+
+  const createRuntimeUnitName = (id: string) =>
+    createPhysicalName({
+      id: `${id}-instance`,
+      maxLength: 64,
+      lowercase: true,
+    }).pipe(Effect.map((name) => name.replaceAll(/[^a-z0-9-]/g, "-")));
+
+  const normalizeSecurityGroups = (groups?: readonly string[]) =>
+    [...(groups ?? [])].sort((a, b) => a.localeCompare(b));
+
+  const bundleProgram = Effect.fn(function* (
+    id: string,
+    props: Ec2HostedProps,
+  ) {
+    if (!props.main) {
+      return yield* Effect.fail(
+        new Error(
+          `${resourceType} '${id}' requires 'main' when bundling a hosted process`,
+        ),
+      );
+    }
+
+    const handler = props.handler ?? "default";
+    const realMain = yield* fs.realPath(props.main);
+    const cwd = yield* findCwdForBundle(realMain);
+
+    const buildBundle = Effect.fnUntraced(function* (
+      entry: string,
+      plugins?: rolldown.RolldownPluginOption,
+    ) {
+      return yield* Bundle.build(
+        {
+          ...props.build?.input,
+          input: entry,
+          cwd,
+          platform: "node",
+          plugins: [props.build?.input?.plugins, plugins],
+        },
+        {
+          ...props.build?.output,
+          format: "esm",
+          sourcemap: props.build?.output?.sourcemap ?? false,
+          minify: props.build?.output?.minify ?? true,
+          entryFileNames: "index.js",
+        },
+      );
+    });
+
+    const bundleOutput = props.isExternal
+      ? yield* buildBundle(realMain)
+      : yield* buildBundle(
+          realMain,
+          virtualEntryPlugin(
+            (importPath) => `
+import { NodeServices } from "@effect/platform-node";
+import { Stack } from "alchemy/Stack";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Credentials from "@distilled.cloud/aws/Credentials";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Region from "@distilled.cloud/aws/Region";
+
+import { ${handler} as handler } from ${JSON.stringify(importPath)};
+
+const platform = Layer.mergeAll(
+  NodeServices.layer,
+  FetchHttpClient.layer,
+  Logger.layer([Logger.consolePretty()]),
+);
+
+const program = handler.pipe(
+  Effect.flatMap((instance) => instance.RuntimeContext.exports.program),
+  Effect.provide(
+    Layer.effect(
+      Stack,
+      Effect.all([
+        Config.string("ALCHEMY_STACK_NAME"),
+        Config.string("ALCHEMY_STAGE")
+      ]).pipe(
+        Effect.map(([name, stage]) => ({
+          name,
+          stage,
+          bindings: {},
+          resources: {}
+        }))
+      )
+    ).pipe(
+      Layer.provideMerge(Credentials.fromEnv()),
+      Layer.provideMerge(Region.fromEnv()),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          ConfigProvider.fromEnv()
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+await Effect.runPromise(program);
+`,
+          ),
+        );
+
+    const mainFile = bundleOutput.files[0];
+    const code =
+      typeof mainFile.content === "string"
+        ? new TextEncoder().encode(mainFile.content)
+        : mainFile.content;
+
+    const archive = yield* zipCode(code);
+    return { archive, hash: bundleOutput.hash };
+  });
+
+  const quoteEnvValue = (value: any) => {
+    const text =
+      typeof value === "string" ? value : JSON.stringify(value ?? null);
+    return `'${text.replaceAll(/'/g, `'""'`).replaceAll(/\n/g, "\\n")}'`;
+  };
+
+  const renderEnvFile = (env: Record<string, any>) =>
+    Object.entries(env)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([key, value]) => `${key}=${quoteEnvValue(value)}`)
+      .join("\n");
+
+  const renderHostedUserData = ({
+    unitName,
+    bundleKey,
+    envKey,
+  }: {
+    unitName: string;
+    bundleKey: string;
+    envKey: string;
+  }) => {
+    const appDir = `/opt/${unitName}`;
+    return `#!/bin/bash
+set -euo pipefail
+
+PKG_INSTALL=""
+if command -v dnf >/dev/null 2>&1; then
+  PKG_INSTALL="dnf install -y"
+elif command -v yum >/dev/null 2>&1; then
+  PKG_INSTALL="yum install -y"
+fi
+
+if [ -n "$PKG_INSTALL" ]; then
+  $PKG_INSTALL unzip curl awscli
+fi
+
+mkdir -p "${appDir}"
+
+export HOME=/root
+if [ ! -x /root/.bun/bin/bun ]; then
+  curl -fsSL https://bun.sh/install | bash
+fi
+
+cat >/usr/local/bin/${unitName}-sync.sh <<'EOF'
+#!/bin/bash
+set -euo pipefail
+mkdir -p "${appDir}"
+aws s3 cp "s3://${assets?.bucketName}/${bundleKey}" "${appDir}/bundle.zip" --region "${region}"
+aws s3 cp "s3://${assets?.bucketName}/${envKey}" "${appDir}/env" --region "${region}"
+rm -f "${appDir}/index.mjs"
+unzip -o "${appDir}/bundle.zip" -d "${appDir}"
+EOF
+chmod +x /usr/local/bin/${unitName}-sync.sh
+
+cat >/etc/systemd/system/${unitName}.service <<'EOF'
+[Unit]
+Description=Alchemy EC2 instance runtime ${unitName}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${appDir}
+ExecStartPre=/usr/local/bin/${unitName}-sync.sh
+EnvironmentFile=${appDir}/env
+ExecStart=/root/.bun/bin/bun ${appDir}/index.mjs
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+/usr/local/bin/${unitName}-sync.sh
+systemctl daemon-reload
+systemctl enable --now ${unitName}.service
+`;
+  };
+
+  const mergeUserData = (hosted: string, userData?: string) => {
+    if (!userData) {
+      return hosted;
+    }
+    return `${hosted}\n\n# User supplied bootstrap\n${userData.replace(
+      /^#!\/bin\/bash\s*/,
+      "",
+    )}`;
+  };
+
+  const listAttachedPolicyArns = (roleName: string) =>
+    iam
+      .listAttachedRolePolicies({
+        RoleName: roleName,
+      })
+      .pipe(
+        Effect.map((result) =>
+          (result.AttachedPolicies ?? [])
+            .map((policy) => policy.PolicyArn)
+            .filter((policyArn): policyArn is string => Boolean(policyArn)),
+        ),
+      );
+
+  const attachManagedPolicies = Effect.fn(function* ({
+    roleName,
+    managedPolicyArns,
+  }: {
+    roleName: string;
+    managedPolicyArns: string[];
+  }) {
+    const attached = new Set(yield* listAttachedPolicyArns(roleName));
+    for (const policyArn of managedPolicyArns) {
+      if (!attached.has(policyArn)) {
+        yield* iam.attachRolePolicy({
+          RoleName: roleName,
+          PolicyArn: policyArn,
+        });
+      }
+    }
+  });
+
+  const ensureManagedRole = Effect.fn(function* ({
+    id,
+    roleName,
+    managedPolicyArns,
+  }: {
+    id: string;
+    roleName: string;
+    managedPolicyArns: string[];
+  }) {
+    const tags = yield* createInternalTags(id);
+    const role = yield* iam
+      .createRole({
+        RoleName: roleName,
+        AssumeRolePolicyDocument: JSON.stringify({
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Service: "ec2.amazonaws.com",
+              },
+              Action: "sts:AssumeRole",
+            },
+          ],
+        }),
+        Tags: createTagsList(tags),
+      })
+      .pipe(
+        Effect.catchTag("EntityAlreadyExistsException", () =>
+          iam.getRole({ RoleName: roleName }).pipe(
+            Effect.filterOrFail(
+              (existing) => hasTags(tags, existing.Role?.Tags),
+              () =>
+                new Error(
+                  `Role '${roleName}' already exists and is not managed by alchemy`,
+                ),
+            ),
+          ),
+        ),
+      );
+
+    yield* attachManagedPolicies({
+      roleName,
+      managedPolicyArns,
+    });
+
+    return role.Role?.Arn ?? `arn:aws:iam::${accountId}:role/${roleName}`;
+  });
+
+  const ensureManagedInstanceProfile = Effect.fn(function* ({
+    id,
+    profileName,
+    roleName,
+  }: {
+    id: string;
+    profileName: string;
+    roleName: string;
+  }) {
+    const tags = yield* createInternalTags(id);
+    yield* iam
+      .createInstanceProfile({
+        InstanceProfileName: profileName,
+        Tags: createTagsList(tags),
+      })
+      .pipe(Effect.catchTag("EntityAlreadyExistsException", () => Effect.void));
+
+    const profile = yield* iam.getInstanceProfile({
+      InstanceProfileName: profileName,
+    });
+    const currentRoleName = profile.InstanceProfile.Roles?.[0]?.RoleName;
+
+    if (currentRoleName && currentRoleName !== roleName) {
+      yield* iam
+        .removeRoleFromInstanceProfile({
+          InstanceProfileName: profileName,
+          RoleName: currentRoleName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }
+
+    if (currentRoleName !== roleName) {
+      yield* iam.addRoleToInstanceProfile({
+        InstanceProfileName: profileName,
+        RoleName: roleName,
+      });
+    }
+
+    const refreshed = yield* iam.getInstanceProfile({
+      InstanceProfileName: profileName,
+    });
+    return {
+      instanceProfileName: refreshed.InstanceProfile.InstanceProfileName,
+      instanceProfileArn: refreshed.InstanceProfile.Arn,
+    };
+  });
+
+  const attachHostedBindings = Effect.fn(function* ({
+    roleName,
+    policyName,
+    assetPrefix,
+    bindings,
+  }: {
+    roleName: string;
+    policyName: string;
+    assetPrefix: string;
+    bindings: ResourceBinding<Ec2HostedBinding>[];
+  }) {
+    const activeBindings = bindings.filter(
+      (binding: ResourceBinding<Ec2HostedBinding> & { action?: string }) =>
+        binding.action !== "delete",
+    );
+
+    const env = activeBindings
+      .map((binding) => binding?.data?.env)
+      .reduce((acc, value) => ({ ...acc, ...value }), {});
+
+    const policyStatements = activeBindings.flatMap(
+      (binding) =>
+        binding?.data?.policyStatements?.map((statement) => ({
+          ...statement,
+          Sid: statement.Sid?.replace(/[^A-Za-z0-9]+/gi, ""),
+        })) ?? [],
+    );
+
+    policyStatements.push({
+      Sid: undefined,
+      Effect: "Allow",
+      Action: ["s3:GetObject"],
+      Resource: [`arn:aws:s3:::${assets?.bucketName}/${assetPrefix}/*`],
+    });
+
+    yield* iam.putRolePolicy({
+      RoleName: roleName,
+      PolicyName: policyName,
+      PolicyDocument: JSON.stringify({
+        Version: "2012-10-17",
+        Statement: policyStatements,
+      }),
+    });
+
+    return env;
+  });
+
+  const uploadHostedArtifacts = Effect.fn(function* ({
+    bundleKey,
+    envKey,
+    archive,
+    env,
+  }: {
+    bundleKey: string;
+    envKey: string;
+    archive: Uint8Array<ArrayBufferLike>;
+    env: Record<string, any>;
+  }) {
+    if (!assets) {
+      return yield* Effect.fail(
+        new Error(
+          `${resourceType} host mode requires the AWS assets bucket. Run bootstrap first.`,
+        ),
+      );
+    }
+
+    const contentHash = yield* sha256(archive);
+    const uploadedAssetKey = yield* assets.uploadAsset(contentHash, archive);
+    yield* s3.copyObject({
+      Bucket: assets.bucketName,
+      Key: bundleKey,
+      CopySource: `${assets.bucketName}/${uploadedAssetKey}`,
+    });
+    yield* s3.putObject({
+      Bucket: assets.bucketName,
+      Key: envKey,
+      Body: renderEnvFile(env),
+      ContentType: "text/plain; charset=utf-8",
+    });
+  });
+
+  const resolveHostedRuntime = Effect.fn(function* ({
+    id,
+    news,
+    bindings,
+    output,
+  }: {
+    id: string;
+    news: Ec2HostedProps;
+    bindings: ResourceBinding<Ec2HostedBinding>[];
+    output?: Ec2HostedRuntimeState;
+  }) {
+    if (!news.main) {
+      return {
+        userData: news.userData,
+        roleName: output?.roleName,
+        roleArn: output?.roleArn,
+        policyName: output?.policyName,
+        instanceProfileName:
+          news.instanceProfileName ?? output?.instanceProfileName,
+        instanceProfileArn: output?.instanceProfileArn,
+        managedIam: output?.managedIam ?? false,
+        runtimeUnitName: output?.runtimeUnitName,
+        assetPrefix: output?.assetPrefix,
+        code: output?.code,
+      } satisfies Ec2HostedRuntimeState;
+    }
+
+    if (
+      news.instanceProfileName &&
+      (news.roleManagedPolicyArns?.length ?? 0) > 0
+    ) {
+      return yield* Effect.fail(
+        new Error(
+          `${resourceType} does not support roleManagedPolicyArns with a custom instanceProfileName in host mode`,
+        ),
+      );
+    }
+    if (!assets) {
+      return yield* Effect.fail(
+        new Error(
+          `${resourceType} host mode requires the AWS assets bucket. Run bootstrap first.`,
+        ),
+      );
+    }
+
+    const runtimeUnitName =
+      output?.runtimeUnitName ?? (yield* createRuntimeUnitName(id));
+    const assetPrefix = output?.assetPrefix ?? `ec2/${runtimeUnitName}`;
+    const bundleKey = `${assetPrefix}/bundle.zip`;
+    const envKey = `${assetPrefix}/env`;
+    const policyName = output?.policyName ?? (yield* createPolicyName(id));
+
+    const managedIam = !news.instanceProfileName;
+    let roleName: string;
+    let roleArn: string | undefined;
+    let instanceProfileName: string | undefined;
+    let instanceProfileArn: string | undefined;
+
+    if (managedIam) {
+      roleName = output?.roleName ?? (yield* createRoleName(id));
+      roleArn =
+        output?.roleArn ??
+        (yield* ensureManagedRole({
+          id,
+          roleName,
+          managedPolicyArns: news.roleManagedPolicyArns ?? [],
+        }));
+      const profileName =
+        output?.instanceProfileName ?? (yield* createManagedProfileName(id));
+      const profile = yield* ensureManagedInstanceProfile({
+        id,
+        profileName,
+        roleName,
+      });
+      instanceProfileName = profile.instanceProfileName;
+      instanceProfileArn = profile.instanceProfileArn;
+    } else {
+      const profile = yield* iam.getInstanceProfile({
+        InstanceProfileName: news.instanceProfileName!,
+      });
+      const role = profile.InstanceProfile.Roles?.[0];
+      if (!role?.RoleName) {
+        return yield* Effect.fail(
+          new Error(
+            `Instance profile '${news.instanceProfileName}' must have a role attached for host mode`,
+          ),
+        );
+      }
+      roleName = role.RoleName;
+      roleArn = role.Arn;
+      instanceProfileName = profile.InstanceProfile.InstanceProfileName;
+      instanceProfileArn = profile.InstanceProfile.Arn;
+    }
+
+    const bindingEnv = yield* attachHostedBindings({
+      roleName,
+      policyName,
+      assetPrefix,
+      bindings,
+    });
+    const env = {
+      ...bindingEnv,
+      ...alchemyEnv,
+      ...(news.port !== undefined ? { PORT: news.port } : {}),
+      ...news.env,
+    };
+
+    const { archive, hash } = yield* bundleProgram(id, news);
+    yield* uploadHostedArtifacts({
+      bundleKey,
+      envKey,
+      archive,
+      env,
+    });
+
+    const hostedUserData = renderHostedUserData({
+      unitName: runtimeUnitName,
+      bundleKey,
+      envKey,
+    });
+
+    return {
+      userData: mergeUserData(hostedUserData, news.userData),
+      roleName,
+      roleArn,
+      policyName,
+      instanceProfileName,
+      instanceProfileArn,
+      managedIam,
+      runtimeUnitName,
+      assetPrefix,
+      code: {
+        hash,
+      },
+    } satisfies Ec2HostedRuntimeState;
+  });
+
+  const cleanupHostedRuntime = Effect.fn(function* ({
+    output,
+    session,
+  }: {
+    output: Ec2HostedCleanupState;
+    session?: Pick<ScopedPlanStatusSession, "note">;
+  }) {
+    if (output.roleName && output.policyName) {
+      yield* iam
+        .deleteRolePolicy({
+          RoleName: output.roleName,
+          PolicyName: output.policyName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }
+
+    if (output.managedIam && output.instanceProfileName && output.roleName) {
+      const attachedPolicyArns = yield* listAttachedPolicyArns(
+        output.roleName,
+      ).pipe(Effect.catch(() => Effect.succeed([])));
+      yield* iam
+        .removeRoleFromInstanceProfile({
+          InstanceProfileName: output.instanceProfileName,
+          RoleName: output.roleName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+      yield* iam
+        .deleteInstanceProfile({
+          InstanceProfileName: output.instanceProfileName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+      for (const policyArn of attachedPolicyArns) {
+        yield* iam
+          .detachRolePolicy({
+            RoleName: output.roleName,
+            PolicyArn: policyArn,
+          })
+          .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+      }
+      yield* iam
+        .deleteRole({
+          RoleName: output.roleName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }
+
+    if (assets && output.assetPrefix) {
+      for (const key of [
+        `${output.assetPrefix}/bundle.zip`,
+        `${output.assetPrefix}/env`,
+      ]) {
+        yield* s3
+          .deleteObject({
+            Bucket: assets.bucketName,
+            Key: key,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+      }
+    }
+
+    if (session) {
+      yield* session.note(`Cleaned hosted assets for ${resourceType}`);
+    }
+  });
+
+  const buildEc2NetworkData = ({
+    subnetId,
+    securityGroupIds,
+    associatePublicIpAddress,
+    privateIpAddress,
+  }: Pick<
+    Ec2HostedProps,
+    | "subnetId"
+    | "securityGroupIds"
+    | "associatePublicIpAddress"
+    | "privateIpAddress"
+  >) => {
+    const groups = normalizeSecurityGroups(securityGroupIds);
+    const usePrimaryNetworkInterface =
+      subnetId !== undefined ||
+      associatePublicIpAddress !== undefined ||
+      privateIpAddress !== undefined;
+
+    return {
+      usePrimaryNetworkInterface,
+      groups,
+      networkInterfaces: usePrimaryNetworkInterface
+        ? [
+            {
+              DeviceIndex: 0,
+              SubnetId: subnetId,
+              Groups: groups.length > 0 ? groups : undefined,
+              AssociatePublicIpAddress: associatePublicIpAddress,
+              PrivateIpAddress: privateIpAddress,
+              DeleteOnTermination: true,
+            },
+          ]
+        : undefined,
+    };
+  };
+
+  const buildLaunchTemplateData = (
+    news: Pick<
+      Ec2HostedProps,
+      | "imageId"
+      | "instanceType"
+      | "keyName"
+      | "subnetId"
+      | "securityGroupIds"
+      | "associatePublicIpAddress"
+      | "privateIpAddress"
+      | "availabilityZone"
+      | "tags"
+    >,
+    runtime: Pick<Ec2HostedRuntimeState, "userData" | "instanceProfileName">,
+  ) => {
+    const encodedUserData = runtime.userData
+      ? Buffer.from(runtime.userData).toString("base64")
+      : undefined;
+    const network = buildEc2NetworkData(news);
+    const instanceTags = {
+      ...news.tags,
+    };
+
+    return {
+      ImageId: news.imageId,
+      InstanceType: news.instanceType,
+      KeyName: news.keyName,
+      IamInstanceProfile: runtime.instanceProfileName
+        ? {
+            Name: runtime.instanceProfileName,
+          }
+        : undefined,
+      UserData: encodedUserData,
+      Placement: news.availabilityZone
+        ? {
+            AvailabilityZone: news.availabilityZone,
+          }
+        : undefined,
+      NetworkInterfaces: network.networkInterfaces,
+      SubnetId: network.usePrimaryNetworkInterface ? undefined : news.subnetId,
+      SecurityGroupIds: network.usePrimaryNetworkInterface
+        ? undefined
+        : network.groups.length > 0
+          ? network.groups
+          : undefined,
+      PrivateIpAddress: network.usePrimaryNetworkInterface
+        ? undefined
+        : news.privateIpAddress,
+      TagSpecifications:
+        Object.keys(instanceTags).length > 0
+          ? [
+              {
+                ResourceType: "instance",
+                Tags: createTagsList(instanceTags),
+              },
+            ]
+          : undefined,
+    };
+  };
+
+  return {
+    normalizeSecurityGroups,
+    buildLaunchTemplateData,
+    resolveHostedRuntime,
+    cleanupHostedRuntime,
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/index.ts
new file mode 100644
index 00000000000..e5baa29aca9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EC2/index.ts
@@ -0,0 +1,18 @@
+export * from "./EgressOnlyInternetGateway.ts";
+export * from "./EIP.ts";
+export * from "./Image.ts";
+export * from "./Instance.ts";
+export * from "./InternetGateway.ts";
+export * from "./NatGateway.ts";
+export * from "./Network.ts";
+export * from "./NetworkAcl.ts";
+export * from "./NetworkAclAssociation.ts";
+export * from "./NetworkAclEntry.ts";
+export * from "./Route.ts";
+export * from "./RouteTable.ts";
+export * from "./RouteTableAssociation.ts";
+export * from "./SecurityGroup.ts";
+export * from "./SecurityGroupRule.ts";
+export * from "./Subnet.ts";
+export * from "./Vpc.ts";
+export * from "./VpcEndpoint.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECR/Repository.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECR/Repository.ts
new file mode 100644
index 00000000000..dbc2ba0f412
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECR/Repository.ts
@@ -0,0 +1,258 @@
+import * as ecr from "@distilled.cloud/aws/ecr";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type RepositoryName = string;
+export type RepositoryArn =
+  `arn:aws:ecr:${RegionID}:${AccountID}:repository/${RepositoryName}`;
+export type RepositoryUri =
+  `${AccountID}.dkr.ecr.${RegionID}.amazonaws.com/${RepositoryName}`;
+
+export interface RepositoryProps {
+  /**
+   * Name of the repository. If omitted, a unique name is generated.
+   */
+  repositoryName?: string;
+  /**
+   * Image tag mutability setting.
+   * @default "MUTABLE"
+   */
+  imageTagMutability?: ecr.ImageTagMutability;
+  /**
+   * Whether enhanced image scanning should run on push.
+   */
+  scanOnPush?: boolean;
+  /**
+   * Optional lifecycle policy document JSON.
+   */
+  lifecyclePolicyText?: string;
+  /**
+   * User-defined tags to apply to the repository.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Repository extends Resource<
+  "AWS.ECR.Repository",
+  RepositoryProps,
+  {
+    repositoryName: RepositoryName;
+    repositoryArn: RepositoryArn;
+    repositoryUri: RepositoryUri;
+    registryId: string;
+    imageTagMutability: ecr.ImageTagMutability;
+    lifecyclePolicyText?: string;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon ECR repository for container images.
+ *
+ * @section Creating Repositories
+ * @example Task Image Repository
+ * ```typescript
+ * const repo = yield* Repository("TaskRepository", {
+ *   scanOnPush: true,
+ * });
+ * ```
+ */
+export const Repository = Resource<Repository>("AWS.ECR.Repository");
+
+export const RepositoryProvider = () =>
+  Provider.effect(
+    Repository,
+    Effect.gen(function* () {
+      const toRepositoryName = (
+        id: string,
+        props: { repositoryName?: string } = {},
+      ) =>
+        props.repositoryName
+          ? Effect.succeed(props.repositoryName)
+          : createPhysicalName({
+              id,
+              maxLength: 256,
+              lowercase: true,
+            });
+
+      return {
+        stables: [
+          "repositoryArn",
+          "repositoryName",
+          "repositoryUri",
+          "registryId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toRepositoryName(id, olds ?? {})) !==
+            (yield* toRepositoryName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const repositoryName =
+            output?.repositoryName ?? (yield* toRepositoryName(id, olds ?? {}));
+          const described = yield* ecr
+            .describeRepositories({
+              repositoryNames: [repositoryName],
+            })
+            .pipe(
+              Effect.catchTag("RepositoryNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const repository = described?.repositories?.[0];
+          if (!repository?.repositoryArn || !repository.repositoryUri) {
+            return undefined;
+          }
+          const listedTags = yield* ecr.listTagsForResource({
+            resourceArn: repository.repositoryArn,
+          });
+          const attrs = {
+            repositoryName,
+            repositoryArn: repository.repositoryArn as RepositoryArn,
+            repositoryUri: repository.repositoryUri as RepositoryUri,
+            registryId: repository.registryId!,
+            imageTagMutability:
+              repository.imageTagMutability ??
+              output?.imageTagMutability ??
+              "MUTABLE",
+            lifecyclePolicyText: output?.lifecyclePolicyText,
+            tags: output?.tags ?? {},
+          };
+          return (yield* hasAlchemyTags(id, listedTags.tags ?? []))
+            ? attrs
+            : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const repositoryName = yield* toRepositoryName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live cloud state. We never trust prior `output`
+          // blindly: the repository may have been deleted out-of-band.
+          let described = yield* ecr
+            .describeRepositories({
+              repositoryNames: [repositoryName],
+            })
+            .pipe(
+              Effect.catchTag("RepositoryNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          let repository = described?.repositories?.[0];
+
+          // Ensure — create the repository if missing. Tolerate
+          // `RepositoryAlreadyExistsException` as a race with a peer
+          // reconciler: re-describe and continue with the sync path.
+          if (!repository?.repositoryArn || !repository.repositoryUri) {
+            const created = yield* ecr
+              .createRepository({
+                repositoryName,
+                imageTagMutability: news.imageTagMutability,
+                imageScanningConfiguration: news.scanOnPush
+                  ? { scanOnPush: true }
+                  : undefined,
+                tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag("RepositoryAlreadyExistsException", () =>
+                  ecr
+                    .describeRepositories({
+                      repositoryNames: [repositoryName],
+                    })
+                    .pipe(
+                      Effect.map((res) => ({
+                        repository: res.repositories?.[0],
+                      })),
+                    ),
+                ),
+              );
+            repository = created.repository;
+            if (!repository?.repositoryArn || !repository.repositoryUri) {
+              return yield* Effect.fail(
+                new Error(
+                  `Failed to create or read repository ${repositoryName}`,
+                ),
+              );
+            }
+          }
+
+          const repositoryArn = repository.repositoryArn as RepositoryArn;
+
+          // Sync lifecycle policy — observed ↔ desired.
+          if (news.lifecyclePolicyText) {
+            yield* ecr.putLifecyclePolicy({
+              repositoryName,
+              lifecyclePolicyText: news.lifecyclePolicyText,
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          const listedTags = yield* ecr.listTagsForResource({
+            resourceArn: repositoryArn,
+          });
+          const observedTags = Object.fromEntries(
+            (listedTags.tags ?? [])
+              .filter(
+                (t): t is { Key: string; Value: string } =>
+                  typeof t.Key === "string" && typeof t.Value === "string",
+              )
+              .map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* ecr.tagResource({
+              resourceArn: repositoryArn,
+              tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* ecr.untagResource({
+              resourceArn: repositoryArn,
+              tagKeys: removed,
+            });
+          }
+
+          yield* session.note(repositoryArn);
+          return {
+            repositoryName,
+            repositoryArn,
+            repositoryUri: repository.repositoryUri as RepositoryUri,
+            registryId: repository.registryId!,
+            imageTagMutability:
+              news.imageTagMutability ??
+              repository.imageTagMutability ??
+              "MUTABLE",
+            lifecyclePolicyText: news.lifecyclePolicyText,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* ecr
+            .deleteRepository({
+              repositoryName: output.repositoryName,
+              force: true,
+            })
+            .pipe(
+              Effect.catchTag("RepositoryNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECR/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECR/index.ts
new file mode 100644
index 00000000000..4782d8ab0ef
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECR/index.ts
@@ -0,0 +1 @@
+export { Repository, RepositoryProvider } from "./Repository.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/CapacityProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/CapacityProvider.ts
new file mode 100644
index 00000000000..a3fef28034e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/CapacityProvider.ts
@@ -0,0 +1,305 @@
+import * as ecs from "@distilled.cloud/aws/ecs";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+
+export type CapacityProviderName = string;
+export type CapacityProviderArn =
+  `arn:aws:ecs:${RegionID}:${AccountID}:capacity-provider/${CapacityProviderName}`;
+
+export interface CapacityProviderProps {
+  /**
+   * Capacity provider name. If omitted, a deterministic name is generated.
+   *
+   * Names beginning with `aws`, `ecs`, or `fargate` are reserved by AWS.
+   * Changing this triggers a replacement.
+   */
+  name?: string;
+  /**
+   * ARN of the EC2 Auto Scaling Group that backs this capacity provider.
+   *
+   * Cannot be changed after creation; changing this triggers a replacement.
+   */
+  autoScalingGroupArn: Input<string>;
+  /**
+   * Managed scaling configuration applied by ECS to the underlying ASG.
+   */
+  managedScaling?: ecs.ManagedScaling;
+  /**
+   * Whether ECS protects in-use container instances from ASG scale-in.
+   * @default "DISABLED"
+   */
+  managedTerminationProtection?: ecs.ManagedTerminationProtection;
+  /**
+   * Whether ECS sets container instances to DRAINING when terminated by ASG.
+   * @default "DISABLED"
+   */
+  managedDraining?: ecs.ManagedDraining;
+  /**
+   * User-defined tags to apply to the capacity provider.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface CapacityProvider extends Resource<
+  "AWS.ECS.CapacityProvider",
+  CapacityProviderProps,
+  {
+    capacityProviderArn: CapacityProviderArn;
+    name: CapacityProviderName;
+    status: ecs.CapacityProviderStatus;
+    updateStatus: ecs.CapacityProviderUpdateStatus | undefined;
+    autoScalingGroupArn: string;
+    managedScaling: ecs.ManagedScaling | undefined;
+    managedTerminationProtection: ecs.ManagedTerminationProtection | undefined;
+    managedDraining: ecs.ManagedDraining | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon ECS capacity provider backed by an EC2 Auto Scaling Group.
+ *
+ * Capacity providers are associated with one or more ECS clusters via
+ * {@link Cluster#capacityProviders} and are referenced by a service or task's
+ * capacity provider strategy.
+ *
+ * Only EC2 Auto Scaling Group-backed capacity providers are currently
+ * supported. The reserved AWS providers `FARGATE` and `FARGATE_SPOT` do not
+ * need to be created and can be referenced by name on a `Cluster` directly.
+ *
+ * @section Creating Capacity Providers
+ * @example ASG-Backed Capacity Provider
+ * ```typescript
+ * const provider = yield* CapacityProvider("AppCapacityProvider", {
+ *   autoScalingGroupArn: asg.autoScalingGroupArn,
+ *   managedScaling: {
+ *     status: "ENABLED",
+ *     targetCapacity: 80,
+ *     minimumScalingStepSize: 1,
+ *     maximumScalingStepSize: 10,
+ *   },
+ *   managedTerminationProtection: "ENABLED",
+ * });
+ *
+ * yield* Cluster("AppCluster", {
+ *   capacityProviders: [provider.name],
+ *   defaultCapacityProviderStrategy: [
+ *     { capacityProvider: provider.name, weight: 1 },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Adopting Existing Capacity Providers
+ * Foreign-tagged capacity providers (i.e. providers that exist in AWS but were
+ * not created by this stack/stage/logical-id) are surfaced as `Unowned` by
+ * `read`, and the engine fails with `OwnedBySomeoneElse` unless adoption is
+ * explicitly opted in via `--adopt` or {@link adopt}.
+ * @example Adopt an existing provider
+ * ```typescript
+ * import { adopt } from "alchemy/AdoptPolicy";
+ *
+ * yield* CapacityProvider("AppCapacityProvider", {
+ *   name: "existing-provider",
+ *   autoScalingGroupArn: asg.autoScalingGroupArn,
+ * }).pipe(adopt());
+ * ```
+ */
+export const CapacityProvider = Resource<CapacityProvider>(
+  "AWS.ECS.CapacityProvider",
+);
+
+export const CapacityProviderProvider = () =>
+  Provider.effect(
+    CapacityProvider,
+    Effect.gen(function* () {
+      const toEcsTags = (tags: Record<string, string>): ecs.Tag[] =>
+        Object.entries(tags).map(([key, value]) => ({ key, value }));
+
+      const fromEcsTags = (
+        tags: ecs.Tag[] | undefined,
+      ): Record<string, string> =>
+        Object.fromEntries(
+          (tags ?? [])
+            .filter(
+              (t): t is { key: string; value: string } =>
+                t.key !== undefined && t.value !== undefined,
+            )
+            .map((t) => [t.key, t.value]),
+        );
+
+      const toName = (id: string, props: { name?: string } = {}) =>
+        props.name
+          ? Effect.succeed(props.name)
+          : createPhysicalName({ id, maxLength: 255, lowercase: true });
+
+      const describe = (name: string) =>
+        ecs
+          .describeCapacityProviders({
+            capacityProviders: [name],
+            include: ["TAGS"],
+          })
+          .pipe(
+            Effect.map((res) =>
+              res.capacityProviders?.find((p) => p.name === name),
+            ),
+          );
+
+      return {
+        stables: ["capacityProviderArn", "name"],
+
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return;
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news);
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+          if (
+            isResolved(olds.autoScalingGroupArn) &&
+            olds.autoScalingGroupArn !== news.autoScalingGroupArn
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name = output?.name ?? (yield* toName(id, olds ?? {}));
+          const found = yield* describe(name);
+          if (!found?.name || !found.capacityProviderArn) {
+            return undefined;
+          }
+          const internalTags = yield* createInternalTags(id);
+          const existingTags = fromEcsTags(found.tags);
+          const attrs = {
+            capacityProviderArn:
+              found.capacityProviderArn as CapacityProviderArn,
+            name: found.name,
+            status: (found.status ?? "ACTIVE") as ecs.CapacityProviderStatus,
+            updateStatus: found.updateStatus,
+            autoScalingGroupArn:
+              found.autoScalingGroupProvider?.autoScalingGroupArn ?? "",
+            managedScaling: found.autoScalingGroupProvider?.managedScaling,
+            managedTerminationProtection:
+              found.autoScalingGroupProvider?.managedTerminationProtection,
+            managedDraining: found.autoScalingGroupProvider?.managedDraining,
+            tags: existingTags,
+          };
+          return hasTags(internalTags, existingTags) ? attrs : Unowned(attrs);
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const region = yield* Region;
+          const { accountId } = yield* AWSEnvironment;
+          const name = yield* toName(id, news);
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+          const autoScalingGroupArn = news.autoScalingGroupArn as string;
+
+          // Observe — fetch live cloud state. We fetch fresh on every
+          // reconcile so adoption, drift, and partial-prior-runs all
+          // converge.
+          let existing = yield* describe(name);
+
+          // Ensure — create the capacity provider if missing.
+          if (!existing?.name || !existing.capacityProviderArn) {
+            yield* ecs
+              .createCapacityProvider({
+                name,
+                autoScalingGroupProvider: {
+                  autoScalingGroupArn,
+                  managedScaling: news.managedScaling,
+                  managedTerminationProtection:
+                    news.managedTerminationProtection,
+                  managedDraining: news.managedDraining,
+                },
+                tags: toEcsTags(desiredTags),
+              })
+              .pipe(
+                // ECS may surface concurrent creation either as
+                // `LimitExceededException` or a generic `ClientException`
+                // with name conflict semantics — re-describe and continue.
+                Effect.catchTag("LimitExceededException", () => Effect.void),
+              );
+            existing = yield* describe(name);
+          }
+
+          const capacityProviderArn = (existing?.capacityProviderArn ??
+            `arn:aws:ecs:${region}:${accountId}:capacity-provider/${name}`) as CapacityProviderArn;
+
+          // Sync managed scaling — observed ↔ desired. ECS
+          // updateCapacityProvider only mutates managed* fields; ASG ARN is
+          // immutable (replacement-triggering, handled in diff).
+          yield* ecs.updateCapacityProvider({
+            name,
+            autoScalingGroupProvider: {
+              managedScaling: news.managedScaling,
+              managedTerminationProtection: news.managedTerminationProtection,
+              managedDraining: news.managedDraining,
+            },
+          });
+
+          // Sync tags — diff observed cloud tags against desired.
+          const observedTags = fromEcsTags(existing?.tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* ecs.tagResource({
+              resourceArn: capacityProviderArn,
+              tags: upsert.map((t) => ({ key: t.Key, value: t.Value })),
+            });
+          }
+          if (removed.length > 0) {
+            yield* ecs.untagResource({
+              resourceArn: capacityProviderArn,
+              tagKeys: removed,
+            });
+          }
+
+          // Re-read to capture status / updateStatus reflecting our changes.
+          const found = yield* describe(name);
+          yield* session.note(capacityProviderArn);
+
+          return {
+            capacityProviderArn,
+            name,
+            status: (found?.status ?? "ACTIVE") as ecs.CapacityProviderStatus,
+            updateStatus: found?.updateStatus,
+            autoScalingGroupArn:
+              found?.autoScalingGroupProvider?.autoScalingGroupArn ??
+              autoScalingGroupArn,
+            managedScaling:
+              found?.autoScalingGroupProvider?.managedScaling ??
+              news.managedScaling,
+            managedTerminationProtection:
+              found?.autoScalingGroupProvider?.managedTerminationProtection ??
+              news.managedTerminationProtection,
+            managedDraining:
+              found?.autoScalingGroupProvider?.managedDraining ??
+              news.managedDraining,
+            tags: desiredTags,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          yield* ecs
+            .deleteCapacityProvider({ capacityProvider: output.name })
+            .pipe(
+              // Already gone — treat as success.
+              Effect.catchTag("InvalidParameterException", () => Effect.void),
+              Effect.catchTag("ClientException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Cluster.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Cluster.ts
new file mode 100644
index 00000000000..d3e829e36c8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Cluster.ts
@@ -0,0 +1,262 @@
+import * as ecs from "@distilled.cloud/aws/ecs";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type ClusterName = string;
+export type ClusterArn =
+  `arn:aws:ecs:${RegionID}:${AccountID}:cluster/${ClusterName}`;
+
+export interface ClusterProps {
+  /**
+   * Cluster name. If omitted, a unique name is generated.
+   */
+  clusterName?: string;
+  /**
+   * ECS cluster settings such as container insights.
+   */
+  settings?: ecs.ClusterSetting[];
+  /**
+   * Cluster configuration such as execute command logging.
+   */
+  configuration?: ecs.ClusterConfiguration;
+  /**
+   * Optional capacity providers associated with the cluster.
+   */
+  capacityProviders?: string[];
+  /**
+   * Default capacity provider strategy for the cluster.
+   */
+  defaultCapacityProviderStrategy?: ecs.CapacityProviderStrategyItem[];
+  /**
+   * Optional Service Connect defaults for the cluster.
+   */
+  serviceConnectDefaults?: ecs.ClusterServiceConnectDefaultsRequest;
+  /**
+   * User-defined tags to apply to the cluster.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Cluster extends Resource<
+  "AWS.ECS.Cluster",
+  ClusterProps,
+  {
+    clusterArn: ClusterArn;
+    clusterName: ClusterName;
+    status: string;
+    settings: ecs.ClusterSetting[];
+    configuration?: ecs.ClusterConfiguration;
+    capacityProviders: string[];
+    defaultCapacityProviderStrategy: ecs.CapacityProviderStrategyItem[];
+    serviceConnectDefaults?: ecs.ClusterServiceConnectDefaultsRequest;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon ECS cluster for running tasks and services.
+ *
+ * @section Creating Clusters
+ * @example Default Cluster
+ * ```typescript
+ * const cluster = yield* Cluster("AppCluster", {});
+ * ```
+ */
+export const Cluster = Resource<Cluster>("AWS.ECS.Cluster");
+
+export const ClusterProvider = () =>
+  Provider.effect(
+    Cluster,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const toEcsTags = (tags: Record<string, string>): ecs.Tag[] =>
+        Object.entries(tags).map(([key, value]) => ({
+          key,
+          value,
+        }));
+
+      const toClusterName = (
+        id: string,
+        props: { clusterName?: string } = {},
+      ) =>
+        props.clusterName
+          ? Effect.succeed(props.clusterName)
+          : createPhysicalName({ id, maxLength: 255, lowercase: true });
+
+      const applyCapacityProviders = Effect.fn(function* ({
+        cluster,
+        capacityProviders,
+        defaultCapacityProviderStrategy,
+      }: {
+        cluster: string;
+        capacityProviders?: string[];
+        defaultCapacityProviderStrategy?: ecs.CapacityProviderStrategyItem[];
+      }) {
+        if (
+          capacityProviders !== undefined ||
+          defaultCapacityProviderStrategy !== undefined
+        ) {
+          yield* ecs.putClusterCapacityProviders({
+            cluster,
+            capacityProviders: capacityProviders ?? [],
+            defaultCapacityProviderStrategy:
+              defaultCapacityProviderStrategy ?? [],
+          });
+        }
+      });
+
+      return {
+        stables: ["clusterArn", "clusterName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toClusterName(id, olds ?? {})) !==
+            (yield* toClusterName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const clusterName =
+            output?.clusterName ?? (yield* toClusterName(id, olds ?? {}));
+          const described = yield* ecs.describeClusters({
+            clusters: [output?.clusterArn ?? clusterName],
+            include: ["SETTINGS", "TAGS", "CONFIGURATIONS"],
+          });
+          const cluster = described.clusters?.[0];
+          if (!cluster?.clusterArn) {
+            return undefined;
+          }
+          return {
+            clusterArn: cluster.clusterArn as ClusterArn,
+            clusterName: cluster.clusterName!,
+            status: cluster.status ?? "ACTIVE",
+            settings: cluster.settings ?? [],
+            configuration: cluster.configuration,
+            capacityProviders: cluster.capacityProviders ?? [],
+            defaultCapacityProviderStrategy:
+              cluster.defaultCapacityProviderStrategy ?? [],
+            serviceConnectDefaults: cluster.serviceConnectDefaults?.namespace
+              ? { namespace: cluster.serviceConnectDefaults.namespace }
+              : undefined,
+            tags: output?.tags ?? {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const clusterName = yield* toClusterName(id, news);
+          const clusterArn =
+            `arn:aws:ecs:${region}:${accountId}:cluster/${clusterName}` as ClusterArn;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live cloud state.
+          let described = yield* ecs.describeClusters({
+            clusters: [clusterArn],
+            include: ["SETTINGS", "TAGS", "CONFIGURATIONS"],
+          });
+          let cluster = described.clusters?.find(
+            (c) =>
+              c.clusterName === clusterName &&
+              (c.status === "ACTIVE" || c.status === "PROVISIONING"),
+          );
+
+          // Ensure — create if missing. ECS createCluster is idempotent for
+          // identical params and returns the existing cluster on conflict;
+          // we always sync below regardless.
+          if (!cluster?.clusterArn) {
+            const created = yield* ecs.createCluster({
+              clusterName,
+              settings: news.settings,
+              configuration: news.configuration,
+              serviceConnectDefaults: news.serviceConnectDefaults,
+              tags: toEcsTags(desiredTags),
+            });
+            cluster = created.cluster;
+          }
+
+          // Sync cluster config — call updateCluster to converge settings,
+          // configuration, and serviceConnectDefaults to desired state.
+          yield* ecs.updateCluster({
+            cluster: clusterArn,
+            settings: news.settings,
+            configuration: news.configuration,
+            serviceConnectDefaults: news.serviceConnectDefaults,
+          });
+
+          // Sync capacity providers — observed ↔ desired.
+          yield* applyCapacityProviders({
+            cluster: clusterArn,
+            capacityProviders: news.capacityProviders,
+            defaultCapacityProviderStrategy:
+              news.defaultCapacityProviderStrategy,
+          });
+
+          // Sync tags — diff observed cloud tags against desired.
+          const observedTags = Object.fromEntries(
+            (cluster?.tags ?? [])
+              .filter(
+                (t): t is { key: string; value: string } =>
+                  typeof t.key === "string" && typeof t.value === "string",
+              )
+              .map((t) => [t.key, t.value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* ecs.tagResource({
+              resourceArn: clusterArn,
+              tags: upsert.map((tag) => ({ key: tag.Key, value: tag.Value })),
+            });
+          }
+          if (removed.length > 0) {
+            yield* ecs.untagResource({
+              resourceArn: clusterArn,
+              tagKeys: removed,
+            });
+          }
+
+          yield* session.note(clusterArn);
+          return {
+            clusterArn,
+            clusterName,
+            status: cluster?.status ?? "ACTIVE",
+            settings: news.settings ?? [],
+            configuration: news.configuration,
+            capacityProviders: news.capacityProviders ?? [],
+            defaultCapacityProviderStrategy:
+              news.defaultCapacityProviderStrategy ?? [],
+            serviceConnectDefaults: news.serviceConnectDefaults,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* ecs
+            .deleteCluster({
+              cluster: output.clusterArn,
+            })
+            .pipe(
+              Effect.catchTag("ClusterNotFoundException", () => Effect.void),
+              Effect.catchTag(
+                "ClusterContainsServicesException",
+                () => Effect.void,
+              ),
+              Effect.catchTag(
+                "ClusterContainsTasksException",
+                () => Effect.void,
+              ),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/DescribeTasks.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/DescribeTasks.ts
new file mode 100644
index 00000000000..573049b6efb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/DescribeTasks.ts
@@ -0,0 +1,67 @@
+import * as ECS from "@distilled.cloud/aws/ecs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { isTask } from "./Task.ts";
+import type { Cluster } from "./Cluster.ts";
+
+export interface DescribeTasksRequest extends Omit<
+  ECS.DescribeTasksRequest,
+  "cluster"
+> {}
+
+export class DescribeTasks extends Binding.Service<
+  DescribeTasks,
+  (
+    cluster: Cluster,
+  ) => Effect.Effect<
+    (
+      request: DescribeTasksRequest,
+    ) => Effect.Effect<ECS.DescribeTasksResponse, ECS.DescribeTasksError>
+  >
+>()("AWS.ECS.DescribeTasks") {}
+
+export const DescribeTasksLive = Layer.effect(
+  DescribeTasks,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeTasksPolicy;
+    const describeTasks = yield* ECS.describeTasks;
+
+    return Effect.fn(function* (cluster: Cluster) {
+      yield* Policy(cluster);
+      const clusterArn = (yield* cluster.clusterArn) as unknown as string;
+      return Effect.fn(function* (request: DescribeTasksRequest) {
+        return yield* describeTasks({
+          ...request,
+          cluster: clusterArn,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeTasksPolicy extends Binding.Policy<
+  DescribeTasksPolicy,
+  (cluster: Cluster) => Effect.Effect<void>
+>()("AWS.ECS.DescribeTasks") {}
+
+export const DescribeTasksPolicyLive = DescribeTasksPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster) {
+    if (isFunction(host) || isTask(host)) {
+      yield* host.bind`Allow(${host}, AWS.ECS.DescribeTasks(${cluster}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["ecs:DescribeTasks"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DescribeTasksPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/ListTasks.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/ListTasks.ts
new file mode 100644
index 00000000000..e337bee6f21
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/ListTasks.ts
@@ -0,0 +1,67 @@
+import * as ECS from "@distilled.cloud/aws/ecs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { isTask } from "./Task.ts";
+import type { Cluster } from "./Cluster.ts";
+
+export interface ListTasksRequest extends Omit<
+  ECS.ListTasksRequest,
+  "cluster"
+> {}
+
+export class ListTasks extends Binding.Service<
+  ListTasks,
+  (
+    cluster: Cluster,
+  ) => Effect.Effect<
+    (
+      request: ListTasksRequest,
+    ) => Effect.Effect<ECS.ListTasksResponse, ECS.ListTasksError>
+  >
+>()("AWS.ECS.ListTasks") {}
+
+export const ListTasksLive = Layer.effect(
+  ListTasks,
+  Effect.gen(function* () {
+    const Policy = yield* ListTasksPolicy;
+    const listTasks = yield* ECS.listTasks;
+
+    return Effect.fn(function* (cluster: Cluster) {
+      yield* Policy(cluster);
+      const clusterArn = (yield* cluster.clusterArn) as unknown as string;
+      return Effect.fn(function* (request: ListTasksRequest) {
+        return yield* listTasks({
+          ...request,
+          cluster: clusterArn,
+        });
+      });
+    });
+  }),
+);
+
+export class ListTasksPolicy extends Binding.Policy<
+  ListTasksPolicy,
+  (cluster: Cluster) => Effect.Effect<void>
+>()("AWS.ECS.ListTasks") {}
+
+export const ListTasksPolicyLive = ListTasksPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster) {
+    if (isFunction(host) || isTask(host)) {
+      yield* host.bind`Allow(${host}, AWS.ECS.ListTasks(${cluster}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["ecs:ListTasks"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListTasksPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/RunTask.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/RunTask.ts
new file mode 100644
index 00000000000..82b308e0798
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/RunTask.ts
@@ -0,0 +1,82 @@
+import * as ECS from "@distilled.cloud/aws/ecs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { Task, isTask } from "./Task.ts";
+import type { Cluster } from "./Cluster.ts";
+
+export interface RunTaskRequest extends Omit<
+  ECS.RunTaskRequest,
+  "cluster" | "taskDefinition"
+> {}
+
+export class RunTask extends Binding.Service<
+  RunTask,
+  (
+    cluster: Cluster,
+    task: Task,
+  ) => Effect.Effect<
+    (
+      request: RunTaskRequest,
+    ) => Effect.Effect<ECS.RunTaskResponse, ECS.RunTaskError>
+  >
+>()("AWS.ECS.RunTask") {}
+
+export const RunTaskLive = Layer.effect(
+  RunTask,
+  Effect.gen(function* () {
+    const Policy = yield* RunTaskPolicy;
+    const runTask = yield* ECS.runTask;
+
+    return Effect.fn(function* (cluster: Cluster, task: Task) {
+      yield* Policy(cluster, task);
+      const clusterArn = (yield* cluster.clusterArn) as unknown as string;
+      const taskDefinitionArn =
+        (yield* task.taskDefinitionArn) as unknown as string;
+
+      return Effect.fn(function* (request: RunTaskRequest) {
+        return yield* runTask({
+          ...request,
+          cluster: clusterArn,
+          taskDefinition: taskDefinitionArn,
+        });
+      });
+    });
+  }),
+);
+
+export class RunTaskPolicy extends Binding.Policy<
+  RunTaskPolicy,
+  (cluster: Cluster, task: Task) => Effect.Effect<void>
+>()("AWS.ECS.RunTask") {}
+
+export const RunTaskPolicyLive = RunTaskPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster, task) {
+    if (isFunction(host) || isTask(host)) {
+      yield* host.bind`Allow(${host}, AWS.ECS.RunTask(${cluster}, ${task}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["ecs:RunTask"],
+            Resource: [task.taskDefinitionArn],
+          },
+          {
+            Effect: "Allow",
+            Action: ["iam:PassRole"],
+            Resource: [task.taskRoleArn, task.executionRoleArn],
+          },
+          {
+            Effect: "Allow",
+            Action: ["ecs:DescribeTasks"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `RunTaskPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Schedule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Schedule.ts
new file mode 100644
index 00000000000..75d71f5ebd0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Schedule.ts
@@ -0,0 +1,115 @@
+import * as Scheduler from "../Scheduler/index.ts";
+import type { Cluster } from "./Cluster.ts";
+
+export interface ScheduleProps {
+  /**
+   * ECS cluster that the scheduled task should run on.
+   */
+  cluster: Cluster;
+
+  /**
+   * ECS task definition and roles to invoke on each schedule tick.
+   *
+   * This is typically the output of `AWS.ECS.Task(...)`.
+   */
+  task: {
+    /**
+     * Task definition ARN to run.
+     */
+    taskDefinitionArn: string;
+    /**
+     * Task role ARN passed through EventBridge `iam:PassRole`.
+     */
+    taskRoleArn: string;
+    /**
+     * Execution role ARN passed through EventBridge `iam:PassRole`.
+     */
+    executionRoleArn: string;
+  };
+
+  /**
+   * Subnets used for the Fargate task network configuration.
+   */
+  subnets: string[];
+
+  /**
+   * Security groups attached to the scheduled task ENIs.
+   */
+  securityGroups?: string[];
+
+  /**
+   * Whether the scheduled task should receive a public IP.
+   * @default false
+   */
+  assignPublicIp?: boolean;
+
+  /**
+   * Number of task copies to start on each invocation.
+   * @default 1
+   */
+  taskCount?: number;
+
+  /**
+   * Static JSON payload forwarded to the EventBridge ECS target.
+   */
+  input?: string;
+}
+
+const toScheduleExpression = (value: string) =>
+  value.startsWith("rate(") || value.startsWith("cron(")
+    ? value
+    : `rate(${value})`;
+
+/**
+ * Creates a scheduled EventBridge rule that runs an ECS Fargate task.
+ *
+ * `every` is the high-level ECS scheduling helper for phase 1. It provisions
+ * the EventBridge rule plus the invoke role required to call `ecs:RunTask` and
+ * `iam:PassRole` for the target task's execution roles.
+ *
+ * Plain English durations like `"1 hour"` are normalized to `rate(...)`
+ * expressions automatically. Full `rate(...)` and `cron(...)` expressions are
+ * also accepted as-is.
+ *
+ * @example Run a task every hour
+ * ```typescript
+ * yield* AWS.ECS.every("HourlyJob", "1 hour", {
+ *   cluster,
+ *   task: jobTask,
+ *   subnets: [privateSubnet1.subnetId, privateSubnet2.subnetId],
+ *   securityGroups: [jobSecurityGroup.groupId],
+ * });
+ * ```
+ *
+ * @example Use an explicit cron expression
+ * ```typescript
+ * yield* AWS.ECS.every("NightlyJob", "cron(0 3 * * ? *)", {
+ *   cluster,
+ *   task: nightlyTask,
+ *   subnets: [privateSubnet1.subnetId, privateSubnet2.subnetId],
+ *   securityGroups: [jobSecurityGroup.groupId],
+ * });
+ * ```
+ *
+ * @example Run multiple copies with static input
+ * ```typescript
+ * yield* AWS.ECS.every("BatchJob", "30 minutes", {
+ *   cluster,
+ *   task: batchTask,
+ *   subnets: [privateSubnet1.subnetId, privateSubnet2.subnetId],
+ *   securityGroups: [jobSecurityGroup.groupId],
+ *   taskCount: 3,
+ *   input: JSON.stringify({ source: "scheduler" }),
+ * });
+ * ```
+ */
+export const every = (id: string, schedule: string, props: ScheduleProps) =>
+  Scheduler.every(toScheduleExpression(schedule)).named(id).toEcsTask({
+    cluster: props.cluster,
+    task: props.task,
+    subnets: props.subnets,
+    securityGroups: props.securityGroups,
+    assignPublicIp: props.assignPublicIp,
+    taskCount: props.taskCount,
+    input: props.input,
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Service.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Service.ts
new file mode 100644
index 00000000000..145825e4c2a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Service.ts
@@ -0,0 +1,632 @@
+import * as ecs from "@distilled.cloud/aws/ecs";
+import * as elbv2 from "@distilled.cloud/aws/elastic-load-balancing-v2";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { ClusterArn } from "./Cluster.ts";
+
+export type ServiceName = string;
+export type ServiceArn =
+  `arn:aws:ecs:${RegionID}:${AccountID}:service/${string}/${ServiceName}`;
+
+export interface ServiceProps {
+  /**
+   * ECS cluster that will own the service.
+   */
+  cluster: Input<ClusterArn> | { clusterArn: Input<ClusterArn> };
+
+  /**
+   * Bundled ECS task to run for each service replica.
+   *
+   * This is the runtime-facing subset of `AWS.ECS.Task` attributes that the
+   * service needs in order to deploy and wire load balancer traffic.
+   */
+  task: {
+    /**
+     * Registered task definition ARN to deploy.
+     */
+    taskDefinitionArn: string;
+    /**
+     * Container name inside the task definition that should receive traffic.
+     */
+    containerName: string;
+    /**
+     * Container port that the service should expose and forward traffic to.
+     */
+    port: number;
+  };
+
+  /**
+   * Name of the ECS service.
+   * If omitted, a unique name will be generated.
+   */
+  serviceName?: string;
+
+  /**
+   * Desired number of running tasks.
+   * @default 1
+   */
+  desiredCount?: number;
+
+  /**
+   * VPC that hosts the service networking and optional public ingress.
+   */
+  vpcId: string;
+
+  /**
+   * Subnets used by the service's awsvpc network configuration.
+   */
+  subnets: string[];
+
+  /**
+   * Security groups attached to the service ENIs and, when `public: true`, the
+   * generated Application Load Balancer.
+   */
+  securityGroups?: string[];
+
+  /**
+   * Whether the service ENIs should receive public IPs.
+   * @default false
+   */
+  assignPublicIp?: boolean;
+
+  /**
+   * Whether Alchemy should provision a public Application Load Balancer and
+   * listener in front of the service.
+   * @default false
+   */
+  public?: boolean;
+
+  /**
+   * Listener port for generated public ingress.
+   * @default 80 when `certificateArn` is omitted, otherwise 443
+   */
+  listenerPort?: number;
+
+  /**
+   * ACM certificate ARN for HTTPS public ingress.
+   * When provided, the generated listener uses HTTPS.
+   */
+  certificateArn?: string;
+
+  /**
+   * Target group health check path for public HTTP services.
+   * @default "/"
+   */
+  healthCheckPath?: string;
+
+  /**
+   * Fargate platform version for the service.
+   */
+  platformVersion?: string;
+
+  /**
+   * Raw ECS deployment configuration overrides.
+   */
+  deploymentConfiguration?: ecs.DeploymentConfiguration;
+
+  /**
+   * Grace period before ECS starts evaluating target health checks.
+   */
+  healthCheckGracePeriodSeconds?: number;
+
+  /**
+   * User-defined tags to apply to the ECS service and generated ingress
+   * resources.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Service extends Resource<
+  "AWS.ECS.Service",
+  ServiceProps,
+  {
+    /**
+     * ARN of the ECS service.
+     */
+    serviceArn: ServiceArn;
+
+    /**
+     * Name of the ECS service.
+     */
+    serviceName: ServiceName;
+
+    /**
+     * ARN of the cluster that owns the service.
+     */
+    clusterArn: ClusterArn;
+
+    /**
+     * Task definition revision currently deployed by the service.
+     */
+    taskDefinitionArn: string;
+
+    /**
+     * ECS service status such as `ACTIVE` or `DRAINING`.
+     */
+    status: string;
+
+    /**
+     * Public URL exposed by the generated Application Load Balancer, when
+     * `public: true`.
+     */
+    url?: string;
+
+    /**
+     * ARN of the generated load balancer, when `public: true`.
+     */
+    loadBalancerArn?: string;
+
+    /**
+     * ARN of the generated target group, when `public: true`.
+     */
+    targetGroupArn?: string;
+
+    /**
+     * ARN of the generated listener, when `public: true`.
+     */
+    listenerArn?: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An ECS Fargate service for running long-lived tasks.
+ *
+ * `Service` turns a bundled `AWS.ECS.Task` into a continuously running Fargate
+ * deployment with awsvpc networking. Phase 1 focuses on the public HTTP path,
+ * so the resource can optionally provision an Application Load Balancer,
+ * target group, and listener when `public: true`.
+ *
+ * @section Creating Services
+ * @example Public HTTP Service
+ * ```typescript
+ * const service = yield* Service("ApiService", {
+ *   cluster,
+ *   task: apiTask,
+ *   vpcId: vpc.vpcId,
+ *   subnets: [publicSubnet1.subnetId, publicSubnet2.subnetId],
+ *   securityGroups: [serviceSecurityGroup.groupId],
+ *   public: true,
+ * });
+ * ```
+ *
+ * @example Internal Service
+ * ```typescript
+ * const service = yield* Service("WorkerService", {
+ *   cluster,
+ *   task: workerTask,
+ *   vpcId: vpc.vpcId,
+ *   subnets: [privateSubnet1.subnetId, privateSubnet2.subnetId],
+ *   securityGroups: [workerSecurityGroup.groupId],
+ *   desiredCount: 2,
+ * });
+ * ```
+ *
+ * @section Public Ingress
+ * @example HTTPS Service
+ * ```typescript
+ * const service = yield* Service("SecureApiService", {
+ *   cluster,
+ *   task: apiTask,
+ *   vpcId: vpc.vpcId,
+ *   subnets: [publicSubnet1.subnetId, publicSubnet2.subnetId],
+ *   securityGroups: [serviceSecurityGroup.groupId],
+ *   public: true,
+ *   certificateArn,
+ *   healthCheckPath: "/health",
+ * });
+ * ```
+ *
+ * @section Deployment
+ * @example Rolling Update Configuration
+ * ```typescript
+ * const service = yield* Service("ApiService", {
+ *   cluster,
+ *   task: apiTask,
+ *   vpcId: vpc.vpcId,
+ *   subnets: [publicSubnet1.subnetId, publicSubnet2.subnetId],
+ *   securityGroups: [serviceSecurityGroup.groupId],
+ *   public: true,
+ *   desiredCount: 3,
+ *   deploymentConfiguration: {
+ *     minimumHealthyPercent: 100,
+ *     maximumPercent: 200,
+ *   },
+ *   healthCheckGracePeriodSeconds: 30,
+ * });
+ * ```
+ */
+export const Service = Resource<Service>("AWS.ECS.Service");
+
+export const ServiceProvider = () =>
+  Provider.effect(
+    Service,
+    Effect.gen(function* () {
+      const clusterArnOf = (cluster: ServiceProps["cluster"] | ClusterArn) =>
+        typeof cluster === "string"
+          ? cluster
+          : (((cluster as any).clusterArn ?? cluster) as string);
+      const toEcsTags = (tags: Record<string, string>): ecs.Tag[] =>
+        Object.entries(tags).map(([key, value]) => ({ key, value }));
+
+      const toServiceName = (
+        id: string,
+        props: { serviceName?: string } = {},
+      ) =>
+        props.serviceName
+          ? Effect.succeed(props.serviceName)
+          : createPhysicalName({
+              id,
+              maxLength: 255,
+              lowercase: true,
+            });
+
+      const ingressNames = (id: string) =>
+        Effect.gen(function* () {
+          const loadBalancerName = yield* createPhysicalName({
+            id: `${id}-alb`,
+            maxLength: 32,
+            lowercase: true,
+          });
+          const targetGroupName = yield* createPhysicalName({
+            id: `${id}-tg`,
+            maxLength: 32,
+            lowercase: true,
+          });
+          return {
+            loadBalancerName,
+            targetGroupName,
+          };
+        });
+
+      const createIngress = Effect.fn(function* ({
+        id,
+        news,
+      }: {
+        id: string;
+        news: ServiceProps;
+      }) {
+        const names = yield* ingressNames(id);
+        const tags = {
+          ...(yield* createInternalTags(id)),
+          ...news.tags,
+        };
+
+        const loadBalancer = yield* elbv2.createLoadBalancer({
+          Name: names.loadBalancerName,
+          Type: "application",
+          Scheme: "internet-facing",
+          Subnets: news.subnets,
+          SecurityGroups: news.securityGroups,
+          Tags: Object.entries(tags).map(([Key, Value]) => ({ Key, Value })),
+        });
+        const lb = loadBalancer.LoadBalancers?.[0];
+        if (!lb?.LoadBalancerArn || !lb.DNSName) {
+          return yield* Effect.die(
+            new Error("Failed to create ECS service load balancer"),
+          );
+        }
+
+        const targetGroup = yield* elbv2.createTargetGroup({
+          Name: names.targetGroupName,
+          VpcId: news.vpcId,
+          TargetType: "ip",
+          Protocol: "HTTP",
+          Port: news.task.port ?? 3000,
+          HealthCheckPath: news.healthCheckPath ?? "/",
+          Tags: Object.entries(tags).map(([Key, Value]) => ({ Key, Value })),
+        });
+        const tg = targetGroup.TargetGroups?.[0];
+        if (!tg?.TargetGroupArn) {
+          return yield* Effect.die(
+            new Error("Failed to create ECS service target group"),
+          );
+        }
+
+        const listener = yield* elbv2.createListener({
+          LoadBalancerArn: lb.LoadBalancerArn,
+          Port: news.listenerPort ?? (news.certificateArn ? 443 : 80),
+          Protocol: news.certificateArn ? "HTTPS" : "HTTP",
+          Certificates: news.certificateArn
+            ? [{ CertificateArn: news.certificateArn }]
+            : undefined,
+          DefaultActions: [
+            {
+              Type: "forward",
+              TargetGroupArn: tg.TargetGroupArn,
+            },
+          ],
+        });
+        const ls = listener.Listeners?.[0];
+        if (!ls?.ListenerArn) {
+          return yield* Effect.die(
+            new Error("Failed to create ECS service listener"),
+          );
+        }
+
+        return {
+          loadBalancerArn: lb.LoadBalancerArn,
+          targetGroupArn: tg.TargetGroupArn,
+          listenerArn: ls.ListenerArn,
+          url: `${news.certificateArn ? "https" : "http"}://${lb.DNSName}`,
+        };
+      });
+
+      const serviceInput = (
+        news: ServiceProps,
+        output?: Service["Attributes"],
+      ) => ({
+        cluster: clusterArnOf(news.cluster),
+        service: output?.serviceName,
+        serviceName: output?.serviceName,
+        taskDefinition: news.task.taskDefinitionArn,
+        desiredCount: news.desiredCount ?? 1,
+        launchType: "FARGATE" as const,
+        platformVersion: news.platformVersion,
+        deploymentConfiguration: news.deploymentConfiguration,
+        healthCheckGracePeriodSeconds: news.healthCheckGracePeriodSeconds,
+        networkConfiguration: {
+          awsvpcConfiguration: {
+            subnets: news.subnets,
+            securityGroups: news.securityGroups,
+            assignPublicIp: news.assignPublicIp ? "ENABLED" : "DISABLED",
+          },
+        },
+      });
+
+      return {
+        stables: ["serviceArn", "serviceName", "clusterArn"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toServiceName(id, olds ?? {})) !==
+            (yield* toServiceName(id, news ?? {}))
+          ) {
+            return { action: "replace", deleteFirst: true } as const;
+          }
+          if (
+            !deepEqual(
+              {
+                cluster: olds.cluster,
+                vpcId: olds.vpcId,
+                subnets: olds.subnets,
+                securityGroups: olds.securityGroups ?? [],
+                assignPublicIp: olds.assignPublicIp ?? false,
+                public: olds.public ?? false,
+                listenerPort: olds.listenerPort,
+                certificateArn: olds.certificateArn,
+                healthCheckPath: olds.healthCheckPath,
+              },
+              {
+                cluster: news.cluster,
+                vpcId: news.vpcId,
+                subnets: news.subnets,
+                securityGroups: news.securityGroups ?? [],
+                assignPublicIp: news.assignPublicIp ?? false,
+                public: news.public ?? false,
+                listenerPort: news.listenerPort,
+                certificateArn: news.certificateArn,
+                healthCheckPath: news.healthCheckPath,
+              },
+            )
+          ) {
+            return { action: "replace", deleteFirst: true } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const serviceName =
+            output?.serviceName ?? (yield* toServiceName(id, olds ?? {}));
+          const described = yield* ecs
+            .describeServices({
+              cluster: output?.clusterArn ?? clusterArnOf(olds!.cluster),
+              services: [serviceName],
+              include: ["TAGS"],
+            })
+            .pipe(
+              Effect.catchTag("ClusterNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const service = described?.services?.[0];
+          if (!service?.serviceArn) {
+            return undefined;
+          }
+          return {
+            ...output!,
+            serviceArn: service.serviceArn as ServiceArn,
+            serviceName: service.serviceName!,
+            clusterArn: service.clusterArn as ClusterArn,
+            taskDefinitionArn: service.taskDefinition!,
+            status: service.status ?? "ACTIVE",
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const serviceName = yield* toServiceName(id, news);
+          const clusterArn = clusterArnOf(news.cluster) as ClusterArn;
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — describe service in target cluster. The cluster may
+          // not yet exist on first reconcile, so we tolerate
+          // `ClusterNotFoundException`.
+          const described = yield* ecs
+            .describeServices({
+              cluster: clusterArn,
+              services: [serviceName],
+              include: ["TAGS"],
+            })
+            .pipe(
+              Effect.catchTag("ClusterNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const observed = described?.services?.find(
+            (s) =>
+              s.serviceName === serviceName &&
+              s.status !== "INACTIVE" &&
+              s.status !== "DRAINING",
+          );
+
+          // Ensure — create if missing. Provision public ingress if
+          // requested and not already in `output`. Replacement (e.g. cluster
+          // change) is handled by diff returning `{ action: "replace" }`,
+          // so within reconcile we trust `output` for ingress identity.
+          let ingress:
+            | {
+                loadBalancerArn?: string;
+                targetGroupArn?: string;
+                listenerArn?: string;
+                url?: string;
+              }
+            | undefined = output?.targetGroupArn
+            ? {
+                loadBalancerArn: output.loadBalancerArn,
+                targetGroupArn: output.targetGroupArn,
+                listenerArn: output.listenerArn,
+                url: output.url,
+              }
+            : undefined;
+
+          if (!observed?.serviceArn) {
+            if (news.public && !ingress) {
+              ingress = yield* createIngress({ id, news });
+            }
+
+            const created = yield* ecs.createService({
+              ...serviceInput(news),
+              serviceName,
+              cluster: clusterArn,
+              loadBalancers: ingress
+                ? [
+                    {
+                      targetGroupArn: ingress.targetGroupArn!,
+                      containerName: news.task.containerName,
+                      containerPort: news.task.port ?? 3000,
+                    },
+                  ]
+                : undefined,
+              tags: toEcsTags(desiredTags),
+              enableECSManagedTags: true,
+            });
+            const service = created.service;
+            if (!service?.serviceArn) {
+              return yield* Effect.die(
+                new Error("createService returned no service"),
+              );
+            }
+            yield* session.note(service.serviceArn);
+            return {
+              serviceArn: service.serviceArn as ServiceArn,
+              serviceName: service.serviceName!,
+              clusterArn: service.clusterArn as ClusterArn,
+              taskDefinitionArn: service.taskDefinition!,
+              status: service.status ?? "ACTIVE",
+              url: ingress?.url,
+              loadBalancerArn: ingress?.loadBalancerArn,
+              targetGroupArn: ingress?.targetGroupArn,
+              listenerArn: ingress?.listenerArn,
+            };
+          }
+
+          // Sync — apply mutable fields (taskDefinition, desiredCount,
+          // network, deployment) via updateService with a forced new
+          // deployment.
+          const updated = yield* ecs.updateService({
+            ...serviceInput(news, output),
+            service: serviceName,
+            cluster: clusterArn,
+            loadBalancers: ingress?.targetGroupArn
+              ? [
+                  {
+                    targetGroupArn: ingress.targetGroupArn,
+                    containerName: news.task.containerName,
+                    containerPort: news.task.port ?? 3000,
+                  },
+                ]
+              : undefined,
+            forceNewDeployment: true,
+          });
+          const service = updated.service;
+          yield* session.note(observed.serviceArn);
+          return {
+            serviceArn: observed.serviceArn as ServiceArn,
+            serviceName: observed.serviceName!,
+            clusterArn: observed.clusterArn as ClusterArn,
+            taskDefinitionArn:
+              service?.taskDefinition ??
+              observed.taskDefinition ??
+              output?.taskDefinitionArn ??
+              "",
+            status: service?.status ?? observed.status ?? "ACTIVE",
+            url: ingress?.url,
+            loadBalancerArn: ingress?.loadBalancerArn,
+            targetGroupArn: ingress?.targetGroupArn,
+            listenerArn: ingress?.listenerArn,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* ecs
+            .updateService({
+              cluster: output.clusterArn,
+              service: output.serviceName,
+              desiredCount: 0,
+            })
+            .pipe(
+              Effect.catchTag("ServiceNotFoundException", () => Effect.void),
+              Effect.catchTag("ClusterNotFoundException", () => Effect.void),
+            );
+
+          yield* ecs
+            .deleteService({
+              cluster: output.clusterArn,
+              service: output.serviceName,
+              force: true,
+            })
+            .pipe(
+              Effect.catchTag("ServiceNotFoundException", () => Effect.void),
+              Effect.catchTag("ClusterNotFoundException", () => Effect.void),
+            );
+
+          if (output.listenerArn) {
+            yield* elbv2
+              .deleteListener({
+                ListenerArn: output.listenerArn,
+              })
+              .pipe(
+                Effect.catchTag("ListenerNotFoundException", () => Effect.void),
+              );
+          }
+          if (output.targetGroupArn) {
+            yield* elbv2
+              .deleteTargetGroup({
+                TargetGroupArn: output.targetGroupArn,
+              })
+              .pipe(Effect.catch(() => Effect.void));
+          }
+          if (output.loadBalancerArn) {
+            yield* elbv2
+              .deleteLoadBalancer({
+                LoadBalancerArn: output.loadBalancerArn,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "LoadBalancerNotFoundException",
+                  () => Effect.void,
+                ),
+              );
+          }
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/StopTask.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/StopTask.ts
new file mode 100644
index 00000000000..e870c23ccf8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/StopTask.ts
@@ -0,0 +1,64 @@
+import * as ECS from "@distilled.cloud/aws/ecs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { isTask } from "./Task.ts";
+import type { Cluster } from "./Cluster.ts";
+
+export interface StopTaskRequest extends Omit<ECS.StopTaskRequest, "cluster"> {}
+
+export class StopTask extends Binding.Service<
+  StopTask,
+  (
+    cluster: Cluster,
+  ) => Effect.Effect<
+    (
+      request: StopTaskRequest,
+    ) => Effect.Effect<ECS.StopTaskResponse, ECS.StopTaskError>
+  >
+>()("AWS.ECS.StopTask") {}
+
+export const StopTaskLive = Layer.effect(
+  StopTask,
+  Effect.gen(function* () {
+    const Policy = yield* StopTaskPolicy;
+    const stopTask = yield* ECS.stopTask;
+
+    return Effect.fn(function* (cluster: Cluster) {
+      yield* Policy(cluster);
+      const clusterArn = (yield* cluster.clusterArn) as unknown as string;
+      return Effect.fn(function* (request: StopTaskRequest) {
+        return yield* stopTask({
+          ...request,
+          cluster: clusterArn,
+        });
+      });
+    });
+  }),
+);
+
+export class StopTaskPolicy extends Binding.Policy<
+  StopTaskPolicy,
+  (cluster: Cluster) => Effect.Effect<void>
+>()("AWS.ECS.StopTask") {}
+
+export const StopTaskPolicyLive = StopTaskPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster) {
+    if (isFunction(host) || isTask(host)) {
+      yield* host.bind`Allow(${host}, AWS.ECS.StopTask(${cluster}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["ecs:StopTask"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `StopTaskPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Task.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Task.ts
new file mode 100644
index 00000000000..c8af60f27ec
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/Task.ts
@@ -0,0 +1,951 @@
+import * as logs from "@distilled.cloud/aws/cloudwatch-logs";
+import * as ecr from "@distilled.cloud/aws/ecr";
+import * as ecs from "@distilled.cloud/aws/ecs";
+import * as iam from "@distilled.cloud/aws/iam";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import type * as rolldown from "rolldown";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import {
+  dockerBuild,
+  materializeDockerfile,
+  pushImage,
+  writeContextFiles,
+} from "../../Bundle/Docker.ts";
+import {
+  findCwdForBundle,
+  getStableContextDir,
+} from "../../Bundle/TempRoot.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Output from "../../Output.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import type { ProcessContext, ServerHost } from "../../Server/Process.ts";
+import { Stack } from "../../Stack.ts";
+import { createInternalTags, createTagsList, hasTags } from "../../Tags.ts";
+import type { Credentials } from "../Credentials.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
+
+export const isTask = (value: any): value is Task => {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "Type" in value &&
+    value.Type === "AWS.ECS.Task"
+  );
+};
+
+export class TaskEnvironment extends Context.Service<
+  TaskEnvironment,
+  Record<string, any>
+>()("AWS.ECS.TaskEnvironment") {}
+
+export interface TaskProps extends PlatformProps {
+  /**
+   * Module entrypoint for the bundled task program. This should typically be
+   * `import.meta.filename` from an inline Effect program.
+   */
+  main: string;
+  /**
+   * Named export to load from `main`.
+   * @default "default"
+   */
+  handler?: string;
+  /**
+   * ECS task family. If omitted, a unique family is generated.
+   */
+  taskName?: string;
+  /**
+   * Task-level cpu configuration for Fargate.
+   * @default 256
+   */
+  cpu?: number;
+  /**
+   * Task-level memory configuration for Fargate.
+   * @default 512
+   */
+  memory?: number;
+  /**
+   * HTTP port exposed by the container.
+   * @default 3000
+   */
+  port?: number;
+  /**
+   * Additional environment variables for the container.
+   */
+  env?: Record<string, any>;
+  /**
+   * Bundler configuration for the task entrypoint.
+   */
+  build?: {
+    input?: Partial<rolldown.InputOptions>;
+    output?: Partial<rolldown.OutputOptions>;
+  };
+  /**
+   * Docker image build: optional full {@link docker.dockerfile}. When omitted,
+   * Alchemy generates a Dockerfile for the bundled `index.mjs`.
+   */
+  docker?: {
+    /**
+     * Base image when Alchemy generates the Dockerfile.
+     * @default public.ecr.aws/docker/library/bun:1
+     */
+    base?: string;
+    /** Full Dockerfile content (replaces generated Dockerfile). */
+    dockerfile?: string;
+  };
+  /**
+   * Container definition overrides applied after Alchemy's defaults.
+   */
+  container?: Partial<ecs.ContainerDefinition>;
+  /**
+   * Additional task definition overrides.
+   */
+  taskDefinition?: Partial<
+    Omit<
+      ecs.RegisterTaskDefinitionRequest,
+      | "family"
+      | "containerDefinitions"
+      | "executionRoleArn"
+      | "taskRoleArn"
+      | "cpu"
+      | "memory"
+      | "networkMode"
+      | "requiresCompatibilities"
+    >
+  >;
+  /**
+   * Additional managed policy ARNs for the task role.
+   */
+  taskRoleManagedPolicyArns?: string[];
+  /**
+   * Additional managed policy ARNs for the execution role.
+   */
+  executionRoleManagedPolicyArns?: string[];
+  /**
+   * User-defined tags to apply to task-owned resources.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Task extends Resource<
+  "AWS.ECS.Task",
+  TaskProps,
+  {
+    taskDefinitionArn: string;
+    taskFamily: string;
+    containerName: string;
+    port: number;
+    imageUri: string;
+    repositoryName: string;
+    repositoryUri: string;
+    taskRoleArn: string;
+    taskRoleName: string;
+    executionRoleArn: string;
+    executionRoleName: string;
+    logGroupName: string;
+    logGroupArn: string;
+    code: {
+      hash: string;
+    };
+  },
+  {
+    env?: Record<string, any>;
+    policyStatements?: PolicyStatement[];
+  },
+  Providers
+> {}
+
+export type TaskServices = Credentials | Region | ServerHost;
+
+export type TaskShape = Main<TaskServices>;
+
+export interface TaskRuntimeContext extends ProcessContext {
+  readonly Type: "AWS.ECS.Task";
+}
+
+export const Task: Platform<Task, TaskServices, TaskShape, TaskRuntimeContext> =
+  Platform("AWS.ECS.Task", {
+    createRuntimeContext: (id): TaskRuntimeContext => {
+      const runners: Effect.Effect<void, never, any>[] = [];
+      const env: Record<string, any> = {};
+
+      return {
+        Type: "AWS.ECS.Task",
+        id,
+        env,
+        set: (bindingId: string, output: Output.Output) =>
+          Effect.sync(() => {
+            const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
+            env[key] = output.pipe(
+              Output.map((value) => JSON.stringify(value)),
+            );
+            return key;
+          }),
+        get: <T>(key: string) =>
+          Config.string(key).pipe(
+            Effect.flatMap((value) =>
+              Effect.try({
+                try: () => JSON.parse(value) as T,
+                catch: (error) => error as Error,
+              }),
+            ),
+            Effect.catch((cause) =>
+              Effect.die(
+                new Error(`Failed to get environment variable: ${key}`, {
+                  cause,
+                }),
+              ),
+            ),
+          ),
+        run: (effect: Effect.Effect<void, never, any>) =>
+          Effect.sync(() => {
+            runners.push(effect);
+          }),
+      };
+    },
+  });
+
+export const TaskProvider = () =>
+  Provider.effect(
+    Task,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const { accountId } = yield* AWSEnvironment;
+      const region = yield* Region;
+      const { dotAlchemy } = yield* AlchemyContext;
+      const fs = yield* FileSystem.FileSystem;
+      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+
+      const alchemyEnv = {
+        ALCHEMY_STACK_NAME: stack.name,
+        ALCHEMY_STAGE: stack.stage,
+        ALCHEMY_PHASE: "runtime",
+      };
+
+      const toTaskFamily = (id: string, props: { taskName?: string } = {}) =>
+        props.taskName
+          ? Effect.succeed(props.taskName)
+          : createPhysicalName({
+              id,
+              maxLength: 255,
+              lowercase: true,
+            });
+
+      const createRoleName = (id: string, suffix: string) =>
+        createPhysicalName({
+          id: `${id}-${suffix}`,
+          maxLength: 64,
+        });
+
+      const createPolicyName = (id: string, suffix: string) =>
+        createPhysicalName({
+          id: `${id}-${suffix}`,
+          maxLength: 128,
+        });
+
+      const createRepositoryName = (id: string) =>
+        createPhysicalName({
+          id: `${id}-repo`,
+          maxLength: 256,
+          lowercase: true,
+        });
+
+      const createLogGroupName = (id: string) =>
+        createPhysicalName({
+          id: `${id}-logs`,
+          maxLength: 512,
+          lowercase: true,
+        });
+
+      const createTaskRoleIfNotExists = Effect.fn(function* ({
+        id,
+        roleName,
+      }: {
+        id: string;
+        roleName: string;
+      }) {
+        const tags = yield* createInternalTags(id);
+        const role = yield* iam
+          .createRole({
+            RoleName: roleName,
+            AssumeRolePolicyDocument: JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Principal: {
+                    Service: "ecs-tasks.amazonaws.com",
+                  },
+                  Action: "sts:AssumeRole",
+                },
+              ],
+            }),
+            Tags: createTagsList(tags),
+          })
+          .pipe(
+            Effect.catchTag("EntityAlreadyExistsException", () =>
+              iam.getRole({ RoleName: roleName }).pipe(
+                Effect.filterOrFail(
+                  (existing) => hasTags(tags, existing.Role?.Tags),
+                  () =>
+                    new Error(
+                      `Role '${roleName}' already exists and is not managed by alchemy`,
+                    ),
+                ),
+              ),
+            ),
+          );
+        return role.Role!.Arn!;
+      });
+
+      const ensureExecutionRole = Effect.fn(function* ({
+        id,
+        roleName,
+        managedPolicyArns,
+      }: {
+        id: string;
+        roleName: string;
+        managedPolicyArns?: string[];
+      }) {
+        const roleArn = yield* createTaskRoleIfNotExists({ id, roleName });
+        const policies = [
+          "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+          ...(managedPolicyArns ?? []),
+        ];
+        for (const policyArn of policies) {
+          yield* iam
+            .attachRolePolicy({
+              RoleName: roleName,
+              PolicyArn: policyArn,
+            })
+            .pipe(Effect.catchTag("LimitExceededException", () => Effect.void));
+        }
+        return roleArn;
+      });
+
+      const ensureRepository = Effect.fn(function* ({
+        repositoryName,
+        tags,
+      }: {
+        id: string;
+        repositoryName: string;
+        tags: Record<string, string>;
+      }) {
+        const created = yield* ecr
+          .createRepository({
+            repositoryName,
+            imageTagMutability: "MUTABLE",
+            imageScanningConfiguration: {
+              scanOnPush: true,
+            },
+            tags: Object.entries(tags).map(([Key, Value]) => ({ Key, Value })),
+          })
+          .pipe(
+            Effect.catchTag("RepositoryAlreadyExistsException", () =>
+              Effect.gen(function* () {
+                const existing = yield* ecr.describeRepositories({
+                  repositoryNames: [repositoryName],
+                });
+                return {
+                  repository: existing.repositories?.[0],
+                };
+              }),
+            ),
+          );
+        const repository = created.repository;
+        if (!repository?.repositoryUri || !repository.repositoryArn) {
+          return yield* Effect.die(
+            new Error(`Failed to resolve ECR repository '${repositoryName}'`),
+          );
+        }
+        return {
+          repositoryUri: repository.repositoryUri,
+          repositoryArn: repository.repositoryArn,
+        };
+      });
+
+      const ensureLogGroup = Effect.fn(function* ({
+        id,
+        logGroupName,
+      }: {
+        id: string;
+        logGroupName: string;
+      }) {
+        const tags = yield* createInternalTags(id);
+        yield* logs
+          .createLogGroup({
+            logGroupName,
+            tags,
+          })
+          .pipe(
+            Effect.catchTag(
+              "ResourceAlreadyExistsException",
+              () => Effect.void,
+            ),
+          );
+        return `arn:aws:logs:${region}:${accountId}:log-group:${logGroupName}`;
+      });
+
+      const attachBindings = Effect.fn(function* ({
+        roleName,
+        policyName,
+        bindings,
+      }: {
+        roleName: string;
+        policyName: string;
+        bindings: ResourceBinding<Task["Binding"]>[];
+      }) {
+        const activeBindings = bindings.filter(
+          (binding: ResourceBinding<Task["Binding"]> & { action?: string }) =>
+            binding.action !== "delete",
+        );
+
+        const env = activeBindings
+          .map((binding) => binding?.data?.env)
+          .reduce((acc, value) => ({ ...acc, ...value }), {});
+
+        const policyStatements = activeBindings.flatMap(
+          (binding) =>
+            binding?.data?.policyStatements?.map((statement) => ({
+              ...statement,
+              Sid: statement.Sid?.replace(/[^A-Za-z0-9]+/gi, ""),
+            })) ?? [],
+        );
+
+        if (policyStatements.length > 0) {
+          yield* iam.putRolePolicy({
+            RoleName: roleName,
+            PolicyName: policyName,
+            PolicyDocument: JSON.stringify({
+              Version: "2012-10-17",
+              Statement: policyStatements,
+            }),
+          });
+        } else {
+          yield* iam
+            .deleteRolePolicy({
+              RoleName: roleName,
+              PolicyName: policyName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+
+        return env;
+      });
+
+      const decodeAuthorizationToken = (token: string) => {
+        const decoded = Buffer.from(token, "base64").toString("utf8");
+        const [, password] = decoded.split(":", 2);
+        return password;
+      };
+
+      const bundleProgram = Effect.fn(function* (id: string, props: TaskProps) {
+        const handler = props.handler ?? "default";
+        const realMain = yield* fs.realPath(props.main);
+        const cwd = yield* findCwdForBundle(realMain);
+
+        const buildBundle = Effect.fnUntraced(function* (
+          entry: string,
+          plugins?: rolldown.RolldownPluginOption,
+        ) {
+          return yield* Bundle.build(
+            {
+              ...props.build?.input,
+              input: entry,
+              cwd,
+              platform: "node",
+              plugins: [props.build?.input?.plugins, plugins],
+            },
+            {
+              ...props.build?.output,
+              format: "esm",
+              sourcemap: props.build?.output?.sourcemap ?? false,
+              minify: props.build?.output?.minify ?? true,
+              entryFileNames: "index.js",
+            },
+          );
+        });
+
+        const bundleOutput = props.isExternal
+          ? yield* buildBundle(realMain)
+          : yield* buildBundle(
+              realMain,
+              virtualEntryPlugin(
+                (importPath) => `
+import { NodeServices } from "@effect/platform-node";
+import { Stack } from "alchemy/Stack";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Credentials from "@distilled.cloud/aws/Credentials";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Region from "@distilled.cloud/aws/Region";
+
+import { ${handler} as handler } from ${JSON.stringify(importPath)};
+
+const platform = Layer.mergeAll(
+  NodeServices.layer,
+  FetchHttpClient.layer,
+  Logger.layer([Logger.consolePretty()]),
+);
+
+const program = handler.pipe(
+  Effect.flatMap((task) => task.RuntimeContext.exports.program),
+  Effect.provide(
+    Layer.effect(
+      Stack,
+      Effect.all([
+        Config.string("ALCHEMY_STACK_NAME"),
+        Config.string("ALCHEMY_STAGE")
+      ]).pipe(
+        Effect.map(([name, stage]) => ({
+          name,
+          stage,
+          bindings: {},
+          resources: {}
+        }))
+      )
+    ).pipe(
+      Layer.provideMerge(Credentials.fromEnv()),
+      Layer.provideMerge(Region.fromEnv()),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          ConfigProvider.fromEnv()
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+await Effect.runPromise(program);
+`,
+              ),
+            );
+
+        const mainFile = bundleOutput.files[0];
+        const code =
+          typeof mainFile.content === "string"
+            ? new TextEncoder().encode(mainFile.content)
+            : mainFile.content;
+
+        return { code, hash: bundleOutput.hash };
+      });
+
+      const buildAndPushImage = Effect.fn(function* ({
+        id,
+        repositoryUri,
+        hash,
+        code,
+        props,
+      }: {
+        id: string;
+        repositoryUri: string;
+        hash: string;
+        code: Uint8Array<ArrayBufferLike>;
+        props: TaskProps;
+      }) {
+        const realMain = yield* fs.realPath(props.main);
+        const contextDir = yield* getStableContextDir(
+          realMain,
+          dotAlchemy,
+          `${id}-image`,
+        );
+        const imageUri = `${repositoryUri}:${hash}`;
+
+        const generatedDockerfile = (() => {
+          const base =
+            props.docker?.base ?? "public.ecr.aws/docker/library/bun:1";
+          const lines = [
+            `FROM ${base}`,
+            `WORKDIR /app`,
+            `COPY index.mjs /app/index.mjs`,
+          ];
+          if (props.port !== undefined) {
+            lines.push(
+              `ENV PORT=${String(props.port)}`,
+              `EXPOSE ${String(props.port)}`,
+            );
+          }
+          lines.push(`ENTRYPOINT ["bun", "/app/index.mjs"]`);
+          return `${lines.join("\n")}\n`;
+        })();
+
+        const dockerfile = props.docker?.dockerfile ?? generatedDockerfile;
+
+        const auth = yield* ecr.getAuthorizationToken({});
+        const credentials = auth.authorizationData?.[0];
+        if (!credentials?.authorizationToken || !credentials.proxyEndpoint) {
+          return yield* Effect.die(
+            new Error("Failed to get ECR authorization token"),
+          );
+        }
+        const password = decodeAuthorizationToken(
+          credentials.authorizationToken,
+        );
+        const registry = credentials.proxyEndpoint.replace(/^https?:\/\//, "");
+
+        yield* materializeDockerfile(dockerfile, contextDir);
+        yield* writeContextFiles(contextDir, [
+          { path: "index.mjs", content: code },
+        ]);
+        yield* dockerBuild({
+          tag: imageUri,
+          context: contextDir,
+        });
+        yield* pushImage(imageUri, {
+          username: "AWS",
+          password,
+          server: registry,
+        });
+
+        return imageUri;
+      });
+
+      const registerTaskDefinition = Effect.fn(function* ({
+        props,
+        family,
+        imageUri,
+        taskRoleArn,
+        executionRoleArn,
+        logGroupName,
+      }: {
+        props: TaskProps;
+        family: string;
+        imageUri: string;
+        taskRoleArn: string;
+        executionRoleArn: string;
+        logGroupName: string;
+      }) {
+        const containerName = props.container?.name ?? family;
+        const response = yield* ecs.registerTaskDefinition({
+          family,
+          taskRoleArn,
+          executionRoleArn,
+          networkMode: "awsvpc",
+          requiresCompatibilities: ["FARGATE"],
+          cpu: String(props.cpu ?? 256),
+          memory: String(props.memory ?? 512),
+          ...props.taskDefinition,
+          containerDefinitions: [
+            {
+              essential: true,
+              name: containerName,
+              image: imageUri,
+              portMappings:
+                props.port !== undefined
+                  ? [
+                      {
+                        containerPort: props.port,
+                        hostPort: props.port,
+                        protocol: "tcp",
+                      },
+                    ]
+                  : undefined,
+              environment: Object.entries(props.env ?? {}).map(
+                ([name, value]) => ({
+                  name,
+                  value:
+                    typeof value === "string" ? value : JSON.stringify(value),
+                }),
+              ),
+              logConfiguration: {
+                logDriver: "awslogs",
+                options: {
+                  "awslogs-group": logGroupName,
+                  "awslogs-region": region,
+                  "awslogs-stream-prefix": family,
+                },
+              },
+              ...props.container,
+            },
+          ],
+        });
+        const taskDefinition = response.taskDefinition;
+        if (!taskDefinition?.taskDefinitionArn) {
+          return yield* Effect.die(
+            new Error("registerTaskDefinition returned no task definition"),
+          );
+        }
+        return taskDefinition;
+      });
+
+      return {
+        stables: [
+          "repositoryName",
+          "repositoryUri",
+          "taskRoleArn",
+          "taskRoleName",
+          "executionRoleArn",
+          "executionRoleName",
+          "logGroupName",
+          "logGroupArn",
+          "taskFamily",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toTaskFamily(id, olds ?? {})) !==
+            (yield* toTaskFamily(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const family =
+            output?.taskFamily ?? (yield* toTaskFamily(id, olds ?? {}));
+          const described = yield* ecs
+            .describeTaskDefinition({
+              taskDefinition: output?.taskDefinitionArn ?? family,
+            })
+            .pipe(
+              Effect.catchTag("ClientException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const taskDefinition = described?.taskDefinition;
+          if (!taskDefinition?.taskDefinitionArn) {
+            return undefined;
+          }
+          if (!output) {
+            return undefined;
+          }
+          return {
+            ...output,
+            taskDefinitionArn: taskDefinition.taskDefinitionArn,
+            taskFamily: taskDefinition.family ?? family,
+            containerName:
+              taskDefinition.containerDefinitions?.[0]?.name ??
+              output.containerName,
+            port:
+              taskDefinition.containerDefinitions?.[0]?.portMappings?.[0]
+                ?.containerPort ?? output.port,
+          };
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          bindings,
+          output,
+          session,
+        }) {
+          const family = yield* toTaskFamily(id, news);
+          const taskRoleName =
+            output?.taskRoleName ?? (yield* createRoleName(id, "task-role"));
+          const executionRoleName =
+            output?.executionRoleName ??
+            (yield* createRoleName(id, "execution-role"));
+          const taskPolicyName = yield* createPolicyName(id, "task-policy");
+          const repositoryName =
+            output?.repositoryName ?? (yield* createRepositoryName(id));
+          const logGroupName =
+            output?.logGroupName ?? (yield* createLogGroupName(id));
+          const tags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Ensure roles, repository, and log group. Each helper is
+          // idempotent (creates on miss, adopts on race) so the same
+          // sequence runs on initial create, adoption, or update.
+          const taskRoleArn =
+            output?.taskRoleArn ??
+            (yield* createTaskRoleIfNotExists({ id, roleName: taskRoleName }));
+          const executionRoleArn =
+            output?.executionRoleArn ??
+            (yield* ensureExecutionRole({
+              id,
+              roleName: executionRoleName,
+              managedPolicyArns: news.executionRoleManagedPolicyArns,
+            }));
+
+          for (const policyArn of news.taskRoleManagedPolicyArns ?? []) {
+            yield* iam
+              .attachRolePolicy({
+                RoleName: taskRoleName,
+                PolicyArn: policyArn,
+              })
+              .pipe(
+                Effect.catchTag("LimitExceededException", () => Effect.void),
+              );
+          }
+
+          const bindingEnv = yield* attachBindings({
+            roleName: taskRoleName,
+            policyName: taskPolicyName,
+            bindings,
+          });
+
+          const { repositoryUri } =
+            output?.repositoryUri && output?.repositoryName === repositoryName
+              ? {
+                  repositoryUri: output.repositoryUri,
+                }
+              : yield* ensureRepository({
+                  id,
+                  repositoryName,
+                  tags,
+                });
+          const logGroupArn =
+            output?.logGroupArn ??
+            (yield* ensureLogGroup({
+              id,
+              logGroupName,
+            }));
+
+          // Build, push, and register a new task definition revision. Task
+          // definitions are versioned in AWS, so registering a new revision
+          // is the unit of "update" — the prior revision is deregistered
+          // only on `delete` of the resource.
+          const { code, hash } = yield* bundleProgram(id, news);
+          const imageUri = yield* buildAndPushImage({
+            id,
+            repositoryUri,
+            hash,
+            code,
+            props: {
+              ...news,
+              env: {
+                ...bindingEnv,
+                ...alchemyEnv,
+                ...news.env,
+              },
+            },
+          });
+          const taskDefinition = yield* registerTaskDefinition({
+            props: {
+              ...news,
+              env: {
+                ...bindingEnv,
+                ...alchemyEnv,
+                ...news.env,
+              },
+            },
+            family,
+            imageUri,
+            taskRoleArn,
+            executionRoleArn,
+            logGroupName,
+          });
+
+          yield* session.note(taskDefinition.taskDefinitionArn!);
+          return {
+            taskDefinitionArn: taskDefinition.taskDefinitionArn!,
+            taskFamily: family,
+            containerName:
+              taskDefinition.containerDefinitions?.[0]?.name ?? family,
+            port: news.port ?? output?.port ?? 3000,
+            imageUri,
+            repositoryName,
+            repositoryUri,
+            taskRoleArn,
+            taskRoleName,
+            executionRoleArn,
+            executionRoleName,
+            logGroupName,
+            logGroupArn,
+            code: {
+              hash,
+            },
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* ecs
+            .deregisterTaskDefinition({
+              taskDefinition: output.taskDefinitionArn,
+            })
+            .pipe(Effect.catchTag("ClientException", () => Effect.void));
+
+          yield* ecr
+            .deleteRepository({
+              repositoryName: output.repositoryName,
+              force: true,
+            })
+            .pipe(
+              Effect.catchTag("RepositoryNotFoundException", () => Effect.void),
+            );
+
+          yield* logs
+            .deleteLogGroup({
+              logGroupName: output.logGroupName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+
+          yield* iam
+            .listRolePolicies({
+              RoleName: output.taskRoleName,
+            })
+            .pipe(
+              Effect.flatMap((policies) =>
+                Effect.all(
+                  (policies.PolicyNames ?? []).map((policyName) =>
+                    iam
+                      .deleteRolePolicy({
+                        RoleName: output.taskRoleName,
+                        PolicyName: policyName,
+                      })
+                      .pipe(
+                        Effect.catchTag(
+                          "NoSuchEntityException",
+                          () => Effect.void,
+                        ),
+                      ),
+                  ),
+                ),
+              ),
+            );
+
+          for (const roleName of [
+            output.taskRoleName,
+            output.executionRoleName,
+          ]) {
+            yield* iam
+              .listAttachedRolePolicies({
+                RoleName: roleName,
+              })
+              .pipe(
+                Effect.flatMap((policies) =>
+                  Effect.all(
+                    (policies.AttachedPolicies ?? []).map((policy) =>
+                      iam
+                        .detachRolePolicy({
+                          RoleName: roleName,
+                          PolicyArn: policy.PolicyArn!,
+                        })
+                        .pipe(
+                          Effect.catchTag(
+                            "NoSuchEntityException",
+                            () => Effect.void,
+                          ),
+                        ),
+                    ),
+                  ),
+                ),
+              );
+            yield* iam
+              .deleteRole({
+                RoleName: roleName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/index.ts
new file mode 100644
index 00000000000..a1525ecf989
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ECS/index.ts
@@ -0,0 +1,32 @@
+export {
+  CapacityProvider,
+  CapacityProviderProvider,
+} from "./CapacityProvider.ts";
+export { Cluster, ClusterProvider } from "./Cluster.ts";
+export {
+  DescribeTasks,
+  DescribeTasksLive,
+  DescribeTasksPolicy,
+  DescribeTasksPolicyLive,
+} from "./DescribeTasks.ts";
+export {
+  ListTasks,
+  ListTasksLive,
+  ListTasksPolicy,
+  ListTasksPolicyLive,
+} from "./ListTasks.ts";
+export {
+  RunTask,
+  RunTaskLive,
+  RunTaskPolicy,
+  RunTaskPolicyLive,
+} from "./RunTask.ts";
+export { every } from "./Schedule.ts";
+export { Service, ServiceProvider } from "./Service.ts";
+export {
+  StopTask,
+  StopTaskLive,
+  StopTaskPolicy,
+  StopTaskPolicyLive,
+} from "./StopTask.ts";
+export { isTask, Task, TaskProvider } from "./Task.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/AccessEntry.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/AccessEntry.ts
new file mode 100644
index 00000000000..7b26a640ef4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/AccessEntry.ts
@@ -0,0 +1,361 @@
+import * as eks from "@distilled.cloud/aws/eks";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+
+export interface AccessPolicyAssociation {
+  /**
+   * ARN of the AWS-managed EKS access policy.
+   */
+  policyArn: string;
+  /**
+   * Scope the policy applies to.
+   */
+  accessScope: eks.AccessScope;
+}
+
+export interface AccessEntryProps {
+  /**
+   * Target cluster name.
+   */
+  clusterName: Input<string>;
+  /**
+   * IAM principal ARN to grant access to.
+   */
+  principalArn: Input<string>;
+  /**
+   * Optional Kubernetes groups for the principal.
+   */
+  kubernetesGroups?: string[];
+  /**
+   * Optional username to map inside Kubernetes.
+   */
+  username?: string;
+  /**
+   * Entry type, such as `STANDARD`.
+   */
+  type?: string;
+  /**
+   * Exact set of EKS access policies associated with this entry.
+   */
+  accessPolicies?: AccessPolicyAssociation[];
+  /**
+   * User-defined tags to apply to the access entry.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface AccessEntry extends Resource<
+  "AWS.EKS.AccessEntry",
+  AccessEntryProps,
+  {
+    accessEntryArn: string;
+    clusterName: string;
+    principalArn: string;
+    kubernetesGroups: string[];
+    username: string | undefined;
+    type: string | undefined;
+    accessPolicies: AccessPolicyAssociation[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon EKS access entry that grants an IAM principal access to a cluster.
+ *
+ * `AccessEntry` owns both the entry itself and the exact set of associated EKS
+ * access policies, making cluster access explicit and updatable after initial
+ * cluster bootstrap.
+ *
+ * @section Managing Cluster Access
+ * @example Grant Read Access to a Role
+ * ```typescript
+ * const viewer = yield* AccessEntry("ViewerAccess", {
+ *   clusterName: cluster.clusterName,
+ *   principalArn: viewerRole.roleArn,
+ *   accessPolicies: [
+ *     {
+ *       policyArn:
+ *         "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy",
+ *       accessScope: {
+ *         type: "cluster",
+ *       },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const AccessEntry = Resource<AccessEntry>("AWS.EKS.AccessEntry");
+
+export const AccessEntryProvider = () =>
+  Provider.succeed(AccessEntry, {
+    stables: ["accessEntryArn"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.clusterName !== news.clusterName) {
+        return { action: "replace" } as const;
+      }
+
+      if (olds.principalArn !== news.principalArn) {
+        return { action: "replace" } as const;
+      }
+
+      if ((olds.type ?? "STANDARD") !== (news.type ?? "STANDARD")) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ id, olds, output }) {
+      const state = yield* readAccessEntry({
+        clusterName: (output?.clusterName ?? olds.clusterName) as string,
+        principalArn: (output?.principalArn ?? olds.principalArn) as string,
+      });
+      if (!state) return undefined;
+      return (yield* hasAlchemyTags(id, state.tags)) ? state : Unowned(state);
+    }),
+    reconcile: Effect.fn(function* ({ id, news, session }) {
+      const clusterName = news.clusterName as string;
+      const principalArn = news.principalArn as string;
+      const desiredTags = {
+        ...(yield* createInternalTags(id)),
+        ...news.tags,
+      };
+
+      // Observe — fetch live cloud state by (clusterName, principalArn).
+      let state = yield* readAccessEntry({
+        clusterName,
+        principalArn,
+      });
+
+      // Ensure — create the entry if missing. Tolerate
+      // `ResourceInUseException` as a race with a peer reconciler.
+      if (!state) {
+        yield* eks
+          .createAccessEntry({
+            clusterName,
+            principalArn,
+            kubernetesGroups: news.kubernetesGroups,
+            username: news.username,
+            type: news.type,
+            tags: desiredTags,
+          })
+          .pipe(Effect.catchTag("ResourceInUseException", () => Effect.void));
+
+        state = yield* readAccessEntry({
+          clusterName,
+          principalArn,
+        });
+
+        if (!state) {
+          return yield* Effect.fail(
+            new Error(
+              `AccessEntry '${principalArn}' could not be read after creation`,
+            ),
+          );
+        }
+      }
+
+      // Sync kubernetesGroups + username — observed ↔ desired.
+      const observedGroups = state.kubernetesGroups ?? [];
+      const desiredGroups = news.kubernetesGroups ?? [];
+      if (
+        JSON.stringify(observedGroups) !== JSON.stringify(desiredGroups) ||
+        state.username !== news.username
+      ) {
+        yield* eks.updateAccessEntry({
+          clusterName,
+          principalArn,
+          kubernetesGroups: desiredGroups,
+          username: news.username,
+        });
+      }
+
+      // Sync tags — diff observed cloud tags against desired.
+      const { removed, upsert } = diffTags(state.tags, desiredTags);
+      if (upsert.length > 0) {
+        yield* eks.tagResource({
+          resourceArn: state.accessEntryArn,
+          tags: Object.fromEntries(
+            upsert.map((tag) => [tag.Key, tag.Value] as const),
+          ),
+        });
+      }
+      if (removed.length > 0) {
+        yield* eks.untagResource({
+          resourceArn: state.accessEntryArn,
+          tagKeys: removed,
+        });
+      }
+
+      // Sync access policy associations — diff observed against desired.
+      const observedPolicies = state.accessPolicies;
+      const desiredPolicies = normalizeAccessPolicies(news.accessPolicies);
+      const observedPolicyMap = new Map(
+        observedPolicies.map((policy) => [policyKey(policy), policy]),
+      );
+      const desiredPolicyMap = new Map(
+        desiredPolicies.map((policy) => [policyKey(policy), policy]),
+      );
+
+      for (const [key, policy] of desiredPolicyMap) {
+        if (!observedPolicyMap.has(key)) {
+          yield* eks.associateAccessPolicy({
+            clusterName,
+            principalArn,
+            policyArn: policy.policyArn,
+            accessScope: policy.accessScope,
+          });
+        }
+      }
+
+      for (const [key, policy] of observedPolicyMap) {
+        if (!desiredPolicyMap.has(key)) {
+          yield* eks.disassociateAccessPolicy({
+            clusterName,
+            principalArn,
+            policyArn: policy.policyArn,
+          });
+        }
+      }
+
+      yield* session.note(state.accessEntryArn);
+
+      // Re-read final state so returned attributes reflect post-sync.
+      return yield* readAccessEntry({
+        clusterName,
+        principalArn,
+      }).pipe(
+        Effect.flatMap((finalState) =>
+          finalState
+            ? Effect.succeed(finalState)
+            : Effect.fail(
+                new Error(
+                  `AccessEntry '${principalArn}' could not be read after reconcile`,
+                ),
+              ),
+        ),
+      );
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* eks
+        .deleteAccessEntry({
+          clusterName: output.clusterName,
+          principalArn: output.principalArn,
+        })
+        .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void));
+    }),
+  });
+
+const normalizeTags = (tags: Record<string, string | undefined> | undefined) =>
+  Object.fromEntries(
+    Object.entries(tags ?? {}).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined,
+    ),
+  );
+
+const comparePolicyAssociation = (
+  a: AccessPolicyAssociation,
+  b: AccessPolicyAssociation,
+) =>
+  a.policyArn.localeCompare(b.policyArn) ||
+  JSON.stringify(a.accessScope).localeCompare(JSON.stringify(b.accessScope));
+
+const normalizeAccessPolicies = (
+  policies:
+    | ReadonlyArray<AccessPolicyAssociation | eks.AssociatedAccessPolicy>
+    | undefined,
+): AccessPolicyAssociation[] =>
+  (policies ?? [])
+    .flatMap((policy) =>
+      policy.policyArn && policy.accessScope
+        ? [
+            {
+              policyArn: policy.policyArn,
+              accessScope: policy.accessScope,
+            },
+          ]
+        : [],
+    )
+    .sort(comparePolicyAssociation);
+
+const policyKey = (policy: AccessPolicyAssociation) =>
+  `${policy.policyArn}::${JSON.stringify(policy.accessScope)}`;
+
+const listAccessPolicies = Effect.fn(function* ({
+  clusterName,
+  principalArn,
+}: {
+  clusterName: string;
+  principalArn: string;
+}) {
+  const policies: AccessPolicyAssociation[] = [];
+  let nextToken: string | undefined;
+
+  while (true) {
+    const response = yield* eks.listAssociatedAccessPolicies({
+      clusterName,
+      principalArn,
+      nextToken,
+    });
+
+    policies.push(
+      ...normalizeAccessPolicies(response.associatedAccessPolicies),
+    );
+
+    if (!response.nextToken) {
+      break;
+    }
+
+    nextToken = response.nextToken;
+  }
+
+  return policies.sort(comparePolicyAssociation);
+});
+
+const readAccessEntry = Effect.fn(function* ({
+  clusterName,
+  principalArn,
+}: {
+  clusterName: string;
+  principalArn: string;
+}) {
+  const response = yield* eks
+    .describeAccessEntry({
+      clusterName,
+      principalArn,
+    })
+    .pipe(
+      Effect.catchTag("ResourceNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  const accessEntry = response?.accessEntry;
+  if (
+    !accessEntry?.accessEntryArn ||
+    !accessEntry.clusterName ||
+    !accessEntry.principalArn
+  ) {
+    return undefined;
+  }
+
+  return {
+    accessEntryArn: accessEntry.accessEntryArn,
+    clusterName: accessEntry.clusterName,
+    principalArn: accessEntry.principalArn,
+    kubernetesGroups: accessEntry.kubernetesGroups ?? [],
+    username: accessEntry.username,
+    type: accessEntry.type,
+    accessPolicies: yield* listAccessPolicies({
+      clusterName: accessEntry.clusterName,
+      principalArn: accessEntry.principalArn,
+    }),
+    tags: normalizeTags(accessEntry.tags),
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Addon.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Addon.ts
new file mode 100644
index 00000000000..90eecf53aee
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Addon.ts
@@ -0,0 +1,385 @@
+import * as eks from "@distilled.cloud/aws/eks";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+
+export interface AddonProps {
+  /**
+   * Target cluster name.
+   */
+  clusterName: Input<string>;
+  /**
+   * Add-on name, such as `metrics-server`.
+   */
+  addonName: string;
+  /**
+   * Optional add-on version. If omitted, EKS chooses the default compatible version.
+   */
+  addonVersion?: string;
+  /**
+   * IAM role ARN used by the add-on's service account.
+   */
+  serviceAccountRoleArn?: Input<string>;
+  /**
+   * Conflict resolution strategy used during create and update.
+   */
+  resolveConflicts?: eks.ResolveConflicts;
+  /**
+   * Optional add-on configuration JSON string.
+   */
+  configurationValues?: string;
+  /**
+   * Optional pod identity associations managed by the add-on.
+   */
+  podIdentityAssociations?: eks.AddonPodIdentityAssociations[];
+  /**
+   * Optional namespace override. Changing this requires replacement.
+   */
+  namespaceConfig?: eks.AddonNamespaceConfigRequest;
+  /**
+   * Preserve the add-on installation when the Alchemy resource is deleted.
+   */
+  preserveOnDelete?: boolean;
+  /**
+   * User-defined tags to apply to the add-on.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Addon extends Resource<
+  "AWS.EKS.Addon",
+  AddonProps,
+  {
+    addonArn: string;
+    addonName: string;
+    clusterName: string;
+    status: eks.AddonStatus;
+    addonVersion: string | undefined;
+    serviceAccountRoleArn: string | undefined;
+    configurationValues: string | undefined;
+    podIdentityAssociations: string[];
+    namespace: string | undefined;
+    publisher: string | undefined;
+    owner: string | undefined;
+    tags: Record<string, string>;
+    healthIssues: eks.AddonIssue[];
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon EKS managed add-on installed on a cluster.
+ *
+ * `Addon` is intended for optional managed add-ons. On Auto Mode clusters, many
+ * core components are already provided by AWS and do not need to be modeled as
+ * explicit add-on resources.
+ *
+ * @section Managing Add-ons
+ * @example Install Metrics Server
+ * ```typescript
+ * const metricsServer = yield* Addon("MetricsServer", {
+ *   clusterName: cluster.clusterName,
+ *   addonName: "metrics-server",
+ * });
+ * ```
+ */
+export const Addon = Resource<Addon>("AWS.EKS.Addon");
+
+const normalizeTags = (tags: Record<string, string | undefined> | undefined) =>
+  Object.fromEntries(
+    Object.entries(tags ?? {}).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined,
+    ),
+  );
+
+const mapAddon = (addon: eks.Addon) => ({
+  addonArn: addon.addonArn!,
+  addonName: addon.addonName!,
+  clusterName: addon.clusterName!,
+  status: addon.status ?? "CREATING",
+  addonVersion: addon.addonVersion,
+  serviceAccountRoleArn: addon.serviceAccountRoleArn,
+  configurationValues: addon.configurationValues,
+  podIdentityAssociations: addon.podIdentityAssociations ?? [],
+  namespace: addon.namespaceConfig?.namespace,
+  publisher: addon.publisher,
+  owner: addon.owner,
+  tags: normalizeTags(addon.tags),
+  healthIssues: addon.health?.issues ?? [],
+});
+
+const readAddon = Effect.fn(function* ({
+  clusterName,
+  addonName,
+}: {
+  clusterName: string;
+  addonName: string;
+}) {
+  const response = yield* eks
+    .describeAddon({
+      clusterName,
+      addonName,
+    })
+    .pipe(
+      Effect.catchTag("ResourceNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  const addon = response?.addon;
+  if (!addon?.addonArn || !addon.addonName || !addon.clusterName) {
+    return undefined;
+  }
+
+  return mapAddon(addon);
+});
+
+class AddonNotReady extends Data.TaggedError("AddonNotReady")<{
+  readonly clusterName: string;
+  readonly addonName: string;
+  readonly status: string | undefined;
+}> {}
+
+class AddonStillExists extends Data.TaggedError("AddonStillExists")<{
+  readonly clusterName: string;
+  readonly addonName: string;
+}> {}
+export const AddonProvider = () =>
+  Provider.effect(
+    Addon,
+    Effect.gen(function* () {
+      const toClientRequestToken = (id: string, action: string) =>
+        createPhysicalName({
+          id: `${id}-${action}`,
+          maxLength: 64,
+          delimiter: "-",
+        });
+
+      return {
+        stables: ["addonArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds.clusterName !== news.clusterName) {
+            return { action: "replace" } as const;
+          }
+
+          if (olds.addonName !== news.addonName) {
+            return { action: "replace" } as const;
+          }
+
+          if (!deepEqual(olds.namespaceConfig, news.namespaceConfig)) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds }) {
+          const state = yield* readAddon({
+            clusterName: olds.clusterName as string,
+            addonName: olds.addonName,
+          });
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const clusterName = news.clusterName as string;
+          const addonName = news.addonName;
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — fetch live cloud state by (clusterName, addonName).
+          let state = yield* readAddon({
+            clusterName,
+            addonName,
+          });
+
+          // Ensure — create if missing. Tolerate `ResourceInUseException`
+          // as a race with a peer reconciler: re-read and continue with
+          // sync.
+          if (!state) {
+            yield* eks
+              .createAddon({
+                clusterName,
+                addonName,
+                addonVersion: news.addonVersion,
+                serviceAccountRoleArn: news.serviceAccountRoleArn as
+                  | string
+                  | undefined,
+                resolveConflicts: news.resolveConflicts,
+                configurationValues: news.configurationValues,
+                podIdentityAssociations: news.podIdentityAssociations,
+                namespaceConfig: news.namespaceConfig,
+                tags: desiredTags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+              );
+
+            state = yield* waitForAddonActive({
+              clusterName,
+              addonName,
+            });
+          }
+
+          // Sync addon version / config — diff observed against desired.
+          // updateAddon handles version, role, resolve conflicts, config
+          // values, and pod identity associations atomically.
+          const podIdentityChanged =
+            JSON.stringify(state.podIdentityAssociations ?? []) !==
+            JSON.stringify(news.podIdentityAssociations ?? []);
+          if (
+            (news.addonVersion !== undefined &&
+              state.addonVersion !== news.addonVersion) ||
+            state.serviceAccountRoleArn !==
+              (news.serviceAccountRoleArn as string | undefined) ||
+            state.configurationValues !== news.configurationValues ||
+            podIdentityChanged
+          ) {
+            yield* eks.updateAddon({
+              clusterName,
+              addonName,
+              addonVersion: news.addonVersion,
+              serviceAccountRoleArn: news.serviceAccountRoleArn as
+                | string
+                | undefined,
+              resolveConflicts: news.resolveConflicts,
+              configurationValues: news.configurationValues,
+              podIdentityAssociations: news.podIdentityAssociations,
+              clientRequestToken: yield* toClientRequestToken(id, "update"),
+            });
+            state = yield* waitForAddonActive({
+              clusterName,
+              addonName,
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
+          if (upsert.length > 0) {
+            yield* eks.tagResource({
+              resourceArn: state.addonArn,
+              tags: Object.fromEntries(
+                upsert.map((tag) => [tag.Key, tag.Value] as const),
+              ),
+            });
+          }
+          if (removed.length > 0) {
+            yield* eks.untagResource({
+              resourceArn: state.addonArn,
+              tagKeys: removed,
+            });
+          }
+
+          yield* session.note(state.addonArn);
+          return state;
+        }),
+        delete: Effect.fn(function* ({ olds, output }) {
+          yield* eks
+            .deleteAddon({
+              clusterName: output.clusterName,
+              addonName: output.addonName,
+              preserve: olds.preserveOnDelete,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+
+          if (!olds.preserveOnDelete) {
+            yield* waitForAddonDeleted({
+              clusterName: output.clusterName,
+              addonName: output.addonName,
+            });
+          }
+        }),
+      };
+    }),
+  );
+
+const waitForAddonActive = Effect.fn(function* ({
+  clusterName,
+  addonName,
+}: {
+  clusterName: string;
+  addonName: string;
+}) {
+  return yield* readAddon({
+    clusterName,
+    addonName,
+  }).pipe(
+    Effect.flatMap((addon) => {
+      if (!addon) {
+        return Effect.fail(
+          new AddonNotReady({
+            clusterName,
+            addonName,
+            status: undefined,
+          }),
+        );
+      }
+
+      switch (addon.status) {
+        case "ACTIVE":
+          return Effect.succeed(addon);
+        case "CREATE_FAILED":
+        case "UPDATE_FAILED":
+        case "DELETE_FAILED":
+          return Effect.fail(
+            new Error(
+              `Addon '${clusterName}/${addonName}' entered terminal status '${addon.status}'`,
+            ),
+          );
+        default:
+          return Effect.fail(
+            new AddonNotReady({
+              clusterName,
+              addonName,
+              status: addon.status,
+            }),
+          );
+      }
+    }),
+    Effect.retry({
+      while: (error) => error instanceof AddonNotReady,
+      schedule: Schedule.exponential("1 second").pipe(
+        Schedule.both(Schedule.recurs(120)),
+      ),
+    }),
+  );
+});
+
+const waitForAddonDeleted = Effect.fn(function* ({
+  clusterName,
+  addonName,
+}: {
+  clusterName: string;
+  addonName: string;
+}) {
+  yield* readAddon({
+    clusterName,
+    addonName,
+  }).pipe(
+    Effect.flatMap((addon) =>
+      addon
+        ? Effect.fail(new AddonStillExists({ clusterName, addonName }))
+        : Effect.void,
+    ),
+    Effect.retry({
+      while: (error) => error instanceof AddonStillExists,
+      schedule: Schedule.exponential("1 second").pipe(
+        Schedule.both(Schedule.recurs(120)),
+      ),
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/AutoCluster.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/AutoCluster.ts
new file mode 100644
index 00000000000..e8e8a3077ed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/AutoCluster.ts
@@ -0,0 +1,288 @@
+import type * as eks from "@distilled.cloud/aws/eks";
+import * as Effect from "effect/Effect";
+import * as Namespace from "../../Namespace.ts";
+import * as Output from "../../Output.ts";
+import type { NetworkResources } from "../EC2/Network.ts";
+import type { Role as RoleResource } from "../IAM/Role.ts";
+import { Role } from "../IAM/Role.ts";
+import type { Cluster as ClusterResource } from "./Cluster.ts";
+import { Cluster } from "./Cluster.ts";
+
+const clusterManagedPolicyArns = [
+  "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy",
+  "arn:aws:iam::aws:policy/AmazonEKSComputePolicy",
+  "arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy",
+  "arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy",
+  "arn:aws:iam::aws:policy/AmazonEKSNetworkingPolicy",
+];
+
+const nodeManagedPolicyArns = [
+  "arn:aws:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy",
+  "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly",
+];
+
+export interface AutoClusterProps {
+  /**
+   * Pre-built VPC layout from `AWS.EC2.Network`.
+   */
+  network?: NetworkResources;
+  /**
+   * Explicit subnet IDs to use instead of deriving them from `network`.
+   */
+  subnetIds?: string[];
+  /**
+   * Optional security groups to associate with the control plane ENIs.
+   */
+  securityGroupIds?: string[];
+  /**
+   * Whether the Kubernetes API server endpoint is public.
+   * @default true
+   */
+  endpointPublicAccess?: boolean;
+  /**
+   * Whether the Kubernetes API server endpoint is private.
+   * @default true
+   */
+  endpointPrivateAccess?: boolean;
+  /**
+   * Optional CIDR allowlist for public endpoint access.
+   */
+  publicAccessCidrs?: string[];
+  /**
+   * Cluster name. If omitted, a unique name is generated.
+   */
+  clusterName?: string;
+  /**
+   * Desired Kubernetes version.
+   */
+  version?: string;
+  /**
+   * Override the cluster role ARN. If omitted, `AutoCluster` creates one.
+   */
+  clusterRoleArn?: string;
+  /**
+   * Override the node role ARN. If omitted, `AutoCluster` creates one.
+   */
+  nodeRoleArn?: string;
+  /**
+   * Name to use when `AutoCluster` creates the cluster role.
+   */
+  clusterRoleName?: string;
+  /**
+   * Name to use when `AutoCluster` creates the node role.
+   */
+  nodeRoleName?: string;
+  /**
+   * Additional or replacement managed policies for the cluster role.
+   */
+  clusterRoleManagedPolicyArns?: string[];
+  /**
+   * Additional or replacement managed policies for the node role.
+   */
+  nodeRoleManagedPolicyArns?: string[];
+  /**
+   * Cluster access configuration.
+   */
+  accessConfig?: eks.CreateAccessConfigRequest;
+  /**
+   * Auto Mode compute configuration overrides.
+   */
+  computeConfig?: Omit<eks.ComputeConfigRequest, "nodeRoleArn">;
+  /**
+   * Auto Mode storage configuration overrides.
+   */
+  storageConfig?: eks.StorageConfigRequest;
+  /**
+   * Kubernetes network configuration overrides.
+   */
+  kubernetesNetworkConfig?: eks.KubernetesNetworkConfigRequest;
+  /**
+   * Control plane logging configuration.
+   */
+  logging?: eks.Logging;
+  /**
+   * Upgrade support policy for the cluster.
+   */
+  upgradePolicy?: eks.UpgradePolicyRequest;
+  /**
+   * Whether deletion protection is enabled.
+   * @default false
+   */
+  deletionProtection?: boolean;
+  /**
+   * Tags applied to the cluster and any IAM roles created by this helper.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface AutoClusterResources {
+  cluster: ClusterResource;
+  clusterRole: RoleResource | undefined;
+  nodeRole: RoleResource | undefined;
+  clusterRoleArn: Output.Output<string, never>;
+  nodeRoleArn: Output.Output<string, never>;
+  subnetIds: Array<string | NetworkResources["publicSubnetIds"][number]>;
+  publicSubnetIds: NetworkResources["publicSubnetIds"];
+  privateSubnetIds: NetworkResources["privateSubnetIds"];
+}
+
+export type AutoCluster = Effect.Success<ReturnType<typeof AutoCluster>>;
+
+/**
+ * Creates a working EKS Auto Mode cluster from an existing VPC network.
+ *
+ * `AutoCluster` is the higher-level entry point that composes `IAM.Role` and
+ * the canonical `EKS.Cluster` resource so callers can stand up a usable EKS
+ * Auto Mode cluster with just `EC2.Network` plus this helper.
+ *
+ * @section Creating Auto Mode Clusters
+ * @example Auto Mode Cluster on Top of `EC2.Network`
+ * ```typescript
+ * const network = yield* AWS.EC2.Network("AppNetwork", {
+ *   cidrBlock: "10.42.0.0/16",
+ *   availabilityZones: 2,
+ *   nat: "single",
+ * });
+ *
+ * const cluster = yield* AWS.EKS.AutoCluster("AppCluster", {
+ *   network,
+ * });
+ * ```
+ */
+export const AutoCluster = (id: string, props: AutoClusterProps) =>
+  Namespace.push(
+    id,
+    Effect.gen(function* () {
+      const subnetIds = resolveSubnetIds(props);
+      if (subnetIds.length < 2) {
+        return yield* Effect.fail(
+          new Error(
+            "AWS.EKS.AutoCluster requires at least two subnet IDs, either explicitly or through EC2.Network",
+          ),
+        );
+      }
+
+      const tags = props.tags;
+
+      const clusterRole = props.clusterRoleArn
+        ? undefined
+        : yield* Role("ClusterRole", {
+            roleName: props.clusterRoleName,
+            assumeRolePolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Principal: {
+                    Service: "eks.amazonaws.com",
+                  },
+                  Action: ["sts:AssumeRole", "sts:TagSession"],
+                },
+              ],
+            },
+            description: "Cluster role for EKS Auto Mode.",
+            managedPolicyArns:
+              props.clusterRoleManagedPolicyArns ?? clusterManagedPolicyArns,
+            tags,
+          });
+
+      const nodeRole = props.nodeRoleArn
+        ? undefined
+        : yield* Role("NodeRole", {
+            roleName: props.nodeRoleName,
+            assumeRolePolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Principal: {
+                    Service: "ec2.amazonaws.com",
+                  },
+                  Action: ["sts:AssumeRole"],
+                },
+              ],
+            },
+            description: "Node role for EKS Auto Mode managed instances.",
+            managedPolicyArns:
+              props.nodeRoleManagedPolicyArns ?? nodeManagedPolicyArns,
+            tags,
+          });
+
+      const cluster = yield* Cluster("Cluster", {
+        clusterName: props.clusterName,
+        roleArn: props.clusterRoleArn ?? clusterRole!.roleArn,
+        version: props.version,
+        resourcesVpcConfig: {
+          subnetIds,
+          securityGroupIds: props.securityGroupIds,
+          endpointPublicAccess: props.endpointPublicAccess ?? true,
+          endpointPrivateAccess: props.endpointPrivateAccess ?? true,
+          publicAccessCidrs: props.publicAccessCidrs,
+        },
+        accessConfig: {
+          bootstrapClusterCreatorAdminPermissions: true,
+          authenticationMode: "API",
+          ...props.accessConfig,
+        },
+        computeConfig: {
+          enabled: true,
+          nodePools: ["system", "general-purpose"],
+          ...props.computeConfig,
+          nodeRoleArn: props.nodeRoleArn ?? nodeRole!.roleArn,
+        },
+        kubernetesNetworkConfig: {
+          ...props.kubernetesNetworkConfig,
+          elasticLoadBalancing: {
+            enabled: true,
+            ...props.kubernetesNetworkConfig?.elasticLoadBalancing,
+          },
+        },
+        storageConfig: {
+          blockStorage: {
+            enabled: true,
+            ...props.storageConfig?.blockStorage,
+          },
+        },
+        logging: props.logging,
+        upgradePolicy: props.upgradePolicy,
+        deletionProtection: props.deletionProtection,
+        tags,
+      });
+
+      return {
+        cluster,
+        clusterRole,
+        nodeRole,
+        clusterRoleArn: props.clusterRoleArn
+          ? Output.literal(props.clusterRoleArn)
+          : clusterRole!.roleArn,
+        nodeRoleArn: props.nodeRoleArn
+          ? Output.literal(props.nodeRoleArn)
+          : nodeRole!.roleArn,
+        subnetIds,
+        publicSubnetIds: props.network?.publicSubnetIds ?? [],
+        privateSubnetIds: props.network?.privateSubnetIds ?? [],
+      } satisfies AutoClusterResources;
+    }).pipe(Effect.orDie),
+  );
+
+const resolveSubnetIds = (props: AutoClusterProps) => {
+  if (props.subnetIds && props.subnetIds.length > 0) {
+    return props.subnetIds;
+  }
+
+  if (!props.network) {
+    return [];
+  }
+
+  if (props.network.privateSubnetIds.length >= 2) {
+    return props.network.privateSubnetIds;
+  }
+
+  return [
+    ...new Set([
+      ...props.network.privateSubnetIds,
+      ...props.network.publicSubnetIds,
+    ]),
+  ];
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Cluster.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Cluster.ts
new file mode 100644
index 00000000000..8957dbbf5f4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Cluster.ts
@@ -0,0 +1,652 @@
+import * as eks from "@distilled.cloud/aws/eks";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import {
+  deleteObjects,
+  reconcileObjects,
+  type KubernetesClusterConnection,
+} from "../../Kubernetes/client.ts";
+import {
+  type KubernetesObjectBinding,
+  type KubernetesObjectDefinition,
+  type KubernetesObjectRef,
+} from "../../Kubernetes/types.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type ClusterName = string;
+export type ClusterArn =
+  `arn:aws:eks:${RegionID}:${AccountID}:cluster/${ClusterName}`;
+
+export interface ClusterProps {
+  /**
+   * Cluster name. If omitted, a unique name is generated.
+   */
+  clusterName?: string;
+  /**
+   * IAM role ARN assumed by the EKS control plane.
+   */
+  roleArn: string;
+  /**
+   * VPC configuration for the cluster control plane.
+   */
+  resourcesVpcConfig: eks.VpcConfigRequest;
+  /**
+   * Desired Kubernetes version.
+   */
+  version?: string;
+  /**
+   * Cluster access configuration.
+   */
+  accessConfig?: eks.CreateAccessConfigRequest;
+  /**
+   * Auto Mode compute configuration.
+   */
+  computeConfig?: eks.ComputeConfigRequest;
+  /**
+   * Auto Mode storage configuration.
+   */
+  storageConfig?: eks.StorageConfigRequest;
+  /**
+   * Kubernetes network configuration.
+   */
+  kubernetesNetworkConfig?: eks.KubernetesNetworkConfigRequest;
+  /**
+   * Control plane logging configuration.
+   */
+  logging?: eks.Logging;
+  /**
+   * Upgrade support policy for the cluster.
+   */
+  upgradePolicy?: eks.UpgradePolicyRequest;
+  /**
+   * Whether deletion protection is enabled.
+   * @default false
+   */
+  deletionProtection?: boolean;
+  /**
+   * User-defined tags to apply to the cluster.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Cluster extends Resource<
+  "AWS.EKS.Cluster",
+  ClusterProps,
+  {
+    clusterArn: ClusterArn;
+    clusterName: ClusterName;
+    status: string;
+    endpoint: string | undefined;
+    certificateAuthorityData: string | undefined;
+    version: string | undefined;
+    platformVersion: string | undefined;
+    roleArn: string;
+    resourcesVpcConfig: eks.VpcConfigResponse;
+    accessConfig: eks.AccessConfigResponse | undefined;
+    computeConfig: eks.ComputeConfigResponse | undefined;
+    storageConfig: eks.StorageConfigResponse | undefined;
+    kubernetesNetworkConfig: eks.KubernetesNetworkConfigResponse | undefined;
+    logging: eks.Logging | undefined;
+    upgradePolicy: eks.UpgradePolicyResponse | undefined;
+    deletionProtection: boolean;
+    oidcIssuer: string | undefined;
+    tags: Record<string, string>;
+    kubernetesObjects: KubernetesObjectRef[];
+  },
+  KubernetesObjectBinding,
+  Providers
+> {}
+
+/**
+ * An Amazon EKS cluster with support for EKS Auto Mode settings.
+ *
+ * @section Creating Clusters
+ * @example Auto Mode Cluster from Existing Roles and Subnets
+ * ```typescript
+ * const cluster = yield* Cluster("AppCluster", {
+ *   roleArn: clusterRole.roleArn,
+ *   resourcesVpcConfig: {
+ *     subnetIds: network.privateSubnetIds,
+ *     endpointPublicAccess: true,
+ *     endpointPrivateAccess: true,
+ *   },
+ *   accessConfig: {
+ *     authenticationMode: "API",
+ *   },
+ *   computeConfig: {
+ *     enabled: true,
+ *     nodeRoleArn: nodeRole.roleArn,
+ *     nodePools: ["system", "general-purpose"],
+ *   },
+ *   kubernetesNetworkConfig: {
+ *     elasticLoadBalancing: { enabled: true },
+ *   },
+ *   storageConfig: {
+ *     blockStorage: { enabled: true },
+ *   },
+ * });
+ * ```
+ */
+export const Cluster = Resource<Cluster>("AWS.EKS.Cluster");
+
+class ClusterNotReady extends Data.TaggedError("EKS.ClusterNotReady")<{
+  status: string | undefined;
+}> {}
+
+class ClusterStillExists extends Data.TaggedError(
+  "EKS.ClusterStillExists",
+)<{}> {}
+
+class ClusterUpdateNotComplete extends Data.TaggedError(
+  "EKS.ClusterUpdateNotComplete",
+)<{
+  status: eks.UpdateStatus | undefined;
+}> {}
+
+const normalizeTags = (tags: Record<string, string | undefined> | undefined) =>
+  Object.fromEntries(
+    Object.entries(tags ?? {}).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined,
+    ),
+  );
+
+const jsonEqual = (a: unknown, b: unknown) =>
+  JSON.stringify(a ?? undefined) === JSON.stringify(b ?? undefined);
+
+const updateRetrySchedule = Schedule.exponential("1 second").pipe(
+  Schedule.both(Schedule.recurs(120)),
+);
+
+const getKubernetesConnection = (
+  state: Pick<
+    Cluster["Attributes"],
+    "clusterName" | "endpoint" | "certificateAuthorityData"
+  >,
+): KubernetesClusterConnection => {
+  if (!state.endpoint || !state.certificateAuthorityData) {
+    throw new Error(
+      `EKS cluster '${state.clusterName}' is missing endpoint or certificate authority data`,
+    );
+  }
+
+  return {
+    clusterName: state.clusterName,
+    endpoint: state.endpoint,
+    certificateAuthorityData: state.certificateAuthorityData,
+  };
+};
+
+const getDesiredKubernetesObjects = (
+  bindings: ReadonlyArray<ResourceBinding<KubernetesObjectBinding>>,
+): KubernetesObjectDefinition[] =>
+  bindings
+    .filter(
+      (binding): binding is ResourceBinding<KubernetesObjectBinding> =>
+        binding.data.type === "kubernetes-object",
+    )
+    .map((binding) => binding.data.object);
+
+const clusterConfigChanged = (olds: ClusterProps, news: ClusterProps) =>
+  !jsonEqual(olds.resourcesVpcConfig, news.resourcesVpcConfig) ||
+  !jsonEqual(
+    olds.accessConfig?.authenticationMode,
+    news.accessConfig?.authenticationMode,
+  ) ||
+  !jsonEqual(olds.computeConfig, news.computeConfig) ||
+  !jsonEqual(olds.storageConfig, news.storageConfig) ||
+  !jsonEqual(olds.kubernetesNetworkConfig, news.kubernetesNetworkConfig) ||
+  !jsonEqual(olds.logging, news.logging) ||
+  !jsonEqual(olds.upgradePolicy, news.upgradePolicy) ||
+  (olds.deletionProtection ?? false) !== (news.deletionProtection ?? false);
+
+const mapClusterState = (
+  cluster: eks.Cluster,
+  tags: Record<string, string>,
+  kubernetesObjects: KubernetesObjectRef[],
+): Cluster["Attributes"] => ({
+  clusterArn: cluster.arn as ClusterArn,
+  clusterName: cluster.name!,
+  status: cluster.status ?? "CREATING",
+  endpoint: cluster.endpoint,
+  certificateAuthorityData: cluster.certificateAuthority?.data,
+  version: cluster.version,
+  platformVersion: cluster.platformVersion,
+  roleArn: cluster.roleArn!,
+  resourcesVpcConfig: {
+    subnetIds: cluster.resourcesVpcConfig?.subnetIds ?? [],
+    securityGroupIds: cluster.resourcesVpcConfig?.securityGroupIds ?? [],
+    clusterSecurityGroupId: cluster.resourcesVpcConfig?.clusterSecurityGroupId,
+    vpcId: cluster.resourcesVpcConfig?.vpcId,
+    endpointPublicAccess: cluster.resourcesVpcConfig?.endpointPublicAccess,
+    endpointPrivateAccess: cluster.resourcesVpcConfig?.endpointPrivateAccess,
+    publicAccessCidrs: cluster.resourcesVpcConfig?.publicAccessCidrs ?? [],
+  },
+  accessConfig: cluster.accessConfig,
+  computeConfig: cluster.computeConfig,
+  storageConfig: cluster.storageConfig,
+  kubernetesNetworkConfig: cluster.kubernetesNetworkConfig,
+  logging: cluster.logging,
+  upgradePolicy: cluster.upgradePolicy,
+  deletionProtection: cluster.deletionProtection ?? false,
+  oidcIssuer: cluster.identity?.oidc?.issuer,
+  tags,
+  kubernetesObjects,
+});
+
+export const ClusterProvider = () =>
+  Provider.effect(
+    Cluster,
+    Effect.gen(function* () {
+      const toClusterName = (
+        id: string,
+        props: { clusterName?: string } = {},
+      ) =>
+        props.clusterName
+          ? Effect.succeed(props.clusterName)
+          : createPhysicalName({ id, maxLength: 100 });
+
+      const toClientRequestToken = (id: string, action: string) =>
+        createPhysicalName({
+          id: `${id}-${action}`,
+          maxLength: 64,
+          delimiter: "-",
+        });
+
+      const validateProps = Effect.fn(function* (props: ClusterProps) {
+        const subnetIds = props.resourcesVpcConfig.subnetIds ?? [];
+        if (subnetIds.length < 2) {
+          return yield* Effect.fail(
+            new Error("AWS.EKS.Cluster requires at least two subnet IDs"),
+          );
+        }
+        if (
+          props.computeConfig?.enabled &&
+          props.accessConfig?.authenticationMode === "CONFIG_MAP"
+        ) {
+          return yield* Effect.fail(
+            new Error(
+              "AWS.EKS.Cluster Auto Mode requires accessConfig.authenticationMode to include API access",
+            ),
+          );
+        }
+      });
+
+      const readCluster = Effect.fn(function* ({
+        clusterName,
+        kubernetesObjects,
+      }: {
+        clusterName: string;
+        kubernetesObjects?: KubernetesObjectRef[];
+      }) {
+        const described = yield* eks
+          .describeCluster({
+            name: clusterName,
+          })
+          .pipe(
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        const cluster = described?.cluster;
+        if (!cluster?.arn || !cluster.name || !cluster.roleArn) {
+          return undefined;
+        }
+        const listedTags = yield* eks
+          .listTagsForResource({
+            resourceArn: cluster.arn,
+          })
+          .pipe(
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        const tags = normalizeTags(listedTags?.tags ?? cluster.tags);
+        return mapClusterState(cluster, tags, kubernetesObjects ?? []);
+      });
+
+      const waitForClusterActive = (
+        clusterName: string,
+        kubernetesObjects: KubernetesObjectRef[] = [],
+      ) =>
+        readCluster({
+          clusterName,
+          kubernetesObjects,
+        }).pipe(
+          Effect.flatMap((state) => {
+            if (!state) {
+              return Effect.fail(
+                new ClusterNotReady({
+                  status: undefined,
+                }),
+              );
+            }
+            if (state.status === "ACTIVE") {
+              return Effect.succeed(state);
+            }
+            if (state.status === "FAILED") {
+              return Effect.fail(
+                new Error(`EKS cluster '${clusterName}' entered FAILED state`),
+              );
+            }
+            return Effect.fail(
+              new ClusterNotReady({
+                status: state.status,
+              }),
+            );
+          }),
+          Effect.retry({
+            while: (error) => error instanceof ClusterNotReady,
+            schedule: updateRetrySchedule,
+          }),
+        );
+
+      const waitForClusterDeleted = (clusterName: string) =>
+        readCluster({
+          clusterName,
+        }).pipe(
+          Effect.flatMap((state) =>
+            state
+              ? Effect.fail(new ClusterStillExists())
+              : Effect.succeed(undefined),
+          ),
+          Effect.retry({
+            while: (error) => error instanceof ClusterStillExists,
+            schedule: updateRetrySchedule,
+          }),
+        );
+
+      const waitForUpdate = (clusterName: string, updateId: string) =>
+        eks
+          .describeUpdate({
+            name: clusterName,
+            updateId,
+          })
+          .pipe(
+            Effect.flatMap(({ update }) => {
+              if (update?.status === "Successful") {
+                return Effect.succeed(update);
+              }
+              if (
+                update?.status === "Failed" ||
+                update?.status === "Cancelled"
+              ) {
+                return Effect.fail(
+                  new Error(
+                    `EKS cluster update '${updateId}' failed with status '${update?.status}'`,
+                  ),
+                );
+              }
+              return Effect.fail(
+                new ClusterUpdateNotComplete({
+                  status: update?.status,
+                }),
+              );
+            }),
+            Effect.retry({
+              while: (error) => error instanceof ClusterUpdateNotComplete,
+              schedule: updateRetrySchedule,
+            }),
+          );
+
+      return {
+        stables: ["clusterArn", "clusterName"],
+        diff: Effect.fn(function* ({ id, olds = {} as ClusterProps, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toClusterName(id, olds)) !==
+            (yield* toClusterName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (olds.roleArn !== news.roleArn) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds.accessConfig?.bootstrapClusterCreatorAdminPermissions !==
+            news.accessConfig?.bootstrapClusterCreatorAdminPermissions
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds.kubernetesNetworkConfig?.serviceIpv4Cidr !==
+              news.kubernetesNetworkConfig?.serviceIpv4Cidr ||
+            olds.kubernetesNetworkConfig?.ipFamily !==
+              news.kubernetesNetworkConfig?.ipFamily
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds.computeConfig?.nodeRoleArn !==
+              news.computeConfig?.nodeRoleArn &&
+            (olds.computeConfig?.enabled || news.computeConfig?.enabled)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const clusterName =
+            output?.clusterName ?? (yield* toClusterName(id, olds ?? {}));
+          const state = yield* readCluster({
+            clusterName,
+            kubernetesObjects: output?.kubernetesObjects,
+          });
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          output,
+          bindings,
+          session,
+        }) {
+          yield* validateProps(news);
+
+          const clusterName = yield* toClusterName(id, news);
+          const desiredObjects = getDesiredKubernetesObjects(bindings);
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — fetch live cloud state. We always fetch fresh so
+          // adoption, drift, and partial-prior-runs all converge.
+          let state = yield* readCluster({
+            clusterName,
+            kubernetesObjects: output?.kubernetesObjects,
+          });
+
+          // Ensure — create cluster if missing. Tolerate
+          // `ResourceInUseException` as a race with a peer reconciler:
+          // re-read and continue with the sync path. The control plane
+          // takes 10+ minutes; we wait for ACTIVE before any sync work.
+          if (!state) {
+            yield* eks
+              .createCluster({
+                name: clusterName,
+                version: news.version,
+                roleArn: news.roleArn,
+                resourcesVpcConfig: news.resourcesVpcConfig,
+                kubernetesNetworkConfig: news.kubernetesNetworkConfig,
+                logging: news.logging,
+                accessConfig: news.accessConfig,
+                computeConfig: news.computeConfig,
+                storageConfig: news.storageConfig,
+                deletionProtection: news.deletionProtection,
+                upgradePolicy: news.upgradePolicy,
+                tags: desiredTags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+              );
+
+            yield* session.note(`Creating EKS cluster ${clusterName}...`);
+            state = yield* waitForClusterActive(clusterName);
+          }
+
+          const clusterArn = state.clusterArn;
+
+          // Sync cluster config — diff observed against desired. Each
+          // mutable aspect (vpc, logging, access mode, compute, storage,
+          // upgrade policy, deletion protection) lives behind a single
+          // updateClusterConfig call. We synthesize a `ClusterProps`
+          // shape from observed attributes for the existing diff helper.
+          const observedAsProps: ClusterProps = {
+            roleArn: state.roleArn,
+            resourcesVpcConfig: state.resourcesVpcConfig,
+            accessConfig: state.accessConfig,
+            computeConfig: state.computeConfig,
+            storageConfig: state.storageConfig,
+            kubernetesNetworkConfig: state.kubernetesNetworkConfig,
+            logging: state.logging,
+            upgradePolicy: state.upgradePolicy,
+            deletionProtection: state.deletionProtection,
+          };
+          if (clusterConfigChanged(observedAsProps, news)) {
+            const configUpdate = yield* eks.updateClusterConfig({
+              name: clusterName,
+              resourcesVpcConfig: news.resourcesVpcConfig,
+              logging: news.logging,
+              accessConfig: news.accessConfig
+                ? {
+                    authenticationMode: news.accessConfig.authenticationMode,
+                  }
+                : undefined,
+              upgradePolicy: news.upgradePolicy,
+              computeConfig: news.computeConfig,
+              kubernetesNetworkConfig: news.kubernetesNetworkConfig,
+              storageConfig: news.storageConfig,
+              deletionProtection: news.deletionProtection,
+              clientRequestToken: yield* toClientRequestToken(id, "config"),
+            });
+            if (configUpdate.update?.id) {
+              yield* session.note(
+                `Updating EKS cluster config ${clusterName}...`,
+              );
+              yield* waitForUpdate(clusterName, configUpdate.update.id);
+              state =
+                (yield* waitForClusterActive(
+                  clusterName,
+                  output?.kubernetesObjects ?? [],
+                )) ?? state;
+            }
+          }
+
+          // Sync version — observed ↔ desired.
+          if (news.version && state.version !== news.version) {
+            const versionUpdate = yield* eks.updateClusterVersion({
+              name: clusterName,
+              version: news.version,
+              clientRequestToken: yield* toClientRequestToken(id, "version"),
+            });
+            if (versionUpdate.update?.id) {
+              yield* session.note(
+                `Updating EKS cluster version ${clusterName}...`,
+              );
+              yield* waitForUpdate(clusterName, versionUpdate.update.id);
+              state =
+                (yield* waitForClusterActive(
+                  clusterName,
+                  output?.kubernetesObjects ?? [],
+                )) ?? state;
+            }
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
+          if (upsert.length > 0) {
+            yield* eks.tagResource({
+              resourceArn: clusterArn,
+              tags: Object.fromEntries(
+                upsert.map((tag) => [tag.Key, tag.Value] as const),
+              ),
+            });
+          }
+          if (removed.length > 0) {
+            yield* eks.untagResource({
+              resourceArn: clusterArn,
+              tagKeys: removed,
+            });
+          }
+
+          yield* session.note(clusterArn);
+
+          // Re-read final state so returned attributes reflect the post-
+          // sync cloud state.
+          const final = yield* readCluster({
+            clusterName,
+            kubernetesObjects: output?.kubernetesObjects ?? [],
+          });
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(
+                `EKS cluster '${clusterName}' could not be read after reconcile`,
+              ),
+            );
+          }
+
+          const kubernetesObjects = yield* reconcileObjects({
+            connection: getKubernetesConnection(final),
+            previousObjects: output?.kubernetesObjects ?? [],
+            desiredObjects,
+          });
+
+          return {
+            ...final,
+            kubernetesObjects,
+          };
+        }),
+        delete: Effect.fn(function* ({ id, output }) {
+          if ((output.kubernetesObjects ?? []).length > 0) {
+            yield* deleteObjects({
+              connection: getKubernetesConnection(output),
+              objects: output.kubernetesObjects ?? [],
+            });
+          }
+
+          if (output.deletionProtection) {
+            const disableDeletionProtection = yield* eks.updateClusterConfig({
+              name: output.clusterName,
+              deletionProtection: false,
+              clientRequestToken: yield* toClientRequestToken(
+                id,
+                "disable-deletion-protection",
+              ),
+            });
+            if (disableDeletionProtection.update?.id) {
+              yield* waitForUpdate(
+                output.clusterName,
+                disableDeletionProtection.update.id,
+              );
+              yield* waitForClusterActive(
+                output.clusterName,
+                output.kubernetesObjects ?? [],
+              );
+            }
+          }
+
+          yield* eks
+            .deleteCluster({
+              name: output.clusterName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+
+          yield* waitForClusterDeleted(output.clusterName);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/LoadBalancedWorkload.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/LoadBalancedWorkload.ts
new file mode 100644
index 00000000000..121c3698aed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/LoadBalancedWorkload.ts
@@ -0,0 +1,76 @@
+import {
+  Workload,
+  type WorkloadProps,
+  type WorkloadServiceProps,
+} from "./Workload.ts";
+
+export type LoadBalancerScheme = "internet-facing" | "internal";
+
+export interface LoadBalancedWorkloadProps extends Omit<
+  WorkloadProps,
+  "service"
+> {
+  /**
+   * Service ports exposed by the load balancer.
+   */
+  ports: WorkloadServiceProps["ports"];
+  /**
+   * Optional explicit service name. Defaults to the workload name.
+   */
+  serviceName?: string;
+  /**
+   * Whether the Service should be internet-facing or internal.
+   * @default "internet-facing"
+   */
+  scheme?: LoadBalancerScheme;
+  /**
+   * Additional annotations to apply to the Service.
+   */
+  serviceAnnotations?: Record<string, string>;
+  /**
+   * Labels to apply to the Service.
+   */
+  serviceLabels?: Record<string, string>;
+}
+
+/**
+ * Creates a workload exposed through a Kubernetes `LoadBalancer` service.
+ *
+ * This helper is the ergonomic path for the common "run a deployment and make
+ * it reachable through the EKS-managed load balancer integration" flow.
+ *
+ * @example Internet-facing workload
+ * ```typescript
+ * const app = yield* LoadBalancedWorkload("api", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   containers: [
+ *     {
+ *       name: "api",
+ *       image: "nginx:latest",
+ *       ports: [{ containerPort: 8080 }],
+ *     },
+ *   ],
+ *   ports: [{ port: 80, targetPort: 8080 }],
+ * });
+ * ```
+ */
+export const LoadBalancedWorkload = (
+  id: string,
+  props: LoadBalancedWorkloadProps,
+) =>
+  Workload(id, {
+    ...props,
+    service: {
+      name: props.serviceName,
+      type: "LoadBalancer",
+      ports: props.ports,
+      labels: props.serviceLabels,
+      annotations: {
+        "service.beta.kubernetes.io/aws-load-balancer-scheme":
+          props.scheme ?? "internet-facing",
+        ...props.serviceAnnotations,
+      },
+    },
+    ...props.serviceAnnotations,
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityAssociation.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityAssociation.ts
new file mode 100644
index 00000000000..9ac4d62014c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityAssociation.ts
@@ -0,0 +1,370 @@
+import * as eks from "@distilled.cloud/aws/eks";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+
+export interface PodIdentityAssociationProps {
+  /**
+   * Target cluster name.
+   */
+  clusterName: Input<string>;
+  /**
+   * Kubernetes namespace that owns the service account.
+   */
+  namespace: string;
+  /**
+   * Kubernetes service account name.
+   */
+  serviceAccount: string;
+  /**
+   * IAM role ARN assumed by pods for this association.
+   */
+  roleArn: Input<string>;
+  /**
+   * Disable session tags for the issued credentials.
+   */
+  disableSessionTags?: boolean;
+  /**
+   * Optional target role ARN for chained role assumption.
+   */
+  targetRoleArn?: Input<string>;
+  /**
+   * Optional inline session policy JSON.
+   */
+  policy?: string;
+  /**
+   * User-defined tags to apply to the association.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface PodIdentityAssociation extends Resource<
+  "AWS.EKS.PodIdentityAssociation",
+  PodIdentityAssociationProps,
+  {
+    associationArn: string;
+    associationId: string;
+    clusterName: string;
+    namespace: string;
+    serviceAccount: string;
+    roleArn: string;
+    disableSessionTags: boolean;
+    targetRoleArn: string | undefined;
+    externalId: string | undefined;
+    ownerArn: string | undefined;
+    policy: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon EKS pod identity association that binds a service account to an IAM role.
+ *
+ * `PodIdentityAssociation` is the canonical workload-identity resource for EKS
+ * clusters that use EKS Pod Identity instead of IRSA.
+ *
+ * @section Managing Pod Identity
+ * @example Bind a Service Account to a Role
+ * ```typescript
+ * const association = yield* PodIdentityAssociation("ApiIdentity", {
+ *   clusterName: cluster.clusterName,
+ *   namespace: "default",
+ *   serviceAccount: "api",
+ *   roleArn: podRole.roleArn,
+ * });
+ * ```
+ */
+export const PodIdentityAssociation = Resource<PodIdentityAssociation>(
+  "AWS.EKS.PodIdentityAssociation",
+);
+
+export const PodIdentityAssociationProvider = () =>
+  Provider.effect(
+    PodIdentityAssociation,
+    Effect.gen(function* () {
+      const toClientRequestToken = (id: string, action: string) =>
+        createPhysicalName({
+          id: `${id}-${action}`,
+          maxLength: 64,
+          delimiter: "-",
+        });
+
+      return {
+        stables: ["associationArn", "associationId"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds.clusterName !== news.clusterName) {
+            return { action: "replace" } as const;
+          }
+
+          if (olds.namespace !== news.namespace) {
+            return { action: "replace" } as const;
+          }
+
+          if (olds.serviceAccount !== news.serviceAccount) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.associationId) {
+            return yield* readAssociationById({
+              clusterName: output.clusterName,
+              associationId: output.associationId,
+            });
+          }
+
+          return yield* findAssociation({
+            id,
+            clusterName: olds.clusterName as string,
+            namespace: olds.namespace,
+            serviceAccount: olds.serviceAccount,
+          });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const clusterName = news.clusterName as string;
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — locate the association either by stored
+          // associationId or by listing on (cluster, namespace, sa).
+          let state = output?.associationId
+            ? yield* readAssociationById({
+                clusterName,
+                associationId: output.associationId,
+              })
+            : yield* findAssociation({
+                id,
+                clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+              });
+
+          // Ensure — create if missing. Tolerate `ResourceInUseException`
+          // as a race with a peer reconciler.
+          if (!state) {
+            yield* eks
+              .createPodIdentityAssociation({
+                clusterName,
+                namespace: news.namespace,
+                serviceAccount: news.serviceAccount,
+                roleArn: news.roleArn as string,
+                disableSessionTags: news.disableSessionTags,
+                targetRoleArn: news.targetRoleArn as string | undefined,
+                policy: news.policy,
+                tags: desiredTags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+              );
+
+            state = yield* findAssociation({
+              id,
+              clusterName,
+              namespace: news.namespace,
+              serviceAccount: news.serviceAccount,
+            });
+
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `PodIdentityAssociation '${news.namespace}/${news.serviceAccount}' could not be read after creation`,
+                ),
+              );
+            }
+          }
+
+          // Sync mutable fields — observed ↔ desired.
+          const desiredRoleArn = news.roleArn as string;
+          const desiredTargetRoleArn = news.targetRoleArn as string | undefined;
+          const desiredDisableSessionTags = news.disableSessionTags ?? false;
+          if (
+            state.roleArn !== desiredRoleArn ||
+            state.disableSessionTags !== desiredDisableSessionTags ||
+            state.targetRoleArn !== desiredTargetRoleArn ||
+            state.policy !== news.policy
+          ) {
+            yield* eks.updatePodIdentityAssociation({
+              clusterName,
+              associationId: state.associationId,
+              roleArn: desiredRoleArn,
+              disableSessionTags: news.disableSessionTags,
+              targetRoleArn: desiredTargetRoleArn,
+              policy: news.policy,
+              clientRequestToken: yield* toClientRequestToken(id, "update"),
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
+          if (upsert.length > 0) {
+            yield* eks.tagResource({
+              resourceArn: state.associationArn,
+              tags: Object.fromEntries(
+                upsert.map((tag) => [tag.Key, tag.Value] as const),
+              ),
+            });
+          }
+          if (removed.length > 0) {
+            yield* eks.untagResource({
+              resourceArn: state.associationArn,
+              tagKeys: removed,
+            });
+          }
+
+          // Re-read final state for fresh attributes.
+          const final = yield* readAssociationById({
+            clusterName,
+            associationId: state.associationId,
+          });
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(
+                `PodIdentityAssociation '${state.associationId}' could not be read after reconcile`,
+              ),
+            );
+          }
+
+          yield* session.note(final.associationArn);
+          return final;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* eks
+            .deletePodIdentityAssociation({
+              clusterName: output.clusterName,
+              associationId: output.associationId,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
+
+const normalizeTags = (tags: Record<string, string | undefined> | undefined) =>
+  Object.fromEntries(
+    Object.entries(tags ?? {}).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined,
+    ),
+  );
+
+const mapAssociation = (association: eks.PodIdentityAssociation) => ({
+  associationArn: association.associationArn!,
+  associationId: association.associationId!,
+  clusterName: association.clusterName!,
+  namespace: association.namespace!,
+  serviceAccount: association.serviceAccount!,
+  roleArn: association.roleArn!,
+  disableSessionTags: association.disableSessionTags ?? false,
+  targetRoleArn: association.targetRoleArn,
+  externalId: association.externalId,
+  ownerArn: association.ownerArn,
+  policy: association.policy,
+  tags: normalizeTags(association.tags),
+});
+
+const readAssociationById = Effect.fn(function* ({
+  clusterName,
+  associationId,
+}: {
+  clusterName: string;
+  associationId: string;
+}) {
+  const response = yield* eks
+    .describePodIdentityAssociation({
+      clusterName,
+      associationId,
+    })
+    .pipe(
+      Effect.catchTag("ResourceNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  const association = response?.association;
+  if (
+    !association?.associationArn ||
+    !association.associationId ||
+    !association.clusterName ||
+    !association.namespace ||
+    !association.serviceAccount ||
+    !association.roleArn
+  ) {
+    return undefined;
+  }
+
+  return mapAssociation(association);
+});
+
+const findAssociation = Effect.fn(function* ({
+  id,
+  clusterName,
+  namespace,
+  serviceAccount,
+}: {
+  id: string;
+  clusterName: string;
+  namespace: string;
+  serviceAccount: string;
+}) {
+  let nextToken: string | undefined;
+  type Association = {
+    associationArn: string;
+    associationId: string;
+    clusterName: string;
+    namespace: string;
+    serviceAccount: string;
+    roleArn: string;
+    disableSessionTags: boolean;
+    targetRoleArn: string | undefined;
+    externalId: string | undefined;
+    ownerArn: string | undefined;
+    policy: string | undefined;
+    tags: Record<string, string>;
+  };
+  let firstMatch: Association | undefined;
+
+  while (true) {
+    const response = yield* eks.listPodIdentityAssociations({
+      clusterName,
+      namespace,
+      serviceAccount,
+      nextToken,
+    });
+
+    for (const summary of response.associations ?? []) {
+      if (!summary.associationId) {
+        continue;
+      }
+
+      const association = yield* readAssociationById({
+        clusterName,
+        associationId: summary.associationId,
+      });
+
+      if (!association) continue;
+
+      if (yield* hasAlchemyTags(id, association.tags)) {
+        return association as Association;
+      }
+      firstMatch ??= association as Association;
+    }
+
+    if (!response.nextToken) {
+      return firstMatch ? Unowned(firstMatch) : undefined;
+    }
+
+    nextToken = response.nextToken;
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityServiceAccount.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityServiceAccount.ts
new file mode 100644
index 00000000000..43befa12bd7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityServiceAccount.ts
@@ -0,0 +1,156 @@
+import * as Effect from "effect/Effect";
+import type { Input } from "../../Input.ts";
+import * as Kubernetes from "../../Kubernetes/index.ts";
+import * as Namespace from "../../Namespace.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import { Role, type RoleArn, type Role as RoleResource } from "../IAM/Role.ts";
+import type { Cluster } from "./Cluster.ts";
+import {
+  PodIdentityAssociation,
+  type PodIdentityAssociation as PodIdentityAssociationResource,
+} from "./PodIdentityAssociation.ts";
+
+export interface PodIdentityServiceAccountProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | Kubernetes.ObjectRef;
+  /**
+   * Optional explicit service account name. Defaults to the logical id.
+   */
+  serviceAccountName?: string;
+  /**
+   * Existing IAM role ARN to use for pod identity.
+   */
+  roleArn?: string;
+  /**
+   * Optional role name when Alchemy creates the IAM role.
+   */
+  roleName?: string;
+  /**
+   * Managed policy ARNs to attach when creating the IAM role.
+   */
+  managedPolicyArns?: string[];
+  /**
+   * Inline policies to attach when creating the IAM role.
+   */
+  inlinePolicies?: Record<string, PolicyDocument>;
+  /**
+   * Optional role description when Alchemy creates the IAM role.
+   */
+  description?: string;
+  /**
+   * Disable session tags for the pod identity association.
+   */
+  disableSessionTags?: boolean;
+  /**
+   * Optional target role ARN for chained role assumption.
+   */
+  targetRoleArn?: string;
+  /**
+   * Optional inline session policy JSON.
+   */
+  policy?: string;
+  /**
+   * Labels applied to the Kubernetes service account.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Annotations applied to the Kubernetes service account.
+   */
+  annotations?: Record<string, string>;
+  /**
+   * Tags applied to AWS resources.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface PodIdentityServiceAccountResources {
+  serviceAccount: Kubernetes.ObjectRef;
+  podIdentityAssociation: PodIdentityAssociationResource;
+  role: RoleResource | undefined;
+  roleArn: Input<string> | RoleArn;
+}
+
+/**
+ * Creates a Kubernetes service account and binds it to EKS Pod Identity.
+ *
+ * @example Service account with generated IAM role
+ * ```typescript
+ * const identity = yield* PodIdentityServiceAccount("ApiIdentity", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   managedPolicyArns: ["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"],
+ * });
+ * ```
+ */
+export const PodIdentityServiceAccount = (
+  id: string,
+  props: PodIdentityServiceAccountProps,
+) =>
+  Namespace.push(
+    id,
+    Effect.gen(function* () {
+      const serviceAccountName = props.serviceAccountName ?? id;
+
+      const role = props.roleArn
+        ? undefined
+        : yield* Role("Role", {
+            roleName: props.roleName,
+            assumeRolePolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Principal: {
+                    Service: "pods.eks.amazonaws.com",
+                  },
+                  Action: ["sts:AssumeRole", "sts:TagSession"],
+                },
+              ],
+            },
+            description:
+              props.description ??
+              `Pod identity role for service account ${serviceAccountName}.`,
+            managedPolicyArns: props.managedPolicyArns,
+            inlinePolicies: props.inlinePolicies,
+            tags: props.tags,
+          });
+
+      const serviceAccount = yield* Kubernetes.ServiceAccount(
+        "ServiceAccount",
+        {
+          cluster: props.cluster,
+          namespace: props.namespace,
+          name: serviceAccountName,
+          labels: props.labels,
+          annotations: props.annotations,
+        },
+      );
+
+      const podIdentityAssociation = yield* PodIdentityAssociation(
+        "PodIdentityAssociation",
+        {
+          clusterName: props.cluster.clusterName,
+          namespace: Kubernetes.namespaceNameOf(props.namespace),
+          serviceAccount: serviceAccount.name,
+          roleArn: props.roleArn ?? role!.roleArn,
+          disableSessionTags: props.disableSessionTags,
+          targetRoleArn: props.targetRoleArn,
+          policy: props.policy,
+          tags: props.tags,
+        },
+      );
+
+      return {
+        serviceAccount,
+        podIdentityAssociation,
+        role,
+        roleArn: props.roleArn ?? role!.roleArn,
+      } satisfies PodIdentityServiceAccountResources;
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityWorkload.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityWorkload.ts
new file mode 100644
index 00000000000..e3ea5426231
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/PodIdentityWorkload.ts
@@ -0,0 +1,182 @@
+import * as Effect from "effect/Effect";
+import type { Input } from "../../Input.ts";
+import * as Kubernetes from "../../Kubernetes/index.ts";
+import * as Namespace from "../../Namespace.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import type { RoleArn, Role as RoleResource } from "../IAM/Role.ts";
+import type { Cluster } from "./Cluster.ts";
+import type { PodIdentityAssociation as PodIdentityAssociationResource } from "./PodIdentityAssociation.ts";
+import { PodIdentityServiceAccount } from "./PodIdentityServiceAccount.ts";
+import { Workload, type WorkloadServiceProps } from "./Workload.ts";
+
+export interface PodIdentityWorkloadProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | Kubernetes.ObjectRef;
+  /**
+   * Optional explicit workload name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Optional explicit service account name. Defaults to the workload name.
+   */
+  serviceAccountName?: string;
+  /**
+   * Existing IAM role ARN to use for pod identity.
+   */
+  roleArn?: string;
+  /**
+   * Optional role name when Alchemy creates the IAM role.
+   */
+  roleName?: string;
+  /**
+   * Managed policy ARNs to attach when creating the IAM role.
+   */
+  managedPolicyArns?: string[];
+  /**
+   * Inline policies to attach when creating the IAM role.
+   */
+  inlinePolicies?: Record<string, PolicyDocument>;
+  /**
+   * Optional role description when Alchemy creates the IAM role.
+   */
+  description?: string;
+  /**
+   * Disable session tags for the pod identity association.
+   */
+  disableSessionTags?: boolean;
+  /**
+   * Optional target role ARN for chained role assumption.
+   */
+  targetRoleArn?: string;
+  /**
+   * Optional inline session policy JSON.
+   */
+  policy?: string;
+  /**
+   * Deployment labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Pod labels. Defaults to `labels`.
+   */
+  podLabels?: Record<string, string>;
+  /**
+   * Labels applied to the Kubernetes service account.
+   */
+  serviceAccountLabels?: Record<string, string>;
+  /**
+   * Annotations applied to the Kubernetes service account.
+   */
+  serviceAccountAnnotations?: Record<string, string>;
+  /**
+   * Replica count.
+   * @default 1
+   */
+  replicas?: number;
+  /**
+   * Container specs for the pod template.
+   */
+  containers: Kubernetes.ContainerSpec[];
+  /**
+   * Optional service to create for the workload.
+   */
+  service?: WorkloadServiceProps;
+  /**
+   * Tags applied to AWS resources.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface PodIdentityWorkloadResources {
+  deployment: Kubernetes.ObjectRef;
+  service: Kubernetes.ObjectRef | undefined;
+  serviceAccount: Kubernetes.ObjectRef;
+  podIdentityAssociation: PodIdentityAssociationResource;
+  role: RoleResource | undefined;
+  roleArn: Input<string> | RoleArn;
+  name: string;
+  labels: Record<string, string>;
+  podLabels: Record<string, string>;
+}
+
+/**
+ * Creates a pod-identity-enabled workload on an EKS cluster.
+ *
+ * This helper combines `PodIdentityServiceAccount` with `Workload` so callers
+ * can declare a service-account-backed deployment without manually wiring the
+ * IAM role, EKS pod identity association, Kubernetes service account, and
+ * deployment together.
+ *
+ * @example Pod identity workload with generated role
+ * ```typescript
+ * const app = yield* PodIdentityWorkload("api", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   managedPolicyArns: ["arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"],
+ *   containers: [
+ *     {
+ *       name: "api",
+ *       image: "nginx:latest",
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const PodIdentityWorkload = (
+  id: string,
+  props: PodIdentityWorkloadProps,
+) =>
+  Namespace.push(
+    id,
+    Effect.gen(function* () {
+      const name = props.name ?? id;
+      const serviceAccountName = props.serviceAccountName ?? name;
+
+      const identity = yield* PodIdentityServiceAccount("Identity", {
+        cluster: props.cluster,
+        namespace: props.namespace,
+        serviceAccountName,
+        roleArn: props.roleArn,
+        roleName: props.roleName,
+        managedPolicyArns: props.managedPolicyArns,
+        inlinePolicies: props.inlinePolicies,
+        description: props.description,
+        disableSessionTags: props.disableSessionTags,
+        targetRoleArn: props.targetRoleArn,
+        policy: props.policy,
+        labels: props.serviceAccountLabels,
+        annotations: props.serviceAccountAnnotations,
+        tags: props.tags,
+      });
+
+      const workload = yield* Workload("Workload", {
+        cluster: props.cluster,
+        namespace: props.namespace,
+        name,
+        labels: props.labels,
+        podLabels: props.podLabels,
+        replicas: props.replicas,
+        serviceAccountName: identity.serviceAccount,
+        containers: props.containers,
+        service: props.service,
+      });
+
+      return {
+        deployment: workload.deployment,
+        service: workload.service,
+        serviceAccount: identity.serviceAccount,
+        podIdentityAssociation: identity.podIdentityAssociation,
+        role: identity.role,
+        roleArn: identity.roleArn,
+        name: workload.name,
+        labels: workload.labels,
+        podLabels: workload.podLabels,
+      } satisfies PodIdentityWorkloadResources;
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Workload.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Workload.ts
new file mode 100644
index 00000000000..e0889124a3d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/Workload.ts
@@ -0,0 +1,145 @@
+import * as Effect from "effect/Effect";
+import * as Namespace from "../../Namespace.ts";
+import * as Kubernetes from "../../Kubernetes/index.ts";
+import type { Cluster } from "./Cluster.ts";
+
+export interface WorkloadServiceProps {
+  /**
+   * Optional explicit service name. Defaults to the workload name.
+   */
+  name?: string;
+  /**
+   * Service type.
+   * @default "ClusterIP"
+   */
+  type?: "ClusterIP" | "NodePort" | "LoadBalancer";
+  /**
+   * Service ports.
+   */
+  ports: Kubernetes.ServicePort[];
+  /**
+   * Service labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Service annotations.
+   */
+  annotations?: Record<string, string>;
+}
+
+export interface WorkloadProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | Kubernetes.ObjectRef;
+  /**
+   * Optional explicit workload name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Deployment labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Pod labels. Defaults to `labels`.
+   */
+  podLabels?: Record<string, string>;
+  /**
+   * Replica count.
+   * @default 1
+   */
+  replicas?: number;
+  /**
+   * Service account name for the pod template.
+   */
+  serviceAccountName?: string | { name: string } | Kubernetes.ObjectRef;
+  /**
+   * Container specs for the pod template.
+   */
+  containers: Kubernetes.ContainerSpec[];
+  /**
+   * Optional service to create for the workload.
+   */
+  service?: WorkloadServiceProps;
+}
+
+export interface WorkloadResources {
+  deployment: Kubernetes.ObjectRef;
+  service: Kubernetes.ObjectRef | undefined;
+  name: string;
+  labels: Record<string, string>;
+  podLabels: Record<string, string>;
+}
+
+/**
+ * Creates a Kubernetes deployment with an optional service on an EKS cluster.
+ *
+ * `Workload` is the higher-level helper for the common "run pods and maybe
+ * expose them on a Service" pattern without dropping down to each individual
+ * Kubernetes primitive.
+ *
+ * @example Deployment with a ClusterIP service
+ * ```typescript
+ * const app = yield* Workload("api", {
+ *   cluster: cluster.cluster,
+ *   namespace: "default",
+ *   containers: [
+ *     {
+ *       name: "api",
+ *       image: "nginx:latest",
+ *       ports: [{ containerPort: 8080 }],
+ *     },
+ *   ],
+ *   service: {
+ *     ports: [{ port: 80, targetPort: 8080 }],
+ *   },
+ * });
+ * ```
+ */
+export const Workload = (id: string, props: WorkloadProps) =>
+  Namespace.push(
+    id,
+    Effect.gen(function* () {
+      const name = props.name ?? id;
+      const labels = props.labels ?? {
+        "app.kubernetes.io/name": name,
+      };
+      const podLabels = props.podLabels ?? labels;
+
+      const deployment = yield* Kubernetes.Deployment("Deployment", {
+        cluster: props.cluster,
+        namespace: props.namespace,
+        name,
+        labels,
+        podLabels,
+        replicas: props.replicas,
+        serviceAccountName: props.serviceAccountName,
+        containers: props.containers,
+      });
+
+      const service = props.service
+        ? yield* Kubernetes.Service("Service", {
+            cluster: props.cluster,
+            namespace: props.namespace,
+            name: props.service.name ?? name,
+            type: props.service.type,
+            selector: podLabels,
+            ports: props.service.ports,
+            labels: props.service.labels ?? labels,
+            annotations: props.service.annotations,
+          })
+        : undefined;
+
+      return {
+        deployment,
+        service,
+        name,
+        labels,
+        podLabels,
+      } satisfies WorkloadResources;
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/index.ts
new file mode 100644
index 00000000000..c7a6427818d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EKS/index.ts
@@ -0,0 +1,9 @@
+export * from "./AccessEntry.ts";
+export * from "./Addon.ts";
+export * from "./AutoCluster.ts";
+export * from "./Cluster.ts";
+export * from "./LoadBalancedWorkload.ts";
+export * from "./PodIdentityAssociation.ts";
+export * from "./PodIdentityServiceAccount.ts";
+export * from "./PodIdentityWorkload.ts";
+export * from "./Workload.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/Listener.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/Listener.ts
new file mode 100644
index 00000000000..49756d1da47
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/Listener.ts
@@ -0,0 +1,182 @@
+import * as elbv2 from "@distilled.cloud/aws/elastic-load-balancing-v2";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { LoadBalancer, LoadBalancerArn } from "./LoadBalancer.ts";
+import type { TargetGroup, TargetGroupArn } from "./TargetGroup.ts";
+
+export type ListenerArn =
+  `arn:aws:elasticloadbalancing:${RegionID}:${AccountID}:listener/${string}`;
+
+export interface ListenerProps {
+  loadBalancerArn: Input<LoadBalancerArn> | LoadBalancer;
+  targetGroupArn: Input<TargetGroupArn> | TargetGroup;
+  port: number;
+  protocol?: "HTTP" | "HTTPS" | "TCP";
+  certificateArn?: string;
+  sslPolicy?: string;
+}
+
+export interface Listener extends Resource<
+  "AWS.ELBv2.Listener",
+  ListenerProps,
+  {
+    listenerArn: ListenerArn;
+    loadBalancerArn: LoadBalancerArn;
+    targetGroupArn: TargetGroupArn;
+    port: number;
+    protocol: string;
+  },
+  never,
+  Providers
+> {}
+
+export const Listener = Resource<Listener>("AWS.ELBv2.Listener");
+
+export const ListenerProvider = () =>
+  Provider.succeed(Listener, {
+    stables: ["listenerArn", "loadBalancerArn"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.loadBalancerArn !== news.loadBalancerArn) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const described = yield* elbv2
+        .describeListeners({
+          ListenerArns: [output.listenerArn],
+        })
+        .pipe(
+          Effect.catchTag("ListenerNotFoundException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      const listener = described?.Listeners?.[0];
+      if (!listener?.ListenerArn) {
+        return undefined;
+      }
+      const defaultForward = (listener.DefaultActions ?? []).find(
+        (action) => action.Type === "forward",
+      );
+      return {
+        listenerArn: listener.ListenerArn as ListenerArn,
+        loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
+        targetGroupArn: (defaultForward?.TargetGroupArn ??
+          output.targetGroupArn) as TargetGroupArn,
+        port: listener.Port!,
+        protocol: listener.Protocol!,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      const loadBalancerArn = news.loadBalancerArn as LoadBalancerArn;
+      const desiredTargetGroupArn = news.targetGroupArn as TargetGroupArn;
+      const desiredProtocol = news.protocol ?? "HTTP";
+
+      // Observe — describe the listener if we have a prior ARN; otherwise
+      // list listeners on the load balancer and find one matching port.
+      let listener: elbv2.Listener | undefined;
+      if (output?.listenerArn) {
+        const described = yield* elbv2
+          .describeListeners({
+            ListenerArns: [output.listenerArn],
+          })
+          .pipe(
+            Effect.catchTag("ListenerNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        listener = described?.Listeners?.[0];
+      }
+      if (!listener?.ListenerArn) {
+        const listed = yield* elbv2
+          .describeListeners({
+            LoadBalancerArn: loadBalancerArn,
+          })
+          .pipe(
+            Effect.catchTag("LoadBalancerNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("ListenerNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        listener = listed?.Listeners?.find((l) => l.Port === news.port);
+      }
+
+      // Ensure — create if missing.
+      if (!listener?.ListenerArn) {
+        const created = yield* elbv2.createListener({
+          LoadBalancerArn: loadBalancerArn,
+          Port: news.port,
+          Protocol: desiredProtocol,
+          Certificates: news.certificateArn
+            ? [{ CertificateArn: news.certificateArn }]
+            : undefined,
+          SslPolicy: news.sslPolicy,
+          DefaultActions: [
+            {
+              Type: "forward",
+              TargetGroupArn: desiredTargetGroupArn,
+            },
+          ],
+        });
+        listener = created.Listeners?.[0];
+        if (!listener?.ListenerArn) {
+          return yield* Effect.die(
+            new Error("createListener returned no listener"),
+          );
+        }
+        yield* session.note(listener.ListenerArn);
+        return {
+          listenerArn: listener.ListenerArn as ListenerArn,
+          loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
+          targetGroupArn: desiredTargetGroupArn,
+          port: listener.Port!,
+          protocol: listener.Protocol!,
+        };
+      }
+
+      // Sync — apply mutable fields (port, protocol, certificates,
+      // sslPolicy, defaultActions). modifyListener fully replaces these.
+      const modified = yield* elbv2.modifyListener({
+        ListenerArn: listener.ListenerArn,
+        Port: news.port,
+        Protocol: desiredProtocol,
+        Certificates: news.certificateArn
+          ? [{ CertificateArn: news.certificateArn }]
+          : undefined,
+        SslPolicy: news.sslPolicy,
+        DefaultActions: [
+          {
+            Type: "forward",
+            TargetGroupArn: desiredTargetGroupArn,
+          },
+        ],
+      });
+      const final = modified.Listeners?.[0] ?? listener;
+      yield* session.note(listener.ListenerArn);
+      return {
+        listenerArn: listener.ListenerArn as ListenerArn,
+        loadBalancerArn: listener.LoadBalancerArn as LoadBalancerArn,
+        targetGroupArn: desiredTargetGroupArn,
+        port: final.Port ?? news.port,
+        protocol: final.Protocol ?? desiredProtocol,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* elbv2
+        .deleteListener({
+          ListenerArn: output.listenerArn,
+        })
+        .pipe(Effect.catchTag("ListenerNotFoundException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/LoadBalancer.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/LoadBalancer.ts
new file mode 100644
index 00000000000..371905c0c8e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/LoadBalancer.ts
@@ -0,0 +1,246 @@
+import * as elbv2 from "@distilled.cloud/aws/elastic-load-balancing-v2";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { SecurityGroupId } from "../EC2/SecurityGroup.ts";
+import type { SubnetId } from "../EC2/Subnet.ts";
+import type { RegionID } from "../Region.ts";
+
+export type LoadBalancerName = string;
+export type LoadBalancerArn =
+  `arn:aws:elasticloadbalancing:${RegionID}:${AccountID}:loadbalancer/${string}`;
+
+export interface LoadBalancerProps {
+  name?: string;
+  scheme?: "internal" | "internet-facing";
+  type?: "application" | "network";
+  subnets: Input<SubnetId[]>;
+  securityGroups?: Input<SecurityGroupId[]>;
+  ipAddressType?: string;
+  attributes?: Record<string, string>;
+  tags?: Record<string, string>;
+}
+
+export interface LoadBalancer extends Resource<
+  "AWS.ELBv2.LoadBalancer",
+  LoadBalancerProps,
+  {
+    loadBalancerArn: LoadBalancerArn;
+    loadBalancerName: LoadBalancerName;
+    dnsName: string;
+    canonicalHostedZoneId: string;
+    vpcId: string;
+    scheme: string;
+    type: string;
+    securityGroups: string[];
+    subnets: string[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+export const LoadBalancer = Resource<LoadBalancer>("AWS.ELBv2.LoadBalancer");
+
+export const LoadBalancerProvider = () =>
+  Provider.effect(
+    LoadBalancer,
+    Effect.gen(function* () {
+      const toName = (id: string, props: { name?: string } = {}) =>
+        props.name
+          ? Effect.succeed(props.name)
+          : createPhysicalName({ id, maxLength: 32, lowercase: true });
+
+      return {
+        stables: [
+          "loadBalancerArn",
+          "loadBalancerName",
+          "dnsName",
+          "canonicalHostedZoneId",
+          "vpcId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news ?? {});
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+          if (
+            !deepEqual(
+              {
+                scheme: olds.scheme ?? "internet-facing",
+                type: olds.type ?? "application",
+                subnets: olds.subnets,
+                securityGroups: olds.securityGroups ?? [],
+                ipAddressType: olds.ipAddressType,
+              },
+              {
+                scheme: news.scheme ?? "internet-facing",
+                type: news.type ?? "application",
+                subnets: news.subnets,
+                securityGroups: news.securityGroups ?? [],
+                ipAddressType: news.ipAddressType,
+              },
+            )
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) {
+            return undefined;
+          }
+          const described = yield* elbv2
+            .describeLoadBalancers({
+              LoadBalancerArns: [output.loadBalancerArn],
+            })
+            .pipe(
+              Effect.catchTag("LoadBalancerNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const loadBalancer = described?.LoadBalancers?.[0];
+          if (!loadBalancer?.LoadBalancerArn) {
+            return undefined;
+          }
+          return {
+            ...output,
+            dnsName: loadBalancer.DNSName!,
+            canonicalHostedZoneId: loadBalancer.CanonicalHostedZoneId!,
+            vpcId: loadBalancer.VpcId!,
+            scheme: loadBalancer.Scheme!,
+            type: loadBalancer.Type!,
+            securityGroups: loadBalancer.SecurityGroups ?? [],
+            subnets:
+              loadBalancer.AvailabilityZones?.flatMap((zone) =>
+                zone.SubnetId ? [zone.SubnetId] : [],
+              ) ?? [],
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* toName(id, news);
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — look up by deterministic name.
+          let described = yield* elbv2
+            .describeLoadBalancers({
+              Names: [name],
+            })
+            .pipe(
+              Effect.catchTag("LoadBalancerNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          let loadBalancer = described?.LoadBalancers?.[0];
+
+          // Ensure — create if missing. The replacement axes (scheme, type,
+          // subnets, securityGroups, ipAddressType) are handled by diff so
+          // we don't need to deal with mismatches here.
+          if (!loadBalancer?.LoadBalancerArn) {
+            const created = yield* elbv2.createLoadBalancer({
+              Name: name,
+              Scheme: news.scheme ?? "internet-facing",
+              Type: news.type ?? "application",
+              Subnets: news.subnets as string[],
+              SecurityGroups: news.securityGroups as string[] | undefined,
+              IpAddressType: news.ipAddressType,
+              Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
+            });
+            loadBalancer = created.LoadBalancers?.[0];
+            if (!loadBalancer?.LoadBalancerArn) {
+              return yield* Effect.die(
+                new Error("createLoadBalancer returned no load balancer"),
+              );
+            }
+          }
+
+          const loadBalancerArn =
+            loadBalancer.LoadBalancerArn as LoadBalancerArn;
+
+          // Sync attributes — observed ↔ desired. We always apply when
+          // desired attrs are non-empty; AWS rejects an empty list anyway,
+          // and reading observed attributes is an extra round-trip we
+          // don't need for convergence.
+          if (news.attributes && Object.keys(news.attributes).length > 0) {
+            yield* elbv2.modifyLoadBalancerAttributes({
+              LoadBalancerArn: loadBalancerArn,
+              Attributes: Object.entries(news.attributes).map(
+                ([Key, Value]) => ({
+                  Key,
+                  Value,
+                }),
+              ),
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          const tagDescriptions = yield* elbv2.describeTags({
+            ResourceArns: [loadBalancerArn],
+          });
+          const observedTags = Object.fromEntries(
+            (tagDescriptions.TagDescriptions?.[0]?.Tags ?? [])
+              .filter(
+                (t): t is { Key: string; Value: string } =>
+                  typeof t.Key === "string" && typeof t.Value === "string",
+              )
+              .map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* elbv2.addTags({
+              ResourceArns: [loadBalancerArn],
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* elbv2.removeTags({
+              ResourceArns: [loadBalancerArn],
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(loadBalancerArn);
+          return {
+            loadBalancerArn,
+            loadBalancerName: loadBalancer.LoadBalancerName!,
+            dnsName: loadBalancer.DNSName!,
+            canonicalHostedZoneId: loadBalancer.CanonicalHostedZoneId!,
+            vpcId: loadBalancer.VpcId!,
+            scheme: loadBalancer.Scheme!,
+            type: loadBalancer.Type!,
+            securityGroups: loadBalancer.SecurityGroups ?? [],
+            subnets:
+              loadBalancer.AvailabilityZones?.flatMap((zone) =>
+                zone.SubnetId ? [zone.SubnetId] : [],
+              ) ?? [],
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* elbv2
+            .deleteLoadBalancer({
+              LoadBalancerArn: output.loadBalancerArn,
+            })
+            .pipe(
+              Effect.catchTag(
+                "LoadBalancerNotFoundException",
+                () => Effect.void,
+              ),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/TargetGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/TargetGroup.ts
new file mode 100644
index 00000000000..94384460342
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/TargetGroup.ts
@@ -0,0 +1,227 @@
+import * as elbv2 from "@distilled.cloud/aws/elastic-load-balancing-v2";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type TargetGroupName = string;
+export type TargetGroupArn =
+  `arn:aws:elasticloadbalancing:${RegionID}:${AccountID}:targetgroup/${string}`;
+
+export interface TargetGroupProps {
+  name?: string;
+  vpcId: string;
+  port: number;
+  protocol?: "HTTP" | "HTTPS" | "TCP";
+  targetType?: "ip" | "instance";
+  healthCheckPath?: string;
+  healthCheckPort?: string;
+  healthCheckProtocol?: string;
+  matcher?: { HttpCode?: string; GrpcCode?: string };
+  attributes?: Record<string, string>;
+  tags?: Record<string, string>;
+}
+
+export interface TargetGroup extends Resource<
+  "AWS.ELBv2.TargetGroup",
+  TargetGroupProps,
+  {
+    targetGroupArn: TargetGroupArn;
+    targetGroupName: TargetGroupName;
+    port: number;
+    protocol: string;
+    targetType: string;
+    vpcId: string;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+export const TargetGroup = Resource<TargetGroup>("AWS.ELBv2.TargetGroup");
+
+export const TargetGroupProvider = () =>
+  Provider.effect(
+    TargetGroup,
+    Effect.gen(function* () {
+      const toName = (id: string, props: { name?: string } = {}) =>
+        props.name
+          ? Effect.succeed(props.name)
+          : createPhysicalName({ id, maxLength: 32, lowercase: true });
+
+      return {
+        stables: ["targetGroupArn", "targetGroupName", "vpcId"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? {})) !== (yield* toName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            !deepEqual(
+              {
+                vpcId: olds.vpcId,
+                protocol: olds.protocol ?? "HTTP",
+                port: olds.port,
+                targetType: olds.targetType ?? "ip",
+              },
+              {
+                vpcId: news.vpcId,
+                protocol: news.protocol ?? "HTTP",
+                port: news.port,
+                targetType: news.targetType ?? "ip",
+              },
+            )
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) {
+            return undefined;
+          }
+          const described = yield* elbv2
+            .describeTargetGroups({
+              TargetGroupArns: [output.targetGroupArn],
+            })
+            .pipe(
+              Effect.catchTag("TargetGroupNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          const targetGroup = described?.TargetGroups?.[0];
+          if (!targetGroup?.TargetGroupArn) {
+            return undefined;
+          }
+          return {
+            ...output,
+            port: targetGroup.Port!,
+            protocol: targetGroup.Protocol!,
+            targetType: targetGroup.TargetType!,
+            vpcId: targetGroup.VpcId!,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const name = yield* toName(id, news);
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — look up by deterministic name.
+          let described = yield* elbv2
+            .describeTargetGroups({
+              Names: [name],
+            })
+            .pipe(
+              Effect.catchTag("TargetGroupNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          let targetGroup = described?.TargetGroups?.[0];
+
+          // Ensure — create if missing. Stable axes (vpcId, port, protocol,
+          // targetType) are handled by diff so we don't deal with mismatch.
+          if (!targetGroup?.TargetGroupArn) {
+            const created = yield* elbv2.createTargetGroup({
+              Name: name,
+              Port: news.port,
+              Protocol: news.protocol ?? "HTTP",
+              VpcId: news.vpcId,
+              TargetType: news.targetType ?? "ip",
+              HealthCheckPath: news.healthCheckPath,
+              HealthCheckPort: news.healthCheckPort,
+              HealthCheckProtocol: news.healthCheckProtocol,
+              Matcher: news.matcher,
+              Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
+            });
+            targetGroup = created.TargetGroups?.[0];
+            if (!targetGroup?.TargetGroupArn) {
+              return yield* Effect.die(
+                new Error("createTargetGroup returned no target group"),
+              );
+            }
+          }
+
+          const targetGroupArn = targetGroup.TargetGroupArn as TargetGroupArn;
+
+          // Sync health check — modifyTargetGroup fully replaces these
+          // mutable fields.
+          yield* elbv2.modifyTargetGroup({
+            TargetGroupArn: targetGroupArn,
+            HealthCheckPath: news.healthCheckPath,
+            HealthCheckPort: news.healthCheckPort,
+            HealthCheckProtocol: news.healthCheckProtocol,
+            Matcher: news.matcher,
+          });
+
+          // Sync attributes — observed ↔ desired. Always apply when desired
+          // attrs are non-empty.
+          if (news.attributes && Object.keys(news.attributes).length > 0) {
+            yield* elbv2.modifyTargetGroupAttributes({
+              TargetGroupArn: targetGroupArn,
+              Attributes: Object.entries(news.attributes).map(
+                ([Key, Value]) => ({
+                  Key,
+                  Value,
+                }),
+              ),
+            });
+          }
+
+          // Sync tags — diff observed cloud tags against desired.
+          const tagDescriptions = yield* elbv2.describeTags({
+            ResourceArns: [targetGroupArn],
+          });
+          const observedTags = Object.fromEntries(
+            (tagDescriptions.TagDescriptions?.[0]?.Tags ?? [])
+              .filter(
+                (t): t is { Key: string; Value: string } =>
+                  typeof t.Key === "string" && typeof t.Value === "string",
+              )
+              .map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* elbv2.addTags({
+              ResourceArns: [targetGroupArn],
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* elbv2.removeTags({
+              ResourceArns: [targetGroupArn],
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(targetGroupArn);
+          return {
+            targetGroupArn,
+            targetGroupName: targetGroup.TargetGroupName!,
+            port: targetGroup.Port!,
+            protocol: targetGroup.Protocol!,
+            targetType: targetGroup.TargetType!,
+            vpcId: targetGroup.VpcId!,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* elbv2
+            .deleteTargetGroup({
+              TargetGroupArn: output.targetGroupArn,
+            })
+            .pipe(Effect.catch(() => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/index.ts
new file mode 100644
index 00000000000..fa0b0c7e86f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/ELBv2/index.ts
@@ -0,0 +1,3 @@
+export { Listener, ListenerProvider } from "./Listener.ts";
+export { LoadBalancer, LoadBalancerProvider } from "./LoadBalancer.ts";
+export { TargetGroup, TargetGroupProvider } from "./TargetGroup.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Endpoint.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Endpoint.ts
new file mode 100644
index 00000000000..1a1bc37c23c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Endpoint.ts
@@ -0,0 +1,17 @@
+import { Endpoint } from "@distilled.cloud/aws";
+import * as Layer from "effect/Layer";
+import { AWSEnvironment } from "./Environment.ts";
+
+export const of = (endpoint: string) =>
+  Layer.succeed(Endpoint.Endpoint, endpoint);
+
+/**
+ * Derive a custom endpoint (if any) from the surrounding
+ * {@link AWSEnvironment}. If the environment has no `endpoint` set, this
+ * Layer is empty (the SDK uses its default endpoint resolver).
+ */
+export const fromEnvironment = Layer.unwrap(
+  AWSEnvironment.useSync((env) =>
+    env.endpoint === undefined ? Layer.empty : of(env.endpoint),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Environment.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Environment.ts
new file mode 100644
index 00000000000..b18bd6ae773
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Environment.ts
@@ -0,0 +1,177 @@
+import * as Auth from "@distilled.cloud/aws/Auth";
+import {
+  fromAwsCredentialIdentity,
+  type CredentialsError,
+  type ResolvedCredentials,
+} from "@distilled.cloud/aws/Credentials";
+import type { AwsCredentialIdentity } from "@smithy/types";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+
+export const AWS_PROFILE = Config.string("AWS_PROFILE").pipe(
+  Config.withDefault("default"),
+);
+
+export const AWS_REGION = Config.string("AWS_REGION");
+export const AWS_ACCOUNT_ID = Config.string("AWS_ACCOUNT_ID");
+export const AWS_ACCESS_KEY_ID = Config.string("AWS_ACCESS_KEY_ID");
+export const AWS_SECRET_ACCESS_KEY = Config.redacted("AWS_SECRET_ACCESS_KEY");
+export const AWS_SESSION_TOKEN = Config.redacted("AWS_SESSION_TOKEN");
+
+export type AccountID = string;
+export type RegionID = string;
+
+export class FailedToGetAccount extends Data.TaggedError(
+  "AWS::Environment::FailedToGetAccount",
+)<{
+  message: string;
+  cause: Error;
+}> {}
+
+/**
+ * Fully-resolved AWS environment for a stack. Mirrors `CloudflareEnvironment`:
+ * one Context.Service that holds account, region, credentials, endpoint, and
+ * (optionally) the SSO profile name.
+ *
+ * `credentials` is held as an Effect so callers can refresh on each access
+ * (SSO sessions expire). The Effect itself is constructed once when this
+ * service is built; resolving it lazily preserves @distilled.cloud/aws's
+ * existing `Credentials` semantics.
+ */
+export interface AWSEnvironmentShape {
+  accountId: AccountID;
+  region: RegionID;
+  credentials: Effect.Effect<ResolvedCredentials, CredentialsError>;
+  endpoint?: string;
+  profile?: string;
+}
+
+export class AWSEnvironment extends Context.Service<
+  AWSEnvironment,
+  AWSEnvironmentShape
+>()("AWS::Environment") {}
+
+/**
+ * Build an `AWSEnvironment` from one of two sources, in priority order:
+ *
+ *   1. **Environment variables** — used when `AWS_ACCESS_KEY_ID` is set, as
+ *      it is on GitHub Actions runners after `aws-actions/configure-aws-credentials`
+ *      runs (OIDC), or whenever the user has exported static creds. Requires
+ *      `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`, and `AWS_ACCOUNT_ID`. The role
+ *      ARN's account ID is exported by `configure-aws-credentials` as
+ *      `AWS_ACCOUNT_ID` when invoked with `output-credentials: true`.
+ *   2. **SSO profile** (`AWS_PROFILE`, default `"default"`) — used locally
+ *      when no static creds are exported. Reads the profile's
+ *      `sso_account_id` / `region` from `~/.aws/config` and refreshes
+ *      credentials lazily via `aws sso login`.
+ */
+export const Default = Layer.effect(
+  AWSEnvironment,
+  Effect.suspend(() => loadDefault()),
+).pipe(Layer.orDie);
+
+export const loadDefault = () =>
+  Effect.gen(function* () {
+    // Env-credentials path only kicks in under CI (where
+    // `aws-actions/configure-aws-credentials` exports AWS_ACCESS_KEY_ID
+    // and friends). Locally we always go through SSO so a stray
+    // AWS_ACCESS_KEY_ID in the shell doesn't silently override the
+    // user's `~/.aws/config` profile.
+    const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+    if (ci) {
+      const accessKeyId = yield* AWS_ACCESS_KEY_ID.pipe(
+        Config.option,
+        Config.map(Option.getOrUndefined),
+      );
+      if (accessKeyId) {
+        return yield* loadFromEnv(accessKeyId);
+      }
+    }
+    return yield* loadFromSso();
+  });
+
+const loadFromEnv = (accessKeyId: string) =>
+  Effect.gen(function* () {
+    const secretAccessKey = yield* AWS_SECRET_ACCESS_KEY;
+    const sessionToken = yield* AWS_SESSION_TOKEN.pipe(
+      Config.option,
+      Config.map(Option.getOrUndefined),
+    );
+    const region = yield* AWS_REGION;
+    const accountId = yield* AWS_ACCOUNT_ID;
+    return {
+      accountId,
+      region,
+      credentials: Effect.succeed({
+        accessKeyId: Redacted.make(accessKeyId),
+        secretAccessKey,
+        sessionToken,
+      } satisfies ResolvedCredentials),
+    } satisfies AWSEnvironmentShape;
+  });
+
+const loadFromSso = () =>
+  Effect.gen(function* () {
+    const profileName = yield* AWS_PROFILE;
+    const auth = yield* Auth.Default;
+    const profile = yield* auth.loadProfile(profileName);
+    if (!profile.sso_account_id) {
+      return yield* Effect.die(
+        `AWS SSO profile '${profileName}' is missing sso_account_id`,
+      );
+    }
+    const region =
+      profile.region ??
+      (yield* AWS_REGION.pipe(
+        Config.option,
+        Config.map(Option.getOrElse(() => "us-east-1")),
+      ));
+    return {
+      profile: profileName,
+      accountId: profile.sso_account_id,
+      region,
+      credentials: auth.loadProfileCredentials(profileName),
+    } satisfies AWSEnvironmentShape;
+  });
+
+export interface AWSEnvironmentStaticInput {
+  accountId: AccountID;
+  region: RegionID;
+  credentials: AwsCredentialIdentity;
+  endpoint?: string;
+  profile?: string;
+}
+
+const isStatic = (
+  shape: AWSEnvironmentShape | AWSEnvironmentStaticInput,
+): shape is AWSEnvironmentStaticInput =>
+  shape.credentials != null &&
+  typeof (shape.credentials as AwsCredentialIdentity).accessKeyId === "string";
+
+/**
+ * Build an `AWSEnvironment` Layer directly from values — useful for
+ * static credentials in CI or tests.
+ *
+ * Named `makeEnvironment` rather than `of` because `Context.Service.of`
+ * already exists with different semantics (builds the service value, not
+ * a Layer); putting both on `AWSEnvironment` would be confusing.
+ */
+export const makeEnvironment = (
+  shape: AWSEnvironmentShape | AWSEnvironmentStaticInput,
+) =>
+  Layer.succeed(
+    AWSEnvironment,
+    isStatic(shape)
+      ? {
+          ...shape,
+          credentials: Effect.succeed(
+            fromAwsCredentialIdentity(shape.credentials),
+          ),
+        }
+      : shape,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/DescribeEventBus.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/DescribeEventBus.ts
new file mode 100644
index 00000000000..a333051a3a7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/DescribeEventBus.ts
@@ -0,0 +1,71 @@
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { EventBus } from "./EventBus.ts";
+
+export interface DescribeEventBusRequest extends Omit<
+  eventbridge.DescribeEventBusRequest,
+  "Name"
+> {}
+
+export class DescribeEventBus extends Binding.Service<
+  DescribeEventBus,
+  (
+    bus: EventBus,
+  ) => Effect.Effect<
+    (
+      request?: DescribeEventBusRequest,
+    ) => Effect.Effect<
+      eventbridge.DescribeEventBusResponse,
+      eventbridge.DescribeEventBusError
+    >
+  >
+>()("AWS.EventBridge.DescribeEventBus") {}
+
+export const DescribeEventBusLive = Layer.effect(
+  DescribeEventBus,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeEventBusPolicy;
+    const describeEventBus = yield* eventbridge.describeEventBus;
+
+    return Effect.fn(function* (bus: EventBus) {
+      const Name = yield* bus.eventBusName;
+      yield* Policy(bus);
+      return Effect.fn(function* (request?: DescribeEventBusRequest) {
+        return yield* describeEventBus({
+          ...request,
+          Name: yield* Name,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeEventBusPolicy extends Binding.Policy<
+  DescribeEventBusPolicy,
+  (bus: EventBus) => Effect.Effect<void>
+>()("AWS.EventBridge.DescribeEventBus") {}
+
+export const DescribeEventBusPolicyLive = DescribeEventBusPolicy.layer.succeed(
+  Effect.fn(function* (host, bus) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.EventBridge.DescribeEventBus(${bus}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["events:DescribeEventBus"],
+              Resource: [bus.eventBusArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `DescribeEventBusPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/DescribeRule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/DescribeRule.ts
new file mode 100644
index 00000000000..bca40f7f4fa
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/DescribeRule.ts
@@ -0,0 +1,73 @@
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Rule } from "./Rule.ts";
+
+export interface DescribeRuleRequest extends Omit<
+  eventbridge.DescribeRuleRequest,
+  "Name" | "EventBusName"
+> {}
+
+export class DescribeRule extends Binding.Service<
+  DescribeRule,
+  (
+    rule: Rule,
+  ) => Effect.Effect<
+    (
+      request?: DescribeRuleRequest,
+    ) => Effect.Effect<
+      eventbridge.DescribeRuleResponse,
+      eventbridge.DescribeRuleError
+    >
+  >
+>()("AWS.EventBridge.DescribeRule") {}
+
+export const DescribeRuleLive = Layer.effect(
+  DescribeRule,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeRulePolicy;
+    const describeRule = yield* eventbridge.describeRule;
+
+    return Effect.fn(function* (rule: Rule) {
+      const Name = yield* rule.ruleName;
+      const EventBusName = yield* rule.eventBusName;
+      yield* Policy(rule);
+      return Effect.fn(function* (request?: DescribeRuleRequest) {
+        const name = yield* Name;
+        const eventBusName = yield* EventBusName;
+        return yield* describeRule({
+          ...request,
+          Name: name,
+          EventBusName: eventBusName !== "default" ? eventBusName : undefined,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeRulePolicy extends Binding.Policy<
+  DescribeRulePolicy,
+  (rule: Rule) => Effect.Effect<void>
+>()("AWS.EventBridge.DescribeRule") {}
+
+export const DescribeRulePolicyLive = DescribeRulePolicy.layer.succeed(
+  Effect.fn(function* (host, rule) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.EventBridge.DescribeRule(${rule}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["events:DescribeRule"],
+            Resource: [rule.ruleArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DescribeRulePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/EventBus.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/EventBus.ts
new file mode 100644
index 00000000000..3a7f1582970
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/EventBus.ts
@@ -0,0 +1,296 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasAlchemyTags,
+} from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+import type { QueueArn } from "../SQS/Queue.ts";
+
+export type {
+  IncludeDetail,
+  Level,
+  LogConfig,
+} from "@distilled.cloud/aws/eventbridge";
+
+export type EventBusName = string;
+export type EventBusArn =
+  `arn:aws:events:${RegionID}:${AccountID}:event-bus/${EventBusName}`;
+
+export interface EventBusDeadLetterConfig {
+  /** ARN of the SQS queue used as the dead-letter queue. */
+  Arn?: QueueArn;
+}
+
+export interface EventBusProps {
+  /**
+   * Name of the event bus. Must match [/\.\-_A-Za-z0-9]+, 1-256 characters.
+   * If omitted, a unique name will be generated.
+   * Cannot be "default" — use the default event bus by omitting eventBusName on rules.
+   */
+  name?: EventBusName;
+
+  /**
+   * The partner event source to associate with this event bus.
+   * Only used when creating a partner event bus.
+   */
+  eventSourceName?: string;
+
+  /**
+   * Description of the event bus.
+   */
+  description?: string;
+
+  /**
+   * The identifier of the KMS customer managed key for EventBridge to use
+   * to encrypt events on this event bus.
+   */
+  kmsKeyIdentifier?: string;
+
+  /**
+   * Dead-letter queue configuration for undeliverable events.
+   */
+  deadLetterConfig?: EventBusDeadLetterConfig;
+
+  /**
+   * Logging configuration for the event bus.
+   */
+  logConfig?: eventbridge.LogConfig;
+
+  /**
+   * Tags to assign to the event bus.
+   */
+  tags?: Record<string, string>;
+}
+
+/**
+ * An Amazon EventBridge event bus for receiving and routing events.
+ *
+ * @section Creating Event Buses
+ * @example Custom Event Bus
+ * ```typescript
+ * const bus = yield* EventBus("MyAppEvents", {
+ *   description: "Custom event bus for my application",
+ * });
+ * ```
+ *
+ * @example Event Bus with Dead Letter Queue
+ * ```typescript
+ * const bus = yield* EventBus("ReliableBus", {
+ *   deadLetterConfig: {
+ *     Arn: yield* dlq.queueArn,
+ *   },
+ * });
+ * ```
+ *
+ * @example Event Bus with KMS Encryption
+ * ```typescript
+ * const bus = yield* EventBus("EncryptedBus", {
+ *   kmsKeyIdentifier: yield* key.keyArn(),
+ * });
+ * ```
+ */
+export interface EventBus extends Resource<
+  "AWS.EventBridge.EventBus",
+  EventBusProps,
+  {
+    /** The name of the event bus. */
+    eventBusName: EventBusName;
+    /** The ARN of the event bus. */
+    eventBusArn: EventBusArn;
+    /** Description of the event bus, if set. */
+    description?: string;
+  },
+  never,
+  Providers
+> {}
+export const EventBus = Resource<EventBus>("AWS.EventBridge.EventBus");
+
+export const EventBusProvider = () =>
+  Provider.effect(
+    EventBus,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createEventBusName = (id: string, props: { name?: string } = {}) =>
+        Effect.gen(function* () {
+          if (props.name) {
+            return props.name;
+          }
+          return yield* createPhysicalName({
+            id,
+            maxLength: 256,
+          });
+        });
+
+      return {
+        stables: ["eventBusName", "eventBusArn"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return;
+          const oldName = yield* createEventBusName(id, olds);
+          const newName = yield* createEventBusName(id, news);
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+          if ((olds.eventSourceName ?? "") !== (news.eventSourceName ?? "")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const eventBusName =
+            output?.eventBusName ?? (yield* createEventBusName(id, olds ?? {}));
+          const described = yield* eventbridge
+            .describeEventBus({
+              Name: eventBusName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          if (!described?.Arn || !described.Name) {
+            return undefined;
+          }
+
+          const { Tags } = yield* eventbridge.listTagsForResource({
+            ResourceARN: described.Arn,
+          });
+          const attrs = {
+            eventBusName: described.Name,
+            eventBusArn: described.Arn as EventBusArn,
+            description: described.Description,
+          };
+          return (yield* hasAlchemyTags(id, Tags ?? []))
+            ? attrs
+            : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const eventBusName =
+            output?.eventBusName ?? (yield* createEventBusName(id, news));
+          const eventBusArn = (output?.eventBusArn ??
+            `arn:aws:events:${region}:${accountId}:event-bus/${eventBusName}`) as EventBusArn;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = {
+            ...internalTags,
+            ...(news.tags as Record<string, string> | undefined),
+          };
+
+          // Observe — fetch live cloud state. We don't trust `output`
+          // blindly: a bus deleted out of band shows up as missing and we
+          // recreate. Foreign-tagged buses have already been screened by
+          // `read` upstream.
+          let described = yield* eventbridge
+            .describeEventBus({
+              Name: eventBusName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the bus if missing. Tolerate
+          // `ResourceAlreadyExistsException` as a race with a peer
+          // reconciler: re-read and continue with the sync path.
+          if (!described?.Arn) {
+            yield* eventbridge
+              .createEventBus({
+                Name: eventBusName,
+                EventSourceName: news.eventSourceName,
+                Description: news.description,
+                KmsKeyIdentifier: news.kmsKeyIdentifier as string | undefined,
+                DeadLetterConfig: news.deadLetterConfig
+                  ? { Arn: news.deadLetterConfig.Arn as string | undefined }
+                  : undefined,
+                LogConfig: news.logConfig,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "ResourceAlreadyExistsException",
+                  () => Effect.void,
+                ),
+              );
+
+            described = yield* eventbridge
+              .describeEventBus({
+                Name: eventBusName,
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+          }
+
+          // Sync mutable bus configuration — `updateEventBus` overwrites
+          // `description`, KMS key, DLQ, and log config in one shot, so we
+          // call it unconditionally (idempotent for matching values).
+          yield* eventbridge.updateEventBus({
+            Name: eventBusName,
+            Description: news.description,
+            KmsKeyIdentifier: news.kmsKeyIdentifier as string | undefined,
+            DeadLetterConfig: news.deadLetterConfig
+              ? { Arn: news.deadLetterConfig.Arn as string | undefined }
+              : undefined,
+            LogConfig: news.logConfig,
+          });
+
+          // Sync tags — diff observed cloud tags against desired. Adoption
+          // may bring us a bus with its own tag set; diffing against the
+          // freshly-fetched tags lets the reconciler converge regardless.
+          const observedTagsList = yield* eventbridge
+            .listTagsForResource({
+              ResourceARN: eventBusArn,
+            })
+            .pipe(Effect.map((r) => r.Tags ?? []));
+          const observedTags: Record<string, string> = {};
+          for (const tag of observedTagsList) {
+            if (tag.Key && tag.Value !== undefined) {
+              observedTags[tag.Key] = tag.Value;
+            }
+          }
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (removed.length > 0) {
+            yield* eventbridge.untagResource({
+              ResourceARN: eventBusArn,
+              TagKeys: removed,
+            });
+          }
+
+          if (upsert.length > 0) {
+            yield* eventbridge.tagResource({
+              ResourceARN: eventBusArn,
+              Tags: upsert,
+            });
+          }
+
+          yield* session.note(eventBusArn);
+          return {
+            eventBusName,
+            eventBusArn,
+            description: news.description,
+          };
+        }),
+        delete: Effect.fn(function* (input) {
+          yield* eventbridge.deleteEventBus({
+            Name: input.output.eventBusName,
+          });
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/EventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/EventSource.ts
new file mode 100644
index 00000000000..131c1683ec0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/EventSource.ts
@@ -0,0 +1,143 @@
+import type * as lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { Cluster } from "../ECS/Cluster.ts";
+import type { Function as LambdaFunction } from "../Lambda/Function.ts";
+import type { Queue } from "../SQS/Queue.ts";
+import type { EventBus } from "./EventBus.ts";
+import type { RuleProps } from "./Rule.ts";
+import {
+  toEcsTask as createEcsTaskRoute,
+  type EcsRouteTargetProps,
+} from "./ToEcsTask.ts";
+import {
+  toLambda as createLambdaRoute,
+  type LambdaRouteTargetProps,
+} from "./ToLambda.ts";
+import {
+  toQueue as createQueueRoute,
+  type QueueRouteTargetProps,
+} from "./ToQueue.ts";
+
+export type EventPattern = Record<string, any>;
+export type EventRecord<Detail = unknown> = lambda.EventBridgeEvent<
+  string,
+  Detail
+>;
+
+export interface EventRouteProps extends Pick<
+  RuleProps,
+  "description" | "state"
+> {}
+
+export interface SubscribeProps extends EventRouteProps {}
+
+export type { EcsRouteTargetProps } from "./ToEcsTask.ts";
+export type { LambdaRouteTargetProps } from "./ToLambda.ts";
+export type { QueueRouteTargetProps } from "./ToQueue.ts";
+
+interface EventDescriptor {
+  id?: string;
+  bus?: EventBus;
+  pattern: EventPattern;
+  props?: EventRouteProps;
+}
+
+export class EventSource extends Binding.Service<
+  EventSource,
+  EventSourceService
+>()("AWS.EventBridge.EventSource") {}
+
+export type EventSourceService = <
+  Detail = unknown,
+  StreamReq = never,
+  Req = never,
+>(
+  descriptor: EventDescriptor,
+  process: (
+    events: Stream.Stream<EventRecord<Detail>, never, StreamReq>,
+  ) => Effect.Effect<void, never, Req>,
+) => Effect.Effect<void, never, never>;
+
+export const events = (...args: any[]) => {
+  const descriptor = parseEventDescriptor(args);
+
+  return {
+    subscribe: <Detail = unknown, Req = never, StreamReq = never>(
+      process: (
+        events: Stream.Stream<EventRecord<Detail>, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) => EventSource.use((source) => source(descriptor, process)),
+    toLambda: (fn: LambdaFunction, props: LambdaRouteTargetProps = {}) =>
+      createLambdaRoute(descriptor, fn, props),
+    toQueue: (queue: Queue, props: QueueRouteTargetProps = {}) =>
+      createQueueRoute(descriptor, queue, props),
+    toEcsTask: (cluster: Cluster, props: EcsRouteTargetProps) =>
+      createEcsTaskRoute(descriptor, cluster, props),
+  };
+};
+
+export const matchesEventPattern = (
+  pattern: EventPattern,
+  event: Record<string, any>,
+): boolean =>
+  Object.entries(pattern).every(([key, expected]) =>
+    matchValue(expected, event[key]),
+  );
+
+const matchValue = (expected: any, actual: any): boolean => {
+  if (Array.isArray(expected)) {
+    return expected.some((value) => matchValue(value, actual));
+  }
+
+  if (expected && typeof expected === "object") {
+    if (actual === null || typeof actual !== "object") {
+      return false;
+    }
+
+    return Object.entries(expected).every(([key, value]) =>
+      matchValue(value, actual[key]),
+    );
+  }
+
+  return actual === expected;
+};
+
+const parseEventDescriptor = (args: any[]): EventDescriptor => {
+  if (typeof args[0] === "string") {
+    if (isEventBus(args[1])) {
+      return {
+        id: args[0],
+        bus: args[1],
+        pattern: args[2],
+        props: args[3],
+      };
+    }
+
+    return {
+      id: args[0],
+      pattern: args[1],
+      props: args[2],
+    };
+  }
+
+  if (isEventBus(args[0])) {
+    return {
+      bus: args[0],
+      pattern: args[1],
+      props: args[2],
+    };
+  }
+
+  return {
+    pattern: args[0],
+    props: args[1],
+  };
+};
+
+const isEventBus = (value: any): value is EventBus =>
+  value &&
+  typeof value === "object" &&
+  "Type" in value &&
+  value.Type === "AWS.EventBridge.EventBus";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListEventBuses.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListEventBuses.ts
new file mode 100644
index 00000000000..8aba3084791
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListEventBuses.ts
@@ -0,0 +1,60 @@
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListEventBusesRequest
+  extends eventbridge.ListEventBusesRequest {}
+
+export class ListEventBuses extends Binding.Service<
+  ListEventBuses,
+  () => Effect.Effect<
+    (
+      request?: ListEventBusesRequest,
+    ) => Effect.Effect<
+      eventbridge.ListEventBusesResponse,
+      eventbridge.ListEventBusesError
+    >
+  >
+>()("AWS.EventBridge.ListEventBuses") {}
+
+export const ListEventBusesLive = Layer.effect(
+  ListEventBuses,
+  Effect.gen(function* () {
+    const Policy = yield* ListEventBusesPolicy;
+    const listEventBuses = yield* eventbridge.listEventBuses;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: ListEventBusesRequest) {
+        return yield* listEventBuses(request ?? {});
+      });
+    });
+  }),
+);
+
+export class ListEventBusesPolicy extends Binding.Policy<
+  ListEventBusesPolicy,
+  () => Effect.Effect<void>
+>()("AWS.EventBridge.ListEventBuses") {}
+
+export const ListEventBusesPolicyLive = ListEventBusesPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.EventBridge.ListEventBuses())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["events:ListEventBuses"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListEventBusesPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListRules.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListRules.ts
new file mode 100644
index 00000000000..a24c3d6aaf1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListRules.ts
@@ -0,0 +1,87 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { EventBus } from "./EventBus.ts";
+
+export interface ListRulesRequest extends Omit<
+  eventbridge.ListRulesRequest,
+  "EventBusName"
+> {}
+
+export class ListRules extends Binding.Service<
+  ListRules,
+  (
+    bus?: EventBus,
+  ) => Effect.Effect<
+    (
+      request?: ListRulesRequest,
+    ) => Effect.Effect<
+      eventbridge.ListRulesResponse,
+      eventbridge.ListRulesError
+    >
+  >
+>()("AWS.EventBridge.ListRules") {}
+
+export const ListRulesLive = Layer.effect(
+  ListRules,
+  Effect.gen(function* () {
+    const Policy = yield* ListRulesPolicy;
+    const listRules = yield* eventbridge.listRules;
+
+    return Effect.fn(function* (bus?: EventBus) {
+      const EventBusName = bus ? yield* bus.eventBusName : undefined;
+      yield* Policy(bus);
+      return Effect.fn(function* (request?: ListRulesRequest) {
+        const eventBusName = EventBusName ? yield* EventBusName : undefined;
+        return yield* listRules({
+          ...request,
+          EventBusName:
+            eventBusName && eventBusName !== "default"
+              ? eventBusName
+              : undefined,
+        });
+      });
+    });
+  }),
+);
+
+export class ListRulesPolicy extends Binding.Policy<
+  ListRulesPolicy,
+  (bus?: EventBus) => Effect.Effect<void>
+>()("AWS.EventBridge.ListRules") {}
+
+export const ListRulesPolicyLive = ListRulesPolicy.layer.effect(
+  Effect.gen(function* () {
+    const region = yield* Region;
+    const { accountId } = yield* AWSEnvironment;
+
+    return Effect.fn(function* (host, bus?: EventBus) {
+      if (isFunction(host)) {
+        const resource = bus
+          ? Output.interpolate`${bus.eventBusArn}`
+          : (`arn:aws:events:${region}:${accountId}:event-bus/default` as const);
+
+        yield* host.bind`Allow(${host}, AWS.EventBridge.ListRules(${bus ?? "default"}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["events:ListRules"],
+                Resource: [resource],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListRulesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListTargetsByRule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListTargetsByRule.ts
new file mode 100644
index 00000000000..d234e2defc2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ListTargetsByRule.ts
@@ -0,0 +1,76 @@
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Rule } from "./Rule.ts";
+
+export interface ListTargetsByRuleRequest extends Omit<
+  eventbridge.ListTargetsByRuleRequest,
+  "Rule" | "EventBusName"
+> {}
+
+export class ListTargetsByRule extends Binding.Service<
+  ListTargetsByRule,
+  (
+    rule: Rule,
+  ) => Effect.Effect<
+    (
+      request?: ListTargetsByRuleRequest,
+    ) => Effect.Effect<
+      eventbridge.ListTargetsByRuleResponse,
+      eventbridge.ListTargetsByRuleError
+    >
+  >
+>()("AWS.EventBridge.ListTargetsByRule") {}
+
+export const ListTargetsByRuleLive = Layer.effect(
+  ListTargetsByRule,
+  Effect.gen(function* () {
+    const Policy = yield* ListTargetsByRulePolicy;
+    const listTargetsByRule = yield* eventbridge.listTargetsByRule;
+
+    return Effect.fn(function* (rule: Rule) {
+      const RuleName = yield* rule.ruleName;
+      const EventBusName = yield* rule.eventBusName;
+      yield* Policy(rule);
+      return Effect.fn(function* (request?: ListTargetsByRuleRequest) {
+        const ruleName = yield* RuleName;
+        const eventBusName = yield* EventBusName;
+        return yield* listTargetsByRule({
+          ...request,
+          Rule: ruleName,
+          EventBusName: eventBusName !== "default" ? eventBusName : undefined,
+        });
+      });
+    });
+  }),
+);
+
+export class ListTargetsByRulePolicy extends Binding.Policy<
+  ListTargetsByRulePolicy,
+  (rule: Rule) => Effect.Effect<void>
+>()("AWS.EventBridge.ListTargetsByRule") {}
+
+export const ListTargetsByRulePolicyLive =
+  ListTargetsByRulePolicy.layer.succeed(
+    Effect.fn(function* (host, rule) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.EventBridge.ListTargetsByRule(${rule}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["events:ListTargetsByRule"],
+                Resource: [rule.ruleArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListTargetsByRulePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/Permission.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/Permission.ts
new file mode 100644
index 00000000000..6554bc2312e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/Permission.ts
@@ -0,0 +1,145 @@
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface PermissionProps {
+  /**
+   * Event bus name. Defaults to the account default bus.
+   */
+  eventBusName?: string;
+  /**
+   * The action that EventBridge allows for the principal.
+   * @default "events:PutEvents"
+   */
+  action?: string;
+  /**
+   * The AWS account ID, organization ID, or `*` principal receiving access.
+   */
+  principal: string;
+  /**
+   * Optional statement identifier. If omitted, Alchemy generates one.
+   */
+  statementId?: string;
+  /**
+   * Optional condition limiting the allowed caller.
+   */
+  condition?: eventbridge.Condition;
+}
+
+/**
+ * An EventBridge event bus permission statement.
+ *
+ * `Permission` manages a single `PutPermission` / `RemovePermission` lifecycle
+ * entry on an event bus so helper surfaces can safely grant publishers access
+ * without requiring callers to hand-write raw bus policies.
+ *
+ * @section Granting Access
+ * @example Allow Another Account To Publish
+ * ```typescript
+ * const permission = yield* Permission("PartnerPublish", {
+ *   eventBusName: bus.eventBusName,
+ *   principal: "123456789012",
+ * });
+ * ```
+ */
+export interface Permission extends Resource<
+  "AWS.EventBridge.Permission",
+  PermissionProps,
+  {
+    statementId: string;
+    eventBusName: string;
+  },
+  never,
+  Providers
+> {}
+
+export const Permission = Resource<Permission>("AWS.EventBridge.Permission");
+
+export const PermissionProvider = () =>
+  Provider.effect(
+    Permission,
+    Effect.gen(function* () {
+      const toStatementId = (id: string, props: PermissionProps) =>
+        props.statementId
+          ? Effect.succeed(props.statementId)
+          : createPhysicalName({
+              id,
+              maxLength: 64,
+            });
+
+      return {
+        stables: ["statementId", "eventBusName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          const oldStatementId = yield* toStatementId(id, olds);
+          const newStatementId = yield* toStatementId(id, news);
+
+          if (oldStatementId !== newStatementId) {
+            return { action: "replace" } as const;
+          }
+
+          if (
+            (olds.eventBusName ?? "default") !==
+            (news.eventBusName ?? "default")
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const statementId =
+            output?.statementId ?? (yield* toStatementId(id, news));
+          const eventBusName =
+            output?.eventBusName ?? news.eventBusName ?? "default";
+          const eventBusParam =
+            eventBusName !== "default" ? eventBusName : undefined;
+
+          // Observe + Ensure for an existence-only resource: there is no
+          // server-side `describePermission` for a single statement, so we
+          // remove-then-put unconditionally. `removePermission` tolerates
+          // missing statements; `putPermission` is idempotent on identical
+          // params and overwrites on different ones — this is the official
+          // recommended update path.
+          yield* eventbridge
+            .removePermission({
+              EventBusName: eventBusParam,
+              StatementId: statementId,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+
+          yield* eventbridge.putPermission({
+            EventBusName: eventBusParam,
+            Action: news.action ?? "events:PutEvents",
+            Principal: news.principal,
+            StatementId: statementId,
+            Condition: news.condition,
+          });
+
+          yield* session.note(`EventBridge permission ${statementId}`);
+
+          return {
+            statementId,
+            eventBusName,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* eventbridge
+            .removePermission({
+              EventBusName:
+                output.eventBusName !== "default"
+                  ? output.eventBusName
+                  : undefined,
+              StatementId: output.statementId,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/PutEvents.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/PutEvents.ts
new file mode 100644
index 00000000000..3b92b600dcd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/PutEvents.ts
@@ -0,0 +1,91 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { EventBus } from "./EventBus.ts";
+
+export interface PutEventsRequest extends Omit<
+  eventbridge.PutEventsRequest,
+  "Entries"
+> {
+  Entries: Array<Omit<eventbridge.PutEventsRequestEntry, "EventBusName">>;
+}
+
+export class PutEvents extends Binding.Service<
+  PutEvents,
+  (
+    bus?: EventBus,
+  ) => Effect.Effect<
+    (
+      request: PutEventsRequest,
+    ) => Effect.Effect<
+      eventbridge.PutEventsResponse,
+      eventbridge.PutEventsError
+    >
+  >
+>()("AWS.EventBridge.PutEvents") {}
+
+export const PutEventsLive = Layer.effect(
+  PutEvents,
+  Effect.gen(function* () {
+    const Policy = yield* PutEventsPolicy;
+    const putEvents = yield* eventbridge.putEvents;
+
+    return Effect.fn(function* (bus?: EventBus) {
+      const EventBusName = bus ? yield* bus.eventBusName : undefined;
+      yield* Policy(bus);
+      return Effect.fn(function* (request: PutEventsRequest) {
+        const eventBusName = EventBusName ? yield* EventBusName : undefined;
+        return yield* putEvents({
+          ...request,
+          Entries: request.Entries.map((entry) => ({
+            ...entry,
+            EventBusName:
+              eventBusName && eventBusName !== "default"
+                ? eventBusName
+                : undefined,
+          })),
+        });
+      });
+    });
+  }),
+);
+
+export class PutEventsPolicy extends Binding.Policy<
+  PutEventsPolicy,
+  (bus?: EventBus) => Effect.Effect<void>
+>()("AWS.EventBridge.PutEvents") {}
+
+export const PutEventsPolicyLive = PutEventsPolicy.layer.effect(
+  Effect.gen(function* () {
+    const region = yield* Region;
+    const { accountId } = yield* AWSEnvironment;
+
+    return Effect.fn(function* (host, bus?: EventBus) {
+      if (isFunction(host)) {
+        const resource = bus
+          ? yield* yield* bus.eventBusArn
+          : (`arn:aws:events:${region}:${accountId}:event-bus/default` as const);
+
+        yield* host.bind`Allow(${host}, AWS.EventBridge.PutEvents(${bus ?? "default"}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["events:PutEvents"],
+                Resource: [resource],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `PutEventsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/Rule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/Rule.ts
new file mode 100644
index 00000000000..0a540d5e178
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/Rule.ts
@@ -0,0 +1,587 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasAlchemyTags,
+} from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type {
+  AppSyncParameters,
+  AssignPublicIp,
+  AwsVpcConfiguration,
+  CapacityProviderStrategyItem,
+  HttpParameters,
+  InputTransformer,
+  KinesisParameters,
+  LaunchType,
+  NetworkConfiguration,
+  PlacementConstraint,
+  PlacementConstraintType,
+  PlacementStrategy,
+  PlacementStrategyType,
+  PropagateTags,
+  RedshiftDataParameters,
+  RetryPolicy,
+  RuleState,
+  RunCommandParameters,
+  RunCommandTarget,
+  SageMakerPipelineParameter,
+  SageMakerPipelineParameters,
+  SqsParameters,
+} from "@distilled.cloud/aws/eventbridge";
+
+export type RuleName = string;
+
+export type RuleArn = `arn:aws:events:${RegionID}:${AccountID}:rule/${string}`;
+
+export interface RuleTarget {
+  /** Unique identifier for this target within the rule. */
+  Id: string;
+  /** ARN of the target resource. */
+  Arn: string;
+  /** ARN of the IAM role to use for this target when the rule is triggered. */
+  RoleArn?: string;
+  /** Valid JSON text passed to the target. Mutually exclusive with InputPath and InputTransformer. */
+  Input?: string;
+  /** JSONPath expression to extract from the event and send to the target. Mutually exclusive with Input and InputTransformer. */
+  InputPath?: string;
+  /** Settings to transform input before sending to the target. Mutually exclusive with Input and InputPath. */
+  InputTransformer?: eventbridge.InputTransformer;
+  /** Settings for a Kinesis Data Stream target. */
+  KinesisParameters?: eventbridge.KinesisParameters;
+  /** Parameters for Systems Manager Run Command targets. */
+  RunCommandParameters?: eventbridge.RunCommandParameters;
+  /** Parameters for ECS task targets. */
+  EcsParameters?: RuleTargetEcsParameters;
+  /** Parameters for AWS Batch job targets. */
+  BatchParameters?: RuleTargetBatchParameters;
+  /** Parameters for SQS queue targets (e.g., FIFO message group ID). */
+  SqsParameters?: eventbridge.SqsParameters;
+  /** Parameters for HTTP endpoint targets (API Gateway, API Destinations). */
+  HttpParameters?: eventbridge.HttpParameters;
+  /** Parameters for Amazon Redshift Data API targets. */
+  RedshiftDataParameters?: eventbridge.RedshiftDataParameters;
+  /** Parameters for SageMaker Pipeline targets. */
+  SageMakerPipelineParameters?: eventbridge.SageMakerPipelineParameters;
+  /** Dead-letter queue configuration for failed event delivery. */
+  DeadLetterConfig?: RuleTargetDeadLetterConfig;
+  /** Retry policy settings for the target. */
+  RetryPolicy?: eventbridge.RetryPolicy;
+  /** Parameters for AWS AppSync GraphQL API targets. */
+  AppSyncParameters?: eventbridge.AppSyncParameters;
+}
+
+/** ECS parameters for a rule target with Input-wrapped ARN fields. */
+export interface RuleTargetEcsParameters extends Omit<
+  eventbridge.EcsParameters,
+  "TaskDefinitionArn"
+> {
+  /** ARN of the ECS task definition to run. */
+  TaskDefinitionArn: string;
+}
+
+/** Batch parameters for a rule target with Input-wrapped ARN fields. */
+export interface RuleTargetBatchParameters extends Omit<
+  eventbridge.BatchParameters,
+  "JobDefinition"
+> {
+  /** ARN or name of the Batch job definition. */
+  JobDefinition: string;
+}
+
+/** Dead-letter config for a rule target with Input-wrapped ARN. */
+export interface RuleTargetDeadLetterConfig {
+  /** ARN of the SQS queue used as the dead-letter queue. */
+  Arn?: string;
+}
+
+export interface RuleProps {
+  /**
+   * Name of the rule. Must match [\.\-_A-Za-z0-9]+, 1-64 characters.
+   * If omitted, a unique name will be generated.
+   */
+  name?: string;
+
+  /**
+   * Description of the rule. Max 512 characters.
+   */
+  description?: string;
+
+  /**
+   * The name or ARN of the event bus to associate with this rule.
+   * If omitted, the default event bus is used.
+   */
+  eventBusName?: string;
+
+  /**
+   * The event pattern that triggers this rule. Specified as a JSON-compatible object.
+   * A rule must contain at least an eventPattern or scheduleExpression.
+   */
+  eventPattern?: Record<string, any>;
+
+  /**
+   * The scheduling expression (e.g. "rate(5 minutes)", "cron(0 20 * * ? *)").
+   * A rule must contain at least an eventPattern or scheduleExpression.
+   */
+  scheduleExpression?: string;
+
+  /**
+   * Whether the rule is enabled or disabled.
+   * @default "ENABLED"
+   */
+  state?: eventbridge.RuleState;
+
+  /**
+   * ARN of the IAM role associated with the rule. Required for targets that need
+   * IAM roles (e.g. Kinesis, Step Functions, ECS, API Gateway).
+   */
+  roleArn?: string;
+
+  /**
+   * The targets to invoke when this rule is triggered. Maximum 5 targets per rule.
+   */
+  targets?: RuleTarget[];
+
+  /**
+   * Tags to assign to the rule.
+   */
+  tags?: Record<string, string>;
+}
+
+/**
+ * An Amazon EventBridge rule that matches events and routes them to targets.
+ *
+ * @section Creating Rules
+ * @example Event Pattern Rule
+ * ```typescript
+ * const rule = yield* Rule("S3Events", {
+ *   eventPattern: {
+ *     source: ["aws.s3"],
+ *     "detail-type": ["Object Created"],
+ *   },
+ *   targets: [{
+ *     Id: "MyTarget",
+ *     Arn: yield* queue.queueArn,
+ *   }],
+ * });
+ * ```
+ *
+ * @example Scheduled Rule
+ * ```typescript
+ * const rule = yield* Rule("EveryFiveMinutes", {
+ *   scheduleExpression: "rate(5 minutes)",
+ *   targets: [{
+ *     Id: "LambdaTarget",
+ *     Arn: yield* fn.functionArn(),
+ *   }],
+ * });
+ * ```
+ *
+ * @section Targeting
+ * @example Rule with Input Transformer
+ * ```typescript
+ * const rule = yield* Rule("TransformedEvents", {
+ *   eventPattern: {
+ *     source: ["aws.ec2"],
+ *     "detail-type": ["EC2 Instance State-change Notification"],
+ *   },
+ *   targets: [{
+ *     Id: "SqsTarget",
+ *     Arn: yield* queue.queueArn,
+ *     InputTransformer: {
+ *       InputPathsMap: {
+ *         instance: "$.detail.instance-id",
+ *         state: "$.detail.state",
+ *       },
+ *       InputTemplate: '{"instanceId": <instance>, "newState": <state>}',
+ *     },
+ *   }],
+ * });
+ * ```
+ *
+ * @example Rule with Dead Letter Queue
+ * ```typescript
+ * const rule = yield* Rule("ReliableEvents", {
+ *   eventPattern: { source: ["my.app"] },
+ *   targets: [{
+ *     Id: "Target",
+ *     Arn: yield* fn.functionArn(),
+ *     DeadLetterConfig: {
+ *       Arn: yield* dlq.queueArn,
+ *     },
+ *     RetryPolicy: {
+ *       MaximumRetryAttempts: 3,
+ *       MaximumEventAgeInSeconds: 3600,
+ *     },
+ *   }],
+ * });
+ * ```
+ *
+ * @example Rule with ECS Target
+ * ```typescript
+ * const rule = yield* Rule("EcsSchedule", {
+ *   scheduleExpression: "rate(1 hour)",
+ *   roleArn: yield* role.roleArn(),
+ *   targets: [{
+ *     Id: "EcsTask",
+ *     Arn: yield* cluster.clusterArn(),
+ *     RoleArn: yield* ecsRole.roleArn(),
+ *     EcsParameters: {
+ *       TaskDefinitionArn: yield* taskDef.taskDefinitionArn(),
+ *       TaskCount: 1,
+ *       LaunchType: "FARGATE",
+ *       NetworkConfiguration: {
+ *         awsvpcConfiguration: {
+ *           Subnets: ["subnet-abc123"],
+ *           AssignPublicIp: "ENABLED",
+ *         },
+ *       },
+ *     },
+ *   }],
+ * });
+ * ```
+ */
+export interface Rule extends Resource<
+  "AWS.EventBridge.Rule",
+  RuleProps,
+  {
+    /** The name of the rule. */
+    ruleName: RuleName;
+    /** The ARN of the rule. */
+    ruleArn: RuleArn;
+    /** The event bus associated with the rule. */
+    eventBusName: string;
+  },
+  never,
+  Providers
+> {}
+export const Rule = Resource<Rule>("AWS.EventBridge.Rule");
+
+export const RuleProvider = () =>
+  Provider.effect(
+    Rule,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createRuleName = (id: string, props: { name?: string } = {}) => {
+        if (props.name) {
+          return Effect.succeed(props.name);
+        }
+        return createPhysicalName({
+          id,
+          maxLength: 64,
+        });
+      };
+
+      return {
+        stables: ["ruleName", "ruleArn", "eventBusName"],
+        diff: Effect.fn(function* ({ id, news, olds }) {
+          if (!isResolved(news)) return;
+          const oldName = yield* createRuleName(id, olds);
+          const newName = yield* createRuleName(id, news);
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+          const oldBus = (olds.eventBusName as string | undefined) ?? "default";
+          const newBus = (news.eventBusName as string | undefined) ?? "default";
+          if (oldBus !== newBus) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const ruleName =
+            output?.ruleName ?? (yield* createRuleName(id, olds));
+          const eventBusName =
+            output?.eventBusName ?? olds.eventBusName ?? "default";
+          const described = yield* eventbridge
+            .describeRule({
+              Name: ruleName,
+              EventBusName:
+                eventBusName !== "default" ? eventBusName : undefined,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          if (!described?.Name) {
+            return undefined;
+          }
+
+          const resolvedEventBusName = described.EventBusName ?? eventBusName;
+          const ruleArn = toRuleArn(
+            region,
+            accountId,
+            resolvedEventBusName,
+            described.Name,
+          );
+          const { Tags } = yield* eventbridge.listTagsForResource({
+            ResourceARN: described.Arn ?? ruleArn,
+          });
+          const attrs = {
+            ruleName: described.Name,
+            ruleArn,
+            eventBusName: resolvedEventBusName,
+          };
+          return (yield* hasAlchemyTags(id, Tags ?? []))
+            ? attrs
+            : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          yield* validateRuleProps(news);
+          const ruleName =
+            output?.ruleName ?? (yield* createRuleName(id, news));
+          const eventBusName =
+            output?.eventBusName ??
+            (news.eventBusName as string | undefined) ??
+            "default";
+          const eventBusParam =
+            eventBusName !== "default" ? eventBusName : undefined;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = {
+            ...internalTags,
+            ...(news.tags as Record<string, string> | undefined),
+          };
+
+          // Ensure + Sync rule definition — `putRule` is the single
+          // create-or-update API for the rule itself. It's idempotent on
+          // matching params and overwrites schedule/eventPattern/state/etc.
+          // on differences, so we call it unconditionally. `Tags` only
+          // applies when creating; tags are reconciled separately below
+          // against observed cloud tags.
+          const { RuleArn } = yield* eventbridge.putRule({
+            Name: ruleName,
+            Description: news.description,
+            EventBusName: eventBusParam,
+            EventPattern: news.eventPattern
+              ? JSON.stringify(news.eventPattern)
+              : undefined,
+            ScheduleExpression: news.scheduleExpression,
+            State: news.state ?? "ENABLED",
+            RoleArn: news.roleArn as string | undefined,
+            Tags: createTagsList(desiredTags),
+          });
+          const ruleArn =
+            (RuleArn as RuleArn | undefined) ??
+            toRuleArn(region, accountId, eventBusName, ruleName);
+
+          // Sync targets — observed cloud targets vs desired. `listTargetsByRule`
+          // gives us the live target ids; we remove anything no longer desired,
+          // and `putTargets` overwrites/upserts the rest.
+          const resolvedTargets =
+            (news.targets as Input.Resolve<RuleTarget>[] | undefined) ?? [];
+          const desiredTargetIds = new Set(resolvedTargets.map((t) => t.Id));
+          const observedTargets = yield* eventbridge
+            .listTargetsByRule({
+              Rule: ruleName,
+              EventBusName: eventBusParam,
+            })
+            .pipe(
+              Effect.map((r) => r.Targets ?? []),
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed([] as eventbridge.Target[]),
+              ),
+            );
+          const removedTargetIds = observedTargets
+            .map((t) => t.Id)
+            .filter(
+              (tid): tid is string => !!tid && !desiredTargetIds.has(tid),
+            );
+
+          if (removedTargetIds.length > 0) {
+            const response = yield* eventbridge
+              .removeTargets({
+                Rule: ruleName,
+                EventBusName: eventBusParam,
+                Ids: removedTargetIds,
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+
+            if (response) {
+              yield* assertRemoveTargetsSucceeded(response);
+            }
+          }
+
+          if (resolvedTargets.length > 0) {
+            const response = yield* eventbridge.putTargets({
+              Rule: ruleName,
+              EventBusName: eventBusParam,
+              Targets: resolvedTargets.map(toTarget),
+            });
+            yield* assertPutTargetsSucceeded(response);
+          }
+
+          // Sync tags — diff observed cloud tags against desired. Adoption
+          // and partial prior runs both converge here.
+          const observedTagsList = yield* eventbridge
+            .listTagsForResource({
+              ResourceARN: ruleArn,
+            })
+            .pipe(Effect.map((r) => r.Tags ?? []));
+          const observedTags: Record<string, string> = {};
+          for (const tag of observedTagsList) {
+            if (tag.Key && tag.Value !== undefined) {
+              observedTags[tag.Key] = tag.Value;
+            }
+          }
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (removed.length > 0) {
+            yield* eventbridge.untagResource({
+              ResourceARN: ruleArn,
+              TagKeys: removed,
+            });
+          }
+
+          if (upsert.length > 0) {
+            yield* eventbridge.tagResource({
+              ResourceARN: ruleArn,
+              Tags: upsert,
+            });
+          }
+
+          yield* session.note(ruleArn);
+          return {
+            ruleName,
+            ruleArn,
+            eventBusName,
+          };
+        }),
+        delete: Effect.fn(function* (input) {
+          const ruleName = input.output.ruleName;
+          const eventBusName = input.output.eventBusName;
+          const eventBusParam =
+            eventBusName !== "default" ? eventBusName : undefined;
+
+          const { Targets } = yield* eventbridge
+            .listTargetsByRule({
+              Rule: ruleName,
+              EventBusName: eventBusParam,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed({ Targets: undefined }),
+              ),
+            );
+
+          if (Targets && Targets.length > 0) {
+            const response = yield* eventbridge
+              .removeTargets({
+                Rule: ruleName,
+                EventBusName: eventBusParam,
+                Ids: Targets.map((t) => t.Id),
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+              );
+            if (response) {
+              yield* assertRemoveTargetsSucceeded(response);
+            }
+          }
+
+          yield* eventbridge
+            .deleteRule({
+              Name: ruleName,
+              EventBusName: eventBusParam,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
+
+const toTarget = (target: Input.Resolve<RuleTarget>): eventbridge.Target => ({
+  Id: target.Id,
+  Arn: target.Arn,
+  RoleArn: target.RoleArn,
+  Input: target.Input,
+  InputPath: target.InputPath,
+  InputTransformer: target.InputTransformer,
+  KinesisParameters: target.KinesisParameters,
+  RunCommandParameters: target.RunCommandParameters,
+  EcsParameters: target.EcsParameters
+    ? {
+        ...target.EcsParameters,
+        TaskDefinitionArn: target.EcsParameters.TaskDefinitionArn,
+      }
+    : undefined,
+  BatchParameters: target.BatchParameters
+    ? {
+        ...target.BatchParameters,
+        JobDefinition: target.BatchParameters.JobDefinition,
+      }
+    : undefined,
+  SqsParameters: target.SqsParameters,
+  HttpParameters: target.HttpParameters,
+  RedshiftDataParameters: target.RedshiftDataParameters,
+  SageMakerPipelineParameters: target.SageMakerPipelineParameters,
+  DeadLetterConfig: target.DeadLetterConfig
+    ? { Arn: target.DeadLetterConfig.Arn }
+    : undefined,
+  RetryPolicy: target.RetryPolicy,
+  AppSyncParameters: target.AppSyncParameters,
+});
+
+const toRuleArn = (
+  region: RegionID,
+  accountId: AccountID,
+  eventBusName: string,
+  ruleName: string,
+): RuleArn =>
+  (eventBusName === "default"
+    ? `arn:aws:events:${region}:${accountId}:rule/${ruleName}`
+    : `arn:aws:events:${region}:${accountId}:rule/${eventBusName}/${ruleName}`) as RuleArn;
+
+const validateRuleProps = Effect.fn(function* (props: RuleProps) {
+  if (!props.eventPattern && !props.scheduleExpression) {
+    return yield* Effect.fail(
+      new Error(
+        "EventBridge Rule requires either `eventPattern` or `scheduleExpression`",
+      ),
+    );
+  }
+});
+
+const assertPutTargetsSucceeded = Effect.fn(function* (
+  response: eventbridge.PutTargetsResponse,
+) {
+  if ((response.FailedEntryCount ?? 0) > 0) {
+    return yield* Effect.fail(
+      new Error(
+        `Failed to attach EventBridge targets: ${JSON.stringify(response.FailedEntries ?? [])}`,
+      ),
+    );
+  }
+});
+
+const assertRemoveTargetsSucceeded = Effect.fn(function* (
+  response: eventbridge.RemoveTargetsResponse,
+) {
+  if ((response.FailedEntryCount ?? 0) > 0) {
+    return yield* Effect.fail(
+      new Error(
+        `Failed to remove EventBridge targets: ${JSON.stringify(response.FailedEntries ?? [])}`,
+      ),
+    );
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/TestEventPattern.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/TestEventPattern.ts
new file mode 100644
index 00000000000..55bd2f48134
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/TestEventPattern.ts
@@ -0,0 +1,60 @@
+import * as eventbridge from "@distilled.cloud/aws/eventbridge";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface TestEventPatternRequest
+  extends eventbridge.TestEventPatternRequest {}
+
+export class TestEventPattern extends Binding.Service<
+  TestEventPattern,
+  () => Effect.Effect<
+    (
+      request: TestEventPatternRequest,
+    ) => Effect.Effect<
+      eventbridge.TestEventPatternResponse,
+      eventbridge.TestEventPatternError
+    >
+  >
+>()("AWS.EventBridge.TestEventPattern") {}
+
+export const TestEventPatternLive = Layer.effect(
+  TestEventPattern,
+  Effect.gen(function* () {
+    const Policy = yield* TestEventPatternPolicy;
+    const testEventPattern = yield* eventbridge.testEventPattern;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request: TestEventPatternRequest) {
+        return yield* testEventPattern(request);
+      });
+    });
+  }),
+);
+
+export class TestEventPatternPolicy extends Binding.Policy<
+  TestEventPatternPolicy,
+  () => Effect.Effect<void>
+>()("AWS.EventBridge.TestEventPattern") {}
+
+export const TestEventPatternPolicyLive = TestEventPatternPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.EventBridge.TestEventPattern())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["events:TestEventPattern"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `TestEventPatternPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToEcsTask.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToEcsTask.ts
new file mode 100644
index 00000000000..bfb4467bc76
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToEcsTask.ts
@@ -0,0 +1,118 @@
+import { createHash } from "node:crypto";
+import * as Effect from "effect/Effect";
+import * as IAM from "../IAM/index.ts";
+import type { Cluster } from "../ECS/Cluster.ts";
+import type { EventBus } from "./EventBus.ts";
+import { Rule, type RuleProps, type RuleTarget } from "./Rule.ts";
+
+interface EventDescriptor {
+  id?: string;
+  bus?: EventBus;
+  pattern: Record<string, any>;
+  props?: Pick<RuleProps, "description" | "state">;
+}
+
+export interface EcsRouteTargetProps extends Pick<
+  RuleTarget,
+  | "Input"
+  | "InputPath"
+  | "InputTransformer"
+  | "RetryPolicy"
+  | "DeadLetterConfig"
+> {
+  task: {
+    taskDefinitionArn: string;
+    taskRoleArn: string;
+    executionRoleArn: string;
+  };
+  subnets: string[];
+  securityGroups?: string[];
+  assignPublicIp?: boolean;
+  taskCount?: number;
+}
+
+export const toEcsTask = (
+  descriptor: EventDescriptor,
+  cluster: Cluster,
+  props: EcsRouteTargetProps,
+) =>
+  Effect.gen(function* () {
+    const routeId =
+      descriptor.id ?? createRouteId(descriptor, `${cluster.LogicalId}Ecs`);
+
+    const role = yield* IAM.Role(`${routeId}${cluster.LogicalId}Role`, {
+      assumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: {
+              Service: "events.amazonaws.com",
+            },
+            Action: ["sts:AssumeRole"],
+            Resource: ["*"],
+          },
+        ],
+      },
+      inlinePolicies: {
+        RunTask: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Action: ["ecs:RunTask"],
+              Resource: [props.task.taskDefinitionArn],
+            },
+            {
+              Effect: "Allow",
+              Action: ["iam:PassRole"],
+              Resource: [props.task.taskRoleArn, props.task.executionRoleArn],
+            },
+          ],
+        },
+      },
+    });
+
+    return yield* Rule(routeId, {
+      description: descriptor.props?.description,
+      state: descriptor.props?.state,
+      eventBusName: descriptor.bus?.eventBusName,
+      eventPattern: descriptor.pattern,
+      targets: [
+        {
+          Id: `${cluster.LogicalId}Target`,
+          Arn: cluster.clusterArn as any,
+          RoleArn: role.roleArn as any,
+          Input: props.Input,
+          InputPath: props.InputPath,
+          InputTransformer: props.InputTransformer,
+          RetryPolicy: props.RetryPolicy,
+          DeadLetterConfig: props.DeadLetterConfig,
+          EcsParameters: {
+            TaskDefinitionArn: props.task.taskDefinitionArn,
+            TaskCount: props.taskCount ?? 1,
+            LaunchType: "FARGATE",
+            NetworkConfiguration: {
+              awsvpcConfiguration: {
+                Subnets: props.subnets,
+                SecurityGroups: props.securityGroups,
+                AssignPublicIp: props.assignPublicIp ? "ENABLED" : "DISABLED",
+              },
+            },
+          },
+        },
+      ],
+    });
+  });
+
+const createRouteId = (descriptor: EventDescriptor, suffix: string) =>
+  `EventBridge${createHash("sha1")
+    .update(
+      JSON.stringify({
+        bus: descriptor.bus?.LogicalId ?? "default",
+        pattern: descriptor.pattern,
+        suffix,
+      }),
+    )
+    .digest("hex")
+    .slice(0, 10)}`;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToLambda.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToLambda.ts
new file mode 100644
index 00000000000..000d89c799b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToLambda.ts
@@ -0,0 +1,87 @@
+import * as Effect from "effect/Effect";
+import { createHash } from "node:crypto";
+import * as Binding from "../../Binding.ts";
+import type { Function as LambdaFunction } from "../Lambda/Function.ts";
+import { Permission as LambdaPermission } from "../Lambda/Permission.ts";
+import type { EventBus } from "./EventBus.ts";
+import { Rule, type RuleProps, type RuleTarget } from "./Rule.ts";
+
+interface EventDescriptor {
+  id?: string;
+  bus?: EventBus;
+  pattern: Record<string, any>;
+  props?: Pick<RuleProps, "description" | "state">;
+}
+
+export interface LambdaRouteTargetProps extends Pick<
+  RuleTarget,
+  | "Input"
+  | "InputPath"
+  | "InputTransformer"
+  | "RetryPolicy"
+  | "DeadLetterConfig"
+> {}
+
+export class ToLambdaPolicy extends Binding.Policy<
+  ToLambdaPolicy,
+  (
+    routeId: string,
+    rule: { ruleArn: unknown },
+    fn: LambdaFunction,
+  ) => Effect.Effect<void>
+>()("AWS.EventBridge.ToLambda") {}
+
+export const ToLambdaPolicyLive = ToLambdaPolicy.layer.succeed(
+  Effect.fn(function* (_host, routeId, rule, fn) {
+    yield* LambdaPermission(`${routeId}${fn.LogicalId}InvokePermission`, {
+      action: "lambda:InvokeFunction",
+      functionName: fn.functionName,
+      principal: "events.amazonaws.com",
+      sourceArn: rule.ruleArn as any,
+    }).pipe(Effect.asVoid);
+  }) as any,
+);
+
+export const toLambda = (
+  descriptor: EventDescriptor,
+  fn: LambdaFunction,
+  props: LambdaRouteTargetProps = {},
+) =>
+  Effect.gen(function* () {
+    const routeId =
+      descriptor.id ?? createRouteId(descriptor, `${fn.LogicalId}Lambda`);
+
+    const rule = yield* Rule(routeId, {
+      description: descriptor.props?.description,
+      state: descriptor.props?.state,
+      eventBusName: descriptor.bus?.eventBusName,
+      eventPattern: descriptor.pattern,
+      targets: [
+        {
+          Id: `${fn.LogicalId}Target`,
+          Arn: fn.functionArn as any,
+          Input: props.Input,
+          InputPath: props.InputPath,
+          InputTransformer: props.InputTransformer,
+          RetryPolicy: props.RetryPolicy,
+          DeadLetterConfig: props.DeadLetterConfig,
+        },
+      ],
+    });
+
+    yield* ToLambdaPolicy.bind(routeId, rule, fn);
+
+    return rule;
+  });
+
+const createRouteId = (descriptor: EventDescriptor, suffix: string) =>
+  `EventBridge${createHash("sha1")
+    .update(
+      JSON.stringify({
+        bus: descriptor.bus?.LogicalId ?? "default",
+        pattern: descriptor.pattern,
+        suffix,
+      }),
+    )
+    .digest("hex")
+    .slice(0, 10)}`;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToQueue.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToQueue.ts
new file mode 100644
index 00000000000..ccb208d59bd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/ToQueue.ts
@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import * as Effect from "effect/Effect";
+import * as Binding from "../../Binding.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Queue } from "../SQS/Queue.ts";
+import type { EventBus } from "./EventBus.ts";
+import { Rule, type RuleProps, type RuleTarget } from "./Rule.ts";
+
+interface EventDescriptor {
+  id?: string;
+  bus?: EventBus;
+  pattern: Record<string, any>;
+  props?: Pick<RuleProps, "description" | "state">;
+}
+
+export interface QueueRouteTargetProps extends Pick<
+  RuleTarget,
+  | "Input"
+  | "InputPath"
+  | "InputTransformer"
+  | "RetryPolicy"
+  | "DeadLetterConfig"
+> {
+  sqsParameters?: RuleTarget["SqsParameters"];
+}
+
+export class ToQueuePolicy extends Binding.Policy<
+  ToQueuePolicy,
+  (rule: { ruleArn: unknown }, queue: Queue) => Effect.Effect<void>
+>()("AWS.EventBridge.ToQueue") {}
+
+export const ToQueuePolicyLive = ToQueuePolicy.layer.succeed(
+  Effect.fn(function* (_host, rule, queue) {
+    yield* queue.bind`Allow(${rule}, AWS.EventBridge.toQueue(${queue}))`({
+      policyStatements: [
+        {
+          Effect: "Allow",
+          Principal: {
+            Service: "events.amazonaws.com",
+          },
+          Action: ["sqs:SendMessage"],
+          Resource: [queue.queueArn as any],
+          Condition: {
+            ArnEquals: {
+              "aws:SourceArn": [rule.ruleArn as any],
+            },
+          },
+        } satisfies PolicyStatement,
+      ],
+    });
+  }),
+);
+
+export const toQueue = (
+  descriptor: EventDescriptor,
+  queue: Queue,
+  props: QueueRouteTargetProps = {},
+) =>
+  Effect.gen(function* () {
+    const routeId =
+      descriptor.id ?? createRouteId(descriptor, `${queue.LogicalId}Queue`);
+
+    const rule = yield* Rule(routeId, {
+      description: descriptor.props?.description,
+      state: descriptor.props?.state,
+      eventBusName: descriptor.bus?.eventBusName,
+      eventPattern: descriptor.pattern,
+      targets: [
+        {
+          Id: `${queue.LogicalId}Target`,
+          Arn: queue.queueArn as any,
+          Input: props.Input,
+          InputPath: props.InputPath,
+          InputTransformer: props.InputTransformer,
+          RetryPolicy: props.RetryPolicy,
+          DeadLetterConfig: props.DeadLetterConfig,
+          SqsParameters: props.sqsParameters,
+        },
+      ],
+    });
+
+    yield* ToQueuePolicy.bind(rule, queue);
+
+    return rule;
+  });
+
+const createRouteId = (descriptor: EventDescriptor, suffix: string) =>
+  `EventBridge${createHash("sha1")
+    .update(
+      JSON.stringify({
+        bus: descriptor.bus?.LogicalId ?? "default",
+        pattern: descriptor.pattern,
+        suffix,
+      }),
+    )
+    .digest("hex")
+    .slice(0, 10)}`;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/index.ts
new file mode 100644
index 00000000000..a9ad5127508
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/EventBridge/index.ts
@@ -0,0 +1,14 @@
+export * from "./DescribeEventBus.ts";
+export * from "./DescribeRule.ts";
+export * from "./EventBus.ts";
+export * from "./EventSource.ts";
+export * from "./ListEventBuses.ts";
+export * from "./ListRules.ts";
+export * from "./ListTargetsByRule.ts";
+export * from "./Permission.ts";
+export * from "./PutEvents.ts";
+export * from "./Rule.ts";
+export * from "./TestEventPattern.ts";
+export * from "./ToEcsTask.ts";
+export * from "./ToLambda.ts";
+export * from "./ToQueue.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccessKey.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccessKey.ts
new file mode 100644
index 00000000000..920415ff13c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccessKey.ts
@@ -0,0 +1,173 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { toRedactedString } from "./common.ts";
+
+export interface AccessKeyProps {
+  /**
+   * User that owns the access key.
+   */
+  userName: string;
+  /**
+   * Desired access key status.
+   * @default "Active"
+   */
+  status?: iam.StatusType;
+}
+
+export interface AccessKey extends Resource<
+  "AWS.IAM.AccessKey",
+  AccessKeyProps,
+  {
+    userName: string;
+    accessKeyId: string;
+    status: iam.StatusType;
+    createDate: Date | undefined;
+    secretAccessKey: Redacted.Redacted<string> | undefined;
+    lastUsedDate: Date | undefined;
+    lastUsedServiceName: string | undefined;
+    lastUsedRegion: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM access key for a user.
+ *
+ * `AccessKey` manages long-lived programmatic credentials for an IAM user. The
+ * secret access key is only returned during creation, so later reads preserve
+ * the originally stored redacted value instead of pretending AWS can return it again.
+ *
+ * @section Managing Programmatic Credentials
+ * @example Create an Access Key
+ * ```typescript
+ * const user = yield* User("DeployUser", {
+ *   userName: "deploy-user",
+ * });
+ *
+ * const key = yield* AccessKey("DeployUserKey", {
+ *   userName: user.userName,
+ *   status: "Active",
+ * });
+ * ```
+ */
+export const AccessKey = Resource<AccessKey>("AWS.IAM.AccessKey");
+
+export const AccessKeyProvider = () =>
+  Provider.succeed(AccessKey, {
+    stables: ["accessKeyId"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.userName !== news.userName) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const listed = yield* iam.listAccessKeys({
+        UserName: output.userName,
+      });
+      const metadata = listed.AccessKeyMetadata.find(
+        (entry) => entry.AccessKeyId === output.accessKeyId,
+      );
+      if (!metadata?.AccessKeyId) {
+        return undefined;
+      }
+      const lastUsed = yield* iam.getAccessKeyLastUsed({
+        AccessKeyId: output.accessKeyId,
+      });
+      return {
+        userName: metadata.UserName ?? output.userName,
+        accessKeyId: metadata.AccessKeyId,
+        status: metadata.Status ?? output.status,
+        createDate: metadata.CreateDate,
+        secretAccessKey: output.secretAccessKey,
+        lastUsedDate: lastUsed?.AccessKeyLastUsed?.LastUsedDate,
+        lastUsedServiceName: lastUsed?.AccessKeyLastUsed?.ServiceName,
+        lastUsedRegion: lastUsed?.AccessKeyLastUsed?.Region,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      // Observe — `accessKeyId` is generated by AWS, so we can only locate
+      // an existing key when we already have its id from a prior output.
+      // Without it (first reconciliation), we go straight to create.
+      const existing = output
+        ? yield* iam.listAccessKeys({ UserName: output.userName }).pipe(
+            Effect.map((listed) =>
+              listed.AccessKeyMetadata.find(
+                (entry) => entry.AccessKeyId === output.accessKeyId,
+              ),
+            ),
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          )
+        : undefined;
+
+      // Ensure — create the access key if it does not exist on the cloud.
+      // The secret is only returned at creation time, so on adoption the
+      // best we can do is preserve any redacted value already stored.
+      let accessKeyId = existing?.AccessKeyId ?? output?.accessKeyId;
+      let secretAccessKey = output?.secretAccessKey;
+      let createDate: Date | undefined =
+        existing?.CreateDate ?? output?.createDate;
+
+      if (!existing) {
+        const created = yield* iam.createAccessKey({
+          UserName: news.userName,
+        });
+        accessKeyId = created.AccessKey.AccessKeyId;
+        secretAccessKey = toRedactedString(created.AccessKey.SecretAccessKey);
+        createDate = created.AccessKey.CreateDate;
+      }
+
+      if (!accessKeyId) {
+        return yield* Effect.fail(
+          new Error(`AccessKey for user '${news.userName}' has no id`),
+        );
+      }
+
+      // Sync — apply the desired status when it differs from the observed
+      // value. Default of `Active` matches AWS's behaviour.
+      const observedStatus = existing?.Status ?? output?.status ?? "Active";
+      const desiredStatus = news.status ?? observedStatus;
+      if (desiredStatus !== observedStatus) {
+        yield* iam.updateAccessKey({
+          UserName: news.userName,
+          AccessKeyId: accessKeyId,
+          Status: desiredStatus,
+        });
+      }
+
+      const lastUsed = yield* iam.getAccessKeyLastUsed({
+        AccessKeyId: accessKeyId,
+      });
+
+      yield* session.note(accessKeyId);
+      return {
+        userName: existing?.UserName ?? news.userName,
+        accessKeyId,
+        status: desiredStatus,
+        createDate,
+        secretAccessKey,
+        lastUsedDate: lastUsed?.AccessKeyLastUsed?.LastUsedDate,
+        lastUsedServiceName: lastUsed?.AccessKeyLastUsed?.ServiceName,
+        lastUsedRegion: lastUsed?.AccessKeyLastUsed?.Region,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteAccessKey({
+          UserName: output.userName,
+          AccessKeyId: output.accessKeyId,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccountAlias.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccountAlias.ts
new file mode 100644
index 00000000000..9d4e3832b6b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccountAlias.ts
@@ -0,0 +1,95 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface AccountAliasProps {
+  /**
+   * The AWS account alias to manage.
+   */
+  accountAlias: string;
+}
+
+export interface AccountAlias extends Resource<
+  "AWS.IAM.AccountAlias",
+  AccountAliasProps,
+  {
+    accountAlias: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * The singleton IAM account alias for an AWS account.
+ *
+ * `AccountAlias` manages the one account-level alias that customizes the AWS
+ * sign-in URL for the current account.
+ *
+ * @section Managing Account Identity
+ * @example Set the Account Alias
+ * ```typescript
+ * const alias = yield* AccountAlias("AccountAlias", {
+ *   accountAlias: "my-company-prod",
+ * });
+ * ```
+ */
+export const AccountAlias = Resource<AccountAlias>("AWS.IAM.AccountAlias");
+
+const readAccountAlias = Effect.gen(function* () {
+  const response = yield* iam.listAccountAliases({});
+  return response.AccountAliases?.[0];
+});
+
+export const AccountAliasProvider = () =>
+  Provider.succeed(AccountAlias, {
+    stables: ["accountAlias"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.accountAlias !== news.accountAlias) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* () {
+      const accountAlias = yield* readAccountAlias;
+      if (!accountAlias) {
+        return undefined;
+      }
+      return { accountAlias };
+    }),
+    reconcile: Effect.fn(function* ({ news, session }) {
+      // Observe — the account alias is a singleton; the only way to know
+      // which alias is set is to list and take the first entry.
+      const existing = yield* readAccountAlias;
+
+      // Ensure / Sync — IAM only allows a single alias per account, so
+      // applying the desired alias is just `createAccountAlias`. If a
+      // different alias already exists, replace it by creating the new one
+      // and deleting the old (the API also supports overwriting in a
+      // single call but we keep delete idempotent).
+      if (existing !== news.accountAlias) {
+        yield* iam.createAccountAlias({
+          AccountAlias: news.accountAlias,
+        });
+        if (existing && existing !== news.accountAlias) {
+          yield* iam
+            .deleteAccountAlias({
+              AccountAlias: existing,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+      }
+
+      yield* session.note(news.accountAlias);
+      return { accountAlias: news.accountAlias };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteAccountAlias({
+          AccountAlias: output.accountAlias,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccountPasswordPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccountPasswordPolicy.ts
new file mode 100644
index 00000000000..f8640cade42
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/AccountPasswordPolicy.ts
@@ -0,0 +1,67 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface AccountPasswordPolicyProps
+  extends iam.UpdateAccountPasswordPolicyRequest {}
+
+export interface AccountPasswordPolicy extends Resource<
+  "AWS.IAM.AccountPasswordPolicy",
+  AccountPasswordPolicyProps,
+  iam.PasswordPolicy,
+  never,
+  Providers
+> {}
+
+/**
+ * The singleton IAM account password policy.
+ *
+ * `AccountPasswordPolicy` manages the account-wide password requirements that
+ * apply to IAM users with console passwords.
+ *
+ * @section Managing Password Rules
+ * @example Require Strong Passwords
+ * ```typescript
+ * const policy = yield* AccountPasswordPolicy("PasswordPolicy", {
+ *   MinimumPasswordLength: 16,
+ *   RequireSymbols: true,
+ *   RequireNumbers: true,
+ *   RequireUppercaseCharacters: true,
+ *   RequireLowercaseCharacters: true,
+ *   AllowUsersToChangePassword: true,
+ * });
+ * ```
+ */
+export const AccountPasswordPolicy = Resource<AccountPasswordPolicy>(
+  "AWS.IAM.AccountPasswordPolicy",
+);
+
+export const AccountPasswordPolicyProvider = () =>
+  Provider.succeed(AccountPasswordPolicy, {
+    read: Effect.fn(function* () {
+      const response = yield* iam
+        .getAccountPasswordPolicy({})
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      return response?.PasswordPolicy;
+    }),
+    reconcile: Effect.fn(function* ({ news, session }) {
+      // The account password policy is a singleton driven entirely by
+      // `updateAccountPasswordPolicy`, which is itself a full upsert.
+      // Observation is implicit in the API — there is nothing meaningful
+      // to diff because the request payload *is* the desired state.
+      yield* iam.updateAccountPasswordPolicy(news);
+      yield* session.note("account-password-policy");
+      return news;
+    }),
+    delete: Effect.fn(function* () {
+      yield* iam
+        .deleteAccountPasswordPolicy({})
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Group.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Group.ts
new file mode 100644
index 00000000000..ce362e29f73
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Group.ts
@@ -0,0 +1,373 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { PolicyDocument } from "./Policy.ts";
+import { parsePolicyDocument, stringifyPolicyDocument } from "./common.ts";
+
+export interface GroupProps {
+  /**
+   * Group name. If omitted, a deterministic name is generated.
+   */
+  groupName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * Managed policy ARNs attached to the group.
+   */
+  managedPolicyArns?: string[];
+  /**
+   * Inline policies embedded in the group.
+   */
+  inlinePolicies?: Record<string, PolicyDocument>;
+}
+
+export interface Group extends Resource<
+  "AWS.IAM.Group",
+  GroupProps,
+  {
+    groupArn: string;
+    groupName: string;
+    groupId: string | undefined;
+    path: string | undefined;
+    managedPolicyArns: string[];
+    inlinePolicies: Record<string, PolicyDocument>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM group that can own managed and inline policies.
+ *
+ * `Group` manages a shared authorization container for IAM users, including
+ * attached managed policies and embedded inline policies.
+ *
+ * @section Creating IAM Groups
+ * @example Group with an Inline Policy
+ * ```typescript
+ * const group = yield* Group("SupportGroup", {
+ *   groupName: "support",
+ *   inlinePolicies: {
+ *     SupportReadOnly: {
+ *       Version: "2012-10-17",
+ *       Statement: [{
+ *         Effect: "Allow",
+ *         Action: ["cloudwatch:Get*", "cloudwatch:List*"],
+ *         Resource: ["*"],
+ *       }],
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export const Group = Resource<Group>("AWS.IAM.Group");
+
+export const GroupProvider = () =>
+  Provider.effect(
+    Group,
+    Effect.gen(function* () {
+      const toName = (id: string, props: GroupProps) =>
+        props.groupName
+          ? Effect.succeed(props.groupName)
+          : createPhysicalName({ id, maxLength: 128 });
+
+      const readInlinePolicies = Effect.fn(function* (groupName: string) {
+        const listed = yield* iam.listGroupPolicies({
+          GroupName: groupName,
+        });
+        const entries = yield* Effect.all(
+          (listed.PolicyNames ?? []).map((policyName) =>
+            iam
+              .getGroupPolicy({
+                GroupName: groupName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.map(
+                  (response) =>
+                    [
+                      policyName,
+                      parsePolicyDocument(response.PolicyDocument),
+                    ] as const,
+                ),
+                Effect.catchTag("NoSuchEntityException", () =>
+                  Effect.succeed([policyName, undefined] as const),
+                ),
+              ),
+          ),
+        );
+        return Object.fromEntries(
+          entries.filter(
+            (entry): entry is [string, PolicyDocument] =>
+              entry[1] !== undefined,
+          ),
+        );
+      });
+
+      const readManagedPolicies = Effect.fn(function* (groupName: string) {
+        const listed = yield* iam.listAttachedGroupPolicies({
+          GroupName: groupName,
+        });
+        return (listed.AttachedPolicies ?? [])
+          .map((policy) => policy.PolicyArn)
+          .filter(
+            (policyArn): policyArn is string => typeof policyArn === "string",
+          );
+      });
+
+      const syncManagedPolicies = Effect.fn(function* ({
+        groupName,
+        olds,
+        news,
+      }: {
+        groupName: string;
+        olds: string[];
+        news: string[];
+      }) {
+        const oldSet = new Set(olds);
+        const newSet = new Set(news);
+        for (const policyArn of news) {
+          if (!oldSet.has(policyArn)) {
+            yield* iam.attachGroupPolicy({
+              GroupName: groupName,
+              PolicyArn: policyArn,
+            });
+          }
+        }
+        for (const policyArn of olds) {
+          if (!newSet.has(policyArn)) {
+            yield* iam
+              .detachGroupPolicy({
+                GroupName: groupName,
+                PolicyArn: policyArn,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }
+      });
+
+      const syncInlinePolicies = Effect.fn(function* ({
+        groupName,
+        olds,
+        news,
+      }: {
+        groupName: string;
+        olds: Record<string, PolicyDocument>;
+        news: Record<string, PolicyDocument>;
+      }) {
+        for (const [policyName, document] of Object.entries(news)) {
+          if (
+            JSON.stringify(olds[policyName] ?? null) !==
+            JSON.stringify(document)
+          ) {
+            yield* iam.putGroupPolicy({
+              GroupName: groupName,
+              PolicyName: policyName,
+              PolicyDocument: stringifyPolicyDocument(document),
+            });
+          }
+        }
+        for (const policyName of Object.keys(olds)) {
+          if (!(policyName in news)) {
+            yield* iam
+              .deleteGroupPolicy({
+                GroupName: groupName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }
+      });
+
+      return {
+        stables: ["groupArn", "groupName", "groupId"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as GroupProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const groupName =
+            output?.groupName ??
+            (yield* toName(id, olds ?? ({} as GroupProps)));
+          const response = yield* iam
+            .getGroup({
+              GroupName: groupName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!response?.Group?.Arn) {
+            return undefined;
+          }
+          const [managedPolicyArns, inlinePolicies] = yield* Effect.all([
+            readManagedPolicies(groupName),
+            readInlinePolicies(groupName),
+          ]);
+          return {
+            groupArn: response.Group.Arn,
+            groupName: response.Group.GroupName,
+            groupId: response.Group.GroupId,
+            path: response.Group.Path,
+            managedPolicyArns,
+            inlinePolicies,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const groupName = output?.groupName ?? (yield* toName(id, news));
+
+          // Observe — fetch the live group. `getGroup` returns
+          // `NoSuchEntityException` when the group has not been created or
+          // was deleted out-of-band, in which case we fall through to the
+          // ensure step below.
+          let observed = yield* iam
+            .getGroup({ GroupName: groupName })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the group when it is missing. A concurrent
+          // peer reconciler may win the race, so tolerate
+          // `EntityAlreadyExistsException` and reload.
+          if (!observed?.Group?.Arn) {
+            observed = yield* iam
+              .createGroup({
+                GroupName: groupName,
+                Path: news.path,
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  iam.getGroup({ GroupName: groupName }),
+                ),
+                Effect.map((response) => ({
+                  Group: response.Group,
+                  Users: [],
+                  IsTruncated: false,
+                })),
+              );
+          }
+
+          // Sync — for each mutable aspect, diff observed against desired
+          // and apply only the delta. We trust the cloud as the source of
+          // truth instead of relying on `olds`.
+          const [observedManagedPolicies, observedInlinePolicies] =
+            yield* Effect.all([
+              readManagedPolicies(groupName),
+              readInlinePolicies(groupName),
+            ]);
+
+          yield* syncManagedPolicies({
+            groupName,
+            olds: observedManagedPolicies,
+            news: news.managedPolicyArns ?? [],
+          });
+          yield* syncInlinePolicies({
+            groupName,
+            olds: observedInlinePolicies,
+            news: news.inlinePolicies ?? {},
+          });
+
+          const groupArn = observed.Group?.Arn ?? groupName;
+          yield* session.note(groupArn);
+          return {
+            groupArn,
+            groupName,
+            groupId: observed.Group?.GroupId,
+            path: observed.Group?.Path ?? news.path ?? "/",
+            managedPolicyArns: news.managedPolicyArns ?? [],
+            inlinePolicies: news.inlinePolicies ?? {},
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const groupState = yield* iam
+            .getGroup({
+              GroupName: output.groupName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          for (const user of groupState?.Users ?? []) {
+            if (user.UserName) {
+              yield* iam
+                .removeUserFromGroup({
+                  GroupName: output.groupName,
+                  UserName: user.UserName,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+          const inlinePolicies = yield* iam
+            .listGroupPolicies({
+              GroupName: output.groupName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          for (const policyName of inlinePolicies?.PolicyNames ?? []) {
+            yield* iam
+              .deleteGroupPolicy({
+                GroupName: output.groupName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+          const attachedPolicies = yield* iam
+            .listAttachedGroupPolicies({
+              GroupName: output.groupName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          for (const policy of attachedPolicies?.AttachedPolicies ?? []) {
+            if (policy.PolicyArn) {
+              yield* iam
+                .detachGroupPolicy({
+                  GroupName: output.groupName,
+                  PolicyArn: policy.PolicyArn,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+          yield* iam
+            .deleteGroup({
+              GroupName: output.groupName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/GroupMembership.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/GroupMembership.ts
new file mode 100644
index 00000000000..60240b358b8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/GroupMembership.ts
@@ -0,0 +1,152 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface GroupMembershipProps {
+  /**
+   * Name of the IAM group to manage membership for.
+   */
+  groupName: Input<string>;
+  /**
+   * Exact set of user names that should be members of the group.
+   */
+  userNames: Input<string[]>;
+}
+
+export interface GroupMembership extends Resource<
+  "AWS.IAM.GroupMembership",
+  GroupMembershipProps,
+  {
+    groupName: string;
+    userNames: string[];
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An explicit IAM group membership resource that owns a group's managed users.
+ *
+ * `GroupMembership` models the exact set of users in a group, making membership
+ * reconciliation explicit instead of spreading it across user or group resources.
+ *
+ * @section Managing Group Membership
+ * @example Sync a Group's Members
+ * ```typescript
+ * const admins = yield* Group("Admins", {
+ *   groupName: "admins",
+ * });
+ *
+ * const alice = yield* User("Alice", {
+ *   userName: "alice",
+ * });
+ *
+ * const bob = yield* User("Bob", {
+ *   userName: "bob",
+ * });
+ *
+ * const membership = yield* GroupMembership("AdminsMembership", {
+ *   groupName: admins.groupName,
+ *   userNames: [alice.userName, bob.userName],
+ * });
+ * ```
+ */
+export const GroupMembership = Resource<GroupMembership>(
+  "AWS.IAM.GroupMembership",
+);
+
+export const GroupMembershipProvider = () =>
+  Provider.succeed(GroupMembership, {
+    stables: ["groupName"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.groupName !== news.groupName) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const response = yield* iam
+        .getGroup({
+          GroupName: output.groupName,
+        })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      if (!response?.Group?.GroupName) {
+        return undefined;
+      }
+      return {
+        groupName: response.Group.GroupName,
+        userNames: (response.Users ?? [])
+          .map((user) => user.UserName)
+          .filter(
+            (userName): userName is string => typeof userName === "string",
+          ),
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, session }) {
+      const groupName = news.groupName as string;
+      const desiredUsers = news.userNames as string[];
+
+      // Observe — read the actual membership of the group. `getGroup`
+      // both confirms the group exists and returns the current user list
+      // in a single call.
+      const response = yield* iam
+        .getGroup({ GroupName: groupName })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      const observedUsers = (response?.Users ?? [])
+        .map((user) => user.UserName)
+        .filter((userName): userName is string => typeof userName === "string");
+
+      // Sync — diff observed against desired and apply only the delta.
+      const observedSet = new Set(observedUsers);
+      const desiredSet = new Set(desiredUsers);
+      for (const userName of desiredUsers) {
+        if (!observedSet.has(userName)) {
+          yield* iam.addUserToGroup({
+            GroupName: groupName,
+            UserName: userName,
+          });
+        }
+      }
+      for (const userName of observedUsers) {
+        if (!desiredSet.has(userName)) {
+          yield* iam
+            .removeUserFromGroup({
+              GroupName: groupName,
+              UserName: userName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+      }
+
+      yield* session.note(groupName);
+      return {
+        groupName,
+        userNames: desiredUsers,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      for (const userName of output.userNames) {
+        yield* iam
+          .removeUserFromGroup({
+            GroupName: output.groupName,
+            UserName: userName,
+          })
+          .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+      }
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/InstanceProfile.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/InstanceProfile.ts
new file mode 100644
index 00000000000..1e178197cfe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/InstanceProfile.ts
@@ -0,0 +1,286 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import { toTagRecord } from "./common.ts";
+
+export interface InstanceProfileProps {
+  /**
+   * Name of the instance profile. If omitted, a deterministic name is generated.
+   */
+  instanceProfileName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * Optional role attached to the instance profile.
+   */
+  roleName?: Input<string>;
+  /**
+   * User-defined tags to apply to the instance profile.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface InstanceProfile extends Resource<
+  "AWS.IAM.InstanceProfile",
+  InstanceProfileProps,
+  {
+    instanceProfileArn: string;
+    instanceProfileName: string;
+    instanceProfileId: string | undefined;
+    path: string | undefined;
+    roleName: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM instance profile that can present a role to EC2 instances.
+ *
+ * `InstanceProfile` bridges IAM roles into EC2 so compute instances can assume
+ * the attached role through the instance metadata service.
+ *
+ * @section Attaching Roles to EC2
+ * @example Create an Instance Profile
+ * ```typescript
+ * const role = yield* Role("InstanceRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ec2.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ *
+ * const profile = yield* InstanceProfile("WebProfile", {
+ *   roleName: role.roleName,
+ * });
+ * ```
+ */
+export const InstanceProfile = Resource<InstanceProfile>(
+  "AWS.IAM.InstanceProfile",
+);
+
+export const InstanceProfileProvider = () =>
+  Provider.effect(
+    InstanceProfile,
+    Effect.gen(function* () {
+      const toName = (id: string, props: InstanceProfileProps) =>
+        props.instanceProfileName
+          ? Effect.succeed(props.instanceProfileName)
+          : createPhysicalName({ id, maxLength: 128 });
+
+      const readInstanceProfile = Effect.fn(function* (name: string) {
+        const response = yield* iam
+          .getInstanceProfile({
+            InstanceProfileName: name,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.InstanceProfile;
+      });
+
+      const syncRole = Effect.fn(function* ({
+        profileName,
+        currentRoleName,
+        nextRoleName,
+      }: {
+        profileName: string;
+        currentRoleName: string | undefined;
+        nextRoleName: string | undefined;
+      }) {
+        if (currentRoleName && currentRoleName !== nextRoleName) {
+          yield* iam
+            .removeRoleFromInstanceProfile({
+              InstanceProfileName: profileName,
+              RoleName: currentRoleName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+        if (nextRoleName && currentRoleName !== nextRoleName) {
+          yield* iam.addRoleToInstanceProfile({
+            InstanceProfileName: profileName,
+            RoleName: nextRoleName,
+          });
+        }
+      });
+
+      return {
+        stables: [
+          "instanceProfileArn",
+          "instanceProfileName",
+          "instanceProfileId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as InstanceProfileProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.instanceProfileName ??
+            (yield* toName(id, olds ?? ({} as InstanceProfileProps)));
+          const profile = yield* readInstanceProfile(name);
+          if (!profile?.Arn || !profile.InstanceProfileName) {
+            return undefined;
+          }
+          return {
+            instanceProfileArn: profile.Arn,
+            instanceProfileName: profile.InstanceProfileName,
+            instanceProfileId: profile.InstanceProfileId,
+            path: profile.Path,
+            roleName: profile.Roles?.[0]?.RoleName,
+            tags: toTagRecord(profile.Tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = output?.instanceProfileName ?? (yield* toName(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — fetch the live instance profile (or absence).
+          let profile = yield* readInstanceProfile(name);
+
+          // Ensure — create the profile when it is missing. Tolerate races
+          // and surface a clear error when an unrelated foreign profile
+          // already owns the name.
+          if (!profile?.Arn) {
+            yield* iam
+              .createInstanceProfile({
+                InstanceProfileName: name,
+                Path: news.path,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  Effect.gen(function* () {
+                    const existing = yield* readInstanceProfile(name);
+                    if (!existing?.Arn) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Instance profile '${name}' already exists but could not be described`,
+                        ),
+                      );
+                    }
+                    if (!hasTags(desiredTags, existing.Tags)) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Instance profile '${name}' already exists and is not managed by alchemy`,
+                        ),
+                      );
+                    }
+                  }),
+                ),
+              );
+            profile = yield* readInstanceProfile(name);
+            if (!profile?.Arn || !profile.InstanceProfileName) {
+              return yield* Effect.fail(
+                new Error(
+                  `Instance profile '${name}' was not readable after create`,
+                ),
+              );
+            }
+          }
+
+          // Sync role attachment — diff the observed role on the profile
+          // against the desired role and only swap when they differ.
+          const observedRoleName = profile.Roles?.[0]?.RoleName;
+          const desiredRoleName = news.roleName as string | undefined;
+          yield* syncRole({
+            profileName: name,
+            currentRoleName: observedRoleName,
+            nextRoleName: desiredRoleName,
+          });
+
+          // Sync tags — use the cloud's actual tags as the baseline so
+          // adoption / out-of-band tag changes converge correctly.
+          const observedTags = toTagRecord(profile.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagInstanceProfile({
+              InstanceProfileName: name,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagInstanceProfile({
+              InstanceProfileName: name,
+              TagKeys: removed,
+            });
+          }
+
+          // Re-read for fresh attributes (the profile's `Roles` array
+          // changes after `syncRole`).
+          const fresh = yield* readInstanceProfile(name);
+          if (!fresh?.Arn || !fresh.InstanceProfileName) {
+            return yield* Effect.fail(
+              new Error(
+                `Instance profile '${name}' was not readable after sync`,
+              ),
+            );
+          }
+
+          yield* session.note(fresh.Arn);
+          return {
+            instanceProfileArn: fresh.Arn,
+            instanceProfileName: fresh.InstanceProfileName,
+            instanceProfileId: fresh.InstanceProfileId,
+            path: fresh.Path,
+            roleName: fresh.Roles?.[0]?.RoleName,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const profile = yield* readInstanceProfile(
+            output.instanceProfileName,
+          );
+          for (const role of profile?.Roles ?? []) {
+            if (role.RoleName) {
+              yield* iam
+                .removeRoleFromInstanceProfile({
+                  InstanceProfileName: output.instanceProfileName,
+                  RoleName: role.RoleName,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+          yield* iam
+            .deleteInstanceProfile({
+              InstanceProfileName: output.instanceProfileName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/LoginProfile.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/LoginProfile.ts
new file mode 100644
index 00000000000..b522699c056
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/LoginProfile.ts
@@ -0,0 +1,150 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { unwrapRedactedString } from "./common.ts";
+
+export interface LoginProfileProps {
+  /**
+   * User that owns the console login profile.
+   */
+  userName: string;
+  /**
+   * Console password. AWS never returns this value after create/update.
+   */
+  password: Redacted.Redacted<string> | string;
+  /**
+   * Require a password reset on next sign in.
+   */
+  passwordResetRequired?: boolean;
+}
+
+export interface LoginProfile extends Resource<
+  "AWS.IAM.LoginProfile",
+  LoginProfileProps,
+  {
+    userName: string;
+    createDate: Date | undefined;
+    passwordResetRequired: boolean | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM console login profile for a user.
+ *
+ * `LoginProfile` manages AWS Management Console access for an IAM user. The
+ * password is write-only, so AWS never returns it during later reads.
+ *
+ * @section Managing Console Access
+ * @example Create a Console Login Profile
+ * ```typescript
+ * const user = yield* User("ConsoleUser", {
+ *   userName: "console-user",
+ * });
+ *
+ * const profile = yield* LoginProfile("ConsoleLogin", {
+ *   userName: user.userName,
+ *   password: Redacted.make("TempPassword123!"),
+ *   passwordResetRequired: true,
+ * });
+ * ```
+ */
+export const LoginProfile = Resource<LoginProfile>("AWS.IAM.LoginProfile");
+
+export const LoginProfileProvider = () =>
+  Provider.succeed(LoginProfile, {
+    stables: ["userName"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.userName !== news.userName) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const response = yield* iam
+        .getLoginProfile({
+          UserName: output.userName,
+        })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      if (!response?.LoginProfile) {
+        return undefined;
+      }
+      return {
+        userName: response.LoginProfile.UserName,
+        createDate: response.LoginProfile.CreateDate,
+        passwordResetRequired: response.LoginProfile.PasswordResetRequired,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, session }) {
+      // Observe — read the live login profile (or absence) for the user.
+      const observed = yield* iam
+        .getLoginProfile({ UserName: news.userName })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+
+      // Ensure / Sync — the password is write-only, so we always send the
+      // desired value. Use `createLoginProfile` when the profile is
+      // missing and `updateLoginProfile` otherwise. A race that turns the
+      // create into `EntityAlreadyExistsException` is recovered by
+      // calling update.
+      let response = observed;
+      if (!observed?.LoginProfile) {
+        response = yield* iam
+          .createLoginProfile({
+            UserName: news.userName,
+            Password: unwrapRedactedString(news.password),
+            PasswordResetRequired: news.passwordResetRequired,
+          })
+          .pipe(
+            Effect.catchTag("EntityAlreadyExistsException", () =>
+              Effect.gen(function* () {
+                yield* iam.updateLoginProfile({
+                  UserName: news.userName,
+                  Password: unwrapRedactedString(news.password),
+                  PasswordResetRequired: news.passwordResetRequired,
+                });
+                return yield* iam.getLoginProfile({
+                  UserName: news.userName,
+                });
+              }),
+            ),
+          );
+      } else {
+        yield* iam.updateLoginProfile({
+          UserName: news.userName,
+          Password: unwrapRedactedString(news.password),
+          PasswordResetRequired: news.passwordResetRequired,
+        });
+        response = yield* iam.getLoginProfile({ UserName: news.userName });
+      }
+
+      yield* session.note(news.userName);
+      return {
+        userName: response!.LoginProfile.UserName,
+        createDate: response!.LoginProfile.CreateDate,
+        passwordResetRequired: response!.LoginProfile.PasswordResetRequired,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteLoginProfile({
+          UserName: output.userName,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/OpenIDConnectProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/OpenIDConnectProvider.ts
new file mode 100644
index 00000000000..97b23e68e2f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/OpenIDConnectProvider.ts
@@ -0,0 +1,240 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { diffTags } from "../../Tags.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
+import { toTagRecord } from "./common.ts";
+
+export interface OpenIDConnectProviderProps {
+  /**
+   * The identity provider URL.
+   */
+  url: string;
+  /**
+   * Client IDs allowed for the provider. AWS rejects requests with an
+   * empty list, so the prop is typed as a non-empty tuple.
+   */
+  clientIDList?: [string, ...string[]];
+  /**
+   * Certificate thumbprints for the provider. AWS auto-manages thumbprints
+   * for well-known IdPs (e.g. GitHub Actions), so this is optional — but
+   * `iam.updateOpenIDConnectProviderThumbprint` rejects an empty list, so
+   * the prop is typed as a non-empty tuple when supplied.
+   */
+  thumbprintList?: [string, ...string[]];
+  /**
+   * User-defined tags to apply to the provider.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface OpenIDConnectProvider extends Resource<
+  "AWS.IAM.OpenIDConnectProvider",
+  OpenIDConnectProviderProps,
+  {
+    openIDConnectProviderArn: string;
+    url: string;
+    clientIDList: string[];
+    /**
+     * Reflects the desired state — `undefined` when the user opted out of
+     * managing thumbprints (AWS auto-manages them for well-known IdPs).
+     */
+    thumbprintList: string[] | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM OpenID Connect provider for web identity federation.
+ *
+ * `OpenIDConnectProvider` registers an external OIDC issuer so IAM roles can be
+ * assumed through web identity federation flows such as GitHub Actions.
+ *
+ * @section Federating with OIDC
+ * @example Create a GitHub Actions OIDC Provider
+ * ```typescript
+ * const oidc = yield* OpenIDConnectProvider("GithubOidc", {
+ *   url: "https://token.actions.githubusercontent.com",
+ *   clientIDList: ["sts.amazonaws.com"],
+ *   thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
+ * });
+ * ```
+ */
+export const OpenIDConnectProvider = Resource<OpenIDConnectProvider>(
+  "AWS.IAM.OpenIDConnectProvider",
+);
+
+export const OpenIDConnectProviderProvider = () =>
+  Provider.effect(
+    OpenIDConnectProvider,
+    Effect.gen(function* () {
+      const { accountId } = yield* AWSEnvironment;
+      const oidcArnFromUrl = (url: string) =>
+        `arn:aws:iam::${accountId}:oidc-provider/${url.replace(/^https?:\/\//, "")}`;
+
+      const readProvider = Effect.fn(function* (providerArn: string) {
+        const response = yield* iam
+          .getOpenIDConnectProvider({
+            OpenIDConnectProviderArn: providerArn,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response;
+      });
+
+      return {
+        stables: ["openIDConnectProviderArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds.url !== news.url) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const providerArn =
+            output?.openIDConnectProviderArn ?? oidcArnFromUrl(olds.url);
+          const provider = yield* readProvider(providerArn);
+          if (!provider?.Url) {
+            return undefined;
+          }
+          const tags = yield* iam.listOpenIDConnectProviderTags({
+            OpenIDConnectProviderArn: providerArn,
+          });
+          return {
+            openIDConnectProviderArn: providerArn,
+            url: provider.Url,
+            clientIDList: provider.ClientIDList ?? [],
+            thumbprintList: provider.ThumbprintList ?? [],
+            tags: toTagRecord(tags.Tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // The OIDC provider's ARN is deterministic from its URL, so we
+          // can observe with or without prior output.
+          const providerArn =
+            output?.openIDConnectProviderArn ?? oidcArnFromUrl(news.url);
+
+          // Observe — read the live provider; absent when missing.
+          let observed = yield* readProvider(providerArn);
+          let observedClientIds: string[] = [];
+          let observedThumbprints: string[] = [];
+          let observedTags: Record<string, string> = {};
+
+          if (observed?.Url) {
+            observedClientIds = observed.ClientIDList ?? [];
+            observedThumbprints = observed.ThumbprintList ?? [];
+            const tagsResp = yield* iam.listOpenIDConnectProviderTags({
+              OpenIDConnectProviderArn: providerArn,
+            });
+            observedTags = toTagRecord(tagsResp.Tags);
+          }
+
+          // Ensure — create the provider when it is missing. The API does
+          // not return idempotently for OIDC, but the deterministic ARN
+          // means a race manifests as `EntityAlreadyExistsException`.
+          if (!observed?.Url) {
+            yield* iam
+              .createOpenIDConnectProvider({
+                Url: news.url,
+                ClientIDList: news.clientIDList,
+                ThumbprintList: news.thumbprintList,
+                Tags: Object.entries(news.tags ?? {}).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "EntityAlreadyExistsException",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readProvider(providerArn);
+            observedClientIds = observed?.ClientIDList ?? [];
+            observedThumbprints = observed?.ThumbprintList ?? [];
+            const tagsResp = yield* iam.listOpenIDConnectProviderTags({
+              OpenIDConnectProviderArn: providerArn,
+            });
+            observedTags = toTagRecord(tagsResp.Tags);
+          }
+
+          // Sync client IDs against the observed list.
+          const desiredClientIds = news.clientIDList ?? [];
+          const observedClientSet = new Set(observedClientIds);
+          const desiredClientSet = new Set(desiredClientIds);
+          for (const clientId of desiredClientIds) {
+            if (!observedClientSet.has(clientId)) {
+              yield* iam.addClientIDToOpenIDConnectProvider({
+                OpenIDConnectProviderArn: providerArn,
+                ClientID: clientId,
+              });
+            }
+          }
+          for (const clientId of observedClientIds) {
+            if (!desiredClientSet.has(clientId)) {
+              yield* iam.removeClientIDFromOpenIDConnectProvider({
+                OpenIDConnectProviderArn: providerArn,
+                ClientID: clientId,
+              });
+            }
+          }
+
+          // Sync thumbprints — `updateOpenIDConnectProviderThumbprint`
+          // replaces the entire list, so call it whenever the set differs.
+          // When the user didn't request a list we leave the cloud-managed
+          // thumbprints alone (AWS auto-manages for well-known IdPs).
+          const desiredThumbprints = news.thumbprintList;
+          if (
+            desiredThumbprints &&
+            JSON.stringify([...observedThumbprints].sort()) !==
+              JSON.stringify([...desiredThumbprints].sort())
+          ) {
+            yield* iam.updateOpenIDConnectProviderThumbprint({
+              OpenIDConnectProviderArn: providerArn,
+              ThumbprintList: desiredThumbprints,
+            });
+          }
+
+          // Sync tags against the observed cloud tags.
+          const desiredTags = news.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagOpenIDConnectProvider({
+              OpenIDConnectProviderArn: providerArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagOpenIDConnectProvider({
+              OpenIDConnectProviderArn: providerArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(providerArn);
+          return {
+            openIDConnectProviderArn: providerArn,
+            url: news.url,
+            clientIDList: desiredClientIds,
+            thumbprintList: desiredThumbprints,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* iam
+            .deleteOpenIDConnectProvider({
+              OpenIDConnectProviderArn: output.openIDConnectProviderArn,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Policy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Policy.ts
new file mode 100644
index 00000000000..6edf4eb48f0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Policy.ts
@@ -0,0 +1,395 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  oldestNondefaultPolicyVersion,
+  parsePolicyDocument,
+  policyArnFromParts,
+  stringifyPolicyDocument,
+  toTagRecord,
+} from "./common.ts";
+
+export interface PolicyDocument {
+  Version: "2012-10-17";
+  Statement: PolicyStatement[];
+}
+
+export interface PolicyStatement {
+  Effect: "Allow" | "Deny";
+  Sid?: string;
+  Action: string[];
+  Resource?: string | string[];
+  Condition?: Record<string, Record<string, string | string[]>>;
+  Principal?: Record<string, string | string[]>;
+  NotPrincipal?: Record<string, string | string[]>;
+  NotAction?: string[];
+  NotResource?: string[];
+}
+
+export type PolicyName = string;
+export type PolicyArn = `arn:aws:iam::${AccountID}:policy/${string}`;
+
+export interface PolicyProps {
+  /**
+   * Name of the managed policy. If omitted, a deterministic name is generated.
+   */
+  policyName?: string;
+  /**
+   * Optional IAM path prefix for the policy.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * The JSON IAM policy document.
+   */
+  policyDocument: PolicyDocument;
+  /**
+   * Optional description for the policy.
+   */
+  description?: string;
+  /**
+   * User-defined tags to apply to the managed policy.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Policy extends Resource<
+  "AWS.IAM.Policy",
+  PolicyProps,
+  {
+    policyArn: PolicyArn;
+    policyName: PolicyName;
+    policyId: string | undefined;
+    path: string | undefined;
+    defaultVersionId: string | undefined;
+    attachmentCount: number | undefined;
+    permissionsBoundaryUsageCount: number | undefined;
+    isAttachable: boolean | undefined;
+    description: string | undefined;
+    policyDocument: PolicyDocument;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A customer-managed IAM policy.
+ *
+ * `Policy` owns the lifecycle of the policy metadata and its default version,
+ * rotating versions on updates while keeping the current document attached to a
+ * stable policy ARN.
+ *
+ * @section Creating Policies
+ * @example Managed Policy
+ * ```typescript
+ * const policy = yield* Policy("AppPolicy", {
+ *   policyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Action: ["s3:GetObject"],
+ *       Resource: ["arn:aws:s3:::my-bucket/*"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export const Policy = Resource<Policy>("AWS.IAM.Policy");
+
+export const PolicyProvider = () =>
+  Provider.effect(
+    Policy,
+    Effect.gen(function* () {
+      const { accountId } = yield* AWSEnvironment;
+
+      const toPolicyName = (id: string, props: PolicyProps) =>
+        props.policyName
+          ? Effect.succeed(props.policyName)
+          : createPhysicalName({ id, maxLength: 128 });
+
+      const toPolicyArn = Effect.fn(function* (id: string, props: PolicyProps) {
+        const policyName = yield* toPolicyName(id, props);
+        return policyArnFromParts({
+          accountId,
+          path: props.path,
+          policyName,
+        }) as PolicyArn;
+      });
+
+      const readPolicy = Effect.fn(function* (policyArn: string) {
+        const response = yield* iam
+          .getPolicy({ PolicyArn: policyArn })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.Policy;
+      });
+
+      const readPolicyDocument = Effect.fn(function* ({
+        policyArn,
+        versionId,
+      }: {
+        policyArn: string;
+        versionId: string | undefined;
+      }) {
+        if (!versionId) {
+          return undefined;
+        }
+        const response = yield* iam
+          .getPolicyVersion({
+            PolicyArn: policyArn,
+            VersionId: versionId,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return parsePolicyDocument(response?.PolicyVersion?.Document);
+      });
+
+      const prunePolicyVersions = Effect.fn(function* (policyArn: string) {
+        const versions = yield* iam.listPolicyVersions({
+          PolicyArn: policyArn,
+        });
+        if ((versions.Versions?.length ?? 0) < 5) {
+          return;
+        }
+        const removable = oldestNondefaultPolicyVersion(versions.Versions);
+        if (!removable?.VersionId) {
+          return;
+        }
+        yield* iam.deletePolicyVersion({
+          PolicyArn: policyArn,
+          VersionId: removable.VersionId,
+        });
+      });
+
+      return {
+        stables: ["policyArn", "policyName", "policyId"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toPolicyName(id, olds ?? ({} as PolicyProps))) !==
+            (yield* toPolicyName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+            return { action: "replace" } as const;
+          }
+          if (
+            (olds?.description ?? undefined) !== (news.description ?? undefined)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const policyArn =
+            output?.policyArn ??
+            (yield* toPolicyArn(id, olds ?? ({} as PolicyProps)));
+          const policy = yield* readPolicy(policyArn);
+          if (!policy?.Arn || !policy.PolicyName) {
+            return undefined;
+          }
+
+          const tags = yield* iam.listPolicyTags({
+            PolicyArn: policy.Arn,
+          });
+          const policyDocument = yield* readPolicyDocument({
+            policyArn: policy.Arn,
+            versionId: policy.DefaultVersionId,
+          });
+
+          if (!policyDocument) {
+            return undefined;
+          }
+
+          return {
+            policyArn: policy.Arn as PolicyArn,
+            policyName: policy.PolicyName,
+            policyId: policy.PolicyId,
+            path: policy.Path,
+            defaultVersionId: policy.DefaultVersionId,
+            attachmentCount: policy.AttachmentCount,
+            permissionsBoundaryUsageCount: policy.PermissionsBoundaryUsageCount,
+            isAttachable: policy.IsAttachable,
+            description: policy.Description,
+            policyDocument,
+            tags: toTagRecord(tags.Tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const policyName =
+            output?.policyName ?? (yield* toPolicyName(id, news));
+          const policyArn = output?.policyArn ?? (yield* toPolicyArn(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — fetch the policy metadata, current default-version
+          // document, and tags. Each piece feeds an independent sync step.
+          let observed = yield* readPolicy(policyArn);
+
+          // Ensure — create the managed policy when it is missing. We
+          // pass the desired document as the initial version so first
+          // create lands fully configured. On race, adopt by reading
+          // existing.
+          if (!observed?.Arn) {
+            const created = yield* iam
+              .createPolicy({
+                PolicyName: policyName,
+                Path: news.path,
+                PolicyDocument: stringifyPolicyDocument(news.policyDocument),
+                Description: news.description,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  Effect.gen(function* () {
+                    const existing = yield* readPolicy(policyArn);
+                    if (!existing?.Arn) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Policy '${policyName}' already exists but could not be described`,
+                        ),
+                      );
+                    }
+                    const existingTags = yield* iam.listPolicyTags({
+                      PolicyArn: existing.Arn,
+                    });
+                    if (!hasTags(desiredTags, existingTags.Tags)) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Policy '${policyName}' already exists and is not managed by alchemy`,
+                        ),
+                      );
+                    }
+                    return { Policy: existing };
+                  }),
+                ),
+              );
+            observed = created.Policy;
+          }
+
+          // Sync default-version document — IAM managed policies are
+          // immutable per version, so any document change requires
+          // creating a new default version (and pruning the oldest non-
+          // default if we're at the 5-version cap).
+          const observedDocument = yield* readPolicyDocument({
+            policyArn,
+            versionId: observed?.DefaultVersionId,
+          });
+          if (
+            JSON.stringify(observedDocument ?? null) !==
+            JSON.stringify(news.policyDocument)
+          ) {
+            yield* prunePolicyVersions(policyArn);
+            const createdVersion = yield* iam.createPolicyVersion({
+              PolicyArn: policyArn,
+              PolicyDocument: stringifyPolicyDocument(news.policyDocument),
+              SetAsDefault: true,
+            });
+            if (createdVersion.PolicyVersion?.VersionId) {
+              yield* iam.setDefaultPolicyVersion({
+                PolicyArn: policyArn,
+                VersionId: createdVersion.PolicyVersion.VersionId,
+              });
+            }
+          }
+
+          // Sync tags against the cloud's actual tags so adoption /
+          // out-of-band tag changes converge.
+          const observedTagsResp = yield* iam.listPolicyTags({
+            PolicyArn: policyArn,
+          });
+          const observedTags = toTagRecord(observedTagsResp.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagPolicy({
+              PolicyArn: policyArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagPolicy({
+              PolicyArn: policyArn,
+              TagKeys: removed,
+            });
+          }
+
+          // Re-read for fresh metadata and the now-current document.
+          const fresh = yield* readPolicy(policyArn);
+          const freshDocument =
+            (yield* readPolicyDocument({
+              policyArn,
+              versionId: fresh?.DefaultVersionId,
+            })) ?? news.policyDocument;
+
+          yield* session.note(policyArn);
+          return {
+            policyArn,
+            policyName,
+            policyId: fresh?.PolicyId ?? observed?.PolicyId,
+            path: fresh?.Path ?? observed?.Path ?? news.path ?? "/",
+            defaultVersionId:
+              fresh?.DefaultVersionId ?? observed?.DefaultVersionId,
+            attachmentCount:
+              fresh?.AttachmentCount ?? observed?.AttachmentCount,
+            permissionsBoundaryUsageCount:
+              fresh?.PermissionsBoundaryUsageCount ??
+              observed?.PermissionsBoundaryUsageCount,
+            isAttachable: fresh?.IsAttachable ?? observed?.IsAttachable,
+            description:
+              fresh?.Description ?? observed?.Description ?? news.description,
+            policyDocument: freshDocument,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          const versions = yield* iam
+            .listPolicyVersions({
+              PolicyArn: output.policyArn,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          for (const version of versions?.Versions ?? []) {
+            if (!version.IsDefaultVersion && version.VersionId) {
+              yield* iam
+                .deletePolicyVersion({
+                  PolicyArn: output.policyArn,
+                  VersionId: version.VersionId,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+          yield* iam
+            .deletePolicy({
+              PolicyArn: output.policyArn,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Role.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Role.ts
new file mode 100644
index 00000000000..44fcdf9efb0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/Role.ts
@@ -0,0 +1,515 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasAlchemyTags,
+} from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { PolicyDocument } from "./Policy.ts";
+import {
+  parsePolicyDocument,
+  stringifyPolicyDocument,
+  toTagRecord,
+} from "./common.ts";
+
+export type RoleName = string;
+export type RoleArn = `arn:aws:iam::${AccountID}:role/${RoleName}`;
+
+export interface RoleProps {
+  /**
+   * Name of the role. If omitted, a unique name will be generated.
+   */
+  roleName?: string;
+  /**
+   * Optional IAM path prefix for the role.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * IAM trust policy for the role.
+   */
+  assumeRolePolicyDocument: PolicyDocument;
+  /**
+   * Managed policy ARNs to attach to the role.
+   */
+  managedPolicyArns?: string[];
+  /**
+   * Inline policies keyed by policy name.
+   */
+  inlinePolicies?: Record<string, PolicyDocument>;
+  /**
+   * Optional description for the role.
+   */
+  description?: string;
+  /**
+   * Maximum session duration in seconds.
+   */
+  maxSessionDuration?: number;
+  /**
+   * Optional managed policy ARN used as the permissions boundary.
+   */
+  permissionsBoundary?: string;
+  /**
+   * User-defined tags to apply to the role.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Role extends Resource<
+  "AWS.IAM.Role",
+  RoleProps,
+  {
+    roleArn: RoleArn;
+    roleName: RoleName;
+    roleId: string | undefined;
+    path: string | undefined;
+    assumeRolePolicyDocument: PolicyDocument;
+    managedPolicyArns: string[];
+    inlinePolicies: Record<string, PolicyDocument>;
+    description: string | undefined;
+    maxSessionDuration: number | undefined;
+    permissionsBoundary: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM role for AWS services and runtimes.
+ *
+ * @section Creating Roles
+ * @example ECS Task Role
+ * ```typescript
+ * const role = yield* Role("TaskRole", {
+ *   assumeRolePolicyDocument: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "ecs-tasks.amazonaws.com" },
+ *       Action: ["sts:AssumeRole"],
+ *     }],
+ *   },
+ * });
+ * ```
+ */
+export const Role = Resource<Role>("AWS.IAM.Role");
+
+export const RoleProvider = () =>
+  Provider.effect(
+    Role,
+    Effect.gen(function* () {
+      yield* AWSEnvironment;
+
+      const toRoleName = (id: string, props: { roleName?: string } = {}) =>
+        props.roleName
+          ? Effect.succeed(props.roleName)
+          : createPhysicalName({ id, maxLength: 64 });
+
+      const readInlinePolicies = Effect.fn(function* (roleName: string) {
+        const listed = yield* iam.listRolePolicies({
+          RoleName: roleName,
+        });
+        const entries = yield* Effect.all(
+          (listed.PolicyNames ?? []).map((policyName) =>
+            iam
+              .getRolePolicy({
+                RoleName: roleName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.map(
+                  (response) =>
+                    [
+                      policyName,
+                      parsePolicyDocument(response.PolicyDocument),
+                    ] as const,
+                ),
+                Effect.catchTag("NoSuchEntityException", () =>
+                  Effect.succeed([policyName, undefined] as const),
+                ),
+              ),
+          ),
+        );
+        return Object.fromEntries(
+          entries.filter(
+            (entry): entry is [string, PolicyDocument] =>
+              entry[1] !== undefined,
+          ),
+        );
+      });
+
+      const readManagedPolicies = Effect.fn(function* (roleName: string) {
+        const listed = yield* iam.listAttachedRolePolicies({
+          RoleName: roleName,
+        });
+        return (listed.AttachedPolicies ?? [])
+          .map((policy) => policy.PolicyArn)
+          .filter(
+            (policyArn): policyArn is string => typeof policyArn === "string",
+          );
+      });
+
+      const readTags = Effect.fn(function* (roleName: string) {
+        const listed = yield* iam.listRoleTags({
+          RoleName: roleName,
+        });
+        return toTagRecord(listed.Tags);
+      });
+
+      const syncManagedPolicies = Effect.fn(function* ({
+        roleName,
+        olds,
+        news,
+      }: {
+        roleName: string;
+        olds: string[];
+        news: string[];
+      }) {
+        const oldSet = new Set(olds);
+        const newSet = new Set(news);
+
+        for (const policyArn of news) {
+          if (!oldSet.has(policyArn)) {
+            yield* iam.attachRolePolicy({
+              RoleName: roleName,
+              PolicyArn: policyArn,
+            });
+          }
+        }
+
+        for (const policyArn of olds) {
+          if (!newSet.has(policyArn)) {
+            yield* iam
+              .detachRolePolicy({
+                RoleName: roleName,
+                PolicyArn: policyArn,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }
+      });
+
+      const syncInlinePolicies = Effect.fn(function* ({
+        roleName,
+        olds,
+        news,
+      }: {
+        roleName: string;
+        olds: Record<string, PolicyDocument>;
+        news: Record<string, PolicyDocument>;
+      }) {
+        for (const [policyName, document] of Object.entries(news)) {
+          if (
+            JSON.stringify(olds[policyName] ?? null) !==
+            JSON.stringify(document)
+          ) {
+            yield* iam.putRolePolicy({
+              RoleName: roleName,
+              PolicyName: policyName,
+              PolicyDocument: stringifyPolicyDocument(document),
+            });
+          }
+        }
+
+        for (const policyName of Object.keys(olds)) {
+          if (!(policyName in news)) {
+            yield* iam
+              .deleteRolePolicy({
+                RoleName: roleName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }
+      });
+
+      return {
+        stables: ["roleArn", "roleName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toRoleName(id, olds ?? {})) !==
+            (yield* toRoleName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const roleName =
+            output?.roleName ?? (yield* toRoleName(id, olds ?? {}));
+          const role = yield* iam
+            .getRole({
+              RoleName: roleName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!role?.Role) {
+            return undefined;
+          }
+
+          const [managedPolicyArns, inlinePolicies, tags] = yield* Effect.all([
+            readManagedPolicies(roleName),
+            readInlinePolicies(roleName),
+            readTags(roleName),
+          ]);
+
+          const assumeRolePolicyDocument =
+            parsePolicyDocument(role.Role.AssumeRolePolicyDocument) ??
+            output?.assumeRolePolicyDocument;
+          if (!assumeRolePolicyDocument) {
+            return undefined;
+          }
+
+          const attrs = {
+            roleArn: role.Role.Arn as RoleArn,
+            roleName: role.Role.RoleName,
+            roleId: role.Role.RoleId,
+            path: role.Role.Path,
+            assumeRolePolicyDocument,
+            managedPolicyArns,
+            inlinePolicies,
+            description: role.Role.Description,
+            maxSessionDuration: role.Role.MaxSessionDuration,
+            permissionsBoundary:
+              role.Role.PermissionsBoundary?.PermissionsBoundaryArn,
+            tags,
+          };
+          return (yield* hasAlchemyTags(id, tags)) ? attrs : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const roleName = output?.roleName ?? (yield* toRoleName(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — read the role from IAM. Absence is signalled by
+          // `NoSuchEntityException`; ownership has already been verified
+          // upstream so adopting a `Unowned` role is the engine's call.
+          let observedRole = yield* iam
+            .getRole({ RoleName: roleName })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create the role when missing. A peer reconciler may
+          // have created it concurrently; tolerate that race by reading
+          // the existing role.
+          if (!observedRole?.Role) {
+            observedRole = yield* iam
+              .createRole({
+                Path: news.path,
+                RoleName: roleName,
+                AssumeRolePolicyDocument: stringifyPolicyDocument(
+                  news.assumeRolePolicyDocument,
+                ),
+                Description: news.description,
+                MaxSessionDuration: news.maxSessionDuration,
+                PermissionsBoundary: news.permissionsBoundary,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  iam.getRole({ RoleName: roleName }),
+                ),
+              );
+          }
+
+          const observedAssumePolicy = parsePolicyDocument(
+            observedRole.Role?.AssumeRolePolicyDocument,
+          );
+          const observedDescription = observedRole.Role?.Description;
+          const observedMaxSessionDuration =
+            observedRole.Role?.MaxSessionDuration;
+          const observedPermissionsBoundary =
+            observedRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn;
+
+          // Sync assume-role policy — only call updateAssumeRolePolicy
+          // when the document actually differs.
+          if (
+            JSON.stringify(observedAssumePolicy ?? null) !==
+            JSON.stringify(news.assumeRolePolicyDocument)
+          ) {
+            yield* iam.updateAssumeRolePolicy({
+              RoleName: roleName,
+              PolicyDocument: stringifyPolicyDocument(
+                news.assumeRolePolicyDocument,
+              ),
+            });
+          }
+
+          // Sync description / maxSessionDuration via updateRole.
+          if (
+            observedDescription !== news.description ||
+            observedMaxSessionDuration !== news.maxSessionDuration
+          ) {
+            yield* iam.updateRole({
+              RoleName: roleName,
+              Description: news.description,
+              MaxSessionDuration: news.maxSessionDuration,
+            });
+          }
+
+          // Sync permissions boundary — put when desired, delete when
+          // cleared, no-op when unchanged.
+          if (news.permissionsBoundary !== observedPermissionsBoundary) {
+            if (news.permissionsBoundary) {
+              yield* iam.putRolePermissionsBoundary({
+                RoleName: roleName,
+                PermissionsBoundary: news.permissionsBoundary,
+              });
+            } else if (observedPermissionsBoundary) {
+              yield* iam
+                .deleteRolePermissionsBoundary({
+                  RoleName: roleName,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+
+          // Sync managed and inline policies — observe the live state
+          // and apply only the delta. This is robust to manual edits in
+          // the AWS console and to adoption.
+          const [observedManagedPolicies, observedInlinePolicies] =
+            yield* Effect.all([
+              readManagedPolicies(roleName),
+              readInlinePolicies(roleName),
+            ]);
+          yield* syncManagedPolicies({
+            roleName,
+            olds: observedManagedPolicies,
+            news: news.managedPolicyArns ?? [],
+          });
+          yield* syncInlinePolicies({
+            roleName,
+            olds: observedInlinePolicies,
+            news: news.inlinePolicies ?? {},
+          });
+
+          // Sync tags against the cloud's actual tags so adoption /
+          // out-of-band tag changes converge.
+          const observedTags = yield* readTags(roleName);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagRole({
+              RoleName: roleName,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagRole({
+              RoleName: roleName,
+              TagKeys: removed,
+            });
+          }
+
+          // Re-read for fresh attributes after all mutations.
+          const liveRole = yield* iam.getRole({ RoleName: roleName });
+          const roleArn = (liveRole.Role?.Arn ??
+            observedRole.Role?.Arn ??
+            `arn:aws:iam::${(yield* AWSEnvironment).accountId}:role/${roleName}`) as RoleArn;
+
+          yield* session.note(roleArn);
+          return {
+            roleArn,
+            roleName: liveRole.Role?.RoleName ?? roleName,
+            roleId: liveRole.Role?.RoleId ?? observedRole.Role?.RoleId,
+            path:
+              liveRole.Role?.Path ??
+              observedRole.Role?.Path ??
+              news.path ??
+              "/",
+            assumeRolePolicyDocument: news.assumeRolePolicyDocument,
+            managedPolicyArns: news.managedPolicyArns ?? [],
+            inlinePolicies: news.inlinePolicies ?? {},
+            description: liveRole.Role?.Description ?? news.description,
+            maxSessionDuration:
+              liveRole.Role?.MaxSessionDuration ?? news.maxSessionDuration,
+            permissionsBoundary:
+              liveRole.Role?.PermissionsBoundary?.PermissionsBoundaryArn ??
+              news.permissionsBoundary,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* iam
+            .deleteRolePermissionsBoundary({
+              RoleName: output.roleName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+
+          yield* iam.listRolePolicies({ RoleName: output.roleName }).pipe(
+            Effect.flatMap((policies) =>
+              Effect.all(
+                (policies.PolicyNames ?? []).map((policyName) =>
+                  iam
+                    .deleteRolePolicy({
+                      RoleName: output.roleName,
+                      PolicyName: policyName,
+                    })
+                    .pipe(
+                      Effect.catchTag(
+                        "NoSuchEntityException",
+                        () => Effect.void,
+                      ),
+                    ),
+                ),
+              ),
+            ),
+          );
+
+          yield* iam
+            .listAttachedRolePolicies({ RoleName: output.roleName })
+            .pipe(
+              Effect.flatMap((policies) =>
+                Effect.all(
+                  (policies.AttachedPolicies ?? []).map((policy) =>
+                    iam
+                      .detachRolePolicy({
+                        RoleName: output.roleName,
+                        PolicyArn: policy.PolicyArn!,
+                      })
+                      .pipe(
+                        Effect.catchTag(
+                          "NoSuchEntityException",
+                          () => Effect.void,
+                        ),
+                      ),
+                  ),
+                ),
+              ),
+            );
+
+          yield* iam
+            .deleteRole({
+              RoleName: output.roleName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SAMLProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SAMLProvider.ts
new file mode 100644
index 00000000000..4ac9683579e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SAMLProvider.ts
@@ -0,0 +1,222 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { AWSEnvironment } from "../Environment.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
+import { toTagRecord, unwrapRedactedString } from "./common.ts";
+
+export interface SAMLProviderProps {
+  /**
+   * The friendly SAML provider name.
+   */
+  name: string;
+  /**
+   * The provider metadata document.
+   */
+  samlMetadataDocument: string;
+  /**
+   * Optional assertion encryption mode.
+   */
+  assertionEncryptionMode?: iam.AssertionEncryptionModeType;
+  /**
+   * Optional private key added during creation/update.
+   */
+  addPrivateKey?: Redacted.Redacted<string> | string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface SAMLProvider extends Resource<
+  "AWS.IAM.SAMLProvider",
+  SAMLProviderProps,
+  {
+    samlProviderArn: string;
+    name: string;
+    samlProviderUUID: string | undefined;
+    samlMetadataDocument: string | undefined;
+    assertionEncryptionMode: iam.AssertionEncryptionModeType | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM SAML identity provider.
+ *
+ * `SAMLProvider` registers a SAML metadata document so IAM roles can trust an
+ * external workforce or application identity provider.
+ *
+ * @section Federating with SAML
+ * @example Create a SAML Identity Provider
+ * ```typescript
+ * const provider = yield* SAMLProvider("WorkforceSaml", {
+ *   name: "workforce-saml",
+ *   samlMetadataDocument: "<EntityDescriptor>...</EntityDescriptor>",
+ * });
+ * ```
+ */
+export const SAMLProvider = Resource<SAMLProvider>("AWS.IAM.SAMLProvider");
+
+export const SAMLProviderProvider = () =>
+  Provider.succeed(SAMLProvider, {
+    stables: ["samlProviderArn"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (olds.name !== news.name) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const response = yield* iam
+        .getSAMLProvider({
+          SAMLProviderArn: output.samlProviderArn,
+        })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      if (!response) {
+        return undefined;
+      }
+      const tags = yield* iam.listSAMLProviderTags({
+        SAMLProviderArn: output.samlProviderArn,
+      });
+      return {
+        samlProviderArn: output.samlProviderArn,
+        name: output.name,
+        samlProviderUUID: response.SAMLProviderUUID,
+        samlMetadataDocument: response.SAMLMetadataDocument,
+        assertionEncryptionMode: response.AssertionEncryptionMode,
+        tags: toTagRecord(tags.Tags),
+      };
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output, session }) {
+      const internalTags = yield* createInternalTags(id);
+      const desiredTags = {
+        ...internalTags,
+        ...news.tags,
+      };
+      const accountId = (yield* AWSEnvironment).accountId;
+      const samlProviderArn =
+        output?.samlProviderArn ??
+        `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
+
+      // Observe — `getSAMLProvider` returns the metadata, encryption
+      // mode, and UUID; absence is `NoSuchEntityException`.
+      let observed = yield* iam
+        .getSAMLProvider({ SAMLProviderArn: samlProviderArn })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+
+      // Ensure — create when missing. Race with a peer is recovered by
+      // verifying alchemy ownership tags on the existing provider.
+      if (!observed) {
+        const created = yield* iam
+          .createSAMLProvider({
+            Name: news.name,
+            SAMLMetadataDocument: news.samlMetadataDocument,
+            AssertionEncryptionMode: news.assertionEncryptionMode,
+            AddPrivateKey: news.addPrivateKey
+              ? unwrapRedactedString(news.addPrivateKey)
+              : undefined,
+            Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+              Key,
+              Value,
+            })),
+          })
+          .pipe(
+            Effect.catchTag("EntityAlreadyExistsException", () =>
+              Effect.gen(function* () {
+                const existingTags = yield* iam.listSAMLProviderTags({
+                  SAMLProviderArn: samlProviderArn,
+                });
+                if (!hasTags(internalTags, existingTags.Tags)) {
+                  return yield* Effect.fail(
+                    new Error(
+                      `SAML provider '${news.name}' already exists and is not managed by alchemy`,
+                    ),
+                  );
+                }
+                return { SAMLProviderArn: samlProviderArn };
+              }),
+            ),
+          );
+        observed = yield* iam.getSAMLProvider({
+          SAMLProviderArn: created.SAMLProviderArn ?? samlProviderArn,
+        });
+      } else {
+        // Sync metadata / encryption mode — `updateSAMLProvider` is a
+        // partial update; only push the doc when it actually differs.
+        if (
+          (observed.SAMLMetadataDocument ?? undefined) !==
+            news.samlMetadataDocument ||
+          observed.AssertionEncryptionMode !== news.assertionEncryptionMode ||
+          news.addPrivateKey !== undefined
+        ) {
+          yield* iam.updateSAMLProvider({
+            SAMLProviderArn: samlProviderArn,
+            SAMLMetadataDocument:
+              (observed.SAMLMetadataDocument ?? undefined) !==
+              news.samlMetadataDocument
+                ? news.samlMetadataDocument
+                : undefined,
+            AssertionEncryptionMode: news.assertionEncryptionMode,
+            AddPrivateKey: news.addPrivateKey
+              ? unwrapRedactedString(news.addPrivateKey)
+              : undefined,
+          });
+        }
+      }
+
+      // Sync tags against the cloud's actual tags.
+      const observedTagsResp = yield* iam.listSAMLProviderTags({
+        SAMLProviderArn: samlProviderArn,
+      });
+      const observedTags = toTagRecord(observedTagsResp.Tags);
+      const { removed, upsert } = diffTags(observedTags, desiredTags);
+      if (upsert.length > 0) {
+        yield* iam.tagSAMLProvider({
+          SAMLProviderArn: samlProviderArn,
+          Tags: upsert,
+        });
+      }
+      if (removed.length > 0) {
+        yield* iam.untagSAMLProvider({
+          SAMLProviderArn: samlProviderArn,
+          TagKeys: removed,
+        });
+      }
+
+      yield* session.note(samlProviderArn);
+      return {
+        samlProviderArn,
+        name: news.name,
+        samlProviderUUID:
+          observed?.SAMLProviderUUID ?? output?.samlProviderUUID,
+        samlMetadataDocument: news.samlMetadataDocument,
+        assertionEncryptionMode: news.assertionEncryptionMode,
+        tags: desiredTags,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteSAMLProvider({
+          SAMLProviderArn: output.samlProviderArn,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SSHPublicKey.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SSHPublicKey.ts
new file mode 100644
index 00000000000..2db7fae54a3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SSHPublicKey.ts
@@ -0,0 +1,162 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface SSHPublicKeyProps {
+  /**
+   * User that owns the SSH public key.
+   */
+  userName: string;
+  /**
+   * SSH public key body.
+   */
+  sshPublicKeyBody: string;
+  /**
+   * Desired key status.
+   * @default "Active"
+   */
+  status?: iam.StatusType;
+}
+
+export interface SSHPublicKey extends Resource<
+  "AWS.IAM.SSHPublicKey",
+  SSHPublicKeyProps,
+  {
+    userName: string;
+    sshPublicKeyId: string;
+    fingerprint: string;
+    sshPublicKeyBody: string;
+    status: iam.StatusType;
+    uploadDate: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM SSH public key for CodeCommit-compatible workflows.
+ *
+ * `SSHPublicKey` uploads and manages a user's public key for services such as
+ * AWS CodeCommit that authenticate through IAM-backed SSH credentials.
+ *
+ * @section Managing SSH Keys
+ * @example Upload an SSH Public Key
+ * ```typescript
+ * const user = yield* User("GitUser", {
+ *   userName: "codecommit-user",
+ * });
+ *
+ * const key = yield* SSHPublicKey("GitKey", {
+ *   userName: user.userName,
+ *   sshPublicKeyBody: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExample codecommit-user",
+ * });
+ * ```
+ */
+export const SSHPublicKey = Resource<SSHPublicKey>("AWS.IAM.SSHPublicKey");
+
+export const SSHPublicKeyProvider = () =>
+  Provider.succeed(SSHPublicKey, {
+    stables: ["sshPublicKeyId"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (
+        olds.userName !== news.userName ||
+        olds.sshPublicKeyBody !== news.sshPublicKeyBody
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const response = yield* iam
+        .getSSHPublicKey({
+          UserName: output.userName,
+          SSHPublicKeyId: output.sshPublicKeyId,
+          Encoding: "SSH",
+        })
+        .pipe(
+          Effect.catchTag("NoSuchEntityException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      if (!response?.SSHPublicKey?.SSHPublicKeyId) {
+        return undefined;
+      }
+      return {
+        userName: response.SSHPublicKey.UserName,
+        sshPublicKeyId: response.SSHPublicKey.SSHPublicKeyId,
+        fingerprint: response.SSHPublicKey.Fingerprint,
+        sshPublicKeyBody: response.SSHPublicKey.SSHPublicKeyBody,
+        status: response.SSHPublicKey.Status,
+        uploadDate: response.SSHPublicKey.UploadDate,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      // Observe — SSH key ids are AWS-generated; we can only locate the
+      // existing key when we have its id from a prior output. The body
+      // and identity are immutable (`diff` triggers replacement on body
+      // change), so a missing key always means we need to upload.
+      const observed = output
+        ? yield* iam
+            .getSSHPublicKey({
+              UserName: output.userName,
+              SSHPublicKeyId: output.sshPublicKeyId,
+              Encoding: "SSH",
+            })
+            .pipe(
+              Effect.map((r) => r.SSHPublicKey),
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            )
+        : undefined;
+
+      // Ensure — upload when missing.
+      let key = observed;
+      if (!key?.SSHPublicKeyId) {
+        const uploaded = yield* iam.uploadSSHPublicKey({
+          UserName: news.userName,
+          SSHPublicKeyBody: news.sshPublicKeyBody,
+        });
+        if (!uploaded.SSHPublicKey?.SSHPublicKeyId) {
+          return yield* Effect.fail(
+            new Error(`uploadSSHPublicKey returned no key id`),
+          );
+        }
+        key = uploaded.SSHPublicKey;
+      }
+
+      // Sync — apply the desired status when it differs from observed.
+      const desiredStatus = news.status ?? key.Status;
+      if (desiredStatus !== key.Status) {
+        yield* iam.updateSSHPublicKey({
+          UserName: news.userName,
+          SSHPublicKeyId: key.SSHPublicKeyId!,
+          Status: desiredStatus,
+        });
+      }
+
+      yield* session.note(key.SSHPublicKeyId!);
+      return {
+        userName: key.UserName,
+        sshPublicKeyId: key.SSHPublicKeyId!,
+        fingerprint: key.Fingerprint,
+        sshPublicKeyBody: key.SSHPublicKeyBody,
+        status: desiredStatus,
+        uploadDate: key.UploadDate,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteSSHPublicKey({
+          UserName: output.userName,
+          SSHPublicKeyId: output.sshPublicKeyId,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/ServerCertificate.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/ServerCertificate.ts
new file mode 100644
index 00000000000..63e50b28676
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/ServerCertificate.ts
@@ -0,0 +1,261 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import { toTagRecord } from "./common.ts";
+
+export interface ServerCertificateProps {
+  /**
+   * Name of the server certificate. If omitted, a deterministic name is generated.
+   */
+  serverCertificateName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * PEM-encoded leaf certificate body.
+   */
+  certificateBody: string;
+  /**
+   * PEM-encoded private key. AWS never returns this after upload.
+   */
+  privateKey: Redacted.Redacted<string> | string;
+  /**
+   * Optional PEM-encoded certificate chain.
+   */
+  certificateChain?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface ServerCertificate extends Resource<
+  "AWS.IAM.ServerCertificate",
+  ServerCertificateProps,
+  {
+    serverCertificateArn: string;
+    serverCertificateName: string;
+    serverCertificateId: string | undefined;
+    path: string | undefined;
+    certificateBody: string;
+    certificateChain: string | undefined;
+    uploadDate: Date | undefined;
+    expiration: Date | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM server certificate.
+ *
+ * `ServerCertificate` uploads and tracks a TLS certificate bundle for legacy
+ * IAM-integrated services. The private key is write-only and should be provided
+ * as a redacted value when possible.
+ *
+ * @section Uploading Server Certificates
+ * @example Upload a TLS Certificate
+ * ```typescript
+ * const certificate = yield* ServerCertificate("ApiTlsCertificate", {
+ *   certificateBody: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+ *   privateKey: Redacted.make(
+ *     "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
+ *   ),
+ *   certificateChain: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+ * });
+ * ```
+ */
+export const ServerCertificate = Resource<ServerCertificate>(
+  "AWS.IAM.ServerCertificate",
+);
+
+export const ServerCertificateProvider = () =>
+  Provider.effect(
+    ServerCertificate,
+    Effect.gen(function* () {
+      const toName = (id: string, props: ServerCertificateProps) =>
+        props.serverCertificateName
+          ? Effect.succeed(props.serverCertificateName)
+          : createPhysicalName({ id, maxLength: 128 });
+
+      const readCertificate = Effect.fn(function* (name: string) {
+        const response = yield* iam
+          .getServerCertificate({
+            ServerCertificateName: name,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.ServerCertificate;
+      });
+
+      return {
+        stables: [
+          "serverCertificateArn",
+          "serverCertificateName",
+          "serverCertificateId",
+        ],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as ServerCertificateProps))) !==
+              (yield* toName(id, news)) ||
+            (olds.path ?? "/") !== (news.path ?? "/") ||
+            olds.certificateBody !== news.certificateBody ||
+            olds.certificateChain !== news.certificateChain
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.serverCertificateName ??
+            (yield* toName(id, olds ?? ({} as ServerCertificateProps)));
+          const cert = yield* readCertificate(name);
+          if (!cert?.ServerCertificateMetadata?.Arn) {
+            return undefined;
+          }
+          const tags = yield* iam.listServerCertificateTags({
+            ServerCertificateName: name,
+          });
+          return {
+            serverCertificateArn: cert.ServerCertificateMetadata.Arn,
+            serverCertificateName:
+              cert.ServerCertificateMetadata.ServerCertificateName,
+            serverCertificateId:
+              cert.ServerCertificateMetadata.ServerCertificateId,
+            path: cert.ServerCertificateMetadata.Path,
+            certificateBody: cert.CertificateBody,
+            certificateChain: cert.CertificateChain,
+            uploadDate: cert.ServerCertificateMetadata.UploadDate,
+            expiration: cert.ServerCertificateMetadata.Expiration,
+            tags: toTagRecord(tags.Tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name =
+            output?.serverCertificateName ?? (yield* toName(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — `getServerCertificate` returns the live cert (or
+          // absence). The cert body / chain are immutable (`diff`
+          // triggers replacement), so we never re-upload during sync.
+          let cert = yield* readCertificate(name);
+
+          // Ensure — upload when missing. On race, verify alchemy
+          // ownership tags; bail out otherwise.
+          if (!cert?.ServerCertificateMetadata?.Arn) {
+            const created = yield* iam
+              .uploadServerCertificate({
+                Path: news.path,
+                ServerCertificateName: name,
+                CertificateBody: news.certificateBody,
+                PrivateKey:
+                  typeof news.privateKey === "string"
+                    ? news.privateKey
+                    : Redacted.value(news.privateKey),
+                CertificateChain: news.certificateChain,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  Effect.gen(function* () {
+                    const existing = yield* readCertificate(name);
+                    if (!existing?.ServerCertificateMetadata?.Arn) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Server certificate '${name}' already exists but could not be described`,
+                        ),
+                      );
+                    }
+                    if (!hasTags(desiredTags, existing.Tags)) {
+                      return yield* Effect.fail(
+                        new Error(
+                          `Server certificate '${name}' already exists and is not managed by alchemy`,
+                        ),
+                      );
+                    }
+                    return {
+                      ServerCertificateMetadata:
+                        existing.ServerCertificateMetadata,
+                    };
+                  }),
+                ),
+              );
+            if (!created.ServerCertificateMetadata?.Arn) {
+              return yield* Effect.fail(
+                new Error(`uploadServerCertificate returned no metadata`),
+              );
+            }
+            cert = yield* readCertificate(name);
+          }
+
+          // Sync tags against the cloud's actual tags.
+          const observedTags = toTagRecord(cert?.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagServerCertificate({
+              ServerCertificateName: name,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagServerCertificate({
+              ServerCertificateName: name,
+              TagKeys: removed,
+            });
+          }
+
+          // Re-read for fresh metadata.
+          const fresh = yield* readCertificate(name);
+          const metadata = fresh?.ServerCertificateMetadata;
+          if (!metadata?.Arn || !metadata.ServerCertificateName) {
+            return yield* Effect.fail(
+              new Error(
+                `Server certificate '${name}' was not readable after sync`,
+              ),
+            );
+          }
+
+          yield* session.note(metadata.Arn);
+          return {
+            serverCertificateArn: metadata.Arn,
+            serverCertificateName: metadata.ServerCertificateName,
+            serverCertificateId: metadata.ServerCertificateId,
+            path: metadata.Path,
+            certificateBody: fresh?.CertificateBody ?? news.certificateBody,
+            certificateChain: fresh?.CertificateChain ?? news.certificateChain,
+            uploadDate: metadata.UploadDate,
+            expiration: metadata.Expiration,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* iam
+            .deleteServerCertificate({
+              ServerCertificateName: output.serverCertificateName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/ServiceSpecificCredential.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/ServiceSpecificCredential.ts
new file mode 100644
index 00000000000..6bc6269d505
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/ServiceSpecificCredential.ts
@@ -0,0 +1,229 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { toRedactedString } from "./common.ts";
+
+export interface ServiceSpecificCredentialProps {
+  /**
+   * User that owns the service-specific credential.
+   */
+  userName: string;
+  /**
+   * AWS service name that will consume the credential.
+   */
+  serviceName: string;
+  /**
+   * Optional credential age in days.
+   */
+  credentialAgeDays?: number;
+  /**
+   * Desired credential status.
+   * @default "Active"
+   */
+  status?: iam.StatusType;
+}
+
+export interface ServiceSpecificCredential extends Resource<
+  "AWS.IAM.ServiceSpecificCredential",
+  ServiceSpecificCredentialProps,
+  {
+    userName: string;
+    serviceName: string;
+    serviceSpecificCredentialId: string;
+    status: iam.StatusType;
+    createDate: Date | undefined;
+    expirationDate: Date | undefined;
+    serviceUserName: string | undefined;
+    serviceCredentialAlias: string | undefined;
+    servicePassword: Redacted.Redacted<string> | undefined;
+    serviceCredentialSecret: Redacted.Redacted<string> | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A service-specific IAM credential.
+ *
+ * `ServiceSpecificCredential` creates service-bound credentials such as
+ * CodeCommit HTTPS passwords for an IAM user. AWS only returns the secret
+ * fields during creation, so subsequent reads preserve the originally stored
+ * redacted values.
+ *
+ * @section Managing Service Credentials
+ * @example Create a CodeCommit Credential
+ * ```typescript
+ * const user = yield* User("CodeCommitUser", {
+ *   userName: "codecommit-user",
+ * });
+ *
+ * const credential = yield* ServiceSpecificCredential("CodeCommitCredential", {
+ *   userName: user.userName,
+ *   serviceName: "codecommit.amazonaws.com",
+ * });
+ * ```
+ */
+export const ServiceSpecificCredential = Resource<ServiceSpecificCredential>(
+  "AWS.IAM.ServiceSpecificCredential",
+);
+
+export const ServiceSpecificCredentialProvider = () =>
+  Provider.succeed(ServiceSpecificCredential, {
+    stables: ["serviceSpecificCredentialId"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (
+        olds.userName !== news.userName ||
+        olds.serviceName !== news.serviceName ||
+        olds.credentialAgeDays !== news.credentialAgeDays
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const listed = yield* iam.listServiceSpecificCredentials({
+        UserName: output.userName,
+        ServiceName: output.serviceName,
+      });
+      const metadata = listed.ServiceSpecificCredentials?.find(
+        (entry) =>
+          entry.ServiceSpecificCredentialId ===
+          output.serviceSpecificCredentialId,
+      );
+      if (!metadata?.ServiceSpecificCredentialId) {
+        return undefined;
+      }
+      return {
+        userName: metadata.UserName,
+        serviceName: metadata.ServiceName,
+        serviceSpecificCredentialId: metadata.ServiceSpecificCredentialId,
+        status: metadata.Status,
+        createDate: metadata.CreateDate,
+        expirationDate: metadata.ExpirationDate,
+        serviceUserName: metadata.ServiceUserName,
+        serviceCredentialAlias: metadata.ServiceCredentialAlias,
+        servicePassword: output.servicePassword,
+        serviceCredentialSecret: output.serviceCredentialSecret,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      // Observe — credential ids are AWS-generated; we can only locate
+      // the existing record via the prior output. The credential's
+      // identity (userName, serviceName, age) is immutable (`diff`
+      // triggers replacement on change), so a missing credential always
+      // requires recreation.
+      const observed = output
+        ? yield* iam
+            .listServiceSpecificCredentials({
+              UserName: output.userName,
+              ServiceName: output.serviceName,
+            })
+            .pipe(
+              Effect.map((r) =>
+                r.ServiceSpecificCredentials?.find(
+                  (entry) =>
+                    entry.ServiceSpecificCredentialId ===
+                    output.serviceSpecificCredentialId,
+                ),
+              ),
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            )
+        : undefined;
+
+      // Ensure — create when missing. The secret fields are only
+      // returned on first creation, so adoption preserves the prior
+      // redacted values.
+      let credentialId =
+        observed?.ServiceSpecificCredentialId ??
+        output?.serviceSpecificCredentialId;
+      let userName = observed?.UserName ?? output?.userName ?? news.userName;
+      let serviceName =
+        observed?.ServiceName ?? output?.serviceName ?? news.serviceName;
+      let createDate = observed?.CreateDate ?? output?.createDate;
+      let expirationDate = observed?.ExpirationDate ?? output?.expirationDate;
+      let serviceUserName =
+        observed?.ServiceUserName ?? output?.serviceUserName;
+      let serviceCredentialAlias =
+        observed?.ServiceCredentialAlias ?? output?.serviceCredentialAlias;
+      let servicePassword = output?.servicePassword;
+      let serviceCredentialSecret = output?.serviceCredentialSecret;
+      let observedStatus = observed?.Status ?? output?.status;
+
+      if (!observed) {
+        const created = yield* iam.createServiceSpecificCredential({
+          UserName: news.userName,
+          ServiceName: news.serviceName,
+          CredentialAgeDays: news.credentialAgeDays,
+        });
+        const credential = created.ServiceSpecificCredential;
+        if (!credential?.ServiceSpecificCredentialId) {
+          return yield* Effect.fail(
+            new Error(
+              `createServiceSpecificCredential returned no credential id`,
+            ),
+          );
+        }
+        credentialId = credential.ServiceSpecificCredentialId;
+        userName = credential.UserName;
+        serviceName = credential.ServiceName;
+        createDate = credential.CreateDate;
+        expirationDate = credential.ExpirationDate;
+        serviceUserName = credential.ServiceUserName;
+        serviceCredentialAlias = credential.ServiceCredentialAlias;
+        servicePassword = toRedactedString(credential.ServicePassword);
+        serviceCredentialSecret = toRedactedString(
+          credential.ServiceCredentialSecret,
+        );
+        observedStatus = credential.Status;
+      }
+
+      if (!credentialId) {
+        return yield* Effect.fail(
+          new Error(
+            `ServiceSpecificCredential for user '${news.userName}' has no id`,
+          ),
+        );
+      }
+
+      // Sync — apply the desired status when it differs from observed.
+      const desiredStatus = news.status ?? observedStatus ?? "Active";
+      if (desiredStatus !== observedStatus) {
+        yield* iam.updateServiceSpecificCredential({
+          UserName: userName,
+          ServiceSpecificCredentialId: credentialId,
+          Status: desiredStatus,
+        });
+      }
+
+      yield* session.note(credentialId);
+      return {
+        userName,
+        serviceName,
+        serviceSpecificCredentialId: credentialId,
+        status: desiredStatus,
+        createDate,
+        expirationDate,
+        serviceUserName,
+        serviceCredentialAlias,
+        servicePassword,
+        serviceCredentialSecret,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteServiceSpecificCredential({
+          UserName: output.userName,
+          ServiceSpecificCredentialId: output.serviceSpecificCredentialId,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SigningCertificate.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SigningCertificate.ts
new file mode 100644
index 00000000000..300dbcd8fc9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/SigningCertificate.ts
@@ -0,0 +1,151 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface SigningCertificateProps {
+  /**
+   * User that owns the signing certificate.
+   */
+  userName: string;
+  /**
+   * X.509 signing certificate body.
+   */
+  certificateBody: string;
+  /**
+   * Desired certificate status.
+   * @default "Active"
+   */
+  status?: iam.StatusType;
+}
+
+export interface SigningCertificate extends Resource<
+  "AWS.IAM.SigningCertificate",
+  SigningCertificateProps,
+  {
+    userName: string;
+    certificateId: string;
+    certificateBody: string;
+    status: iam.StatusType;
+    uploadDate: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM signing certificate for a user.
+ *
+ * `SigningCertificate` uploads an X.509 signing certificate for legacy
+ * IAM-integrated workflows that still depend on user-scoped certificates.
+ *
+ * @section Managing User Certificates
+ * @example Upload a Signing Certificate
+ * ```typescript
+ * const user = yield* User("Signer", {
+ *   userName: "build-signer",
+ * });
+ *
+ * const certificate = yield* SigningCertificate("SigningCertificate", {
+ *   userName: user.userName,
+ *   certificateBody: "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+ * });
+ * ```
+ */
+export const SigningCertificate = Resource<SigningCertificate>(
+  "AWS.IAM.SigningCertificate",
+);
+
+export const SigningCertificateProvider = () =>
+  Provider.succeed(SigningCertificate, {
+    stables: ["certificateId"],
+    diff: Effect.fn(function* ({ olds, news }) {
+      if (!isResolved(news)) return;
+      if (
+        olds.userName !== news.userName ||
+        olds.certificateBody !== news.certificateBody
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    read: Effect.fn(function* ({ output }) {
+      if (!output) {
+        return undefined;
+      }
+      const listed = yield* iam.listSigningCertificates({
+        UserName: output.userName,
+      });
+      const cert = listed.Certificates.find(
+        (entry) => entry.CertificateId === output.certificateId,
+      );
+      if (!cert?.CertificateId) {
+        return undefined;
+      }
+      return {
+        userName: cert.UserName,
+        certificateId: cert.CertificateId,
+        certificateBody: cert.CertificateBody,
+        status: cert.Status,
+        uploadDate: cert.UploadDate,
+      };
+    }),
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      // Observe — certificate ids are AWS-generated; we can only locate
+      // the live entry via the prior output. The certificate body is
+      // immutable (`diff` triggers replacement on body change), so a
+      // missing entry always means we need to upload.
+      const observed = output
+        ? yield* iam
+            .listSigningCertificates({ UserName: output.userName })
+            .pipe(
+              Effect.map((r) =>
+                r.Certificates.find(
+                  (entry) => entry.CertificateId === output.certificateId,
+                ),
+              ),
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            )
+        : undefined;
+
+      // Ensure — upload when missing.
+      let cert = observed;
+      if (!cert?.CertificateId) {
+        const uploaded = yield* iam.uploadSigningCertificate({
+          UserName: news.userName,
+          CertificateBody: news.certificateBody,
+        });
+        cert = uploaded.Certificate;
+      }
+
+      // Sync — apply the desired status when it differs.
+      const desiredStatus = news.status ?? cert.Status;
+      if (desiredStatus !== cert.Status) {
+        yield* iam.updateSigningCertificate({
+          UserName: news.userName,
+          CertificateId: cert.CertificateId,
+          Status: desiredStatus,
+        });
+      }
+
+      yield* session.note(cert.CertificateId);
+      return {
+        userName: cert.UserName,
+        certificateId: cert.CertificateId,
+        certificateBody: cert.CertificateBody,
+        status: desiredStatus,
+        uploadDate: cert.UploadDate,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* iam
+        .deleteSigningCertificate({
+          UserName: output.userName,
+          CertificateId: output.certificateId,
+        })
+        .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/User.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/User.ts
new file mode 100644
index 00000000000..fcf8d05f2fd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/User.ts
@@ -0,0 +1,431 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import type { PolicyDocument } from "./Policy.ts";
+import {
+  parsePolicyDocument,
+  stringifyPolicyDocument,
+  toTagRecord,
+} from "./common.ts";
+
+export interface UserProps {
+  /**
+   * User name. If omitted, a deterministic name is generated.
+   */
+  userName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * Optional permissions boundary policy ARN.
+   */
+  permissionsBoundary?: string;
+  /**
+   * Managed policy ARNs attached to the user.
+   */
+  managedPolicyArns?: string[];
+  /**
+   * Inline policies embedded in the user.
+   */
+  inlinePolicies?: Record<string, PolicyDocument>;
+  /**
+   * User-defined tags to apply to the user.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface User extends Resource<
+  "AWS.IAM.User",
+  UserProps,
+  {
+    userArn: string;
+    userName: string;
+    userId: string | undefined;
+    path: string | undefined;
+    permissionsBoundary: string | undefined;
+    managedPolicyArns: string[];
+    inlinePolicies: Record<string, PolicyDocument>;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM user with optional inline policies, managed policies, and tags.
+ *
+ * `User` manages a long-lived IAM identity together with its attached managed
+ * policies, inline policies, permissions boundary, and tags.
+ *
+ * @section Creating IAM Users
+ * @example User with Managed Policies
+ * ```typescript
+ * const user = yield* User("AppUser", {
+ *   userName: "app-user",
+ *   managedPolicyArns: [
+ *     "arn:aws:iam::aws:policy/ReadOnlyAccess",
+ *   ],
+ * });
+ * ```
+ */
+export const User = Resource<User>("AWS.IAM.User");
+
+export const UserProvider = () =>
+  Provider.effect(
+    User,
+    Effect.gen(function* () {
+      const toName = (id: string, props: UserProps) =>
+        props.userName
+          ? Effect.succeed(props.userName)
+          : createPhysicalName({ id, maxLength: 64 });
+
+      const readManagedPolicies = Effect.fn(function* (userName: string) {
+        const listed = yield* iam.listAttachedUserPolicies({
+          UserName: userName,
+        });
+        return (listed.AttachedPolicies ?? [])
+          .map((policy) => policy.PolicyArn)
+          .filter(
+            (policyArn): policyArn is string => typeof policyArn === "string",
+          );
+      });
+
+      const readInlinePolicies = Effect.fn(function* (userName: string) {
+        const listed = yield* iam.listUserPolicies({
+          UserName: userName,
+        });
+        const entries = yield* Effect.all(
+          (listed.PolicyNames ?? []).map((policyName) =>
+            iam
+              .getUserPolicy({
+                UserName: userName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.map(
+                  (response) =>
+                    [
+                      policyName,
+                      parsePolicyDocument(response.PolicyDocument),
+                    ] as const,
+                ),
+                Effect.catchTag("NoSuchEntityException", () =>
+                  Effect.succeed([policyName, undefined] as const),
+                ),
+              ),
+          ),
+        );
+        return Object.fromEntries(
+          entries.filter(
+            (entry): entry is [string, PolicyDocument] =>
+              entry[1] !== undefined,
+          ),
+        );
+      });
+
+      const readTags = Effect.fn(function* (userName: string) {
+        const listed = yield* iam.listUserTags({
+          UserName: userName,
+        });
+        return toTagRecord(listed.Tags);
+      });
+
+      const syncManagedPolicies = Effect.fn(function* ({
+        userName,
+        olds,
+        news,
+      }: {
+        userName: string;
+        olds: string[];
+        news: string[];
+      }) {
+        const oldSet = new Set(olds);
+        const newSet = new Set(news);
+        for (const policyArn of news) {
+          if (!oldSet.has(policyArn)) {
+            yield* iam.attachUserPolicy({
+              UserName: userName,
+              PolicyArn: policyArn,
+            });
+          }
+        }
+        for (const policyArn of olds) {
+          if (!newSet.has(policyArn)) {
+            yield* iam
+              .detachUserPolicy({
+                UserName: userName,
+                PolicyArn: policyArn,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }
+      });
+
+      const syncInlinePolicies = Effect.fn(function* ({
+        userName,
+        olds,
+        news,
+      }: {
+        userName: string;
+        olds: Record<string, PolicyDocument>;
+        news: Record<string, PolicyDocument>;
+      }) {
+        for (const [policyName, document] of Object.entries(news)) {
+          if (
+            JSON.stringify(olds[policyName] ?? null) !==
+            JSON.stringify(document)
+          ) {
+            yield* iam.putUserPolicy({
+              UserName: userName,
+              PolicyName: policyName,
+              PolicyDocument: stringifyPolicyDocument(document),
+            });
+          }
+        }
+        for (const policyName of Object.keys(olds)) {
+          if (!(policyName in news)) {
+            yield* iam
+              .deleteUserPolicy({
+                UserName: userName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+        }
+      });
+
+      return {
+        stables: ["userArn", "userName", "userId"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as UserProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if ((olds?.path ?? "/") !== (news.path ?? "/")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const userName =
+            output?.userName ?? (yield* toName(id, olds ?? ({} as UserProps)));
+          const response = yield* iam
+            .getUser({
+              UserName: userName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          if (!response?.User?.Arn) {
+            return undefined;
+          }
+          const [managedPolicyArns, inlinePolicies, tags] = yield* Effect.all([
+            readManagedPolicies(userName),
+            readInlinePolicies(userName),
+            readTags(userName),
+          ]);
+          return {
+            userArn: response.User.Arn,
+            userName: response.User.UserName,
+            userId: response.User.UserId,
+            path: response.User.Path,
+            permissionsBoundary:
+              response.User.PermissionsBoundary?.PermissionsBoundaryArn,
+            managedPolicyArns,
+            inlinePolicies,
+            tags,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const userName = output?.userName ?? (yield* toName(id, news));
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — read the live user (or absence).
+          const observedResponse = yield* iam
+            .getUser({ UserName: userName })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          let observedUser = observedResponse?.User;
+
+          // Ensure — create the user when missing. On race, verify
+          // ownership tags before adopting.
+          if (!observedUser?.Arn) {
+            const created = yield* iam
+              .createUser({
+                UserName: userName,
+                Path: news.path,
+                PermissionsBoundary: news.permissionsBoundary,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("EntityAlreadyExistsException", () =>
+                  iam.getUser({ UserName: userName }).pipe(
+                    Effect.filterOrFail(
+                      (existing) => hasTags(desiredTags, existing.User?.Tags),
+                      () =>
+                        new Error(
+                          `User '${userName}' already exists and is not managed by alchemy`,
+                        ),
+                    ),
+                  ),
+                ),
+              );
+            observedUser = created.User;
+          }
+
+          // Sync permissions boundary against observed.
+          const observedBoundary =
+            observedUser?.PermissionsBoundary?.PermissionsBoundaryArn;
+          if (news.permissionsBoundary !== observedBoundary) {
+            if (news.permissionsBoundary) {
+              yield* iam.putUserPermissionsBoundary({
+                UserName: userName,
+                PermissionsBoundary: news.permissionsBoundary,
+              });
+            } else if (observedBoundary) {
+              yield* iam
+                .deleteUserPermissionsBoundary({
+                  UserName: userName,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+
+          // Sync managed and inline policies — observe live state and
+          // apply only the delta.
+          const [observedManagedPolicies, observedInlinePolicies] =
+            yield* Effect.all([
+              readManagedPolicies(userName),
+              readInlinePolicies(userName),
+            ]);
+          yield* syncManagedPolicies({
+            userName,
+            olds: observedManagedPolicies,
+            news: news.managedPolicyArns ?? [],
+          });
+          yield* syncInlinePolicies({
+            userName,
+            olds: observedInlinePolicies,
+            news: news.inlinePolicies ?? {},
+          });
+
+          // Sync tags against the cloud's actual tags.
+          const observedTags = yield* readTags(userName);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagUser({
+              UserName: userName,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagUser({
+              UserName: userName,
+              TagKeys: removed,
+            });
+          }
+
+          // Re-read for fresh attributes after all mutations.
+          const user = yield* iam.getUser({ UserName: userName });
+          const userArn = user.User?.Arn ?? observedUser?.Arn ?? userName;
+
+          yield* session.note(userArn);
+          return {
+            userArn,
+            userName: user.User?.UserName ?? userName,
+            userId: user.User?.UserId ?? observedUser?.UserId,
+            path: user.User?.Path ?? observedUser?.Path ?? news.path ?? "/",
+            permissionsBoundary:
+              user.User?.PermissionsBoundary?.PermissionsBoundaryArn ??
+              news.permissionsBoundary,
+            managedPolicyArns: news.managedPolicyArns ?? [],
+            inlinePolicies: news.inlinePolicies ?? {},
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* iam
+            .deleteUserPermissionsBoundary({
+              UserName: output.userName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+
+          const inlinePolicies = yield* iam
+            .listUserPolicies({
+              UserName: output.userName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          for (const policyName of inlinePolicies?.PolicyNames ?? []) {
+            yield* iam
+              .deleteUserPolicy({
+                UserName: output.userName,
+                PolicyName: policyName,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+
+          const attachedPolicies = yield* iam
+            .listAttachedUserPolicies({
+              UserName: output.userName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchEntityException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          for (const policy of attachedPolicies?.AttachedPolicies ?? []) {
+            if (policy.PolicyArn) {
+              yield* iam
+                .detachUserPolicy({
+                  UserName: output.userName,
+                  PolicyArn: policy.PolicyArn,
+                })
+                .pipe(
+                  Effect.catchTag("NoSuchEntityException", () => Effect.void),
+                );
+            }
+          }
+
+          yield* iam
+            .deleteUser({
+              UserName: output.userName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/VirtualMFADevice.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/VirtualMFADevice.ts
new file mode 100644
index 00000000000..4a0c1b59d4a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/VirtualMFADevice.ts
@@ -0,0 +1,284 @@
+import * as iam from "@distilled.cloud/aws/iam";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import { toRedactedBytes, toTagRecord } from "./common.ts";
+
+export interface VirtualMFADeviceProps {
+  /**
+   * Name of the virtual MFA device. If omitted, a deterministic name is generated.
+   */
+  virtualMFADeviceName?: string;
+  /**
+   * Optional IAM path prefix.
+   * @default "/"
+   */
+  path?: string;
+  /**
+   * Optional user to activate the device for.
+   */
+  userName?: string;
+  /**
+   * First authentication code used when activating the device.
+   */
+  authenticationCode1?: string;
+  /**
+   * Second authentication code used when activating the device.
+   */
+  authenticationCode2?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface VirtualMFADevice extends Resource<
+  "AWS.IAM.VirtualMFADevice",
+  VirtualMFADeviceProps,
+  {
+    serialNumber: string;
+    userName: string | undefined;
+    enableDate: Date | undefined;
+    base32StringSeed:
+      | Redacted.Redacted<Uint8Array<ArrayBufferLike>>
+      | undefined;
+    qrCodePNG: Redacted.Redacted<Uint8Array<ArrayBufferLike>> | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM virtual MFA device.
+ *
+ * `VirtualMFADevice` creates a software MFA device and can optionally activate
+ * it for a user during creation when the initial authentication codes are
+ * provided.
+ *
+ * @section Managing MFA Devices
+ * @example Create and Activate a Virtual MFA Device
+ * ```typescript
+ * const user = yield* User("AdminUser", {
+ *   userName: "admin-user",
+ * });
+ *
+ * const device = yield* VirtualMFADevice("AdminMfa", {
+ *   userName: user.userName,
+ *   authenticationCode1: "123456",
+ *   authenticationCode2: "654321",
+ * });
+ * ```
+ */
+export const VirtualMFADevice = Resource<VirtualMFADevice>(
+  "AWS.IAM.VirtualMFADevice",
+);
+
+export const VirtualMFADeviceProvider = () =>
+  Provider.effect(
+    VirtualMFADevice,
+    Effect.gen(function* () {
+      const toName = (id: string, props: VirtualMFADeviceProps) =>
+        props.virtualMFADeviceName
+          ? Effect.succeed(props.virtualMFADeviceName)
+          : createPhysicalName({ id, maxLength: 226 });
+
+      const readDevice = Effect.fn(function* ({
+        serialNumber,
+        userName,
+      }: {
+        serialNumber: string;
+        userName: string | undefined;
+      }) {
+        if (!userName) {
+          const listed = yield* iam.listVirtualMFADevices({
+            AssignmentStatus: "Unassigned",
+          });
+          const device = listed.VirtualMFADevices.find(
+            (entry) => entry.SerialNumber === serialNumber,
+          );
+          return device
+            ? {
+                SerialNumber: device.SerialNumber,
+                UserName: device.User?.UserName,
+                EnableDate: device.EnableDate,
+              }
+            : undefined;
+        }
+        return yield* iam
+          .getMFADevice({
+            SerialNumber: serialNumber,
+            UserName: userName,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchEntityException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      });
+
+      return {
+        stables: ["serialNumber"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(id, olds ?? ({} as VirtualMFADeviceProps))) !==
+              (yield* toName(id, news)) ||
+            (olds.path ?? "/") !== (news.path ?? "/") ||
+            (olds.userName ?? undefined) !== (news.userName ?? undefined) ||
+            (olds.authenticationCode1 ?? undefined) !==
+              (news.authenticationCode1 ?? undefined) ||
+            (olds.authenticationCode2 ?? undefined) !==
+              (news.authenticationCode2 ?? undefined)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output) {
+            return undefined;
+          }
+          const response = yield* readDevice({
+            serialNumber: output.serialNumber,
+            userName: output.userName,
+          });
+          if (!response?.SerialNumber) {
+            return undefined;
+          }
+          const tags = yield* iam.listMFADeviceTags({
+            SerialNumber: output.serialNumber,
+          });
+          return {
+            serialNumber: response.SerialNumber,
+            userName: response.UserName ?? output.userName,
+            enableDate: response.EnableDate,
+            base32StringSeed: output.base32StringSeed,
+            qrCodePNG: output.qrCodePNG,
+            tags: toTagRecord(tags.Tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const desiredTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          // Observe — virtual MFA devices have AWS-generated serial
+          // numbers, so we can only locate the existing device when we
+          // already have its serial from a prior output.
+          const observed = output
+            ? yield* readDevice({
+                serialNumber: output.serialNumber,
+                userName: output.userName,
+              })
+            : undefined;
+
+          // Ensure — create the device when missing. The seed and QR
+          // code are only returned on creation, so on adoption the best
+          // we can do is preserve the existing redacted values.
+          let serialNumber = observed?.SerialNumber ?? output?.serialNumber;
+          let base32StringSeed = output?.base32StringSeed;
+          let qrCodePNG = output?.qrCodePNG;
+
+          if (!observed?.SerialNumber) {
+            const deviceName = yield* toName(id, news);
+            const created = yield* iam.createVirtualMFADevice({
+              Path: news.path,
+              VirtualMFADeviceName: deviceName,
+              Tags: createTagsList(desiredTags),
+            });
+            if (!created.VirtualMFADevice.SerialNumber) {
+              return yield* Effect.fail(
+                new Error(`createVirtualMFADevice returned no serial number`),
+              );
+            }
+            serialNumber = created.VirtualMFADevice.SerialNumber;
+            base32StringSeed = toRedactedBytes(
+              created.VirtualMFADevice.Base32StringSeed,
+            );
+            qrCodePNG = toRedactedBytes(created.VirtualMFADevice.QRCodePNG);
+
+            // The device was just created, so it is unassigned. Activate
+            // it for the user when activation codes are provided. After
+            // first activation the codes lose their meaning (`diff`
+            // triggers replacement on code change).
+            if (
+              news.userName &&
+              news.authenticationCode1 &&
+              news.authenticationCode2
+            ) {
+              yield* iam.enableMFADevice({
+                UserName: news.userName,
+                SerialNumber: serialNumber,
+                AuthenticationCode1: news.authenticationCode1,
+                AuthenticationCode2: news.authenticationCode2,
+              });
+            }
+          }
+
+          if (!serialNumber) {
+            return yield* Effect.fail(
+              new Error(`Virtual MFA device has no serial number`),
+            );
+          }
+
+          // Sync tags against the cloud's actual tags.
+          const observedTagsResp = yield* iam.listMFADeviceTags({
+            SerialNumber: serialNumber,
+          });
+          const observedTags = toTagRecord(observedTagsResp.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* iam.tagMFADevice({
+              SerialNumber: serialNumber,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0) {
+            yield* iam.untagMFADevice({
+              SerialNumber: serialNumber,
+              TagKeys: removed,
+            });
+          }
+
+          // Re-read for fresh `EnableDate` / `UserName` after activation.
+          const fresh = yield* readDevice({
+            serialNumber,
+            userName: news.userName ?? output?.userName,
+          });
+
+          yield* session.note(serialNumber);
+          return {
+            serialNumber,
+            userName: fresh?.UserName ?? news.userName ?? output?.userName,
+            enableDate: fresh?.EnableDate ?? output?.enableDate,
+            base32StringSeed,
+            qrCodePNG,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (output.userName) {
+            yield* iam
+              .deactivateMFADevice({
+                UserName: output.userName,
+                SerialNumber: output.serialNumber,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchEntityException", () => Effect.void),
+              );
+          }
+          yield* iam
+            .deleteVirtualMFADevice({
+              SerialNumber: output.serialNumber,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/common.ts
new file mode 100644
index 00000000000..3738fc33f55
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/common.ts
@@ -0,0 +1,89 @@
+import type * as iam from "@distilled.cloud/aws/iam";
+import * as Redacted from "effect/Redacted";
+import type { PolicyDocument } from "./Policy.ts";
+
+export const toTagRecord = (
+  tags: Array<{ Key?: string; Value?: string }> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const decodePolicyString = (value: string) => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
+export const parsePolicyDocument = (
+  value: string | undefined,
+): PolicyDocument | undefined => {
+  if (!value) {
+    return undefined;
+  }
+
+  const decoded = decodePolicyString(value);
+  return JSON.parse(decoded) as PolicyDocument;
+};
+
+export const stringifyPolicyDocument = (value: PolicyDocument) =>
+  JSON.stringify(value);
+
+export const normalizeIamPath = (value: string | undefined) => {
+  const path = value ?? "/";
+  const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
+  return withLeadingSlash.endsWith("/")
+    ? withLeadingSlash
+    : `${withLeadingSlash}/`;
+};
+
+export const policyArnFromParts = ({
+  accountId,
+  path,
+  policyName,
+}: {
+  accountId: string;
+  path: string | undefined;
+  policyName: string;
+}) => `arn:aws:iam::${accountId}:policy${normalizeIamPath(path)}${policyName}`;
+
+export const oldestNondefaultPolicyVersion = (
+  versions: iam.PolicyVersion[] | undefined,
+) =>
+  [...(versions ?? [])]
+    .filter((version) => !version.IsDefaultVersion && version.VersionId)
+    .sort(
+      (a, b) => (a.CreateDate?.getTime() ?? 0) - (b.CreateDate?.getTime() ?? 0),
+    )[0];
+
+export const toRedactedString = (
+  value: string | Redacted.Redacted<string> | undefined,
+): Redacted.Redacted<string> | undefined =>
+  value === undefined
+    ? undefined
+    : typeof value === "string"
+      ? Redacted.make(value)
+      : value;
+
+export const toRedactedBytes = (
+  value:
+    | Uint8Array<ArrayBufferLike>
+    | Redacted.Redacted<Uint8Array<ArrayBufferLike>>
+    | undefined,
+): Redacted.Redacted<Uint8Array<ArrayBufferLike>> | undefined =>
+  value === undefined
+    ? undefined
+    : value instanceof Uint8Array
+      ? Redacted.make(value)
+      : value;
+
+export const unwrapRedactedString = (
+  value: string | Redacted.Redacted<string>,
+): string => (typeof value === "string" ? value : Redacted.value(value));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/index.ts
new file mode 100644
index 00000000000..b465a79ffeb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IAM/index.ts
@@ -0,0 +1,40 @@
+export { AccessKey, AccessKeyProvider } from "./AccessKey.ts";
+export { AccountAlias, AccountAliasProvider } from "./AccountAlias.ts";
+export {
+  AccountPasswordPolicy,
+  AccountPasswordPolicyProvider,
+} from "./AccountPasswordPolicy.ts";
+export { Group, GroupProvider } from "./Group.ts";
+export { GroupMembership, GroupMembershipProvider } from "./GroupMembership.ts";
+export { InstanceProfile, InstanceProfileProvider } from "./InstanceProfile.ts";
+export { LoginProfile, LoginProfileProvider } from "./LoginProfile.ts";
+export {
+  OpenIDConnectProvider,
+  OpenIDConnectProviderProvider,
+} from "./OpenIDConnectProvider.ts";
+export {
+  Policy,
+  PolicyProvider,
+  type PolicyDocument,
+  type PolicyStatement,
+} from "./Policy.ts";
+export { Role, RoleProvider } from "./Role.ts";
+export { SAMLProvider, SAMLProviderProvider } from "./SAMLProvider.ts";
+export {
+  ServerCertificate,
+  ServerCertificateProvider,
+} from "./ServerCertificate.ts";
+export {
+  ServiceSpecificCredential,
+  ServiceSpecificCredentialProvider,
+} from "./ServiceSpecificCredential.ts";
+export {
+  SigningCertificate,
+  SigningCertificateProvider,
+} from "./SigningCertificate.ts";
+export { SSHPublicKey, SSHPublicKeyProvider } from "./SSHPublicKey.ts";
+export { User, UserProvider } from "./User.ts";
+export {
+  VirtualMFADevice,
+  VirtualMFADeviceProvider,
+} from "./VirtualMFADevice.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/AccountAssignment.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/AccountAssignment.ts
new file mode 100644
index 00000000000..383295ccded
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/AccountAssignment.ts
@@ -0,0 +1,297 @@
+import * as ssoAdmin from "@distilled.cloud/aws/sso-admin";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { resolveInstance, retryIdentityCenter } from "./common.ts";
+
+export interface AccountAssignmentProps {
+  /**
+   * Explicit Identity Center instance ARN.
+   * If omitted, Alchemy adopts the only visible instance.
+   */
+  instanceArn?: string;
+  /**
+   * Permission set ARN to assign.
+   */
+  permissionSetArn: string;
+  /**
+   * Principal ID from the IAM Identity Center identity store.
+   */
+  principalId: string;
+  /**
+   * Principal type.
+   */
+  principalType: "USER" | "GROUP";
+  /**
+   * Target AWS account ID.
+   */
+  targetId: string;
+}
+
+export interface AccountAssignment extends Resource<
+  "AWS.IdentityCenter.AccountAssignment",
+  AccountAssignmentProps,
+  {
+    instanceArn: string;
+    permissionSetArn: string;
+    principalId: string;
+    principalType: "USER" | "GROUP";
+    targetId: string;
+    targetType: "AWS_ACCOUNT";
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Assigns an IAM Identity Center permission set to a user or group in an AWS
+ * account.
+ *
+ * @section Creating Assignments
+ * @example Assign A Group To A Workload Account
+ * ```typescript
+ * const assignment = yield* AccountAssignment("ProdAdminAssignment", {
+ *   permissionSetArn: admin.permissionSetArn,
+ *   principalType: "GROUP",
+ *   principalId: engineers.groupId,
+ *   targetId: prod.accountId,
+ * });
+ * ```
+ */
+export const AccountAssignment = Resource<AccountAssignment>(
+  "AWS.IdentityCenter.AccountAssignment",
+);
+
+export const AccountAssignmentProvider = () =>
+  Provider.effect(
+    AccountAssignment,
+    Effect.gen(function* () {
+      return {
+        stables: [
+          "instanceArn",
+          "permissionSetArn",
+          "principalId",
+          "principalType",
+          "targetId",
+          "targetType",
+        ],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            olds?.instanceArn !== news.instanceArn ||
+            olds?.permissionSetArn !== news.permissionSetArn ||
+            olds?.principalId !== news.principalId ||
+            olds?.principalType !== news.principalType ||
+            olds?.targetId !== news.targetId
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          if (output?.instanceArn) {
+            return yield* readAssignment({
+              instanceArn: output.instanceArn,
+              permissionSetArn: output.permissionSetArn,
+              principalId: output.principalId,
+              principalType: output.principalType,
+              targetId: output.targetId,
+            });
+          }
+
+          if (!olds) {
+            return undefined;
+          }
+
+          return yield* readAssignment(olds);
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          // Observe — look up the assignment between (principal,
+          // permissionSet, target). All identifying fields are stable;
+          // diff() forces a replace on any change, so this reconcile is
+          // existence-only.
+          const existing = yield* readAssignment({
+            ...news,
+            instanceArn: output?.instanceArn ?? news.instanceArn,
+          });
+          if (existing) {
+            yield* session.note(
+              `${existing.targetId}:${existing.permissionSetArn}:${existing.principalId}`,
+            );
+            return existing;
+          }
+
+          // Ensure — create the assignment if missing.
+          const instance = yield* resolveInstance(news.instanceArn);
+          const response = yield* retryIdentityCenter(
+            ssoAdmin.createAccountAssignment({
+              InstanceArn: instance.InstanceArn!,
+              PermissionSetArn: news.permissionSetArn,
+              PrincipalId: news.principalId,
+              PrincipalType: news.principalType,
+              TargetId: news.targetId,
+              TargetType: "AWS_ACCOUNT",
+            }),
+          );
+
+          const requestId =
+            response.AccountAssignmentCreationStatus?.RequestId ?? undefined;
+          if (requestId) {
+            yield* waitForAssignmentCreation(instance.InstanceArn!, requestId);
+          }
+
+          const created = yield* readAssignment({
+            ...news,
+            instanceArn: instance.InstanceArn,
+          });
+          if (!created) {
+            return yield* Effect.fail(
+              new Error("account assignment not found after create"),
+            );
+          }
+
+          yield* session.note(
+            `${created.targetId}:${created.permissionSetArn}:${created.principalId}`,
+          );
+          return created;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!(yield* readAssignment(output))) {
+            return;
+          }
+
+          const response = yield* retryIdentityCenter(
+            ssoAdmin
+              .deleteAccountAssignment({
+                InstanceArn: output.instanceArn,
+                PermissionSetArn: output.permissionSetArn,
+                PrincipalId: output.principalId,
+                PrincipalType: output.principalType,
+                TargetId: output.targetId,
+                TargetType: "AWS_ACCOUNT",
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              ),
+          );
+
+          const requestId =
+            response?.AccountAssignmentDeletionStatus?.RequestId ?? undefined;
+          if (requestId) {
+            yield* waitForAssignmentDeletion(output.instanceArn, requestId);
+          }
+        }),
+      };
+    }),
+  );
+
+const readAssignment = Effect.fn(function* ({
+  instanceArn,
+  permissionSetArn,
+  principalId,
+  principalType,
+  targetId,
+}: AccountAssignmentProps) {
+  const instance = yield* resolveInstance(instanceArn);
+  const assignments = yield* ssoAdmin.listAccountAssignments
+    .items({
+      InstanceArn: instance.InstanceArn!,
+      AccountId: targetId,
+      PermissionSetArn: permissionSetArn,
+      MaxResults: 100,
+    })
+    .pipe(
+      Stream.runCollect,
+      Effect.map((items) => Array.from(items) as ssoAdmin.AccountAssignment[]),
+    );
+
+  const match = assignments.find(
+    (assignment) =>
+      assignment.PrincipalId === principalId &&
+      assignment.PrincipalType === principalType,
+  );
+
+  return match
+    ? ({
+        instanceArn: instance.InstanceArn!,
+        permissionSetArn,
+        principalId,
+        principalType,
+        targetId,
+        targetType: "AWS_ACCOUNT",
+      } satisfies AccountAssignment["Attributes"])
+    : undefined;
+});
+
+const waitForAssignmentCreation = (instanceArn: string, requestId: string) =>
+  Effect.gen(function* () {
+    const response = yield* retryIdentityCenter(
+      ssoAdmin.describeAccountAssignmentCreationStatus({
+        InstanceArn: instanceArn,
+        AccountAssignmentCreationRequestId: requestId,
+      }),
+    );
+    const status = response.AccountAssignmentCreationStatus;
+
+    if (!status?.Status || status.Status === "IN_PROGRESS") {
+      return yield* Effect.fail({
+        _tag: "AssignmentCreationInProgress" as const,
+      });
+    }
+
+    if (status.Status === "FAILED") {
+      return yield* Effect.fail(
+        new Error(
+          `account assignment creation failed: ${status.FailureReason ?? "unknown failure"}`,
+        ),
+      );
+    }
+
+    return status;
+  }).pipe(
+    Effect.retry({
+      while: (error: any) => error?._tag === "AssignmentCreationInProgress",
+      schedule: Schedule.spaced("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(120)),
+      ),
+    }),
+  );
+
+const waitForAssignmentDeletion = (instanceArn: string, requestId: string) =>
+  Effect.gen(function* () {
+    const response = yield* retryIdentityCenter(
+      ssoAdmin.describeAccountAssignmentDeletionStatus({
+        InstanceArn: instanceArn,
+        AccountAssignmentDeletionRequestId: requestId,
+      }),
+    );
+    const status = response.AccountAssignmentDeletionStatus;
+
+    if (!status?.Status || status.Status === "IN_PROGRESS") {
+      return yield* Effect.fail({
+        _tag: "AssignmentDeletionInProgress" as const,
+      });
+    }
+
+    if (status.Status === "FAILED") {
+      return yield* Effect.fail(
+        new Error(
+          `account assignment deletion failed: ${status.FailureReason ?? "unknown failure"}`,
+        ),
+      );
+    }
+
+    return status;
+  }).pipe(
+    Effect.retry({
+      while: (error: any) => error?._tag === "AssignmentDeletionInProgress",
+      schedule: Schedule.spaced("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(120)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/Group.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/Group.ts
new file mode 100644
index 00000000000..9b12045fe89
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/Group.ts
@@ -0,0 +1,237 @@
+import * as identitystore from "@distilled.cloud/aws/identitystore";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  listGroups,
+  resolveIdentityStoreId,
+  retryIdentityCenter,
+} from "./common.ts";
+
+export interface GroupProps {
+  /**
+   * Explicit identity store ID.
+   * If omitted, Alchemy resolves it from the selected Identity Center instance.
+   */
+  identityStoreId?: string;
+  /**
+   * Optional instance ARN used to discover the identity store ID.
+   */
+  instanceArn?: string;
+  /**
+   * Group display name.
+   */
+  displayName: string;
+  /**
+   * Optional group description.
+   */
+  description?: string;
+}
+
+export interface Group extends Resource<
+  "AWS.IdentityCenter.Group",
+  GroupProps,
+  {
+    identityStoreId: string;
+    groupId: string;
+    displayName: string | undefined;
+    description: string | undefined;
+    createdAt: Date | undefined;
+    updatedAt: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A group in the IAM Identity Center identity store.
+ *
+ * @section Creating Groups
+ * @example Platform Engineers
+ * ```typescript
+ * const engineers = yield* Group("PlatformEngineers", {
+ *   displayName: "platform-engineers",
+ *   description: "Platform engineering team",
+ * });
+ * ```
+ */
+export const Group = Resource<Group>("AWS.IdentityCenter.Group");
+
+export const GroupProvider = () =>
+  Provider.effect(
+    Group,
+    Effect.gen(function* () {
+      return {
+        stables: ["identityStoreId", "groupId"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds?.identityStoreId !== news.identityStoreId) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          if (output?.groupId && output.identityStoreId) {
+            return yield* readGroupById(output.identityStoreId, output.groupId);
+          }
+
+          if (!olds) {
+            return undefined;
+          }
+
+          return yield* readGroupByDisplayName(olds);
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const identityStoreId =
+            output?.identityStoreId ?? (yield* resolveIdentityStoreId(news));
+
+          // Observe — find the group by id (if we already have one) or
+          // by display name. We never trust `output.groupId` blindly: a
+          // group deleted out of band shows up as missing here.
+          let existing =
+            (output?.groupId
+              ? yield* readGroupById(identityStoreId, output.groupId)
+              : undefined) ??
+            (yield* readGroupByDisplayName({
+              ...news,
+              identityStoreId,
+            }));
+
+          // Ensure — create the group if missing.
+          if (!existing) {
+            const response = yield* retryIdentityCenter(
+              identitystore.createGroup({
+                IdentityStoreId: identityStoreId,
+                DisplayName: news.displayName,
+                Description: news.description,
+              }),
+            );
+
+            existing =
+              (response.GroupId
+                ? yield* readGroupById(identityStoreId, response.GroupId)
+                : undefined) ??
+              (yield* readGroupByDisplayName({
+                ...news,
+                identityStoreId,
+              }));
+
+            if (!existing) {
+              return yield* Effect.fail(
+                new Error(`group '${news.displayName}' not found after create`),
+              );
+            }
+
+            yield* session.note(existing.groupId);
+            return existing;
+          }
+
+          // Sync mutable attributes — `updateGroup` overwrites
+          // displayName and description in one call. We diff against
+          // observed cloud state so adoption converges.
+          const operations: {
+            AttributePath: string;
+            AttributeValue: string;
+          }[] = [];
+          if (existing.displayName !== news.displayName) {
+            operations.push({
+              AttributePath: "DisplayName",
+              AttributeValue: news.displayName,
+            });
+          }
+          const desiredDescription = news.description ?? "";
+          if ((existing.description ?? "") !== desiredDescription) {
+            operations.push({
+              AttributePath: "Description",
+              AttributeValue: desiredDescription,
+            });
+          }
+
+          if (operations.length > 0) {
+            yield* retryIdentityCenter(
+              identitystore.updateGroup({
+                IdentityStoreId: existing.identityStoreId,
+                GroupId: existing.groupId,
+                Operations: operations,
+              }),
+            );
+
+            const updated = yield* readGroupById(
+              existing.identityStoreId,
+              existing.groupId,
+            );
+            if (!updated) {
+              return yield* Effect.fail(
+                new Error(`group '${existing.groupId}' not found after update`),
+              );
+            }
+            yield* session.note(updated.groupId);
+            return updated;
+          }
+
+          yield* session.note(existing.groupId);
+          return existing;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryIdentityCenter(
+            identitystore
+              .deleteGroup({
+                IdentityStoreId: output.identityStoreId,
+                GroupId: output.groupId,
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const readGroupById = Effect.fn(function* (
+  identityStoreId: string,
+  groupId: string,
+) {
+  const response = yield* retryIdentityCenter(
+    identitystore
+      .describeGroup({
+        IdentityStoreId: identityStoreId,
+        GroupId: groupId,
+      })
+      .pipe(
+        Effect.catchTag("ResourceNotFoundException", () =>
+          Effect.succeed(undefined),
+        ),
+      ),
+  );
+
+  if (!response?.GroupId || !response.IdentityStoreId) {
+    return undefined;
+  }
+
+  return {
+    identityStoreId: response.IdentityStoreId,
+    groupId: response.GroupId,
+    displayName: response.DisplayName as string | undefined,
+    description: response.Description as string | undefined,
+    createdAt: response.CreatedAt,
+    updatedAt: response.UpdatedAt,
+  } satisfies Group["Attributes"];
+});
+
+const readGroupByDisplayName = Effect.fn(function* ({
+  identityStoreId,
+  instanceArn,
+  displayName,
+}: Pick<GroupProps, "identityStoreId" | "instanceArn" | "displayName">) {
+  const resolvedIdentityStoreId = yield* resolveIdentityStoreId({
+    identityStoreId,
+    instanceArn,
+  });
+  const groups = yield* listGroups(resolvedIdentityStoreId);
+  const match = groups.find((group) => group.DisplayName === displayName);
+  return match?.GroupId
+    ? yield* readGroupById(resolvedIdentityStoreId, match.GroupId)
+    : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/Instance.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/Instance.ts
new file mode 100644
index 00000000000..5f40f58ddd0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/Instance.ts
@@ -0,0 +1,202 @@
+import * as ssoAdmin from "@distilled.cloud/aws/sso-admin";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  listInstances,
+  resolveInstance,
+  retryIdentityCenter,
+  toInstanceAttributes,
+} from "./common.ts";
+
+export interface InstanceProps {
+  /**
+   * Explicit instance ARN to adopt.
+   */
+  instanceArn?: string;
+  /**
+   * Friendly instance name.
+   *
+   * When `mode` is `"account"`, this name is passed to `CreateInstance`.
+   * When `mode` is `"existing"`, it is used only for discovery.
+   */
+  name?: string;
+  /**
+   * How Alchemy should satisfy this resource.
+   *
+   * `existing` adopts a visible instance and fails if none is found.
+   * `account` creates an account instance when no visible instance matches.
+   *
+   * Organization instances cannot currently be enabled via public API, so
+   * organization-management-account deployments should use `existing`.
+   *
+   * @default "existing"
+   */
+  mode?: "existing" | "account";
+}
+
+export interface Instance extends Resource<
+  "AWS.IdentityCenter.Instance",
+  InstanceProps,
+  {
+    instanceArn: string;
+    identityStoreId: string;
+    ownerAccountId: string | undefined;
+    name: string | undefined;
+    status: string | undefined;
+    statusReason: string | undefined;
+    createdDate: Date | undefined;
+    mode: "existing" | "account";
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM Identity Center instance visible to the current account.
+ *
+ * Use `mode: "existing"` to adopt a pre-enabled organization instance. Use
+ * `mode: "account"` only for standalone or member-account account instances.
+ *
+ * @section Discovering Existing Instances
+ * @example Adopt An Existing Instance
+ * ```typescript
+ * const instance = yield* Instance("IdentityCenter", {
+ *   mode: "existing",
+ * });
+ * ```
+ *
+ * @section Creating Account Instances
+ * @example Create A Member Account Instance
+ * ```typescript
+ * const instance = yield* Instance("IdentityCenter", {
+ *   mode: "account",
+ *   name: "customer-a",
+ * });
+ * ```
+ */
+export const Instance = Resource<Instance>("AWS.IdentityCenter.Instance");
+
+export const InstanceProvider = () =>
+  Provider.effect(
+    Instance,
+    Effect.gen(function* () {
+      return {
+        stables: ["instanceArn", "identityStoreId", "ownerAccountId", "mode"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            olds?.instanceArn !== news.instanceArn ||
+            olds?.mode !== news.mode ||
+            olds?.name !== news.name
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const mode = output?.mode ?? olds?.mode ?? "existing";
+          const instance = yield* readInstance({
+            instanceArn: output?.instanceArn ?? olds?.instanceArn,
+            name: olds?.name,
+          });
+          return instance ? { ...instance, mode } : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const mode = output?.mode ?? news.mode ?? "existing";
+
+          // Observe — try to find a visible instance, preferring an
+          // explicit ARN (from output or props) and otherwise scanning
+          // the account.
+          const existing = yield* readInstance({
+            instanceArn: output?.instanceArn ?? news.instanceArn,
+            name: news.name,
+          });
+          if (existing) {
+            yield* session.note(existing.instanceArn);
+            return {
+              ...existing,
+              mode,
+            };
+          }
+
+          // Ensure — for `existing` mode we cannot create one; fail.
+          // Organization instances must be enabled manually in the
+          // management account.
+          if (mode !== "account") {
+            return yield* Effect.fail(
+              new Error(
+                "No visible Identity Center instance was found. Organization instances must be enabled manually in the management account before Alchemy can adopt them.",
+              ),
+            );
+          }
+
+          // Ensure — `account` mode creates an account instance.
+          const response = yield* retryIdentityCenter(
+            ssoAdmin.createInstance({
+              Name: news.name,
+            }),
+          );
+
+          const created = yield* readInstance({
+            instanceArn: response.InstanceArn,
+            name: news.name,
+          });
+          if (!created) {
+            return yield* Effect.fail(
+              new Error(
+                "failed to resolve Identity Center instance after create",
+              ),
+            );
+          }
+
+          yield* session.note(created.instanceArn);
+          return {
+            ...created,
+            mode,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (output.mode !== "account") {
+            return;
+          }
+
+          const existing = yield* readInstance({
+            instanceArn: output.instanceArn,
+          });
+          if (!existing) {
+            return;
+          }
+
+          yield* retryIdentityCenter(
+            ssoAdmin.deleteInstance({
+              InstanceArn: output.instanceArn,
+            }),
+          );
+        }),
+      };
+    }),
+  );
+
+const readInstance = Effect.fn(function* ({
+  instanceArn,
+  name,
+}: Pick<InstanceProps, "instanceArn" | "name">) {
+  if (instanceArn) {
+    const instance = yield* resolveInstance(instanceArn).pipe(
+      Effect.catch(() => Effect.succeed(undefined)),
+    );
+    return instance ? toInstanceAttributes(instance) : undefined;
+  }
+
+  const instances = yield* listInstances();
+  const match =
+    instances.find((instance) => instance.Name === name) ??
+    (instances.length === 1 ? instances[0] : undefined) ??
+    instances.find((instance) => instance.Status === "ACTIVE");
+
+  return match?.InstanceArn && match.IdentityStoreId
+    ? toInstanceAttributes(match)
+    : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/PermissionSet.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/PermissionSet.ts
new file mode 100644
index 00000000000..23dff5b283b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/PermissionSet.ts
@@ -0,0 +1,264 @@
+import * as ssoAdmin from "@distilled.cloud/aws/sso-admin";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { resolveInstance, retryIdentityCenter } from "./common.ts";
+
+export interface PermissionSetProps {
+  /**
+   * Explicit IAM Identity Center instance ARN.
+   * If omitted, Alchemy adopts the only visible instance.
+   */
+  instanceArn?: string;
+  /**
+   * Permission set name.
+   */
+  name: string;
+  /**
+   * Optional human-readable description.
+   */
+  description?: string;
+  /**
+   * Optional ISO-8601 session duration such as `PT8H`.
+   */
+  sessionDuration?: string;
+  /**
+   * Optional relay state passed to supported applications.
+   */
+  relayState?: string;
+}
+
+export interface PermissionSet extends Resource<
+  "AWS.IdentityCenter.PermissionSet",
+  PermissionSetProps,
+  {
+    instanceArn: string;
+    permissionSetArn: string;
+    name: string;
+    description: string | undefined;
+    sessionDuration: string | undefined;
+    relayState: string | undefined;
+    createdDate: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An IAM Identity Center permission set.
+ *
+ * @section Creating Permission Sets
+ * @example Administrator Access
+ * ```typescript
+ * const admin = yield* PermissionSet("AdministratorAccess", {
+ *   name: "AdministratorAccess",
+ *   description: "Administrator access for platform engineers",
+ *   sessionDuration: "PT8H",
+ * });
+ * ```
+ */
+export const PermissionSet = Resource<PermissionSet>(
+  "AWS.IdentityCenter.PermissionSet",
+);
+
+export const PermissionSetProvider = () =>
+  Provider.effect(
+    PermissionSet,
+    Effect.gen(function* () {
+      return {
+        stables: ["permissionSetArn", "instanceArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            olds?.instanceArn !== news.instanceArn ||
+            olds?.name !== news.name
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          if (output?.permissionSetArn && output.instanceArn) {
+            return yield* readPermissionSetByArn({
+              instanceArn: output.instanceArn,
+              permissionSetArn: output.permissionSetArn,
+            });
+          }
+
+          if (!olds) {
+            return undefined;
+          }
+
+          return yield* readPermissionSetByName(olds);
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const instance = yield* resolveInstance(
+            output?.instanceArn ?? news.instanceArn,
+          );
+
+          // Observe — find the permission set by ARN (when we already
+          // have one) or by name on the resolved instance.
+          let existing =
+            (output?.permissionSetArn
+              ? yield* readPermissionSetByArn({
+                  instanceArn: instance.InstanceArn!,
+                  permissionSetArn: output.permissionSetArn,
+                })
+              : undefined) ??
+            (yield* readPermissionSetByName({
+              ...news,
+              instanceArn: instance.InstanceArn,
+            }));
+
+          // Ensure — create the permission set if missing.
+          if (!existing) {
+            const response = yield* retryIdentityCenter(
+              ssoAdmin.createPermissionSet({
+                InstanceArn: instance.InstanceArn!,
+                Name: news.name,
+                Description: news.description,
+                SessionDuration: news.sessionDuration,
+                RelayState: news.relayState,
+              }),
+            );
+
+            const createdArn = response.PermissionSet?.PermissionSetArn;
+            existing =
+              (createdArn
+                ? yield* readPermissionSetByArn({
+                    instanceArn: instance.InstanceArn!,
+                    permissionSetArn: createdArn,
+                  })
+                : undefined) ??
+              (yield* readPermissionSetByName({
+                ...news,
+                instanceArn: instance.InstanceArn,
+              }));
+
+            if (!existing) {
+              return yield* Effect.fail(
+                new Error(
+                  `permission set '${news.name}' not found after create`,
+                ),
+              );
+            }
+
+            yield* session.note(existing.permissionSetArn);
+            return existing;
+          }
+
+          // Sync mutable attributes — `updatePermissionSet` overwrites
+          // description, sessionDuration, relayState. Diff against
+          // observed cloud state so adoption converges; only call when
+          // there's a real delta.
+          if (
+            (existing.description ?? undefined) !== news.description ||
+            (existing.sessionDuration ?? undefined) !== news.sessionDuration ||
+            (existing.relayState ?? undefined) !== news.relayState
+          ) {
+            yield* retryIdentityCenter(
+              ssoAdmin.updatePermissionSet({
+                InstanceArn: existing.instanceArn,
+                PermissionSetArn: existing.permissionSetArn,
+                Description: news.description,
+                SessionDuration: news.sessionDuration,
+                RelayState: news.relayState,
+              }),
+            );
+
+            const updated = yield* readPermissionSetByArn({
+              instanceArn: existing.instanceArn,
+              permissionSetArn: existing.permissionSetArn,
+            });
+            if (!updated) {
+              return yield* Effect.fail(
+                new Error(
+                  `permission set '${existing.permissionSetArn}' not found after update`,
+                ),
+              );
+            }
+            yield* session.note(updated.permissionSetArn);
+            return updated;
+          }
+
+          yield* session.note(existing.permissionSetArn);
+          return existing;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryIdentityCenter(
+            ssoAdmin
+              .deletePermissionSet({
+                InstanceArn: output.instanceArn,
+                PermissionSetArn: output.permissionSetArn,
+              })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const readPermissionSetByArn = Effect.fn(function* ({
+  instanceArn,
+  permissionSetArn,
+}: {
+  instanceArn: string;
+  permissionSetArn: string;
+}) {
+  const response = yield* retryIdentityCenter(
+    ssoAdmin
+      .describePermissionSet({
+        InstanceArn: instanceArn,
+        PermissionSetArn: permissionSetArn,
+      })
+      .pipe(
+        Effect.catchTag("ResourceNotFoundException", () =>
+          Effect.succeed(undefined),
+        ),
+      ),
+  );
+
+  const permissionSet = response?.PermissionSet;
+  if (!permissionSet?.PermissionSetArn || !permissionSet.Name) {
+    return undefined;
+  }
+
+  return {
+    instanceArn,
+    permissionSetArn: permissionSet.PermissionSetArn,
+    name: permissionSet.Name,
+    description: permissionSet.Description,
+    sessionDuration: permissionSet.SessionDuration,
+    relayState: permissionSet.RelayState,
+    createdDate: permissionSet.CreatedDate,
+  } satisfies PermissionSet["Attributes"];
+});
+
+const readPermissionSetByName = Effect.fn(function* ({
+  instanceArn,
+  name,
+}: Pick<PermissionSetProps, "instanceArn" | "name">) {
+  const instance = yield* resolveInstance(instanceArn);
+  const arns = yield* ssoAdmin.listPermissionSets
+    .items({
+      InstanceArn: instance.InstanceArn!,
+      MaxResults: 100,
+    })
+    .pipe(Stream.runCollect);
+
+  for (const permissionSetArn of arns) {
+    const permissionSet = yield* readPermissionSetByArn({
+      instanceArn: instance.InstanceArn!,
+      permissionSetArn,
+    });
+    if (permissionSet?.name === name) {
+      return permissionSet;
+    }
+  }
+
+  return undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/common.ts
new file mode 100644
index 00000000000..384e4f7b188
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/common.ts
@@ -0,0 +1,117 @@
+import * as identitystore from "@distilled.cloud/aws/identitystore";
+import * as ssoAdmin from "@distilled.cloud/aws/sso-admin";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+
+export const retryIdentityCenter = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.retry({
+      while: (error: any) =>
+        error?._tag === "ConflictException" ||
+        error?._tag === "ThrottlingException" ||
+        error?._tag === "InternalServerException",
+      schedule: Schedule.exponential(200).pipe(
+        Schedule.both(Schedule.recurs(8)),
+      ),
+    }),
+  );
+
+export const listInstances = Effect.fn(function* () {
+  return yield* ssoAdmin.listInstances
+    .items({
+      MaxResults: 100,
+    })
+    .pipe(
+      Stream.runCollect,
+      Effect.map(
+        (instances) => Array.from(instances) as ssoAdmin.InstanceMetadata[],
+      ),
+    );
+});
+
+export const resolveInstance = Effect.fn(function* (instanceArn?: string) {
+  const instances = yield* listInstances();
+
+  if (instanceArn) {
+    const selected = instances.find(
+      (instance) => instance.InstanceArn === instanceArn,
+    );
+    if (!selected?.InstanceArn || !selected.IdentityStoreId) {
+      return yield* Effect.fail(
+        new Error(`Identity Center instance '${instanceArn}' was not found`),
+      );
+    }
+    return selected;
+  }
+
+  if (instances.length === 1) {
+    return instances[0]!;
+  }
+
+  const active = instances.filter((instance) => instance.Status === "ACTIVE");
+  if (active.length === 1) {
+    return active[0]!;
+  }
+
+  return yield* Effect.fail(
+    new Error(
+      "Unable to resolve a single visible Identity Center instance; pass instanceArn explicitly",
+    ),
+  );
+});
+
+export const resolveIdentityStoreId = Effect.fn(function* ({
+  identityStoreId,
+  instanceArn,
+}: {
+  identityStoreId?: string;
+  instanceArn?: string;
+}) {
+  if (identityStoreId) {
+    return identityStoreId;
+  }
+
+  const instance = yield* resolveInstance(instanceArn);
+  if (!instance.IdentityStoreId) {
+    return yield* Effect.fail(
+      new Error(
+        `Identity Center instance '${instance.InstanceArn}' is missing an identity store ID`,
+      ),
+    );
+  }
+
+  return instance.IdentityStoreId;
+});
+
+export const toInstanceAttributes = (
+  instance: ssoAdmin.InstanceMetadata,
+): {
+  instanceArn: string;
+  identityStoreId: string;
+  ownerAccountId: string | undefined;
+  name: string | undefined;
+  status: string | undefined;
+  statusReason: string | undefined;
+  createdDate: Date | undefined;
+} => ({
+  instanceArn: instance.InstanceArn ?? "",
+  identityStoreId: instance.IdentityStoreId ?? "",
+  ownerAccountId: instance.OwnerAccountId,
+  name: instance.Name,
+  status: instance.Status,
+  statusReason: instance.StatusReason,
+  createdDate: instance.CreatedDate,
+});
+
+export const listGroups = Effect.fn(function* (identityStoreId: string) {
+  return yield* identitystore.listGroups
+    .items({
+      IdentityStoreId: identityStoreId,
+      MaxResults: 100,
+    })
+    .pipe(
+      Stream.runCollect,
+      Effect.map((groups) => Array.from(groups) as identitystore.Group[]),
+    );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/index.ts
new file mode 100644
index 00000000000..c95f0a31ef8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/IdentityCenter/index.ts
@@ -0,0 +1,4 @@
+export * from "./AccountAssignment.ts";
+export * from "./Group.ts";
+export * from "./Instance.ts";
+export * from "./PermissionSet.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeAccountSettings.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeAccountSettings.ts
new file mode 100644
index 00000000000..b87c91daefd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeAccountSettings.ts
@@ -0,0 +1,63 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface DescribeAccountSettingsRequest
+  extends Kinesis.DescribeAccountSettingsInput {}
+
+export class DescribeAccountSettings extends Binding.Service<
+  DescribeAccountSettings,
+  () => Effect.Effect<
+    (
+      request?: DescribeAccountSettingsRequest,
+    ) => Effect.Effect<
+      Kinesis.DescribeAccountSettingsOutput,
+      Kinesis.DescribeAccountSettingsError
+    >
+  >
+>()("AWS.Kinesis.DescribeAccountSettings") {}
+
+export const DescribeAccountSettingsLive = Layer.effect(
+  DescribeAccountSettings,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeAccountSettingsPolicy;
+    const describeAccountSettings = yield* Kinesis.describeAccountSettings;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: DescribeAccountSettingsRequest) {
+        return yield* describeAccountSettings(request ?? {});
+      });
+    });
+  }),
+);
+
+export class DescribeAccountSettingsPolicy extends Binding.Policy<
+  DescribeAccountSettingsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.Kinesis.DescribeAccountSettings") {}
+
+export const DescribeAccountSettingsPolicyLive =
+  DescribeAccountSettingsPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Kinesis.DescribeAccountSettings())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["kinesis:DescribeAccountSettings"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeAccountSettingsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeLimits.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeLimits.ts
new file mode 100644
index 00000000000..68cc1cc65af
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeLimits.ts
@@ -0,0 +1,59 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface DescribeLimitsRequest extends Kinesis.DescribeLimitsInput {}
+
+export class DescribeLimits extends Binding.Service<
+  DescribeLimits,
+  () => Effect.Effect<
+    (
+      request?: DescribeLimitsRequest,
+    ) => Effect.Effect<
+      Kinesis.DescribeLimitsOutput,
+      Kinesis.DescribeLimitsError
+    >
+  >
+>()("AWS.Kinesis.DescribeLimits") {}
+
+export const DescribeLimitsLive = Layer.effect(
+  DescribeLimits,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeLimitsPolicy;
+    const describeLimits = yield* Kinesis.describeLimits;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: DescribeLimitsRequest) {
+        return yield* describeLimits(request ?? {});
+      });
+    });
+  }),
+);
+
+export class DescribeLimitsPolicy extends Binding.Policy<
+  DescribeLimitsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.Kinesis.DescribeLimits") {}
+
+export const DescribeLimitsPolicyLive = DescribeLimitsPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.DescribeLimits())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:DescribeLimits"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DescribeLimitsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStream.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStream.ts
new file mode 100644
index 00000000000..277dba35be6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStream.ts
@@ -0,0 +1,69 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface DescribeStreamRequest extends Omit<
+  Kinesis.DescribeStreamInput,
+  "StreamName" | "StreamARN"
+> {}
+
+export class DescribeStream extends Binding.Service<
+  DescribeStream,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request?: DescribeStreamRequest,
+    ) => Effect.Effect<
+      Kinesis.DescribeStreamOutput,
+      Kinesis.DescribeStreamError
+    >
+  >
+>()("AWS.Kinesis.DescribeStream") {}
+
+export const DescribeStreamLive = Layer.effect(
+  DescribeStream,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeStreamPolicy;
+    const describeStream = yield* Kinesis.describeStream;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamARN = yield* stream.streamArn;
+      yield* Policy(stream);
+      return Effect.fn(function* (request?: DescribeStreamRequest) {
+        return yield* describeStream({
+          ...request,
+          StreamARN: yield* StreamARN,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeStreamPolicy extends Binding.Policy<
+  DescribeStreamPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.DescribeStream") {}
+
+export const DescribeStreamPolicyLive = DescribeStreamPolicy.layer.succeed(
+  Effect.fn(function* (host, stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.DescribeStream(${stream}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:DescribeStream"],
+            Resource: [stream.streamArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DescribeStreamPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStreamConsumer.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStreamConsumer.ts
new file mode 100644
index 00000000000..388eaa72b09
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStreamConsumer.ts
@@ -0,0 +1,72 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { StreamConsumer } from "./StreamConsumer.ts";
+
+export interface DescribeStreamConsumerRequest extends Omit<
+  Kinesis.DescribeStreamConsumerInput,
+  "ConsumerARN" | "StreamARN" | "ConsumerName"
+> {}
+
+export class DescribeStreamConsumer extends Binding.Service<
+  DescribeStreamConsumer,
+  (
+    consumer: StreamConsumer,
+  ) => Effect.Effect<
+    (
+      request?: DescribeStreamConsumerRequest,
+    ) => Effect.Effect<
+      Kinesis.DescribeStreamConsumerOutput,
+      Kinesis.DescribeStreamConsumerError
+    >
+  >
+>()("AWS.Kinesis.DescribeStreamConsumer") {}
+
+export const DescribeStreamConsumerLive = Layer.effect(
+  DescribeStreamConsumer,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeStreamConsumerPolicy;
+    const describeStreamConsumer = yield* Kinesis.describeStreamConsumer;
+
+    return Effect.fn(function* (consumer: StreamConsumer) {
+      const ConsumerARN = yield* consumer.consumerArn;
+      yield* Policy(consumer);
+      return Effect.fn(function* (request?: DescribeStreamConsumerRequest) {
+        return yield* describeStreamConsumer({
+          ...request,
+          ConsumerARN: yield* ConsumerARN,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeStreamConsumerPolicy extends Binding.Policy<
+  DescribeStreamConsumerPolicy,
+  (consumer: StreamConsumer) => Effect.Effect<void>
+>()("AWS.Kinesis.DescribeStreamConsumer") {}
+
+export const DescribeStreamConsumerPolicyLive =
+  DescribeStreamConsumerPolicy.layer.succeed(
+    Effect.fn(function* (host, consumer) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Kinesis.DescribeStreamConsumer(${consumer}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["kinesis:DescribeStreamConsumer"],
+                Resource: [consumer.consumerArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeStreamConsumerPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStreamSummary.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStreamSummary.ts
new file mode 100644
index 00000000000..d21d1e45e04
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/DescribeStreamSummary.ts
@@ -0,0 +1,72 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface DescribeStreamSummaryRequest extends Omit<
+  Kinesis.DescribeStreamSummaryInput,
+  "StreamName" | "StreamARN"
+> {}
+
+export class DescribeStreamSummary extends Binding.Service<
+  DescribeStreamSummary,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request?: DescribeStreamSummaryRequest,
+    ) => Effect.Effect<
+      Kinesis.DescribeStreamSummaryOutput,
+      Kinesis.DescribeStreamSummaryError
+    >
+  >
+>()("AWS.Kinesis.DescribeStreamSummary") {}
+
+export const DescribeStreamSummaryLive = Layer.effect(
+  DescribeStreamSummary,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeStreamSummaryPolicy;
+    const describeStreamSummary = yield* Kinesis.describeStreamSummary;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamARN = yield* stream.streamArn;
+      yield* Policy(stream);
+      return Effect.fn(function* (request?: DescribeStreamSummaryRequest) {
+        return yield* describeStreamSummary({
+          ...request,
+          StreamARN: yield* StreamARN,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeStreamSummaryPolicy extends Binding.Policy<
+  DescribeStreamSummaryPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.DescribeStreamSummary") {}
+
+export const DescribeStreamSummaryPolicyLive =
+  DescribeStreamSummaryPolicy.layer.succeed(
+    Effect.fn(function* (host, stream) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Kinesis.DescribeStreamSummary(${stream}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["kinesis:DescribeStreamSummary"],
+                Resource: [stream.streamArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `DescribeStreamSummaryPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetRecords.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetRecords.ts
new file mode 100644
index 00000000000..693655573cc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetRecords.ts
@@ -0,0 +1,59 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface GetRecordsRequest extends Kinesis.GetRecordsInput {}
+
+export class GetRecords extends Binding.Service<
+  GetRecords,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request: GetRecordsRequest,
+    ) => Effect.Effect<Kinesis.GetRecordsOutput, Kinesis.GetRecordsError>
+  >
+>()("AWS.Kinesis.GetRecords") {}
+
+export const GetRecordsLive = Layer.effect(
+  GetRecords,
+  Effect.gen(function* () {
+    const Policy = yield* GetRecordsPolicy;
+    const getRecords = yield* Kinesis.getRecords;
+
+    return Effect.fn(function* (stream: Stream) {
+      yield* Policy(stream);
+      return Effect.fn(function* (request: GetRecordsRequest) {
+        return yield* getRecords(request);
+      });
+    });
+  }),
+);
+
+export class GetRecordsPolicy extends Binding.Policy<
+  GetRecordsPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.GetRecords") {}
+
+export const GetRecordsPolicyLive = GetRecordsPolicy.layer.succeed(
+  Effect.fn(function* (host, stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.GetRecords(${stream}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:GetRecords"],
+            Resource: [stream.streamArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `GetRecordsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetResourcePolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetResourcePolicy.ts
new file mode 100644
index 00000000000..58dbc1131fe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetResourcePolicy.ts
@@ -0,0 +1,72 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface GetResourcePolicyRequest extends Omit<
+  Kinesis.GetResourcePolicyInput,
+  "ResourceARN"
+> {}
+
+export class GetResourcePolicy extends Binding.Service<
+  GetResourcePolicy,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request?: GetResourcePolicyRequest,
+    ) => Effect.Effect<
+      Kinesis.GetResourcePolicyOutput,
+      Kinesis.GetResourcePolicyError
+    >
+  >
+>()("AWS.Kinesis.GetResourcePolicy") {}
+
+export const GetResourcePolicyLive = Layer.effect(
+  GetResourcePolicy,
+  Effect.gen(function* () {
+    const Policy = yield* GetResourcePolicyPolicy;
+    const getResourcePolicy = yield* Kinesis.getResourcePolicy;
+
+    return Effect.fn(function* (stream: Stream) {
+      const ResourceARN = yield* stream.streamArn;
+      yield* Policy(stream);
+      return Effect.fn(function* (request?: GetResourcePolicyRequest) {
+        return yield* getResourcePolicy({
+          ...request,
+          ResourceARN: yield* ResourceARN,
+        });
+      });
+    });
+  }),
+);
+
+export class GetResourcePolicyPolicy extends Binding.Policy<
+  GetResourcePolicyPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.GetResourcePolicy") {}
+
+export const GetResourcePolicyPolicyLive =
+  GetResourcePolicyPolicy.layer.succeed(
+    Effect.fn(function* (host, stream) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Kinesis.GetResourcePolicy(${stream}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["kinesis:GetResourcePolicy"],
+                Resource: [stream.streamArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `GetResourcePolicyPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetShardIterator.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetShardIterator.ts
new file mode 100644
index 00000000000..ae05b3f7e03
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/GetShardIterator.ts
@@ -0,0 +1,71 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface GetShardIteratorRequest extends Omit<
+  Kinesis.GetShardIteratorInput,
+  "StreamName" | "StreamARN"
+> {}
+
+export class GetShardIterator extends Binding.Service<
+  GetShardIterator,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request: GetShardIteratorRequest,
+    ) => Effect.Effect<
+      Kinesis.GetShardIteratorOutput,
+      Kinesis.GetShardIteratorError
+    >
+  >
+>()("AWS.Kinesis.GetShardIterator") {}
+
+export const GetShardIteratorLive = Layer.effect(
+  GetShardIterator,
+  Effect.gen(function* () {
+    const Policy = yield* GetShardIteratorPolicy;
+    const getShardIterator = yield* Kinesis.getShardIterator;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamARN = yield* stream.streamArn;
+      yield* Policy(stream);
+      return Effect.fn(function* (request: GetShardIteratorRequest) {
+        return yield* getShardIterator({
+          ...request,
+          StreamARN: yield* StreamARN,
+        });
+      });
+    });
+  }),
+);
+
+export class GetShardIteratorPolicy extends Binding.Policy<
+  GetShardIteratorPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.GetShardIterator") {}
+
+export const GetShardIteratorPolicyLive = GetShardIteratorPolicy.layer.succeed(
+  Effect.fn(function* (host, stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.GetShardIterator(${stream}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["kinesis:GetShardIterator"],
+              Resource: [stream.streamArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `GetShardIteratorPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListShards.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListShards.ts
new file mode 100644
index 00000000000..057136fa631
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListShards.ts
@@ -0,0 +1,66 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface ListShardsRequest extends Omit<
+  Kinesis.ListShardsInput,
+  "StreamName" | "StreamARN"
+> {}
+
+export class ListShards extends Binding.Service<
+  ListShards,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request?: ListShardsRequest,
+    ) => Effect.Effect<Kinesis.ListShardsOutput, Kinesis.ListShardsError>
+  >
+>()("AWS.Kinesis.ListShards") {}
+
+export const ListShardsLive = Layer.effect(
+  ListShards,
+  Effect.gen(function* () {
+    const Policy = yield* ListShardsPolicy;
+    const listShards = yield* Kinesis.listShards;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamARN = yield* stream.streamArn;
+      yield* Policy(stream);
+      return Effect.fn(function* (request?: ListShardsRequest) {
+        return yield* listShards({
+          ...request,
+          StreamARN: yield* StreamARN,
+        });
+      });
+    });
+  }),
+);
+
+export class ListShardsPolicy extends Binding.Policy<
+  ListShardsPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.ListShards") {}
+
+export const ListShardsPolicyLive = ListShardsPolicy.layer.succeed(
+  Effect.fn(function* (host, stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.ListShards(${stream}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:ListShards"],
+            Resource: [stream.streamArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListShardsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListStreamConsumers.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListStreamConsumers.ts
new file mode 100644
index 00000000000..840302bfb04
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListStreamConsumers.ts
@@ -0,0 +1,72 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface ListStreamConsumersRequest extends Omit<
+  Kinesis.ListStreamConsumersInput,
+  "StreamARN"
+> {}
+
+export class ListStreamConsumers extends Binding.Service<
+  ListStreamConsumers,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request?: ListStreamConsumersRequest,
+    ) => Effect.Effect<
+      Kinesis.ListStreamConsumersOutput,
+      Kinesis.ListStreamConsumersError
+    >
+  >
+>()("AWS.Kinesis.ListStreamConsumers") {}
+
+export const ListStreamConsumersLive = Layer.effect(
+  ListStreamConsumers,
+  Effect.gen(function* () {
+    const Policy = yield* ListStreamConsumersPolicy;
+    const listStreamConsumers = yield* Kinesis.listStreamConsumers;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamARN = yield* stream.streamArn;
+      yield* Policy(stream);
+      return Effect.fn(function* (request?: ListStreamConsumersRequest) {
+        return yield* listStreamConsumers({
+          ...request,
+          StreamARN: yield* StreamARN,
+        });
+      });
+    });
+  }),
+);
+
+export class ListStreamConsumersPolicy extends Binding.Policy<
+  ListStreamConsumersPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.ListStreamConsumers") {}
+
+export const ListStreamConsumersPolicyLive =
+  ListStreamConsumersPolicy.layer.succeed(
+    Effect.fn(function* (host, stream) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Kinesis.ListStreamConsumers(${stream}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["kinesis:ListStreamConsumers"],
+                Resource: [stream.streamArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListStreamConsumersPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListStreams.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListStreams.ts
new file mode 100644
index 00000000000..83f80e77111
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListStreams.ts
@@ -0,0 +1,56 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListStreamsRequest extends Kinesis.ListStreamsInput {}
+
+export class ListStreams extends Binding.Service<
+  ListStreams,
+  () => Effect.Effect<
+    (
+      request?: ListStreamsRequest,
+    ) => Effect.Effect<Kinesis.ListStreamsOutput, Kinesis.ListStreamsError>
+  >
+>()("AWS.Kinesis.ListStreams") {}
+
+export const ListStreamsLive = Layer.effect(
+  ListStreams,
+  Effect.gen(function* () {
+    const Policy = yield* ListStreamsPolicy;
+    const listStreams = yield* Kinesis.listStreams;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: ListStreamsRequest) {
+        return yield* listStreams(request ?? {});
+      });
+    });
+  }),
+);
+
+export class ListStreamsPolicy extends Binding.Policy<
+  ListStreamsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.Kinesis.ListStreams") {}
+
+export const ListStreamsPolicyLive = ListStreamsPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.ListStreams())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:ListStreams"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListStreamsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListTagsForResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListTagsForResource.ts
new file mode 100644
index 00000000000..19a35c5d083
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/ListTagsForResource.ts
@@ -0,0 +1,78 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+import type { StreamConsumer } from "./StreamConsumer.ts";
+
+type TaggableResource = Stream | StreamConsumer;
+
+export interface ListTagsForResourceRequest extends Omit<
+  Kinesis.ListTagsForResourceInput,
+  "ResourceARN"
+> {}
+
+export class ListTagsForResource extends Binding.Service<
+  ListTagsForResource,
+  (
+    resource: TaggableResource,
+  ) => Effect.Effect<
+    (
+      request?: ListTagsForResourceRequest,
+    ) => Effect.Effect<
+      Kinesis.ListTagsForResourceOutput,
+      Kinesis.ListTagsForResourceError
+    >
+  >
+>()("AWS.Kinesis.ListTagsForResource") {}
+
+const getResourceArn = (resource: TaggableResource) =>
+  "consumerArn" in resource ? resource.consumerArn : resource.streamArn;
+
+export const ListTagsForResourceLive = Layer.effect(
+  ListTagsForResource,
+  Effect.gen(function* () {
+    const Policy = yield* ListTagsForResourcePolicy;
+    const listTagsForResource = yield* Kinesis.listTagsForResource;
+
+    return Effect.fn(function* (resource: TaggableResource) {
+      const ResourceARN = yield* getResourceArn(resource);
+      yield* Policy(resource);
+      return Effect.fn(function* (request?: ListTagsForResourceRequest) {
+        return yield* listTagsForResource({
+          ...request,
+          ResourceARN: yield* ResourceARN,
+        });
+      });
+    });
+  }),
+);
+
+export class ListTagsForResourcePolicy extends Binding.Policy<
+  ListTagsForResourcePolicy,
+  (resource: TaggableResource) => Effect.Effect<void>
+>()("AWS.Kinesis.ListTagsForResource") {}
+
+export const ListTagsForResourcePolicyLive =
+  ListTagsForResourcePolicy.layer.succeed(
+    Effect.fn(function* (host, resource) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Kinesis.ListTagsForResource(${resource}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["kinesis:ListTagsForResource"],
+                Resource: [getResourceArn(resource)],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListTagsForResourcePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/PutRecord.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/PutRecord.ts
new file mode 100644
index 00000000000..38be5a15c7e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/PutRecord.ts
@@ -0,0 +1,67 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface PutRecordRequest extends Omit<
+  Kinesis.PutRecordInput,
+  "StreamName"
+> {}
+
+export class PutRecord extends Binding.Service<
+  PutRecord,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request: PutRecordRequest,
+    ) => Effect.Effect<Kinesis.PutRecordOutput, Kinesis.PutRecordError>
+  >
+>()("AWS.Kinesis.PutRecord") {}
+
+export const PutRecordLive = Layer.effect(
+  PutRecord,
+  Effect.gen(function* () {
+    const Policy = yield* PutRecordPolicy;
+    const putRecord = yield* Kinesis.putRecord;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamName = yield* stream.streamName;
+      yield* Policy(stream);
+      return Effect.fn(function* (request: PutRecordRequest) {
+        return yield* putRecord({
+          ...request,
+          StreamName: yield* StreamName,
+        });
+      });
+    });
+  }),
+);
+
+export class PutRecordPolicy extends Binding.Policy<
+  PutRecordPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.PutRecord") {}
+
+export const PutRecordPolicyLive = PutRecordPolicy.layer.succeed(
+  Effect.fn(function* (host, stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.PutRecord(${stream}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:PutRecord"],
+            Resource: [Output.interpolate`${stream.streamArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PutRecordPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/PutRecords.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/PutRecords.ts
new file mode 100644
index 00000000000..9346f3f585d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/PutRecords.ts
@@ -0,0 +1,67 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Stream } from "./Stream.ts";
+
+export interface PutRecordsRequest extends Omit<
+  Kinesis.PutRecordsInput,
+  "StreamName"
+> {}
+
+export class PutRecords extends Binding.Service<
+  PutRecords,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    (
+      request: PutRecordsRequest,
+    ) => Effect.Effect<Kinesis.PutRecordsOutput, Kinesis.PutRecordsError>
+  >
+>()("AWS.Kinesis.PutRecords") {}
+
+export const PutRecordsLive = Layer.effect(
+  PutRecords,
+  Effect.gen(function* () {
+    const Policy = yield* PutRecordsPolicy;
+    const putRecords = yield* Kinesis.putRecords;
+
+    return Effect.fn(function* (stream: Stream) {
+      const StreamName = yield* stream.streamName;
+      yield* Policy(stream);
+      return Effect.fn(function* (request: PutRecordsRequest) {
+        return yield* putRecords({
+          ...request,
+          StreamName: yield* StreamName,
+        });
+      });
+    });
+  }),
+);
+
+export class PutRecordsPolicy extends Binding.Policy<
+  PutRecordsPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.PutRecords") {}
+
+export const PutRecordsPolicyLive = PutRecordsPolicy.layer.succeed(
+  Effect.fn(function* (host, stream: Stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.PutRecords(${stream}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:PutRecords"],
+            Resource: [Output.interpolate`${stream.streamArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PutRecordsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/Stream.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/Stream.ts
new file mode 100644
index 00000000000..ee939fdb6a1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/Stream.ts
@@ -0,0 +1,734 @@
+// required to avoid this error in consumers: "The inferred type of 'Records' cannot be named without a reference to '../../@distilled.cloud/aws/node_modules/@types/aws-lambda'. This is likely not portable. A type annotation is necessary.ts(2742)"
+export type * as lambda from "aws-lambda";
+
+import { Region } from "@distilled.cloud/aws/Region";
+import * as kinesis from "@distilled.cloud/aws/kinesis";
+import type * as lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  diffTags,
+  hasAlchemyTags,
+  type Tags,
+} from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type StreamRecord = lambda.KinesisStreamRecord;
+
+export type StreamEvent = lambda.KinesisStreamEvent;
+
+export type StreamName = string;
+export type StreamArn =
+  `arn:aws:kinesis:${RegionID}:${AccountID}:stream/${StreamName}`;
+
+export type StreamStatus = "CREATING" | "DELETING" | "ACTIVE" | "UPDATING";
+
+export type StreamMode = "PROVISIONED" | "ON_DEMAND";
+
+export type EncryptionType = "NONE" | "KMS";
+
+export type WarmThroughput = {
+  targetMiBps?: number;
+  currentMiBps?: number;
+};
+
+export type StreamProps = {
+  /**
+   * Name of the stream.
+   * @default ${app}-${stage}-${id}
+   */
+  streamName?: string;
+  /**
+   * The capacity mode of the data stream.
+   * - PROVISIONED: You specify the number of shards for the data stream.
+   * - ON_DEMAND: AWS manages the shards for the data stream.
+   * @default "ON_DEMAND"
+   */
+  streamMode?: StreamMode;
+  /**
+   * The number of shards that the stream will use when in PROVISIONED mode.
+   * Required when `streamMode` is `"PROVISIONED"`.
+   */
+  shardCount?: number;
+  /**
+   * The number of hours that records remain accessible in the stream.
+   * Valid values range from 24 to 8760.
+   * @default 24
+   */
+  retentionPeriodHours?: number;
+  /**
+   * If set to true, server-side encryption is enabled on the stream.
+   * Uses the AWS managed CMK for Kinesis (`alias/aws/kinesis`) when `kmsKeyId`
+   * is omitted.
+   * @default false
+   */
+  encryption?: boolean;
+  /**
+   * The AWS KMS key to use when encryption is enabled.
+   */
+  kmsKeyId?: string;
+  /**
+   * A list of shard-level CloudWatch metrics to enable for the stream.
+   */
+  shardLevelMetrics?: ShardLevelMetric[];
+  /**
+   * Pre-provisioned warm throughput for on-demand streams, in MiBps.
+   */
+  warmThroughputMiBps?: number;
+  /**
+   * Maximum size of a single record, in KiB.
+   */
+  maxRecordSizeInKiB?: number;
+  /**
+   * Resource policy attached to the stream.
+   */
+  resourcePolicy?: string;
+  /**
+   * Tags to associate with the stream.
+   */
+  tags?: Record<string, string>;
+};
+
+export interface Stream extends Resource<
+  "AWS.Kinesis.Stream",
+  StreamProps,
+  {
+    /**
+     * The stream's physical name.
+     */
+    streamName: StreamName;
+    /**
+     * ARN of the stream.
+     */
+    streamArn: StreamArn;
+    /**
+     * Provider-assigned unique identifier for the stream, when returned by AWS.
+     */
+    streamId: string | undefined;
+    /**
+     * Current lifecycle status of the stream.
+     */
+    streamStatus: StreamStatus;
+    /**
+     * Current capacity mode of the stream.
+     */
+    streamMode: StreamMode;
+    /**
+     * Number of hours that records remain accessible in the stream.
+     */
+    retentionPeriodHours: number;
+    /**
+     * Current server-side encryption mode.
+     */
+    encryptionType: EncryptionType;
+    /**
+     * KMS key ID backing stream encryption, when encryption is enabled with KMS.
+     */
+    kmsKeyId: string | undefined;
+    /**
+     * Number of open shards currently reported by the stream summary.
+     */
+    openShardCount: number | undefined;
+    /**
+     * Number of registered consumers currently attached to the stream.
+     */
+    consumerCount: number | undefined;
+    /**
+     * Enabled shard-level CloudWatch metrics for the stream.
+     */
+    shardLevelMetrics: ShardLevelMetric[];
+    /**
+     * Current and target warm throughput settings for on-demand streams, when available.
+     */
+    warmThroughput: WarmThroughput | undefined;
+    /**
+     * Maximum record size, in KiB, that the stream accepts.
+     */
+    maxRecordSizeInKiB: number | undefined;
+    /**
+     * Current resource policy attached to the stream, if one is configured.
+     */
+    resourcePolicy: string | undefined;
+    /**
+     * Current tags reported for the stream.
+     */
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon Kinesis Data Stream.
+ *
+ * `Stream` owns the stream's lifecycle and mutable control-plane configuration,
+ * including retention, encryption, monitoring, warm throughput, record size, tags,
+ * and stream resource policy. A stream name is auto-generated from the app,
+ * stage, and logical ID unless you provide one explicitly.
+ *
+ * @section Creating Streams
+ * @example On-Demand Stream
+ * ```typescript
+ * import * as Kinesis from "alchemy/AWS/Kinesis";
+ *
+ * const stream = yield* Kinesis.Stream("OrdersStream");
+ * ```
+ *
+ * @example Provisioned Stream
+ * ```typescript
+ * const stream = yield* Kinesis.Stream("AnalyticsStream", {
+ *   streamMode: "PROVISIONED",
+ *   shardCount: 2,
+ *   retentionPeriodHours: 48,
+ * });
+ * ```
+ *
+ * @example Encrypted Stream
+ * ```typescript
+ * const stream = yield* Kinesis.Stream("SecureStream", {
+ *   encryption: true,
+ *   kmsKeyId: "alias/my-key",
+ * });
+ * ```
+ *
+ * @section Runtime Producers
+ * Bind producer operations in the init phase and use them in runtime
+ * handlers.
+ *
+ * @example Put a record from a handler
+ * ```typescript
+ * // init
+ * const putRecord = yield* Kinesis.PutRecord.bind(stream);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* putRecord({
+ *       PartitionKey: "order-123",
+ *       Data: new TextEncoder().encode(JSON.stringify({ orderId: "123" })),
+ *     });
+ *     return HttpServerResponse.text("Sent");
+ *   }),
+ * };
+ * ```
+ *
+ * @section Event Sources
+ * Process records from a Kinesis stream using a Lambda event source
+ * mapping.
+ *
+ * @example Process stream records
+ * ```typescript
+ * // init
+ * yield* Kinesis.records(stream).process(
+ *   Effect.fn(function* (record) {
+ *     const data = new TextDecoder().decode(record.data);
+ *     yield* Effect.log(`Received: ${data}`);
+ *   }),
+ * );
+ * ```
+ */
+export const Stream = Resource<Stream>("AWS.Kinesis.Stream");
+
+export type ShardLevelMetric =
+  | "IncomingBytes"
+  | "IncomingRecords"
+  | "OutgoingBytes"
+  | "OutgoingRecords"
+  | "WriteProvisionedThroughputExceeded"
+  | "ReadProvisionedThroughputExceeded"
+  | "IteratorAgeMilliseconds"
+  | "ALL";
+
+const defaultStreamMode = "ON_DEMAND" as const;
+const defaultRetentionPeriodHours = 24;
+const defaultEncryptionType = "NONE" as const;
+
+const createStreamName = (
+  id: string,
+  props: {
+    streamName?: string | undefined;
+  },
+) =>
+  Effect.gen(function* () {
+    if (props.streamName) {
+      return props.streamName;
+    }
+    return yield* createPhysicalName({
+      id,
+      maxLength: 128,
+    });
+  });
+
+const getStreamMode = (props: StreamProps): kinesis.StreamModeDetails => ({
+  StreamMode: props.streamMode ?? defaultStreamMode,
+});
+
+const assertProvisionedProps = (props: StreamProps) =>
+  props.streamMode === "PROVISIONED" && props.shardCount === undefined
+    ? Effect.fail(
+        new Error(`streamMode "PROVISIONED" requires shardCount to be set`),
+      )
+    : Effect.void;
+
+const toTagRecord = (
+  tags: Array<{ Key: string; Value?: string }> | undefined,
+) =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const toWarmThroughput = (
+  warmThroughput: kinesis.WarmThroughputObject | undefined,
+): WarmThroughput | undefined =>
+  warmThroughput
+    ? {
+        targetMiBps: warmThroughput.TargetMiBps,
+        currentMiBps: warmThroughput.CurrentMiBps,
+      }
+    : undefined;
+
+const toShardLevelMetrics = (
+  monitoring: kinesis.EnhancedMetrics[] | undefined,
+): ShardLevelMetric[] =>
+  [
+    ...new Set(
+      (monitoring ?? []).flatMap((metric) => metric.ShardLevelMetrics ?? []),
+    ),
+  ] as ShardLevelMetric[];
+
+const toAttrs = ({
+  summary,
+  tags,
+  resourcePolicy,
+}: {
+  summary: kinesis.StreamDescriptionSummary;
+  tags: Record<string, string>;
+  resourcePolicy?: string;
+}): Stream["Attributes"] => ({
+  streamName: summary.StreamName,
+  streamArn: summary.StreamARN as StreamArn,
+  streamId: summary.StreamId,
+  streamStatus: summary.StreamStatus as StreamStatus,
+  streamMode: (summary.StreamModeDetails?.StreamMode ??
+    defaultStreamMode) as StreamMode,
+  retentionPeriodHours:
+    summary.RetentionPeriodHours ?? defaultRetentionPeriodHours,
+  encryptionType: (summary.EncryptionType ??
+    defaultEncryptionType) as EncryptionType,
+  kmsKeyId: summary.KeyId,
+  openShardCount: summary.OpenShardCount,
+  consumerCount: summary.ConsumerCount,
+  shardLevelMetrics: toShardLevelMetrics(summary.EnhancedMonitoring),
+  warmThroughput: toWarmThroughput(summary.WarmThroughput),
+  maxRecordSizeInKiB: summary.MaxRecordSizeInKiB,
+  resourcePolicy,
+  tags,
+});
+
+const readStream = Effect.fn(function* ({
+  streamName,
+  streamArn,
+}: {
+  streamName?: string;
+  streamArn?: string;
+}) {
+  const response = yield* kinesis
+    .describeStreamSummary({
+      StreamName: streamName,
+      StreamARN: streamArn,
+    })
+    .pipe(
+      Effect.catchTag("ResourceNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  if (!response) {
+    return undefined;
+  }
+
+  const summary = response.StreamDescriptionSummary;
+  const tagsResponse = yield* kinesis.listTagsForResource({
+    ResourceARN: summary.StreamARN,
+  });
+  const policyResponse = yield* kinesis
+    .getResourcePolicy({
+      ResourceARN: summary.StreamARN,
+    })
+    .pipe(
+      Effect.catchTag("ResourceNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  return toAttrs({
+    summary,
+    tags: toTagRecord(tagsResponse.Tags),
+    // Treat an empty policy string as "no policy attached" so the
+    // sync step doesn't try to delete a phantom policy.
+    resourcePolicy: policyResponse?.Policy ? policyResponse.Policy : undefined,
+  });
+});
+
+const waitForStreamActive = (streamName: string) =>
+  Effect.gen(function* () {
+    yield* Effect.sleep("2 seconds");
+    const { StreamDescriptionSummary } = yield* kinesis.describeStreamSummary({
+      StreamName: streamName,
+    });
+    if (StreamDescriptionSummary.StreamStatus !== "ACTIVE") {
+      return yield* Effect.fail({ _tag: "StreamNotActive" as const });
+    }
+    return StreamDescriptionSummary;
+  }).pipe(
+    Effect.retry({
+      while: (e: { _tag: string }) =>
+        e._tag === "StreamNotActive" || e._tag === "ParseError",
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+  );
+
+const waitForStreamDeleted = (streamName: string) =>
+  Effect.gen(function* () {
+    yield* kinesis.describeStreamSummary({
+      StreamName: streamName,
+    });
+    return yield* Effect.fail({ _tag: "StreamStillExists" as const });
+  }).pipe(
+    Effect.retry({
+      while: (e: { _tag: string }) =>
+        e._tag === "StreamStillExists" || e._tag === "ParseError",
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+    Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+  );
+
+export const StreamProvider = () =>
+  Provider.effect(
+    Stream,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      return {
+        stables: ["streamName", "streamArn"],
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const streamName =
+            output?.streamName ?? (yield* createStreamName(id, olds ?? {}));
+          const state = yield* readStream({
+            streamName,
+            streamArn: output?.streamArn,
+          });
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags as Tags))
+            ? state
+            : Unowned(state);
+        }),
+        diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+          if (!isResolved(news)) return;
+          const oldStreamName = yield* createStreamName(id, olds);
+          const newStreamName = yield* createStreamName(id, news);
+          if (oldStreamName !== newStreamName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          yield* assertProvisionedProps(news);
+
+          const streamName =
+            output?.streamName ?? (yield* createStreamName(id, news));
+          const streamArn =
+            `arn:aws:kinesis:${region}:${accountId}:stream/${streamName}` as const;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live cloud state. `output` is treated as a cache
+          // for the physical name only; the stream's actual existence and
+          // configuration are fetched fresh so the reconciler converges
+          // regardless of drift, adoption, or a partially-completed prior
+          // run.
+          let state = yield* readStream({ streamName, streamArn });
+
+          // Ensure — create the stream if it's missing. Tolerate
+          // `ResourceInUseException` as a race with a peer reconciler:
+          // re-read and continue with the sync path. Retry transient
+          // `LimitExceededException`.
+          if (state === undefined) {
+            yield* kinesis
+              .createStream({
+                StreamName: streamName,
+                ShardCount:
+                  news.streamMode === "PROVISIONED"
+                    ? news.shardCount
+                    : undefined,
+                StreamModeDetails: getStreamMode(news),
+                Tags: desiredTags,
+                WarmThroughputMiBps: news.warmThroughputMiBps,
+                MaxRecordSizeInKiB: news.maxRecordSizeInKiB,
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+                Effect.retry({
+                  while: (e: any) => e._tag === "LimitExceededException",
+                  schedule: Schedule.exponential(1000),
+                }),
+              );
+
+            yield* session.note(`Creating stream ${streamName}...`);
+            yield* waitForStreamActive(streamName);
+
+            state = yield* readStream({ streamName, streamArn });
+            if (state === undefined) {
+              return yield* Effect.fail(
+                new Error(`failed to read created stream ${streamName}`),
+              );
+            }
+          }
+
+          // Sync stream mode — observed ↔ desired.
+          const desiredMode = news.streamMode ?? defaultStreamMode;
+          if (state.streamMode !== desiredMode) {
+            yield* kinesis.updateStreamMode({
+              StreamARN: streamArn,
+              StreamModeDetails: getStreamMode(news),
+              WarmThroughputMiBps:
+                desiredMode === "ON_DEMAND"
+                  ? news.warmThroughputMiBps
+                  : undefined,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note(`Updated stream mode to ${desiredMode}`);
+            state = yield* readStream({ streamName, streamArn });
+            if (state === undefined) {
+              return yield* Effect.fail(
+                new Error(`failed to re-read stream ${streamName}`),
+              );
+            }
+          }
+
+          // Sync shard count — only meaningful in PROVISIONED mode.
+          if (
+            desiredMode === "PROVISIONED" &&
+            news.shardCount !== undefined &&
+            state.openShardCount !== news.shardCount
+          ) {
+            yield* kinesis.updateShardCount({
+              StreamName: streamName,
+              TargetShardCount: news.shardCount,
+              ScalingType: "UNIFORM_SCALING",
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note(`Updated shard count to ${news.shardCount}`);
+          }
+
+          // Sync retention period — observed ↔ desired.
+          const desiredRetention =
+            news.retentionPeriodHours ?? defaultRetentionPeriodHours;
+          if (state.retentionPeriodHours !== desiredRetention) {
+            if (desiredRetention > state.retentionPeriodHours) {
+              yield* kinesis.increaseStreamRetentionPeriod({
+                StreamName: streamName,
+                RetentionPeriodHours: desiredRetention,
+              });
+            } else {
+              yield* kinesis.decreaseStreamRetentionPeriod({
+                StreamName: streamName,
+                RetentionPeriodHours: desiredRetention,
+              });
+            }
+            yield* waitForStreamActive(streamName);
+            yield* session.note(
+              `Updated retention period to ${desiredRetention} hours`,
+            );
+          }
+
+          // Sync encryption — observed ↔ desired.
+          const desiredEncryption = news.encryption ?? false;
+          const desiredKmsKey = news.kmsKeyId ?? "alias/aws/kinesis";
+          const observedEncryption = state.encryptionType === "KMS";
+          if (!observedEncryption && desiredEncryption) {
+            yield* kinesis.startStreamEncryption({
+              StreamName: streamName,
+              EncryptionType: "KMS",
+              KeyId: desiredKmsKey,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note("Enabled encryption");
+          } else if (observedEncryption && !desiredEncryption) {
+            yield* kinesis.stopStreamEncryption({
+              StreamName: streamName,
+              EncryptionType: "KMS",
+              KeyId: state.kmsKeyId ?? desiredKmsKey,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note("Disabled encryption");
+          } else if (
+            observedEncryption &&
+            desiredEncryption &&
+            news.kmsKeyId !== undefined &&
+            state.kmsKeyId !== news.kmsKeyId
+          ) {
+            yield* kinesis.startStreamEncryption({
+              StreamName: streamName,
+              EncryptionType: "KMS",
+              KeyId: news.kmsKeyId,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note("Updated KMS key");
+          }
+
+          // Sync shard-level metrics — observed ↔ desired.
+          const observedMetrics = new Set(state.shardLevelMetrics);
+          const desiredMetrics = new Set(news.shardLevelMetrics ?? []);
+          const metricsToEnable = (news.shardLevelMetrics ?? []).filter(
+            (metric) => !observedMetrics.has(metric),
+          );
+          const metricsToDisable = state.shardLevelMetrics.filter(
+            (metric) => !desiredMetrics.has(metric),
+          );
+
+          if (metricsToDisable.length > 0) {
+            yield* kinesis.disableEnhancedMonitoring({
+              StreamName: streamName,
+              ShardLevelMetrics: metricsToDisable,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note(
+              `Disabled metrics: ${metricsToDisable.join(", ")}`,
+            );
+          }
+
+          if (metricsToEnable.length > 0) {
+            yield* kinesis.enableEnhancedMonitoring({
+              StreamName: streamName,
+              ShardLevelMetrics: metricsToEnable,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note(
+              `Enabled metrics: ${metricsToEnable.join(", ")}`,
+            );
+          }
+
+          // Sync warm throughput — only meaningful in ON_DEMAND mode.
+          if (
+            desiredMode === "ON_DEMAND" &&
+            news.warmThroughputMiBps !== undefined &&
+            state.warmThroughput?.targetMiBps !== news.warmThroughputMiBps
+          ) {
+            yield* kinesis.updateStreamWarmThroughput({
+              StreamARN: streamArn,
+              WarmThroughputMiBps: news.warmThroughputMiBps,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note(
+              `Updated warm throughput to ${news.warmThroughputMiBps} MiBps`,
+            );
+          }
+
+          // Sync max record size — observed ↔ desired.
+          if (
+            news.maxRecordSizeInKiB !== undefined &&
+            state.maxRecordSizeInKiB !== news.maxRecordSizeInKiB
+          ) {
+            yield* kinesis.updateMaxRecordSize({
+              StreamARN: streamArn,
+              MaxRecordSizeInKiB: news.maxRecordSizeInKiB,
+            });
+            yield* waitForStreamActive(streamName);
+            yield* session.note(
+              `Updated max record size to ${news.maxRecordSizeInKiB} KiB`,
+            );
+          }
+
+          // Sync tags — diff observed cloud tags against desired. Adoption
+          // may bring us a stream that already has its own tag set; diffing
+          // against `state.tags` (fetched fresh) lets the reconciler
+          // converge ownership without fighting whatever was there before.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
+
+          if (removed.length > 0) {
+            yield* kinesis.removeTagsFromStream({
+              StreamName: streamName,
+              TagKeys: removed,
+            });
+          }
+
+          if (upsert.length > 0) {
+            const tagsToAdd: Record<string, string> = {};
+            for (const { Key, Value } of upsert) {
+              tagsToAdd[Key] = Value;
+            }
+            yield* kinesis.addTagsToStream({
+              StreamName: streamName,
+              Tags: tagsToAdd,
+            });
+          }
+
+          // Sync resource policy — observed ↔ desired. Tolerate the
+          // race where the cloud's policy was already removed (delete
+          // fails with `ResourceNotFoundException`) or where another
+          // reconcile already wrote the same policy.
+          if (state.resourcePolicy !== news.resourcePolicy) {
+            if (news.resourcePolicy) {
+              yield* kinesis.putResourcePolicy({
+                ResourceARN: streamArn,
+                Policy: news.resourcePolicy,
+              });
+            } else if (state.resourcePolicy) {
+              yield* kinesis
+                .deleteResourcePolicy({
+                  ResourceARN: streamArn,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "ResourceNotFoundException",
+                    () => Effect.void,
+                  ),
+                );
+            }
+          }
+
+          yield* session.note(streamArn);
+
+          // Re-read final state so the returned attributes reflect what's
+          // actually in the cloud after all sync steps.
+          const final = yield* readStream({ streamName, streamArn });
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(`failed to read reconciled stream ${streamName}`),
+            );
+          }
+          return final;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* kinesis
+            .deleteStream({
+              StreamName: output.streamName,
+              EnforceConsumerDeletion: true,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+
+          yield* waitForStreamDeleted(output.streamName);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamConsumer.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamConsumer.ts
new file mode 100644
index 00000000000..aafa0997277
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamConsumer.ts
@@ -0,0 +1,373 @@
+import * as kinesis from "@distilled.cloud/aws/kinesis";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  diffTags,
+  hasAlchemyTags,
+  type Tags,
+} from "../../Tags.ts";
+import type { StreamArn } from "./Stream.ts";
+
+export type ConsumerName = string;
+
+export type ConsumerArn = string;
+
+export type ConsumerStatus = "CREATING" | "DELETING" | "ACTIVE";
+
+export interface StreamConsumerProps {
+  /**
+   * ARN of the stream that owns the consumer.
+   */
+  streamArn: Input<StreamArn>;
+  /**
+   * Name of the stream consumer.
+   * @default ${app}-${stage}-${id}
+   */
+  consumerName?: string;
+  /**
+   * Tags to associate with the consumer.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface StreamConsumer extends Resource<
+  "AWS.Kinesis.StreamConsumer",
+  StreamConsumerProps,
+  {
+    consumerName: ConsumerName;
+    consumerArn: ConsumerArn;
+    consumerStatus: ConsumerStatus;
+    streamArn: StreamArn;
+    consumerCreationTimestamp: Date;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A registered Kinesis enhanced fan-out consumer.
+ *
+ * `StreamConsumer` is the canonical lifecycle resource for
+ * `RegisterStreamConsumer` / `DeregisterStreamConsumer`.
+ *
+ * @section Creating Consumers
+ * @example Register a Consumer
+ * ```typescript
+ * const consumer = yield* StreamConsumer("AnalyticsConsumer", {
+ *   streamArn: stream.streamArn,
+ * });
+ * ```
+ */
+export const StreamConsumer = Resource<StreamConsumer>(
+  "AWS.Kinesis.StreamConsumer",
+);
+
+const createConsumerName = (
+  id: string,
+  props: {
+    consumerName?: string | undefined;
+  },
+) =>
+  Effect.gen(function* () {
+    if (props.consumerName) {
+      return props.consumerName;
+    }
+    return yield* createPhysicalName({
+      id,
+      maxLength: 128,
+    });
+  });
+
+const toTagRecord = (
+  tags: Array<{ Key: string; Value?: string }> | undefined,
+) =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const toAttrs = ({
+  description,
+  tags,
+}: {
+  description: kinesis.ConsumerDescription;
+  tags: Record<string, string>;
+}): StreamConsumer["Attributes"] => ({
+  consumerName: description.ConsumerName,
+  consumerArn: description.ConsumerARN,
+  consumerStatus: description.ConsumerStatus as ConsumerStatus,
+  streamArn: description.StreamARN as StreamArn,
+  consumerCreationTimestamp: description.ConsumerCreationTimestamp,
+  tags,
+});
+
+const readConsumer = Effect.fn(function* ({
+  streamArn,
+  consumerName,
+  consumerArn,
+}: {
+  streamArn?: string;
+  consumerName?: string;
+  consumerArn?: string;
+}) {
+  const response = yield* kinesis
+    .describeStreamConsumer({
+      StreamARN: streamArn,
+      ConsumerName: consumerName,
+      ConsumerARN: consumerArn,
+    })
+    .pipe(
+      Effect.catchTag("ResourceNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  if (!response) {
+    return undefined;
+  }
+
+  const description = response.ConsumerDescription;
+  const tagsResponse = yield* kinesis.listTagsForResource({
+    ResourceARN: description.ConsumerARN,
+  });
+
+  return toAttrs({
+    description,
+    tags: toTagRecord(tagsResponse.Tags),
+  });
+});
+
+// Kinesis tells us "in use" via ResourceInUseException, but the consumer
+// registry is eventually consistent — describeStreamConsumer can briefly
+// return ResourceNotFoundException for a consumer the registry just
+// confirmed exists. Poll up to ~10s before giving up.
+class ConsumerRegistryNotConsistent extends Data.TaggedError(
+  "ConsumerRegistryNotConsistent",
+)<{ consumerName: string }> {}
+
+const adoptExistingConsumer = Effect.fn(function* (
+  streamArn: string,
+  consumerName: string,
+) {
+  return yield* Effect.gen(function* () {
+    const state = yield* readConsumer({
+      streamArn,
+      consumerName,
+    });
+
+    if (!state) {
+      return yield* new ConsumerRegistryNotConsistent({ consumerName });
+    }
+
+    return state;
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "ConsumerRegistryNotConsistent",
+      schedule: Schedule.exponential(250).pipe(
+        Schedule.both(Schedule.recurs(8)),
+      ),
+    }),
+    Effect.catchTag("ConsumerRegistryNotConsistent", () =>
+      Effect.fail(
+        new Error(
+          `consumer ${consumerName} exists but could not be read after ` +
+            `~10s of registry-consistency retries`,
+        ),
+      ),
+    ),
+  );
+});
+
+const waitForConsumerStatus = (
+  consumerArn: string,
+  expectedStatus: ConsumerStatus,
+) =>
+  Effect.gen(function* () {
+    yield* Effect.sleep("2 seconds");
+    const response = yield* kinesis.describeStreamConsumer({
+      ConsumerARN: consumerArn,
+    });
+    if (response.ConsumerDescription.ConsumerStatus !== expectedStatus) {
+      return yield* Effect.fail({ _tag: "ConsumerStatusNotReady" as const });
+    }
+    return response.ConsumerDescription;
+  }).pipe(
+    Effect.retry({
+      while: (e: { _tag: string }) =>
+        e._tag === "ConsumerStatusNotReady" || e._tag === "ParseError",
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+  );
+
+const waitForConsumerDeleted = (consumerArn: string) =>
+  Effect.gen(function* () {
+    yield* kinesis.describeStreamConsumer({
+      ConsumerARN: consumerArn,
+    });
+    return yield* Effect.fail({ _tag: "ConsumerStillExists" as const });
+  }).pipe(
+    Effect.retry({
+      while: (e: { _tag: string }) =>
+        e._tag === "ConsumerStillExists" || e._tag === "ParseError",
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+    Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+  );
+
+export const StreamConsumerProvider = () =>
+  Provider.succeed(StreamConsumer, {
+    stables: ["consumerArn", "consumerName"],
+    read: Effect.fn(function* ({ id, olds, output }) {
+      const consumerName =
+        output?.consumerName ?? (yield* createConsumerName(id, olds ?? {}));
+      const streamArn = output?.streamArn ?? olds?.streamArn;
+      // describeStreamConsumer rejects with InvalidArgumentException unless
+      // either consumerARN, or both streamARN + consumerName, are provided.
+      // If the engine probed for adoption before our upstream Stream was
+      // created we'll have neither — treat that as "doesn't exist".
+      if (typeof streamArn !== "string" && !output?.consumerArn) {
+        return undefined;
+      }
+      const state = yield* readConsumer({
+        streamArn: typeof streamArn === "string" ? streamArn : undefined,
+        consumerName,
+        consumerArn: output?.consumerArn,
+      });
+      if (!state) return undefined;
+      return (yield* hasAlchemyTags(id, state.tags as Tags))
+        ? state
+        : Unowned(state);
+    }),
+    diff: Effect.fn(function* ({ id, news, olds }) {
+      if (!isResolved(news)) return;
+      const oldConsumerName = yield* createConsumerName(id, olds);
+      const newConsumerName = yield* createConsumerName(id, news);
+      if (oldConsumerName !== newConsumerName) {
+        return { action: "replace" } as const;
+      }
+      if (
+        typeof news.streamArn === "string" &&
+        typeof olds.streamArn === "string" &&
+        news.streamArn !== olds.streamArn
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output, session }) {
+      const consumerName =
+        output?.consumerName ?? (yield* createConsumerName(id, news));
+      const streamArn = news.streamArn as string;
+      const internalTags = yield* createInternalTags(id);
+      const desiredTags = { ...internalTags, ...news.tags };
+
+      // Observe — fetch live cloud state. `output` is treated as a cache
+      // for the consumer ARN; the consumer's actual existence and tags are
+      // fetched fresh so the reconciler converges regardless of drift,
+      // adoption, or a partially-completed prior run.
+      let state = yield* readConsumer({
+        streamArn,
+        consumerName,
+        consumerArn: output?.consumerArn,
+      });
+
+      // Ensure — register the consumer if it's missing. Tolerate
+      // `ResourceInUseException` as a race with a peer reconciler: a
+      // brief registry-consistency wait, then re-read and continue the
+      // sync path.
+      if (state === undefined) {
+        yield* kinesis
+          .registerStreamConsumer({
+            StreamARN: streamArn,
+            ConsumerName: consumerName,
+            Tags: desiredTags,
+          })
+          .pipe(
+            Effect.asVoid,
+            Effect.catchTag("ResourceInUseException", () =>
+              adoptExistingConsumer(streamArn, consumerName).pipe(
+                Effect.asVoid,
+              ),
+            ),
+          );
+
+        state = yield* adoptExistingConsumer(streamArn, consumerName);
+        yield* waitForConsumerStatus(state.consumerArn, "ACTIVE");
+
+        state = yield* readConsumer({
+          consumerArn: state.consumerArn,
+          streamArn,
+          consumerName,
+        });
+        if (state === undefined) {
+          return yield* Effect.fail(
+            new Error(`failed to read created consumer ${consumerName}`),
+          );
+        }
+      }
+
+      // Sync tags — diff observed cloud tags against desired. Adoption
+      // may bring us a consumer that already has its own tag set; diffing
+      // against `state.tags` (fetched fresh) lets the reconciler converge
+      // ownership without fighting whatever was there before.
+      const { removed, upsert } = diffTags(state.tags, desiredTags);
+
+      if (removed.length > 0) {
+        yield* kinesis.untagResource({
+          ResourceARN: state.consumerArn,
+          TagKeys: removed,
+        });
+      }
+
+      if (upsert.length > 0) {
+        const tagsToAdd: Record<string, string> = {};
+        for (const { Key, Value } of upsert) {
+          tagsToAdd[Key] = Value;
+        }
+        yield* kinesis.tagResource({
+          ResourceARN: state.consumerArn,
+          Tags: tagsToAdd,
+        });
+      }
+
+      // Re-read final state so the returned attributes reflect what's
+      // actually in the cloud after all sync steps.
+      const final = yield* readConsumer({
+        consumerArn: state.consumerArn,
+      });
+      if (!final) {
+        return yield* Effect.fail(
+          new Error(`failed to read reconciled consumer ${consumerName}`),
+        );
+      }
+
+      yield* session.note(final.consumerArn);
+      return final;
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* kinesis
+        .deregisterStreamConsumer({
+          ConsumerARN: output.consumerArn,
+        })
+        .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void));
+
+      yield* waitForConsumerDeleted(output.consumerArn);
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamEventSource.ts
new file mode 100644
index 00000000000..41491a201b1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamEventSource.ts
@@ -0,0 +1,103 @@
+import type * as Lambda from "@distilled.cloud/aws/lambda";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { Stream as KinesisStream } from "./Stream.ts";
+
+export type KinesisEventRecord = import("aws-lambda").KinesisStreamRecord;
+
+export interface StreamEventSourceProps {
+  /**
+   * The maximum number of records in each batch that Lambda pulls from the stream.
+   * @default 100
+   */
+  batchSize?: number;
+  /**
+   * The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.
+   * @default 0
+   */
+  maximumBatchingWindowInSeconds?: number;
+  /**
+   * The position in the stream from which Lambda starts reading.
+   * @default "LATEST"
+   */
+  startingPosition?: "TRIM_HORIZON" | "LATEST" | "AT_TIMESTAMP";
+  /**
+   * The timestamp to start reading from when `startingPosition` is `AT_TIMESTAMP`.
+   */
+  startingPositionTimestamp?: Date;
+  /**
+   * The number of batches to process from each shard concurrently.
+   * @default 1
+   */
+  parallelizationFactor?: number;
+  /**
+   * Split the batch in two and retry if the function returns an error.
+   * @default false
+   */
+  bisectBatchOnFunctionError?: boolean;
+  /**
+   * Discard records older than the specified age in seconds.
+   * @default -1
+   */
+  maximumRecordAgeInSeconds?: number;
+  /**
+   * Discard records after the specified number of retries.
+   * @default -1
+   */
+  maximumRetryAttempts?: number;
+  /**
+   * The duration in seconds of a processing window for tumbling windows.
+   */
+  tumblingWindowInSeconds?: number;
+  /**
+   * A list of current response type enums applied to the event source mapping.
+   */
+  functionResponseTypes?: "ReportBatchItemFailures"[];
+  /**
+   * A destination for records that failed processing.
+   */
+  destinationConfig?: Lambda.DestinationConfig;
+  /**
+   * Filter criteria to control which records are sent to the function.
+   */
+  filterCriteria?: Lambda.FilterCriteria;
+  /**
+   * The ARN of an AWS KMS key to encrypt the filter criteria.
+   */
+  kmsKeyArn?: string;
+  /**
+   * Metrics configuration for the event source mapping.
+   */
+  metricsConfig?: Lambda.EventSourceMappingMetricsConfig;
+}
+
+export class StreamEventSource extends Binding.Service<
+  StreamEventSource,
+  StreamEventSourceService
+>()("AWS.Kinesis.StreamEventSource") {}
+
+export type StreamEventSourceService = <StreamReq = never, Req = never>(
+  stream: KinesisStream,
+  props: StreamEventSourceProps,
+  process: (
+    stream: Stream.Stream<KinesisEventRecord, never, StreamReq>,
+  ) => Effect.Effect<void, never, Req>,
+) => Effect.Effect<void, never, never>;
+
+/**
+ * Subscribe a runtime to records from a Kinesis stream.
+ *
+ * The Lambda runtime implementation creates an event source mapping and forwards
+ * matching `aws:kinesis` records into the supplied `Stream`.
+ */
+export const records = <S extends KinesisStream>(
+  stream: S,
+  props: StreamEventSourceProps = {},
+) => ({
+  process: <Req = never, StreamReq = never>(
+    process: (
+      stream: Stream.Stream<KinesisEventRecord, never, StreamReq>,
+    ) => Effect.Effect<void, never, Req>,
+  ) => StreamEventSource.use((source) => source(stream, props, process)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamSink.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamSink.ts
new file mode 100644
index 00000000000..e37134ef799
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/StreamSink.ts
@@ -0,0 +1,68 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Sink from "effect/Sink";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { PutRecords } from "./PutRecords.ts";
+import type { Stream } from "./Stream.ts";
+
+export type StreamSinkRecord = Kinesis.PutRecordsRequestEntry;
+
+export class StreamSink extends Binding.Service<
+  StreamSink,
+  (
+    stream: Stream,
+  ) => Effect.Effect<
+    Sink.Sink<void, StreamSinkRecord, readonly StreamSinkRecord[], never>
+  >
+>()("AWS.Kinesis.StreamSink") {}
+
+/**
+ * A partition-aware sink for batching `PutRecords` requests into a stream.
+ *
+ * Each input element is a raw `PutRecordsRequestEntry`, so callers stay in
+ * control of `PartitionKey` and optional `ExplicitHashKey`.
+ */
+export const StreamSinkLive = Layer.effect(
+  StreamSink,
+  Effect.gen(function* () {
+    const Policy = yield* StreamSinkPolicy;
+    const putRecords = yield* PutRecords;
+
+    return Effect.fn(function* (stream: Stream) {
+      yield* Policy(stream);
+      const publish = yield* putRecords(stream);
+      return Sink.forEachArray((records: readonly StreamSinkRecord[]) =>
+        publish({
+          Records: [...records],
+        }).pipe(Effect.orDie, Effect.asVoid),
+      );
+    });
+  }),
+);
+
+export class StreamSinkPolicy extends Binding.Policy<
+  StreamSinkPolicy,
+  (stream: Stream) => Effect.Effect<void>
+>()("AWS.Kinesis.StreamSink") {}
+
+export const StreamSinkPolicyLive = StreamSinkPolicy.layer.succeed(
+  Effect.fn(function* (host, stream) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.StreamSink(${stream}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["kinesis:PutRecords"],
+            Resource: [stream.streamArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `StreamSinkPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/SubscribeToShard.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/SubscribeToShard.ts
new file mode 100644
index 00000000000..1d192b62a5f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/SubscribeToShard.ts
@@ -0,0 +1,71 @@
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { StreamConsumer } from "./StreamConsumer.ts";
+
+export interface SubscribeToShardRequest extends Omit<
+  Kinesis.SubscribeToShardInput,
+  "ConsumerARN"
+> {}
+
+export class SubscribeToShard extends Binding.Service<
+  SubscribeToShard,
+  (
+    consumer: StreamConsumer,
+  ) => Effect.Effect<
+    (
+      request: SubscribeToShardRequest,
+    ) => Effect.Effect<
+      Kinesis.SubscribeToShardOutput,
+      Kinesis.SubscribeToShardError
+    >
+  >
+>()("AWS.Kinesis.SubscribeToShard") {}
+
+export const SubscribeToShardLive = Layer.effect(
+  SubscribeToShard,
+  Effect.gen(function* () {
+    const Policy = yield* SubscribeToShardPolicy;
+    const subscribeToShard = yield* Kinesis.subscribeToShard;
+
+    return Effect.fn(function* (consumer: StreamConsumer) {
+      const ConsumerARN = yield* consumer.consumerArn;
+      yield* Policy(consumer);
+      return Effect.fn(function* (request: SubscribeToShardRequest) {
+        return yield* subscribeToShard({
+          ...request,
+          ConsumerARN: yield* ConsumerARN,
+        });
+      });
+    });
+  }),
+);
+
+export class SubscribeToShardPolicy extends Binding.Policy<
+  SubscribeToShardPolicy,
+  (consumer: StreamConsumer) => Effect.Effect<void>
+>()("AWS.Kinesis.SubscribeToShard") {}
+
+export const SubscribeToShardPolicyLive = SubscribeToShardPolicy.layer.succeed(
+  Effect.fn(function* (host, consumer) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Kinesis.SubscribeToShard(${consumer}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["kinesis:SubscribeToShard"],
+              Resource: [consumer.consumerArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `SubscribeToShardPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/index.ts
new file mode 100644
index 00000000000..b877a4fec3d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Kinesis/index.ts
@@ -0,0 +1,19 @@
+export * from "./DescribeAccountSettings.ts";
+export * from "./DescribeLimits.ts";
+export * from "./DescribeStream.ts";
+export * from "./DescribeStreamConsumer.ts";
+export * from "./DescribeStreamSummary.ts";
+export * from "./GetRecords.ts";
+export * from "./GetResourcePolicy.ts";
+export * from "./GetShardIterator.ts";
+export * from "./ListShards.ts";
+export * from "./ListStreamConsumers.ts";
+export * from "./ListStreams.ts";
+export * from "./ListTagsForResource.ts";
+export * from "./PutRecord.ts";
+export * from "./PutRecords.ts";
+export * from "./Stream.ts";
+export * from "./StreamConsumer.ts";
+export * from "./StreamEventSource.ts";
+export * from "./StreamSink.ts";
+export * from "./SubscribeToShard.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/BucketEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/BucketEventSource.ts
new file mode 100644
index 00000000000..1b4187a5db1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/BucketEventSource.ts
@@ -0,0 +1,146 @@
+import type lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import * as Binding from "../../Binding.ts";
+import type { Bucket } from "../S3/Bucket.ts";
+import {
+  BucketEventSource as S3BucketEventSource,
+  type BucketEventSourceService,
+} from "../S3/BucketEventSource.ts";
+import type {
+  BucketNotification,
+  NotificationsProps,
+} from "../S3/BucketNotifications.ts";
+import type { S3EventType } from "../S3/S3Event.ts";
+import * as Lambda from "./Function.ts";
+import { Permission as LambdaPermission } from "./Permission.ts";
+
+/**
+ * Connects an S3 bucket notification stream to the current Lambda function.
+ *
+ * This layer listens for bucket notifications routed through the Lambda runtime
+ * and exposes them as an `Effect.Stream`, while the companion policy configures
+ * the invoke permission and bucket notification binding during deployment.
+ *
+ * @section Wiring Events
+ * @example Listen for Object Created Events
+ * ```typescript
+ * yield* BucketEventSource.bind(
+ *   bucket,
+ *   { events: ["s3:ObjectCreated:*"] },
+ *   (events) => Stream.runForEach(events, (event) => Effect.log(event.key)),
+ * );
+ * ```
+ */
+export const BucketEventSource = Layer.effect(
+  S3BucketEventSource,
+  Effect.gen(function* () {
+    // this layer can only be used in a Lambda Function
+    const func = yield* Lambda.Function;
+
+    const bind = yield* BucketEventSourcePolicy;
+
+    return Effect.fn(function* <
+      Events extends S3EventType[],
+      StreamReq = never,
+      Req = never,
+    >(
+      bucket: Bucket,
+      props: NotificationsProps<Events>,
+      process: (
+        stream: Stream.Stream<BucketNotification, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) {
+      // this adds it to the Lambda Function's environment variables
+      const BucketName = yield* bucket.bucketName;
+
+      yield* bind(bucket, props);
+
+      yield* func.listen(
+        Effect.gen(function* () {
+          // this accesses it
+          const bucketName = yield* BucketName;
+          return (event: any) => {
+            if (isS3Event(event)) {
+              const events = event.Records.filter(
+                (record) => record.s3.bucket.name === bucketName,
+              );
+              if (events.length > 0) {
+                return process(
+                  Stream.fromArray(
+                    events.map((record: lambda.S3EventRecord) => ({
+                      type: record.eventName as S3EventType,
+                      bucket: record.s3.bucket.name,
+                      key: record.s3.object.key,
+                      size: record.s3.object.size,
+                      eTag: record.s3.object.eTag,
+                    })),
+                  ),
+                  // TODO(sam): don't die?
+                ).pipe(Effect.orDie);
+              }
+            }
+          };
+        }),
+      );
+    }) as BucketEventSourceService;
+  }),
+);
+
+const isS3Event = (event: any): event is lambda.S3Event =>
+  Array.isArray(event.Records) &&
+  event.Records.some((record: any) => record.s3);
+
+/**
+ * Deploy-time policy for attaching an S3 bucket as a Lambda event source.
+ */
+export class BucketEventSourcePolicy extends Binding.Policy<
+  BucketEventSourcePolicy,
+  (
+    bucket: Bucket,
+    props?: NotificationsProps<S3EventType[]>,
+  ) => Effect.Effect<void>
+>()("AWS.S3.BucketEventSource") {}
+
+export const BucketEventSourcePolicyLive = BucketEventSourcePolicy.layer.effect(
+  Effect.gen(function* () {
+    const Permission = yield* LambdaPermission;
+
+    return Effect.fn(function* (
+      host,
+      bucket: Bucket,
+      {
+        events: Events = ["s3:ObjectCreated:*"],
+      }: {
+        events?: S3EventType[];
+      } = {},
+    ) {
+      if (Lambda.isFunction(host)) {
+        yield* Permission(`AWS.Lambda.InvokeFunction(${bucket.LogicalId})`, {
+          action: "lambda.InvokeFunction",
+          functionName: host.functionName,
+          principal: "s3.amazonaws.com",
+          sourceArn: bucket.bucketArn,
+        });
+        yield* bucket.bind(`AWS.S3.Notifications(${bucket.LogicalId})`, {
+          notificationConfiguration: {
+            LambdaFunctionConfigurations: [
+              {
+                LambdaFunctionArn: host.functionArn,
+                Events,
+              },
+            ],
+          },
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `BucketEventSourcePolicy does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/EventBridgeEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/EventBridgeEventSource.ts
new file mode 100644
index 00000000000..eaaf1b76b43
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/EventBridgeEventSource.ts
@@ -0,0 +1,183 @@
+import type * as lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import {
+  EventSource as EventBridgeEventSource,
+  matchesEventPattern,
+  type EventPattern,
+  type EventRecord,
+  type EventRouteProps,
+  type EventSourceService,
+} from "../EventBridge/EventSource.ts";
+import { toLambda as createLambdaRoute } from "../EventBridge/ToLambda.ts";
+import * as Lambda from "./Function.ts";
+
+/**
+ * Narrow an arbitrary Lambda invocation payload to an EventBridge event.
+ */
+export const isEventBridgeEvent = (
+  event: any,
+): event is lambda.EventBridgeEvent<string, any> =>
+  typeof event?.source === "string" &&
+  typeof event?.["detail-type"] === "string";
+
+/**
+ * Lambda runtime implementation for `AWS.EventBridge.events(...).subscribe(...)`.
+ *
+ * This layer does two things:
+ *
+ * 1. It delegates to `EventSourcePolicy` so deployment creates an EventBridge
+ *    rule targeting the current Lambda function.
+ * 2. At runtime it filters incoming Lambda events against the original event
+ *    pattern and forwards matching events into the supplied `Stream`.
+ *
+ * @section Subscribing To The Default Bus
+ * @example Match User Events On The Default Bus
+ * ```typescript
+ * yield* AWS.EventBridge
+ *   .events({
+ *     source: ["app.user"],
+ *     "detail-type": ["UserCreated"],
+ *   })
+ *   .subscribe((events) =>
+ *     Stream.runForEach(events, (event) =>
+ *       Effect.log(`new user: ${event.detail.userId}`),
+ *     ),
+ *   );
+ * ```
+ *
+ * @section Subscribing To A Custom Bus
+ * @example Match Orders On A Named Bus
+ * ```typescript
+ * const bus = yield* AWS.EventBridge.EventBus("OrdersBus", {
+ *   name: "orders",
+ * });
+ *
+ * yield* AWS.EventBridge
+ *   .events(bus, {
+ *     source: ["app.orders"],
+ *     "detail-type": ["OrderPaid"],
+ *   })
+ *   .subscribe((events) =>
+ *     Stream.runForEach(events, (event) =>
+ *       Effect.log(`paid order: ${event.detail.orderId}`),
+ *     ),
+ *   );
+ * ```
+ *
+ * @section Explicit Route Names
+ * @example Name The Backing Rule Deterministically
+ * ```typescript
+ * yield* AWS.EventBridge
+ *   .events(
+ *     "InvoiceEvents",
+ *     {
+ *       source: ["app.billing"],
+ *       "detail-type": ["InvoiceIssued"],
+ *     },
+ *     {
+ *       description: "Deliver invoice events into this Lambda function",
+ *     },
+ *   )
+ *   .subscribe((events) =>
+ *     Stream.runForEach(events, (event) =>
+ *       Effect.log(`invoice: ${event.detail.invoiceId}`),
+ *     ),
+ *   );
+ * ```
+ *
+ * @section Processing Typed Details
+ * @example Narrow The Event Detail Payload
+ * ```typescript
+ * type UserCreated = {
+ *   userId: string;
+ *   email: string;
+ * };
+ *
+ * yield* AWS.EventBridge
+ *   .events({
+ *     source: ["app.user"],
+ *     "detail-type": ["UserCreated"],
+ *   })
+ *   .subscribe((events) =>
+ *     Stream.runForEach(
+ *       events as Stream.Stream<AWS.EventBridge.EventRecord<UserCreated>>,
+ *       (event) => Effect.log(`welcome ${event.detail.email}`),
+ *     ),
+ *   );
+ * ```
+ */
+export const EventSource = Layer.effect(
+  EventBridgeEventSource,
+  Effect.gen(function* () {
+    const host = yield* Lambda.Function;
+    const bind = yield* EventSourcePolicy;
+
+    return Effect.fn(function* <
+      Detail = unknown,
+      StreamReq = never,
+      Req = never,
+    >(
+      descriptor: {
+        id?: string;
+        bus?: any;
+        pattern: EventPattern;
+        props?: EventRouteProps;
+      },
+      process: (
+        events: Stream.Stream<EventRecord<Detail>, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) {
+      yield* bind(descriptor);
+
+      yield* host.listen(
+        Effect.sync(() => (event: any) => {
+          if (
+            isEventBridgeEvent(event) &&
+            matchesEventPattern(descriptor.pattern, event)
+          ) {
+            return process(Stream.succeed(event as EventRecord<Detail>)).pipe(
+              Effect.orDie,
+            );
+          }
+        }),
+      );
+    }) as EventSourceService;
+  }),
+);
+
+/**
+ * Deploy-time policy/service bridge for EventBridge subscriptions.
+ *
+ * Runtime-specific implementations use this to materialize the infrastructure
+ * wiring required by `events(...).subscribe(...)`.
+ */
+export class EventSourcePolicy extends Binding.Policy<
+  EventSourcePolicy,
+  (
+    descriptor: Parameters<EventSourceService>[0],
+  ) => Effect.Effect<void, never, any>
+>()("AWS.EventBridge.EventSource") {}
+
+/**
+ * Lambda-specific EventBridge subscription wiring.
+ *
+ * Subscribing a Lambda function to an EventBridge pattern creates a backing
+ * rule with `toLambda(host)` so the function can receive matching events
+ * without manual rule/permission setup.
+ */
+export const EventSourcePolicyLive = EventSourcePolicy.layer.succeed(
+  Effect.fn(function* (host, descriptor) {
+    if (Lambda.isFunction(host)) {
+      yield* createLambdaRoute(descriptor, host).pipe(Effect.asVoid);
+    } else {
+      return yield* Effect.die(
+        new Error(
+          `EventBridge EventSource does not support runtime '${host.Type}'`,
+        ),
+      );
+    }
+  }) as any,
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/EventSourceMapping.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/EventSourceMapping.ts
new file mode 100644
index 00000000000..428439b7a97
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/EventSourceMapping.ts
@@ -0,0 +1,497 @@
+import * as lambda from "@distilled.cloud/aws/lambda";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
+import { AWSEnvironment } from "../Environment.ts";
+
+export type StartingPosition = "TRIM_HORIZON" | "LATEST" | "AT_TIMESTAMP";
+
+export type FunctionResponseType = "ReportBatchItemFailures";
+
+export interface EventSourceMappingProps {
+  /**
+   * The name or ARN of the Lambda function to invoke.
+   */
+  functionName: string;
+  /**
+   * The ARN of the event source (SQS queue, Kinesis stream, DynamoDB stream, etc.).
+   */
+  eventSourceArn: string;
+  /**
+   * The maximum number of records in each batch that Lambda pulls and sends to the function.
+   *
+   * - SQS: default 10, max 10,000 (FIFO max 10)
+   * - Kinesis: default 100, max 10,000
+   * - DynamoDB Streams: default 100, max 10,000
+   */
+  batchSize?: number;
+  /**
+   * The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.
+   * @default 0
+   */
+  maximumBatchingWindowInSeconds?: number;
+  /**
+   * Whether the event source mapping is active.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * The position in a stream from which to start reading. Required for Kinesis and DynamoDB Streams.
+   *
+   * - `LATEST` - Read only new records.
+   * - `TRIM_HORIZON` - Process all available records.
+   * - `AT_TIMESTAMP` - Start reading from a specific time.
+   */
+  startingPosition?: StartingPosition;
+  /**
+   * The timestamp to start reading from when `startingPosition` is `AT_TIMESTAMP`.
+   */
+  startingPositionTimestamp?: Date;
+  /**
+   * (Kinesis and DynamoDB Streams) The number of batches to process from each shard concurrently.
+   * @default 1
+   */
+  parallelizationFactor?: number;
+  /**
+   * (Kinesis and DynamoDB Streams) Split the batch in two and retry if the function returns an error.
+   * @default false
+   */
+  bisectBatchOnFunctionError?: boolean;
+  /**
+   * (Kinesis and DynamoDB Streams) Discard records older than the specified age in seconds.
+   * @default -1 (infinite)
+   */
+  maximumRecordAgeInSeconds?: number;
+  /**
+   * (Kinesis and DynamoDB Streams) Discard records after the specified number of retries.
+   * @default -1 (infinite)
+   */
+  maximumRetryAttempts?: number;
+  /**
+   * (Kinesis and DynamoDB Streams) The duration in seconds of a processing window for tumbling windows.
+   */
+  tumblingWindowInSeconds?: number;
+  /**
+   * A list of current response type enums applied to the event source mapping.
+   * @default ["ReportBatchItemFailures"]
+   */
+  functionResponseTypes?: FunctionResponseType[];
+  /**
+   * (SQS) Scaling configuration for the event source.
+   */
+  scalingConfig?: lambda.ScalingConfig;
+  /**
+   * (Kinesis and DynamoDB Streams) A destination for records that failed processing.
+   */
+  destinationConfig?: lambda.DestinationConfig;
+  /**
+   * Filter criteria to control which records are sent to the function.
+   */
+  filterCriteria?: lambda.FilterCriteria;
+  /**
+   * The ARN of an AWS KMS key to encrypt the filter criteria.
+   */
+  kmsKeyArn?: string;
+  /**
+   * Metrics configuration for the event source mapping.
+   * @default { Metrics: ["EventCount"] }
+   */
+  metricsConfig?: lambda.EventSourceMappingMetricsConfig;
+  /**
+   * (SQS, MSK, self-managed Kafka) Provisioned poller configuration.
+   */
+  provisionedPollerConfig?: lambda.ProvisionedPollerConfig;
+  /**
+   * (Amazon MSK) Configuration for an Amazon Managed Streaming for Apache Kafka event source.
+   */
+  amazonManagedKafkaEventSourceConfig?: lambda.AmazonManagedKafkaEventSourceConfig;
+  /**
+   * (Self-managed Kafka) Configuration for a self-managed Apache Kafka event source.
+   */
+  selfManagedKafkaEventSourceConfig?: lambda.SelfManagedKafkaEventSourceConfig;
+  /**
+   * (Self-managed Kafka) The self-managed Apache Kafka cluster for the event source.
+   */
+  selfManagedEventSource?: lambda.SelfManagedEventSource;
+  /**
+   * (Amazon MQ, MSK, self-managed Kafka) Source access configuration for VPC, authentication, etc.
+   */
+  sourceAccessConfigurations?: lambda.SourceAccessConfiguration[];
+  /**
+   * (Amazon MSK, self-managed Kafka) The Kafka topic name(s).
+   */
+  topics?: string[];
+  /**
+   * (Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
+   */
+  queues?: string[];
+  /**
+   * (Amazon DocumentDB) Configuration for a DocumentDB event source.
+   */
+  documentDBEventSourceConfig?: lambda.DocumentDBEventSourceConfig;
+  /**
+   * (Amazon MSK and self-managed Apache Kafka) The logging configuration for the event source.
+   */
+  loggingConfig?: lambda.LoggingConfig;
+  /**
+   * Tags to associate with the event source mapping.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface EventSourceMapping extends Resource<
+  "AWS.Lambda.EventSourceMapping",
+  EventSourceMappingProps,
+  {
+    /**
+     * The UUID of the event source mapping.
+     */
+    uuid: string;
+    /**
+     * The ARN of the event source mapping.
+     */
+    eventSourceMappingArn: string;
+    /**
+     * The ARN of the Lambda function.
+     */
+    functionArn: string;
+    /**
+     * The current state of the event source mapping.
+     */
+    state: string;
+  },
+  never,
+  Providers
+> {}
+
+export const EventSourceMapping = Resource<EventSourceMapping>(
+  "AWS.Lambda.EventSourceMapping",
+);
+
+export const EventSourceMappingProvider = () =>
+  Provider.effect(
+    EventSourceMapping,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const createEventSourceMappingTags = Effect.fn(function* (id: string) {
+        const internalTags = yield* createInternalTags(id);
+        return {
+          ...internalTags,
+          "alchemy::id": sanitizeAwsTagValue(internalTags["alchemy::id"]),
+        };
+      });
+
+      const toCreateRequest = (
+        props: EventSourceMappingProps,
+        tags: Record<string, string>,
+      ): lambda.CreateEventSourceMappingRequest => ({
+        FunctionName: props.functionName as string,
+        EventSourceArn: props.eventSourceArn as string,
+        Enabled: props.enabled ?? true,
+        BatchSize: props.batchSize,
+        MaximumBatchingWindowInSeconds: props.maximumBatchingWindowInSeconds,
+        StartingPosition: props.startingPosition,
+        StartingPositionTimestamp: props.startingPositionTimestamp,
+        ParallelizationFactor: props.parallelizationFactor,
+        BisectBatchOnFunctionError: props.bisectBatchOnFunctionError,
+        MaximumRecordAgeInSeconds: props.maximumRecordAgeInSeconds,
+        MaximumRetryAttempts: props.maximumRetryAttempts,
+        TumblingWindowInSeconds: props.tumblingWindowInSeconds,
+        FunctionResponseTypes: props.functionResponseTypes ?? [
+          "ReportBatchItemFailures",
+        ],
+        ScalingConfig: props.scalingConfig,
+        DestinationConfig: props.destinationConfig,
+        FilterCriteria: props.filterCriteria,
+        KMSKeyArn: props.kmsKeyArn,
+        MetricsConfig: props.metricsConfig ?? { Metrics: ["EventCount"] },
+        ProvisionedPollerConfig: props.provisionedPollerConfig,
+        AmazonManagedKafkaEventSourceConfig:
+          props.amazonManagedKafkaEventSourceConfig,
+        SelfManagedKafkaEventSourceConfig:
+          props.selfManagedKafkaEventSourceConfig,
+        SelfManagedEventSource: props.selfManagedEventSource,
+        SourceAccessConfigurations: props.sourceAccessConfigurations,
+        Topics: props.topics,
+        Queues: props.queues,
+        DocumentDBEventSourceConfig: props.documentDBEventSourceConfig,
+        LoggingConfig: props.loggingConfig,
+        Tags: tags,
+      });
+
+      const toUpdateRequest = (
+        uuid: string,
+        props: EventSourceMappingProps,
+      ): lambda.UpdateEventSourceMappingRequest => ({
+        UUID: uuid,
+        FunctionName: props.functionName as string,
+        Enabled: props.enabled ?? true,
+        BatchSize: props.batchSize,
+        MaximumBatchingWindowInSeconds: props.maximumBatchingWindowInSeconds,
+        BisectBatchOnFunctionError: props.bisectBatchOnFunctionError,
+        MaximumRecordAgeInSeconds: props.maximumRecordAgeInSeconds,
+        MaximumRetryAttempts: props.maximumRetryAttempts,
+        TumblingWindowInSeconds: props.tumblingWindowInSeconds,
+        FunctionResponseTypes: props.functionResponseTypes ?? [
+          "ReportBatchItemFailures",
+        ],
+        ScalingConfig: props.scalingConfig,
+        DestinationConfig: props.destinationConfig,
+        FilterCriteria: props.filterCriteria,
+        KMSKeyArn: props.kmsKeyArn,
+        MetricsConfig: props.metricsConfig ?? { Metrics: ["EventCount"] },
+        ProvisionedPollerConfig: props.provisionedPollerConfig,
+        AmazonManagedKafkaEventSourceConfig:
+          props.amazonManagedKafkaEventSourceConfig,
+        SelfManagedKafkaEventSourceConfig:
+          props.selfManagedKafkaEventSourceConfig,
+        SourceAccessConfigurations: props.sourceAccessConfigurations,
+        DocumentDBEventSourceConfig: props.documentDBEventSourceConfig,
+        LoggingConfig: props.loggingConfig,
+      });
+
+      const configToAttrs = (
+        config: lambda.EventSourceMappingConfiguration,
+      ): EventSourceMapping["Attributes"] => ({
+        uuid: config.UUID!,
+        eventSourceMappingArn: config.EventSourceMappingArn!,
+        functionArn: config.FunctionArn!,
+        state: config.State!,
+      });
+
+      return {
+        stables: ["uuid", "eventSourceMappingArn"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          if (
+            (news.eventSourceArn as string) !== (olds.eventSourceArn as string)
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (news.startingPosition !== olds.startingPosition) {
+            return { action: "replace" } as const;
+          }
+          if (
+            news.startingPositionTimestamp?.getTime() !==
+            olds.startingPositionTimestamp?.getTime()
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            !deepEqual(news.selfManagedEventSource, olds.selfManagedEventSource)
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const expectedInternalTags = yield* createEventSourceMappingTags(id);
+          const desiredTags = { ...expectedInternalTags, ...news.tags };
+
+          const functionName = news.functionName as string;
+          const eventSourceArn = news.eventSourceArn as string;
+
+          // Observe — find the existing mapping. UUIDs are server-assigned
+          // so we either trust `output.uuid` (fast path) or scan
+          // `listEventSourceMappings` and confirm ownership via tags
+          // (recovery from a state-persistence failure or adoption).
+          let config: lambda.EventSourceMappingConfiguration | undefined;
+          if (output?.uuid) {
+            config = yield* lambda
+              .getEventSourceMapping({ UUID: output.uuid })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+          }
+          if (!config?.UUID) {
+            config = yield* lambda.listEventSourceMappings
+              .pages({ FunctionName: functionName })
+              .pipe(
+                Stream.mapEffect(
+                  Effect.fn(function* (page) {
+                    const mapping = page.EventSourceMappings?.find(
+                      (m) => m.EventSourceArn === eventSourceArn,
+                    );
+                    if (mapping?.UUID) {
+                      const { Tags } = yield* lambda
+                        .listTags({
+                          Resource: `arn:aws:lambda:${region}:${accountId}:event-source-mapping:${mapping.UUID}`,
+                        })
+                        .pipe(retryTransient);
+                      if (hasTags(expectedInternalTags, Tags)) {
+                        return mapping;
+                      }
+                    }
+                  }),
+                ),
+                Stream.filter((item) => item !== undefined),
+                Stream.runHead,
+                Effect.map(Option.getOrUndefined),
+              );
+          }
+
+          // Ensure — create if no live mapping exists. Tolerate
+          // `ResourceConflictException` (peer reconciler raced ahead) by
+          // re-scanning to find the mapping by tag ownership.
+          if (!config?.UUID) {
+            config = yield* lambda
+              .createEventSourceMapping(toCreateRequest(news, desiredTags))
+              .pipe(
+                Effect.catchTags({
+                  ResourceConflictException: () =>
+                    lambda.listEventSourceMappings
+                      .pages({ FunctionName: functionName })
+                      .pipe(
+                        Stream.mapEffect(
+                          Effect.fn(function* (page) {
+                            const mapping = page.EventSourceMappings?.find(
+                              (m) => m.EventSourceArn === eventSourceArn,
+                            );
+                            if (mapping?.UUID) {
+                              const { Tags } = yield* lambda
+                                .listTags({
+                                  Resource: `arn:aws:lambda:${region}:${accountId}:event-source-mapping:${mapping.UUID}`,
+                                })
+                                .pipe(retryTransient);
+                              if (hasTags(expectedInternalTags, Tags)) {
+                                return mapping;
+                              }
+                            }
+                          }),
+                        ),
+                        Stream.filter((item) => item !== undefined),
+                        Stream.runHead,
+                        Effect.map(Option.getOrUndefined),
+                        Effect.flatMap((mapping) =>
+                          mapping
+                            ? Effect.succeed(mapping)
+                            : Effect.die(
+                                new Error(
+                                  `EventSourceMapping(${id}) not found on function ${functionName}`,
+                                ),
+                              ),
+                        ),
+                      ),
+                }),
+                retryPermissionsPropagation,
+                retryTransient,
+              );
+          }
+
+          if (!config?.UUID) {
+            return yield* Effect.die(
+              new Error(`EventSourceMapping(${id}) could not be reconciled`),
+            );
+          }
+
+          const uuid = config.UUID;
+          const mappingArn = `arn:aws:lambda:${region}:${accountId}:event-source-mapping:${uuid}`;
+
+          // Sync configuration — `updateEventSourceMapping` is a full PUT
+          // for mutable fields. We always send the full desired config so
+          // observed state converges. Retry `ResourceInUseException`
+          // (mapping is transitioning) and known IAM-propagation errors.
+          config = yield* lambda
+            .updateEventSourceMapping(toUpdateRequest(uuid, news))
+            .pipe(
+              Effect.retry({
+                while: (e: any) =>
+                  e._tag === "ResourceInUseException" ||
+                  e._tag === "ResourceConflictException",
+                schedule: Schedule.exponential(100).pipe(
+                  Schedule.both(Schedule.recurs(20)),
+                ),
+              }),
+              retryPermissionsPropagation,
+              retryTransient,
+            );
+
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption rewrites ownership tags correctly.
+          const observedTagsResp = yield* lambda
+            .listTags({ Resource: mappingArn })
+            .pipe(retryTransient);
+          const observedTags: Record<string, string> = Object.fromEntries(
+            Object.entries(observedTagsResp.Tags ?? {}).filter(
+              (entry): entry is [string, string] =>
+                typeof entry[1] === "string",
+            ),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (removed.length > 0) {
+            yield* lambda
+              .untagResource({ Resource: mappingArn, TagKeys: removed })
+              .pipe(retryTransient);
+          }
+          if (upsert.length > 0) {
+            const tagsToAdd: Record<string, string> = {};
+            for (const { Key, Value } of upsert) {
+              tagsToAdd[Key] = Value;
+            }
+            yield* lambda
+              .tagResource({ Resource: mappingArn, Tags: tagsToAdd })
+              .pipe(retryTransient);
+          }
+
+          yield* session.note(config.EventSourceMappingArn ?? uuid);
+
+          return configToAttrs(config);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* lambda.deleteEventSourceMapping({ UUID: output.uuid }).pipe(
+            Effect.retry({
+              while: (e: any) =>
+                e._tag === "ResourceInUseException" ||
+                e._tag === "ResourceConflictException",
+              schedule: Schedule.exponential(100).pipe(
+                Schedule.both(Schedule.recurs(20)),
+              ),
+            }),
+            Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+          );
+        }),
+      };
+    }),
+  );
+
+const retryTransient: <A, R, Err>(
+  self: Effect.Effect<A, Err, R>,
+) => Effect.Effect<A, Err, R> = Effect.retry({
+  while: (e: any) =>
+    e._tag === "InternalFailure" ||
+    e._tag === "RequestExpired" ||
+    e._tag === "ServiceException" ||
+    e._tag === "ServiceUnavailable" ||
+    e._tag === "ThrottlingException" ||
+    e._tag === "TooManyRequestsException" ||
+    e._tag === "RequestLimitExceeded" ||
+    e._tag === "ResourceInUseException",
+  schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(30))),
+});
+
+const retryPermissionsPropagation = Effect.retry({
+  while: (e: any) =>
+    e._tag === "InvalidParameterValueException" &&
+    (e.message?.includes(
+      "The function execution role does not have permissions to call",
+    ) ||
+      e.message?.includes("cannot be assumed by Lambda") ||
+      e.message?.includes("Please add Lambda as a Trusted Entity") ||
+      e.message?.includes("Cannot access stream") ||
+      e.message?.includes("Please ensure the role can perform the GetRecords")),
+  schedule: Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(30))),
+}) as <A, R, Err>(self: Effect.Effect<A, Err, R>) => Effect.Effect<A, Err, R>;
+
+const sanitizeAwsTagValue = (value: string) =>
+  value.replace(/[^\p{L}\p{Z}\p{N}_.:/=+\-@]/gu, "-");
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/Function.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/Function.ts
new file mode 100644
index 00000000000..e1b39937003
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/Function.ts
@@ -0,0 +1,1451 @@
+import * as logs from "@distilled.cloud/aws/cloudwatch-logs";
+import type { Credentials } from "@distilled.cloud/aws/Credentials";
+import * as iam from "@distilled.cloud/aws/iam";
+import type { CreateFunctionRequest } from "@distilled.cloud/aws/lambda";
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import { Region } from "@distilled.cloud/aws/Region";
+import type * as lambda from "aws-lambda";
+import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import type * as rolldown from "rolldown";
+import { Unowned } from "../../AdoptPolicy.ts";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import * as TempRoot from "../../Bundle/TempRoot.ts";
+import { isResolved } from "../../Diff.ts";
+import type { HttpEffect } from "../../Http.ts";
+import * as Output from "../../Output.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
+import type { LogLine, LogsInput } from "../../Provider.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { Self } from "../../Self.ts";
+import * as Serverless from "../../Serverless/index.ts";
+import { Stack } from "../../Stack.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  hasAlchemyTags,
+  hasTags,
+} from "../../Tags.ts";
+import { sha256 } from "../../Util/sha256.ts";
+import { zipCode } from "../../Util/zip.ts";
+import { Assets } from "../Assets.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import * as IAM from "../IAM/index.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
+import { makeFunctionHttpHandler } from "./HttpServer.ts";
+
+export const FunctionTypeId = "AWS.Lambda.Function" as const;
+export type FunctionTypeId = typeof FunctionTypeId;
+
+export class HandlerContext extends Context.Service<
+  HandlerContext,
+  lambda.Context
+>()("AWS.Lambda.HandlerContext") {}
+
+export const isFunction = (value: any): value is Function => {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "Type" in value &&
+    value.Type === "AWS.Lambda.Function"
+  );
+};
+
+export interface FunctionBuildOptions {
+  readonly input?: Partial<rolldown.InputOptions>;
+  readonly output?: Partial<rolldown.OutputOptions>;
+}
+
+export interface FunctionProps extends PlatformProps {
+  /**
+   * Entry module for the bundled Lambda function.
+   */
+  main: string;
+  /**
+   * Exported handler symbol inside the bundled module.
+   * @default "handler"
+   */
+  handler?: string;
+  /**
+   * Whether to create a public Lambda function URL.
+   * @default false
+   */
+  url?: boolean;
+  functionName?: string;
+  // TODO(sam): use a Layer instead so we can manage Effect platform?
+  runtime?: "nodejs22.x" | "nodejs24.x";
+  build?: FunctionBuildOptions;
+  uploadSourceMap?: boolean;
+  env?: Record<string, any>;
+  exports?: string[];
+  /**
+   * Attach the function to a VPC for private AWS connectivity such as Aurora.
+   */
+  vpc?: {
+    subnetIds: string[];
+    securityGroupIds: string[];
+  };
+  /**
+   * Maximum execution time before the function is forcibly terminated.
+   * Rounded up to whole seconds.
+   *
+   * @default 3 seconds (AWS Lambda default)
+   */
+  timeout?: Duration.Duration;
+}
+
+/**
+ * Normalize a {@link FunctionProps.timeout} to whole seconds.
+ *
+ * State JSON round-trips flatten a `Duration` to its `toJSON` shape
+ * (`{_id:"Duration",_tag:"Millis"|"Nanos"|"Infinity",...}`), which is not a
+ * valid `Duration.Input`. Reconstruct an input that `Duration.toSeconds`
+ * accepts before delegating.
+ */
+export const toTimeoutSeconds = (
+  timeout: Duration.Duration | undefined,
+): number | undefined => {
+  if (timeout === undefined) return undefined;
+  const json = timeout as {
+    _id?: unknown;
+    _tag?: "Millis" | "Nanos" | "Infinity" | "NegativeInfinity";
+    millis?: number;
+    nanos?: string;
+  };
+  const input: Duration.Input =
+    json._id === "Duration"
+      ? json._tag === "Millis"
+        ? json.millis!
+        : json._tag === "Nanos"
+          ? BigInt(json.nanos!)
+          : "Infinity"
+      : timeout;
+  const seconds = Duration.toSeconds(input);
+  return Number.isFinite(seconds) ? Math.max(1, Math.ceil(seconds)) : undefined;
+};
+
+export interface Function extends Resource<
+  FunctionTypeId,
+  FunctionProps,
+  {
+    functionArn: string;
+    functionName: string;
+    functionUrl: string | undefined;
+    roleName: string;
+    roleArn: string;
+    code: {
+      hash: string;
+    };
+  },
+  {
+    env?: Record<string, any>;
+    policyStatements?: PolicyStatement[];
+  },
+  Providers
+> {}
+
+export type FunctionServices = Credentials | Region;
+
+export type FunctionShape = Main<FunctionServices>;
+
+/**
+ * An AWS Lambda host resource that combines code bundling, IAM role
+ * provisioning, and runtime binding collection.
+ *
+ * `Function` is the canonical runtime host for AWS. Alchemy automatically
+ * bundles your TypeScript entry module with Rolldown, creates an IAM
+ * execution role, and uploads the zip artifact. On subsequent deploys, the
+ * function is only updated when the bundle hash changes.
+ *
+ * There are two ways to define a Lambda Function:
+ *
+ * - **Async** — plain handler export, no Effect runtime in the bundle.
+ * - **Effect** — Effect implementation with typed bindings and event sources.
+ *
+ * See the {@link https://alchemy.run/guides/async-lambda | Async Lambda Guide}
+ * for plain handler patterns, or the
+ * {@link https://alchemy.run/guides/lambda | Effect Lambda Guide}
+ * for the full Effect-based approach with bindings, event sources, and sinks.
+ *
+ * @section Async Functions
+ * Point `main` at a file that exports a standard Lambda handler. No
+ * Effect runtime is included in the bundle. Useful when migrating
+ * existing Lambda functions or when you don't need Effect.
+ *
+ * @example Defining an async Lambda in your stack
+ * ```typescript
+ * // alchemy.run.ts
+ * import * as AWS from "alchemy/AWS";
+ *
+ * const func = yield* AWS.Lambda.Function("ApiFunction", {
+ *   main: "./src/handler.ts",
+ *   url: true,
+ * });
+ * ```
+ *
+ * @example Writing the async handler
+ * ```typescript
+ * // src/handler.ts
+ * export const handler = async (event: any) => {
+ *   return {
+ *     statusCode: 200,
+ *     body: JSON.stringify({ message: "Hello from Lambda!" }),
+ *   };
+ * };
+ * ```
+ *
+ * @section Effect Functions
+ * Pass the Effect implementation as the third argument. Bindings
+ * attach IAM permissions and environment variables at deploy time,
+ * while the runtime execution context collects listeners and exports.
+ *
+ * @example Effect Function with HTTP handler
+ * ```typescript
+ * export default class ApiFunction extends AWS.Lambda.Function<ApiFunction>()(
+ *   "ApiFunction",
+ *   { main: import.meta.filename, url: true },
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const getItem = yield* DynamoDB.GetItem.bind(table);
+ *
+ *     return {
+ *       // runtime: use them
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         const url = new URL(request.url);
+ *         const id = url.searchParams.get("id");
+ *         const result = yield* getItem({ Key: { pk: { S: id! } } });
+ *         return yield* HttpServerResponse.json(result.Item);
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Configuration
+ * @example Function with URL
+ * ```typescript
+ * const func = yield* AWS.Lambda.Function("ApiFunction", {
+ *   main: "./src/handler.ts",
+ *   url: true,
+ * });
+ * ```
+ *
+ * @example Function in a VPC
+ * ```typescript
+ * const func = yield* AWS.Lambda.Function("VpcFunction", {
+ *   main: "./src/handler.ts",
+ *   vpc: {
+ *     subnetIds: ["subnet-abc123", "subnet-def456"],
+ *     securityGroupIds: ["sg-xyz789"],
+ *   },
+ * });
+ * ```
+ *
+ * @section S3 Bindings
+ * Bind S3 operations in the init phase to give the function IAM
+ * permissions and inject the bucket name as an environment variable.
+ *
+ * @example Read and write S3 objects
+ * ```typescript
+ * // init
+ * const getObject = yield* S3.GetObject.bind(bucket);
+ * const putObject = yield* S3.PutObject.bind(bucket);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* putObject({ Key: "hello.txt", Body: "Hello!" });
+ *     const obj = yield* getObject({ Key: "hello.txt" });
+ *     return HttpServerResponse.text("OK");
+ *   }),
+ * };
+ * ```
+ *
+ * @section DynamoDB Bindings
+ * Bind DynamoDB operations in the init phase to grant table-scoped
+ * IAM permissions.
+ *
+ * @example Get and put items
+ * ```typescript
+ * // init
+ * const getItem = yield* DynamoDB.GetItem.bind(table);
+ * const putItem = yield* DynamoDB.PutItem.bind(table);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* putItem({ Item: { pk: { S: "user#1" }, name: { S: "Alice" } } });
+ *     const result = yield* getItem({ Key: { pk: { S: "user#1" } } });
+ *     return yield* HttpServerResponse.json(result.Item);
+ *   }),
+ * };
+ * ```
+ *
+ * @section SQS Bindings
+ * Bind SQS operations in the init phase to send messages to a queue.
+ *
+ * @example Send a message
+ * ```typescript
+ * // init
+ * const sendMessage = yield* SQS.SendMessage.bind(queue);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* sendMessage({
+ *       MessageBody: JSON.stringify({ orderId: "123" }),
+ *     });
+ *     return HttpServerResponse.text("Queued");
+ *   }),
+ * };
+ * ```
+ *
+ * @section SNS Bindings
+ * Bind SNS operations in the init phase to publish messages to a
+ * topic.
+ *
+ * @example Publish a notification
+ * ```typescript
+ * // init
+ * const publish = yield* SNS.Publish.bind(topic);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* publish({
+ *       Message: JSON.stringify({ event: "order.created" }),
+ *       Subject: "OrderCreated",
+ *     });
+ *     return HttpServerResponse.text("Published");
+ *   }),
+ * };
+ * ```
+ *
+ * @section Kinesis Bindings
+ * Bind Kinesis operations in the init phase to put records into a
+ * stream.
+ *
+ * @example Put a record
+ * ```typescript
+ * // init
+ * const putRecord = yield* Kinesis.PutRecord.bind(stream);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* putRecord({
+ *       PartitionKey: "order-123",
+ *       Data: new TextEncoder().encode(JSON.stringify({ orderId: "123" })),
+ *     });
+ *     return HttpServerResponse.text("Sent");
+ *   }),
+ * };
+ * ```
+ *
+ * @section Event Sources
+ * Lambda functions can be triggered by event sources like SQS queues,
+ * DynamoDB streams, S3 notifications, SNS topics, and Kinesis streams.
+ *
+ * @example Process SQS messages
+ * ```typescript
+ * yield* SQS.messages(queue).process(
+ *   Effect.fn(function* (message) {
+ *     yield* Effect.log(`Received: ${message.body}`);
+ *   }),
+ * );
+ * ```
+ *
+ * @example Process DynamoDB stream changes
+ * ```typescript
+ * yield* DynamoDB.streams(table, {
+ *   StreamViewType: "NEW_AND_OLD_IMAGES",
+ * }).process(
+ *   Effect.fn(function* (record) {
+ *     yield* Effect.log(`Change: ${record.eventName}`);
+ *   }),
+ * );
+ * ```
+ *
+ * @example Process S3 notifications
+ * ```typescript
+ * yield* S3.notifications(bucket, {
+ *   events: ["s3:ObjectCreated:*"],
+ * }).subscribe((stream) =>
+ *   stream.pipe(
+ *     Stream.runForEach((event) =>
+ *       Effect.log(`New object: ${event.key}`),
+ *     ),
+ *   ),
+ * );
+ * ```
+ */
+export const Function: Platform<
+  Function,
+  FunctionServices,
+  FunctionShape,
+  Serverless.FunctionContext
+> = Platform(FunctionTypeId, {
+  createRuntimeContext: (id: string): Serverless.FunctionContext => {
+    const listeners: Effect.Effect<Serverless.FunctionListener>[] = [];
+    const env: Record<string, any> = {};
+
+    const ctx = {
+      Type: FunctionTypeId,
+      id,
+      env,
+      set: (id: string, output: Output.Output) =>
+        Effect.sync(() => {
+          // Key is already canonical (see RuntimeContext.sanitizeKey); store it
+          // verbatim.
+          const key = id;
+          // Preserve `Redacted`-ness across the Output → Lambda env var
+          // round-trip. `JSON.stringify(Redacted)` would emit the literal
+          // string `"<redacted>"` and lose the value, so secrets are
+          // serialized with a `{_tag: "Redacted", value: ...}` marker
+          // that the runtime `get` path detects and rebuilds.
+          env[key] = output.pipe(
+            Output.map((value) =>
+              Redacted.isRedacted(value)
+                ? JSON.stringify({
+                    _tag: "Redacted",
+                    value: Redacted.value(value),
+                  })
+                : JSON.stringify(value),
+            ),
+          );
+          return key;
+        }),
+      get: <T>(key: string) =>
+        // Read the captured value straight from `process.env`. We must NOT
+        // resolve through `Config.string` here: at runtime the ambient
+        // `ConfigProvider` is the interceptor installed in `Platform.ts`,
+        // whose runtime branch calls back into `ctx.get(key)`. Going through
+        // `Config` would re-enter that interceptor for the same key and
+        // recurse forever, allocating until the Lambda init OOMs. The Worker
+        // runtime reads from `WorkerEnvironment` for the same reason.
+        Effect.sync(() => {
+          // Key is already canonical (see RuntimeContext.sanitizeKey).
+          const val = process.env[key];
+          if (val === undefined) {
+            return undefined;
+          }
+          try {
+            const value = JSON.parse(val);
+            if (
+              typeof value === "object" &&
+              value?._tag === "Redacted" &&
+              "value" in value
+            ) {
+              return Redacted.make(
+                (value as { value: unknown }).value,
+              ) as unknown as T;
+            }
+            return value as T;
+          } catch {
+            return val as unknown as T; // assume it's just a string
+          }
+        }),
+      serve: (handler: HttpEffect) =>
+        ctx.listen(makeFunctionHttpHandler(handler)),
+      listen: ((
+        handler:
+          | Serverless.FunctionListener
+          | Effect.Effect<Serverless.FunctionListener>,
+      ) =>
+        Effect.sync(() =>
+          Effect.isEffect(handler)
+            ? listeners.push(handler)
+            : listeners.push(Effect.succeed(handler)),
+        )) as any as Serverless.FunctionContext["listen"],
+      exports: Effect.sync(() => ({
+        // construct an Effect that produces the Function's entrypoint
+        // Effect<(event, context) => Promise<any>>
+        handler: Effect.map(
+          Effect.all(listeners, {
+            concurrency: "unbounded",
+          }),
+          (handlers) =>
+            async (event: any, context: lambda.Context): Promise<any> => {
+              for (const handler of handlers) {
+                const eff = handler(event);
+                if (Effect.isEffect(eff)) {
+                  return await eff.pipe(
+                    Effect.provideService(HandlerContext, context),
+                    Effect.tap(Effect.logDebug),
+                    Effect.runPromise,
+                  );
+                }
+              }
+              throw new Error("No event handler found");
+            },
+        ),
+      })),
+    };
+    return ctx;
+  },
+});
+
+export const FunctionProvider = () =>
+  Provider.effect(
+    Function,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const { accountId } = yield* AWSEnvironment;
+      const region = yield* Region;
+      const fs = yield* FileSystem.FileSystem;
+      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+      const alchemyEnv = {
+        ALCHEMY_STACK_NAME: stack.name,
+        ALCHEMY_STAGE: stack.stage,
+        ALCHEMY_PHASE: "runtime",
+      };
+
+      const createFunctionName = (
+        id: string,
+        functionName: string | undefined,
+      ) =>
+        Effect.gen(function* () {
+          return (
+            functionName ?? (yield* createPhysicalName({ id, maxLength: 64 }))
+          );
+        });
+
+      const createRoleName = (id: string) =>
+        createPhysicalName({ id, maxLength: 64 });
+
+      const createPolicyName = (id: string) =>
+        createPhysicalName({ id, maxLength: 128 });
+
+      const hashBundle = (code: Uint8Array<ArrayBufferLike>) => sha256(code);
+
+      const createNames = (id: string, functionName: string | undefined) =>
+        Effect.gen(function* () {
+          const roleName = yield* createRoleName(id);
+          const policyName = yield* createPolicyName(id);
+          const fn = yield* createFunctionName(id, functionName);
+          return {
+            roleName,
+            policyName,
+            functionName: fn,
+            roleArn: `arn:aws:iam::${accountId}:role/${roleName}`,
+            functionArn: `arn:aws:lambda:${region}:${accountId}:function:${fn}`,
+          };
+        });
+
+      const attachBindings = Effect.fnUntraced(function* ({
+        roleName,
+        policyName,
+        // functionArn,
+        // functionName,
+        bindings,
+      }: {
+        roleName: string;
+        policyName: string;
+        functionArn: string;
+        functionName: string;
+        bindings: ResourceBinding<Function["Binding"]>[];
+      }) {
+        const activeBindings = bindings.filter(
+          (
+            binding: ResourceBinding<Function["Binding"]> & { action?: string },
+          ) => binding.action !== "delete",
+        );
+        const env = activeBindings
+          .map((binding) => binding?.data?.env)
+          .reduce((acc, env) => ({ ...acc, ...env }), {});
+        const policyStatements = activeBindings.flatMap(
+          (binding) =>
+            binding?.data?.policyStatements?.map(
+              (stmt: IAM.PolicyStatement) => ({
+                ...stmt,
+                Sid: stmt.Sid?.replace(/[^A-Za-z0-9]+/gi, ""),
+              }),
+            ) ?? [],
+        );
+
+        if (policyStatements.length > 0) {
+          yield* iam.putRolePolicy({
+            RoleName: roleName,
+            PolicyName: policyName,
+            PolicyDocument: JSON.stringify({
+              Version: "2012-10-17",
+              Statement: policyStatements,
+            } satisfies IAM.PolicyDocument),
+          });
+        } else {
+          yield* iam
+            .deleteRolePolicy({
+              RoleName: roleName,
+              PolicyName: policyName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+        }
+
+        return env;
+      });
+
+      const createRoleIfNotExists = Effect.fnUntraced(function* ({
+        id,
+        roleName,
+        vpc,
+      }: {
+        id: string;
+        roleName: string;
+        vpc?: FunctionProps["vpc"];
+      }) {
+        yield* Effect.logDebug(`creating role ${id}`);
+        const tags = yield* createInternalTags(id);
+        // Engine has cleared us via `read` — foreign-tagged functions are
+        // surfaced as `Unowned` and require `--adopt`. On a race between
+        // read and create, treat `EntityAlreadyExistsException` as adoption.
+        const role = yield* iam
+          .createRole({
+            RoleName: roleName,
+            AssumeRolePolicyDocument: JSON.stringify({
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Principal: {
+                    Service: "lambda.amazonaws.com",
+                  },
+                  Action: "sts:AssumeRole",
+                },
+              ],
+            }),
+            Tags: createTagsList(tags),
+          })
+          .pipe(
+            Effect.catchTag("EntityAlreadyExistsException", () =>
+              iam.getRole({
+                RoleName: roleName,
+              }),
+            ),
+          );
+
+        yield* Effect.logDebug(`attaching policy ${id}`);
+        yield* iam
+          .attachRolePolicy({
+            RoleName: roleName,
+            PolicyArn:
+              "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          })
+          .pipe(Effect.tapError(Effect.logDebug), Effect.tap(Effect.logDebug));
+
+        if (vpc) {
+          yield* iam
+            .attachRolePolicy({
+              RoleName: roleName,
+              PolicyArn:
+                "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
+            })
+            .pipe(
+              Effect.tapError(Effect.logDebug),
+              Effect.tap(Effect.logDebug),
+            );
+        }
+
+        yield* Effect.logDebug(`attached policy ${id}`);
+        return role;
+      });
+
+      const bundleCode = Effect.fnUntraced(function* (
+        id: string,
+        props: FunctionProps,
+      ) {
+        const handler = props.handler ?? "default";
+        const sourcemap = props.build?.output?.sourcemap ?? true;
+        const uploadSourceMap = props.uploadSourceMap ?? true;
+
+        const realMain = yield* fs.realPath(props.main);
+        const cwd = yield* TempRoot.findCwdForBundle(realMain);
+
+        const rolldownSourcemap = sourcemap;
+
+        const buildBundle = Effect.fnUntraced(function* (
+          entry: string,
+          plugins?: rolldown.RolldownPluginOption,
+        ) {
+          return yield* Bundle.build(
+            {
+              ...props.build?.input,
+              input: entry,
+              cwd,
+              external: [
+                /^@aws-sdk\//,
+                ...((props.build?.input?.external as string[]) ?? []),
+              ],
+              platform: "node",
+              plugins: [props.build?.input?.plugins, plugins],
+            },
+            {
+              ...props.build?.output,
+              format: "esm",
+              sourcemap: rolldownSourcemap,
+              minify: props.build?.output?.minify ?? false,
+              entryFileNames: "index.js",
+              codeSplitting: props.build?.output?.codeSplitting ?? false,
+            },
+          );
+        });
+
+        const bundleOutput = props.isExternal
+          ? yield* buildBundle(realMain)
+          : yield* buildBundle(
+              realMain,
+              virtualEntryPlugin(
+                (importPath) => `
+import { layer as nodeServicesLayer } from "@effect/platform-node/NodeServices";
+import { Stack } from "alchemy/Stack";
+import { makeEntrypointLayer } from "alchemy/Runtime";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Credentials from "@distilled.cloud/aws/Credentials";
+import * as Effect from "effect/Effect";
+import { layer as fetchHttpClientLayer } from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Region from "@distilled.cloud/aws/Region";
+import * as Context from "effect/Context";
+import { MinimumLogLevel } from "effect/References";
+
+import entrypoint from ${JSON.stringify(importPath)};
+
+const tag = Context.Service("${Self.key}")
+const layer = makeEntrypointLayer(tag, entrypoint);
+
+const platform = Layer.mergeAll(
+  nodeServicesLayer,
+  fetchHttpClientLayer,
+  // TODO(sam): wire this up to telemetry more directly
+  Logger.layer([Logger.consolePretty()]),
+);
+
+const stack = Layer.effect(
+  Stack,
+  Effect.all([
+    Config.string("ALCHEMY_STACK_NAME"),
+    Config.string("ALCHEMY_STAGE")
+  ]).pipe(
+    Effect.map(([name, stage]) => ({
+      name,
+      stage,
+      bindings: {},
+      resources: {}
+    }))
+  )
+);
+
+const handlerEffect = tag.pipe(
+  Effect.flatMap(func => func.RuntimeContext.exports),
+  Effect.flatMap(exports => exports.handler),
+  Effect.provide(
+    layer.pipe(
+      Layer.provideMerge(stack),
+      Layer.provideMerge(Credentials.fromEnv()),
+      Layer.provideMerge(Region.fromEnv()),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          ConfigProvider.ConfigProvider,
+          ConfigProvider.fromEnv()
+        )
+      ),
+      Layer.provideMerge(
+        Layer.succeed(
+          MinimumLogLevel,
+          process.env.DEBUG ? "Debug" : "Info",
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+export default await Effect.runPromise(handlerEffect)
+`,
+              ),
+            );
+
+        const mainFile = bundleOutput.files[0];
+        const code =
+          typeof mainFile.content === "string"
+            ? new TextEncoder().encode(mainFile.content)
+            : mainFile.content;
+
+        const includeSourceMaps =
+          uploadSourceMap && (sourcemap === true || sourcemap === "hidden");
+
+        const extraFiles = bundleOutput.files
+          .slice(1)
+          .filter(
+            (f: Bundle.BundleFile) =>
+              includeSourceMaps || !f.path.endsWith(".map"),
+          )
+          .map((f: Bundle.BundleFile) => ({
+            path: f.path,
+            content: f.content,
+          }));
+
+        const archive = yield* zipCode(
+          code,
+          extraFiles.length > 0 ? extraFiles : undefined,
+        );
+        return {
+          archive,
+          code,
+          hash: bundleOutput.hash,
+        };
+      });
+
+      const withNodeSourceMaps = (
+        env: Record<string, string> | undefined,
+        props: FunctionProps,
+      ) => {
+        const sourcemap = props.build?.output?.sourcemap ?? true;
+        const uploadSourceMap = props.uploadSourceMap ?? true;
+        const shouldEnableSourceMaps =
+          sourcemap === "inline" ||
+          (uploadSourceMap && (sourcemap === true || sourcemap === "hidden"));
+
+        if (!shouldEnableSourceMaps) {
+          return env;
+        }
+
+        const current = env?.NODE_OPTIONS;
+        if (current?.split(/\s+/).includes("--enable-source-maps")) {
+          return env;
+        }
+
+        return {
+          ...env,
+          NODE_OPTIONS: current
+            ? `${current} --enable-source-maps`
+            : "--enable-source-maps",
+        };
+      };
+
+      const createOrUpdateFunction = Effect.fnUntraced(function* ({
+        id,
+        news,
+        roleArn,
+        archive,
+        hash,
+        env,
+        functionName,
+        preferUpdate,
+        session,
+      }: {
+        id: string;
+        news: FunctionProps;
+        roleArn: string;
+        archive: Uint8Array<ArrayBufferLike>;
+        hash: string;
+        env: Record<string, string> | undefined;
+        functionName: string;
+        preferUpdate?: boolean;
+        session: { note: (note: string) => Effect.Effect<void> };
+      }) {
+        yield* Effect.logDebug(`creating function ${id}`);
+        const waitStartedAt = Date.now();
+
+        const isRolePropagationError = <
+          E extends Lambda.UpdateFunctionCodeError | Lambda.CreateFunctionError,
+        >(
+          e: E,
+        ) =>
+          e._tag === "InvalidParameterValueException" &&
+          (e.message?.includes("cannot be assumed by Lambda") ||
+            (e.message?.includes("KMS key is invalid for CreateGrant") &&
+              e.message?.includes("ARN does not refer to a valid principal")));
+
+        const noteRolePropagationWait = () =>
+          session.note(
+            `Waiting for Lambda execution role to become assumable: ${functionName} (${Math.ceil((Date.now() - waitStartedAt) / 1000)}s)`,
+          );
+
+        const tags = yield* createInternalTags(id);
+
+        // Try to use S3 if assets bucket is available, otherwise fall back to inline ZipFile
+        const assets = (yield* Effect.serviceOption(Assets)).pipe(
+          Option.getOrUndefined,
+        );
+
+        const codeLocation = yield* Effect.gen(function* () {
+          if (assets) {
+            const key = yield* assets.uploadAsset(hash, archive);
+            yield* Effect.logDebug(
+              `Using S3 for code: s3://${assets.bucketName}/${key}`,
+            );
+            return {
+              S3Bucket: assets.bucketName,
+              S3Key: key,
+            } as const;
+          } else {
+            return { ZipFile: archive } as const;
+          }
+        });
+        const runtimeEnv = withNodeSourceMaps(env, news);
+
+        const createFunctionRequest: CreateFunctionRequest = {
+          FunctionName: functionName,
+          Handler: `index.${news.handler ?? "default"}`,
+          Role: roleArn,
+          Code: codeLocation,
+          Runtime: news.runtime ?? "nodejs22.x",
+          Environment: runtimeEnv
+            ? {
+                Variables: {
+                  ...runtimeEnv,
+                  ...alchemyEnv,
+                },
+              }
+            : undefined,
+          Tags: tags,
+          Timeout: toTimeoutSeconds(news.timeout),
+          VpcConfig: news.vpc
+            ? {
+                SubnetIds: news.vpc.subnetIds,
+                SecurityGroupIds: news.vpc.securityGroupIds,
+              }
+            : undefined,
+        };
+
+        const getAndUpdate = Lambda.getFunction({
+          FunctionName: functionName,
+        }).pipe(
+          Effect.filterOrFail(
+            // if it exists and contains these tags, we will assume it was created by alchemy
+            // but state was lost, so if it exists, let's adopt it
+            (f) => hasTags(tags, f.Tags),
+            () =>
+              // TODO(sam): add custom
+              new Error("Function tags do not match expected values"),
+          ),
+          Effect.flatMap(() =>
+            Effect.gen(function* () {
+              yield* Effect.logDebug(`updating function code ${id}`);
+              yield* Lambda.updateFunctionCode({
+                FunctionName: createFunctionRequest.FunctionName,
+                Architectures: createFunctionRequest.Architectures,
+                // Use S3 or ZipFile based on what was used for create
+                ...("S3Bucket" in codeLocation
+                  ? {
+                      S3Bucket: codeLocation.S3Bucket,
+                      S3Key: codeLocation.S3Key,
+                    }
+                  : { ZipFile: codeLocation.ZipFile }),
+              }).pipe(
+                Effect.tapError((e) =>
+                  isRolePropagationError(e)
+                    ? noteRolePropagationWait()
+                    : Effect.void,
+                ),
+                Effect.retry({
+                  while: (e) =>
+                    e._tag === "ResourceConflictException" ||
+                    isRolePropagationError(e),
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+              yield* Effect.logDebug(`updated function code ${id}`);
+              yield* Lambda.updateFunctionConfiguration({
+                FunctionName: createFunctionRequest.FunctionName,
+                DeadLetterConfig: createFunctionRequest.DeadLetterConfig,
+                Description: createFunctionRequest.Description,
+                Environment: createFunctionRequest.Environment,
+                EphemeralStorage: createFunctionRequest.EphemeralStorage,
+                FileSystemConfigs: createFunctionRequest.FileSystemConfigs,
+                Handler: createFunctionRequest.Handler,
+                ImageConfig: createFunctionRequest.ImageConfig,
+                KMSKeyArn: createFunctionRequest.KMSKeyArn,
+                Layers: createFunctionRequest.Layers,
+                LoggingConfig: createFunctionRequest.LoggingConfig,
+                MemorySize: createFunctionRequest.MemorySize,
+                // RevisionId: "???"
+                Role: createFunctionRequest.Role,
+                Runtime: createFunctionRequest.Runtime,
+                SnapStart: createFunctionRequest.SnapStart,
+                Timeout: createFunctionRequest.Timeout,
+                TracingConfig: createFunctionRequest.TracingConfig,
+                VpcConfig: createFunctionRequest.VpcConfig,
+              }).pipe(
+                Effect.tapError((e) =>
+                  isRolePropagationError(e)
+                    ? noteRolePropagationWait()
+                    : Effect.void,
+                ),
+                Effect.retry({
+                  while: (e) =>
+                    e._tag === "ResourceConflictException" ||
+                    isRolePropagationError(e),
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+              yield* Effect.logDebug(`updated function configuration ${id}`);
+            }),
+          ),
+        );
+
+        const create = Lambda.createFunction(createFunctionRequest).pipe(
+          Effect.tapError((e) =>
+            Effect.gen(function* () {
+              yield* Effect.logDebug(e);
+            }),
+          ),
+          Effect.retry({
+            while: (e) => isRolePropagationError(e),
+            schedule: Schedule.fixed(1000).pipe(
+              Schedule.tapOutput(() => noteRolePropagationWait()),
+            ),
+          }),
+          Effect.catchTags({
+            ResourceConflictException: () => getAndUpdate,
+          }),
+        );
+
+        if (preferUpdate) {
+          yield* getAndUpdate.pipe(
+            Effect.catchTags({
+              ResourceNotFoundException: () => create,
+            }),
+          );
+        } else {
+          yield* create;
+        }
+      });
+
+      const createOrUpdateFunctionUrl = Effect.fnUntraced(function* ({
+        functionName,
+        url = true,
+        oldUrl,
+      }: {
+        functionName: string;
+        url: FunctionProps["url"];
+        oldUrl?: FunctionProps["url"];
+      }) {
+        // TODO(sam): support AWS_IAM
+        const authType = "NONE";
+        yield* Effect.logDebug(`creating function url config ${functionName}`);
+        if (url) {
+          const config = {
+            FunctionName: functionName,
+            AuthType: authType, // | AWS_IAM
+            // Cors: {
+            //   AllowCredentials: true,
+            //   AllowHeaders: ["*"],
+            //   AllowMethods: ["*"],
+            //   AllowOrigins: ["*"],
+            //   ExposeHeaders: ["*"],
+            //   MaxAge: 86400,
+            // },
+            InvokeMode: "BUFFERED", // | RESPONSE_STREAM
+            // Qualifier: "$LATEST"
+          } satisfies
+            | Lambda.CreateFunctionUrlConfigRequest
+            | Lambda.UpdateFunctionUrlConfigRequest;
+          const urlPermission = {
+            FunctionName: functionName,
+            StatementId: "FunctionURLAllowPublicAccess",
+            Action: "lambda:InvokeFunctionUrl",
+            Principal: "*",
+            FunctionUrlAuthType: "NONE",
+          } as const;
+          const invokePermission = {
+            FunctionName: functionName,
+            StatementId: "FunctionURLAllowPublicInvoke",
+            Action: "lambda:InvokeFunction",
+            Principal: "*",
+            InvokedViaFunctionUrl: true,
+          } as const;
+          const upsertPermission = (permission: Lambda.AddPermissionRequest) =>
+            Lambda.addPermission(permission).pipe(
+              Effect.catchTag("ResourceConflictException", () =>
+                Effect.gen(function* () {
+                  yield* Lambda.removePermission({
+                    FunctionName: functionName,
+                    StatementId: permission.StatementId,
+                  });
+                  yield* Lambda.addPermission(permission);
+                }),
+              ),
+            );
+          const [{ FunctionUrl }] = yield* Effect.all([
+            Lambda.createFunctionUrlConfig(config).pipe(
+              Effect.catchTag("ResourceConflictException", () =>
+                Lambda.updateFunctionUrlConfig(config),
+              ),
+            ),
+            authType === "NONE"
+              ? Effect.all([
+                  upsertPermission(urlPermission),
+                  upsertPermission(invokePermission),
+                ])
+              : // TODO(sam): support AWS_IAM
+                Effect.void,
+          ]);
+          yield* Effect.logDebug(`created function url config ${functionName}`);
+          return FunctionUrl;
+        } else if (oldUrl) {
+          yield* Effect.logDebug(
+            `deleting function url config ${functionName}`,
+          );
+          yield* Effect.all([
+            Lambda.deleteFunctionUrlConfig({
+              FunctionName: functionName,
+            }).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            ),
+            Lambda.removePermission({
+              FunctionName: functionName,
+              StatementId: "FunctionURLAllowPublicAccess",
+            }).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            ),
+            Lambda.removePermission({
+              FunctionName: functionName,
+              StatementId: "FunctionURLAllowPublicInvoke",
+            }).pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            ),
+          ]);
+          yield* Effect.logDebug(`deleted function url config ${functionName}`);
+        }
+        return undefined;
+      });
+
+      const summary = ({ code }: { code: Uint8Array<ArrayBufferLike> }) =>
+        `${
+          code.length >= 1024 * 1024
+            ? `${(code.length / (1024 * 1024)).toFixed(2)}MB`
+            : code.length >= 1024
+              ? `${(code.length / 1024).toFixed(2)}KB`
+              : `${code.length}B`
+        }`;
+
+      return {
+        stables: ["functionArn", "functionName", "roleName"],
+        diff: Effect.fnUntraced(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return;
+          // If output is undefined (resource in creating state), defer to default diff
+          if (!output) {
+            return undefined;
+          }
+          if (
+            // function name changed
+            output.functionName !==
+              (yield* createFunctionName(id, news.functionName)) ||
+            // url changed
+            (olds.url ?? true) !== news.url
+          ) {
+            return { action: "replace" };
+          }
+          if (
+            output.code.hash !==
+            (yield* bundleCode(id, {
+              main: news.main,
+              handler: news.handler,
+              build: news.build,
+              uploadSourceMap: news.uploadSourceMap,
+            })).hash
+          ) {
+            // code changed
+            return { action: "update" };
+          }
+          if (
+            toTimeoutSeconds(olds.timeout) !== toTimeoutSeconds(news.timeout)
+          ) {
+            return { action: "update" };
+          }
+        }),
+        read: Effect.fnUntraced(function* ({ id, olds, output }) {
+          const functionName =
+            output?.functionName ??
+            (yield* createFunctionName(id, olds?.functionName));
+          yield* Effect.logDebug(`reading function ${functionName}`);
+          const fn = yield* Lambda.getFunction({
+            FunctionName: functionName,
+          }).pipe(
+            Effect.map((r) => r.Configuration),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          if (!fn?.FunctionArn || !fn.FunctionName || !fn.Role) {
+            return undefined;
+          }
+          const tagsResult = yield* Lambda.listTags({
+            Resource: fn.FunctionArn,
+          }).pipe(
+            Effect.map((r) => r.Tags ?? {}),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed({} as Record<string, string>),
+            ),
+          );
+          const functionUrl = yield* Lambda.getFunctionUrlConfig({
+            FunctionName: fn.FunctionName,
+          }).pipe(
+            Effect.map((f) => f.FunctionUrl),
+            Effect.retry({
+              while: (e: any) => e._tag === "ResourceConflictException",
+              schedule: Schedule.exponential(100),
+            }),
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          // Reuse the persisted output where we have it (e.g. code hash) so
+          // diff doesn't see drift it can't reconstruct from the API.
+          const attrs = {
+            ...output,
+            functionArn: fn.FunctionArn,
+            functionName: fn.FunctionName,
+            functionUrl,
+            roleArn: fn.Role,
+            roleName: output?.roleName ?? fn.Role.split("/").pop()!,
+          } as any;
+          return (yield* hasAlchemyTags(id, tagsResult))
+            ? attrs
+            : Unowned(attrs);
+        }),
+
+        precreate: Effect.fnUntraced(function* ({ id, news, session }) {
+          const { roleName, functionName, roleArn } = yield* createNames(
+            id,
+            news.functionName,
+          );
+
+          const role = yield* createRoleIfNotExists({
+            id,
+            roleName,
+            vpc: news.vpc,
+          });
+
+          // Mock code for the pre-created stub. It responds 503 (rather than a
+          // bare 200) so that, during the brief window where the real
+          // code/config update is still `InProgress`, a Function URL hit serves
+          // an honest "not ready" signal instead of a successful-but-empty 200.
+          // Downstream readiness probes already retry on non-200, so they wait
+          // for the real handler to go live without the provider blocking.
+          const code = new TextEncoder().encode(
+            `export default () => ({ statusCode: 503, headers: { "content-type": "application/json" }, body: JSON.stringify({ error: "function initializing" }) })`,
+          );
+          const archive = yield* zipCode(code);
+          const hash = yield* hashBundle(code);
+          yield* createOrUpdateFunction({
+            id,
+            news,
+            roleArn: role.Role.Arn,
+            archive,
+            hash,
+            functionName,
+            env: alchemyEnv,
+            session,
+          });
+
+          return {
+            functionArn: `arn:aws:lambda:${region}:${accountId}:function:${functionName}`,
+            functionName,
+            functionUrl: undefined,
+            roleName,
+            code: {
+              hash,
+            },
+            roleArn,
+          };
+        }),
+        reconcile: Effect.fnUntraced(function* ({
+          id,
+          news,
+          olds,
+          bindings,
+          output,
+          session,
+        }) {
+          const { roleName, policyName, functionName, functionArn } =
+            yield* createNames(id, news.functionName);
+
+          const roleArn =
+            output?.roleArn ??
+            (yield* createRoleIfNotExists({ id, roleName, vpc: news.vpc })).Role
+              .Arn;
+
+          const env = yield* attachBindings({
+            roleName,
+            policyName,
+            functionArn,
+            functionName,
+            bindings,
+          });
+
+          const { archive, code, hash } = yield* bundleCode(id, news);
+
+          yield* createOrUpdateFunction({
+            id,
+            news,
+            roleArn,
+            archive,
+            hash,
+            env: {
+              ...env,
+              ...news.env,
+            },
+            functionName,
+            preferUpdate: output !== undefined,
+            session,
+          });
+
+          const functionUrl = yield* createOrUpdateFunctionUrl({
+            functionName,
+            url: news.url,
+            oldUrl: olds?.url,
+          });
+
+          yield* session.note(summary({ code }));
+
+          return {
+            ...output,
+            functionArn,
+            functionName,
+            functionUrl: functionUrl as any,
+            roleName,
+            roleArn,
+            code: {
+              hash,
+            },
+          };
+        }),
+        delete: Effect.fnUntraced(function* ({ output }) {
+          yield* iam
+            .listRolePolicies({
+              RoleName: output.roleName,
+            })
+            .pipe(
+              Effect.flatMap((policies) =>
+                Effect.all(
+                  (policies.PolicyNames ?? []).map((policyName) =>
+                    iam.deleteRolePolicy({
+                      RoleName: output.roleName,
+                      PolicyName: policyName,
+                    }),
+                  ),
+                ),
+              ),
+            );
+
+          yield* iam
+            .listAttachedRolePolicies({
+              RoleName: output.roleName,
+            })
+            .pipe(
+              Effect.flatMap((policies) =>
+                Effect.all(
+                  (policies.AttachedPolicies ?? []).map((policy) =>
+                    iam
+                      .detachRolePolicy({
+                        RoleName: output.roleName,
+                        PolicyArn: policy.PolicyArn!,
+                      })
+                      .pipe(
+                        Effect.catchTag(
+                          "NoSuchEntityException",
+                          () => Effect.void,
+                        ),
+                      ),
+                  ),
+                ),
+              ),
+            );
+
+          yield* Lambda.deleteFunction({
+            FunctionName: output.functionName,
+          }).pipe(
+            Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+          );
+
+          yield* iam
+            .deleteRole({
+              RoleName: output.roleName,
+            })
+            .pipe(Effect.catchTag("NoSuchEntityException", () => Effect.void));
+          return null as any;
+        }),
+        tail: ({ output }) => {
+          const logGroupArn = `arn:aws:logs:${region}:${accountId}:log-group:/aws/lambda/${output.functionName}`;
+
+          const runTailSession = Effect.gen(function* () {
+            const response = yield* logs.startLiveTail({
+              logGroupIdentifiers: [logGroupArn],
+            });
+
+            if (!response.responseStream) {
+              return Stream.empty as Stream.Stream<LogLine>;
+            }
+
+            return response.responseStream.pipe(
+              Stream.flatMap((event) => {
+                if ("sessionUpdate" in event && event.sessionUpdate) {
+                  const lines: LogLine[] = (
+                    event.sessionUpdate.sessionResults ?? []
+                  ).flatMap((result) => {
+                    if (!result.message) return [];
+                    return [
+                      {
+                        timestamp: new Date(result.timestamp ?? Date.now()),
+                        message: result.message.trimEnd(),
+                      },
+                    ];
+                  });
+                  return Stream.fromIterable(lines);
+                }
+                return Stream.empty;
+              }),
+            );
+          });
+
+          return Stream.unwrap(runTailSession).pipe(
+            Stream.retry(Schedule.spaced("1 second")),
+          );
+        },
+        logs: ({
+          output,
+          options,
+        }: {
+          output: Function["Attributes"];
+          options: LogsInput;
+        }) =>
+          logs
+            .filterLogEvents({
+              logGroupName: `/aws/lambda/${output.functionName}`,
+              startTime: options.since?.getTime(),
+              limit: options.limit ?? 100,
+            })
+            .pipe(
+              Effect.map((response) =>
+                (response.events ?? []).flatMap((event): LogLine[] => {
+                  if (!event.message) return [];
+                  return [
+                    {
+                      timestamp: new Date(event.timestamp ?? Date.now()),
+                      message: event.message.trimEnd(),
+                    },
+                  ];
+                }),
+              ),
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed([] as LogLine[]),
+              ),
+            ),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/HttpServer.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/HttpServer.ts
new file mode 100644
index 00000000000..3576f47e44a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/HttpServer.ts
@@ -0,0 +1,291 @@
+import type {
+  APIGatewayProxyEvent,
+  APIGatewayProxyResult,
+  LambdaFunctionURLEvent,
+  LambdaFunctionURLResult,
+} from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import type { Scope } from "effect/Scope";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as Http from "../../Http.ts";
+
+export const isFunctionURLEvent = (
+  event: any,
+): event is LambdaFunctionURLEvent => {
+  return event.requestContext?.http?.method !== undefined;
+};
+
+/**
+ * REST API (v1) AWS_PROXY events have a top-level `httpMethod` and a
+ * `requestContext.resourcePath` field. They lack the `requestContext.http.*`
+ * shape of Function URL / HTTP API (v2) events.
+ */
+export const isApiGatewayProxyEvent = (
+  event: any,
+): event is APIGatewayProxyEvent => {
+  return (
+    typeof event?.httpMethod === "string" &&
+    event?.requestContext?.resourcePath !== undefined
+  );
+};
+
+export const makeFunctionHttpHandler = <Req>(handler: Http.HttpEffect<Req>) => {
+  const safeHandler = Http.safeHttpEffect(handler);
+  return (event: any) => {
+    if (isFunctionURLEvent(event)) {
+      const webRequest = functionUrlEventToWebRequest(event);
+      const request = HttpServerRequest.fromWeb(webRequest).modify({
+        url: webRequest.url,
+        remoteAddress: Option.some(event.requestContext.http.sourceIp),
+      });
+      return safeHandler.pipe(
+        Effect.provideService(HttpServerRequest.HttpServerRequest, request),
+        Effect.flatMap(toLambdaFunctionURLResult),
+      ) as Effect.Effect<
+        LambdaFunctionURLResult,
+        never,
+        Exclude<
+          Effect.Services<typeof handler>,
+          HttpServerRequest.HttpServerRequest | Scope
+        >
+      >;
+    }
+    if (isApiGatewayProxyEvent(event)) {
+      const webRequest = apiGatewayProxyEventToWebRequest(event);
+      const request = HttpServerRequest.fromWeb(webRequest).modify({
+        url: webRequest.url,
+        remoteAddress: Option.fromNullishOr(
+          event.requestContext?.identity?.sourceIp,
+        ),
+      });
+      return safeHandler.pipe(
+        Effect.provideService(HttpServerRequest.HttpServerRequest, request),
+        Effect.flatMap(toApiGatewayProxyResult),
+      ) as Effect.Effect<
+        APIGatewayProxyResult,
+        never,
+        Exclude<
+          Effect.Services<typeof handler>,
+          HttpServerRequest.HttpServerRequest | Scope
+        >
+      >;
+    }
+  };
+};
+
+const functionUrlEventToWebRequest = (
+  event: LambdaFunctionURLEvent,
+): Request => {
+  const protocol =
+    event.headers["x-forwarded-proto"] ??
+    event.requestContext.http.protocol ??
+    "https";
+  const host = event.headers.host ?? event.requestContext.domainName;
+  const url = `${protocol}://${host}${event.rawPath}${event.rawQueryString ? `?${event.rawQueryString}` : ""}`;
+  const method = event.requestContext.http.method;
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(event.headers)) {
+    if (value !== undefined) {
+      headers.set(key, value);
+    }
+  }
+  if (event.cookies?.length) {
+    headers.set("cookie", event.cookies.join("; "));
+  }
+
+  let body: string | ArrayBuffer | undefined;
+  if (event.body !== undefined) {
+    body = event.isBase64Encoded
+      ? Uint8Array.from(atob(event.body), (c) => c.charCodeAt(0)).buffer
+      : event.body;
+  }
+
+  return new Request(url, {
+    method,
+    headers,
+    body: body && method !== "GET" && method !== "HEAD" ? body : undefined,
+  });
+};
+
+const apiGatewayProxyEventToWebRequest = (
+  event: APIGatewayProxyEvent,
+): Request => {
+  const headers = new Headers();
+  if (event.multiValueHeaders) {
+    for (const [key, values] of Object.entries(event.multiValueHeaders)) {
+      if (!values) continue;
+      for (const value of values) {
+        if (value !== undefined && value !== null) {
+          headers.append(key, value);
+        }
+      }
+    }
+  }
+  if (event.headers) {
+    for (const [key, value] of Object.entries(event.headers)) {
+      if (value !== undefined && value !== null && !headers.has(key)) {
+        headers.set(key, value);
+      }
+    }
+  }
+
+  const protocol =
+    headers.get("x-forwarded-proto") ??
+    headers.get("X-Forwarded-Proto") ??
+    "https";
+  const host =
+    headers.get("host") ??
+    headers.get("Host") ??
+    event.requestContext.domainName ??
+    "lambda";
+  const stage = event.requestContext.stage;
+  // API Gateway prefixes paths with the stage when invoked via the default
+  // execute-api endpoint; `event.path` already contains that. Use it as-is.
+  const path = event.path ?? "/";
+
+  const queryParts: string[] = [];
+  if (event.multiValueQueryStringParameters) {
+    for (const [k, vs] of Object.entries(
+      event.multiValueQueryStringParameters,
+    )) {
+      if (!vs) continue;
+      for (const v of vs) {
+        queryParts.push(
+          `${encodeURIComponent(k)}=${encodeURIComponent(v ?? "")}`,
+        );
+      }
+    }
+  } else if (event.queryStringParameters) {
+    for (const [k, v] of Object.entries(event.queryStringParameters)) {
+      if (v === undefined || v === null) continue;
+      queryParts.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);
+    }
+  }
+  const queryString = queryParts.length > 0 ? `?${queryParts.join("&")}` : "";
+
+  const url = `${protocol}://${host}${path}${queryString}`;
+  const method = event.httpMethod;
+
+  let body: string | ArrayBuffer | undefined;
+  if (event.body !== null && event.body !== undefined) {
+    body = event.isBase64Encoded
+      ? Uint8Array.from(atob(event.body), (c) => c.charCodeAt(0)).buffer
+      : event.body;
+  }
+
+  // Reference `stage` so static analysis sees it as used; the variable is
+  // useful when constructing fully-qualified URLs in downstream code.
+  void stage;
+
+  return new Request(url, {
+    method,
+    headers,
+    body: body && method !== "GET" && method !== "HEAD" ? body : undefined,
+  });
+};
+
+const toLambdaFunctionURLResult = (
+  response: HttpServerResponse.HttpServerResponse,
+): Effect.Effect<LambdaFunctionURLResult> =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context();
+    const webResponse = HttpServerResponse.toWeb(response, { context });
+    const headers = new Headers(webResponse.headers);
+    const cookies =
+      typeof headers.getSetCookie === "function" ? headers.getSetCookie() : [];
+
+    headers.delete("set-cookie");
+
+    if (!webResponse.body) {
+      return {
+        statusCode: webResponse.status,
+        headers: Object.fromEntries(headers.entries()),
+        cookies: cookies.length > 0 ? cookies : undefined,
+      };
+    }
+
+    const bytes = new Uint8Array(
+      yield* Effect.promise(() => webResponse.arrayBuffer()),
+    );
+    const isTextual = isTextualContentType(headers.get("content-type"));
+    const body =
+      bytes.length === 0
+        ? undefined
+        : isTextual
+          ? new TextDecoder().decode(bytes)
+          : Buffer.from(bytes).toString("base64");
+
+    return {
+      statusCode: webResponse.status,
+      headers: Object.fromEntries(headers.entries()),
+      body,
+      cookies: cookies.length > 0 ? cookies : undefined,
+      isBase64Encoded: body !== undefined && !isTextual ? true : undefined,
+    };
+  });
+
+const toApiGatewayProxyResult = (
+  response: HttpServerResponse.HttpServerResponse,
+): Effect.Effect<APIGatewayProxyResult> =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context();
+    const webResponse = HttpServerResponse.toWeb(response, { context });
+    const headers = new Headers(webResponse.headers);
+
+    const multiValueHeaders: { [name: string]: string[] } = {};
+    const singleHeaders: { [name: string]: string } = {};
+    for (const [key, value] of headers.entries()) {
+      if (multiValueHeaders[key]) {
+        multiValueHeaders[key].push(value);
+      } else {
+        multiValueHeaders[key] = [value];
+        singleHeaders[key] = value;
+      }
+    }
+
+    if (!webResponse.body) {
+      return {
+        statusCode: webResponse.status,
+        headers: singleHeaders,
+        multiValueHeaders,
+        body: "",
+      };
+    }
+
+    const bytes = new Uint8Array(
+      yield* Effect.promise(() => webResponse.arrayBuffer()),
+    );
+    const isTextual = isTextualContentType(headers.get("content-type"));
+    const isBase64 = bytes.length > 0 && !isTextual;
+    const body =
+      bytes.length === 0
+        ? ""
+        : isTextual
+          ? new TextDecoder().decode(bytes)
+          : Buffer.from(bytes).toString("base64");
+
+    return {
+      statusCode: webResponse.status,
+      headers: singleHeaders,
+      multiValueHeaders,
+      body,
+      isBase64Encoded: isBase64,
+    };
+  });
+
+const isTextualContentType = (contentType: string | null): boolean => {
+  if (!contentType) {
+    return false;
+  }
+
+  const normalized = contentType.toLowerCase();
+  return (
+    normalized.startsWith("text/") ||
+    normalized.includes("json") ||
+    normalized.includes("xml") ||
+    normalized.includes("javascript") ||
+    normalized.includes("form-urlencoded")
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/InvokeFunction.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/InvokeFunction.ts
new file mode 100644
index 00000000000..6fe2e542756
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/InvokeFunction.ts
@@ -0,0 +1,67 @@
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import type { Function } from "./Function.ts";
+import { isFunction } from "./Function.ts";
+
+export interface InvokeFunctionRequest extends Omit<
+  Lambda.InvocationRequest,
+  "FunctionName"
+> {}
+
+export class InvokeFunction extends Binding.Service<
+  InvokeFunction,
+  (
+    func: Function,
+  ) => Effect.Effect<
+    (
+      request: InvokeFunctionRequest,
+    ) => Effect.Effect<Lambda.InvocationResponse, Lambda.InvokeError>
+  >
+>()("AWS.Lambda.InvokeFunction") {}
+
+export const InvokeFunctionLive = Layer.effect(
+  InvokeFunction,
+  Effect.gen(function* () {
+    const bind = yield* InvokeFunctionPolicy;
+    const invoke = yield* Lambda.invoke;
+
+    return Effect.fn(function* (func: Function) {
+      const FunctionArn = yield* func.functionArn;
+      yield* bind(func);
+      return Effect.fn(function* (request: InvokeFunctionRequest) {
+        return yield* invoke({
+          ...request,
+          FunctionName: yield* FunctionArn,
+        });
+      });
+    });
+  }),
+);
+
+export class InvokeFunctionPolicy extends Binding.Policy<
+  InvokeFunctionPolicy,
+  (func: Function) => Effect.Effect<void>
+>()("AWS.Lambda.InvokeFunction") {}
+
+export const InvokeFunctionPolicyLive = InvokeFunctionPolicy.layer.succeed(
+  Effect.fn(function* (host, func) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.Lambda.InvokeFunction(${func}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["lambda:InvokeFunction"],
+            Resource: [Output.interpolate`${func.functionArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `InvokeFunctionPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/Permission.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/Permission.ts
new file mode 100644
index 00000000000..c72cfbd5152
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/Permission.ts
@@ -0,0 +1,206 @@
+import type * as lambda from "@distilled.cloud/aws/lambda";
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export type { FunctionUrlAuthType } from "@distilled.cloud/aws/lambda";
+
+export interface PermissionProps {
+  /**
+   * The action that the principal can use on the function.
+   * For example, `lambda:InvokeFunction` or `lambda:GetFunction`.
+   */
+  action: string;
+
+  /**
+   * The name or ARN of the Lambda function, version, or alias.
+   */
+  functionName: string;
+
+  /**
+   * The AWS service, AWS account, IAM user, or IAM role that invokes the function.
+   * If you specify a service, use `sourceArn` or `sourceAccount` to limit who can
+   * invoke the function through that service.
+   */
+  principal: string;
+
+  /**
+   * For Alexa Smart Home functions, a token that the invoker must supply.
+   */
+  eventSourceToken?: string;
+
+  /**
+   * The type of authentication that your function URL uses.
+   * Set to `AWS_IAM` to restrict access to authenticated users only.
+   * Set to `NONE` to bypass IAM authentication to create a public endpoint.
+   */
+  functionUrlAuthType?: lambda.FunctionUrlAuthType;
+
+  /**
+   * Indicates whether the permission applies when the function is invoked
+   * through a function URL.
+   */
+  invokedViaFunctionUrl?: boolean;
+
+  /**
+   * The identifier for your organization in AWS Organizations.
+   * Use this to grant permissions to all the AWS accounts under this organization.
+   */
+  principalOrgID?: string;
+
+  /**
+   * For AWS services, the ID of the AWS account that owns the resource.
+   * Use this together with `sourceArn` to ensure that the specified account owns the resource.
+   */
+  sourceAccount?: string;
+
+  /**
+   * For AWS services, the ARN of the AWS resource that invokes the function.
+   * For example, an Amazon S3 bucket or Amazon SNS topic.
+   */
+  sourceArn?: string;
+}
+
+export interface Permission extends Resource<
+  "AWS.Lambda.Permission",
+  PermissionProps,
+  {
+    /** The statement ID of the permission. */
+    statementId: string;
+    /** The function name or ARN the permission is attached to. */
+    functionName: string;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A Lambda permission that grants an AWS service or another account permission to
+ * invoke a function.
+ *
+ * @section Granting Permissions
+ * @example S3 Notification Permission
+ * ```typescript
+ * const perm = yield* Permission("S3Invoke", {
+ *   action: "lambda:InvokeFunction",
+ *   functionName: yield* fn.functionArn(),
+ *   principal: "s3.amazonaws.com",
+ *   sourceArn: yield* bucket.bucketArn,
+ *   sourceAccount: (yield* AWSEnvironment).accountId,
+ * });
+ * ```
+ *
+ * @example Cross Account Invoke
+ * ```typescript
+ * const perm = yield* Permission("CrossAccount", {
+ *   action: "lambda:InvokeFunction",
+ *   functionName: yield* fn.functionArn(),
+ *   principal: "123456789012",
+ * });
+ * ```
+ *
+ * @example Public Function URL
+ * ```typescript
+ * const perm = yield* Permission("PublicUrl", {
+ *   action: "lambda:InvokeFunctionUrl",
+ *   functionName: yield* fn.functionArn(),
+ *   principal: "*",
+ *   functionUrlAuthType: "NONE",
+ * });
+ * ```
+ */
+export const Permission = Resource<Permission>("AWS.Lambda.Permission");
+
+export const PermissionProvider = () =>
+  Provider.effect(
+    Permission,
+    Effect.gen(function* () {
+      const createStatementId = (id: string) =>
+        createPhysicalName({
+          id,
+          maxLength: 100,
+          delimiter: "-",
+        });
+
+      return {
+        stables: ["statementId", "functionName"],
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          if (news.functionName !== olds.functionName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — derive identity. The statementId is deterministic from
+          // the logical id, so we always use it whether this is a first
+          // reconciliation, an adoption, or a re-run after a partial create.
+          const statementId =
+            output?.statementId ?? (yield* createStatementId(id));
+
+          // Ensure + sync — addPermission has no "update" API, so we
+          // unconditionally re-add. Tolerate `ResourceConflictException`
+          // (statement already exists) by removing and re-adding so the
+          // permission ends up matching `news`.
+          yield* Lambda.addPermission({
+            FunctionName: news.functionName,
+            StatementId: statementId,
+            Action: news.action,
+            Principal: news.principal,
+            SourceArn: news.sourceArn,
+            SourceAccount: news.sourceAccount,
+            EventSourceToken: news.eventSourceToken,
+            FunctionUrlAuthType: news.functionUrlAuthType,
+            InvokedViaFunctionUrl: news.invokedViaFunctionUrl,
+            PrincipalOrgID: news.principalOrgID,
+          }).pipe(
+            Effect.catchTag("ResourceConflictException", () =>
+              Effect.gen(function* () {
+                yield* Lambda.removePermission({
+                  FunctionName: news.functionName,
+                  StatementId: statementId,
+                }).pipe(
+                  Effect.catchTag(
+                    "ResourceNotFoundException",
+                    () => Effect.void,
+                  ),
+                );
+                yield* Lambda.addPermission({
+                  FunctionName: news.functionName,
+                  StatementId: statementId,
+                  Action: news.action,
+                  Principal: news.principal,
+                  SourceArn: news.sourceArn,
+                  SourceAccount: news.sourceAccount,
+                  EventSourceToken: news.eventSourceToken,
+                  FunctionUrlAuthType: news.functionUrlAuthType,
+                  InvokedViaFunctionUrl: news.invokedViaFunctionUrl,
+                  PrincipalOrgID: news.principalOrgID,
+                });
+              }),
+            ),
+          );
+
+          yield* session.note(
+            `Permission ${statementId} on ${news.functionName}`,
+          );
+
+          return {
+            statementId,
+            functionName: news.functionName,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* Lambda.removePermission({
+            FunctionName: output.functionName,
+            StatementId: output.statementId,
+          }).pipe(
+            Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/QueueEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/QueueEventSource.ts
new file mode 100644
index 00000000000..39bd52bb708
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/QueueEventSource.ts
@@ -0,0 +1,96 @@
+import type lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import * as Binding from "../../Binding.ts";
+import type { Queue } from "../SQS/Queue.ts";
+import {
+  QueueEventSource as SQSQueueEventSource,
+  type QueueEventSourceProps,
+  type SQSRecord,
+} from "../SQS/QueueEventSource.ts";
+import { EventSourceMapping } from "./EventSourceMapping.ts";
+import * as Lambda from "./Function.ts";
+
+export const isSQSEvent = (event: any): event is lambda.SQSEvent =>
+  Array.isArray(event?.Records) &&
+  event.Records.length > 0 &&
+  event.Records[0].eventSource === "aws:sqs";
+
+export const QueueEventSource = Layer.effect(
+  SQSQueueEventSource,
+  // @ts-expect-error
+  Effect.gen(function* () {
+    const host = yield* Lambda.Function;
+    const Policy = yield* QueueEventSourcePolicy;
+
+    return Effect.fn(function* <StreamReq = never, Req = never>(
+      queue: Queue,
+      props: QueueEventSourceProps,
+      process: (
+        stream: Stream.Stream<SQSRecord, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req | StreamReq>,
+    ) {
+      yield* Policy(queue, props);
+
+      yield* host.listen(
+        Effect.gen(function* () {
+          return (event: any) => {
+            if (isSQSEvent(event)) {
+              const eff = process(Stream.fromArray(event.Records)).pipe(
+                Effect.orDie,
+              );
+              return eff;
+            }
+          };
+        }),
+      );
+    });
+  }),
+);
+
+export class QueueEventSourcePolicy extends Binding.Policy<
+  QueueEventSourcePolicy,
+  (queue: Queue, props: QueueEventSourceProps) => Effect.Effect<void>
+>()("AWS.SQS.QueueEventSourcePolicy") {}
+
+export const QueueEventSourcePolicyLive = QueueEventSourcePolicy.layer.effect(
+  Effect.gen(function* () {
+    const Mapping = yield* EventSourceMapping;
+
+    return Effect.fn(function* (host, queue, props) {
+      if (Lambda.isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Lambda.QueueEventSource(${queue}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "sqs:ReceiveMessage",
+                  "sqs:DeleteMessage",
+                  "sqs:GetQueueAttributes",
+                ],
+                Resource: [queue.queueArn],
+              },
+            ],
+          },
+        );
+
+        yield* Mapping(`${queue.LogicalId}-EventSource`, {
+          functionName: host.functionName,
+          eventSourceArn: queue.queueArn,
+          batchSize: props.batchSize,
+          maximumBatchingWindowInSeconds: props.maximumBatchingWindowInSeconds,
+          enabled: true,
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `QueueEventSourcePolicy does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/StreamEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/StreamEventSource.ts
new file mode 100644
index 00000000000..c3125bfe1a5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/StreamEventSource.ts
@@ -0,0 +1,123 @@
+import type lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { Stream as KinesisStream } from "../Kinesis/Stream.ts";
+import {
+  StreamEventSource as KinesisStreamEventSource,
+  type KinesisEventRecord,
+  type StreamEventSourceProps,
+  type StreamEventSourceService,
+} from "../Kinesis/StreamEventSource.ts";
+import { EventSourceMapping } from "./EventSourceMapping.ts";
+import * as Lambda from "./Function.ts";
+
+export const isKinesisStreamEvent = (
+  event: any,
+): event is lambda.KinesisStreamEvent =>
+  Array.isArray(event?.Records) &&
+  event.Records.length > 0 &&
+  event.Records[0].eventSource === "aws:kinesis";
+
+export const StreamEventSource = Layer.effect(
+  KinesisStreamEventSource,
+  Effect.gen(function* () {
+    const host = yield* Lambda.Function;
+    const bind = yield* StreamEventSourcePolicy;
+
+    return Effect.fn(function* <StreamReq = never, Req = never>(
+      stream: KinesisStream,
+      props: StreamEventSourceProps,
+      process: (
+        stream: Stream.Stream<KinesisEventRecord, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) {
+      const StreamArn = yield* stream.streamArn;
+
+      yield* bind(stream, props);
+
+      yield* host.listen(
+        Effect.gen(function* () {
+          const streamArn = yield* StreamArn;
+
+          return (event: any) => {
+            if (isKinesisStreamEvent(event)) {
+              const records = event.Records.filter(
+                (record) =>
+                  record.eventSourceARN?.startsWith(streamArn) === true,
+              );
+              if (records.length > 0) {
+                return process(
+                  Stream.fromArray(records as KinesisEventRecord[]),
+                ).pipe(Effect.orDie);
+              }
+            }
+          };
+        }),
+      );
+    }) as StreamEventSourceService;
+  }),
+);
+
+export class StreamEventSourcePolicy extends Binding.Policy<
+  StreamEventSourcePolicy,
+  (stream: KinesisStream, props: StreamEventSourceProps) => Effect.Effect<void>
+>()("AWS.Kinesis.StreamEventSource") {}
+
+export const StreamEventSourcePolicyLive = StreamEventSourcePolicy.layer.effect(
+  Effect.gen(function* () {
+    const Mapping = yield* EventSourceMapping;
+
+    return Effect.fn(function* (host, stream, props) {
+      if (Lambda.isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.Lambda.StreamEventSource(${stream}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "kinesis:DescribeStream",
+                  "kinesis:GetRecords",
+                  "kinesis:GetShardIterator",
+                  "kinesis:ListShards",
+                ],
+                Resource: [stream.streamArn],
+              },
+            ],
+          },
+        );
+
+        yield* Mapping(
+          `AWS.Lambda.EventSourceMapping(${host.LogicalId}, ${stream.LogicalId})`,
+          {
+            functionName: host.functionName,
+            eventSourceArn: stream.streamArn,
+            batchSize: props.batchSize,
+            maximumBatchingWindowInSeconds:
+              props.maximumBatchingWindowInSeconds,
+            enabled: true,
+            startingPosition: props.startingPosition ?? "LATEST",
+            startingPositionTimestamp: props.startingPositionTimestamp,
+            parallelizationFactor: props.parallelizationFactor,
+            bisectBatchOnFunctionError: props.bisectBatchOnFunctionError,
+            maximumRecordAgeInSeconds: props.maximumRecordAgeInSeconds,
+            maximumRetryAttempts: props.maximumRetryAttempts,
+            tumblingWindowInSeconds: props.tumblingWindowInSeconds,
+            functionResponseTypes: props.functionResponseTypes,
+            destinationConfig: props.destinationConfig,
+            filterCriteria: props.filterCriteria,
+            kmsKeyArn: props.kmsKeyArn,
+            metricsConfig: props.metricsConfig,
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `StreamEventSourcePolicy does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/TableEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/TableEventSource.ts
new file mode 100644
index 00000000000..db705f92b95
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/TableEventSource.ts
@@ -0,0 +1,156 @@
+import type lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import {
+  TableEventSource as DynamoDBTableEventSource,
+  type StreamRecord,
+  type StreamsProps,
+  type TableEventSourceService,
+} from "../DynamoDB/Stream.ts";
+
+import type { Table } from "../DynamoDB/Table.ts";
+import { EventSourceMapping } from "./EventSourceMapping.ts";
+import * as Lambda from "./Function.ts";
+
+export const isDynamoDBStreamEvent = (
+  event: any,
+): event is lambda.DynamoDBStreamEvent =>
+  Array.isArray(event?.Records) &&
+  event.Records.length > 0 &&
+  event.Records[0].eventSource === "aws:dynamodb";
+
+export const TableEventSource = Layer.effect(
+  DynamoDBTableEventSource,
+  Effect.gen(function* () {
+    const host = yield* Lambda.Function;
+    const bind = yield* TableEventSourcePolicy;
+
+    return Effect.fn(function* <Data = unknown, StreamReq = never, Req = never>(
+      table: Table,
+      props: StreamsProps,
+      process: (
+        stream: Stream.Stream<StreamRecord<Data>, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) {
+      const TableArn = yield* table.tableArn;
+
+      yield* bind(table, props);
+
+      yield* host.listen(
+        Effect.gen(function* () {
+          const tableArn = yield* TableArn;
+          const streamArnPrefix = `${tableArn}/stream/`;
+
+          return (event: any) => {
+            if (isDynamoDBStreamEvent(event)) {
+              const records = event.Records.filter(
+                (record) =>
+                  record.eventSourceARN?.startsWith(streamArnPrefix) === true,
+              );
+              if (records.length > 0) {
+                return process(
+                  Stream.fromArray(records as StreamRecord<Data>[]),
+                ).pipe(Effect.orDie);
+              }
+            }
+          };
+        }),
+      );
+    }) as TableEventSourceService;
+  }),
+);
+
+export class TableEventSourcePolicy extends Binding.Policy<
+  TableEventSourcePolicy,
+  (table: Table, props: StreamsProps) => Effect.Effect<void>
+>()("AWS.DynamoDB.TableEventSource") {}
+
+export const TableEventSourcePolicyLive = TableEventSourcePolicy.layer.effect(
+  Effect.gen(function* () {
+    const Mapping = yield* EventSourceMapping;
+
+    return Effect.fn(function* (host, table, props) {
+      if (Lambda.isFunction(host)) {
+        const latestStreamArn = table.latestStreamArn.pipe(
+          Output.mapEffect((arn) =>
+            typeof arn === "string"
+              ? Effect.succeed(arn)
+              : Effect.die(`latestStreamArn is not a string: ${arn}`),
+          ),
+        );
+
+        const streamViewType = props.streamViewType ?? "NEW_AND_OLD_IMAGES";
+
+        yield* Effect.logInfo(
+          `Lambda TableEventSource: binding stream ${streamViewType} for ${table.LogicalId}`,
+        );
+        yield* table.bind`AWS.DynamoDB.Stream(${host}, ${table}, ${streamViewType})`(
+          {
+            streamSpecification: {
+              StreamEnabled: true,
+              StreamViewType: streamViewType,
+            },
+          },
+        );
+
+        yield* Effect.logInfo(
+          `Lambda TableEventSourcePolicy: creating mapping for ${host.LogicalId} <- ${table.LogicalId}`,
+        );
+
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.Table.ReadStream(${table}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "dynamodb:DescribeStream",
+                  "dynamodb:GetRecords",
+                  "dynamodb:GetShardIterator",
+                ],
+                Resource: [latestStreamArn],
+              },
+            ],
+          },
+        );
+
+        yield* host.bind`Allow(${host}, AWS.DynamoDB.ListStreams(${table}))`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["dynamodb:ListStreams"],
+              Resource: [table.tableArn],
+            },
+          ],
+        });
+
+        yield* Mapping(
+          `AWS.Lambda.EventSourceMapping(${host.LogicalId}, ${table.LogicalId})`,
+          {
+            functionName: host.functionName,
+            eventSourceArn: latestStreamArn,
+            batchSize: props.batchSize,
+            maximumBatchingWindowInSeconds:
+              props.maximumBatchingWindowInSeconds,
+            enabled: true,
+            startingPosition: props.startingPosition ?? "LATEST",
+            startingPositionTimestamp: props.startingPositionTimestamp,
+            parallelizationFactor: props.parallelizationFactor,
+            bisectBatchOnFunctionError: props.bisectBatchOnFunctionError,
+            maximumRecordAgeInSeconds: props.maximumRecordAgeInSeconds,
+            maximumRetryAttempts: props.maximumRetryAttempts,
+            tumblingWindowInSeconds: props.tumblingWindowInSeconds,
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `TableEventSourcePolicy does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/TopicEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/TopicEventSource.ts
new file mode 100644
index 00000000000..c6e59a97f91
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/TopicEventSource.ts
@@ -0,0 +1,105 @@
+import type lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import { Subscription as SNSSubscription } from "../SNS/Subscription.ts";
+import type { Topic } from "../SNS/Topic.ts";
+import {
+  TopicEventSource as SNSTopicEventSource,
+  type TopicEventSourceProps,
+  type TopicEventSourceService,
+  type TopicNotification,
+} from "../SNS/TopicEventSource.ts";
+import * as Lambda from "./Function.ts";
+import { Permission as LambdaPermission } from "./Permission.ts";
+
+export const isSNSEvent = (event: any): event is lambda.SNSEvent =>
+  Array.isArray(event?.Records) &&
+  event.Records.some((record: any) => record.EventSource === "aws:sns");
+
+export const TopicEventSource = Layer.effect(
+  SNSTopicEventSource,
+  Effect.gen(function* () {
+    const host = yield* Lambda.Function;
+    const bind = yield* TopicEventSourcePolicy;
+
+    return Effect.fn(function* <StreamReq = never, Req = never>(
+      topic: Topic,
+      props: TopicEventSourceProps,
+      process: (
+        stream: Stream.Stream<TopicNotification, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) {
+      const TopicArn = yield* topic.topicArn;
+
+      yield* bind(topic, props);
+
+      yield* host.listen(
+        Effect.gen(function* () {
+          const topicArn = yield* TopicArn;
+
+          return (event: any) => {
+            if (isSNSEvent(event)) {
+              const records = event.Records.filter(
+                (record) => record.Sns?.TopicArn === topicArn,
+              );
+
+              if (records.length > 0) {
+                return process(
+                  Stream.fromArray(
+                    records.map((record) => record.Sns as TopicNotification),
+                  ),
+                ).pipe(Effect.orDie);
+              }
+            }
+          };
+        }),
+      );
+    }) as TopicEventSourceService;
+  }),
+);
+
+export class TopicEventSourcePolicy extends Binding.Policy<
+  TopicEventSourcePolicy,
+  (topic: Topic, props?: TopicEventSourceProps) => Effect.Effect<void>
+>()("AWS.SNS.TopicEventSource") {}
+
+export const TopicEventSourcePolicyLive = TopicEventSourcePolicy.layer.effect(
+  Effect.gen(function* () {
+    const Permission = yield* LambdaPermission;
+    const Subscription = yield* SNSSubscription;
+
+    return Effect.fn(function* (
+      host,
+      topic,
+      props: TopicEventSourceProps = {},
+    ) {
+      if (Lambda.isFunction(host)) {
+        yield* Permission(`AWS.Lambda.InvokeFunction(${topic.LogicalId})`, {
+          action: "lambda:InvokeFunction",
+          functionName: host.functionName,
+          principal: "sns.amazonaws.com",
+          sourceArn: topic.topicArn,
+        });
+
+        yield* Subscription(
+          `AWS.SNS.Subscription(${topic.LogicalId}, ${host.LogicalId})`,
+          {
+            topicArn: topic.topicArn,
+            protocol: "lambda",
+            endpoint: host.functionArn,
+            attributes: props.attributes,
+            returnSubscriptionArn: true,
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `TopicEventSourcePolicy does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/index.ts
new file mode 100644
index 00000000000..3db36e083e9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Lambda/index.ts
@@ -0,0 +1,13 @@
+export * from "./BucketEventSource.ts";
+export * from "./EventBridgeEventSource.ts";
+export * from "./EventSourceMapping.ts";
+export * from "./Function.ts";
+export * from "./HttpServer.ts";
+export * from "./InvokeFunction.ts";
+export * from "./Permission.ts";
+export * from "./QueueEventSource.ts";
+export * from "./StreamEventSource.ts";
+export * from "./TableEventSource.ts";
+export * from "./TopicEventSource.ts";
+
+export type { Context } from "aws-lambda";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Logs/LogGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Logs/LogGroup.ts
new file mode 100644
index 00000000000..51154d9df22
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Logs/LogGroup.ts
@@ -0,0 +1,230 @@
+import * as logs from "@distilled.cloud/aws/cloudwatch-logs";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import { AWSEnvironment } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type LogGroupName = string;
+export type LogGroupArn =
+  `arn:aws:logs:${RegionID}:${AccountID}:log-group:${LogGroupName}`;
+
+export interface LogGroupProps {
+  /**
+   * Name of the log group. If omitted, a unique name is generated.
+   */
+  logGroupName?: string;
+  /**
+   * Retention in days. If omitted, CloudWatch keeps logs indefinitely.
+   */
+  retentionInDays?: number;
+  /**
+   * Optional KMS key identifier used to encrypt the log group.
+   */
+  kmsKeyId?: string;
+  /**
+   * User-defined tags to apply to the log group.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface LogGroup extends Resource<
+  "AWS.Logs.LogGroup",
+  LogGroupProps,
+  {
+    logGroupName: LogGroupName;
+    logGroupArn: LogGroupArn;
+    retentionInDays?: number;
+    kmsKeyId?: string;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A CloudWatch Logs log group.
+ *
+ * @section Creating Log Groups
+ * @example ECS Task Log Group
+ * ```typescript
+ * const logs = yield* LogGroup("TaskLogs", {
+ *   retentionInDays: 7,
+ * });
+ * ```
+ */
+export const LogGroup = Resource<LogGroup>("AWS.Logs.LogGroup");
+
+export const LogGroupProvider = () =>
+  Provider.effect(
+    LogGroup,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+
+      const toLogGroupName = (
+        id: string,
+        props: { logGroupName?: string } = {},
+      ) =>
+        props.logGroupName
+          ? Effect.succeed(props.logGroupName)
+          : createPhysicalName({ id, maxLength: 512 });
+
+      return {
+        stables: ["logGroupArn", "logGroupName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toLogGroupName(id, olds ?? {})) !==
+            (yield* toLogGroupName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const logGroupName =
+            output?.logGroupName ?? (yield* toLogGroupName(id, olds ?? {}));
+          const described = yield* logs.describeLogGroups({
+            logGroupNamePrefix: logGroupName,
+            limit: 1,
+          });
+          const match = (described.logGroups ?? []).find(
+            (group) => group.logGroupName === logGroupName,
+          );
+          if (!match?.arn) {
+            return undefined;
+          }
+          return {
+            logGroupName,
+            logGroupArn: match.arn as LogGroupArn,
+            retentionInDays: match.retentionInDays,
+            kmsKeyId: match.kmsKeyId,
+            tags: output?.tags ?? {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const logGroupName =
+            output?.logGroupName ?? (yield* toLogGroupName(id, news));
+          const arn = (output?.logGroupArn ??
+            `arn:aws:logs:${region}:${accountId}:log-group:${logGroupName}`) as LogGroupArn;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live state. `describeLogGroups` returns
+          // retention/kms info so we can diff against desired without
+          // trusting `olds` or `output`.
+          const described = yield* logs.describeLogGroups({
+            logGroupNamePrefix: logGroupName,
+            limit: 1,
+          });
+          let observed = (described.logGroups ?? []).find(
+            (group) => group.logGroupName === logGroupName,
+          );
+
+          // Ensure — create if missing. `createLogGroup` accepts tags and
+          // kmsKeyId on first create; tolerate `ResourceAlreadyExistsException`
+          // (race with peer reconciler) and re-read.
+          if (!observed?.arn) {
+            yield* logs
+              .createLogGroup({
+                logGroupName,
+                kmsKeyId: news.kmsKeyId,
+                tags: desiredTags,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "ResourceAlreadyExistsException",
+                  () => Effect.void,
+                ),
+              );
+            const reread = yield* logs.describeLogGroups({
+              logGroupNamePrefix: logGroupName,
+              limit: 1,
+            });
+            observed = (reread.logGroups ?? []).find(
+              (group) => group.logGroupName === logGroupName,
+            );
+          }
+
+          // Sync retention — observed ↔ desired.
+          const observedRetention = observed?.retentionInDays;
+          if (news.retentionInDays !== observedRetention) {
+            if (news.retentionInDays === undefined) {
+              yield* logs
+                .deleteRetentionPolicy({
+                  logGroupName,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "ResourceNotFoundException",
+                    () => Effect.void,
+                  ),
+                );
+            } else {
+              yield* logs.putRetentionPolicy({
+                logGroupName,
+                retentionInDays: news.retentionInDays,
+              });
+            }
+          }
+
+          // Sync tags — list observed tags then diff against desired so
+          // adoption rewrites ownership tags correctly.
+          const observedTags = yield* logs
+            .listTagsForResource({ resourceArn: arn })
+            .pipe(
+              Effect.map(
+                (r): Record<string, string> =>
+                  Object.fromEntries(
+                    Object.entries(r.tags ?? {}).filter(
+                      (entry): entry is [string, string] =>
+                        typeof entry[1] === "string",
+                    ),
+                  ),
+              ),
+              Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+            );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0) {
+            yield* logs.tagResource({
+              resourceArn: arn,
+              tags: Object.fromEntries(
+                upsert.map((tag) => [tag.Key, tag.Value]),
+              ),
+            });
+          }
+          if (removed.length > 0) {
+            yield* logs.untagResource({
+              resourceArn: arn,
+              tagKeys: removed,
+            });
+          }
+
+          yield* session.note(arn);
+
+          return {
+            logGroupName,
+            logGroupArn: arn,
+            retentionInDays: news.retentionInDays,
+            kmsKeyId: news.kmsKeyId,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* logs
+            .deleteLogGroup({
+              logGroupName: output.logGroupName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Logs/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Logs/index.ts
new file mode 100644
index 00000000000..84a8a9dfdbc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Logs/index.ts
@@ -0,0 +1 @@
+export { LogGroup, LogGroupProvider } from "./LogGroup.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Account.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Account.ts
new file mode 100644
index 00000000000..fc414b51b0f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Account.ts
@@ -0,0 +1,322 @@
+import * as accountManagement from "@distilled.cloud/aws/account";
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  collectPages,
+  readResourceTags,
+  retryOrganizations,
+  updateResourceTags,
+} from "./common.ts";
+
+export type AccountId = string;
+export type AccountArn = string;
+
+export interface AccountProps {
+  /**
+   * Account email. Must be globally unique across AWS accounts.
+   */
+  email: string;
+  /**
+   * Friendly account name.
+   */
+  name: string;
+  /**
+   * Parent root or OU ID.
+   */
+  parentId: string;
+  /**
+   * Optional cross-account access role name created during account vending.
+   */
+  roleName?: string;
+  /**
+   * Whether IAM users can access billing information.
+   */
+  iamUserAccessToBilling?: organizations.IAMUserAccessToBilling;
+  /**
+   * Optional tags applied to the member account while it remains in the org.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Account extends Resource<
+  "AWS.Organizations.Account",
+  AccountProps,
+  {
+    accountId: AccountId;
+    accountArn: AccountArn;
+    name: organizations.Account["Name"] | undefined;
+    email: organizations.Account["Email"] | undefined;
+    parentId: string | undefined;
+    status: organizations.AccountStatus | undefined;
+    state: organizations.AccountState | undefined;
+    joinedMethod: organizations.AccountJoinedMethod | undefined;
+    joinedTimestamp: Date | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A member account created and managed by AWS Organizations.
+ */
+export const Account = Resource<Account>("AWS.Organizations.Account");
+
+export const AccountProvider = () =>
+  Provider.effect(
+    Account,
+    Effect.gen(function* () {
+      return {
+        stables: ["accountId", "accountArn", "joinedMethod", "joinedTimestamp"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds?.email !== news.email) {
+            return { action: "replace" } as const;
+          }
+          if (olds?.name !== news.name) {
+            return { action: "update" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const state = output?.accountId
+            ? yield* readAccountById(output.accountId)
+            : olds
+              ? yield* readAccountByNameOrEmail({
+                  name: olds.name,
+                  email: olds.email,
+                })
+              : undefined;
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — locate the account by ID if known, else by
+          // name/email. We always fetch fresh: state persistence may have
+          // failed after a prior `createAccount`, leaving an account on AWS
+          // we have no record of.
+          let state = output?.accountId
+            ? yield* readAccountById(output.accountId)
+            : yield* readAccountByNameOrEmail({
+                name: news.name,
+                email: news.email,
+              });
+
+          // Ensure — create the account if it doesn't exist. Account
+          // creation is asynchronous: `createAccount` returns a
+          // `CreateAccountStatus` which we poll until the account ID is
+          // assigned (or the request fails).
+          if (!state) {
+            const createResponse = yield* retryOrganizations(
+              organizations.createAccount({
+                Email: news.email,
+                AccountName: news.name,
+                RoleName: news.roleName,
+                IamUserAccessToBilling: news.iamUserAccessToBilling,
+              }),
+            );
+
+            const requestId = createResponse.CreateAccountStatus?.Id;
+            if (requestId) {
+              const status = yield* waitForCreateAccount(requestId);
+              yield* session.note(status.AccountId ?? requestId);
+            }
+
+            state = yield* readAccountByNameOrEmail({
+              name: news.name,
+              email: news.email,
+            });
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(`account '${news.name}' not found after create`),
+              );
+            }
+          }
+
+          // Sync name — observed ↔ desired. Account name lives on the
+          // account-management service, not Organizations. The diff has
+          // already short-circuited any email change as a replacement.
+          if (state.name !== news.name) {
+            yield* retryAccountManagement(
+              accountManagement.putAccountName({
+                AccountId: state.accountId,
+                AccountName: news.name,
+              }),
+            );
+          }
+
+          // Sync parent — move the account if its observed parent differs
+          // from desired. We only move when we know the source parent (the
+          // API requires it).
+          if (state.parentId && state.parentId !== news.parentId) {
+            yield* retryOrganizations(
+              organizations.moveAccount({
+                AccountId: state.accountId,
+                SourceParentId: state.parentId,
+                DestinationParentId: news.parentId,
+              }),
+            );
+          }
+
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption and drift converge. We baseline against `state.tags`
+          // (fetched fresh) instead of stale `olds`.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceId: state.accountId,
+            olds: state.tags,
+            news: news.tags,
+          });
+
+          const updated = yield* readAccountById(state.accountId);
+          if (!updated) {
+            return yield* Effect.fail(
+              new Error(
+                `account '${state.accountId}' not found after reconcile`,
+              ),
+            );
+          }
+
+          yield* session.note(updated.accountArn);
+          return {
+            ...updated,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryOrganizations(
+            organizations
+              .removeAccountFromOrganization({
+                AccountId: output.accountId,
+              })
+              .pipe(
+                Effect.catchTags({
+                  AccountNotFoundException: () => Effect.void,
+                  AWSOrganizationsNotInUseException: () => Effect.void,
+                }),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const listAccounts = () =>
+  collectPages(
+    (NextToken) => organizations.listAccounts({ NextToken }),
+    (page) => page.Accounts,
+  ).pipe(retryOrganizations);
+
+const readParentId = (childId: string) =>
+  collectPages(
+    (NextToken) => organizations.listParents({ ChildId: childId, NextToken }),
+    (page) => page.Parents,
+  ).pipe(
+    retryOrganizations,
+    Effect.map((parents) => parents[0]?.Id),
+    Effect.catchTag("ChildNotFoundException", () => Effect.succeed(undefined)),
+  );
+
+const readAccountById = Effect.fn(function* (accountId: string) {
+  const described = yield* retryOrganizations(
+    organizations.describeAccount({ AccountId: accountId }).pipe(
+      Effect.map((response) => response.Account),
+      Effect.catchTag("AccountNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    ),
+  );
+
+  if (!described?.Id || !described.Arn) {
+    return undefined;
+  }
+
+  const [parentId, tags] = yield* Effect.all([
+    readParentId(described.Id),
+    readResourceTags(described.Id).pipe(
+      Effect.catchTag("TargetNotFoundException", () => Effect.succeed({})),
+    ),
+  ]);
+
+  return {
+    accountId: described.Id,
+    accountArn: described.Arn,
+    name: described.Name,
+    email: described.Email,
+    parentId,
+    status: described.Status,
+    state: described.State,
+    joinedMethod: described.JoinedMethod,
+    joinedTimestamp: described.JoinedTimestamp,
+    tags,
+  } satisfies Account["Attributes"];
+});
+
+const readAccountByNameOrEmail = Effect.fn(function* ({
+  name,
+  email,
+}: Pick<AccountProps, "name" | "email">) {
+  const accounts = yield* listAccounts();
+  const match = accounts.find(
+    (candidate) => candidate.Name === name || candidate.Email === email,
+  );
+  return match?.Id ? yield* readAccountById(match.Id) : undefined;
+});
+
+const waitForCreateAccount = (requestId: string) =>
+  Effect.gen(function* () {
+    const status = yield* retryOrganizations(
+      organizations
+        .describeCreateAccountStatus({
+          CreateAccountRequestId: requestId,
+        })
+        .pipe(Effect.map((response) => response.CreateAccountStatus)),
+    );
+
+    if (!status?.State || status.State === "IN_PROGRESS") {
+      return yield* Effect.fail({ _tag: "CreateAccountInProgress" as const });
+    }
+
+    if (status.State === "FAILED") {
+      return yield* Effect.fail(
+        new Error(
+          `account creation failed: ${status.FailureReason ?? "unknown failure"}`,
+        ),
+      );
+    }
+
+    if (!status.AccountId) {
+      return yield* Effect.fail(
+        new Error("account creation succeeded without AccountId"),
+      );
+    }
+
+    return status;
+  }).pipe(
+    Effect.retry({
+      while: (error: any) => error?._tag === "CreateAccountInProgress",
+      schedule: Schedule.spaced("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(120)),
+      ),
+    }),
+  );
+
+const retryAccountManagement = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.retry({
+      while: (error: any) =>
+        error?._tag === "TooManyRequestsException" ||
+        error?._tag === "InternalServerException",
+      schedule: Schedule.exponential(200).pipe(
+        Schedule.both(Schedule.recurs(8)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/DelegatedAdministrator.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/DelegatedAdministrator.ts
new file mode 100644
index 00000000000..8e72cbdc908
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/DelegatedAdministrator.ts
@@ -0,0 +1,166 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { collectPages, retryOrganizations } from "./common.ts";
+
+export interface DelegatedAdministratorProps {
+  /**
+   * Member account registered as delegated administrator.
+   */
+  accountId: string;
+  /**
+   * Service principal delegated to the account.
+   */
+  servicePrincipal: string;
+}
+
+export interface DelegatedAdministrator extends Resource<
+  "AWS.Organizations.DelegatedAdministrator",
+  DelegatedAdministratorProps,
+  {
+    accountId: string;
+    accountArn: string | undefined;
+    accountName: organizations.DelegatedAdministrator["Name"] | undefined;
+    accountEmail: organizations.DelegatedAdministrator["Email"] | undefined;
+    servicePrincipal: string;
+    delegationEnabledDate: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Registers a delegated administrator account for a trusted AWS service.
+ */
+export const DelegatedAdministrator = Resource<DelegatedAdministrator>(
+  "AWS.Organizations.DelegatedAdministrator",
+);
+
+export const DelegatedAdministratorProvider = () =>
+  Provider.effect(
+    DelegatedAdministrator,
+    Effect.gen(function* () {
+      return {
+        stables: ["accountId", "servicePrincipal"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            olds?.accountId !== news.accountId ||
+            olds?.servicePrincipal !== news.servicePrincipal
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          return yield* readDelegatedAdministrator({
+            accountId: output?.accountId ?? olds!.accountId,
+            servicePrincipal:
+              output?.servicePrincipal ?? olds!.servicePrincipal,
+          });
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — look up the live delegation. Replacement-only props
+          // (`accountId`, `servicePrincipal`) mean the diff handles identity
+          // changes; we just check whether the registration exists.
+          let state = yield* readDelegatedAdministrator(news);
+
+          // Ensure — register if missing. Tolerate
+          // `AccountAlreadyRegisteredException` for idempotency under races
+          // between observe and register.
+          if (!state) {
+            yield* retryOrganizations(
+              organizations
+                .registerDelegatedAdministrator({
+                  AccountId: news.accountId,
+                  ServicePrincipal: news.servicePrincipal,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "AccountAlreadyRegisteredException",
+                    () => Effect.void,
+                  ),
+                ),
+            );
+            state = yield* readDelegatedAdministrator(news);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `delegated administrator '${news.accountId}' for '${news.servicePrincipal}' not found after create`,
+                ),
+              );
+            }
+          }
+
+          yield* session.note(`${state.accountId}:${state.servicePrincipal}`);
+          return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (
+            !(yield* readDelegatedAdministrator({
+              accountId: output.accountId,
+              servicePrincipal: output.servicePrincipal,
+            }))
+          ) {
+            return;
+          }
+
+          yield* retryOrganizations(
+            organizations.deregisterDelegatedAdministrator({
+              AccountId: output.accountId,
+              ServicePrincipal: output.servicePrincipal,
+            }),
+          );
+        }),
+      };
+    }),
+  );
+
+const readDelegatedAdministrator = Effect.fn(function* ({
+  accountId,
+  servicePrincipal,
+}: DelegatedAdministratorProps) {
+  const [delegatedServices, delegatedAdmins] = yield* Effect.all([
+    retryOrganizations(
+      collectPages(
+        (NextToken) =>
+          organizations.listDelegatedServicesForAccount({
+            AccountId: accountId,
+            NextToken,
+          }),
+        (page) => page.DelegatedServices,
+      ),
+    ),
+    retryOrganizations(
+      collectPages(
+        (NextToken) =>
+          organizations.listDelegatedAdministrators({
+            ServicePrincipal: servicePrincipal,
+            NextToken,
+          }),
+        (page) => page.DelegatedAdministrators,
+      ),
+    ),
+  ]);
+
+  const service = delegatedServices.find(
+    (candidate) => candidate.ServicePrincipal === servicePrincipal,
+  );
+  const account = delegatedAdmins.find(
+    (candidate) => candidate.Id === accountId,
+  );
+
+  return service && account
+    ? ({
+        accountId,
+        accountArn: account.Arn,
+        accountName: account.Name,
+        accountEmail: account.Email,
+        servicePrincipal,
+        delegationEnabledDate:
+          service.DelegationEnabledDate ?? account.DelegationEnabledDate,
+      } satisfies DelegatedAdministrator["Attributes"])
+    : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Organization.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Organization.ts
new file mode 100644
index 00000000000..b5b72d09bec
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Organization.ts
@@ -0,0 +1,183 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { retryOrganizations } from "./common.ts";
+
+export type OrganizationId = string;
+export type OrganizationArn = string;
+
+export interface OrganizationProps {
+  /**
+   * Organization feature set.
+   * `ALL` unlocks the full AWS Organizations feature set.
+   * @default "ALL"
+   */
+  featureSet?: organizations.OrganizationFeatureSet;
+}
+
+export interface Organization extends Resource<
+  "AWS.Organizations.Organization",
+  OrganizationProps,
+  {
+    organizationId: OrganizationId;
+    organizationArn: OrganizationArn;
+    featureSet: organizations.OrganizationFeatureSet | undefined;
+    managementAccountArn: string | undefined;
+    managementAccountId: string | undefined;
+    managementAccountEmail:
+      | organizations.Organization["MasterAccountEmail"]
+      | undefined;
+    availablePolicyTypes: organizations.PolicyTypeSummary[];
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * The AWS Organization for the current management account.
+ *
+ * This is a singleton-style resource. If an organization already exists,
+ * Alchemy adopts and reconciles it instead of creating a second one.
+ *
+ * @section Creating An Organization
+ * @example Full Features Organization
+ * ```typescript
+ * const organization = yield* Organization("Org", {
+ *   featureSet: "ALL",
+ * });
+ * ```
+ */
+export const Organization = Resource<Organization>(
+  "AWS.Organizations.Organization",
+);
+
+export const OrganizationProvider = () =>
+  Provider.effect(
+    Organization,
+    Effect.gen(function* () {
+      return {
+        stables: ["organizationId", "organizationArn", "managementAccountId"],
+        diff: Effect.fn(function* () {}),
+        read: Effect.fn(function* () {
+          const org = yield* readOrganization();
+          return org?.Id && org.Arn ? toAttrs(org) : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const desiredFeatureSet = news.featureSet ?? "ALL";
+
+          // Observe — fetch the live singleton organization. There's at most
+          // one organization per management account, and `read` may have
+          // surfaced an existing one for adoption.
+          let org = yield* readOrganization();
+
+          // Ensure — create the organization if it's missing. Tolerate
+          // `AlreadyInOrganizationException` as a race with a concurrent
+          // creator (e.g. another tool, or a peer reconciler).
+          if (!org) {
+            org = yield* retryOrganizations(
+              organizations.createOrganization({
+                FeatureSet: desiredFeatureSet,
+              }),
+            ).pipe(
+              Effect.map((response) => response.Organization),
+              Effect.catchTag("AlreadyInOrganizationException", () =>
+                readOrganization(),
+              ),
+            );
+          }
+
+          if (!org?.Id || !org.Arn) {
+            return yield* Effect.fail(
+              new Error("failed to resolve organization after reconcile"),
+            );
+          }
+
+          const orgArn = org.Arn;
+
+          // Sync feature set — observed ↔ desired. `ensureFeatureSet`
+          // handles the only legal transition (CONSOLIDATED_BILLING -> ALL)
+          // and rejects anything else.
+          org = yield* ensureFeatureSet({
+            desired: desiredFeatureSet,
+            current: org,
+          });
+
+          yield* session.note(orgArn);
+          return toAttrs(org);
+        }),
+        delete: Effect.fn(function* () {
+          yield* retryOrganizations(
+            organizations
+              .deleteOrganization({})
+              .pipe(
+                Effect.catchTag(
+                  "AWSOrganizationsNotInUseException",
+                  () => Effect.void,
+                ),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const toAttrs = (
+  org: organizations.Organization,
+): Organization["Attributes"] => ({
+  organizationId: org.Id ?? "",
+  organizationArn: org.Arn ?? "",
+  featureSet: org.FeatureSet,
+  managementAccountArn: org.MasterAccountArn,
+  managementAccountId: org.MasterAccountId,
+  managementAccountEmail: org.MasterAccountEmail,
+  availablePolicyTypes: org.AvailablePolicyTypes ?? [],
+});
+
+const readOrganization = () =>
+  retryOrganizations(
+    organizations.describeOrganization({}).pipe(
+      Effect.map((response) => response.Organization),
+      Effect.catchTag("AWSOrganizationsNotInUseException", () =>
+        Effect.succeed(undefined),
+      ),
+    ),
+  );
+
+const ensureFeatureSet = Effect.fn(function* ({
+  desired,
+  current,
+}: {
+  desired: organizations.OrganizationFeatureSet | undefined;
+  current: organizations.Organization;
+}) {
+  const desiredFeatureSet = desired ?? "ALL";
+  if (current.FeatureSet === desiredFeatureSet) {
+    return current;
+  }
+
+  if (
+    desiredFeatureSet === "ALL" &&
+    current.FeatureSet === "CONSOLIDATED_BILLING"
+  ) {
+    yield* retryOrganizations(organizations.enableAllFeatures({}));
+
+    const updated = yield* readOrganization();
+    if (updated?.FeatureSet === "ALL") {
+      return updated;
+    }
+
+    return yield* Effect.fail(
+      new Error(
+        "Organization upgrade to ALL features requires handshake completion before deployment can converge",
+      ),
+    );
+  }
+
+  return yield* Effect.fail(
+    new Error(
+      `Organization feature set cannot be changed from '${current.FeatureSet}' to '${desiredFeatureSet}'`,
+    ),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/OrganizationResourcePolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/OrganizationResourcePolicy.ts
new file mode 100644
index 00000000000..f6a440c9dda
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/OrganizationResourcePolicy.ts
@@ -0,0 +1,114 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import { retryOrganizations } from "./common.ts";
+
+export interface OrganizationResourcePolicyProps {
+  /**
+   * Typed resource policy document for the organization.
+   */
+  document: PolicyDocument;
+}
+
+export interface OrganizationResourcePolicy extends Resource<
+  "AWS.Organizations.OrganizationResourcePolicy",
+  OrganizationResourcePolicyProps,
+  {
+    resourcePolicyId: string;
+    resourcePolicyArn: string;
+    document: PolicyDocument;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * The singleton AWS Organizations resource policy.
+ */
+export const OrganizationResourcePolicy = Resource<OrganizationResourcePolicy>(
+  "AWS.Organizations.OrganizationResourcePolicy",
+);
+
+const readResourcePolicy = () =>
+  retryOrganizations(
+    organizations.describeResourcePolicy({}).pipe(
+      Effect.map((response) => response.ResourcePolicy),
+      Effect.catchTag("ResourcePolicyNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+      Effect.map((policy) => {
+        const summary = policy?.ResourcePolicySummary;
+        return summary?.Id && summary.Arn
+          ? ({
+              resourcePolicyId: summary.Id,
+              resourcePolicyArn: summary.Arn,
+              document: JSON.parse(policy?.Content ?? "{}") as PolicyDocument,
+            } satisfies OrganizationResourcePolicy["Attributes"])
+          : undefined;
+      }),
+    ),
+  );
+
+export const OrganizationResourcePolicyProvider = () =>
+  Provider.effect(
+    OrganizationResourcePolicy,
+    Effect.gen(function* () {
+      return {
+        stables: ["resourcePolicyId", "resourcePolicyArn"],
+        diff: Effect.fn(function* () {}),
+        read: Effect.fn(function* () {
+          return yield* readResourcePolicy();
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const desiredContent = JSON.stringify(news.document);
+
+          // Observe — fetch the live resource policy (or absence).
+          let state = yield* readResourcePolicy();
+
+          // Sync — `putResourcePolicy` is a single upsert that handles both
+          // first-create and update. We diff observed content against
+          // desired so the call only fires when there's drift. Reading by
+          // ID isn't possible (resource is a singleton with a server-issued
+          // ID), so we compare the JSON-stringified document.
+          const observedContent = state
+            ? JSON.stringify(state.document)
+            : undefined;
+
+          if (observedContent !== desiredContent) {
+            yield* retryOrganizations(
+              organizations.putResourcePolicy({
+                Content: desiredContent,
+              }),
+            );
+            state = yield* readResourcePolicy();
+          }
+
+          if (!state) {
+            return yield* Effect.fail(
+              new Error(
+                "organization resource policy not found after reconcile",
+              ),
+            );
+          }
+
+          yield* session.note(state.resourcePolicyArn);
+          return state;
+        }),
+        delete: Effect.fn(function* () {
+          yield* retryOrganizations(
+            organizations
+              .deleteResourcePolicy({})
+              .pipe(
+                Effect.catchTag(
+                  "ResourcePolicyNotFoundException",
+                  () => Effect.void,
+                ),
+              ),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/OrganizationalUnit.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/OrganizationalUnit.ts
new file mode 100644
index 00000000000..b204e453408
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/OrganizationalUnit.ts
@@ -0,0 +1,266 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  collectPages,
+  createName,
+  readResourceTags,
+  retryOrganizations,
+  updateResourceTags,
+} from "./common.ts";
+
+export type OrganizationalUnitId = string;
+export type OrganizationalUnitArn = string;
+
+export interface OrganizationalUnitProps {
+  /**
+   * Parent root or OU ID.
+   */
+  parentId: string;
+  /**
+   * OU name. If omitted, Alchemy generates one.
+   */
+  name?: string;
+  /**
+   * Optional tags applied to the OU.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface OrganizationalUnit extends Resource<
+  "AWS.Organizations.OrganizationalUnit",
+  OrganizationalUnitProps,
+  {
+    ouId: OrganizationalUnitId;
+    ouArn: OrganizationalUnitArn;
+    name: string;
+    parentId: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An AWS Organizations organizational unit.
+ *
+ * @section Creating OUs
+ * @example Nested OU
+ * ```typescript
+ * const workloads = yield* OrganizationalUnit("Workloads", {
+ *   parentId: root.rootId,
+ *   name: "workloads",
+ * });
+ * ```
+ */
+export const OrganizationalUnit = Resource<OrganizationalUnit>(
+  "AWS.Organizations.OrganizationalUnit",
+);
+
+export const OrganizationalUnitProvider = () =>
+  Provider.effect(
+    OrganizationalUnit,
+    Effect.gen(function* () {
+      return {
+        stables: ["ouId", "ouArn"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news ?? {});
+
+          if (olds?.parentId !== news?.parentId) {
+            return { action: "replace" } as const;
+          }
+
+          if (oldName !== newName) {
+            return { action: "update" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const state = output?.ouId
+            ? yield* readOUById(output.ouId)
+            : olds?.parentId
+              ? yield* readOUByParentAndName({
+                  parentId: olds.parentId,
+                  name: yield* toName(id, olds ?? {}),
+                })
+              : undefined;
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* toName(id, news);
+
+          // Observe — locate the OU by ID if known, else by parent+name.
+          // We fetch fresh so the reconciler converges over drift, adoption,
+          // and partial prior runs. `output.ouId` is treated only as a
+          // cache.
+          let state = output?.ouId
+            ? yield* readOUById(output.ouId)
+            : yield* readOUByParentAndName({
+                parentId: news.parentId,
+                name,
+              });
+
+          // Ensure — create the OU if missing. Tolerate
+          // `DuplicateOrganizationalUnitException` as adoption when a peer
+          // reconciler created it concurrently.
+          if (!state) {
+            yield* retryOrganizations(
+              organizations
+                .createOrganizationalUnit({
+                  ParentId: news.parentId,
+                  Name: name,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "DuplicateOrganizationalUnitException",
+                    () => Effect.void,
+                  ),
+                ),
+            );
+            state = yield* readOUByParentAndName({
+              parentId: news.parentId,
+              name,
+            });
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `organizational unit '${name}' not found after create`,
+                ),
+              );
+            }
+          }
+
+          // Sync name — observed ↔ desired. `parentId` is replacement-only,
+          // so the diff has handled any cross-parent move.
+          if (state.name !== name) {
+            yield* retryOrganizations(
+              organizations.updateOrganizationalUnit({
+                OrganizationalUnitId: state.ouId,
+                Name: name,
+              }),
+            );
+          }
+
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption and drift converge correctly without trusting `olds`.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceId: state.ouId,
+            olds: state.tags,
+            news: news.tags,
+          });
+
+          const updated = yield* readOUById(state.ouId);
+          if (!updated) {
+            return yield* Effect.fail(
+              new Error(
+                `organizational unit '${state.ouId}' not found after reconcile`,
+              ),
+            );
+          }
+
+          yield* session.note(updated.ouArn);
+          return {
+            ...updated,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryOrganizations(
+            organizations
+              .deleteOrganizationalUnit({
+                OrganizationalUnitId: output.ouId,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "OrganizationalUnitNotFoundException",
+                  () => Effect.void,
+                ),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const toName = (id: string, props: { name?: string } = {}) =>
+  createName(id, props.name, 128);
+
+const listOUsForParent = (parentId: string) =>
+  collectPages(
+    (NextToken) =>
+      organizations.listOrganizationalUnitsForParent({
+        ParentId: parentId,
+        NextToken,
+      }),
+    (page) => page.OrganizationalUnits,
+  ).pipe(retryOrganizations);
+
+const readParentId = (childId: string) =>
+  collectPages(
+    (NextToken) => organizations.listParents({ ChildId: childId, NextToken }),
+    (page) => page.Parents,
+  ).pipe(
+    retryOrganizations,
+    Effect.map((parents) => parents[0]?.Id),
+  );
+
+const readOUById = Effect.fn(function* (ouId: string) {
+  const described = yield* retryOrganizations(
+    organizations
+      .describeOrganizationalUnit({
+        OrganizationalUnitId: ouId,
+      })
+      .pipe(
+        Effect.map((response) => response.OrganizationalUnit),
+        Effect.catchTag("OrganizationalUnitNotFoundException", () =>
+          Effect.succeed(undefined),
+        ),
+      ),
+  );
+
+  if (!described?.Id || !described.Arn || !described.Name) {
+    return undefined;
+  }
+
+  const [parentId, tags] = yield* Effect.all([
+    readParentId(described.Id).pipe(
+      Effect.catchTag("ChildNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    ),
+    readResourceTags(described.Id).pipe(
+      Effect.catchTag("TargetNotFoundException", () => Effect.succeed({})),
+    ),
+  ]);
+
+  return {
+    ouId: described.Id,
+    ouArn: described.Arn,
+    name: described.Name,
+    parentId,
+    tags,
+  } satisfies OrganizationalUnit["Attributes"];
+});
+
+const readOUByParentAndName = Effect.fn(function* ({
+  parentId,
+  name,
+}: {
+  parentId: string;
+  name: string;
+}) {
+  const match = (yield* listOUsForParent(parentId)).find(
+    (ou) => ou.Name === name,
+  );
+  return match?.Id ? yield* readOUById(match.Id) : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Policy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Policy.ts
new file mode 100644
index 00000000000..9c04d167972
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Policy.ts
@@ -0,0 +1,249 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { hasAlchemyTags } from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import {
+  collectPages,
+  createName,
+  readResourceTags,
+  retryOrganizations,
+  updateResourceTags,
+} from "./common.ts";
+
+export type PolicyId = string;
+export type PolicyArn = string;
+
+export interface PolicyProps {
+  /**
+   * Policy name. If omitted, Alchemy generates one.
+   */
+  name?: string;
+  /**
+   * Policy description.
+   * @default ""
+   */
+  description?: string;
+  /**
+   * Organizations policy type.
+   */
+  type: organizations.PolicyType;
+  /**
+   * Typed policy document.
+   */
+  document: PolicyDocument;
+  /**
+   * Optional tags applied to the policy.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Policy extends Resource<
+  "AWS.Organizations.Policy",
+  PolicyProps,
+  {
+    policyId: PolicyId;
+    policyArn: PolicyArn;
+    name: string;
+    description: string | undefined;
+    type: organizations.PolicyType | undefined;
+    awsManaged: boolean | undefined;
+    document: PolicyDocument;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An AWS Organizations policy such as an SCP or tag policy.
+ */
+export const Policy = Resource<Policy>("AWS.Organizations.Policy");
+
+export const PolicyProvider = () =>
+  Provider.effect(
+    Policy,
+    Effect.gen(function* () {
+      return {
+        stables: ["policyId", "policyArn"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds?.type !== news.type) {
+            return { action: "replace" } as const;
+          }
+
+          const oldName = yield* toName(id, olds ?? {});
+          const newName = yield* toName(id, news);
+          if (oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const state = output?.policyId
+            ? yield* readPolicyById(output.policyId)
+            : olds
+              ? yield* readPolicyByName({
+                  type: olds.type,
+                  name: yield* toName(id, olds),
+                })
+              : undefined;
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = yield* toName(id, news);
+          const desiredDescription = news.description ?? "";
+          const desiredContent = JSON.stringify(news.document);
+
+          // Observe — locate the policy by ID if known, else by type+name.
+          // Both `name` (after generation) and `type` are stable, so `diff`
+          // handles renames as a replacement; here we just look up.
+          let state = output?.policyId
+            ? yield* readPolicyById(output.policyId)
+            : yield* readPolicyByName({
+                type: news.type,
+                name,
+              });
+
+          // Ensure — create the policy if missing. Tolerate
+          // `DuplicatePolicyException` as adoption (a peer reconciler beat
+          // us, or our observation lost a race).
+          if (!state) {
+            yield* retryOrganizations(
+              organizations
+                .createPolicy({
+                  Name: name,
+                  Description: desiredDescription,
+                  Type: news.type,
+                  Content: desiredContent,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "DuplicatePolicyException",
+                    () => Effect.void,
+                  ),
+                ),
+            );
+            state = yield* readPolicyByName({
+              type: news.type,
+              name,
+            });
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(`policy '${name}' not found after create`),
+              );
+            }
+          }
+
+          // Sync description + content — diff observed cloud state against
+          // desired. `updatePolicy` requires `Name`; we keep the existing
+          // policy name (rename triggers replacement at the diff level).
+          const observedDescription = state.description ?? "";
+          const observedContent = JSON.stringify(state.document);
+          if (
+            observedDescription !== desiredDescription ||
+            observedContent !== desiredContent
+          ) {
+            yield* retryOrganizations(
+              organizations.updatePolicy({
+                PolicyId: state.policyId,
+                Name: state.name,
+                Description: desiredDescription,
+                Content: desiredContent,
+              }),
+            );
+          }
+
+          // Sync tags — diff observed cloud tags against desired. Using
+          // `state.tags` (fetched fresh) keeps the reconciler convergent on
+          // adoption and drift.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceId: state.policyId,
+            olds: state.tags,
+            news: news.tags,
+          });
+
+          const updated = yield* readPolicyById(state.policyId);
+          if (!updated) {
+            return yield* Effect.fail(
+              new Error(`policy '${state.policyId}' not found after reconcile`),
+            );
+          }
+
+          yield* session.note(updated.policyArn);
+          return {
+            ...updated,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryOrganizations(
+            organizations
+              .deletePolicy({ PolicyId: output.policyId })
+              .pipe(
+                Effect.catchTag("PolicyNotFoundException", () => Effect.void),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const toName = (id: string, props: { name?: string } = {}) =>
+  createName(id, props.name, 128);
+
+const readPolicyById = Effect.fn(function* (policyId: string) {
+  const described = yield* retryOrganizations(
+    organizations.describePolicy({ PolicyId: policyId }).pipe(
+      Effect.map((response) => response.Policy),
+      Effect.catchTag("PolicyNotFoundException", () =>
+        Effect.succeed(undefined),
+      ),
+    ),
+  );
+
+  const summary = described?.PolicySummary;
+  if (!summary?.Id || !summary.Arn || !summary.Name) {
+    return undefined;
+  }
+
+  const tags = yield* readResourceTags(summary.Id).pipe(
+    Effect.catchTag("TargetNotFoundException", () => Effect.succeed({})),
+  );
+
+  return {
+    policyId: summary.Id,
+    policyArn: summary.Arn,
+    name: summary.Name,
+    description: summary.Description,
+    type: summary.Type,
+    awsManaged: summary.AwsManaged,
+    document: JSON.parse(described?.Content ?? "{}") as PolicyDocument,
+    tags,
+  } satisfies Policy["Attributes"];
+});
+
+const readPolicyByName = Effect.fn(function* ({
+  type,
+  name,
+}: {
+  type: organizations.PolicyType;
+  name: string;
+}) {
+  const policies = yield* retryOrganizations(
+    collectPages(
+      (NextToken) => organizations.listPolicies({ Filter: type, NextToken }),
+      (page) => page.Policies,
+    ),
+  );
+
+  const match = policies.find((policy) => policy.Name === name);
+  return match?.Id ? yield* readPolicyById(match.Id) : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/PolicyAttachment.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/PolicyAttachment.ts
new file mode 100644
index 00000000000..d5f55342d1e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/PolicyAttachment.ts
@@ -0,0 +1,140 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { collectPages, retryOrganizations } from "./common.ts";
+
+export interface PolicyAttachmentProps {
+  /**
+   * Policy to attach.
+   */
+  policyId: string;
+  /**
+   * Target root, OU, or account ID.
+   */
+  targetId: string;
+}
+
+export interface PolicyAttachment extends Resource<
+  "AWS.Organizations.PolicyAttachment",
+  PolicyAttachmentProps,
+  {
+    policyId: string;
+    targetId: string;
+    targetArn: string | undefined;
+    targetName: string | undefined;
+    targetType: organizations.TargetType | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Attaches an Organizations policy to a root, OU, or account.
+ */
+export const PolicyAttachment = Resource<PolicyAttachment>(
+  "AWS.Organizations.PolicyAttachment",
+);
+
+export const PolicyAttachmentProvider = () =>
+  Provider.effect(
+    PolicyAttachment,
+    Effect.gen(function* () {
+      return {
+        stables: ["policyId", "targetId"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            olds?.policyId !== news.policyId ||
+            olds?.targetId !== news.targetId
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          return yield* readAttachment({
+            policyId: output?.policyId ?? olds!.policyId,
+            targetId: output?.targetId ?? olds!.targetId,
+          });
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — list current attachments to see whether ours is present.
+          // The attachment is identity-only; both `policyId` and `targetId`
+          // are stable, so `diff` handles any change as a replacement.
+          let state = yield* readAttachment(news);
+
+          // Ensure — attach if missing. `DuplicatePolicyAttachmentException`
+          // is treated as success (e.g. a peer reconciler attached
+          // concurrently, or our observation lost a race).
+          if (!state) {
+            yield* retryOrganizations(
+              organizations
+                .attachPolicy({
+                  PolicyId: news.policyId,
+                  TargetId: news.targetId,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "DuplicatePolicyAttachmentException",
+                    () => Effect.void,
+                  ),
+                ),
+            );
+            state = yield* readAttachment(news);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `policy attachment '${news.policyId}' -> '${news.targetId}' not found after create`,
+                ),
+              );
+            }
+          }
+
+          yield* session.note(`${state.policyId}:${state.targetId}`);
+          return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryOrganizations(
+            organizations
+              .detachPolicy({
+                PolicyId: output.policyId,
+                TargetId: output.targetId,
+              })
+              .pipe(
+                Effect.catchTags({
+                  PolicyNotAttachedException: () => Effect.void,
+                  PolicyNotFoundException: () => Effect.void,
+                  TargetNotFoundException: () => Effect.void,
+                }),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const readAttachment = Effect.fn(function* ({
+  policyId,
+  targetId,
+}: PolicyAttachmentProps) {
+  const targets = yield* retryOrganizations(
+    collectPages(
+      (NextToken) =>
+        organizations.listTargetsForPolicy({ PolicyId: policyId, NextToken }),
+      (page) => page.Targets,
+    ),
+  );
+
+  const target = targets.find((candidate) => candidate.TargetId === targetId);
+  return target
+    ? ({
+        policyId,
+        targetId,
+        targetArn: target.Arn,
+        targetName: target.Name,
+        targetType: target.Type,
+      } satisfies PolicyAttachment["Attributes"])
+    : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Root.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Root.ts
new file mode 100644
index 00000000000..c7e29cd82fd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/Root.ts
@@ -0,0 +1,150 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  collectPages,
+  readResourceTags,
+  retryOrganizations,
+  updateResourceTags,
+} from "./common.ts";
+
+export type RootId = string;
+export type RootArn = string;
+
+export interface RootProps {
+  /**
+   * Optional root ID to import explicitly.
+   * If omitted, Alchemy adopts the single organization root.
+   */
+  rootId?: string;
+  /**
+   * Optional root name to match when multiple roots are ever supported.
+   */
+  name?: string;
+  /**
+   * Optional tags to apply to the imported root.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Root extends Resource<
+  "AWS.Organizations.Root",
+  RootProps,
+  {
+    rootId: RootId;
+    rootArn: RootArn;
+    rootName: string;
+    policyTypes: organizations.PolicyTypeSummary[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * The organization root.
+ *
+ * `Root` is an import-style resource. It discovers the existing root returned by
+ * AWS Organizations and can reconcile root tags.
+ */
+export const Root = Resource<Root>("AWS.Organizations.Root");
+
+export const RootProvider = () =>
+  Provider.effect(
+    Root,
+    Effect.gen(function* () {
+      return {
+        stables: ["rootId", "rootArn"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds?.rootId !== news?.rootId) {
+            return { action: "replace" } as const;
+          }
+          if (olds?.name !== news?.name) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          return yield* readRoot({
+            rootId: output?.rootId ?? olds?.rootId,
+            name: olds?.name,
+          });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          // Observe — discover the live root. `Root` is import-only: AWS
+          // creates the root for us when the organization is created, and we
+          // never create or delete it. We always look it up fresh.
+          const root = yield* readRoot({
+            rootId: output?.rootId ?? news.rootId,
+            name: news.name,
+          });
+          if (!root) {
+            return yield* Effect.fail(
+              new Error(
+                output?.rootId
+                  ? `organization root '${output.rootId}' not found`
+                  : "organization root not found",
+              ),
+            );
+          }
+
+          // Sync tags — diff observed cloud tags against desired. Using
+          // `root.tags` as the baseline (instead of stale `olds.tags`) keeps
+          // the reconciler convergent even on adoption or after drift.
+          const tags = yield* updateResourceTags({
+            id,
+            resourceId: root.rootId,
+            olds: root.tags,
+            news: news.tags,
+          });
+
+          yield* session.note(root.rootArn);
+          return {
+            ...root,
+            tags,
+          };
+        }),
+        delete: Effect.fn(function* () {}),
+      };
+    }),
+  );
+
+const listRoots = () =>
+  collectPages(
+    (NextToken) => organizations.listRoots({ NextToken }),
+    (page) => page.Roots,
+  );
+
+const readRoot = Effect.fn(function* ({
+  rootId,
+  name,
+}: {
+  rootId?: string;
+  name?: string;
+}) {
+  const roots = yield* retryOrganizations(listRoots());
+  const root = roots.find(
+    (candidate) =>
+      (rootId ? candidate.Id === rootId : true) &&
+      (name ? candidate.Name === name : true),
+  );
+
+  if (!root?.Id || !root.Arn || !root.Name) {
+    return undefined;
+  }
+
+  const tags = yield* readResourceTags(root.Id).pipe(
+    Effect.catchTag("TargetNotFoundException", () => Effect.succeed({})),
+  );
+
+  return {
+    rootId: root.Id,
+    rootArn: root.Arn,
+    rootName: root.Name,
+    policyTypes: root.PolicyTypes ?? [],
+    tags,
+  } satisfies Root["Attributes"];
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/RootPolicyType.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/RootPolicyType.ts
new file mode 100644
index 00000000000..118a9b19dc2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/RootPolicyType.ts
@@ -0,0 +1,142 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { collectPages, retryOrganizations } from "./common.ts";
+
+export interface RootPolicyTypeProps {
+  /**
+   * Root that owns the enabled policy type.
+   */
+  rootId: string;
+  /**
+   * Policy type to enable on the root.
+   */
+  policyType: organizations.PolicyType;
+}
+
+export interface RootPolicyType extends Resource<
+  "AWS.Organizations.RootPolicyType",
+  RootPolicyTypeProps,
+  {
+    rootId: string;
+    rootArn: string | undefined;
+    policyType: organizations.PolicyType;
+    status: organizations.PolicyTypeStatus | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Enables a policy type on an organization root.
+ */
+export const RootPolicyType = Resource<RootPolicyType>(
+  "AWS.Organizations.RootPolicyType",
+);
+
+export const RootPolicyTypeProvider = () =>
+  Provider.effect(
+    RootPolicyType,
+    Effect.gen(function* () {
+      return {
+        stables: ["rootId", "rootArn", "policyType"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            olds?.rootId !== news.rootId ||
+            olds?.policyType !== news.policyType
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          return yield* readRootPolicyType({
+            rootId: output?.rootId ?? olds!.rootId,
+            policyType: output?.policyType ?? olds!.policyType,
+          });
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — read the root's policy-type list to see whether our
+          // type is already enabled. Both `rootId` and `policyType` are
+          // stable identifiers, so `diff` replaces on any change.
+          let state = yield* readRootPolicyType(news);
+
+          // Ensure — enable if missing. Tolerate
+          // `PolicyTypeAlreadyEnabledException` for idempotency. The list
+          // can lag behind the enable call, so we fall back to a
+          // `PENDING_ENABLE` synthetic state when read still returns nothing.
+          if (!state) {
+            yield* retryOrganizations(
+              organizations
+                .enablePolicyType({
+                  RootId: news.rootId,
+                  PolicyType: news.policyType,
+                })
+                .pipe(
+                  Effect.catchTag(
+                    "PolicyTypeAlreadyEnabledException",
+                    () => Effect.void,
+                  ),
+                ),
+            );
+
+            state = yield* readRootPolicyType(news);
+            if (!state) {
+              return {
+                rootId: news.rootId,
+                rootArn: undefined,
+                policyType: news.policyType,
+                status: "PENDING_ENABLE",
+              } satisfies RootPolicyType["Attributes"];
+            }
+          }
+
+          yield* session.note(state.rootArn ?? state.rootId);
+          return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* retryOrganizations(
+            organizations
+              .disablePolicyType({
+                RootId: output.rootId,
+                PolicyType: output.policyType,
+              })
+              .pipe(
+                Effect.catchTags({
+                  PolicyTypeNotEnabledException: () => Effect.void,
+                  RootNotFoundException: () => Effect.void,
+                }),
+              ),
+          );
+        }),
+      };
+    }),
+  );
+
+const readRoot = (rootId: string) =>
+  collectPages(
+    (NextToken) => organizations.listRoots({ NextToken }),
+    (page) => page.Roots,
+  ).pipe(
+    retryOrganizations,
+    Effect.map((roots) => roots.find((root) => root.Id === rootId)),
+  );
+
+const readRootPolicyType = Effect.fn(function* ({
+  rootId,
+  policyType,
+}: RootPolicyTypeProps) {
+  const root = yield* readRoot(rootId);
+  const summary = root?.PolicyTypes?.find((item) => item.Type === policyType);
+  return summary
+    ? ({
+        rootId,
+        rootArn: root?.Arn,
+        policyType,
+        status: summary.Status,
+      } satisfies RootPolicyType["Attributes"])
+    : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/TenantRoot.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/TenantRoot.ts
new file mode 100644
index 00000000000..7696d652b72
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/TenantRoot.ts
@@ -0,0 +1,505 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import type { PolicyDocument } from "../IAM/Policy.ts";
+import * as IdentityCenter from "../IdentityCenter/index.ts";
+import type { Account, AccountProps } from "./Account.ts";
+import { Account as OrganizationAccount } from "./Account.ts";
+import type { DelegatedAdministrator } from "./DelegatedAdministrator.ts";
+import { DelegatedAdministrator as OrganizationsDelegatedAdministrator } from "./DelegatedAdministrator.ts";
+import type { Organization, OrganizationProps } from "./Organization.ts";
+import { Organization as AwsOrganization } from "./Organization.ts";
+import type {
+  OrganizationalUnit,
+  OrganizationalUnitProps,
+} from "./OrganizationalUnit.ts";
+import { OrganizationalUnit as AwsOrganizationalUnit } from "./OrganizationalUnit.ts";
+import type { Policy } from "./Policy.ts";
+import { Policy as OrganizationsPolicy } from "./Policy.ts";
+import type { PolicyAttachment } from "./PolicyAttachment.ts";
+import { PolicyAttachment as OrganizationsPolicyAttachment } from "./PolicyAttachment.ts";
+import type { Root, RootProps } from "./Root.ts";
+import { Root as OrganizationRoot } from "./Root.ts";
+import type { RootPolicyType } from "./RootPolicyType.ts";
+import { RootPolicyType as OrganizationsRootPolicyType } from "./RootPolicyType.ts";
+import type { TrustedServiceAccess } from "./TrustedServiceAccess.ts";
+import { TrustedServiceAccess as OrganizationsTrustedServiceAccess } from "./TrustedServiceAccess.ts";
+
+export type TenantTargetKey = "root" | string;
+
+export interface TenantAccountSpec extends Omit<
+  AccountProps,
+  "parentId" | "name" | "email"
+> {
+  key: string;
+  name: string;
+  email: string;
+}
+
+export interface TenantOrganizationalUnitSpec extends Omit<
+  OrganizationalUnitProps,
+  "parentId" | "name"
+> {
+  key: string;
+  name?: string;
+  accounts?: TenantAccountSpec[];
+  children?: TenantOrganizationalUnitSpec[];
+}
+
+export interface TenantPolicySpec {
+  key: string;
+  name?: string;
+  description?: string;
+  type?: organizations.PolicyType;
+  document: PolicyDocument;
+  targetKeys: TenantTargetKey[];
+  tags?: Record<string, string>;
+}
+
+export interface TenantIdentityCenterGroupSpec {
+  key: string;
+  displayName: string;
+  description?: string;
+}
+
+export interface TenantIdentityCenterPermissionSetSpec {
+  key: string;
+  name: string;
+  description?: string;
+  sessionDuration?: string;
+  relayState?: string;
+}
+
+export interface TenantIdentityCenterAssignmentSpec {
+  key?: string;
+  permissionSetKey: string;
+  accountKey: string;
+  principalType?: "USER" | "GROUP";
+  groupKey?: string;
+  principalId?: string;
+}
+
+export interface TenantIdentityCenterSpec {
+  mode?: "existing" | "account";
+  instanceArn?: string;
+  name?: string;
+  delegatedAdminAccountKey?: string;
+  groups?: TenantIdentityCenterGroupSpec[];
+  permissionSets?: TenantIdentityCenterPermissionSetSpec[];
+  assignments?: TenantIdentityCenterAssignmentSpec[];
+}
+
+export interface TenantRootProps {
+  organization?: OrganizationProps;
+  root?: RootProps;
+  policyTypes?: organizations.PolicyType[];
+  trustedServicePrincipals?: string[];
+  organizationalUnits?: TenantOrganizationalUnitSpec[];
+  policies?: TenantPolicySpec[];
+  identityCenter?: TenantIdentityCenterSpec;
+  tags?: Record<string, string>;
+}
+
+export interface TenantRootResult {
+  organization: Organization;
+  root: Root;
+  policyTypes: RootPolicyType[];
+  trustedServiceAccess: TrustedServiceAccess[];
+  delegatedAdministrators: DelegatedAdministrator[];
+  organizationalUnits: Record<string, OrganizationalUnit>;
+  accounts: Record<string, Account>;
+  policies: Record<string, Policy>;
+  policyAttachments: PolicyAttachment[];
+  identityCenter?: {
+    instance: IdentityCenter.Instance;
+    groups: Record<string, IdentityCenter.Group>;
+    permissionSets: Record<string, IdentityCenter.PermissionSet>;
+    assignments: Record<string, IdentityCenter.AccountAssignment>;
+  };
+}
+
+const defaultTenantOrganizationalUnits = (): TenantOrganizationalUnitSpec[] => [
+  {
+    key: "security",
+    name: "security",
+    accounts: [
+      {
+        key: "security",
+        name: "security",
+        email: "security@example.com",
+      },
+      {
+        key: "log-archive",
+        name: "log-archive",
+        email: "log-archive@example.com",
+      },
+    ],
+  },
+  {
+    key: "infrastructure",
+    name: "infrastructure",
+    accounts: [
+      {
+        key: "shared-services",
+        name: "shared-services",
+        email: "shared-services@example.com",
+      },
+    ],
+  },
+  {
+    key: "workloads",
+    name: "workloads",
+    accounts: [
+      {
+        key: "prod",
+        name: "prod",
+        email: "prod@example.com",
+      },
+    ],
+  },
+];
+
+const toLogicalIdSegment = (value: string) =>
+  value
+    .split(/[^A-Za-z0-9]+/)
+    .filter(Boolean)
+    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+    .join("");
+
+/**
+ * Compose an opinionated single-tenant landing zone inside the current AWS
+ * Organizations management account.
+ *
+ * This helper intentionally stays aligned to native AWS semantics:
+ * one real Organization, one root, nested OUs, and accounts beneath that
+ * tenant root. The broader `RootRoot` concept is an Alchemy control-plane
+ * abstraction over many such tenant roots deployed into separate management
+ * accounts, not a nested AWS Organizations feature.
+ *
+ * @section Creating A Tenant Root
+ * @example Tenant With Baseline Accounts
+ * ```typescript
+ * const tenant = yield* TenantRoot("CustomerA", {
+ *   identityCenter: {
+ *     mode: "existing",
+ *     groups: [
+ *       { key: "platform", displayName: "platform-engineers" },
+ *     ],
+ *     permissionSets: [
+ *       {
+ *         key: "admin",
+ *         name: "AdministratorAccess",
+ *         sessionDuration: "PT8H",
+ *       },
+ *     ],
+ *     assignments: [
+ *       {
+ *         permissionSetKey: "admin",
+ *         groupKey: "platform",
+ *         accountKey: "prod",
+ *       },
+ *     ],
+ *   },
+ * });
+ * ```
+ */
+export const TenantRoot = Effect.fn(function* (
+  id: string,
+  props: TenantRootProps = {},
+) {
+  const sharedTags = props.tags ?? {};
+  const organization = yield* AwsOrganization(`${id}Organization`, {
+    featureSet: "ALL",
+    ...props.organization,
+  });
+  const root = yield* OrganizationRoot(`${id}Root`, {
+    ...props.root,
+    tags: mergeTags(sharedTags, props.root?.tags),
+  });
+
+  const policyTypes = yield* Effect.forEach(
+    props.policyTypes ?? ["SERVICE_CONTROL_POLICY"],
+    (policyType) =>
+      OrganizationsRootPolicyType(
+        `${id}${toLogicalIdSegment(policyType)}PolicyType`,
+        {
+          rootId: root.rootId,
+          policyType,
+        },
+      ),
+    { concurrency: "unbounded" },
+  );
+
+  const trustedServicePrincipals = [
+    ...(props.trustedServicePrincipals ?? []),
+    ...(props.identityCenter ? ["sso.amazonaws.com"] : []),
+  ];
+  const trustedServiceAccess = yield* Effect.forEach(
+    [...new Set(trustedServicePrincipals)],
+    (servicePrincipal) =>
+      OrganizationsTrustedServiceAccess(
+        `${id}${toLogicalIdSegment(servicePrincipal)}TrustedAccess`,
+        { servicePrincipal },
+      ),
+    { concurrency: "unbounded" },
+  );
+
+  const organizationalUnits: Record<string, OrganizationalUnit> = {};
+  const accounts: Record<string, Account> = {};
+  const targets: Record<TenantTargetKey, { targetId: any }> = {
+    root: { targetId: root.rootId as any },
+  };
+
+  yield* createOrganizationalUnits({
+    id,
+    parentId: root.rootId,
+    sharedTags,
+    specs: props.organizationalUnits ?? defaultTenantOrganizationalUnits(),
+    organizationalUnits,
+    accounts,
+    targets,
+  });
+
+  const delegatedAdministrators: DelegatedAdministrator[] = [];
+  const identityCenter = props.identityCenter
+    ? yield* createTenantIdentityCenter({
+        id,
+        spec: props.identityCenter,
+        accounts,
+        sharedTags,
+        delegatedAdministrators,
+      })
+    : undefined;
+
+  const policies: Record<string, Policy> = {};
+  const policyAttachments: PolicyAttachment[] = [];
+  for (const policySpec of props.policies ?? []) {
+    const policy = yield* OrganizationsPolicy(
+      `${id}${toLogicalIdSegment(policySpec.key)}Policy`,
+      {
+        name: policySpec.name,
+        description: policySpec.description,
+        type: policySpec.type ?? "SERVICE_CONTROL_POLICY",
+        document: policySpec.document,
+        tags: mergeTags(sharedTags, policySpec.tags),
+      },
+    );
+    policies[policySpec.key] = policy;
+
+    for (const targetKey of policySpec.targetKeys) {
+      const target = targets[targetKey];
+      if (!target) {
+        return yield* Effect.fail(
+          new Error(
+            `Unknown tenant policy target '${targetKey}' for policy '${policySpec.key}'`,
+          ),
+        );
+      }
+
+      policyAttachments.push(
+        yield* OrganizationsPolicyAttachment(
+          `${id}${toLogicalIdSegment(policySpec.key)}${toLogicalIdSegment(targetKey)}Attachment`,
+          {
+            policyId: policy.policyId,
+            targetId: target.targetId,
+          },
+        ),
+      );
+    }
+  }
+
+  return {
+    organization,
+    root,
+    policyTypes,
+    trustedServiceAccess,
+    delegatedAdministrators,
+    organizationalUnits,
+    accounts,
+    policies,
+    policyAttachments,
+    identityCenter,
+  } satisfies TenantRootResult;
+});
+
+const createOrganizationalUnits = ({
+  id,
+  parentId,
+  sharedTags,
+  specs,
+  organizationalUnits,
+  accounts,
+  targets,
+}: {
+  id: string;
+  parentId: any;
+  sharedTags: Record<string, string>;
+  specs: TenantOrganizationalUnitSpec[];
+  organizationalUnits: Record<string, OrganizationalUnit>;
+  accounts: Record<string, Account>;
+  targets: Record<TenantTargetKey, { targetId: any }>;
+}): Effect.Effect<void, unknown, unknown> =>
+  Effect.gen(function* () {
+    for (const spec of specs) {
+      const ou = yield* AwsOrganizationalUnit(
+        `${id}${toLogicalIdSegment(spec.key)}Ou`,
+        {
+          parentId,
+          name: spec.name ?? spec.key,
+          tags: mergeTags(sharedTags, spec.tags),
+        },
+      );
+      organizationalUnits[spec.key] = ou;
+      targets[spec.key] = { targetId: ou.ouId as any };
+
+      for (const accountSpec of spec.accounts ?? []) {
+        const account = yield* OrganizationAccount(
+          `${id}${toLogicalIdSegment(accountSpec.key)}Account`,
+          {
+            ...accountSpec,
+            parentId: ou.ouId,
+            tags: mergeTags(sharedTags, accountSpec.tags),
+          },
+        );
+        accounts[accountSpec.key] = account;
+        targets[accountSpec.key] = { targetId: account.accountId as any };
+      }
+
+      if (spec.children?.length) {
+        yield* createOrganizationalUnits({
+          id,
+          parentId: ou.ouId as any,
+          sharedTags,
+          specs: spec.children,
+          organizationalUnits,
+          accounts,
+          targets,
+        });
+      }
+    }
+  });
+
+const createTenantIdentityCenter = Effect.fn(function* ({
+  id,
+  spec,
+  accounts,
+  delegatedAdministrators,
+}: {
+  id: string;
+  spec: TenantIdentityCenterSpec;
+  accounts: Record<string, Account>;
+  sharedTags: Record<string, string>;
+  delegatedAdministrators: DelegatedAdministrator[];
+}) {
+  const instance = yield* IdentityCenter.Instance(`${id}IdentityCenter`, {
+    mode: spec.mode ?? "existing",
+    instanceArn: spec.instanceArn,
+    name: spec.name,
+  });
+
+  if (spec.delegatedAdminAccountKey) {
+    const account = accounts[spec.delegatedAdminAccountKey];
+    if (!account) {
+      return yield* Effect.fail(
+        new Error(
+          `Unknown delegated admin account '${spec.delegatedAdminAccountKey}'`,
+        ),
+      );
+    }
+    delegatedAdministrators.push(
+      yield* OrganizationsDelegatedAdministrator(
+        `${id}${toLogicalIdSegment(spec.delegatedAdminAccountKey)}IdentityCenterDelegatedAdmin`,
+        {
+          accountId: account.accountId,
+          servicePrincipal: "sso.amazonaws.com",
+        },
+      ),
+    );
+  }
+
+  const groups: Record<string, IdentityCenter.Group> = {};
+  for (const groupSpec of spec.groups ?? []) {
+    groups[groupSpec.key] = yield* IdentityCenter.Group(
+      `${id}${toLogicalIdSegment(groupSpec.key)}Group`,
+      {
+        identityStoreId: instance.identityStoreId,
+        displayName: groupSpec.displayName,
+        description: groupSpec.description,
+      },
+    );
+  }
+
+  const permissionSets: Record<string, IdentityCenter.PermissionSet> = {};
+  for (const permissionSetSpec of spec.permissionSets ?? []) {
+    permissionSets[permissionSetSpec.key] = yield* IdentityCenter.PermissionSet(
+      `${id}${toLogicalIdSegment(permissionSetSpec.key)}PermissionSet`,
+      {
+        instanceArn: instance.instanceArn,
+        name: permissionSetSpec.name,
+        description: permissionSetSpec.description,
+        sessionDuration: permissionSetSpec.sessionDuration,
+        relayState: permissionSetSpec.relayState,
+      },
+    );
+  }
+
+  const assignments: Record<string, IdentityCenter.AccountAssignment> = {};
+  for (const assignmentSpec of spec.assignments ?? []) {
+    const account = accounts[assignmentSpec.accountKey];
+    if (!account) {
+      return yield* Effect.fail(
+        new Error(`Unknown assignment account '${assignmentSpec.accountKey}'`),
+      );
+    }
+    const permissionSet = permissionSets[assignmentSpec.permissionSetKey];
+    if (!permissionSet) {
+      return yield* Effect.fail(
+        new Error(
+          `Unknown assignment permission set '${assignmentSpec.permissionSetKey}'`,
+        ),
+      );
+    }
+    const principalId =
+      assignmentSpec.groupKey !== undefined
+        ? groups[assignmentSpec.groupKey]?.groupId
+        : assignmentSpec.principalId;
+    if (!principalId) {
+      return yield* Effect.fail(
+        new Error(
+          `Unable to resolve principal for assignment '${assignmentSpec.key ?? `${assignmentSpec.permissionSetKey}-${assignmentSpec.accountKey}`}'`,
+        ),
+      );
+    }
+
+    const key =
+      assignmentSpec.key ??
+      `${assignmentSpec.permissionSetKey}-${assignmentSpec.accountKey}-${assignmentSpec.groupKey ?? principalId}`;
+
+    assignments[key] = yield* IdentityCenter.AccountAssignment(
+      `${id}${toLogicalIdSegment(key)}Assignment`,
+      {
+        instanceArn: instance.instanceArn,
+        permissionSetArn: permissionSet.permissionSetArn,
+        principalId,
+        principalType: assignmentSpec.groupKey
+          ? "GROUP"
+          : (assignmentSpec.principalType ?? "USER"),
+        targetId: account.accountId,
+      },
+    );
+  }
+
+  return {
+    instance,
+    groups,
+    permissionSets,
+    assignments,
+  };
+});
+
+const mergeTags = (
+  shared: Record<string, string>,
+  tags: Record<string, string> | undefined,
+) => ({
+  ...shared,
+  ...tags,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/TrustedServiceAccess.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/TrustedServiceAccess.ts
new file mode 100644
index 00000000000..8845c6f9b88
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/TrustedServiceAccess.ts
@@ -0,0 +1,114 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { collectPages, retryOrganizations } from "./common.ts";
+
+export interface TrustedServiceAccessProps {
+  /**
+   * Service principal granted trusted access to the organization.
+   */
+  servicePrincipal: string;
+}
+
+export interface TrustedServiceAccess extends Resource<
+  "AWS.Organizations.TrustedServiceAccess",
+  TrustedServiceAccessProps,
+  {
+    servicePrincipal: string;
+    dateEnabled: Date | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Enables trusted access for an AWS service principal.
+ */
+export const TrustedServiceAccess = Resource<TrustedServiceAccess>(
+  "AWS.Organizations.TrustedServiceAccess",
+);
+
+export const TrustedServiceAccessProvider = () =>
+  Provider.effect(
+    TrustedServiceAccess,
+    Effect.gen(function* () {
+      return {
+        stables: ["servicePrincipal"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return;
+          if (olds?.servicePrincipal !== news.servicePrincipal) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          return yield* readTrustedServiceAccess(
+            output?.servicePrincipal ?? olds!.servicePrincipal,
+          );
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Observe — fetch live trusted-access state. We never trust prior
+          // `output` blindly; if access was disabled out-of-band we re-enable.
+          let state = yield* readTrustedServiceAccess(news.servicePrincipal);
+
+          // Ensure — enable trusted access if it's missing. This API is
+          // effectively idempotent for already-enabled principals, but we
+          // gate the call to avoid unnecessary churn.
+          if (!state) {
+            yield* retryOrganizations(
+              organizations.enableAWSServiceAccess({
+                ServicePrincipal: news.servicePrincipal,
+              }),
+            );
+            state = yield* readTrustedServiceAccess(news.servicePrincipal);
+            if (!state) {
+              return yield* Effect.fail(
+                new Error(
+                  `trusted service access '${news.servicePrincipal}' not found after create`,
+                ),
+              );
+            }
+          }
+
+          yield* session.note(state.servicePrincipal);
+          return state;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!(yield* readTrustedServiceAccess(output.servicePrincipal))) {
+            return;
+          }
+
+          yield* retryOrganizations(
+            organizations.disableAWSServiceAccess({
+              ServicePrincipal: output.servicePrincipal,
+            }),
+          );
+        }),
+      };
+    }),
+  );
+
+const readTrustedServiceAccess = Effect.fn(function* (
+  servicePrincipal: string,
+) {
+  const principals = yield* retryOrganizations(
+    collectPages(
+      (NextToken) =>
+        organizations.listAWSServiceAccessForOrganization({ NextToken }),
+      (page) => page.EnabledServicePrincipals,
+    ),
+  );
+
+  const match = principals.find(
+    (candidate) => candidate.ServicePrincipal === servicePrincipal,
+  );
+
+  return match
+    ? ({
+        servicePrincipal,
+        dateEnabled: match.DateEnabled,
+      } satisfies TrustedServiceAccess["Attributes"])
+    : undefined;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/common.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/common.ts
new file mode 100644
index 00000000000..47d1a75fa5d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/common.ts
@@ -0,0 +1,115 @@
+import * as organizations from "@distilled.cloud/aws/organizations";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export type OrganizationsTags = Record<string, string>;
+
+export const createName = (
+  id: string,
+  providedName: string | undefined,
+  maxLength: number,
+) =>
+  providedName
+    ? Effect.succeed(providedName)
+    : createPhysicalName({
+        id,
+        maxLength,
+      });
+
+export const toTagRecord = (
+  tags: organizations.Tag[] | undefined,
+): OrganizationsTags =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+export const collectPages = <Page extends { NextToken?: string }, Item, E, R>(
+  fetch: (nextToken?: string) => Effect.Effect<Page, E, R>,
+  select: (page: Page) => ReadonlyArray<Item> | undefined,
+) =>
+  Effect.gen(function* () {
+    const items: Item[] = [];
+    let nextToken: string | undefined;
+
+    do {
+      const page = yield* fetch(nextToken);
+      items.push(...(select(page) ?? []));
+      nextToken = page.NextToken;
+    } while (nextToken);
+
+    return items;
+  });
+
+export const retryOrganizations = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.retry({
+      while: (error: any) =>
+        error?._tag === "ConcurrentModificationException" ||
+        error?._tag === "TooManyRequestsException" ||
+        error?._tag === "ServiceException" ||
+        error?._tag === "FinalizingOrganizationException",
+      schedule: Schedule.exponential(200).pipe(
+        Schedule.both(Schedule.recurs(8)),
+      ),
+    }),
+  );
+
+export const createManagedTags = Effect.fn(function* (
+  id: string,
+  tags: Record<string, string> | undefined,
+) {
+  return {
+    ...(yield* createInternalTags(id)),
+    ...(tags ?? {}),
+  };
+});
+
+export const readResourceTags = (resourceId: string) =>
+  collectPages(
+    (NextToken) =>
+      organizations.listTagsForResource({ ResourceId: resourceId, NextToken }),
+    (page) => page.Tags,
+  ).pipe(Effect.map(toTagRecord));
+
+export const updateResourceTags = Effect.fn(function* ({
+  id,
+  resourceId,
+  olds,
+  news,
+}: {
+  id: string;
+  resourceId: string;
+  olds: Record<string, string> | undefined;
+  news: Record<string, string> | undefined;
+}) {
+  const oldTags = yield* createManagedTags(id, olds);
+  const newTags = yield* createManagedTags(id, news);
+  const { removed, upsert } = diffTags(oldTags, newTags);
+
+  if (removed.length > 0) {
+    yield* retryOrganizations(
+      organizations.untagResource({
+        ResourceId: resourceId,
+        TagKeys: removed,
+      }),
+    );
+  }
+
+  if (upsert.length > 0) {
+    yield* retryOrganizations(
+      organizations.tagResource({
+        ResourceId: resourceId,
+        Tags: upsert,
+      }),
+    );
+  }
+
+  return newTags;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/index.ts
new file mode 100644
index 00000000000..e347a394eed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Organizations/index.ts
@@ -0,0 +1,11 @@
+export * from "./Account.ts";
+export * from "./DelegatedAdministrator.ts";
+export * from "./Organization.ts";
+export * from "./OrganizationalUnit.ts";
+export * from "./OrganizationResourcePolicy.ts";
+export * from "./Policy.ts";
+export * from "./PolicyAttachment.ts";
+export * from "./Root.ts";
+export * from "./RootPolicyType.ts";
+export * from "./TrustedServiceAccess.ts";
+export * from "./TenantRoot.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Providers.ts
new file mode 100644
index 00000000000..d7653ea6b96
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Providers.ts
@@ -0,0 +1,637 @@
+import {
+  isRetryable,
+  isThrottlingError,
+  isTransientError,
+} from "@distilled.cloud/aws/Category";
+import {
+  capped,
+  jittered,
+  Retry,
+  type Factory as RetryFactory,
+} from "@distilled.cloud/aws/Retry";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import * as Layer from "effect/Layer";
+import * as Ref from "effect/Ref";
+import * as Schedule from "effect/Schedule";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { Command, CommandProvider } from "../Build/Command.ts";
+import * as Provider from "../Provider.ts";
+import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
+import { Random, RandomProvider } from "../Random.ts";
+import * as ACM from "./ACM/index.ts";
+import * as ApiGateway from "./ApiGateway/index.ts";
+import * as Assets from "./Assets.ts";
+import { AwsAuth } from "./AuthProvider.ts";
+import * as AutoScaling from "./AutoScaling/index.ts";
+import * as CloudFront from "./CloudFront/index.ts";
+import * as CloudWatch from "./CloudWatch/index.ts";
+import * as Credentials from "./Credentials.ts";
+import * as DynamoDB from "./DynamoDB/index.ts";
+import * as EC2 from "./EC2/index.ts";
+import * as ECR from "./ECR/index.ts";
+import * as ECS from "./ECS/index.ts";
+import * as EKS from "./EKS/index.ts";
+import * as ELBv2 from "./ELBv2/index.ts";
+import * as Endpoint from "./Endpoint.ts";
+import { Default as DefaultEnvironment } from "./Environment.ts";
+import * as EventBridge from "./EventBridge/index.ts";
+import * as IAM from "./IAM/index.ts";
+import * as IdentityCenter from "./IdentityCenter/index.ts";
+import * as Kinesis from "./Kinesis/index.ts";
+import * as Lambda from "./Lambda/index.ts";
+import * as Logs from "./Logs/index.ts";
+import * as Organizations from "./Organizations/index.ts";
+import * as RDS from "./RDS/index.ts";
+import * as RDSData from "./RDSData/index.ts";
+import * as Region from "./Region.ts";
+import * as Route53 from "./Route53/index.ts";
+import * as S3 from "./S3/index.ts";
+import * as Scheduler from "./Scheduler/index.ts";
+import * as SecretsManager from "./SecretsManager/index.ts";
+import * as SNS from "./SNS/index.ts";
+import * as SQS from "./SQS/index.ts";
+import * as Website from "./Website/index.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "AWS",
+) {}
+
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      Command,
+      KeyPair,
+      Random,
+      ACM.Certificate,
+      ApiGateway.Account,
+      ApiGateway.ApiKey,
+      ApiGateway.Authorizer,
+      ApiGateway.BasePathMapping,
+      ApiGateway.DeploymentResource,
+      ApiGateway.DomainName,
+      ApiGateway.GatewayResponse,
+      ApiGateway.MethodResource,
+      ApiGateway.GatewayResource,
+      ApiGateway.RestApi,
+      ApiGateway.StageResource,
+      ApiGateway.UsagePlan,
+      ApiGateway.UsagePlanKey,
+      ApiGateway.VpcLink,
+      AutoScaling.AutoScalingGroup,
+      AutoScaling.LaunchTemplate,
+      AutoScaling.ScalingPolicy,
+      CloudFront.CachePolicy,
+      CloudFront.Distribution,
+      CloudFront.Function,
+      CloudFront.Invalidation,
+      CloudFront.KeyGroup,
+      CloudFront.KeyValueStore,
+      CloudFront.KvEntries,
+      CloudFront.KvRoutesUpdate,
+      CloudFront.OriginAccessControl,
+      CloudFront.OriginRequestPolicy,
+      CloudFront.PublicKey,
+      CloudFront.ResponseHeadersPolicy,
+      CloudWatch.Alarm,
+      CloudWatch.AlarmMuteRule,
+      CloudWatch.AnomalyDetector,
+      CloudWatch.CompositeAlarm,
+      CloudWatch.Dashboard,
+      CloudWatch.DescribeAlarmContributorsPolicy,
+      CloudWatch.DescribeAlarmHistoryPolicy,
+      CloudWatch.DescribeAlarmsForMetricPolicy,
+      CloudWatch.DescribeAlarmsPolicy,
+      CloudWatch.DescribeAnomalyDetectorsPolicy,
+      CloudWatch.DescribeInsightRulesPolicy,
+      CloudWatch.DisableAlarmActionsPolicy,
+      CloudWatch.DisableInsightRulesPolicy,
+      CloudWatch.EnableAlarmActionsPolicy,
+      CloudWatch.GetAlarmMuteRulePolicy,
+      CloudWatch.GetDashboardPolicy,
+      CloudWatch.GetInsightRuleReportPolicy,
+      CloudWatch.GetMetricDataPolicy,
+      CloudWatch.GetMetricStatisticsPolicy,
+      CloudWatch.GetMetricStreamPolicy,
+      CloudWatch.GetMetricWidgetImagePolicy,
+      CloudWatch.InsightRule,
+      CloudWatch.ListAlarmMuteRulesPolicy,
+      CloudWatch.ListDashboardsPolicy,
+      CloudWatch.ListManagedInsightRulesPolicy,
+      CloudWatch.ListMetricsPolicy,
+      CloudWatch.ListMetricStreamsPolicy,
+      CloudWatch.ListTagsForResourcePolicy,
+      CloudWatch.MetricStream,
+      CloudWatch.PutMetricDataPolicy,
+      CloudWatch.SetAlarmStatePolicy,
+      DynamoDB.BatchExecuteStatementPolicy,
+      DynamoDB.BatchGetItemPolicy,
+      DynamoDB.BatchWriteItemPolicy,
+      DynamoDB.DeleteItemPolicy,
+      DynamoDB.DescribeTablePolicy,
+      DynamoDB.DescribeTimeToLivePolicy,
+      DynamoDB.ExecuteStatementPolicy,
+      DynamoDB.ExecuteTransactionPolicy,
+      DynamoDB.GetItemPolicy,
+      DynamoDB.ListTablesPolicy,
+      DynamoDB.ListTagsOfResourcePolicy,
+      DynamoDB.PutItemPolicy,
+      DynamoDB.QueryPolicy,
+      DynamoDB.RestoreTableToPointInTimePolicy,
+      DynamoDB.ScanPolicy,
+      DynamoDB.Table,
+      DynamoDB.TransactGetItemsPolicy,
+      DynamoDB.TransactWriteItemsPolicy,
+      DynamoDB.UpdateItemPolicy,
+      DynamoDB.UpdateTimeToLivePolicy,
+      EC2.EgressOnlyInternetGateway,
+      EC2.EIP,
+      EC2.Instance,
+      EC2.InternetGateway,
+      EC2.NatGateway,
+      EC2.NetworkAcl,
+      EC2.NetworkAclAssociation,
+      EC2.NetworkAclEntry,
+      EC2.Route,
+      EC2.RouteTable,
+      EC2.RouteTableAssociation,
+      EC2.SecurityGroup,
+      EC2.SecurityGroupRule,
+      EC2.Subnet,
+      EC2.Vpc,
+      EC2.VpcEndpoint,
+      ECR.Repository,
+      ECS.CapacityProvider,
+      ECS.Cluster,
+      ECS.DescribeTasksPolicy,
+      ECS.ListTasksPolicy,
+      ECS.RunTaskPolicy,
+      ECS.Service,
+      ECS.StopTaskPolicy,
+      ECS.Task,
+      EKS.AccessEntry,
+      EKS.Addon,
+      EKS.Cluster,
+      EKS.PodIdentityAssociation,
+      ELBv2.Listener,
+      ELBv2.LoadBalancer,
+      ELBv2.TargetGroup,
+      EventBridge.DescribeEventBusPolicy,
+      EventBridge.DescribeRulePolicy,
+      EventBridge.EventBus,
+      EventBridge.ListEventBusesPolicy,
+      EventBridge.ListRulesPolicy,
+      EventBridge.ListTargetsByRulePolicy,
+      EventBridge.Permission,
+      EventBridge.PutEventsPolicy,
+      EventBridge.Rule,
+      EventBridge.TestEventPatternPolicy,
+      EventBridge.ToLambdaPolicy,
+      EventBridge.ToQueuePolicy,
+      IAM.AccessKey,
+      IAM.AccountAlias,
+      IAM.AccountPasswordPolicy,
+      IAM.Group,
+      IAM.GroupMembership,
+      IAM.InstanceProfile,
+      IAM.LoginProfile,
+      IAM.OpenIDConnectProvider,
+      IAM.Policy,
+      IAM.Role,
+      IAM.SAMLProvider,
+      IAM.ServerCertificate,
+      IAM.ServiceSpecificCredential,
+      IAM.SigningCertificate,
+      IAM.SSHPublicKey,
+      IAM.User,
+      IAM.VirtualMFADevice,
+      IdentityCenter.AccountAssignment,
+      IdentityCenter.Group,
+      IdentityCenter.Instance,
+      IdentityCenter.PermissionSet,
+      Kinesis.DescribeAccountSettingsPolicy,
+      Kinesis.DescribeLimitsPolicy,
+      Kinesis.DescribeStreamConsumerPolicy,
+      Kinesis.DescribeStreamPolicy,
+      Kinesis.DescribeStreamSummaryPolicy,
+      Kinesis.GetRecordsPolicy,
+      Kinesis.GetResourcePolicyPolicy,
+      Kinesis.GetShardIteratorPolicy,
+      Kinesis.ListShardsPolicy,
+      Kinesis.ListStreamConsumersPolicy,
+      Kinesis.ListStreamsPolicy,
+      Kinesis.ListTagsForResourcePolicy,
+      Kinesis.PutRecordPolicy,
+      Kinesis.PutRecordsPolicy,
+      Kinesis.Stream,
+      Kinesis.StreamConsumer,
+      Kinesis.StreamSinkPolicy,
+      Kinesis.SubscribeToShardPolicy,
+      Lambda.BucketEventSourcePolicy,
+      Lambda.EventSourcePolicy,
+      Lambda.EventSourceMapping,
+      Lambda.Function,
+      Lambda.InvokeFunctionPolicy,
+      Lambda.Permission,
+      Lambda.QueueEventSourcePolicy,
+      Lambda.StreamEventSourcePolicy,
+      Lambda.TableEventSourcePolicy,
+      Lambda.TopicEventSourcePolicy,
+      Logs.LogGroup,
+      Organizations.Account,
+      Organizations.DelegatedAdministrator,
+      Organizations.Organization,
+      Organizations.OrganizationalUnit,
+      Organizations.OrganizationResourcePolicy,
+      Organizations.Policy,
+      Organizations.PolicyAttachment,
+      Organizations.Root,
+      Organizations.RootPolicyType,
+      Organizations.TrustedServiceAccess,
+      RDS.ConnectPolicy,
+      RDS.DBCluster,
+      RDS.DBClusterEndpoint,
+      RDS.DBClusterParameterGroup,
+      RDS.DBInstance,
+      RDS.DBParameterGroup,
+      RDS.DBProxy,
+      RDS.DBProxyEndpoint,
+      RDS.DBProxyTargetGroup,
+      RDS.DBSubnetGroup,
+      RDSData.BatchExecuteStatementPolicy,
+      RDSData.BeginTransactionPolicy,
+      RDSData.CommitTransactionPolicy,
+      RDSData.ExecuteSqlPolicy,
+      RDSData.ExecuteStatementPolicy,
+      RDSData.RollbackTransactionPolicy,
+      Route53.Record,
+      S3.AbortMultipartUploadPolicy,
+      S3.Bucket,
+      S3.CompleteMultipartUploadPolicy,
+      S3.CreateMultipartUploadPolicy,
+      S3.DeleteObjectPolicy,
+      S3.GetObjectPolicy,
+      S3.HeadObjectPolicy,
+      S3.ListObjectsV2Policy,
+      S3.PutObjectPolicy,
+      S3.CopyObjectPolicy,
+      S3.UploadPartPolicy,
+      Scheduler.Schedule,
+      Scheduler.ScheduleGroup,
+      SecretsManager.DescribeSecretPolicy,
+      SecretsManager.GetRandomPasswordPolicy,
+      SecretsManager.GetSecretValuePolicy,
+      SecretsManager.ListSecretsPolicy,
+      SecretsManager.PutSecretValuePolicy,
+      SecretsManager.Secret,
+      SNS.AddPermissionPolicy,
+      SNS.ConfirmSubscriptionPolicy,
+      SNS.GetDataProtectionPolicyPolicy,
+      SNS.GetSubscriptionAttributesPolicy,
+      SNS.GetTopicAttributesPolicy,
+      SNS.ListSubscriptionsByTopicPolicy,
+      SNS.ListSubscriptionsPolicy,
+      SNS.ListTagsForResourcePolicy,
+      SNS.ListTopicsPolicy,
+      SNS.PublishBatchPolicy,
+      SNS.PublishPolicy,
+      SNS.PutDataProtectionPolicyPolicy,
+      SNS.RemovePermissionPolicy,
+      SNS.SetSubscriptionAttributesPolicy,
+      SNS.SetTopicAttributesPolicy,
+      SNS.Subscription,
+      SNS.TagResourcePolicy,
+      SNS.Topic,
+      SNS.TopicSinkPolicy,
+      SNS.UntagResourcePolicy,
+      SQS.DeleteMessagePolicy,
+      SQS.DeleteMessageBatchPolicy,
+      SQS.Queue,
+      SQS.QueueSinkPolicy,
+      SQS.ReceiveMessagePolicy,
+      SQS.SendMessageBatchPolicy,
+      SQS.SendMessagePolicy,
+      Website.AssetDeployment,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        ACM.CertificateProvider(),
+        ApiGateway.AccountProvider(),
+        ApiGateway.ApiKeyProvider(),
+        ApiGateway.AuthorizerProvider(),
+        ApiGateway.BasePathMappingProvider(),
+        ApiGateway.DeploymentProvider(),
+        ApiGateway.DomainNameProvider(),
+        ApiGateway.GatewayResponseProvider(),
+        ApiGateway.MethodProvider(),
+        ApiGateway.ResourceProvider(),
+        ApiGateway.RestApiProvider(),
+        ApiGateway.StageProvider(),
+        ApiGateway.UsagePlanProvider(),
+        ApiGateway.UsagePlanKeyProvider(),
+        ApiGateway.VpcLinkProvider(),
+        AutoScaling.AutoScalingGroupProvider(),
+        AutoScaling.LaunchTemplateProvider(),
+        AutoScaling.ScalingPolicyProvider(),
+        CloudFront.CachePolicyProvider(),
+        CloudFront.DistributionProvider(),
+        CloudFront.FunctionProvider(),
+        CloudFront.InvalidationProvider(),
+        CloudFront.KeyGroupProvider(),
+        CloudFront.KeyValueStoreProvider(),
+        CloudFront.KvEntriesProvider(),
+        CloudFront.KvRoutesUpdateProvider(),
+        CloudFront.OriginAccessControlProvider(),
+        CloudFront.OriginRequestPolicyProvider(),
+        CloudFront.PublicKeyProvider(),
+        CloudFront.ResponseHeadersPolicyProvider(),
+        CloudWatch.AlarmMuteRuleProvider(),
+        CloudWatch.AlarmProvider(),
+        CloudWatch.AnomalyDetectorProvider(),
+        CloudWatch.CompositeAlarmProvider(),
+        CloudWatch.DashboardProvider(),
+        CloudWatch.DescribeAlarmContributorsPolicyLive,
+        CloudWatch.DescribeAlarmHistoryPolicyLive,
+        CloudWatch.DescribeAlarmsForMetricPolicyLive,
+        CloudWatch.DescribeAlarmsPolicyLive,
+        CloudWatch.DescribeAnomalyDetectorsPolicyLive,
+        CloudWatch.DescribeInsightRulesPolicyLive,
+        CloudWatch.DisableAlarmActionsPolicyLive,
+        CloudWatch.DisableInsightRulesPolicyLive,
+        CloudWatch.EnableAlarmActionsPolicyLive,
+        CloudWatch.GetAlarmMuteRulePolicyLive,
+        CloudWatch.GetDashboardPolicyLive,
+        CloudWatch.GetInsightRuleReportPolicyLive,
+        CloudWatch.GetMetricDataPolicyLive,
+        CloudWatch.GetMetricStatisticsPolicyLive,
+        CloudWatch.GetMetricStreamPolicyLive,
+        CloudWatch.GetMetricWidgetImagePolicyLive,
+        CloudWatch.InsightRuleProvider(),
+        CloudWatch.ListAlarmMuteRulesPolicyLive,
+        CloudWatch.ListDashboardsPolicyLive,
+        CloudWatch.ListManagedInsightRulesPolicyLive,
+        CloudWatch.ListMetricsPolicyLive,
+        CloudWatch.ListMetricStreamsPolicyLive,
+        CloudWatch.ListTagsForResourcePolicyLive,
+        CloudWatch.MetricStreamProvider(),
+        CloudWatch.PutMetricDataPolicyLive,
+        CloudWatch.SetAlarmStatePolicyLive,
+        DynamoDB.BatchExecuteStatementPolicyLive,
+        DynamoDB.BatchGetItemPolicyLive,
+        DynamoDB.BatchWriteItemPolicyLive,
+        DynamoDB.DeleteItemPolicyLive,
+        DynamoDB.DescribeTablePolicyLive,
+        DynamoDB.DescribeTimeToLivePolicyLive,
+        DynamoDB.ExecuteStatementPolicyLive,
+        DynamoDB.ExecuteTransactionPolicyLive,
+        DynamoDB.GetItemPolicyLive,
+        DynamoDB.ListTablesPolicyLive,
+        DynamoDB.ListTagsOfResourcePolicyLive,
+        DynamoDB.PutItemPolicyLive,
+        DynamoDB.QueryPolicyLive,
+        DynamoDB.RestoreTableToPointInTimePolicyLive,
+        DynamoDB.ScanPolicyLive,
+        DynamoDB.TableProvider(),
+        DynamoDB.TransactGetItemsPolicyLive,
+        DynamoDB.TransactWriteItemsPolicyLive,
+        DynamoDB.UpdateItemPolicyLive,
+        DynamoDB.UpdateTimeToLivePolicyLive,
+        EC2.EgressOnlyInternetGatewayProvider(),
+        EC2.EIPProvider(),
+        EC2.InstanceProvider(),
+        EC2.InternetGatewayProvider(),
+        EC2.NatGatewayProvider(),
+        EC2.NetworkAclAssociationProvider(),
+        EC2.NetworkAclEntryProvider(),
+        EC2.NetworkAclProvider(),
+        EC2.RouteProvider(),
+        EC2.RouteTableAssociationProvider(),
+        EC2.RouteTableProvider(),
+        EC2.SecurityGroupProvider(),
+        EC2.SecurityGroupRuleProvider(),
+        EC2.SubnetProvider(),
+        EC2.VpcEndpointProvider(),
+        EC2.VpcProvider(),
+        ECR.RepositoryProvider(),
+        ECS.CapacityProviderProvider(),
+        ECS.ClusterProvider(),
+        ECS.DescribeTasksPolicyLive,
+        ECS.ListTasksPolicyLive,
+        ECS.RunTaskPolicyLive,
+        ECS.ServiceProvider(),
+        ECS.StopTaskPolicyLive,
+        ECS.TaskProvider(),
+        EKS.AccessEntryProvider(),
+        EKS.AddonProvider(),
+        EKS.ClusterProvider(),
+        EKS.PodIdentityAssociationProvider(),
+        ELBv2.ListenerProvider(),
+        ELBv2.LoadBalancerProvider(),
+        ELBv2.TargetGroupProvider(),
+        EventBridge.DescribeEventBusPolicyLive,
+        EventBridge.DescribeRulePolicyLive,
+        EventBridge.EventBusProvider(),
+        EventBridge.ListEventBusesPolicyLive,
+        EventBridge.ListRulesPolicyLive,
+        EventBridge.ListTargetsByRulePolicyLive,
+        EventBridge.PermissionProvider(),
+        EventBridge.PutEventsPolicyLive,
+        EventBridge.RuleProvider(),
+        EventBridge.TestEventPatternPolicyLive,
+        EventBridge.ToLambdaPolicyLive,
+        EventBridge.ToQueuePolicyLive,
+        IAM.AccessKeyProvider(),
+        IAM.AccountAliasProvider(),
+        IAM.AccountPasswordPolicyProvider(),
+        IAM.GroupMembershipProvider(),
+        IAM.GroupProvider(),
+        IAM.InstanceProfileProvider(),
+        IAM.LoginProfileProvider(),
+        IAM.OpenIDConnectProviderProvider(),
+        IAM.PolicyProvider(),
+        IAM.RoleProvider(),
+        IAM.SAMLProviderProvider(),
+        IAM.ServerCertificateProvider(),
+        IAM.ServiceSpecificCredentialProvider(),
+        IAM.SigningCertificateProvider(),
+        IAM.SSHPublicKeyProvider(),
+        IAM.UserProvider(),
+        IAM.VirtualMFADeviceProvider(),
+        IdentityCenter.AccountAssignmentProvider(),
+        IdentityCenter.GroupProvider(),
+        IdentityCenter.InstanceProvider(),
+        IdentityCenter.PermissionSetProvider(),
+        Kinesis.DescribeAccountSettingsPolicyLive,
+        Kinesis.DescribeLimitsPolicyLive,
+        Kinesis.DescribeStreamConsumerPolicyLive,
+        Kinesis.DescribeStreamPolicyLive,
+        Kinesis.DescribeStreamSummaryPolicyLive,
+        Kinesis.GetRecordsPolicyLive,
+        Kinesis.GetResourcePolicyPolicyLive,
+        Kinesis.GetShardIteratorPolicyLive,
+        Kinesis.ListShardsPolicyLive,
+        Kinesis.ListStreamConsumersPolicyLive,
+        Kinesis.ListStreamsPolicyLive,
+        Kinesis.ListTagsForResourcePolicyLive,
+        Kinesis.PutRecordPolicyLive,
+        Kinesis.PutRecordsPolicyLive,
+        Kinesis.StreamConsumerProvider(),
+        Kinesis.StreamProvider(),
+        Kinesis.StreamSinkPolicyLive,
+        Kinesis.SubscribeToShardPolicyLive,
+        Lambda.BucketEventSourcePolicyLive,
+        Lambda.EventSourceMappingProvider(),
+        Lambda.EventSourcePolicyLive,
+        Lambda.FunctionProvider(),
+        Lambda.InvokeFunctionPolicyLive,
+        Lambda.PermissionProvider(),
+        Lambda.QueueEventSourcePolicyLive,
+        Lambda.StreamEventSourcePolicyLive,
+        Lambda.TableEventSourcePolicyLive,
+        Lambda.TopicEventSourcePolicyLive,
+        Logs.LogGroupProvider(),
+        Organizations.AccountProvider(),
+        Organizations.DelegatedAdministratorProvider(),
+        Organizations.OrganizationalUnitProvider(),
+        Organizations.OrganizationProvider(),
+        Organizations.OrganizationResourcePolicyProvider(),
+        Organizations.PolicyAttachmentProvider(),
+        Organizations.PolicyProvider(),
+        Organizations.RootPolicyTypeProvider(),
+        Organizations.RootProvider(),
+        Organizations.TrustedServiceAccessProvider(),
+        RDS.ConnectPolicyLive,
+        RDS.DBClusterEndpointProvider(),
+        RDS.DBClusterParameterGroupProvider(),
+        RDS.DBClusterProvider(),
+        RDS.DBInstanceProvider(),
+        RDS.DBParameterGroupProvider(),
+        RDS.DBProxyEndpointProvider(),
+        RDS.DBProxyProvider(),
+        RDS.DBProxyTargetGroupProvider(),
+        RDS.DBSubnetGroupProvider(),
+        RDSData.BatchExecuteStatementPolicyLive,
+        RDSData.BeginTransactionPolicyLive,
+        RDSData.CommitTransactionPolicyLive,
+        RDSData.ExecuteSqlPolicyLive,
+        RDSData.ExecuteStatementPolicyLive,
+        RDSData.RollbackTransactionPolicyLive,
+        Route53.RecordProvider(),
+        S3.AbortMultipartUploadPolicyLive,
+        S3.BucketProvider(),
+        S3.CompleteMultipartUploadPolicyLive,
+        S3.CopyObjectPolicyLive,
+        S3.CreateMultipartUploadPolicyLive,
+        S3.DeleteObjectPolicyLive,
+        S3.GetObjectPolicyLive,
+        S3.HeadObjectPolicyLive,
+        S3.ListObjectsV2PolicyLive,
+        S3.PutObjectPolicyLive,
+        S3.UploadPartPolicyLive,
+        Scheduler.ScheduleGroupProvider(),
+        Scheduler.ScheduleProvider(),
+        SecretsManager.DescribeSecretPolicyLive,
+        SecretsManager.GetRandomPasswordPolicyLive,
+        SecretsManager.GetSecretValuePolicyLive,
+        SecretsManager.ListSecretsPolicyLive,
+        SecretsManager.PutSecretValuePolicyLive,
+        SecretsManager.SecretProvider(),
+        SNS.AddPermissionPolicyLive,
+        SNS.ConfirmSubscriptionPolicyLive,
+        SNS.GetDataProtectionPolicyPolicyLive,
+        SNS.GetSubscriptionAttributesPolicyLive,
+        SNS.GetTopicAttributesPolicyLive,
+        SNS.ListSubscriptionsByTopicPolicyLive,
+        SNS.ListSubscriptionsPolicyLive,
+        SNS.ListTagsForResourcePolicyLive,
+        SNS.ListTopicsPolicyLive,
+        SNS.PublishBatchPolicyLive,
+        SNS.PublishPolicyLive,
+        SNS.PutDataProtectionPolicyPolicyLive,
+        SNS.RemovePermissionPolicyLive,
+        SNS.SetSubscriptionAttributesPolicyLive,
+        SNS.SetTopicAttributesPolicyLive,
+        SNS.SubscriptionProvider(),
+        SNS.TagResourcePolicyLive,
+        SNS.TopicProvider(),
+        SNS.TopicSinkPolicyLive,
+        SNS.UntagResourcePolicyLive,
+        SQS.DeleteMessageBatchPolicyLive,
+        SQS.DeleteMessagePolicyLive,
+        SQS.QueueProvider(),
+        SQS.QueueSinkPolicyLive,
+        SQS.ReceiveMessagePolicyLive,
+        SQS.SendMessageBatchPolicyLive,
+        SQS.SendMessagePolicyLive,
+        Website.AssetDeploymentProvider(),
+      ),
+    ),
+    Layer.provideMerge(
+      Layer.mergeAll(
+        CommandProvider(),
+        KeyPairProvider(),
+        RandomProvider(),
+        Assets.AssetsProvider(),
+      ),
+    ),
+    Layer.provideMerge(Region.fromEnvironment),
+    Layer.provideMerge(Credentials.fromEnvironment),
+    Layer.provideMerge(Endpoint.fromEnvironment),
+    Layer.provideMerge(DefaultEnvironment),
+    Layer.provideMerge(AwsAuth),
+    Layer.provideMerge(CredentialsStoreLive),
+    // Apply a blanket retry policy to every AWS SDK call. Like distilled's
+    // `makeDefault` it retries throttling, 5xx, and Smithy `@retryable`
+    // errors with exponential backoff + jitter + `RetryAfter` header
+    // awareness, but with a higher attempt cap (10 vs 5) so heavy
+    // parallel deploys ride out S3 `SlowDown` bursts that span more than
+    // a few seconds. Bounded so real rate-limit pressure still surfaces
+    // instead of masking as an indefinite hang.
+    Layer.provideMerge(Layer.succeed(Retry, awsRetryFactory)),
+    Layer.orDie,
+  );
+
+// TODO(sam): remove this once it's upstreamed to distilled
+const isHttpTransportError = (error: unknown): boolean => {
+  if (!HttpClientError.isHttpClientError(error)) return false;
+  const tag = error.reason._tag;
+  if (tag === "TransportError") return true;
+  if (
+    tag === "StatusCodeError" &&
+    "response" in error.reason &&
+    error.reason.response.status >= 500
+  ) {
+    return true;
+  }
+  return false;
+};
+
+const awsRetryFactory: RetryFactory = (lastError) => ({
+  while: (error) =>
+    isTransientError(error) ||
+    isThrottlingError(error) ||
+    isRetryable(error) ||
+    isHttpTransportError(error),
+  schedule: pipe(
+    Schedule.exponential(Duration.millis(200), 2),
+    Schedule.modifyDelay(
+      Effect.fnUntraced(function* (duration) {
+        const error = yield* Ref.get(lastError);
+        if (isThrottlingError(error)) {
+          // Throttling: floor at 500ms (matches distilled default).
+          if (Duration.toMillis(duration) < 500) {
+            return Duration.toMillis(Duration.millis(500));
+          }
+        }
+        return Duration.toMillis(duration);
+      }),
+    ),
+    capped(Duration.seconds(5)),
+    jittered,
+    Schedule.both(Schedule.recurs(10)),
+  ),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/Aurora.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/Aurora.ts
new file mode 100644
index 00000000000..3288b6f52c3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/Aurora.ts
@@ -0,0 +1,499 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { Input } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
+import type { SecurityGroupId } from "../EC2/SecurityGroup.ts";
+import type { SubnetId } from "../EC2/Subnet.ts";
+import * as IAM from "../IAM/index.ts";
+import {
+  Secret,
+  type GenerateSecretStringProps,
+  type SecretProps,
+  type Secret as SecretResource,
+} from "../SecretsManager/Secret.ts";
+import {
+  DBCluster,
+  type DBClusterProps,
+  type DBCluster as DBClusterResource,
+} from "./DBCluster.ts";
+import {
+  DBClusterParameterGroup,
+  type DBClusterParameterGroupProps,
+  type DBClusterParameterGroup as DBClusterParameterGroupResource,
+} from "./DBClusterParameterGroup.ts";
+import {
+  DBInstance,
+  type DBInstanceProps,
+  type DBInstance as DBInstanceResource,
+} from "./DBInstance.ts";
+import {
+  DBParameterGroup,
+  type DBParameterGroupProps,
+  type DBParameterGroup as DBParameterGroupResource,
+} from "./DBParameterGroup.ts";
+import {
+  DBProxy,
+  type DBProxyProps,
+  type DBProxy as DBProxyResource,
+} from "./DBProxy.ts";
+import {
+  DBProxyEndpoint,
+  type DBProxyEndpointProps,
+  type DBProxyEndpoint as DBProxyEndpointResource,
+} from "./DBProxyEndpoint.ts";
+import {
+  DBProxyTargetGroup,
+  type DBProxyTargetGroupProps,
+  type DBProxyTargetGroup as DBProxyTargetGroupResource,
+} from "./DBProxyTargetGroup.ts";
+import {
+  DBSubnetGroup,
+  type DBSubnetGroupProps,
+  type DBSubnetGroup as DBSubnetGroupResource,
+} from "./DBSubnetGroup.ts";
+
+export interface AuroraSecretProps extends Omit<
+  SecretProps,
+  "secretString" | "secretBinary" | "generateSecretString"
+> {
+  /**
+   * Existing secret to reuse instead of creating one.
+   */
+  resource?: SecretResource;
+  /**
+   * Master username written into a generated secret payload.
+   * @default "app"
+   */
+  username?: string;
+  /**
+   * Optional explicit JSON/string secret payload.
+   */
+  secretString?: Redacted.Redacted<string>;
+  /**
+   * Optional explicit binary secret payload.
+   */
+  secretBinary?: Redacted.Redacted<Uint8Array<ArrayBufferLike>>;
+  /**
+   * Password generation settings for the created secret.
+   */
+  generateSecretString?: GenerateSecretStringProps;
+}
+
+export interface AuroraProxyProps extends Omit<
+  DBProxyProps,
+  "engineFamily" | "auth" | "roleArn" | "vpcSubnetIds"
+> {
+  /**
+   * Override the default proxy auth config.
+   */
+  auth?: DBProxyProps["auth"];
+  /**
+   * Additional target-group configuration for the default proxy target group.
+   */
+  targetGroup?: Omit<
+    DBProxyTargetGroupProps,
+    "dbProxyName" | "dbClusterIdentifiers"
+  >;
+  /**
+   * Optional extra endpoint to create for the proxy.
+   * Use `true` for sensible defaults.
+   */
+  endpoint?: true | Omit<DBProxyEndpointProps, "dbProxyName" | "vpcSubnetIds">;
+}
+
+export interface AuroraProps {
+  /**
+   * Database name created in the cluster.
+   * @default "app"
+   */
+  databaseName?: string;
+  /**
+   * Aurora engine.
+   * @default "aurora-postgresql"
+   */
+  engine?: string;
+  /**
+   * Optional engine version.
+   */
+  engineVersion?: string;
+  /**
+   * Subnets for the cluster and optional proxy.
+   */
+  subnetIds: Input<SubnetId[]>;
+  /**
+   * Security groups attached to the cluster and instance.
+   */
+  securityGroupIds: Input<SecurityGroupId[]>;
+  /**
+   * Number of read replicas to create alongside the writer.
+   * @default 0
+   */
+  readers?: number;
+  /**
+   * Cluster-wide tags applied to all created resources by default.
+   */
+  tags?: Record<string, Input<string>>;
+  /**
+   * Tune the generated or reused admin secret.
+   */
+  secret?: AuroraSecretProps;
+  /**
+   * Override subnet group creation.
+   */
+  subnetGroup?: Omit<DBSubnetGroupProps, "subnetIds">;
+  /**
+   * Optional cluster parameter group.
+   */
+  clusterParameterGroup?: Omit<DBClusterParameterGroupProps, "family"> & {
+    family: string;
+  };
+  /**
+   * Optional instance parameter group.
+   */
+  parameterGroup?: Omit<DBParameterGroupProps, "family"> & {
+    family: string;
+  };
+  /**
+   * Tune the Aurora cluster resource.
+   */
+  cluster?: Omit<
+    DBClusterProps,
+    | "engine"
+    | "engineVersion"
+    | "databaseName"
+    | "dbSubnetGroupName"
+    | "dbClusterParameterGroupName"
+    | "vpcSecurityGroupIds"
+    | "masterUserSecretArn"
+    | "masterUsername"
+    | "masterUserPassword"
+    | "tags"
+  > & {
+    tags?: Record<string, Input<string>>;
+  };
+  /**
+   * Tune the writer/readers.
+   */
+  instance?: Omit<
+    DBInstanceProps,
+    | "dbClusterIdentifier"
+    | "engine"
+    | "engineVersion"
+    | "dbSubnetGroupName"
+    | "dbParameterGroupName"
+    | "vpcSecurityGroupIds"
+    | "tags"
+  > & {
+    tags?: Record<string, Input<string>>;
+  };
+  /**
+   * Whether to enable the Aurora Data API.
+   * @default true
+   */
+  dataApi?: boolean;
+  /**
+   * Opt in to an auto-wired RDS Proxy.
+   */
+  proxy?: boolean | AuroraProxyProps;
+}
+
+export interface AuroraDatabase {
+  secret: SecretResource;
+  subnetGroup: DBSubnetGroupResource;
+  clusterParameterGroup?: DBClusterParameterGroupResource;
+  parameterGroup?: DBParameterGroupResource;
+  cluster: DBClusterResource;
+  writer: DBInstanceResource;
+  readers: DBInstanceResource[];
+  instances: [DBInstanceResource, ...DBInstanceResource[]];
+  proxy?: {
+    role: IAM.Role;
+    proxy: DBProxyResource;
+    targetGroup: DBProxyTargetGroupResource;
+    endpoint?: DBProxyEndpointResource;
+  };
+}
+
+const mergeTags = (
+  base: AuroraProps["tags"] | undefined,
+  extra: Record<string, Input<string>> | undefined,
+) => ({
+  ...base,
+  ...extra,
+});
+
+const inferProxyEngineFamily = (engine: string) => {
+  if (engine.includes("postgres")) {
+    return "POSTGRESQL" as const;
+  }
+  if (engine.includes("mysql")) {
+    return "MYSQL" as const;
+  }
+  return "POSTGRESQL" as const;
+};
+
+/**
+ * Opinionated Aurora bring-up helper.
+ *
+ * `Aurora` is the fast-start L2 for getting a working database online with one
+ * call. It creates a generated admin secret, DB subnet group, Aurora cluster,
+ * and a single writer instance by default. Optional readers, parameter groups,
+ * and an auto-wired RDS Proxy can be enabled as needs grow.
+ *
+ * The return value intentionally exposes the underlying `DB*` resources so
+ * users can expand into the lower-level surface without rewriting the stack.
+ *
+ * @example Start a Small Aurora Cluster
+ * ```typescript
+ * const db = yield* AWS.RDS.Aurora("AppDb", {
+ *   subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
+ *   securityGroupIds: [databaseSecurityGroup.groupId],
+ * });
+ * ```
+ *
+ * @example Add Readers and a Proxy
+ * ```typescript
+ * const db = yield* AWS.RDS.Aurora("AppDb", {
+ *   subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
+ *   securityGroupIds: [databaseSecurityGroup.groupId],
+ *   readers: 2,
+ *   proxy: true,
+ * });
+ * ```
+ */
+export const Aurora = (id: string, props: AuroraProps) =>
+  Namespace.push(
+    id,
+    Effect.gen(function* () {
+      const engine = props.engine ?? "aurora-postgresql";
+      const engineVersion = props.engineVersion;
+      const databaseName = props.databaseName ?? "app";
+      const username = props.secret?.username ?? "app";
+      const subnetIds = props.subnetIds;
+      const securityGroupIds = props.securityGroupIds;
+      const commonTags = props.tags;
+      const proxyConfig: AuroraProxyProps | undefined =
+        props.proxy === true ? {} : props.proxy || undefined;
+
+      const secret =
+        props.secret?.resource ??
+        (yield* Secret("Secret", {
+          name: props.secret?.name,
+          description:
+            props.secret?.description ??
+            `Credentials for Aurora database ${id}`,
+          kmsKeyId: props.secret?.kmsKeyId,
+          secretString: props.secret?.secretString,
+          secretBinary: props.secret?.secretBinary,
+          generateSecretString:
+            props.secret?.secretString || props.secret?.secretBinary
+              ? undefined
+              : {
+                  secretStringTemplate: JSON.stringify({ username }),
+                  generateStringKey: "password",
+                  PasswordLength: 32,
+                  ExcludeCharacters: "\"'@/\\",
+                  ...props.secret?.generateSecretString,
+                },
+          tags: mergeTags(commonTags, props.secret?.tags),
+        }));
+
+      const subnetGroup = yield* DBSubnetGroup("SubnetGroup", {
+        dbSubnetGroupName: props.subnetGroup?.dbSubnetGroupName,
+        description: props.subnetGroup?.description,
+        subnetIds,
+        tags: mergeTags(commonTags, props.subnetGroup?.tags),
+      });
+
+      const clusterParameterGroup = props.clusterParameterGroup
+        ? yield* DBClusterParameterGroup("ClusterParameterGroup", {
+            dbClusterParameterGroupName:
+              props.clusterParameterGroup.dbClusterParameterGroupName,
+            family: props.clusterParameterGroup.family,
+            description: props.clusterParameterGroup.description,
+            tags: mergeTags(commonTags, props.clusterParameterGroup.tags),
+          })
+        : undefined;
+
+      const parameterGroup = props.parameterGroup
+        ? yield* DBParameterGroup("ParameterGroup", {
+            dbParameterGroupName: props.parameterGroup.dbParameterGroupName,
+            family: props.parameterGroup.family,
+            description: props.parameterGroup.description,
+            tags: mergeTags(commonTags, props.parameterGroup.tags),
+          })
+        : undefined;
+
+      const cluster = yield* DBCluster("Cluster", {
+        engine,
+        engineVersion,
+        databaseName,
+        dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
+        dbClusterParameterGroupName:
+          clusterParameterGroup?.dbClusterParameterGroupName,
+        vpcSecurityGroupIds: securityGroupIds,
+        enableHttpEndpoint: props.dataApi ?? true,
+        copyTagsToSnapshot: props.cluster?.copyTagsToSnapshot ?? true,
+        deletionProtection: props.cluster?.deletionProtection ?? false,
+        serverlessV2ScalingConfiguration: props.cluster
+          ?.serverlessV2ScalingConfiguration ?? {
+          MinCapacity: 0.5,
+          MaxCapacity: 1,
+        },
+        masterUserSecretArn: secret.secretArn,
+        tags: mergeTags(commonTags, props.cluster?.tags),
+        ...props.cluster,
+      });
+
+      const writer = yield* DBInstance("Writer", {
+        dbClusterIdentifier: cluster.dbClusterIdentifier,
+        dbInstanceClass: props.instance?.dbInstanceClass ?? "db.serverless",
+        engine,
+        engineVersion,
+        dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
+        dbParameterGroupName: parameterGroup?.dbParameterGroupName,
+        vpcSecurityGroupIds: securityGroupIds,
+        publiclyAccessible: props.instance?.publiclyAccessible ?? false,
+        promotionTier: props.instance?.promotionTier ?? 0,
+        autoMinorVersionUpgrade:
+          props.instance?.autoMinorVersionUpgrade ?? true,
+        copyTagsToSnapshot: props.instance?.copyTagsToSnapshot ?? true,
+        tags: mergeTags(commonTags, props.instance?.tags),
+        ...props.instance,
+      });
+
+      const readers = yield* Effect.all(
+        Array.from({ length: props.readers ?? 0 }, (_, index) =>
+          DBInstance(`Reader${index + 1}`, {
+            dbClusterIdentifier: cluster.dbClusterIdentifier,
+            dbInstanceClass: props.instance?.dbInstanceClass ?? "db.serverless",
+            engine,
+            engineVersion,
+            dbSubnetGroupName: subnetGroup.dbSubnetGroupName,
+            dbParameterGroupName: parameterGroup?.dbParameterGroupName,
+            vpcSecurityGroupIds: securityGroupIds,
+            publiclyAccessible: props.instance?.publiclyAccessible ?? false,
+            promotionTier: index + 1,
+            autoMinorVersionUpgrade:
+              props.instance?.autoMinorVersionUpgrade ?? true,
+            copyTagsToSnapshot: props.instance?.copyTagsToSnapshot ?? true,
+            tags: mergeTags(commonTags, props.instance?.tags),
+            ...props.instance,
+          }),
+        ),
+        { concurrency: "unbounded" },
+      );
+
+      const proxy =
+        proxyConfig === undefined
+          ? undefined
+          : yield* Effect.gen(function* () {
+              const role = yield* IAM.Role("ProxyRole", {
+                assumeRolePolicyDocument: {
+                  Version: "2012-10-17",
+                  Statement: [
+                    {
+                      Effect: "Allow",
+                      Principal: {
+                        Service: "rds.amazonaws.com",
+                      },
+                      Action: ["sts:AssumeRole"],
+                      Resource: ["*"],
+                    },
+                  ],
+                },
+                inlinePolicies: {
+                  ReadSecret: {
+                    Version: "2012-10-17",
+                    Statement: [
+                      {
+                        Effect: "Allow",
+                        Action: [
+                          "secretsmanager:GetSecretValue",
+                          "secretsmanager:DescribeSecret",
+                        ],
+                        Resource: [secret.secretArn],
+                      },
+                    ],
+                  },
+                },
+                tags: mergeTags(commonTags, undefined),
+              });
+
+              const proxy = yield* DBProxy("Proxy", {
+                dbProxyName: proxyConfig.dbProxyName,
+                engineFamily: inferProxyEngineFamily(engine),
+                auth: proxyConfig.auth ?? [
+                  {
+                    AuthScheme: "SECRETS",
+                    SecretArn: secret.secretArn,
+                    IAMAuth: "DISABLED",
+                  },
+                ],
+                roleArn: role.roleArn,
+                vpcSubnetIds: subnetIds,
+                vpcSecurityGroupIds: securityGroupIds,
+                requireTLS: proxyConfig.requireTLS ?? true,
+                idleClientTimeout: proxyConfig.idleClientTimeout,
+                debugLogging: proxyConfig.debugLogging,
+                endpointNetworkType: proxyConfig.endpointNetworkType,
+                targetConnectionNetworkType:
+                  proxyConfig.targetConnectionNetworkType,
+                tags: mergeTags(commonTags, proxyConfig.tags),
+              });
+
+              const targetGroup = yield* DBProxyTargetGroup(
+                "ProxyTargetGroup",
+                {
+                  targetGroupName: proxyConfig.targetGroup?.targetGroupName,
+                  dbProxyName: proxy.dbProxyName,
+                  dbClusterIdentifiers: [cluster.dbClusterIdentifier],
+                  dbInstanceIdentifiers:
+                    proxyConfig.targetGroup?.dbInstanceIdentifiers,
+                  connectionPoolConfig:
+                    proxyConfig.targetGroup?.connectionPoolConfig,
+                },
+              );
+
+              const endpoint =
+                proxyConfig.endpoint === undefined
+                  ? undefined
+                  : yield* DBProxyEndpoint("ProxyEndpoint", {
+                      dbProxyName: proxy.dbProxyName,
+                      vpcSubnetIds: subnetIds,
+                      vpcSecurityGroupIds: securityGroupIds,
+                      ...(proxyConfig.endpoint === true
+                        ? {}
+                        : proxyConfig.endpoint),
+                      tags: mergeTags(
+                        commonTags,
+                        proxyConfig.endpoint === true
+                          ? undefined
+                          : proxyConfig.endpoint.tags,
+                      ),
+                    });
+
+              return {
+                role,
+                proxy,
+                targetGroup,
+                endpoint,
+              };
+            });
+
+      return {
+        secret,
+        subnetGroup,
+        clusterParameterGroup,
+        parameterGroup,
+        cluster,
+        writer,
+        readers,
+        instances: [writer, ...readers] as [
+          DBInstanceResource,
+          ...DBInstanceResource[],
+        ],
+        proxy,
+      } satisfies AuroraDatabase as AuroraDatabase;
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/Connect.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/Connect.ts
new file mode 100644
index 00000000000..327995ca2a1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/Connect.ts
@@ -0,0 +1,127 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Binding from "../../Binding.ts";
+import type { Input } from "../../Input.ts";
+import type { SecurityGroupId } from "../EC2/SecurityGroup.ts";
+import type { SubnetId } from "../EC2/Subnet.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+import type { DBCluster } from "./DBCluster.ts";
+import type { DBProxy } from "./DBProxy.ts";
+import type { DBProxyEndpoint } from "./DBProxyEndpoint.ts";
+
+type ConnectResource = DBCluster | DBProxy | DBProxyEndpoint;
+
+export interface ConnectionInfo {
+  host: string;
+  port: number;
+  database?: string;
+  username?: string;
+  password?: string;
+  ssl: boolean;
+}
+
+export interface ConnectOptions {
+  secret: Secret;
+  database?: string;
+  port?: number;
+  ssl?: boolean;
+  subnetIds?: Input<SubnetId[]>;
+  securityGroupIds?: Input<SecurityGroupId[]>;
+}
+
+/**
+ * Runtime binding that resolves connection settings for an Aurora cluster,
+ * proxy, or proxy endpoint using a Secrets Manager secret.
+ */
+export class Connect extends Binding.Service<
+  Connect,
+  (
+    resource: ConnectResource,
+    options: ConnectOptions,
+  ) => Effect.Effect<
+    Effect.Effect<ConnectionInfo, secretsmanager.GetSecretValueError>
+  >
+>()("AWS.RDS.Connect") {}
+
+export const ConnectLive = Layer.effect(
+  Connect,
+  Effect.gen(function* () {
+    const Policy = yield* ConnectPolicy;
+    const getSecretValue = yield* secretsmanager.getSecretValue;
+
+    return Effect.fn(function* (
+      resource: ConnectResource,
+      options: ConnectOptions,
+    ) {
+      const SecretId = yield* options.secret.secretArn;
+      const Host = yield* resource.endpoint;
+      const Port =
+        resource.Type === "AWS.RDS.DBCluster"
+          ? yield* resource.port
+          : undefined;
+      yield* Policy(resource, options);
+
+      return Effect.gen(function* () {
+        const secretId = yield* SecretId;
+        const host = yield* Host;
+        const port = Port ? yield* Port : undefined;
+        const value = yield* getSecretValue({
+          SecretId: secretId,
+        });
+        const secretString = value.SecretString
+          ? typeof value.SecretString === "string"
+            ? value.SecretString
+            : Redacted.value(value.SecretString)
+          : "{}";
+        const secret = JSON.parse(secretString) as {
+          username?: string;
+          password?: string;
+        };
+
+        if (!host) {
+          return yield* Effect.die(`RDS endpoint is not available yet`);
+        }
+
+        return {
+          host,
+          port: options.port ?? port ?? 5432,
+          database: options.database,
+          username: secret.username,
+          password: secret.password,
+          ssl: options.ssl ?? true,
+        };
+      });
+    });
+  }),
+);
+
+export class ConnectPolicy extends Binding.Policy<
+  ConnectPolicy,
+  (resource: ConnectResource, options: ConnectOptions) => Effect.Effect<void>
+>()("AWS.RDS.Connect") {}
+
+export const ConnectPolicyLive = ConnectPolicy.layer.succeed(
+  Effect.fn(function* (host, _resource, options) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.RDS.Connect(${options.secret}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: [
+              "secretsmanager:GetSecretValue",
+              "secretsmanager:DescribeSecret",
+            ],
+            Resource: [options.secret.secretArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ConnectPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBCluster.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBCluster.ts
new file mode 100644
index 00000000000..5256e51a47f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBCluster.ts
@@ -0,0 +1,374 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBClusterProps {
+  /**
+   * Cluster identifier. If omitted, Alchemy generates one.
+   */
+  dbClusterIdentifier?: string;
+  /**
+   * Aurora engine, such as `aurora-postgresql`.
+   */
+  engine: string;
+  /**
+   * Optional engine version.
+   */
+  engineVersion?: string;
+  /**
+   * Optional database name created with the cluster.
+   */
+  databaseName?: string;
+  /**
+   * Subnet group used by the cluster.
+   */
+  dbSubnetGroupName?: string;
+  /**
+   * Cluster parameter group name.
+   */
+  dbClusterParameterGroupName?: string;
+  /**
+   * Security groups attached to the cluster.
+   */
+  vpcSecurityGroupIds?: string[];
+  /**
+   * Optional listener port.
+   */
+  port?: number;
+  /**
+   * Enable IAM database authentication.
+   */
+  enableIAMDatabaseAuthentication?: boolean;
+  /**
+   * Enable Aurora Data API / HTTP endpoint support.
+   */
+  enableHttpEndpoint?: boolean;
+  /**
+   * Engine mode, for example `provisioned` or `serverless`.
+   */
+  engineMode?: string;
+  /**
+   * Serverless v2 scaling configuration.
+   */
+  serverlessV2ScalingConfiguration?: rds.ServerlessV2ScalingConfiguration;
+  /**
+   * Whether to copy tags to snapshots.
+   */
+  copyTagsToSnapshot?: boolean;
+  /**
+   * Whether to block accidental deletion.
+   */
+  deletionProtection?: boolean;
+  /**
+   * Whether the storage is encrypted.
+   */
+  storageEncrypted?: boolean;
+  /**
+   * Optional KMS key used for storage encryption.
+   */
+  kmsKeyId?: string;
+  /**
+   * Let RDS manage the master user password in Secrets Manager.
+   */
+  manageMasterUserPassword?: boolean;
+  /**
+   * Explicit master username when not deriving credentials from a secret.
+   */
+  masterUsername?: string;
+  /**
+   * Explicit master password when not deriving credentials from a secret.
+   */
+  masterUserPassword?: string;
+  /**
+   * Existing Secrets Manager secret ARN whose JSON payload contains
+   * `username` and `password`.
+   */
+  masterUserSecretArn?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBCluster extends Resource<
+  "AWS.RDS.DBCluster",
+  DBClusterProps,
+  {
+    dbClusterIdentifier: string;
+    dbClusterArn: string;
+    dbSubnetGroupName: string | undefined;
+    endpoint: string | undefined;
+    readerEndpoint: string | undefined;
+    port: number | undefined;
+    engine: string;
+    engineVersion: string | undefined;
+    status: string | undefined;
+    databaseName: string | undefined;
+    masterUsername: string | undefined;
+    masterUserSecretArn: string | undefined;
+    vpcSecurityGroupIds: string[];
+    httpEndpointEnabled: boolean | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Aurora DB cluster.
+ *
+ * `DBCluster` owns the writer and reader endpoints, cluster-wide networking,
+ * and Data API enablement. It can bootstrap master credentials directly or by
+ * reading a Secrets Manager secret that contains `username` and `password`.
+ */
+export const DBCluster = Resource<DBCluster>("AWS.RDS.DBCluster");
+
+const toTagRecord = (
+  tags: Array<{ Key?: string; Value?: string }> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const resolveMasterCredentials = (props: DBClusterProps) =>
+  Effect.gen(function* () {
+    if (props.masterUserSecretArn) {
+      const value = yield* secretsmanager.getSecretValue({
+        SecretId: props.masterUserSecretArn,
+      });
+      const secretString = value.SecretString
+        ? typeof value.SecretString === "string"
+          ? value.SecretString
+          : Redacted.value(value.SecretString)
+        : undefined;
+      const secret = secretString
+        ? (JSON.parse(secretString) as {
+            username?: string;
+            password?: string;
+          })
+        : {};
+      return {
+        MasterUsername: props.masterUsername ?? secret.username,
+        MasterUserPassword: props.masterUserPassword ?? secret.password,
+      };
+    }
+
+    return {
+      MasterUsername: props.masterUsername,
+      MasterUserPassword: props.masterUserPassword,
+    };
+  });
+
+const toAttrs = ({
+  cluster,
+  tags,
+}: {
+  cluster: rds.DBCluster;
+  tags: Record<string, string>;
+}): DBCluster["Attributes"] => ({
+  dbClusterIdentifier: cluster.DBClusterIdentifier ?? "",
+  dbClusterArn: cluster.DBClusterArn ?? "",
+  dbSubnetGroupName: cluster.DBSubnetGroup,
+  endpoint: cluster.Endpoint,
+  readerEndpoint: cluster.ReaderEndpoint,
+  port: cluster.Port,
+  engine: cluster.Engine ?? "",
+  engineVersion: cluster.EngineVersion,
+  status: cluster.Status,
+  databaseName: cluster.DatabaseName,
+  masterUsername: cluster.MasterUsername,
+  masterUserSecretArn: cluster.MasterUserSecret?.SecretArn,
+  vpcSecurityGroupIds: (cluster.VpcSecurityGroups ?? []).flatMap((group) =>
+    group.VpcSecurityGroupId ? [group.VpcSecurityGroupId] : [],
+  ),
+  httpEndpointEnabled: cluster.HttpEndpointEnabled,
+  tags,
+});
+
+export const DBClusterProvider = () =>
+  Provider.effect(
+    DBCluster,
+    Effect.gen(function* () {
+      const toIdentifier = (id: string, props: DBClusterProps) =>
+        props.dbClusterIdentifier
+          ? Effect.succeed(props.dbClusterIdentifier)
+          : createPhysicalName({ id, maxLength: 63 });
+
+      const readCluster = Effect.fn(function* (clusterId: string) {
+        const response = yield* rds
+          .describeDBClusters({
+            DBClusterIdentifier: clusterId,
+          })
+          .pipe(
+            Effect.catchTag("DBClusterNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBClusters?.[0];
+      });
+
+      const waitForCluster = Effect.fn(function* (clusterId: string) {
+        const readinessPolicy = Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(30)),
+        );
+        return yield* readCluster(clusterId).pipe(
+          Effect.flatMap((cluster) =>
+            cluster?.DBClusterArn
+              ? Effect.succeed(cluster)
+              : Effect.fail(new Error(`DB cluster '${clusterId}' not ready`)),
+          ),
+          Effect.retry({ schedule: readinessPolicy }),
+        );
+      });
+
+      return {
+        stables: ["dbClusterArn", "dbClusterIdentifier"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toIdentifier(id, olds ?? ({} as DBClusterProps))) !==
+            (yield* toIdentifier(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (olds?.engine !== news.engine) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const identifier =
+            output?.dbClusterIdentifier ??
+            (yield* toIdentifier(
+              id,
+              olds ?? ({ engine: "" } as DBClusterProps),
+            ));
+          const cluster = yield* readCluster(identifier);
+          if (!cluster?.DBClusterArn) {
+            return undefined;
+          }
+          return toAttrs({
+            cluster,
+            tags: toTagRecord(cluster.TagList),
+          });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const identifier =
+            output?.dbClusterIdentifier ?? (yield* toIdentifier(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+          const credentials = yield* resolveMasterCredentials(news);
+
+          // Observe — fetch live cluster state. We never trust `output`
+          // blindly: the cluster may have been deleted out-of-band, or this
+          // may be a first-time reconcile after adoption.
+          let observed = yield* readCluster(identifier);
+
+          // Ensure — create the cluster if it's missing. Tolerate
+          // `DBClusterAlreadyExistsFault` as a race with a peer reconciler
+          // (e.g. retry after state-persistence failure).
+          if (!observed?.DBClusterArn) {
+            yield* rds
+              .createDBCluster({
+                DBClusterIdentifier: identifier,
+                Engine: news.engine,
+                EngineVersion: news.engineVersion,
+                DatabaseName: news.databaseName,
+                DBSubnetGroupName: news.dbSubnetGroupName,
+                DBClusterParameterGroupName: news.dbClusterParameterGroupName,
+                VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+                Port: news.port,
+                EnableIAMDatabaseAuthentication:
+                  news.enableIAMDatabaseAuthentication,
+                EnableHttpEndpoint: news.enableHttpEndpoint,
+                EngineMode: news.engineMode,
+                ServerlessV2ScalingConfiguration:
+                  news.serverlessV2ScalingConfiguration,
+                CopyTagsToSnapshot: news.copyTagsToSnapshot,
+                DeletionProtection: news.deletionProtection,
+                StorageEncrypted: news.storageEncrypted,
+                KmsKeyId: news.kmsKeyId,
+                ManageMasterUserPassword: news.manageMasterUserPassword,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+                ...credentials,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBClusterAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+
+            observed = yield* waitForCluster(identifier);
+          } else {
+            // Sync mutable cluster config — push the desired shape via
+            // `modifyDBCluster`. Many fields land in `PendingModifiedValues`
+            // and apply on next reboot; `ApplyImmediately` shortens that.
+            yield* rds.modifyDBCluster({
+              DBClusterIdentifier: identifier,
+              EngineVersion: news.engineVersion,
+              DBClusterParameterGroupName: news.dbClusterParameterGroupName,
+              VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+              Port: news.port,
+              EnableIAMDatabaseAuthentication:
+                news.enableIAMDatabaseAuthentication,
+              EnableHttpEndpoint: news.enableHttpEndpoint,
+              ServerlessV2ScalingConfiguration:
+                news.serverlessV2ScalingConfiguration,
+              CopyTagsToSnapshot: news.copyTagsToSnapshot,
+              DeletionProtection: news.deletionProtection,
+              MasterUserPassword: credentials.MasterUserPassword,
+              ApplyImmediately: true,
+            });
+            observed = yield* waitForCluster(identifier);
+          }
+
+          const dbClusterArn = observed.DBClusterArn ?? "";
+
+          // Sync tags — diff observed cloud tags against desired so the
+          // reconciler converges regardless of what was on the resource
+          // before (initial create, adoption, or drift).
+          const observedTags = toTagRecord(observed.TagList);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbClusterArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbClusterArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbClusterArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbClusterArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbClusterArn || identifier);
+          return toAttrs({ cluster: observed, tags: desiredTags });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBCluster({
+              DBClusterIdentifier: output.dbClusterIdentifier,
+              SkipFinalSnapshot: true,
+            })
+            .pipe(Effect.catchTag("DBClusterNotFoundFault", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBClusterEndpoint.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBClusterEndpoint.ts
new file mode 100644
index 00000000000..fff22911b0d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBClusterEndpoint.ts
@@ -0,0 +1,232 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBClusterEndpointProps {
+  /**
+   * Endpoint identifier. If omitted, Alchemy generates one.
+   */
+  dbClusterEndpointIdentifier?: string;
+  /**
+   * Cluster that owns the endpoint.
+   */
+  dbClusterIdentifier: string;
+  /**
+   * Endpoint type such as `READER`, `WRITER`, or `ANY`.
+   */
+  endpointType: string;
+  /**
+   * Static members explicitly attached to the endpoint.
+   */
+  staticMembers?: string[];
+  /**
+   * Members excluded from the endpoint.
+   */
+  excludedMembers?: string[];
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBClusterEndpoint extends Resource<
+  "AWS.RDS.DBClusterEndpoint",
+  DBClusterEndpointProps,
+  {
+    dbClusterEndpointIdentifier: string;
+    dbClusterEndpointArn: string | undefined;
+    dbClusterIdentifier: string | undefined;
+    endpoint: string | undefined;
+    status: string | undefined;
+    endpointType: string | undefined;
+    customEndpointType: string | undefined;
+    staticMembers: string[];
+    excludedMembers: string[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A custom Aurora cluster endpoint.
+ */
+export const DBClusterEndpoint = Resource<DBClusterEndpoint>(
+  "AWS.RDS.DBClusterEndpoint",
+);
+
+const toAttrs = ({
+  endpoint,
+  tags,
+}: {
+  endpoint: rds.DBClusterEndpoint;
+  tags: Record<string, string>;
+}): DBClusterEndpoint["Attributes"] => ({
+  dbClusterEndpointIdentifier: endpoint.DBClusterEndpointIdentifier ?? "",
+  dbClusterEndpointArn: endpoint.DBClusterEndpointArn,
+  dbClusterIdentifier: endpoint.DBClusterIdentifier,
+  endpoint: endpoint.Endpoint,
+  status: endpoint.Status,
+  endpointType: endpoint.EndpointType,
+  customEndpointType: endpoint.CustomEndpointType,
+  staticMembers: endpoint.StaticMembers ?? [],
+  excludedMembers: endpoint.ExcludedMembers ?? [],
+  tags,
+});
+
+export const DBClusterEndpointProvider = () =>
+  Provider.effect(
+    DBClusterEndpoint,
+    Effect.gen(function* () {
+      const toIdentifier = (id: string, props: DBClusterEndpointProps) =>
+        props.dbClusterEndpointIdentifier
+          ? Effect.succeed(props.dbClusterEndpointIdentifier)
+          : createPhysicalName({ id, maxLength: 63 });
+
+      const readEndpoint = Effect.fn(function* (identifier: string) {
+        const response = yield* rds
+          .describeDBClusterEndpoints({
+            DBClusterEndpointIdentifier: identifier,
+          })
+          .pipe(
+            Effect.catchTag("DBClusterNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBClusterEndpoints?.[0];
+      });
+
+      return {
+        stables: ["dbClusterEndpointArn", "dbClusterEndpointIdentifier"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toIdentifier(
+              id,
+              olds ?? ({} as DBClusterEndpointProps),
+            )) !== (yield* toIdentifier(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (olds?.dbClusterIdentifier !== news.dbClusterIdentifier) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const identifier =
+            output?.dbClusterEndpointIdentifier ??
+            (yield* toIdentifier(
+              id,
+              olds ??
+                ({
+                  dbClusterIdentifier: "",
+                  endpointType: "READER",
+                } as DBClusterEndpointProps),
+            ));
+          const endpoint = yield* readEndpoint(identifier);
+          if (!endpoint?.DBClusterEndpointIdentifier) {
+            return undefined;
+          }
+          return toAttrs({ endpoint, tags: output?.tags ?? {} });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const identifier =
+            output?.dbClusterEndpointIdentifier ??
+            (yield* toIdentifier(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch the endpoint's live state.
+          let observed = yield* readEndpoint(identifier);
+
+          // Ensure — create if missing. Tolerate
+          // `DBClusterEndpointAlreadyExistsFault` as a race with a peer
+          // reconciler.
+          if (!observed?.DBClusterEndpointIdentifier) {
+            yield* rds
+              .createDBClusterEndpoint({
+                DBClusterIdentifier: news.dbClusterIdentifier,
+                DBClusterEndpointIdentifier: identifier,
+                EndpointType: news.endpointType,
+                StaticMembers: news.staticMembers,
+                ExcludedMembers: news.excludedMembers,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBClusterEndpointAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readEndpoint(identifier);
+            if (!observed?.DBClusterEndpointIdentifier) {
+              return yield* Effect.fail(
+                new Error(
+                  `DB cluster endpoint '${identifier}' not found after create`,
+                ),
+              );
+            }
+          } else {
+            // Sync mutable endpoint config — push desired shape.
+            yield* rds.modifyDBClusterEndpoint({
+              DBClusterEndpointIdentifier: identifier,
+              EndpointType: news.endpointType,
+              StaticMembers: news.staticMembers,
+              ExcludedMembers: news.excludedMembers,
+            });
+            observed = yield* readEndpoint(identifier);
+            if (!observed?.DBClusterEndpointIdentifier) {
+              return yield* Effect.fail(
+                new Error(
+                  `DB cluster endpoint '${identifier}' not found after update`,
+                ),
+              );
+            }
+          }
+
+          const dbClusterEndpointArn = observed.DBClusterEndpointArn;
+
+          // Sync tags — diff observed cloud tags against desired. The
+          // describeDBClusterEndpoints response does not include tags, so we
+          // diff against the previously-recorded tag set on `output`.
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbClusterEndpointArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbClusterEndpointArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbClusterEndpointArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbClusterEndpointArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbClusterEndpointArn ?? identifier);
+          return toAttrs({ endpoint: observed, tags: desiredTags });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBClusterEndpoint({
+              DBClusterEndpointIdentifier: output.dbClusterEndpointIdentifier,
+            })
+            .pipe(
+              Effect.catchTag(
+                "DBClusterEndpointNotFoundFault",
+                () => Effect.void,
+              ),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBClusterParameterGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBClusterParameterGroup.ts
new file mode 100644
index 00000000000..c18a411b23b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBClusterParameterGroup.ts
@@ -0,0 +1,194 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBClusterParameterGroupProps {
+  /**
+   * Name of the parameter group. If omitted, Alchemy generates one.
+   */
+  dbClusterParameterGroupName?: string;
+  /**
+   * Parameter group family, for example `aurora-postgresql16`.
+   */
+  family: string;
+  /**
+   * Human-readable description.
+   */
+  description?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBClusterParameterGroup extends Resource<
+  "AWS.RDS.DBClusterParameterGroup",
+  DBClusterParameterGroupProps,
+  {
+    dbClusterParameterGroupName: string;
+    dbClusterParameterGroupArn: string | undefined;
+    family: string;
+    description: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Aurora cluster parameter group.
+ */
+export const DBClusterParameterGroup = Resource<DBClusterParameterGroup>(
+  "AWS.RDS.DBClusterParameterGroup",
+);
+
+export const DBClusterParameterGroupProvider = () =>
+  Provider.effect(
+    DBClusterParameterGroup,
+    Effect.gen(function* () {
+      const toName = (id: string, props: DBClusterParameterGroupProps) =>
+        props.dbClusterParameterGroupName
+          ? Effect.succeed(props.dbClusterParameterGroupName)
+          : createPhysicalName({ id, maxLength: 255 });
+
+      const readGroup = Effect.fn(function* (name: string) {
+        const response = yield* rds
+          .describeDBClusterParameterGroups({
+            DBClusterParameterGroupName: name,
+          })
+          .pipe(
+            Effect.catchTag("DBParameterGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBClusterParameterGroups?.[0];
+      });
+
+      return {
+        stables: ["dbClusterParameterGroupArn", "dbClusterParameterGroupName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          if (
+            (yield* toName(
+              id,
+              olds ?? ({} as DBClusterParameterGroupProps),
+            )) !== (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds?.family !== news.family ||
+            olds?.description !== news.description
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.dbClusterParameterGroupName ??
+            (yield* toName(
+              id,
+              olds ?? ({ family: "" } as DBClusterParameterGroupProps),
+            ));
+          const group = yield* readGroup(name);
+          if (!group?.DBClusterParameterGroupName) {
+            return undefined;
+          }
+          return {
+            dbClusterParameterGroupName: group.DBClusterParameterGroupName,
+            dbClusterParameterGroupArn: group.DBClusterParameterGroupArn,
+            family: group.DBParameterGroupFamily ?? olds?.family ?? "",
+            description: group.Description,
+            tags: output?.tags ?? {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name =
+            output?.dbClusterParameterGroupName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch the parameter group's live state.
+          let observed = yield* readGroup(name);
+
+          // Ensure — create if missing. Tolerate
+          // `DBParameterGroupAlreadyExistsFault` as a race with a peer
+          // reconciler by re-reading.
+          if (!observed?.DBClusterParameterGroupName) {
+            yield* rds
+              .createDBClusterParameterGroup({
+                DBClusterParameterGroupName: name,
+                DBParameterGroupFamily: news.family,
+                Description:
+                  news.description ?? `Alchemy parameter group ${name}`,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBParameterGroupAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readGroup(name);
+            if (!observed?.DBClusterParameterGroupName) {
+              return yield* Effect.fail(
+                new Error(
+                  `Failed to create DB cluster parameter group '${name}'`,
+                ),
+              );
+            }
+          }
+
+          const dbClusterParameterGroupArn =
+            observed.DBClusterParameterGroupArn;
+
+          // Sync tags — diff observed (the describe response does not
+          // surface tags, so use prior `output.tags` as the baseline) ↔
+          // desired.
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbClusterParameterGroupArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbClusterParameterGroupArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbClusterParameterGroupArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbClusterParameterGroupArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbClusterParameterGroupArn ?? name);
+          return {
+            dbClusterParameterGroupName: observed.DBClusterParameterGroupName,
+            dbClusterParameterGroupArn,
+            family: observed.DBParameterGroupFamily ?? news.family,
+            description: observed.Description,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBClusterParameterGroup({
+              DBClusterParameterGroupName: output.dbClusterParameterGroupName,
+            })
+            .pipe(
+              Effect.catchTag(
+                "DBParameterGroupNotFoundFault",
+                () => Effect.void,
+              ),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBInstance.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBInstance.ts
new file mode 100644
index 00000000000..bbf334b52f9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBInstance.ts
@@ -0,0 +1,282 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBInstanceProps {
+  /**
+   * Instance identifier. If omitted, Alchemy generates one.
+   */
+  dbInstanceIdentifier?: string;
+  /**
+   * Aurora cluster the instance belongs to.
+   */
+  dbClusterIdentifier?: string;
+  /**
+   * Instance class such as `db.serverless`.
+   */
+  dbInstanceClass: string;
+  /**
+   * Database engine, usually matching the cluster engine.
+   */
+  engine: string;
+  /**
+   * Optional engine version.
+   */
+  engineVersion?: string;
+  /**
+   * Optional DB subnet group.
+   */
+  dbSubnetGroupName?: string;
+  /**
+   * Optional DB parameter group.
+   */
+  dbParameterGroupName?: string;
+  /**
+   * VPC security groups attached to the instance.
+   */
+  vpcSecurityGroupIds?: string[];
+  /**
+   * Whether the instance is publicly reachable.
+   */
+  publiclyAccessible?: boolean;
+  /**
+   * Promotion tier inside the cluster.
+   */
+  promotionTier?: number;
+  /**
+   * Auto minor version upgrades.
+   */
+  autoMinorVersionUpgrade?: boolean;
+  /**
+   * Copy tags to snapshots.
+   */
+  copyTagsToSnapshot?: boolean;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBInstance extends Resource<
+  "AWS.RDS.DBInstance",
+  DBInstanceProps,
+  {
+    dbInstanceIdentifier: string;
+    dbInstanceArn: string;
+    dbClusterIdentifier: string | undefined;
+    endpointAddress: string | undefined;
+    endpointPort: number | undefined;
+    dbInstanceClass: string | undefined;
+    engine: string | undefined;
+    engineVersion: string | undefined;
+    status: string | undefined;
+    promotionTier: number | undefined;
+    publiclyAccessible: boolean | undefined;
+    dbSubnetGroupName: string | undefined;
+    dbParameterGroupNames: string[];
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Aurora cluster instance.
+ */
+export const DBInstance = Resource<DBInstance>("AWS.RDS.DBInstance");
+
+const toTagRecord = (
+  tags: Array<{ Key?: string; Value?: string }> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const toAttrs = ({
+  instance,
+  tags,
+}: {
+  instance: rds.DBInstance;
+  tags: Record<string, string>;
+}): DBInstance["Attributes"] => ({
+  dbInstanceIdentifier: instance.DBInstanceIdentifier ?? "",
+  dbInstanceArn: instance.DBInstanceArn ?? "",
+  dbClusterIdentifier: instance.DBClusterIdentifier,
+  endpointAddress: instance.Endpoint?.Address,
+  endpointPort: instance.Endpoint?.Port,
+  dbInstanceClass: instance.DBInstanceClass,
+  engine: instance.Engine,
+  engineVersion: instance.EngineVersion,
+  status: instance.DBInstanceStatus,
+  promotionTier: instance.PromotionTier,
+  publiclyAccessible: instance.PubliclyAccessible,
+  dbSubnetGroupName: instance.DBSubnetGroup?.DBSubnetGroupName,
+  dbParameterGroupNames: (instance.DBParameterGroups ?? []).flatMap((group) =>
+    group.DBParameterGroupName ? [group.DBParameterGroupName] : [],
+  ),
+  tags,
+});
+
+export const DBInstanceProvider = () =>
+  Provider.effect(
+    DBInstance,
+    Effect.gen(function* () {
+      const toIdentifier = (id: string, props: DBInstanceProps) =>
+        props.dbInstanceIdentifier
+          ? Effect.succeed(props.dbInstanceIdentifier)
+          : createPhysicalName({ id, maxLength: 63 });
+
+      const readInstance = Effect.fn(function* (instanceId: string) {
+        const response = yield* rds
+          .describeDBInstances({
+            DBInstanceIdentifier: instanceId,
+          })
+          .pipe(
+            Effect.catchTag("DBInstanceNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBInstances?.[0];
+      });
+
+      const waitForInstance = Effect.fn(function* (instanceId: string) {
+        const readinessPolicy = Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(30)),
+        );
+        return yield* readInstance(instanceId).pipe(
+          Effect.flatMap((instance) =>
+            instance?.DBInstanceArn
+              ? Effect.succeed(instance)
+              : Effect.fail(new Error(`DB instance '${instanceId}' not ready`)),
+          ),
+          Effect.retry({ schedule: readinessPolicy }),
+        );
+      });
+
+      return {
+        stables: ["dbInstanceArn", "dbInstanceIdentifier"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toIdentifier(id, olds ?? ({} as DBInstanceProps))) !==
+            (yield* toIdentifier(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const identifier =
+            output?.dbInstanceIdentifier ??
+            (yield* toIdentifier(
+              id,
+              olds ?? { dbInstanceClass: "", engine: "" },
+            ));
+          const instance = yield* readInstance(identifier);
+          if (!instance?.DBInstanceArn) {
+            return undefined;
+          }
+          return toAttrs({ instance, tags: toTagRecord(instance.TagList) });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const identifier =
+            output?.dbInstanceIdentifier ?? (yield* toIdentifier(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live instance state.
+          let observed = yield* readInstance(identifier);
+
+          // Ensure — create if missing. Tolerate
+          // `DBInstanceAlreadyExistsFault` as a race with a peer reconciler.
+          if (!observed?.DBInstanceArn) {
+            yield* rds
+              .createDBInstance({
+                DBInstanceIdentifier: identifier,
+                DBClusterIdentifier: news.dbClusterIdentifier,
+                DBInstanceClass: news.dbInstanceClass,
+                Engine: news.engine,
+                EngineVersion: news.engineVersion,
+                DBSubnetGroupName: news.dbSubnetGroupName,
+                DBParameterGroupName: news.dbParameterGroupName,
+                VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+                PubliclyAccessible: news.publiclyAccessible,
+                PromotionTier: news.promotionTier,
+                AutoMinorVersionUpgrade: news.autoMinorVersionUpgrade,
+                CopyTagsToSnapshot: news.copyTagsToSnapshot,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBInstanceAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+
+            observed = yield* waitForInstance(identifier);
+          } else {
+            // Sync mutable instance config — push desired shape via
+            // `modifyDBInstance`. Many fields land in
+            // `PendingModifiedValues`; `ApplyImmediately` shortens the wait.
+            yield* rds.modifyDBInstance({
+              DBInstanceIdentifier: identifier,
+              DBInstanceClass: news.dbInstanceClass,
+              EngineVersion: news.engineVersion,
+              DBParameterGroupName: news.dbParameterGroupName,
+              VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+              PubliclyAccessible: news.publiclyAccessible,
+              PromotionTier: news.promotionTier,
+              AutoMinorVersionUpgrade: news.autoMinorVersionUpgrade,
+              CopyTagsToSnapshot: news.copyTagsToSnapshot,
+              ApplyImmediately: true,
+            });
+            observed = yield* waitForInstance(identifier);
+          }
+
+          const dbInstanceArn = observed.DBInstanceArn ?? "";
+
+          // Sync tags — diff observed cloud tags against desired.
+          const observedTags = toTagRecord(observed.TagList);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbInstanceArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbInstanceArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbInstanceArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbInstanceArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbInstanceArn || identifier);
+          return toAttrs({ instance: observed, tags: desiredTags });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBInstance({
+              DBInstanceIdentifier: output.dbInstanceIdentifier,
+              SkipFinalSnapshot: true,
+            })
+            .pipe(
+              Effect.catchTag("DBInstanceNotFoundFault", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBParameterGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBParameterGroup.ts
new file mode 100644
index 00000000000..ebd0942efbc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBParameterGroup.ts
@@ -0,0 +1,188 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBParameterGroupProps {
+  /**
+   * Name of the parameter group. If omitted, Alchemy generates one.
+   */
+  dbParameterGroupName?: string;
+  /**
+   * Parameter group family, for example `aurora-postgresql16`.
+   */
+  family: string;
+  /**
+   * Human-readable description.
+   */
+  description?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBParameterGroup extends Resource<
+  "AWS.RDS.DBParameterGroup",
+  DBParameterGroupProps,
+  {
+    dbParameterGroupName: string;
+    dbParameterGroupArn: string | undefined;
+    family: string;
+    description: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An RDS DB parameter group, useful for Aurora cluster instances.
+ */
+export const DBParameterGroup = Resource<DBParameterGroup>(
+  "AWS.RDS.DBParameterGroup",
+);
+
+export const DBParameterGroupProvider = () =>
+  Provider.effect(
+    DBParameterGroup,
+    Effect.gen(function* () {
+      const toName = (id: string, props: DBParameterGroupProps) =>
+        props.dbParameterGroupName
+          ? Effect.succeed(props.dbParameterGroupName)
+          : createPhysicalName({ id, maxLength: 255 });
+
+      const readGroup = Effect.fn(function* (name: string) {
+        const response = yield* rds
+          .describeDBParameterGroups({
+            DBParameterGroupName: name,
+          })
+          .pipe(
+            Effect.catchTag("DBParameterGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBParameterGroups?.[0];
+      });
+
+      return {
+        stables: ["dbParameterGroupArn", "dbParameterGroupName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toName(id, olds ?? ({} as DBParameterGroupProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            olds?.family !== news.family ||
+            olds?.description !== news.description
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.dbParameterGroupName ??
+            (yield* toName(
+              id,
+              olds ?? ({ family: "" } as DBParameterGroupProps),
+            ));
+          const group = yield* readGroup(name);
+          if (!group?.DBParameterGroupName) {
+            return undefined;
+          }
+          return {
+            dbParameterGroupName: group.DBParameterGroupName,
+            dbParameterGroupArn: group.DBParameterGroupArn,
+            family: group.DBParameterGroupFamily ?? olds?.family ?? "",
+            description: group.Description,
+            tags: output?.tags ?? {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name =
+            output?.dbParameterGroupName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live parameter-group state.
+          let observed = yield* readGroup(name);
+
+          // Ensure — create if missing. Tolerate
+          // `DBParameterGroupAlreadyExistsFault` as a race with a peer
+          // reconciler by re-reading.
+          if (!observed?.DBParameterGroupName) {
+            yield* rds
+              .createDBParameterGroup({
+                DBParameterGroupName: name,
+                DBParameterGroupFamily: news.family,
+                Description:
+                  news.description ?? `Alchemy parameter group ${name}`,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBParameterGroupAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readGroup(name);
+            if (!observed?.DBParameterGroupName) {
+              return yield* Effect.fail(
+                new Error(`Failed to create DB parameter group '${name}'`),
+              );
+            }
+          }
+
+          const dbParameterGroupArn = observed.DBParameterGroupArn;
+
+          // Sync tags — diff prior recorded tags against desired (the
+          // describe response does not surface tags directly).
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbParameterGroupArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbParameterGroupArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbParameterGroupArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbParameterGroupArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbParameterGroupArn ?? name);
+          return {
+            dbParameterGroupName: observed.DBParameterGroupName,
+            dbParameterGroupArn,
+            family: observed.DBParameterGroupFamily ?? news.family,
+            description: observed.Description,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBParameterGroup({
+              DBParameterGroupName: output.dbParameterGroupName,
+            })
+            .pipe(
+              Effect.catchTag(
+                "DBParameterGroupNotFoundFault",
+                () => Effect.void,
+              ),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxy.ts
new file mode 100644
index 00000000000..522b993caca
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxy.ts
@@ -0,0 +1,266 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBProxyProps {
+  /**
+   * Proxy name. If omitted, Alchemy generates one.
+   */
+  dbProxyName?: string;
+  /**
+   * Engine family such as `POSTGRESQL`.
+   */
+  engineFamily: rds.EngineFamily;
+  /**
+   * Authentication config for the proxy.
+   */
+  auth: rds.UserAuthConfig[];
+  /**
+   * IAM role ARN used by the proxy to read secrets.
+   */
+  roleArn: string;
+  /**
+   * Subnets used by the proxy.
+   */
+  vpcSubnetIds: string[];
+  /**
+   * Security groups attached to the proxy.
+   */
+  vpcSecurityGroupIds?: string[];
+  /**
+   * Require TLS from clients.
+   */
+  requireTLS?: boolean;
+  /**
+   * Idle client timeout in seconds.
+   */
+  idleClientTimeout?: number;
+  /**
+   * Enable debug logging.
+   */
+  debugLogging?: boolean;
+  /**
+   * Endpoint network type.
+   */
+  endpointNetworkType?: rds.EndpointNetworkType;
+  /**
+   * Target connection network type.
+   */
+  targetConnectionNetworkType?: rds.TargetConnectionNetworkType;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBProxy extends Resource<
+  "AWS.RDS.DBProxy",
+  DBProxyProps,
+  {
+    dbProxyName: string;
+    dbProxyArn: string;
+    endpoint: string | undefined;
+    status: string | undefined;
+    engineFamily: string | undefined;
+    roleArn: string | undefined;
+    vpcId: string | undefined;
+    vpcSubnetIds: string[];
+    vpcSecurityGroupIds: string[];
+    requireTLS: boolean | undefined;
+    idleClientTimeout: number | undefined;
+    debugLogging: boolean | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An RDS Proxy for pooled Lambda-to-Aurora connectivity.
+ */
+export const DBProxy = Resource<DBProxy>("AWS.RDS.DBProxy");
+
+const toAttrs = ({
+  proxy,
+  tags,
+}: {
+  proxy: rds.DBProxy;
+  tags: Record<string, string>;
+}): DBProxy["Attributes"] => ({
+  dbProxyName: proxy.DBProxyName ?? "",
+  dbProxyArn: proxy.DBProxyArn ?? "",
+  endpoint: proxy.Endpoint,
+  status: proxy.Status,
+  engineFamily: proxy.EngineFamily,
+  roleArn: proxy.RoleArn,
+  vpcId: proxy.VpcId,
+  vpcSubnetIds: proxy.VpcSubnetIds ?? [],
+  vpcSecurityGroupIds: proxy.VpcSecurityGroupIds ?? [],
+  requireTLS: proxy.RequireTLS,
+  idleClientTimeout: proxy.IdleClientTimeout,
+  debugLogging: proxy.DebugLogging,
+  tags,
+});
+
+export const DBProxyProvider = () =>
+  Provider.effect(
+    DBProxy,
+    Effect.gen(function* () {
+      const toName = (id: string, props: DBProxyProps) =>
+        props.dbProxyName
+          ? Effect.succeed(props.dbProxyName)
+          : createPhysicalName({ id, maxLength: 63 });
+
+      const readProxy = Effect.fn(function* (name: string) {
+        const response = yield* rds
+          .describeDBProxies({
+            DBProxyName: name,
+          })
+          .pipe(
+            Effect.catchTag("DBProxyNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBProxies?.[0];
+      });
+
+      const waitForProxy = Effect.fn(function* (name: string) {
+        const readinessPolicy = Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(30)),
+        );
+        return yield* readProxy(name).pipe(
+          Effect.flatMap((proxy) =>
+            proxy?.DBProxyArn
+              ? Effect.succeed(proxy)
+              : Effect.fail(new Error(`DB proxy '${name}' not ready`)),
+          ),
+          Effect.retry({ schedule: readinessPolicy }),
+        );
+      });
+
+      return {
+        stables: ["dbProxyArn", "dbProxyName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toName(id, olds ?? ({} as DBProxyProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (olds?.engineFamily !== news.engineFamily) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.dbProxyName ??
+            (yield* toName(
+              id,
+              olds ??
+                ({
+                  engineFamily: "POSTGRESQL",
+                  auth: [],
+                  roleArn: "",
+                  vpcSubnetIds: [],
+                } as DBProxyProps),
+            ));
+          const proxy = yield* readProxy(name);
+          if (!proxy?.DBProxyArn) {
+            return undefined;
+          }
+          return toAttrs({ proxy, tags: output?.tags ?? {} });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const name = output?.dbProxyName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live proxy state.
+          let observed = yield* readProxy(name);
+
+          // Ensure — create if missing. Tolerate
+          // `DBProxyAlreadyExistsFault` as a race with a peer reconciler.
+          if (!observed?.DBProxyArn) {
+            yield* rds
+              .createDBProxy({
+                DBProxyName: name,
+                EngineFamily: news.engineFamily,
+                Auth: news.auth,
+                RoleArn: news.roleArn,
+                VpcSubnetIds: news.vpcSubnetIds,
+                VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+                RequireTLS: news.requireTLS,
+                IdleClientTimeout: news.idleClientTimeout,
+                DebugLogging: news.debugLogging,
+                EndpointNetworkType: news.endpointNetworkType,
+                TargetConnectionNetworkType: news.targetConnectionNetworkType,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag("DBProxyAlreadyExistsFault", () => Effect.void),
+              );
+
+            observed = yield* waitForProxy(name);
+          } else {
+            // Sync mutable proxy config — push desired shape via
+            // `modifyDBProxy`. Rename via `NewDBProxyName` is a no-op when
+            // the desired name already matches the observed name.
+            yield* rds.modifyDBProxy({
+              DBProxyName: name,
+              Auth: news.auth,
+              RoleArn: news.roleArn,
+              SecurityGroups: news.vpcSecurityGroupIds,
+              RequireTLS: news.requireTLS,
+              IdleClientTimeout: news.idleClientTimeout,
+              DebugLogging: news.debugLogging,
+              NewDBProxyName:
+                news.dbProxyName && news.dbProxyName !== name
+                  ? news.dbProxyName
+                  : undefined,
+            });
+            observed = yield* waitForProxy(news.dbProxyName ?? name);
+          }
+
+          const dbProxyArn = observed.DBProxyArn ?? "";
+          const finalName = observed.DBProxyName ?? name;
+
+          // Sync tags — diff prior recorded tags against desired (describe
+          // does not surface tags inline).
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbProxyArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbProxyArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbProxyArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbProxyArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbProxyArn || finalName);
+          return toAttrs({ proxy: observed, tags: desiredTags });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBProxy({
+              DBProxyName: output.dbProxyName,
+            })
+            .pipe(Effect.catchTag("DBProxyNotFoundFault", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxyEndpoint.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxyEndpoint.ts
new file mode 100644
index 00000000000..11dbfcc0bb6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxyEndpoint.ts
@@ -0,0 +1,269 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface DBProxyEndpointProps {
+  /**
+   * Proxy endpoint name. If omitted, Alchemy generates one.
+   */
+  dbProxyEndpointName?: string;
+  /**
+   * Proxy that owns the endpoint.
+   */
+  dbProxyName: string;
+  /**
+   * Subnets used by the proxy endpoint.
+   */
+  vpcSubnetIds: string[];
+  /**
+   * Security groups attached to the endpoint.
+   */
+  vpcSecurityGroupIds?: string[];
+  /**
+   * Target role for the endpoint.
+   */
+  targetRole?: rds.DBProxyEndpointTargetRole;
+  /**
+   * Endpoint network type.
+   */
+  endpointNetworkType?: rds.EndpointNetworkType;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBProxyEndpoint extends Resource<
+  "AWS.RDS.DBProxyEndpoint",
+  DBProxyEndpointProps,
+  {
+    dbProxyEndpointName: string;
+    dbProxyEndpointArn: string;
+    dbProxyName: string | undefined;
+    endpoint: string | undefined;
+    status: string | undefined;
+    vpcId: string | undefined;
+    vpcSubnetIds: string[];
+    vpcSecurityGroupIds: string[];
+    targetRole: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An additional RDS Proxy endpoint.
+ */
+export const DBProxyEndpoint = Resource<DBProxyEndpoint>(
+  "AWS.RDS.DBProxyEndpoint",
+);
+
+const toAttrs = ({
+  endpoint,
+  tags,
+}: {
+  endpoint: rds.DBProxyEndpoint;
+  tags: Record<string, string>;
+}): DBProxyEndpoint["Attributes"] => ({
+  dbProxyEndpointName: endpoint.DBProxyEndpointName ?? "",
+  dbProxyEndpointArn: endpoint.DBProxyEndpointArn ?? "",
+  dbProxyName: endpoint.DBProxyName,
+  endpoint: endpoint.Endpoint,
+  status: endpoint.Status,
+  vpcId: endpoint.VpcId,
+  vpcSubnetIds: endpoint.VpcSubnetIds ?? [],
+  vpcSecurityGroupIds: endpoint.VpcSecurityGroupIds ?? [],
+  targetRole: endpoint.TargetRole,
+  tags,
+});
+
+export const DBProxyEndpointProvider = () =>
+  Provider.effect(
+    DBProxyEndpoint,
+    Effect.gen(function* () {
+      const toName = (id: string, props: DBProxyEndpointProps) =>
+        props.dbProxyEndpointName
+          ? Effect.succeed(props.dbProxyEndpointName)
+          : createPhysicalName({ id, maxLength: 63 });
+
+      const readEndpoint = Effect.fn(function* ({
+        dbProxyName,
+        dbProxyEndpointName,
+      }: {
+        dbProxyName: string;
+        dbProxyEndpointName: string;
+      }) {
+        const response = yield* rds
+          .describeDBProxyEndpoints({
+            DBProxyName: dbProxyName,
+            DBProxyEndpointName: dbProxyEndpointName,
+          })
+          .pipe(
+            Effect.catchTag("DBProxyEndpointNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBProxyEndpoints?.[0];
+      });
+
+      const waitForEndpoint = Effect.fn(function* (props: {
+        dbProxyName: string;
+        dbProxyEndpointName: string;
+      }) {
+        const readinessPolicy = Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(30)),
+        );
+        return yield* readEndpoint(props).pipe(
+          Effect.flatMap((endpoint) =>
+            endpoint?.DBProxyEndpointArn
+              ? Effect.succeed(endpoint)
+              : Effect.fail(
+                  new Error(
+                    `DB proxy endpoint '${props.dbProxyEndpointName}' not ready`,
+                  ),
+                ),
+          ),
+          Effect.retry({ schedule: readinessPolicy }),
+        );
+      });
+
+      return {
+        stables: ["dbProxyEndpointArn", "dbProxyEndpointName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toName(id, olds ?? ({} as DBProxyEndpointProps))) !==
+            (yield* toName(id, news))
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (olds?.dbProxyName !== news.dbProxyName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const dbProxyEndpointName =
+            output?.dbProxyEndpointName ??
+            (yield* toName(
+              id,
+              olds ??
+                ({
+                  dbProxyName: "",
+                  vpcSubnetIds: [],
+                } as DBProxyEndpointProps),
+            ));
+          const endpoint = yield* readEndpoint({
+            dbProxyName: output?.dbProxyName ?? olds?.dbProxyName ?? "",
+            dbProxyEndpointName,
+          });
+          if (!endpoint?.DBProxyEndpointArn) {
+            return undefined;
+          }
+          return toAttrs({ endpoint, tags: output?.tags ?? {} });
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const dbProxyEndpointName =
+            output?.dbProxyEndpointName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live endpoint state.
+          let observed = yield* readEndpoint({
+            dbProxyName: output?.dbProxyName ?? news.dbProxyName,
+            dbProxyEndpointName,
+          });
+
+          // Ensure — create if missing. Tolerate
+          // `DBProxyEndpointAlreadyExistsFault` as a race with a peer
+          // reconciler.
+          if (!observed?.DBProxyEndpointArn) {
+            yield* rds
+              .createDBProxyEndpoint({
+                DBProxyName: news.dbProxyName,
+                DBProxyEndpointName: dbProxyEndpointName,
+                VpcSubnetIds: news.vpcSubnetIds,
+                VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+                TargetRole: news.targetRole,
+                EndpointNetworkType: news.endpointNetworkType,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBProxyEndpointAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+
+            observed = yield* waitForEndpoint({
+              dbProxyName: news.dbProxyName,
+              dbProxyEndpointName,
+            });
+          } else {
+            // Sync mutable endpoint config — security groups + rename. The
+            // rename argument is a no-op when desired matches observed.
+            yield* rds.modifyDBProxyEndpoint({
+              DBProxyEndpointName: dbProxyEndpointName,
+              VpcSecurityGroupIds: news.vpcSecurityGroupIds,
+              NewDBProxyEndpointName:
+                news.dbProxyEndpointName &&
+                news.dbProxyEndpointName !== dbProxyEndpointName
+                  ? news.dbProxyEndpointName
+                  : undefined,
+            });
+            observed = yield* waitForEndpoint({
+              dbProxyName: observed.DBProxyName ?? news.dbProxyName,
+              dbProxyEndpointName:
+                news.dbProxyEndpointName &&
+                news.dbProxyEndpointName !== dbProxyEndpointName
+                  ? news.dbProxyEndpointName
+                  : dbProxyEndpointName,
+            });
+          }
+
+          const dbProxyEndpointArn = observed.DBProxyEndpointArn ?? "";
+
+          // Sync tags — diff prior recorded tags against desired (describe
+          // does not surface tags inline).
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbProxyEndpointArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbProxyEndpointArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbProxyEndpointArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbProxyEndpointArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbProxyEndpointArn || dbProxyEndpointName);
+          return toAttrs({ endpoint: observed, tags: desiredTags });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBProxyEndpoint({
+              DBProxyEndpointName: output.dbProxyEndpointName,
+            })
+            .pipe(
+              Effect.catchTag(
+                "DBProxyEndpointNotFoundFault",
+                () => Effect.void,
+              ),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxyTargetGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxyTargetGroup.ts
new file mode 100644
index 00000000000..0ce8b4c3543
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBProxyTargetGroup.ts
@@ -0,0 +1,286 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface DBProxyTargetGroupProps {
+  /**
+   * Proxy that owns the target group.
+   */
+  dbProxyName: string;
+  /**
+   * Target group name.
+   * @default "default"
+   */
+  targetGroupName?: string;
+  /**
+   * Cluster targets registered with the proxy.
+   */
+  dbClusterIdentifiers?: string[];
+  /**
+   * Instance targets registered with the proxy.
+   */
+  dbInstanceIdentifiers?: string[];
+  /**
+   * Connection pool configuration.
+   */
+  connectionPoolConfig?: rds.ConnectionPoolConfiguration;
+}
+
+export interface DBProxyTargetGroup extends Resource<
+  "AWS.RDS.DBProxyTargetGroup",
+  DBProxyTargetGroupProps,
+  {
+    dbProxyName: string;
+    targetGroupName: string;
+    targetGroupArn: string | undefined;
+    status: string | undefined;
+    isDefault: boolean | undefined;
+    connectionPoolConfig: rds.ConnectionPoolConfigurationInfo | undefined;
+    dbClusterIdentifiers: string[];
+    dbInstanceIdentifiers: string[];
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * The proxy target group that registers Aurora clusters or instances behind an
+ * RDS Proxy.
+ */
+export const DBProxyTargetGroup = Resource<DBProxyTargetGroup>(
+  "AWS.RDS.DBProxyTargetGroup",
+);
+
+const toTargetGroupName = (props: DBProxyTargetGroupProps) =>
+  props.targetGroupName ?? "default";
+
+export const DBProxyTargetGroupProvider = () =>
+  Provider.effect(
+    DBProxyTargetGroup,
+    Effect.gen(function* () {
+      const readGroup = Effect.fn(function* ({
+        dbProxyName,
+        targetGroupName,
+      }: {
+        dbProxyName: string;
+        targetGroupName: string;
+      }) {
+        const response = yield* rds
+          .describeDBProxyTargetGroups({
+            DBProxyName: dbProxyName,
+            TargetGroupName: targetGroupName,
+          })
+          .pipe(
+            Effect.catchTag("DBProxyTargetGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.TargetGroups?.[0];
+      });
+
+      const toAttrs = ({
+        group,
+        props,
+      }: {
+        group: rds.DBProxyTargetGroup;
+        props: DBProxyTargetGroupProps;
+      }): DBProxyTargetGroup["Attributes"] => ({
+        dbProxyName: group.DBProxyName ?? props.dbProxyName,
+        targetGroupName: group.TargetGroupName ?? toTargetGroupName(props),
+        targetGroupArn: group.TargetGroupArn,
+        status: group.Status,
+        isDefault: group.IsDefault,
+        connectionPoolConfig: group.ConnectionPoolConfig,
+        dbClusterIdentifiers: props.dbClusterIdentifiers ?? [],
+        dbInstanceIdentifiers: props.dbInstanceIdentifiers ?? [],
+      });
+
+      const readTargets = Effect.fn(function* ({
+        dbProxyName,
+        targetGroupName,
+      }: {
+        dbProxyName: string;
+        targetGroupName: string;
+      }) {
+        const response = yield* rds
+          .describeDBProxyTargets({
+            DBProxyName: dbProxyName,
+            TargetGroupName: targetGroupName,
+          })
+          .pipe(
+            Effect.catchTag("DBProxyTargetNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("DBProxyTargetGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("DBProxyNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        const targets = response?.Targets ?? [];
+        const observedClusters: string[] = [];
+        const observedInstances: string[] = [];
+        for (const target of targets) {
+          const id = target.RdsResourceId;
+          if (!id) continue;
+          if (target.Type === "TRACKED_CLUSTER") {
+            observedClusters.push(id);
+          } else if (target.Type === "RDS_INSTANCE") {
+            observedInstances.push(id);
+          }
+        }
+        return { observedClusters, observedInstances };
+      });
+
+      return {
+        stables: ["dbProxyName", "targetGroupArn", "targetGroupName"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (olds?.dbProxyName !== news.dbProxyName) {
+            return { action: "replace" } as const;
+          }
+          if (toTargetGroupName(olds ?? news) !== toTargetGroupName(news)) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const props = {
+            dbProxyName: output?.dbProxyName ?? olds?.dbProxyName ?? "",
+            targetGroupName: output?.targetGroupName ?? olds?.targetGroupName,
+            dbClusterIdentifiers:
+              output?.dbClusterIdentifiers ?? olds?.dbClusterIdentifiers,
+            dbInstanceIdentifiers:
+              output?.dbInstanceIdentifiers ?? olds?.dbInstanceIdentifiers,
+            connectionPoolConfig:
+              output?.connectionPoolConfig ?? olds?.connectionPoolConfig,
+          } satisfies DBProxyTargetGroupProps;
+          const group = yield* readGroup({
+            dbProxyName: props.dbProxyName,
+            targetGroupName: toTargetGroupName(props),
+          });
+          if (!group?.TargetGroupName) {
+            return undefined;
+          }
+          return toAttrs({ group, props });
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          const targetGroupName = toTargetGroupName(news);
+
+          // Observe — the "default" target group is created automatically
+          // by RDS when the parent DBProxy is created, so we don't `Ensure`
+          // a target group ourselves. We just describe it to confirm the
+          // proxy is ready and to read connection-pool config.
+          let observedGroup = yield* readGroup({
+            dbProxyName: news.dbProxyName,
+            targetGroupName,
+          });
+
+          // Sync connection pool config — push desired shape if provided.
+          // `modifyDBProxyTargetGroup` is idempotent for unchanged config.
+          if (news.connectionPoolConfig) {
+            yield* rds.modifyDBProxyTargetGroup({
+              DBProxyName: news.dbProxyName,
+              TargetGroupName: targetGroupName,
+              ConnectionPoolConfig: news.connectionPoolConfig,
+            });
+          }
+
+          // Sync registered targets — diff observed live targets against
+          // desired and apply only the delta. We trust live cloud state
+          // over `output`/`olds` so adoption and drift converge.
+          const { observedClusters, observedInstances } = yield* readTargets({
+            dbProxyName: news.dbProxyName,
+            targetGroupName,
+          });
+          const desiredClusters = new Set(news.dbClusterIdentifiers ?? []);
+          const desiredInstances = new Set(news.dbInstanceIdentifiers ?? []);
+          const observedClusterSet = new Set(observedClusters);
+          const observedInstanceSet = new Set(observedInstances);
+
+          const addClusters = [...desiredClusters].filter(
+            (id) => !observedClusterSet.has(id),
+          );
+          const removeClusters = [...observedClusterSet].filter(
+            (id) => !desiredClusters.has(id),
+          );
+          const addInstances = [...desiredInstances].filter(
+            (id) => !observedInstanceSet.has(id),
+          );
+          const removeInstances = [...observedInstanceSet].filter(
+            (id) => !desiredInstances.has(id),
+          );
+
+          if (addClusters.length > 0 || addInstances.length > 0) {
+            yield* rds.registerDBProxyTargets({
+              DBProxyName: news.dbProxyName,
+              TargetGroupName: targetGroupName,
+              DBClusterIdentifiers:
+                addClusters.length > 0 ? addClusters : undefined,
+              DBInstanceIdentifiers:
+                addInstances.length > 0 ? addInstances : undefined,
+            });
+          }
+
+          if (removeClusters.length > 0 || removeInstances.length > 0) {
+            yield* rds.deregisterDBProxyTargets({
+              DBProxyName: news.dbProxyName,
+              TargetGroupName: targetGroupName,
+              DBClusterIdentifiers:
+                removeClusters.length > 0 ? removeClusters : undefined,
+              DBInstanceIdentifiers:
+                removeInstances.length > 0 ? removeInstances : undefined,
+            });
+          }
+
+          // Re-read so returned attrs reflect post-sync state. If the
+          // target group still isn't visible, surface the failure (the
+          // parent DBProxy must be up).
+          observedGroup = yield* readGroup({
+            dbProxyName: news.dbProxyName,
+            targetGroupName,
+          });
+          if (!observedGroup?.TargetGroupName) {
+            return yield* Effect.fail(
+              new Error(`DB proxy target group '${targetGroupName}' not found`),
+            );
+          }
+          yield* session.note(
+            observedGroup.TargetGroupArn ??
+              output?.targetGroupArn ??
+              observedGroup.TargetGroupName,
+          );
+          return toAttrs({ group: observedGroup, props: news });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (
+            output.dbClusterIdentifiers.length > 0 ||
+            output.dbInstanceIdentifiers.length > 0
+          ) {
+            yield* rds
+              .deregisterDBProxyTargets({
+                DBProxyName: output.dbProxyName,
+                TargetGroupName: output.targetGroupName,
+                DBClusterIdentifiers:
+                  output.dbClusterIdentifiers.length > 0
+                    ? output.dbClusterIdentifiers
+                    : undefined,
+                DBInstanceIdentifiers:
+                  output.dbInstanceIdentifiers.length > 0
+                    ? output.dbInstanceIdentifiers
+                    : undefined,
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBProxyTargetGroupNotFoundFault",
+                  () => Effect.void,
+                ),
+              );
+          }
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBSubnetGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBSubnetGroup.ts
new file mode 100644
index 00000000000..ffab864ac49
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/DBSubnetGroup.ts
@@ -0,0 +1,209 @@
+import * as rds from "@distilled.cloud/aws/rds";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+import type { SubnetId } from "../EC2/Subnet.ts";
+
+export interface DBSubnetGroupProps {
+  /**
+   * Name of the DB subnet group. If omitted, a deterministic name is generated.
+   */
+  dbSubnetGroupName?: string;
+  /**
+   * Description for the subnet group.
+   * @default "Managed by Alchemy"
+   */
+  description?: string;
+  /**
+   * Subnets that the database resources may use.
+   */
+  subnetIds: SubnetId[];
+  /**
+   * User-defined tags for the subnet group.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface DBSubnetGroup extends Resource<
+  "AWS.RDS.DBSubnetGroup",
+  DBSubnetGroupProps,
+  {
+    dbSubnetGroupName: string;
+    dbSubnetGroupArn: string | undefined;
+    vpcId: string | undefined;
+    subnetIds: string[];
+    status: string | undefined;
+    supportedNetworkTypes: string[] | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An RDS DB subnet group for Aurora clusters, instances, and proxies.
+ */
+export const DBSubnetGroup = Resource<DBSubnetGroup>("AWS.RDS.DBSubnetGroup");
+
+export const DBSubnetGroupProvider = () =>
+  Provider.effect(
+    DBSubnetGroup,
+    Effect.gen(function* () {
+      const toName = (id: string, props: DBSubnetGroupProps) =>
+        props.dbSubnetGroupName
+          ? Effect.succeed(props.dbSubnetGroupName)
+          : createPhysicalName({ id, maxLength: 255 });
+
+      const readGroup = Effect.fn(function* (groupName: string) {
+        const response = yield* rds
+          .describeDBSubnetGroups({
+            DBSubnetGroupName: groupName,
+          })
+          .pipe(
+            Effect.catchTag("DBSubnetGroupNotFoundFault", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        return response?.DBSubnetGroups?.[0];
+      });
+
+      return {
+        stables: ["dbSubnetGroupArn", "dbSubnetGroupName", "vpcId"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toName(id, olds ?? {})) !== (yield* toName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const name =
+            output?.dbSubnetGroupName ??
+            (yield* toName(
+              id,
+              olds ?? ({ subnetIds: [] } as DBSubnetGroupProps),
+            ));
+          const group = yield* readGroup(name);
+          if (!group?.DBSubnetGroupName) {
+            return undefined;
+          }
+
+          return {
+            dbSubnetGroupName: group.DBSubnetGroupName,
+            dbSubnetGroupArn: group.DBSubnetGroupArn,
+            vpcId: group.VpcId,
+            subnetIds: (group.Subnets ?? []).flatMap((subnet) =>
+              subnet.SubnetIdentifier ? [subnet.SubnetIdentifier] : [],
+            ),
+            status: group.SubnetGroupStatus,
+            supportedNetworkTypes: group.SupportedNetworkTypes,
+            tags: output?.tags ?? {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const dbSubnetGroupName =
+            output?.dbSubnetGroupName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live subnet-group state.
+          let observed = yield* readGroup(dbSubnetGroupName);
+
+          // Ensure — create if missing. Tolerate
+          // `DBSubnetGroupAlreadyExistsFault` as a race with a peer
+          // reconciler by re-reading.
+          if (!observed?.DBSubnetGroupName) {
+            yield* rds
+              .createDBSubnetGroup({
+                DBSubnetGroupName: dbSubnetGroupName,
+                DBSubnetGroupDescription:
+                  news.description ?? "Managed by Alchemy",
+                SubnetIds: news.subnetIds,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+              })
+              .pipe(
+                Effect.catchTag(
+                  "DBSubnetGroupAlreadyExistsFault",
+                  () => Effect.void,
+                ),
+              );
+            observed = yield* readGroup(dbSubnetGroupName);
+            if (!observed?.DBSubnetGroupName) {
+              return yield* Effect.fail(
+                new Error(
+                  `Failed to create DB subnet group '${dbSubnetGroupName}'`,
+                ),
+              );
+            }
+          } else {
+            // Sync description and subnet membership — `modifyDBSubnetGroup`
+            // accepts the full desired set and is idempotent for unchanged
+            // input.
+            yield* rds.modifyDBSubnetGroup({
+              DBSubnetGroupName: dbSubnetGroupName,
+              DBSubnetGroupDescription:
+                news.description ?? "Managed by Alchemy",
+              SubnetIds: news.subnetIds,
+            });
+            observed = yield* readGroup(dbSubnetGroupName);
+            if (!observed?.DBSubnetGroupName) {
+              return yield* Effect.fail(
+                new Error(
+                  `DB subnet group '${dbSubnetGroupName}' not found after update`,
+                ),
+              );
+            }
+          }
+
+          const dbSubnetGroupArn = observed.DBSubnetGroupArn;
+
+          // Sync tags — diff prior recorded tags against desired (describe
+          // does not surface tags inline).
+          const observedTags = output?.tags ?? {};
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (upsert.length > 0 && dbSubnetGroupArn) {
+            yield* rds.addTagsToResource({
+              ResourceName: dbSubnetGroupArn,
+              Tags: upsert,
+            });
+          }
+          if (removed.length > 0 && dbSubnetGroupArn) {
+            yield* rds.removeTagsFromResource({
+              ResourceName: dbSubnetGroupArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(dbSubnetGroupArn ?? dbSubnetGroupName);
+          return {
+            dbSubnetGroupName: observed.DBSubnetGroupName,
+            dbSubnetGroupArn,
+            vpcId: observed.VpcId,
+            subnetIds: (observed.Subnets ?? []).flatMap((subnet) =>
+              subnet.SubnetIdentifier ? [subnet.SubnetIdentifier] : [],
+            ),
+            status: observed.SubnetGroupStatus,
+            supportedNetworkTypes: observed.SupportedNetworkTypes,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* rds
+            .deleteDBSubnetGroup({
+              DBSubnetGroupName: output.dbSubnetGroupName,
+            })
+            .pipe(
+              Effect.catchTag("DBSubnetGroupNotFoundFault", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/index.ts
new file mode 100644
index 00000000000..eddad339491
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDS/index.ts
@@ -0,0 +1,11 @@
+export * from "./Aurora.ts";
+export * from "./Connect.ts";
+export * from "./DBCluster.ts";
+export * from "./DBClusterEndpoint.ts";
+export * from "./DBClusterParameterGroup.ts";
+export * from "./DBInstance.ts";
+export * from "./DBParameterGroup.ts";
+export * from "./DBProxy.ts";
+export * from "./DBProxyEndpoint.ts";
+export * from "./DBProxyTargetGroup.ts";
+export * from "./DBSubnetGroup.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/BatchExecuteStatement.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/BatchExecuteStatement.ts
new file mode 100644
index 00000000000..a0068587cea
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/BatchExecuteStatement.ts
@@ -0,0 +1,103 @@
+import * as rdsdata from "@distilled.cloud/aws/rds-data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { DBCluster } from "../RDS/DBCluster.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+
+export interface BatchExecuteStatementOptions {
+  secret: Secret;
+  database?: string;
+  schema?: string;
+}
+
+export interface BatchExecuteStatementRequest extends Omit<
+  rdsdata.BatchExecuteStatementRequest,
+  "resourceArn" | "secretArn" | "database" | "schema"
+> {}
+
+/**
+ * Runtime binding for `rds-data:BatchExecuteStatement`.
+ */
+export class BatchExecuteStatement extends Binding.Service<
+  BatchExecuteStatement,
+  (
+    cluster: DBCluster,
+    options: BatchExecuteStatementOptions,
+  ) => Effect.Effect<
+    (
+      request: BatchExecuteStatementRequest,
+    ) => Effect.Effect<
+      rdsdata.BatchExecuteStatementResponse,
+      rdsdata.BatchExecuteStatementError
+    >
+  >
+>()("AWS.RDSData.BatchExecuteStatement") {}
+
+export const BatchExecuteStatementLive = Layer.effect(
+  BatchExecuteStatement,
+  Effect.gen(function* () {
+    const Policy = yield* BatchExecuteStatementPolicy;
+    const batchExecuteStatement = yield* rdsdata.batchExecuteStatement;
+
+    return Effect.fn(function* (
+      cluster: DBCluster,
+      options: BatchExecuteStatementOptions,
+    ) {
+      const resourceArn = yield* cluster.dbClusterArn;
+      const secretArn = yield* options.secret.secretArn;
+      yield* Policy(cluster, options);
+      return Effect.fn(function* (request: BatchExecuteStatementRequest) {
+        const clusterArn = yield* resourceArn;
+        const resolvedSecretArn = yield* secretArn;
+        return yield* batchExecuteStatement({
+          ...request,
+          resourceArn: clusterArn,
+          secretArn: resolvedSecretArn,
+          database: options.database,
+          schema: options.schema,
+        });
+      });
+    });
+  }),
+);
+
+export class BatchExecuteStatementPolicy extends Binding.Policy<
+  BatchExecuteStatementPolicy,
+  (
+    cluster: DBCluster,
+    options: BatchExecuteStatementOptions,
+  ) => Effect.Effect<void>
+>()("AWS.RDSData.BatchExecuteStatement") {}
+
+export const BatchExecuteStatementPolicyLive =
+  BatchExecuteStatementPolicy.layer.succeed(
+    Effect.fn(function* (host, cluster, options) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.RDSData.BatchExecuteStatement(${cluster}, ${options.secret}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["rds-data:BatchExecuteStatement"],
+                Resource: [cluster.dbClusterArn, options.secret.secretArn],
+              },
+              {
+                Effect: "Allow",
+                Action: [
+                  "secretsmanager:GetSecretValue",
+                  "secretsmanager:DescribeSecret",
+                ],
+                Resource: [options.secret.secretArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `BatchExecuteStatementPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/BeginTransaction.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/BeginTransaction.ts
new file mode 100644
index 00000000000..ae3f8ef5998
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/BeginTransaction.ts
@@ -0,0 +1,97 @@
+import * as rdsdata from "@distilled.cloud/aws/rds-data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { DBCluster } from "../RDS/DBCluster.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+
+export interface BeginTransactionOptions {
+  secret: Secret;
+  database?: string;
+  schema?: string;
+}
+
+/**
+ * Runtime binding for `rds-data:BeginTransaction`.
+ */
+export class BeginTransaction extends Binding.Service<
+  BeginTransaction,
+  (
+    cluster: DBCluster,
+    options: BeginTransactionOptions,
+  ) => Effect.Effect<
+    () => Effect.Effect<
+      rdsdata.BeginTransactionResponse,
+      rdsdata.BeginTransactionError
+    >
+  >
+>()("AWS.RDSData.BeginTransaction") {}
+
+export const BeginTransactionLive = Layer.effect(
+  BeginTransaction,
+  Effect.gen(function* () {
+    const Policy = yield* BeginTransactionPolicy;
+    const beginTransaction = yield* rdsdata.beginTransaction;
+
+    return Effect.fn(function* (
+      cluster: DBCluster,
+      options: BeginTransactionOptions,
+    ) {
+      const resourceArn = yield* cluster.dbClusterArn;
+      const secretArn = yield* options.secret.secretArn;
+      yield* Policy(cluster, options);
+      return Effect.fn(function* () {
+        const clusterArn = yield* resourceArn;
+        const resolvedSecretArn = yield* secretArn;
+        return yield* beginTransaction({
+          resourceArn: clusterArn,
+          secretArn: resolvedSecretArn,
+          database: options.database,
+          schema: options.schema,
+        });
+      });
+    });
+  }),
+);
+
+export class BeginTransactionPolicy extends Binding.Policy<
+  BeginTransactionPolicy,
+  (cluster: DBCluster, options: BeginTransactionOptions) => Effect.Effect<void>
+>()("AWS.RDSData.BeginTransaction") {}
+
+export const BeginTransactionPolicyLive = BeginTransactionPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster, options) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.RDSData.BeginTransaction(${cluster}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["rds-data:BeginTransaction"],
+              Resource: [cluster.dbClusterArn, options.secret.secretArn],
+            },
+          ],
+        },
+      );
+      yield* host.bind`Allow(${host}, AWS.SecretsManager.GetSecretValue(${options.secret}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: [
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:DescribeSecret",
+              ],
+              Resource: [options.secret.secretArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `BeginTransactionPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/CommitTransaction.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/CommitTransaction.ts
new file mode 100644
index 00000000000..bcb43a35021
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/CommitTransaction.ts
@@ -0,0 +1,102 @@
+import * as rdsdata from "@distilled.cloud/aws/rds-data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { DBCluster } from "../RDS/DBCluster.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+
+export interface CommitTransactionOptions {
+  secret: Secret;
+}
+
+export interface CommitTransactionRequest extends Omit<
+  rdsdata.CommitTransactionRequest,
+  "resourceArn" | "secretArn"
+> {}
+
+/**
+ * Runtime binding for `rds-data:CommitTransaction`.
+ */
+export class CommitTransaction extends Binding.Service<
+  CommitTransaction,
+  (
+    cluster: DBCluster,
+    options: CommitTransactionOptions,
+  ) => Effect.Effect<
+    (
+      request: CommitTransactionRequest,
+    ) => Effect.Effect<
+      rdsdata.CommitTransactionResponse,
+      rdsdata.CommitTransactionError
+    >
+  >
+>()("AWS.RDSData.CommitTransaction") {}
+
+export const CommitTransactionLive = Layer.effect(
+  CommitTransaction,
+  Effect.gen(function* () {
+    const Policy = yield* CommitTransactionPolicy;
+    const commitTransaction = yield* rdsdata.commitTransaction;
+
+    return Effect.fn(function* (
+      cluster: DBCluster,
+      options: CommitTransactionOptions,
+    ) {
+      const resourceArn = yield* cluster.dbClusterArn;
+      const secretArn = yield* options.secret.secretArn;
+      yield* Policy(cluster, options);
+      return Effect.fn(function* (request: CommitTransactionRequest) {
+        const clusterArn = yield* resourceArn;
+        const resolvedSecretArn = yield* secretArn;
+        return yield* commitTransaction({
+          ...request,
+          resourceArn: clusterArn,
+          secretArn: resolvedSecretArn,
+        });
+      });
+    });
+  }),
+);
+
+export class CommitTransactionPolicy extends Binding.Policy<
+  CommitTransactionPolicy,
+  (cluster: DBCluster, options: CommitTransactionOptions) => Effect.Effect<void>
+>()("AWS.RDSData.CommitTransaction") {}
+
+export const CommitTransactionPolicyLive =
+  CommitTransactionPolicy.layer.succeed(
+    Effect.fn(function* (host, cluster, options) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.RDSData.CommitTransaction(${cluster}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["rds-data:CommitTransaction"],
+                Resource: [cluster.dbClusterArn, options.secret.secretArn],
+              },
+            ],
+          },
+        );
+        yield* host.bind`Allow(${host}, AWS.SecretsManager.GetSecretValue(${options.secret}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "secretsmanager:GetSecretValue",
+                  "secretsmanager:DescribeSecret",
+                ],
+                Resource: [options.secret.secretArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `CommitTransactionPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/ExecuteSql.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/ExecuteSql.ts
new file mode 100644
index 00000000000..38cd3ff49cb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/ExecuteSql.ts
@@ -0,0 +1,98 @@
+import * as rdsdata from "@distilled.cloud/aws/rds-data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { DBCluster } from "../RDS/DBCluster.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+
+export interface ExecuteSqlOptions {
+  secret: Secret;
+  database?: string;
+  schema?: string;
+}
+
+export interface ExecuteSqlRequest extends Omit<
+  rdsdata.ExecuteSqlRequest,
+  "dbClusterOrInstanceArn" | "awsSecretStoreArn" | "database" | "schema"
+> {}
+
+/**
+ * Runtime binding for the deprecated `rds-data:ExecuteSql` API.
+ */
+export class ExecuteSql extends Binding.Service<
+  ExecuteSql,
+  (
+    cluster: DBCluster,
+    options: ExecuteSqlOptions,
+  ) => Effect.Effect<
+    (
+      request: ExecuteSqlRequest,
+    ) => Effect.Effect<rdsdata.ExecuteSqlResponse, rdsdata.ExecuteSqlError>
+  >
+>()("AWS.RDSData.ExecuteSql") {}
+
+export const ExecuteSqlLive = Layer.effect(
+  ExecuteSql,
+  Effect.gen(function* () {
+    const Policy = yield* ExecuteSqlPolicy;
+    const executeSql = yield* rdsdata.executeSql;
+
+    return Effect.fn(function* (
+      cluster: DBCluster,
+      options: ExecuteSqlOptions,
+    ) {
+      const clusterArn = yield* cluster.dbClusterArn;
+      const secretArn = yield* options.secret.secretArn;
+      yield* Policy(cluster, options);
+      return Effect.fn(function* (request: ExecuteSqlRequest) {
+        return yield* executeSql({
+          ...request,
+          dbClusterOrInstanceArn: yield* clusterArn,
+          awsSecretStoreArn: yield* secretArn,
+          database: options.database,
+          schema: options.schema,
+        });
+      });
+    });
+  }),
+);
+
+export class ExecuteSqlPolicy extends Binding.Policy<
+  ExecuteSqlPolicy,
+  (cluster: DBCluster, options: ExecuteSqlOptions) => Effect.Effect<void>
+>()("AWS.RDSData.ExecuteSql") {}
+
+export const ExecuteSqlPolicyLive = ExecuteSqlPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster, options) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.RDSData.ExecuteSql(${cluster}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["rds-data:ExecuteSql"],
+            Resource: [cluster.dbClusterArn, options.secret.secretArn],
+          },
+        ],
+      });
+      yield* host.bind`Allow(${host}, AWS.SecretsManager.GetSecretValue(${options.secret}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: [
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:DescribeSecret",
+              ],
+              Resource: [options.secret.secretArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `ExecuteSqlPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/ExecuteStatement.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/ExecuteStatement.ts
new file mode 100644
index 00000000000..d9b8373db8a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/ExecuteStatement.ts
@@ -0,0 +1,99 @@
+import * as rdsdata from "@distilled.cloud/aws/rds-data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { DBCluster } from "../RDS/DBCluster.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+
+export interface ExecuteStatementOptions {
+  secret: Secret;
+  database?: string;
+  schema?: string;
+}
+
+export interface ExecuteStatementRequest extends Omit<
+  rdsdata.ExecuteStatementRequest,
+  "resourceArn" | "secretArn" | "database" | "schema"
+> {}
+
+/**
+ * Runtime binding for `rds-data:ExecuteStatement`.
+ */
+export class ExecuteStatement extends Binding.Service<
+  ExecuteStatement,
+  (
+    cluster: DBCluster,
+    options: ExecuteStatementOptions,
+  ) => Effect.Effect<
+    (
+      request: ExecuteStatementRequest,
+    ) => Effect.Effect<
+      rdsdata.ExecuteStatementResponse,
+      rdsdata.ExecuteStatementError
+    >
+  >
+>()("AWS.RDSData.ExecuteStatement") {}
+
+export const ExecuteStatementLive = Layer.effect(
+  ExecuteStatement,
+  Effect.gen(function* () {
+    const Policy = yield* ExecuteStatementPolicy;
+    const executeStatement = yield* rdsdata.executeStatement;
+
+    return Effect.fn(function* (
+      cluster: DBCluster,
+      options: ExecuteStatementOptions,
+    ) {
+      const resourceArn = yield* cluster.dbClusterArn;
+      const secretArn = yield* options.secret.secretArn;
+      yield* Policy(cluster, options);
+      return Effect.fn(function* (request: ExecuteStatementRequest) {
+        const clusterArn = yield* resourceArn;
+        const resolvedSecretArn = yield* secretArn;
+        return yield* executeStatement({
+          ...request,
+          resourceArn: clusterArn,
+          secretArn: resolvedSecretArn,
+          database: options.database,
+          schema: options.schema,
+        });
+      });
+    });
+  }),
+);
+
+export class ExecuteStatementPolicy extends Binding.Policy<
+  ExecuteStatementPolicy,
+  (cluster: DBCluster, options: ExecuteStatementOptions) => Effect.Effect<void>
+>()("AWS.RDSData.ExecuteStatement") {}
+
+export const ExecuteStatementPolicyLive = ExecuteStatementPolicy.layer.succeed(
+  Effect.fn(function* (host, cluster, options) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.RDSData.ExecuteStatement(${cluster}, ${options.secret}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["rds-data:ExecuteStatement"],
+              Resource: [cluster.dbClusterArn, options.secret.secretArn],
+            },
+            {
+              Effect: "Allow",
+              Action: [
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:DescribeSecret",
+              ],
+              Resource: [options.secret.secretArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `ExecuteStatementPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/RollbackTransaction.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/RollbackTransaction.ts
new file mode 100644
index 00000000000..d540c418c65
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/RollbackTransaction.ts
@@ -0,0 +1,105 @@
+import * as rdsdata from "@distilled.cloud/aws/rds-data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { DBCluster } from "../RDS/DBCluster.ts";
+import type { Secret } from "../SecretsManager/Secret.ts";
+
+export interface RollbackTransactionOptions {
+  secret: Secret;
+}
+
+export interface RollbackTransactionRequest extends Omit<
+  rdsdata.RollbackTransactionRequest,
+  "resourceArn" | "secretArn"
+> {}
+
+/**
+ * Runtime binding for `rds-data:RollbackTransaction`.
+ */
+export class RollbackTransaction extends Binding.Service<
+  RollbackTransaction,
+  (
+    cluster: DBCluster,
+    options: RollbackTransactionOptions,
+  ) => Effect.Effect<
+    (
+      request: RollbackTransactionRequest,
+    ) => Effect.Effect<
+      rdsdata.RollbackTransactionResponse,
+      rdsdata.RollbackTransactionError
+    >
+  >
+>()("AWS.RDSData.RollbackTransaction") {}
+
+export const RollbackTransactionLive = Layer.effect(
+  RollbackTransaction,
+  Effect.gen(function* () {
+    const Policy = yield* RollbackTransactionPolicy;
+    const rollbackTransaction = yield* rdsdata.rollbackTransaction;
+
+    return Effect.fn(function* (
+      cluster: DBCluster,
+      options: RollbackTransactionOptions,
+    ) {
+      const resourceArn = yield* cluster.dbClusterArn;
+      const secretArn = yield* options.secret.secretArn;
+      yield* Policy(cluster, options);
+      return Effect.fn(function* (request: RollbackTransactionRequest) {
+        const clusterArn = yield* resourceArn;
+        const resolvedSecretArn = yield* secretArn;
+        return yield* rollbackTransaction({
+          ...request,
+          resourceArn: clusterArn,
+          secretArn: resolvedSecretArn,
+        });
+      });
+    });
+  }),
+);
+
+export class RollbackTransactionPolicy extends Binding.Policy<
+  RollbackTransactionPolicy,
+  (
+    cluster: DBCluster,
+    options: RollbackTransactionOptions,
+  ) => Effect.Effect<void>
+>()("AWS.RDSData.RollbackTransaction") {}
+
+export const RollbackTransactionPolicyLive =
+  RollbackTransactionPolicy.layer.succeed(
+    Effect.fn(function* (host, cluster, options) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.RDSData.RollbackTransaction(${cluster}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["rds-data:RollbackTransaction"],
+                Resource: [cluster.dbClusterArn, options.secret.secretArn],
+              },
+            ],
+          },
+        );
+        yield* host.bind`Allow(${host}, AWS.SecretsManager.GetSecretValue(${options.secret}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: [
+                  "secretsmanager:GetSecretValue",
+                  "secretsmanager:DescribeSecret",
+                ],
+                Resource: [options.secret.secretArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `RollbackTransactionPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/index.ts
new file mode 100644
index 00000000000..f3a4a0305d8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/RDSData/index.ts
@@ -0,0 +1,6 @@
+export * from "./BatchExecuteStatement.ts";
+export * from "./BeginTransaction.ts";
+export * from "./CommitTransaction.ts";
+export * from "./ExecuteSql.ts";
+export * from "./ExecuteStatement.ts";
+export * from "./RollbackTransaction.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Region.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Region.ts
new file mode 100644
index 00000000000..1bd50c2b745
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Region.ts
@@ -0,0 +1,19 @@
+import * as Region from "@distilled.cloud/aws/Region";
+import * as Layer from "effect/Layer";
+import { AWSEnvironment } from "./Environment.ts";
+
+export { AWS_REGION, type RegionID } from "./Environment.ts";
+export { Region } from "@distilled.cloud/aws/Region";
+
+export const of = (region: string) => Layer.succeed(Region.Region, region);
+
+export const fromEnvOrElse = (region: string) =>
+  Layer.succeed(Region.Region, process.env.AWS_REGION ?? region);
+
+/**
+ * Derive the AWS region from the surrounding {@link AWSEnvironment}.
+ */
+export const fromEnvironment = Layer.effect(
+  Region.Region,
+  AWSEnvironment.useSync((env) => env.region),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Route53/Record.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Route53/Record.ts
new file mode 100644
index 00000000000..e1d8765532c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Route53/Record.ts
@@ -0,0 +1,341 @@
+import * as route53 from "@distilled.cloud/aws/route-53";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export interface RecordAliasTarget {
+  /**
+   * Hosted zone ID for the alias target.
+   */
+  hostedZoneId: Input<string>;
+  /**
+   * DNS name for the alias target.
+   */
+  dnsName: Input<string>;
+  /**
+   * Whether Route 53 should evaluate target health for the alias.
+   * @default false
+   */
+  evaluateTargetHealth?: boolean;
+}
+
+export interface ResolvedRecordAliasTarget {
+  hostedZoneId: string;
+  dnsName: string;
+  evaluateTargetHealth?: boolean;
+}
+
+export interface RecordProps {
+  /**
+   * Hosted zone that owns the record.
+   */
+  hostedZoneId: string;
+  /**
+   * Record name.
+   */
+  name: string;
+  /**
+   * Record type.
+   */
+  type: route53.RRType;
+  /**
+   * TTL in seconds for non-alias records.
+   */
+  ttl?: number;
+  /**
+   * Record values for non-alias records.
+   */
+  records?: string[];
+  /**
+   * Alias target for alias records.
+   */
+  aliasTarget?: RecordAliasTarget;
+  /**
+   * Optional set identifier for weighted, latency, failover, and other routing
+   * policies that require unique record identities.
+   */
+  setIdentifier?: string;
+}
+
+export interface Record extends Resource<
+  "AWS.Route53.Record",
+  RecordProps,
+  {
+    /**
+     * Hosted zone that owns the record.
+     */
+    hostedZoneId: string;
+    /**
+     * Fully qualified record name.
+     */
+    name: string;
+    /**
+     * Record type.
+     */
+    type: route53.RRType;
+    /**
+     * Current TTL for non-alias records.
+     */
+    ttl: number | undefined;
+    /**
+     * Current non-alias record values.
+     */
+    records: string[] | undefined;
+    /**
+     * Current alias target, when this record is an alias.
+     */
+    aliasTarget: ResolvedRecordAliasTarget | undefined;
+    /**
+     * Optional routing set identifier.
+     */
+    setIdentifier: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * A Route 53 DNS record set.
+ *
+ * `Record` manages a single Route 53 record set using `UPSERT` for create and
+ * update operations, and waits for Route 53 change propagation before
+ * returning.
+ *
+ * @section Creating Records
+ * @example A Record Alias To CloudFront
+ * ```typescript
+ * const record = yield* Record("WebsiteAlias", {
+ *   hostedZoneId: "Z1234567890",
+ *   name: "www.example.com",
+ *   type: "A",
+ *   aliasTarget: {
+ *     hostedZoneId: distribution.hostedZoneId,
+ *     dnsName: distribution.domainName,
+ *   },
+ * });
+ * ```
+ *
+ * @example TXT Record
+ * ```typescript
+ * const record = yield* Record("VerificationRecord", {
+ *   hostedZoneId: "Z1234567890",
+ *   name: "_acme-challenge.example.com",
+ *   type: "TXT",
+ *   ttl: 60,
+ *   records: ["\"value\""],
+ * });
+ * ```
+ */
+export const Record = Resource<Record>("AWS.Route53.Record");
+
+const normalizeHostedZoneId = (hostedZoneId: string) =>
+  hostedZoneId.replace(/^\/hostedzone\//, "");
+
+const normalizeName = (name: string) =>
+  name.endsWith(".") ? name : `${name}.`;
+
+const toAliasTarget = (
+  aliasTarget: route53.AliasTarget | undefined,
+): ResolvedRecordAliasTarget | undefined =>
+  aliasTarget
+    ? {
+        hostedZoneId: aliasTarget.HostedZoneId,
+        dnsName: aliasTarget.DNSName,
+        evaluateTargetHealth: aliasTarget.EvaluateTargetHealth,
+      }
+    : undefined;
+
+const toRecordSet = (props: RecordProps): route53.ResourceRecordSet => ({
+  Name: normalizeName(props.name),
+  Type: props.type,
+  SetIdentifier: props.setIdentifier,
+  TTL: props.aliasTarget ? undefined : props.ttl,
+  ResourceRecords: props.aliasTarget
+    ? undefined
+    : (props.records ?? []).map((Value) => ({ Value })),
+  AliasTarget: props.aliasTarget
+    ? {
+        HostedZoneId: normalizeHostedZoneId(
+          props.aliasTarget.hostedZoneId as string,
+        ),
+        DNSName: props.aliasTarget.dnsName as string,
+        EvaluateTargetHealth: props.aliasTarget.evaluateTargetHealth ?? false,
+      }
+    : undefined,
+});
+
+const toAttrs = (
+  recordSet: route53.ResourceRecordSet,
+  hostedZoneId: string,
+) => ({
+  hostedZoneId: normalizeHostedZoneId(hostedZoneId),
+  name: recordSet.Name,
+  type: recordSet.Type,
+  ttl: recordSet.TTL,
+  records: recordSet.ResourceRecords?.map((record) => record.Value),
+  aliasTarget: toAliasTarget(recordSet.AliasTarget),
+  setIdentifier: recordSet.SetIdentifier,
+});
+
+export const RecordProvider = () =>
+  Provider.effect(
+    Record,
+    Effect.gen(function* () {
+      const waitForChange = Effect.fn(function* (changeId: string) {
+        return yield* route53.getChange({ Id: changeId }).pipe(
+          Effect.map((response) => response.ChangeInfo),
+          Effect.flatMap((changeInfo) =>
+            changeInfo.Status === "INSYNC"
+              ? Effect.succeed(changeInfo)
+              : Effect.die(new Error("Route53ChangePending")),
+          ),
+          Effect.retry({
+            while: (error) =>
+              error instanceof Error &&
+              error.message === "Route53ChangePending",
+            schedule: Schedule.fixed("2 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      const findRecord = Effect.fn(function* (
+        hostedZoneId: string,
+        props: Pick<RecordProps, "name" | "type" | "setIdentifier">,
+      ) {
+        const response = yield* route53
+          .listResourceRecordSets({
+            HostedZoneId: normalizeHostedZoneId(hostedZoneId),
+            StartRecordName: normalizeName(props.name),
+            StartRecordType: props.type,
+            MaxItems: 100,
+          })
+          .pipe(
+            Effect.catchTag("NoSuchHostedZone", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        return response?.ResourceRecordSets.find(
+          (recordSet) =>
+            recordSet.Name === normalizeName(props.name) &&
+            recordSet.Type === props.type &&
+            (recordSet.SetIdentifier ?? undefined) === props.setIdentifier,
+        );
+      });
+
+      const upsertRecord = Effect.fn(function* (props: RecordProps) {
+        const response = yield* route53.changeResourceRecordSets({
+          HostedZoneId: normalizeHostedZoneId(props.hostedZoneId),
+          ChangeBatch: {
+            Comment: "Alchemy Route53 record upsert",
+            Changes: [
+              {
+                Action: "UPSERT",
+                ResourceRecordSet: toRecordSet(props),
+              },
+            ],
+          },
+        });
+
+        yield* waitForChange(response.ChangeInfo.Id);
+      });
+
+      return {
+        stables: ["hostedZoneId", "name", "type", "setIdentifier"],
+        diff: Effect.fn(function* ({ olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            normalizeHostedZoneId(olds.hostedZoneId) !==
+              normalizeHostedZoneId(news.hostedZoneId) ||
+            normalizeName(olds.name) !== normalizeName(news.name) ||
+            olds.type !== news.type ||
+            olds.setIdentifier !== news.setIdentifier
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const recordSet = yield* findRecord(
+            output?.hostedZoneId ?? olds!.hostedZoneId,
+            {
+              name: output?.name ?? olds!.name,
+              type: output?.type ?? olds!.type,
+              setIdentifier: output?.setIdentifier ?? olds!.setIdentifier,
+            },
+          );
+
+          if (!recordSet) {
+            return undefined;
+          }
+
+          return toAttrs(recordSet, output?.hostedZoneId ?? olds!.hostedZoneId);
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          // Route 53 `changeResourceRecordSets` with `UPSERT` is naturally
+          // reconciler-friendly: it creates the record if missing and
+          // overwrites it if present. There's no separate ensure/sync split
+          // — one call converges to the desired record set.
+          yield* upsertRecord(news);
+
+          // Re-read so the returned attributes reflect the actual current
+          // record (including server-applied defaults).
+          const recordSet = yield* findRecord(news.hostedZoneId, news);
+
+          if (!recordSet) {
+            return yield* Effect.die(
+              new Error("Route53 record was not found after upsert"),
+            );
+          }
+
+          yield* session.note(`${news.type} ${normalizeName(news.name)}`);
+          return toAttrs(recordSet, news.hostedZoneId);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* route53
+            .changeResourceRecordSets({
+              HostedZoneId: normalizeHostedZoneId(output.hostedZoneId),
+              ChangeBatch: {
+                Comment: "Alchemy Route53 record delete",
+                Changes: [
+                  {
+                    Action: "DELETE",
+                    ResourceRecordSet: {
+                      Name: output.name,
+                      Type: output.type,
+                      SetIdentifier: output.setIdentifier,
+                      TTL: output.aliasTarget ? undefined : output.ttl,
+                      ResourceRecords: output.records?.map((Value) => ({
+                        Value,
+                      })),
+                      AliasTarget: output.aliasTarget
+                        ? {
+                            HostedZoneId: normalizeHostedZoneId(
+                              output.aliasTarget.hostedZoneId as string,
+                            ),
+                            DNSName: output.aliasTarget.dnsName as string,
+                            EvaluateTargetHealth:
+                              output.aliasTarget.evaluateTargetHealth ?? false,
+                          }
+                        : undefined,
+                    },
+                  },
+                ],
+              },
+            })
+            .pipe(
+              Effect.flatMap((response) =>
+                waitForChange(response.ChangeInfo.Id),
+              ),
+              Effect.catchTag("NoSuchHostedZone", () => Effect.void),
+              Effect.catchTag("InvalidChangeBatch", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Route53/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Route53/index.ts
new file mode 100644
index 00000000000..34413e17a86
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Route53/index.ts
@@ -0,0 +1 @@
+export { Record, RecordProvider } from "./Record.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/AbortMultipartUpload.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/AbortMultipartUpload.ts
new file mode 100644
index 00000000000..195b8090537
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/AbortMultipartUpload.ts
@@ -0,0 +1,73 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface AbortMultipartUploadRequest extends Omit<
+  S3.AbortMultipartUploadRequest,
+  "Bucket"
+> {}
+
+export class AbortMultipartUpload extends Binding.Service<
+  AbortMultipartUpload,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: AbortMultipartUploadRequest,
+    ) => Effect.Effect<
+      S3.AbortMultipartUploadOutput,
+      S3.AbortMultipartUploadError
+    >
+  >
+>()("AWS.S3.AbortMultipartUpload") {}
+
+export const AbortMultipartUploadLive = Layer.effect(
+  AbortMultipartUpload,
+  Effect.gen(function* () {
+    const Policy = yield* AbortMultipartUploadPolicy;
+    const abortMultipartUpload = yield* S3.abortMultipartUpload;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: AbortMultipartUploadRequest) {
+        return yield* abortMultipartUpload({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class AbortMultipartUploadPolicy extends Binding.Policy<
+  AbortMultipartUploadPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.AbortMultipartUpload") {}
+
+export const AbortMultipartUploadPolicyLive =
+  AbortMultipartUploadPolicy.layer.succeed(
+    Effect.fn(function* (host, bucket) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.S3.AbortMultipartUpload(${bucket}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["s3:AbortMultipartUpload"],
+                Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `AbortMultipartUploadPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/Bucket.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/Bucket.ts
new file mode 100644
index 00000000000..786907d6080
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/Bucket.ts
@@ -0,0 +1,598 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import type { BucketLocationConstraint } from "@distilled.cloud/aws/s3";
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { diffTags } from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { RegionID } from "../Region.ts";
+
+export type BucketName = string;
+export type BucketArn = `arn:aws:s3:::${BucketName}`;
+
+export interface BucketProps {
+  /**
+   * Name of the bucket. If omitted, a unique name will be generated.
+   * Must be lowercase and between 3-63 characters.
+   */
+  bucketName?: string;
+  /**
+   * Indicates whether this bucket has Object Lock enabled.
+   * Once enabled, cannot be disabled.
+   */
+  objectLockEnabled?: boolean;
+  /**
+   * Whether to delete all objects when the bucket is destroyed.
+   * @default false
+   */
+  forceDestroy?: boolean;
+  /**
+   * Tags to apply to the bucket.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Bucket extends Resource<
+  "AWS.S3.Bucket",
+  BucketProps,
+  {
+    /**
+     * Name of the bucket.
+     */
+    bucketName: BucketName;
+    /**
+     * ARN of the bucket.
+     */
+    bucketArn: BucketArn;
+    /**
+     * Domain name of the bucket (e.g., bucket-name.s3.amazonaws.com).
+     */
+    bucketDomainName: `${BucketName}.s3.amazonaws.com`;
+    /**
+     * Regional domain name of the bucket.
+     */
+    bucketRegionalDomainName: `${BucketName}.s3.${RegionID}.amazonaws.com`;
+    /**
+     * AWS region where the bucket is located.
+     */
+    region: RegionID;
+    /**
+     * AWS account ID that owns the bucket.
+     */
+    accountId: AccountID;
+  },
+  {
+    /**
+     * Notification configuration for the bucket.
+     */
+    notificationConfiguration?: s3.NotificationConfiguration;
+    /**
+     * Policy statements for the bucket.
+     */
+    policyStatements?: PolicyStatement[];
+  },
+  Providers
+> {}
+
+/**
+ * An S3 bucket for storing objects in AWS.
+ *
+ * A bucket name is auto-generated from the app, stage, and logical ID unless
+ * you provide one explicitly via `bucketName`. Enable `forceDestroy` to allow
+ * Alchemy to empty the bucket before deleting it.
+ *
+ * @section Creating a Bucket
+ * @example Basic Bucket
+ * ```typescript
+ * import * as S3 from "alchemy/AWS/S3";
+ *
+ * const bucket = yield* S3.Bucket("my-bucket", {});
+ * ```
+ *
+ * @example Bucket with a custom name
+ * ```typescript
+ * const bucket = yield* S3.Bucket("my-bucket", {
+ *   bucketName: "my-company-assets",
+ * });
+ * ```
+ *
+ * @example Bucket with force destroy
+ * ```typescript
+ * const bucket = yield* S3.Bucket("my-bucket", {
+ *   forceDestroy: true,
+ * });
+ * ```
+ *
+ * @section Runtime Operations
+ * Bind S3 operations in the init phase and use them in runtime
+ * handlers. Bindings inject the bucket name and grant scoped IAM
+ * permissions automatically.
+ *
+ * @example Read and write objects
+ * ```typescript
+ * // init
+ * const getObject = yield* S3.GetObject.bind(bucket);
+ * const putObject = yield* S3.PutObject.bind(bucket);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* putObject({
+ *       Key: "hello.txt",
+ *       Body: "Hello, World!",
+ *       ContentType: "text/plain",
+ *     });
+ *     const response = yield* getObject({ Key: "hello.txt" });
+ *     return HttpServerResponse.text("OK");
+ *   }),
+ * };
+ * ```
+ *
+ * @example Delete an object
+ * ```typescript
+ * // init
+ * const deleteObject = yield* S3.DeleteObject.bind(bucket);
+ * ```
+ *
+ * @section Event Notifications
+ * Subscribe to bucket events from the init phase. The subscription
+ * and Lambda invoke permissions are created automatically.
+ *
+ * @example Process object creation events
+ * ```typescript
+ * // init
+ * yield* S3.notifications(bucket, {
+ *   events: ["s3:ObjectCreated:*"],
+ * }).subscribe((stream) =>
+ *   stream.pipe(
+ *     Stream.runForEach((event) =>
+ *       Effect.log(`New object: ${event.key}`),
+ *     ),
+ *   ),
+ * );
+ * ```
+ */
+export const Bucket = Resource<Bucket>("AWS.S3.Bucket");
+
+export const BucketProvider = () =>
+  Provider.effect(
+    Bucket,
+    Effect.gen(function* () {
+      const createBucketName = (
+        id: string,
+        props: { bucketName?: string | undefined },
+      ) =>
+        Effect.gen(function* () {
+          if (props.bucketName) {
+            return props.bucketName;
+          }
+          return yield* createPhysicalName({
+            id,
+            maxLength: 63,
+            lowercase: true,
+          });
+        });
+
+      const deleteAllObjects = Effect.fn(function* (bucketName: string) {
+        yield* Effect.logInfo(
+          `S3 Bucket delete: deleting all objects from ${bucketName}`,
+        );
+        // List and delete all objects (including versions and delete markers)
+        let continuationToken: string | undefined;
+        do {
+          const listResponse = yield* s3.listObjectsV2({
+            Bucket: bucketName,
+            ContinuationToken: continuationToken,
+          });
+
+          if (listResponse.Contents && listResponse.Contents.length > 0) {
+            yield* Effect.logInfo(
+              `S3 Bucket delete: deleting ${listResponse.Contents.length} object(s) from ${bucketName}`,
+            );
+            yield* s3.deleteObjects({
+              Bucket: bucketName,
+              Delete: {
+                Objects: listResponse.Contents.map((obj) => ({
+                  Key: obj.Key!,
+                })),
+                Quiet: true,
+              },
+            });
+          }
+
+          continuationToken = listResponse.NextContinuationToken;
+        } while (continuationToken);
+
+        // Also delete all object versions and delete markers
+        let keyMarker: string | undefined;
+        let versionIdMarker: string | undefined;
+        do {
+          const listVersionsResponse = yield* s3.listObjectVersions({
+            Bucket: bucketName,
+            KeyMarker: keyMarker,
+            VersionIdMarker: versionIdMarker,
+          });
+
+          const objectsToDelete = [
+            ...(listVersionsResponse.Versions ?? []).map((v) => ({
+              Key: v.Key!,
+              VersionId: v.VersionId,
+            })),
+            ...(listVersionsResponse.DeleteMarkers ?? []).map((dm) => ({
+              Key: dm.Key!,
+              VersionId: dm.VersionId,
+            })),
+          ];
+
+          if (objectsToDelete.length > 0) {
+            yield* Effect.logInfo(
+              `S3 Bucket delete: deleting ${objectsToDelete.length} versioned object(s) from ${bucketName}`,
+            );
+            yield* s3.deleteObjects({
+              Bucket: bucketName,
+              Delete: {
+                Objects: objectsToDelete,
+                Quiet: true,
+              },
+            });
+          }
+
+          keyMarker = listVersionsResponse.NextKeyMarker;
+          versionIdMarker = listVersionsResponse.NextVersionIdMarker;
+        } while (keyMarker);
+      });
+
+      const ensureBucketExists = Effect.fnUntraced(function* ({
+        id,
+        news = {},
+      }: {
+        id: string;
+        news: BucketProps;
+      }) {
+        const region = yield* Region;
+        const { accountId } = yield* AWSEnvironment;
+        const bucketName = yield* createBucketName(id, news);
+
+        yield* Effect.logInfo(
+          `S3 Bucket create: bucket=${bucketName} region=${region} `,
+        );
+
+        // For us-east-1, BucketAlreadyOwnedByYou is not thrown, so we need to
+        // pre-emptively check if the bucket exists for idempotency
+        if (region === "us-east-1") {
+          const exists = yield* s3.headBucket({ Bucket: bucketName }).pipe(
+            Effect.map(() => true),
+            Effect.catchTag("NotFound", () => Effect.succeed(false)),
+            Effect.catch(() => Effect.succeed(false)),
+          );
+
+          yield* Effect.logInfo(
+            `S3 Bucket create: us-east-1 existence check for ${bucketName} -> ${exists}`,
+          );
+
+          if (!exists) {
+            yield* Effect.logInfo(
+              `S3 Bucket create: creating bucket ${bucketName} in us-east-1`,
+            );
+            yield* s3
+              .createBucket({
+                Bucket: bucketName,
+                ObjectLockEnabledForBucket: news.objectLockEnabled ?? false,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) =>
+                    e._tag === "OperationAborted" ||
+                    e._tag === "ServiceUnavailable",
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+          }
+        } else {
+          // For non-us-east-1 regions, we can rely on BucketAlreadyOwnedByYou
+          yield* Effect.logInfo(
+            `S3 Bucket create: creating bucket ${bucketName} in ${region}`,
+          );
+          yield* s3
+            .createBucket({
+              Bucket: bucketName,
+              CreateBucketConfiguration: {
+                LocationConstraint: region as BucketLocationConstraint,
+              },
+              ObjectLockEnabledForBucket: news.objectLockEnabled,
+            })
+            .pipe(
+              Effect.catchTag("BucketAlreadyOwnedByYou", () => Effect.void),
+              Effect.retry({
+                while: (e) =>
+                  e._tag === "OperationAborted" ||
+                  e._tag === "ServiceUnavailable",
+                schedule: Schedule.exponential(100),
+              }),
+            );
+        }
+
+        // Wait for bucket to exist (eventual consistency)
+        yield* Effect.retry(
+          s3.headBucket({ Bucket: bucketName }),
+          Schedule.exponential(100).pipe(Schedule.both(Schedule.recurs(10))),
+        );
+        yield* Effect.logInfo(
+          `S3 Bucket create: bucket is available ${bucketName}`,
+        );
+
+        return {
+          bucketName,
+          bucketArn: `arn:aws:s3:::${bucketName}` as const,
+          bucketDomainName: `${bucketName}.s3.amazonaws.com` as const,
+          bucketRegionalDomainName:
+            `${bucketName}.s3.${region}.amazonaws.com` as const,
+          region,
+          accountId,
+        };
+      });
+
+      const fetchBucketTags = (
+        bucketName: string,
+      ): Effect.Effect<Record<string, string>, never, any> =>
+        s3.getBucketTagging({ Bucket: bucketName }).pipe(
+          Effect.map(
+            (r) =>
+              Object.fromEntries(
+                (r.TagSet ?? []).map((t) => [t.Key!, t.Value!]),
+              ) as Record<string, string>,
+          ),
+          Effect.catchTag("NoSuchTagSet", () =>
+            Effect.succeed({} as Record<string, string>),
+          ),
+          Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+        );
+
+      const syncBucketTags = Effect.fnUntraced(function* ({
+        bucketName,
+        oldTags,
+        newTags,
+        session,
+        operation,
+      }: {
+        bucketName: string;
+        oldTags?: Record<string, string>;
+        newTags?: Record<string, string>;
+        session: ScopedPlanStatusSession;
+        operation: "create" | "update";
+      }) {
+        // Compare against the cloud's actual tags so drift surfaces
+        // correctly even after a cold-start adoption (where olds.tags
+        // equals news.tags and would otherwise look like a no-op).
+        const previousTags = oldTags ?? (yield* fetchBucketTags(bucketName));
+        const desiredTags = newTags ?? {};
+        const { removed, upsert } = diffTags(previousTags, desiredTags);
+        const canSkip = oldTags !== undefined;
+
+        yield* Effect.logInfo(
+          `S3 Bucket ${operation}: bucket=${bucketName} removedTags=${removed.length} upsertTags=${Object.keys(upsert).length}`,
+        );
+
+        if (
+          canSkip &&
+          removed.length === 0 &&
+          Object.keys(upsert).length === 0
+        ) {
+          return;
+        }
+
+        if (Object.keys(desiredTags).length > 0) {
+          yield* Effect.logInfo(
+            `S3 Bucket ${operation}: writing ${Object.keys(desiredTags).length} total tag(s) to ${bucketName}`,
+          );
+          yield* s3.putBucketTagging({
+            Bucket: bucketName,
+            Tagging: {
+              TagSet: Object.entries(desiredTags).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
+            },
+          });
+          yield* session.note(`Updated bucket tags: ${bucketName}`);
+          return;
+        }
+
+        yield* Effect.logInfo(
+          `S3 Bucket ${operation}: removing all tags from ${bucketName}`,
+        );
+        yield* s3.deleteBucketTagging({
+          Bucket: bucketName,
+        });
+        yield* session.note(`Removed all tags from bucket: ${bucketName}`);
+      });
+
+      const syncBucketPolicy = Effect.fnUntraced(function* ({
+        bucketName,
+        bindings,
+        session,
+        operation,
+      }: {
+        bucketName: string;
+        session: ScopedPlanStatusSession;
+        bindings: ResourceBinding<Bucket["Binding"]>[];
+        operation: "create" | "update";
+      }) {
+        const policyStatements = bindings.flatMap(
+          (binding) => binding.data.policyStatements ?? [],
+        );
+        const desiredPolicy =
+          policyStatements.length > 0
+            ? JSON.stringify({
+                Version: "2012-10-17",
+                Statement: policyStatements,
+              })
+            : undefined;
+        const existingPolicy = yield* s3
+          .getBucketPolicy({ Bucket: bucketName })
+          .pipe(
+            Effect.map((r) => r.Policy),
+            Effect.catchTag("NoSuchBucketPolicy", () =>
+              Effect.succeed<string | undefined>(undefined),
+            ),
+          );
+
+        yield* Effect.logInfo(
+          `S3 Bucket ${operation}: bucket=${bucketName} policyStatements=${policyStatements.length}`,
+        );
+
+        if (desiredPolicy) {
+          if (existingPolicy === desiredPolicy) {
+            return;
+          }
+
+          yield* Effect.logInfo(
+            `S3 Bucket ${operation}: applying ${policyStatements.length} policy statement(s) to ${bucketName}`,
+          );
+          yield* s3.putBucketPolicy({
+            Bucket: bucketName,
+            Policy: desiredPolicy,
+          });
+          yield* session.note(`Updated bucket policy: ${bucketName}`);
+          return;
+        }
+
+        if (existingPolicy === undefined) {
+          return;
+        }
+
+        yield* Effect.logInfo(
+          `S3 Bucket ${operation}: deleting bucket policy for ${bucketName}`,
+        );
+        yield* s3.deleteBucketPolicy({ Bucket: bucketName });
+        yield* session.note(`Removed bucket policy: ${bucketName}`);
+      });
+
+      return {
+        stables: ["bucketName", "bucketArn", "region", "accountId"],
+        // S3 bucket names are globally unique. `headBucket` succeeds only when
+        // the bucket exists in our account, so a successful response is itself
+        // proof of account-level ownership — there is no separate ownership
+        // signal to surface as `Unowned`.
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const bucketName =
+            output?.bucketName ?? (yield* createBucketName(id, olds ?? {}));
+          const region = yield* Region;
+          const { accountId } = yield* AWSEnvironment;
+          const exists = yield* s3.headBucket({ Bucket: bucketName }).pipe(
+            Effect.map(() => true),
+            Effect.catchTag("NotFound", () => Effect.succeed(false)),
+            Effect.catch(() => Effect.succeed(false)),
+          );
+          if (!exists) return undefined;
+          return {
+            bucketName,
+            bucketArn: `arn:aws:s3:::${bucketName}` as const,
+            bucketDomainName: `${bucketName}.s3.amazonaws.com` as const,
+            bucketRegionalDomainName:
+              `${bucketName}.s3.${region}.amazonaws.com` as const,
+            region,
+            accountId,
+          };
+        }),
+        diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          const oldBucketName = yield* createBucketName(id, olds);
+          const newBucketName = yield* createBucketName(id, news);
+          yield* Effect.logInfo(
+            `S3 Bucket diff: old=${oldBucketName} new=${newBucketName} oldObjectLock=${olds.objectLockEnabled ?? false} newObjectLock=${news.objectLockEnabled ?? false}`,
+          );
+          if (oldBucketName !== newBucketName) {
+            yield* Effect.logInfo(
+              `S3 Bucket diff: replacing bucket because name changed from ${oldBucketName} to ${newBucketName}`,
+            );
+            return { action: "replace" } as const;
+          }
+          // Object lock can only be enabled at creation time
+          if (
+            (olds.objectLockEnabled ?? false) !==
+            (news.objectLockEnabled ?? false)
+          ) {
+            yield* Effect.logInfo(
+              `S3 Bucket diff: replacing bucket because object lock changed for ${newBucketName}`,
+            );
+            return { action: "replace" } as const;
+          }
+        }),
+        precreate: (props) => ensureBucketExists(props),
+        reconcile: Effect.fn(function* ({
+          id,
+          news = {},
+          output,
+          session,
+          bindings,
+        }) {
+          const operation = output === undefined ? "create" : "update";
+          const resolved = output ?? (yield* ensureBucketExists({ id, news }));
+
+          yield* syncBucketTags({
+            bucketName: resolved.bucketName,
+            // Omit `oldTags` so syncBucketTags fetches the cloud's actual
+            // current tags. This makes drift detection correct even after
+            // a cold-start adoption where olds.tags would equal news.tags.
+            newTags: news.tags,
+            session,
+            operation,
+          });
+
+          yield* syncBucketPolicy({
+            bucketName: resolved.bucketName,
+            bindings,
+            session,
+            operation,
+          });
+
+          if (operation === "create") {
+            yield* session.note(`Ensured bucket: ${resolved.bucketName}`);
+          }
+
+          return resolved;
+        }),
+        delete: Effect.fn(function* ({ olds = {}, output, session }) {
+          yield* Effect.logInfo(
+            `S3 Bucket delete: bucket=${output.bucketName} forceDestroy=${olds.forceDestroy ?? false}`,
+          );
+          // If forceDestroy is enabled, delete all objects first. The bucket
+          // may already be gone (deleted out-of-band, or a previous destroy
+          // partially succeeded) — treat NoSuchBucket as a no-op so the
+          // overall delete still converges.
+          if (olds.forceDestroy) {
+            yield* session.note(
+              `Force destroying bucket: ${output.bucketName} - deleting all objects...`,
+            );
+            yield* deleteAllObjects(output.bucketName).pipe(
+              Effect.catchTag("NoSuchBucket", () => Effect.void),
+            );
+          }
+
+          yield* s3
+            .deleteBucket({
+              Bucket: output.bucketName,
+            })
+            .pipe(
+              Effect.catchTag("NoSuchBucket", () => Effect.void),
+              Effect.retry({
+                while: (e) => e._tag === "BucketNotEmpty",
+                schedule: Schedule.exponential(100).pipe(
+                  Schedule.both(Schedule.recurs(5)),
+                ),
+              }),
+            );
+
+          yield* session.note(`Deleted bucket: ${output.bucketName}`);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/BucketEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/BucketEventSource.ts
new file mode 100644
index 00000000000..b375044f604
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/BucketEventSource.ts
@@ -0,0 +1,26 @@
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { Bucket } from "./Bucket.ts";
+import type {
+  BucketNotification,
+  NotificationsProps,
+} from "./BucketNotifications.ts";
+import type { S3EventType } from "./S3Event.ts";
+
+export class BucketEventSource extends Binding.Service<
+  BucketEventSource,
+  BucketEventSourceService
+>()("BucketNotificationStream") {}
+
+export type BucketEventSourceService = <
+  Events extends S3EventType[],
+  StreamReq = never,
+  Req = never,
+>(
+  bucket: Bucket,
+  props: NotificationsProps<Events>,
+  process: (
+    stream: Stream.Stream<BucketNotification, never, StreamReq>,
+  ) => Effect.Effect<void, never, Req>,
+) => Effect.Effect<void, never, never>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/BucketNotifications.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/BucketNotifications.ts
new file mode 100644
index 00000000000..e188497dc5a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/BucketNotifications.ts
@@ -0,0 +1,74 @@
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+
+import type { Bucket } from "./Bucket.ts";
+import { BucketEventSource } from "./BucketEventSource.ts";
+import type { S3EventType } from "./S3Event.ts";
+
+/**
+ * A normalized S3 event notification record.
+ */
+export type BucketNotification = {
+  /** The S3 event type that triggered this notification. */
+  type: S3EventType;
+  /** Name of the bucket the event originated from. */
+  bucket: string;
+  /** Object key that the event applies to. */
+  key: string;
+  /** Size of the object in bytes. */
+  size: number;
+  /** ETag of the object. */
+  eTag: string;
+};
+
+export interface NotificationsProps<Events extends S3EventType[]> {
+  /** S3 event types to subscribe to. Defaults to all event types. */
+  events?: Events;
+}
+
+/**
+ * Subscribe to S3 bucket event notifications.
+ *
+ * Returns an object with a `.subscribe(process)` method that receives a
+ * `Stream<BucketNotification>` for processing events.
+ *
+ * @section Subscribing to Events
+ * @example Process all object creation events
+ * ```typescript
+ * import * as S3 from "alchemy/AWS/S3";
+ *
+ * yield* S3.notifications(bucket, {
+ *   events: ["s3:ObjectCreated:*"],
+ * }).subscribe((stream) =>
+ *   stream.pipe(
+ *     Stream.runForEach((event) =>
+ *       Effect.log(`New object: ${event.key} (${event.size} bytes)`),
+ *     ),
+ *   ),
+ * );
+ * ```
+ *
+ * @example Process all events (no filter)
+ * ```typescript
+ * yield* S3.notifications(bucket).subscribe((stream) =>
+ *   stream.pipe(
+ *     Stream.runForEach((event) =>
+ *       Effect.log(`${event.type}: ${event.key}`),
+ *     ),
+ *   ),
+ * );
+ * ```
+ */
+export const notifications = <
+  B extends Bucket,
+  const Events extends S3EventType[] = S3EventType[],
+>(
+  bucket: B,
+  props: NotificationsProps<Events> = {},
+) => ({
+  subscribe: <Req = never, StreamReq = never>(
+    process: (
+      stream: Stream.Stream<BucketNotification, never, StreamReq>,
+    ) => Effect.Effect<void, never, Req>,
+  ) => BucketEventSource.use((source) => source(bucket, props, process)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CompleteMultipartUpload.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CompleteMultipartUpload.ts
new file mode 100644
index 00000000000..1a16914de24
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CompleteMultipartUpload.ts
@@ -0,0 +1,73 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface CompleteMultipartUploadRequest extends Omit<
+  S3.CompleteMultipartUploadRequest,
+  "Bucket"
+> {}
+
+export class CompleteMultipartUpload extends Binding.Service<
+  CompleteMultipartUpload,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: CompleteMultipartUploadRequest,
+    ) => Effect.Effect<
+      S3.CompleteMultipartUploadOutput,
+      S3.CompleteMultipartUploadError
+    >
+  >
+>()("AWS.S3.CompleteMultipartUpload") {}
+
+export const CompleteMultipartUploadLive = Layer.effect(
+  CompleteMultipartUpload,
+  Effect.gen(function* () {
+    const Policy = yield* CompleteMultipartUploadPolicy;
+    const completeMultipartUpload = yield* S3.completeMultipartUpload;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: CompleteMultipartUploadRequest) {
+        return yield* completeMultipartUpload({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class CompleteMultipartUploadPolicy extends Binding.Policy<
+  CompleteMultipartUploadPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.CompleteMultipartUpload") {}
+
+export const CompleteMultipartUploadPolicyLive =
+  CompleteMultipartUploadPolicy.layer.succeed(
+    Effect.fn(function* (host, bucket) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.S3.CompleteMultipartUpload(${bucket}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["s3:PutObject"],
+                Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `CompleteMultipartUploadPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CopyObject.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CopyObject.ts
new file mode 100644
index 00000000000..d40993fa084
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CopyObject.ts
@@ -0,0 +1,68 @@
+// @ts-nocheck
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface CopyObjectRequest extends Omit<
+  S3.CopyObjectRequest,
+  "Bucket"
+> {}
+
+export class CopyObject extends Binding.Service<
+  CopyObject,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: CopyObjectRequest,
+    ) => Effect.Effect<S3.CopyObjectOutput, S3.CopyObjectError>
+  >
+>()("AWS.S3.CopyObject") {}
+
+export const CopyObjectLive = Layer.effect(
+  CopyObject,
+  Effect.gen(function* () {
+    const Policy = yield* CopyObjectPolicy;
+    const copyObject = yield* S3.copyObject;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: CopyObjectRequest) {
+        return yield* copyObject({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class CopyObjectPolicy extends Binding.Policy<
+  CopyObjectPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.CopyObject") {}
+
+export const CopyObjectPolicyLive = CopyObjectPolicy.layer.succeed(
+  Effect.fn(function* (host, bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.CopyObject(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:PutObject", "s3:GetObject"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `CopyObjectPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CreateMultipartUpload.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CreateMultipartUpload.ts
new file mode 100644
index 00000000000..ea4c06fdebb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/CreateMultipartUpload.ts
@@ -0,0 +1,73 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface CreateMultipartUploadRequest extends Omit<
+  S3.CreateMultipartUploadRequest,
+  "Bucket"
+> {}
+
+export class CreateMultipartUpload extends Binding.Service<
+  CreateMultipartUpload,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: CreateMultipartUploadRequest,
+    ) => Effect.Effect<
+      S3.CreateMultipartUploadOutput,
+      S3.CreateMultipartUploadError
+    >
+  >
+>()("AWS.S3.CreateMultipartUpload") {}
+
+export const CreateMultipartUploadLive = Layer.effect(
+  CreateMultipartUpload,
+  Effect.gen(function* () {
+    const Policy = yield* CreateMultipartUploadPolicy;
+    const createMultipartUpload = yield* S3.createMultipartUpload;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: CreateMultipartUploadRequest) {
+        return yield* createMultipartUpload({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class CreateMultipartUploadPolicy extends Binding.Policy<
+  CreateMultipartUploadPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.CreateMultipartUpload") {}
+
+export const CreateMultipartUploadPolicyLive =
+  CreateMultipartUploadPolicy.layer.succeed(
+    Effect.fn(function* (host, bucket) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.S3.CreateMultipartUpload(${bucket}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["s3:PutObject"],
+                Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `CreateMultipartUploadPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/DeleteObject.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/DeleteObject.ts
new file mode 100644
index 00000000000..9ce7579aac8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/DeleteObject.ts
@@ -0,0 +1,67 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface DeleteObjectRequest extends Omit<
+  S3.DeleteObjectRequest,
+  "Bucket"
+> {}
+
+export class DeleteObject extends Binding.Service<
+  DeleteObject,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: DeleteObjectRequest,
+    ) => Effect.Effect<S3.DeleteObjectOutput, S3.DeleteObjectError>
+  >
+>()("AWS.S3.DeleteObject") {}
+
+export const DeleteObjectLive = Layer.effect(
+  DeleteObject,
+  Effect.gen(function* () {
+    const Policy = yield* DeleteObjectPolicy;
+    const deleteObject = yield* S3.deleteObject;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: DeleteObjectRequest) {
+        return yield* deleteObject({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class DeleteObjectPolicy extends Binding.Policy<
+  DeleteObjectPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.DeleteObject") {}
+
+export const DeleteObjectPolicyLive = DeleteObjectPolicy.layer.succeed(
+  Effect.fn(function* (host, bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.DeleteObject(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:DeleteObject", "s3:DeleteObjectVersion"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DeleteObjectPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/GetObject.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/GetObject.ts
new file mode 100644
index 00000000000..2fd20983aa8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/GetObject.ts
@@ -0,0 +1,74 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface GetObjectRequest extends Omit<S3.GetObjectRequest, "Bucket"> {}
+
+export class GetObject extends Binding.Service<
+  GetObject,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: GetObjectRequest,
+    ) => Effect.Effect<S3.GetObjectOutput, S3.GetObjectError>
+  >
+>()("AWS.S3.GetObject") {}
+
+export const GetObjectLive = Layer.effect(
+  GetObject,
+  Effect.gen(function* () {
+    const Policy = yield* GetObjectPolicy;
+    const getObject = yield* S3.getObject;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const b = bucket.bucketName;
+      const BucketName = yield* b;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: GetObjectRequest) {
+        return yield* getObject({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class GetObjectPolicy extends Binding.Policy<
+  GetObjectPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.GetObject") {}
+
+export const GetObjectPolicyLive = GetObjectPolicy.layer.succeed(
+  Effect.fn(function* (host, bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.GetObject(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:GetObject", "s3:GetObjectVersion"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+          },
+          {
+            Effect: "Allow",
+            Action: [
+              // ListBucket is required to check if the object exists (otherwise a non-existent key returns 403)
+              // https://repost.aws/articles/ARe3OTZ3SCTWWqGtiJ6aHn8Q/why-does-s-3-return-403-instead-of-404-when-the-object-doesnt-exist
+              "s3:ListBucket",
+            ],
+            Resource: [bucket.bucketArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `GetObjectPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/HeadObject.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/HeadObject.ts
new file mode 100644
index 00000000000..348ac389eb0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/HeadObject.ts
@@ -0,0 +1,67 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface HeadObjectRequest extends Omit<
+  S3.HeadObjectRequest,
+  "Bucket"
+> {}
+
+export class HeadObject extends Binding.Service<
+  HeadObject,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: HeadObjectRequest,
+    ) => Effect.Effect<S3.HeadObjectOutput, S3.HeadObjectError>
+  >
+>()("AWS.S3.HeadObject") {}
+
+export const HeadObjectLive = Layer.effect(
+  HeadObject,
+  Effect.gen(function* () {
+    const Policy = yield* HeadObjectPolicy;
+    const headObject = yield* S3.headObject;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: HeadObjectRequest) {
+        return yield* headObject({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class HeadObjectPolicy extends Binding.Policy<
+  HeadObjectPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.HeadObject") {}
+
+export const HeadObjectPolicyLive = HeadObjectPolicy.layer.succeed(
+  Effect.fn(function* (host, bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.HeadObject(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:GetObject"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `HeadObjectPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/ListObjectsV2.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/ListObjectsV2.ts
new file mode 100644
index 00000000000..c726fd8fca9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/ListObjectsV2.ts
@@ -0,0 +1,67 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface ListObjectsV2Request extends Omit<
+  S3.ListObjectsV2Request,
+  "Bucket"
+> {}
+
+export class ListObjectsV2 extends Binding.Service<
+  ListObjectsV2,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request?: ListObjectsV2Request,
+    ) => Effect.Effect<S3.ListObjectsV2Output, S3.ListObjectsV2Error>
+  >
+>()("AWS.S3.ListObjectsV2") {}
+
+export const ListObjectsV2Live = Layer.effect(
+  ListObjectsV2,
+  Effect.gen(function* () {
+    const bind = yield* ListObjectsV2Policy;
+    const listObjectsV2 = yield* S3.listObjectsV2;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* bind(bucket);
+      return Effect.fn(function* (request?: ListObjectsV2Request) {
+        return yield* listObjectsV2({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class ListObjectsV2Policy extends Binding.Policy<
+  ListObjectsV2Policy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.ListObjectsV2") {}
+
+export const ListObjectsV2PolicyLive = ListObjectsV2Policy.layer.succeed(
+  Effect.fn(function* (host, bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.ListObjectsV2(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:ListBucket"],
+            Resource: [Output.interpolate`${bucket.bucketArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListObjectsV2Policy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/PutObject.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/PutObject.ts
new file mode 100644
index 00000000000..58955c96c4e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/PutObject.ts
@@ -0,0 +1,83 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface PutObjectRequest extends Omit<S3.PutObjectRequest, "Bucket"> {}
+
+/**
+ * Runtime binding for `s3:PutObject`.
+ *
+ * Bind this operation to a bucket to get a callable that writes objects without
+ * manually supplying the bucket name on every request.
+ *
+ * @section Writing Objects
+ * @example Put an Object
+ * ```typescript
+ * const putObject = yield* PutObject.bind(bucket);
+ *
+ * yield* putObject({
+ *   Key: "hello.txt",
+ *   Body: "Hello, world!",
+ *   ContentType: "text/plain",
+ * });
+ * ```
+ */
+export class PutObject extends Binding.Service<
+  PutObject,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: PutObjectRequest,
+    ) => Effect.Effect<S3.PutObjectOutput, S3.PutObjectError>
+  >
+>()("AWS.S3.PutObject") {}
+
+export const PutObjectLive = Layer.effect(
+  PutObject,
+  Effect.gen(function* () {
+    const bind = yield* PutObjectPolicy;
+    const putObject = yield* S3.putObject;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* bind(bucket);
+      return Effect.fn(function* (request: PutObjectRequest) {
+        return yield* putObject({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class PutObjectPolicy extends Binding.Policy<
+  PutObjectPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.PutObject") {}
+
+export const PutObjectPolicyLive = PutObjectPolicy.layer.succeed(
+  Effect.fn(function* (host, bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.PutObject(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:PutObject"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PutObjectPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/S3Event.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/S3Event.ts
new file mode 100644
index 00000000000..f3a239539f8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/S3Event.ts
@@ -0,0 +1,43 @@
+import type * as lambda from "aws-lambda";
+
+export type S3Record = lambda.S3EventRecord;
+export type S3Event = lambda.S3Event;
+
+/**
+ * S3 event types that can trigger notifications.
+ */
+export type S3EventType =
+  // Object Created Events
+  | "s3:ObjectCreated:*"
+  | "s3:ObjectCreated:Put"
+  | "s3:ObjectCreated:Post"
+  | "s3:ObjectCreated:Copy"
+  | "s3:ObjectCreated:CompleteMultipartUpload"
+  // Object Removed Events
+  | "s3:ObjectRemoved:*"
+  | "s3:ObjectRemoved:Delete"
+  | "s3:ObjectRemoved:DeleteMarkerCreated"
+  // Object Restore Events
+  | "s3:ObjectRestore:*"
+  | "s3:ObjectRestore:Post"
+  | "s3:ObjectRestore:Completed"
+  | "s3:ObjectRestore:Delete"
+  // Replication Events
+  | "s3:Replication:*"
+  | "s3:Replication:OperationFailedReplication"
+  | "s3:Replication:OperationNotTracked"
+  | "s3:Replication:OperationMissedThreshold"
+  | "s3:Replication:OperationReplicatedAfterThreshold"
+  // Lifecycle Events
+  | "s3:LifecycleExpiration:*"
+  | "s3:LifecycleExpiration:Delete"
+  | "s3:LifecycleExpiration:DeleteMarkerCreated"
+  | "s3:LifecycleTransition"
+  // Intelligent Tiering
+  | "s3:IntelligentTiering"
+  // Object Tagging
+  | "s3:ObjectTagging:*"
+  | "s3:ObjectTagging:Put"
+  | "s3:ObjectTagging:Delete"
+  // Object ACL
+  | "s3:ObjectAcl:Put";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/UploadPart.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/UploadPart.ts
new file mode 100644
index 00000000000..e7e6991f0a9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/UploadPart.ts
@@ -0,0 +1,67 @@
+import * as S3 from "@distilled.cloud/aws/s3";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Bucket } from "./Bucket.ts";
+
+export interface UploadPartRequest extends Omit<
+  S3.UploadPartRequest,
+  "Bucket"
+> {}
+
+export class UploadPart extends Binding.Service<
+  UploadPart,
+  (
+    bucket: Bucket,
+  ) => Effect.Effect<
+    (
+      request: UploadPartRequest,
+    ) => Effect.Effect<S3.UploadPartOutput, S3.UploadPartError>
+  >
+>()("AWS.S3.UploadPart") {}
+
+export const UploadPartLive = Layer.effect(
+  UploadPart,
+  Effect.gen(function* () {
+    const Policy = yield* UploadPartPolicy;
+    const uploadPart = yield* S3.uploadPart;
+
+    return Effect.fn(function* (bucket: Bucket) {
+      const BucketName = yield* bucket.bucketName;
+      yield* Policy(bucket);
+      return Effect.fn(function* (request: UploadPartRequest) {
+        return yield* uploadPart({
+          ...request,
+          Bucket: yield* BucketName,
+        });
+      });
+    });
+  }),
+);
+
+export class UploadPartPolicy extends Binding.Policy<
+  UploadPartPolicy,
+  (bucket: Bucket) => Effect.Effect<void>
+>()("AWS.S3.UploadPart") {}
+
+export const UploadPartPolicyLive = UploadPartPolicy.layer.succeed(
+  Effect.fn(function* (host, bucket: Bucket) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.S3.UploadPart(${bucket}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["s3:PutObject"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `UploadPartPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/index.ts
new file mode 100644
index 00000000000..0691e19f2f3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/S3/index.ts
@@ -0,0 +1,14 @@
+export * from "./AbortMultipartUpload.ts";
+export * from "./Bucket.ts";
+export * from "./BucketEventSource.ts";
+export * from "./BucketNotifications.ts";
+export * from "./CompleteMultipartUpload.ts";
+export * from "./CopyObject.ts";
+export * from "./CreateMultipartUpload.ts";
+export * from "./DeleteObject.ts";
+export * from "./GetObject.ts";
+export * from "./HeadObject.ts";
+export * from "./ListObjectsV2.ts";
+export * from "./PutObject.ts";
+export * from "./S3Event.ts";
+export * from "./UploadPart.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/AddPermission.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/AddPermission.ts
new file mode 100644
index 00000000000..14c656a97a6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/AddPermission.ts
@@ -0,0 +1,66 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface AddPermissionRequest extends Omit<
+  sns.AddPermissionInput,
+  "TopicArn"
+> {}
+
+export class AddPermission extends Binding.Service<
+  AddPermission,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: AddPermissionRequest,
+    ) => Effect.Effect<sns.AddPermissionResponse, sns.AddPermissionError>
+  >
+>()("AWS.SNS.AddPermission") {}
+
+export const AddPermissionLive = Layer.effect(
+  AddPermission,
+  Effect.gen(function* () {
+    const Policy = yield* AddPermissionPolicy;
+    const addPermission = yield* sns.addPermission;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: AddPermissionRequest) {
+        return yield* addPermission({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class AddPermissionPolicy extends Binding.Policy<
+  AddPermissionPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.AddPermission") {}
+
+export const AddPermissionPolicyLive = AddPermissionPolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.AddPermission(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:AddPermission"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `AddPermissionPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ConfirmSubscription.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ConfirmSubscription.ts
new file mode 100644
index 00000000000..7fe6110b3c9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ConfirmSubscription.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Subscription } from "./Subscription.ts";
+
+export interface ConfirmSubscriptionRequest extends Omit<
+  sns.ConfirmSubscriptionInput,
+  "TopicArn"
+> {}
+
+export class ConfirmSubscription extends Binding.Service<
+  ConfirmSubscription,
+  (
+    subscription: Subscription,
+  ) => Effect.Effect<
+    (
+      request: ConfirmSubscriptionRequest,
+    ) => Effect.Effect<
+      sns.ConfirmSubscriptionResponse,
+      sns.ConfirmSubscriptionError
+    >
+  >
+>()("AWS.SNS.ConfirmSubscription") {}
+
+export const ConfirmSubscriptionLive = Layer.effect(
+  ConfirmSubscription,
+  Effect.gen(function* () {
+    const Policy = yield* ConfirmSubscriptionPolicy;
+    const confirmSubscription = yield* sns.confirmSubscription;
+
+    return Effect.fn(function* (subscription: Subscription) {
+      const TopicArn = yield* subscription.topicArn;
+      yield* Policy(subscription);
+      return Effect.fn(function* (request: ConfirmSubscriptionRequest) {
+        return yield* confirmSubscription({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class ConfirmSubscriptionPolicy extends Binding.Policy<
+  ConfirmSubscriptionPolicy,
+  (subscription: Subscription) => Effect.Effect<void>
+>()("AWS.SNS.ConfirmSubscription") {}
+
+export const ConfirmSubscriptionPolicyLive =
+  ConfirmSubscriptionPolicy.layer.succeed(
+    Effect.fn(function* (host, subscription) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.ConfirmSubscription(${subscription}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:ConfirmSubscription"],
+                Resource: [subscription.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ConfirmSubscriptionPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetDataProtectionPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetDataProtectionPolicy.ts
new file mode 100644
index 00000000000..b21e0a0f98d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetDataProtectionPolicy.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface GetDataProtectionPolicyRequest extends Omit<
+  sns.GetDataProtectionPolicyInput,
+  "ResourceArn"
+> {}
+
+export class GetDataProtectionPolicy extends Binding.Service<
+  GetDataProtectionPolicy,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request?: GetDataProtectionPolicyRequest,
+    ) => Effect.Effect<
+      sns.GetDataProtectionPolicyResponse,
+      sns.GetDataProtectionPolicyError
+    >
+  >
+>()("AWS.SNS.GetDataProtectionPolicy") {}
+
+export const GetDataProtectionPolicyLive = Layer.effect(
+  GetDataProtectionPolicy,
+  Effect.gen(function* () {
+    const Policy = yield* GetDataProtectionPolicyPolicy;
+    const getDataProtectionPolicy = yield* sns.getDataProtectionPolicy;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request?: GetDataProtectionPolicyRequest) {
+        return yield* getDataProtectionPolicy({
+          ...request,
+          ResourceArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class GetDataProtectionPolicyPolicy extends Binding.Policy<
+  GetDataProtectionPolicyPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.GetDataProtectionPolicy") {}
+
+export const GetDataProtectionPolicyPolicyLive =
+  GetDataProtectionPolicyPolicy.layer.succeed(
+    Effect.fn(function* (host, topic) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.GetDataProtectionPolicy(${topic}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:GetDataProtectionPolicy"],
+                Resource: [topic.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `GetDataProtectionPolicyPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetSubscriptionAttributes.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetSubscriptionAttributes.ts
new file mode 100644
index 00000000000..07b7c700735
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetSubscriptionAttributes.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Subscription } from "./Subscription.ts";
+
+export interface GetSubscriptionAttributesRequest extends Omit<
+  sns.GetSubscriptionAttributesInput,
+  "SubscriptionArn"
+> {}
+
+export class GetSubscriptionAttributes extends Binding.Service<
+  GetSubscriptionAttributes,
+  (
+    subscription: Subscription,
+  ) => Effect.Effect<
+    (
+      request?: GetSubscriptionAttributesRequest,
+    ) => Effect.Effect<
+      sns.GetSubscriptionAttributesResponse,
+      sns.GetSubscriptionAttributesError
+    >
+  >
+>()("AWS.SNS.GetSubscriptionAttributes") {}
+
+export const GetSubscriptionAttributesLive = Layer.effect(
+  GetSubscriptionAttributes,
+  Effect.gen(function* () {
+    const Policy = yield* GetSubscriptionAttributesPolicy;
+    const getSubscriptionAttributes = yield* sns.getSubscriptionAttributes;
+
+    return Effect.fn(function* (subscription: Subscription) {
+      const SubscriptionArn = yield* subscription.subscriptionArn;
+      yield* Policy(subscription);
+      return Effect.fn(function* (request?: GetSubscriptionAttributesRequest) {
+        return yield* getSubscriptionAttributes({
+          ...request,
+          SubscriptionArn: yield* SubscriptionArn,
+        });
+      });
+    });
+  }),
+);
+
+export class GetSubscriptionAttributesPolicy extends Binding.Policy<
+  GetSubscriptionAttributesPolicy,
+  (subscription: Subscription) => Effect.Effect<void>
+>()("AWS.SNS.GetSubscriptionAttributes") {}
+
+export const GetSubscriptionAttributesPolicyLive =
+  GetSubscriptionAttributesPolicy.layer.succeed(
+    Effect.fn(function* (host, subscription) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.GetSubscriptionAttributes(${subscription}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:GetSubscriptionAttributes"],
+                Resource: [subscription.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `GetSubscriptionAttributesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetTopicAttributes.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetTopicAttributes.ts
new file mode 100644
index 00000000000..19dbafbcb35
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/GetTopicAttributes.ts
@@ -0,0 +1,70 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface GetTopicAttributesRequest extends Omit<
+  sns.GetTopicAttributesInput,
+  "TopicArn"
+> {}
+
+export class GetTopicAttributes extends Binding.Service<
+  GetTopicAttributes,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request?: GetTopicAttributesRequest,
+    ) => Effect.Effect<
+      sns.GetTopicAttributesResponse,
+      sns.GetTopicAttributesError
+    >
+  >
+>()("AWS.SNS.GetTopicAttributes") {}
+
+export const GetTopicAttributesLive = Layer.effect(
+  GetTopicAttributes,
+  Effect.gen(function* () {
+    const Policy = yield* GetTopicAttributesPolicy;
+    const getTopicAttributes = yield* sns.getTopicAttributes;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request?: GetTopicAttributesRequest) {
+        return yield* getTopicAttributes({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class GetTopicAttributesPolicy extends Binding.Policy<
+  GetTopicAttributesPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.GetTopicAttributes") {}
+
+export const GetTopicAttributesPolicyLive =
+  GetTopicAttributesPolicy.layer.succeed(
+    Effect.fn(function* (host, topic) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.GetTopicAttributes(${topic}))`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["sns:GetTopicAttributes"],
+              Resource: [topic.topicArn],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `GetTopicAttributesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListSubscriptions.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListSubscriptions.ts
new file mode 100644
index 00000000000..319fa6747de
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListSubscriptions.ts
@@ -0,0 +1,60 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListSubscriptionsRequest extends sns.ListSubscriptionsInput {}
+
+export class ListSubscriptions extends Binding.Service<
+  ListSubscriptions,
+  () => Effect.Effect<
+    (
+      request?: ListSubscriptionsRequest,
+    ) => Effect.Effect<
+      sns.ListSubscriptionsResponse,
+      sns.ListSubscriptionsError
+    >
+  >
+>()("AWS.SNS.ListSubscriptions") {}
+
+export const ListSubscriptionsLive = Layer.effect(
+  ListSubscriptions,
+  Effect.gen(function* () {
+    const Policy = yield* ListSubscriptionsPolicy;
+    const listSubscriptions = yield* sns.listSubscriptions;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: ListSubscriptionsRequest) {
+        return yield* listSubscriptions(request ?? {});
+      });
+    });
+  }),
+);
+
+export class ListSubscriptionsPolicy extends Binding.Policy<
+  ListSubscriptionsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.SNS.ListSubscriptions") {}
+
+export const ListSubscriptionsPolicyLive =
+  ListSubscriptionsPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.ListSubscriptions())`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["sns:ListSubscriptions"],
+              Resource: ["*"],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `ListSubscriptionsPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListSubscriptionsByTopic.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListSubscriptionsByTopic.ts
new file mode 100644
index 00000000000..9ee9e4e1249
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListSubscriptionsByTopic.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface ListSubscriptionsByTopicRequest extends Omit<
+  sns.ListSubscriptionsByTopicInput,
+  "TopicArn"
+> {}
+
+export class ListSubscriptionsByTopic extends Binding.Service<
+  ListSubscriptionsByTopic,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request?: ListSubscriptionsByTopicRequest,
+    ) => Effect.Effect<
+      sns.ListSubscriptionsByTopicResponse,
+      sns.ListSubscriptionsByTopicError
+    >
+  >
+>()("AWS.SNS.ListSubscriptionsByTopic") {}
+
+export const ListSubscriptionsByTopicLive = Layer.effect(
+  ListSubscriptionsByTopic,
+  Effect.gen(function* () {
+    const Policy = yield* ListSubscriptionsByTopicPolicy;
+    const listSubscriptionsByTopic = yield* sns.listSubscriptionsByTopic;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request?: ListSubscriptionsByTopicRequest) {
+        return yield* listSubscriptionsByTopic({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class ListSubscriptionsByTopicPolicy extends Binding.Policy<
+  ListSubscriptionsByTopicPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.ListSubscriptionsByTopic") {}
+
+export const ListSubscriptionsByTopicPolicyLive =
+  ListSubscriptionsByTopicPolicy.layer.succeed(
+    Effect.fn(function* (host, topic) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.ListSubscriptionsByTopic(${topic}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:ListSubscriptionsByTopic"],
+                Resource: [topic.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListSubscriptionsByTopicPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListTagsForResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListTagsForResource.ts
new file mode 100644
index 00000000000..512c673cc1c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListTagsForResource.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface ListTagsForResourceRequest extends Omit<
+  sns.ListTagsForResourceRequest,
+  "ResourceArn"
+> {}
+
+export class ListTagsForResource extends Binding.Service<
+  ListTagsForResource,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request?: ListTagsForResourceRequest,
+    ) => Effect.Effect<
+      sns.ListTagsForResourceResponse,
+      sns.ListTagsForResourceError
+    >
+  >
+>()("AWS.SNS.ListTagsForResource") {}
+
+export const ListTagsForResourceLive = Layer.effect(
+  ListTagsForResource,
+  Effect.gen(function* () {
+    const Policy = yield* ListTagsForResourcePolicy;
+    const listTagsForResource = yield* sns.listTagsForResource;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request?: ListTagsForResourceRequest) {
+        return yield* listTagsForResource({
+          ...request,
+          ResourceArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class ListTagsForResourcePolicy extends Binding.Policy<
+  ListTagsForResourcePolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.ListTagsForResource") {}
+
+export const ListTagsForResourcePolicyLive =
+  ListTagsForResourcePolicy.layer.succeed(
+    Effect.fn(function* (host, topic) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.ListTagsForResource(${topic}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:ListTagsForResource"],
+                Resource: [topic.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `ListTagsForResourcePolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListTopics.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListTopics.ts
new file mode 100644
index 00000000000..6a7b61804ce
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/ListTopics.ts
@@ -0,0 +1,56 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+export interface ListTopicsRequest extends sns.ListTopicsInput {}
+
+export class ListTopics extends Binding.Service<
+  ListTopics,
+  () => Effect.Effect<
+    (
+      request?: ListTopicsRequest,
+    ) => Effect.Effect<sns.ListTopicsResponse, sns.ListTopicsError>
+  >
+>()("AWS.SNS.ListTopics") {}
+
+export const ListTopicsLive = Layer.effect(
+  ListTopics,
+  Effect.gen(function* () {
+    const Policy = yield* ListTopicsPolicy;
+    const listTopics = yield* sns.listTopics;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (request?: ListTopicsRequest) {
+        return yield* listTopics(request ?? {});
+      });
+    });
+  }),
+);
+
+export class ListTopicsPolicy extends Binding.Policy<
+  ListTopicsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.SNS.ListTopics") {}
+
+export const ListTopicsPolicyLive = ListTopicsPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.ListTopics())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:ListTopics"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListTopicsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Publish.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Publish.ts
new file mode 100644
index 00000000000..77ac295318c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Publish.ts
@@ -0,0 +1,66 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface PublishRequest extends Omit<
+  sns.PublishInput,
+  "TopicArn" | "TargetArn" | "PhoneNumber"
+> {}
+
+export class Publish extends Binding.Service<
+  Publish,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: PublishRequest,
+    ) => Effect.Effect<sns.PublishResponse, sns.PublishError>
+  >
+>()("AWS.SNS.Publish") {}
+
+export const PublishLive = Layer.effect(
+  Publish,
+  Effect.gen(function* () {
+    const Policy = yield* PublishPolicy;
+    const publish = yield* sns.publish;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: PublishRequest) {
+        return yield* publish({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class PublishPolicy extends Binding.Policy<
+  PublishPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.Publish") {}
+
+export const PublishPolicyLive = PublishPolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.Publish(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:Publish"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PublishPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/PublishBatch.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/PublishBatch.ts
new file mode 100644
index 00000000000..cca267ccb11
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/PublishBatch.ts
@@ -0,0 +1,66 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface PublishBatchRequest extends Omit<
+  sns.PublishBatchInput,
+  "TopicArn"
+> {}
+
+export class PublishBatch extends Binding.Service<
+  PublishBatch,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: PublishBatchRequest,
+    ) => Effect.Effect<sns.PublishBatchResponse, sns.PublishBatchError>
+  >
+>()("AWS.SNS.PublishBatch") {}
+
+export const PublishBatchLive = Layer.effect(
+  PublishBatch,
+  Effect.gen(function* () {
+    const Policy = yield* PublishBatchPolicy;
+    const publishBatch = yield* sns.publishBatch;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: PublishBatchRequest) {
+        return yield* publishBatch({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class PublishBatchPolicy extends Binding.Policy<
+  PublishBatchPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.PublishBatch") {}
+
+export const PublishBatchPolicyLive = PublishBatchPolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.PublishBatch(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:Publish"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `PublishBatchPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/PutDataProtectionPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/PutDataProtectionPolicy.ts
new file mode 100644
index 00000000000..9238e55ef9e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/PutDataProtectionPolicy.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface PutDataProtectionPolicyRequest extends Omit<
+  sns.PutDataProtectionPolicyInput,
+  "ResourceArn"
+> {}
+
+export class PutDataProtectionPolicy extends Binding.Service<
+  PutDataProtectionPolicy,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: PutDataProtectionPolicyRequest,
+    ) => Effect.Effect<
+      sns.PutDataProtectionPolicyResponse,
+      sns.PutDataProtectionPolicyError
+    >
+  >
+>()("AWS.SNS.PutDataProtectionPolicy") {}
+
+export const PutDataProtectionPolicyLive = Layer.effect(
+  PutDataProtectionPolicy,
+  Effect.gen(function* () {
+    const Policy = yield* PutDataProtectionPolicyPolicy;
+    const putDataProtectionPolicy = yield* sns.putDataProtectionPolicy;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: PutDataProtectionPolicyRequest) {
+        return yield* putDataProtectionPolicy({
+          ...request,
+          ResourceArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class PutDataProtectionPolicyPolicy extends Binding.Policy<
+  PutDataProtectionPolicyPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.PutDataProtectionPolicy") {}
+
+export const PutDataProtectionPolicyPolicyLive =
+  PutDataProtectionPolicyPolicy.layer.succeed(
+    Effect.fn(function* (host, topic) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.PutDataProtectionPolicy(${topic}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:PutDataProtectionPolicy"],
+                Resource: [topic.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `PutDataProtectionPolicyPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/RemovePermission.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/RemovePermission.ts
new file mode 100644
index 00000000000..4b3b395e8ae
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/RemovePermission.ts
@@ -0,0 +1,66 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface RemovePermissionRequest extends Omit<
+  sns.RemovePermissionInput,
+  "TopicArn"
+> {}
+
+export class RemovePermission extends Binding.Service<
+  RemovePermission,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: RemovePermissionRequest,
+    ) => Effect.Effect<sns.RemovePermissionResponse, sns.RemovePermissionError>
+  >
+>()("AWS.SNS.RemovePermission") {}
+
+export const RemovePermissionLive = Layer.effect(
+  RemovePermission,
+  Effect.gen(function* () {
+    const Policy = yield* RemovePermissionPolicy;
+    const removePermission = yield* sns.removePermission;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: RemovePermissionRequest) {
+        return yield* removePermission({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class RemovePermissionPolicy extends Binding.Policy<
+  RemovePermissionPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.RemovePermission") {}
+
+export const RemovePermissionPolicyLive = RemovePermissionPolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.RemovePermission(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:RemovePermission"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `RemovePermissionPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/SetSubscriptionAttributes.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/SetSubscriptionAttributes.ts
new file mode 100644
index 00000000000..041c68df2dd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/SetSubscriptionAttributes.ts
@@ -0,0 +1,72 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Subscription } from "./Subscription.ts";
+
+export interface SetSubscriptionAttributesRequest extends Omit<
+  sns.SetSubscriptionAttributesInput,
+  "SubscriptionArn"
+> {}
+
+export class SetSubscriptionAttributes extends Binding.Service<
+  SetSubscriptionAttributes,
+  (
+    subscription: Subscription,
+  ) => Effect.Effect<
+    (
+      request: SetSubscriptionAttributesRequest,
+    ) => Effect.Effect<
+      sns.SetSubscriptionAttributesResponse,
+      sns.SetSubscriptionAttributesError
+    >
+  >
+>()("AWS.SNS.SetSubscriptionAttributes") {}
+
+export const SetSubscriptionAttributesLive = Layer.effect(
+  SetSubscriptionAttributes,
+  Effect.gen(function* () {
+    const Policy = yield* SetSubscriptionAttributesPolicy;
+    const setSubscriptionAttributes = yield* sns.setSubscriptionAttributes;
+
+    return Effect.fn(function* (subscription: Subscription) {
+      const SubscriptionArn = yield* subscription.subscriptionArn;
+      yield* Policy(subscription);
+      return Effect.fn(function* (request: SetSubscriptionAttributesRequest) {
+        return yield* setSubscriptionAttributes({
+          ...request,
+          SubscriptionArn: yield* SubscriptionArn,
+        });
+      });
+    });
+  }),
+);
+
+export class SetSubscriptionAttributesPolicy extends Binding.Policy<
+  SetSubscriptionAttributesPolicy,
+  (subscription: Subscription) => Effect.Effect<void>
+>()("AWS.SNS.SetSubscriptionAttributes") {}
+
+export const SetSubscriptionAttributesPolicyLive =
+  SetSubscriptionAttributesPolicy.layer.succeed(
+    Effect.fn(function* (host, subscription) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.SetSubscriptionAttributes(${subscription}))`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["sns:SetSubscriptionAttributes"],
+                Resource: [subscription.topicArn],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `SetSubscriptionAttributesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/SetTopicAttributes.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/SetTopicAttributes.ts
new file mode 100644
index 00000000000..d030442a346
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/SetTopicAttributes.ts
@@ -0,0 +1,70 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface SetTopicAttributesRequest extends Omit<
+  sns.SetTopicAttributesInput,
+  "TopicArn"
+> {}
+
+export class SetTopicAttributes extends Binding.Service<
+  SetTopicAttributes,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: SetTopicAttributesRequest,
+    ) => Effect.Effect<
+      sns.SetTopicAttributesResponse,
+      sns.SetTopicAttributesError
+    >
+  >
+>()("AWS.SNS.SetTopicAttributes") {}
+
+export const SetTopicAttributesLive = Layer.effect(
+  SetTopicAttributes,
+  Effect.gen(function* () {
+    const Policy = yield* SetTopicAttributesPolicy;
+    const setTopicAttributes = yield* sns.setTopicAttributes;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: SetTopicAttributesRequest) {
+        return yield* setTopicAttributes({
+          ...request,
+          TopicArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class SetTopicAttributesPolicy extends Binding.Policy<
+  SetTopicAttributesPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.SetTopicAttributes") {}
+
+export const SetTopicAttributesPolicyLive =
+  SetTopicAttributesPolicy.layer.succeed(
+    Effect.fn(function* (host, topic) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SNS.SetTopicAttributes(${topic}))`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["sns:SetTopicAttributes"],
+              Resource: [topic.topicArn],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `SetTopicAttributesPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Subscription.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Subscription.ts
new file mode 100644
index 00000000000..e5d4e1e0fe8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Subscription.ts
@@ -0,0 +1,364 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+
+export type SubscriptionArn = string;
+
+export interface SubscriptionProps {
+  /**
+   * ARN of the topic to subscribe to.
+   */
+  topicArn: Input<string>;
+  /**
+   * SNS subscription protocol, for example `lambda`, `sqs`, `https`, or `email`.
+   */
+  protocol: string;
+  /**
+   * Endpoint for the selected protocol, such as a Lambda function ARN or queue ARN.
+   */
+  endpoint?: Input<string>;
+  /**
+   * Raw SNS subscription attributes keyed by AWS attribute name.
+   */
+  attributes?: Record<string, string>;
+  /**
+   * Whether SNS should return the subscription ARN immediately, even while pending confirmation.
+   * @default true
+   */
+  returnSubscriptionArn?: boolean;
+}
+
+export interface Subscription extends Resource<
+  "AWS.SNS.Subscription",
+  SubscriptionProps,
+  {
+    subscriptionArn: SubscriptionArn;
+    topicArn: string;
+    protocol: string;
+    endpoint: string | undefined;
+    owner: string | undefined;
+    pendingConfirmation: boolean;
+    attributes: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon SNS subscription that attaches an endpoint to a topic.
+ *
+ * `Subscription` keeps the lifecycle of the subscription itself separate from the
+ * topic, which lets Lambda event sources and manually managed subscriptions share
+ * the same canonical resource model.
+ *
+ * @section Creating Subscriptions
+ * @example Lambda Subscription
+ * ```typescript
+ * const subscription = yield* Subscription("TopicSubscription", {
+ *   topicArn: topic.topicArn,
+ *   protocol: "lambda",
+ *   endpoint: fn.functionArn,
+ * });
+ * ```
+ */
+export const Subscription = Resource<Subscription>("AWS.SNS.Subscription");
+
+export const SubscriptionProvider = () =>
+  Provider.succeed(Subscription, {
+    read: Effect.fn(function* ({ olds, output }) {
+      return yield* readSubscription({
+        subscriptionArn: output?.subscriptionArn,
+        topicArn: (output?.topicArn ?? olds.topicArn) as string | undefined,
+        protocol: output?.protocol ?? olds.protocol,
+        endpoint: (output?.endpoint ?? olds.endpoint) as string | undefined,
+      });
+    }),
+    stables: ["subscriptionArn"],
+    diff: Effect.fn(function* ({ news, olds }) {
+      if (!isResolved(news)) return undefined;
+      if (news.protocol !== olds.protocol) {
+        return { action: "replace" } as const;
+      }
+
+      if (
+        typeof news.topicArn === "string" &&
+        typeof olds.topicArn === "string" &&
+        news.topicArn !== olds.topicArn
+      ) {
+        return { action: "replace" } as const;
+      }
+
+      if (
+        typeof news.endpoint === "string" &&
+        typeof olds.endpoint === "string" &&
+        news.endpoint !== olds.endpoint
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    reconcile: Effect.fn(function* ({ news, output, session }) {
+      const topicArn = news.topicArn as string;
+      const protocol = news.protocol;
+      const endpoint = news.endpoint as string | undefined;
+      const desiredAttributes = toAttributeMap(news.attributes);
+
+      // Observe — derive the live SubscriptionArn. We can't trust a
+      // pending-confirmation ARN from `output`, since the user may have
+      // confirmed it out of band. Cached ARN is preferred when concrete;
+      // otherwise we list-and-match by (topicArn, protocol, endpoint).
+      let subscriptionArn: string | undefined;
+      if (
+        output?.subscriptionArn &&
+        !isPendingConfirmation(output.subscriptionArn)
+      ) {
+        const observed = yield* sns
+          .getSubscriptionAttributes({
+            SubscriptionArn: output.subscriptionArn,
+          })
+          .pipe(
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("InvalidParameterException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        if (observed) {
+          subscriptionArn = output.subscriptionArn;
+        }
+      } else {
+        subscriptionArn = yield* findSubscription({
+          topicArn,
+          protocol,
+          endpoint,
+        });
+      }
+
+      // Ensure — subscribe if no live subscription matches.
+      if (!subscriptionArn) {
+        const response = yield* sns.subscribe({
+          TopicArn: topicArn,
+          Protocol: protocol,
+          Endpoint: endpoint,
+          Attributes: news.attributes,
+          ReturnSubscriptionArn: news.returnSubscriptionArn ?? true,
+        });
+        if (!response.SubscriptionArn) {
+          return yield* Effect.die(new Error(`subscribe returned no ARN`));
+        }
+        subscriptionArn = response.SubscriptionArn;
+        yield* session.note(subscriptionArn);
+        return {
+          subscriptionArn,
+          topicArn,
+          protocol,
+          endpoint,
+          owner: undefined,
+          pendingConfirmation: isPendingConfirmation(subscriptionArn),
+          attributes: desiredAttributes,
+        };
+      }
+
+      // Sync attributes — fetch observed cloud attributes (FilterPolicy,
+      // RawMessageDelivery, etc.) and apply only the delta. We can only
+      // do this once the subscription is confirmed (pending confirmation
+      // returns no real ARN to mutate against).
+      const attrsResponse = yield* sns
+        .getSubscriptionAttributes({ SubscriptionArn: subscriptionArn })
+        .pipe(
+          Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+          Effect.catchTag("InvalidParameterException", () =>
+            Effect.succeed(undefined),
+          ),
+        );
+      const observedAttributes = toAttributeMap(attrsResponse?.Attributes);
+
+      for (const [name, value] of Object.entries(desiredAttributes)) {
+        if (observedAttributes[name] !== value) {
+          yield* sns.setSubscriptionAttributes({
+            SubscriptionArn: subscriptionArn,
+            AttributeName: name,
+            AttributeValue: value,
+          });
+        }
+      }
+
+      // Reset attributes the user no longer specifies. We only clear
+      // user-specified keys (those present in `news.attributes`/`olds`),
+      // not all observed keys, because SNS exposes many read-only system
+      // attributes we should not touch.
+      const previousKeys = new Set(
+        Object.keys(toAttributeMap(output?.attributes)),
+      );
+      for (const name of previousKeys) {
+        if (!(name in desiredAttributes)) {
+          yield* sns.setSubscriptionAttributes({
+            SubscriptionArn: subscriptionArn,
+            AttributeName: name,
+          });
+        }
+      }
+
+      yield* session.note(subscriptionArn);
+
+      return {
+        subscriptionArn,
+        topicArn,
+        protocol,
+        endpoint,
+        owner: output?.owner,
+        pendingConfirmation: isPendingConfirmation(subscriptionArn),
+        attributes: desiredAttributes,
+      };
+    }),
+    delete: Effect.fn(function* ({ olds, output }) {
+      const subscriptionArn = isPendingConfirmation(output.subscriptionArn)
+        ? yield* findSubscription({
+            topicArn: (output.topicArn ?? olds.topicArn) as string | undefined,
+            protocol: output.protocol ?? olds.protocol,
+            endpoint: (output.endpoint ?? olds.endpoint) as string | undefined,
+          })
+        : output.subscriptionArn;
+
+      if (!subscriptionArn) {
+        return;
+      }
+
+      yield* sns
+        .unsubscribe({
+          SubscriptionArn: subscriptionArn,
+        })
+        .pipe(
+          Effect.catchTag("NotFoundException", () => Effect.void),
+          Effect.catchTag("InvalidParameterException", () => Effect.void),
+        );
+    }),
+  });
+
+const isPendingConfirmation = (subscriptionArn: string | undefined) =>
+  subscriptionArn === undefined ||
+  subscriptionArn.toLowerCase() === "pending confirmation";
+
+const toAttributeMap = (
+  attributes: Record<string, string | undefined> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    Object.entries(attributes ?? {}).filter(
+      (entry): entry is [string, string] => typeof entry[1] === "string",
+    ),
+  );
+
+const findSubscription = Effect.fn(function* ({
+  topicArn,
+  protocol,
+  endpoint,
+}: {
+  topicArn: string | undefined;
+  protocol: string | undefined;
+  endpoint: string | undefined;
+}) {
+  if (!topicArn || !protocol) {
+    return undefined;
+  }
+
+  let nextToken: string | undefined;
+
+  while (true) {
+    const response = yield* sns.listSubscriptionsByTopic({
+      TopicArn: topicArn,
+      NextToken: nextToken,
+    });
+
+    const match = response.Subscriptions?.find(
+      (subscription) =>
+        subscription.Protocol === protocol &&
+        subscription.Endpoint === endpoint,
+    );
+
+    if (match?.SubscriptionArn) {
+      return match.SubscriptionArn;
+    }
+
+    if (!response.NextToken) {
+      return undefined;
+    }
+
+    nextToken = response.NextToken;
+  }
+});
+
+const readSubscription = Effect.fn(function* ({
+  subscriptionArn,
+  topicArn,
+  protocol,
+  endpoint,
+}: {
+  subscriptionArn?: string;
+  topicArn?: string;
+  protocol?: string;
+  endpoint: string | undefined;
+}) {
+  const resolvedSubscriptionArn =
+    subscriptionArn && !isPendingConfirmation(subscriptionArn)
+      ? subscriptionArn
+      : yield* findSubscription({
+          topicArn,
+          protocol,
+          endpoint,
+        });
+
+  if (!resolvedSubscriptionArn) {
+    if (!topicArn || !protocol) {
+      return undefined;
+    }
+
+    return {
+      subscriptionArn: subscriptionArn ?? "pending confirmation",
+      topicArn,
+      protocol,
+      endpoint,
+      owner: undefined,
+      pendingConfirmation: true,
+      attributes: {},
+    };
+  }
+
+  const response = yield* sns
+    .getSubscriptionAttributes({
+      SubscriptionArn: resolvedSubscriptionArn,
+    })
+    .pipe(
+      Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+      Effect.catchTag("InvalidParameterException", () =>
+        Effect.succeed(undefined),
+      ),
+    );
+
+  if (!response) {
+    return undefined;
+  }
+
+  const attributes = toAttributeMap(response.Attributes);
+  const resolvedTopicArn = attributes.TopicArn ?? topicArn;
+  const resolvedProtocol = attributes.Protocol ?? protocol;
+
+  if (!resolvedTopicArn || !resolvedProtocol) {
+    return undefined;
+  }
+
+  return {
+    subscriptionArn: resolvedSubscriptionArn,
+    topicArn: resolvedTopicArn,
+    protocol: resolvedProtocol,
+    endpoint: attributes.Endpoint ?? endpoint,
+    owner: attributes.Owner,
+    pendingConfirmation:
+      attributes.PendingConfirmation === "true" ||
+      isPendingConfirmation(resolvedSubscriptionArn),
+    attributes,
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TagResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TagResource.ts
new file mode 100644
index 00000000000..5b2c12a0409
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TagResource.ts
@@ -0,0 +1,66 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface TagResourceRequest extends Omit<
+  sns.TagResourceRequest,
+  "ResourceArn"
+> {}
+
+export class TagResource extends Binding.Service<
+  TagResource,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: TagResourceRequest,
+    ) => Effect.Effect<sns.TagResourceResponse, sns.TagResourceError>
+  >
+>()("AWS.SNS.TagResource") {}
+
+export const TagResourceLive = Layer.effect(
+  TagResource,
+  Effect.gen(function* () {
+    const Policy = yield* TagResourcePolicy;
+    const tagResource = yield* sns.tagResource;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: TagResourceRequest) {
+        return yield* tagResource({
+          ...request,
+          ResourceArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class TagResourcePolicy extends Binding.Policy<
+  TagResourcePolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.TagResource") {}
+
+export const TagResourcePolicyLive = TagResourcePolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.TagResource(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:TagResource"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `TagResourcePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Topic.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Topic.ts
new file mode 100644
index 00000000000..2b1d131bf88
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/Topic.ts
@@ -0,0 +1,422 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags, hasAlchemyTags } from "../../Tags.ts";
+import type { AccountID } from "../Environment.ts";
+import type { RegionID } from "../Region.ts";
+
+export type TopicName = string;
+export type TopicArn = `arn:aws:sns:${RegionID}:${AccountID}:${TopicName}`;
+
+export interface TopicProps {
+  /**
+   * Name of the topic.
+   * @default ${app}-${stage}-${id}?.fifo
+   */
+  topicName?: string;
+  /**
+   * Whether to create a FIFO topic.
+   * @default false
+   */
+  fifo?: boolean;
+  /**
+   * Raw SNS topic attributes keyed by AWS attribute name.
+   * Use this for delivery policies, tracing, KMS, signatures, archive policy, and
+   * other SNS topic attributes not modeled as first-class props.
+   */
+  attributes?: Record<string, string>;
+  /**
+   * SNS data protection policy JSON for the topic.
+   *
+   * TODO(sam): should this be a typed object that we serialize/deserialize?
+   */
+  dataProtectionPolicy?: string;
+  /**
+   * User-defined tags to apply to the topic.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Topic extends Resource<
+  "AWS.SNS.Topic",
+  TopicProps,
+  {
+    topicArn: TopicArn;
+    topicName: TopicName;
+    fifo: boolean;
+    attributes: Record<string, string>;
+    dataProtectionPolicy: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An Amazon SNS topic for fan-out messaging and notifications.
+ *
+ * `Topic` owns the SNS topic lifecycle while raw AWS topic attributes remain
+ * available through the `attributes` prop so the full core pub/sub surface can
+ * be configured without waiting on additional typed wrappers. A topic name is
+ * auto-generated unless you provide one explicitly.
+ *
+ * @section Creating Topics
+ * @example Standard Topic
+ * ```typescript
+ * import * as SNS from "alchemy/AWS/SNS";
+ *
+ * const topic = yield* SNS.Topic("OrdersTopic");
+ * ```
+ *
+ * @example Topic with Display Name
+ * ```typescript
+ * const topic = yield* SNS.Topic("NotificationsTopic", {
+ *   attributes: {
+ *     DisplayName: "App Notifications",
+ *   },
+ * });
+ * ```
+ *
+ * @example FIFO Topic
+ * ```typescript
+ * const topic = yield* SNS.Topic("OrdersFifoTopic", {
+ *   fifo: true,
+ *   attributes: {
+ *     ContentBasedDeduplication: "true",
+ *   },
+ * });
+ * ```
+ *
+ * @section Runtime Publishing
+ * Bind publish operations in the init phase and use them in runtime
+ * handlers.
+ *
+ * @example Publish from a handler
+ * ```typescript
+ * // init
+ * const publish = yield* SNS.Publish.bind(topic);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* publish({
+ *       Message: JSON.stringify({ orderId: "123" }),
+ *       Subject: "OrderCreated",
+ *     });
+ *     return HttpServerResponse.text("Published");
+ *   }),
+ * };
+ * ```
+ *
+ * @section Subscriptions
+ * Subscribe a Lambda function to process messages published to the
+ * topic. The subscription and invoke permissions are created
+ * automatically.
+ *
+ * @example Process topic notifications
+ * ```typescript
+ * // init
+ * yield* SNS.notifications(topic).subscribe((stream) =>
+ *   stream.pipe(
+ *     Stream.runForEach((message) =>
+ *       Effect.log(`Received: ${message.Message}`),
+ *     ),
+ *   ),
+ * );
+ * ```
+ */
+export const Topic = Resource<Topic>("AWS.SNS.Topic");
+
+export const TopicProvider = () =>
+  Provider.succeed(Topic, {
+    read: Effect.fn(function* ({ id, olds, output }) {
+      const topicName =
+        output?.topicName ?? (yield* toTopicName(id, olds ?? {}));
+
+      const state = yield* readTopic({
+        id,
+        topicArn: output?.topicArn,
+        topicName,
+      });
+      if (!state) return undefined;
+      return (yield* hasAlchemyTags(id, state.tags)) ? state : Unowned(state);
+    }),
+    stables: ["topicArn", "topicName", "fifo"],
+    diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+      if (!isResolved(news)) return undefined;
+      if ((news.fifo ?? false) !== (olds.fifo ?? false)) {
+        return { action: "replace" } as const;
+      }
+
+      const oldTopicName = yield* toTopicName(id, olds);
+      const newTopicName = yield* toTopicName(id, news);
+
+      if (oldTopicName !== newTopicName) {
+        return { action: "replace" } as const;
+      }
+
+      if (
+        olds.dataProtectionPolicy !== undefined &&
+        news.dataProtectionPolicy === undefined
+      ) {
+        return { action: "replace" } as const;
+      }
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {}, olds, output, session }) {
+      const topicName = yield* toTopicName(id, news);
+      const internalTags = yield* createInternalTags(id);
+      const desiredTags = { ...internalTags, ...news.tags };
+      const desiredAttributes = toAttributes(news);
+      const isFifo = news.fifo ?? false;
+
+      // Observe + ensure — `createTopic` is idempotent for an identical
+      // (name, FifoTopic) pair, so we use it both to ensure-on-greenfield
+      // and to fetch the ARN for adoption. We deliberately pass ONLY the
+      // FifoTopic attribute (which is stable at create time): AWS rejects
+      // createTopic for an existing topic if any other attribute, tag,
+      // or DataProtectionPolicy differs from what's already attached.
+      // Mutable attributes are reconciled below against observed state.
+      const createResponse = yield* sns.createTopic({
+        Name: topicName,
+        Attributes: isFifo ? { FifoTopic: "true" } : undefined,
+      });
+      const topicArn = createResponse.TopicArn;
+      if (!topicArn) {
+        return yield* Effect.die(new Error(`createTopic returned no ARN`));
+      }
+
+      // Sync attributes — fetch observed cloud attributes and apply only
+      // the delta.
+      const observedState = yield* sns
+        .getTopicAttributes({ TopicArn: topicArn })
+        .pipe(
+          Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+        );
+      const observedAttributes = toAttributeMap(observedState?.Attributes);
+
+      for (const [name, value] of Object.entries(desiredAttributes)) {
+        if (observedAttributes[name] !== value) {
+          yield* sns.setTopicAttributes({
+            TopicArn: topicArn,
+            AttributeName: name,
+            AttributeValue: value,
+          });
+        }
+      }
+
+      // Reset previously-user-specified attributes that the user no
+      // longer specifies. Use `olds.attributes` (the prior props) — NOT
+      // `output.attributes`, which on adoption holds every attribute SNS
+      // returns and would erroneously try to reset SNS-managed values
+      // like the auto-generated Policy.
+      const previouslyManaged = olds?.attributes ?? {};
+      for (const name of Object.keys(previouslyManaged)) {
+        if (!(name in desiredAttributes) && name !== "FifoTopic") {
+          yield* sns.setTopicAttributes({
+            TopicArn: topicArn,
+            AttributeName: name,
+          });
+        }
+      }
+
+      // Sync tags — diff observed cloud tags against desired so that an
+      // adoption-takeover (cloud tags identify a different logical id)
+      // correctly rewrites ownership tags.
+      const observedTagsResp = yield* sns
+        .listTagsForResource({ ResourceArn: topicArn })
+        .pipe(
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed({ Tags: [] as sns.Tag[] }),
+          ),
+        );
+      const observedTags = toTagMap(observedTagsResp.Tags);
+      const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+      if (upsert.length > 0) {
+        yield* sns.tagResource({
+          ResourceArn: topicArn,
+          Tags: upsert,
+        });
+      }
+
+      if (removed.length > 0) {
+        yield* sns.untagResource({
+          ResourceArn: topicArn,
+          TagKeys: removed,
+        });
+      }
+
+      // Sync data protection policy — observed ↔ desired. SNS rejects
+      // getDataProtectionPolicy on FIFO topics, so we skip it there.
+      let observedPolicy: string | undefined;
+      if (!isFifo) {
+        observedPolicy = yield* sns
+          .getDataProtectionPolicy({ ResourceArn: topicArn })
+          .pipe(
+            Effect.map((r) => r.DataProtectionPolicy),
+            Effect.catchTag("NotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+            Effect.catchTag("InvalidParameterException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      }
+      if (
+        !isFifo &&
+        news.dataProtectionPolicy !== undefined &&
+        news.dataProtectionPolicy !== observedPolicy
+      ) {
+        yield* sns.putDataProtectionPolicy({
+          ResourceArn: topicArn,
+          DataProtectionPolicy: news.dataProtectionPolicy,
+        });
+      }
+
+      yield* session.note(topicArn);
+
+      return {
+        topicArn: topicArn as TopicArn,
+        topicName,
+        fifo: isFifo,
+        attributes: desiredAttributes,
+        dataProtectionPolicy: news.dataProtectionPolicy ?? observedPolicy,
+        tags: desiredTags,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      yield* sns
+        .deleteTopic({
+          TopicArn: output.topicArn,
+        })
+        .pipe(
+          Effect.catchTag("NotFoundException", () => Effect.void),
+          Effect.catchTag("InvalidParameterException", () => Effect.void),
+        );
+    }),
+  });
+
+const toTopicName = Effect.fn(function* (id: string, props: TopicProps) {
+  if (props.topicName) {
+    return props.topicName;
+  }
+
+  const baseName = yield* createPhysicalName({
+    id,
+    maxLength: props.fifo ? 256 - ".fifo".length : 256,
+  });
+
+  return props.fifo ? `${baseName}.fifo` : baseName;
+});
+
+const toAttributes = (props: TopicProps): Record<string, string> => ({
+  ...props.attributes,
+  ...(props.fifo ? { FifoTopic: "true" } : undefined),
+});
+
+const toTagMap = (tags: sns.Tag[] | undefined): Record<string, string> =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is Required<Pick<sns.Tag, "Key" | "Value">> =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const toAttributeMap = (
+  attributes: Record<string, string | undefined> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    Object.entries(attributes ?? {}).filter(
+      (entry): entry is [string, string] => typeof entry[1] === "string",
+    ),
+  );
+
+const findTopicArnByName = Effect.fn(function* (topicName: string) {
+  let nextToken: string | undefined;
+
+  while (true) {
+    const response = yield* sns.listTopics({
+      NextToken: nextToken,
+    });
+
+    const match = response.Topics?.find(
+      (topic) => topic.TopicArn?.split(":").at(-1) === topicName,
+    )?.TopicArn;
+
+    if (match) {
+      return match;
+    }
+
+    if (!response.NextToken) {
+      return undefined;
+    }
+
+    nextToken = response.NextToken;
+  }
+});
+
+const readTopic = Effect.fn(function* ({
+  id,
+  topicArn,
+  topicName,
+}: {
+  id: string;
+  topicArn?: string;
+  topicName: string;
+}) {
+  const resolvedTopicArn = topicArn ?? (yield* findTopicArnByName(topicName));
+
+  if (!resolvedTopicArn) {
+    return undefined;
+  }
+
+  const topicState = yield* Effect.all(
+    [
+      sns.getTopicAttributes({
+        TopicArn: resolvedTopicArn,
+      }),
+      sns.listTagsForResource({
+        ResourceArn: resolvedTopicArn,
+      }),
+      sns
+        .getDataProtectionPolicy({
+          ResourceArn: resolvedTopicArn,
+        })
+        .pipe(
+          Effect.map((response) => response.DataProtectionPolicy),
+          Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+        ),
+    ],
+    { concurrency: "unbounded" },
+  ).pipe(
+    Effect.catchTag("NotFoundException", () => Effect.succeed(undefined)),
+    Effect.catchTag("InvalidParameterException", () =>
+      Effect.succeed(undefined),
+    ),
+  );
+
+  if (!topicState) {
+    return undefined;
+  }
+
+  const [attributes, tags, dataProtectionPolicy] = topicState;
+
+  const topicAttributes = toAttributeMap(attributes.Attributes);
+
+  const apiTags = toTagMap(tags.Tags);
+  return {
+    topicArn: resolvedTopicArn as TopicArn,
+    topicName: topicAttributes.TopicArn?.split(":").at(-1) ?? topicName,
+    fifo: topicAttributes.FifoTopic === "true",
+    attributes: topicAttributes,
+    dataProtectionPolicy,
+    tags: apiTags,
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TopicEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TopicEventSource.ts
new file mode 100644
index 00000000000..d3956ac61aa
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TopicEventSource.ts
@@ -0,0 +1,39 @@
+import type * as lambda from "aws-lambda";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { Topic } from "./Topic.ts";
+
+export type TopicNotification = lambda.SNSMessage;
+
+export interface TopicEventSourceProps {
+  /**
+   * Raw SNS subscription attributes for the Lambda subscription, such as
+   * `FilterPolicy` or `RedrivePolicy`.
+   */
+  attributes?: Record<string, string>;
+}
+
+export class TopicEventSource extends Binding.Service<
+  TopicEventSource,
+  TopicEventSourceService
+>()("AWS.SNS.TopicEventSource") {}
+
+export type TopicEventSourceService = <StreamReq = never, Req = never>(
+  topic: Topic,
+  props: TopicEventSourceProps,
+  process: (
+    stream: Stream.Stream<TopicNotification, never, StreamReq>,
+  ) => Effect.Effect<void, never, Req>,
+) => Effect.Effect<void, never, never>;
+
+export const notifications = <T extends Topic>(
+  topic: T,
+  props: TopicEventSourceProps = {},
+) => ({
+  subscribe: <Req = never, StreamReq = never>(
+    process: (
+      stream: Stream.Stream<TopicNotification, never, StreamReq>,
+    ) => Effect.Effect<void, never, Req>,
+  ) => TopicEventSource.use((source) => source(topic, props, process)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TopicSink.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TopicSink.ts
new file mode 100644
index 00000000000..db139033d44
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/TopicSink.ts
@@ -0,0 +1,61 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Sink from "effect/Sink";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import { PublishBatch } from "./PublishBatch.ts";
+import type { Topic } from "./Topic.ts";
+
+export class TopicSink extends Binding.Service<
+  TopicSink,
+  (
+    topic: Topic,
+  ) => Effect.Effect<Sink.Sink<void, string, readonly string[], never>>
+>()("AWS.SNS.TopicSink") {}
+
+export const TopicSinkLive = Layer.effect(
+  TopicSink,
+  Effect.gen(function* () {
+    const Policy = yield* TopicSinkPolicy;
+    const publishBatch = yield* PublishBatch;
+
+    return Effect.fn(function* (topic: Topic) {
+      yield* Policy(topic);
+      const publish = yield* publishBatch(topic);
+
+      return Sink.forEachArray((messages: readonly string[]) =>
+        publish({
+          PublishBatchRequestEntries: messages.map((message, index) => ({
+            Id: `${index}`,
+            Message: message,
+          })),
+        }).pipe(Effect.orDie, Effect.asVoid),
+      );
+    });
+  }),
+);
+
+export class TopicSinkPolicy extends Binding.Policy<
+  TopicSinkPolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.TopicSink") {}
+
+export const TopicSinkPolicyLive = TopicSinkPolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.TopicSink(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:Publish"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `TopicSinkPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/UntagResource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/UntagResource.ts
new file mode 100644
index 00000000000..c4fd1aa0543
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/UntagResource.ts
@@ -0,0 +1,66 @@
+import * as sns from "@distilled.cloud/aws/sns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Topic } from "./Topic.ts";
+
+export interface UntagResourceRequest extends Omit<
+  sns.UntagResourceRequest,
+  "ResourceArn"
+> {}
+
+export class UntagResource extends Binding.Service<
+  UntagResource,
+  (
+    topic: Topic,
+  ) => Effect.Effect<
+    (
+      request: UntagResourceRequest,
+    ) => Effect.Effect<sns.UntagResourceResponse, sns.UntagResourceError>
+  >
+>()("AWS.SNS.UntagResource") {}
+
+export const UntagResourceLive = Layer.effect(
+  UntagResource,
+  Effect.gen(function* () {
+    const Policy = yield* UntagResourcePolicy;
+    const untagResource = yield* sns.untagResource;
+
+    return Effect.fn(function* (topic: Topic) {
+      const TopicArn = yield* topic.topicArn;
+      yield* Policy(topic);
+      return Effect.fn(function* (request: UntagResourceRequest) {
+        return yield* untagResource({
+          ...request,
+          ResourceArn: yield* TopicArn,
+        });
+      });
+    });
+  }),
+);
+
+export class UntagResourcePolicy extends Binding.Policy<
+  UntagResourcePolicy,
+  (topic: Topic) => Effect.Effect<void>
+>()("AWS.SNS.UntagResource") {}
+
+export const UntagResourcePolicyLive = UntagResourcePolicy.layer.succeed(
+  Effect.fn(function* (host, topic) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SNS.UntagResource(${topic}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sns:UntagResource"],
+            Resource: [topic.topicArn],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `UntagResourcePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/index.ts
new file mode 100644
index 00000000000..6f7f08a60a4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SNS/index.ts
@@ -0,0 +1,21 @@
+export * from "./AddPermission.ts";
+export * from "./ConfirmSubscription.ts";
+export * from "./GetDataProtectionPolicy.ts";
+export * from "./GetSubscriptionAttributes.ts";
+export * from "./GetTopicAttributes.ts";
+export * from "./ListSubscriptions.ts";
+export * from "./ListSubscriptionsByTopic.ts";
+export * from "./ListTagsForResource.ts";
+export * from "./ListTopics.ts";
+export * from "./Publish.ts";
+export * from "./PublishBatch.ts";
+export * from "./PutDataProtectionPolicy.ts";
+export * from "./RemovePermission.ts";
+export * from "./SetSubscriptionAttributes.ts";
+export * from "./SetTopicAttributes.ts";
+export * from "./Subscription.ts";
+export * from "./TagResource.ts";
+export * from "./Topic.ts";
+export * from "./TopicEventSource.ts";
+export * from "./TopicSink.ts";
+export * from "./UntagResource.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/DeleteMessage.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/DeleteMessage.ts
new file mode 100644
index 00000000000..cb43af30185
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/DeleteMessage.ts
@@ -0,0 +1,67 @@
+import * as sqs from "@distilled.cloud/aws/sqs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Queue } from "./Queue.ts";
+
+export interface DeleteMessageRequest extends Omit<
+  sqs.DeleteMessageRequest,
+  "QueueUrl"
+> {}
+
+export class DeleteMessage extends Binding.Service<
+  DeleteMessage,
+  (
+    queue: Queue,
+  ) => Effect.Effect<
+    (
+      request: DeleteMessageRequest,
+    ) => Effect.Effect<sqs.DeleteMessageResponse, sqs.DeleteMessageError>
+  >
+>()("AWS.SQS.DeleteMessage") {}
+
+export const DeleteMessageLive = Layer.effect(
+  DeleteMessage,
+  Effect.gen(function* () {
+    const Policy = yield* DeleteMessagePolicy;
+    const deleteMessage = yield* sqs.deleteMessage;
+
+    return Effect.fn(function* (queue: Queue) {
+      const QueueUrl = yield* queue.queueUrl;
+      yield* Policy(queue);
+      return Effect.fn(function* (request: DeleteMessageRequest) {
+        return yield* deleteMessage({
+          ...request,
+          QueueUrl: yield* QueueUrl,
+        });
+      });
+    });
+  }),
+);
+
+export class DeleteMessagePolicy extends Binding.Policy<
+  DeleteMessagePolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("AWS.SQS.DeleteMessage") {}
+
+export const DeleteMessagePolicyLive = DeleteMessagePolicy.layer.succeed(
+  Effect.fn(function* (host, queue) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SQS.DeleteMessage(${queue}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sqs:DeleteMessage"],
+            Resource: [Output.interpolate`${queue.queueArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `DeleteMessagePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/DeleteMessageBatch.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/DeleteMessageBatch.ts
new file mode 100644
index 00000000000..7c829e473f0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/DeleteMessageBatch.ts
@@ -0,0 +1,72 @@
+import * as sqs from "@distilled.cloud/aws/sqs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isInstance } from "../EC2/Instance.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Queue } from "./Queue.ts";
+
+export interface DeleteMessageBatchRequest extends Omit<
+  sqs.DeleteMessageBatchRequest,
+  "QueueUrl"
+> {}
+
+export class DeleteMessageBatch extends Binding.Service<
+  DeleteMessageBatch,
+  (
+    queue: Queue,
+  ) => Effect.Effect<
+    (
+      request: DeleteMessageBatchRequest,
+    ) => Effect.Effect<
+      sqs.DeleteMessageBatchResult,
+      sqs.DeleteMessageBatchError
+    >
+  >
+>()("AWS.SQS.DeleteMessageBatch") {}
+
+export const DeleteMessageBatchLive = Layer.effect(
+  DeleteMessageBatch,
+  Effect.gen(function* () {
+    const Policy = yield* DeleteMessageBatchPolicy;
+    const deleteMessageBatch = yield* sqs.deleteMessageBatch;
+
+    return Effect.fn(function* (queue: Queue) {
+      const QueueUrl = yield* queue.queueUrl;
+      yield* Policy(queue);
+      return Effect.fn(function* (request: DeleteMessageBatchRequest) {
+        return yield* deleteMessageBatch({
+          ...request,
+          QueueUrl: yield* QueueUrl,
+        });
+      });
+    });
+  }),
+);
+
+export class DeleteMessageBatchPolicy extends Binding.Policy<
+  DeleteMessageBatchPolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("AWS.SQS.DeleteMessageBatch") {}
+
+export const DeleteMessageBatchPolicyLive =
+  DeleteMessageBatchPolicy.layer.succeed(
+    Effect.fn(function* (host, queue) {
+      if (isFunction(host) || isInstance(host)) {
+        yield* host.bind`Allow(${host}, AWS.SQS.DeleteMessageBatch(${queue}))`({
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["sqs:DeleteMessage"],
+              Resource: [Output.interpolate`${queue.queueArn}`],
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          `DeleteMessageBatchPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/Queue.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/Queue.ts
new file mode 100644
index 00000000000..46de1dc7b30
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/Queue.ts
@@ -0,0 +1,408 @@
+import { Region } from "@distilled.cloud/aws/Region";
+import * as sqs from "@distilled.cloud/aws/sqs";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { createInternalTags, hasAlchemyTags } from "../../Tags.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import type { Providers } from "../Providers.ts";
+import type { RegionID } from "../Region.ts";
+
+export type QueueName = string;
+export type QueueArn = `arn:aws:sqs:${RegionID}:${AccountID}:${QueueName}`;
+export type QueueUrl = string;
+
+export type QueueProps = {
+  /**
+   * Name of the queue.
+   * @default ${app}-${stage}-${id}?.fifo
+   */
+  queueName?: string;
+  /**
+   * Delay in seconds for all messages in the queue (`0` - `900`).
+   * @default 0
+   */
+  delaySeconds?: number;
+  /**
+   * Maximum message size in bytes (`1,024` - `1,048,576`).
+   * @default 1048576
+   */
+  maximumMessageSize?: number;
+  /**
+   * Message retention period in seconds (`60` - `1,209,600`).
+   * @default 345600
+   */
+  messageRetentionPeriod?: number;
+  /**
+   * Time in seconds for `ReceiveMessage` to wait for a message (`0` - `20`).
+   * @default 0
+   */
+  receiveMessageWaitTimeSeconds?: number;
+  /**
+   * Visibility timeout in seconds (`0` - `43,200`).
+   * @default 30
+   */
+  visibilityTimeout?: number;
+} & (
+  | {
+      fifo?: false;
+      contentBasedDeduplication?: undefined;
+      deduplicationScope?: undefined;
+      fifoThroughputLimit?: undefined;
+    }
+  | {
+      fifo: true;
+      /**
+       * Enables content-based deduplication for FIFO queues. Only valid when `fifo` is `true`.
+       * @default false
+       */
+      contentBasedDeduplication?: boolean;
+      /**
+       * Specifies whether message deduplication occurs at the message group or queue level.
+       * Valid values are `messageGroup` and `queue`. Only valid when `fifo` is `true`.
+       */
+      deduplicationScope?: "messageGroup" | "queue";
+      /**
+       * Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group.
+       * Valid values are `perQueue` and `perMessageGroupId`. Only valid when `fifo` is `true`.
+       */
+      fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
+    }
+);
+
+export interface Queue extends Resource<
+  "AWS.SQS.Queue",
+  QueueProps,
+  {
+    queueUrl: string;
+    queueName: QueueName;
+    queueArn: QueueArn;
+  },
+  {
+    policyStatements: PolicyStatement[];
+  },
+  Providers
+> {}
+
+/**
+ * An Amazon SQS queue for reliable, decoupled message processing.
+ *
+ * `Queue` owns the lifecycle of a standard or FIFO SQS queue. A queue name
+ * is auto-generated from the app, stage, and logical ID unless you provide
+ * one explicitly. FIFO queues automatically append the `.fifo` suffix.
+ *
+ * @section Creating Queues
+ * @example Standard Queue
+ * ```typescript
+ * import * as SQS from "alchemy/AWS/SQS";
+ *
+ * const queue = yield* SQS.Queue("OrdersQueue");
+ * ```
+ *
+ * @example FIFO Queue
+ * ```typescript
+ * const queue = yield* SQS.Queue("OrdersFifoQueue", {
+ *   fifo: true,
+ *   contentBasedDeduplication: true,
+ * });
+ * ```
+ *
+ * @example Queue with Custom Settings
+ * ```typescript
+ * const queue = yield* SQS.Queue("ProcessingQueue", {
+ *   visibilityTimeout: 120,
+ *   messageRetentionPeriod: 86400,
+ *   receiveMessageWaitTimeSeconds: 20,
+ * });
+ * ```
+ *
+ * @section Sending Messages
+ * Bind send operations in the init phase and use them in runtime
+ * handlers.
+ *
+ * @example Send a message from a handler
+ * ```typescript
+ * // init
+ * const sendMessage = yield* SQS.SendMessage.bind(queue);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     // runtime
+ *     yield* sendMessage({
+ *       MessageBody: JSON.stringify({ orderId: "123" }),
+ *     });
+ *     return HttpServerResponse.text("Queued");
+ *   }),
+ * };
+ * ```
+ *
+ * @section Event Sources
+ * Process messages from a queue using a Lambda event source mapping.
+ * Messages are automatically deleted after successful processing.
+ *
+ * @example Process queue messages
+ * ```typescript
+ * // init
+ * yield* SQS.messages(queue).process(
+ *   Effect.fn(function* (message) {
+ *     yield* Effect.log(`Received: ${message.body}`);
+ *   }),
+ * );
+ * ```
+ */
+export const Queue = Resource<Queue>("AWS.SQS.Queue");
+
+export const QueueProvider = () =>
+  Provider.effect(
+    Queue,
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const { accountId } = yield* AWSEnvironment;
+      const createQueueName = Effect.fnUntraced(function* (
+        id: string,
+        props: {
+          queueName?: string | undefined;
+          fifo?: boolean;
+        },
+      ) {
+        if (props.queueName) {
+          return props.queueName;
+        }
+        const baseName = yield* createPhysicalName({
+          id,
+          maxLength: props.fifo ? 80 - ".fifo".length : 80,
+        });
+        return props.fifo ? `${baseName}.fifo` : baseName;
+      });
+      const createAttributes = (
+        props: QueueProps,
+        bindings: ResourceBinding<Queue["Binding"]>[],
+      ) => {
+        const baseAttributes: Record<string, string | undefined> = {
+          DelaySeconds: props.delaySeconds?.toString(),
+          MaximumMessageSize: props.maximumMessageSize?.toString(),
+          MessageRetentionPeriod: props.messageRetentionPeriod?.toString(),
+          ReceiveMessageWaitTimeSeconds:
+            props.receiveMessageWaitTimeSeconds?.toString(),
+          VisibilityTimeout: props.visibilityTimeout?.toString(),
+          Policy:
+            bindings.length > 0
+              ? JSON.stringify({
+                  Version: "2012-10-17",
+                  Statement: bindings.flatMap((p) => p.data.policyStatements),
+                })
+              : undefined,
+        };
+
+        if (props.fifo) {
+          return {
+            ...baseAttributes,
+            FifoQueue: "true",
+            FifoThroughputLimit: props.fifoThroughputLimit,
+            ContentBasedDeduplication: props.contentBasedDeduplication
+              ? "true"
+              : "false",
+            DeduplicationScope: props.deduplicationScope,
+          };
+        }
+
+        return baseAttributes;
+      };
+      return Queue.Provider.of({
+        stables: ["queueName", "queueUrl", "queueArn"],
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const queueName =
+            output?.queueName ?? (yield* createQueueName(id, olds ?? {}));
+          const url = yield* sqs.getQueueUrl({ QueueName: queueName }).pipe(
+            Effect.map((r) => r.QueueUrl),
+            Effect.catchTag("QueueDoesNotExist", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+          if (!url) return undefined;
+          const queueArn =
+            `arn:aws:sqs:${region}:${accountId}:${queueName}` as const;
+          const tagsResp = yield* sqs.listQueueTags({ QueueUrl: url }).pipe(
+            Effect.map((r) => r.Tags ?? {}),
+            Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+          );
+          const attrs = {
+            queueName,
+            queueUrl: url,
+            queueArn,
+          };
+          return (yield* hasAlchemyTags(id, tagsResp)) ? attrs : Unowned(attrs);
+        }),
+        diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          const oldFifo = olds.fifo ?? false;
+          const newFifo = news.fifo ?? false;
+          if (oldFifo !== newFifo) {
+            return { action: "replace" } as const;
+          }
+          const oldQueueName = yield* createQueueName(id, olds);
+          const newQueueName = yield* createQueueName(id, news);
+          if (oldQueueName !== newQueueName) {
+            return { action: "replace" } as const;
+          }
+          // Return undefined to allow update function to be called for other attribute changes
+        }),
+        reconcile: Effect.fn(function* ({
+          id,
+          news = {},
+          output,
+          session,
+          bindings,
+        }) {
+          const queueName =
+            output?.queueName ?? (yield* createQueueName(id, news));
+          const queueArn =
+            output?.queueArn ??
+            (`arn:aws:sqs:${region}:${accountId}:${queueName}` as const);
+          const desiredAttributes = createAttributes(news, bindings);
+          const internalTags = yield* createInternalTags(id);
+
+          // Observe — find the queue's URL or create it.
+          //
+          // We never trust a stale `output.queueUrl` blindly: if the queue was
+          // deleted out-of-band, downstream API calls fail with
+          // `QueueDoesNotExist` and we recreate. This keeps the reconciler
+          // convergent regardless of the starting cloud state.
+          let queueUrl = yield* sqs.getQueueUrl({ QueueName: queueName }).pipe(
+            Effect.map((r) => r.QueueUrl!),
+            Effect.catchTag("QueueDoesNotExist", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+          if (queueUrl === undefined) {
+            // `createQueue` is idempotent for identical params; with different
+            // params it raises `QueueNameExists`. We pass the desired attrs so
+            // first-create lands fully configured, and tolerate the race where
+            // a peer reconciler created it concurrently.
+            queueUrl = yield* sqs
+              .createQueue({
+                QueueName: queueName,
+                Attributes: desiredAttributes,
+                tags: internalTags,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "QueueDeletedRecently",
+                  schedule: Schedule.fixed(1000).pipe(
+                    Schedule.tapOutput((i) =>
+                      session.note(
+                        `Queue was deleted recently, retrying... ${i + 1}s`,
+                      ),
+                    ),
+                  ),
+                }),
+                Effect.catchTag("QueueNameExists", () =>
+                  sqs.getQueueUrl({ QueueName: queueName }),
+                ),
+                Effect.map((r) => r.QueueUrl!),
+              );
+          }
+
+          // Sync attributes — diff observed cloud state against desired and
+          // apply only the delta. SQS returns all attribute values as strings,
+          // and `desiredAttributes` is already string-shaped, so equality
+          // comparison is direct.
+          // SQS is eventually consistent: a freshly-created queue can return
+          // `QueueDoesNotExist` from `getQueueAttributes` for a few seconds
+          // even after `createQueue` succeeded. Retry briefly so the
+          // reconciler converges instead of failing the first deploy.
+          const currentAttributes = yield* sqs
+            .getQueueAttributes({
+              QueueUrl: queueUrl,
+              AttributeNames: ["All"],
+            })
+            .pipe(
+              Effect.retry({
+                while: (e) => e._tag === "QueueDoesNotExist",
+                schedule: Schedule.fixed(1000).pipe(
+                  Schedule.both(Schedule.recurs(30)),
+                ),
+              }),
+              Effect.map((r) => r.Attributes ?? {}),
+            );
+
+          const attributeDelta: Record<string, string> = {};
+          for (const [key, value] of Object.entries(desiredAttributes)) {
+            if (value === undefined) continue;
+            if (
+              currentAttributes[key as keyof typeof currentAttributes] !== value
+            ) {
+              attributeDelta[key] = value;
+            }
+          }
+          if (Object.keys(attributeDelta).length > 0) {
+            yield* sqs
+              .setQueueAttributes({
+                QueueUrl: queueUrl,
+                Attributes: attributeDelta,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "QueueDoesNotExist",
+                  schedule: Schedule.fixed(1000).pipe(
+                    Schedule.both(Schedule.recurs(30)),
+                  ),
+                }),
+              );
+          }
+
+          // Sync alchemy-owned tags. The `tags` parameter on `createQueue`
+          // only applies on first create, so on adoption (or after a queue
+          // was created without our tags) we fix them up here.
+          const currentTags = yield* sqs
+            .listQueueTags({ QueueUrl: queueUrl })
+            .pipe(
+              Effect.retry({
+                while: (e) => e._tag === "QueueDoesNotExist",
+                schedule: Schedule.fixed(1000).pipe(
+                  Schedule.both(Schedule.recurs(30)),
+                ),
+              }),
+              Effect.map((r) => r.Tags ?? {}),
+              Effect.catch(() => Effect.succeed({} as Record<string, string>)),
+            );
+          const tagDelta: Record<string, string> = {};
+          for (const [key, value] of Object.entries(internalTags)) {
+            if (currentTags[key] !== value) {
+              tagDelta[key] = value;
+            }
+          }
+          if (Object.keys(tagDelta).length > 0) {
+            yield* sqs.tagQueue({ QueueUrl: queueUrl, Tags: tagDelta }).pipe(
+              Effect.retry({
+                while: (e) => e._tag === "QueueDoesNotExist",
+                schedule: Schedule.fixed(1000).pipe(
+                  Schedule.both(Schedule.recurs(30)),
+                ),
+              }),
+            );
+          }
+
+          yield* session.note(queueUrl);
+          return {
+            queueName,
+            queueUrl,
+            queueArn,
+          };
+        }),
+        delete: Effect.fn(function* (input) {
+          yield* sqs
+            .deleteQueue({
+              QueueUrl: input.output.queueUrl,
+            })
+            .pipe(Effect.catchTag("QueueDoesNotExist", () => Effect.void));
+        }),
+      });
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/QueueEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/QueueEventSource.ts
new file mode 100644
index 00000000000..30099af287e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/QueueEventSource.ts
@@ -0,0 +1,57 @@
+import type * as lambda from "aws-lambda";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import type { Queue } from "./Queue.ts";
+
+export type SQSRecord = lambda.SQSRecord;
+
+export interface MessagesProps extends QueueEventSourceProps {
+  /**
+   * Time in seconds for long polling when using the process (run) path.
+   * @default 20
+   */
+  waitTimeSeconds?: number;
+  /**
+   * Maximum number of messages to receive per poll when using the process (run) path.
+   * @default 10
+   */
+  maxNumberOfMessages?: number;
+}
+
+export const messages = <Q extends Queue>(
+  queue: Q,
+  props: MessagesProps = {},
+) => ({
+  subscribe: <Req = never>(
+    process: (
+      stream: Stream.Stream<SQSRecord>,
+    ) => Effect.Effect<void, never, Req>,
+  ) => QueueEventSource.use((source) => source(queue, props, process)),
+});
+
+export class QueueEventSource extends Context.Service<
+  QueueEventSource,
+  QueueEventSourceService
+>()("AWS.SQS.QueueEventSource") {}
+
+export interface QueueEventSourceProps {
+  /**
+   * The maximum number of records in each batch that Lambda pulls from the queue.
+   * @default 10
+   */
+  batchSize?: number;
+  /**
+   * The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function.
+   * @default 0
+   */
+  maximumBatchingWindowInSeconds?: number;
+}
+
+export type QueueEventSourceService = <Req = never>(
+  bucket: Queue,
+  props: MessagesProps,
+  process: (
+    stream: Stream.Stream<SQSRecord>,
+  ) => Effect.Effect<void, never, Req>,
+) => Effect.Effect<void, never, never>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/QueueSink.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/QueueSink.ts
new file mode 100644
index 00000000000..9d0b467bc74
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/QueueSink.ts
@@ -0,0 +1,61 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Sink from "effect/Sink";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Queue } from "./Queue.ts";
+import { SendMessageBatch } from "./SendMessageBatch.ts";
+
+export class QueueSink extends Binding.Service<
+  QueueSink,
+  (
+    queue: Queue,
+  ) => Effect.Effect<Sink.Sink<void, string, readonly string[], never>>
+>()("AWS.SQS.QueueSink") {}
+
+export const QueueSinkLive = Layer.effect(
+  QueueSink,
+  Effect.gen(function* () {
+    const Policy = yield* QueueSinkPolicy;
+    const sendMessageBatch = yield* SendMessageBatch;
+
+    return Effect.fn(function* (queue: Queue) {
+      yield* Policy(queue);
+      const sendBatch = yield* sendMessageBatch(queue);
+      return Sink.forEachArray((messages: readonly string[]) =>
+        sendBatch({
+          Entries: messages.map((message, i) => ({
+            Id: `${i}`,
+            MessageBody: message,
+          })),
+        }).pipe(Effect.orDie, Effect.asVoid),
+      );
+    });
+  }),
+);
+
+export class QueueSinkPolicy extends Binding.Policy<
+  QueueSinkPolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("AWS.SQS.QueueSinkPolicy") {}
+
+export const QueueSinkPolicyLive = QueueSinkPolicy.layer.succeed(
+  Effect.fn(function* (host, queue) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SQS.QueueSink(${queue}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sqs:SendMessage", "sqs:SendMessageBatch"],
+            Resource: [Output.interpolate`${queue.queueArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `QueueSinkPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/ReceiveMessage.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/ReceiveMessage.ts
new file mode 100644
index 00000000000..805a7a82f80
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/ReceiveMessage.ts
@@ -0,0 +1,68 @@
+import * as sqs from "@distilled.cloud/aws/sqs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isInstance } from "../EC2/Instance.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Queue } from "./Queue.ts";
+
+export interface ReceiveMessageRequest extends Omit<
+  sqs.ReceiveMessageRequest,
+  "QueueUrl"
+> {}
+
+export class ReceiveMessage extends Binding.Service<
+  ReceiveMessage,
+  (
+    queue: Queue,
+  ) => Effect.Effect<
+    (
+      request: ReceiveMessageRequest,
+    ) => Effect.Effect<sqs.ReceiveMessageResult, sqs.ReceiveMessageError>
+  >
+>()("AWS.SQS.ReceiveMessage") {}
+
+export const ReceiveMessageLive = Layer.effect(
+  ReceiveMessage,
+  Effect.gen(function* () {
+    const Policy = yield* ReceiveMessagePolicy;
+    const receiveMessage = yield* sqs.receiveMessage;
+
+    return Effect.fn(function* (queue: Queue) {
+      const QueueUrl = yield* queue.queueUrl;
+      yield* Policy(queue);
+      return Effect.fn(function* (request: ReceiveMessageRequest) {
+        return yield* receiveMessage({
+          ...request,
+          QueueUrl: yield* QueueUrl,
+        });
+      });
+    });
+  }),
+);
+
+export class ReceiveMessagePolicy extends Binding.Policy<
+  ReceiveMessagePolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("AWS.SQS.ReceiveMessage") {}
+
+export const ReceiveMessagePolicyLive = ReceiveMessagePolicy.layer.succeed(
+  Effect.fn(function* (host, queue) {
+    if (isFunction(host) || isInstance(host)) {
+      yield* host.bind`Allow(${host}, AWS.SQS.ReceiveMessage(${queue}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sqs:ReceiveMessage"],
+            Resource: [Output.interpolate`${queue.queueArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ReceiveMessagePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/SendMessage.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/SendMessage.ts
new file mode 100644
index 00000000000..09522e3060a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/SendMessage.ts
@@ -0,0 +1,69 @@
+import * as sqs from "@distilled.cloud/aws/sqs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isInstance } from "../EC2/Instance.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Queue } from "./Queue.ts";
+
+export interface SendMessageRequest extends Omit<
+  sqs.SendMessageRequest,
+  "QueueUrl"
+> {}
+
+export class SendMessage extends Binding.Service<
+  SendMessage,
+  (
+    queue: Queue,
+  ) => Effect.Effect<
+    (
+      request: SendMessageRequest,
+    ) => Effect.Effect<sqs.SendMessageResult, sqs.SendMessageError>
+  >
+>()("AWS.SQS.SendMessage") {}
+
+export const SendMessageLive = Layer.effect(
+  SendMessage,
+  Effect.gen(function* () {
+    const Policy = yield* SendMessagePolicy;
+    const sendMessage = yield* sqs.sendMessage;
+
+    return Effect.fn(function* (queue: Queue) {
+      const QueueUrl = yield* queue.queueUrl;
+      yield* Policy(queue);
+      return Effect.fn(function* (request: SendMessageRequest) {
+        return yield* sendMessage({
+          ...request,
+          QueueUrl: yield* QueueUrl,
+          MessageBody: request.MessageBody,
+        });
+      });
+    });
+  }),
+);
+
+export class SendMessagePolicy extends Binding.Policy<
+  SendMessagePolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("AWS.SQS.SendMessage") {}
+
+export const SendMessagePolicyLive = SendMessagePolicy.layer.succeed(
+  Effect.fn(function* (host, queue) {
+    if (isFunction(host) || isInstance(host)) {
+      yield* host.bind`Allow(${host}, AWS.SQS.SendMessage(${queue}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sqs:SendMessage"],
+            Resource: [Output.interpolate`${queue.queueArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `SendMessagePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/SendMessageBatch.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/SendMessageBatch.ts
new file mode 100644
index 00000000000..fbb0066f8d2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/SendMessageBatch.ts
@@ -0,0 +1,67 @@
+import * as sqs from "@distilled.cloud/aws/sqs";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Queue } from "./Queue.ts";
+
+export interface SendMessageBatchRequest extends Omit<
+  sqs.SendMessageBatchRequest,
+  "QueueUrl"
+> {}
+
+export class SendMessageBatch extends Binding.Service<
+  SendMessageBatch,
+  (
+    queue: Queue,
+  ) => Effect.Effect<
+    (
+      request: SendMessageBatchRequest,
+    ) => Effect.Effect<sqs.SendMessageBatchResult, sqs.SendMessageBatchError>
+  >
+>()("AWS.SQS.SendMessageBatch") {}
+
+export const SendMessageBatchLive = Layer.effect(
+  SendMessageBatch,
+  Effect.gen(function* () {
+    const Policy = yield* SendMessageBatchPolicy;
+    const sendMessageBatch = yield* sqs.sendMessageBatch;
+
+    return Effect.fn(function* (queue: Queue) {
+      const QueueUrl = yield* queue.queueUrl;
+      yield* Policy(queue);
+      return Effect.fn(function* (request: SendMessageBatchRequest) {
+        return yield* sendMessageBatch({
+          ...request,
+          QueueUrl: yield* QueueUrl,
+        });
+      });
+    });
+  }),
+);
+
+export class SendMessageBatchPolicy extends Binding.Policy<
+  SendMessageBatchPolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("AWS.SQS.SendMessageBatch") {}
+
+export const SendMessageBatchPolicyLive = SendMessageBatchPolicy.layer.succeed(
+  Effect.fn(function* (host, queue) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SQS.SendMessageBatch(${queue}))`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["sqs:SendMessage"],
+            Resource: [Output.interpolate`${queue.queueArn}`],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `SendMessageBatchPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/index.ts
new file mode 100644
index 00000000000..a8ca0ae41c1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SQS/index.ts
@@ -0,0 +1,8 @@
+export * from "./DeleteMessage.ts";
+export * from "./DeleteMessageBatch.ts";
+export * from "./Queue.ts";
+export * from "./QueueEventSource.ts";
+export * from "./QueueSink.ts";
+export * from "./ReceiveMessage.ts";
+export * from "./SendMessage.ts";
+export * from "./SendMessageBatch.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/Schedule.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/Schedule.ts
new file mode 100644
index 00000000000..16a86edfb27
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/Schedule.ts
@@ -0,0 +1,315 @@
+import * as scheduler from "@distilled.cloud/aws/scheduler";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import type { Input } from "../../Input.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+
+export interface ScheduleProps {
+  /**
+   * Schedule name. If omitted, Alchemy generates a deterministic name.
+   */
+  name?: string;
+  /**
+   * Optional schedule group. Defaults to the AWS default group.
+   */
+  groupName?: Input<string>;
+  /**
+   * Required schedule expression, such as `rate(5 minutes)` or `cron(...)`.
+   */
+  scheduleExpression: string;
+  /**
+   * Optional start date.
+   */
+  startDate?: Date;
+  /**
+   * Optional end date.
+   */
+  endDate?: Date;
+  /**
+   * Optional description.
+   */
+  description?: string;
+  /**
+   * Optional timezone for cron or at expressions.
+   */
+  scheduleExpressionTimezone?: string;
+  /**
+   * Desired schedule state.
+   */
+  state?: string;
+  /**
+   * Optional KMS key ARN.
+   */
+  kmsKeyArn?: Input<string>;
+  /**
+   * Scheduler target configuration.
+   */
+  target: Input<scheduler.Target>;
+  /**
+   * Flexible time window configuration.
+   */
+  flexibleTimeWindow?: Input<scheduler.FlexibleTimeWindow>;
+  /**
+   * Action after a one-time schedule completes.
+   */
+  actionAfterCompletion?: string;
+  /**
+   * User-defined tags.
+   */
+  tags?: Record<string, string>;
+}
+
+/**
+ * An EventBridge Scheduler schedule.
+ *
+ * `Schedule` is the canonical time-based delivery primitive. High-level helpers
+ * like `every`, `cron`, and `at` can synthesize the target role and scheduler
+ * target configuration on top of this resource.
+ *
+ * @section Creating Schedules
+ * @example Hourly Schedule
+ * ```typescript
+ * const schedule = yield* Schedule("HourlyJob", {
+ *   scheduleExpression: "rate(1 hour)",
+ *   target: {
+ *     Arn: fn.functionArn,
+ *     RoleArn: role.roleArn,
+ *   },
+ *   flexibleTimeWindow: {
+ *     Mode: "OFF",
+ *   },
+ * });
+ * ```
+ */
+export interface Schedule extends Resource<
+  "AWS.Scheduler.Schedule",
+  ScheduleProps,
+  {
+    scheduleArn: string;
+    scheduleName: string;
+    groupName: string;
+    state: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+export const Schedule = Resource<Schedule>("AWS.Scheduler.Schedule");
+
+export const ScheduleProvider = () =>
+  Provider.effect(
+    Schedule,
+    Effect.gen(function* () {
+      const toName = (id: string, props: ScheduleProps) =>
+        props.name
+          ? Effect.succeed(props.name)
+          : createPhysicalName({ id, maxLength: 64 });
+
+      return {
+        stables: ["scheduleArn", "scheduleName", "groupName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if ((yield* toName(id, olds)) !== (yield* toName(id, news))) {
+            return { action: "replace" } as const;
+          }
+
+          if ((olds.groupName ?? "default") !== (news.groupName ?? "default")) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const scheduleName =
+            output?.scheduleName ?? (yield* toName(id, olds));
+          const groupName =
+            output?.groupName ??
+            (olds.groupName as string | undefined) ??
+            "default";
+          const described = yield* scheduler
+            .getSchedule({
+              Name: scheduleName,
+              GroupName: groupName !== "default" ? groupName : undefined,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          if (!described?.Arn || !described.Name) {
+            return undefined;
+          }
+
+          return {
+            scheduleArn: described.Arn,
+            scheduleName: described.Name,
+            groupName: described.GroupName ?? groupName,
+            state: described.State,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const scheduleName =
+            output?.scheduleName ?? (yield* toName(id, news));
+          const groupName =
+            output?.groupName ??
+            (news.groupName as string | undefined) ??
+            "default";
+          const groupNameParam =
+            groupName !== "default" ? groupName : undefined;
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          const desiredConfig = {
+            ScheduleExpression: news.scheduleExpression,
+            StartDate: news.startDate,
+            EndDate: news.endDate,
+            Description: news.description,
+            ScheduleExpressionTimezone: news.scheduleExpressionTimezone,
+            State: news.state,
+            KmsKeyArn: news.kmsKeyArn as string | undefined,
+            Target: news.target as scheduler.Target,
+            FlexibleTimeWindow: (news.flexibleTimeWindow as
+              | scheduler.FlexibleTimeWindow
+              | undefined) ?? {
+              Mode: "OFF" as const,
+            },
+            ActionAfterCompletion: news.actionAfterCompletion,
+          };
+
+          // Observe — fetch live schedule.
+          let observed = yield* scheduler
+            .getSchedule({ Name: scheduleName, GroupName: groupNameParam })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create if missing. On `ConflictException` (race or
+          // adoption), verify ownership via internal tags then fall through
+          // to the sync path.
+          if (!observed?.Arn) {
+            yield* scheduler
+              .createSchedule({
+                Name: scheduleName,
+                GroupName: groupNameParam,
+                ...desiredConfig,
+              })
+              .pipe(
+                Effect.catchTag("ConflictException", () =>
+                  scheduler
+                    .getSchedule({
+                      Name: scheduleName,
+                      GroupName: groupNameParam,
+                    })
+                    .pipe(
+                      Effect.flatMap((existing) =>
+                        existing.Arn
+                          ? scheduler
+                              .listTagsForResource({
+                                ResourceArn: existing.Arn,
+                              })
+                              .pipe(
+                                Effect.filterOrFail(
+                                  ({ Tags }) => hasTags(internalTags, Tags),
+                                  () =>
+                                    new Error(
+                                      `Schedule '${scheduleName}' already exists and is not managed by alchemy`,
+                                    ),
+                                ),
+                                Effect.asVoid,
+                              )
+                          : Effect.fail(
+                              new Error(
+                                `Schedule '${scheduleName}' already exists but could not be described`,
+                              ),
+                            ),
+                      ),
+                    ),
+                ),
+              );
+            observed = yield* scheduler
+              .getSchedule({ Name: scheduleName, GroupName: groupNameParam })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+          }
+
+          if (!observed?.Arn) {
+            return yield* Effect.fail(
+              new Error(`Failed to read created Schedule '${scheduleName}'`),
+            );
+          }
+
+          const scheduleArn = observed.Arn;
+
+          // Sync schedule configuration. Scheduler doesn't support a partial
+          // update — `updateSchedule` is a full PUT — so we always send the
+          // full desired config. Fields like `state` are reflected in
+          // `observed.State`; sending a no-op update is cheap.
+          yield* scheduler.updateSchedule({
+            Name: scheduleName,
+            GroupName: groupNameParam,
+            ...desiredConfig,
+          });
+
+          // Sync tags — diff observed cloud tags against desired so that
+          // adoption rewrites ownership tags correctly.
+          const observedTagsResp = yield* scheduler
+            .listTagsForResource({ ResourceArn: scheduleArn })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed({ Tags: [] as scheduler.Tag[] }),
+              ),
+            );
+          const observedTags = Object.fromEntries(
+            (observedTagsResp.Tags ?? []).map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (removed.length > 0) {
+            yield* scheduler.untagResource({
+              ResourceArn: scheduleArn,
+              TagKeys: removed,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* scheduler.tagResource({
+              ResourceArn: scheduleArn,
+              Tags: upsert,
+            });
+          }
+
+          yield* session.note(scheduleArn);
+
+          return {
+            scheduleArn,
+            scheduleName,
+            groupName,
+            state: news.state ?? observed.State,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* scheduler
+            .deleteSchedule({
+              Name: output.scheduleName,
+              GroupName:
+                output.groupName !== "default" ? output.groupName : undefined,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/ScheduleGroup.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/ScheduleGroup.ts
new file mode 100644
index 00000000000..cfbf0e9e60c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/ScheduleGroup.ts
@@ -0,0 +1,216 @@
+import * as scheduler from "@distilled.cloud/aws/scheduler";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+
+export interface ScheduleGroupProps {
+  /**
+   * Schedule group name. If omitted, Alchemy generates a deterministic name.
+   */
+  name?: string;
+  /**
+   * User-defined tags for the schedule group.
+   */
+  tags?: Record<string, string>;
+}
+
+/**
+ * An EventBridge Scheduler schedule group.
+ *
+ * Schedule groups provide a namespace for schedules so higher-level helpers can
+ * organize recurring jobs separately from one-shot or operational schedules.
+ *
+ * @section Creating Schedule Groups
+ * @example Basic Group
+ * ```typescript
+ * const group = yield* ScheduleGroup("Operations", {
+ *   tags: {
+ *     domain: "ops",
+ *   },
+ * });
+ * ```
+ */
+export interface ScheduleGroup extends Resource<
+  "AWS.Scheduler.ScheduleGroup",
+  ScheduleGroupProps,
+  {
+    scheduleGroupArn: string;
+    scheduleGroupName: string;
+    state: string | undefined;
+  },
+  never,
+  Providers
+> {}
+
+export const ScheduleGroup = Resource<ScheduleGroup>(
+  "AWS.Scheduler.ScheduleGroup",
+);
+
+export const ScheduleGroupProvider = () =>
+  Provider.effect(
+    ScheduleGroup,
+    Effect.gen(function* () {
+      const toName = (id: string, props: ScheduleGroupProps) =>
+        props.name
+          ? Effect.succeed(props.name)
+          : createPhysicalName({ id, maxLength: 64 });
+
+      return {
+        stables: ["scheduleGroupArn", "scheduleGroupName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toName(id, olds)) !==
+            (yield* toName(id, news as ScheduleGroupProps))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const scheduleGroupName =
+            output?.scheduleGroupName ?? (yield* toName(id, olds));
+          const described = yield* scheduler
+            .getScheduleGroup({
+              Name: scheduleGroupName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          if (!described?.Arn || !described.Name) {
+            return undefined;
+          }
+
+          return {
+            scheduleGroupArn: described.Arn,
+            scheduleGroupName: described.Name,
+            state: described.State,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const scheduleGroupName =
+            output?.scheduleGroupName ?? (yield* toName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — fetch live group; gracefully handle missing.
+          let observed = yield* scheduler
+            .getScheduleGroup({ Name: scheduleGroupName })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+
+          // Ensure — create if missing. Tolerate `ConflictException` as a
+          // race or adoption case: verify ownership via tags before
+          // continuing.
+          if (!observed?.Arn) {
+            yield* scheduler
+              .createScheduleGroup({
+                Name: scheduleGroupName,
+                Tags: createTagsList(desiredTags),
+              })
+              .pipe(
+                Effect.catchTag("ConflictException", () =>
+                  scheduler.getScheduleGroup({ Name: scheduleGroupName }).pipe(
+                    Effect.flatMap((existing) =>
+                      existing.Arn
+                        ? scheduler
+                            .listTagsForResource({ ResourceArn: existing.Arn })
+                            .pipe(
+                              Effect.filterOrFail(
+                                ({ Tags }) => hasTags(internalTags, Tags),
+                                () =>
+                                  new Error(
+                                    `ScheduleGroup '${scheduleGroupName}' already exists and is not managed by alchemy`,
+                                  ),
+                              ),
+                              Effect.asVoid,
+                            )
+                        : Effect.fail(
+                            new Error(
+                              `ScheduleGroup '${scheduleGroupName}' already exists but could not be described`,
+                            ),
+                          ),
+                    ),
+                  ),
+                ),
+              );
+            observed = yield* scheduler
+              .getScheduleGroup({ Name: scheduleGroupName })
+              .pipe(
+                Effect.catchTag("ResourceNotFoundException", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+          }
+
+          if (!observed?.Arn) {
+            return yield* Effect.fail(
+              new Error(
+                `Failed to read created ScheduleGroup '${scheduleGroupName}'`,
+              ),
+            );
+          }
+
+          const groupArn = observed.Arn;
+
+          // Sync tags — diff observed cloud tags against desired so
+          // adoption rewrites ownership tags.
+          const observedTagsResp = yield* scheduler
+            .listTagsForResource({ ResourceArn: groupArn })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () =>
+                Effect.succeed({ Tags: [] as scheduler.Tag[] }),
+              ),
+            );
+          const observedTags = Object.fromEntries(
+            (observedTagsResp.Tags ?? []).map((t) => [t.Key, t.Value]),
+          );
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (removed.length > 0) {
+            yield* scheduler.untagResource({
+              ResourceArn: groupArn,
+              TagKeys: removed,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* scheduler.tagResource({
+              ResourceArn: groupArn,
+              Tags: upsert,
+            });
+          }
+
+          yield* session.note(groupArn);
+
+          return {
+            scheduleGroupArn: groupArn,
+            scheduleGroupName,
+            state: observed?.State,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* scheduler
+            .deleteScheduleGroup({
+              Name: output.scheduleGroupName,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/builders.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/builders.ts
new file mode 100644
index 00000000000..b5343c778ed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/builders.ts
@@ -0,0 +1,229 @@
+import type * as scheduler from "@distilled.cloud/aws/scheduler";
+import * as Effect from "effect/Effect";
+import type { Cluster } from "../ECS/Cluster.ts";
+import * as IAM from "../IAM/index.ts";
+import type { Function } from "../Lambda/Function.ts";
+import type { Queue } from "../SQS/Queue.ts";
+import { Schedule } from "./Schedule.ts";
+import type { ScheduleGroup } from "./ScheduleGroup.ts";
+
+interface ScheduleBuilderState {
+  expression: string;
+  name?: string;
+  group?: ScheduleGroup;
+  description?: string;
+  timezone?: string;
+  startDate?: Date;
+  endDate?: Date;
+  state?: string;
+  kmsKeyArn?: string;
+  flexibleTimeWindow?: scheduler.FlexibleTimeWindow;
+  actionAfterCompletion?: string;
+}
+
+export interface ScheduleOptions {
+  group?: ScheduleGroup;
+  description?: string;
+  timezone?: string;
+  startDate?: Date;
+  endDate?: Date;
+  state?: string;
+  kmsKeyArn?: string;
+  flexibleTimeWindow?: scheduler.FlexibleTimeWindow;
+  actionAfterCompletion?: string;
+}
+
+export interface LambdaTargetProps {
+  input?: unknown;
+  retryPolicy?: scheduler.RetryPolicy;
+  deadLetterConfig?: scheduler.DeadLetterConfig;
+}
+
+export interface QueueTargetProps {
+  input?: unknown;
+  retryPolicy?: scheduler.RetryPolicy;
+  deadLetterConfig?: scheduler.DeadLetterConfig;
+  sqs?: scheduler.SqsParameters;
+}
+
+export interface EcsTaskTargetProps {
+  cluster: Cluster;
+  task: {
+    taskDefinitionArn: string;
+    taskRoleArn: string;
+    executionRoleArn: string;
+  };
+  subnets: string[];
+  securityGroups?: string[];
+  assignPublicIp?: boolean;
+  taskCount?: number;
+  input?: unknown;
+  retryPolicy?: scheduler.RetryPolicy;
+  deadLetterConfig?: scheduler.DeadLetterConfig;
+}
+
+export const every = (value: string, options: ScheduleOptions = {}) =>
+  makeBuilder({
+    expression:
+      value.startsWith("rate(") || value.startsWith("cron(")
+        ? value
+        : `rate(${value})`,
+    ...options,
+  });
+
+export const cron = (expression: string, options: ScheduleOptions = {}) =>
+  makeBuilder({
+    expression,
+    ...options,
+  });
+
+export const at = (date: Date, options: ScheduleOptions = {}) =>
+  makeBuilder({
+    expression: `at(${date.toISOString().replace(/\.\d{3}Z$/, "Z")})`,
+    ...options,
+  });
+
+const makeBuilder = (state: ScheduleBuilderState) => ({
+  named: (name: string) =>
+    makeBuilder({
+      ...state,
+      name,
+    }),
+
+  toLambda: (fn: Function, props: LambdaTargetProps = {}) =>
+    materializeSchedule(
+      state,
+      fn.LogicalId,
+      [
+        {
+          Effect: "Allow",
+          Action: ["lambda:InvokeFunction"],
+          Resource: [fn.functionArn],
+        },
+      ],
+      {
+        Arn: fn.functionArn as any,
+        Input: toInput(props.input),
+        RetryPolicy: props.retryPolicy,
+        DeadLetterConfig: props.deadLetterConfig,
+      },
+    ),
+
+  toQueue: (
+    queue: Queue,
+    payload?: unknown,
+    props: Omit<QueueTargetProps, "input"> = {},
+  ) =>
+    materializeSchedule(
+      state,
+      queue.LogicalId,
+      [
+        {
+          Effect: "Allow",
+          Action: ["sqs:SendMessage"],
+          Resource: [queue.queueArn],
+        },
+      ],
+      {
+        Arn: queue.queueArn as any,
+        Input: toInput(payload),
+        RetryPolicy: props.retryPolicy,
+        DeadLetterConfig: props.deadLetterConfig,
+        SqsParameters: props.sqs,
+      },
+    ),
+
+  toEcsTask: (props: EcsTaskTargetProps) =>
+    materializeSchedule(
+      state,
+      props.cluster.LogicalId,
+      [
+        {
+          Effect: "Allow",
+          Action: ["ecs:RunTask"],
+          Resource: [props.task.taskDefinitionArn],
+        },
+        {
+          Effect: "Allow",
+          Action: ["iam:PassRole"],
+          Resource: [props.task.taskRoleArn, props.task.executionRoleArn],
+        },
+      ],
+      {
+        Arn: props.cluster.clusterArn as any,
+        Input: toInput(props.input),
+        RetryPolicy: props.retryPolicy,
+        DeadLetterConfig: props.deadLetterConfig,
+        EcsParameters: {
+          TaskDefinitionArn: props.task.taskDefinitionArn,
+          TaskCount: props.taskCount ?? 1,
+          LaunchType: "FARGATE",
+          NetworkConfiguration: {
+            awsvpcConfiguration: {
+              Subnets: props.subnets,
+              SecurityGroups: props.securityGroups,
+              AssignPublicIp: props.assignPublicIp ? "ENABLED" : "DISABLED",
+            },
+          },
+        },
+      },
+    ),
+});
+
+const materializeSchedule = (
+  state: ScheduleBuilderState,
+  targetId: string,
+  statements: any[],
+  target: Omit<scheduler.Target, "RoleArn">,
+) =>
+  Effect.gen(function* () {
+    const scheduleId = state.name ?? `${targetId}Schedule`;
+    const role = yield* IAM.Role(`${scheduleId}Role`, {
+      assumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: {
+              Service: "scheduler.amazonaws.com",
+            },
+            Action: ["sts:AssumeRole"],
+            Resource: ["*"],
+          },
+        ],
+      },
+      inlinePolicies: {
+        ScheduleTarget: {
+          Version: "2012-10-17",
+          Statement: statements,
+        },
+      },
+    });
+
+    return yield* Schedule(scheduleId, {
+      name: state.name,
+      groupName: state.group?.scheduleGroupName,
+      scheduleExpression: state.expression,
+      startDate: state.startDate,
+      endDate: state.endDate,
+      description: state.description,
+      scheduleExpressionTimezone: state.timezone,
+      state: state.state,
+      kmsKeyArn: state.kmsKeyArn,
+      flexibleTimeWindow: state.flexibleTimeWindow ?? {
+        Mode: "OFF",
+      },
+      actionAfterCompletion: state.actionAfterCompletion,
+      target: {
+        ...target,
+        RoleArn: role.roleArn,
+      } as any,
+    });
+  });
+
+const toInput = (value: unknown) =>
+  value === undefined
+    ? undefined
+    : typeof value === "string"
+      ? value
+      : JSON.stringify(value);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/index.ts
new file mode 100644
index 00000000000..f0fc10cb25a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Scheduler/index.ts
@@ -0,0 +1,3 @@
+export * from "./builders.ts";
+export * from "./Schedule.ts";
+export * from "./ScheduleGroup.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/DescribeSecret.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/DescribeSecret.ts
new file mode 100644
index 00000000000..1c30c806a9e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/DescribeSecret.ts
@@ -0,0 +1,66 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Secret } from "./Secret.ts";
+
+/**
+ * Runtime binding for `secretsmanager:DescribeSecret`.
+ */
+export class DescribeSecret extends Binding.Service<
+  DescribeSecret,
+  (
+    secret: Secret,
+  ) => Effect.Effect<
+    () => Effect.Effect<
+      secretsmanager.DescribeSecretResponse,
+      secretsmanager.DescribeSecretError
+    >
+  >
+>()("AWS.SecretsManager.DescribeSecret") {}
+
+export const DescribeSecretLive = Layer.effect(
+  DescribeSecret,
+  Effect.gen(function* () {
+    const Policy = yield* DescribeSecretPolicy;
+    const describeSecret = yield* secretsmanager.describeSecret;
+
+    return Effect.fn(function* (secret: Secret) {
+      const SecretId = yield* secret.secretArn;
+      yield* Policy(secret);
+      return Effect.fn(function* () {
+        return yield* describeSecret({
+          SecretId: yield* SecretId,
+        });
+      });
+    });
+  }),
+);
+
+export class DescribeSecretPolicy extends Binding.Policy<
+  DescribeSecretPolicy,
+  (secret: Secret) => Effect.Effect<void>
+>()("AWS.SecretsManager.DescribeSecret") {}
+
+export const DescribeSecretPolicyLive = DescribeSecretPolicy.layer.succeed(
+  Effect.fn(function* (host, secret) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SecretsManager.DescribeSecret(${secret}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: ["secretsmanager:DescribeSecret"],
+              Resource: [secret.secretArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `DescribeSecretPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/GetRandomPassword.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/GetRandomPassword.ts
new file mode 100644
index 00000000000..aaf5305353a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/GetRandomPassword.ts
@@ -0,0 +1,65 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+/**
+ * Runtime binding for `secretsmanager:GetRandomPassword`.
+ */
+export class GetRandomPassword extends Binding.Service<
+  GetRandomPassword,
+  () => Effect.Effect<
+    (
+      request?: secretsmanager.GetRandomPasswordRequest,
+    ) => Effect.Effect<
+      secretsmanager.GetRandomPasswordResponse,
+      secretsmanager.GetRandomPasswordError
+    >
+  >
+>()("AWS.SecretsManager.GetRandomPassword") {}
+
+export const GetRandomPasswordLive = Layer.effect(
+  GetRandomPassword,
+  Effect.gen(function* () {
+    const Policy = yield* GetRandomPasswordPolicy;
+    const getRandomPassword = yield* secretsmanager.getRandomPassword;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (
+        request: secretsmanager.GetRandomPasswordRequest = {},
+      ) {
+        return yield* getRandomPassword(request);
+      });
+    });
+  }),
+);
+
+export class GetRandomPasswordPolicy extends Binding.Policy<
+  GetRandomPasswordPolicy,
+  () => Effect.Effect<void>
+>()("AWS.SecretsManager.GetRandomPassword") {}
+
+export const GetRandomPasswordPolicyLive =
+  GetRandomPasswordPolicy.layer.succeed(
+    Effect.fn(function* (host) {
+      if (isFunction(host)) {
+        yield* host.bind`Allow(${host}, AWS.SecretsManager.GetRandomPassword())`(
+          {
+            policyStatements: [
+              {
+                Effect: "Allow",
+                Action: ["secretsmanager:GetRandomPassword"],
+                Resource: ["*"],
+              },
+            ],
+          },
+        );
+      } else {
+        return yield* Effect.die(
+          `GetRandomPasswordPolicy does not support runtime '${host.Type}'`,
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/GetSecretValue.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/GetSecretValue.ts
new file mode 100644
index 00000000000..dcc46d10f21
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/GetSecretValue.ts
@@ -0,0 +1,78 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Secret } from "./Secret.ts";
+
+export interface GetSecretValueRequest extends Omit<
+  secretsmanager.GetSecretValueRequest,
+  "SecretId"
+> {}
+
+/**
+ * Runtime binding for `secretsmanager:GetSecretValue`.
+ */
+export class GetSecretValue extends Binding.Service<
+  GetSecretValue,
+  (
+    secret: Secret,
+  ) => Effect.Effect<
+    (
+      request?: GetSecretValueRequest,
+    ) => Effect.Effect<
+      secretsmanager.GetSecretValueResponse,
+      secretsmanager.GetSecretValueError
+    >
+  >
+>()("AWS.SecretsManager.GetSecretValue") {}
+
+export const GetSecretValueLive = Layer.effect(
+  GetSecretValue,
+  Effect.gen(function* () {
+    const Policy = yield* GetSecretValuePolicy;
+    const getSecretValue = yield* secretsmanager.getSecretValue;
+
+    return Effect.fn(function* (secret: Secret) {
+      const SecretId = yield* secret.secretArn;
+      yield* Policy(secret);
+      return Effect.fn(function* (request: GetSecretValueRequest = {}) {
+        const secretId = yield* SecretId;
+        return yield* getSecretValue({
+          ...request,
+          SecretId: secretId,
+        });
+      });
+    });
+  }),
+);
+
+export class GetSecretValuePolicy extends Binding.Policy<
+  GetSecretValuePolicy,
+  (secret: Secret) => Effect.Effect<void>
+>()("AWS.SecretsManager.GetSecretValue") {}
+
+export const GetSecretValuePolicyLive = GetSecretValuePolicy.layer.succeed(
+  Effect.fn(function* (host, secret) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SecretsManager.GetSecretValue(${secret}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: [
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:DescribeSecret",
+              ],
+              Resource: [secret.secretArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `GetSecretValuePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/ListSecrets.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/ListSecrets.ts
new file mode 100644
index 00000000000..af6d37667a1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/ListSecrets.ts
@@ -0,0 +1,62 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+
+/**
+ * Runtime binding for `secretsmanager:ListSecrets`.
+ */
+export class ListSecrets extends Binding.Service<
+  ListSecrets,
+  () => Effect.Effect<
+    (
+      request?: secretsmanager.ListSecretsRequest,
+    ) => Effect.Effect<
+      secretsmanager.ListSecretsResponse,
+      secretsmanager.ListSecretsError
+    >
+  >
+>()("AWS.SecretsManager.ListSecrets") {}
+
+export const ListSecretsLive = Layer.effect(
+  ListSecrets,
+  Effect.gen(function* () {
+    const Policy = yield* ListSecretsPolicy;
+    const listSecrets = yield* secretsmanager.listSecrets;
+
+    return Effect.fn(function* () {
+      yield* Policy();
+      return Effect.fn(function* (
+        request: secretsmanager.ListSecretsRequest = {},
+      ) {
+        return yield* listSecrets(request);
+      });
+    });
+  }),
+);
+
+export class ListSecretsPolicy extends Binding.Policy<
+  ListSecretsPolicy,
+  () => Effect.Effect<void>
+>()("AWS.SecretsManager.ListSecrets") {}
+
+export const ListSecretsPolicyLive = ListSecretsPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SecretsManager.ListSecrets())`({
+        policyStatements: [
+          {
+            Effect: "Allow",
+            Action: ["secretsmanager:ListSecrets"],
+            Resource: ["*"],
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        `ListSecretsPolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/PutSecretValue.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/PutSecretValue.ts
new file mode 100644
index 00000000000..f8d17235872
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/PutSecretValue.ts
@@ -0,0 +1,78 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import { isFunction } from "../Lambda/Function.ts";
+import type { Secret } from "./Secret.ts";
+
+export interface PutSecretValueRequest extends Omit<
+  secretsmanager.PutSecretValueRequest,
+  "SecretId"
+> {}
+
+/**
+ * Runtime binding for `secretsmanager:PutSecretValue`.
+ */
+export class PutSecretValue extends Binding.Service<
+  PutSecretValue,
+  (
+    secret: Secret,
+  ) => Effect.Effect<
+    (
+      request: PutSecretValueRequest,
+    ) => Effect.Effect<
+      secretsmanager.PutSecretValueResponse,
+      secretsmanager.PutSecretValueError
+    >
+  >
+>()("AWS.SecretsManager.PutSecretValue") {}
+
+export const PutSecretValueLive = Layer.effect(
+  PutSecretValue,
+  Effect.gen(function* () {
+    const Policy = yield* PutSecretValuePolicy;
+    const putSecretValue = yield* secretsmanager.putSecretValue;
+
+    return Effect.fn(function* (secret: Secret) {
+      const SecretId = yield* secret.secretArn;
+      yield* Policy(secret);
+      return Effect.fn(function* (request: PutSecretValueRequest) {
+        const secretId = yield* SecretId;
+        return yield* putSecretValue({
+          ...request,
+          SecretId: secretId,
+        });
+      });
+    });
+  }),
+);
+
+export class PutSecretValuePolicy extends Binding.Policy<
+  PutSecretValuePolicy,
+  (secret: Secret) => Effect.Effect<void>
+>()("AWS.SecretsManager.PutSecretValue") {}
+
+export const PutSecretValuePolicyLive = PutSecretValuePolicy.layer.succeed(
+  Effect.fn(function* (host, secret) {
+    if (isFunction(host)) {
+      yield* host.bind`Allow(${host}, AWS.SecretsManager.PutSecretValue(${secret}))`(
+        {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Action: [
+                "secretsmanager:PutSecretValue",
+                "secretsmanager:DescribeSecret",
+              ],
+              Resource: [secret.secretArn],
+            },
+          ],
+        },
+      );
+    } else {
+      return yield* Effect.die(
+        `PutSecretValuePolicy does not support runtime '${host.Type}'`,
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/Secret.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/Secret.ts
new file mode 100644
index 00000000000..d605891b953
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/Secret.ts
@@ -0,0 +1,298 @@
+import * as secretsmanager from "@distilled.cloud/aws/secrets-manager";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { createInternalTags, diffTags } from "../../Tags.ts";
+
+export interface GenerateSecretStringProps
+  extends secretsmanager.GetRandomPasswordRequest {
+  /**
+   * JSON template merged with the generated password.
+   * @default "{}"
+   */
+  secretStringTemplate?: string;
+  /**
+   * Key written into the generated secret payload.
+   * @default "password"
+   */
+  generateStringKey?: string;
+}
+
+export interface SecretProps {
+  /**
+   * Secret name. If omitted, Alchemy generates a deterministic physical name.
+   */
+  name?: string;
+  /**
+   * Optional description for the secret.
+   */
+  description?: string;
+  /**
+   * Optional KMS key used to encrypt the secret.
+   */
+  kmsKeyId?: string;
+  /**
+   * Plain string secret value.
+   */
+  secretString?: Redacted.Redacted<string>;
+  /**
+   * Binary secret value.
+   */
+  secretBinary?: Redacted.Redacted<Uint8Array<ArrayBufferLike>>;
+  /**
+   * Generate a password and store it inside a JSON secret string.
+   */
+  generateSecretString?: GenerateSecretStringProps;
+  /**
+   * User-defined tags for the secret.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Secret extends Resource<
+  "AWS.SecretsManager.Secret",
+  SecretProps,
+  {
+    secretArn: string;
+    secretName: string;
+    versionId: string | undefined;
+    description: string | undefined;
+    kmsKeyId: string | undefined;
+    tags: Record<string, string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An AWS Secrets Manager secret.
+ *
+ * `Secret` owns the lifecycle of the secret metadata and current value. It can
+ * store a caller-provided value or generate a password-backed JSON payload for
+ * downstream resources such as Aurora clusters and RDS proxies.
+ *
+ * @section Creating Secrets
+ * @example Static Secret String
+ * ```typescript
+ * const secret = yield* Secret("DbSecret", {
+ *   secretString: Redacted.make(JSON.stringify({
+ *     username: "app",
+ *     password: "super-secret",
+ *   })),
+ * });
+ * ```
+ *
+ * @example Generated Password Secret
+ * ```typescript
+ * const secret = yield* Secret("DbSecret", {
+ *   generateSecretString: {
+ *     secretStringTemplate: JSON.stringify({ username: "app" }),
+ *     generateStringKey: "password",
+ *     PasswordLength: 32,
+ *   },
+ * });
+ * ```
+ */
+export const Secret = Resource<Secret>("AWS.SecretsManager.Secret");
+
+const toTagRecord = (
+  tags: Array<{ Key?: string; Value?: string }> | undefined,
+): Record<string, string> =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+export const SecretProvider = () =>
+  Provider.effect(
+    Secret,
+    Effect.gen(function* () {
+      const toSecretName = (id: string, props: SecretProps) =>
+        props.name
+          ? Effect.succeed(props.name)
+          : createPhysicalName({ id, maxLength: 512 });
+
+      const createValue = Effect.fn(function* (props: SecretProps) {
+        if (props.secretBinary !== undefined) {
+          return { SecretBinary: props.secretBinary } as const;
+        }
+
+        if (props.secretString !== undefined) {
+          return { SecretString: props.secretString } as const;
+        }
+
+        if (props.generateSecretString) {
+          const {
+            secretStringTemplate = "{}",
+            generateStringKey = "password",
+            ...request
+          } = props.generateSecretString;
+          const password = yield* secretsmanager.getRandomPassword(request);
+          const generated = password.RandomPassword
+            ? typeof password.RandomPassword === "string"
+              ? password.RandomPassword
+              : Redacted.value(password.RandomPassword)
+            : "";
+          const template = JSON.parse(secretStringTemplate) as Record<
+            string,
+            unknown
+          >;
+          return {
+            SecretString: JSON.stringify({
+              ...template,
+              [generateStringKey]: generated,
+            }),
+          } as const;
+        }
+
+        return {} as const;
+      });
+
+      const readSecret = Effect.fn(function* (secretId: string) {
+        return yield* secretsmanager
+          .describeSecret({
+            SecretId: secretId,
+          })
+          .pipe(
+            Effect.catchTag("ResourceNotFoundException", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+      });
+
+      return {
+        stables: ["secretArn", "secretName"],
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            (yield* toSecretName(id, olds ?? {})) !==
+            (yield* toSecretName(id, news ?? {}))
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const secretName =
+            output?.secretName ?? (yield* toSecretName(id, olds ?? {}));
+          const described = yield* readSecret(output?.secretArn ?? secretName);
+          if (!described?.ARN || !described.Name) {
+            return undefined;
+          }
+
+          return {
+            secretArn: described.ARN,
+            secretName: described.Name,
+            versionId: output?.versionId,
+            description: described.Description,
+            kmsKeyId: described.KmsKeyId,
+            tags: toTagRecord(described.Tags),
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const secretName =
+            output?.secretName ?? (yield* toSecretName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+          const hasNewValue =
+            news.secretString !== undefined ||
+            news.secretBinary !== undefined ||
+            news.generateSecretString !== undefined;
+
+          // Observe — describe the secret using whichever identifier we
+          // have (ARN preferred, name as fallback).
+          let observed = yield* readSecret(output?.secretArn ?? secretName);
+
+          // Ensure — create if missing. Tolerate `ResourceExistsException`
+          // by re-describing; the sync step below converges metadata and
+          // value.
+          if (!observed?.ARN) {
+            yield* secretsmanager
+              .createSecret({
+                Name: secretName,
+                Description: news.description,
+                KmsKeyId: news.kmsKeyId,
+                Tags: Object.entries(desiredTags).map(([Key, Value]) => ({
+                  Key,
+                  Value,
+                })),
+                ...(yield* createValue(news)),
+              })
+              .pipe(
+                Effect.catchTag("ResourceExistsException", () => Effect.void),
+              );
+            observed = yield* readSecret(secretName);
+          }
+
+          if (!observed?.ARN || !observed.Name) {
+            return yield* Effect.fail(
+              new Error(`Failed to describe Secret '${secretName}'`),
+            );
+          }
+
+          const secretArn = observed.ARN;
+
+          // Sync metadata + value. `updateSecret` accepts description,
+          // KMS key, and the secret value in one call. We always send
+          // metadata (idempotent) and only send a new value if the user
+          // provided one — `updateSecret` requires SecretString or
+          // SecretBinary to actually rotate, but is fine to call without
+          // them to update description/kmsKeyId only.
+          const valuePayload = yield* createValue(news);
+          const updated = yield* secretsmanager.updateSecret({
+            SecretId: secretArn,
+            Description: news.description,
+            KmsKeyId: news.kmsKeyId,
+            ...valuePayload,
+          });
+
+          // Sync tags — diff observed cloud tags against desired.
+          const observedTags = toTagRecord(observed.Tags);
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+
+          if (upsert.length > 0) {
+            yield* secretsmanager.tagResource({
+              SecretId: secretArn,
+              Tags: upsert,
+            });
+          }
+
+          if (removed.length > 0) {
+            yield* secretsmanager.untagResource({
+              SecretId: secretArn,
+              TagKeys: removed,
+            });
+          }
+
+          yield* session.note(secretArn);
+          return {
+            secretArn,
+            secretName: observed.Name,
+            versionId: hasNewValue
+              ? (updated.VersionId ?? output?.versionId)
+              : output?.versionId,
+            description: news.description,
+            kmsKeyId: news.kmsKeyId,
+            tags: desiredTags,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* secretsmanager
+            .deleteSecret({
+              SecretId: output.secretArn,
+              ForceDeleteWithoutRecovery: true,
+            })
+            .pipe(
+              Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+            );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/index.ts
new file mode 100644
index 00000000000..8795b828cb2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/SecretsManager/index.ts
@@ -0,0 +1,6 @@
+export * from "./DescribeSecret.ts";
+export * from "./GetSecretValue.ts";
+export * from "./GetRandomPassword.ts";
+export * from "./ListSecrets.ts";
+export * from "./PutSecretValue.ts";
+export * from "./Secret.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/AssetDeployment.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/AssetDeployment.ts
new file mode 100644
index 00000000000..1cb7713e60f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/AssetDeployment.ts
@@ -0,0 +1,386 @@
+import * as s3 from "@distilled.cloud/aws/s3";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { createHash } from "node:crypto";
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { WebsiteTextEncoding } from "./shared.ts";
+
+export interface AssetFileOption {
+  /**
+   * Glob or globs of files to match.
+   */
+  files: string | string[];
+  /**
+   * Override `Content-Type` for matched files.
+   */
+  contentType?: string;
+  /**
+   * Override `Cache-Control` for matched files.
+   */
+  cacheControl?: string;
+  /**
+   * Optional glob or globs excluded from this rule.
+   */
+  ignore?: string | string[];
+}
+
+export interface AssetDeploymentProps {
+  /**
+   * Destination bucket.
+   */
+  bucket: {
+    bucketName: string;
+  };
+  /**
+   * Local directory to upload.
+   */
+  sourcePath: string;
+  /**
+   * Optional key prefix within the bucket.
+   */
+  prefix?: string;
+  /**
+   * Remove old files under the prefix that are not part of the current deploy.
+   * @default false
+   */
+  purge?: boolean;
+  /**
+   * Optional per-file overrides.
+   */
+  fileOptions?: AssetFileOption[];
+  /**
+   * Character encoding applied to inferred text-based asset content types.
+   * @default "utf-8"
+   */
+  textEncoding?: WebsiteTextEncoding;
+}
+
+export interface AssetDeployment extends Resource<
+  "AWS.Website.AssetDeployment",
+  AssetDeploymentProps,
+  {
+    bucketName: string;
+    prefix: string;
+    version: string;
+    fileCount: number;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * Upload a local directory into S3 with website-friendly defaults.
+ *
+ * `AssetDeployment` is a helper resource for website hosting. It uploads all
+ * files in a directory, infers content types, applies cache-control defaults,
+ * and can optionally purge stale files under a prefix.
+ *
+ * @section Deploying Files
+ * @example Upload A Build Directory
+ * ```typescript
+ * const files = yield* AssetDeployment("WebsiteFiles", {
+ *   bucket,
+ *   sourcePath: "./dist",
+ *   prefix: "_assets",
+ * });
+ * ```
+ */
+export const AssetDeployment = Resource<AssetDeployment>(
+  "AWS.Website.AssetDeployment",
+);
+
+const defaultHtmlCacheControl = "max-age=0,no-cache,no-store,must-revalidate";
+const defaultAssetCacheControl = "max-age=31536000,public,immutable";
+
+export const AssetDeploymentProvider = () =>
+  Provider.effect(
+    AssetDeployment,
+    Effect.gen(function* () {
+      const reconcileSync = Effect.fn(function* (news: AssetDeploymentProps) {
+        const bucketName = news.bucket.bucketName;
+        const prefix = normalizePrefix(news.prefix);
+        const root = news.sourcePath;
+        const files = yield* Effect.tryPromise(() => walk(root));
+        const hash = createHash("sha256");
+        const desiredKeys = new Set<string>();
+
+        // Observe — list every key already under the prefix and capture
+        // its ETag (S3 ETag for non-multipart PUTs is the hex MD5 of the
+        // body) so we can skip re-uploads when the content already matches.
+        const observed = yield* listObjects(
+          bucketName,
+          prefix ? `${prefix}/` : prefix,
+        );
+
+        for (const relativePath of files.sort((a, b) => a.localeCompare(b))) {
+          const body = yield* Effect.tryPromise(() =>
+            readFile(path.join(root, relativePath)),
+          );
+          const normalizedRelativePath = toPosix(relativePath);
+          const key = prefix
+            ? `${prefix}/${normalizedRelativePath}`
+            : normalizedRelativePath;
+          const options = getFileOptions(
+            normalizedRelativePath,
+            news.fileOptions,
+            news.textEncoding,
+          );
+
+          hash.update(normalizedRelativePath);
+          hash.update(body);
+          hash.update(options.contentType);
+          hash.update(options.cacheControl);
+
+          desiredKeys.add(key);
+
+          // Sync — diff observed object hash against desired body hash,
+          // and only PUT when the content has changed. ETag is wrapped in
+          // quotes by S3 and is lower-case hex.
+          const expectedETag = createHash("md5").update(body).digest("hex");
+          const observedETag = observed.get(key)?.replace(/^"|"$/g, "");
+          if (observedETag === expectedETag) {
+            continue;
+          }
+
+          yield* s3.putObject({
+            Bucket: bucketName,
+            Key: key,
+            Body: body,
+            ContentType: options.contentType,
+            CacheControl: options.cacheControl,
+          });
+        }
+
+        // Sync purge — delete observed keys that aren't in the desired
+        // set. Reuses the same observation rather than re-listing.
+        if (news.purge ?? false) {
+          const staleKeys = [...observed.keys()].filter(
+            (key) => !desiredKeys.has(key),
+          );
+          yield* deleteKeys(bucketName, staleKeys);
+        }
+
+        return {
+          bucketName,
+          prefix,
+          version: hash.digest("hex"),
+          fileCount: files.length,
+        };
+      });
+
+      return {
+        read: Effect.fn(function* ({ output }) {
+          return output;
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+          const output = yield* retryForBucketReadiness(reconcileSync(news));
+          yield* session.note(
+            `Uploaded ${output.fileCount} file(s) to s3://${output.bucketName}/${output.prefix}`,
+          );
+          return output;
+        }),
+        delete: Effect.fn(function* ({ olds, output }) {
+          if (!(olds.purge ?? false)) {
+            return;
+          }
+          const prefix = output.prefix ? `${output.prefix}/` : output.prefix;
+          yield* retryForBucketReadiness(
+            Effect.gen(function* () {
+              const existingKeys = yield* listKeys(output.bucketName, prefix);
+              yield* deleteKeys(output.bucketName, existingKeys);
+            }),
+          ).pipe(Effect.catchTag("NoSuchBucket", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const normalizePrefix = (prefix: string | undefined) =>
+  prefix ? prefix.replace(/^\/+|\/+$/g, "") : "";
+
+const toPosix = (value: string) => value.split(path.sep).join("/");
+
+const withCharset = (mimeType: string, textEncoding: WebsiteTextEncoding) =>
+  textEncoding === "none" ? mimeType : `${mimeType}; charset=${textEncoding}`;
+
+const inferContentType = (
+  file: string,
+  textEncoding: WebsiteTextEncoding = "utf-8",
+) => {
+  const ext = path.extname(file).toLowerCase();
+  switch (ext) {
+    case ".html":
+      return withCharset("text/html", textEncoding);
+    case ".css":
+      return withCharset("text/css", textEncoding);
+    case ".js":
+    case ".mjs":
+      return withCharset("application/javascript", textEncoding);
+    case ".json":
+      return withCharset("application/json", textEncoding);
+    case ".svg":
+      return "image/svg+xml";
+    case ".png":
+      return "image/png";
+    case ".jpg":
+    case ".jpeg":
+      return "image/jpeg";
+    case ".gif":
+      return "image/gif";
+    case ".webp":
+      return "image/webp";
+    case ".ico":
+      return "image/x-icon";
+    case ".txt":
+      return withCharset("text/plain", textEncoding);
+    case ".xml":
+      return withCharset("application/xml", textEncoding);
+    case ".woff":
+      return "font/woff";
+    case ".woff2":
+      return "font/woff2";
+    default:
+      return "application/octet-stream";
+  }
+};
+
+const defaultCacheControlFor = (file: string) =>
+  path.extname(file).toLowerCase() === ".html"
+    ? defaultHtmlCacheControl
+    : defaultAssetCacheControl;
+
+const escapeRegex = (value: string) =>
+  value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+
+const globToRegExp = (glob: string) =>
+  new RegExp(
+    `^${escapeRegex(toPosix(glob))
+      .replace(/\\\*\\\*/g, ".*")
+      .replace(/\\\*/g, "[^/]*")
+      .replace(/\\\?/g, ".")}$`,
+  );
+
+const matchesAny = (file: string, globs: string | string[]) =>
+  (Array.isArray(globs) ? globs : [globs]).some((glob) =>
+    globToRegExp(glob).test(file),
+  );
+
+const getFileOptions = (
+  file: string,
+  options: AssetFileOption[] | undefined,
+  textEncoding: WebsiteTextEncoding | undefined,
+): {
+  contentType: string;
+  cacheControl: string;
+} => {
+  const matched = [...(options ?? [])]
+    .reverse()
+    .find(
+      (option) =>
+        matchesAny(file, option.files) &&
+        !(option.ignore && matchesAny(file, option.ignore)),
+    );
+
+  return {
+    contentType:
+      matched?.contentType ?? inferContentType(file, textEncoding ?? "utf-8"),
+    cacheControl: matched?.cacheControl ?? defaultCacheControlFor(file),
+  };
+};
+
+const walk = async (root: string, dir = ""): Promise<string[]> => {
+  const entries = await readdir(path.join(root, dir), { withFileTypes: true });
+  const files = await Promise.all(
+    entries.map(async (entry) => {
+      const relative = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        return walk(root, relative);
+      }
+      return [relative];
+    }),
+  );
+  return files.flat();
+};
+
+const listKeys = Effect.fn(function* (bucketName: string, prefix: string) {
+  let continuationToken: string | undefined;
+  const keys: string[] = [];
+
+  do {
+    const response = yield* s3.listObjectsV2({
+      Bucket: bucketName,
+      Prefix: prefix || undefined,
+      ContinuationToken: continuationToken,
+    });
+    keys.push(
+      ...(response.Contents ?? []).flatMap((item) =>
+        item.Key ? [item.Key] : [],
+      ),
+    );
+    continuationToken = response.NextContinuationToken;
+  } while (continuationToken);
+
+  return keys;
+});
+
+/** List `{key -> ETag}` pairs under `prefix`. ETag from S3 is wrapped in
+ * quotes; for non-multipart uploads it is the hex MD5 of the object body. */
+const listObjects = Effect.fn(function* (bucketName: string, prefix: string) {
+  let continuationToken: string | undefined;
+  const out = new Map<string, string>();
+
+  do {
+    const response = yield* s3.listObjectsV2({
+      Bucket: bucketName,
+      Prefix: prefix || undefined,
+      ContinuationToken: continuationToken,
+    });
+    for (const item of response.Contents ?? []) {
+      if (item.Key && item.ETag) {
+        out.set(item.Key, item.ETag);
+      }
+    }
+    continuationToken = response.NextContinuationToken;
+  } while (continuationToken);
+
+  return out;
+});
+
+const deleteKeys = Effect.fn(function* (bucketName: string, keys: string[]) {
+  for (let i = 0; i < keys.length; i += 1000) {
+    const batch = keys.slice(i, i + 1000);
+    if (batch.length === 0) {
+      continue;
+    }
+    yield* s3.deleteObjects({
+      Bucket: bucketName,
+      Delete: {
+        Objects: batch.map((Key) => ({ Key })),
+        Quiet: true,
+      },
+    });
+  }
+});
+
+const isMissingBucket = (error: unknown) =>
+  (error as { _tag?: string })._tag === "NoSuchBucket";
+
+const retryForBucketReadiness = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(
+    Effect.retry({
+      while: isMissingBucket,
+      schedule: Schedule.exponential("100 millis").pipe(
+        Schedule.both(Schedule.recurs(30)),
+        Schedule.map(([duration]) =>
+          Duration.isGreaterThan(duration, Duration.seconds(2))
+            ? Duration.seconds(2)
+            : duration,
+        ),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/Router.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/Router.ts
new file mode 100644
index 00000000000..be5911bbfcc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/Router.ts
@@ -0,0 +1,384 @@
+import * as Effect from "effect/Effect";
+import { createHash } from "node:crypto";
+import * as Construct from "../../Construct.ts";
+import { toPath } from "../../FQN.ts";
+import type { Input } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
+import * as Output from "../../Output.ts";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import { Certificate } from "../ACM/Certificate.ts";
+import {
+  Distribution,
+  type DistributionBehavior,
+} from "../CloudFront/Distribution.ts";
+import { Function as CloudFrontFunction } from "../CloudFront/Function.ts";
+import { Invalidation } from "../CloudFront/Invalidation.ts";
+import { KeyValueStore } from "../CloudFront/KeyValueStore.ts";
+import { KvEntries } from "../CloudFront/KvEntries.ts";
+import { KvRoutesUpdate } from "../CloudFront/KvRoutesUpdate.ts";
+import { MANAGED_CACHING_OPTIMIZED_POLICY_ID } from "../CloudFront/ManagedPolicies.ts";
+import { Record as Route53Record } from "../Route53/Record.ts";
+import {
+  CF_BLOCK_CLOUDFRONT_URL_INJECTION,
+  CF_ROUTER_INJECTION,
+} from "./cfcode.ts";
+import type { RouterProps } from "./shared.ts";
+
+/**
+ * Shared CloudFront front door with KV-based dynamic routing.
+ *
+ * `Router` owns a single CloudFront distribution with a placeholder origin.
+ * Routes are registered lazily via KV entries. A CloudFront Function reads the
+ * KV store at the edge and dynamically sets the origin using
+ * `cf.updateRequestOrigin()`.
+ *
+ * Sites register themselves by writing their file manifest and metadata into
+ * the Router's KV store. The Router's CF function matches incoming requests to
+ * routes by host pattern and path prefix, then delegates to `routeSite()` for
+ * static site routing or directly sets URL/S3 origins.
+ *
+ * @section Creating Routers
+ * @example Basic Router
+ * ```typescript
+ * const router = yield* Router("WebsiteRouter", {
+ *   domain: { name: "example.com", hostedZoneId },
+ * });
+ * ```
+ *
+ * @section Inline Routes
+ * @example URL And Bucket Routes
+ * ```typescript
+ * const router = yield* Router("WebsiteRouter", {
+ *   routes: {
+ *     "/*": { url: api.functionUrl },
+ *   },
+ * });
+ * ```
+ */
+export const Router = Construct.fn(function* (id: string, props: RouterProps) {
+  const domain = props.domain;
+
+  if (domain && domain.dns === false && !domain.cert) {
+    return yield* Effect.die(
+      "Router domain configuration with `dns: false` requires `cert`.",
+    );
+  }
+
+  const certificate =
+    !domain || domain.cert
+      ? domain?.cert
+        ? { certificateArn: domain.cert }
+        : undefined
+      : yield* Certificate("Certificate", {
+          domainName: domain.name,
+          subjectAlternativeNames: [
+            ...(domain.aliases ?? []),
+            ...(domain.redirects ?? []),
+          ],
+          hostedZoneId: domain.hostedZoneId,
+          tags: props.tags,
+        });
+
+  const stack = yield* Stack;
+  const stage = yield* Stage;
+  const ns = yield* Namespace.CurrentNamespace;
+  const fqn = ns ? toPath(ns).join("/") : id;
+  const kvNamespace = createHash("md5")
+    .update(`${stack.name}-${stage}-${fqn}`)
+    .digest("hex")
+    .substring(0, 4);
+
+  const kvStore = yield* KeyValueStore("KvStore", {});
+
+  const viewerRequest = yield* CloudFrontFunction("ViewerRequest", {
+    comment: `${id} viewer request`,
+    code: buildRouterRequestFunctionCode({
+      kvNamespace,
+      userInjection: props.edge?.viewerRequest?.injection,
+      blockCloudfrontUrl: !!domain,
+    }),
+    keyValueStoreArns: [kvStore.keyValueStoreArn],
+  });
+
+  const viewerResponse = props.edge?.viewerResponse
+    ? yield* CloudFrontFunction("ViewerResponse", {
+        comment: `${id} viewer response`,
+        code: buildRouterResponseFunctionCode(
+          props.edge.viewerResponse.injection,
+        ),
+        keyValueStoreArns: props.edge.viewerResponse.keyValueStoreArn
+          ? [props.edge.viewerResponse.keyValueStoreArn as any]
+          : undefined,
+      })
+    : undefined;
+
+  const functionAssociations: DistributionBehavior["functionAssociations"] = [
+    {
+      eventType: "viewer-request" as const,
+      functionArn: viewerRequest.functionArn as any,
+    },
+    ...(viewerResponse
+      ? [
+          {
+            eventType: "viewer-response" as const,
+            functionArn: viewerResponse.functionArn as any,
+          },
+        ]
+      : []),
+  ];
+
+  const inlineRouteEntries: Record<string, Input<string>> = {};
+
+  if (props.routes) {
+    let routeIndex = 0;
+    for (const [pattern, route] of Object.entries(props.routes)) {
+      routeIndex++;
+      const routeNs = createHash("md5")
+        .update(`${stack.name}-${stage}-${fqn}:route:${routeIndex}`)
+        .digest("hex")
+        .substring(0, 4);
+
+      if (typeof route === "string" || "url" in (route as any)) {
+        const url = typeof route === "string" ? route : (route as any).url;
+        const host = typeof url === "string" ? new URL(url).host : url;
+        inlineRouteEntries[`${routeNs}:metadata`] = stringifyResolvedString(
+          host,
+          (resolvedHost) =>
+            JSON.stringify({
+              host: resolvedHost,
+              origin: (route as any).origin,
+              rewrite: (route as any).rewrite,
+            }),
+        );
+        yield* KvRoutesUpdate(`Route${routeIndex}`, {
+          store: kvStore.keyValueStoreArn as any,
+          namespace: kvNamespace,
+          key: "routes",
+          entry: `url,${routeNs},,${normalizePattern(pattern)}`,
+        });
+      } else {
+        const bucketRoute = route as any;
+        const bucketDomain =
+          typeof bucketRoute.bucket === "string"
+            ? bucketRoute.bucket
+            : bucketRoute.bucket.bucketRegionalDomainName;
+        inlineRouteEntries[`${routeNs}:metadata`] = stringifyResolvedString(
+          bucketDomain,
+          (resolvedDomain) =>
+            JSON.stringify({
+              domain: resolvedDomain,
+              origin: bucketRoute.origin,
+              rewrite: bucketRoute.rewrite,
+            }),
+        );
+        yield* KvRoutesUpdate(`Route${routeIndex}`, {
+          store: kvStore.keyValueStoreArn as any,
+          namespace: kvNamespace,
+          key: "routes",
+          entry: `bucket,${routeNs},,${normalizePattern(pattern)}`,
+        });
+      }
+    }
+  }
+
+  if (Object.keys(inlineRouteEntries).length > 0) {
+    yield* KvEntries("InlineRouteEntries", {
+      store: kvStore.keyValueStoreArn as any,
+      namespace: kvNamespace,
+      entries: inlineRouteEntries,
+    });
+  }
+
+  const distribution = yield* Distribution("Distribution", {
+    aliases: domain
+      ? [domain.name, ...(domain.aliases ?? []), ...(domain.redirects ?? [])]
+      : undefined,
+    origins: [
+      {
+        id: "default",
+        domainName: "placeholder.sst.dev",
+        customOriginConfig: {
+          httpPort: 80,
+          httpsPort: 443,
+          originProtocolPolicy: "https-only",
+          originReadTimeout: 20,
+          originSslProtocols: ["TLSv1.2"],
+        },
+      },
+    ],
+    defaultCacheBehavior: {
+      targetOriginId: "default",
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "DELETE",
+        "GET",
+        "HEAD",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+      ],
+      cachedMethods: ["GET", "HEAD"],
+      compress: true,
+      cachePolicyId: MANAGED_CACHING_OPTIMIZED_POLICY_ID,
+      functionAssociations,
+    },
+    viewerCertificate: certificate
+      ? {
+          acmCertificateArn: (certificate as any).certificateArn,
+          sslSupportMethod: "sni-only",
+          minimumProtocolVersion: "TLSv1.2_2021",
+        }
+      : undefined,
+    tags: props.tags,
+  });
+
+  const records =
+    domain?.hostedZoneId && domain.dns !== false
+      ? yield* Effect.forEach(
+          [domain.name, ...(domain.aliases ?? []), ...(domain.redirects ?? [])],
+          (name, index) =>
+            Route53Record(`AliasRecord${index + 1}`, {
+              hostedZoneId: domain.hostedZoneId!,
+              name,
+              type: "A",
+              aliasTarget: {
+                hostedZoneId: distribution.hostedZoneId,
+                dnsName: distribution.domainName,
+              },
+            }),
+          { concurrency: "unbounded" },
+        )
+      : [];
+
+  const invalidation =
+    props.invalidation === false || !props.invalidation
+      ? undefined
+      : yield* Invalidation("Invalidation", {
+          distributionId: distribution.distributionId,
+          version: createHash("sha256")
+            .update(JSON.stringify(inlineRouteEntries))
+            .digest("hex"),
+          wait: props.invalidation.wait,
+          paths:
+            props.invalidation.paths === "all" || !props.invalidation.paths
+              ? ["/*"]
+              : Array.isArray(props.invalidation.paths)
+                ? props.invalidation.paths
+                : ["/*"],
+        });
+
+  return {
+    certificate,
+    distribution,
+    records,
+    invalidation,
+    kvStoreArn: kvStore.keyValueStoreArn as Input<string>,
+    kvNamespace,
+    distributionId: distribution.distributionId as Input<string>,
+    url: domain
+      ? Output.interpolate`https://${domain.name}`
+      : Output.interpolate`https://${distribution.domainName}`,
+  };
+});
+
+const buildRouterRequestFunctionCode = ({
+  kvNamespace,
+  userInjection,
+  blockCloudfrontUrl,
+}: {
+  kvNamespace: string;
+  userInjection?: string;
+  blockCloudfrontUrl: boolean;
+}) => `import cf from "cloudfront";
+async function handler(event) {
+  ${userInjection ?? ""}
+  ${blockCloudfrontUrl ? CF_BLOCK_CLOUDFRONT_URL_INJECTION : ""}
+  ${CF_ROUTER_INJECTION}
+
+  async function getRoutes() {
+    var routerNS = "${kvNamespace}";
+    var routes = [];
+    try {
+      var v = await cf.kvs().get(routerNS + ":routes");
+      routes = JSON.parse(v);
+      if (routes.parts) {
+        var chunkPromises = [];
+        for (var i = 0; i < routes.parts; i++) {
+          chunkPromises.push(cf.kvs().get(routerNS + ":routes:" + i));
+        }
+        var chunks = await Promise.all(chunkPromises);
+        routes = JSON.parse(chunks.join(""));
+      }
+    } catch (e) {}
+    return routes;
+  }
+
+  async function matchRoute(routes) {
+    var requestHost = event.request.headers.host.value;
+    var requestHostWithEscapedDots = requestHost.replace(/\\./g, "\\\\.");
+    var requestHostRegexPattern = "^" + requestHost + "$";
+    var match;
+    routes.forEach(function(r) {
+      var parts = r.split(",");
+      var type = parts[0];
+      var routeNs = parts[1];
+      var host = parts[2];
+      var hostLength = host.length;
+      var path = parts[3];
+      var pathLength = path.length;
+      if (match && (hostLength < match.hostLength || (hostLength === match.hostLength && pathLength < match.pathLength))) return;
+      var hostMatches = host === "" || host === requestHostWithEscapedDots || (host.includes("*") && new RegExp(host).test(requestHostRegexPattern));
+      if (!hostMatches) return;
+      var pathMatches = event.request.uri.startsWith(path) && (event.request.uri === path || path.endsWith('/') || event.request.uri[path.length] === '/' || path === '/');
+      if (!pathMatches) return;
+      match = { type: type, routeNs: routeNs, host: host, hostLength: hostLength, path: path, pathLength: pathLength };
+    });
+    if (match) {
+      try {
+        var type = match.type;
+        var routeNs = match.routeNs;
+        var v = await cf.kvs().get(routeNs + ":metadata");
+        return { type: type, routeNs: routeNs, metadata: JSON.parse(v) };
+      } catch (e) {}
+    }
+  }
+
+  var routes = await getRoutes();
+  var route = await matchRoute(routes);
+  if (!route) return event.request;
+  if (route.metadata.rewrite) {
+    var rw = route.metadata.rewrite;
+    event.request.uri = event.request.uri.replace(new RegExp(rw.regex), rw.to);
+  }
+  if (route.type === "url") setUrlOrigin(route.metadata.host, route.metadata.origin);
+  if (route.type === "bucket") setS3Origin(route.metadata.domain, route.metadata.origin);
+  if (route.type === "site") {
+    var response = await routeSite(route.routeNs, route.metadata);
+    return response || event.request;
+  }
+  return event.request;
+}`;
+
+const buildRouterResponseFunctionCode = (userInjection?: string) =>
+  `import cf from "cloudfront";
+async function handler(event) {
+  ${userInjection ?? ""}
+  return event.response;
+}`;
+
+const normalizePattern = (pattern: string) => {
+  if (pattern === "/" || pattern === "/*") return "/";
+  return pattern.replace(/\/?\*$/, "");
+};
+
+const stringifyResolvedString = (
+  value: Input<string>,
+  build: (resolved: string) => string,
+): Input<string> =>
+  typeof value === "string"
+    ? build(value)
+    : Effect.isEffect(value)
+      ? value.pipe(Effect.map((resolved) => build(resolved)))
+      : value.pipe(Output.map((resolved) => build(resolved)));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/SsrSite.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/SsrSite.ts
new file mode 100644
index 00000000000..0bcc843259f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/SsrSite.ts
@@ -0,0 +1,393 @@
+import type * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Effect from "effect/Effect";
+import * as Construct from "../../Construct.ts";
+import type { Input } from "../../Input.ts";
+import * as Output from "../../Output.ts";
+import { Certificate } from "../ACM/Certificate.ts";
+import { Distribution } from "../CloudFront/Distribution.ts";
+import { Invalidation } from "../CloudFront/Invalidation.ts";
+import {
+  MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_POLICY_ID,
+  MANAGED_CACHING_DISABLED_POLICY_ID,
+  MANAGED_CACHING_OPTIMIZED_POLICY_ID,
+} from "../CloudFront/ManagedPolicies.ts";
+import { OriginAccessControl } from "../CloudFront/OriginAccessControl.ts";
+import type { Service } from "../ECS/Service.ts";
+import type { PolicyStatement } from "../IAM/Policy.ts";
+import { Function } from "../Lambda/Function.ts";
+import { Record as Route53Record } from "../Route53/Record.ts";
+import { Bucket } from "../S3/Bucket.ts";
+import type { AssetFileOption } from "./AssetDeployment.ts";
+import { AssetDeployment } from "./AssetDeployment.ts";
+import type {
+  SsrSiteRouteTargets,
+  WebsiteDomainProps,
+  WebsiteInvalidationProps,
+} from "./shared.ts";
+
+export type SsrSiteServerOrigin =
+  | {
+      type: "lambda";
+      function: Function;
+      originProtocolPolicy?: "https-only";
+    }
+  | {
+      type: "ecs";
+      service: Service;
+      originProtocolPolicy?: "http-only" | "https-only" | "match-viewer";
+    }
+  | {
+      type: "url";
+      url: Input<string>;
+      originProtocolPolicy?: cloudfront.OriginProtocolPolicy;
+    };
+
+export interface SsrSiteProps {
+  /**
+   * Dynamic server origin behind CloudFront.
+   */
+  server: SsrSiteServerOrigin;
+  /**
+   * Optional custom domain managed through Route 53.
+   */
+  domain?: WebsiteDomainProps;
+  /**
+   * Optional static asset bundle to serve from S3.
+   */
+  assets?: {
+    /**
+     * Local build output directory to upload.
+     */
+    sourcePath: Input<string>;
+    /**
+     * Optional deterministic S3 bucket name.
+     */
+    bucketName?: string;
+    /**
+     * Optional asset key prefix.
+     */
+    prefix?: string;
+    /**
+     * Path pattern that should be served from the asset bucket.
+     * @default "/_assets/*"
+     */
+    pathPattern?: string;
+    /**
+     * Remove stale files under the prefix.
+     * @default false
+     */
+    purge?: boolean;
+    /**
+     * Optional file overrides.
+     */
+    fileOptions?: AssetFileOption[];
+  };
+  /**
+   * CloudFront cache policy ID for the dynamic server route.
+   * @default CloudFront managed CachingDisabled
+   */
+  cachePolicyId?: Input<string>;
+  /**
+   * Cache invalidation behavior for asset updates.
+   * @default false
+   */
+  invalidate?: false | WebsiteInvalidationProps;
+  /**
+   * Whether to create a standalone CloudFront distribution for the site.
+   * Set this to `false` when the site should be routed through `AWS.Website.Router`.
+   * @default true
+   */
+  cdn?: boolean;
+  /**
+   * User-defined tags applied to created resources.
+   */
+  tags?: Record<string, string>;
+}
+
+const serverUrlOf = (server: SsrSiteServerOrigin): Input<string> => {
+  switch (server.type) {
+    case "lambda":
+      return Output.map((url: string | undefined) => {
+        if (!url) {
+          throw new Error(
+            "SsrSite lambda origins require a function created with `url: true`.",
+          );
+        }
+        return url;
+      })(server.function.functionUrl as any) as any;
+    case "ecs":
+      return Output.map((url: string | undefined) => {
+        if (!url) {
+          throw new Error(
+            "SsrSite ECS origins require a service created with `public: true`.",
+          );
+        }
+        return url;
+      })(server.service.url as any) as any;
+    case "url":
+      return server.url;
+  }
+};
+
+const serverOriginOf = (server: SsrSiteServerOrigin): Input<string> =>
+  Output.map((url: string) => new URL(url).hostname)(
+    serverUrlOf(server) as any,
+  ) as any;
+
+/**
+ * A server-rendered website behind CloudFront.
+ *
+ * `SsrSite` serves a dynamic origin behind CloudFront and can optionally split
+ * immutable static assets into a private S3 bucket origin.
+ *
+ * @section Creating SSR Sites
+ * @example Lambda URL Origin
+ * ```typescript
+ * const site = yield* SsrSite("App", {
+ *   server: {
+ *     type: "lambda",
+ *     function: appFunction,
+ *   },
+ * });
+ * ```
+ *
+ * @example SSR With Static Assets
+ * ```typescript
+ * const site = yield* SsrSite("App", {
+ *   server: {
+ *     type: "lambda",
+ *     function: appFunction,
+ *   },
+ *   assets: {
+ *     sourcePath: "./dist/client",
+ *   },
+ * });
+ * ```
+ */
+export const SsrSite = Construct.fn(function* (
+  id: string,
+  props: SsrSiteProps,
+) {
+  const assetPattern = props.assets?.pathPattern ?? "/_assets/*";
+  const serverUrl = serverUrlOf(props.server);
+  const serverOriginHost = serverOriginOf(props.server);
+
+  const assetBucket = props.assets
+    ? yield* Bucket("AssetsBucket", {
+        bucketName: props.assets.bucketName,
+        tags: props.tags,
+      })
+    : undefined;
+
+  const assetFiles =
+    props.assets && assetBucket
+      ? yield* AssetDeployment("AssetsFiles", {
+          bucket: assetBucket,
+          sourcePath: props.assets.sourcePath,
+          prefix: props.assets.prefix,
+          purge: props.assets.purge ?? false,
+          fileOptions: props.assets.fileOptions,
+        })
+      : undefined;
+
+  const assetOac =
+    props.assets && assetBucket
+      ? yield* OriginAccessControl("AssetsOriginAccessControl", {
+          originType: "s3",
+          description: `${id} SSR asset origin access control`,
+        })
+      : undefined;
+
+  const routeTargets: SsrSiteRouteTargets = {
+    server: {
+      url: serverUrl,
+      originProtocolPolicy: props.server.originProtocolPolicy ?? "https-only",
+    },
+    assets:
+      assetBucket && assetOac
+        ? {
+            pattern: assetPattern,
+            route: {
+              bucket: assetBucket,
+              originAccessControlId: assetOac.originAccessControlId,
+              originPath: props.assets?.prefix,
+              version: assetFiles?.version,
+            },
+          }
+        : undefined,
+  };
+
+  if (props.cdn === false) {
+    return {
+      assetBucket,
+      assetFiles,
+      assetOriginAccessControl: assetOac,
+      certificate: undefined,
+      distribution: undefined,
+      records: [],
+      invalidation: undefined,
+      routeTargets,
+      url: undefined,
+    };
+  }
+
+  if (props.domain && props.domain.dns === false && !props.domain.cert) {
+    return yield* Effect.fail(
+      new Error(
+        "SsrSite domain configuration with `dns: false` requires `cert`.",
+      ),
+    );
+  }
+
+  const certificate =
+    !props.domain || props.domain.cert
+      ? props.domain?.cert
+        ? { certificateArn: props.domain.cert }
+        : undefined
+      : yield* Certificate("Certificate", {
+          domainName: props.domain.name,
+          subjectAlternativeNames: [
+            ...(props.domain.aliases ?? []),
+            ...(props.domain.redirects ?? []),
+          ],
+          hostedZoneId: props.domain.hostedZoneId,
+          tags: props.tags,
+        });
+
+  const distribution = yield* Distribution("Distribution", {
+    aliases: props.domain
+      ? [props.domain.name, ...(props.domain.aliases ?? [])]
+      : undefined,
+    origins: [
+      {
+        id: "server",
+        domainName: serverOriginHost,
+        customOriginConfig: {
+          originProtocolPolicy:
+            props.server.originProtocolPolicy ?? "https-only",
+        },
+      },
+      ...(assetBucket && assetOac
+        ? [
+            {
+              id: "assets",
+              domainName: assetBucket.bucketRegionalDomainName,
+              originPath: props.assets?.prefix,
+              s3Origin: true,
+              originAccessControlId: assetOac.originAccessControlId,
+            },
+          ]
+        : []),
+    ],
+    defaultCacheBehavior: {
+      targetOriginId: "server",
+      viewerProtocolPolicy: "redirect-to-https",
+      compress: true,
+      allowedMethods: [
+        "DELETE",
+        "GET",
+        "HEAD",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+      ],
+      cachedMethods: ["GET", "HEAD"],
+      cachePolicyId: props.cachePolicyId ?? MANAGED_CACHING_DISABLED_POLICY_ID,
+      originRequestPolicyId: MANAGED_ALL_VIEWER_EXCEPT_HOST_HEADER_POLICY_ID,
+    },
+    orderedCacheBehaviors:
+      assetBucket && assetOac
+        ? [
+            {
+              pathPattern: assetPattern,
+              targetOriginId: "assets",
+              viewerProtocolPolicy: "redirect-to-https",
+              compress: true,
+              allowedMethods: ["GET", "HEAD", "OPTIONS"],
+              cachedMethods: ["GET", "HEAD"],
+              cachePolicyId: MANAGED_CACHING_OPTIMIZED_POLICY_ID,
+            },
+          ]
+        : undefined,
+    viewerCertificate: certificate
+      ? {
+          acmCertificateArn: (certificate as any).certificateArn,
+          sslSupportMethod: "sni-only",
+          minimumProtocolVersion: "TLSv1.2_2021",
+        }
+      : undefined,
+    tags: props.tags,
+  });
+
+  if (assetBucket && assetOac) {
+    const bucketPolicy: PolicyStatement = {
+      Effect: "Allow",
+      Principal: {
+        Service: "cloudfront.amazonaws.com",
+      },
+      Action: ["s3:GetObject"],
+      Resource: [Output.interpolate`${assetBucket.bucketArn}/*` as any],
+      Condition: {
+        StringEquals: {
+          "AWS:SourceArn": distribution.distributionArn as any,
+        },
+      },
+    };
+
+    yield* assetBucket.bind`AWS.S3.Policy(${distribution}, ${assetBucket})`({
+      policyStatements: [bucketPolicy],
+    });
+  }
+
+  const records =
+    props.domain?.hostedZoneId && props.domain.dns !== false
+      ? yield* Effect.forEach(
+          [
+            props.domain.name,
+            ...(props.domain.aliases ?? []),
+            ...(props.domain.redirects ?? []),
+          ],
+          (name, index) =>
+            Route53Record(`AliasRecord${index + 1}`, {
+              hostedZoneId: props.domain!.hostedZoneId!,
+              name,
+              type: "A",
+              aliasTarget: {
+                hostedZoneId: distribution.hostedZoneId,
+                dnsName: distribution.domainName,
+              },
+            }),
+          { concurrency: "unbounded" },
+        )
+      : [];
+
+  const invalidation =
+    props.invalidate === false || !assetFiles
+      ? undefined
+      : yield* Invalidation("Invalidation", {
+          distributionId: distribution.distributionId,
+          version: assetFiles.version,
+          wait: props.invalidate?.wait,
+          paths:
+            props.invalidate?.paths === "versioned"
+              ? [assetPattern]
+              : props.invalidate?.paths === "all" || !props.invalidate?.paths
+                ? ["/*"]
+                : props.invalidate.paths,
+        });
+
+  return {
+    assetBucket,
+    assetFiles,
+    assetOriginAccessControl: assetOac,
+    certificate,
+    distribution,
+    records,
+    invalidation,
+    routeTargets,
+    url: props.domain
+      ? Output.interpolate`https://${props.domain.name}`
+      : Output.interpolate`https://${distribution.domainName}`,
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/StaticSite.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/StaticSite.ts
new file mode 100644
index 00000000000..a79eef67444
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/StaticSite.ts
@@ -0,0 +1,603 @@
+import * as Effect from "effect/Effect";
+import { createHash } from "node:crypto";
+import { readdirSync } from "node:fs";
+import path from "node:path";
+import { Command } from "../../Build/Command.ts";
+import * as Construct from "../../Construct.ts";
+import { toPath } from "../../FQN.ts";
+import type { Input } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
+import * as Output from "../../Output.ts";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import { Certificate } from "../ACM/Certificate.ts";
+import { Distribution } from "../CloudFront/Distribution.ts";
+import { Function as CloudFrontFunction } from "../CloudFront/Function.ts";
+import { Invalidation } from "../CloudFront/Invalidation.ts";
+import { KeyValueStore } from "../CloudFront/KeyValueStore.ts";
+import { KvEntries } from "../CloudFront/KvEntries.ts";
+import { KvRoutesUpdate } from "../CloudFront/KvRoutesUpdate.ts";
+import { MANAGED_CACHING_OPTIMIZED_POLICY_ID } from "../CloudFront/ManagedPolicies.ts";
+import { Record as Route53Record } from "../Route53/Record.ts";
+import { Bucket } from "../S3/Bucket.ts";
+import type { AssetFileOption } from "./AssetDeployment.ts";
+import { AssetDeployment } from "./AssetDeployment.ts";
+import {
+  CF_BLOCK_CLOUDFRONT_URL_INJECTION,
+  CF_ROUTER_INJECTION,
+} from "./cfcode.ts";
+import type {
+  StaticSiteAssetsProps,
+  StaticSiteBuildProps,
+  WebsiteDomainProps,
+  WebsiteEdgeProps,
+  WebsiteInvalidationProps,
+} from "./shared.ts";
+
+type StaticSiteDomainInput = string | WebsiteDomainProps;
+
+export interface StaticSiteRouterAttachment {
+  instance: {
+    kvStoreArn: Input<string>;
+    kvNamespace: Input<string>;
+    distributionId: Input<string>;
+    url: Input<string>;
+  };
+  domain?: string;
+  path?: string;
+}
+
+export interface StaticSiteProps {
+  /**
+   * Path to the local site directory.
+   * @default "."
+   */
+  path?: Input<string>;
+  /**
+   * Optional build configuration executed before upload.
+   */
+  build?: StaticSiteBuildProps;
+  /**
+   * Environment variables exposed to the build command.
+   */
+  environment?: Record<string, Input<string>>;
+  /**
+   * Static site asset upload configuration.
+   */
+  assets?: StaticSiteAssetsProps & {
+    fileOptions?: AssetFileOption[];
+  };
+  /**
+   * Optional custom domain.
+   */
+  domain?: StaticSiteDomainInput;
+  /**
+   * Serve this site through an existing Router instead of creating a standalone
+   * CloudFront distribution.
+   */
+  router?: StaticSiteRouterAttachment;
+  /**
+   * Additional CloudFront Function customizations.
+   */
+  edge?: WebsiteEdgeProps;
+  /**
+   * Index page served for the site root.
+   * @default "index.html"
+   */
+  indexPage?: string;
+  /**
+   * Error page returned for 403/404 requests.
+   * When set, CloudFront customErrorResponses are created.
+   */
+  errorPage?: string;
+  /**
+   * Optional deterministic S3 bucket name for newly created buckets.
+   */
+  bucketName?: string;
+  /**
+   * Whether to delete uploaded objects before destroying created buckets.
+   * @default false
+   */
+  forceDestroy?: boolean;
+  /**
+   * CloudFront invalidation behavior.
+   * @default { paths: "all", wait: false }
+   */
+  invalidation?: false | WebsiteInvalidationProps;
+  /**
+   * User-defined tags applied to created resources.
+   */
+  tags?: Record<string, string>;
+}
+
+/**
+ * Deploy a static website to S3 and CloudFront using KV-based edge routing.
+ *
+ * `StaticSite` uploads site files to a private S3 bucket, creates a CloudFront
+ * KeyValueStore with a file manifest for edge routing, and optionally builds
+ * the site first. Supports standalone distribution or composition with
+ * `AWS.Website.Router`.
+ *
+ * @section Basic Sites
+ * @example Simple Static Site
+ * ```typescript
+ * const site = yield* StaticSite("Docs", {
+ *   path: "./site",
+ * });
+ * ```
+ *
+ * @section Built Sites
+ * @example Build A Vite App
+ * ```typescript
+ * const site = yield* StaticSite("Web", {
+ *   path: "./frontend",
+ *   build: {
+ *     command: "bun run build",
+ *     output: "dist",
+ *   },
+ *   environment: {
+ *     VITE_API_URL: api.url,
+ *   },
+ * });
+ * ```
+ *
+ * @section Router Composition
+ * @example Serve Through A Router
+ * ```typescript
+ * const site = yield* StaticSite("Docs", {
+ *   path: "./docs",
+ *   router: {
+ *     instance: router,
+ *     path: "/docs",
+ *   },
+ * });
+ * ```
+ */
+export const StaticSite = Construct.fn(function* (
+  id: string,
+  props: StaticSiteProps,
+) {
+  const domain = normalizeDomain(props.domain);
+  const sitePath = (props.path ?? ".") as string;
+  const indexPage = props.indexPage ?? "index.html";
+  const assetPrefix = normalizePrefix(props.assets?.path);
+  const assetRoutes = [...(props.assets?.routes ?? [])]
+    .map((value) => value.trim())
+    .filter(Boolean)
+    .map(normalizeRoutePath);
+  const invalidationProps =
+    props.invalidation !== undefined
+      ? props.invalidation
+      : { paths: "all" as const, wait: false };
+
+  if (props.router && props.domain) {
+    return yield* Effect.die(
+      `Cannot provide both "domain" and "router". Use the "domain" prop on the Router component.`,
+    );
+  }
+  if (props.router && props.edge) {
+    return yield* Effect.die(
+      `Cannot provide both "edge" and "router". Use the "edge" prop on the Router component.`,
+    );
+  }
+
+  const build = props.build
+    ? yield* Command("Build", {
+        command: props.build.command,
+        cwd: sitePath,
+        memo: {
+          include: props.build.include,
+          exclude: props.build.exclude,
+          lockfile: props.build.lockfile,
+        },
+        outdir: props.build.output,
+        env: props.environment,
+      })
+    : undefined;
+
+  const uploadSourcePath = (build?.outdir ?? sitePath) as string;
+
+  const providedBucket = props.assets?.bucket;
+  const bucket =
+    providedBucket ??
+    (yield* Bucket("Bucket", {
+      bucketName: props.bucketName,
+      forceDestroy: props.forceDestroy,
+      tags: props.tags,
+    }));
+
+  const routerAttachment = props.router;
+  const routerPathPrefix = routerAttachment?.path
+    ? "/" + routerAttachment.path.replace(/^\//, "").replace(/\/$/, "")
+    : undefined;
+
+  const files = yield* AssetDeployment("Files", {
+    bucket: bucket,
+    sourcePath: uploadSourcePath,
+    prefix: normalizeUploadPrefix(assetPrefix, routerPathPrefix),
+    purge: props.assets?.purge ?? true,
+    fileOptions: props.assets?.fileOptions,
+    textEncoding: props.assets?.textEncoding,
+  });
+
+  const stack = yield* Stack;
+  const stage = yield* Stage;
+  const ns = yield* Namespace.CurrentNamespace;
+  const fqn = ns ? toPath(ns).join("/") : id;
+  const kvNamespace = createHash("md5")
+    .update(`${stack.name}-${stage}-${fqn}`)
+    .digest("hex")
+    .substring(0, 4);
+
+  const kvEntries = buildKvEntries(
+    uploadSourcePath,
+    bucket,
+    assetPrefix,
+    assetRoutes,
+    indexPage,
+    props.errorPage,
+    routerPathPrefix,
+  );
+
+  let distributionId: Input<string>;
+  let kvStoreArn: Input<string>;
+  let distribution: Distribution | undefined;
+  let prodUrl: Input<string> | undefined;
+
+  if (routerAttachment) {
+    kvStoreArn = routerAttachment.instance.kvStoreArn;
+    distributionId = routerAttachment.instance.distributionId;
+    const hostPattern = routerAttachment.domain
+      ? routerAttachment.domain
+          .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+          .replace(/\*/g, ".*")
+      : undefined;
+    yield* KvRoutesUpdate("RoutesUpdate", {
+      store: kvStoreArn,
+      namespace: routerAttachment.instance.kvNamespace as any,
+      key: "routes",
+      entry: [
+        "site",
+        kvNamespace,
+        hostPattern ?? "",
+        routerPathPrefix ?? "/",
+      ].join(","),
+    });
+    prodUrl = routerAttachment.domain
+      ? `https://${routerAttachment.domain}${routerPathPrefix ?? ""}`
+      : Output.interpolate`${routerAttachment.instance.url}${routerPathPrefix ?? ""}`;
+  } else {
+    if (
+      domain &&
+      !domain.cert &&
+      !domain.hostedZoneId &&
+      domain.dns === false
+    ) {
+      return yield* Effect.die(
+        "StaticSite domain configuration with `dns: false` requires `cert`.",
+      );
+    }
+
+    const certificate =
+      !domain || domain.cert
+        ? domain?.cert
+          ? { certificateArn: domain.cert }
+          : undefined
+        : yield* Certificate("Certificate", {
+            domainName: domain.name,
+            subjectAlternativeNames: [
+              ...(domain.aliases ?? []),
+              ...(domain.redirects ?? []),
+            ],
+            hostedZoneId: domain.hostedZoneId,
+            tags: props.tags,
+          });
+
+    const kvStore = yield* KeyValueStore("KvStore", {});
+    kvStoreArn = kvStore.keyValueStoreArn;
+
+    const viewerRequest = yield* CloudFrontFunction("ViewerRequest", {
+      comment: `${id} viewer request`,
+      code: buildRequestFunctionCode({
+        kvNamespace,
+        userInjection: props.edge?.viewerRequest?.injection,
+        blockCloudfrontUrl: !!domain,
+      }),
+      keyValueStoreArns: [kvStore.keyValueStoreArn],
+    });
+
+    const viewerResponse = props.edge?.viewerResponse
+      ? yield* CloudFrontFunction("ViewerResponse", {
+          comment: `${id} viewer response`,
+          code: buildResponseFunctionCode(props.edge.viewerResponse.injection),
+          keyValueStoreArns: props.edge.viewerResponse.keyValueStoreArn
+            ? [props.edge.viewerResponse.keyValueStoreArn]
+            : undefined,
+        })
+      : undefined;
+
+    const functionAssociations = [
+      {
+        eventType: "viewer-request" as const,
+        functionArn: viewerRequest.functionArn,
+      },
+      ...(viewerResponse
+        ? [
+            {
+              eventType: "viewer-response" as const,
+              functionArn: viewerResponse.functionArn,
+            },
+          ]
+        : []),
+    ];
+
+    const errorPage = "/" + (props.errorPage ?? indexPage).replace(/^\//, "");
+    const customErrorResponses = props.errorPage
+      ? [
+          {
+            ErrorCode: 403,
+            ResponseCode: "404",
+            ResponsePagePath: errorPage,
+            ErrorCachingMinTTL: 0,
+          },
+          {
+            ErrorCode: 404,
+            ResponseCode: "404",
+            ResponsePagePath: errorPage,
+            ErrorCachingMinTTL: 0,
+          },
+        ]
+      : undefined;
+
+    distribution = yield* Distribution("Distribution", {
+      aliases: domain
+        ? [domain.name, ...(domain.aliases ?? []), ...(domain.redirects ?? [])]
+        : undefined,
+      origins: [
+        {
+          id: "default",
+          domainName: "placeholder.alchemy.run",
+          customOriginConfig: {
+            httpPort: 80,
+            httpsPort: 443,
+            originProtocolPolicy: "https-only",
+            originReadTimeout: 20,
+            originSslProtocols: ["TLSv1.2"],
+          },
+        },
+      ],
+      defaultCacheBehavior: {
+        targetOriginId: "default",
+        viewerProtocolPolicy: "redirect-to-https",
+        allowedMethods: [
+          "DELETE",
+          "GET",
+          "HEAD",
+          "OPTIONS",
+          "PATCH",
+          "POST",
+          "PUT",
+        ],
+        cachedMethods: ["GET", "HEAD"],
+        compress: true,
+        cachePolicyId: MANAGED_CACHING_OPTIMIZED_POLICY_ID,
+        functionAssociations,
+      },
+      customErrorResponses,
+      viewerCertificate: certificate
+        ? {
+            acmCertificateArn: certificate.certificateArn,
+            sslSupportMethod: "sni-only",
+            minimumProtocolVersion: "TLSv1.2_2021",
+          }
+        : undefined,
+      tags: props.tags,
+    });
+
+    const dist = distribution;
+    distributionId = dist.distributionId;
+
+    if (domain?.hostedZoneId && domain.dns !== false) {
+      yield* Effect.forEach(
+        [domain.name, ...(domain.aliases ?? []), ...(domain.redirects ?? [])],
+        (name, index) =>
+          Route53Record(`AliasRecord${index + 1}`, {
+            hostedZoneId: domain.hostedZoneId!,
+            name,
+            type: "A",
+            aliasTarget: {
+              hostedZoneId: dist.hostedZoneId,
+              dnsName: dist.domainName,
+            },
+          }),
+        { concurrency: "unbounded" },
+      );
+    }
+
+    prodUrl = domain
+      ? Output.interpolate`https://${domain.name}`
+      : Output.interpolate`https://${dist.domainName}`;
+  }
+
+  yield* KvEntries("KvEntries", {
+    store: kvStoreArn,
+    namespace: kvNamespace,
+    entries: kvEntries,
+    purge: props.assets?.purge ?? true,
+  });
+
+  const invalidation =
+    invalidationProps === false
+      ? undefined
+      : yield* Invalidation("Invalidation", {
+          distributionId: distributionId,
+          version: files.version,
+          wait: invalidationProps?.wait,
+          paths:
+            invalidationProps?.paths === "all" || !invalidationProps?.paths
+              ? ["/*"]
+              : invalidationProps.paths === "versioned"
+                ? [`/${indexPage.replace(/^\/+/, "")}`]
+                : invalidationProps.paths,
+        });
+
+  return {
+    bucket: bucket,
+    build,
+    files,
+    distribution,
+    invalidation,
+    kvNamespace,
+    url: prodUrl,
+  };
+});
+
+const buildKvEntries = (
+  outputPath: string,
+  bucket: {
+    bucketRegionalDomainName: Input<string>;
+  },
+  assetPrefix: string,
+  assetRoutes: string[],
+  indexPage: string,
+  errorPage: string | undefined,
+  routerPathPrefix: string | undefined,
+): Record<string, Input<string>> => {
+  const entries: Record<string, Input<string>> = {};
+  const dirs: string[] = [];
+  const expandDirs = [".well-known"];
+
+  const processDir = (childPath = "", level = 0) => {
+    let currentPath: string;
+    try {
+      currentPath = path.join(outputPath, childPath);
+    } catch {
+      return;
+    }
+    let items: { name: string; isFile(): boolean; isDirectory(): boolean }[];
+    try {
+      items = readdirSync(currentPath, { withFileTypes: true }) as any;
+    } catch {
+      return;
+    }
+    for (const item of items) {
+      const name = String(item.name);
+      if (item.isFile()) {
+        const filePath = path.posix.join("/", childPath, name);
+        entries[filePath] = "s3";
+      } else if (item.isDirectory()) {
+        if (level === 0 && expandDirs.includes(name)) {
+          processDir(path.join(childPath, name), level + 1);
+        } else {
+          dirs.push(path.posix.join("/", childPath, name));
+        }
+      }
+    }
+  };
+  processDir();
+
+  const errorPagePath = "/" + (errorPage ?? indexPage).replace(/^\//, "");
+  const bucketDomain = bucket.bucketRegionalDomainName;
+  const metadata: Omit<KvSiteMetadata, "s3"> & {
+    s3: Omit<KvSiteMetadata["s3"], "domain">;
+  } = {
+    base:
+      routerPathPrefix && routerPathPrefix !== "/"
+        ? routerPathPrefix
+        : undefined,
+    custom404: errorPage ? undefined : errorPagePath,
+    errorResponseCode: errorPage ? 404 : undefined,
+    s3: {
+      dir: assetPrefix ? "/" + assetPrefix : "",
+      routes: [...assetRoutes, ...dirs],
+    },
+  };
+
+  entries["metadata"] = stringifyResolvedString(bucketDomain, (domain) =>
+    JSON.stringify({
+      ...metadata,
+      s3: {
+        ...metadata.s3,
+        domain,
+      },
+    }),
+  );
+
+  return entries;
+};
+
+interface KvSiteMetadata {
+  base?: string;
+  custom404?: string;
+  errorResponseCode?: number;
+  s3: {
+    domain: string;
+    dir: string;
+    routes: string[];
+  };
+}
+
+const stringifyResolvedString = (
+  value: Input<string>,
+  build: (resolved: string) => string,
+): Input<string> =>
+  typeof value === "string"
+    ? build(value)
+    : Effect.isEffect(value)
+      ? value.pipe(Effect.map((resolved) => build(resolved)))
+      : value.pipe(Output.map((resolved) => build(resolved)));
+
+const buildRequestFunctionCode = ({
+  kvNamespace,
+  userInjection,
+  blockCloudfrontUrl,
+}: {
+  kvNamespace: string;
+  userInjection?: string;
+  blockCloudfrontUrl: boolean;
+}) => `import cf from "cloudfront";
+async function handler(event) {
+  ${userInjection ?? ""}
+  ${blockCloudfrontUrl ? CF_BLOCK_CLOUDFRONT_URL_INJECTION : ""}
+  ${CF_ROUTER_INJECTION}
+
+  const kvNamespace = "${kvNamespace}";
+
+  let metadata;
+  try {
+    const v = await cf.kvs().get(kvNamespace + ":metadata");
+    metadata = JSON.parse(v);
+  } catch (e) {}
+
+  const response = await routeSite(kvNamespace, metadata);
+  return response || event.request;
+}`;
+
+const buildResponseFunctionCode = (
+  userInjection?: string,
+) => `import cf from "cloudfront";
+async function handler(event) {
+  ${userInjection ?? ""}
+  return event.response;
+}`;
+
+const normalizePrefix = (prefix: string | undefined) =>
+  prefix ? prefix.replace(/^\/+|\/+$/g, "") : "";
+
+const normalizeUploadPrefix = (
+  assetPrefix: string,
+  routerPathPrefix: string | undefined,
+) => {
+  const parts = [assetPrefix, routerPathPrefix?.replace(/^\//, "")].filter(
+    Boolean,
+  );
+  return parts.join("/") || "";
+};
+
+const normalizeRoutePath = (value: string) =>
+  `/${value.replace(/^\/+|\/+$/g, "")}`;
+
+const normalizeDomain = (
+  domain: StaticSiteProps["domain"],
+): WebsiteDomainProps | undefined =>
+  typeof domain === "string" ? { name: domain } : domain;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/cfcode.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/cfcode.ts
new file mode 100644
index 00000000000..b9e4e53abf5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/cfcode.ts
@@ -0,0 +1,180 @@
+/**
+ * CloudFront Function injection code ported from SST's Router component.
+ * These are JavaScript code strings that get injected into CloudFront Function handlers.
+ */
+
+export const CF_BLOCK_CLOUDFRONT_URL_INJECTION = `
+if (event.request.headers.host.value.includes('cloudfront.net')) {
+  return {
+    statusCode: 403,
+    statusDescription: 'Forbidden',
+    body: {
+      encoding: "text",
+      data: '<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>'
+    }
+  };
+}`;
+
+const CLOUDFRONT_FUNCTION_SAFE_HEADER_LIMIT = 10240 - 512;
+
+export const CF_ROUTER_INJECTION = `
+async function routeSite(kvNamespace, metadata) {
+  var baselessUri = metadata.base
+    ? event.request.uri.replace(metadata.base, "")
+    : event.request.uri;
+
+  try {
+    var u = decodeURIComponent(baselessUri);
+    var postfixes = u.endsWith("/")
+      ? ["index.html"]
+      : ["", ".html", "/index.html"];
+    var v = await Promise.any(postfixes.map(function(p) { return cf.kvs().get(kvNamespace + ":" + u + p).then(function() { return p; }); }));
+    event.request.uri = metadata.s3.dir + event.request.uri + v;
+    setS3Origin(metadata.s3.domain);
+    return;
+  } catch (e) {}
+
+  if (metadata.s3 && metadata.s3.routes) {
+    for (var i=0, l=metadata.s3.routes.length; i<l; i++) {
+      var route = metadata.s3.routes[i];
+      if (baselessUri.startsWith(route)) {
+        event.request.uri = metadata.s3.dir + event.request.uri;
+        if (event.request.uri.endsWith("/")) {
+          event.request.uri += "index.html";
+        } else if (!event.request.uri.split("/").pop().includes(".")) {
+          event.request.uri += "/index.html";
+        }
+        setS3Origin(metadata.s3.domain);
+        return;
+      }
+    }
+  }
+
+  if (metadata.custom404 && !metadata.errorResponseCode) {
+    event.request.uri = metadata.s3.dir + (metadata.base ? metadata.base : "") + metadata.custom404;
+    setS3Origin(metadata.s3.domain);
+    return;
+  }
+
+  if (metadata.s3 && !metadata.servers) {
+    event.request.uri = metadata.s3.dir + event.request.uri;
+    setS3Origin(metadata.s3.domain);
+    return;
+  }
+
+  if (metadata.image && baselessUri.startsWith(metadata.image.route)) {
+    setForwardedHost();
+    if (isRequestHeaderTooLarge()) return buildOversizedHeadersResponse();
+    setUrlOrigin(metadata.image.host, metadata.image.originAccessControlConfig ? { originAccessControlConfig: metadata.image.originAccessControlConfig } : undefined);
+    return;
+  }
+
+  if (metadata.servers) {
+    setForwardedHost();
+    for (var key in event.request.querystring) {
+      if (key.includes("/")) {
+        event.request.querystring[encodeURIComponent(key)] = event.request.querystring[key];
+        delete event.request.querystring[key];
+      }
+    }
+    if (isRequestHeaderTooLarge()) return buildOversizedHeadersResponse();
+    setUrlOrigin(findNearestServer(metadata.servers), metadata.origin);
+  }
+
+  function findNearestServer(servers) {
+    if (servers.length === 1) return servers[0][0];
+    var h = event.request.headers;
+    var lat = h["cloudfront-viewer-latitude"] && h["cloudfront-viewer-latitude"].value;
+    var lon = h["cloudfront-viewer-longitude"] && h["cloudfront-viewer-longitude"].value;
+    if (!lat || !lon) return servers[0][0];
+    return servers.map(function(s) { return { distance: haversineDistance(lat, lon, s[1], s[2]), host: s[0] }; }).sort(function(a,b) { return a.distance - b.distance; })[0].host;
+  }
+
+  function haversineDistance(lat1, lon1, lat2, lon2) {
+    var toRad = function(a) { return a * Math.PI / 180; };
+    var dLat = toRad(lat2 - lat1);
+    var dLon = toRad(lon2 - lon1);
+    var a = Math.sin(dLat/2)*Math.sin(dLat/2) + Math.cos(toRad(lat1))*Math.cos(toRad(lat2))*Math.sin(dLon/2)*Math.sin(dLon/2);
+    return 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+  }
+
+  function isRequestHeaderTooLarge() {
+    return getRequestHeaderSize() > ${CLOUDFRONT_FUNCTION_SAFE_HEADER_LIMIT};
+  }
+
+  function buildOversizedHeadersResponse() {
+    return {
+      statusCode: 431,
+      statusDescription: "Request Header Fields Too Large",
+      headers: { "cache-control": { value: "no-store" }, "content-type": { value: "text/plain; charset=utf-8" } },
+      body: { encoding: "text", data: "Request headers are too large. Reduce cookie size and try again." },
+    };
+  }
+
+  function getRequestHeaderSize() {
+    var size = 0;
+    for (var key in event.request.headers) {
+      var header = event.request.headers[key];
+      if (header.multiValue) {
+        for (var i=0; i<header.multiValue.length; i++) size += key.length + header.multiValue[i].value.length + 4;
+      } else if (header.value) {
+        size += key.length + header.value.length + 4;
+      }
+    }
+    var cookies = [];
+    for (var key in event.request.cookies) {
+      var cookie = event.request.cookies[key];
+      if (cookie.multiValue) {
+        for (var i=0; i<cookie.multiValue.length; i++) cookies.push(key + "=" + cookie.multiValue[i].value);
+      } else {
+        cookies.push(key + "=" + cookie.value);
+      }
+    }
+    if (cookies.length) size += 10 + cookies.join("; ").length;
+    return size;
+  }
+}
+
+function setForwardedHost() {
+  event.request.headers["x-forwarded-host"] = event.request.headers.host;
+}
+
+function setUrlOrigin(urlHost, override) {
+  setForwardedHost();
+  var origin = {
+    domainName: urlHost,
+    customOriginConfig: {
+      port: 443,
+      protocol: "https",
+      sslProtocols: ["TLSv1.2"],
+    },
+    originAccessControlConfig: {
+      enabled: false,
+    }
+  };
+  override = override || {};
+  if (override.protocol === "http") delete origin.customOriginConfig;
+  if (override.connectionAttempts) origin.connectionAttempts = override.connectionAttempts;
+  if (override.timeouts) origin.timeouts = override.timeouts;
+  if (override.originAccessControlConfig) origin.originAccessControlConfig = override.originAccessControlConfig;
+  cf.updateRequestOrigin(origin);
+}
+
+function setS3Origin(s3Domain, override) {
+  delete event.request.headers["Cookies"];
+  delete event.request.headers["cookies"];
+  delete event.request.cookies;
+  var origin = {
+    domainName: s3Domain,
+    originAccessControlConfig: {
+      enabled: true,
+      signingBehavior: "always",
+      signingProtocol: "sigv4",
+      originType: "s3",
+    }
+  };
+  override = override || {};
+  if (override.connectionAttempts) origin.connectionAttempts = override.connectionAttempts;
+  if (override.timeouts) origin.timeouts = override.timeouts;
+  cf.updateRequestOrigin(origin);
+}`;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/index.ts
new file mode 100644
index 00000000000..de30942620e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/index.ts
@@ -0,0 +1,5 @@
+export * from "./AssetDeployment.ts";
+export * from "./Router.ts";
+export * from "./shared.ts";
+export * from "./SsrSite.ts";
+export * from "./StaticSite.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/shared.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/shared.ts
new file mode 100644
index 00000000000..aa6e2256fc0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/Website/shared.ts
@@ -0,0 +1,235 @@
+import type { Input } from "../../Input.ts";
+import type { Bucket } from "../S3/Bucket.ts";
+
+export interface WebsiteDomainProps {
+  /**
+   * Primary domain name for the website or router.
+   */
+  name: string;
+  /**
+   * Hosted zone used for Route 53 automation.
+   */
+  hostedZoneId?: string;
+  /**
+   * Additional aliases that should point at the same distribution.
+   */
+  aliases?: string[];
+  /**
+   * Optional aliases that should redirect to the primary domain.
+   */
+  redirects?: string[];
+  /**
+   * Existing ACM certificate ARN to use instead of creating one.
+   */
+  cert?: Input<string>;
+  /**
+   * Disable Route 53 automation. When set, no DNS records are created.
+   */
+  dns?: false;
+}
+
+export interface WebsiteRewrite {
+  /**
+   * Regex matched against the request URI.
+   */
+  regex: string;
+  /**
+   * Replacement path forwarded to the origin.
+   */
+  to: string;
+}
+
+export interface WebsiteEdgeInjection {
+  /**
+   * JavaScript injected into the generated CloudFront Function body.
+   */
+  injection: string;
+  /**
+   * Optional associated KeyValueStore ARN for the function.
+   */
+  keyValueStoreArn?: Input<string>;
+}
+
+export interface WebsiteEdgeProps {
+  /**
+   * Additional logic for viewer request handling.
+   */
+  viewerRequest?: WebsiteEdgeInjection;
+  /**
+   * Additional logic for viewer response handling.
+   */
+  viewerResponse?: WebsiteEdgeInjection;
+}
+
+export interface WebsiteInvalidationProps {
+  /**
+   * Wait for the CloudFront invalidation to finish.
+   * @default false
+   */
+  wait?: boolean;
+  /**
+   * Paths to invalidate.
+   * @default "all"
+   */
+  paths?: "all" | "versioned" | string[];
+}
+
+export type WebsiteTextEncoding =
+  | "utf-8"
+  | "iso-8859-1"
+  | "windows-1252"
+  | "ascii"
+  | "none";
+
+export interface StaticSiteBuildProps {
+  /**
+   * Command used to build the site before upload.
+   */
+  command: string;
+  /**
+   * Directory containing the build output, relative to `path`.
+   */
+  output: string;
+  /**
+   * Glob patterns of files to hash. Paths are relative to `path`.
+   * When the hash of matched files changes, the build will re-run.
+   *
+   * @default ["**\/*"] (all files, filtered by `exclude`)
+   * @example ["src/**", "package.json", "tsconfig.json"]
+   */
+  include?: string[];
+  /**
+   * Glob patterns to exclude from input hashing. Paths are relative to `path`.
+   *
+   * @default gitignore rules collected from the working directory up to the repo root
+   */
+  exclude?: string[];
+  /**
+   * Whether to include the nearest package-manager lockfile in the hash,
+   * even when it lives above the site directory (e.g. monorepo root).
+   *
+   * @default true when both `include` and `exclude` are unset; false otherwise
+   */
+  lockfile?: boolean;
+}
+
+export interface StaticSiteAssetsProps {
+  /**
+   * Existing bucket used for asset uploads.
+   * When a string bucket name is provided, bucket policies must be managed
+   * separately because Alchemy cannot bind to an external bucket resource.
+   */
+  bucket?: Bucket;
+  /**
+   * Optional path prefix inside the bucket.
+   */
+  path?: string;
+  /**
+   * Remove stale files under the bucket path prefix.
+   * @default true
+   */
+  purge?: boolean;
+  /**
+   * Additional route prefixes that should be served directly from the bucket.
+   */
+  routes?: string[];
+  /**
+   * Character encoding used for text-based assets.
+   * @default "utf-8"
+   */
+  textEncoding?: WebsiteTextEncoding;
+}
+
+export interface StaticSiteRouterProps {
+  /**
+   * Optional path prefix used when composing with `AWS.Website.Router`.
+   * This is metadata only; `StaticSite` still returns `routeTarget` for
+   * explicit router composition.
+   * @default "/"
+   */
+  path?: string;
+}
+
+export interface RouterUrlRouteProps {
+  /**
+   * Destination URL.
+   */
+  url: Input<string>;
+  /**
+   * Optional rewrite applied before forwarding.
+   */
+  rewrite?: WebsiteRewrite;
+  /**
+   * Optional origin override configuration.
+   */
+  origin?: Record<string, any>;
+  /**
+   * Origin protocol policy (used by SsrSite for server origins).
+   */
+  originProtocolPolicy?: string;
+}
+
+export interface RouterBucketRouteProps {
+  /**
+   * Bucket or bucket regional domain name served by the route.
+   */
+  bucket: Bucket | string;
+  /**
+   * Optional rewrite applied before forwarding.
+   */
+  rewrite?: WebsiteRewrite;
+  /**
+   * Optional origin override configuration.
+   */
+  origin?: Record<string, any>;
+  /**
+   * Optional CloudFront OAC to attach to the S3 origin (used by SsrSite).
+   */
+  originAccessControlId?: Input<string>;
+  /**
+   * Additional origin path prefix (used by SsrSite).
+   */
+  originPath?: Input<string>;
+  /**
+   * Version token for invalidation (used by SsrSite).
+   */
+  version?: Input<string>;
+}
+
+export type RouterRoute = string | RouterUrlRouteProps | RouterBucketRouteProps;
+
+export interface RouterProps {
+  /**
+   * Optional custom domain managed through Route 53.
+   */
+  domain?: WebsiteDomainProps;
+  /**
+   * Optional inline routes keyed by path pattern.
+   * Sites register lazily via the KV store; inline routes are for
+   * URL-based or bucket-based origins that aren't managed by StaticSite.
+   */
+  routes?: Record<string, RouterRoute>;
+  /**
+   * Optional edge behavior shared by the router's default behavior.
+   */
+  edge?: WebsiteEdgeProps;
+  /**
+   * Optional invalidation behavior for route updates.
+   * @default false
+   */
+  invalidation?: false | WebsiteInvalidationProps;
+  /**
+   * User-defined tags applied to created resources.
+   */
+  tags?: Record<string, string>;
+}
+
+export type StaticSiteRouteTarget = RouterBucketRouteProps;
+
+export interface SsrSiteRouteTargets {
+  server: RouterUrlRouteProps;
+  assets?: {
+    pattern: string;
+    route: RouterBucketRouteProps;
+  };
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AWS/index.ts b/.repos/alchemy-effect/packages/alchemy/src/AWS/index.ts
new file mode 100644
index 00000000000..f22271443e6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AWS/index.ts
@@ -0,0 +1,36 @@
+export * from "./Arn.ts";
+export * from "./Assets.ts";
+export * from "./Bootstrap.ts";
+export * from "./Context.ts";
+export * from "./Environment.ts";
+export * from "./Providers.ts";
+
+export { Region } from "@distilled.cloud/aws/Region";
+
+export * as ACM from "./ACM/index.ts";
+export * as ApiGateway from "./ApiGateway/index.ts";
+export * as AutoScaling from "./AutoScaling/index.ts";
+export * as CloudFront from "./CloudFront/index.ts";
+export * as CloudWatch from "./CloudWatch/index.ts";
+export * as DynamoDB from "./DynamoDB/index.ts";
+export * as EC2 from "./EC2/index.ts";
+export * as ECR from "./ECR/index.ts";
+export * as ECS from "./ECS/index.ts";
+export * as EKS from "./EKS/index.ts";
+export * as ELBv2 from "./ELBv2/index.ts";
+export * as EventBridge from "./EventBridge/index.ts";
+export * as IAM from "./IAM/index.ts";
+export * as IdentityCenter from "./IdentityCenter/index.ts";
+export * as Kinesis from "./Kinesis/index.ts";
+export * as Lambda from "./Lambda/index.ts";
+export * as Logs from "./Logs/index.ts";
+export * as Organizations from "./Organizations/index.ts";
+export * as RDS from "./RDS/index.ts";
+export * as RDSData from "./RDSData/index.ts";
+export * as Route53 from "./Route53/index.ts";
+export * as S3 from "./S3/index.ts";
+export * as Scheduler from "./Scheduler/index.ts";
+export * as SecretsManager from "./SecretsManager/index.ts";
+export * as SNS from "./SNS/index.ts";
+export * as SQS from "./SQS/index.ts";
+export * as Website from "./Website/index.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Action.ts b/.repos/alchemy-effect/packages/alchemy/src/Action.ts
new file mode 100644
index 00000000000..1d68773f790
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Action.ts
@@ -0,0 +1,280 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { Pipeable } from "effect/Pipeable";
+import { toFqn } from "./FQN.ts";
+import type { Input } from "./Input.ts";
+import { CurrentNamespace, type NamespaceNode } from "./Namespace.ts";
+import * as Output from "./Output.ts";
+import { Stack } from "./Stack.ts";
+
+/**
+ * An Action is a node in the dependency graph that runs an Effect with its
+ * resolved input during {@link plan}/{@link apply}. It is similar to a
+ * Resource but without a Provider lifecycle:
+ *
+ *   - It has a LogicalId and typed Input.
+ *   - The body Effect is called when input changes (diff) or `--force` is set.
+ *   - There is no replace/precreate/read/delete: removing an Action from the
+ *     stack simply drops its persisted state without invoking the body.
+ *   - Dependencies pulled in by the init Effect surface as `Req` on the
+ *     call site, exactly like a Resource's provider services.
+ *
+ * Actions are recorded on {@link Stack.actions} and produce a single output
+ * value; `yield*` on the constructor returns `Output<Out>` for use as
+ * input to downstream Resources / Actions.
+ */
+export interface ActionLike<
+  Type extends string = string,
+  In extends object | undefined = any,
+  Out = any,
+> {
+  readonly Kind: "action";
+  readonly Namespace: NamespaceNode | undefined;
+  readonly FQN: string;
+  readonly Type: Type;
+  readonly LogicalId: string;
+  readonly Input: In;
+  /** Resolved runner — populated by the init effect (if any). */
+  readonly Run: (input: In) => Effect.Effect<Out, any, any>;
+  /** @internal phantom */
+  Output: Out;
+}
+
+export const isAction = (value: any): value is ActionLike =>
+  typeof value === "object" && value !== null && value?.Kind === "action";
+
+/** Body function — runs each time the resolved input changes. */
+export type ActionRunner<In extends object | undefined, Out, Req = any> = (
+  input: In,
+) => Effect.Effect<Out, any, Req>;
+
+/**
+ * Init Effect — declares dependencies via `yield*` and returns the runner.
+ * Lets multiple Action definitions share resolved services.
+ */
+export type ActionInit<In extends object | undefined, Out, Req> = Effect.Effect<
+  ActionRunner<In, Out, any>,
+  any,
+  Req
+>;
+
+// ── Public API ─────────────────────────────────────────────────────────────
+//
+// Direct runner:
+//
+//   const Sync = Action("Sync", Effect.fn(function* (input: { table: string }) {
+//     return { rows: 42 };
+//   }));
+//
+// Init constructor — pulls in dependencies, returns the runner. The init
+// Effect's `Req` channel bubbles up to the call site:
+//
+//   const Sync = Action("Sync", Effect.gen(function* () {
+//     const db = yield* Database;
+//     return Effect.fn(function* (input: { table: string }) {
+//       return { rows: yield* db.count(input.table) };
+//     });
+//   }));
+//
+// Either way, call it inside a stack to register an instance — `yield*`
+// returns `Output<Out>` ready to feed into downstream nodes:
+//
+//   const rows = yield* Sync({ table: bucket.name });
+//   // rows: Output<{ rows: number }, never>
+//
+// Tagged form for split contract/implementation:
+//
+//   class Sync extends Action<Sync, { table: string }, { rows: number }>()("Sync") {}
+//   const SyncLive = Sync.make(Effect.gen(function* () { /* ... */ }));
+
+export function Action<
+  Type extends string,
+  In extends object | undefined,
+  Out,
+  Req = never,
+>(
+  type: Type,
+  initOrRun: ActionRunner<In, Out, Req> | ActionInit<In, Out, Req>,
+): ActionClass<never, Type, In, Out, Req>;
+
+export function Action<Self, In extends object | undefined, Out>(): <
+  Type extends string,
+>(
+  type: Type,
+) => ActionClass<Self, Type, In, Out, Self>;
+
+export function Action(...args: any[]): any {
+  if (args.length === 0) {
+    // Tagged form: Action<Self, In, Out>()(type)
+    return (type: string) => makeActionClass(type, undefined);
+  }
+  // Inline form: Action(type, runnerOrInit)
+  const [type, initOrRun] = args as [
+    string,
+    ActionRunner<any, any, any> | ActionInit<any, any, any>,
+  ];
+  return makeActionClass(type, initOrRun);
+}
+
+export interface ActionClass<
+  Self,
+  Type extends string,
+  In extends object | undefined,
+  Out,
+  Req,
+> {
+  readonly Type: Type;
+  /**
+   * Default form — uses `Type` as the LogicalId. One instance per Action
+   * definition (the common case for deploy-time work). Returns the Action's
+   * output as `Output<Out>`.
+   */
+  (input: { [k in keyof In]: Input<In[k]> }): Effect.Effect<
+    Output.ToOutput<Out, never>,
+    never,
+    Req | Stack
+  >;
+  /**
+   * Explicit-id form — register multiple instances of the same Action
+   * definition under distinct logical ids.
+   */
+  (
+    id: string,
+    input: { [k in keyof In]: Input<In[k]> },
+  ): Effect.Effect<Output.ToOutput<Out, never>, never, Req | Stack>;
+  /**
+   * Tagged-only: bind an init Effect to this Action's Self tag. Add the
+   * returned Layer to the stack's `providers`.
+   */
+  make: [Self] extends [never]
+    ? never
+    : <R = never>(
+        init: ActionRunner<In, Out, R> | ActionInit<In, Out, R>,
+      ) => Layer.Layer<Self, never, R>;
+  /** Tagged-only: the Context tag holding the resolved runner. */
+  readonly Self: [Self] extends [never]
+    ? never
+    : Context.Service<Self, ActionRunner<In, Out, any>>;
+}
+
+const isRunnerEffect = (
+  v: ActionRunner<any, any, any> | ActionInit<any, any, any>,
+): v is ActionInit<any, any, any> => Effect.isEffect(v as any);
+
+const makeActionClass = (
+  type: string,
+  baked: ActionRunner<any, any, any> | ActionInit<any, any, any> | undefined,
+): any => {
+  // Pre-resolve baked init/runner into a single Effect<Runner, _, Req>. Use
+  // Effect.cached so the init's body runs at most once per process — every
+  // action instance after the first reuses the resolved runner without paying
+  // the init cost (or re-yielding its dependencies).
+  let resolveRunner:
+    | Effect.Effect<ActionRunner<any, any, any>, any, any>
+    | undefined;
+  if (baked !== undefined) {
+    resolveRunner = isRunnerEffect(baked)
+      ? Effect.runSync(Effect.cached(baked))
+      : Effect.succeed(baked);
+  }
+
+  // Tagged form needs a Context tag so the user can supply the runner
+  // through a Layer. Inline form bakes the runner in and skips the tag.
+  const SelfTag = baked
+    ? undefined
+    : Context.Service<any, ActionRunner<any, any, any>>(
+        `alchemy/Action<${type}>`,
+      );
+
+  const constructor = (...args: [any] | [string, any]) => {
+    const [id, input] =
+      args.length === 1 ? [type, args[0]] : (args as [string, any]);
+    return Effect.gen(function* () {
+      const run = resolveRunner
+        ? yield* resolveRunner
+        : ((yield* SelfTag!) as ActionRunner<any, any, any>);
+      return yield* registerAction(type, id, input, run);
+    });
+  };
+
+  const extra: Record<string, any> = { Type: type };
+  if (SelfTag) {
+    extra.Self = SelfTag;
+    // `.make(initOrRun)` — accepts either a direct runner or an init Effect.
+    // For init form we use `Layer.effect` so the init's Req surfaces on the
+    // Layer; for runners we use `Layer.succeed`.
+    extra.make = <R>(
+      initOrRun: ActionRunner<any, any, R> | ActionInit<any, any, R>,
+    ) =>
+      isRunnerEffect(initOrRun)
+        ? Layer.effect(SelfTag, initOrRun as any)
+        : Layer.succeed(SelfTag, initOrRun as ActionRunner<any, any, any>);
+  }
+  return Object.assign(constructor, extra);
+};
+
+const registerAction = <
+  Type extends string,
+  In extends object | undefined,
+  Out,
+>(
+  type: Type,
+  id: string,
+  input: any,
+  run: ActionRunner<In, Out, any>,
+): Effect.Effect<Output.ToOutput<Out, never>, never, Stack> =>
+  Effect.gen(function* () {
+    const stack = yield* Stack;
+    const namespace = yield* CurrentNamespace;
+    const fqn = toFqn(namespace, id);
+
+    const actions = (stack.actions ??= {});
+    const existing = actions[fqn];
+    if (existing)
+      return Output.of(existing as any) as unknown as Output.ToOutput<
+        Out,
+        never
+      >;
+
+    // FQN collision check: actions share the same FQN namespace as resources
+    // so the dependency graph stays unified. Rejecting overlaps here makes
+    // the constraint obvious at registration time.
+    if (stack.resources[fqn]) {
+      return yield* Effect.die(
+        new Error(
+          `Action '${fqn}' collides with a Resource of the same logical id`,
+        ),
+      );
+    }
+
+    const target: ActionLike<Type, In, Out> = {
+      Kind: "action" as const,
+      Type: type,
+      Namespace: namespace,
+      FQN: fqn,
+      LogicalId: id,
+      Input: input,
+      Run: run,
+      Output: undefined as any,
+    };
+    (target as any).toString = () => `Action<${type}>(${id})`;
+
+    actions[fqn] = target as any;
+    // `yield* Sync({...})` returns `Output<Out>`. The engine writes the
+    // materialized value into `tracker[fqn]` during apply; `Output.of(action)`
+    // resolves a ResourceExpr by looking up `outputs[fqn]` — which is
+    // precisely that materialized value. Property access into the returned
+    // Output chains through the standard PropExpr proxy.
+    return Output.of(target as any) as unknown as Output.ToOutput<Out, never>;
+  });
+
+/**
+ * Pipeable Action instance used internally by Plan/Apply. Users get an
+ * `Output<Out>` from `yield*` and don't normally see this.
+ */
+export type Action<
+  Type extends string = string,
+  In extends object | undefined = any,
+  Out = any,
+> = Pipeable & ActionLike<Type, In, Out>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AdoptPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/AdoptPolicy.ts
new file mode 100644
index 00000000000..5ed3e84934c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AdoptPolicy.ts
@@ -0,0 +1,148 @@
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+
+/**
+ * AdoptPolicy controls whether the engine should "adopt" pre-existing cloud
+ * resources that conflict with this stack instead of failing.
+ *
+ * The engine always calls a provider's `read` lifecycle operation when there
+ * is no prior state and `read` is implemented. The provider's job is to
+ * report two things:
+ *
+ *   1. Whether the resource exists (returns attributes vs. `undefined`).
+ *   2. Whether *we* own it (plain attributes vs. {@link Unowned}-branded).
+ *
+ * The engine then routes:
+ *
+ *   | `read` outcome      | `adopt: false` | `adopt: true`     |
+ *   | ------------------- | -------------- | ----------------- |
+ *   | undefined           | create         | create            |
+ *   | owned (plain attrs) | silent adopt   | silent adopt      |
+ *   | {@link Unowned}     | fail           | takeover (adopt)  |
+ *
+ * "Owned" means a provider has affirmatively determined the resource was
+ * created by this stack/stage/logical-id (typically by inspecting tags or
+ * naming conventions). Resources without ownership semantics simply always
+ * return plain attrs — they are treated as owned by default, so silent
+ * adoption is the norm and `--adopt` is unnecessary.
+ *
+ * The policy can be overridden per-effect via {@link adopt} — most commonly
+ * applied at the resource or stack scope.
+ */
+export class AdoptPolicy extends Context.Service<AdoptPolicy, boolean>()(
+  "AdoptPolicy",
+) {}
+
+/**
+ * Engine-raised failure produced when `read` reports an existing resource
+ * marked as {@link Unowned} and `adopt` is `false`. Surface this to the user
+ * to indicate they should either re-tag the cloud resource, pick a different
+ * physical name, or re-run with `--adopt` (or `adopt(true)`) to force a
+ * takeover.
+ */
+export class OwnedBySomeoneElse extends Data.TaggedError("OwnedBySomeoneElse")<{
+  /** A human-readable description of why the resource cannot be adopted. */
+  message: string;
+  /** The Resource Type (e.g. `AWS.S3.Bucket`). */
+  resourceType?: string;
+  /** The logical ID of the conflicting resource. */
+  logicalId?: string;
+  /** The physical name/identifier of the conflicting resource. */
+  physicalName?: string;
+}> {}
+
+/**
+ * Private symbol used to brand attribute objects returned by `read` as
+ * "exists in cloud, but not owned by this stack/stage/logical-id".
+ *
+ * Deliberately *not* registered via `Symbol.for` — the brand is an
+ * engine-internal routing hint and must not be observable or
+ * forgeable from outside this module. The engine strips it before any
+ * state persistence (see {@link stripUnowned}) so it never leaks into
+ * the state store, JSON serialization, or downstream `Output`s.
+ */
+const UnownedTag: unique symbol = Symbol("alchemy/Unowned");
+
+/**
+ * Brand a `read` return value as belonging to a different owner.
+ *
+ * Use this in a provider's `read` implementation when the resource exists in
+ * the cloud but a positive ownership check (e.g. tag inspection) shows it
+ * was *not* created by this stack/stage/logical-id:
+ *
+ * ```ts
+ * read: Effect.fnUntraced(function* ({ id, output, olds }) {
+ *   const settings = yield* getScriptSettings({ ... }).pipe(
+ *     Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
+ *   );
+ *   if (!settings) return undefined;
+ *
+ *   const attrs = { workerName, ...buildAttrs(settings) };
+ *   return hasAlchemyWorkerTags(id, settings.tags) ? attrs : Unowned(attrs);
+ * }),
+ * ```
+ *
+ * The returned value is structurally still `T` — there is no wrapper to
+ * unwrap. The brand is a non-enumerable symbol that the engine inspects
+ * during planning to decide whether to take over (`adopt: true`) or fail
+ * loudly (`adopt: false`).
+ *
+ * Resources without ownership semantics should simply return plain attrs —
+ * the engine treats them as owned and silent adoption is the default.
+ */
+export const Unowned: {
+  <T extends object>(attrs: T): T;
+  is: (value: unknown) => boolean;
+} = Object.assign(
+  <T extends object>(attrs: T): T => {
+    const cloned = { ...attrs } as T;
+    Object.defineProperty(cloned, UnownedTag, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false,
+    });
+    return cloned;
+  },
+  {
+    is: (value: unknown): boolean =>
+      typeof value === "object" &&
+      value !== null &&
+      (value as any)[UnownedTag] === true,
+  },
+);
+
+/**
+ * Strip the {@link Unowned} brand from an attributes object before persisting
+ * it — state should not carry per-deploy ownership-routing metadata.
+ *
+ * The brand is intentionally non-enumerable, so a plain spread already
+ * drops it; the additional `delete` is defense-in-depth in case a future
+ * change makes the descriptor enumerable. Always returns a fresh object
+ * (never mutates the input).
+ */
+export const stripUnowned = <T extends object>(attrs: T): T => {
+  const out: any = { ...attrs };
+  if (UnownedTag in out) delete out[UnownedTag];
+  return out;
+};
+
+export const adopt: {
+  (
+    enabled?: boolean,
+  ): <A, E, R = never>(
+    effect: Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E, R>;
+  <R1 = never>(
+    enabled: Effect.Effect<boolean, never, R1>,
+  ): <A, E, R2 = never>(
+    effect: Effect.Effect<A, E, R2>,
+  ) => Effect.Effect<A, E, R1 | R2>;
+} = ((enabled: boolean | Effect.Effect<boolean, never, any> = true) =>
+  (eff: Effect.Effect<any, any, any>) =>
+    eff.pipe(
+      typeof enabled === "boolean"
+        ? Effect.provideService(AdoptPolicy, enabled ?? true)
+        : Effect.provideServiceEffect(AdoptPolicy, enabled),
+    )) as any;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/AlchemyContext.ts b/.repos/alchemy-effect/packages/alchemy/src/AlchemyContext.ts
new file mode 100644
index 00000000000..9d54f7d9f0b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/AlchemyContext.ts
@@ -0,0 +1,40 @@
+import * as EffectContext from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+
+export class AlchemyContext extends EffectContext.Service<
+  AlchemyContext,
+  {
+    dotAlchemy: string;
+    dev: boolean;
+    /**
+     * Global default for the {@link import("./AdoptPolicy.ts").AdoptPolicy}
+     * service. When `true`, resources without prior state will be adopted by
+     * calling their `read` lifecycle operation; if that returns attributes
+     * (and does not fail with `OwnedBySomeoneElse`), those attributes are
+     * persisted as the resource's initial `created` state.
+     *
+     * The CLI's `--adopt` flag flows in through this field. Per-resource
+     * overrides via the `adopt(enabled)` combinator still take precedence.
+     */
+    adopt: boolean;
+  }
+>()("alchemy/Context") {}
+
+export const AlchemyContextLive = Layer.effect(
+  AlchemyContext,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = path.join(process.cwd(), ".alchemy");
+    yield* fs.makeDirectory(dir, { recursive: true });
+    return {
+      dotAlchemy: dir,
+      updateStateStore: false,
+      dev: false,
+      adopt: false,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Apply.ts b/.repos/alchemy-effect/packages/alchemy/src/Apply.ts
new file mode 100644
index 00000000000..e85efb1f652
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Apply.ts
@@ -0,0 +1,1661 @@
+import * as Cause from "effect/Cause";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import type { Simplify } from "effect/Types";
+import {
+  Artifacts,
+  ArtifactStore,
+  createArtifactStore,
+  ensureArtifactStore,
+  makeScopedArtifacts,
+} from "./Artifacts.ts";
+import {
+  type PlanStatusSession,
+  type ScopedPlanStatusSession,
+  Cli,
+} from "./Cli/Cli.ts";
+import type { ApplyStatus } from "./Cli/Event.ts";
+import { havePropsChanged } from "./Diff.ts";
+import { toFqn } from "./FQN.ts";
+import type { Input } from "./Input.ts";
+import { generateInstanceId, InstanceId } from "./InstanceId.ts";
+import * as Output from "./Output.ts";
+import {
+  type ActionApply,
+  type Apply,
+  type Delete,
+  type Plan,
+} from "./Plan.ts";
+import { findProviderByType } from "./Provider.ts";
+import type { ResourceBinding } from "./Resource.ts";
+import { Stack } from "./Stack.ts";
+import { Stage } from "./Stage.ts";
+import {
+  type ActionState,
+  type CreatedResourceState,
+  type CreatingResourceState,
+  type DeletingResourceState,
+  type PersistedState,
+  type RanActionState,
+  type ReplacedResourceState,
+  type ReplacingResourceState,
+  type ResourceState,
+  type RunningActionState,
+  type UpdatedResourceState,
+  type UpdatingReourceState,
+  State,
+  StateStoreError,
+} from "./State/index.ts";
+import { type ResourceOp, recordResourceOp } from "./Telemetry/Metrics.ts";
+import { hashInput } from "./Util/hash.ts";
+
+export type ApplyEffect<
+  P extends Plan,
+  Err = never,
+  Req = never,
+> = Effect.Effect<
+  {
+    [k in keyof AppliedPlan<P>]: AppliedPlan<P>[k];
+  },
+  Err,
+  Req
+>;
+
+export type AppliedPlan<P extends Plan> = {
+  [id in keyof P["resources"]]: P["resources"][id] extends
+    | Delete
+    | undefined
+    | never
+    ? never
+    : Simplify<P["resources"][id]["resource"]["attr"]>;
+};
+
+interface ResourceTracker {
+  output: any;
+  props: any;
+  bindings: ResourceBinding[];
+  instanceId: string;
+}
+
+const provideLifecycleScope =
+  (fqn: string, instanceId: string) =>
+  <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E, Exclude<R, InstanceId | Artifacts>> =>
+    Effect.serviceOption(ArtifactStore).pipe(
+      Effect.map(Option.getOrElse(createArtifactStore)),
+      Effect.flatMap((store) =>
+        effect.pipe(
+          Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)),
+          Effect.provideService(InstanceId, instanceId),
+        ),
+      ),
+    ) as Effect.Effect<A, E, Exclude<R, InstanceId | Artifacts>>;
+
+/**
+ * Instruments a single provider lifecycle call with an OTel span
+ * (`provider.<op>`), the resource counter / duration histogram, and the
+ * scoped artifacts/instance services normally supplied by
+ * {@link provideLifecycleScope}.
+ *
+ * This is the only call site through which provider lifecycle methods
+ * are dispatched, so wrapping it here gives us a fully-instrumented
+ * toolchain without touching any individual provider implementation.
+ */
+const instrumentLifecycle =
+  (
+    op: ResourceOp,
+    fqn: string,
+    resourceType: string,
+    logicalId: string,
+    instanceId: string,
+  ) =>
+  <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E, Exclude<R, InstanceId | Artifacts>> =>
+    effect.pipe(
+      provideLifecycleScope(fqn, instanceId),
+      recordResourceOp(resourceType, op),
+      Effect.withSpan(`provider.${op}`, {
+        attributes: {
+          "alchemy.resource.fqn": fqn,
+          "alchemy.resource.type": resourceType,
+          "alchemy.resource.logical_id": logicalId,
+          "alchemy.resource.instance_id": instanceId,
+          "alchemy.resource.op": op,
+        },
+      }),
+    );
+
+export const apply = <P extends Plan>(
+  plan: P,
+): Effect.Effect<
+  Input.Resolve<P["output"]>,
+  Output.InvalidReferenceError | Output.MissingSourceError | StateStoreError,
+  Cli | State | Stack | Stage
+> =>
+  Effect.gen(function* () {
+    const cli = yield* Cli;
+    const session = yield* cli.startApplySession(plan);
+    const state = yield* yield* State;
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    const stackName = stack.name;
+
+    const tracker: Record<string, ResourceTracker> = {};
+    const terminalStatuses = new Map<
+      string,
+      {
+        id: string;
+        type: string;
+        status: Extract<ApplyStatus, "created" | "updated" | "ran" | "skipped">;
+      }
+    >();
+
+    yield* executePlan(
+      plan,
+      tracker,
+      terminalStatuses,
+      session,
+      state,
+      stackName,
+      stage,
+    );
+
+    // TODO(sam): support roll back to previous state if errors occur during expansion
+    // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
+    // TODO(sam): should pivot be done separately? E.g shift traffic?
+
+    yield* collectGarbage(plan, session);
+
+    yield* converge(
+      plan,
+      tracker,
+      terminalStatuses,
+      session,
+      state,
+      stackName,
+      stage,
+    );
+
+    yield* Effect.forEach(
+      Array.from(terminalStatuses.values()),
+      ({ id, type, status }) =>
+        session.emit({ kind: "status-change", id, type, status }),
+      { concurrency: "unbounded" },
+    );
+
+    yield* session.done();
+
+    if (!plan.output) {
+      return undefined;
+    }
+
+    const outputs = Object.fromEntries(
+      Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]),
+    );
+    const resolved = yield* Output.evaluate(plan.output, outputs);
+
+    // Persist the stack's evaluated outputs so cross-stack references
+    // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
+    // can read them back out of the state store.
+    yield* state.setOutput({ stack: stackName, stage, value: resolved });
+
+    return resolved;
+  }).pipe(
+    ensureArtifactStore,
+    Effect.withSpan("apply", {
+      attributes: {
+        "alchemy.resources.count": Object.keys(plan.resources).length,
+        "alchemy.deletions.count": Object.keys(plan.deletions).length,
+      },
+    }),
+  );
+
+// ── Phase 1: concurrent initial execution ──────────────────────────────────
+//
+// Each resource gets a Deferred<void> that signals "I have some output
+// available in `tracker`." Resources with `precreate` signal early so that
+// downstream resources can resolve stable identifiers without deadlocking.
+// The actual output lives in the mutable `tracker` map, not in the Deferred.
+
+const executePlan = Effect.fnUntraced(function* (
+  plan: Plan,
+  tracker: Record<string, ResourceTracker>,
+  terminalStatuses: Map<
+    string,
+    {
+      id: string;
+      type: string;
+      status: Extract<ApplyStatus, "created" | "updated" | "ran" | "skipped">;
+    }
+  >,
+  session: PlanStatusSession,
+  state: {
+    set: <V extends PersistedState>(req: {
+      stack: string;
+      stage: string;
+      fqn: string;
+      value: V;
+    }) => Effect.Effect<V, StateStoreError, never>;
+  },
+  stackName: string,
+  stage: string,
+) {
+  // Resources and tasks share the same FQN namespace and DAG, so the
+  // scheduler tracks them together. Each entry gets a single Deferred that
+  // signals "my output is available in `tracker`."
+  const allNodes: Record<string, Apply | ActionApply> = {
+    ...plan.resources,
+    ...plan.actions,
+  };
+
+  const ready = Object.fromEntries(
+    yield* Effect.all(
+      Object.keys(allNodes).map((fqn) =>
+        Effect.map(Deferred.make<void>(), (d) => [fqn, d] as const),
+      ),
+    ),
+  ) as Record<string, Deferred.Deferred<void>>;
+
+  // `readyStable` fires only when a node has reached its TERMINAL output —
+  // resources after `reconcile`, tasks after the body completes. Resource
+  // precreate stubs do NOT signal `readyStable`, so any consumer that
+  // requires stable inputs (e.g. Tasks) waits past the precreate phase.
+  const readyStable = Object.fromEntries(
+    yield* Effect.all(
+      Object.keys(allNodes).map((fqn) =>
+        Effect.map(Deferred.make<void>(), (d) => [fqn, d] as const),
+      ),
+    ),
+  ) as Record<string, Deferred.Deferred<void>>;
+
+  const getOutputs = (): Record<string, any> =>
+    Object.fromEntries(
+      Object.entries(tracker).map(([fqn, t]) => [fqn, t.output]),
+    );
+
+  const waitForDeps = (fqns: string[]) =>
+    Effect.all(
+      fqns
+        .filter((fqn) => fqn in ready)
+        .map((fqn) =>
+          // Non-cycle upstreams must be observed at their TERMINAL output
+          // (`readyStable`), not their early precreate signal (`ready`). This
+          // is what makes a failed upstream actually interrupt its downstream:
+          // a resource with `precreate` resolves `ready` before its real
+          // `reconcile` runs, so a downstream waiting on `ready` would proceed
+          // (and even finish) even though the upstream's reconcile later
+          // failed. Waiting on `readyStable` means the downstream's
+          // `waitForDeps` short-circuits with the upstream's failure cause.
+          //
+          // Cycle members are the exception: peers in an SCC depend on each
+          // other, so they must rendezvous on the early `ready`/precreate
+          // signal to break the deadlock. Phase 3 (`converge`) re-runs them
+          // against final outputs once the cycle settles.
+          plan.cycleMembers.has(fqn)
+            ? Deferred.await(ready[fqn])
+            : Deferred.await(readyStable[fqn]),
+        ),
+      { concurrency: "unbounded" },
+    );
+
+  const waitForStableDeps = (fqns: string[]) =>
+    Effect.all(
+      fqns
+        .filter((fqn) => fqn in readyStable)
+        .map((fqn) => Deferred.await(readyStable[fqn])),
+      { concurrency: "unbounded" },
+    );
+
+  const failures: LifecycleFailure[] = [];
+
+  yield* Effect.all(
+    Object.entries(allNodes).map(([fqn, node]) =>
+      (node as ActionApply).kind === "action"
+        ? executeActionNode(
+            fqn,
+            node as ActionApply,
+            tracker,
+            ready,
+            readyStable,
+            terminalStatuses,
+            session,
+            state,
+            stackName,
+            stage,
+            getOutputs,
+            waitForStableDeps,
+            failures,
+          )
+        : executeNode(
+            fqn,
+            node as Apply,
+            tracker,
+            ready,
+            readyStable,
+            terminalStatuses as any,
+            session,
+            state,
+            stackName,
+            stage,
+            getOutputs,
+            waitForDeps,
+            failures,
+            plan.cycleMembers.has(fqn),
+          ),
+    ),
+    { concurrency: "unbounded" },
+  );
+
+  if (failures.length > 0) {
+    // Aggregate every collected lifecycle failure into a single parallel Cause
+    // so the apply ends with one combined error containing every distinct
+    // failure / defect that occurred across the concurrent fibers.
+    yield* Effect.failCause(failures.map((f) => f.cause).reduce(Cause.combine));
+  }
+});
+
+interface LifecycleFailure {
+  fqn: string;
+  logicalId: string;
+  type: string;
+  cause: Cause.Cause<unknown>;
+}
+
+const executeNode = (
+  fqn: string,
+  node: Apply,
+  tracker: Record<string, ResourceTracker>,
+  ready: Record<string, Deferred.Deferred<void>>,
+  readyStable: Record<string, Deferred.Deferred<void>>,
+  terminalStatuses: Map<
+    string,
+    {
+      id: string;
+      type: string;
+      status: Extract<ApplyStatus, "created" | "updated">;
+    }
+  >,
+  session: PlanStatusSession,
+  state: {
+    set: <V extends ResourceState>(req: {
+      stack: string;
+      stage: string;
+      fqn: string;
+      value: V;
+    }) => Effect.Effect<V, StateStoreError, never>;
+  },
+  stackName: string,
+  stage: string,
+  getOutputs: () => Record<string, any>,
+  waitForDeps: (fqns: string[]) => Effect.Effect<void[], never, never>,
+  failures: LifecycleFailure[],
+  inCycle: boolean,
+): Effect.Effect<void, never, never> =>
+  Effect.gen(function* () {
+    const logicalId = node.resource.LogicalId;
+    const namespace = node.resource.Namespace;
+
+    const commit = <S extends ResourceState>(value: Omit<S, "namespace">) =>
+      state.set({
+        stack: stackName,
+        stage,
+        fqn,
+        value: { ...value, namespace } as S,
+      });
+
+    const scopedSession = {
+      ...session,
+      note: (note: string) =>
+        session.emit({ id: logicalId, kind: "annotate", message: note }),
+    } satisfies ScopedPlanStatusSession;
+
+    const report = (status: ApplyStatus) =>
+      session.emit({
+        kind: "status-change",
+        id: logicalId,
+        type: node.resource.Type,
+        status,
+      });
+
+    const markTerminal = (status: "created" | "updated") =>
+      Effect.gen(function* () {
+        terminalStatuses.set(fqn, {
+          id: logicalId,
+          type: node.resource.Type,
+          status,
+        });
+        // Emit immediately so the CLI surfaces the terminal status as soon
+        // as the resource is actually done — instead of batching every
+        // resource's "created"/"updated" event to the end of apply(), which
+        // makes long-running siblings appear stuck in "creating" until the
+        // entire deploy finishes.
+        //
+        // Cycle members are exempt: their initial pass produces an
+        // intermediate result that Phase 3 (`converge`) will overwrite once
+        // the SCC reaches a fixed point. Emitting "created"/"updated" here
+        // would surface that intermediate state to the CLI before the real
+        // terminal status is known. Their final status is flushed from
+        // `terminalStatuses` after `converge` completes.
+        if (inCycle) return;
+        yield* session.emit({
+          kind: "status-change",
+          id: logicalId,
+          type: node.resource.Type,
+          status,
+        });
+      });
+
+    const signalReady = Deferred.succeed(ready[fqn], void 0);
+    // Signal only after reconcile completes — never during precreate. Tasks
+    // (and any other consumer that calls `waitForStableDeps`) block on this
+    // so they observe the resource's final attrs rather than a stub.
+    const signalReadyStable = Deferred.succeed(readyStable[fqn], void 0);
+
+    const storeAndSignal = (t: ResourceTracker) =>
+      Effect.gen(function* () {
+        tracker[fqn] = t;
+        yield* signalReady;
+      });
+
+    // ── noop ──
+
+    if (node.action === "noop") {
+      // No work to do — the persisted attr is already stable.
+      yield* signalReadyStable;
+      yield* storeAndSignal({
+        output: node.state.attr,
+        props: node.state.props,
+        bindings: node.state.bindings ?? [],
+        instanceId: node.state.instanceId,
+      });
+      return;
+    }
+
+    const allUpstreamFqns = () => {
+      const propDeps = Object.keys(Output.resolveUpstream(node.props));
+      const bindingDeps = Object.keys(Output.resolveUpstream(node.bindings));
+      return [...new Set([...propDeps, ...bindingDeps])];
+    };
+
+    // ── instance ID ──
+
+    const instanceId = yield* Effect.gen(function* () {
+      if (node.action === "create" && !node.state?.instanceId) {
+        const id = yield* generateInstanceId();
+        yield* commit<CreatingResourceState>({
+          status: "creating",
+          fqn,
+          logicalId,
+          instanceId: id,
+          downstream: node.downstream,
+          props: node.props,
+          providerVersion: node.provider.version ?? 0,
+          resourceType: node.resource.Type,
+          bindings: excludeDeletedBindings(node.bindings),
+          removalPolicy: node.resource.RemovalPolicy,
+        });
+        return id;
+      } else if (node.action === "replace") {
+        if (
+          (node.state.status === "replaced" ||
+            node.state.status === "replacing") &&
+          !node.restart
+        ) {
+          // Ordinary replacement recovery keeps using the same replacement
+          // generation. Only `restart` is allowed to mint a new instance id.
+          return node.state.instanceId;
+        }
+        const id = yield* generateInstanceId();
+        yield* commit<ReplacingResourceState>({
+          status: "replacing",
+          fqn,
+          logicalId,
+          instanceId: id,
+          downstream: node.downstream,
+          props: node.props,
+          providerVersion: node.provider.version ?? 0,
+          resourceType: node.resource.Type,
+          bindings: excludeDeletedBindings(node.bindings),
+          old: node.state,
+          deleteFirst: node.deleteFirst,
+          removalPolicy: node.resource.RemovalPolicy,
+        });
+        return id;
+      } else if (node.state?.instanceId) {
+        return node.state.instanceId;
+      }
+      return yield* Effect.die(
+        `Instance ID not found for resource '${logicalId}' and action is '${node.action}'`,
+      );
+    });
+
+    // ── lifecycle ──
+
+    yield* Effect.gen(function* () {
+      // ── create ──
+      if (node.action === "create") {
+        if (!node.state) {
+          // First persistence point for a brand new logical resource. Once this is
+          // written, retries know they should resume creation instead of planning
+          // another fresh create from scratch.
+          yield* commit<CreatingResourceState>({
+            status: "creating",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: node.props,
+            attr: undefined,
+            providerVersion: node.provider.version ?? 0,
+            bindings: excludeDeletedBindings(node.bindings),
+            downstream: node.downstream,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+        }
+
+        let attr: any = node.state?.attr;
+
+        if (attr !== undefined) {
+          // Precreate/read may already have produced a usable output snapshot. Publish
+          // it early so downstream resources can start resolving against it.
+          yield* storeAndSignal({
+            output: attr,
+            props: {},
+            bindings: [],
+            instanceId,
+          });
+        }
+
+        if (node.provider.precreate && attr === undefined) {
+          // Some resources need a placeholder physical resource before their real
+          // create can finish. Persist that stub so downstream evaluation can proceed.
+          yield* report("pre-creating");
+          attr = yield* node.provider
+            .precreate({
+              id: logicalId,
+              news: node.props,
+              session: scopedSession,
+              instanceId,
+              bindings: excludeDeletedBindings(node.bindings),
+            })
+            .pipe(
+              instrumentLifecycle(
+                "precreate",
+                fqn,
+                node.resource.Type,
+                logicalId,
+                instanceId,
+              ),
+            );
+          yield* commit<CreatingResourceState>({
+            status: "creating",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: node.props,
+            attr,
+            providerVersion: node.provider.version ?? 0,
+            bindings: excludeDeletedBindings(node.bindings),
+            downstream: node.downstream,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+          yield* storeAndSignal({
+            output: attr,
+            props: {},
+            bindings: [],
+            instanceId,
+          });
+        }
+
+        // While we're waiting on upstream outputs the resource isn't actually
+        // creating anything yet — surface that as "pending" so the CLI doesn't
+        // look stuck in "creating" for slow-upstream deploys.
+        yield* report("pending");
+
+        // Create runs against fully resolved upstream outputs and bindings, not the
+        // raw Output expressions stored in the plan.
+        yield* waitForDeps(allUpstreamFqns());
+
+        yield* report("creating");
+        const outputs = getOutputs();
+
+        const news = (yield* Output.evaluate(node.props, outputs)) as Record<
+          string,
+          any
+        >;
+
+        const bindingOutputs = excludeDeletedBindings(
+          yield* Output.evaluate(node.bindings, outputs),
+        );
+
+        attr = yield* node.provider
+          .reconcile({
+            id: logicalId,
+            news,
+            instanceId,
+            bindings: bindingOutputs,
+            session: scopedSession,
+            olds: undefined,
+            output: attr,
+          })
+          .pipe(
+            instrumentLifecycle(
+              "create",
+              fqn,
+              node.resource.Type,
+              logicalId,
+              instanceId,
+            ),
+          );
+
+        yield* commit<CreatedResourceState>({
+          status: "created",
+          fqn,
+          logicalId,
+          instanceId,
+          resourceType: node.resource.Type,
+          props: news,
+          attr,
+          bindings: excludeDeletedBindings(node.bindings),
+          providerVersion: node.provider.version ?? 0,
+          downstream: node.downstream,
+          removalPolicy: node.resource.RemovalPolicy,
+        });
+
+        tracker[fqn] = {
+          output: attr,
+          props: news,
+          bindings: bindingOutputs,
+          instanceId,
+        };
+        yield* signalReady;
+        yield* signalReadyStable;
+
+        yield* markTerminal("created");
+        return;
+      }
+
+      // ── update ──
+      if (node.action === "update") {
+        // Cycle members publish their previous live attr *before* waiting on
+        // upstreams so the SCC can converge — peers in the cycle would
+        // otherwise deadlock waiting on each other. Phase 3 (`converge`)
+        // re-runs each peer's update against fresh outputs once everyone
+        // has settled.
+        //
+        // Linear (DAG) update nodes skip this entirely and simply wait for
+        // fresh upstream outputs, mirroring the create flow. This is the
+        // important property: a downstream of a non-cycle update never
+        // observes the upstream's stale attr, which prevents wasted/
+        // destructive intermediate updates (e.g. a Worker deploying with
+        // stale Build assets).
+        if (inCycle) {
+          yield* storeAndSignal({
+            output: node.state.attr,
+            props: node.state.props,
+            bindings: node.state.bindings ?? [],
+            instanceId,
+          });
+        }
+
+        // See create-flow note: while we're waiting on upstream outputs
+        // this resource isn't actually updating yet.
+        yield* report("pending");
+        yield* waitForDeps(allUpstreamFqns());
+        const outputs = getOutputs();
+
+        const news = (yield* Output.evaluate(node.props, outputs)) as Record<
+          string,
+          any
+        >;
+
+        yield* node.state.status === "replaced"
+          ? commit<ReplacedResourceState>({
+              // Keep the replacement wrapper intact while changing the live
+              // replacement props; GC still has older generations to delete.
+              ...node.state,
+              attr: node.state.attr,
+              props: news,
+            })
+          : commit<UpdatingReourceState>({
+              // For ordinary updates we snapshot the previously stable props/attrs
+              // once, so retries can continue from the same baseline.
+              status: "updating",
+              fqn,
+              logicalId,
+              instanceId,
+              resourceType: node.resource.Type,
+              props: news,
+              attr: node.state.attr,
+              providerVersion: node.provider.version ?? 0,
+              bindings: excludeDeletedBindings(node.bindings),
+              downstream: node.downstream,
+              old:
+                node.state.status === "updating" ? node.state.old : node.state,
+              removalPolicy: node.resource.RemovalPolicy,
+            });
+
+        yield* report("updating");
+
+        const previousProps =
+          node.state.status === "created" ||
+          node.state.status === "updated" ||
+          node.state.status === "replaced"
+            ? node.state.props
+            : node.state.old.props;
+
+        // Providers receive the resolved binding payload for this exact pass, while
+        // `previousProps` tells them what state the live resource is being updated from.
+        const bindingOutputs = excludeDeletedBindings(
+          yield* Output.evaluate(node.bindings, outputs),
+        );
+
+        const attr = yield* node.provider
+          .reconcile({
+            id: logicalId,
+            news,
+            instanceId,
+            bindings: bindingOutputs,
+            session: scopedSession,
+            olds: previousProps,
+            output: node.state.attr,
+          })
+          .pipe(
+            instrumentLifecycle(
+              "update",
+              fqn,
+              node.resource.Type,
+              logicalId,
+              instanceId,
+            ),
+          );
+
+        if (node.state.status === "replaced") {
+          yield* commit<ReplacedResourceState>({
+            // The live replacement changed, but cleanup of older generations still
+            // has to continue afterwards.
+            ...node.state,
+            attr,
+            props: news,
+          });
+        } else {
+          yield* commit<UpdatedResourceState>({
+            status: "updated",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: news,
+            attr,
+            bindings: excludeDeletedBindings(node.bindings),
+            providerVersion: node.provider.version ?? 0,
+            downstream: node.downstream,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+        }
+
+        tracker[fqn] = {
+          output: attr,
+          props: news,
+          bindings: bindingOutputs,
+          instanceId,
+        };
+        // Signal here for the linear (non-cycle) path. For in-cycle updates
+        // the deferred has already been resolved by the early `storeAndSignal`
+        // above and `signalReady` is a no-op the second time.
+        yield* signalReady;
+        yield* signalReadyStable;
+
+        yield* markTerminal("updated");
+        return;
+      }
+
+      // ── replace ──
+      if (node.action === "replace") {
+        if (node.state.status === "replaced" && !node.restart) {
+          // The replacement already exists; this pass only needs GC to clean up
+          // older generations, so expose the current replacement and stop here.
+          tracker[fqn] = {
+            output: node.state.attr,
+            props: node.state.props,
+            bindings: node.state.bindings ?? [],
+            instanceId,
+          };
+          yield* signalReady;
+          yield* signalReadyStable;
+          yield* markTerminal("created");
+          return;
+        }
+
+        let replState: ReplacingResourceState;
+        if (node.state.status !== "replacing" || node.restart) {
+          // `restart` deliberately nests the previous top-level replacement state
+          // into `old`, creating a new outer generation to replace it.
+          replState = yield* commit<ReplacingResourceState>({
+            status: "replacing",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: node.props,
+            bindings: excludeDeletedBindings(node.bindings),
+            attr: undefined,
+            providerVersion: node.provider.version ?? 0,
+            deleteFirst: node.deleteFirst,
+            old: node.state,
+            downstream: node.downstream,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+        } else {
+          // Resume the same replacement generation after an interrupted apply.
+          replState = node.state;
+        }
+
+        let attr: any = replState.attr;
+
+        if (attr !== undefined) {
+          // If precreate already ran, expose that intermediate output immediately so
+          // downstream resources can resolve against the same in-flight replacement.
+          yield* storeAndSignal({
+            output: attr,
+            props: {},
+            bindings: [],
+            instanceId,
+          });
+        }
+
+        if (node.provider.precreate && attr === undefined) {
+          yield* report("pre-creating");
+          attr = yield* node.provider
+            .precreate({
+              id: logicalId,
+              news: node.props,
+              session: scopedSession,
+              instanceId,
+              bindings: excludeDeletedBindings(node.bindings),
+            })
+            .pipe(
+              instrumentLifecycle(
+                "precreate",
+                fqn,
+                node.resource.Type,
+                logicalId,
+                instanceId,
+              ),
+            );
+          yield* commit<ReplacingResourceState>({
+            status: "replacing",
+            fqn,
+            logicalId,
+            instanceId,
+            resourceType: node.resource.Type,
+            props: node.props,
+            attr,
+            providerVersion: node.provider.version ?? 0,
+            bindings: excludeDeletedBindings(node.bindings),
+            downstream: node.downstream,
+            old: replState.old,
+            deleteFirst: node.deleteFirst,
+            removalPolicy: node.resource.RemovalPolicy,
+          });
+          yield* storeAndSignal({
+            output: attr,
+            props: {},
+            bindings: [],
+            instanceId,
+          });
+        }
+
+        // See create-flow note: while we're waiting on upstream outputs
+        // the replacement isn't actually being created yet.
+        yield* report("pending");
+
+        // Replacement create is evaluated exactly like create, but against the new
+        // generation's instance id and with the previous generations preserved in `old`.
+        yield* waitForDeps(allUpstreamFqns());
+
+        yield* report("creating replacement");
+        const outputs = getOutputs();
+
+        const news = (yield* Output.evaluate(node.props, outputs)) as Record<
+          string,
+          any
+        >;
+
+        const bindingOutputs = excludeDeletedBindings(
+          yield* Output.evaluate(node.bindings, outputs),
+        );
+
+        attr = yield* node.provider
+          .reconcile({
+            id: logicalId,
+            news,
+            instanceId,
+            bindings: bindingOutputs,
+            session: scopedSession,
+            olds: undefined,
+            output: attr,
+          })
+          .pipe(
+            instrumentLifecycle(
+              "create",
+              fqn,
+              node.resource.Type,
+              logicalId,
+              instanceId,
+            ),
+          );
+
+        yield* commit<ReplacedResourceState>({
+          // Creation of the new generation succeeded; from here on the only remaining
+          // work is draining the old chain via garbage collection.
+          status: "replaced",
+          fqn,
+          logicalId,
+          instanceId,
+          resourceType: node.resource.Type,
+          props: news,
+          attr,
+          providerVersion: node.provider.version ?? 0,
+          bindings: excludeDeletedBindings(node.bindings),
+          downstream: node.downstream,
+          // Preserve the remaining backlog exactly as-is. GC is responsible for
+          // popping one generation at a time until the chain is exhausted.
+          old: replState.old,
+          deleteFirst: node.deleteFirst,
+          removalPolicy: node.resource.RemovalPolicy,
+        });
+
+        tracker[fqn] = {
+          output: attr,
+          props: news,
+          bindings: bindingOutputs,
+          instanceId,
+        };
+        yield* signalReady;
+        yield* signalReadyStable;
+
+        // Keep progress anchored to the live replacement while GC drains the
+        // previous generation(s) in the background.
+        yield* markTerminal("created");
+        return;
+      }
+
+      // @ts-expect-error - node is never, this should be unreachable
+      return yield* Effect.die(`Unknown action: ${node.action}`);
+    });
+  }).pipe(
+    Effect.catchCause((cause) =>
+      // Record the failure, propagate it to any downstream resources waiting on
+      // our Deferred (so their waitForDeps short-circuits instead of deadlocking),
+      // emit a "fail" status to the session, and resolve to void so Effect.all
+      // does not interrupt sibling fibers. The aggregated cause is raised at
+      // the end of executePlan.
+      Effect.gen(function* () {
+        failures.push({
+          fqn,
+          logicalId: node.resource.LogicalId,
+          type: node.resource.Type,
+          cause,
+        });
+        yield* Deferred.failCause(ready[fqn], cause as Cause.Cause<never>);
+        yield* Deferred.failCause(
+          readyStable[fqn],
+          cause as Cause.Cause<never>,
+        );
+        yield* session.emit({
+          kind: "status-change",
+          id: node.resource.LogicalId,
+          type: node.resource.Type,
+          status: "fail",
+        });
+      }),
+    ),
+    Effect.withSpan("apply.resource", {
+      attributes: {
+        "alchemy.resource.fqn": fqn,
+        "alchemy.resource.type": node.resource.Type,
+        "alchemy.resource.logical_id": node.resource.LogicalId,
+        "alchemy.resource.action": node.action,
+      },
+    }),
+  ) as Effect.Effect<void, never, never>;
+
+// ── Task execution ─────────────────────────────────────────────────────────
+//
+// Tasks slot into the same scheduler as resources. They have no provider
+// lifecycle — just a single Effect that runs when inputs change (or when
+// `--force` is set). The output value is written to `tracker[fqn].output`
+// so downstream Output evaluation works identically to resource attrs.
+
+const executeActionNode = (
+  fqn: string,
+  node: ActionApply,
+  tracker: Record<string, ResourceTracker>,
+  ready: Record<string, Deferred.Deferred<void>>,
+  readyStable: Record<string, Deferred.Deferred<void>>,
+  terminalStatuses: Map<
+    string,
+    {
+      id: string;
+      type: string;
+      status: Extract<ApplyStatus, "created" | "updated" | "ran" | "skipped">;
+    }
+  >,
+  session: PlanStatusSession,
+  state: {
+    set: <V extends PersistedState>(req: {
+      stack: string;
+      stage: string;
+      fqn: string;
+      value: V;
+    }) => Effect.Effect<V, StateStoreError, never>;
+  },
+  stackName: string,
+  stage: string,
+  getOutputs: () => Record<string, any>,
+  waitForDeps: (fqns: string[]) => Effect.Effect<void[], never, never>,
+  failures: LifecycleFailure[],
+): Effect.Effect<void, never, any> =>
+  Effect.gen(function* () {
+    const task = node.def;
+    const logicalId = task.LogicalId;
+    const namespace = task.Namespace;
+
+    const commit = <S extends ActionState>(value: Omit<S, "namespace">) =>
+      state.set({
+        stack: stackName,
+        stage,
+        fqn,
+        value: { ...value, namespace } as S,
+      });
+
+    const report = (status: ApplyStatus) =>
+      session.emit({
+        kind: "status-change",
+        id: logicalId,
+        type: task.Type,
+        status,
+      });
+
+    const signalReady = Deferred.succeed(ready[fqn], void 0);
+    const signalReadyStable = Deferred.succeed(readyStable[fqn], void 0);
+
+    if (node.action === "noop") {
+      tracker[fqn] = {
+        output: node.state.output,
+        props: { __input: node.state.input },
+        bindings: [],
+        instanceId: fqn,
+      };
+      yield* signalReady;
+      yield* signalReadyStable;
+      terminalStatuses.set(fqn, {
+        id: logicalId,
+        type: task.Type,
+        status: "skipped",
+      });
+      yield* report("skipped");
+      return;
+    }
+
+    // ── run ──
+    // Tasks wait on `waitForStableDeps` (post-reconcile attrs) for their
+    // upstreams, which is often the slowest dep chain in the deploy.
+    // Surface that as "pending" instead of having the task show no status
+    // until its run actually starts.
+    yield* report("pending");
+    yield* waitForDeps(
+      Object.keys(Output.resolveUpstream(node.input)).filter(
+        (f) => f in readyStable,
+      ),
+    );
+
+    const outputs = getOutputs();
+    const resolvedInput = (yield* Output.evaluate(node.input, outputs)) as any;
+    const inputHashValue = yield* hashInput(resolvedInput);
+
+    yield* commit<RunningActionState>({
+      kind: "action",
+      status: "running",
+      fqn,
+      logicalId,
+      actionType: task.Type,
+      inputHash: inputHashValue,
+      input: resolvedInput,
+      downstream: node.downstream,
+    });
+    yield* report("running");
+
+    const result = yield* task.Run(resolvedInput);
+
+    yield* commit<RanActionState>({
+      kind: "action",
+      status: "ran",
+      fqn,
+      logicalId,
+      actionType: task.Type,
+      inputHash: inputHashValue,
+      input: resolvedInput,
+      output: result,
+      downstream: node.downstream,
+    });
+
+    tracker[fqn] = {
+      output: result,
+      props: { __input: resolvedInput },
+      bindings: [],
+      instanceId: fqn,
+    };
+    yield* signalReady;
+    yield* signalReadyStable;
+    terminalStatuses.set(fqn, {
+      id: logicalId,
+      type: task.Type,
+      status: "ran",
+    });
+    yield* report("ran");
+  }).pipe(
+    Effect.catchCause((cause) =>
+      Effect.gen(function* () {
+        failures.push({
+          fqn,
+          logicalId: node.def.LogicalId,
+          type: node.def.Type,
+          cause,
+        });
+        yield* Deferred.failCause(ready[fqn], cause as Cause.Cause<never>);
+        yield* Deferred.failCause(
+          readyStable[fqn],
+          cause as Cause.Cause<never>,
+        );
+        yield* session.emit({
+          kind: "status-change",
+          id: node.def.LogicalId,
+          type: node.def.Type,
+          status: "fail",
+        });
+      }),
+    ),
+    Effect.withSpan("apply.action", {
+      attributes: {
+        "alchemy.action.fqn": fqn,
+        "alchemy.action.type": node.def.Type,
+        "alchemy.action.logical_id": node.def.LogicalId,
+        "alchemy.action.verb": node.action,
+      },
+    }),
+  ) as Effect.Effect<void, never, any>;
+
+// ── Phase 3: imperative convergence loop ───────────────────────────────────
+//
+// After the initial concurrent pass, some resources may have been created
+// with stale upstream values (e.g. a precreate stub instead of the final
+// output). Walk the plan and re-evaluate each resource's props/bindings
+// against the current tracker outputs. Call provider.reconcile for any
+// resource whose resolved inputs differ from what it was last applied with.
+// Repeat until no resource needs updating.
+
+const converge = Effect.fnUntraced(function* (
+  plan: Plan,
+  tracker: Record<string, ResourceTracker>,
+  terminalStatuses: Map<
+    string,
+    {
+      id: string;
+      type: string;
+      status: Extract<ApplyStatus, "created" | "updated" | "ran" | "skipped">;
+    }
+  >,
+  session: PlanStatusSession,
+  state: {
+    set: <V extends PersistedState>(req: {
+      stack: string;
+      stage: string;
+      fqn: string;
+      value: V;
+    }) => Effect.Effect<V, StateStoreError, never>;
+  },
+  stackName: string,
+  stage: string,
+) {
+  for (;;) {
+    let anyUpdated = false;
+
+    for (const [fqn, node] of Object.entries(plan.resources)) {
+      if (node.action === "noop") continue;
+      if (!tracker[fqn]) continue;
+
+      const outputs = Object.fromEntries(
+        Object.entries(tracker).map(([k, t]) => [k, t.output]),
+      );
+
+      const newProps = (yield* Output.evaluate(node.props, outputs)) as Record<
+        string,
+        any
+      >;
+
+      const newBindings = excludeDeletedBindings(
+        yield* Output.evaluate(node.bindings, outputs),
+      );
+
+      const oldProps = tracker[fqn].props;
+      const oldBindings = tracker[fqn].bindings;
+
+      const propsChanged = havePropsChanged(oldProps, newProps);
+      const bindingsChanged =
+        JSON.stringify(oldBindings) !== JSON.stringify(newBindings);
+
+      if (!propsChanged && !bindingsChanged) continue;
+
+      anyUpdated = true;
+
+      const logicalId = node.resource.LogicalId;
+      const namespace = node.resource.Namespace;
+      const instanceId = tracker[fqn].instanceId;
+
+      const scopedSession = {
+        ...session,
+        note: (note: string) =>
+          session.emit({ id: logicalId, kind: "annotate", message: note }),
+      } satisfies ScopedPlanStatusSession;
+
+      const attr = yield* node.provider
+        .reconcile({
+          id: logicalId,
+          news: newProps,
+          instanceId,
+          bindings: newBindings,
+          session: scopedSession,
+          olds: oldProps,
+          output: tracker[fqn].output,
+        })
+        .pipe(
+          instrumentLifecycle(
+            "update",
+            fqn,
+            node.resource.Type,
+            logicalId,
+            instanceId,
+          ),
+        );
+
+      tracker[fqn] = {
+        output: attr,
+        props: newProps,
+        bindings: newBindings,
+        instanceId,
+      };
+
+      yield* state.set({
+        stack: stackName,
+        stage,
+        fqn,
+        value: {
+          status: "updated",
+          fqn,
+          logicalId,
+          instanceId,
+          resourceType: node.resource.Type,
+          props: newProps,
+          attr,
+          providerVersion: node.provider.version ?? 0,
+          bindings: excludeDeletedBindings(node.bindings),
+          downstream: node.downstream,
+          namespace,
+          removalPolicy: node.resource.RemovalPolicy,
+        } as UpdatedResourceState,
+      });
+
+      terminalStatuses.set(fqn, {
+        id: logicalId,
+        type: node.resource.Type,
+        status: "updated",
+      });
+    }
+
+    // Tasks: re-run when their resolved input drifts vs. the value they
+    // last applied with (e.g. an upstream resource produced new attrs in
+    // this pass). Skipped (noop) tasks are not re-checked here — their
+    // recorded inputHash is authoritative until the next plan.
+    for (const [fqn, node] of Object.entries(plan.actions)) {
+      if (node.action !== "run") continue;
+      if (!tracker[fqn]) continue;
+
+      const outputs = Object.fromEntries(
+        Object.entries(tracker).map(([k, t]) => [k, t.output]),
+      );
+      const newInput = (yield* Output.evaluate(node.input, outputs)) as any;
+      const newHash = yield* hashInput(newInput);
+      const oldInput = tracker[fqn].props?.__input;
+      const oldHash = yield* hashInput(oldInput);
+      if (newHash === oldHash) continue;
+
+      anyUpdated = true;
+
+      yield* state.set({
+        stack: stackName,
+        stage,
+        fqn,
+        value: {
+          kind: "action",
+          status: "running",
+          fqn,
+          logicalId: node.def.LogicalId,
+          namespace: node.def.Namespace,
+          actionType: node.def.Type,
+          inputHash: newHash,
+          input: newInput,
+          downstream: node.downstream,
+        } satisfies RunningActionState,
+      });
+
+      const result = yield* node.def.Run(newInput);
+
+      yield* state.set({
+        stack: stackName,
+        stage,
+        fqn,
+        value: {
+          kind: "action",
+          status: "ran",
+          fqn,
+          logicalId: node.def.LogicalId,
+          namespace: node.def.Namespace,
+          actionType: node.def.Type,
+          inputHash: newHash,
+          input: newInput,
+          output: result,
+          downstream: node.downstream,
+        } satisfies RanActionState,
+      });
+
+      tracker[fqn] = {
+        output: result,
+        props: { __input: newInput },
+        bindings: [],
+        instanceId: fqn,
+      };
+      terminalStatuses.set(fqn, {
+        id: node.def.LogicalId,
+        type: node.def.Type,
+        status: "ran",
+      });
+    }
+
+    if (!anyUpdated) break;
+  }
+});
+
+// ── Phase 2: delete orphans and old replaced resources ─────────────────────
+
+const collectGarbage = Effect.fnUntraced(function* (
+  plan: Plan,
+  session: PlanStatusSession,
+) {
+  const state = yield* yield* State;
+  const stack = yield* Stack;
+  const stackName = stack.name;
+  const stage = yield* Stage;
+
+  // Task deletions are pure state drops — no body is invoked. Run them in
+  // parallel before resource GC; tasks never have provider-side dependencies
+  // to wait on.
+  yield* Effect.all(
+    Object.entries(plan.actionDeletions ?? {}).map(([fqn, node]) =>
+      node === undefined
+        ? Effect.void
+        : Effect.gen(function* () {
+            yield* session.emit({
+              kind: "status-change",
+              id: node.def.LogicalId,
+              type: node.def.Type,
+              status: "deleting",
+            });
+            yield* state.delete({ stack: stackName, stage, fqn });
+            yield* session.emit({
+              kind: "status-change",
+              id: node.def.LogicalId,
+              type: node.def.Type,
+              status: "deleted",
+            });
+          }),
+    ),
+    { concurrency: "unbounded" },
+  );
+
+  const deleteGraph = Effect.fnUntraced(function* (
+    deletionGraph: Record<string, Delete | ReplacedResourceState | undefined>,
+  ) {
+    const deletions: {
+      [fqn in string]: Effect.Effect<void, StateStoreError, ArtifactStore>;
+    } = {};
+
+    const deleteResource = (
+      node: Delete | ReplacedResourceState,
+      ancestors: ReadonlySet<string> = new Set(),
+    ): Effect.Effect<void, StateStoreError, ArtifactStore> =>
+      Effect.gen(function* () {
+        const isDeleteNode = (
+          node: Delete | ReplacedResourceState,
+        ): node is Delete => "action" in node;
+
+        const {
+          logicalId,
+          namespace,
+          resourceType,
+          instanceId,
+          downstream,
+          props,
+          attr,
+          provider,
+        } = isDeleteNode(node)
+          ? {
+              logicalId: node.resource.LogicalId,
+              namespace: node.resource.Namespace,
+              resourceType: node.resource.Type,
+              instanceId: node.state.instanceId,
+              downstream: node.downstream,
+              props: node.state.props,
+              attr: node.state.attr,
+              provider: node.provider,
+            }
+          : {
+              logicalId: node.logicalId,
+              namespace: node.namespace,
+              resourceType: node.old.resourceType,
+              instanceId: node.old.instanceId,
+              downstream: node.old.downstream,
+              props: node.old.props,
+              attr: node.old.attr,
+              provider: yield* findProviderByType(node.old.resourceType),
+            };
+
+        const fqn = toFqn(namespace, logicalId);
+        const nextAncestors = new Set(ancestors).add(fqn);
+
+        const commit = <S extends ResourceState>(value: Omit<S, "namespace">) =>
+          state.set({
+            stack: stackName,
+            stage,
+            fqn,
+            value: { ...value, namespace } as S,
+          });
+
+        const report = (status: ApplyStatus) =>
+          session.emit({
+            kind: "status-change",
+            id: logicalId,
+            type: resourceType,
+            status,
+          });
+
+        const scopedSession = {
+          ...session,
+          note: (note: string) =>
+            session.emit({
+              id: logicalId,
+              kind: "annotate",
+              message: note,
+            }),
+        } satisfies ScopedPlanStatusSession;
+
+        return yield* (deletions[fqn] ??= yield* Effect.cached(
+          Effect.gen(function* () {
+            yield* Effect.all(
+              downstream.map((dep) =>
+                dep !== fqn && dep in deletionGraph && !ancestors.has(dep)
+                  ? deleteResource(
+                      deletionGraph[dep] as Delete | ReplacedResourceState,
+                      nextAncestors,
+                    )
+                  : Effect.void,
+              ),
+              { concurrency: "unbounded" },
+            );
+
+            if (isDeleteNode(node)) {
+              yield* report("deleting");
+              if (node.resource.RemovalPolicy === "retain") {
+                yield* state.delete({
+                  stack: stackName,
+                  stage,
+                  fqn,
+                });
+                yield* report("deleted");
+                return;
+              }
+              yield* commit<DeletingResourceState>({
+                status: "deleting",
+                fqn,
+                logicalId,
+                instanceId,
+                resourceType,
+                props,
+                attr,
+                downstream,
+                providerVersion: provider.version ?? 0,
+                bindings: excludeDeletedBindings(node.bindings),
+                removalPolicy: node.resource.RemovalPolicy,
+              });
+            }
+
+            if (attr !== undefined) {
+              yield* provider
+                .delete({
+                  id: logicalId,
+                  instanceId,
+                  olds: props as never,
+                  output: attr,
+                  session: scopedSession,
+                  bindings: [],
+                })
+                .pipe(
+                  instrumentLifecycle(
+                    "delete",
+                    fqn,
+                    resourceType,
+                    logicalId,
+                    instanceId,
+                  ),
+                );
+            }
+
+            if (isDeleteNode(node)) {
+              yield* state.delete({
+                stack: stackName,
+                stage,
+                fqn,
+              });
+              yield* report("deleted");
+            } else {
+              yield* scopedSession.note("Cleaning up replaced resource...");
+              if (
+                node.old.status === "replacing" ||
+                node.old.status === "replaced"
+              ) {
+                // We only deleted the outermost old generation. A nested replacement
+                // chain still exists, so stay in `replaced` and pop the chain forward
+                // one level. The outer loop will pick this resource up again.
+                yield* commit<ReplacedResourceState>({
+                  status: "replaced",
+                  fqn,
+                  logicalId: node.logicalId,
+                  instanceId: node.instanceId,
+                  resourceType: node.resourceType,
+                  props: node.props,
+                  attr: node.attr,
+                  providerVersion: node.providerVersion,
+                  downstream: node.downstream,
+                  bindings: excludeDeletedBindings(node.bindings),
+                  old: node.old.old,
+                  deleteFirst: node.deleteFirst,
+                  removalPolicy: node.removalPolicy,
+                });
+              } else {
+                // The old chain is fully drained, so the current replacement is now
+                // the stable resource and we can collapse back to a terminal state.
+                yield* commit<CreatedResourceState>({
+                  status: "created",
+                  fqn,
+                  logicalId: node.logicalId,
+                  instanceId: node.instanceId,
+                  resourceType: node.resourceType,
+                  props: node.props,
+                  attr: node.attr,
+                  providerVersion: node.providerVersion,
+                  downstream: node.downstream,
+                  bindings: excludeDeletedBindings(node.bindings),
+                  removalPolicy: node.removalPolicy,
+                });
+              }
+              yield* scopedSession.note("Replaced resource cleanup complete.");
+            }
+          }),
+        ));
+      });
+
+    yield* Effect.all(
+      Object.values(deletionGraph)
+        .filter((node) => node !== undefined)
+        .map((node) => deleteResource(node)),
+      { concurrency: "unbounded" },
+    );
+  });
+
+  // The first pass handles both planned deletions and any top-level replaced
+  // resources already present in state. Later passes only drain replacement
+  // chains that were re-committed as `replaced` while deleting older generations.
+  let first = true;
+  while (true) {
+    const remainingReplacedResources = yield* state.getReplacedResources({
+      stack: stackName,
+      stage,
+    });
+    if (!first && remainingReplacedResources.length === 0) {
+      break;
+    }
+    yield* deleteGraph({
+      // Orphan/resource deletions from the current plan should only run once.
+      ...(first ? plan.deletions : {}),
+      ...Object.fromEntries(
+        remainingReplacedResources.map((replaced) => [
+          toFqn(replaced.namespace, replaced.logicalId),
+          replaced,
+        ]),
+      ),
+    });
+    first = false;
+  }
+});
+
+const excludeDeletedBindings = (
+  bindings: ReadonlyArray<ResourceBinding & { action?: string }>,
+): ResourceBinding[] =>
+  bindings.flatMap(({ action, sid, data }) =>
+    action === "delete" ? [] : [{ sid, data }],
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Artifacts.ts b/.repos/alchemy-effect/packages/alchemy/src/Artifacts.ts
new file mode 100644
index 00000000000..acb49f05c52
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Artifacts.ts
@@ -0,0 +1,154 @@
+import * as Context from "effect/Context";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+
+/**
+ * Per-resource in-memory artifacts shared across a single `Plan.make -> apply`
+ * execution.
+ *
+ * The engine scopes this service by resource `FQN` before invoking lifecycle
+ * handlers, so providers should treat it as a resource-local bag for expensive,
+ * deterministic intermediate results that can be reused across phases.
+ *
+ * Expected usage:
+ *
+ * - `diff` computes an expensive artifact once and stores it
+ * - `create` / `update` reads the same artifact and skips recomputing it
+ * - artifacts are ephemeral and must never be required for correctness on a
+ *   later deploy because the bag is reset between runs
+ *
+ * Example:
+ *
+ * ```ts
+ * const artifacts = yield* Artifacts;
+ * const cached = yield* artifacts.get<PreparedBundle>("bundle");
+ * if (cached) return cached;
+ *
+ * const bundle = yield* prepareBundle();
+ * yield* artifacts.set("bundle", bundle);
+ * return bundle;
+ * ```
+ */
+export class Artifacts extends Context.Service<
+  Artifacts,
+  {
+    /**
+     * Get an artifact by key from the current resource's bag.
+     */
+    get<T>(key: string): Effect.Effect<T | undefined>;
+    /**
+     * Store an artifact by key in the current resource's bag.
+     */
+    set<T>(key: string, value: T): Effect.Effect<void>;
+    /**
+     * Delete an artifact by key from the current resource's bag.
+     */
+    delete(key: string): Effect.Effect<void>;
+  }
+>()("Artifacts") {}
+
+type ArtifactBag = Map<string, unknown>;
+
+export class ArtifactStore extends Context.Service<
+  ArtifactStore,
+  Map<string, ArtifactBag>
+>()("Artifacts/Store") {}
+
+/**
+ * Create a fresh root store for one deploy/test run.
+ */
+export const createArtifactStore = (): ArtifactStore["Service"] =>
+  new Map<string, ArtifactBag>();
+
+const getOrCreateBag = (
+  store: Map<string, ArtifactBag>,
+  fqn: string,
+): ArtifactBag => {
+  const existing = store.get(fqn);
+  if (existing) {
+    return existing;
+  }
+  const bag = new Map<string, unknown>();
+  store.set(fqn, bag);
+  return bag;
+};
+
+export const makeScopedArtifacts = (
+  store: Map<string, ArtifactBag>,
+  fqn: string,
+): Artifacts["Service"] => {
+  const bag = getOrCreateBag(store, fqn);
+  return {
+    get: <T>(key: string) => Effect.sync(() => bag.get(key) as T | undefined),
+    set: <T>(key: string, value: T) =>
+      Effect.sync(() => {
+        bag.set(key, value);
+      }),
+    delete: (key: string) =>
+      Effect.sync(() => {
+        bag.delete(key);
+      }),
+  };
+};
+
+export const scopedArtifacts = (
+  fqn: string,
+): Layer.Layer<Artifacts, never, ArtifactStore> =>
+  Layer.effect(
+    Artifacts,
+    ArtifactStore.useSync((store) => makeScopedArtifacts(store, fqn)),
+  );
+
+/**
+ * Run an effect with a fresh artifact root, replacing any existing store.
+ * Use this at top-level entrypoints that intentionally define a new deploy run.
+ */
+export const provideFreshArtifactStore = <A, E, R>(
+  effect: Effect.Effect<A, E, R | ArtifactStore>,
+): Effect.Effect<A, E, R> =>
+  effect.pipe(
+    Effect.provideServiceEffect(
+      ArtifactStore,
+      Effect.sync(createArtifactStore),
+    ),
+  );
+
+/**
+ * Ensure an artifact root exists, reusing the ambient store when one is already
+ * present. This lets nested helpers participate in the same run-scoped cache.
+ */
+export const ensureArtifactStore = <A, E, R>(
+  effect: Effect.Effect<A, E, R | ArtifactStore>,
+): Effect.Effect<A, E, R> =>
+  Effect.serviceOption(ArtifactStore).pipe(
+    Effect.map(Option.getOrUndefined),
+    Effect.flatMap((existing) =>
+      effect.pipe(
+        Effect.provideService(ArtifactStore, existing ?? createArtifactStore()),
+      ),
+    ),
+  );
+
+export const cached =
+  (id: string) =>
+  <A, Err = never, Req = never>(
+    eff: Effect.Effect<A, Err, Req>,
+  ): Effect.Effect<A, Err, Req | Artifacts> =>
+    Effect.gen(function* () {
+      const artifacts = yield* Artifacts;
+      const deferred = yield* Deferred.make<A>();
+      const cached = yield* artifacts.get<A>(id);
+      if (cached) {
+        if (Effect.isEffect(cached)) {
+          return yield* cached;
+        }
+        return cached;
+      }
+      yield* artifacts.set(id, Deferred.await(deferred));
+      const result = yield* eff;
+      yield* Deferred.succeed(deferred, result);
+      yield* artifacts.set(id, result);
+      return result;
+    });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Auth/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Auth/AuthProvider.ts
new file mode 100644
index 00000000000..67be8d31223
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Auth/AuthProvider.ts
@@ -0,0 +1,251 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+import { withLock } from "./Lock.ts";
+
+/**
+ * Methods on an {@link AuthProviderImpl} that mutate (or could trigger
+ * mutation of) on-disk credentials. The factory wraps these in a
+ * cross-process file lock keyed by `(profileName, providerName)` so that
+ * concurrent processes never refresh / write credentials simultaneously.
+ *
+ * `prettyPrint` is intentionally excluded: it's read-only display.
+ */
+const LOCKED_METHODS = new Set(["read", "login", "logout", "configure"]);
+
+/**
+ * Methods that may drive an interactive flow (prompts, browser-based
+ * OAuth, etc.). A process-wide mutex serializes these across providers
+ * so that, e.g., Cloudflare's `configure` finishes its prompt sequence
+ * before Planetscale's begins — even when the two auth provider Layers
+ * are built in parallel as part of a single `providers()` Layer.
+ *
+ * The clack prompt wrapper in `Util/Clank.ts` enforces per-prompt
+ * serialization; this mutex enforces per-flow serialization so the user
+ * sees one provider's prompts grouped together rather than interleaved.
+ */
+const INTERACTIVE_METHODS = new Set(["login", "configure"]);
+const interactiveMutex = Semaphore.makeUnsafe(1);
+
+export class AuthError extends Schema.TaggedErrorClass<AuthError>()(
+  "AuthError",
+  {
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect),
+  },
+) {}
+
+export class AuthProviders extends Context.Service<
+  AuthProviders,
+  {
+    [providerName: string]: AuthProvider;
+  }
+>()("AuthProviders") {}
+
+/**
+ * Context passed to {@link AuthProviderImpl.configure}.
+ */
+export interface ConfigureContext {
+  /**
+   * `true` when running in a CI/CD environment (resolved from the `CI`
+   * env/config). Providers MUST NOT prompt interactively when `ci` is true;
+   * they should pick a non-interactive default (typically
+   * `{ method: "env" }`) so unattended runs work.
+   */
+  readonly ci: boolean;
+}
+
+export interface AuthProviderImpl<
+  Config extends { method: string } = any,
+  Credentials = any,
+  ConfigureReq = any,
+  LoginReq = any,
+  LogoutReq = any,
+  PrettyPrintReq = any,
+  ReadReq = any,
+> {
+  configure(
+    profileName: string,
+    ctx: ConfigureContext,
+  ): Effect.Effect<Config, AuthError, ConfigureReq>;
+
+  login(
+    profileName: string,
+    config: Config,
+  ): Effect.Effect<void, AuthError, LoginReq>;
+
+  logout(
+    profileName: string,
+    config: Config,
+  ): Effect.Effect<void, AuthError, LogoutReq>;
+
+  prettyPrint(
+    profileName: string,
+    config: Config,
+  ): Effect.Effect<void, AuthError, PrettyPrintReq>;
+
+  read(
+    profileName: string,
+    config: Config,
+  ): Effect.Effect<Credentials, AuthError, ReadReq>;
+}
+
+export interface AuthProvider<
+  Config extends { method: string } = any,
+  Credentials = any,
+> extends AuthProviderImpl<
+  Config,
+  Credentials,
+  never,
+  never,
+  never,
+  never,
+  never
+> {
+  readonly kind: "AuthProvider";
+  readonly name: string;
+}
+
+export const AuthProvider =
+  <Config extends { method: string }, Credentials>() =>
+  <
+    ImplReq = never,
+    ConfigureReq = never,
+    LoginReq = never,
+    LogoutReq = never,
+    PrettyPrintReq = never,
+    ReadReq = never,
+  >(
+    name: string,
+    impl:
+      | AuthProviderImpl<
+          Config,
+          Credentials,
+          ConfigureReq,
+          LoginReq,
+          LogoutReq,
+          PrettyPrintReq,
+          ReadReq
+        >
+      | Effect.Effect<
+          AuthProviderImpl<
+            Config,
+            Credentials,
+            ConfigureReq,
+            LoginReq,
+            LogoutReq,
+            PrettyPrintReq,
+            ReadReq
+          >,
+          never,
+          ImplReq
+        >,
+  ) =>
+    Effect.gen(function* () {
+      const ctx = yield* Effect.context();
+      const providers = yield* AuthProviders;
+      const service = yield* Effect.isEffect(impl)
+        ? impl
+        : Effect.succeed(impl);
+      return yield* Effect.sync(
+        () =>
+          (providers[name] = {
+            kind: "AuthProvider",
+            name,
+            ...Object.fromEntries(
+              Object.entries(service).map(([methodName, fn]) => [
+                methodName,
+                (...args: Parameters<typeof fn>) => {
+                  let eff = (fn as any)(...args).pipe(
+                    Effect.provideContext(ctx),
+                  );
+                  if (LOCKED_METHODS.has(methodName)) {
+                    // First positional arg is always `profileName`.
+                    const profileName = args[0] as string;
+                    eff = withLock(`${profileName}-${name}`, eff);
+                  }
+                  if (INTERACTIVE_METHODS.has(methodName)) {
+                    eff = Semaphore.withPermits(interactiveMutex, 1)(eff);
+                  }
+                  return eff;
+                },
+              ]),
+            ),
+          } as AuthProvider<Config, Credentials>),
+      );
+    });
+
+/**
+ * Build a Layer that registers an AuthProvider into the {@link AuthProviders}
+ * registry when its parent layer is built. Use this from a provider's
+ * top-level `providers()` Layer so that `alchemy login` can discover the
+ * provider via the registry without forcing credential resolution.
+ */
+export const AuthProviderLayer =
+  <Config extends { method: string }, Credentials>() =>
+  <
+    ImplReq = never,
+    ConfigureReq = never,
+    LoginReq = never,
+    LogoutReq = never,
+    PrettyPrintReq = never,
+    ReadReq = never,
+  >(
+    name: string,
+    impl:
+      | AuthProviderImpl<
+          Config,
+          Credentials,
+          ConfigureReq,
+          LoginReq,
+          LogoutReq,
+          PrettyPrintReq,
+          ReadReq
+        >
+      | Effect.Effect<
+          AuthProviderImpl<
+            Config,
+            Credentials,
+            ConfigureReq,
+            LoginReq,
+            LogoutReq,
+            PrettyPrintReq,
+            ReadReq
+          >,
+          never,
+          ImplReq
+        >,
+  ) =>
+    Layer.effectDiscard(
+      AuthProvider<Config, Credentials>()<
+        ImplReq,
+        ConfigureReq,
+        LoginReq,
+        LogoutReq,
+        PrettyPrintReq,
+        ReadReq
+      >(name, impl),
+    );
+
+/**
+ * Look up a registered {@link AuthProvider} by name. Fails with
+ * {@link AuthError} if the provider hasn't been registered (typically because
+ * its layer hasn't been built).
+ */
+export const getAuthProvider = <
+  Config extends { method: string } = any,
+  Credentials = any,
+>(
+  name: string,
+): Effect.Effect<AuthProvider<Config, Credentials>, AuthError, AuthProviders> =>
+  AuthProviders.use((registry) =>
+    registry[name] == null
+      ? Effect.fail(
+          new AuthError({
+            message: `AuthProvider '${name}' is not registered. Make sure its layer has been provided.`,
+          }),
+        )
+      : Effect.succeed(registry[name] as AuthProvider<Config, Credentials>),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Auth/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/Auth/Credentials.ts
new file mode 100644
index 00000000000..93faa25c6ae
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Auth/Credentials.ts
@@ -0,0 +1,109 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import type { PlatformError } from "effect/PlatformError";
+import * as Redacted from "effect/Redacted";
+import path from "pathe";
+import { rootDir } from "./Profile.ts";
+
+const credentialsDirPath = path.join(rootDir, "credentials");
+
+export const profileCredentialsDirPath = (profile: string) =>
+  path.join(credentialsDirPath, profile);
+
+export const credentialsFilePath = (profile: string, provider: string) =>
+  path.join(profileCredentialsDirPath(profile), `${provider}.json`);
+
+/**
+ * Service exposing per-profile credential file helpers. All methods have
+ * `R = never` — the {@link FileSystem.FileSystem} requirement is captured
+ * by {@link CredentialsStoreLive} when the layer is built.
+ */
+export interface CredentialsStoreService {
+  readonly read: <T>(
+    profile: string,
+    provider: string,
+  ) => Effect.Effect<T | undefined>;
+  readonly write: <T>(
+    profile: string,
+    provider: string,
+    credentials: T,
+  ) => Effect.Effect<void, PlatformError>;
+  readonly delete: (profile: string, provider: string) => Effect.Effect<void>;
+  /**
+   * Recursively remove the `~/.alchemy/credentials/{profile}` directory
+   * containing all per-provider secrets for `profile`. No-op if it doesn't exist.
+   */
+  readonly deleteProfile: (profile: string) => Effect.Effect<void>;
+}
+
+export class CredentialsStore extends Context.Service<
+  CredentialsStore,
+  CredentialsStoreService
+>()("Alchemy::CredentialsStore") {}
+
+export const CredentialsStoreLive = Layer.effect(
+  CredentialsStore,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+
+    const read = <T>(
+      profile: string,
+      provider: string,
+    ): Effect.Effect<T | undefined> =>
+      fs.readFileString(credentialsFilePath(profile, provider)).pipe(
+        Effect.catch(() => Effect.succeed(undefined as string | undefined)),
+        Effect.map((data) => {
+          if (data === undefined) return undefined as T | undefined;
+          try {
+            return JSON.parse(data) as T;
+          } catch {
+            return undefined as T | undefined;
+          }
+        }),
+      );
+
+    const write = <T>(
+      profile: string,
+      provider: string,
+      credentials: T,
+    ): Effect.Effect<void, PlatformError> => {
+      const filePath = credentialsFilePath(profile, provider);
+      return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(
+        Effect.flatMap(() => {
+          return fs.writeFileString(
+            filePath,
+            JSON.stringify(credentials, null, 2),
+          );
+        }),
+      );
+    };
+
+    const remove_ = (profile: string, provider: string): Effect.Effect<void> =>
+      fs
+        .remove(credentialsFilePath(profile, provider))
+        .pipe(Effect.catch(() => Effect.void));
+
+    const deleteProfile = (profile: string): Effect.Effect<void> =>
+      fs
+        .remove(profileCredentialsDirPath(profile), { recursive: true })
+        .pipe(Effect.catch(() => Effect.void));
+
+    return {
+      read,
+      write,
+      delete: remove_,
+      deleteProfile,
+    } satisfies CredentialsStoreService;
+  }),
+);
+
+export function displayRedacted(
+  r: Redacted.Redacted<string>,
+  visibleChars = 4,
+): string {
+  const raw = Redacted.value(r);
+  if (raw.length <= visibleChars) return "****";
+  return `${raw.slice(0, visibleChars)}****`;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Auth/Env.ts b/.repos/alchemy-effect/packages/alchemy/src/Auth/Env.ts
new file mode 100644
index 00000000000..8fff3a98319
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Auth/Env.ts
@@ -0,0 +1,37 @@
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Clank from "../Util/Clank.ts";
+import { AuthError } from "./AuthProvider.ts";
+
+export const getEnv = (key: string) =>
+  Config.string(key).pipe(Effect.orElseSucceed(() => undefined));
+
+export const getEnvRequired = (key: string) =>
+  Config.string(key).pipe(
+    Effect.catch(() =>
+      Effect.fail(new AuthError({ message: `Missing required env: ${key}` })),
+    ),
+  );
+
+export const getEnvRedacted = (key: string) =>
+  Config.redacted(key).pipe(Effect.orElseSucceed(() => undefined));
+
+export const getEnvRedactedRequired = (key: string) =>
+  Config.redacted(key).pipe(
+    Effect.catch(() =>
+      Effect.fail(new AuthError({ message: `Missing required env: ${key}` })),
+    ),
+  );
+
+export const retryOnce = <A, R>(
+  self: Effect.Effect<A, Clank.PromptCancelled, R>,
+) =>
+  self.pipe(
+    Effect.retry({
+      times: 1,
+      while: (e) => e instanceof Clank.PromptCancelled,
+    }),
+    Effect.mapError(
+      (e) => new AuthError({ message: "User cancelled prompt", cause: e }),
+    ),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Auth/Lock.ts b/.repos/alchemy-effect/packages/alchemy/src/Auth/Lock.ts
new file mode 100644
index 00000000000..220914f0ef4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Auth/Lock.ts
@@ -0,0 +1,36 @@
+import { lock } from "@alchemy.run/node-utils/lockfile";
+import * as Effect from "effect/Effect";
+import * as fs from "node:fs/promises";
+import * as path from "pathe";
+import { rootDir } from "./Profile.ts";
+
+const lockDir = path.join(rootDir, "lock");
+
+/**
+ * Serialise execution of `effect` so no two callers ever run inside the
+ * critical section concurrently for the same `key`, both within this
+ * process and across other processes on the same machine.
+ *
+ * Uses `@alchemy.run/node-utils` lockfile for both: it tracks in-process
+ * holders by path (so same-process callers wait via `retries`) and uses
+ * an OS file lock for cross-process coordination, with stale-lock
+ * detection at 60s.
+ */
+export const withLock = <A, E, R>(
+  key: string,
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> => {
+  const lockPath = path.join(lockDir, `${key}.lock`);
+  return Effect.acquireUseRelease(
+    Effect.promise(async () => {
+      await fs.mkdir(lockDir, { recursive: true });
+      return await lock(lockPath, {
+        retries: { retries: 600, minTimeout: 50, maxTimeout: 50 },
+        stale: 5_000,
+        realpath: false,
+      });
+    }),
+    () => effect,
+    (release) => Effect.promise(() => release().catch(() => {})),
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Auth/Profile.ts b/.repos/alchemy-effect/packages/alchemy/src/Auth/Profile.ts
new file mode 100644
index 00000000000..4f42d9f3ba8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Auth/Profile.ts
@@ -0,0 +1,204 @@
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import type { PlatformError } from "effect/PlatformError";
+import os from "node:os";
+import path from "pathe";
+import type {
+  AuthError,
+  AuthProvider,
+  ConfigureContext,
+} from "./AuthProvider.ts";
+
+export const rootDir = path.join(os.homedir(), ".alchemy");
+export const configFilePath = path.join(rootDir, "profiles.json");
+
+/**
+ * Config key consulted by the various `fromAuthProvider` /
+ * `fromEnvironment` layers to pick which named profile in
+ * `~/.alchemy/profiles.json` to use. Defaults to `"default"`.
+ */
+export const ALCHEMY_PROFILE = Config.string("ALCHEMY_PROFILE").pipe(
+  Config.withDefault("default"),
+);
+
+export const CONFIG_VERSION = 0;
+
+export class AlchemyConfig extends Context.Service<
+  AlchemyConfig,
+  {
+    version: typeof CONFIG_VERSION;
+    profiles: {
+      [profileName: string]: AlchemyProfile;
+    };
+  }
+>()("Alchemy::Profiles") {}
+
+export interface AlchemyProfile {
+  [providerName: string]: {
+    /**
+     * The method used to login to the provider. Different providers may use different methods, but common ones are:
+     * - oauth: OAuth authentication
+     * - api-key: API key authentication
+     * - username-password: Username and password authentication
+     * - token: Token authentication
+     * - certificate: Certificate authentication
+     * - ssh: SSH authentication
+     * - other: Other authentication methods
+     */
+    method: string;
+  };
+}
+
+const emptyConfig = (): AlchemyConfig["Service"] => ({
+  version: CONFIG_VERSION,
+  profiles: {},
+});
+
+/**
+ * Service exposing on-disk profile helpers. All methods have `R = never` —
+ * the {@link FileSystem.FileSystem} requirement is captured by
+ * {@link ProfileLive} when the layer is built, freeing call sites from
+ * having to thread `FileSystem` through their own Effects.
+ *
+ * Use {@link Profile} directly when you need profile helpers — yield it
+ * from your `Effect.gen` and call its methods (each has `R = never`).
+ */
+export interface ProfileService {
+  readonly readConfig: Effect.Effect<AlchemyConfig["Service"]>;
+  readonly writeConfig: (
+    config: AlchemyConfig["Service"],
+  ) => Effect.Effect<void, PlatformError>;
+  readonly getProfile: (
+    name: string,
+  ) => Effect.Effect<AlchemyProfile | undefined>;
+  readonly setProfile: (
+    name: string,
+    profile: AlchemyProfile,
+  ) => Effect.Effect<void, PlatformError>;
+  readonly deleteProfile: (
+    name: string,
+  ) => Effect.Effect<boolean, PlatformError>;
+  readonly loadOrConfigure: <Config extends { method: string }>(
+    auth: AuthProvider<Config>,
+    profileName: string,
+    ctx: ConfigureContext,
+  ) => Effect.Effect<Config, AuthError | PlatformError>;
+}
+
+export class Profile extends Context.Service<Profile, ProfileService>()(
+  "Alchemy::Profile",
+) {}
+
+/**
+ * Layer that builds the {@link Profile} service. Captures the
+ * {@link FileSystem.FileSystem} dependency at layer-build time, so any
+ * Effect that yields {@link Profile} ends up with `R = Profile` (no
+ * `FileSystem` leak). Provide this once at the top of your runtime
+ * (alongside `PlatformServices` / `NodeContext`).
+ */
+export const ProfileLive = Layer.effect(
+  Profile,
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+
+    const readConfig: Effect.Effect<AlchemyConfig["Service"]> = fs
+      .readFileString(configFilePath)
+      .pipe(
+        Effect.flatMap((data) =>
+          Effect.try({
+            try: () => {
+              const parsed = JSON.parse(data);
+              if (parsed?.version !== CONFIG_VERSION) {
+                // TODO(sam): this is destructive, should we maintain a chain of migrations from 0 to current?
+                return emptyConfig();
+              }
+              return parsed as AlchemyConfig["Service"];
+            },
+            catch: emptyConfig,
+          }),
+        ),
+        Effect.orElseSucceed(emptyConfig),
+      );
+
+    const writeConfig = (config: AlchemyConfig["Service"]) =>
+      fs
+        .makeDirectory(path.dirname(configFilePath), { recursive: true })
+        .pipe(
+          Effect.flatMap(() =>
+            fs.writeFileString(configFilePath, JSON.stringify(config, null, 2)),
+          ),
+        );
+
+    const getProfile = (name: string) =>
+      readConfig.pipe(Effect.map((config) => config.profiles[name]));
+
+    const setProfile = (name: string, profile: AlchemyProfile) =>
+      readConfig.pipe(
+        Effect.tap((config) =>
+          Effect.sync(() => (config.profiles[name] = profile)),
+        ),
+        Effect.flatMap(writeConfig),
+      );
+
+    const deleteProfile = (name: string) =>
+      readConfig.pipe(
+        Effect.flatMap((config) => {
+          if (!(name in config.profiles)) {
+            return Effect.succeed(false);
+          }
+          delete config.profiles[name];
+          return writeConfig(config).pipe(Effect.as(true));
+        }),
+      );
+
+    const loadOrConfigure = <Config extends { method: string }>(
+      auth: AuthProvider<Config>,
+      profileName: string,
+      ctx: ConfigureContext,
+    ) =>
+      Effect.flatMap(getProfile(profileName), (existing) =>
+        existing?.[auth.name]
+          ? Effect.succeed(existing[auth.name] as Config)
+          : Effect.tap(auth.configure(profileName, ctx), (config) =>
+              setProfile(profileName, { ...existing, [auth.name]: config }),
+            ),
+      );
+
+    return {
+      readConfig,
+      writeConfig,
+      getProfile,
+      setProfile,
+      deleteProfile,
+      loadOrConfigure,
+    } satisfies ProfileService;
+  }),
+);
+
+/**
+ * Returns a `ConfigProvider` that overrides `ALCHEMY_PROFILE` with the
+ * given `profile` (when explicitly passed via the CLI `--profile` flag),
+ * falling through to `base` for everything else.
+ *
+ * Use this to let the CLI's `--profile <name>` win over `$ALCHEMY_PROFILE`
+ * without disturbing other config lookups.
+ */
+export const withProfileOverride = (
+  base: ConfigProvider.ConfigProvider,
+  profile: string | undefined,
+): ConfigProvider.ConfigProvider => {
+  if (profile === undefined) return base;
+  const overrides: Record<string, string> = { ALCHEMY_PROFILE: profile };
+  const overrideProvider = ConfigProvider.make((path) =>
+    Effect.succeed(
+      path.length === 1 && typeof path[0] === "string" && path[0] in overrides
+        ? ConfigProvider.makeValue(overrides[path[0]]!)
+        : undefined,
+    ),
+  );
+  return ConfigProvider.orElse(base)(overrideProvider);
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Auth/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Auth/index.ts
new file mode 100644
index 00000000000..df398c61bd1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Auth/index.ts
@@ -0,0 +1,4 @@
+export * from "./AuthProvider.ts";
+export * from "./Credentials.ts";
+export * from "./Env.ts";
+export * from "./Profile.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Annotation.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Annotation.ts
new file mode 100644
index 00000000000..afe45fe8d3e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Annotation.ts
@@ -0,0 +1,114 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type AnnotationProps = Axiom.CreateAnnotationInput;
+
+export type Annotation = Resource<
+  "Axiom.Annotation",
+  AnnotationProps,
+  Axiom.CreateAnnotationOutput,
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom annotation — a vertical marker overlaid on charts to flag a
+ * deploy, incident, feature flag flip, or any other point/range event you
+ * want correlated with telemetry.
+ *
+ * Annotations are scoped to one or more `datasets`. Use a single `time` for
+ * a point marker or `time` + `endTime` for a range. The `type` (e.g.
+ * `"deploy"`, `"incident"`) groups markers visually in the UI.
+ *
+ * Although typically created at deploy/release time (out-of-band of
+ * regular IaC), modelling them as resources makes per-environment
+ * annotation history reproducible.
+ *
+ * @see https://axiom.co/docs/query-data/annotate-charts
+ *
+ * @section Creating an Annotation
+ * @example Point-in-time deploy marker
+ * ```typescript
+ * yield* Axiom.Annotation("deploy-1.2.3", {
+ *   type: "deploy",
+ *   title: "Release 1.2.3",
+ *   description: "https://github.com/acme/app/releases/tag/v1.2.3",
+ *   datasets: ["my-app-traces", "my-app-logs"],
+ *   time: new Date().toISOString(),
+ *   url: "https://github.com/acme/app/releases/tag/v1.2.3",
+ * });
+ * ```
+ *
+ * @example Incident time-range
+ * ```typescript
+ * yield* Axiom.Annotation("inc-2026-04-27", {
+ *   type: "incident",
+ *   title: "Database failover",
+ *   datasets: ["my-app-traces"],
+ *   time:    "2026-04-27T18:05:00Z",
+ *   endTime: "2026-04-27T18:32:00Z",
+ *   url: "https://incident.io/incidents/abc123",
+ * });
+ * ```
+ */
+export const Annotation = Resource<Annotation>("Axiom.Annotation");
+
+export const AnnotationProvider = () =>
+  Provider.effect(
+    Annotation,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createAnnotation;
+      const update = yield* Axiom.updateAnnotation;
+      const get = yield* Axiom.getAnnotation;
+      const del = yield* Axiom.deleteAnnotation;
+
+      return {
+        stables: ["id"],
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom assigns the annotation id server-side, so the
+          // only handle to a previously-created annotation is the cached
+          // `output.id`. Probe for live state with that id; treat NotFound
+          // (deleted out-of-band, or never created) as "no observed state".
+          const observed = output?.id
+            ? yield* get({ id: output.id }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // Ensure — when no observed annotation exists, POST creates one
+          // and Axiom assigns the id.
+          if (observed === undefined) {
+            return yield* create(news);
+          }
+
+          // Sync — the annotation exists; apply desired props with PUT and
+          // preserve the stable id and original time as fallbacks.
+          const result = yield* update({ ...news, id: observed.id! });
+          return {
+            ...result,
+            id: observed.id!,
+            time: result.time ?? output?.time ?? news.time,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.map((current) => ({
+              ...current,
+              id: current.id ?? output.id,
+              time: current.time ?? output.time,
+            })),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/ApiToken.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/ApiToken.ts
new file mode 100644
index 00000000000..3be0dad06c6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/ApiToken.ts
@@ -0,0 +1,134 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { deepEqual, isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type ApiTokenProps = Omit<Axiom.CreateAPITokenInput, never>;
+
+export type ApiToken = Resource<
+  "Axiom.ApiToken",
+  ApiTokenProps,
+  Omit<Axiom.CreateAPITokenOutput, "token"> & {
+    /**
+     * The bearer token. Returned only by `create` (and `regenerate`); Axiom
+     * does not return it on subsequent reads. Persisted in resource state via
+     * `Redacted` — handle with care.
+     */
+    token: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom API token — a scoped bearer token used to authenticate API
+ * requests (ingest, query, admin). Capabilities are pinned at creation time;
+ * changing any field triggers a **replacement** because Axiom does not
+ * expose an update endpoint.
+ *
+ * The raw token value is returned only by `create`. After that, Axiom
+ * never echoes it back, so it is captured into `output.token` (as a
+ * {@link Redacted}) on initial create and persisted in resource state.
+ * Treat resource state as sensitive — anyone with read access can recover
+ * the token. Pair with a secret store for downstream consumption.
+ *
+ * @see https://axiom.co/docs/reference/tokens
+ *
+ * @section Creating an API Token
+ * @example Ingest-only token scoped to one dataset
+ * ```typescript
+ * const ingest = yield* Axiom.ApiToken("ingest", {
+ *   name: "prod-ingest",
+ *   description: "OTEL collector ingest",
+ *   datasetCapabilities: {
+ *     "my-app-traces": { ingest: ["create"] },
+ *   },
+ * });
+ * ```
+ *
+ * @example Read-only query token
+ * ```typescript
+ * yield* Axiom.ApiToken("query", {
+ *   name: "grafana-reader",
+ *   datasetCapabilities: {
+ *     "my-app-traces": { query: ["read"] },
+ *     "my-app-logs":   { query: ["read"] },
+ *   },
+ * });
+ * ```
+ *
+ * @section Consuming the Token
+ * @example Forward the token via Cloudflare Secrets
+ * ```typescript
+ * const secret = yield* Cloudflare.Secret("axiom-token", {
+ *   value: ingest.token,
+ * });
+ * ```
+ */
+export const ApiToken = Resource<ApiToken>("Axiom.ApiToken");
+
+export const ApiTokenProvider = () =>
+  Provider.effect(
+    ApiToken,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createAPIToken;
+      const get = yield* Axiom.getAPIToken;
+      const del = yield* Axiom.deleteAPIToken;
+
+      return {
+        stables: ["id", "token"],
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          // First create — let the engine create normally.
+          if (output == null) return undefined;
+          // Axiom has no update endpoint for tokens, so any actual change
+          // to the inputs forces a replacement (which mints a new bearer
+          // value). If nothing changed, fall through to `noop` so we don't
+          // needlessly rotate the token on every deploy.
+          if (deepEqual(olds, news)) return undefined;
+          return { action: "replace" } as const;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom does not expose an update endpoint for tokens,
+          // so any actual change to the inputs is forced to a replacement
+          // by `diff` above. That means by the time `reconcile` runs we
+          // are either (a) creating fresh, or (b) re-reconciling identical
+          // inputs against an existing token.
+          if (output !== undefined) {
+            // Identical inputs — Axiom does not echo the bearer back, so
+            // the cached `output` (with the persisted Redacted token) is
+            // the authoritative current state.
+            return output;
+          }
+
+          // Ensure — mint a new token. Axiom returns the bearer exactly
+          // once; capture it into Redacted state for downstream consumers.
+          const result = yield* create(news);
+          if (!result.token) {
+            return yield* Effect.die(
+              new Error("Axiom did not return a token on create"),
+            );
+          }
+          return {
+            ...result,
+            token: Redacted.make(result.token),
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.map((current) => ({ ...current, token: output.token })),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/AuthProvider.ts
new file mode 100644
index 00000000000..6c52c99a077
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/AuthProvider.ts
@@ -0,0 +1,344 @@
+import { DEFAULT_API_BASE_URL } from "@distilled.cloud/axiom/Credentials";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import { getEnv, getEnvRedacted, retryOnce } from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+const STORAGE_KEY = "axiom-stored";
+
+const options: Array<{
+  value: AxiomAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "AXIOM_TOKEN (or AXIOM_API_KEY) + optional AXIOM_ORG_ID, AXIOM_URL",
+  },
+  {
+    value: "stored",
+    label: "API Token or Personal Access Token",
+    hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+export type AxiomAuthConfig =
+  | { method: "env" }
+  | { method: "stored"; credentialType: "apiToken" }
+  | { method: "stored"; credentialType: "pat" };
+
+export type AxiomStoredCredentials =
+  | { type: "apiToken"; apiToken: string; apiBaseUrl?: string; orgId?: string }
+  | { type: "pat"; apiToken: string; apiBaseUrl?: string; orgId: string };
+
+export type AxiomResolvedCredentials =
+  | {
+      type: "apiToken";
+      apiToken: Redacted.Redacted<string>;
+      apiBaseUrl: string;
+      orgId?: string;
+      source: { type: AxiomAuthConfig["method"]; details?: string };
+    }
+  | {
+      type: "pat";
+      apiToken: Redacted.Redacted<string>;
+      apiBaseUrl: string;
+      orgId: string;
+      source: { type: AxiomAuthConfig["method"]; details?: string };
+    };
+
+export const AXIOM_AUTH_PROVIDER_NAME = "Axiom";
+
+const promptOrgId = (required: boolean) =>
+  getEnv("AXIOM_ORG_ID").pipe(
+    Effect.flatMap((envOrgId) =>
+      Clank.text({
+        message: required
+          ? "Axiom Org ID (required for PAT)"
+          : "Axiom Org ID (Enter to skip)",
+        placeholder: envOrgId ?? "",
+        defaultValue: envOrgId ?? "",
+        validate: required
+          ? (v) => (v.length === 0 ? "Required" : undefined)
+          : undefined,
+      }).pipe(retryOnce),
+    ),
+  );
+
+/**
+ * Layer that registers the Axiom {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the Axiom
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const AxiomAuth = AuthProviderLayer<
+  AxiomAuthConfig,
+  AxiomResolvedCredentials
+>()(
+  AXIOM_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const credentialType = yield* Clank.select({
+        message: "Axiom credential type",
+        options: [
+          {
+            value: "apiToken" as const,
+            label: "API Token",
+            hint: "recommended — scoped to specific datasets/actions",
+          },
+          {
+            value: "pat" as const,
+            label: "Personal Access Token",
+            hint: "full account control, requires Org ID",
+          },
+        ],
+      }).pipe(retryOnce);
+
+      const apiBaseUrlPrompt = yield* Clank.text({
+        message: "Axiom API Base URL (Enter for default)",
+        placeholder: DEFAULT_API_BASE_URL,
+        defaultValue: DEFAULT_API_BASE_URL,
+      }).pipe(retryOnce);
+      const apiBaseUrl =
+        apiBaseUrlPrompt && apiBaseUrlPrompt.length > 0
+          ? apiBaseUrlPrompt
+          : undefined;
+
+      return yield* Match.value(credentialType).pipe(
+        Match.when("apiToken", () =>
+          Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+              message: "Axiom API Token",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const orgId = yield* promptOrgId(false);
+
+            yield* store.write<AxiomStoredCredentials>(
+              profileName,
+              STORAGE_KEY,
+              {
+                type: "apiToken",
+                apiToken,
+                apiBaseUrl,
+                orgId: orgId && orgId.length > 0 ? orgId : undefined,
+              },
+            );
+            yield* Clank.success("Axiom: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "apiToken" as const,
+            };
+          }),
+        ),
+        Match.when("pat", () =>
+          Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+              message: "Axiom Personal Access Token",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const orgId = yield* promptOrgId(true);
+
+            yield* store.write<AxiomStoredCredentials>(
+              profileName,
+              STORAGE_KEY,
+              { type: "pat", apiToken, apiBaseUrl, orgId },
+            );
+            yield* Clank.success("Axiom: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "pat" as const,
+            };
+          }),
+        ),
+        Match.exhaustive,
+      );
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Axiom authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: AxiomAuthConfig,
+    ): Effect.Effect<AxiomResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const apiToken =
+              (yield* getEnvRedacted("AXIOM_TOKEN")) ??
+              (yield* getEnvRedacted("AXIOM_API_KEY"));
+            if (!apiToken) {
+              return yield* new AuthError({
+                message:
+                  "Axiom env credentials not found. Set AXIOM_TOKEN (or AXIOM_API_KEY).",
+              });
+            }
+            const apiBaseUrl =
+              (yield* getEnv("AXIOM_URL")) ?? DEFAULT_API_BASE_URL;
+            const orgId = yield* getEnv("AXIOM_ORG_ID");
+            if (orgId) {
+              return {
+                type: "pat" as const,
+                apiToken,
+                apiBaseUrl,
+                orgId,
+                source: { type: "env" as const },
+              };
+            }
+            return {
+              type: "apiToken" as const,
+              apiToken,
+              apiBaseUrl,
+              source: { type: "env" as const },
+            };
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store.read<AxiomStoredCredentials>(profileName, STORAGE_KEY).pipe(
+            Effect.flatMap((creds) =>
+              creds == null
+                ? Effect.fail(
+                    new AuthError({
+                      message:
+                        "Axiom stored credentials not found. Run: alchemy login --configure",
+                    }),
+                  )
+                : Effect.succeed(
+                    Match.value(creds).pipe(
+                      Match.when({ type: "apiToken" }, (c) => ({
+                        type: "apiToken" as const,
+                        apiToken: Redacted.make(c.apiToken),
+                        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+                        orgId: c.orgId,
+                        source: { type: "stored" as const },
+                      })),
+                      Match.when({ type: "pat" }, (c) => ({
+                        type: "pat" as const,
+                        apiToken: Redacted.make(c.apiToken),
+                        apiBaseUrl: c.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+                        orgId: c.orgId,
+                        source: { type: "stored" as const },
+                      })),
+                      Match.exhaustive,
+                    ),
+                  ),
+            ),
+          ),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: AxiomAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, STORAGE_KEY)
+            .pipe(
+              Effect.andThen(
+                Clank.success("Axiom: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: AxiomAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<AxiomStoredCredentials>(profileName, STORAGE_KEY)
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: AxiomAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) =>
+              Effect.all([
+                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+                Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
+                Console.log(`  orgId: ${c.orgId ?? "(none)"}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.when({ type: "pat" }, (c) =>
+              Effect.all([
+                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+                Console.log(`  apiBaseUrl: ${c.apiBaseUrl}`),
+                Console.log(`  orgId: ${c.orgId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.exhaustive,
+          );
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Chart.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Chart.ts
new file mode 100644
index 00000000000..6fae44a8ed6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Chart.ts
@@ -0,0 +1,148 @@
+/**
+ * Typed view of the Axiom dashboard chart-JSON subset.
+ *
+ * Axiom's `CreateDashboardInput` declares
+ * `dashboard.charts: ReadonlyArray<unknown>` (see
+ * `@distilled.cloud/axiom/.../v2/createDashboard.ts`); these
+ * interfaces give callers compile-time safety when building the
+ * payload by hand.
+ *
+ * `chart.id` is a free-form string the author picks — Axiom
+ * doesn't validate the format. It joins to the matching
+ * `LayoutCell.i` in `dashboard.layout`.
+ */
+
+/**
+ * Axiom-validated chart kinds. Discovered by probing
+ * `POST /v2/dashboards`: anything else returns
+ * `dashboard validation failed at [charts N type]: Invalid input`.
+ */
+export type ChartKind =
+  | "TimeSeries"
+  | "Table"
+  | "Pie"
+  | "Statistic"
+  | "Heatmap"
+  | "LogStream"
+  | "Note"
+  | "SmartFilter";
+
+/**
+ * Minimum chart payload Axiom's `POST /v2/dashboards` accepts.
+ * Any unknown keys (e.g. `dataset`, `description`) trigger
+ * `Unrecognized keys: "<name>"`, so this struct is intentionally
+ * narrow. The dataset is implicit via the APL query.
+ */
+export interface BaseChart {
+  readonly id: string;
+  readonly name: string;
+  readonly type: ChartKind;
+  readonly query: { readonly apl: string };
+}
+
+export interface TimeSeriesChart extends BaseChart {
+  readonly type: "TimeSeries";
+}
+
+export interface TableChart extends BaseChart {
+  readonly type: "Table";
+}
+
+export interface PieChart extends BaseChart {
+  readonly type: "Pie";
+}
+
+export interface StatisticChart extends BaseChart {
+  readonly type: "Statistic";
+}
+
+export interface HeatmapChart extends BaseChart {
+  readonly type: "Heatmap";
+}
+
+export interface LogStreamChart extends BaseChart {
+  readonly type: "LogStream";
+}
+
+export interface NoteChart extends BaseChart {
+  readonly type: "Note";
+}
+
+/**
+ * A dashboard filter bar (Axiom calls it `SmartFilter` on the wire,
+ * `Filter bar` in the UI). Holds one or more filters whose IDs can
+ * be referenced from other charts' APL via
+ * `declare query_parameters (<filter-id>:string = "")`.
+ *
+ * Unlike data charts, `SmartFilter` has no top-level `query` field —
+ * each filter inside `filters` may carry its own option-source APL.
+ */
+export interface SmartFilterChart {
+  readonly id: string;
+  readonly type: "SmartFilter";
+  /** Optional display name for the filter bar element. */
+  readonly name?: string;
+  readonly filters: readonly SmartFilter[];
+}
+
+/**
+ * One filter inside a {@link SmartFilterChart}. Either a free-text
+ * `search` filter or a dropdown `select` filter. Select filters draw
+ * their options from either an inline `list` or an APL `query`.
+ */
+export type SmartFilter = SmartFilterSearch | SmartFilterSelect;
+
+export interface SmartFilterSearch {
+  readonly id: string;
+  readonly type: "search";
+  readonly name?: string;
+  readonly active?: boolean;
+}
+
+export interface SmartFilterSelect {
+  readonly id: string;
+  readonly type: "select";
+  readonly name?: string;
+  readonly active?: boolean;
+  /** `"list"` for inline `options`, `"apl"` for a query-driven dropdown. */
+  readonly selectType?: "list" | "apl";
+  /**
+   * APL query that returns rows shaped `{ key, value }`. Axiom shows
+   * `key` in the dropdown and substitutes `value` into chart queries.
+   */
+  readonly apl?: { readonly apl: string };
+  /** Inline key/value options when `selectType === "list"`. */
+  readonly options?: readonly {
+    readonly id?: string;
+    readonly key: string;
+    readonly value: string;
+    readonly default?: boolean;
+  }[];
+}
+
+export type Chart =
+  | TimeSeriesChart
+  | TableChart
+  | PieChart
+  | StatisticChart
+  | HeatmapChart
+  | LogStreamChart
+  | NoteChart
+  | SmartFilterChart;
+
+/**
+ * Mirrors Axiom's `CreateDashboardInput.dashboard.layout` cell schema.
+ * `i` references a chart by its `id`.
+ */
+export interface LayoutCell {
+  readonly i: string;
+  readonly x: number;
+  readonly y: number | null;
+  readonly w: number;
+  readonly h: number;
+  readonly minW?: number;
+  readonly minH?: number;
+  readonly maxW?: number;
+  readonly maxH?: number;
+  readonly static?: boolean;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Credentials.ts
new file mode 100644
index 00000000000..69989d6a006
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Credentials.ts
@@ -0,0 +1,65 @@
+import { Credentials } from "@distilled.cloud/axiom/Credentials";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Match from "effect/Match";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  AXIOM_AUTH_PROVIDER_NAME,
+  type AxiomAuthConfig,
+  type AxiomResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export {
+  Credentials,
+  CredentialsFromEnv,
+  DEFAULT_API_BASE_URL,
+} from "@distilled.cloud/axiom/Credentials";
+
+/**
+ * Build a `Credentials` layer that resolves Axiom credentials via the Alchemy
+ * AuthProvider using the configured profile (defaults to "default", overridable
+ * with the `ALCHEMY_PROFILE` env/config value).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    Credentials,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        AxiomAuthConfig,
+        AxiomResolvedCredentials
+      >(AXIOM_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as AxiomAuthConfig),
+        ),
+        Effect.map((creds) =>
+          Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) => ({
+              apiKey: c.apiToken,
+              apiBaseUrl: c.apiBaseUrl,
+              orgId: c.orgId,
+            })),
+            Match.when({ type: "pat" }, (c) => ({
+              apiKey: c.apiToken,
+              apiBaseUrl: c.apiBaseUrl,
+              orgId: c.orgId,
+            })),
+            Match.exhaustive,
+          ),
+        ),
+        Effect.mapError(
+          (e) =>
+            new ConfigError({
+              message: `Failed to resolve Axiom credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+      );
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Dashboard.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Dashboard.ts
new file mode 100644
index 00000000000..d1b533b3ce1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Dashboard.ts
@@ -0,0 +1,201 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Chart, LayoutCell } from "./Chart.ts";
+import type { Providers } from "./Providers.ts";
+
+type DashboardDoc = Axiom.CreateDashboardInput["dashboard"];
+
+/**
+ * Dashboard input. Mirrors `Operations.CreateDashboardInput` but
+ * narrows `dashboard.charts` and `dashboard.layout` to the typed
+ * {@link Chart} / {@link LayoutCell} shapes (Axiom declares them
+ * as `Schema.Array(Schema.Unknown)`, so this is a compile-time-only
+ * refinement; runtime validation is unchanged).
+ */
+export type DashboardProps = Omit<Axiom.CreateDashboardInput, "dashboard"> & {
+  readonly dashboard: Omit<DashboardDoc, "charts" | "layout"> & {
+    readonly charts: readonly Chart[];
+    readonly layout: readonly LayoutCell[];
+  };
+};
+
+export type Dashboard = Resource<
+  "Axiom.Dashboard",
+  DashboardProps,
+  {
+    /** Stable Axiom dashboard `uid` (used as the path identifier). */
+    uid: string;
+    id: string;
+    createdAt: string;
+    createdBy: string;
+    updatedAt: string;
+    updatedBy: string;
+    /** The full dashboard document as returned by Axiom. */
+    dashboard: Axiom.CreateDashboardOutput["dashboard"]["dashboard"];
+  },
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom dashboard — a named, layout-driven collection of charts. Each
+ * dashboard takes a full document (`charts` + `layout` array of grid cells +
+ * `timeWindow` + `refreshTime`) at version `schemaVersion: 2`.
+ *
+ * Charts are typed via {@link Chart} (a discriminated union over the
+ * Axiom-validated chart kinds — `TimeSeries`, `Table`, `Pie`, `Statistic`,
+ * `Heatmap`, `LogStream`, `Note`). The `id` on each chart is a free-form
+ * string the author picks; layout cells join via `LayoutCell.i`.
+ *
+ * The path identifier is `uid` (auto-assigned by Axiom). `id` is also
+ * exposed as an output but the API uses `uid` everywhere.
+ *
+ * Notes from probing `POST /v2/dashboards`:
+ *
+ * - Relative time windows must use the `qr-now-{duration}` form (e.g.
+ *   `"qr-now-7d"` / `"qr-now"`); plain `"now-7d"` is rejected.
+ * - When authenticating with an API token, `dashboard.owner` must be `""`
+ *   (Axiom rewrites this to the org-shared `X-AXIOM-EVERYONE`); per-user
+ *   "private" dashboards aren't allowed for tokens.
+ * - The chart payload is strict: only `id`, `name`, `type`, `query`. Extra
+ *   keys (e.g. `dataset`, `description`) trigger
+ *   `Unrecognized keys: "<name>"`.
+ *
+ * @see https://axiom.co/docs/query-data/dashboards
+ *
+ * @section Creating a Dashboard
+ * @example Minimal empty dashboard
+ * ```typescript
+ * yield* Axiom.Dashboard("ops", {
+ *   dashboard: {
+ *     name: "Ops Overview",
+ *     owner: "",                 // org-shared (required for API tokens)
+ *     description: "Top-level service health",
+ *     charts: [],
+ *     layout: [],
+ *     refreshTime: 60,           // seconds: 15 | 60 | 300
+ *     schemaVersion: 2,
+ *     timeWindowStart: "qr-now-1h",
+ *     timeWindowEnd: "qr-now",
+ *   },
+ * });
+ * ```
+ *
+ * @example One-chart dashboard
+ * ```typescript
+ * import type { Chart, LayoutCell } from "alchemy/Axiom";
+ *
+ * const errors: Chart = {
+ *   id: "errors-5m",
+ *   name: "5xx errors / 5m",
+ *   type: "TimeSeries",
+ *   query: {
+ *     apl: `['my-app-traces']
+ *       | where status >= 500
+ *       | summarize count() by bin_auto(_time)`,
+ *   },
+ * };
+ *
+ * yield* Axiom.Dashboard("errors", {
+ *   dashboard: {
+ *     name: "Errors",
+ *     owner: "",
+ *     refreshTime: 60,
+ *     schemaVersion: 2,
+ *     timeWindowStart: "qr-now-24h",
+ *     timeWindowEnd: "qr-now",
+ *     charts: [errors],
+ *     layout: [{ i: errors.id, x: 0, y: 0, w: 12, h: 6 } satisfies LayoutCell],
+ *   },
+ * });
+ * ```
+ *
+ * @example Compare to last 24h
+ * ```typescript
+ * yield* Axiom.Dashboard("compare", {
+ *   dashboard: {
+ *     name: "Compare vs yesterday",
+ *     owner: "",
+ *     refreshTime: 300,
+ *     schemaVersion: 2,
+ *     timeWindowStart: "qr-now-1h",
+ *     timeWindowEnd: "qr-now",
+ *     against: "-1d",            // overlay the same window from 24h ago
+ *     charts: [],
+ *     layout: [],
+ *   },
+ * });
+ * ```
+ */
+export const Dashboard = Resource<Dashboard>("Axiom.Dashboard");
+
+export const DashboardProvider = () =>
+  Provider.effect(
+    Dashboard,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createDashboard;
+      const update = yield* Axiom.updateDashboard;
+      const get = yield* Axiom.getDashboard;
+      const del = yield* Axiom.deleteDashboard;
+
+      const toAttrsFromCreate = (envelope: Axiom.CreateDashboardOutput) => ({
+        uid: envelope.dashboard.uid,
+        id: envelope.dashboard.id,
+        createdAt: envelope.dashboard.createdAt,
+        createdBy: envelope.dashboard.createdBy,
+        updatedAt: envelope.dashboard.updatedAt,
+        updatedBy: envelope.dashboard.updatedBy,
+        dashboard: envelope.dashboard.dashboard,
+      });
+      const toAttrsFromGet = (current: Axiom.GetDashboardOutput) => ({
+        uid: current.uid,
+        id: current.id,
+        createdAt: current.createdAt,
+        createdBy: current.createdBy,
+        updatedAt: current.updatedAt,
+        updatedBy: current.updatedBy,
+        dashboard: current.dashboard,
+      });
+
+      return {
+        stables: ["uid", "id", "createdAt", "createdBy"],
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — `uid` is server-assigned at create time. We probe
+          // Axiom for the dashboard via the cached uid; treat NotFound
+          // (deleted out-of-band) as "no observed state" so we converge
+          // by re-creating.
+          const observed = output?.uid
+            ? yield* get({ uid: output.uid }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // Ensure — POST mints a new dashboard with a fresh uid.
+          if (observed === undefined) {
+            return toAttrsFromCreate(yield* create(news));
+          }
+
+          // Sync — `overwrite: true` short-circuits Axiom's optimistic-
+          // concurrency check (otherwise the API requires the caller to
+          // echo back the server-side `version`, which we don't track).
+          return toAttrsFromCreate(
+            yield* update({ ...news, uid: observed.uid, overwrite: true }),
+          );
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ uid: output.uid }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.uid) return undefined;
+          return yield* get({ uid: output.uid }).pipe(
+            Effect.map(toAttrsFromGet),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Dataset.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Dataset.ts
new file mode 100644
index 00000000000..4ac1f061bea
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Dataset.ts
@@ -0,0 +1,301 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import { Credentials } from "@distilled.cloud/axiom/Credentials";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../AdoptPolicy.ts";
+import { isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { Stack } from "../Stack.ts";
+import { Stage } from "../Stage.ts";
+import type { Providers } from "./Providers.ts";
+
+export type DatasetKind =
+  | "otel:metrics:v1"
+  | "otel:traces:v1"
+  | "otel:logs:v1"
+  | "axiom:events:v1";
+
+export type DatasetProps = {
+  /**
+   * Dataset name. Used as the dataset's stable identifier in Axiom — changing
+   * this triggers a replacement.
+   */
+  name: string;
+  /** Free-form description shown in the Axiom UI. */
+  description?: string;
+  /**
+   * Dataset kind. Defaults to `axiom:events:v1`.
+   *
+   * For OTEL pipelines, choose:
+   * - `otel:traces:v1` for traces
+   * - `otel:logs:v1` for logs
+   * - `otel:metrics:v1` for metrics
+   *
+   * Cannot be changed after creation — triggers a replacement.
+   */
+  kind?: DatasetKind;
+  /** Retention in days. Plan-dependent — see Axiom docs. */
+  retentionDays?: number;
+  /** Whether to enforce the configured retention period. */
+  useRetentionPeriod?: boolean;
+};
+
+export type Dataset = Resource<
+  "Axiom.Dataset",
+  DatasetProps,
+  {
+    id: string;
+    name: string;
+    kind: DatasetKind;
+    description: string;
+    created: string;
+    apiBaseUrl: string;
+    /** Root OTLP endpoint (`${apiBaseUrl}`). Most exporters auto-append the signal path. */
+    otelEndpoint: string;
+    /** OTLP/HTTP traces endpoint. */
+    otelTracesEndpoint: string;
+    /** OTLP/HTTP logs endpoint. */
+    otelLogsEndpoint: string;
+    /** OTLP/HTTP metrics endpoint. */
+    otelMetricsEndpoint: string;
+    /**
+     * Headers required for OTLP shipping aside from the bearer token.
+     * Add `Authorization: Bearer <AXIOM_TOKEN>` separately at runtime so the
+     * secret is never persisted in resource state.
+     */
+    otelHeaders: Record<string, string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom dataset — the top-level container that stores events, logs,
+ * traces, or metrics. Pick a `kind` up-front: it determines schema and how
+ * the data is shown in the UI, and **cannot be changed** after creation
+ * (changing it triggers a replacement, which deletes the data).
+ *
+ * Datasets expose Axiom's OTLP/HTTP endpoints (`otelTracesEndpoint`,
+ * `otelLogsEndpoint`, `otelMetricsEndpoint`) as output attributes so you can
+ * inject them into a Worker / Lambda's env vars for OpenTelemetry shipping.
+ * The bearer token is **not** stored in resource state — supply
+ * `Authorization: Bearer <AXIOM_TOKEN>` separately at runtime.
+ *
+ * @see https://axiom.co/docs/reference/datasets
+ * @see https://axiom.co/docs/send-data/opentelemetry — OTLP endpoint reference
+ *
+ * @section Creating a Dataset
+ * @example Logs dataset with 30-day retention
+ * ```typescript
+ * const logs = yield* Axiom.Dataset("app-logs", {
+ *   name: "my-app-logs",
+ *   kind: "otel:logs:v1",
+ *   description: "Application logs from prod workers",
+ *   retentionDays: 30,
+ *   useRetentionPeriod: true,
+ * });
+ * ```
+ *
+ * @example Separate datasets per OTEL signal
+ * ```typescript
+ * const traces  = yield* Axiom.Dataset("traces",  { name: "app-traces",  kind: "otel:traces:v1"  });
+ * const logs    = yield* Axiom.Dataset("logs",    { name: "app-logs",    kind: "otel:logs:v1"    });
+ * const metrics = yield* Axiom.Dataset("metrics", { name: "app-metrics", kind: "otel:metrics:v1" });
+ * ```
+ *
+ * @section Shipping OTEL data
+ * @example Wire OTEL env vars into a Cloudflare Worker
+ * ```typescript
+ * yield* Cloudflare.Worker("api", {
+ *   vars: {
+ *     OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: traces.otelTracesEndpoint,
+ *     OTEL_EXPORTER_OTLP_LOGS_ENDPOINT:   logs.otelLogsEndpoint,
+ *     // Bearer token must come from a secret store, not the dataset state.
+ *     OTEL_EXPORTER_OTLP_HEADERS:
+ *       `Authorization=Bearer ${env.AXIOM_TOKEN},X-Axiom-Dataset=${traces.name}`,
+ *   },
+ * });
+ * ```
+ */
+export const Dataset = Resource<Dataset>("Axiom.Dataset");
+
+/**
+ * Axiom has no tags/labels API. The only writable field we can use to mark
+ * ownership is `description`. We append a deterministic marker on create so
+ * that on a re-apply (e.g. state was wiped) we can safely identify a dataset
+ * that **we** previously created and adopt it idempotently — without
+ * accidentally hijacking a dataset created by someone else with the same name.
+ */
+const MARKER_RE = /\s*\[alchemy:stack=([^;]+);stage=([^;]+);id=([^\]]+)\]\s*$/;
+
+const buildMarker = (stack: string, stage: string, id: string) =>
+  `[alchemy:stack=${stack};stage=${stage};id=${id}]`;
+
+const augmentDescription = (
+  description: string | undefined,
+  marker: string,
+) => {
+  const base = stripMarker(description ?? "");
+  return base.length > 0 ? `${base}\n${marker}` : marker;
+};
+
+const stripMarker = (description: string): string =>
+  description.replace(MARKER_RE, "").trimEnd();
+
+const parseMarker = (
+  description: string | undefined,
+): { stack: string; stage: string; id: string } | undefined => {
+  if (!description) return undefined;
+  const m = description.match(MARKER_RE);
+  if (!m) return undefined;
+  return { stack: m[1], stage: m[2], id: m[3] };
+};
+
+const buildOtelAttrs = (apiBaseUrl: string, name: string) => {
+  const root = apiBaseUrl.replace(/\/$/, "");
+  return {
+    apiBaseUrl: root,
+    otelEndpoint: root,
+    otelTracesEndpoint: `${root}/v1/traces`,
+    otelLogsEndpoint: `${root}/v1/logs`,
+    otelMetricsEndpoint: `${root}/v1/metrics`,
+    otelHeaders: { "X-Axiom-Dataset": name } as Record<string, string>,
+  };
+};
+
+export const DatasetProvider = () =>
+  Provider.effect(
+    Dataset,
+    Effect.gen(function* () {
+      const { apiBaseUrl } = yield* Credentials;
+      const create = yield* Axiom.createDataset;
+      const update = yield* Axiom.updateDataset;
+      const get = yield* Axiom.getDataset;
+      const del = yield* Axiom.deleteDataset;
+
+      const toAttrs = (dataset: Axiom.CreateDatasetOutput) => ({
+        id: dataset.id,
+        name: dataset.name,
+        kind: dataset.kind,
+        description: stripMarker(dataset.description),
+        created: dataset.created,
+        ...buildOtelAttrs(apiBaseUrl, dataset.name),
+      });
+
+      return {
+        stables: ["id", "name", "kind"],
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (output && news.name !== output.name) {
+            return { action: "replace" } as const;
+          }
+          if (news.kind && output && news.kind !== output.kind) {
+            return { action: "replace" } as const;
+          }
+          if (
+            news.description !== olds?.description ||
+            news.retentionDays !== olds?.retentionDays ||
+            news.useRetentionPeriod !== olds?.useRetentionPeriod
+          ) {
+            return { action: "update" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const stack = yield* Stack;
+          const stage = yield* Stage;
+          const marker = buildMarker(stack.name, stage, id);
+
+          // Observe — Axiom's dataset path identifier is `name`, which is
+          // also stable input. Probe for live state by name (preferring the
+          // cached `output.id` when present). `read` upstream has already
+          // surfaced foreign datasets as `Unowned`, so by the time we land
+          // here mutation is safe.
+          const datasetId = output?.id ?? news.name;
+          const observed = yield* get({ dataset_id: datasetId }).pipe(
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+
+          // Ensure — POST creates the dataset. Tolerate Conflict/
+          // UnprocessableEntity as a race with a peer reconciler (or with
+          // upstream read↔create), falling through to the sync path.
+          let current = observed;
+          if (current === undefined) {
+            current = yield* (
+              create({
+                name: news.name,
+                description: augmentDescription(news.description, marker),
+                kind: news.kind,
+                retentionDays: news.retentionDays,
+                useRetentionPeriod: news.useRetentionPeriod,
+              }) as Effect.Effect<
+                Axiom.CreateDatasetOutput,
+                { readonly _tag: string },
+                never
+              >
+            ).pipe(
+              Effect.catchIf(
+                (
+                  e,
+                ): e is { readonly _tag: "Conflict" | "UnprocessableEntity" } =>
+                  e._tag === "Conflict" || e._tag === "UnprocessableEntity",
+                () =>
+                  update({
+                    dataset_id: news.name,
+                    description: augmentDescription(news.description, marker),
+                    retentionDays: news.retentionDays,
+                    useRetentionPeriod: news.useRetentionPeriod,
+                  }),
+              ),
+            );
+            return toAttrs(current);
+          }
+
+          // Sync — the dataset exists. Apply mutable aspects (description,
+          // retentionDays, useRetentionPeriod) via PATCH. `kind` and `name`
+          // are stable and replacement-only via diff above.
+          const desiredDescription = augmentDescription(
+            news.description,
+            marker,
+          );
+          const needsSync =
+            current.description !== desiredDescription ||
+            current.retentionDays !== news.retentionDays ||
+            current.useRetentionPeriod !== news.useRetentionPeriod;
+          if (!needsSync) {
+            return toAttrs(current);
+          }
+          const updated = yield* update({
+            dataset_id: current.id,
+            description: desiredDescription,
+            retentionDays: news.retentionDays,
+            useRetentionPeriod: news.useRetentionPeriod,
+          });
+          return toAttrs(updated);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ dataset_id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const stack = yield* Stack;
+          const stage = yield* Stage;
+          const datasetId = output?.id ?? olds?.name;
+          if (!datasetId) return undefined;
+          const existing = yield* get({ dataset_id: datasetId }).pipe(
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+          if (!existing) return undefined;
+          const ownership = parseMarker(existing.description);
+          const isOurs =
+            ownership !== undefined &&
+            ownership.stack === stack.name &&
+            ownership.stage === stage &&
+            ownership.id === id;
+          const attrs = toAttrs(existing);
+          return isOurs ? attrs : Unowned(attrs);
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Monitor.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Monitor.ts
new file mode 100644
index 00000000000..f6aad72485a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Monitor.ts
@@ -0,0 +1,137 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type MonitorProps = Axiom.CreateMonitorInput;
+
+export type Monitor = Resource<
+  "Axiom.Monitor",
+  MonitorProps,
+  Axiom.CreateMonitorOutput,
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom monitor — a scheduled APL/MPL query that evaluates on a fixed
+ * cadence and fires alerts via {@link Notifier notifiers} when its
+ * condition is met.
+ *
+ * Three monitor `type`s are supported:
+ *
+ * - **`Threshold`** — fires when an aggregate result crosses a static
+ *   `threshold` (compared with `operator`).
+ * - **`MatchEvent`** — fires for every event matching the query.
+ * - **`AnomalyDetection`** — fires when results deviate from a learned
+ *   baseline by more than `tolerance` over `compareDays`.
+ *
+ * Changing `type` triggers a replacement; everything else updates in place.
+ *
+ * @see https://axiom.co/docs/monitor-data/monitors
+ *
+ * @section Creating a Monitor
+ * @example Threshold: alert on >100 errors per 5m
+ * ```typescript
+ * yield* Axiom.Monitor("error-rate", {
+ *   name: "High error rate",
+ *   description: "Fires when error count exceeds 100/5m",
+ *   type: "Threshold",
+ *   aplQuery: `
+ *     ['my-app-traces']
+ *     | where status >= 500
+ *     | summarize count() by bin_auto(_time)
+ *   `,
+ *   operator: "Above",
+ *   threshold: 100,
+ *   intervalMinutes: 5,
+ *   rangeMinutes: 5,
+ *   alertOnNoData: false,
+ *   resolvable: true,
+ *   notifierIds: [slack.id, pagerduty.id],
+ * });
+ * ```
+ *
+ * @example MatchEvent: alert on every panic
+ * ```typescript
+ * yield* Axiom.Monitor("panics", {
+ *   name: "Service panic",
+ *   type: "MatchEvent",
+ *   aplQuery: `['my-app-logs'] | where message contains "panic:"`,
+ *   intervalMinutes: 1,
+ *   rangeMinutes: 1,
+ *   notifierIds: [pagerduty.id],
+ * });
+ * ```
+ *
+ * @example AnomalyDetection: deviation vs. last 7 days
+ * ```typescript
+ * yield* Axiom.Monitor("traffic-anomaly", {
+ *   name: "Traffic anomaly",
+ *   type: "AnomalyDetection",
+ *   aplQuery: `['my-app-traces'] | summarize count() by bin_auto(_time)`,
+ *   compareDays: 7,
+ *   tolerance: 25,             // %
+ *   intervalMinutes: 15,
+ *   rangeMinutes: 15,
+ *   notifierIds: [slack.id],
+ * });
+ * ```
+ */
+export const Monitor = Resource<Monitor>("Axiom.Monitor");
+
+export const MonitorProvider = () =>
+  Provider.effect(
+    Monitor,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createMonitor;
+      const update = yield* Axiom.updateMonitor;
+      const get = yield* Axiom.getMonitor;
+      const del = yield* Axiom.deleteMonitor;
+
+      return {
+        stables: ["id"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (output && news.type !== output.type) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom assigns the monitor id server-side, so the only
+          // handle to a previously-created monitor is the cached
+          // `output.id`. Probe for live state with that id; treat NotFound
+          // (deleted out-of-band) as "no observed state" so we converge by
+          // re-creating.
+          const observed = output?.id
+            ? yield* get({ id: output.id }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // Ensure — POST mints a new monitor with a fresh id.
+          if (observed === undefined) {
+            return yield* create(news);
+          }
+
+          // Sync — the monitor exists; PATCH against its id with the
+          // desired props. `type` is replacement-only (handled in diff).
+          return yield* update({ ...news, id: observed.id });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Notifier.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Notifier.ts
new file mode 100644
index 00000000000..58de12ebd50
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Notifier.ts
@@ -0,0 +1,125 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type NotifierProps = Axiom.CreateNotifierInput;
+
+export type Notifier = Resource<
+  "Axiom.Notifier",
+  NotifierProps,
+  Axiom.CreateNotifierOutput & { id: string },
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom notifier — an alert destination (Slack, email, PagerDuty,
+ * Opsgenie, Discord, Microsoft Teams, generic webhook, or a fully custom
+ * webhook with templated body/headers) that {@link Monitor monitors} target
+ * via `notifierIds`. Exactly one channel under `properties` should be set.
+ *
+ * @see https://axiom.co/docs/monitor-data/notifiers
+ *
+ * @section Creating a Notifier
+ * @example Slack incoming webhook
+ * ```typescript
+ * const slack = yield* Axiom.Notifier("ops-slack", {
+ *   name: "ops-channel",
+ *   properties: {
+ *     slack: { slackUrl: process.env.SLACK_WEBHOOK_URL! },
+ *   },
+ * });
+ * ```
+ *
+ * @example Email distribution list
+ * ```typescript
+ * yield* Axiom.Notifier("ops-email", {
+ *   name: "ops-team",
+ *   properties: { email: { emails: ["sre@example.com", "oncall@example.com"] } },
+ * });
+ * ```
+ *
+ * @example PagerDuty integration
+ * ```typescript
+ * yield* Axiom.Notifier("pagerduty", {
+ *   name: "primary-oncall",
+ *   properties: {
+ *     pagerduty: { routingKey: process.env.PAGERDUTY_ROUTING_KEY!, token: "" },
+ *   },
+ * });
+ * ```
+ *
+ * @example Custom webhook with templated body
+ * ```typescript
+ * yield* Axiom.Notifier("incident-webhook", {
+ *   name: "incident.io",
+ *   properties: {
+ *     customWebhook: {
+ *       url: "https://api.incident.io/v2/alert_events",
+ *       headers: { "Content-Type": "application/json" },
+ *       secretHeaders: { Authorization: `Bearer ${process.env.INCIDENT_TOKEN}` },
+ *       body: '{"title": "{{.Monitor.Name}}", "status": "firing"}',
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export const Notifier = Resource<Notifier>("Axiom.Notifier");
+
+export const NotifierProvider = () =>
+  Provider.effect(
+    Notifier,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createNotifier;
+      const update = yield* Axiom.updateNotifier;
+      const get = yield* Axiom.getNotifier;
+      const del = yield* Axiom.deleteNotifier;
+
+      return {
+        stables: ["id"],
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom assigns the notifier id server-side, so the
+          // only handle to a previously-created notifier is the cached
+          // `output.id`. Probe for live state with that id; treat NotFound
+          // (deleted out-of-band) as "no observed state" so we converge
+          // by re-creating.
+          const observed = output?.id
+            ? yield* get({ id: output.id }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // Ensure — POST mints a new notifier. The Axiom create response
+          // sometimes omits `id` on the body; default to "" to keep the
+          // attribute shape stable until the next read populates it.
+          if (observed === undefined) {
+            const result = yield* create(news);
+            return { ...result, id: result.id ?? "" };
+          }
+
+          // Sync — the notifier exists; PATCH against its id with the
+          // desired props. Preserve the cached id if the API response
+          // omits it.
+          const result = yield* update({ ...news, id: observed.id! });
+          return { ...result, id: result.id ?? observed.id! };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.map((current) => ({
+              ...current,
+              id: current.id ?? output.id,
+            })),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Providers.ts
new file mode 100644
index 00000000000..358b4e67e99
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/Providers.ts
@@ -0,0 +1,62 @@
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
+import * as Provider from "../Provider.ts";
+import { Annotation, AnnotationProvider } from "./Annotation.ts";
+import { ApiToken, ApiTokenProvider } from "./ApiToken.ts";
+import { AxiomAuth } from "./AuthProvider.ts";
+import * as Credentials from "./Credentials.ts";
+import { Dashboard, DashboardProvider } from "./Dashboard.ts";
+import { Dataset, DatasetProvider } from "./Dataset.ts";
+import { Monitor, MonitorProvider } from "./Monitor.ts";
+import { Notifier, NotifierProvider } from "./Notifier.ts";
+import { View, ViewProvider } from "./View.ts";
+import { VirtualField, VirtualFieldProvider } from "./VirtualField.ts";
+
+export { Credentials } from "@distilled.cloud/axiom/Credentials";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "Axiom",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Axiom providers and credentials. Wires up Dataset, ApiToken, Notifier,
+ * Monitor, Dashboard, VirtualField, View and Annotation resources, and
+ * registers the Axiom AuthProvider so `alchemy login` can configure it.
+ */
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      Annotation,
+      ApiToken,
+      Dashboard,
+      Dataset,
+      Monitor,
+      Notifier,
+      View,
+      VirtualField,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        AnnotationProvider(),
+        ApiTokenProvider(),
+        DashboardProvider(),
+        DatasetProvider(),
+        MonitorProvider(),
+        NotifierProvider(),
+        ViewProvider(),
+        VirtualFieldProvider(),
+      ),
+    ),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(AxiomAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.orDie,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/View.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/View.ts
new file mode 100644
index 00000000000..861d31d6da4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/View.ts
@@ -0,0 +1,119 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type ViewProps = Axiom.CreateViewInput;
+
+export type View = Resource<
+  "Axiom.View",
+  ViewProps,
+  Axiom.CreateViewOutput & {
+    /**
+     * Path identifier used by `updateView` / `getView` / `deleteView`.
+     * Currently derived from `name` because Axiom's view list/get responses
+     * don't expose a separate id field.
+     */
+    id: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom saved view — a named, shareable APL query. Useful for building
+ * starter dashboards, providing canned "open in Axiom" links from your app,
+ * or pinning common investigations the team revisits.
+ *
+ * The path identifier is `name`. Renaming a view triggers a replacement
+ * (the old one is deleted, a new one is created).
+ *
+ * @see https://axiom.co/docs/query-data/datasets — APL query reference
+ *
+ * @section Creating a View
+ * @example Recent errors across one dataset
+ * ```typescript
+ * yield* Axiom.View("recent-errors", {
+ *   name: "recent-errors",
+ *   description: "Last 100 5xx responses",
+ *   datasets: ["my-app-traces"],
+ *   aplQuery: `
+ *     ['my-app-traces']
+ *     | where status >= 500
+ *     | order by _time desc
+ *     | take 100
+ *   `,
+ * });
+ * ```
+ *
+ * @example Cross-dataset join (logs + traces by trace_id)
+ * ```typescript
+ * yield* Axiom.View("trace-with-logs", {
+ *   name: "trace-with-logs",
+ *   datasets: ["my-app-traces", "my-app-logs"],
+ *   aplQuery: `
+ *     ['my-app-traces']
+ *     | where duration_ms > 1000
+ *     | join kind=leftouter (['my-app-logs']) on trace_id
+ *   `,
+ * });
+ * ```
+ */
+export const View = Resource<View>("Axiom.View");
+
+export const ViewProvider = () =>
+  Provider.effect(
+    View,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createView;
+      const update = yield* Axiom.updateView;
+      const get = yield* Axiom.getView;
+      const del = yield* Axiom.deleteView;
+
+      return {
+        stables: ["id"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (output && news.name !== output.name) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — `name` is the path identifier for views. Renames are
+          // forced to a replacement by `diff` above, so the cached
+          // `output.id` (set to `news.name` on first create) and the
+          // current `news.name` always agree by the time we land here.
+          const viewId = output?.id ?? news.name;
+          const observed = yield* get({ id: viewId }).pipe(
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+
+          // Ensure — POST creates the view under `news.name`.
+          if (observed === undefined) {
+            const result = yield* create(news);
+            return { ...result, id: news.name };
+          }
+
+          // Sync — the view exists; PUT against its id with the desired
+          // props.
+          const result = yield* update({ ...news, id: viewId });
+          return { ...result, id: viewId };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.map((current) => ({ ...current, id: output.id })),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/VirtualField.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/VirtualField.ts
new file mode 100644
index 00000000000..bfbd7328174
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/VirtualField.ts
@@ -0,0 +1,105 @@
+import * as Axiom from "@distilled.cloud/axiom";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type VirtualFieldProps = Axiom.CreateVirtualFieldInput;
+
+export type VirtualField = Resource<
+  "Axiom.VirtualField",
+  VirtualFieldProps,
+  Axiom.CreateVirtualFieldOutput,
+  never,
+  Providers
+>;
+
+/**
+ * An Axiom virtual field — a saved APL expression that appears as a derived
+ * column on a dataset at query time. Use these to standardise common
+ * computations (status classes, latency buckets, parsed JSON paths) so
+ * dashboards and monitors don't have to redefine them.
+ *
+ * Bound to a single `dataset`; changing the dataset triggers a replacement.
+ *
+ * @see https://axiom.co/docs/query-data/virtual-fields
+ *
+ * @section Creating a Virtual Field
+ * @example HTTP status class (e.g. 200 → "2xx")
+ * ```typescript
+ * yield* Axiom.VirtualField("status-class", {
+ *   dataset: "my-app-traces",
+ *   name: "status_class",
+ *   description: "HTTP response class bucket",
+ *   expression: 'strcat(tostring(toint(status / 100)), "xx")',
+ *   type: "string",
+ * });
+ * ```
+ *
+ * @example Latency bucket in seconds
+ * ```typescript
+ * yield* Axiom.VirtualField("latency-bucket", {
+ *   dataset: "my-app-traces",
+ *   name: "latency_bucket_s",
+ *   expression: "bin(duration_ms / 1000.0, 0.5)",
+ *   type: "number",
+ *   unit: "s",
+ * });
+ * ```
+ */
+export const VirtualField = Resource<VirtualField>("Axiom.VirtualField");
+
+export const VirtualFieldProvider = () =>
+  Provider.effect(
+    VirtualField,
+    Effect.gen(function* () {
+      const create = yield* Axiom.createVirtualField;
+      const update = yield* Axiom.updateVirtualField;
+      const get = yield* Axiom.getVirtualField;
+      const del = yield* Axiom.deleteVirtualField;
+
+      return {
+        stables: ["id"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (output && news.dataset !== output.dataset) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // Observe — Axiom assigns the virtual-field id server-side, so
+          // the only handle to a previously-created field is the cached
+          // `output.id`. Probe for live state with that id; treat NotFound
+          // (deleted out-of-band) as "no observed state" so we converge by
+          // re-creating.
+          const observed = output?.id
+            ? yield* get({ id: output.id }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // Ensure — POST mints a new virtual field with a fresh id.
+          if (observed === undefined) {
+            return yield* create(news);
+          }
+
+          // Sync — the field exists; PUT against its id with the desired
+          // props. `dataset` is replacement-only (handled in diff).
+          return yield* update({ ...news, id: observed.id });
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* del({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+          return yield* get({ id: output.id }).pipe(
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Axiom/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Axiom/index.ts
new file mode 100644
index 00000000000..4d6388693f5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Axiom/index.ts
@@ -0,0 +1,12 @@
+export * from "./Annotation.ts";
+export * from "./ApiToken.ts";
+export * from "./AuthProvider.ts";
+export * from "./Chart.ts";
+export * from "./Credentials.ts";
+export * from "./Dashboard.ts";
+export * from "./Dataset.ts";
+export * from "./Monitor.ts";
+export * from "./Notifier.ts";
+export * from "./Providers.ts";
+export * from "./View.ts";
+export * from "./VirtualField.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Binding.ts b/.repos/alchemy-effect/packages/alchemy/src/Binding.ts
new file mode 100644
index 00000000000..cbb7bf678e0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Binding.ts
@@ -0,0 +1,219 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { SingleShotGen } from "effect/Utils";
+import type { Input } from "./Input.ts";
+import * as Namespace from "./Namespace.ts";
+import { ALCHEMY_PHASE } from "./Phase.ts";
+import { tryFindProviderByType } from "./Provider.ts";
+import type { ResourceLike } from "./Resource.ts";
+import { RuntimeContext } from "./RuntimeContext.ts";
+import { Self } from "./Self.ts";
+import { CurrentStack } from "./Stack.ts";
+
+export interface ServiceLike {
+  kind: "Service";
+}
+
+export interface ServiceShape<
+  Identifier extends string,
+  Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
+>
+  extends Context.ServiceClass.Shape<Identifier, Shape>, ServiceLike {}
+
+export interface Service<
+  Self,
+  Identifier extends string,
+  Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
+>
+  extends Context.Service<Self, Shape>, ServiceLike {
+  readonly key: Identifier;
+  new (_: never): ServiceShape<Identifier, Shape>;
+  bind: <Req = never>(
+    ...args: BindParameters<Parameters<Shape>, Req>
+  ) => Effect.Effect<
+    Effect.Success<ReturnType<Shape>>,
+    Effect.Error<ReturnType<Shape>>,
+    Self | Effect.Services<ReturnType<Shape>> | Req
+  >;
+}
+
+type BindParameters<
+  Parameters extends any[],
+  Req = never,
+> = Parameters extends [infer First, ...infer Rest]
+  ? [
+      Input<First> | Effect.Effect<First, never, Req>,
+      ...BindParameters<Rest, Req>,
+    ]
+  : [];
+
+/**
+ * Creates a runtime binding service.
+ *
+ * A `Binding.Service` is the runtime-facing half of an operation such as
+ * `GetItem`, `PutObject`, or `Fetch`. It is provided on the function or worker
+ * effect so user code can call `.bind(resource)` and receive a typed runtime
+ * API that already knows how to talk to the target resource.
+ */
+export const Service =
+  <Self, Shape extends (...args: any[]) => Effect.Effect<any, any, any>>() =>
+  <Identifier extends string>(id: Identifier) => {
+    const self = Context.Service<Self, Shape>(id) as Service<
+      Self,
+      Identifier,
+      Shape
+    >;
+    return Object.assign(self, {
+      bind: (...args: Parameters<Shape>) =>
+        self.use((f) =>
+          Effect.all(
+            args.map((arg) =>
+              Effect.isEffect(arg) ? arg : Effect.succeed(arg),
+            ),
+            {
+              concurrency: "unbounded",
+            },
+          ).pipe(Effect.flatMap((args) => f(...args))),
+        ),
+    });
+  };
+
+export interface PolicyLike {
+  kind: "Policy";
+}
+
+export interface PolicyShape<
+  Identifier extends string,
+  Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
+>
+  extends Context.ServiceClass.Shape<Identifier, Shape>, PolicyLike {}
+
+export interface Policy<
+  in out Self,
+  in out Identifier extends string,
+  in out Shape extends (...args: any[]) => Effect.Effect<any, any, any>,
+> extends Effect.Effect<Shape, never, Self> {
+  readonly key: Identifier;
+  new (_: never): PolicyShape<Identifier, Shape>;
+  layer: {
+    succeed(
+      fn: (
+        ctx: ResourceLike,
+        ...args: Parameters<Shape>
+      ) => Effect.Effect<void>,
+    ): Layer.Layer<Self>;
+    effect<Req = never>(
+      fn: Effect.Effect<
+        (ctx: ResourceLike, ...args: Parameters<Shape>) => Effect.Effect<void>,
+        never,
+        Req
+      >,
+    ): Layer.Layer<Self, never, Req>;
+  };
+  bind(
+    ...args: Parameters<Shape>
+  ): Effect.Effect<
+    Effect.Success<ReturnType<Shape>>,
+    Effect.Error<ReturnType<Shape>>,
+    Self | RuntimeContext | Effect.Services<ReturnType<Shape>>
+  >;
+}
+
+/**
+ * Creates a deploy-time binding policy.
+ *
+ * A `Binding.Policy` attaches the infrastructure-side permissions or bindings
+ * that make a runtime binding usable. At deploy time it records IAM statements
+ * or host bindings on the target function/worker. At runtime the layer is
+ * absent, so the policy gracefully becomes a no-op.
+ */
+export const Policy =
+  <Self, Shape extends (...args: any[]) => Effect.Effect<void, any, any>>() =>
+  <Identifier extends string>(
+    Identifier: Identifier,
+  ): Policy<Self, `Policy<${Identifier}>`, Shape> => {
+    const self = Context.Service<Self, Shape>(`Policy<${Identifier}>`);
+
+    // we use a service option because at runtime (e.g. in a Lambda Function or Cloudflare Worker)
+    // the Policy Layer is not provided and this becomes a no-op
+    const Service = tryFindProviderByType<Policy<Self, Identifier, Shape>>(
+      self.key as Identifier,
+    ).pipe(
+      Effect.map(Option.getOrUndefined),
+      Effect.flatMap((service) =>
+        service
+          ? Effect.succeed(service)
+          : Effect.all([CurrentStack, ALCHEMY_PHASE]).pipe(
+              Effect.flatMap(([stack, phase]) =>
+                stack && phase === "plan"
+                  ? Effect.die(
+                      `Binding.Policy provider 'Policy<${Identifier}>' was not provided at Plan Time in Stack '${stack.name}'`,
+                    )
+                  : Effect.succeed((() => Effect.void) as any as Shape),
+              ),
+            ),
+      ),
+    );
+
+    const asEffect = () =>
+      Effect.all([Self, Service]).pipe(
+        Effect.map(
+          ([resource, fn]) =>
+            (...args: any[]) =>
+              Effect.all(
+                args.map((arg) =>
+                  Effect.isEffect(arg) ? arg : Effect.succeed(arg),
+                ),
+              ).pipe(
+                Effect.flatMap((args) =>
+                  fn(...args).pipe(
+                    Namespace.push((resource as ResourceLike).LogicalId),
+                  ),
+                ),
+              ),
+        ),
+      );
+    // @ts-expect-error
+    return Object.assign(self, {
+      [Symbol.iterator]() {
+        return new SingleShotGen(asEffect());
+      },
+      asEffect,
+      bind: (...args: any[]) =>
+        asEffect().pipe(Effect.flatMap((fn) => fn(...args))),
+      layer: {
+        succeed: (
+          fn: (
+            self: ResourceLike,
+            ...args: Parameters<Shape>
+          ) => Effect.Effect<void>,
+        ) =>
+          Layer.succeed(
+            self,
+            // @ts-expect-error
+            (...args: Parameters<Shape>) =>
+              Self.use((self) => fn(self as ResourceLike, ...args)),
+          ),
+        effect: (
+          fn: Effect.Effect<
+            (
+              self: ResourceLike,
+              ...args: Parameters<Shape>
+            ) => Effect.Effect<void>
+          >,
+        ) =>
+          Layer.effect(
+            self,
+            // @ts-expect-error
+            Effect.map(
+              fn,
+              (fn) =>
+                (...args: Parameters<Shape>) =>
+                  Self.use((self) => fn(self as ResourceLike, ...args)),
+            ),
+          ),
+      },
+    });
+  };
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Build/Command.ts b/.repos/alchemy-effect/packages/alchemy/src/Build/Command.ts
new file mode 100644
index 00000000000..387a8c993ed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Build/Command.ts
@@ -0,0 +1,261 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { ChildProcess } from "effect/unstable/process";
+import { isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { hashDirectory, type MemoOptions } from "./Memo.ts";
+
+export interface CommandProps {
+  /**
+   * The shell command to run for the build.
+   * @example "npm run build"
+   * @example "vite build"
+   */
+  command: string;
+  /**
+   * Working directory for the command.
+   * Defaults to the current working directory.
+   */
+  cwd?: string;
+  /**
+   * Controls which files are hashed to decide whether the build should re-run.
+   * By default every non-gitignored file in `cwd` is hashed, plus the nearest
+   * lockfile. Provide explicit globs to narrow the scope.
+   *
+   * @see {@link MemoOptions}
+   */
+  memo?: MemoOptions;
+  /**
+   * The output path (file or directory) produced by the build.
+   * This path is relative to the working directory.
+   * @example "dist"
+   */
+  outdir: string;
+  /**
+   * Environment variables to pass to the build command.
+   */
+  env?: Record<string, string | Redacted.Redacted<string>>;
+}
+
+export interface Command extends Resource<
+  "Build.Command",
+  CommandProps,
+  {
+    /**
+     * Absolute path to the build output.
+     */
+    outdir: string;
+    /**
+     * Hash of the input files that produced this build.
+     */
+    hash: string;
+  }
+> {}
+
+/**
+ * A Build resource that runs a shell command and produces an output asset.
+ * Input files are hashed using globs to avoid redundant rebuilds.
+ *
+ * @section Building a Vite App
+ * @example Basic Vite Build
+ * ```typescript
+ * const build = yield* Build("vite-build", {
+ *   command: "npm run build",
+ *   cwd: "./frontend",
+ *   outdir: "dist",
+ * });
+ * yield* Console.log(build.path); // absolute path to dist directory
+ * yield* Console.log(build.hash); // hash of input files
+ * ```
+ *
+ * @section Building with Custom Environment
+ * @example Build with Environment Variables
+ * ```typescript
+ * const build = yield* Build("production-build", {
+ *   command: "npm run build",
+ *   cwd: "./app",
+ *   output: "dist",
+ *   env: {
+ *     NODE_ENV: "production",
+ *     API_URL: "https://api.example.com",
+ *   },
+ * });
+ * ```
+ *
+ * @section Customizing Memoization
+ * @example Customize Memoization
+ * ```typescript
+ * const build = yield* Build("custom-build", {
+ *   command: "npm run build",
+ *   cwd: "./app",
+ *   output: "dist",
+ *   memo: { include: ["src/*", "package.json"], exclude: ["node_modules", "dist"] },
+ * });
+ */
+export const Command = Resource<Command>("Build.Command");
+
+export const CommandProvider = () =>
+  Provider.effect(
+    Command,
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const pathModule = yield* Path.Path;
+
+      const runBuild = (props: CommandProps) =>
+        Effect.gen(function* () {
+          const cwd = props.cwd ? pathModule.resolve(props.cwd) : process.cwd();
+          yield* runBuildCommand({
+            command: props.command,
+            cwd,
+            env: props.env
+              ? Object.fromEntries(
+                  Object.entries(props.env).map(([key, value]) => [
+                    key,
+                    typeof value === "string" ? value : Redacted.value(value),
+                  ]),
+                )
+              : undefined,
+          });
+        });
+
+      const getOutputPath = (props: CommandProps) => {
+        const cwd = props.cwd ? pathModule.resolve(props.cwd) : process.cwd();
+        return pathModule.resolve(cwd, props.outdir);
+      };
+
+      return Command.Provider.of({
+        stables: ["outdir"],
+        diff: Effect.fnUntraced(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (!output) {
+            return undefined;
+          }
+          const newHash = yield* hashDirectory(news);
+          if (newHash !== output.hash) {
+            return { action: "update" as const };
+          }
+        }),
+        read: Effect.fnUntraced(function* ({ olds, output }) {
+          if (!output) {
+            return undefined;
+          }
+          // Recompute the output path against the *current* cwd. State
+          // may have been written by a different machine (e.g. CI) and
+          // the absolute path baked into `output.outdir` won't exist
+          // locally. As long as the path resolved against this
+          // machine's cwd is present, return the refreshed output so
+          // downstream consumers (e.g. `Cloudflare.Worker` assets)
+          // don't try to read a stale, foreign-machine path.
+          const outputPath = getOutputPath(olds);
+          const exists = yield* fs.exists(outputPath);
+          if (!exists) {
+            return undefined;
+          }
+          return { ...output, outdir: outputPath };
+        }),
+        reconcile: Effect.fnUntraced(function* ({ news, output, session }) {
+          // Observe — the build artifact is a local directory keyed by the
+          // hash of its inputs. The previous run's `output.hash` is our
+          // cache; recompute against the current sources to detect drift.
+          const desiredHash = yield* hashDirectory(news);
+          const outputPath = getOutputPath(news);
+          const cachedExists =
+            output !== undefined && (yield* fs.exists(output.outdir));
+          const reusable =
+            cachedExists &&
+            output!.hash === desiredHash &&
+            output!.outdir === outputPath;
+
+          // Ensure — when the cached artifact is missing, stale, or the
+          // output path moved, run the build. The build command itself is
+          // responsible for producing `outputPath`.
+          if (!reusable) {
+            yield* session.note(
+              output === undefined
+                ? `Running build: ${news.command}`
+                : `Rebuilding: ${news.command}`,
+            );
+            yield* runBuild(news);
+            const exists = yield* fs.exists(outputPath);
+            if (!exists) {
+              return yield* Effect.die(
+                `Build completed but output path does not exist: ${outputPath}`,
+              );
+            }
+            yield* session.note(
+              output === undefined
+                ? `Build completed: ${outputPath}`
+                : `Rebuild completed: ${outputPath}`,
+            );
+          }
+
+          // Return — the artifact location and the hash that produced it.
+          return {
+            outdir: outputPath,
+            hash: desiredHash,
+          };
+        }),
+        delete: Effect.fnUntraced(function* ({ output, session }) {
+          const exists = yield* fs.exists(output.outdir);
+          if (exists) {
+            yield* fs.remove(output.outdir, { recursive: true });
+            yield* session.note(`Removed build output: ${output.outdir}`);
+          }
+        }),
+      });
+    }),
+  );
+
+export interface RunBuildCommandOptions {
+  command: string;
+  cwd?: string;
+  env?: Record<string, string>;
+}
+
+export const execBuildCommand = Effect.fnUntraced(function* (
+  command: ChildProcess.Command,
+) {
+  const handle = yield* command;
+  const [exitCode, stdout, stderr] = yield* Effect.all(
+    [
+      handle.exitCode,
+      Stream.mkString(Stream.decodeText(handle.stdout)),
+      Stream.mkString(Stream.decodeText(handle.stderr)),
+    ] as const,
+    { concurrency: 3 },
+  );
+  return { exitCode, stdout, stderr };
+});
+
+export const runBuildCommand = Effect.fnUntraced(function* ({
+  command,
+  cwd,
+  env,
+}: RunBuildCommandOptions) {
+  const child = ChildProcess.setCwd(
+    ChildProcess.make(command, [], {
+      shell: true,
+      env: { ...process.env, ...env },
+    }),
+    cwd ?? process.cwd(),
+  );
+
+  const result = yield* execBuildCommand(child).pipe(Effect.orDie);
+
+  if (result.exitCode !== 0) {
+    return yield* Effect.die(
+      `Build command failed with exit code ${result.exitCode}${result.stderr ? `\n${result.stderr}` : ""}`,
+    );
+  }
+
+  yield* Effect.logDebug("Build output", result.stdout);
+  if (result.stderr) {
+    yield* Effect.logDebug("Build stderr", result.stderr);
+  }
+
+  return result;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Build/Memo.ts b/.repos/alchemy-effect/packages/alchemy/src/Build/Memo.ts
new file mode 100644
index 00000000000..2a004c26290
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Build/Memo.ts
@@ -0,0 +1,187 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import type { PlatformError } from "effect/PlatformError";
+import fg from "fast-glob";
+import { gitignoreRulesToGlobs } from "../Util/gitignore-rules-to-globs.ts";
+import { sha256, sha256Object } from "../Util/sha256.ts";
+
+/**
+ * Controls which files are included in the content hash that determines
+ * whether a build needs to re-run.
+ *
+ * By default (no options), every non-gitignored file in the working directory
+ * is hashed, plus the nearest package-manager lockfile. Provide explicit
+ * `include`/`exclude` globs to narrow the scope when the default is too broad.
+ */
+export interface MemoOptions {
+  /**
+   * Glob patterns of files to hash. Paths are relative to the working directory.
+   *
+   * @default ["**\/*"] (all files, filtered by `exclude`)
+   * @example ["src/**", "package.json", "tsconfig.json"]
+   */
+  include?: string[];
+  /**
+   * Glob patterns to exclude from hashing. Paths are relative to the working directory.
+   *
+   * @default gitignore rules collected from the working directory up to the repo root
+   */
+  exclude?: string[];
+  /**
+   * Whether to include the nearest package-manager lockfile (`bun.lock`,
+   * `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`) in the hash,
+   * even when it lives above the working directory (e.g. monorepo root).
+   *
+   * @default true when both `include` and `exclude` are unset; false otherwise
+   */
+  lockfile?: boolean;
+}
+
+interface ResolvedMemoOptions {
+  cwd: string;
+  include: string[];
+  exclude: string[];
+  lockfile: boolean;
+}
+
+/**
+ * Internal service that resolves memo options, lists matching files, and
+ * produces a single SHA-256 content hash. Constructed as an Effect so it
+ * can access the platform `FileSystem` and `Path` services.
+ */
+const Memo = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+
+  const findUp = Effect.fnUntraced(function* (
+    cwd: string,
+    filenames: string[],
+  ): Effect.fn.Return<string | undefined, PlatformError> {
+    const [file] = yield* Effect.filter(
+      filenames.map((filename) => path.join(cwd, filename)),
+      fs.exists,
+      { concurrency: "unbounded" },
+    );
+    if (file) {
+      return file;
+    }
+    const parent = path.dirname(cwd);
+    if (parent === cwd) {
+      return undefined;
+    }
+    return yield* findUp(parent, filenames);
+  });
+
+  const readGitIgnoreRules = Effect.fnUntraced(function* (
+    cwd: string,
+  ): Effect.fn.Return<string[], PlatformError> {
+    const rules = yield* fs.readFileString(path.join(cwd, ".gitignore")).pipe(
+      Effect.map((file) => file.split("\n")),
+      Effect.catchIf(
+        (error) =>
+          error._tag === "PlatformError" && error.reason._tag === "NotFound",
+        () => Effect.succeed([]),
+      ),
+    );
+    const parent = path.dirname(cwd);
+    if (parent === cwd || (yield* fs.exists(path.join(cwd, ".git")))) {
+      return rules;
+    }
+    return [...(yield* readGitIgnoreRules(parent)), ...rules];
+  });
+
+  const resolveMemoOptions = Effect.fnUntraced(function* (
+    cwd: string | undefined,
+    options: MemoOptions,
+  ): Effect.fn.Return<ResolvedMemoOptions, PlatformError> {
+    const resolvedCwd = cwd ? path.resolve(cwd) : process.cwd();
+    return {
+      cwd: resolvedCwd,
+      include: options.include ?? ["**/*"],
+      exclude:
+        options.exclude ??
+        (yield* readGitIgnoreRules(resolvedCwd).pipe(
+          Effect.map(gitignoreRulesToGlobs),
+          Effect.map((globs) => ["**/.git/**", ...globs]),
+        )),
+      lockfile: options.lockfile ?? !(options.exclude || options.include),
+    };
+  });
+
+  const listFiles = Effect.fnUntraced(function* (
+    options: ResolvedMemoOptions,
+  ): Effect.fn.Return<string[], PlatformError> {
+    const [files, lockfile] = yield* Effect.all(
+      [
+        Effect.promise(() =>
+          fg.glob(options.include, {
+            cwd: options.cwd,
+            ignore: options.exclude,
+            onlyFiles: true,
+            dot: true,
+          }),
+        ),
+        options.lockfile
+          ? findUp(options.cwd, [
+              "bun.lock",
+              "bun.lockb",
+              "package-lock.json",
+              "pnpm-lock.yaml",
+              "yarn.lock",
+            ]).pipe(
+              Effect.map((lockfile) =>
+                lockfile ? path.relative(options.cwd, lockfile) : undefined,
+              ),
+            )
+          : Effect.succeed(undefined),
+      ],
+      { concurrency: "unbounded" },
+    );
+    if (lockfile && !files.includes(lockfile)) {
+      files.push(lockfile);
+    }
+    return files.sort();
+  });
+
+  const hashFiles = Effect.fnUntraced(function* (
+    cwd: string,
+    files: string[],
+  ): Effect.fn.Return<string, PlatformError> {
+    const hashes = yield* Effect.forEach(
+      files,
+      (file) =>
+        fs.readFile(path.join(cwd, file)).pipe(
+          Effect.flatMap(sha256),
+          Effect.map((hash) => `${file}:${hash}`),
+        ),
+      { concurrency: "unbounded" },
+    );
+    return yield* sha256Object(hashes);
+  });
+
+  return {
+    resolveMemoOptions,
+    listFiles,
+    hashFiles,
+  };
+});
+
+/**
+ * Produces a deterministic SHA-256 hash of all files matched by the given
+ * memo options. The hash changes if and only if the content of the matched
+ * files changes, making it suitable for cache-busting build outputs.
+ */
+export const hashDirectory = Effect.fn(function* (props: {
+  cwd?: string;
+  memo?: MemoOptions;
+}): Effect.fn.Return<string, PlatformError, FileSystem.FileSystem | Path.Path> {
+  const service = yield* Memo;
+  const resolvedOptions = yield* service.resolveMemoOptions(
+    props.cwd,
+    props.memo ?? {},
+  );
+  const files = yield* service.listFiles(resolvedOptions);
+  const hash = yield* service.hashFiles(resolvedOptions.cwd, files);
+  return hash;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Build/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Build/index.ts
new file mode 100644
index 00000000000..ec1d689814e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Build/index.ts
@@ -0,0 +1 @@
+export * from "./Command.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/Bundle.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/Bundle.ts
new file mode 100644
index 00000000000..544c914d221
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/Bundle.ts
@@ -0,0 +1,345 @@
+import * as Effect from "effect/Effect";
+import * as Path from "effect/Path";
+import * as Queue from "effect/Queue";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import assert from "node:assert";
+import * as rolldown from "rolldown";
+import { sha256, sha256Object } from "../Util/sha256.ts";
+import {
+  bundleAnalyzerPlugin,
+  type BundleAnalyzerPluginOptions,
+} from "./BundleAnalyzerPlugin.ts";
+import { purePlugin, type PurePluginOptions } from "./PurePlugin.ts";
+import { rawPlugin } from "./RawPlugin.ts";
+
+/**
+ * Extra options accepted by {@link build} / {@link watch} on top of the
+ * standard rolldown input/output options.
+ */
+export interface BundleExtraOptions {
+  /**
+   * Configures the {@link purePlugin} which annotates top-level
+   * call/new expressions in matching packages with `/*#__PURE__*\/`
+   * so rolldown can tree-shake them.
+   *
+   * - `undefined` (default): plugin is enabled with default packages
+   *   (`effect`, `@effect/*`).
+   * - `PurePluginOptions`: plugin is enabled with the provided options.
+   * - `false`: plugin is disabled.
+   */
+  readonly pure?: PurePluginOptions | false;
+  /**
+   * Configures the {@link bundleAnalyzerPlugin} which emits a bundle analysis
+   * report alongside the bundle output, describing chunks, modules, and the
+   * import graph reachable from each entry point.
+   *
+   * - `undefined` / `false` (default): plugin is disabled.
+   * - `true`: plugin is enabled with default options.
+   * - `BundleAnalyzerPluginOptions`: plugin is enabled with the provided options.
+   */
+  readonly bundleAnalyzer?: BundleAnalyzerPluginOptions | boolean;
+}
+
+export interface BundleOutput {
+  /**
+   * The files in the bundle.
+   * The first file is the entry.
+   */
+  readonly files: [BundleFile, ...BundleFile[]];
+  /**
+   * The SHA-256 hash of all files in the bundle.
+   */
+  readonly hash: string;
+}
+
+export interface BundleFile {
+  readonly path: string;
+  readonly content: string | Uint8Array<ArrayBufferLike>;
+  readonly hash: string;
+}
+
+export class BundleError extends Schema.TaggedErrorClass<BundleError>()(
+  "BundleError",
+  {
+    message: Schema.String,
+    cause: Schema.optional(Schema.DefectWithStack),
+  },
+) {}
+
+export type BundleWatchEvent =
+  | BundleWatchEvent.Start
+  | BundleWatchEvent.Success
+  | BundleWatchEvent.Error;
+
+export declare namespace BundleWatchEvent {
+  interface Start {
+    readonly _tag: "Start";
+  }
+  interface Success {
+    readonly _tag: "Success";
+    readonly output: BundleOutput;
+  }
+  interface Error {
+    readonly _tag: "Error";
+    readonly error: BundleError;
+  }
+}
+
+/**
+ * Build a bundle using rolldown from the given input options and output options.
+ * @param inputOptions - The input options for the bundle.
+ * @param outputOptions - The output options for the bundle.
+ * @returns The bundle output.
+ */
+export const build = (
+  inputOptions: rolldown.InputOptions,
+  outputOptions?: rolldown.OutputOptions,
+  extra?: BundleExtraOptions,
+): Effect.Effect<BundleOutput, BundleError> =>
+  Effect.tryPromise({
+    try: async () => {
+      const bundle = await rolldown.rolldown({
+        ...inputOptions,
+        plugins: [inputOptions.plugins, builtInPlugins(extra)],
+        optimization: inputOptions.optimization ?? {
+          inlineConst: {
+            mode: "smart",
+            pass: 3,
+          },
+        },
+      });
+      const result = await bundle.write(outputOptions);
+      await bundle.close();
+      return result.output;
+    },
+    catch: bundleErrorFromUnknown,
+  }).pipe(
+    Effect.flatMap(Effect.forEach(bundleFileFromOutputChunk)),
+    Effect.flatMap(bundleOutputFromFiles),
+  );
+
+/**
+ * Watch for changes in the bundle and return a stream of bundle output.
+ * @param inputOptions - The input options for the bundle.
+ * @param outputOptions - The output options for the bundle.
+ * @returns A stream of Result instances containing either the bundle output or an error.
+ */
+export const watch = (
+  inputOptions: rolldown.InputOptions,
+  outputOptions?: rolldown.OutputOptions,
+  extra?: BundleExtraOptions,
+): Stream.Stream<BundleWatchEvent> =>
+  Stream.callback<
+    | BundleWatchEvent.Start
+    | BundleWatchEvent.Error
+    | {
+        readonly _tag: "Success";
+        readonly output: rolldown.OutputBundle;
+      }
+  >((queue) =>
+    Effect.acquireRelease(
+      Effect.sync(() => {
+        const watcher = rolldown.watch({
+          ...inputOptions,
+          plugins: [
+            inputOptions.plugins,
+            builtInPlugins(extra),
+            // The watcher event listener does not receive the bundle output, so we grab it using a plugin.
+            {
+              name: "alchemy:watch-bundle",
+              watchChange() {
+                Queue.offerUnsafe(queue, {
+                  _tag: "Start",
+                });
+              },
+              generateBundle(_outputOptions, bundle) {
+                Queue.offerUnsafe(queue, {
+                  _tag: "Success",
+                  output: bundle,
+                });
+              },
+            },
+          ],
+          output: outputOptions,
+        });
+        watcher.on("event", (event) => {
+          if (event.code === "ERROR") {
+            Queue.offerUnsafe(queue, {
+              _tag: "Error",
+              error: bundleErrorFromUnknown(event.error),
+            });
+          } else if (event.code === "BUNDLE_END") {
+            // This must be called to avoid resource leaks.
+            event.result.close().catch(() => {});
+          }
+        });
+        return watcher;
+      }),
+      (watcher) => Effect.promise(() => watcher.close()),
+    ),
+  ).pipe(
+    Stream.mapEffect((event) =>
+      Effect.gen(function* () {
+        if (event._tag !== "Success") {
+          return event;
+        }
+        return yield* bundleOutputFromRolldownOutputBundle(event.output).pipe(
+          Effect.map(
+            (output): BundleWatchEvent.Success => ({
+              _tag: "Success",
+              output,
+            }),
+          ),
+          Effect.catch((error) =>
+            Effect.succeed<BundleWatchEvent.Error>({
+              _tag: "Error",
+              error: bundleErrorFromUnknown(error),
+            }),
+          ),
+        );
+      }),
+    ),
+  );
+
+const ENTRY_PREFIX = "\0virtual:alchemy-entry:";
+// oxlint-disable-next-line no-control-regex
+const ENTRY_REGEX = /^\0virtual:alchemy-entry:/;
+
+export const virtualEntryPlugin = Effect.gen(function* () {
+  const path = yield* Path.Path;
+
+  const normalizeInput = (
+    input: rolldown.InputOption,
+  ): Record<string, string> => {
+    if (typeof input === "string") {
+      return { [path.parse(input).name || "index"]: input };
+    } else if (Array.isArray(input)) {
+      return Object.fromEntries(input.map((p) => [path.parse(p).name, p]));
+    } else {
+      return input;
+    }
+  };
+
+  return (content: (importPath: string) => string) => {
+    const entries = new Map<string, string>();
+    return {
+      name: "alchemy:virtual-entry",
+      options: {
+        order: "pre",
+        handler(inputOptions) {
+          const cwd = inputOptions.cwd ?? process.cwd();
+          const input = normalizeInput(inputOptions.input ?? {});
+          inputOptions.input = Object.fromEntries(
+            Object.entries(input).map(([name, p]) => {
+              const id = `${ENTRY_PREFIX}${name}`;
+              entries.set(id, path.resolve(cwd, p));
+              return [name, id];
+            }),
+          );
+        },
+      },
+      resolveId: {
+        filter: { id: ENTRY_REGEX },
+        handler(id) {
+          return entries.has(id) ? { id } : null;
+        },
+      },
+      load: {
+        filter: { id: ENTRY_REGEX },
+        handler(id) {
+          const entry = entries.get(id);
+          assert(entry !== undefined, `unknown alchemy entry: ${id}`);
+          return {
+            code: content(entry),
+            moduleType: "ts",
+          };
+        },
+      },
+    } satisfies rolldown.Plugin;
+  };
+});
+
+export function bundleOutputFromRolldownOutputBundle(
+  bundle: rolldown.OutputBundle,
+): Effect.Effect<BundleOutput, BundleError> {
+  const files = Object.values(bundle);
+  // These are sanity checks - with rolldown, the first file is always an entry chunk.
+  if (!files[0] || files[0].type !== "chunk" || !files[0].isEntry) {
+    return Effect.fail(
+      new BundleError({
+        message: "Invalid bundle output",
+      }),
+    );
+  }
+  return Effect.forEach(
+    files as [
+      rolldown.OutputChunk,
+      ...(rolldown.OutputChunk | rolldown.OutputAsset)[],
+    ],
+    bundleFileFromOutputChunk,
+  ).pipe(Effect.flatMap(bundleOutputFromFiles));
+}
+
+/**
+ * Returns the built-in plugins appended after the user-provided plugin chain,
+ * configured by {@link BundleExtraOptions}.
+ *
+ * These run LAST so they see module ids that have already been resolved into
+ * `node_modules/<pkg>/...` by upstream resolver plugins such as
+ * `@distilled.cloud/cloudflare-rolldown-plugin`.
+ */
+function builtInPlugins(
+  extra?: BundleExtraOptions,
+): rolldown.RolldownPluginOption {
+  return [
+    extra?.bundleAnalyzer
+      ? bundleAnalyzerPlugin(
+          extra.bundleAnalyzer === true ? {} : extra.bundleAnalyzer,
+        )
+      : undefined,
+    extra?.pure !== false ? purePlugin(extra?.pure ?? {}) : undefined,
+    rawPlugin(),
+  ];
+}
+
+function bundleErrorFromUnknown(error: unknown): BundleError {
+  const message = error instanceof Error ? error.message : String(error);
+  return new BundleError({
+    message,
+    cause: error,
+  });
+}
+
+function bundleOutputFromFiles(
+  files: [BundleFile, ...BundleFile[]],
+): Effect.Effect<BundleOutput> {
+  return Effect.map(
+    sha256Object(
+      files.map((file) => ({
+        path: file.path,
+        hash: file.hash,
+      })),
+    ),
+    (hash) => ({ files, hash }),
+  );
+}
+
+function bundleFileFromOutputChunk(
+  chunk: rolldown.OutputChunk | rolldown.OutputAsset,
+): Effect.Effect<BundleFile> {
+  switch (chunk.type) {
+    case "chunk":
+      return Effect.map(sha256(chunk.code), (hash) => ({
+        path: chunk.fileName,
+        content: chunk.code,
+        hash,
+      }));
+    case "asset":
+      return Effect.map(sha256(chunk.source), (hash) => ({
+        path: chunk.fileName,
+        content: chunk.source,
+        hash,
+      }));
+  }
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/BundleAnalyzerPlugin.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/BundleAnalyzerPlugin.ts
new file mode 100644
index 00000000000..46c2ba23c67
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/BundleAnalyzerPlugin.ts
@@ -0,0 +1,33 @@
+import type { Plugin } from "rolldown";
+import { bundleAnalyzerPlugin as rolldownBundleAnalyzerPlugin } from "rolldown/experimental";
+
+export interface BundleAnalyzerPluginOptions {
+  /**
+   * The filename of the bundle analysis data.
+   * @default "analyze-data.md"
+   */
+  readonly fileName?: string;
+  /**
+   * The format of the bundle analysis data.
+   * @default "md"
+   */
+  readonly format?: "json" | "md";
+}
+
+/**
+ * Wraps rolldown's experimental bundle analyzer plugin, which emits a report
+ * describing the composition of the bundle.
+ *
+ * The report includes:
+ * - all chunks and their relationships
+ * - the modules bundled into each chunk
+ * - import dependencies between chunks
+ * - the modules reachable from each entry point
+ */
+export const bundleAnalyzerPlugin = (
+  options: BundleAnalyzerPluginOptions = {},
+): Plugin =>
+  rolldownBundleAnalyzerPlugin({
+    fileName: options.fileName,
+    format: options.format ?? "md",
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/Docker.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/Docker.ts
new file mode 100644
index 00000000000..e770d6f0b89
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/Docker.ts
@@ -0,0 +1,210 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Stream from "effect/Stream";
+import { ChildProcess } from "effect/unstable/process";
+import { exec } from "../Util/exec.ts";
+
+export class DockerCommandError extends Data.TaggedError("DockerCommandError")<{
+  readonly command: string;
+  readonly stderr: string;
+  readonly exitCode: number;
+  readonly message: string;
+}> {}
+
+export interface RegistryAuth {
+  readonly username: string;
+  readonly password: string;
+  /**
+   * Registry host only (no `https://`, no path), e.g. `123456789.dkr.ecr.us-east-1.amazonaws.com`.
+   */
+  readonly server: string;
+}
+
+export interface DockerBuildOptions {
+  /** Image reference passed to `docker build -t`. */
+  readonly tag: string;
+  /** Build context directory (`.` argument to `docker build`). */
+  readonly context: string;
+  readonly platform?: string;
+  readonly target?: string;
+  readonly buildArgs?: Record<string, string>;
+  /** Appended to `docker build` before the final context path. */
+  readonly extraArgs?: ReadonlyArray<string>;
+  readonly env?: Record<string, string | undefined>;
+}
+
+export const materializeDockerfile = Effect.fn(function* (
+  dockerfile: string,
+  dir: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  yield* fs.makeDirectory(dir, { recursive: true });
+  const target = path.join(dir, "Dockerfile");
+  yield* fs.writeFileString(target, dockerfile);
+  return target;
+});
+
+export const writeContextFiles = Effect.fn(function* (
+  dir: string,
+  files: ReadonlyArray<{
+    readonly path: string;
+    readonly content: string | Uint8Array;
+  }>,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  for (const file of files) {
+    const fullPath = path.join(dir, file.path);
+    yield* fs.makeDirectory(path.dirname(fullPath), { recursive: true });
+    if (typeof file.content === "string") {
+      yield* fs.writeFileString(fullPath, file.content);
+    } else {
+      yield* fs.writeFile(fullPath, file.content);
+    }
+  }
+});
+
+export const runDockerCommand = Effect.fn(function* (
+  args: ReadonlyArray<string>,
+  options?: {
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    /** Passed to the process stdin (e.g. for `docker login --password-stdin`). */
+    stdin?: string;
+  },
+) {
+  const command = `docker ${args.join(" ")}`;
+  const env = { ...process.env, ...options?.env };
+  const commandOptions: ChildProcess.CommandOptions = {
+    env,
+    ...(options?.stdin !== undefined
+      ? {
+          stdin: Stream.succeed(new TextEncoder().encode(options.stdin)),
+        }
+      : {}),
+  };
+  const child = options?.cwd
+    ? ChildProcess.setCwd(
+        ChildProcess.make("docker", args, commandOptions),
+        options.cwd,
+      )
+    : ChildProcess.make("docker", args, commandOptions);
+
+  const { stdout, stderr, exitCode } = yield* exec(child).pipe(
+    Effect.catch((e) =>
+      Effect.fail(
+        new DockerCommandError({
+          command,
+          stderr: e instanceof Error ? e.message : String(e),
+          exitCode: 1,
+          message: e instanceof Error ? e.message : String(e),
+        }),
+      ),
+    ),
+  );
+
+  if (exitCode !== 0) {
+    return yield* Effect.fail(
+      new DockerCommandError({
+        command,
+        stderr,
+        exitCode,
+        message:
+          `Docker command failed (${exitCode}): ${command}\n${stderr}`.trim(),
+      }),
+    );
+  }
+
+  return { stdout, stderr };
+});
+
+/**
+ * Run `docker build` with standard flags from {@link DockerBuildOptions}.
+ */
+export const dockerBuild = Effect.fn(function* (options: DockerBuildOptions) {
+  const args: string[] = ["build", "-t", options.tag];
+  if (options.platform) {
+    args.push("--platform", options.platform);
+  }
+  if (options.target) {
+    args.push("--target", options.target);
+  }
+  if (options.buildArgs) {
+    for (const [k, v] of Object.entries(options.buildArgs)) {
+      args.push("--build-arg", `${k}=${v}`);
+    }
+  }
+  if (options.extraArgs?.length) {
+    args.push(...options.extraArgs);
+  }
+  args.push(options.context);
+
+  yield* runDockerCommand(args, { env: options.env });
+});
+
+/**
+ * Get the image ID (content-addressable digest) of a locally-built image.
+ */
+export const getDockerImageId = Effect.fn(function* (tag: string) {
+  const { stdout } = yield* runDockerCommand([
+    "inspect",
+    "--format",
+    "{{.Id}}",
+    tag,
+  ]);
+  return stdout.trim();
+});
+
+/**
+ * Tag a local image with a new reference.
+ */
+export const dockerTag = Effect.fn(function* (source: string, target: string) {
+  yield* runDockerCommand(["tag", source, target]);
+});
+
+/**
+ * Log in to a registry using `docker login --password-stdin` (no password on argv).
+ */
+export const dockerLogin = Effect.fn(function* (
+  auth: RegistryAuth,
+  options?: { env?: Record<string, string | undefined> },
+) {
+  yield* runDockerCommand(
+    ["login", "-u", auth.username, "--password-stdin", auth.server],
+    {
+      env: options?.env,
+      stdin: auth.password,
+    },
+  );
+});
+
+/**
+ * Push an image ref. When `auth` is set, uses an isolated `DOCKER_CONFIG`
+ * directory so concurrent deploys do not race on global docker credentials.
+ */
+export const pushImage = Effect.fn(function* (
+  imageRef: string,
+  auth?: RegistryAuth,
+) {
+  if (auth) {
+    const fs = yield* FileSystem.FileSystem;
+    const configDir = yield* fs.makeTempDirectory({
+      prefix: "alchemy-docker-",
+    });
+    const env = { ...process.env, DOCKER_CONFIG: configDir };
+    return yield* Effect.gen(function* () {
+      yield* dockerLogin(auth, { env });
+      yield* runDockerCommand(["push", imageRef], { env });
+    }).pipe(
+      Effect.ensuring(
+        fs
+          .remove(configDir, { recursive: true })
+          .pipe(Effect.catch(() => Effect.void)),
+      ),
+    );
+  }
+  yield* runDockerCommand(["push", imageRef]);
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/PurePlugin.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/PurePlugin.ts
new file mode 100644
index 00000000000..f1fa2b184f9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/PurePlugin.ts
@@ -0,0 +1,557 @@
+import type {
+  CallExpression,
+  ExportDefaultDeclaration,
+  ExportNamedDeclaration,
+  Expression,
+  ExpressionStatement,
+  NewExpression,
+  Program,
+  Statement,
+  VariableDeclaration,
+} from "@oxc-project/types";
+import MagicString from "magic-string";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import picomatch from "picomatch";
+import type * as rolldown from "rolldown";
+import { parseAst } from "rolldown/parseAst";
+
+/**
+ * Default packages whose modules will receive `/*#__PURE__*\/` annotations.
+ * Mirrors what `effect-smol` ships via `babel-plugin-annotate-pure-calls`
+ * applied to its own `dist/` output.
+ *
+ * `alchemy` is included so its own resources (which consist almost entirely
+ * of `Effect.fn(...)`, `Context.Service(...)(...)`, `Layer.effect(...)` and
+ * `Data.TaggedError(...)` top-level calls) become tree-shakeable. The
+ * package already declares `"sideEffects": false`, so it is safe.
+ */
+export const DEFAULT_PURE_PACKAGES: ReadonlyArray<string> = [
+  "effect",
+  "@effect/*",
+  "alchemy",
+  "@alchemy.run/*",
+];
+
+/**
+ * Options for {@link purePlugin}.
+ */
+export interface PurePluginOptions {
+  /**
+   * Extra package names or globs to annotate, in addition to
+   * {@link DEFAULT_PURE_PACKAGES}. Globs are matched with picomatch
+   * against the package name (e.g. `effect`, `@effect/cluster`).
+   */
+  readonly packages?: ReadonlyArray<string>;
+  /**
+   * If true, the configured `packages` list replaces the defaults
+   * entirely instead of extending them.
+   * @default false
+   */
+  readonly replaceDefaults?: boolean;
+  /**
+   * If true, also marks matched modules as side-effect free
+   * (mirrors `"sideEffects": []` in package.json), so rolldown drops
+   * unused re-exports from those packages.
+   * @default true
+   */
+  readonly markSideEffectFree?: boolean;
+  /**
+   * If true, automatically detect the npm package that owns the bundle
+   * entry (by walking up to the nearest `package.json`) and annotate it
+   * too. This makes the user's own source tree-shakeable without any
+   * configuration.
+   *
+   * The package's `sideEffects` field is NOT consulted for this gate —
+   * if your entry's package has init-time side effects you wish to
+   * preserve, declare them in `package.json` (`"sideEffects": ["./foo.ts"]`)
+   * or set this option to `false`.
+   *
+   * @default true
+   */
+  readonly autoDetectEntryPackage?: boolean;
+}
+
+const PURE_COMMENT = "/*#__PURE__*/ ";
+const SUPPORTED_FILE_RE = /\.(?:m?[jt]sx?|cjs|cts)$/;
+
+/**
+ * Rolldown plugin that injects `/*#__PURE__*\/` annotations on top-level
+ * call/new expressions of modules belonging to the configured packages,
+ * enabling tree-shaking of `effect`, `@effect/*`, and any user-listed
+ * packages without requiring a babel post-build pass.
+ */
+export const purePlugin = (
+  options: PurePluginOptions = {},
+): rolldown.Plugin => {
+  const patterns = options.replaceDefaults
+    ? [...(options.packages ?? DEFAULT_PURE_PACKAGES)]
+    : [...DEFAULT_PURE_PACKAGES, ...(options.packages ?? [])];
+  const markSideEffectFreeOpt = options.markSideEffectFree ?? true;
+  const autoDetect = options.autoDetectEntryPackage ?? true;
+  // Mutable so the `options` hook can append the auto-detected entry
+  // package without rebuilding the plugin instance.
+  let isMatch = picomatch(patterns);
+  // Per-bundle cache of directory -> owning package metadata.
+  // Avoids walking the filesystem for every module of a large package.
+  const pkgInfoCache = new Map<string, PackageInfo | null>();
+  // Resolved absolute paths of entry modules. Marking an entry module as
+  // `moduleSideEffects: false` makes rolldown treat its top-level
+  // statements (including `console.log` etc.) as eliminable, often
+  // collapsing the whole bundle. We always preserve entries' side
+  // effects, regardless of the package they belong to.
+  const entryPaths = new Set<string>();
+
+  return {
+    name: "alchemy:annotate-pure",
+    async options(opts) {
+      collectEntryPaths(opts, entryPaths);
+      if (!autoDetect) return null;
+      const detected = await detectEntryPackage(opts);
+      if (detected === null) return null;
+      if (patterns.includes(detected)) return null;
+      patterns.push(detected);
+      isMatch = picomatch(patterns);
+      return null;
+    },
+    transform: {
+      filter: { id: SUPPORTED_FILE_RE },
+      async handler(code, id) {
+        const info = await resolvePackageInfo(id, pkgInfoCache);
+        if (info === null || info.name === null || !isMatch(info.name)) {
+          return null;
+        }
+        const cleanId = id.replace(/[?#].*$/, "");
+        const isEntry = entryPaths.has(cleanId);
+        // Only override `moduleSideEffects` when the owning package
+        // explicitly opts in via `sideEffects: false` / `[]`. Pure
+        // annotations themselves are always safe to add (they only mean
+        // "if the result is unused, the call may be dropped"), but
+        // marking arbitrary modules side-effect-free could erase
+        // intentional registrations / mutations the author made at the
+        // top level of files in packages that did not declare so.
+        const markSideEffectFree =
+          markSideEffectFreeOpt &&
+          !isEntry &&
+          isSideEffectFree(info.sideEffects);
+        const annotated = annotateModule(code, id);
+        if (annotated === null) {
+          return markSideEffectFree ? { code, moduleSideEffects: false } : null;
+        }
+        return {
+          code: annotated.code,
+          map: annotated.map,
+          moduleSideEffects: markSideEffectFree ? false : null,
+        };
+      },
+    },
+  };
+};
+
+/**
+ * Captures the absolute paths of every entry module declared on the
+ * rolldown input options into `out`. Handles all three input shapes:
+ * string, array of strings, and `{ name -> path }` record.
+ */
+function collectEntryPaths(
+  opts: rolldown.InputOptions,
+  out: Set<string>,
+): void {
+  const cwd = opts.cwd ?? process.cwd();
+  const add = (entry: unknown) => {
+    if (typeof entry !== "string") return;
+    out.add(path.resolve(cwd, entry));
+  };
+  if (typeof opts.input === "string") add(opts.input);
+  else if (Array.isArray(opts.input)) for (const e of opts.input) add(e);
+  else if (opts.input && typeof opts.input === "object") {
+    for (const e of Object.values(opts.input)) add(e);
+  }
+}
+
+/**
+ * Walks up from each entry path (and `cwd`) to find the nearest
+ * `package.json`, and returns its `name` if the package is safely
+ * annotatable — i.e. it declares `sideEffects: false` or `[]`. Returns
+ * `null` if no entry package can be found, the entry has no name, or the
+ * package opts out of side-effect-free treatment.
+ */
+async function detectEntryPackage(
+  opts: rolldown.InputOptions,
+): Promise<string | null> {
+  const inputs: string[] = [];
+  if (typeof opts.input === "string") inputs.push(opts.input);
+  else if (Array.isArray(opts.input)) inputs.push(...opts.input);
+  else if (opts.input && typeof opts.input === "object") {
+    inputs.push(...(Object.values(opts.input) as string[]));
+  }
+  if (opts.cwd) inputs.push(opts.cwd);
+  if (inputs.length === 0) inputs.push(process.cwd());
+
+  for (const candidate of inputs) {
+    const meta = await findOwningPackageMeta(candidate);
+    if (meta === null || meta.name === null) continue;
+    return meta.name;
+  }
+  return null;
+}
+
+/**
+ * Metadata extracted from a `package.json`. `name` may be `null` when the
+ * file exists but has no `"name"` field (rare, but possible for private
+ * subpackage roots).
+ */
+export interface PackageInfo {
+  readonly name: string | null;
+  readonly sideEffects: unknown;
+}
+
+async function findOwningPackageMeta(
+  start: string,
+): Promise<PackageInfo | null> {
+  // Resolve to absolute and start from the directory containing `start`
+  // (or `start` itself if it is already a directory).
+  let dir = path.resolve(start);
+  try {
+    if ((await fs.stat(dir)).isFile()) dir = path.dirname(dir);
+  } catch {
+    dir = path.dirname(dir);
+  }
+  for (let i = 0; i < 64; i++) {
+    const pj = path.join(dir, "package.json");
+    try {
+      const stat = await fs.stat(pj);
+      if (stat.isFile()) {
+        const contents = await fs.readFile(pj, "utf8");
+        const json = JSON.parse(contents) as {
+          name?: unknown;
+          sideEffects?: unknown;
+        };
+        return {
+          name: typeof json.name === "string" ? json.name : null,
+          sideEffects: json.sideEffects,
+        };
+      }
+    } catch {
+      // keep climbing
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+/**
+ * Mirrors how rolldown / rollup interpret the `sideEffects` package.json
+ * field. We only treat `false` and `[]` as "fully side-effect free"; an
+ * array of files or `true` is treated as not safe to auto-annotate the
+ * whole package.
+ */
+function isSideEffectFree(value: unknown): boolean {
+  if (value === false) return true;
+  if (Array.isArray(value) && value.length === 0) return true;
+  return false;
+}
+
+/**
+ * Extracts the npm package name from a resolved module id by walking back to
+ * the last `node_modules/` segment. Handles scoped packages. This is the
+ * fast path that does not hit the filesystem; it works for ordinary
+ * `node_modules/<pkg>/...` ids but NOT for workspace-linked sources whose
+ * resolved path is e.g. `<repo>/packages/alchemy/src/Bundle/PurePlugin.ts`.
+ *
+ * @example
+ *   packageNameFromId("/proj/node_modules/effect/dist/Effect.js")
+ *     // => "effect"
+ *   packageNameFromId("/proj/node_modules/@effect/cluster/dist/index.js")
+ *     // => "@effect/cluster"
+ */
+export function packageNameFromId(id: string): string | null {
+  const normalized = id.replace(/\\/g, "/");
+  const idx = normalized.lastIndexOf("/node_modules/");
+  if (idx === -1) return null;
+  const rest = normalized.slice(idx + "/node_modules/".length);
+  const parts = rest.split("/");
+  if (parts.length === 0 || parts[0] === "") return null;
+  if (parts[0].startsWith("@")) {
+    if (parts.length < 2) return null;
+    return `${parts[0]}/${parts[1]}`;
+  }
+  return parts[0];
+}
+
+/**
+ * Resolves the owning {@link PackageInfo} for a module id by walking up
+ * the directory tree to the nearest `package.json`. This is what makes
+ * the plugin work for workspace-linked sources (e.g. our own
+ * `packages/alchemy/src/**` when consumers import via the `worker`/`bun`
+ * conditions which resolve to `.ts`).
+ *
+ * Caches both positive and negative results per directory to keep the
+ * filesystem walk bounded across an entire bundle pass.
+ */
+export async function resolvePackageInfo(
+  id: string,
+  cache: Map<string, PackageInfo | null>,
+): Promise<PackageInfo | null> {
+  // Strip rolldown's `?query` / `#hash` suffixes if present.
+  const cleanId = id.replace(/[?#].*$/, "");
+
+  // Fast path: id matches `node_modules/<pkg>/...`. We still try to read
+  // the package's `package.json` to learn its `sideEffects` field, but if
+  // the file is unreadable (or this is a virtual id from a test) we fall
+  // back to a minimal record using the path-derived name.
+  const fastName = packageNameFromId(cleanId);
+
+  let dir = path.dirname(cleanId);
+  // Remember dirs we visited for this lookup so we can backfill their
+  // cache entries — but ONLY descendants of the resolved package root.
+  // Caching shared ancestors like `/proj/node_modules` would poison
+  // sibling packages (e.g. effect and lodash both live under it).
+  const visited: string[] = [];
+  let foundRoot: string | null = null;
+  let foundInfo: PackageInfo | null = null;
+  // Hard ceiling to prevent runaway walks on weird ids.
+  for (let i = 0; i < 64; i++) {
+    const cached = cache.get(dir);
+    if (cached !== undefined) {
+      cacheDescendants(cache, visited, dir, cached);
+      return cached;
+    }
+    visited.push(dir);
+    const pkgJsonPath = path.join(dir, "package.json");
+    let info: PackageInfo | null = null;
+    try {
+      const stat = await fs.stat(pkgJsonPath);
+      if (stat.isFile()) {
+        const contents = await fs.readFile(pkgJsonPath, "utf8");
+        const json = JSON.parse(contents) as {
+          name?: unknown;
+          sideEffects?: unknown;
+        };
+        info = {
+          name: typeof json.name === "string" ? json.name : null,
+          sideEffects: json.sideEffects,
+        };
+      }
+    } catch {
+      // package.json missing or unreadable — keep climbing.
+    }
+    if (info !== null) {
+      foundRoot = dir;
+      foundInfo = info;
+      break;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  if (foundInfo !== null && foundRoot !== null) {
+    cacheDescendants(cache, visited, foundRoot, foundInfo);
+    return foundInfo;
+  }
+  // No `package.json` found on disk. If we have a path-derived name
+  // (from a `node_modules/<pkg>/...` segment), use it with no
+  // `sideEffects` info — annotation can still happen, the override is
+  // gated separately. Cache only the directly-owning dir so we don't
+  // poison sibling lookups under the same `node_modules`.
+  if (fastName !== null) {
+    const fallback: PackageInfo = { name: fastName, sideEffects: undefined };
+    if (visited[0]) cache.set(visited[0], fallback);
+    return fallback;
+  }
+  if (visited[0]) cache.set(visited[0], null);
+  return null;
+}
+
+/**
+ * Caches `info` only at directories that are at or below `root` — i.e.
+ * directories that genuinely belong to the same package. Dirs above the
+ * package root are shared with siblings (e.g. `node_modules`) and must
+ * not be tagged.
+ */
+function cacheDescendants(
+  cache: Map<string, PackageInfo | null>,
+  visited: string[],
+  root: string,
+  info: PackageInfo | null,
+): void {
+  for (const v of visited) {
+    if (v === root || isPathInside(v, root)) cache.set(v, info);
+  }
+}
+
+/**
+ * `true` if `child` is `parent` or a directory contained beneath it.
+ * Path-only check; does not touch the filesystem.
+ */
+function isPathInside(child: string, parent: string): boolean {
+  if (child === parent) return true;
+  const rel = path.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+/**
+ * Convenience wrapper that returns just the package name. Equivalent to
+ * `resolvePackageInfo(...)?.name ?? packageNameFromId(id)`.
+ */
+export async function resolvePackageName(
+  id: string,
+  cache: Map<string, string | null>,
+): Promise<string | null> {
+  const cleanId = id.replace(/[?#].*$/, "");
+  const fast = packageNameFromId(cleanId);
+  if (fast !== null) return fast;
+  // Adapter cache so callers can keep a single-value cache shape.
+  const adapter = new Map<string, PackageInfo | null>();
+  for (const [k, v] of cache) {
+    adapter.set(k, v === null ? null : { name: v, sideEffects: undefined });
+  }
+  const info = await resolvePackageInfo(cleanId, adapter);
+  for (const [k, v] of adapter) {
+    cache.set(k, v?.name ?? null);
+  }
+  return info?.name ?? null;
+}
+
+interface AnnotatedModule {
+  readonly code: string;
+  readonly map: ReturnType<MagicString["generateMap"]>;
+}
+
+/**
+ * Parses `code` and inserts `/*#__PURE__*\/` before every top-level
+ * `CallExpression` / `NewExpression` callee. Returns `null` if the file
+ * does not need to be modified (parse failure or no annotations added).
+ */
+export function annotateModule(
+  code: string,
+  filename: string,
+): AnnotatedModule | null {
+  let program: Program;
+  try {
+    // Use TS lang so the parser tolerates TS syntax (`as`, `satisfies`,
+    // non-null assertions) even when scanning published .js dist files
+    // — TS is a strict superset of JS for our purposes here.
+    program = parseAst(code, { sourceType: "module", lang: "ts" }, filename);
+  } catch {
+    return null;
+  }
+
+  const s = new MagicString(code);
+  let mutated = false;
+
+  const annotateCall = (call: CallExpression | NewExpression) => {
+    if (isIIFE(call)) return;
+    // For `new X()`, anchor BEFORE the `new` keyword so we get
+    // `/*#__PURE__*/ new X()` (matches babel-plugin-annotate-pure-calls).
+    const anchor =
+      call.type === "NewExpression" ? call.start : call.callee.start;
+    if (alreadyAnnotated(code, anchor)) return;
+    s.appendLeft(anchor, PURE_COMMENT);
+    mutated = true;
+  };
+
+  const annotateExpression = (expr: Expression | null | undefined) => {
+    if (!expr) return;
+    switch (expr.type) {
+      case "CallExpression":
+      case "NewExpression":
+        annotateCall(expr);
+        return;
+      case "SequenceExpression":
+        for (const inner of expr.expressions) annotateExpression(inner);
+        return;
+      case "ParenthesizedExpression":
+        annotateExpression(expr.expression);
+        return;
+      case "LogicalExpression":
+        annotateExpression(expr.left);
+        annotateExpression(expr.right);
+        return;
+      case "ConditionalExpression":
+        annotateExpression(expr.consequent);
+        annotateExpression(expr.alternate);
+        return;
+      case "AssignmentExpression":
+        annotateExpression(expr.right);
+        return;
+      case "TSAsExpression":
+      case "TSSatisfiesExpression":
+      case "TSNonNullExpression":
+      case "TSTypeAssertion":
+        annotateExpression(expr.expression);
+        return;
+      case "ChainExpression": {
+        const inner = expr.expression;
+        if (inner.type === "CallExpression") annotateCall(inner);
+        return;
+      }
+      default:
+        return;
+    }
+  };
+
+  const visitTopLevel = (node: Statement) => {
+    switch (node.type) {
+      case "ExpressionStatement":
+        annotateExpression((node as ExpressionStatement).expression);
+        return;
+      case "VariableDeclaration":
+        for (const decl of (node as VariableDeclaration).declarations) {
+          annotateExpression(decl.init);
+        }
+        return;
+      case "ExportNamedDeclaration": {
+        const decl = (node as ExportNamedDeclaration).declaration;
+        if (decl) visitTopLevel(decl as Statement);
+        return;
+      }
+      case "ExportDefaultDeclaration": {
+        const decl = (node as ExportDefaultDeclaration).declaration;
+        if (
+          decl &&
+          decl.type !== "FunctionDeclaration" &&
+          decl.type !== "ClassDeclaration" &&
+          decl.type !== "TSInterfaceDeclaration"
+        ) {
+          annotateExpression(decl as Expression);
+        }
+        return;
+      }
+      default:
+        return;
+    }
+  };
+
+  for (const node of program.body) {
+    // Directive nodes (e.g. "use strict") have type "ExpressionStatement"
+    // with a `directive` field and a string literal expression — they
+    // cannot contain calls, so visiting them is a safe no-op.
+    visitTopLevel(node as Statement);
+  }
+
+  if (!mutated) return null;
+  return {
+    code: s.toString(),
+    map: s.generateMap({ source: filename, hires: true, includeContent: true }),
+  };
+}
+
+function isIIFE(node: CallExpression | NewExpression): boolean {
+  let callee: Expression = node.callee;
+  while (callee.type === "ParenthesizedExpression") {
+    callee = callee.expression;
+  }
+  return (
+    callee.type === "FunctionExpression" ||
+    callee.type === "ArrowFunctionExpression"
+  );
+}
+
+function alreadyAnnotated(code: string, pos: number): boolean {
+  const start = Math.max(0, pos - 32);
+  const slice = code.slice(start, pos);
+  return slice.includes("/*#__PURE__*/") || slice.includes("/*@__PURE__*/");
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/RawPlugin.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/RawPlugin.ts
new file mode 100644
index 00000000000..afbb68a481b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/RawPlugin.ts
@@ -0,0 +1,82 @@
+import type * as rolldown from "rolldown";
+
+/**
+ * Matches `?raw` or `&raw` query suffixes, mirroring Vite's `rawRE`
+ * (see `vite/src/node/utils.ts`). Used to gate both `resolveId` and
+ * `load` so the plugin only inspects ids that opt in.
+ */
+export const RAW_RE: RegExp = /(\?|&)raw(?:&|$)/;
+
+/**
+ * Rolldown plugin that adds Vite-style `?raw` import support to the
+ * Alchemy bundler.
+ *
+ * Importing a file with the `?raw` suffix inlines its contents as the
+ * default export of a JS module:
+ *
+ * ```ts
+ * import sql from "./schema.sql?raw";
+ * //         ^ string — the file contents read as UTF-8
+ * ```
+ *
+ * This plugin only implements `?raw`. Vite's `?url` and `?inline`
+ * variants both rely on a browser asset pipeline (URL serving / `data:`
+ * fallback) that has no analogue in the server-side bundles produced
+ * here (Cloudflare Workers, AWS Lambda), so they are intentionally
+ * omitted.
+ */
+export const rawPlugin = (): rolldown.Plugin => ({
+  name: "alchemy:raw",
+  resolveId: {
+    filter: { id: RAW_RE },
+    async handler(source, importer) {
+      const [base, query] = splitFileAndPostfix(source);
+      const resolved = await this.resolve(base, importer, { skipSelf: true });
+      if (!resolved || resolved.external) return null;
+      return { id: resolved.id + query, moduleSideEffects: false };
+    },
+  },
+  load: {
+    filter: { id: RAW_RE },
+    async handler(id) {
+      const file = id.replace(/[?#].*$/, "");
+      const contents = await this.fs.readFile(file, { encoding: "utf8" });
+      return {
+        code: `export default ${JSON.stringify(contents)};`,
+        // Empty mappings = "this module has no meaningful source map".
+        // The generated code is a synthetic `export default "..."` that
+        // doesn't correspond line-for-line to any source file (the
+        // underlying file isn't JS), so there's nothing to map. Supplying
+        // `{ mappings: "" }` (rather than omitting `map`) opts the module
+        // out of source-map generation without making rolldown synthesize
+        // a default one from the loaded code.
+        map: { mappings: "" },
+        // NOTE: matches Vite — avoids a double `export default` if the
+        // file extension would otherwise be picked up by another loader
+        // (e.g. `?raw&.json`).
+        moduleType: "js",
+      };
+    },
+  },
+});
+
+/**
+ * Splits an id into its file portion and the query/hash postfix (kept
+ * with the leading `?` / `#`). Matches Vite's `splitFileAndPostfix`.
+ *
+ * @example
+ *   splitFileAndPostfix("./foo.txt?raw") // => ["./foo.txt", "?raw"]
+ *   splitFileAndPostfix("./foo.txt")     // => ["./foo.txt", ""]
+ */
+export function splitFileAndPostfix(id: string): [string, string] {
+  const queryIdx = id.indexOf("?");
+  const hashIdx = id.indexOf("#");
+  const idx =
+    queryIdx === -1
+      ? hashIdx
+      : hashIdx === -1
+        ? queryIdx
+        : Math.min(queryIdx, hashIdx);
+  if (idx === -1) return [id, ""];
+  return [id.slice(0, idx), id.slice(idx)];
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/TempRoot.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/TempRoot.ts
new file mode 100644
index 00000000000..77ea1fced6f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/TempRoot.ts
@@ -0,0 +1,104 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as crypto from "node:crypto";
+import { Stack } from "../Stack.ts";
+import { Stage } from "../Stage.ts";
+
+/**
+ * Creates a unique bundle staging directory under the nearest package-local
+ * `.alchemy/tmp` root. Each invocation gets its own directory (via a random
+ * nonce) so concurrent bundle operations for the same resource never collide.
+ * Stale directories from previous crashed runs are cleaned up best-effort.
+ */
+export const createTempBundleDir = (
+  entry: string,
+  dotAlchemy: string,
+  id: string,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    const tempRoot = yield* findBundleTempRoot(entry, dotAlchemy);
+    yield* fs.makeDirectory(tempRoot, { recursive: true });
+
+    const nonce = crypto.randomUUID().slice(0, 8);
+    const bundleId = `${stack.name}-${stage}-${id}-${nonce}`;
+    const tempDir = path.join(tempRoot, bundleId);
+    yield* fs.makeDirectory(tempDir, { recursive: true });
+
+    return tempDir;
+  });
+
+/**
+ * Returns a deterministic bundle staging directory without clearing it first.
+ * Useful for Docker build contexts where keeping the directory stable avoids
+ * unnecessary file churn between builds.
+ */
+export const getStableContextDir = (
+  entry: string,
+  dotAlchemy: string,
+  id: string,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    const tempRoot = yield* findBundleTempRoot(entry, dotAlchemy);
+    const bundleId = `${stack.name}-${stage}-${id}`;
+    const tempDir = path.join(tempRoot, bundleId);
+
+    yield* fs.makeDirectory(tempDir, { recursive: true });
+
+    return tempDir;
+  });
+
+/**
+ * Cleans up a bundle's private temp directory.
+ */
+export const cleanupBundleTempDir = (tempDir: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    yield* fs.remove(tempDir, { recursive: true }).pipe(Effect.ignore);
+  });
+
+const findBundleTempRoot = (entry: string, dotAlchemy: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+
+    let current = path.dirname(entry);
+    while (true) {
+      // `node_modules` acts as the package/workspace anchor for temp bundles.
+      if (yield* fs.exists(path.join(current, "node_modules"))) {
+        return path.join(current, path.basename(dotAlchemy), "tmp");
+      }
+
+      const parent = path.dirname(current);
+      if (parent === current) {
+        break;
+      }
+      current = parent;
+    }
+
+    return path.join(path.dirname(entry), path.basename(dotAlchemy), "tmp");
+  });
+
+export const findCwdForBundle = Effect.fnUntraced(function* (entry: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  let current = path.dirname(entry);
+  while (true) {
+    if (yield* fs.exists(path.join(current, "package.json"))) {
+      return current;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return process.cwd();
+    }
+    current = parent;
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Bundle/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Bundle/index.ts
new file mode 100644
index 00000000000..4129cc0b16b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Bundle/index.ts
@@ -0,0 +1,6 @@
+export * from "./Bundle.ts";
+export * from "./BundleAnalyzerPlugin.ts";
+export * from "./Docker.ts";
+export * from "./PurePlugin.ts";
+export * from "./RawPlugin.ts";
+export * from "./TempRoot.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/Cli.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/Cli.ts
new file mode 100644
index 00000000000..f2798088a0d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/Cli.ts
@@ -0,0 +1,23 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import type { Plan } from "../Plan.ts";
+import type { ApplyEvent } from "./Event.ts";
+
+export interface PlanStatusSession {
+  emit: (event: ApplyEvent) => Effect.Effect<void>;
+  done: () => Effect.Effect<void>;
+}
+
+export interface ScopedPlanStatusSession extends PlanStatusSession {
+  note: (note: string) => Effect.Effect<void>;
+}
+
+export interface CLIService {
+  approvePlan: <P extends Plan>(plan: P) => Effect.Effect<boolean>;
+  displayPlan: <P extends Plan>(plan: P) => Effect.Effect<void>;
+  startApplySession: <P extends Plan>(
+    plan: P,
+  ) => Effect.Effect<PlanStatusSession>;
+}
+
+export class Cli extends Context.Service<Cli, CLIService>()("CLI") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/Event.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/Event.ts
new file mode 100644
index 00000000000..4274f977532
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/Event.ts
@@ -0,0 +1,36 @@
+export type ApplyStatus =
+  | "attaching"
+  | "post-attach"
+  | "pending"
+  | "pre-creating"
+  | "creating"
+  | "creating replacement"
+  | "created"
+  | "updating"
+  | "updated"
+  | "deleting"
+  | "deleted"
+  | "replacing"
+  | "replaced"
+  // Action lifecycle (see {@link Action})
+  | "running"
+  | "ran"
+  | "skipped"
+  | "fail";
+
+export type ApplyEvent = AnnotateEvent | StatusChangeEvent;
+
+export interface AnnotateEvent {
+  kind: "annotate";
+  id: string;
+  message: string;
+}
+
+export interface StatusChangeEvent {
+  kind: "status-change";
+  id: string; // resource id (e.g. "messages", "api")
+  type: string; // resource type (e.g. "AWS::Lambda::Function", "Cloudflare::Worker")
+  status: ApplyStatus;
+  message?: string; // optional details
+  bindingId?: string; // if this event is for a binding
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/LoggingCli.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/LoggingCli.ts
new file mode 100644
index 00000000000..db187b1c9db
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/LoggingCli.ts
@@ -0,0 +1,137 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { CRUD, Plan } from "../Plan.ts";
+import { Cli } from "./Cli.ts";
+import type { ApplyEvent, ApplyStatus } from "./Event.ts";
+
+const ESC = "\x1b[";
+const RESET = `${ESC}0m`;
+const useColor = process.stdout.hasColors?.() ?? !!process.stdout.isTTY;
+const c = (code: string, s: string) =>
+  useColor ? `${ESC}${code}m${s}${RESET}` : s;
+const dim = (s: string) => c("2", s);
+const bold = (s: string) => c("1", s);
+const red = (s: string) => c("31", s);
+const green = (s: string) => c("32", s);
+const yellow = (s: string) => c("33", s);
+const blue = (s: string) => c("34", s);
+const magenta = (s: string) => c("35", s);
+const cyan = (s: string) => c("36", s);
+
+const actionColor: Record<CRUD["action"], (s: string) => string> = {
+  create: green,
+  update: yellow,
+  replace: magenta,
+  delete: red,
+  noop: dim,
+};
+
+const statusColor = (status: ApplyStatus): ((s: string) => string) => {
+  switch (status) {
+    case "created":
+    case "updated":
+    case "replaced":
+      return green;
+    case "deleted":
+      return dim;
+    case "fail":
+      return red;
+    case "attaching":
+    case "post-attach":
+      return cyan;
+    default:
+      return yellow;
+  }
+};
+
+const tag = (id: string) => bold(`[${id}]`);
+
+const isTerminal = (status: ApplyStatus): boolean =>
+  status === "created" ||
+  status === "updated" ||
+  status === "deleted" ||
+  status === "replaced" ||
+  status === "fail";
+
+const formatPlanLines = (plan: Plan): string[] => {
+  const items = [
+    ...Object.values(plan.resources),
+    ...Object.values(plan.deletions),
+  ] as CRUD[];
+  if (items.length === 0) return [bold("Plan:") + " no changes"];
+
+  const counts = items.reduce(
+    (acc, item) => ((acc[item.action] = (acc[item.action] ?? 0) + 1), acc),
+    {} as Record<CRUD["action"], number>,
+  );
+  const summary = (["create", "update", "replace", "delete", "noop"] as const)
+    .filter((a) => counts[a])
+    .map((a) => actionColor[a](`${counts[a]} to ${a}`))
+    .join(dim(", "));
+
+  const sorted = [...items].sort((a, b) =>
+    a.resource.LogicalId.localeCompare(b.resource.LogicalId),
+  );
+  const lines = [`${bold("Plan:")} ${summary}`];
+  for (const item of sorted) {
+    const action = actionColor[item.action](item.action);
+    lines.push(`${tag(item.resource.LogicalId)} ${action}`);
+    for (const binding of item.bindings) {
+      if (binding.action === "noop") continue;
+      const bindingAction = actionColor[binding.action](binding.action);
+      lines.push(
+        `${tag(`${item.resource.LogicalId}/${binding.sid}`)} ${bindingAction}`,
+      );
+    }
+  }
+  return lines;
+};
+
+export const LoggingCli = Layer.succeed(
+  Cli,
+  Cli.of({
+    approvePlan: (plan) =>
+      Effect.gen(function* () {
+        for (const line of formatPlanLines(plan)) yield* Console.log(line);
+        yield* Console.log(
+          `\n${yellow("Non-interactive terminal detected.")} Pass ${bold("--yes")} to approve, or set ${bold("ALCHEMY_TUI=1")} for the interactive UI.`,
+        );
+        return false;
+      }),
+    displayPlan: (plan) =>
+      Effect.gen(function* () {
+        for (const line of formatPlanLines(plan)) yield* Console.log(line);
+      }),
+    startApplySession: (plan) =>
+      Effect.gen(function* () {
+        for (const line of formatPlanLines(plan)) yield* Console.log(line);
+        yield* Console.log("");
+
+        const counts = { ok: 0, fail: 0 };
+        return {
+          emit: (event: ApplyEvent) =>
+            Effect.sync(() => {
+              if (event.kind === "annotate") {
+                console.log(`${tag(event.id)} ${blue(event.message)}`);
+                return;
+              }
+              const id = event.bindingId
+                ? `${event.id}/${event.bindingId}`
+                : event.id;
+              const status = statusColor(event.status)(event.status);
+              const msg = event.message ? ` ${dim("—")} ${event.message}` : "";
+              console.log(`${tag(id)} ${status}${msg}`);
+              if (isTerminal(event.status)) {
+                if (event.status === "fail") counts.fail++;
+                else counts.ok++;
+              }
+            }),
+          done: () =>
+            Console.log(
+              `\n${bold("Done:")} ${green(`${counts.ok} succeeded`)}${counts.fail ? dim(", ") + red(`${counts.fail} failed`) : ""}`,
+            ),
+        };
+      }),
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/NamespaceTree.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/NamespaceTree.ts
new file mode 100644
index 00000000000..27be247f667
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/NamespaceTree.ts
@@ -0,0 +1,246 @@
+import { toPath } from "../FQN.ts";
+import type {
+  BindingAction,
+  CRUD,
+  ActionApply,
+  ActionDelete,
+} from "../Plan.ts";
+
+export interface TreeBinding {
+  sid: string;
+  action: BindingAction;
+}
+
+export type ActionTreeItem = ActionApply | ActionDelete;
+export type ActionVerb = ActionTreeItem["action"]; // "run" | "noop" | "delete"
+
+/**
+ * A tree node representing a namespace.
+ * Resources and tasks live directly inside the namespace where they were
+ * created.
+ */
+export interface TreeNode {
+  id: string;
+  path: string[];
+  children: Map<string, TreeNode>;
+  resources: CRUD[];
+  actions: ActionTreeItem[];
+}
+
+export type DerivedAction =
+  | "create"
+  | "update"
+  | "delete"
+  | "replace"
+  | "noop"
+  | "mixed";
+
+export function buildNamespaceTree(
+  items: CRUD[],
+  actions: ReadonlyArray<ActionTreeItem> = [],
+): TreeNode {
+  const root: TreeNode = {
+    id: "",
+    path: [],
+    children: new Map(),
+    resources: [],
+    actions: [],
+  };
+
+  const getNode = (path: string[]) => {
+    let current = root;
+    for (let i = 0; i < path.length; i++) {
+      const segment = path[i];
+      let child = current.children.get(segment);
+      if (!child) {
+        child = {
+          id: segment,
+          path: path.slice(0, i + 1),
+          children: new Map(),
+          resources: [],
+          actions: [],
+        };
+        current.children.set(segment, child);
+      }
+      current = child;
+    }
+    return current;
+  };
+
+  for (const item of items) {
+    getNode(toPath(item.resource.Namespace)).resources.push(item);
+  }
+  for (const action of actions) {
+    getNode(toPath(action.def.Namespace)).actions.push(action);
+  }
+
+  return root;
+}
+
+export function deriveNamespaceAction(node: TreeNode): DerivedAction {
+  const actions = new Set<BindingAction | CRUD["action"] | DerivedAction>();
+
+  for (const resource of node.resources) {
+    actions.add(deriveResourceChildrenAction(resource, node));
+  }
+  for (const action of node.actions) {
+    // Map task actions onto the resource action space for the rollup:
+    // run → create, delete → delete, noop → noop.
+    actions.add(
+      action.action === "run"
+        ? "create"
+        : action.action === "delete"
+          ? "delete"
+          : "noop",
+    );
+  }
+  for (const child of node.children.values()) {
+    const childAction = deriveNamespaceAction(child);
+    if (childAction === "mixed") {
+      return "mixed";
+    }
+    actions.add(childAction);
+  }
+
+  return deriveAction(actions);
+}
+
+export interface FlattenedItem {
+  type: "namespace" | "resource" | "binding" | "action";
+  depth: number;
+  id: string;
+  path: string[];
+  action: CRUD["action"] | BindingAction | DerivedAction | ActionVerb;
+  resourceType?: string;
+  bindingSid?: string;
+  bindingCount?: number;
+  hasChildren?: boolean;
+  /** For task items, the Task's Type (e.g. "Sync"). */
+  actionType?: string;
+}
+
+export function flattenTree(
+  node: TreeNode,
+  depth = 0,
+  result: FlattenedItem[] = [],
+): FlattenedItem[] {
+  flattenNamespace(node, depth, result);
+  return result;
+}
+
+const flattenNamespace = (
+  node: TreeNode,
+  depth: number,
+  result: FlattenedItem[],
+) => {
+  const sortedResources = [...node.resources].sort((a, b) =>
+    a.resource.LogicalId.localeCompare(b.resource.LogicalId),
+  );
+  const sortedChildren = Array.from(node.children.entries()).sort(([a], [b]) =>
+    a.localeCompare(b),
+  );
+  const resourceIds = new Set(
+    sortedResources.map((resource) => resource.resource.LogicalId),
+  );
+
+  for (const [id, child] of sortedChildren) {
+    if (resourceIds.has(id) || isEmpty(child)) {
+      continue;
+    }
+    result.push({
+      type: "namespace",
+      depth,
+      id,
+      path: child.path,
+      action: deriveNamespaceAction(child),
+      hasChildren: true,
+    });
+    flattenNamespace(child, depth + 1, result);
+  }
+
+  for (const resource of sortedResources) {
+    const childNamespace = node.children.get(resource.resource.LogicalId);
+    result.push({
+      type: "resource",
+      depth,
+      id: resource.resource.LogicalId,
+      path: [...node.path, resource.resource.LogicalId],
+      action: resource.action,
+      resourceType: resource.resource.Type,
+      bindingCount: resource.bindings.length,
+    });
+    for (const binding of [...resource.bindings].sort((a, b) =>
+      a.sid.localeCompare(b.sid),
+    )) {
+      result.push({
+        type: "binding",
+        depth: depth + 1,
+        id: binding.sid,
+        path: [...node.path, resource.resource.LogicalId, binding.sid],
+        action: binding.action,
+        bindingSid: binding.sid,
+      });
+    }
+    if (childNamespace) {
+      flattenNamespace(childNamespace, depth + 1, result);
+    }
+  }
+
+  // Actions are listed after resources at the same depth.
+  const sortedActions = [...node.actions].sort((a, b) =>
+    a.def.LogicalId.localeCompare(b.def.LogicalId),
+  );
+  for (const action of sortedActions) {
+    result.push({
+      type: "action",
+      depth,
+      id: action.def.LogicalId,
+      path: [...node.path, action.def.LogicalId],
+      action: action.action,
+      actionType: action.def.Type,
+    });
+  }
+};
+
+const isEmpty = (node: TreeNode) =>
+  node.resources.length === 0 &&
+  node.actions.length === 0 &&
+  Array.from(node.children.values()).every(isEmpty);
+
+const countVisibleChildren = (node: TreeNode) => {
+  const resourceIds = new Set(
+    node.resources.map((resource) => resource.resource.LogicalId),
+  );
+  return (
+    node.resources.length +
+    Array.from(node.children.keys()).filter((id) => !resourceIds.has(id)).length
+  );
+};
+
+const deriveResourceChildrenAction = (
+  resource: CRUD,
+  node: TreeNode,
+): DerivedAction => {
+  const actions = new Set<BindingAction | CRUD["action"] | DerivedAction>([
+    resource.action,
+  ]);
+  for (const binding of resource.bindings) {
+    actions.add(binding.action);
+  }
+  const childNamespace = node.children.get(resource.resource.LogicalId);
+  if (childNamespace) {
+    actions.add(deriveNamespaceAction(childNamespace));
+  }
+  return deriveAction(actions);
+};
+
+const deriveAction = (
+  actions: Set<BindingAction | CRUD["action"] | DerivedAction>,
+): DerivedAction => {
+  if (actions.size === 0) return "noop";
+  if (actions.has("replace")) return actions.size === 1 ? "replace" : "mixed";
+  if (actions.has("delete")) return actions.size === 1 ? "delete" : "mixed";
+  if (actions.has("create")) return actions.size === 1 ? "create" : "mixed";
+  if (actions.has("update")) return actions.size === 1 ? "update" : "mixed";
+  return "noop";
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/Reporter.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/Reporter.ts
new file mode 100644
index 00000000000..ab453e387dd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/Reporter.ts
@@ -0,0 +1,8 @@
+import * as Context from "effect/Context";
+
+export class Reporter extends Context.Service<
+  Reporter,
+  {
+    report: (event: Event) => void;
+  }
+>()("Reporter") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/checkVersion.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/checkVersion.ts
new file mode 100644
index 00000000000..bd3f0f33182
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/checkVersion.ts
@@ -0,0 +1,57 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+
+import packageJson from "../../package.json" with { type: "json" };
+
+const NPM_DIST_TAGS_URL =
+  "https://registry.npmjs.org/-/package/alchemy/dist-tags";
+
+/**
+ * Pick the dist-tag matching the current channel. For pre-release versions
+ * like `2.0.0-beta.33`, npm's `latest` tag points at the most recent stable
+ * release — not the newest beta — so we match the prerelease identifier
+ * (`beta`, `next`, etc.), falling back through `next` → `latest`.
+ */
+const pickDistTag = (
+  current: string,
+  distTags: Record<string, string>,
+): string | undefined => {
+  const pre = current.split("-", 2)[1];
+  if (pre) {
+    const id = pre.split(".")[0];
+    if (id && distTags[id]) return distTags[id];
+    if (distTags.next) return distTags.next;
+  }
+  return distTags.latest;
+};
+
+/**
+ * Fetch the published `alchemy` version on the dist-tag matching the
+ * current channel and log a warning if it's different from the bundled
+ * version. Best-effort: any failure (offline, registry hiccup, slow
+ * response) is swallowed silently.
+ */
+export const checkLatestVersion = Effect.gen(function* () {
+  const http = yield* HttpClient.HttpClient;
+  const response = yield* http.get(NPM_DIST_TAGS_URL);
+  const distTags = (yield* response.json) as Record<string, string>;
+  if (typeof distTags !== "object" || distTags === null) return;
+  const current = packageJson.version;
+  const latest = pickDistTag(current, distTags);
+  if (typeof latest !== "string" || latest === current) return;
+  const installCmd =
+    typeof process !== "undefined" && (process as any).versions?.bun
+      ? `bun add alchemy@${latest}`
+      : `pnpm add alchemy@${latest}`;
+  yield* Effect.logWarning(
+    `alchemy ${latest} is available (you're on ${current}). ` +
+      `Run \`${installCmd}\` to upgrade.`,
+  );
+}).pipe(
+  Effect.timeout(Duration.seconds(5)),
+  Effect.catch(() => Effect.void),
+);
+
+// Exported for tests.
+export const _internal = { pickDistTag };
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/_shared.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/_shared.ts
new file mode 100644
index 00000000000..801c8c61af0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/_shared.ts
@@ -0,0 +1,322 @@
+import * as Cause from "effect/Cause";
+import * as Config from "effect/Config";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as S from "effect/Schema";
+import * as Argument from "effect/unstable/cli/Argument";
+import * as CliError from "effect/unstable/cli/CliError";
+import * as Flag from "effect/unstable/cli/Flag";
+
+import {
+  type AuthProvider,
+  AuthError,
+  AuthProviders,
+} from "../../Auth/AuthProvider.ts";
+import type { AlchemyProfile } from "../../Auth/Profile.ts";
+import type * as Stack from "../../Stack.ts";
+import { recordCli } from "../../Telemetry/Metrics.ts";
+import { PromptCancelled } from "../../Util/Clank.ts";
+
+export const USER = Config.string("USER").pipe(
+  Config.orElse(() => Config.string("USERNAME")),
+  Config.withDefault("unknown"),
+);
+
+export const STAGE = Config.string("stage").pipe(
+  Config.option,
+  (a) => a,
+  Effect.map(Option.getOrUndefined),
+);
+
+/**
+ * `true` if `e` is a {@link PromptCancelled}, or an {@link AuthError} whose
+ * `cause` chain bottoms out in one. Schema-tagged errors don't always
+ * survive `instanceof` across module boundaries, so we also accept any
+ * object whose `_tag` matches.
+ */
+const isPromptCancellation = (e: unknown): boolean => {
+  for (let cur: unknown = e, i = 0; cur != null && i < 16; i++) {
+    if (cur instanceof PromptCancelled) return true;
+    if (
+      typeof cur === "object" &&
+      (cur as { _tag?: unknown })._tag === "PromptCancelled"
+    ) {
+      return true;
+    }
+    if (
+      cur instanceof AuthError ||
+      (typeof cur === "object" &&
+        (cur as { _tag?: unknown })._tag === "AuthError")
+    ) {
+      cur = (cur as { cause?: unknown }).cause;
+      continue;
+    }
+    return false;
+  }
+  return false;
+};
+
+/**
+ * Catches user cancellations (Ctrl+C inside a prompt, surfaced as
+ * {@link PromptCancelled} or wrapped in an {@link AuthError}) and exits
+ * the CLI cleanly with a friendly message instead of dumping a stack
+ * trace.
+ */
+export const handleCancellation = <A, E, R>(self: Effect.Effect<A, E, R>) =>
+  self.pipe(
+    Effect.catchCause((cause) => {
+      const cancelled = cause.reasons.some((r) => {
+        if (Cause.isFailReason(r)) return isPromptCancellation(r.error);
+        if (Cause.isDieReason(r)) return isPromptCancellation(r.defect);
+        return false;
+      });
+      return cancelled
+        ? Console.log("\nCancelled.")
+        : (Effect.failCause(cause) as Effect.Effect<never, E, never>);
+    }),
+    // A bare fiber interrupt (Ctrl+C while not inside a prompt) shouldn't
+    // dump a stack trace either.
+    Effect.onInterrupt(() => Console.log("\nInterrupted.")),
+  );
+
+export const stage = Flag.string("stage").pipe(
+  Flag.withSchema(S.String.check(S.isPattern(/^[a-z0-9]+([-_a-z0-9]+)*$/gi))),
+  Flag.withDescription("Stage to deploy to, defaults to dev_${USER}"),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+  Flag.mapEffect(
+    Effect.fn(function* (stage) {
+      if (stage) {
+        return stage;
+      }
+      return yield* STAGE.pipe(
+        Effect.catch(() =>
+          Effect.fail(
+            new CliError.MissingOption({
+              option: "stage",
+            }),
+          ),
+        ),
+        Effect.flatMap((s) =>
+          s === undefined
+            ? USER.pipe(
+                Effect.map((user) => `dev_${user}`),
+                Effect.catch(() => Effect.succeed("unknown")),
+              )
+            : Effect.succeed(s),
+        ),
+      );
+    }),
+  ),
+);
+
+export const envFile = Flag.file("env-file").pipe(
+  Flag.optional,
+  Flag.withDescription(
+    "File to load environment variables from, defaults to .env",
+  ),
+);
+
+export const dryRun = Flag.boolean("dry-run").pipe(
+  Flag.withDescription("Dry run the deployment, do not actually deploy"),
+  Flag.withDefault(false),
+);
+
+export const yes = Flag.boolean("yes").pipe(
+  Flag.withDescription("Yes to all prompts"),
+  Flag.withDefault(false),
+);
+
+export const force = Flag.boolean("force").pipe(
+  Flag.withDescription(
+    "Force updates for resources that would otherwise no-op",
+  ),
+  Flag.withDefault(false),
+);
+
+export const script = Argument.file("main", {
+  mustExist: true,
+}).pipe(
+  Argument.withDescription("Main file to deploy, defaults to alchemy.run.ts"),
+  Argument.withDefault("alchemy.run.ts"),
+);
+
+export const profile = Flag.string("profile").pipe(
+  Flag.withDescription(
+    "Auth profile to use (~/.alchemy/profiles.json). Defaults to 'default' or $ALCHEMY_PROFILE.",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrElse(() => "default")),
+);
+
+export const resourceFilter = Flag.string("filter").pipe(
+  Flag.withDescription(
+    "Comma-separated logical resource IDs (e.g. Api,Sandbox). Only those resources are included.",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+export const TAIL_COLORS = [
+  "\x1b[36m", // cyan
+  "\x1b[35m", // magenta
+  "\x1b[33m", // yellow
+  "\x1b[32m", // green
+  "\x1b[34m", // blue
+  "\x1b[91m", // bright red
+  "\x1b[96m", // bright cyan
+  "\x1b[95m", // bright magenta
+  "\x1b[93m", // bright yellow
+  "\x1b[92m", // bright green
+];
+export const TAIL_RESET = "\x1b[0m";
+
+export const formatLocalTimestamp = (date: Date): string => {
+  const y = date.getFullYear();
+  const mo = String(date.getMonth() + 1).padStart(2, "0");
+  const d = String(date.getDate()).padStart(2, "0");
+  const h = String(date.getHours()).padStart(2, "0");
+  const mi = String(date.getMinutes()).padStart(2, "0");
+  const s = String(date.getSeconds()).padStart(2, "0");
+  const ms = String(date.getMilliseconds()).padStart(3, "0");
+  const tz =
+    new Intl.DateTimeFormat("en-US", { timeZoneName: "short" })
+      .formatToParts(date)
+      .find((p) => p.type === "timeZoneName")?.value ?? "";
+  return `${y}-${mo}-${d} ${h}:${mi}:${s}.${ms} ${tz}`;
+};
+
+export const parseResourceFilter = (
+  filter: string | undefined,
+): ReadonlySet<string> | undefined => {
+  if (filter === undefined) return undefined;
+  const ids = filter
+    .split(",")
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+  if (ids.length === 0) return undefined;
+  return new Set(ids);
+};
+
+export const parseSince = (value: string): Date => {
+  const match = value.match(/^(\d+)([smhd])$/);
+  if (match) {
+    const num = parseInt(match[1]!, 10);
+    const unit = match[2]!;
+    const ms =
+      unit === "s"
+        ? num * 1000
+        : unit === "m"
+          ? num * 60_000
+          : unit === "h"
+            ? num * 3_600_000
+            : num * 86_400_000;
+    return new Date(Date.now() - ms);
+  }
+  const parsed = new Date(value);
+  if (isNaN(parsed.getTime())) {
+    throw new Error(
+      `Invalid --since value: '${value}'. Use a duration (e.g. '1h', '30m') or ISO date.`,
+    );
+  }
+  return parsed;
+};
+
+/**
+ * Wraps a CLI command handler with a top-level OpenTelemetry span
+ * (`cli.<command>`) and bumps the `alchemy.cli.invocations` counter.
+ *
+ * `attrs` runs against the parsed command args and contributes
+ * additional attributes to the span (e.g. stage, profile, dry-run flag).
+ *
+ * Usage:
+ * ```ts
+ * Command.make(
+ *   "deploy",
+ *   { ...flags },
+ *   instrumentCommand("deploy", (a) => ({
+ *     "alchemy.stage": a.stage,
+ *     "alchemy.profile": a.profile,
+ *   }))(execStack),
+ * );
+ * ```
+ */
+export const instrumentCommand =
+  <AttrsArgs = unknown>(
+    command: string,
+    attrs?: (args: AttrsArgs) => Record<string, unknown>,
+  ) =>
+  <Args extends AttrsArgs, A, E, R>(
+    handler: (args: Args) => Effect.Effect<A, E, R>,
+  ): ((args: Args) => Effect.Effect<A, E, R>) =>
+  (args) =>
+    handler(args).pipe(
+      Effect.withSpan(`cli.${command}`, {
+        attributes: attrs ? attrs(args) : {},
+      }),
+      recordCli(command),
+    );
+
+/**
+ * Render a profile's stored credential entries the same way across
+ * `alchemy login` and `alchemy profile show`: one `── Provider ──`
+ * header per entry, then either the provider's own `prettyPrint` block
+ * (preferred) or a JSON-style fallback when the provider isn't
+ * registered in the supplied {@link AuthProviders} registry.
+ */
+export const printProfile = Effect.fn(function* (
+  profile: string,
+  stored: AlchemyProfile,
+  registry: AuthProviders["Service"],
+) {
+  yield* Console.log(`Profile: ${profile}`);
+  const names = Object.keys(stored).sort();
+  if (names.length === 0) {
+    yield* Console.log("(no providers configured)");
+    return;
+  }
+  for (const name of names) {
+    const cfg = stored[name]!;
+    yield* Console.log("");
+    yield* Console.log(`── ${name} ──`);
+    const provider: AuthProvider | undefined = registry[name];
+    if (provider == null) {
+      yield* Console.log(`  method: ${cfg.method}`);
+      const { method: _method, ...rest } = cfg as Record<string, unknown> & {
+        method: string;
+      };
+      for (const [k, v] of Object.entries(rest)) {
+        yield* Console.log(
+          `  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`,
+        );
+      }
+      continue;
+    }
+    yield* provider.prettyPrint(profile, cfg);
+  }
+});
+
+export const importStack = Effect.fn(function* (main: string) {
+  const path = yield* Path.Path;
+  const url = import.meta.resolve(path.resolve(main));
+  const module = yield* Effect.promise(() => import(url));
+  const stackEffect = module.default as ReturnType<
+    ReturnType<typeof Stack.make>
+  >;
+  if (!Effect.isEffect(stackEffect)) {
+    return yield* Effect.die(
+      new Error(
+        `Main file '${main}' must export a default stack definition (export default Alchemy.Stack({...}))`,
+      ),
+    );
+  }
+  return stackEffect as typeof stackEffect & {
+    stackName: string;
+    stage: string;
+    providers: Layer.Layer<never>;
+    state: Layer.Layer<never>;
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/aws.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/aws.ts
new file mode 100644
index 00000000000..14a2ee523c2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/aws.ts
@@ -0,0 +1,127 @@
+import * as Auth from "@distilled.cloud/aws/Auth";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import type { FileSystem } from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import { Path } from "effect/Path";
+import * as Command from "effect/unstable/cli/Command";
+import * as Flag from "effect/unstable/cli/Flag";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+
+import {
+  bootstrap as bootstrapAws,
+  destroyBootstrap as destroyBootstrapAws,
+} from "../../AWS/Bootstrap.ts";
+import * as AWSCredentials from "../../AWS/Credentials.ts";
+import * as AWSEnvironment from "../../AWS/Environment.ts";
+import * as AWSRegion from "../../AWS/Region.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import { envFile, instrumentCommand } from "./_shared.ts";
+
+const awsProfile = Flag.string("profile").pipe(
+  Flag.withDescription("AWS profile to use for credentials"),
+  Flag.optional,
+  Flag.map(Option.getOrElse(() => "default")),
+);
+
+const awsRegion = Flag.string("region").pipe(
+  Flag.withDescription(
+    "AWS region to bootstrap (defaults to AWS_REGION env var)",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+const bootstrapDestroy = Flag.boolean("destroy").pipe(
+  Flag.withDescription("Destroy all bootstrap buckets in the selected region"),
+  Flag.withDefault(false),
+);
+
+const bootstrapCommand = Command.make(
+  "bootstrap",
+  {
+    envFile,
+    profile: awsProfile,
+    region: awsRegion,
+    destroy: bootstrapDestroy,
+  },
+  instrumentCommand(
+    "aws.bootstrap",
+    (a: { profile: string; region: string | undefined; destroy: boolean }) => ({
+      "alchemy.profile": a.profile,
+      "alchemy.region": a.region ?? "",
+      "alchemy.destroy": a.destroy,
+    }),
+  )(
+    Effect.fnUntraced(function* ({ envFile, profile, region, destroy }) {
+      const logger = Logger.layer([fileLogger("bootstrap.txt")], {
+        mergeWithExisting: true,
+      });
+
+      return yield* Effect.gen(function* () {
+        const ssoProfile = yield* Auth.loadProfile(profile);
+        if (!ssoProfile.sso_account_id) {
+          return yield* Effect.die(
+            `AWS SSO profile '${profile}' is missing sso_account_id`,
+          );
+        }
+
+        const ambient = yield* Effect.context<FileSystem | Path | HttpClient>();
+        const environment = AWSEnvironment.makeEnvironment({
+          accountId: ssoProfile.sso_account_id,
+          region: region ?? ssoProfile.region ?? "us-east-1",
+          credentials: Auth.loadProfileCredentials(profile).pipe(
+            Effect.provide(ambient),
+          ),
+          profile,
+        });
+
+        const awsLayers = Layer.provideMerge(
+          Layer.mergeAll(
+            AWSRegion.fromEnvironment,
+            AWSCredentials.fromEnvironment,
+          ),
+          environment,
+        );
+
+        return yield* Effect.gen(function* () {
+          const provider = yield* loadConfigProvider(envFile);
+          const bootstrapLayer = Layer.provide(
+            awsLayers,
+            Layer.succeed(ConfigProvider.ConfigProvider, provider),
+          );
+          if (destroy) {
+            yield* destroyBootstrapAws().pipe(
+              Effect.tap((result) =>
+                result.destroyed === 0
+                  ? Console.log("✓ No bootstrap buckets found to destroy")
+                  : Console.log(
+                      `✓ Destroyed ${result.destroyed} bootstrap bucket(s): ${result.bucketNames.join(", ")}`,
+                    ),
+              ),
+              Effect.provide(bootstrapLayer),
+            );
+            return;
+          }
+          yield* bootstrapAws().pipe(
+            Effect.tap(({ bucketName, created }) =>
+              created
+                ? Console.log(`✓ Created assets bucket: ${bucketName}`)
+                : Console.log(`✓ Assets bucket already exists: ${bucketName}`),
+            ),
+            Effect.provide(bootstrapLayer),
+          );
+        });
+      }).pipe(Effect.provide(logger));
+    }),
+  ),
+);
+
+export const awsCommand = Command.make("aws", {}).pipe(
+  Command.withSubcommands([bootstrapCommand]),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/cloudflare.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/cloudflare.ts
new file mode 100644
index 00000000000..5d27922afe4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/cloudflare.ts
@@ -0,0 +1,617 @@
+import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
+import { apiKeyCredentials } from "@distilled.cloud/cloudflare/Credentials";
+import * as user from "@distilled.cloud/cloudflare/user";
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { Command, Flag } from "effect/unstable/cli";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { withProfileOverride } from "../../Auth/Profile.ts";
+import * as CloudflareAccess from "../../Cloudflare/Access.ts";
+import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.ts";
+import * as CloudflareEnvironment from "../../Cloudflare/CloudflareEnvironment.ts";
+import * as CloudflareCredentials from "../../Cloudflare/Credentials.ts";
+import { CloudflareLogs } from "../../Cloudflare/Logs.ts";
+import { STATE_STORE_SCRIPT_NAME } from "../../Cloudflare/StateStore/Api.ts";
+import { bootstrap as bootstrapCloudflare } from "../../Cloudflare/StateStore/State.ts";
+import * as Clank from "../../Util/Clank.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import {
+  envFile,
+  formatLocalTimestamp,
+  instrumentCommand,
+  parseSince,
+  profile,
+} from "./_shared.ts";
+
+/**
+ * Build the Cloudflare auth + environment layer stack used by every
+ * `alchemy cloudflare ...` subcommand. Mirrors the wiring inside
+ * `Cloudflare.state(...)` so the command can talk to the user's
+ * account out-of-band.
+ */
+const cloudflareLayers = (
+  envFileOpt: Option.Option<string>,
+  profileName: string,
+) =>
+  Effect.gen(function* () {
+    const authProviders: AuthProviders["Service"] = {};
+    const authRegistry = Layer.succeed(AuthProviders, authProviders);
+    const authLayer = Layer.provideMerge(CloudflareAuth, authRegistry);
+    const cf = Layer.provideMerge(
+      Layer.mergeAll(
+        CloudflareCredentials.fromAuthProvider(),
+        CloudflareEnvironment.fromProfile(),
+        CloudflareAccess.AccessLive,
+      ),
+      authLayer,
+    );
+
+    const logger = Logger.layer([fileLogger("cloudflare.txt")], {
+      mergeWithExisting: true,
+    });
+
+    return Layer.mergeAll(
+      cf,
+      ConfigProvider.layer(
+        withProfileOverride(yield* loadConfigProvider(envFileOpt), profileName),
+      ),
+      logger,
+    );
+  });
+
+const cloudflareForce = Flag.boolean("force").pipe(
+  Flag.withDescription(
+    "Force a full redeploy even if the state-store worker already exists. " +
+      "Without this flag, an existing worker is adopted and only its credentials are refreshed.",
+  ),
+  Flag.withDefault(false),
+);
+
+const cloudflareWorkerName = Flag.string("worker-name").pipe(
+  Flag.withDescription(
+    "Override the default state-store worker name (advanced; only needed for multiple state stores per account).",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+const bootstrapCommand = Command.make(
+  "bootstrap",
+  {
+    envFile,
+    profile,
+    force: cloudflareForce,
+    workerName: cloudflareWorkerName,
+  },
+  instrumentCommand(
+    "cloudflare.bootstrap",
+    (a: {
+      profile: string;
+      force: boolean;
+      workerName: string | undefined;
+    }) => ({
+      "alchemy.profile": a.profile,
+      "alchemy.force": a.force,
+      "alchemy.worker_name": a.workerName ?? "",
+    }),
+  )(
+    Effect.fnUntraced(function* ({ envFile, profile, force, workerName }) {
+      const services = yield* cloudflareLayers(envFile, profile);
+      yield* bootstrapCloudflare({
+        workerName,
+        force,
+        profile,
+      }).pipe(Effect.provide(services));
+    }),
+  ),
+);
+
+/**
+ * A single resolved Cloudflare token policy in the shape expected by
+ * `POST /user/tokens`.
+ */
+type CreateTokenPolicy = {
+  effect: "allow";
+  permissionGroups: { id: string }[];
+  resources: Record<string, unknown>;
+};
+
+/**
+ * Curated set of permission groups granted by `create-token` when
+ * `--all-permissions` is NOT passed. Covers the services Alchemy commonly
+ * deploys (Workers + storage + zone/DNS) without handing out a god token.
+ * Names are matched against the account's live permission groups; any name
+ * not available for the account is silently skipped.
+ */
+const ALCHEMY_DEFAULT_PERMISSION_GROUP_NAMES: ReadonlySet<string> = new Set([
+  "Account Settings Read",
+  "Workers Scripts Read",
+  "Workers Scripts Write",
+  "Workers KV Storage Read",
+  "Workers KV Storage Write",
+  "Workers R2 Storage Read",
+  "Workers R2 Storage Write",
+  "Workers Routes Read",
+  "Workers Routes Write",
+  "Workers Tail Read",
+  "Workers Observability Read",
+  "Workers Observability Write",
+  "Workers AI Read",
+  "Workers AI Write",
+  "D1 Read",
+  "D1 Write",
+  "Queues Read",
+  "Queues Write",
+  "Hyperdrive Read",
+  "Hyperdrive Write",
+  "Pages Read",
+  "Pages Write",
+  "Vectorize Read",
+  "Vectorize Write",
+  "Pipelines Read",
+  "Pipelines Write",
+  "AI Gateway Read",
+  "AI Gateway Run",
+  "AI Gateway Write",
+  "Browser Rendering Read",
+  "Browser Rendering Write",
+  "Images Read",
+  "Images Write",
+  "Stream Read",
+  "Stream Write",
+  "Secrets Store Read",
+  "Secrets Store Write",
+  "DNS Read",
+  "DNS Write",
+  "Zone Read",
+  "Zone Settings Read",
+  "Zone Settings Write",
+  "SSL and Certificates Read",
+  "SSL and Certificates Write",
+]);
+
+/**
+ * Group permission groups by their Cloudflare scope and produce one policy
+ * per scope, wiring up the right resource selector for each:
+ *
+ * - `com.cloudflare.api.account` → scoped to the account ID
+ * - `com.cloudflare.api.account.zone` → all zones (`*`)
+ * - `com.cloudflare.edge.r2.bucket` → all buckets (`*`)
+ *
+ * Mirrors the upstream `alchemy` "god token" policy shape. Groups with an
+ * unrecognized scope are skipped, and empty policies are dropped.
+ */
+const buildTokenPolicies = (
+  accountId: string,
+  groups: readonly { id: string; scopes: readonly string[] }[],
+): CreateTokenPolicy[] => {
+  const buckets: Record<string, CreateTokenPolicy> = {
+    "com.cloudflare.api.account": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+    },
+    "com.cloudflare.api.account.zone": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { "com.cloudflare.api.account.zone.*": "*" },
+    },
+    "com.cloudflare.edge.r2.bucket": {
+      effect: "allow",
+      permissionGroups: [],
+      resources: { "com.cloudflare.edge.r2.bucket.*": "*" },
+    },
+  };
+  const seen = new Set<string>();
+  for (const group of groups) {
+    const bucket = buckets[group.scopes[0]!];
+    if (!bucket || seen.has(group.id)) continue;
+    seen.add(group.id);
+    bucket.permissionGroups.push({ id: group.id });
+  }
+  return Object.values(buckets).filter((p) => p.permissionGroups.length > 0);
+};
+
+/**
+ * Let the user pick which Cloudflare account the token is scoped to. Lists
+ * the accounts visible to the configured credentials and prompts a selection
+ * (defaulting the cursor to the profile's account). If there's exactly one
+ * account, it's used without prompting; if the API returns none, falls back
+ * to the profile's account.
+ */
+const selectAccountId = (defaultAccountId: string | undefined) =>
+  Effect.gen(function* () {
+    const list = yield* cfAccounts.listAccounts;
+    const response = yield* list({});
+    const accounts = response.result;
+
+    if (accounts.length === 0) {
+      if (defaultAccountId) return defaultAccountId;
+      return yield* Effect.die(
+        "No Cloudflare accounts found for these credentials.",
+      );
+    }
+    if (accounts.length === 1) {
+      const account = accounts[0]!;
+      yield* Clank.info(`Using account: ${account.name} (${account.id})`);
+      return account.id;
+    }
+    return yield* Clank.select({
+      message: "Select a Cloudflare account",
+      initialValue: defaultAccountId,
+      options: accounts.map((a) => ({
+        value: a.id,
+        label: a.name,
+        hint: a.id === defaultAccountId ? `${a.id} (current profile)` : a.id,
+      })),
+    });
+  });
+
+const allPermissionsFlag = Flag.boolean("all-permissions").pipe(
+  Flag.withDescription(
+    "Grant the token EVERY Cloudflare permission group (a 'god token'). " +
+      "Use with care — it has full access to your account.",
+  ),
+  Flag.withDefault(false),
+);
+
+const tokenNameFlag = Flag.string("name").pipe(
+  Flag.withDescription(
+    "Name for the API token. Defaults to 'alchemy' (or 'alchemy-all-permissions').",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+const tokenAccountIdFlag = Flag.string("account-id").pipe(
+  Flag.withDescription(
+    "Cloudflare account ID to scope the token to. Defaults to the profile's account.",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+/**
+ * `alchemy cloudflare create-token` — mint a Cloudflare API token
+ * (`POST /user/tokens`).
+ *
+ * This command is **standalone**: it does not use an Alchemy auth profile.
+ * Cloudflare only mints a token whose permissions the authenticating
+ * credential is allowed to grant — and OAuth/scoped tokens silently produce a
+ * token with zero permissions — so it always authenticates with the account's
+ * **Global API Key** (read from `CLOUDFLARE_API_KEY` / `CLOUDFLARE_EMAIL`,
+ * otherwise prompted). The key is used only to create the token and is never
+ * stored.
+ *
+ * With `--all-permissions` it builds a "superuser" token spanning every
+ * permission group (after a confirmation prompt). Otherwise it grants a
+ * curated set covering the services Alchemy commonly deploys.
+ */
+const createTokenCommand = Command.make(
+  "create-token",
+  {
+    envFile,
+    allPermissions: allPermissionsFlag,
+    name: tokenNameFlag,
+    accountId: tokenAccountIdFlag,
+  },
+  instrumentCommand(
+    "cloudflare.create-token",
+    (a: { allPermissions: boolean }) => ({
+      "alchemy.all_permissions": a.allPermissions,
+    }),
+  )(
+    Effect.fnUntraced(function* ({ envFile, allPermissions, name, accountId }) {
+      const configProvider = ConfigProvider.layer(
+        yield* loadConfigProvider(envFile),
+      );
+
+      yield* Effect.gen(function* () {
+        // The Global API Key is a dashboard-only secret — there is no API to
+        // fetch it — so read it from the environment or prompt for it. It is
+        // used only to create the token and is never stored.
+        const envApiKey = yield* Config.string("CLOUDFLARE_API_KEY").pipe(
+          Config.option,
+          Config.map(Option.getOrUndefined),
+        );
+        const apiKey =
+          envApiKey ??
+          (yield* Clank.password({
+            message:
+              "Paste your Global API Key (see bottom of https://dash.cloudflare.com/profile/api-tokens)",
+            validate: (v) => (v.trim().length === 0 ? "Required" : undefined),
+          }));
+
+        const envEmail = yield* Config.string("CLOUDFLARE_EMAIL").pipe(
+          Config.option,
+          Config.map(Option.getOrUndefined),
+        );
+        const email =
+          envEmail ??
+          (yield* Clank.text({
+            message: "Cloudflare account email",
+            validate: (v) => (v.trim().length === 0 ? "Required" : undefined),
+          }));
+
+        const credentials = Effect.succeed(
+          apiKeyCredentials({ apiKey, email }),
+        );
+        const withCreds = <A, E, R>(self: Effect.Effect<A, E, R>) =>
+          self.pipe(
+            Effect.provideService(
+              CloudflareCredentials.Credentials,
+              credentials,
+            ),
+          );
+
+        const resolvedAccountId =
+          accountId ?? (yield* withCreds(selectAccountId(undefined)));
+
+        const tokenName =
+          name ??
+          (yield* Clank.text({
+            message: "Token name",
+            placeholder: allPermissions ? "alchemy-superuser" : "alchemy",
+            validate: (v) =>
+              v.trim().length === 0 ? "Token name is required" : undefined,
+          }));
+
+        // Resolve permission groups live from Cloudflare instead of a static
+        // catalog. Cloudflare silently ignores permission-group IDs it doesn't
+        // recognize, so a stale local list yields a token with zero
+        // permissions. `/user/tokens/permission_groups` returns exactly the
+        // groups (and IDs) valid for this credential.
+        //
+        // We hit the endpoint with a raw GET rather than the typed distilled
+        // client: the client hard-codes the set of valid `scopes` literals,
+        // and Cloudflare keeps adding new ones (e.g. `com.cloudflare.edge.
+        // worker.script`), which makes the strict schema reject the whole
+        // response. Parsing leniently keeps us forward-compatible.
+        const http = yield* HttpClient.HttpClient;
+        const pgResponse = yield* http.get(
+          "https://api.cloudflare.com/client/v4/user/tokens/permission_groups",
+          {
+            headers: {
+              "X-Auth-Key": apiKey,
+              "X-Auth-Email": email,
+              Accept: "application/json",
+            },
+          },
+        );
+        const pgBody = (yield* pgResponse.json) as {
+          result?: { id?: string; name?: string; scopes?: string[] }[];
+        };
+        const liveGroups = (pgBody.result ?? []).flatMap((g) =>
+          g.id && g.scopes && g.scopes.length > 0
+            ? [{ id: g.id, name: g.name ?? "", scopes: g.scopes }]
+            : [],
+        );
+
+        const selected = allPermissions
+          ? liveGroups
+          : liveGroups.filter((g) =>
+              ALCHEMY_DEFAULT_PERMISSION_GROUP_NAMES.has(g.name),
+            );
+        const policies = buildTokenPolicies(resolvedAccountId, selected);
+
+        if (policies.length === 0) {
+          return yield* Effect.die(
+            "No permission groups resolved for this account; cannot create a token.",
+          );
+        }
+
+        if (allPermissions) {
+          yield* Clank.warn(
+            "This token will have FULL access to your Cloudflare account. " +
+              "Keep it secret — anyone with it can control your account.",
+          );
+          const ok = yield* Clank.confirm({
+            message: "Create a superuser token with all permissions?",
+            initialValue: false,
+          });
+          if (!ok) {
+            yield* Console.log("Cancelled.");
+            return;
+          }
+        }
+
+        const result = yield* withCreds(
+          user.createToken({ name: tokenName, policies }),
+        );
+
+        if (!result.value) {
+          return yield* Effect.die(
+            "Cloudflare did not return a token value. Try again.",
+          );
+        }
+
+        // Cloudflare echoes back the policies it actually accepted. It silently
+        // drops permission groups the authenticating user isn't allowed to
+        // grant — so a token can come back with zero permissions even though
+        // the request was well-formed. Count what was granted and warn loudly
+        // if it's empty (almost always an account-role problem, not a bug).
+        const granted = (result.policies ?? []).reduce(
+          (n, p) => n + (p.permissionGroups?.length ?? 0),
+          0,
+        );
+
+        // Verify the freshly minted token actually authenticates. The
+        // Cloudflare dashboard has a long-standing rendering bug where
+        // API-created tokens show a blank permission summary (and a disabled
+        // "View"), which makes a perfectly good token look empty. A live
+        // `/user/tokens/verify` is the source of truth.
+        const status = yield* http
+          .get("https://api.cloudflare.com/client/v4/user/tokens/verify", {
+            headers: {
+              Authorization: `Bearer ${result.value}`,
+              Accept: "application/json",
+            },
+          })
+          .pipe(
+            Effect.flatMap((r) => r.json),
+            Effect.map(
+              (b) => (b as { result?: { status?: string } }).result?.status,
+            ),
+            Effect.catch(() => Effect.succeed(undefined)),
+          );
+
+        yield* Console.log("");
+        yield* Console.log(
+          `Created Cloudflare API token "${result.name ?? tokenName}" (${result.id ?? "unknown id"}).`,
+        );
+        yield* Console.log(
+          `Granted ${granted} permission group(s) across ${result.policies?.length ?? 0} policy(ies)` +
+            (status ? `; token status: ${status}.` : "."),
+        );
+        yield* Console.log("");
+        yield* Console.log(result.value);
+        yield* Console.log("");
+        yield* Console.log(
+          "Store this value now — Cloudflare only shows it once. " +
+            "Use it as CLOUDFLARE_API_TOKEN.",
+        );
+
+        if (granted === 0) {
+          yield* Clank.warn(
+            "Cloudflare granted 0 permissions. A token can only carry permissions " +
+              "the authenticating user already holds, so this usually means the " +
+              "Global API Key's user is not a Super Administrator on the selected " +
+              "account. Check the user's role in the Cloudflare dashboard " +
+              "(Members) and retry with an owner/Super Administrator.",
+          );
+        } else {
+          // Token is good; preempt the "it looks empty" confusion.
+          yield* Clank.info(
+            "Heads up: the Cloudflare dashboard often renders API-created tokens " +
+              'with a blank permission summary (and a greyed-out "View") — this is ' +
+              "a known UI bug, not a broken token. The permissions above are applied. " +
+              'To see them in the dashboard, open the token and click "← Edit token".',
+          );
+        }
+      }).pipe(Effect.provide(configProvider));
+    }),
+  ),
+);
+
+const tailFlag = Flag.boolean("tail").pipe(
+  Flag.withDescription(
+    "Stream logs in real time via the Cloudflare tail websocket instead of fetching past entries.",
+  ),
+  Flag.withDefault(false),
+);
+
+const limitFlag = Flag.integer("limit").pipe(
+  Flag.withDescription("Number of log entries to fetch (ignored with --tail)"),
+  Flag.withDefault(100),
+);
+
+const sinceFlag = Flag.string("since").pipe(
+  Flag.withDescription(
+    "Fetch logs since this time (e.g. '1h', '30m', '2024-01-01T00:00:00Z')",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+/**
+ * `alchemy cloudflare state logs` — get or tail logs from the
+ * `alchemy-state-store` Worker on the user's account. Lets us debug
+ * the state-store worker without standing up a stack file.
+ */
+const stateLogsCommand = Command.make(
+  "logs",
+  {
+    envFile,
+    profile,
+    workerName: cloudflareWorkerName,
+    tail: tailFlag,
+    limit: limitFlag,
+    since: sinceFlag,
+  },
+  instrumentCommand(
+    "cloudflare.state.logs",
+    (a: {
+      profile: string;
+      workerName: string | undefined;
+      tail: boolean;
+      limit: number;
+    }) => ({
+      "alchemy.profile": a.profile,
+      "alchemy.worker_name": a.workerName ?? STATE_STORE_SCRIPT_NAME,
+      "alchemy.tail": a.tail,
+      "alchemy.limit": a.limit,
+    }),
+  )(
+    Effect.fnUntraced(function* ({
+      envFile,
+      profile,
+      workerName,
+      tail,
+      limit,
+      since,
+    }) {
+      const services = yield* cloudflareLayers(envFile, profile);
+      const scriptName = workerName ?? STATE_STORE_SCRIPT_NAME;
+
+      yield* Effect.gen(function* () {
+        const { accountId } =
+          yield* CloudflareEnvironment.CloudflareEnvironment;
+        const telemetry = yield* CloudflareLogs;
+
+        const formatLine = (line: { timestamp: Date; message: string }) =>
+          `${formatLocalTimestamp(line.timestamp)} [${scriptName}] ${line.message}`;
+
+        if (tail) {
+          yield* Console.log(`Tailing ${scriptName}...`);
+          yield* telemetry
+            .tailScript({ accountId, scriptName })
+            .pipe(Stream.runForEach((line) => Console.log(formatLine(line))));
+          return;
+        }
+
+        const sinceDate = since ? parseSince(since) : undefined;
+        const lines = yield* telemetry.queryLogs({
+          accountId,
+          filters: [
+            {
+              key: "$workers.scriptName",
+              operation: "eq",
+              type: "string",
+              value: scriptName,
+            },
+          ],
+          options: { limit, since: sinceDate },
+        });
+
+        if (lines.length === 0) {
+          yield* Console.log(`(no log entries for ${scriptName})`);
+          return;
+        }
+
+        for (const line of lines.sort(
+          (a, b) => a.timestamp.getTime() - b.timestamp.getTime(),
+        )) {
+          yield* Console.log(formatLine(line));
+        }
+      }).pipe(Effect.provide(services));
+    }),
+  ),
+);
+
+const stateCommand = Command.make("state", {}).pipe(
+  Command.withSubcommands([stateLogsCommand]),
+);
+
+export const cloudflareCommand = Command.make("cloudflare", {}).pipe(
+  Command.withSubcommands([bootstrapCommand, createTokenCommand, stateCommand]),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/deploy.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/deploy.ts
new file mode 100644
index 00000000000..6236122ace4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/deploy.ts
@@ -0,0 +1,218 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Command from "effect/unstable/cli/Command";
+import * as Flag from "effect/unstable/cli/Flag";
+
+import { AdoptPolicy } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { apply } from "../../Apply.ts";
+import { ArtifactStore, createArtifactStore } from "../../Artifacts.ts";
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { withProfileOverride } from "../../Auth/Profile.ts";
+import * as CLI from "../../Cli/Cli.ts";
+import * as Plan from "../../Plan.ts";
+import { Stage } from "../../Stage.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import {
+  dryRun as dryRunFlag,
+  envFile,
+  force,
+  importStack,
+  instrumentCommand,
+  profile,
+  script,
+  stage,
+  yes,
+} from "./_shared.ts";
+
+export const ExecStackOptions = Schema.Struct({
+  main: Schema.String,
+  stage: Schema.String,
+  envFile: Schema.OptionFromOptional(Schema.String),
+  profile: Schema.optional(Schema.String),
+  dryRun: Schema.optional(Schema.Boolean),
+  force: Schema.optional(Schema.Boolean),
+  yes: Schema.optional(Schema.Boolean),
+  destroy: Schema.optional(Schema.Boolean),
+  dev: Schema.optional(Schema.Boolean),
+  adopt: Schema.optional(Schema.Boolean),
+});
+export type ExecStackOptions = typeof ExecStackOptions.Type;
+export type ExecStackOptionsEncoded = typeof ExecStackOptions.Encoded;
+
+const stackSpanAttrs = (args: ExecStackOptions) => ({
+  "alchemy.stage": args.stage,
+  "alchemy.profile": args.profile,
+  "alchemy.main": args.main,
+  "alchemy.dry_run": !!args.dryRun,
+  "alchemy.force": !!args.force,
+  "alchemy.destroy": !!args.destroy,
+  "alchemy.dev": !!args.dev,
+  "alchemy.adopt": !!args.adopt,
+});
+
+const adopt = Flag.boolean("adopt").pipe(
+  Flag.withDescription(
+    "Adopt pre-existing cloud resources that conflict with this stack instead of failing. " +
+      "Useful for re-importing infrastructure into a fresh state store.",
+  ),
+  Flag.withDefault(false),
+);
+
+export const execStack = Effect.fn(function* ({
+  main,
+  stage,
+  envFile,
+  profile,
+  dryRun = false,
+  force = false,
+  yes = false,
+  destroy = false,
+  dev = false,
+  adopt = false,
+}: ExecStackOptions) {
+  const stackEffect = yield* importStack(main);
+
+  const services = Layer.mergeAll(
+    Layer.effect(
+      AlchemyContext,
+      AlchemyContext.pipe(
+        Effect.map((ctx) => ({
+          ...ctx,
+          dev,
+          adopt,
+        })),
+      ),
+    ),
+    // `--adopt` opts the entire deploy in to adoption-on-conflict.
+    // Resource providers that wire `AdoptPolicy` (Worker domains,
+    // Cloudflare.SecretsStore, etc.) will reconcile against
+    // pre-existing cloud resources instead of failing on duplicates.
+    // Default is `false` so an unintentional collision still surfaces
+    // loudly.
+    Layer.succeed(AdoptPolicy, adopt),
+    Layer.succeed(ArtifactStore, createArtifactStore()),
+    Layer.succeed(
+      AuthProviders,
+      yield* Effect.serviceOption(AuthProviders).pipe(
+        Effect.map(Option.getOrElse(() => ({}))),
+      ),
+    ),
+    ConfigProvider.layer(
+      withProfileOverride(yield* loadConfigProvider(envFile), profile),
+    ),
+    Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+    Layer.succeed(Stage, stage),
+  );
+
+  yield* Effect.gen(function* () {
+    const cli = yield* CLI.Cli;
+    const stack = yield* stackEffect;
+
+    yield* Effect.gen(function* () {
+      const updatePlan = yield* Plan.make(
+        destroy
+          ? {
+              ...stack,
+              // zero these out (destroy will treat all as orphans)
+              // TODO(sam): probably better to have Plan.destroy and Plan.update
+              resources: {},
+              bindings: {},
+              actions: {},
+              output: {},
+            }
+          : stack,
+        { force },
+      );
+      if (dryRun) {
+        yield* cli.displayPlan(updatePlan);
+      } else {
+        const hasChanges =
+          Object.keys(updatePlan.deletions).length > 0 ||
+          Object.values(updatePlan.resources).some(
+            (node) =>
+              node.action !== "noop" ||
+              node.bindings.some((b) => b.action !== "noop"),
+          );
+        if (!yes && hasChanges) {
+          const approved = yield* cli.approvePlan(updatePlan);
+          if (!approved) {
+            return;
+          }
+        }
+        const outputs = yield* apply(updatePlan);
+
+        if (outputs !== undefined) {
+          yield* Console.log(outputs);
+        }
+
+        if (dev) {
+          yield* Effect.never;
+        }
+      }
+    }).pipe(Effect.provide(stack.services));
+  }).pipe(Effect.provide(services));
+});
+
+export const deployCommand = Command.make(
+  "deploy",
+  {
+    dryRun: dryRunFlag,
+    force,
+    main: script,
+    envFile,
+    stage,
+    yes,
+    profile,
+    adopt,
+  },
+  instrumentCommand("deploy", stackSpanAttrs)(execStack),
+);
+
+export const destroyCommand = Command.make(
+  "destroy",
+  {
+    dryRun: dryRunFlag,
+    main: script,
+    envFile,
+    stage,
+    yes,
+    profile,
+  },
+  instrumentCommand(
+    "destroy",
+    stackSpanAttrs,
+  )((args) =>
+    execStack({
+      ...args,
+      destroy: true,
+    }),
+  ),
+);
+
+export const planCommand = Command.make(
+  "plan",
+  {
+    main: script,
+    envFile,
+    stage,
+    profile,
+  },
+  instrumentCommand(
+    "plan",
+    stackSpanAttrs,
+  )((args) =>
+    execStack({
+      ...args,
+      // plan is the same as deploy with dryRun always set to true
+      dryRun: true,
+    }),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/dev.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/dev.ts
new file mode 100644
index 00000000000..00d62279c29
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/dev.ts
@@ -0,0 +1,81 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Command from "effect/unstable/cli/Command";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { fileURLToPath } from "node:url";
+import { SPAWNER_URL_ENV_KEY } from "../../Local/RpcProviderProxy.ts";
+import * as RpcSpawner from "../../Local/RpcSpawner.ts";
+import { envFile, force, profile, script, stage } from "./_shared.ts";
+import { ExecStackOptions } from "./deploy.ts";
+
+export const devCommand = Command.make(
+  "dev",
+  {
+    force,
+    main: script,
+    envFile,
+    stage,
+    profile,
+  },
+  Effect.fn(
+    function* (args) {
+      const options = yield* Schema.encodeEffect(ExecStackOptions)({
+        ...args,
+        yes: true,
+        dev: true,
+      });
+      const spawner = yield* RpcSpawner.RpcSpawner;
+      // We no longer force Bun in development because this prevents us from testing in Node.
+      const command =
+        typeof globalThis.Bun !== "undefined"
+          ? [
+              "bun",
+              "run",
+              ...process.execArgv,
+              "--watch",
+              "--no-clear-screen",
+              fileURLToPath(import.meta.resolve("alchemy/bin/exec.ts")),
+            ]
+          : [
+              "node",
+              ...process.execArgv,
+              ...(isTransformTypesSupported()
+                ? [
+                    "--experimental-transform-types",
+                    "--no-warnings=ExperimentalWarning",
+                  ]
+                : []),
+              "--watch",
+              "--watch-preserve-output",
+              fileURLToPath(import.meta.resolve("alchemy/bin/exec.js")),
+            ];
+      const child = yield* ChildProcess.make(command[0], command.slice(1), {
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+        env: {
+          ALCHEMY_EXEC_OPTIONS: JSON.stringify(options),
+          [SPAWNER_URL_ENV_KEY]: spawner.url,
+        },
+        extendEnv: true,
+        detached: false,
+      });
+      yield* child.exitCode;
+    },
+    (effect, args) =>
+      Effect.provide(
+        RpcSpawner.layerServer({
+          profile: args.profile,
+          envFile: Option.getOrUndefined(args.envFile),
+        }),
+      )(effect),
+  ),
+);
+
+const isTransformTypesSupported = (
+  version = process.versions.node,
+): boolean => {
+  const [major, minor] = version.split(".").map(Number);
+  return (major === 22 && minor >= 7) || (major >= 23 && major < 26);
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/login.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/login.ts
new file mode 100644
index 00000000000..9f4d7e0ac6d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/login.ts
@@ -0,0 +1,140 @@
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import { Command, Flag } from "effect/unstable/cli";
+
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { Profile, withProfileOverride } from "../../Auth/Profile.ts";
+import { Stage } from "../../Stage.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import { Stack } from "../../Stack.ts";
+import {
+  envFile,
+  importStack,
+  instrumentCommand,
+  printProfile,
+  profile,
+  script,
+  stage,
+} from "./_shared.ts";
+
+const loginConfigure = Flag.boolean("configure").pipe(
+  Flag.withDescription(
+    "Run the provider's interactive configure step before logging in",
+  ),
+  Flag.withDefault(false),
+);
+
+export const loginCommand = Command.make(
+  "login",
+  {
+    main: script,
+    envFile,
+    stage,
+    profile,
+    configure: loginConfigure,
+  },
+  instrumentCommand(
+    "login",
+    (a: {
+      main: string;
+      stage: string;
+      profile: string;
+      configure: boolean;
+    }) => ({
+      "alchemy.stage": a.stage,
+      "alchemy.profile": a.profile,
+      "alchemy.main": a.main,
+      "alchemy.configure": a.configure,
+    }),
+  )(
+    Effect.fnUntraced(function* ({ main, stage, envFile, profile, configure }) {
+      const stackEffect = yield* importStack(main);
+
+      const authProviders: AuthProviders["Service"] = {};
+
+      // build the state + providers layer to capture the Auth Providers
+      yield* Layer.build(
+        (stackEffect.providers ?? Layer.empty).pipe(
+          Layer.provideMerge(stackEffect.state ?? Layer.empty),
+          Layer.provideMerge(
+            Layer.mergeAll(
+              Layer.succeed(AuthProviders, authProviders),
+              ConfigProvider.layer(
+                withProfileOverride(
+                  yield* loadConfigProvider(envFile),
+                  profile,
+                ),
+              ),
+              Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+              Layer.succeed(Stage, stage),
+              Layer.succeed(Stack, {
+                actions: {},
+                bindings: {},
+                name: stackEffect.stackName,
+                resources: {},
+                stage,
+              }),
+            ),
+          ),
+        ),
+      );
+
+      const profiles = yield* Profile;
+
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const providers = Object.values(authProviders);
+
+      if (providers.length === 0) {
+        yield* Console.log(
+          "No AuthProviders registered. Make sure the stack's providers() layer includes AuthProviderLayer entries.",
+        );
+        return;
+      }
+
+      yield* Effect.forEach(
+        providers,
+        (provider) =>
+          Effect.gen(function* () {
+            const existing = yield* profiles.getProfile(profile);
+            // --configure treats every provider as missing, so configure
+            // runs unconditionally and overwrites the stored entry.
+            const stored = configure ? undefined : existing?.[provider.name];
+
+            let cfg: { method: string };
+            if (stored == null) {
+              cfg = yield* provider.configure(profile, { ci });
+              yield* profiles.setProfile(profile, {
+                ...existing,
+                [provider.name]: cfg,
+              });
+            } else {
+              cfg = stored;
+            }
+
+            // `read` succeeds when creds are present and not expired
+            // (refreshing OAuth proactively if near expiry). Any failure
+            // — missing file, dead refresh token, etc. — falls through
+            // to `login`.
+            yield* provider
+              .read(profile, cfg)
+              .pipe(Effect.catch(() => provider.login(profile, cfg)));
+          }),
+        { discard: true },
+      );
+
+      // Print the resulting profile using the same renderer as
+      // `alchemy profile show`.
+      const final = yield* profiles.getProfile(profile);
+      if (final != null) {
+        yield* Console.log("");
+        yield* printProfile(profile, final, authProviders);
+      }
+    }),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/logs.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/logs.ts
new file mode 100644
index 00000000000..ee653738477
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/logs.ts
@@ -0,0 +1,168 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import { Command, Flag } from "effect/unstable/cli";
+
+import { findProviderByType, type LogLine } from "../../Provider.ts";
+import { Stage } from "../../Stage.ts";
+import * as State from "../../State/index.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { withProfileOverride } from "../../Auth/Profile.ts";
+import {
+  envFile,
+  formatLocalTimestamp,
+  importStack,
+  instrumentCommand,
+  parseResourceFilter,
+  parseSince,
+  profile,
+  resourceFilter,
+  script,
+  stage,
+  TAIL_COLORS,
+  TAIL_RESET,
+} from "./_shared.ts";
+
+const logsLimit = Flag.integer("limit").pipe(
+  Flag.withDescription("Number of log entries to fetch"),
+  Flag.withDefault(100),
+);
+
+const logsSince = Flag.string("since").pipe(
+  Flag.withDescription(
+    "Fetch logs since this time (e.g. '1h', '30m', '2024-01-01T00:00:00Z')",
+  ),
+  Flag.optional,
+  Flag.map(Option.getOrUndefined),
+);
+
+export const logsCommand = Command.make(
+  "logs",
+  {
+    main: script,
+    envFile,
+    stage,
+    profile,
+    filter: resourceFilter,
+    limit: logsLimit,
+    since: logsSince,
+  },
+  instrumentCommand(
+    "logs",
+    (a: { main: string; stage: string; profile: string; limit: number }) => ({
+      "alchemy.stage": a.stage,
+      "alchemy.profile": a.profile,
+      "alchemy.main": a.main,
+      "alchemy.limit": a.limit,
+    }),
+  )(
+    Effect.fnUntraced(function* ({
+      main,
+      stage,
+      envFile,
+      profile,
+      filter,
+      limit,
+      since,
+    }) {
+      const stackEffect = yield* importStack(main);
+
+      const services = Layer.mergeAll(
+        ConfigProvider.layer(
+          withProfileOverride(yield* loadConfigProvider(envFile), profile),
+        ),
+        Layer.succeed(AuthProviders, {}),
+        Layer.succeed(Stage, stage),
+        Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+        State.localState(),
+      );
+
+      const sinceDate = since ? parseSince(since) : undefined;
+
+      yield* Effect.gen(function* () {
+        const stack = yield* stackEffect;
+
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State.State;
+          const filterSet = parseResourceFilter(filter);
+          const availableIds = [
+            ...new Set(Object.values(stack.resources).map((r) => r.LogicalId)),
+          ].sort();
+
+          if (filterSet) {
+            for (const id of filterSet) {
+              if (!availableIds.includes(id)) {
+                return yield* Effect.die(
+                  new Error(
+                    `Unknown resource '${id}' in --filter. Available: ${availableIds.join(", ") || "(none)"}`,
+                  ),
+                );
+              }
+            }
+          }
+
+          const fqns = Object.keys(stack.resources);
+          const allLogs: { logicalId: string; lines: LogLine[] }[] = [];
+
+          for (const fqn of fqns) {
+            const resource = stack.resources[fqn]!;
+            if (filterSet && !filterSet.has(resource.LogicalId)) continue;
+
+            const resourceState = yield* state.get({
+              stack: stack.name,
+              stage: stack.stage,
+              fqn,
+            });
+            if (!(resourceState as any)?.attr) continue;
+
+            const provider = yield* findProviderByType(resource.Type);
+            if (!provider.logs) continue;
+
+            const lines = yield* provider.logs({
+              id: resource.LogicalId,
+              instanceId: (resourceState as any).instanceId,
+              props: (resourceState as any).props,
+              output: (resourceState as any).attr,
+              options: { limit, since: sinceDate },
+            });
+
+            allLogs.push({ logicalId: resource.LogicalId, lines });
+          }
+
+          if (allLogs.length === 0) {
+            if (filterSet) {
+              yield* Console.log(
+                "No resources with logs match --filter (deploy first, or selected resources may not expose logs).",
+              );
+            } else {
+              yield* Console.log(
+                "No resources with logs found. Deploy first, then run logs.",
+              );
+            }
+            return;
+          }
+
+          const merged = allLogs
+            .flatMap(({ logicalId, lines }, i) => {
+              const color = TAIL_COLORS[i % TAIL_COLORS.length]!;
+              return lines.map((line) => ({
+                ...line,
+                formatted: `${color}${formatLocalTimestamp(line.timestamp)} [${logicalId}]${TAIL_RESET} ${line.message}`,
+              }));
+            })
+            .sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
+
+          for (const entry of merged) {
+            yield* Console.log(entry.formatted);
+          }
+        }).pipe(Effect.provide(stack.services));
+      }).pipe(Effect.provide(services));
+    }),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/profile.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/profile.ts
new file mode 100644
index 00000000000..a782d7dde93
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/profile.ts
@@ -0,0 +1,104 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import { Command } from "effect/unstable/cli";
+
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { CredentialsStore } from "../../Auth/Credentials.ts";
+import { Profile, withProfileOverride } from "../../Auth/Profile.ts";
+import { AwsAuth } from "../../AWS/AuthProvider.ts";
+import { AxiomAuth } from "../../Axiom/AuthProvider.ts";
+import { CloudflareAuth } from "../../Cloudflare/Auth/AuthProvider.ts";
+import { GitHubAuth } from "../../GitHub/AuthProvider.ts";
+import { NeonAuth } from "../../Neon/AuthProvider.ts";
+import { PlanetscaleAuth } from "../../Planetscale/AuthProvider.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import {
+  envFile,
+  instrumentCommand,
+  printProfile,
+  profile,
+} from "./_shared.ts";
+
+const showCommand = Command.make(
+  "show",
+  { profile, envFile },
+  instrumentCommand("profile.show", (a: { profile: string }) => ({
+    "alchemy.profile": a.profile,
+  }))(
+    Effect.fnUntraced(function* ({ profile, envFile }) {
+      const profiles = yield* Profile;
+      const stored = yield* profiles.getProfile(profile);
+      if (stored == null) {
+        const config = yield* profiles.readConfig;
+        const names = Object.keys(config.profiles);
+        yield* Console.log(`Profile '${profile}' not found.`);
+        if (names.length > 0) {
+          yield* Console.log(`Available profiles: ${names.sort().join(", ")}`);
+        } else {
+          yield* Console.log("No profiles configured. Run `alchemy login`.");
+        }
+        return;
+      }
+
+      const authProviders: AuthProviders["Service"] = {};
+      const authRegistry = Layer.succeed(AuthProviders, authProviders);
+      const services = Layer.mergeAll(
+        authRegistry,
+        ConfigProvider.layer(
+          withProfileOverride(yield* loadConfigProvider(envFile), profile),
+        ),
+        Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+        // Building these layers triggers their AuthProviderLayer effect, which
+        // registers the provider into the shared `authProviders` registry.
+        Layer.provide(
+          Layer.mergeAll(
+            AwsAuth,
+            AxiomAuth,
+            CloudflareAuth,
+            GitHubAuth,
+            NeonAuth,
+            PlanetscaleAuth,
+          ),
+          authRegistry,
+        ),
+      );
+
+      yield* printProfile(profile, stored, authProviders).pipe(
+        Effect.provide(services),
+      );
+    }),
+  ),
+);
+
+const clearCommand = Command.make(
+  "clear",
+  { profile },
+  instrumentCommand("profile.clear", (a: { profile: string }) => ({
+    "alchemy.profile": a.profile,
+  }))(
+    Effect.fnUntraced(function* ({ profile }) {
+      const profiles = yield* Profile;
+      const store = yield* CredentialsStore;
+      const removed = yield* profiles.deleteProfile(profile);
+      yield* store.deleteProfile(profile);
+      if (removed) {
+        yield* Console.log(
+          `Cleared profile '${profile}' and all its credentials.`,
+        );
+      } else {
+        yield* Console.log(
+          `Profile '${profile}' not found in profiles.json; removed any stray credentials directory.`,
+        );
+      }
+    }),
+  ),
+);
+
+export const profileCommand = Command.make("profile", {}).pipe(
+  Command.withSubcommands([showCommand, clearCommand]),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/state.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/state.ts
new file mode 100644
index 00000000000..d8ed6f1af15
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/state.ts
@@ -0,0 +1,377 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import { Argument, Command, Flag } from "effect/unstable/cli";
+
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { withProfileOverride } from "../../Auth/Profile.ts";
+import { Stage } from "../../Stage.ts";
+import * as State from "../../State/index.ts";
+import { encodeState } from "../../State/StateEncoding.ts";
+import * as Clank from "../../Util/Clank.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import {
+  envFile,
+  importStack,
+  instrumentCommand,
+  profile,
+  script,
+  stage,
+  yes,
+} from "./_shared.ts";
+
+/**
+ * When set, the State service is replaced with the on-disk
+ * `LocalState` (`.alchemy/state` under the cwd) instead of whatever
+ * the stack file configures (e.g. the Cloudflare HTTP state store).
+ * Useful for inspecting orphaned local state after a partially-failed
+ * bootstrap.
+ */
+const localFlag = Flag.boolean("local").pipe(
+  Flag.withDescription(
+    "Read from local .alchemy/state instead of the stack's configured state store",
+  ),
+  Flag.withDefault(false),
+);
+
+const stackArg = Argument.string("stack").pipe(
+  Argument.withDescription("Stack name (e.g. AlchemyEffectWebsite)"),
+);
+
+const stageArg = Argument.string("stage").pipe(
+  Argument.withDescription("Stage name (e.g. dev_samgoodwin, prod)"),
+);
+
+const fqnArg = Argument.string("fqn").pipe(
+  Argument.withDescription("Fully-qualified resource name"),
+);
+
+/**
+ * Build the layer stack used by every `alchemy state ...` subcommand.
+ *
+ * The stack file is imported and evaluated so that its `state` layer
+ * (Cloudflare HTTP store, in-memory, etc.) is in scope. Pass `local`
+ * to swap the configured State for an on-disk LocalState instead.
+ */
+const withStateService = <A, E>(
+  args: {
+    main: string;
+    stage: string;
+    envFile: import("effect/Option").Option<string>;
+    profile: string;
+    local: boolean;
+  },
+  body: (state: State.StateService) => Effect.Effect<A, E, never>,
+) =>
+  Effect.gen(function* () {
+    const stackEffect = yield* importStack(args.main);
+
+    const services = Layer.mergeAll(
+      Layer.succeed(AuthProviders, {}),
+      ConfigProvider.layer(
+        withProfileOverride(
+          yield* loadConfigProvider(args.envFile),
+          args.profile,
+        ),
+      ),
+      Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+      Layer.succeed(Stage, args.stage),
+      // When --local is set we still build the stack to get its other
+      // services, but force State to be LocalState. Without --local the
+      // stack's configured State (httpState, etc.) wins.
+      args.local ? State.localState() : Layer.empty,
+    );
+
+    return yield* Effect.gen(function* () {
+      const stack = yield* stackEffect;
+      return yield* Effect.gen(function* () {
+        const state = yield* yield* State.State;
+        return yield* body(state);
+      }).pipe(Effect.provide(stack.services));
+    }).pipe(Effect.provide(services));
+  });
+
+const stacksCommand = Command.make(
+  "stacks",
+  { main: script, envFile, stage, profile, local: localFlag },
+  instrumentCommand("state.stacks")(
+    Effect.fnUntraced(function* (args) {
+      yield* withStateService(args, (state) =>
+        Effect.gen(function* () {
+          const stacks = yield* state.listStacks();
+          if (stacks.length === 0) {
+            yield* Console.log("(no stacks)");
+            return;
+          }
+          for (const s of [...stacks].sort()) {
+            yield* Console.log(s);
+          }
+        }),
+      );
+    }),
+  ),
+);
+
+const stagesCommand = Command.make(
+  "stages",
+  { stack: stackArg, main: script, envFile, stage, profile, local: localFlag },
+  instrumentCommand("state.stages")(
+    Effect.fnUntraced(function* ({ stack: stackName, ...rest }) {
+      yield* withStateService(rest, (state) =>
+        Effect.gen(function* () {
+          const stages = yield* state.listStages(stackName);
+          if (stages.length === 0) {
+            yield* Console.log(`(no stages in ${stackName})`);
+            return;
+          }
+          for (const s of [...stages].sort()) {
+            yield* Console.log(s);
+          }
+        }),
+      );
+    }),
+  ),
+);
+
+const resourcesCommand = Command.make(
+  "resources",
+  {
+    stack: stackArg,
+    stageName: Argument.string("stage").pipe(
+      Argument.withDescription("Stage to list resources from"),
+    ),
+    main: script,
+    envFile,
+    stage,
+    profile,
+    local: localFlag,
+  },
+  instrumentCommand("state.resources")(
+    Effect.fnUntraced(function* ({ stack: stackName, stageName, ...rest }) {
+      yield* withStateService(rest, (state) =>
+        Effect.gen(function* () {
+          const fqns = yield* state.list({
+            stack: stackName,
+            stage: stageName,
+          });
+          if (fqns.length === 0) {
+            yield* Console.log(`(no resources in ${stackName}/${stageName})`);
+            return;
+          }
+          for (const f of [...fqns].sort()) {
+            yield* Console.log(f);
+          }
+        }),
+      );
+    }),
+  ),
+);
+
+const getCommand = Command.make(
+  "get",
+  {
+    stack: stackArg,
+    stageName: Argument.string("stage").pipe(
+      Argument.withDescription("Stage the resource lives in"),
+    ),
+    fqn: fqnArg,
+    main: script,
+    envFile,
+    stage,
+    profile,
+    local: localFlag,
+  },
+  instrumentCommand("state.get")(
+    Effect.fnUntraced(function* ({
+      stack: stackName,
+      stageName,
+      fqn,
+      ...rest
+    }) {
+      yield* withStateService(rest, (state) =>
+        Effect.gen(function* () {
+          const value = yield* state.get({
+            stack: stackName,
+            stage: stageName,
+            fqn,
+          });
+          if (value === undefined) {
+            yield* Console.log(`(not found: ${stackName}/${stageName}/${fqn})`);
+            return;
+          }
+          // encodeState produces a JSON-friendly view: redacted secrets
+          // are unwrapped into `{ __redacted__: ... }`, Resources are
+          // flattened, etc. Same shape the store persists.
+          yield* Console.log(JSON.stringify(encodeState(value), null, 2));
+        }),
+      );
+    }),
+  ),
+);
+
+const treeCommand = Command.make(
+  "tree",
+  { main: script, envFile, stage, profile, local: localFlag },
+  instrumentCommand("state.tree")(
+    Effect.fnUntraced(function* (args) {
+      yield* withStateService(args, (state) =>
+        Effect.gen(function* () {
+          const stacks = [...(yield* state.listStacks())].sort();
+          if (stacks.length === 0) {
+            yield* Console.log("(empty state store)");
+            return;
+          }
+          // Fetch the entire tree in parallel: for each stack, list its
+          // stages; for each (stack, stage), list its resources. All
+          // network round-trips happen concurrently; output is rendered
+          // once at the end so the user doesn't see stuttered partial
+          // output.
+          const tree = yield* Effect.forEach(
+            stacks,
+            (stk) =>
+              Effect.gen(function* () {
+                const stages = [...(yield* state.listStages(stk))].sort();
+                const stageEntries = yield* Effect.forEach(
+                  stages,
+                  (stg) =>
+                    Effect.map(
+                      state.list({ stack: stk, stage: stg }),
+                      (fqns) => ({ stage: stg, fqns: [...fqns].sort() }),
+                    ),
+                  { concurrency: "unbounded" },
+                );
+                return { stack: stk, stages: stageEntries };
+              }),
+            { concurrency: "unbounded" },
+          );
+
+          const lines: string[] = [];
+          for (const { stack: stk, stages } of tree) {
+            lines.push(stk);
+            for (let i = 0; i < stages.length; i++) {
+              const { stage: stg, fqns } = stages[i]!;
+              const stageBranch = i === stages.length - 1 ? "└─" : "├─";
+              lines.push(`${stageBranch} ${stg}`);
+              const indent = i === stages.length - 1 ? "   " : "│  ";
+              for (let j = 0; j < fqns.length; j++) {
+                const leaf = j === fqns.length - 1 ? "└─" : "├─";
+                lines.push(`${indent}${leaf} ${fqns[j]}`);
+              }
+            }
+          }
+          yield* Console.log(lines.join("\n"));
+        }),
+      );
+    }),
+  ),
+);
+
+const clearStackArg = Argument.string("stack").pipe(
+  Argument.withDescription(
+    "Stack name to clear. Omit to clear ALL stacks in the store.",
+  ),
+  Argument.optional,
+);
+
+const clearStageArg = Argument.string("stage").pipe(
+  Argument.withDescription(
+    "Stage to clear within the stack. Omit to clear all stages in the stack.",
+  ),
+  Argument.optional,
+);
+
+/**
+ * Destructive: removes resource state from the store. The actual cloud
+ * resources are NOT touched — this only affects what alchemy thinks
+ * exists. Always confirms before deleting unless `--yes` is passed.
+ */
+const clearCommand = Command.make(
+  "clear",
+  {
+    stack: clearStackArg,
+    stageName: clearStageArg,
+    main: script,
+    envFile,
+    stage,
+    profile,
+    local: localFlag,
+    yes,
+  },
+  instrumentCommand("state.clear")(
+    Effect.fnUntraced(function* ({
+      stack: stackOpt,
+      stageName: stageOpt,
+      yes: yesFlag,
+      ...rest
+    }) {
+      const stackName = Option.getOrUndefined(stackOpt);
+      const stageName = Option.getOrUndefined(stageOpt);
+
+      if (stageName !== undefined && stackName === undefined) {
+        yield* Console.log(
+          "Error: cannot specify <stage> without <stack>. Pass the stack name as the first argument.",
+        );
+        return yield* Effect.fail(new Error("missing stack"));
+      }
+
+      yield* withStateService(rest, (state) =>
+        Effect.gen(function* () {
+          const targets: ReadonlyArray<{ stack: string; stage?: string }> =
+            stackName === undefined
+              ? [...(yield* state.listStacks())]
+                  .sort()
+                  .map((s) => ({ stack: s }))
+              : stageName === undefined
+                ? [{ stack: stackName }]
+                : [{ stack: stackName, stage: stageName }];
+
+          if (targets.length === 0) {
+            yield* Console.log("(nothing to clear)");
+            return;
+          }
+
+          const scope =
+            stackName === undefined
+              ? `ALL stacks (${targets.length}): ${targets.map((t) => t.stack).join(", ")}`
+              : stageName === undefined
+                ? `stack '${stackName}' (all stages)`
+                : `stage '${stageName}' in stack '${stackName}'`;
+
+          if (!yesFlag) {
+            const ok = yield* Clank.confirm({
+              message: `About to delete ${scope} from the state store. This cannot be undone. Continue?`,
+              initialValue: false,
+            });
+            if (!ok) {
+              yield* Console.log("Cancelled.");
+              return;
+            }
+          }
+
+          for (const target of targets) {
+            yield* state.deleteStack(target);
+            yield* Console.log(
+              `cleared ${target.stack}${target.stage ? `/${target.stage}` : ""}`,
+            );
+          }
+        }),
+      );
+    }),
+  ),
+);
+
+export const stateCommand = Command.make("state", {}).pipe(
+  Command.withSubcommands([
+    stacksCommand,
+    stagesCommand,
+    resourcesCommand,
+    getCommand,
+    treeCommand,
+    clearCommand,
+  ]),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/tail.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/tail.ts
new file mode 100644
index 00000000000..16fd501eb62
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/commands/tail.ts
@@ -0,0 +1,148 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Stream from "effect/Stream";
+import * as Command from "effect/unstable/cli/Command";
+
+import { findProviderByType, type LogLine } from "../../Provider.ts";
+import { Stage } from "../../Stage.ts";
+import * as State from "../../State/index.ts";
+import { loadConfigProvider } from "../../Util/ConfigProvider.ts";
+import { fileLogger } from "../../Util/FileLogger.ts";
+
+import { AuthProviders } from "../../Auth/AuthProvider.ts";
+import { withProfileOverride } from "../../Auth/Profile.ts";
+import {
+  envFile,
+  formatLocalTimestamp,
+  importStack,
+  instrumentCommand,
+  parseResourceFilter,
+  profile,
+  resourceFilter,
+  script,
+  stage,
+  TAIL_COLORS,
+  TAIL_RESET,
+} from "./_shared.ts";
+
+export const tailCommand = Command.make(
+  "tail",
+  {
+    main: script,
+    envFile,
+    stage,
+    profile,
+    filter: resourceFilter,
+  },
+  instrumentCommand(
+    "tail",
+    (a: { main: string; stage: string; profile: string }) => ({
+      "alchemy.stage": a.stage,
+      "alchemy.profile": a.profile,
+      "alchemy.main": a.main,
+    }),
+  )(
+    Effect.fnUntraced(function* ({ main, stage, envFile, profile, filter }) {
+      const stackEffect = yield* importStack(main);
+
+      const services = Layer.mergeAll(
+        ConfigProvider.layer(
+          withProfileOverride(yield* loadConfigProvider(envFile), profile),
+        ),
+        Layer.succeed(AuthProviders, {}),
+        Layer.succeed(Stage, stage),
+        Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+        State.localState(),
+      );
+
+      yield* Effect.gen(function* () {
+        const stack = yield* stackEffect;
+
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State.State;
+          const filterSet = parseResourceFilter(filter);
+          const availableIds = [
+            ...new Set(Object.values(stack.resources).map((r) => r.LogicalId)),
+          ].sort();
+
+          if (filterSet) {
+            for (const id of filterSet) {
+              if (!availableIds.includes(id)) {
+                return yield* Effect.die(
+                  new Error(
+                    `Unknown resource '${id}' in --filter. Available: ${availableIds.join(", ") || "(none)"}`,
+                  ),
+                );
+              }
+            }
+          }
+
+          const fqns = Object.keys(stack.resources);
+          const tailable: {
+            logicalId: string;
+            stream: Stream.Stream<LogLine, any, any>;
+          }[] = [];
+
+          for (const fqn of fqns) {
+            const resource = stack.resources[fqn]!;
+            if (filterSet && !filterSet.has(resource.LogicalId)) continue;
+
+            const resourceState = yield* state.get({
+              stack: stack.name,
+              stage: stack.stage,
+              fqn,
+            });
+            if (!(resourceState as any)?.attr) continue;
+
+            const provider = yield* findProviderByType(resource.Type);
+            if (!provider.tail) continue;
+
+            tailable.push({
+              logicalId: resource.LogicalId,
+              stream: provider.tail({
+                id: resource.LogicalId,
+                instanceId: (resourceState as any).instanceId,
+                props: (resourceState as any).props,
+                output: (resourceState as any).attr,
+              }),
+            });
+          }
+
+          if (tailable.length === 0) {
+            if (filterSet) {
+              yield* Console.log(
+                "No tailable resources match --filter (deploy first, or selected resources may not support tail).",
+              );
+            } else {
+              yield* Console.log(
+                "No tailable resources found. Deploy first, then run tail.",
+              );
+            }
+            return;
+          }
+
+          yield* Console.log(
+            `Tailing: ${tailable.map((t) => t.logicalId).join(", ")}`,
+          );
+
+          const taggedStreams = tailable.map(({ logicalId, stream }, i) => {
+            const color = TAIL_COLORS[i % TAIL_COLORS.length]!;
+            return stream.pipe(
+              Stream.map(({ timestamp, message }) => {
+                const ts = formatLocalTimestamp(timestamp);
+                return `${color}${ts} [${logicalId}]${TAIL_RESET} ${message}`;
+              }),
+            );
+          });
+
+          yield* Stream.mergeAll(taggedStreams, {
+            concurrency: "unbounded",
+          }).pipe(Stream.runForEach((line) => Console.log(line)));
+        }).pipe(Effect.provide(stack.services));
+      }).pipe(Effect.provide(services));
+    }),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/exec.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/exec.ts
new file mode 100644
index 00000000000..fbc3b839376
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/exec.ts
@@ -0,0 +1,33 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+
+import { AlchemyContextLive } from "../AlchemyContext.ts";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
+import * as RpcProviderProxy from "../Local/RpcProviderProxy.ts";
+import { PlatformServices } from "../Util/PlatformServices.ts";
+import { execStack, ExecStackOptions } from "./commands/deploy.ts";
+import { selectCli } from "./selectCli.ts";
+
+const services = Layer.merge(selectCli(), RpcProviderProxy.fromEnv()).pipe(
+  Layer.provideMerge(
+    Layer.mergeAll(AlchemyContextLive, ProfileLive, CredentialsStoreLive),
+  ),
+  Layer.provideMerge(
+    Layer.mergeAll(
+      PlatformServices,
+      FetchHttpClient.layer,
+      ConfigProvider.layer(ConfigProvider.fromEnv()),
+    ),
+  ),
+);
+
+export const exec = () =>
+  execStack(
+    Schema.decodeSync(ExecStackOptions)(
+      JSON.parse(process.env.ALCHEMY_EXEC_OPTIONS!),
+    ),
+  ).pipe(Effect.provide(services), Effect.scoped);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/index.ts
new file mode 100644
index 00000000000..82143d52a19
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/index.ts
@@ -0,0 +1,2 @@
+export * from "./exec.ts";
+export * from "./main.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/main.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/main.ts
new file mode 100644
index 00000000000..4c52959faa4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/main.ts
@@ -0,0 +1,75 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Command from "effect/unstable/cli/Command";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+
+import { AlchemyContextLive } from "alchemy/AlchemyContext";
+import { CredentialsStoreLive } from "alchemy/Auth/Credentials";
+import { ProfileLive } from "alchemy/Auth/Profile";
+import { TelemetryLive } from "alchemy/Telemetry/Layer";
+import { PlatformServices } from "alchemy/Util/PlatformServices";
+import packageJson from "../../package.json" with { type: "json" };
+
+import { checkLatestVersion } from "./checkVersion.ts";
+import { handleCancellation } from "./commands/_shared.ts";
+import { awsCommand } from "./commands/aws.ts";
+import { cloudflareCommand } from "./commands/cloudflare.ts";
+import {
+  deployCommand,
+  destroyCommand,
+  planCommand,
+} from "./commands/deploy.ts";
+import { devCommand } from "./commands/dev.ts";
+import { loginCommand } from "./commands/login.ts";
+import { logsCommand } from "./commands/logs.ts";
+import { profileCommand } from "./commands/profile.ts";
+import { stateCommand } from "./commands/state.ts";
+import { tailCommand } from "./commands/tail.ts";
+import { selectCli } from "./selectCli.ts";
+
+const root = Command.make("alchemy", {}).pipe(
+  Command.withSubcommands([
+    awsCommand,
+    cloudflareCommand,
+    deployCommand,
+    devCommand,
+    destroyCommand,
+    planCommand,
+    tailCommand,
+    logsCommand,
+    loginCommand,
+    profileCommand,
+    stateCommand,
+  ]),
+);
+
+const cli = Command.run(root, {
+  // name: "Alchemy Effect CLI",
+  version: packageJson.version,
+});
+
+const services = Layer.mergeAll(
+  Layer.provideMerge(AlchemyContextLive, PlatformServices),
+  Layer.provide(ProfileLive, PlatformServices),
+  Layer.provide(CredentialsStoreLive, PlatformServices),
+  FetchHttpClient.layer,
+  ConfigProvider.layer(ConfigProvider.fromEnv()),
+  TelemetryLive,
+  selectCli(),
+);
+
+const program = Effect.gen(function* () {
+  // Best-effort, non-blocking check for a newer published version. If the
+  // CLI command finishes before the registry responds, the fiber is
+  // interrupted on scope close — that's intentional.
+  yield* checkLatestVersion.pipe(Effect.forkScoped);
+  return yield* cli;
+});
+
+export const main = program.pipe(
+  // $USER and $STAGE are set by the environment
+  Effect.provide(services),
+  Effect.scoped,
+  handleCancellation,
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/selectCli.ts b/.repos/alchemy-effect/packages/alchemy/src/Cli/selectCli.ts
new file mode 100644
index 00000000000..ca3cd5ad5ee
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/selectCli.ts
@@ -0,0 +1,33 @@
+import * as Layer from "effect/Layer";
+import type { Cli } from "./Cli.ts";
+import { LoggingCli } from "./LoggingCli.ts";
+import { inkCLI } from "./tui/InkCLI.tsx";
+
+/**
+ * Returns true when the current process looks like it's being driven by a
+ * coding agent, CI runner, or anything else that won't render an interactive
+ * TUI well. The Ink renderer repaints the screen on every event, which floods
+ * agent transcripts with redundant frames; LoggingCli emits one line per
+ * status change instead.
+ */
+export const isNonInteractive = (): boolean => {
+  const env = process.env;
+  if (env.ALCHEMY_PLAIN === "1" || env.ALCHEMY_NO_TUI === "1") return true;
+  if (env.ALCHEMY_TUI === "1") return false;
+  if (!process.stdout.isTTY) return true;
+  if (env.CI) return true;
+  // Known coding-agent env vars. These are best-effort — the isTTY check
+  // above already catches most cases since agents typically pipe stdout.
+  if (
+    env.CLAUDECODE ||
+    env.CLAUDE_CODE_ENTRYPOINT ||
+    env.CURSOR_AGENT ||
+    env.AIDER_MODEL ||
+    env.CODEX_CLI
+  )
+    return true;
+  return false;
+};
+
+export const selectCli = (): Layer.Layer<Cli> =>
+  isNonInteractive() ? LoggingCli : inkCLI();
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/InkCLI.tsx b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/InkCLI.tsx
new file mode 100644
index 00000000000..803b6ba3c9a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/InkCLI.tsx
@@ -0,0 +1,60 @@
+/** @jsxImportSource react */
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { render } from "ink";
+import type { Plan } from "../../Plan.ts";
+import { type PlanStatusSession, Cli } from "../Cli.ts";
+import type { ApplyEvent } from "../Event.ts";
+import { ApprovePlan } from "./components/ApprovePlan.tsx";
+import { Plan as PlanComponent } from "./components/Plan.tsx";
+import { PlanProgress } from "./components/PlanProgress.tsx";
+
+export const inkCLI = () =>
+  Layer.succeed(
+    Cli,
+    Cli.of({
+      approvePlan,
+      displayPlan,
+      startApplySession,
+    }),
+  );
+
+const approvePlan = Effect.fn(function* <P extends Plan>(plan: P) {
+  let approved = false;
+  const { waitUntilExit } = render(
+    <ApprovePlan plan={plan} approve={(a) => (approved = a)} />,
+  );
+  yield* Effect.promise(waitUntilExit);
+  return approved;
+});
+
+const displayPlan = <P extends Plan>(plan: P): Effect.Effect<void> =>
+  Effect.sync(() => {
+    const { unmount } = render(<PlanComponent plan={plan} />);
+    unmount();
+  });
+
+const startApplySession = Effect.fn(function* <P extends Plan>(plan: P) {
+  const listeners = new Set<(event: ApplyEvent) => void>();
+  const { unmount } = render(
+    <PlanProgress
+      plan={plan}
+      source={{
+        subscribe(listener) {
+          listeners.add(listener);
+          return () => listeners.delete(listener);
+        },
+      }}
+    />,
+  );
+  return {
+    done: Effect.fn(function* () {
+      yield* Effect.sleep(10); // give the react event loop time to re-render
+      yield* Effect.sync(() => unmount());
+    }),
+    emit: (event) =>
+      Effect.sync(() => {
+        for (const listener of listeners) listener(event);
+      }),
+  } satisfies PlanStatusSession;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/ApprovePlan.tsx b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/ApprovePlan.tsx
new file mode 100644
index 00000000000..0cdfbf5f570
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/ApprovePlan.tsx
@@ -0,0 +1,44 @@
+/** @jsxImportSource react */
+import { useState, type JSX } from "react";
+
+import { Box, Text, useApp, useInput } from "ink";
+import type { Plan as AlchemyPlan } from "../../../Plan.ts";
+
+import { Plan } from "./Plan.tsx";
+
+export interface ApprovePlanProps {
+  plan: AlchemyPlan;
+  approve: (result: boolean) => void;
+}
+
+export function ApprovePlan(props: ApprovePlanProps): JSX.Element {
+  const { plan, approve } = props;
+  const [selected, setSelected] = useState(0);
+  const { exit } = useApp();
+
+  useInput((_input, key) => {
+    if (key.leftArrow || key.rightArrow) {
+      setSelected((prev) => (prev === 0 ? 1 : 0));
+    } else if (key.return) {
+      approve(selected === 0);
+      exit();
+    }
+  });
+
+  return (
+    <Box flexDirection="column">
+      <Plan plan={plan} />
+      <Box marginTop={1}>
+        <Text>Proceed?</Text>
+      </Box>
+      <Box gap={1}>
+        <Text color={selected === 0 ? "green" : "gray"}>
+          {selected === 0 ? "◉" : "○"} Yes
+        </Text>
+        <Text color={selected === 1 ? "red" : "gray"}>
+          {selected === 1 ? "◉" : "○"} No
+        </Text>
+      </Box>
+    </Box>
+  );
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/Plan.tsx b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/Plan.tsx
new file mode 100644
index 00000000000..ebe178a0fe3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/Plan.tsx
@@ -0,0 +1,200 @@
+/** @jsxImportSource react */
+import { useMemo, type JSX } from "react";
+
+import { Box, Text } from "ink";
+import type {
+  Plan as AlchemyPlan,
+  BindingAction,
+  CRUD,
+  ActionApply,
+  ActionDelete,
+} from "../../../Plan.ts";
+import {
+  buildNamespaceTree,
+  flattenTree,
+  type DerivedAction,
+  type ActionVerb,
+} from "../../NamespaceTree.ts";
+
+export interface PlanProps {
+  plan: AlchemyPlan;
+}
+export function Plan({ plan }: PlanProps): JSX.Element {
+  const items = useMemo(
+    () =>
+      [
+        ...Object.values(plan.resources),
+        ...Object.values(plan.deletions),
+      ] as CRUD[],
+    [plan],
+  );
+  const taskItems = useMemo(
+    () =>
+      [
+        ...Object.values(plan.actions ?? {}),
+        ...Object.values(plan.actionDeletions ?? {}),
+      ].filter((t): t is ActionApply | ActionDelete => t !== undefined),
+    [plan],
+  );
+
+  const flatItems = useMemo(() => {
+    const tree = buildNamespaceTree(items, taskItems);
+    return flattenTree(tree);
+  }, [items, taskItems]);
+
+  if (items.length === 0 && taskItems.length === 0) {
+    return <Text color="gray">No changes planned</Text>;
+  }
+
+  const counts = items.reduce((acc, item) => (acc[item.action]++, acc), {
+    create: 0,
+    update: 0,
+    delete: 0,
+    noop: 0,
+    replace: 0,
+  });
+  const taskCounts = taskItems.reduce(
+    (acc, item) => (acc[item.action]++, acc),
+    { run: 0, noop: 0, delete: 0 },
+  );
+
+  const actions = (["create", "update", "delete", "replace"] as const).filter(
+    (action) => counts[action] > 0,
+  );
+  const taskHeaderEntries = [
+    taskCounts.run > 0 ? `${taskCounts.run} to run` : undefined,
+    taskCounts.delete > 0 ? `${taskCounts.delete} to drop` : undefined,
+  ].filter((s): s is string => !!s);
+
+  return (
+    <Box flexDirection="column">
+      <Box marginTop={1}>
+        <Text underline>Plan</Text>
+        <Text>: </Text>
+        {[
+          ...actions.map((action) => {
+            const count = counts[action];
+            const color = actionColor(action);
+            return (
+              <Box key={action}>
+                <Text color={color}>
+                  {count} to {action}
+                </Text>
+              </Box>
+            );
+          }),
+          ...taskHeaderEntries.map((label, i) => (
+            <Box key={`task-${i}`}>
+              <Text color="cyan">{label}</Text>
+            </Box>
+          )),
+        ].flatMap((box, i, arr) =>
+          i === arr.length - 1
+            ? [box]
+            : [box, <Text key={`sep-${i}`}> | </Text>],
+        )}
+      </Box>
+      <Box flexDirection="column" marginTop={1}>
+        {flatItems.map((item) => {
+          const indent = "  ".repeat(item.depth);
+          const color = getActionColor(item.action);
+          const icon = getActionIcon(item.action);
+          const key = item.path.join("/");
+
+          if (item.type === "namespace") {
+            return (
+              <Box key={key} flexDirection="row">
+                <Text>{indent}</Text>
+                <Box width={2}>
+                  <Text color={color}>{icon} </Text>
+                </Box>
+                <Text color="blueBright">{item.id}</Text>
+              </Box>
+            );
+          }
+
+          if (item.type === "binding") {
+            return (
+              <Box key={key} flexDirection="row">
+                <Text>{indent}</Text>
+                <Box width={2}>
+                  <Text color={color}>{icon} </Text>
+                </Box>
+                <Text color="cyan">{item.bindingSid}</Text>
+              </Box>
+            );
+          }
+
+          if (item.type === "action") {
+            return (
+              <Box key={key} flexDirection="row">
+                <Text>{indent}</Text>
+                <Box width={2}>
+                  <Text color={color}>{icon} </Text>
+                </Box>
+                <Box>
+                  <Text bold>{item.id}</Text>
+                </Box>
+                <Box marginLeft={1}>
+                  <Text color="blackBright">({item.actionType})</Text>
+                </Box>
+                <Box marginLeft={1}>
+                  <Text color="cyan">[action]</Text>
+                </Box>
+              </Box>
+            );
+          }
+
+          // Resource item
+          return (
+            <Box key={key} flexDirection="row">
+              <Text>{indent}</Text>
+              <Box width={2}>
+                <Text color={color}>{icon} </Text>
+              </Box>
+              <Box>
+                <Text bold>{item.id}</Text>
+              </Box>
+              <Box marginLeft={1}>
+                <Text color="blackBright">({item.resourceType})</Text>
+              </Box>
+              {item.bindingCount !== undefined && item.bindingCount > 0 && (
+                <Box marginLeft={1}>
+                  <Text color="cyan">({item.bindingCount} bindings)</Text>
+                </Box>
+              )}
+            </Box>
+          );
+        })}
+      </Box>
+    </Box>
+  );
+}
+
+type Color = Parameters<typeof Text>[0]["color"];
+
+type AnyAction = CRUD["action"] | BindingAction | DerivedAction | ActionVerb;
+
+const getActionColor = (action: AnyAction): Color =>
+  ({
+    noop: "gray",
+    create: "green",
+    update: "yellow",
+    delete: "red",
+    replace: "magenta",
+    mixed: "cyan",
+    run: "cyan",
+  })[action] ?? "gray";
+
+const getActionIcon = (action: AnyAction): string =>
+  ({
+    create: "+",
+    update: "~",
+    delete: "-",
+    noop: "•",
+    replace: "!",
+    mixed: "*",
+    run: "λ",
+  })[action] ?? "?";
+
+const actionColor = (action: CRUD["action"]): Color => getActionColor(action);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/PlanProgress.tsx b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/PlanProgress.tsx
new file mode 100644
index 00000000000..de500168ed7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cli/tui/components/PlanProgress.tsx
@@ -0,0 +1,439 @@
+/** @jsxImportSource react */
+import { useEffect, useMemo, useRef, useState, type JSX } from "react";
+
+import { Box, Text } from "ink";
+import type { CRUD, Plan, ActionApply, ActionDelete } from "../../../Plan.ts";
+
+import type {
+  ApplyEvent,
+  ApplyStatus,
+  StatusChangeEvent,
+} from "../../Event.ts";
+import {
+  buildNamespaceTree,
+  flattenTree,
+  type FlattenedItem,
+  type ActionVerb,
+} from "../../NamespaceTree.ts";
+
+interface ProgressEventSource {
+  subscribe(listener: (event: ApplyEvent) => void): () => void;
+}
+
+interface PlanTask extends Required<
+  Pick<StatusChangeEvent, "id" | "type" | "status">
+> {
+  key: string;
+  message?: string;
+  updatedAt: number;
+}
+
+interface PlanProgressProps {
+  source: ProgressEventSource;
+  plan: Plan;
+}
+
+type PlanItem = CRUD | NonNullable<Plan["deletions"][string]>;
+
+export type ProgressRow =
+  | {
+      key: string;
+      type: "namespace";
+      id: string;
+      depth: number;
+      action: FlattenedItem["action"];
+    }
+  | {
+      key: string;
+      type: "resource";
+      id: string;
+      depth: number;
+      resourceType: string;
+      action: CRUD["action"];
+      /** For `noop` resources, persisted state status to show instead of `pending`. */
+      persistedApplyStatus?: "created" | "updated";
+    }
+  | {
+      key: string;
+      type: "task";
+      id: string;
+      depth: number;
+      actionType: string;
+      action: ActionVerb;
+    };
+
+const getTaskKey = (item: FlattenedItem) => item.path.join("/");
+
+type ResourceProgressRow = Extract<ProgressRow, { type: "resource" }>;
+
+export const buildProgressRows = (plan: Plan): ProgressRow[] => {
+  const items = [
+    ...Object.values(plan.resources),
+    ...Object.values(plan.deletions).filter(
+      (item): item is NonNullable<Plan["deletions"][string]> =>
+        item !== undefined,
+    ),
+  ] as PlanItem[];
+  const taskItems = [
+    ...Object.values(plan.actions ?? {}),
+    ...Object.values(plan.actionDeletions ?? {}),
+  ].filter((t): t is ActionApply | ActionDelete => t !== undefined);
+  const tree = buildNamespaceTree(items, taskItems);
+  return flattenTree(tree)
+    .filter((item) => item.type !== "binding")
+    .map((item) => {
+      if (item.type === "namespace") {
+        return {
+          key: getTaskKey(item),
+          type: "namespace" as const,
+          id: item.id,
+          depth: item.depth,
+          action: item.action,
+        };
+      }
+      if (item.type === "action") {
+        return {
+          key: getTaskKey(item),
+          type: "task" as const,
+          id: item.id,
+          depth: item.depth,
+          actionType: item.actionType ?? "unknown",
+          action: item.action as ActionVerb,
+        };
+      }
+      return {
+        key: getTaskKey(item),
+        type: "resource" as const,
+        id: item.id,
+        depth: item.depth,
+        resourceType: item.resourceType ?? "unknown",
+        action: item.action as CRUD["action"],
+        persistedApplyStatus:
+          item.action === "noop"
+            ? (() => {
+                const crud = findCrudByLogicalId(plan, item.id);
+                return crud?.action === "noop" ? crud.state.status : undefined;
+              })()
+            : undefined,
+      };
+    });
+};
+
+const buildLogicalIdIndex = (rows: ProgressRow[]) => {
+  const index = new Map<string, string[]>();
+  for (const row of rows) {
+    if (row.type !== "resource" && row.type !== "task") continue;
+    const keys = index.get(row.id);
+    if (keys) {
+      keys.push(row.key);
+    } else {
+      index.set(row.id, [row.key]);
+    }
+  }
+  return index;
+};
+
+export function toPlanTask(id: string, planItem: PlanItem): PlanTask;
+export function toPlanTask(row: ResourceProgressRow): PlanTask;
+export function toPlanTask(
+  rowOrId: ResourceProgressRow | string,
+  planItem?: PlanItem,
+): PlanTask {
+  if (typeof rowOrId === "string") {
+    return {
+      key: rowOrId,
+      id: rowOrId,
+      type: planItem!.resource.Type,
+      status: planItem!.action === "noop" ? planItem!.state.status : "pending",
+      updatedAt: Date.now(),
+    };
+  }
+
+  return {
+    key: rowOrId.key,
+    id: rowOrId.id,
+    type: rowOrId.resourceType,
+    status:
+      rowOrId.action === "noop"
+        ? (rowOrId.persistedApplyStatus ?? "created")
+        : "pending",
+    updatedAt: Date.now(),
+  };
+}
+
+const buildInitialTasks = (rows: ProgressRow[]) =>
+  new Map(
+    rows.flatMap((row) =>
+      row.type === "resource"
+        ? [[row.key, toPlanTask(row)]]
+        : row.type === "task"
+          ? [
+              [
+                row.key,
+                {
+                  key: row.key,
+                  id: row.id,
+                  type: row.actionType,
+                  // `noop` tasks are skipped — render as gray `•` from the start
+                  // rather than briefly flashing the `ran` cyan styling.
+                  status:
+                    row.action === "noop"
+                      ? ("skipped" as ApplyStatus)
+                      : ("pending" as ApplyStatus),
+                  updatedAt: Date.now(),
+                },
+              ],
+            ]
+          : [],
+    ),
+  );
+
+export function PlanProgress(props: PlanProgressProps): JSX.Element {
+  const { source, plan } = props;
+  const spinner = useGlobalSpinner();
+  const rows = useMemo(() => buildProgressRows(plan), [plan]);
+  const logicalIdIndex = useMemo(() => buildLogicalIdIndex(rows), [rows]);
+  const [tasks, setTasks] = useState<Map<string, PlanTask>>(() =>
+    buildInitialTasks(rows),
+  );
+
+  const unsubscribeRef = useRef<null | (() => void)>(null);
+
+  useEffect(() => {
+    unsubscribeRef.current?.();
+    unsubscribeRef.current = source.subscribe((event) => {
+      setTasks((prev) => {
+        const next = new Map(prev);
+        const keys = logicalIdIndex.get(event.id) ?? [];
+
+        if (event.kind === "status-change") {
+          if (!event.bindingId) {
+            for (const key of keys) {
+              const current = next.get(key);
+              next.set(key, {
+                key,
+                id: event.id,
+                type: event.type,
+                status: event.status,
+                message: event.message ?? current?.message,
+                updatedAt: Date.now(),
+              });
+            }
+          }
+        } else {
+          for (const key of keys) {
+            const current = next.get(key);
+            if (!current) continue;
+            next.set(key, {
+              ...current,
+              message: event.message,
+              updatedAt: Date.now(),
+            });
+          }
+        }
+
+        return next;
+      });
+    });
+    return () => {
+      unsubscribeRef.current?.();
+      unsubscribeRef.current = null;
+    };
+  }, [logicalIdIndex, source]);
+
+  useEffect(() => {
+    setTasks(buildInitialTasks(rows));
+  }, [rows]);
+
+  return (
+    <Box flexDirection="column">
+      {rows.map((row) => {
+        const indent = "  ".repeat(row.depth);
+
+        if (row.type === "namespace") {
+          return (
+            <Box key={row.key} flexDirection="row">
+              <Text>{indent}</Text>
+              <Box width={2}>
+                <Text color="blueBright">↳ </Text>
+              </Box>
+              <Text color="blueBright">{row.id}</Text>
+            </Box>
+          );
+        }
+
+        if (row.type === "task") {
+          const t = tasks.get(row.key);
+          const status: ApplyStatus =
+            t?.status ?? (row.action === "noop" ? "ran" : "pending");
+          const color = statusColor(status);
+          const icon = taskIcon(row.action, status, spinner);
+          const label =
+            row.action === "delete"
+              ? status === "deleted"
+                ? "deleted"
+                : "drop"
+              : status === "ran"
+                ? row.action === "noop"
+                  ? "skip"
+                  : "ran"
+                : status === "running"
+                  ? "running"
+                  : status === "fail"
+                    ? "fail"
+                    : row.action === "noop"
+                      ? "skip"
+                      : "run";
+
+          return (
+            <Box key={row.key} flexDirection="column">
+              <Box flexDirection="row">
+                <Text>{indent}</Text>
+                <Box width={2}>
+                  <Text color={color}>{icon} </Text>
+                </Box>
+                <Text bold>{row.id}</Text>
+                <Text dimColor> ({row.actionType})</Text>
+                <Text color={color}> {label}</Text>
+                <Text color="cyan" dimColor>
+                  {" "}
+                  [action]
+                </Text>
+              </Box>
+              {t?.message ? (
+                <Box paddingLeft={row.depth * 2 + 2}>
+                  <Text dimColor>• {t.message}</Text>
+                </Box>
+              ) : null}
+            </Box>
+          );
+        }
+
+        const task = tasks.get(row.key) ?? toPlanTask(row);
+        const displayStatus = getDisplayStatus(row, task.status);
+        const color = statusColor(displayStatus);
+        const icon = statusIcon(task.status, spinner);
+
+        return (
+          <Box key={row.key} flexDirection="column">
+            <Box flexDirection="row">
+              <Text>{indent}</Text>
+              <Box width={2}>
+                <Text color={color}>{icon} </Text>
+              </Box>
+              <Text bold>{task.id}</Text>
+              <Text dimColor> ({task.type})</Text>
+              <Text color={color}> {displayStatus}</Text>
+            </Box>
+            {task.message ? (
+              <Box paddingLeft={row.depth * 2 + 2}>
+                <Text dimColor>• {task.message}</Text>
+              </Box>
+            ) : null}
+          </Box>
+        );
+      })}
+    </Box>
+  );
+}
+
+function getDisplayStatus(
+  row: ResourceProgressRow,
+  status: ApplyStatus,
+): ApplyStatus | "no change" {
+  if (row.action === "noop" && (status === "created" || status === "updated")) {
+    return "no change";
+  }
+
+  return status;
+}
+
+function statusColor(
+  status: ApplyStatus | "no change",
+): Parameters<typeof Text>[0]["color"] {
+  switch (status) {
+    case "no change":
+      return "gray";
+    case "pending":
+      return "gray";
+    case "creating":
+    case "created":
+      return "green";
+    case "updating":
+    case "updated":
+      return "yellow";
+    case "deleting":
+    case "deleted":
+      return "red";
+    case "running":
+    case "ran":
+      return "cyan";
+    case "skipped":
+      return "gray";
+    case "fail":
+      return "redBright";
+    default:
+      return undefined;
+  }
+}
+
+function taskIcon(
+  action: ActionVerb,
+  status: ApplyStatus,
+  spinnerChar: string,
+): string {
+  if (status === "running") return spinnerChar;
+  if (status === "fail") return "✗";
+  if (status === "skipped") return "•";
+  if (status === "ran") return action === "noop" ? "•" : "✓";
+  if (status === "deleted") return "✓";
+  if (action === "delete") return "-";
+  if (action === "noop") return "•";
+  return "λ";
+}
+
+function statusIcon(status: ApplyStatus, spinnerChar: string): string {
+  if (isInProgress(status)) return spinnerChar;
+  if (status === "fail") return "✗";
+  return "✓"; // created/updated/deleted/replaced/etc.
+}
+
+function isInProgress(status: ApplyStatus): boolean {
+  return (
+    status === "pending" ||
+    status === "creating" ||
+    status === "updating" ||
+    status === "deleting" ||
+    status === "running"
+  );
+}
+
+const spinnerFrames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+
+function useGlobalSpinner(intervalMs = 80): string {
+  const [index, setIndex] = useState(0);
+  useEffect(() => {
+    const timer = setInterval(() => {
+      setIndex((i) => (i + 1) % spinnerFrames.length);
+    }, intervalMs);
+    return () => clearInterval(timer);
+  }, [intervalMs]);
+  return spinnerFrames[index];
+}
+
+const findCrudByLogicalId = (
+  plan: Plan,
+  logicalId: string,
+): CRUD | undefined => {
+  for (const node of Object.values(plan.resources)) {
+    if (node.resource.LogicalId === logicalId) {
+      return node;
+    }
+  }
+  for (const node of Object.values(plan.deletions)) {
+    if (node?.resource.LogicalId === logicalId) {
+      return node;
+    }
+  }
+  return undefined;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Access.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Access.ts
new file mode 100644
index 00000000000..26d8e3b0537
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Access.ts
@@ -0,0 +1,110 @@
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+import { cachedFunction } from "../Util/cached-function.ts";
+
+export class AccessError extends Schema.TaggedErrorClass<AccessError>()(
+  "AccessError",
+  {
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect),
+  },
+) {}
+
+export class Access extends Context.Service<
+  Access,
+  {
+    readonly getAccessHeaders: (
+      domain: string,
+    ) => Effect.Effect<Record<string, string>, AccessError>;
+  }
+>()("alchemy/Cloudflare/Access") {}
+
+export const AccessLive = Layer.effect(
+  Access,
+  Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const domainUsesAccess = yield* cachedFunction((domain: string) =>
+      Effect.promise((signal) =>
+        fetch(`https://${domain}`, { redirect: "manual", signal }),
+      ).pipe(
+        Effect.map(
+          (response) =>
+            response.status === 302 &&
+            (response.headers
+              .get("location")
+              ?.includes("cloudflareaccess.com") ??
+              false),
+        ),
+        Effect.timeout(1000),
+        Effect.catch(() => Effect.succeed(false)),
+      ),
+    );
+    const login = (domain: string) =>
+      ChildProcess.make("cloudflared", ["access", "login", domain]).pipe(
+        spawner.spawn,
+        Effect.flatMap((process) => Stream.runCollect(process.stdout)),
+        Effect.mapError(
+          (error) =>
+            new AccessError({
+              message:
+                `The domain "${domain}" uses Cloudflare Access, but \`cloudflared\` is not installed. ` +
+                `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation.`,
+              cause: error,
+            }),
+        ),
+        Effect.flatMap((stdout) => {
+          const matches = stdout
+            .toString()
+            .match(/fetched your token:\n\n(.*)/m);
+          return matches && matches.length >= 2
+            ? Effect.succeed({ Cookie: `CF_Authorization=${matches[1]}` })
+            : Effect.fail(
+                new AccessError({
+                  message: "Failed to authenticate with Cloudflare Access",
+                }),
+              );
+        }),
+        Effect.scoped,
+      );
+
+    const getEnv = (name: string) =>
+      Config.string(name)
+
+        .pipe(Effect.catchTag("ConfigError", () => Effect.succeed(undefined)));
+
+    return Access.of({
+      getAccessHeaders: Effect.fn(function* (domain) {
+        if (!(yield* domainUsesAccess(domain))) {
+          return {};
+        }
+        const clientId = yield* getEnv("CLOUDFLARE_ACCESS_CLIENT_ID");
+        const clientSecret = yield* getEnv("CLOUDFLARE_ACCESS_CLIENT_SECRET");
+        if (clientId && clientSecret) {
+          return {
+            "CF-Access-Client-Id": clientId,
+            "CF-Access-Client-Secret": clientSecret,
+          } as Record<string, string>;
+        }
+
+        if (clientId !== undefined || clientSecret !== undefined) {
+          yield* Effect.logWarning(
+            "Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. " +
+              `Only ${
+                clientId !== undefined
+                  ? "CLOUDFLARE_ACCESS_CLIENT_ID"
+                  : "CLOUDFLARE_ACCESS_CLIENT_SECRET"
+              } was found.`,
+          );
+        }
+
+        return yield* login(domain);
+      }),
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/AiGateway.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/AiGateway.ts
new file mode 100644
index 00000000000..3470a495943
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/AiGateway.ts
@@ -0,0 +1,612 @@
+import * as aiGateway from "@distilled.cloud/cloudflare/ai-gateway";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { AiGatewayBinding } from "./AiGatewayBinding.ts";
+
+export type AiGatewayRateLimitingTechnique = "fixed" | "sliding";
+
+export type AiGatewayLogManagementStrategy = "STOP_INSERTING" | "DELETE_OLDEST";
+
+export type AiGatewayDlp =
+  | {
+      /**
+       * Action to take when a DLP profile matches.
+       */
+      action: "BLOCK" | "FLAG";
+      /**
+       * Whether DLP is enabled.
+       */
+      enabled: boolean;
+      /**
+       * DLP profile identifiers to apply.
+       */
+      profiles: string[];
+    }
+  | {
+      /**
+       * Whether DLP is enabled.
+       */
+      enabled: boolean;
+      /**
+       * DLP policies to apply.
+       */
+      policies: {
+        /**
+         * DLP policy identifier.
+         */
+        id: string;
+        /**
+         * Action to take when the policy matches.
+         */
+        action: "FLAG" | "BLOCK";
+        /**
+         * Request or response phases checked by the policy.
+         */
+        check: ("REQUEST" | "RESPONSE")[];
+        /**
+         * Whether the policy is enabled.
+         */
+        enabled: boolean;
+        /**
+         * DLP profile identifiers to apply.
+         */
+        profiles: string[];
+      }[];
+    };
+
+export type AiGatewayOtel = {
+  /**
+   * Authorization header value for the OpenTelemetry endpoint.
+   */
+  authorization: string;
+  /**
+   * Additional headers sent to the OpenTelemetry endpoint.
+   */
+  headers: Record<string, unknown>;
+  /**
+   * OpenTelemetry endpoint URL.
+   */
+  url: string;
+};
+
+export type AiGatewayStripe = {
+  /**
+   * Authorization header value for Stripe usage events.
+   */
+  authorization: string;
+  /**
+   * Stripe usage event payload definitions.
+   */
+  usageEvents: {
+    /**
+     * Usage event payload.
+     */
+    payload: string;
+  }[];
+};
+
+export type AiGatewayProps = {
+  /**
+   * Gateway identifier. If omitted, a unique ID will be generated.
+   *
+   * Must be 1-64 characters and match Cloudflare's AI Gateway ID pattern:
+   * lowercase letters, numbers, underscores, and hyphens.
+   *
+   * @default ${app}-${stage}-${id}
+   */
+  id?: string;
+  /**
+   * Whether cached responses are invalidated when a request changes.
+   *
+   * @default false
+   */
+  cacheInvalidateOnUpdate?: boolean;
+  /**
+   * Cache time-to-live in seconds. Set to `null` to disable caching.
+   *
+   * @default null
+   */
+  cacheTtl?: number | null;
+  /**
+   * Whether AI Gateway stores request logs.
+   *
+   * @default true
+   */
+  collectLogs?: boolean;
+  /**
+   * Rate limiting interval in seconds. Set to `null` to disable rate limiting.
+   *
+   * @default null
+   */
+  rateLimitingInterval?: number | null;
+  /**
+   * Maximum requests allowed during the rate limiting interval. Set to `null`
+   * to disable rate limiting.
+   *
+   * @default null
+   */
+  rateLimitingLimit?: number | null;
+  /**
+   * Rate limiting algorithm.
+   *
+   * @default "fixed"
+   */
+  rateLimitingTechnique?: AiGatewayRateLimitingTechnique;
+  /**
+   * Whether gateway authentication is enabled.
+   */
+  authentication?: boolean;
+  /**
+   * DLP configuration. The installed distilled Cloudflare client applies this
+   * through the update API after gateway creation.
+   */
+  dlp?: AiGatewayDlp;
+  /**
+   * Whether this gateway is the account default.
+   */
+  isDefault?: boolean;
+  /**
+   * Maximum number of log entries to retain.
+   */
+  logManagement?: number | null;
+  /**
+   * Strategy used when retained logs reach `logManagement`.
+   */
+  logManagementStrategy?: AiGatewayLogManagementStrategy | null;
+  /**
+   * Whether Logpush is enabled for this gateway.
+   */
+  logpush?: boolean;
+  /**
+   * Public key used for Logpush encryption.
+   */
+  logpushPublicKey?: string | null;
+  /**
+   * OpenTelemetry export configuration.
+   */
+  otel?: AiGatewayOtel[] | null;
+  /**
+   * Store identifier used by the gateway.
+   */
+  storeId?: string | null;
+  /**
+   * Stripe usage export configuration.
+   */
+  stripe?: AiGatewayStripe | null;
+  /**
+   * Whether Zero Data Retention is enabled.
+   */
+  zdr?: boolean;
+};
+
+export type AiGateway = Resource<
+  "Cloudflare.AiGateway",
+  AiGatewayProps,
+  {
+    gatewayId: string;
+    accountId: string;
+    cacheInvalidateOnUpdate: boolean;
+    cacheTtl: number | null;
+    collectLogs: boolean;
+    createdAt: string;
+    modifiedAt: string;
+    rateLimitingInterval: number | null;
+    rateLimitingLimit: number | null;
+    rateLimitingTechnique: AiGatewayRateLimitingTechnique;
+    authentication: boolean;
+    dlp: AiGatewayDlp | undefined;
+    isDefault: boolean;
+    logManagement: number;
+    logManagementStrategy: AiGatewayLogManagementStrategy;
+    logpush: boolean;
+    logpushPublicKey: string | undefined;
+    otel: AiGatewayOtel[] | undefined;
+    storeId: string;
+    stripe: AiGatewayStripe | undefined;
+    zdr: boolean;
+  },
+  never,
+  Providers
+>;
+
+// Cloudflare's AI Gateway API uses 0 to mean "disabled" for cache TTL and
+// rate limiting fields. Normalize back to null so user-facing semantics
+// match what was passed in.
+const nullIfZero = (value: number | null | undefined): number | null =>
+  value == null || value === 0 ? null : value;
+
+export const isAiGateway = (value: unknown): value is AiGateway =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  (value as AiGateway).Type === "Cloudflare.AiGateway";
+
+/**
+ * A Cloudflare AI Gateway for observability, caching, rate limiting, and
+ * governance across AI provider requests.
+ *
+ * AI Gateway gives your application a stable gateway ID and account-scoped
+ * endpoint that can route model requests through Cloudflare. Once bound to a
+ * Worker, `aiGateway.model({...})` returns an `effect/unstable/ai`
+ * `LanguageModel` Layer so you use the standard `generateText` / `streamText`
+ * APIs — provider-agnostic, with caching, rate limiting, retries, and a
+ * unified request log handled by the gateway.
+ *
+ * @section Creating a Gateway
+ * @example Basic gateway
+ * ```typescript
+ * const gateway = yield* Cloudflare.AiGateway("Gateway");
+ * ```
+ *
+ * @example Gateway with caching and rate limiting
+ * ```typescript
+ * const gateway = yield* Cloudflare.AiGateway("Gateway", {
+ *   id: "my-gateway",
+ *   cacheTtl: 300,
+ *   cacheInvalidateOnUpdate: true,
+ *   rateLimitingInterval: 60,
+ *   rateLimitingLimit: 100,
+ *   rateLimitingTechnique: "sliding",
+ * });
+ * ```
+ *
+ * @section Logging
+ * @example Gateway with log retention
+ * ```typescript
+ * const gateway = yield* Cloudflare.AiGateway("Gateway", {
+ *   collectLogs: true,
+ *   logManagement: 10000,
+ *   logManagementStrategy: "STOP_INSERTING",
+ * });
+ * ```
+ *
+ * @section Binding into a Worker
+ * @example Bind the gateway and provide the runtime layer
+ * `AiGateway.bind(gateway)` returns a typed, Effect-native client during the
+ * Worker's Init phase. Provide `Cloudflare.AiGatewayBindingLive` once at the
+ * bottom of the Init layer chain so every `bind(...)` resolves at runtime.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import { Gateway } from "./AiGateway.ts";
+ *
+ * export default class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.path },
+ *   Effect.gen(function* () {
+ *     const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         // …routes
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.AiGatewayBindingLive)),
+ * ) {}
+ * ```
+ *
+ * @section Building a LanguageModel
+ * @example `aiGateway.model(...)` -> Effect AI `LanguageModel`
+ * Call `aiGateway.model({...})` with a Workers AI model id. It returns a
+ * `Layer<LanguageModel, never, RuntimeContext>` directly — no API key and no
+ * `Layer.unwrap`, since the binding handles auth and the gateway URL. Build it
+ * in the Init phase; construction is pure.
+ * ```typescript
+ * const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+ *
+ * const languageModel = aiGateway.model({
+ *   client: aiGateway,
+ *   model: "@cf/meta/llama-3.1-8b-instruct",
+ *   parameters: { temperature: 0.7, maxTokens: 1024 },
+ * });
+ * ```
+ *
+ * @section Generating Text
+ * @example Generate text on a route
+ * Provide the `languageModel` layer to the handler and call
+ * `LanguageModel.generateText` like any other Effect. `Effect.orDie` collapses
+ * `AiError` to a defect (a 500); use `Effect.catchTag("AiError", …)` for typed
+ * handling instead.
+ * ```typescript
+ * import { LanguageModel } from "effect/unstable/ai";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * fetch: Effect.gen(function* () {
+ *   const response = yield* LanguageModel.generateText({
+ *     prompt: "Say hello.",
+ *   }).pipe(Effect.orDie);
+ *   return yield* HttpServerResponse.json({
+ *     text: response.text,
+ *     usage: {
+ *       inputTokens: response.usage.inputTokens.total,
+ *       outputTokens: response.usage.outputTokens.total,
+ *     },
+ *   });
+ * }).pipe(Effect.provide(languageModel));
+ * ```
+ *
+ * @section Streaming Text
+ * @example Stream tokens as Server-Sent Events
+ * `LanguageModel.streamText` returns a `Stream` of typed response parts.
+ * `Stream.provide(languageModel)` keeps the model available for the whole
+ * stream lifetime; pipe through `Sse.encode` for an SSE response.
+ * ```typescript
+ * import { LanguageModel } from "effect/unstable/ai";
+ * import * as Stream from "effect/Stream";
+ * import * as Sse from "effect/unstable/encoding/Sse";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const stream = LanguageModel.streamText({ prompt }).pipe(
+ *   Stream.provide(languageModel),
+ *   Sse.encode,
+ * );
+ * return HttpServerResponse.stream(stream, {
+ *   headers: {
+ *     "content-type": "text/event-stream",
+ *     "cache-control": "no-cache",
+ *     "x-accel-buffering": "no",
+ *   },
+ * });
+ * ```
+ *
+ * @section Tuning the Gateway
+ * @example Production-grade caching, rate limits, and DLP
+ * Every prop maps to an in-place update — no replacement, no downtime.
+ * ```typescript
+ * export const Gateway = Cloudflare.AiGateway("Gateway", {
+ *   id: "prod-gateway",
+ *   cacheTtl: 300,
+ *   cacheInvalidateOnUpdate: true,
+ *   rateLimitingInterval: 60,
+ *   rateLimitingLimit: 100,
+ *   rateLimitingTechnique: "sliding",
+ *   collectLogs: true,
+ *   logManagement: 100_000,
+ *   logManagementStrategy: "DELETE_OLDEST",
+ *   authentication: true,
+ * });
+ * ```
+ */
+export const AiGateway = Resource<AiGateway>("Cloudflare.AiGateway")({
+  /**
+   * Bind this gateway to the surrounding Worker, returning an Effect-native
+   * client for the runtime AI Gateway binding.
+   */
+  bind: AiGatewayBinding.bind,
+});
+
+export const AiGatewayProvider = () =>
+  Provider.effect(
+    AiGateway,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createAiGateway = yield* aiGateway.createAiGateway;
+      const getAiGateway = yield* aiGateway.getAiGateway;
+      const updateAiGateway = yield* aiGateway.updateAiGateway;
+      const deleteAiGateway = yield* aiGateway.deleteAiGateway;
+
+      const createGatewayId = (id: string, gatewayId: string | undefined) =>
+        Effect.gen(function* () {
+          if (gatewayId) return gatewayId;
+          return yield* createPhysicalName({
+            id,
+            maxLength: 64,
+            lowercase: true,
+          });
+        });
+
+      const desired = (id: string, props: AiGatewayProps | undefined) =>
+        Effect.gen(function* () {
+          return {
+            gatewayId: yield* createGatewayId(id, props?.id),
+            cacheInvalidateOnUpdate: props?.cacheInvalidateOnUpdate ?? false,
+            cacheTtl: props?.cacheTtl ?? null,
+            collectLogs: props?.collectLogs ?? true,
+            rateLimitingInterval: props?.rateLimitingInterval ?? null,
+            rateLimitingLimit: props?.rateLimitingLimit ?? null,
+            rateLimitingTechnique: props?.rateLimitingTechnique ?? "fixed",
+            // Defaults align with what Cloudflare's API returns for an
+            // unconfigured gateway, so the reconciler converges to noop
+            // when the user didn't explicitly set the field.
+            authentication: props?.authentication ?? false,
+            dlp: props?.dlp ?? undefined,
+            isDefault: props?.isDefault ?? false,
+            logManagement: props?.logManagement ?? 100_000,
+            logManagementStrategy:
+              props?.logManagementStrategy ?? "STOP_INSERTING",
+            logpush: props?.logpush ?? false,
+            logpushPublicKey: props?.logpushPublicKey ?? undefined,
+            otel: props?.otel ?? undefined,
+            storeId: props?.storeId ?? "",
+            stripe: props?.stripe ?? undefined,
+            zdr: props?.zdr ?? false,
+          };
+        });
+
+      const mapGateway = (
+        gateway:
+          | aiGateway.GetAiGatewayResponse
+          | aiGateway.CreateAiGatewayResponse
+          | aiGateway.UpdateAiGatewayResponse,
+        accountId: string,
+      ): AiGateway["Attributes"] => ({
+        gatewayId: gateway.id,
+        accountId,
+        // accountTag: gateway.accountTag ?? undefined,
+        // internalId: gateway.internalId ?? undefined,
+        cacheInvalidateOnUpdate: gateway.cacheInvalidateOnUpdate,
+        cacheTtl: nullIfZero(gateway.cacheTtl),
+        collectLogs: gateway.collectLogs,
+        createdAt: gateway.createdAt,
+        modifiedAt: gateway.modifiedAt,
+        rateLimitingInterval: nullIfZero(gateway.rateLimitingInterval),
+        rateLimitingLimit: nullIfZero(gateway.rateLimitingLimit),
+        rateLimitingTechnique: gateway.rateLimitingTechnique ?? "fixed",
+        authentication: gateway.authentication ?? false,
+        // Distilled widened generated string enums to open unions (`string & {}`).
+        dlp: (gateway.dlp ?? undefined) as AiGatewayDlp | undefined,
+        isDefault: gateway.isDefault ?? false,
+        logManagement: gateway.logManagement ?? 100_000,
+        logManagementStrategy:
+          gateway.logManagementStrategy ?? "STOP_INSERTING",
+        logpush: gateway.logpush ?? false,
+        logpushPublicKey: gateway.logpushPublicKey ?? undefined,
+        otel: gateway.otel ?? undefined,
+        storeId: gateway.storeId ?? "",
+        stripe: gateway.stripe ?? undefined,
+        zdr: gateway.zdr ?? false,
+      });
+
+      const mutable = (gateway: AiGateway["Attributes"]) => ({
+        cacheInvalidateOnUpdate: gateway.cacheInvalidateOnUpdate,
+        cacheTtl: gateway.cacheTtl,
+        collectLogs: gateway.collectLogs,
+        rateLimitingInterval: gateway.rateLimitingInterval,
+        rateLimitingLimit: gateway.rateLimitingLimit,
+        rateLimitingTechnique: gateway.rateLimitingTechnique,
+        authentication: gateway.authentication,
+        dlp: gateway.dlp,
+        isDefault: gateway.isDefault,
+        logManagement: gateway.logManagement,
+        logManagementStrategy: gateway.logManagementStrategy,
+        logpush: gateway.logpush,
+        logpushPublicKey: gateway.logpushPublicKey,
+        otel: gateway.otel,
+        storeId: gateway.storeId,
+        stripe: gateway.stripe,
+        zdr: gateway.zdr,
+      });
+
+      const createRequest = Effect.fn(function* (
+        id: string,
+        props: AiGatewayProps | undefined,
+      ) {
+        const next = yield* desired(id, props);
+        return {
+          accountId,
+          id: next.gatewayId,
+          cacheInvalidateOnUpdate: next.cacheInvalidateOnUpdate,
+          cacheTtl: next.cacheTtl,
+          collectLogs: next.collectLogs,
+          rateLimitingInterval: next.rateLimitingInterval,
+          rateLimitingLimit: next.rateLimitingLimit,
+          rateLimitingTechnique: next.rateLimitingTechnique,
+          authentication: next.authentication,
+          logManagement: next.logManagement,
+          logManagementStrategy: next.logManagementStrategy,
+          logpush: next.logpush,
+          logpushPublicKey: next.logpushPublicKey,
+          zdr: next.zdr,
+        } satisfies aiGateway.CreateAiGatewayRequest;
+      });
+
+      const updateRequest = Effect.fn(function* (
+        id: string,
+        props: AiGatewayProps | undefined,
+        accountId: string,
+      ) {
+        const next = yield* desired(id, props);
+        return {
+          accountId,
+          id: next.gatewayId,
+          cacheInvalidateOnUpdate: next.cacheInvalidateOnUpdate,
+          cacheTtl: next.cacheTtl,
+          collectLogs: next.collectLogs,
+          rateLimitingInterval: next.rateLimitingInterval,
+          rateLimitingLimit: next.rateLimitingLimit,
+          rateLimitingTechnique: next.rateLimitingTechnique,
+          authentication: next.authentication,
+          dlp: next.dlp,
+          logManagement: next.logManagement,
+          logManagementStrategy: next.logManagementStrategy,
+          logpush: next.logpush,
+          logpushPublicKey: next.logpushPublicKey,
+          otel: next.otel,
+          storeId: next.storeId,
+          stripe: next.stripe,
+          zdr: next.zdr,
+        } satisfies aiGateway.UpdateAiGatewayRequest;
+      });
+
+      return {
+        stables: ["gatewayId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const next = yield* desired(id, news);
+          const oldGatewayId =
+            output?.gatewayId ?? (yield* createGatewayId(id, olds.id));
+          if (
+            (output?.accountId ?? accountId) !== accountId ||
+            oldGatewayId !== next.gatewayId
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          const oldMutable = mutable(
+            output ?? ((yield* desired(id, olds)) as AiGateway["Attributes"]),
+          );
+          const nextMutable = mutable(next as AiGateway["Attributes"]);
+          if (!deepEqual(oldMutable, nextMutable)) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          const acct = output?.accountId ?? accountId;
+          const gatewayId =
+            output?.gatewayId ?? (yield* createGatewayId(id, news.id));
+
+          // Observe — fetch the gateway's current state. The Cloudflare API
+          // returns 404 when the gateway is missing, which we tolerate so the
+          // reconciler can fall through to create.
+          const observed = yield* getAiGateway({
+            accountId: acct,
+            id: gatewayId,
+          }).pipe(
+            Effect.catchTag("GatewayNotFound", () => Effect.succeed(undefined)),
+          );
+
+          // Ensure — create if missing. Tolerate `GatewayAlreadyExists` for
+          // idempotency: a peer reconciler may have created it concurrently,
+          // or state persistence may have failed after a previous create.
+          if (observed === undefined) {
+            const request = yield* createRequest(id, news);
+            yield* createAiGateway(request).pipe(
+              Effect.catchTag("GatewayAlreadyExists", () =>
+                getAiGateway({ accountId: acct, id: request.id }),
+              ),
+            );
+          }
+
+          // Sync — the Cloudflare AI Gateway update API is a full PATCH that
+          // overwrites all mutable fields. We always apply the desired shape
+          // so adoption, drift, and routine updates all converge.
+          const update = yield* updateRequest(id, news, acct);
+          const gateway = yield* updateAiGateway(update);
+          return mapGateway(gateway, acct);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteAiGateway({
+            accountId: output.accountId,
+            id: output.gatewayId,
+          }).pipe(Effect.catchTag("GatewayNotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const gatewayId =
+            output?.gatewayId ?? (yield* createGatewayId(id, olds?.id));
+          const acct = output?.accountId ?? accountId;
+          return yield* getAiGateway({
+            accountId: acct,
+            id: gatewayId,
+          }).pipe(
+            Effect.map((gateway) => mapGateway(gateway, acct)),
+            Effect.catchTag("GatewayNotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/AiGatewayBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/AiGatewayBinding.ts
new file mode 100644
index 00000000000..048d10d15e3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/AiGatewayBinding.ts
@@ -0,0 +1,227 @@
+/// <reference types="@cloudflare/workers-types" />
+
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { LanguageModel } from "effect/unstable/ai/LanguageModel";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { AiGateway as AiGatewayResource } from "./AiGateway.ts";
+import {
+  makeLanguageModelLayer,
+  type LanguageModelOptions,
+} from "./LanguageModel.ts";
+
+// Error raised by AI Gateway runtime operations.
+export class AiGatewayError extends Data.TaggedError("AiGatewayError")<{
+  /**
+   * Human-readable runtime error message.
+   */
+  message: string;
+  /**
+   * Original error thrown by the Cloudflare runtime binding.
+   */
+  cause: unknown;
+}> {}
+
+/**
+ * Effect-native client for a Cloudflare AI Gateway Worker binding.
+ *
+ * Wraps the runtime {@link AiGateway} binding so each operation returns an
+ * Effect tagged with {@link AiGatewayError}. Use
+ * `Cloudflare.AiGatewayBinding.bind(gateway)` inside a Worker's init phase.
+ */
+export interface AiGatewayClient {
+  /**
+   * Effect resolving to the raw Workers AI binding.
+   */
+  raw: Effect.Effect<Ai, never, RuntimeContext>;
+  /**
+   * Effect resolving to the raw AI Gateway runtime binding.
+   */
+  gateway: Effect.Effect<AiGateway, never, RuntimeContext>;
+  /**
+   * Effect resolving to the gateway id (the resource attribute, captured at
+   * bind time). Useful when calling `ai.run(model, inputs, { gateway: { id } })`
+   * — the in-account path for first-party services like Workers AI.
+   */
+  id: Effect.Effect<string, never, RuntimeContext>;
+  /**
+   * Update metadata on an existing AI Gateway log entry.
+   */
+  patchLog(
+    logId: string,
+    data: Parameters<AiGateway["patchLog"]>[1],
+  ): Effect.Effect<void, AiGatewayError, RuntimeContext>;
+  /**
+   * Read an AI Gateway log entry by ID.
+   */
+  getLog(
+    logId: string,
+  ): Effect.Effect<AiGatewayLog, AiGatewayError, RuntimeContext>;
+  /**
+   * Build a provider URL routed through this gateway.
+   */
+  getUrl(
+    provider?: Parameters<AiGateway["getUrl"]>[0],
+  ): Effect.Effect<string, AiGatewayError, RuntimeContext>;
+  /**
+   * Run an AI Gateway request through the Cloudflare runtime binding.
+   */
+  run(
+    data: Parameters<AiGateway["run"]>[0],
+    options?: Parameters<AiGateway["run"]>[1],
+  ): Effect.Effect<Response, AiGatewayError, RuntimeContext>;
+
+  model(
+    options: LanguageModelOptions,
+  ): Layer.Layer<LanguageModel, never, RuntimeContext>;
+}
+
+/**
+ * Binding service that turns an {@link AiGatewayResource} resource
+ * into a typed {@link AiGatewayClient} for Worker runtime code. Wraps
+ * the Cloudflare AI Gateway runtime binding so each operation returns
+ * an Effect tagged with {@link AiGatewayError}, exposes the raw
+ * Workers AI handle for `ai.run(...)`, and provides a `model(options)`
+ * factory that produces an `effect/unstable/ai` `LanguageModel`
+ * `Layer`.
+ *
+ * @binding
+ *
+ * @section Calling AI Gateway
+ * @example Run through a gateway
+ * Bind the gateway during the Worker's init phase, then use `run` or
+ * `getUrl` from request handlers.
+ * ```typescript
+ * const aiGateway = yield* Cloudflare.AiGatewayBinding.bind(gateway);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     return yield* aiGateway.run({
+ *       provider: "workers-ai",
+ *       endpoint: "@cf/meta/llama-3.1-8b-instruct",
+ *       headers: { "content-type": "application/json" },
+ *       query: { prompt: "Write a concise status update" },
+ *     });
+ *   }),
+ * };
+ * ```
+ *
+ * @section Driving Effect AI through the gateway
+ * @example `aiGateway.model(...)` -> Effect AI `LanguageModel`
+ * `model(options)` produces a `Layer<LanguageModel, never,
+ * RuntimeContext>` that translates `LanguageModel.generateText` /
+ * `streamText` calls (including tool calls and structured outputs)
+ * into `ai.run(...)` against the bound Workers AI model, routed
+ * through the gateway.
+ * ```typescript
+ * const aiGateway = yield* Cloudflare.AiGatewayBinding.bind(gateway);
+ *
+ * const languageModel = aiGateway.model({
+ *   client: aiGateway,
+ *   model: "@cf/meta/llama-3.1-8b-instruct",
+ *   parameters: { temperature: 0.7, maxTokens: 1024 },
+ * });
+ *
+ * const response = yield* AiLanguageModel.generateText({ prompt }).pipe(
+ *   Effect.provide(languageModel),
+ * );
+ * ```
+ *
+ * Provide {@link AiGatewayBindingLive} in the worker's runtime layer
+ * to resolve the underlying Cloudflare AI binding at request time.
+ */
+export class AiGatewayBinding extends Binding.Service<
+  AiGatewayBinding,
+  (gateway: AiGatewayResource) => Effect.Effect<AiGatewayClient>
+>()("Cloudflare.AiGateway.Binding") {}
+
+/**
+ * Runtime layer for {@link AiGatewayBinding}.
+ */
+export const AiGatewayBindingLive = Layer.effect(
+  AiGatewayBinding,
+  Effect.gen(function* () {
+    const Policy = yield* AiGatewayBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (gateway: AiGatewayResource) {
+      yield* Policy(gateway);
+      const gatewayIdAccessor = yield* gateway.gatewayId;
+      const ai = Effect.sync(
+        () => (env as Record<string, Ai>)[gateway.LogicalId]!,
+      );
+      const runtimeGateway = yield* Effect.zip(ai, gatewayIdAccessor).pipe(
+        Effect.map(([ai, gatewayId]) => ai.gateway(gatewayId)),
+        Effect.cached,
+      );
+
+      const use = <T>(
+        fn: (gateway: AiGateway) => Promise<T>,
+      ): Effect.Effect<T, AiGatewayError> =>
+        runtimeGateway.pipe(
+          Effect.flatMap((gateway) => tryPromise(() => fn(gateway))),
+        );
+
+      return {
+        raw: ai,
+        gateway: runtimeGateway,
+        id: gatewayIdAccessor,
+        patchLog: (logId, data) =>
+          use((gateway) => gateway.patchLog(logId, data)),
+        getLog: (logId) => use((gateway) => gateway.getLog(logId)),
+        getUrl: (provider) => use((gateway) => gateway.getUrl(provider)),
+        run: (data, options) => use((gateway) => gateway.run(data, options)),
+        model: (options) => makeLanguageModelLayer(options),
+      } satisfies AiGatewayClient;
+    });
+  }),
+);
+
+/**
+ * Deploy-time policy service that attaches an AI binding to Workers.
+ */
+export class AiGatewayBindingPolicy extends Binding.Policy<
+  AiGatewayBindingPolicy,
+  (gateway: AiGatewayResource) => Effect.Effect<void>
+>()("Cloudflare.AiGateway.Binding") {}
+
+/**
+ * Live deploy-time policy layer for {@link AiGatewayBindingPolicy}.
+ */
+export const AiGatewayBindingPolicyLive = AiGatewayBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, gateway: AiGatewayResource) {
+    if (isWorker(host)) {
+      yield* host.bind(gateway.LogicalId, {
+        bindings: [
+          {
+            type: "ai",
+            name: gateway.LogicalId,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`AiGatewayBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
+
+const tryPromise = <T>(
+  fn: () => Promise<T>,
+): Effect.Effect<T, AiGatewayError> =>
+  Effect.tryPromise({
+    try: fn,
+    catch: (error) =>
+      new AiGatewayError({
+        message:
+          error instanceof Error
+            ? error.message
+            : "Unknown AI Gateway runtime error",
+        cause: error,
+      }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/LanguageModel.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/LanguageModel.ts
new file mode 100644
index 00000000000..638a75fc0fa
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/LanguageModel.ts
@@ -0,0 +1,907 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import {
+  AiError,
+  LanguageModel as AiLanguageModel,
+  IdGenerator,
+  Prompt,
+  Response,
+  Tool,
+} from "effect/unstable/ai";
+import * as Sse from "effect/unstable/encoding/Sse";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AiGatewayClient } from "./AiGatewayBinding.ts";
+
+/**
+ * Options for constructing an AI Gateway-backed Workers AI LanguageModel.
+ */
+export interface LanguageModelOptions {
+  /** Already-bound AI Gateway client from `AiGatewayBinding.bind(gateway)`. */
+  readonly client: AiGatewayClient;
+  /** Workers AI model id, e.g. `@cf/meta/llama-3.3-70b-instruct-fp8-fast`. */
+  readonly model: string;
+  /** Optional per-call defaults; overridable per request via `providerOptions`. */
+  readonly parameters?: {
+    readonly temperature?: number;
+    readonly maxTokens?: number;
+    readonly topP?: number;
+    readonly topK?: number;
+    readonly seed?: number;
+    readonly frequencyPenalty?: number;
+    readonly presencePenalty?: number;
+  };
+}
+
+/**
+ * Provide a {@link AiLanguageModel.LanguageModel} layer backed by the supplied
+ * AI Gateway client and Workers AI model.
+ */
+export const makeLanguageModelLayer = (
+  options: LanguageModelOptions,
+): Layer.Layer<AiLanguageModel.LanguageModel, never, RuntimeContext> =>
+  Layer.effect(AiLanguageModel.LanguageModel, makeLanguageModel(options));
+
+/**
+ * Build a {@link AiLanguageModel.Service} that proxies generateText/streamText
+ * through the supplied AI Gateway client to a Workers AI model.
+ */
+export const makeLanguageModel = ({
+  client,
+  model,
+  parameters,
+}: LanguageModelOptions): Effect.Effect<
+  AiLanguageModel.Service,
+  never,
+  RuntimeContext
+> =>
+  Effect.gen(function* () {
+    const ai = yield* client.raw;
+    const gatewayId = yield* client.id;
+
+    const callRaw = (
+      body: WorkersAiInputs,
+      method: "generateText" | "streamText",
+    ): Effect.Effect<Response, AiError.AiError> =>
+      Effect.tryPromise({
+        try: () =>
+          ai.run(
+            model as keyof AiModels,
+            body as unknown as AiModels[keyof AiModels]["inputs"],
+            {
+              gateway: { id: gatewayId },
+              returnRawResponse: true,
+            },
+          ),
+        catch: (cause) => toAiError(cause, method),
+      });
+
+    return yield* AiLanguageModel.make({
+      generateText: (options) =>
+        Effect.gen(function* () {
+          const body = toRequestBody({ options, parameters, stream: false });
+          const resp = yield* callRaw(body, "generateText");
+          const json = yield* Effect.tryPromise({
+            try: () => resp.json() as Promise<Record<string, unknown>>,
+            catch: (cause) => toAiError(cause, "generateText"),
+          });
+          return yield* parseGenerateText(json);
+        }),
+      streamText: (options) =>
+        Stream.unwrap(
+          Effect.gen(function* () {
+            const idGen = yield* IdGenerator.IdGenerator;
+            const body = toRequestBody({ options, parameters, stream: true });
+            const resp = yield* callRaw(body, "streamText");
+            return parseStreamText(resp, idGen);
+          }),
+        ),
+    });
+  });
+
+// ---------------------------------------------------------------------------
+// Wire format types (Workers AI request)
+//
+// Workers AI returns two response shapes depending on the model:
+//   - Native:  { response: "...", tool_calls: [...] , usage }
+//   - OpenAI:  { choices: [{ message: { content, tool_calls, reasoning_content } }], usage }
+//
+// We accept both defensively — schemas would over-constrain.
+// ---------------------------------------------------------------------------
+
+interface WorkersAiMessage {
+  readonly role: "system" | "user" | "assistant" | "tool";
+  readonly content?: unknown;
+  readonly name?: string;
+  readonly tool_call_id?: string;
+  readonly tool_calls?: ReadonlyArray<{
+    readonly id: string;
+    readonly type: "function";
+    readonly function: { readonly name: string; readonly arguments: string };
+  }>;
+  readonly reasoning?: string;
+}
+
+interface WorkersAiToolDef {
+  readonly type: "function";
+  readonly function: {
+    readonly name: string;
+    readonly description?: string;
+    readonly parameters: unknown;
+  };
+}
+
+type WorkersAiToolChoice =
+  | "auto"
+  | "required"
+  | "none"
+  | { readonly type: "function"; readonly function: { readonly name: string } };
+
+interface WorkersAiInputs {
+  readonly messages: ReadonlyArray<WorkersAiMessage>;
+  readonly tools?: ReadonlyArray<WorkersAiToolDef>;
+  readonly tool_choice?: WorkersAiToolChoice;
+  readonly stream?: boolean;
+  readonly stream_options?: { readonly include_usage: boolean };
+  readonly max_tokens?: number;
+  readonly temperature?: number;
+  readonly top_p?: number;
+  readonly top_k?: number;
+  readonly random_seed?: number;
+  readonly frequency_penalty?: number;
+  readonly presence_penalty?: number;
+}
+
+// ---------------------------------------------------------------------------
+// Prompt → Workers AI messages (pure, no .push mutation)
+// ---------------------------------------------------------------------------
+
+const uint8ArrayToBase64 = (bytes: Uint8Array): string => {
+  let binary = "";
+  const chunkSize = 8192;
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    const chunk = bytes.subarray(i, Math.min(i + chunkSize, bytes.length));
+    binary += String.fromCharCode(...chunk);
+  }
+  return btoa(binary);
+};
+
+const fileToImageUrl = (
+  data: string | Uint8Array | URL,
+  mediaType: string,
+): string => {
+  if (data instanceof URL) return data.toString();
+  if (data instanceof Uint8Array) {
+    return `data:${mediaType};base64,${uint8ArrayToBase64(data)}`;
+  }
+  if (data.startsWith("data:") || data.startsWith("http")) return data;
+  return `data:${mediaType};base64,${data}`;
+};
+
+const convertPromptToMessages = (
+  prompt: Prompt.Prompt,
+): ReadonlyArray<WorkersAiMessage> =>
+  prompt.content.flatMap((m): ReadonlyArray<WorkersAiMessage> => {
+    switch (m.role) {
+      case "system":
+        return [{ role: "system", content: m.content }];
+      case "user":
+        return [toUserMessage(m.content)];
+      case "assistant":
+        return [toAssistantMessage(m.content)];
+      case "tool":
+        return m.content.flatMap(toToolMessage);
+    }
+  });
+
+const toUserMessage = (
+  parts: Prompt.UserMessage["content"],
+): WorkersAiMessage => {
+  const text = parts
+    .flatMap((p) => (p.type === "text" ? [p.text] : []))
+    .join("\n");
+  const images = parts.flatMap((p) =>
+    p.type === "file"
+      ? [
+          {
+            type: "image_url" as const,
+            image_url: { url: fileToImageUrl(p.data, p.mediaType) },
+          },
+        ]
+      : [],
+  );
+  if (images.length === 0) return { role: "user", content: text };
+  return {
+    role: "user",
+    content: [
+      ...(text.length > 0 ? [{ type: "text" as const, text }] : []),
+      ...images,
+    ],
+  };
+};
+
+const toAssistantMessage = (
+  parts: Prompt.AssistantMessage["content"],
+): WorkersAiMessage => {
+  const text = parts
+    .flatMap((p) => (p.type === "text" ? [p.text] : []))
+    .join("");
+  const reasoning = parts
+    .flatMap((p) => (p.type === "reasoning" ? [p.text] : []))
+    .join("");
+  const toolCalls = parts.flatMap((p) =>
+    p.type === "tool-call"
+      ? [
+          {
+            id: p.id,
+            type: "function" as const,
+            function: {
+              name: p.name,
+              arguments:
+                typeof p.params === "string"
+                  ? p.params
+                  : JSON.stringify(p.params ?? {}),
+            },
+          },
+        ]
+      : [],
+  );
+  return {
+    role: "assistant",
+    content: text,
+    ...(reasoning ? { reasoning } : {}),
+    ...(toolCalls.length > 0 ? { tool_calls: toolCalls } : {}),
+  };
+};
+
+const toToolMessage = (
+  part: Prompt.ToolMessage["content"][number],
+): ReadonlyArray<WorkersAiMessage> =>
+  part.type === "tool-result"
+    ? [
+        {
+          role: "tool",
+          name: part.name,
+          tool_call_id: part.id,
+          content:
+            typeof part.result === "string"
+              ? part.result
+              : JSON.stringify(part.result),
+        },
+      ]
+    : [];
+
+// ---------------------------------------------------------------------------
+// Tools / tool_choice
+// ---------------------------------------------------------------------------
+
+const prepareTools = (
+  tools: ReadonlyArray<Tool.Any>,
+  toolChoice: AiLanguageModel.ProviderOptions["toolChoice"],
+): {
+  tools?: ReadonlyArray<WorkersAiToolDef>;
+  tool_choice?: WorkersAiToolChoice;
+} => {
+  if (tools.length === 0) return {};
+  const mapped: ReadonlyArray<WorkersAiToolDef> = tools.map((tool) => ({
+    type: "function",
+    function: {
+      name: tool.name,
+      description: Tool.getDescription(tool),
+      parameters: Tool.getJsonSchema(tool),
+    },
+  }));
+
+  if (toolChoice === "auto" || toolChoice == null) {
+    return { tools: mapped, tool_choice: "auto" };
+  }
+  if (toolChoice === "none") return { tools: mapped, tool_choice: "none" };
+  if (toolChoice === "required") {
+    return { tools: mapped, tool_choice: "required" };
+  }
+  if (typeof toolChoice === "object" && "tool" in toolChoice) {
+    return {
+      tools: mapped.filter((t) => t.function.name === toolChoice.tool),
+      tool_choice: "required",
+    };
+  }
+  if (typeof toolChoice === "object" && "oneOf" in toolChoice) {
+    const allowed = new Set(toolChoice.oneOf);
+    return {
+      tools: mapped.filter((t) => allowed.has(t.function.name)),
+      tool_choice: toolChoice.mode === "required" ? "required" : "auto",
+    };
+  }
+  return { tools: mapped, tool_choice: "auto" };
+};
+
+// ---------------------------------------------------------------------------
+// Request body
+// ---------------------------------------------------------------------------
+
+const toRequestBody = ({
+  options,
+  parameters,
+  stream,
+}: {
+  readonly options: AiLanguageModel.ProviderOptions;
+  readonly parameters: LanguageModelOptions["parameters"];
+  readonly stream: boolean;
+}): WorkersAiInputs => {
+  const messages = convertPromptToMessages(options.prompt);
+  const { tools, tool_choice } = prepareTools(
+    options.tools,
+    options.toolChoice,
+  );
+  return {
+    messages,
+    ...(tools !== undefined ? { tools } : {}),
+    ...(tool_choice !== undefined ? { tool_choice } : {}),
+    // `stream_options.include_usage` is the OpenAI-compatible opt-in for
+    // usage tokens to appear in the final streamed chunk. Without it most
+    // Workers AI models omit `usage` from the stream entirely, leaving the
+    // `finish` part with zeroed counts.
+    ...(stream
+      ? { stream: true, stream_options: { include_usage: true } }
+      : {}),
+    ...(parameters?.maxTokens !== undefined
+      ? { max_tokens: parameters.maxTokens }
+      : {}),
+    ...(parameters?.temperature !== undefined
+      ? { temperature: parameters.temperature }
+      : {}),
+    ...(parameters?.topP !== undefined ? { top_p: parameters.topP } : {}),
+    ...(parameters?.topK !== undefined ? { top_k: parameters.topK } : {}),
+    ...(parameters?.seed !== undefined ? { random_seed: parameters.seed } : {}),
+    ...(parameters?.frequencyPenalty !== undefined
+      ? { frequency_penalty: parameters.frequencyPenalty }
+      : {}),
+    ...(parameters?.presencePenalty !== undefined
+      ? { presence_penalty: parameters.presencePenalty }
+      : {}),
+  };
+};
+
+// ---------------------------------------------------------------------------
+// Finish reason / usage mapping
+// ---------------------------------------------------------------------------
+
+const mapFinishReason = (raw: unknown): Response.FinishReason => {
+  switch (raw) {
+    case "stop":
+      return "stop";
+    case "length":
+    case "model_length":
+      return "length";
+    case "tool_calls":
+      return "tool-calls";
+    case "content_filter":
+    case "content-filter":
+      return "content-filter";
+    case "error":
+      return "error";
+    case undefined:
+    case null:
+      return "unknown";
+    default:
+      return "other";
+  }
+};
+
+const mapUsage = (raw: Record<string, unknown> | undefined): Response.Usage => {
+  const usage = (raw?.usage as Record<string, unknown> | undefined) ?? {};
+  const promptTokens = (usage.prompt_tokens as number | undefined) ?? 0;
+  const completionTokens = (usage.completion_tokens as number | undefined) ?? 0;
+  const cached = (
+    usage.prompt_tokens_details as { cached_tokens?: number } | undefined
+  )?.cached_tokens;
+  // Construct an actual `Response.Usage` instance — `Schema.Class<Usage>`
+  // encodes by going through the class constructor / `isInstance` check, so a
+  // plain struct that "matches" the encoded shape isn't enough.
+  return new Response.Usage({
+    inputTokens: {
+      uncached:
+        cached !== undefined
+          ? Math.max(0, promptTokens - cached)
+          : promptTokens,
+      total: promptTokens,
+      cacheRead: cached ?? 0,
+      cacheWrite: 0,
+    },
+    outputTokens: {
+      total: completionTokens,
+      text: 0,
+      reasoning: 0,
+    },
+  });
+};
+
+// ---------------------------------------------------------------------------
+// generateText: JSON → Response.PartEncoded[]
+//
+// Normalize the dual-shape (native + OpenAI) response into a single
+// `DecodedResponse` once, then build the part list with pure spreads.
+// ---------------------------------------------------------------------------
+
+interface DecodedToolCall {
+  readonly rawId: string;
+  readonly name: string;
+  readonly arguments: unknown;
+}
+
+interface DecodedResponse {
+  readonly text: string | undefined;
+  readonly reasoning: string | undefined;
+  readonly toolCalls: ReadonlyArray<DecodedToolCall>;
+  readonly finishReason: string | undefined;
+}
+
+const decodeResponse = (raw: Record<string, unknown>): DecodedResponse => {
+  const choice = (
+    raw.choices as
+      | Array<{
+          message?: {
+            content?: string | null;
+            reasoning_content?: string;
+            reasoning?: string;
+            tool_calls?: ReadonlyArray<Record<string, unknown>>;
+          };
+          finish_reason?: string;
+        }>
+      | undefined
+  )?.[0];
+  const message = choice?.message;
+
+  const openAiText = message?.content;
+  const text =
+    typeof openAiText === "string" && openAiText.length > 0
+      ? openAiText
+      : nativeTextOf(raw.response);
+  const reasoning = message?.reasoning_content ?? message?.reasoning;
+  const rawToolCalls =
+    message?.tool_calls ??
+    (Array.isArray(raw.tool_calls)
+      ? (raw.tool_calls as ReadonlyArray<Record<string, unknown>>)
+      : []);
+
+  return {
+    text,
+    reasoning: reasoning && reasoning.length > 0 ? reasoning : undefined,
+    toolCalls: rawToolCalls.flatMap(decodeToolCall),
+    finishReason:
+      choice?.finish_reason ?? (raw.finish_reason as string | undefined),
+  };
+};
+
+const nativeTextOf = (raw: unknown): string | undefined => {
+  if (raw == null) return undefined;
+  if (typeof raw === "object") return JSON.stringify(raw);
+  const text = String(raw);
+  return text.length > 0 ? text : undefined;
+};
+
+const decodeToolCall = (
+  tc: Record<string, unknown>,
+): ReadonlyArray<DecodedToolCall> => {
+  const fn = tc.function as { name?: string; arguments?: unknown } | undefined;
+  const rawId = (tc.id as string | undefined) ?? "";
+  if (fn?.name) {
+    return [{ rawId, name: fn.name, arguments: fn.arguments ?? "" }];
+  }
+  const flatName = tc.name as string | undefined;
+  if (flatName) {
+    return [{ rawId, name: flatName, arguments: tc.arguments ?? "" }];
+  }
+  return [];
+};
+
+const tryParseJsonArgs = (raw: unknown): unknown => {
+  if (typeof raw !== "string") return raw;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    // Leave as raw string; the framework's tool-result decoder will fail loudly.
+    return raw;
+  }
+};
+
+const parseGenerateText = Effect.fnUntraced(function* (
+  raw: Record<string, unknown>,
+) {
+  const idGen = yield* IdGenerator.IdGenerator;
+  const decoded = decodeResponse(raw);
+
+  const toolCallParts = yield* Effect.forEach(decoded.toolCalls, (tc) =>
+    Effect.gen(function* () {
+      const id = tc.rawId || (yield* idGen.generateId());
+      return {
+        type: "tool-call" as const,
+        id,
+        name: tc.name,
+        params: tryParseJsonArgs(tc.arguments),
+      };
+    }),
+  );
+
+  const finish = mapFinishReason(
+    decoded.finishReason ??
+      (decoded.toolCalls.length > 0 ? "tool_calls" : "stop"),
+  );
+
+  return [
+    ...(decoded.reasoning !== undefined
+      ? [{ type: "reasoning" as const, text: decoded.reasoning }]
+      : []),
+    ...(decoded.text !== undefined && decoded.text.length > 0
+      ? [{ type: "text" as const, text: decoded.text }]
+      : []),
+    ...toolCallParts,
+    {
+      type: "finish" as const,
+      reason: finish,
+      usage: mapUsage(raw),
+      response: undefined,
+    },
+  ] satisfies ReadonlyArray<Response.PartEncoded>;
+});
+
+// ---------------------------------------------------------------------------
+// streamText: SSE byte stream → Stream<Response.StreamPartEncoded>
+//
+// Immutable `StreamState` is threaded through `Stream.mapAccumEffect`. The
+// per-chunk output buffer (`parts: Array<StreamPartEncoded>`) is mutable for
+// performance — it's scoped to one chunk, never escapes the handler, and lets
+// us avoid the O(n²) array-spread that pure threading would force in the hot
+// path. This matches the pattern Effect's own `@effect/ai-*` adapters use.
+// ---------------------------------------------------------------------------
+
+interface StreamState {
+  readonly textId: string | undefined;
+  readonly reasoningId: string | undefined;
+  readonly toolCalls: ReadonlyMap<
+    number,
+    { readonly id: string; readonly name: string }
+  >;
+  readonly lastToolIndex: number | undefined;
+  readonly closedToolIndices: ReadonlySet<number>;
+  readonly usage: Record<string, unknown> | undefined;
+  readonly finishReason: string | undefined;
+  readonly receivedAnyData: boolean;
+  readonly receivedDone: boolean;
+}
+
+const initialStreamState = (): StreamState => ({
+  textId: undefined,
+  reasoningId: undefined,
+  toolCalls: new Map(),
+  lastToolIndex: undefined,
+  closedToolIndices: new Set(),
+  usage: undefined,
+  finishReason: undefined,
+  receivedAnyData: false,
+  receivedDone: false,
+});
+
+type StreamParts = Array<Response.StreamPartEncoded>;
+
+const tryParseJson = (data: string): Record<string, unknown> | undefined => {
+  try {
+    const v = JSON.parse(data);
+    return v && typeof v === "object"
+      ? (v as Record<string, unknown>)
+      : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+const isNullFinalizationToolCall = (tc: Record<string, unknown>): boolean => {
+  const fn = tc.function as Record<string, unknown> | undefined;
+  const name = fn?.name ?? tc.name ?? null;
+  const args = fn?.arguments ?? tc.arguments ?? null;
+  const id = tc.id ?? null;
+  return !id && !name && (!args || args === "");
+};
+
+const closeReasoning = (
+  state: StreamState,
+  parts: StreamParts,
+): StreamState => {
+  if (state.reasoningId === undefined) return state;
+  parts.push({ type: "reasoning-end", id: state.reasoningId });
+  return { ...state, reasoningId: undefined };
+};
+
+const closeToolCall = (
+  state: StreamState,
+  index: number,
+  parts: StreamParts,
+): StreamState => {
+  if (state.closedToolIndices.has(index)) return state;
+  const tc = state.toolCalls.get(index);
+  if (!tc) return state;
+  parts.push({ type: "tool-params-end", id: tc.id });
+  const closed = new Set(state.closedToolIndices);
+  closed.add(index);
+  return { ...state, closedToolIndices: closed };
+};
+
+const emitTextDelta = (
+  state: StreamState,
+  delta: string,
+  parts: StreamParts,
+  idGen: IdGenerator.Service,
+): Effect.Effect<StreamState> =>
+  Effect.gen(function* () {
+    let s = closeReasoning(state, parts);
+    if (s.textId === undefined) {
+      const id = yield* idGen.generateId();
+      parts.push({ type: "text-start", id });
+      s = { ...s, textId: id };
+    }
+    parts.push({ type: "text-delta", id: s.textId!, delta });
+    return s;
+  });
+
+const emitReasoningDelta = (
+  state: StreamState,
+  delta: string,
+  parts: StreamParts,
+  idGen: IdGenerator.Service,
+): Effect.Effect<StreamState> =>
+  Effect.gen(function* () {
+    let s = state;
+    if (s.reasoningId === undefined) {
+      const id = yield* idGen.generateId();
+      parts.push({ type: "reasoning-start", id });
+      s = { ...s, reasoningId: id };
+    }
+    parts.push({ type: "reasoning-delta", id: s.reasoningId!, delta });
+    return s;
+  });
+
+const handleToolDeltas = (
+  state: StreamState,
+  deltas: ReadonlyArray<Record<string, unknown>>,
+  parts: StreamParts,
+  idGen: IdGenerator.Service,
+): Effect.Effect<StreamState> =>
+  Effect.gen(function* () {
+    let s = state;
+    for (const d of deltas) {
+      if (isNullFinalizationToolCall(d)) {
+        if (s.lastToolIndex !== undefined) {
+          s = closeToolCall(s, s.lastToolIndex, parts);
+        }
+        continue;
+      }
+      const idx = (d.index as number | undefined) ?? 0;
+      const fn = d.function as
+        | { name?: string; arguments?: string }
+        | undefined;
+      const name = fn?.name ?? (d.name as string | undefined) ?? "";
+      const args = fn?.arguments ?? (d.arguments as string | undefined) ?? "";
+      const rawId = (d.id as string | undefined) ?? "";
+
+      const existing = s.toolCalls.get(idx);
+      if (existing === undefined) {
+        if (s.lastToolIndex !== undefined && s.lastToolIndex !== idx) {
+          s = closeToolCall(s, s.lastToolIndex, parts);
+        }
+        const id = rawId || (yield* idGen.generateId());
+        const entry = { id, name };
+        const next = new Map(s.toolCalls);
+        next.set(idx, entry);
+        s = { ...s, toolCalls: next, lastToolIndex: idx };
+        parts.push({ type: "tool-params-start", id, name });
+        if (args.length > 0) {
+          parts.push({ type: "tool-params-delta", id, delta: args });
+        }
+      } else {
+        s = { ...s, lastToolIndex: idx };
+        if (args.length > 0) {
+          parts.push({
+            type: "tool-params-delta",
+            id: existing.id,
+            delta: args,
+          });
+        }
+      }
+    }
+    return s;
+  });
+
+const hasNonZeroUsage = (raw: unknown): boolean => {
+  if (raw == null || typeof raw !== "object") return false;
+  const u = raw as Record<string, unknown>;
+  const prompt = (u.prompt_tokens as number | undefined) ?? 0;
+  const completion = (u.completion_tokens as number | undefined) ?? 0;
+  const total = (u.total_tokens as number | undefined) ?? 0;
+  return prompt > 0 || completion > 0 || total > 0;
+};
+
+const updateChunkMeta = (
+  state: StreamState,
+  chunk: Record<string, unknown>,
+): StreamState => {
+  let s = state;
+  // Workers AI's native stream emits the real usage chunk, then a
+  // "zero-valued terminator" chunk where every count is 0 (it also re-emits
+  // `usage` with all zeros). Treat the zero chunk as a no-op so we keep the
+  // meaningful counts.
+  if (chunk.usage !== undefined && hasNonZeroUsage(chunk.usage)) {
+    s = { ...s, usage: chunk };
+  }
+  const choices = chunk.choices as
+    | Array<{ finish_reason?: string }>
+    | undefined;
+  const finish =
+    choices?.[0]?.finish_reason ?? (chunk.finish_reason as string | undefined);
+  if (finish != null) s = { ...s, finishReason: finish };
+  return s;
+};
+
+const handleNativeText = (
+  state: StreamState,
+  chunk: Record<string, unknown>,
+  parts: StreamParts,
+  idGen: IdGenerator.Service,
+): Effect.Effect<StreamState> => {
+  const native = chunk.response;
+  if (native == null || native === "") return Effect.succeed(state);
+  const text =
+    typeof native === "object" ? JSON.stringify(native) : String(native);
+  if (text.length === 0) return Effect.succeed(state);
+  return emitTextDelta(state, text, parts, idGen);
+};
+
+const handleNativeToolCalls = (
+  state: StreamState,
+  chunk: Record<string, unknown>,
+  parts: StreamParts,
+  idGen: IdGenerator.Service,
+): Effect.Effect<StreamState> => {
+  if (!Array.isArray(chunk.tool_calls)) return Effect.succeed(state);
+  return Effect.gen(function* () {
+    const s = closeReasoning(state, parts);
+    return yield* handleToolDeltas(
+      s,
+      chunk.tool_calls as ReadonlyArray<Record<string, unknown>>,
+      parts,
+      idGen,
+    );
+  });
+};
+
+const handleOpenAiDelta = (
+  state: StreamState,
+  chunk: Record<string, unknown>,
+  parts: StreamParts,
+  idGen: IdGenerator.Service,
+): Effect.Effect<StreamState> => {
+  const delta = (
+    chunk.choices as Array<{ delta?: Record<string, unknown> }> | undefined
+  )?.[0]?.delta;
+  if (!delta) return Effect.succeed(state);
+  return Effect.gen(function* () {
+    let s = state;
+    const reasoning = (delta.reasoning_content ?? delta.reasoning) as
+      | string
+      | undefined;
+    if (reasoning && reasoning.length > 0) {
+      s = yield* emitReasoningDelta(s, reasoning, parts, idGen);
+    }
+    const text = delta.content as string | undefined;
+    if (text && text.length > 0) {
+      s = yield* emitTextDelta(s, text, parts, idGen);
+    }
+    const toolDeltas = delta.tool_calls as
+      | ReadonlyArray<Record<string, unknown>>
+      | undefined;
+    if (Array.isArray(toolDeltas)) {
+      s = closeReasoning(s, parts);
+      s = yield* handleToolDeltas(s, toolDeltas, parts, idGen);
+    }
+    return s;
+  });
+};
+
+const handleStreamChunk = (
+  state: StreamState,
+  data: string,
+  idGen: IdGenerator.Service,
+): Effect.Effect<
+  readonly [StreamState, ReadonlyArray<Response.StreamPartEncoded>]
+> =>
+  Effect.gen(function* () {
+    if (data === "") return [state, []] as const;
+    if (data === "[DONE]") {
+      return [{ ...state, receivedDone: true }, []] as const;
+    }
+    const chunk = tryParseJson(data);
+    if (chunk === undefined) return [state, []] as const;
+
+    const parts: StreamParts = [];
+    let s: StreamState = { ...state, receivedAnyData: true };
+    s = updateChunkMeta(s, chunk);
+    s = yield* handleNativeText(s, chunk, parts, idGen);
+    s = yield* handleNativeToolCalls(s, chunk, parts, idGen);
+    s = yield* handleOpenAiDelta(s, chunk, parts, idGen);
+    return [s, parts] as const;
+  });
+
+const finalizeStream = (
+  state: StreamState,
+): ReadonlyArray<Response.StreamPartEncoded> => {
+  const parts: StreamParts = [];
+  let s = state;
+  for (const [idx] of s.toolCalls) s = closeToolCall(s, idx, parts);
+  s = closeReasoning(s, parts);
+  if (s.textId !== undefined) parts.push({ type: "text-end", id: s.textId });
+
+  // Three cases for the final reason:
+  //  1. The model emitted an explicit `finish_reason`           → map it.
+  //  2. The stream ended cleanly (`[DONE]` seen) but no reason  → "stop".
+  //     Workers AI's native shape never includes `finish_reason`,
+  //     so without this rule every native-mode stream would report
+  //     `unknown` despite completing successfully.
+  //  3. The stream ended abnormally (no `[DONE]`, no reason)    → "error".
+  const reason: Response.FinishReason =
+    s.finishReason !== undefined
+      ? mapFinishReason(s.finishReason)
+      : s.receivedDone
+        ? "stop"
+        : s.receivedAnyData
+          ? "error"
+          : "unknown";
+
+  parts.push({
+    type: "finish",
+    reason,
+    usage: mapUsage(s.usage),
+    response: undefined,
+  });
+  return parts;
+};
+
+const parseStreamText = (
+  resp: Response,
+  idGen: IdGenerator.Service,
+): Stream.Stream<Response.StreamPartEncoded, AiError.AiError> => {
+  const body = resp.body;
+  if (body === null) {
+    return Stream.fromIterable<Response.StreamPartEncoded>(
+      finalizeStream(initialStreamState()),
+    );
+  }
+  return Stream.fromReadableStream<Uint8Array, AiError.AiError>({
+    evaluate: () => body,
+    onError: (cause) => toAiError(cause, "streamText"),
+  }).pipe(
+    Stream.decodeText(),
+    Stream.pipeThroughChannel(Sse.decode<AiError.AiError, unknown>()),
+    Stream.catchTag("Retry", (retry) => Stream.die(retry)),
+    Stream.mapAccumEffect(
+      initialStreamState,
+      (state, event) => handleStreamChunk(state, event.data, idGen),
+      { onHalt: (state) => finalizeStream(state) },
+    ),
+  );
+};
+
+// ---------------------------------------------------------------------------
+// Error mapping
+// ---------------------------------------------------------------------------
+
+const toAiError = (
+  cause: unknown,
+  method: "generateText" | "streamText",
+): AiError.AiError =>
+  AiError.AiError.make({
+    module: "Cloudflare.AiGateway.LanguageModel",
+    method,
+    reason: new AiError.UnknownError({
+      description:
+        cause instanceof Error ? cause.message : "AI Gateway request failed",
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/index.ts
new file mode 100644
index 00000000000..ca5f67f629f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AiGateway/index.ts
@@ -0,0 +1,3 @@
+export * from "./AiGateway.ts";
+export * from "./AiGatewayBinding.ts";
+export * from "./LanguageModel.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.ts
new file mode 100644
index 00000000000..86b927f133f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.ts
@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import { AnalyticsEngineDatasetBinding } from "./AnalyticsEngineDatasetBinding.ts";
+
+type AnalyticsEngineDatasetTypeId = typeof AnalyticsEngineDatasetTypeId;
+const AnalyticsEngineDatasetTypeId =
+  "Cloudflare.AnalyticsEngineDataset" as const;
+
+export type AnalyticsEngineDatasetProps = {
+  /**
+   * Dataset name. If omitted, the logical ID is used.
+   */
+  dataset?: string;
+};
+
+/**
+ * A Cloudflare Workers Analytics Engine dataset binding.
+ *
+ * Analytics Engine datasets are configured as Worker bindings. The binding
+ * exposes `writeDataPoint()` at runtime and does not require separate
+ * provisioning through the Cloudflare API.
+ *
+ * @resource
+ *
+ * @section Binding to a Worker
+ * @example Basic Analytics Engine binding
+ * ```typescript
+ * const Analytics = yield* Cloudflare.AnalyticsEngineDataset("Analytics", {
+ *   dataset: "app-events",
+ * });
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { Analytics },
+ * });
+ * ```
+ *
+ * @example Effect-style worker
+ * ```typescript
+ * const analytics = yield* Cloudflare.AnalyticsEngineDataset.bind(Analytics);
+ * yield* analytics.writeDataPoint({ blobs: ["signup"] });
+ * ```
+ */
+export type AnalyticsEngineDataset = {
+  kind: AnalyticsEngineDatasetTypeId;
+  name: string;
+  dataset: string;
+};
+
+export const isAnalyticsEngineDataset = (
+  value: unknown,
+): value is AnalyticsEngineDataset =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as AnalyticsEngineDataset).kind === AnalyticsEngineDatasetTypeId;
+
+export const AnalyticsEngineDataset: {
+  (
+    name: string,
+    props?: AnalyticsEngineDatasetProps,
+  ): Effect.Effect<AnalyticsEngineDataset>;
+  /**
+   * Bind Analytics Engine to the surrounding Worker, returning an
+   * Effect-native client with access to the native Workers runtime binding.
+   */
+  bind: typeof AnalyticsEngineDatasetBinding.bind;
+} = Object.assign(
+  Effect.fnUntraced(function* (
+    name: string,
+    props?: AnalyticsEngineDatasetProps,
+  ) {
+    return {
+      kind: AnalyticsEngineDatasetTypeId,
+      name,
+      dataset: props?.dataset ?? name,
+    } satisfies AnalyticsEngineDataset;
+  }),
+  {
+    bind: (...args: Parameters<typeof AnalyticsEngineDatasetBinding.bind>) =>
+      AnalyticsEngineDatasetBinding.bind(...args),
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDatasetBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDatasetBinding.ts
new file mode 100644
index 00000000000..524c9323a15
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/AnalyticsEngineDatasetBinding.ts
@@ -0,0 +1,104 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { AnalyticsEngineDataset as AnalyticsEngineDatasetLike } from "./AnalyticsEngineDataset.ts";
+
+export interface AnalyticsEngineDataPoint {
+  indexes?: string[];
+  blobs?: string[];
+  doubles?: number[];
+}
+
+export interface RuntimeAnalyticsEngineDataset {
+  writeDataPoint(dataPoint: AnalyticsEngineDataPoint): void;
+}
+
+export class AnalyticsEngineDatasetError extends Data.TaggedError(
+  "AnalyticsEngineDatasetError",
+)<{
+  message: string;
+  cause: Error;
+}> {}
+
+export interface AnalyticsEngineDatasetClient {
+  raw: Effect.Effect<RuntimeAnalyticsEngineDataset, never, RuntimeContext>;
+  writeDataPoint(
+    dataPoint: AnalyticsEngineDataPoint,
+  ): Effect.Effect<void, AnalyticsEngineDatasetError, RuntimeContext>;
+}
+
+export class AnalyticsEngineDatasetBinding extends Binding.Service<
+  AnalyticsEngineDatasetBinding,
+  (
+    dataset: AnalyticsEngineDatasetLike,
+  ) => Effect.Effect<AnalyticsEngineDatasetClient>
+>()("Cloudflare.AnalyticsEngineDataset.Binding") {}
+
+export const AnalyticsEngineDatasetBindingLive = Layer.effect(
+  AnalyticsEngineDatasetBinding,
+  Effect.gen(function* () {
+    const bind = yield* AnalyticsEngineDatasetBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fnUntraced(function* (dataset: AnalyticsEngineDatasetLike) {
+      yield* bind(dataset);
+
+      const raw = Effect.sync(
+        () =>
+          (env as Record<string, RuntimeAnalyticsEngineDataset>)[dataset.name]!,
+      );
+
+      return {
+        raw,
+        writeDataPoint: (dataPoint) =>
+          raw.pipe(
+            Effect.flatMap((raw) =>
+              Effect.try({
+                try: () => raw.writeDataPoint(dataPoint),
+                catch: (error: any) =>
+                  new AnalyticsEngineDatasetError({
+                    message: error?.message ?? "Unknown error",
+                    cause: error,
+                  }),
+              }),
+            ),
+          ),
+      } satisfies AnalyticsEngineDatasetClient;
+    });
+  }),
+);
+
+export class AnalyticsEngineDatasetBindingPolicy extends Binding.Policy<
+  AnalyticsEngineDatasetBindingPolicy,
+  (dataset: AnalyticsEngineDatasetLike) => Effect.Effect<void>
+>()("Cloudflare.AnalyticsEngineDataset.Binding") {}
+
+export const AnalyticsEngineDatasetBindingPolicyLive =
+  AnalyticsEngineDatasetBindingPolicy.layer.succeed(
+    Effect.fnUntraced(function* (
+      host: ResourceLike,
+      dataset: AnalyticsEngineDatasetLike,
+    ) {
+      if (isWorker(host)) {
+        yield* host.bind(dataset.name, {
+          bindings: [
+            {
+              type: "analytics_engine",
+              name: dataset.name,
+              dataset: dataset.dataset,
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(
+            `AnalyticsEngineDatasetBinding does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/index.ts
new file mode 100644
index 00000000000..2b639e70ea6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/AnalyticsEngine/index.ts
@@ -0,0 +1,2 @@
+export * from "./AnalyticsEngineDataset.ts";
+export * from "./AnalyticsEngineDatasetBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/AccountApiToken.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/AccountApiToken.ts
new file mode 100644
index 00000000000..72b293878c8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/AccountApiToken.ts
@@ -0,0 +1,283 @@
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  buildConditionPayload,
+  collectPolicies,
+  conditionFingerprint,
+  policyFingerprint,
+  resolvePolicies,
+  type ApiTokenBinding,
+  type ApiTokenProps,
+} from "./Common.ts";
+
+export type AccountApiToken = Resource<
+  "Cloudflare.AccountApiToken",
+  ApiTokenProps,
+  {
+    tokenId: string;
+    name: string;
+    status: "active" | "disabled" | "expired";
+    /**
+     * The plaintext token value. Cloudflare returns this only once, on
+     * creation, so we persist it here for downstream consumers (e.g. a
+     * GitHub Actions secret).
+     */
+    value: Redacted.Redacted<string>;
+    accountId: string;
+  },
+  ApiTokenBinding,
+  Providers
+>;
+
+/**
+ * A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
+ *
+ * Account-owned tokens are managed at the account level and persist
+ * independently of any single user. Use these for CI tokens, third-party
+ * integrations, or anywhere the token should outlive an individual user's
+ * session.
+ *
+ * Creating account-owned tokens requires the caller to have the
+ * `API Tokens > Write` account permission.
+ *
+ * @section Creating a Token
+ * @example A token for managing Workers and KV from CI
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("ci-token", {
+ *   name: "my-ci-token",
+ *   accountId,
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: [
+ *         "Workers Scripts Write",
+ *         "Workers KV Storage Write",
+ *       ],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ *
+ * yield* GitHub.Secret("cf-api-token", {
+ *   owner: "me",
+ *   repository: "my-repo",
+ *   name: "CLOUDFLARE_API_TOKEN",
+ *   value: token.value,
+ * });
+ * ```
+ *
+ * @section Attaching Policies via Bindings
+ * @example Let a downstream capability contribute its own policies
+ * A token can be created with no `policies` of its own; the policies are
+ * supplied through its binding contract (see {@link ApiTokenBinding}). This is
+ * how capabilities like {@link CreateTunnel} provision a least-privilege token.
+ * ```typescript
+ * const token = yield* Cloudflare.AccountApiToken("scoped-token");
+ *
+ * yield* token.bind("MyCapability", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Cloudflare Tunnel Write"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Exposing a Token to a Worker
+ * @example Read the token value at runtime
+ * Bind the token's outputs in the Worker's Init phase to get runtime
+ * accessors. Binding `token.value` injects it as a `secret_text` Worker
+ * binding; the returned accessor reads it back (as `Redacted`) at runtime.
+ * ```typescript
+ * // init
+ * const value = yield* token.value; // Accessor<Redacted<string>>
+ * const accountId = yield* token.accountId; // Accessor<string>
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const apiToken = yield* value; // Redacted<string>
+ *     // ... call the Cloudflare API with `apiToken`
+ *     return HttpServerResponse.text("ok");
+ *   }),
+ * };
+ * ```
+ */
+export const AccountApiToken = Resource<AccountApiToken>(
+  "Cloudflare.AccountApiToken",
+);
+
+type AccountApiTokenAttributes = AccountApiToken["Attributes"];
+
+const resolveName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+  });
+
+export const AccountApiTokenProvider = () =>
+  Provider.effect(
+    AccountApiToken,
+    Effect.gen(function* () {
+      const { accountId: defaultAccountId } = yield* CloudflareEnvironment;
+      const createToken = yield* accounts.createToken;
+      const updateToken = yield* accounts.updateToken;
+      const deleteToken = yield* accounts.deleteToken;
+      const getToken = yield* accounts.getToken;
+
+      const buildAttributes = (
+        tokenData: {
+          id?: string | null;
+          name?: string | null;
+          // Distilled widened generated string enums to open unions (`string & {}`).
+          status?: string | null;
+        },
+        value: Redacted.Redacted<string>,
+        accountId: string,
+      ): AccountApiTokenAttributes => ({
+        tokenId: tokenData.id ?? "",
+        name: tokenData.name ?? "",
+        status: (tokenData.status ?? "active") as
+          | "active"
+          | "disabled"
+          | "expired",
+        value,
+        accountId,
+      });
+
+      return {
+        stables: ["tokenId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const newAccountId = news.accountId ?? defaultAccountId;
+          const oldAccountId =
+            output?.accountId ?? olds?.accountId ?? defaultAccountId;
+          if (oldAccountId !== newAccountId) {
+            return { action: "replace" } as const;
+          }
+          const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+          const newName = yield* resolveName(id, news.name);
+          const oldPolicyFp = policyFingerprint(
+            resolvePolicies(olds?.policies ?? []),
+          );
+          const newPolicyFp = policyFingerprint(
+            resolvePolicies(news.policies ?? []),
+          );
+          const oldCondFp = conditionFingerprint(olds?.condition);
+          const newCondFp = conditionFingerprint(news.condition);
+          if (
+            oldName !== newName ||
+            oldPolicyFp !== newPolicyFp ||
+            oldCondFp !== newCondFp ||
+            (olds?.expiresOn ?? undefined) !== (news.expiresOn ?? undefined) ||
+            (olds?.notBefore ?? undefined) !== (news.notBefore ?? undefined)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output, bindings }) {
+          const accountId = news.accountId ?? defaultAccountId;
+          const name = yield* resolveName(id, news.name);
+          const collected = collectPolicies(news.policies, bindings);
+          if (collected.length === 0) {
+            return yield* Effect.die(
+              `Cloudflare requires at least one policy on token "${name}". ` +
+                "Pass `policies` or attach them via a binding.",
+            );
+          }
+          const policies = resolvePolicies(collected);
+
+          // Observe — fetch current state if we already know the token id.
+          // Cloudflare reports a deleted token as `InvalidRoute` or
+          // `TokenNotFound`; both mean "create from scratch".
+          const observed = output?.tokenId
+            ? yield* getToken({
+                accountId: output.accountId,
+                tokenId: output.tokenId,
+              }).pipe(
+                Effect.map((token) => token),
+                Effect.catchTag("InvalidRoute", () =>
+                  Effect.succeed(undefined),
+                ),
+                Effect.catchTag("TokenNotFound", () =>
+                  Effect.succeed(undefined),
+                ),
+              )
+            : undefined;
+
+          // Ensure — create if missing. Cloudflare returns the plaintext
+          // token value exactly once on create, so we must persist it for
+          // downstream consumers. There is no idempotency token here; if
+          // a stale write produced an orphan we accept the duplicate over
+          // the alternative of losing the secret value.
+          if (observed === undefined) {
+            const result = yield* createToken({
+              accountId,
+              name,
+              policies,
+              condition: buildConditionPayload(news.condition),
+              expiresOn: news.expiresOn,
+              notBefore: news.notBefore,
+            });
+            if (!result.value) {
+              return yield* Effect.die(
+                `Cloudflare did not return a value for token "${name}".`,
+              );
+            }
+            return buildAttributes(
+              result,
+              Redacted.make(result.value),
+              accountId,
+            );
+          }
+
+          // Sync — the update API replaces all mutable fields (name,
+          // policies, condition, validity window). Cloudflare does not
+          // return the plaintext value on update, so we preserve the one
+          // captured at creation.
+          const result = yield* updateToken({
+            accountId,
+            tokenId: output!.tokenId,
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          return buildAttributes(result, output!.value, accountId);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteToken({
+            accountId: output.accountId,
+            tokenId: output.tokenId,
+          }).pipe(
+            // Already gone — Cloudflare may report this as either an
+            // `InvalidRoute` (token-id no longer routable) or a generic
+            // `TokenNotFound`. Either is fine; we just want the resource gone.
+            Effect.catchTag("InvalidRoute", () => Effect.void),
+            Effect.catchTag("TokenNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.tokenId) return undefined;
+          return yield* getToken({
+            accountId: output.accountId,
+            tokenId: output.tokenId,
+          }).pipe(
+            Effect.map((token) =>
+              buildAttributes(token, output.value, output.accountId),
+            ),
+            Effect.catchTag("InvalidRoute", () => Effect.succeed(undefined)),
+            Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/Common.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/Common.ts
new file mode 100644
index 00000000000..e24fff4ea84
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/Common.ts
@@ -0,0 +1,178 @@
+import {
+  PERMISSION_GROUPS_BY_NAME,
+  type PermissionGroupName,
+} from "./PermissionGroups.ts";
+
+/**
+ * Resource keys recognized by Cloudflare API token policies.
+ *
+ * Cloudflare requires the account ID to be embedded directly in the resource
+ * key (e.g. `com.cloudflare.api.account.<accountId>`); pass the fully-qualified
+ * key — no rewriting is performed.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/api/reference/permissions/
+ */
+export type ApiTokenResourceKey =
+  | `com.cloudflare.api.account.${string}`
+  | `com.cloudflare.api.account.zone.${string}`
+  | `com.cloudflare.edge.r2.bucket.${string}`
+  | (string & {});
+
+/**
+ * A permission group reference: either a typed Cloudflare permission-group
+ * name (resolved against the static catalog) or an explicit `{ id }` for
+ * names that aren't in the catalog or have multiple scopes.
+ */
+export type ApiTokenPermissionGroupRef =
+  | PermissionGroupName
+  | { id: string; meta?: { key?: string; value?: string } };
+
+/**
+ * Value of a resource entry in an {@link ApiTokenPolicy}. Usually `"*"`, but
+ * account-owned tokens must nest zone resources under the account resource —
+ * e.g. `{ "com.cloudflare.api.account.<id>": { "com.cloudflare.api.account.zone.*": "*" } }`
+ * — so a nested object is also allowed.
+ */
+export type ApiTokenResourceScope =
+  | string
+  | { [K in ApiTokenResourceKey]?: string };
+
+export interface ApiTokenPolicy {
+  effect: "allow" | "deny";
+  permissionGroups: ApiTokenPermissionGroupRef[];
+  resources: { [K in ApiTokenResourceKey]?: ApiTokenResourceScope };
+}
+
+export interface ApiTokenCondition {
+  requestIp?: {
+    in?: string[];
+    notIn?: string[];
+  };
+}
+
+export type ApiTokenProps = {
+  /**
+   * Token name. Defaults to a generated physical name based on the
+   * resource's logical id, app name, and stage.
+   */
+  name?: string;
+  /**
+   * The Cloudflare account ID that owns this token. Defaults to the
+   * account ID resolved from the ambient {@link CloudflareEnvironment}.
+   */
+  accountId?: string;
+  /**
+   * Access policies attached to the token. Cloudflare requires at least one
+   * policy on a token; if you omit `policies` here, the policies must instead
+   * be contributed by bindings (see {@link ApiTokenBinding}).
+   */
+  policies?: ApiTokenPolicy[];
+  /** ISO 8601 expiration timestamp. */
+  expiresOn?: string;
+  /** ISO 8601 "not before" timestamp. */
+  notBefore?: string;
+  /** Optional usage conditions (e.g. IP allowlist). */
+  condition?: ApiTokenCondition;
+};
+
+/**
+ * Binding contract for {@link AccountApiToken} / {@link UserApiToken}.
+ *
+ * A binding contributes additional access policies to the token. This lets a
+ * downstream resource (e.g. a runtime capability that needs to call a specific
+ * Cloudflare API) create a token and attach exactly the policies it requires,
+ * without the token's owner having to enumerate them up front.
+ *
+ * Binding-contributed policies are merged with any `policies` passed directly
+ * as props; the union must contain at least one policy.
+ */
+export type ApiTokenBinding = {
+  /** Access policies to attach to the token. */
+  policies?: ApiTokenPolicy[];
+};
+
+/**
+ * Collect the policies a token should be created with: those passed directly
+ * as props, plus those contributed by bindings.
+ */
+export const collectPolicies = (
+  props: ApiTokenPolicy[] | undefined,
+  bindings: { data: ApiTokenBinding }[],
+): ApiTokenPolicy[] => [
+  ...(props ?? []),
+  ...bindings.flatMap((binding) => binding.data.policies ?? []),
+];
+
+export type ResolvedPolicy = {
+  effect: "allow" | "deny";
+  permissionGroups: { id: string; meta?: { key?: string; value?: string } }[];
+  resources: Record<string, unknown>;
+};
+
+export const resolvePermissionGroup = (ref: ApiTokenPermissionGroupRef) => {
+  if (typeof ref === "string") {
+    const group = PERMISSION_GROUPS_BY_NAME[ref];
+    if (!group) {
+      // Should be unreachable due to the typed union, but guard anyway in
+      // case Cloudflare retires a name we still have in the catalog.
+      throw new Error(
+        `Unknown Cloudflare permission group: "${ref}". Pass an explicit { id } instead.`,
+      );
+    }
+    return { id: group.id };
+  }
+  return ref.meta ? { id: ref.id, meta: ref.meta } : { id: ref.id };
+};
+
+const resolveResources = (
+  resources: ApiTokenPolicy["resources"],
+): Record<string, ApiTokenResourceScope> => {
+  const out: Record<string, ApiTokenResourceScope> = {};
+  for (const [key, value] of Object.entries(resources)) {
+    if (value === undefined) continue;
+    out[key] = value;
+  }
+  return out;
+};
+
+export const resolvePolicies = (policies: ApiTokenPolicy[]): ResolvedPolicy[] =>
+  policies.map((policy) => ({
+    effect: policy.effect,
+    permissionGroups: policy.permissionGroups.map(resolvePermissionGroup),
+    resources: resolveResources(policy.resources),
+  }));
+
+export const policyFingerprint = (policies: ResolvedPolicy[]): string =>
+  JSON.stringify(
+    policies.map((p) => ({
+      effect: p.effect,
+      permissionGroups: [...p.permissionGroups]
+        .map((g) => ({ id: g.id, meta: g.meta ?? null }))
+        .sort((a, b) => a.id.localeCompare(b.id)),
+      resources: Object.keys(p.resources)
+        .sort()
+        .map((k) => [k, p.resources[k]]),
+    })),
+  );
+
+export const conditionFingerprint = (
+  condition: ApiTokenCondition | undefined,
+): string =>
+  JSON.stringify({
+    in: [...(condition?.requestIp?.in ?? [])].sort(),
+    notIn: [...(condition?.requestIp?.notIn ?? [])].sort(),
+  });
+
+export const buildConditionPayload = (
+  condition: ApiTokenCondition | undefined,
+) =>
+  condition
+    ? {
+        requestIp: condition.requestIp
+          ? {
+              in: condition.requestIp.in,
+              notIn: condition.requestIp.notIn,
+            }
+          : undefined,
+      }
+    : undefined;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/PermissionGroups.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/PermissionGroups.ts
new file mode 100644
index 00000000000..1927eb39bac
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/PermissionGroups.ts
@@ -0,0 +1,1910 @@
+/**
+ * Static catalog of Cloudflare API token permission groups, copied from the
+ * upstream `alchemy` repo so we can offer typed permission-group names without
+ * a network round-trip on every token create/update.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/api/reference/permissions/
+ */
+
+export interface PermissionGroup {
+  id: string;
+  name: string;
+  description: string;
+  scopes: readonly string[];
+}
+
+export const PERMISSION_GROUPS = [
+  {
+    id: "19637fbb73d242c0a92845d8db0b95b1",
+    name: "AI Audit Read",
+    description: "Grants access to reading AI Audit",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "1ba6ab4cacdb454b913bbb93e1b8cb8c",
+    name: "AI Audit Write",
+    description: "Grants access to reading and editing AI Audit",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "4dc8917b4b40457d88d3035d5dadb054",
+    name: "AI Gateway Read",
+    description: "Grants access to reading AI Gateways",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "9e9b428a0bcd46fd80e580b46a69963c",
+    name: "AI Search Index Engine",
+    description: "Grants access to run AI Search Index Engine",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "644535f4ed854494a59cb289d634b257",
+    name: "AI Gateway Run",
+    description: "Grants access to run AI Gateways",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6c8a3737f07f46369c1ea1f22138daaf",
+    name: "AI Gateway Write",
+    description: "Grants access to reading and editing AI Gateways",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "eb258a38ea634c86a0c89da6b27cb6b6",
+    name: "Access: Apps and Policies Read",
+    description: "Grants read access to Cloudflare Access zone resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "7ea222f6d5064cfa89ea366d7c1fee89",
+    name: "Access: Apps and Policies Read",
+    description:
+      "Grants read access to Cloudflare Access applications and policies",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6db4e222e21248ac96a3f4c2a81e3b41",
+    name: "Access: Apps and Policies Revoke",
+    description:
+      "Grants ability to revoke all tokens to Cloudflare Access zone resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "6c9d1cfcfc6840a987d1b5bfb880a841",
+    name: "Access: Apps and Policies Revoke",
+    description:
+      "Grants ability to revoke Cloudflare Access application tokens",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "959972745952452f8be2452be8cbb9f2",
+    name: "Access: Apps and Policies Write",
+    description: "Grants write access to Cloudflare Access zone resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "1e13c5124ca64b72b1969a67e8829049",
+    name: "Access: Apps and Policies Write",
+    description:
+      "Grants write access to Cloudflare Access applications and policies",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b05b28e839c54467a7d6cba5d3abb5a3",
+    name: "Access: Audit Logs Read",
+    description: "Grants read access to Cloudflare Access audit logs",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "08e61dabe81a422dab0dea6fdef1a98a",
+    name: "Access: Custom Pages Read",
+    description: "Grants read access to Cloudflare Access Custom Pages",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4e5fd8ac327b4a358e48c66fcbeb856d",
+    name: "Access: Custom Pages Write",
+    description: "Grants write access to Cloudflare Access Custom Pages",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0f4841f80adb4bada5a09493300e7f8d",
+    name: "Access: Device Posture Read",
+    description: "Grants read access to Cloudflare Access Device Posture",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "2fc1072ee6b743828db668fcb3f9dee7",
+    name: "Access: Device Posture Write",
+    description: "Grants write access to Cloudflare Access Device Posture",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4f3196a5c95747b6ad82e34e1d0a694f",
+    name: "Access: Mutual TLS Certificates Read",
+    description: "Grants read access to Cloudflare Access mTLS certificates",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "29d3afbfd4054af9accdd1118815ed05",
+    name: "Access: Mutual TLS Certificates Write",
+    description: "Grants write access to Cloudflare Access mTLS certificates",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "26bc23f853634eb4bff59983b9064fde",
+    name: "Access: Organizations, Identity Providers, and Groups Read",
+    description: "Grants read access to Cloudflare Access account resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7121a0c7e9ed46e3829f9cca2bb572aa",
+    name: "Access: Organizations, Identity Providers, and Groups Revoke",
+    description:
+      "Grants ability to revoke user sessions to Cloudflare Access account resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "bfe0d8686a584fa680f4c53b5eb0de6d",
+    name: "Access: Organizations, Identity Providers, and Groups Write",
+    description: "Grants write access to Cloudflare Access account resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b8b7514ce5364cd8ac0455f3eb16eb5f",
+    name: "Access: Policy Test Read",
+    description: "Grants read access to Cloudflare Access Policy Tests",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6d23f290472f4e6fad5c4398c057c356",
+    name: "Access: Policy Test Write",
+    description: "Grants full access to Cloudflare Access Policy Tests",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "de99c87e48d642ce8c985d027905b475",
+    name: "Access: Population Read",
+    description: "Grants read access to Cloudflare Access Populations",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "bc783549a3a741aaa10556faf8b485bb",
+    name: "Access: Population Write",
+    description: "Grants write access to Cloudflare Access Populations",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e985ca9351db460faebbe8681c48e560",
+    name: "Access: SCIM logs read",
+    description: "Grants read access to SCIM audit logs",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "99ff99e4e30247a99d3777a8c4c18541",
+    name: "Access: SSH Auditing Read",
+    description:
+      "Grants read access to Cloudflare Access SSH certificate authorities (CAs)",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "d30c9ad8b5224e7cb8d41bcb4757effc",
+    name: "Access: SSH Auditing Write",
+    description:
+      "Grants write access to Cloudflare Access SSH certificate authorities (CAs)",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "91f7ce32fa614d73b7e1fc8f0e78582b",
+    name: "Access: Service Tokens Read",
+    description: "Grants read access to Cloudflare Access Service Tokens",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a1c0fec57cf94af79479a6d827fa518c",
+    name: "Access: Service Tokens Write",
+    description: "Grants write access to Cloudflare Access Service Tokens",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5e5d3e8efeec49f3afb67bafecbcd511",
+    name: "Account API Gateway",
+    description:
+      "Grants full access to API-Gateway Management (including API Shield) across the whole account",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "05a2a65760a546439ed29762b163cece",
+    name: "Account API Gateway Read",
+    description:
+      "Grants read access to API-Gateway Management (including API Shield) across the whole account",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "eb56a6953c034b9d97dd838155666f06",
+    name: "Account API Tokens Read",
+    description: "Grants read access to account API Tokens",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5bc3f8b21c554832afc660159ab75fa4",
+    name: "Account API Tokens Write",
+    description: "Grants write access to account API Tokens",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b89a480218d04ceb98b4fe57ca29dc1f",
+    name: "Account Analytics Read",
+    description: "Grants read access to analytics",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c57ea647ef654b47bc8944fa739b570d",
+    name: "Account Custom Pages Read",
+    description: "Grants read access to account custom pages",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "8a9d35a7c8504208ad5c3e8d58e6162d",
+    name: "Account Custom Pages Write",
+    description: "Grants write access to account custom pages",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cfa964bcdafc4ab39704e7476154e41b",
+    name: "Account DNS Settings Read",
+    description: "Grants read access to Account DNS Settings",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "dc44f27f48ab405392a5f69fe822bd01",
+    name: "Account DNS Settings Write",
+    description: "Grants write access to Account DNS Settings",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "de7a688cc47d43bd9ea700b467a09c96",
+    name: "Account Firewall Access Rules Read",
+    description: "Grants read access to account firewall access rules",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a416acf9ef5a4af19fb11ed3b96b1fe6",
+    name: "Account Firewall Access Rules Write",
+    description: "Grants write access to account firewall access rules",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4f1071168de8466e9808de86febfc516",
+    name: "Account Rule Lists Read",
+    description: "Grants read access to Rule Lists",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "2edbf20661fd4661b0fe10e9e12f485c",
+    name: "Account Rule Lists Write",
+    description: "Grants write access to Rule Lists",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "fb39996ee9044d2a8725921e02744b39",
+    name: "Account Rulesets Read",
+    description: "Grants read access to Account Rulesets",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "56907406c3d548ed902070ec4df0e328",
+    name: "Account Rulesets Write",
+    description: "Grants write access to Account Rulesets",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "ece81d7757ff406cad61f221a4920d55",
+    name: "Account Security Center Insights Read",
+    description: "Grants read access to Security Center Insights",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cfa2e2893226455c9b945914969dff7c",
+    name: "Account Security Center Insights Write",
+    description: "Grants write access to Security Center Insights",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c1fde68c7bcc44588cbb6ddbc16d6480",
+    name: "Account Settings Read",
+    description:
+      "Grants read access to Account resources, account membership, and account level features",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "1af1fa2adc104452b74a9a3364202f20",
+    name: "Account Settings Write",
+    description:
+      "Grants write access to Account resources, account membership, and account level features",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "56b2af4817c84ad99187911dc3986c23",
+    name: "Account WAF Read",
+    description: "Grants read access to Account WAF",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cde8c82463b6414ca06e46b9633f52a6",
+    name: "Account WAF Write",
+    description: "grants write access to account waf",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3e4e20ee40b9475dae22201c468fdb70",
+    name: "Account Waiting Rooms Read",
+    description: "Grants read access to Waiting Rooms\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a7a233f9604845c787d4c8c39ac09c21",
+    name: "Account: SSL and Certificates Read",
+    description:
+      "Grants read access to SSL MTLS certificates or Certificate Store",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "db37e5f1cb1a4e1aabaef8deaea43575",
+    name: "Account: SSL and Certificates Write",
+    description:
+      "Grants read and write access to SSL MTLS certificates or Certificate Store",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "d07270cea5484b08ad6440c985af2148",
+    name: "Address Maps Read",
+    description: "Grants read access to Address Maps",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6ffe7f4299db4d4cb54f64e0eb12a456",
+    name: "Address Maps Write",
+    description: "Grants write access to Address Maps",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "151803815e4f47de854c2fb7f8284d57",
+    name: "Agents Gateway Read",
+    description: "Grants access to reading Agents Gateway",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "82748b814dcd46b9b3e66b8151ba5e95",
+    name: "Agents Gateway Run",
+    description: "Grants access to running Agents Gateway",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e84fd345697c4036a14e7810da036e1a",
+    name: "Agents Gateway Write",
+    description: "Grants access to reading and editing Agents Gateway",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "f3604047d46144d2a3e9cf4ac99d7f16",
+    name: "Allow Request Tracer Read",
+    description: "Allows read access to request tracer API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "9c88f9c5bce24ce7af9a958ba9c504db",
+    name: "Analytics Read",
+    description: "Grants read access to analytics",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "d79c5e2a405b4516a322432287d40c31",
+    name: "Application Security Reports Read",
+    description: "Can read Application Security Reports",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "094547ab6e77498c8c4dfa87fadd5c51",
+    name: "Apps Write",
+    description: "Grants full access to Cloudflare Apps",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "d7887c7a417e4cf2a69f1d01c1a1dc3b",
+    name: "Auto Rag Read",
+    description: "Grants access to reading data from Auto Rag",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7fb8d27511b34d02994d005b520b679f",
+    name: "Auto Rag Write",
+    description: "Grants access to reading and writing data from Auto Rag",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "234108c786084936a381bb19b7f4ea65",
+    name: "Auto Rag Write Run Engine",
+    description: "Grants access to run Auto RAG engine",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7cf72faf220841aabcfdfab81c43c4f6",
+    name: "Billing Read",
+    description:
+      "Grants read access to billing profile, subscriptions, usage data and access to fetch invoices and entitlements",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6c80e02421494afc9ae14414ed442632",
+    name: "Billing Write",
+    description:
+      "Grants write access to billing profile, subscriptions, and access to fetch invoices and entitlements",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "51be404b56244056868226263a44a632",
+    name: "Bot Management Feedback Report Read",
+    description: "Grants read access to BOT Management Feedback Reports",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "2002629aaff0454085bf5a201ed70a72",
+    name: "Bot Management Feedback Report Write",
+    description: "Grants write access to BOT Management Feedback Reports",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "07bea2220b2343fa9fae15656c0d8e88",
+    name: "Bot Management Read",
+    description: "Grants read access to BOT Management",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "3b94c49258ec4573b06d51d99b6416c0",
+    name: "Bot Management Write",
+    description: "Grants write access to BOT Management",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "374b03fa229f4eb6b011bb1cd7f235ee",
+    name: "Browser Rendering Read",
+    description: "Grants read access to Browser Rendering API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "adddda876faa4a0590f1b23a038976e4",
+    name: "Browser Rendering Write",
+    description: "Grants write access to Browser Rendering API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "da5fe84b9c5446a0a5955b673fafa288",
+    name: "CASB Read",
+    description: "Grants read access to Cloudflare CASB",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b9ed086b20864ad89c5aac24cdd02365",
+    name: "CASB Write",
+    description: "Grants write access to Cloudflare CASB",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "47b936e2027140c0a474cac8887b8c29",
+    name: "CF Agents Read",
+    description: "Grants read access to CF Agents",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cb142f7fbc3540f0bade0cbe75f606dc",
+    name: "CF Agents Write",
+    description: "Grants write access to CF Agents",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e17beae8b8cb423a99b1730f21238bed",
+    name: "Cache Purge",
+    description: "Grants access to purge cache",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "3245da1cf36c45c3847bb9b483c62f97",
+    name: "Cache Settings Read",
+    description: "Grants read access to cache settings phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "9ff81cbbe65c400b97d92c3c1033cab6",
+    name: "Cache Settings Write",
+    description: "Grants write access to cache settings phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "686ab9a8b3854f25a1474f302d14b68d",
+    name: "Calls Read",
+    description: "Grants read access to Calls configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b711942448db4b0aace44d1312f9fdb0",
+    name: "Calls Write",
+    description: "Grants read/write access to Calls configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "9ade9cfc8f8949bcb2371be2f0ec8db1",
+    name: "China Network Steering Read",
+    description: "Grants read access to China Network Steering",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c6f6338ceae545d0b90daaa1fed855e6",
+    name: "China Network Steering Write",
+    description: "Grants write access to China Network Steering",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0661ff47aa3a4786beab3b8128e0cd24",
+    name: "Cloud Connector Read",
+    description: "Grants read access to Cloud Connector",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "eafd71286d0e4fdca404a7b4d203c5c9",
+    name: "Cloud Connector Write",
+    description: "Grants write access to Cloud Connector",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "9e5a9912439940fca5898b5b8dc6d1a5",
+    name: "Cloud Email Security: Read",
+    description: "Grants read access to Cloudflare Cloud Email Security",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a3567c13e074447fb101babac3463566",
+    name: "Cloud Email Security: Write",
+    description: "Grants write access to Cloudflare Cloud Email Security",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "65ec50cbde3d4c838bbe7500024d5745",
+    name: "Cloudchamber Read",
+    description: "Grants read access to Cloudchamber deployments",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "26ce6c7d18a346528e7b905d5e269866",
+    name: "Cloudchamber Write",
+    description: "Grants write access to Cloudchamber deployments",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "00ec19a0d4fa4e4aae23b50bf04c0630",
+    name: "Cloudflare CDS Compute Account Read",
+    description:
+      "Grants read access to Cloudflare CDS compute account resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "9bf884ba0de445dab37ea4a3e1a2c9f1",
+    name: "Cloudflare CDS Compute Account Write",
+    description:
+      "Grants write access to Cloudflare CDS compute account resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3a1e1ef09dd34271bb44fc4c6a419952",
+    name: "Cloudflare DEX",
+    description: "Grants access to Cloudflare DEX",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3b376e0aa52c41cbb6afc9cab945afa8",
+    name: "Cloudflare DEX Read",
+    description: "Grants read access to Cloudflare DEX",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "92c8dcd551cc42a6a57a54e8f8d3f3e3",
+    name: "Cloudflare DEX Write",
+    description: "Grants full access to Cloudflare DEX",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "1cd960c063a0448481343372c963d8c7",
+    name: "Cloudflare One Connector: WARP Read",
+    description: "Grants read access to WARP Connectors",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5b5c774a5d174ca88d046c8889648b3f",
+    name: "Cloudflare One Connector: WARP Write",
+    description: "Grants write access to WARP Connectors",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c1968d31028d4239976ec3bc4750bbf6",
+    name: "Cloudflare One Connector: cloudflared Read",
+    description: "Grants read access to cloudflared connectors",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "037b9e348b3b42d4b46ea2fcb1cfb3e7",
+    name: "Cloudflare One Connector: cloudflared Write",
+    description: "Grants write access to cloudflared connectors",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "07cf1c1952a84b13b2cd542f3d2f29ab",
+    name: "Cloudflare One Connectors Read",
+    description: "Grants read access to Cloudflare One connectors",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a7030c9c98d544e092d8b099fabb1f06",
+    name: "Cloudflare One Connectors Write",
+    description: "Grants write access to Cloudflare One connectors",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4f1276d1e7e34c32a5012bbe02ece86d",
+    name: "Cloudflare One Networks Read",
+    description:
+      "Grants read access to Cloudflare One routes, subnets, and virtual networks",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e2980d9241cf4939bbbd74fdc43b9651",
+    name: "Cloudflare One Networks Write",
+    description:
+      "Grants write access to Cloudflare One routes, subnets, and virtual networks",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "efea2ab8357b47888938f101ae5e053f",
+    name: "Cloudflare Tunnel Read",
+    description: "Grants access to view Cloudflare Tunnels",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c07321b023e944ff818fec44d8203567",
+    name: "Cloudflare Tunnel Write",
+    description: "Grants access to create and delete Cloudflare Tunnels",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e0e0edfbe8834df3b51424ba4fb7bb5f",
+    name: "Cloudflare Zero Trust Secure DNS Locations Write",
+    description:
+      "Grants access to create and edit secure DNS Locations only in teams (Zero Trust)",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cf9353ed7978436e8fb20c03fce26449",
+    name: "Cloudforce One Read",
+    description: "Grants read access to Cloudforce One",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "677767156f294485b497a8f103172e7d",
+    name: "Cloudforce One Write",
+    description: "Grants read access to Cloudforce One",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "20e5ea084b2f491c86b8d8d90abff905",
+    name: "Config Settings Read",
+    description: "Grants read access to config settings phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "06f0526e6e464647bd61b63c54935235",
+    name: "Config Settings Write",
+    description: "Grants write access to config settings phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "77efc2c0724d4c4eb94bfd9656247130",
+    name: "Connectivity Directory Admin",
+    description:
+      "Can view, edit, create, and delete Connectivity Directory Services, including the ability to create Services that bind to Cloudflare Tunnel",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "95fa65ba51fd49c4a6ac4c8c78ebac93",
+    name: "Connectivity Directory Bind",
+    description:
+      "Can read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "8764961c1edb4274be129d630b0b2671",
+    name: "Connectivity Directory Read",
+    description:
+      "Can view Connectivity Directory services and Cloudflare Tunnels",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "eeffa4d16812430cb4a0ae9e7f46fc24",
+    name: "Constellation Read",
+    description: "Grants read access to Constellation configuration and models",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7c81856725af47ce89a790d5fb36f362",
+    name: "Constellation Write",
+    description:
+      "Grants write access to Constellation configuration and models",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a2b55cd504d44ef18b7ba6a7f2b8fbb1",
+    name: "Custom Errors Read",
+    description: "Grants read access to custom errors phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "a9dba34cf5814d4ab2007b4ada0045bd",
+    name: "Custom Errors Write",
+    description: "Grants write access to custom errors phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "a2431ca73b7d41f99c53303027392586",
+    name: "Custom Pages Read",
+    description: "Grants read access to custom pages",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "c244ec076974430a88bda1cdd992d0d9",
+    name: "Custom Pages Write",
+    description: "Grants write access to custom pages",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "192192df92ee43ac90f2aeeffce67e35",
+    name: "D1 Read",
+    description: "Grants read access to D1 configuration and SQL queries",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "09b2857d1c31407795e75e3fed8617a1",
+    name: "D1 Write",
+    description: "Grants write access to D1 configuration and SQL queries",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "dee7c22a57674abea8f942110b094717",
+    name: "DDoS Botnet Feed Read",
+    description: "Grants read access to Botnet Feed reports",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0caa90c9b186447397c8b00358d34a76",
+    name: "DDoS Botnet Feed Write",
+    description: "Grants write access to Botnet Feed configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "af1c363c35ba45b9a8c682ae50eb3f99",
+    name: "DDoS Protection Read",
+    description: "Grants read access to DDoS protection",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "d44ed14bcc4340b194d3824d60edad3f",
+    name: "DDoS Protection Write",
+    description: "Grants write access to DDoS protection",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5f48a472240a4b489a21d43bd19a06e1",
+    name: "DNS Firewall Read",
+    description: "Grants read access to DNS Firewall",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "da6d2d6f2ec8442eaadda60d13f42bca",
+    name: "DNS Firewall Write",
+    description: "Grants write access to DNS Firewall",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "82e64a83756745bbbb1c9c2701bf816b",
+    name: "DNS Read",
+    description: "Grants read access to DNS",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "95d69e8d6d5144bfb0923667355d9f11",
+    name: "DNS View Read",
+    description: "Grants read access to DNS Views",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5b7aedd821a548b9bf5a2acabbce98c7",
+    name: "DNS View Write",
+    description: "Grants write access to DNS Views",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4755a26eedb94da69e1066d98aa820be",
+    name: "DNS Write",
+    description: "Grants write access to DNS",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "e199d584e69344eba202452019deafe3",
+    name: "Disable ESC Read",
+    description: "Grants read access to Cloudflare Disable ESC",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "29eefa0805f94fdfae2b058b5b52f319",
+    name: "Disable ESC Read",
+    description: "Grants read access to Cloudflare Disable ESC",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "9110d9dd749e464fb9f3961a2064efc5",
+    name: "Disable ESC Write",
+    description: "Grants write access to Cloudflare Disable ESC",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "18555e39c5ba40d284dde87eda845a90",
+    name: "Disable ESC Write",
+    description: "Grants write access to Cloudflare Disable ESC",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "f0235726de25444a84f704b7c93afadf",
+    name: "Domain API Gateway",
+    description:
+      "Grants full access to API-Gateway Management (including API Shield)",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "6ced5d0d69b1422396909a62c38ab41b",
+    name: "Domain API Gateway Read",
+    description:
+      "Grants read access to API-Gateway Management (including API Shield)",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "6134079371904d8ebd77931c8ca07e50",
+    name: "Domain Page Shield",
+    description: "Grants write access to Page Shield",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "945315185a8f40518bf3e9e6d0bee126",
+    name: "Domain Page Shield Read",
+    description: "Grants read access to Page Shield",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "d8e12db741544d1586ec1d6f5d3c7786",
+    name: "Dynamic URL Redirects Read",
+    description: "Grants read access to Dynamic URL Redirect",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "74e1036f577a48528b78d2413b40538d",
+    name: "Dynamic URL Redirects Write",
+    description: "Grants write access to Dynamic URL Redirect",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "5272e56105d04b5897466995b9bd4643",
+    name: "Email Routing Addresses Read",
+    description: "Grants read access to Email Routing target addresses\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e4589eb09e63436686cd64252a3aebeb",
+    name: "Email Routing Addresses Write",
+    description: "Grants full access to Email Routing target addresses\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "1b600d9d8062443e986a973f097e728a",
+    name: "Email Routing Rules Read",
+    description: "Grants read access to Email Routing rules\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "79b3ec0d10ce4148a8f8bdc0cc5f97f2",
+    name: "Email Routing Rules Write",
+    description: "Grants full access to Email Routing rules\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "1047880d37b649b49db4a504a245896f",
+    name: "Email Security DMARC Reports Read",
+    description: "Grants read access to Email Security dmarc reports\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "2eee71c9364c4cacaf469e8370f09056",
+    name: "Email Security DMARC Reports Write",
+    description: "Grants full access to Email Security dmarc reports\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "2d5b4b1f6c89487bb7184c2c1dcd3bf1",
+    name: "Email Sending Read",
+    description: "Grants access to reading data from Email Sending",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5df633d6b41c42bcaf5b4a62b9d14b64",
+    name: "Email Sending Write",
+    description: "Grants access to reading and writing data from Email Sending",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4ec32dfcb35641c5bb32d5ef1ab963b4",
+    name: "Firewall Services Read",
+    description: "Grants read access to Firewall resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "43137f8d07884d3198dc0ee77ca6e79b",
+    name: "Firewall Services Write",
+    description: "Grants write access to Firewall resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "a2c61201f92a4e06a901f156795388a9",
+    name: "Firewall for AI Read",
+    description: "Grants read access to Firewall for AI settings.",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "5af6a2f284144e95a89840408439adef",
+    name: "Firewall for AI Write",
+    description: "Grants full access to Firewall for AI settings.",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "0d24e472a9654642a97df736e8b0d980",
+    name: "Fraud Detection Read",
+    description: "Grants read access to Fraud Detection",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "685f9605fd4e44ec937b6a0db658e629",
+    name: "Fraud Detection Write",
+    description: "Grants write access to Fraud Detection",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "6b60a5a87cae475da7e76e77e4209dd5",
+    name: "HTTP Applications Read",
+    description: "Grants read-only access to HTTP Applications",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4736c02a9f224c8196ae5b127beae78c",
+    name: "HTTP Applications Write",
+    description: "Grants full access to HTTP Applications",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c49f8d15f9f44885a544d945ef5aa6ae",
+    name: "HTTP DDoS Managed Ruleset Read",
+    description: "Grants read access to HTTP DDoS Managed Ruleset",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "b88a3aa889474524bccea5cf18f122bf",
+    name: "HTTP DDoS Managed Ruleset Write",
+    description: "Grants write access to HTTP DDoS Managed Ruleset",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "fac65912d42144aa86b7dd33281bf79e",
+    name: "Health Checks Read",
+    description: "Grants read access to Health Checks",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "e0dc25a0fbdf4286b1ea100e3256b0e3",
+    name: "Health Checks Write",
+    description: "Grants write access to Health Checks",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "4d62ccf834df44808bc9283d65c4e4e9",
+    name: "Hyperdrive Read",
+    description: "Grants read access to Hyperdrive configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "721b2f51fba74871bd361de65aeb7e03",
+    name: "Hyperdrive Write",
+    description: "Grants write access to Hyperdrive configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "212c9ff247b9406d990c017482afb3a5",
+    name: "IOT Read",
+    description: "Grants read access to IOT devices",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "865ebd55bc6d4b109de6813eccfefd13",
+    name: "IOT Write",
+    description: "Grants full access to IOT devices",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e763fae6ee95443b8f56f19213c5f2a5",
+    name: "IP Prefixes: BGP On Demand Read",
+    description: "Grants access to read ip prefix bgp configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "2ae23e4939d54074b7d252d27ce75a77",
+    name: "IP Prefixes: BGP On Demand Write",
+    description: "Grants access to read and change ip prefix bgp configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "27beb7f8333b41e2b946f0e23cd8091e",
+    name: "IP Prefixes: Read",
+    description: "Grants access to read ip prefix settings",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "92b8234e99f64e05bbbc59e1dc0f76b6",
+    name: "IP Prefixes: Write",
+    description: "Grants access to read/write ip prefix settings",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0cf6473ad41449e7b7b743d14fc20c60",
+    name: "Images Read",
+    description: "Grants read access to Images",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "618ec6c64a3a42f8b08bdcb147ded4e4",
+    name: "Images Write",
+    description: "Grants write access to upload Images",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c6f97eeee13345db8cc00af0953a42de",
+    name: "Integration Write",
+    description: "Grants write access to integrations",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "df1577df30ee46268f9470952d7b0cdf",
+    name: "Intel Read",
+    description: "Grants read access to Intel API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "92209474242d459690e2cdb1985eaa6c",
+    name: "Intel Write",
+    description: "Grants write access to Intel API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4657621393f94f83b8ef94adba382e48",
+    name: "L4 DDoS Managed Ruleset Read",
+    description: "Grants read access to L4 DDoS Managed Ruleset",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7a4c3574054a4d0ba7c692893ba8bdd4",
+    name: "L4 DDoS Managed Ruleset Write",
+    description: "Grants write access to L4 DDoS Managed Ruleset",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "59059f0c977b44f8b1c18e0aaf91c369",
+    name: "Load Balancers Account Read",
+    description:
+      "Grants read access to account load balancers and associated resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "419ec42810af4659ade77716dbe47bc6",
+    name: "Load Balancers Account Write",
+    description:
+      "Grants write access to account load balancers and associated resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e9a975f628014f1d85b723993116f7d5",
+    name: "Load Balancers Read",
+    description:
+      "Grants read access to load balancers and associated resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "6d7f2f5f5b1d4a0e9081fdc98d432fd1",
+    name: "Load Balancers Write",
+    description:
+      "Grants write access to load balancers and associated resources",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "9d24387c6e8544e2bc4024a03991339f",
+    name: "Load Balancing: Monitors and Pools Read",
+    description: "Grants read access to account level load balancer resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "d2a1802cc9a34e30852f8b33869b2f3c",
+    name: "Load Balancing: Monitors and Pools Write",
+    description: "Grants write access to account level load balancer resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6a315a56f18441e59ed03352369ae956",
+    name: "Logs Read",
+    description: "Grants read access to logs and logpush jobs",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c4a30cd58c5d42619c86a3c36c441e2d",
+    name: "Logs Read",
+    description: "Grants read access to logs and logpush jobs",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "96163bd1b0784f62b3e44ed8c2ab1eb6",
+    name: "Logs Write",
+    description: "Grants write access to logpush jobs",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3e0b5820118e47f3922f7c989e673882",
+    name: "Logs Write",
+    description: "Grants write access to logpush jobs",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "b84a912ebb4a418888fec65f65c8ff3b",
+    name: "MCP Portals Read",
+    description: "Grants access to reading MCP Portals",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "db3d398df73946acb755c05b69edfc30",
+    name: "MCP Portals Write",
+    description: "Grants access to reading and editing MCP Portals",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3a46c728a0a040d5a65cd8e2f3bc6935",
+    name: "Magic Firewall Packet Captures - Read PCAPs API",
+    description: "Grants read access to Packet Captures",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "4ea7d6421801452dbf07cef853a5ef39",
+    name: "Magic Firewall Packet Captures - Write PCAPs API",
+    description: "Grants write access to Packet Captures",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "02b71f12bb0748e9af8126494e181342",
+    name: "Magic Firewall Read",
+    description: "Grants read access to Magic Firewall",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "8bd1dac84d3d43e7bfb43145f010a15c",
+    name: "Magic Firewall Write",
+    description: "Grants write access to Magic Firewall",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "8e6ed1ef6e864ad0ae477ceffa5aa5eb",
+    name: "Magic Network Monitoring Admin",
+    description: "Grants admin access to MNM settings",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "3d85e9514f944bb4912c5871d92e5af5",
+    name: "Magic Network Monitoring Config Read",
+    description: "Grants read access to MNM config and rules",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "09c77baecb6341a2b1ca2c62b658d290",
+    name: "Magic Network Monitoring Config Write",
+    description:
+      "Grants write access to MNM rules and update access to account settings",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "967ecf860a244dd1911a0331a0af582a",
+    name: "Magic Transit Read",
+    description: "Grants read access to Magic Transit",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0bc09a3cd4b54605990df4e307f138e1",
+    name: "Magic Transit Write",
+    description: "Grants write access to Magic Transit",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "17fc856c4ebe49d4bb70f8e4744398cf",
+    name: "Magic WAN Read",
+    description: "Grants read access to Magic WAN",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a1a7389ba7e441dba95852e10970fcc3",
+    name: "Magic WAN Write",
+    description: "Grants write access to Magic WAN",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "319f5059d33a410da0fac4d35a716157",
+    name: "Managed headers Read",
+    description: "Grants read access to managed headers phases",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "0fd9d56bc2da43ad8ea22d610dd8cab1",
+    name: "Managed headers Write",
+    description: "Grants write access to managed headers phases",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "429a068902904c5a9ed9fc267c67da9a",
+    name: "Mass URL Redirects Read",
+    description: "Grants read access to Mass URL Redirect",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "abe78e2276664f4db588c1f675a77486",
+    name: "Mass URL Redirects Write",
+    description: "Grants write access to Mass URL Redirect",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "ce18edbdcebf465e9d6d1d2fc80ffd42",
+    name: "Notifications Read",
+    description: "Grants read access to notifications",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "c3c847c5802d4ce3ba00e3e97b3c8555",
+    name: "Notifications Write",
+    description: "Grants write access to Notifications",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7b32a91ece3140d4b3c2c56f23fc8e35",
+    name: "Origin Read",
+    description: "Grants read access to origin phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "a4308c6855c84eb2873e01b6cc85cbb3",
+    name: "Origin Write",
+    description: "Grants write access to origin phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "b415b70a4fd1412886f164451f20405c",
+    name: "Page Rules Read",
+    description: "Grants read access to Page Rules",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "ed07f6c337da4195b4e72a1fb2c6bcae",
+    name: "Page Rules Write",
+    description: "Grants write access to Page Rules",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "440e6958bcc947329f8d56328d7322ce",
+    name: "Page Shield",
+    description: "Grants write access to Page Shield",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "050531528b044d58bbb71666fef7c07c",
+    name: "Page Shield Read",
+    description: "Grants read access to Page Shield across the whole account",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "87065285ab38463481e72815eefd18c3",
+    name: "Page Shield Write",
+    description: "Grants write access to Page Shield",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "e247aedd66bd41cc9193af0213416666",
+    name: "Pages Read",
+    description: "Grants read access to Cloudflare Pages",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "8d28297797f24fb8a0c332fe0866ec89",
+    name: "Pages Write",
+    description: "Grants write access to Cloudflare Pages",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "14b9cf2f410f4c0c9a16bb10a81c0e0b",
+    name: "Pipelines Read",
+    description: "Grants read access to Cloudflare Pipelines",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5606e7405dc542949d949d59993d321f",
+    name: "Pipelines Send",
+    description: "Grants access to Send Events to Cloudflare Pipelines",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e34111af393449539859485aa5ddd5bd",
+    name: "Pipelines Write",
+    description: "Grants write access to Cloudflare Pipelines",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "fd7f886c75a244389e892c4c3c068292",
+    name: "Pubsub Configuration Read",
+    description: "Grants read access to Pubsub Configurations\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "910b6ecca1c5411bb894e787362d1312",
+    name: "Pubsub Configuration Write",
+    description: "Grants full access to Pubsub Configurations\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "84a7755d54c646ca87cd50682a34bf7c",
+    name: "Queues Read",
+    description: "Grants read access to Cloudflare Queues",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "366f57075ffc42689627bcf8242a1b6d",
+    name: "Queues Write",
+    description: "Grants write access to Cloudflare Queues",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "dfe525ec7b07472c827d8d009178b2ac",
+    name: "Radar Read",
+    description: "Grants access to reading Radar",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "de62b15d79cc4d8d9c7b443c656eadbd",
+    name: "Realtime",
+    description:
+      "Grants access to Realtime configuration excluding sensitive data",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "ba6ce7d23a9544ccad0816691ba38e21",
+    name: "Realtime Admin",
+    description: "Grants admin access to Realtime configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "9bb90620717647a39679e1d951f140d6",
+    name: "Registrar Domains Read",
+    description: "Grants read access to Cloudflare Registrar domains",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "93ae59e7a40c4287a57ff6e501186a63",
+    name: "Response Compression Read",
+    description: "Grants read access to the response compression phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "4bd3fb513a23494aa1341a7e1eb6e080",
+    name: "Response Compression Write",
+    description: "Grants write access to the response compression phase",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "58abbad6d2ce40abb2594fbe932a2e0e",
+    name: "Rule Policies Read",
+    description: "Grants read access to Rule Policies",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "61ddc58f1da14f95b33b41213360cbeb",
+    name: "Rule Policies Write",
+    description: "Grants write access to Rule Policies",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "d5812c023a5048b4882175a28952362d",
+    name: "SCIM Provisioning",
+    description: "Grants membership permissions needed for SCIM provisioning",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "7b7216b327b04b8fbc8f524e1f9b7531",
+    name: "SSL and Certificates Read",
+    description: "Grants read access to SSL configuration and cert management",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "c03055bc037c4ea9afb9a9f104b7b721",
+    name: "SSL and Certificates Write",
+    description: "Grants write access to SSL configuration and cert management",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "1d80f6f165ea47f2b55d4a393fd697de",
+    name: "SSO Connector Read",
+    description: "Grants read access to Cloudflare SSO connectors\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "901ca5e292584c6aa1b4cdb39248bb07",
+    name: "SSO Connector Write",
+    description: "Grants write access to Cloudflare SSO connectors\n",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "853643ed57244ed1a05a7c024af9ab5a",
+    name: "Sanitize Read",
+    description: "Grants read access to sanitization",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "89bb8c37d46042e98b84560eaaa6379f",
+    name: "Sanitize Write",
+    description: "Grants write access to sanitization",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "5e33b7d77788455c9fdf18cbd38ee5a0",
+    name: "Secrets Store Read",
+    description: "Grants read access to Secrets Store",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "adc8fa2bc6124928a8b3314dc63a1235",
+    name: "Secrets Store Write",
+    description: "Grants write access to Secrets Store",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "595409c54a24444b80a495620b2d614c",
+    name: "Select Configuration Read",
+    description: "Grants read access to select configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "235eac9bb64942b49cb805cc851cb000",
+    name: "Select Configuration Write",
+    description: "Grants write access to select configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "74c654eb4aac40e28d6c6caa4c5aeb3d",
+    name: "Snippets Read",
+    description: "Grants read access to Snippets",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "dadeaf3abdf14126a77a35e0c92fc36e",
+    name: "Snippets Write",
+    description: "Grants write access to Snippets",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "de21485a24744b76a004aa153898f7fe",
+    name: "Stream Read",
+    description: "Grants read access to Cloudflare Stream",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "714f9c13a5684c2885a793f5edb36f59",
+    name: "Stream Write",
+    description: "Grants write access to Cloudflare Stream",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a9a99455bf3245f6a5a244f909d74830",
+    name: "Transform Rules Read",
+    description: "Grants read access to transform rules",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "ae16e88bc7814753a1894c7ce187ab72",
+    name: "Transform Rules Write",
+    description: "Grants write access to transform rules",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "f0ba3733e746429182fcd40ec648c066",
+    name: "Trust and Safety Read",
+    description: "Grants access to read abuse reports and abuse actions",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "120f843a9c074f399b830e542e5616b8",
+    name: "Trust and Safety Write",
+    description:
+      "Grants access to interact with abuse reports and abuse actions",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5d78fd7895974fd0bdbbbb079482721b",
+    name: "Turnstile Sites Read",
+    description: "Grants read access to Turnstile",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "755c05aa014b4f9ab263aa80b8167bd8",
+    name: "Turnstile Sites Write",
+    description: "Grants write access to Turnstile",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "5d613a610b294788a29572aaac2f254d",
+    name: "URL Scanner Read",
+    description: "Grants read access to URL Scanner API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "2a400bcb29154daab509fe07e3facab0",
+    name: "URL Scanner Write",
+    description: "Grants write access to URL Scanner API",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "1799edaae5db489294430e20d9b519e0",
+    name: "Vectorize Read",
+    description: "Grants read access to Vectorize configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "64156ba5be47441096c83c7fc17c488b",
+    name: "Vectorize Write",
+    description: "Grants write access to Vectorize configuration",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cab5202d07ef47beae788e6bc95cb6fe",
+    name: "Waiting Rooms Read",
+    description: "Grants read access to Waiting Rooms\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "24fc124dc8254e0db468e60bf410c800",
+    name: "Waiting Rooms Write",
+    description: "Grants write access to Waiting Rooms\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "8e31f574901c42e8ad89140b28d42112",
+    name: "Web3 Hostnames Read",
+    description: "Grants read access to Web3 Hostnames\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "5ea6da42edb34811a78d1b007557c0ca",
+    name: "Web3 Hostnames Write",
+    description: "Grants write access to Web3 Hostnames\n",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "a92d2450e05d4e7bb7d0a64968f83d11",
+    name: "Workers AI Read",
+    description: "Grants access to invoke Workers AI models",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "bacc64e0f6c34fc0883a1223f938a104",
+    name: "Workers AI Write",
+    description: "Grants access to invoke Workers AI models and edit assets",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "ad99c5ae555e45c4bef5bdf2678388ba",
+    name: "Workers CI Read",
+    description: "Grants read access to Workers CI",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "2e095cf436e2455fa62c9a9c2e18c478",
+    name: "Workers CI Write",
+    description: "Grants write access to Workers CI",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cfd39eebc07c4e3ea849e4b3d2644637",
+    name: "Workers Containers Read",
+    description: "Grants read access to Workers Containers",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "bdbcd690c763475a985e8641dddc09f7",
+    name: "Workers Containers Write",
+    description: "Grants write access to Workers Containers",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "8b47d2786a534c08a1f94ee8f9f599ef",
+    name: "Workers KV Storage Read",
+    description: "Grants read access to Cloudflare Workers KV Storage",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "f7f0eda5697f475c90846e879bab8666",
+    name: "Workers KV Storage Write",
+    description: "Grants write access to Cloudflare Workers KV Storage",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "66c1ed49f4ed46098b75696a6d4ee3c9",
+    name: "Workers Observability Read",
+    description: "Grants read access to Cloudflare Workers Observability",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "29c629fb7b5e4c408ca0f7b545724fcc",
+    name: "Workers Observability Telemetry Write",
+    description:
+      "Grants write access for Telemetry to Cloudflare Workers Observability",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "82c075da3f4647a2a03becd0fe240f8a",
+    name: "Workers Observability Write",
+    description:
+      "Grants read and write access to Cloudflare Workers Observability",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "45db74139a62490b9b60eb7c4f34994b",
+    name: "Workers R2 Data Catalog Read",
+    description: "Grants read access to R2 Data Catalog",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "d229766a2f7f4d299f20eaa8c9b1fde9",
+    name: "Workers R2 Data Catalog Write",
+    description: "Grants write access to R2 Data Catalog",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "f45430d92e2b4a6cb9f94f2594c141b8",
+    name: "Workers R2 SQL Read",
+    description:
+      "Grants access to read-only SQL queries against R2 Data Catalog",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "6a018a9f2fc74eb6b293b0c548f38b39",
+    name: "Workers R2 Storage Bucket Item Read",
+    description: "Grants read access to Cloudflare R2 Bucket Scoped Storage",
+    scopes: ["com.cloudflare.edge.r2.bucket"],
+  },
+  {
+    id: "2efd5506f9c8494dacb1fa10a3e7d5b6",
+    name: "Workers R2 Storage Bucket Item Write",
+    description: "Grants write access to Cloudflare R2 Bucket Scoped Storage",
+    scopes: ["com.cloudflare.edge.r2.bucket"],
+  },
+  {
+    id: "b4992e1108244f5d8bfbd5744320c2e1",
+    name: "Workers R2 Storage Read",
+    description: "Grants read access to Cloudflare R2 Storage",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "bf7481a1826f439697cb59a20b22293e",
+    name: "Workers R2 Storage Write",
+    description: "Grants write access to Cloudflare R2 Storage",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "2072033d694d415a936eaeb94e6405b8",
+    name: "Workers Routes Read",
+    description:
+      "Grants read access to Cloudflare Workers and Workers KV Storage",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "28f4b596e7d643029c524985477ae49a",
+    name: "Workers Routes Write",
+    description:
+      "Grants write access to Cloudflare Workers and Workers KV Storage",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "1a71c399035b4950a1bd1466bbe4f420",
+    name: "Workers Scripts Read",
+    description: "Grants read access to Cloudflare Workers scripts",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "e086da7e2179491d91ee5f35b3ca210a",
+    name: "Workers Scripts Write",
+    description: "Grants write access to Cloudflare Workers scripts",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "05880cd1bdc24d8bae0be2136972816b",
+    name: "Workers Tail Read",
+    description: "Grants `wrangler tail` read permissions",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cdeb15b336e640a2965df8c65052f1e0",
+    name: "Zaraz Admin",
+    description: "Can edit and publish Zaraz settings.",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "89d5bf002389496e9994b8c30608b5d0",
+    name: "Zaraz Edit",
+    description: "Can edit Zaraz settings.",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "5bdbde7e76144204a244274eac3eb0eb",
+    name: "Zaraz Read",
+    description: "Grants read access to Zaraz settings.",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "3f376c8e6f764a938b848bd01c8995c4",
+    name: "Zero Trust Read",
+    description: "Grants read access to Cloudflare Zero Trust resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "efb81b5cd37d49f3be1da9363a6d7a19",
+    name: "Zero Trust Report",
+    description: "Grants reporting access to Cloudflare Zero Trust",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "07f91e3e32b647ffae0178d884f23ee0",
+    name: "Zero Trust Resilience Read",
+    description:
+      "Grants read access to Cloudflare Zero Trust Resilience resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "cc00ebddebca4b8399607562a78df084",
+    name: "Zero Trust Resilience Write",
+    description:
+      "Grants write access to Cloudflare Zero Trust Resilience resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "b33f02c6f7284e05a6f20741c0bb0567",
+    name: "Zero Trust Write",
+    description: "Grants write access to Cloudflare Zero Trust resources",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "f5d857f67f144e3c8bacea88c17d4a13",
+    name: "Zero Trust: PII Read",
+    description: "Grants read access to Cloudflare Zero Trust PII.",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "a1a6298e52584c8fb6313760a30c681e",
+    name: "Zero Trust: Seats Write",
+    description:
+      "Grants write access to the Zero Trust seats your organization can use (and be billed for)",
+    scopes: ["com.cloudflare.api.account"],
+  },
+  {
+    id: "0a6cfe8cd3ed445e918579e2fb13087b",
+    name: "Zone DNS Settings Read",
+    description: "Grants read access to Zone DNS Settings",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "c4df38be41c247b3b4b7702e76eadae0",
+    name: "Zone DNS Settings Write",
+    description: "Grants write access to Zone DNS Settings",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "c8fed203ed3043cba015a93ad1616f1f",
+    name: "Zone Read",
+    description: "Grants read access to zone management",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "517b21aee92c4d89936c976ba6e4be55",
+    name: "Zone Settings Read",
+    description: "Grants read access to zone settings",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "3030687196b94b638145a3953da2b699",
+    name: "Zone Settings Write",
+    description: "Grants write access to zone settings",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "211a4c0feb3e43b3a2d41f1443a433e7",
+    name: "Zone Transform Rules Read",
+    description: "Grants read access to transform rules at zone level",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "0ac90a90249747bca6b047d97f0803e9",
+    name: "Zone Transform Rules Write",
+    description: "Grants write access to transform rules at zone level",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "1b1ea24cf0904d33903f0cc7e54e280f",
+    name: "Zone Versioning Read",
+    description: "Grants read-only access to Zone Versioning",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "c9915d86fbff46af9dd945c0a882294b",
+    name: "Zone Versioning Write",
+    description: "Grants full access to Zone Versioning",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "dbc512b354774852af2b5a5f4ba3d470",
+    name: "Zone WAF Read",
+    description: "Grants read access to Zone WAF",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "fb6778dc191143babbfaa57993f1d275",
+    name: "Zone WAF Write",
+    description: "Grants write access to Zone WAF",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+  {
+    id: "e6d2666161e84845a636613608cee8d5",
+    name: "Zone Write",
+    description: "Grants write access to zone management",
+    scopes: ["com.cloudflare.api.account.zone"],
+  },
+] as const;
+
+export type PermissionGroupName = (typeof PERMISSION_GROUPS)[number]["name"];
+
+/**
+ * Lookup map from permission-group name to the first matching permission group.
+ *
+ * Some Cloudflare names appear twice (e.g. account-scope and zone-scope variants
+ * sharing a label). We keep the first occurrence; callers that need a specific
+ * scope should pass `{ id }` directly instead of using the name shorthand.
+ */
+export const PERMISSION_GROUPS_BY_NAME: Record<
+  PermissionGroupName,
+  PermissionGroup
+> = (() => {
+  const map = {} as Record<PermissionGroupName, PermissionGroup>;
+  for (const group of PERMISSION_GROUPS) {
+    if (!(group.name in map)) {
+      map[group.name as PermissionGroupName] = group;
+    }
+  }
+  return map;
+})();
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/UserApiToken.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/UserApiToken.ts
new file mode 100644
index 00000000000..7e18c3431f9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/UserApiToken.ts
@@ -0,0 +1,232 @@
+import * as user from "@distilled.cloud/cloudflare/user";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  buildConditionPayload,
+  collectPolicies,
+  conditionFingerprint,
+  policyFingerprint,
+  resolvePolicies,
+  type ApiTokenBinding,
+  type ApiTokenProps,
+} from "./Common.ts";
+
+export type UserApiToken = Resource<
+  "Cloudflare.UserApiToken",
+  ApiTokenProps,
+  {
+    tokenId: string;
+    name: string;
+    status: "active" | "disabled" | "expired";
+    /**
+     * The plaintext token value. Cloudflare returns this only once, on
+     * creation, so we persist it here for downstream consumers.
+     */
+    value: Redacted.Redacted<string>;
+  },
+  ApiTokenBinding,
+  Providers
+>;
+
+/**
+ * A Cloudflare user-owned API token (`POST /user/tokens`).
+ *
+ * User-owned tokens are tied to the authenticated user's identity. They can
+ * be created by any authenticated user (including OAuth-derived sessions
+ * from `alchemy login`) without needing the account-level
+ * `API Tokens > Write` permission, but they are also revoked if the user
+ * leaves the account.
+ *
+ * For CI tokens, prefer {@link AccountApiToken} so the token survives
+ * personnel changes.
+ *
+ * Policy `resources` are passed through verbatim — no `accountId` rewriting
+ * is performed because user tokens aren't bound to a single account.
+ *
+ * @section Creating a Token
+ * @example A token bound to the authenticated user
+ * ```typescript
+ * const token = yield* Cloudflare.UserApiToken("personal-token", {
+ *   name: "my-personal-token",
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Workers Scripts Read"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Attaching Policies via Bindings
+ * @example Let a downstream capability contribute its own policies
+ * A token can be created with no `policies` of its own; the policies are
+ * supplied through its binding contract (see {@link ApiTokenBinding}).
+ * ```typescript
+ * const token = yield* Cloudflare.UserApiToken("scoped-token");
+ *
+ * yield* token.bind("MyCapability", {
+ *   policies: [
+ *     {
+ *       effect: "allow",
+ *       permissionGroups: ["Workers Scripts Read"],
+ *       resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Exposing a Token to a Worker
+ * @example Read the token value at runtime
+ * Bind the token's value output in the Worker's Init phase to get a runtime
+ * accessor. Binding it injects a `secret_text` Worker binding; the returned
+ * accessor reads it back (as `Redacted`) at runtime.
+ * ```typescript
+ * // init
+ * const value = yield* token.value; // Accessor<Redacted<string>>
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const apiToken = yield* value; // Redacted<string>
+ *     // ... call the Cloudflare API with `apiToken`
+ *     return HttpServerResponse.text("ok");
+ *   }),
+ * };
+ * ```
+ */
+export const UserApiToken = Resource<UserApiToken>("Cloudflare.UserApiToken");
+
+type UserApiTokenAttributes = UserApiToken["Attributes"];
+
+const resolveName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id }));
+  });
+
+export const UserApiTokenProvider = () =>
+  Provider.effect(
+    UserApiToken,
+    Effect.gen(function* () {
+      const createToken = yield* user.createToken;
+      const updateToken = yield* user.updateToken;
+      const deleteToken = yield* user.deleteToken;
+      const getToken = yield* user.getToken;
+
+      const buildAttributes = (
+        tokenData: {
+          id?: string | null;
+          name?: string | null;
+          // Distilled widened generated string enums to open unions (`string & {}`).
+          status?: string | null;
+        },
+        value: Redacted.Redacted<string>,
+      ): UserApiTokenAttributes => ({
+        tokenId: tokenData.id ?? "",
+        name: tokenData.name ?? "",
+        status: (tokenData.status ?? "active") as
+          | "active"
+          | "disabled"
+          | "expired",
+        value,
+      });
+
+      return {
+        stables: ["tokenId"],
+        diff: Effect.fn(function* ({ id, olds, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+          const newName = yield* resolveName(id, news.name);
+          const oldPolicyFp = policyFingerprint(
+            resolvePolicies(olds?.policies ?? []),
+          );
+          const newPolicyFp = policyFingerprint(
+            resolvePolicies(news.policies ?? []),
+          );
+          const oldCondFp = conditionFingerprint(olds?.condition);
+          const newCondFp = conditionFingerprint(news.condition);
+          if (
+            oldName !== newName ||
+            oldPolicyFp !== newPolicyFp ||
+            oldCondFp !== newCondFp ||
+            (olds?.expiresOn ?? undefined) !== (news.expiresOn ?? undefined) ||
+            (olds?.notBefore ?? undefined) !== (news.notBefore ?? undefined)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output, bindings }) {
+          const name = yield* resolveName(id, news.name);
+          const collected = collectPolicies(news.policies, bindings);
+          if (collected.length === 0) {
+            return yield* Effect.die(
+              `Cloudflare requires at least one policy on token "${name}". ` +
+                "Pass `policies` or attach them via a binding.",
+            );
+          }
+          const policies = resolvePolicies(collected);
+
+          // Observe — fetch current state if we know the token id;
+          // Cloudflare reports a deleted token as `TokenNotFound`, which
+          // we treat as "create from scratch".
+          const observed = output?.tokenId
+            ? yield* getToken({ tokenId: output.tokenId }).pipe(
+                Effect.map((token) => token),
+                Effect.catchTag("TokenNotFound", () =>
+                  Effect.succeed(undefined),
+                ),
+              )
+            : undefined;
+
+          // Ensure — create if missing. Cloudflare returns the plaintext
+          // token value exactly once on create, so we must persist it.
+          // No idempotency token is available; we accept a duplicate over
+          // losing the secret value.
+          if (observed === undefined) {
+            const result = yield* createToken({
+              name,
+              policies,
+              condition: buildConditionPayload(news.condition),
+              expiresOn: news.expiresOn,
+              notBefore: news.notBefore,
+            });
+            if (!result.value) {
+              return yield* Effect.die(
+                `Cloudflare did not return a value for token "${name}".`,
+              );
+            }
+            return buildAttributes(result, Redacted.make(result.value));
+          }
+
+          // Sync — the update API replaces all mutable fields. Cloudflare
+          // does not return the plaintext value on update, so preserve
+          // the one captured at creation.
+          const result = yield* updateToken({
+            tokenId: output!.tokenId,
+            name,
+            policies,
+            condition: buildConditionPayload(news.condition),
+            expiresOn: news.expiresOn,
+            notBefore: news.notBefore,
+          });
+          return buildAttributes(result, output!.value);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteToken({ tokenId: output.tokenId }).pipe(
+            Effect.catchTag("TokenNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.tokenId) return undefined;
+          return yield* getToken({ tokenId: output.tokenId }).pipe(
+            Effect.map((token) => buildAttributes(token, output.value)),
+            Effect.catchTag("TokenNotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/index.ts
new file mode 100644
index 00000000000..92a7ce8a60c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/ApiToken/index.ts
@@ -0,0 +1,4 @@
+export * from "./AccountApiToken.ts";
+export * from "./Common.ts";
+export * from "./PermissionGroups.ts";
+export * from "./UserApiToken.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/Artifacts.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/Artifacts.ts
new file mode 100644
index 00000000000..cc9ef7ccb68
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/Artifacts.ts
@@ -0,0 +1,139 @@
+import * as Effect from "effect/Effect";
+import { Stack } from "../../Stack.ts";
+import { Stage } from "../../Stage.ts";
+import { ArtifactsBinding } from "./ArtifactsBinding.ts";
+
+type ArtifactsTypeId = typeof ArtifactsTypeId;
+const ArtifactsTypeId = "Cloudflare.Artifacts" as const;
+
+/**
+ * Cloudflare validation: 3–63 chars, lowercase alphanumeric and hyphens, must
+ * start and end with a lowercase alphanumeric character.
+ */
+const ARTIFACTS_NAMESPACE_REGEX = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/;
+
+export class InvalidArtifactsNamespaceError extends Error {
+  readonly _tag = "InvalidArtifactsNamespaceError" as const;
+  constructor(public readonly namespace: string) {
+    super(
+      `Invalid artifacts namespace name '${namespace}'. Must be 3-63 characters, start and end with a lowercase alphanumeric character, and contain only lowercase alphanumeric characters and hyphens.`,
+    );
+  }
+}
+
+export type ArtifactsProps = {
+  /**
+   * Cloudflare namespace name. Namespaces are implicit on Cloudflare — the
+   * first repo created against this name conjures the namespace.
+   *
+   * Must be 3–63 lowercase alphanumeric characters or hyphens, and must start
+   * and end with a lowercase alphanumeric character. If omitted, a unique
+   * physical name is generated from the resource's logical id, app, and stage.
+   */
+  namespace?: string;
+};
+
+/**
+ * Marker for a Cloudflare Artifacts namespace binding.
+ *
+ * Artifacts namespaces are implicit (created on first repo write) and require
+ * no deploy-time provisioning, so this is a pure binding marker rather than
+ * a full Resource. The Worker provider sees this object in `bindings: { ... }`
+ * and emits the corresponding `{ type: "artifacts", name, namespace }` binding
+ * to the script.
+ */
+export type Artifacts = {
+  kind: ArtifactsTypeId;
+  name: string;
+  namespace: string;
+};
+
+export const isArtifacts = (value: unknown): value is Artifacts =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as Artifacts).kind === ArtifactsTypeId;
+
+/**
+ * A Cloudflare Artifacts namespace — the top-level container for Git-compatible
+ * versioned repositories. See the
+ * {@link https://blog.cloudflare.com/artifacts-git-for-agents-beta/ | Artifacts launch post}
+ * and {@link https://developers.cloudflare.com/artifacts/concepts/namespaces/ | Namespaces docs}.
+ *
+ * Namespaces on Cloudflare are **implicit**: there is no `POST /namespaces`
+ * endpoint. The namespace is conjured the first time a repo is created against
+ * it (either via the REST API or the Worker binding). Because of that, the
+ * Alchemy "resource" is a thin binding marker — there is nothing to provision
+ * at deploy time. Repos themselves are typically created at runtime through
+ * the bound `Artifacts` API.
+ *
+ * @section Declaring a Namespace
+ * @example Default namespace (a unique physical name is generated)
+ * ```typescript
+ * const Repos = Cloudflare.Artifacts("Repos");
+ * ```
+ *
+ * @example Override the namespace name (must be lowercase, 3–63 chars)
+ * ```typescript
+ * const Repos = Cloudflare.Artifacts("Repos", { namespace: "starter-repos" });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Wiring it into a Worker
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: { Repos },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { Repos: Artifacts }
+ * ```
+ *
+ * @example Async-style worker
+ * ```typescript
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     const repo = await env.Repos.create("starter-repo");
+ *     return Response.json({ remote: repo.remote, token: repo.token });
+ *   },
+ * };
+ * ```
+ *
+ * @example Effect-style worker
+ * ```typescript
+ * const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
+ * const repo = yield* artifacts.create("starter-repo", {
+ *   setDefaultBranch: "main",
+ * });
+ * ```
+ */
+export const Artifacts: {
+  (
+    name: string,
+    props?: ArtifactsProps,
+  ): Effect.Effect<Artifacts, never, Stack | Stage>;
+  /**
+   * Bind a Cloudflare Artifacts namespace to the surrounding Worker, returning
+   * an Effect-native client. See {@link ArtifactsBinding}.
+   */
+  bind: typeof ArtifactsBinding.bind;
+} = Object.assign(
+  Effect.fn(function* (name: string, props?: ArtifactsProps) {
+    const namespace = props?.namespace
+      ? props.namespace
+      : name.toLocaleLowerCase();
+    if (!ARTIFACTS_NAMESPACE_REGEX.test(namespace)) {
+      return yield* Effect.die(new InvalidArtifactsNamespaceError(namespace));
+    }
+    return {
+      kind: ArtifactsTypeId,
+      name,
+      namespace,
+    } satisfies Artifacts;
+  }),
+  {
+    bind: (...args: Parameters<typeof ArtifactsBinding.bind>) =>
+      ArtifactsBinding.bind(...args),
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/ArtifactsBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/ArtifactsBinding.ts
new file mode 100644
index 00000000000..2726d224503
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/ArtifactsBinding.ts
@@ -0,0 +1,177 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type Artifacts as ArtifactsLike } from "./Artifacts.ts";
+
+export class ArtifactsError extends Data.TaggedError("ArtifactsError")<{
+  message: string;
+  cause: Error;
+}> {}
+
+export type Scope = "read" | "write";
+
+export type ArtifactsCreateOptions = {
+  readOnly?: boolean;
+  description?: string;
+  setDefaultBranch?: string;
+};
+
+export type ArtifactsImportOptions = {
+  source: { url: string; branch?: string; depth?: number };
+  target: {
+    name: string;
+    opts?: { description?: string; readOnly?: boolean };
+  };
+};
+
+export type ArtifactsListOptions = {
+  limit?: number;
+  cursor?: string;
+};
+
+export type ArtifactsForkOptions = {
+  description?: string;
+  readOnly?: boolean;
+  defaultBranchOnly?: boolean;
+};
+
+/**
+ * Effect-native handle to a single Artifacts repo. Wraps the runtime
+ * {@link ArtifactsRepo} so each method returns an Effect.
+ */
+export interface ArtifactsRepoClient {
+  /** Underlying Cloudflare runtime handle. */
+  raw: ArtifactsRepo;
+  createToken(
+    scope?: Scope,
+    ttl?: number,
+  ): Effect.Effect<ArtifactsCreateTokenResult, ArtifactsError>;
+  listTokens(): Effect.Effect<ArtifactsTokenListResult, ArtifactsError>;
+  revokeToken(tokenOrId: string): Effect.Effect<boolean, ArtifactsError>;
+  fork(
+    name: string,
+    opts?: ArtifactsForkOptions,
+  ): Effect.Effect<ArtifactsCreateRepoResult, ArtifactsError>;
+}
+
+/**
+ * Effect-native client for a Cloudflare Artifacts namespace binding.
+ *
+ * Wraps the runtime {@link Artifacts} binding so each method returns an
+ * Effect tagged with {@link ArtifactsError}. Use
+ * `Cloudflare.ArtifactsBinding.bind(Repos)` inside a Worker's init phase.
+ */
+export interface ArtifactsClient {
+  /** Effect resolving to the raw Cloudflare runtime binding. */
+  raw: Effect.Effect<Artifacts, never, RuntimeContext>;
+  create(
+    name: string,
+    opts?: ArtifactsCreateOptions,
+  ): Effect.Effect<ArtifactsCreateRepoResult, ArtifactsError, RuntimeContext>;
+  /** Look up an existing repo by name. Fails with `ArtifactsError` if missing. */
+  get(
+    name: string,
+  ): Effect.Effect<ArtifactsRepoClient, ArtifactsError, RuntimeContext>;
+  list(
+    opts?: ArtifactsListOptions,
+  ): Effect.Effect<ArtifactsRepoListResult, ArtifactsError, RuntimeContext>;
+  delete(name: string): Effect.Effect<boolean, ArtifactsError, RuntimeContext>;
+  import(
+    opts: ArtifactsImportOptions,
+  ): Effect.Effect<ArtifactsCreateRepoResult, ArtifactsError, RuntimeContext>;
+}
+
+export class ArtifactsBinding extends Binding.Service<
+  ArtifactsBinding,
+  (artifacts: ArtifactsLike) => Effect.Effect<ArtifactsClient>
+>()("Cloudflare.Artifacts.Binding") {}
+
+export const ArtifactsBindingLive = Layer.effect(
+  ArtifactsBinding,
+  Effect.gen(function* () {
+    const Policy = yield* ArtifactsBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (artifacts: ArtifactsLike) {
+      yield* Policy(artifacts);
+      const raw = Effect.sync(
+        () => (env as Record<string, Artifacts>)[artifacts.name]!,
+      );
+
+      const use = <T>(
+        fn: (raw: Artifacts) => Promise<T>,
+      ): Effect.Effect<T, ArtifactsError> =>
+        raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
+
+      return {
+        raw,
+        create: (name, opts) => use((raw) => raw.create(name, opts)),
+        get: (name) =>
+          use((raw) => raw.get(name)).pipe(
+            Effect.flatMap((repo) =>
+              repo == null
+                ? Effect.fail(
+                    new ArtifactsError({
+                      message: `Artifacts repo '${name}' not found`,
+                      cause: new Error("not_found"),
+                    }),
+                  )
+                : Effect.succeed(wrapRepo(repo as ArtifactsRepo)),
+            ),
+          ),
+        list: (opts) => use((raw) => raw.list(opts)),
+        delete: (name) => use((raw) => raw.delete(name)),
+        import: (opts) => use((raw) => raw.import(opts)),
+      } satisfies ArtifactsClient;
+    });
+  }),
+);
+
+export class ArtifactsBindingPolicy extends Binding.Policy<
+  ArtifactsBindingPolicy,
+  (artifacts: ArtifactsLike) => Effect.Effect<void>
+>()("Cloudflare.Artifacts.Binding") {}
+
+export const ArtifactsBindingPolicyLive = ArtifactsBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, artifacts: ArtifactsLike) {
+    if (isWorker(host)) {
+      yield* host.bind(artifacts.name, {
+        bindings: [
+          {
+            type: "artifacts",
+            name: artifacts.name,
+            namespace: artifacts.namespace,
+          } as any,
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`ArtifactsBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
+
+const tryPromise = <T>(
+  fn: () => Promise<T>,
+): Effect.Effect<T, ArtifactsError> =>
+  Effect.tryPromise({
+    try: fn,
+    catch: (error: any) =>
+      new ArtifactsError({
+        message: error?.message ?? "Unknown error",
+        cause: error,
+      }),
+  });
+
+const wrapRepo = (raw: ArtifactsRepo): ArtifactsRepoClient => ({
+  raw,
+  createToken: (scope, ttl) => tryPromise(() => raw.createToken(scope, ttl)),
+  listTokens: () => tryPromise(() => raw.listTokens()),
+  revokeToken: (tokenOrId) => tryPromise(() => raw.revokeToken(tokenOrId)),
+  fork: (name, opts) => tryPromise(() => raw.fork(name, opts)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/index.ts
new file mode 100644
index 00000000000..44b361d80a4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Artifacts/index.ts
@@ -0,0 +1,2 @@
+export * from "./Artifacts.ts";
+export * from "./ArtifactsBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/AuthProvider.ts
new file mode 100644
index 00000000000..253c1c47485
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/AuthProvider.ts
@@ -0,0 +1,711 @@
+import * as cfAccounts from "@distilled.cloud/cloudflare/accounts";
+import * as CfCredentialsModule from "@distilled.cloud/cloudflare/Credentials";
+import * as Console from "effect/Console";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../../Auth/Credentials.ts";
+import {
+  getEnv,
+  getEnvRedacted,
+  getEnvRequired,
+  retryOnce,
+} from "../../Auth/Env.ts";
+import * as Clank from "../../Util/Clank.ts";
+import * as OAuthClient from "./OAuthClient.ts";
+
+const options: Array<{
+  value: CloudflareAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "oauth",
+    label: "OAuth",
+    hint: "recommended — browser-based login with automatic token refresh",
+  },
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL",
+  },
+  {
+    value: "stored",
+    label: "API Token or API Key",
+    hint: "enter credentials interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+export type CloudflareAuthConfig =
+  | { method: "env" }
+  | { method: "stored"; credentialType: "apiToken" }
+  | { method: "stored"; credentialType: "apiKey" }
+  | { method: "oauth"; scopes: string[]; accountId: string };
+
+export type CloudflareStoredCredentials =
+  | { type: "apiToken"; apiToken: string; accountId: string }
+  | { type: "apiKey"; apiKey: string; email: string; accountId: string };
+
+export type CloudflareResolvedCredentials =
+  | {
+      type: "apiToken";
+      apiToken: Redacted.Redacted<string>;
+      accountId: string;
+      source: { type: CloudflareAuthConfig["method"]; details?: string };
+    }
+  | {
+      type: "apiKey";
+      apiKey: Redacted.Redacted<string>;
+      email: Redacted.Redacted<string>;
+      accountId: string;
+      source: { type: CloudflareAuthConfig["method"]; details?: string };
+    }
+  | {
+      type: "oauth";
+      accessToken: Redacted.Redacted<string>;
+      expires: number;
+      accountId: string;
+      source: { type: CloudflareAuthConfig["method"]; details?: string };
+    };
+
+export const CLOUDFLARE_AUTH_PROVIDER_NAME = "Cloudflare";
+
+const withOAuthCredentials = <A, E>(
+  accessToken: string,
+  effect: Effect.Effect<
+    A,
+    E,
+    CfCredentialsModule.Credentials | HttpClient.HttpClient
+  >,
+): Effect.Effect<A, E> =>
+  Effect.provide(
+    effect,
+    Layer.mergeAll(
+      CfCredentialsModule.fromOAuth({
+        load: Effect.succeed({ accessToken }),
+        refresh: () =>
+          Effect.die("refresh not expected during account selection"),
+      }),
+      FetchHttpClient.layer,
+    ),
+  );
+
+const selectAccount = (accessToken: string) =>
+  Effect.gen(function* () {
+    const list = yield* cfAccounts.listAccounts;
+    const response = yield* list({});
+    const accounts = response.result;
+    if (accounts.length === 0) {
+      yield* new AuthError({
+        message: "Cloudflare: no accounts found for this credential.",
+      });
+    }
+    if (accounts.length === 1) {
+      const account = accounts[0]!;
+      yield* Clank.info(
+        `Cloudflare: using account: ${account.name} (${account.id})`,
+      );
+      return account.id;
+    }
+    return yield* Clank.select({
+      message: "Select a Cloudflare account",
+      options: accounts.map((a) => ({
+        value: a.id,
+        label: a.name,
+        hint: a.id,
+      })),
+    }).pipe(retryOnce);
+  }).pipe((e) => withOAuthCredentials(accessToken, e));
+
+const promptAccountId = () =>
+  getEnv("CLOUDFLARE_ACCOUNT_ID").pipe(
+    Effect.flatMap((envAccountId) =>
+      Clank.text({
+        message: "Cloudflare Account ID (Enter to skip)",
+        placeholder: envAccountId ?? "",
+        defaultValue: envAccountId ?? "",
+      }).pipe(retryOnce),
+    ),
+  );
+
+const promptOAuthScopes = () =>
+  Clank.confirm({
+    message: "Customize OAuth scopes? (default covers typical use cases)",
+    initialValue: false,
+  }).pipe(
+    retryOnce,
+    Effect.flatMap((customize) => {
+      if (!customize) return Effect.succeed([...DEFAULT_SCOPES]);
+      return Clank.multiselect({
+        message: "Select OAuth scopes",
+        initialValues: DEFAULT_SCOPES as string[],
+        options: Object.entries(ALL_SCOPES).map(([value, hint]) => ({
+          value: value as string,
+          label: value,
+          hint,
+        })),
+        required: true,
+      }).pipe(
+        Effect.map((s) => s as string[]),
+        retryOnce,
+      );
+    }),
+  );
+
+/**
+ * Layer that registers the Cloudflare {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the Cloudflare
+ * `providers()` layer so `alchemy login` can discover it.
+ */
+export const CloudflareAuth = AuthProviderLayer<
+  CloudflareAuthConfig,
+  CloudflareResolvedCredentials
+>()(
+  CLOUDFLARE_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+
+    const oauthLogin = (profileName: string, scopes: string[]) =>
+      Effect.gen(function* () {
+        const authorization = OAuthClient.authorize([
+          ...scopes,
+          "offline_access",
+        ]);
+
+        yield* Clank.info("Cloudflare: opening browser for OAuth login...");
+        yield* Clank.info(authorization.url);
+        yield* Clank.openUrl(authorization.url).pipe(
+          Effect.catch(() =>
+            Clank.warn(
+              "Cloudflare: could not open browser automatically. Please open the URL above manually.",
+            ),
+          ),
+        );
+        yield* Clank.info(
+          "Cloudflare: waiting for authorization (up to 5 minutes)...",
+        );
+
+        const credentials = yield* OAuthClient.callback(authorization);
+        yield* store.write(profileName, "cf-oauth", credentials);
+        yield* Clank.success("Cloudflare: OAuth credentials saved.");
+        return credentials;
+      });
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const credentialType = yield* Clank.select({
+        message: "Cloudflare credential type",
+        options: [
+          {
+            value: "apiToken" as const,
+            label: "API Token",
+            hint: "recommended",
+          },
+          { value: "apiKey" as const, label: "API Key + Email" },
+        ],
+      }).pipe(retryOnce);
+
+      return yield* Match.value(credentialType).pipe(
+        Match.when("apiToken", () =>
+          Effect.gen(function* () {
+            const apiToken = yield* Clank.password({
+              message: "Cloudflare API Token",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const accountId = yield* promptAccountId();
+
+            yield* store.write<CloudflareStoredCredentials>(
+              profileName,
+              "cf-stored",
+              { type: "apiToken", apiToken, accountId },
+            );
+            yield* Clank.success("Cloudflare: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "apiToken" as const,
+            };
+          }),
+        ),
+        Match.when("apiKey", () =>
+          Effect.gen(function* () {
+            const apiKey = yield* Clank.text({
+              message: "Cloudflare API Key",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+
+            const email = yield* Clank.text({
+              message: "Cloudflare Email",
+              validate: (v) => (v.length === 0 ? "Required" : undefined),
+            }).pipe(retryOnce);
+            const accountId = yield* promptAccountId();
+
+            yield* store.write<CloudflareStoredCredentials>(
+              profileName,
+              "cf-stored",
+              { type: "apiKey", apiKey, email, accountId },
+            );
+            yield* Clank.success("Cloudflare: credentials saved.");
+            return {
+              method: "stored" as const,
+              credentialType: "apiKey" as const,
+            };
+          }),
+        ),
+        Match.exhaustive,
+      );
+    });
+
+    const configureOAuth = Effect.fnUntraced(function* (profileName: string) {
+      const scopes = yield* promptOAuthScopes();
+
+      const oauthCreds = yield* oauthLogin(profileName, scopes);
+
+      const accountId = yield* selectAccount(oauthCreds.access).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "Cloudflare: could not list accounts",
+              cause: e,
+            }),
+        ),
+      );
+
+      return {
+        method: "oauth" as const,
+        scopes,
+        accountId,
+      };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Cloudflare authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("oauth", () => configureOAuth(profileName)),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: CloudflareAuthConfig,
+    ): Effect.Effect<CloudflareResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const accountId = yield* getEnvRequired("CLOUDFLARE_ACCOUNT_ID");
+            const apiToken = yield* getEnvRedacted("CLOUDFLARE_API_TOKEN");
+            if (apiToken) {
+              return {
+                type: "apiToken" as const,
+                apiToken,
+                accountId,
+                source: { type: "env" as const },
+              };
+            }
+            const apiKey = yield* getEnvRedacted("CLOUDFLARE_API_KEY");
+            const email = yield* getEnvRedacted("CLOUDFLARE_EMAIL");
+            if (apiKey && email) {
+              return {
+                type: "apiKey" as const,
+                apiKey,
+                email,
+                accountId,
+                source: { type: "env" as const },
+              };
+            }
+            return yield* new AuthError({
+              message:
+                "Cloudflare env credentials not found. Set CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY + CLOUDFLARE_EMAIL.",
+            });
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .read<CloudflareStoredCredentials>(profileName, "cf-stored")
+            .pipe(
+              Effect.flatMap((creds) =>
+                creds == null
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          "Cloudflare stored credentials not found. Run: alchemy-effect login --configure",
+                      }),
+                    )
+                  : Effect.succeed(
+                      Match.value(creds).pipe(
+                        Match.when({ type: "apiToken" }, (c) => ({
+                          type: "apiToken" as const,
+                          apiToken: Redacted.make(c.apiToken),
+                          accountId: c.accountId,
+                          source: { type: "stored" as const },
+                        })),
+                        Match.when({ type: "apiKey" }, (c) => ({
+                          type: "apiKey" as const,
+                          apiKey: Redacted.make(c.apiKey),
+                          email: Redacted.make(c.email),
+                          accountId: c.accountId,
+                          source: { type: "stored" as const },
+                        })),
+                        Match.exhaustive,
+                      ),
+                    ),
+              ),
+            ),
+        ),
+        Match.when({ method: "oauth" }, (cfg) =>
+          Effect.gen(function* () {
+            const creds = yield* store.read<OAuthClient.OAuthCredentials>(
+              profileName,
+              "cf-oauth",
+            );
+            if (creds == null || creds.type !== "oauth") {
+              return yield* Effect.fail(
+                new AuthError({
+                  message:
+                    "Cloudflare OAuth credentials not found. Run: alchemy login",
+                }),
+              );
+            }
+            // Refresh proactively if the token has expired (or is within
+            // 10s of expiring). Persist the refreshed creds so subsequent
+            // resolves don't repeat the round-trip.
+            const fresh =
+              creds.expires > Date.now() + 10_000
+                ? creds
+                : yield* OAuthClient.refresh(creds).pipe(
+                    Effect.tap((refreshed) =>
+                      store.write(profileName, "cf-oauth", refreshed),
+                    ),
+                    Effect.mapError(
+                      (e) =>
+                        new AuthError({
+                          message:
+                            "Cloudflare OAuth refresh failed. Run: alchemy login",
+                          cause: e,
+                        }),
+                    ),
+                  );
+            return {
+              type: "oauth" as const,
+              accessToken: Redacted.make(fresh.access),
+              expires: fresh.expires,
+              accountId: cfg.accountId,
+              source: { type: "oauth" as const },
+            };
+          }),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: CloudflareAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "cf-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("Cloudflare: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.when({ method: "oauth" }, () =>
+          store
+            .read<OAuthClient.OAuthCredentials>(profileName, "cf-oauth")
+            .pipe(
+              Effect.tap((creds) =>
+                creds?.type === "oauth"
+                  ? OAuthClient.revoke(creds).pipe(
+                      Effect.catchTag("OAuthError", (err) =>
+                        Clank.warn(
+                          `Cloudflare: could not revoke OAuth token: ${err.errorDescription}`,
+                        ),
+                      ),
+                    )
+                  : Effect.void,
+              ),
+              Effect.andThen(store.delete(profileName, "cf-oauth")),
+              Effect.andThen(
+                Clank.success("Cloudflare: OAuth credentials removed."),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: CloudflareAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<CloudflareStoredCredentials>(profileName, "cf-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.when({ method: "oauth" }, (c) =>
+            Effect.gen(function* () {
+              const creds = yield* store.read<OAuthClient.OAuthCredentials>(
+                profileName,
+                "cf-oauth",
+              );
+
+              if (creds?.type === "oauth") {
+                yield* Clank.info(
+                  "Cloudflare: refreshing OAuth credentials...",
+                );
+                yield* OAuthClient.refresh(creds).pipe(
+                  Effect.flatMap((refreshed) =>
+                    store
+                      .write(profileName, "cf-oauth", refreshed)
+                      .pipe(
+                        Effect.andThen(
+                          Clank.success(
+                            "Cloudflare: OAuth credentials refreshed.",
+                          ),
+                        ),
+                      ),
+                  ),
+                  Effect.catchTag("OAuthError", () =>
+                    oauthLogin(profileName, c.scopes).pipe(Effect.asVoid),
+                  ),
+                );
+                return;
+              }
+
+              yield* oauthLogin(profileName, c.scopes);
+            }),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: CloudflareAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) =>
+              Effect.all([
+                Console.log(`  apiToken: ${displayRedacted(c.apiToken, 9)}`),
+                Console.log(`  accountId: ${c.accountId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.when({ type: "apiKey" }, (c) =>
+              Effect.all([
+                Console.log(`  apiKey: ${displayRedacted(c.apiKey)}`),
+                Console.log(`  email:  ${displayRedacted(c.email)}`),
+                Console.log(`  accountId: ${c.accountId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]),
+            ),
+            Match.when({ type: "oauth" }, (c) => {
+              const remainingMs = c.expires - Date.now();
+              const expiresAt = new Date(c.expires).toISOString();
+              const expiresStr =
+                remainingMs <= 0
+                  ? `expired (${expiresAt})`
+                  : `in ${Duration.format(Duration.millis(remainingMs))} (${expiresAt})`;
+              return Effect.all([
+                Console.log(`  accessToken: ${displayRedacted(c.accessToken)}`),
+                Console.log(`  expires: ${expiresStr}`),
+                Console.log(`  accountId: ${c.accountId}`),
+                Console.log(`  source: ${sourceStr}`),
+              ]);
+            }),
+            Match.exhaustive,
+          );
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
+
+export const ALL_SCOPES = {
+  "access:read":
+    "See Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+  "access:write":
+    "See and change Cloudflare Access data such as zones, applications, certificates, device postures, groups, identity providers, login counts, organizations, policies, service tokens, and users",
+  "account:read":
+    "See your account info such as account details, analytics, and memberships",
+  "agw:read": "Grants read level access to Agents Gateway",
+  "agw:run": "Grants run level access to Agents Gateway",
+  "agw:write": "Grants read and write level access to Agents Gateway",
+  "ai:read": "Grants read level access to Workers AI",
+  "ai:write": "Grants write level access to Workers AI",
+  "aiaudit:read": "Grants read level access to AI Audit",
+  "aiaudit:write": "Grants write level access to AI Audit",
+  "aig:read": "Grants read level access to AI Gateway",
+  "aig:write": "Grants write level access to AI Gateway",
+  "auditlogs:read": "View Cloudflare Account Audit Logs",
+  "browser:read": "Grants read level access to Browser Rendering",
+  "browser:write": "Grants write level access to Browser Rendering",
+  "cfone:read": "Grants read level access to Cloudforce One data",
+  "cfone:write": "Grants write level access to Cloudforce One data",
+  "cloudchamber:write": "See and make changes to Cloudchamber",
+  "connectivity:admin":
+    "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel",
+  "connectivity:bind":
+    "read, list, and bind to Connectivity Directory services, as well as read and list Cloudflare Tunnels",
+  "connectivity:read":
+    "See Connectivity Directory services and Cloudflare Tunnels",
+  "constellation:write":
+    "Grants write access to Constellation configuration and models",
+  "containers:write": "See and make changes to Workers Containers",
+  "d1:write": "See and make changes to D1",
+  "dex:read": "Grants read level access to Cloudflare DEX",
+  "dex:write": "Grants write level access to Cloudflare DEX",
+  "dns_analytics:read": "Grants read level access to Cloudflare DNS Analytics",
+  "dns_records:edit": "Grants edit level access to dns records",
+  "dns_records:read": "Grants read level access to dns records",
+  "dns_settings:read": "Grants read level access to Cloudflare DNS Settings",
+  "firstpartytags:write":
+    "Can see, edit and publish Google tag gateway configuration.",
+  "lb:edit": "Grants edit level access to lb and lb pools",
+  "lb:read": "Grants read level access to lb and lb pools",
+  "logpush:read": "See Cloudflare Logpush data",
+  "logpush:write": "See and change Cloudflare Logpush data",
+  "notification:read": "View Cloudflare Notifications",
+  "notification:write": "View and Modify Cloudflare Notifications",
+  "pages:read": "See Cloudflare Pages projects, settings and deployments",
+  "pages:write":
+    "See and change Cloudflare Pages projects, settings and deployments",
+  "pipelines:read": "Grants read level access to Cloudflare Pipelines",
+  "pipelines:setup":
+    "Grants permission to generate R2 tokens for Workers Pipelines",
+  "pipelines:write": "Grants write level access to Cloudflare Pipelines",
+  "query_cache:write": "See and make changes to Hyperdrive",
+  "queues:write": "See and change Cloudflare Queues settings and data",
+  "r2_catalog:write": "Grants write level access to R2 Data Catalog",
+  "radar:read": "Grants access to read Cloudflare Radar data",
+  "ai-search:read": "Grants read level access to AI Search",
+  "ai-search:write": "Grants write level access to AI Search",
+  "ai-search:run": "Grants run level access to AI Search",
+  "secrets_store:read": "Grants read level access to Secrets Store",
+  "secrets_store:write": "Grants write level access to Secrets Store",
+  "ssl_certs:write":
+    "Grants read and write access to SSL MTLS certificates or Certificate Store",
+  "sso-connector:read": "See Cloudflare SSO connectors",
+  "sso-connector:write":
+    "See Cloudflare SSO connectors to toggle activation and deactivation of SSO",
+  "teams:pii": "See personally identifiable Cloudflare Teams data",
+  "teams:read":
+    "See Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+  "teams:secure_location":
+    "See all DNS Location data but can only change secure DNS Locations",
+  "teams:write":
+    "See and change Cloudflare Teams data such as zones, gateway, and argo tunnel details",
+  "url_scanner:read": "Grants read level access to URL Scanner",
+  "url_scanner:write": "Grants write level access to URL Scanner",
+  "user:read":
+    "See your user info such as name, email address, and account memberships",
+  "vectorize:write": "See and make changes to Vectorize",
+  "workers:read":
+    "See Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+  "workers:write":
+    "See and change Cloudflare Workers data such as zones, KV storage, R2 storage, scripts, and routes",
+  "workers_builds:read":
+    "See Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+  "workers_builds:write":
+    "See and change Cloudflare Workers Builds data such as builds, build configuration, and build logs",
+  "workers_kv:write":
+    "See and change Cloudflare Workers KV Storage data such as keys and namespaces",
+  "workers_observability:read":
+    "Grants read access to Cloudflare Workers Observability",
+  "workers_observability_telemetry:write":
+    "Grants write access to Cloudflare Workers Observability Telemetry API",
+  "workers_routes:write":
+    "See and change Cloudflare Workers data such as filters and routes",
+  "workers_scripts:write":
+    "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data",
+  "workers_tail:read": "See Cloudflare Workers tail and script data",
+  "zone:read": "Grants read level access to account zone",
+};
+
+export const DEFAULT_SCOPES = [
+  "account:read",
+  "ai-search:write",
+  "ai-search:run",
+  "ai:write",
+  "aig:read",
+  "aig:write",
+  "cloudchamber:write",
+  "connectivity:admin",
+  "containers:write",
+  "d1:write",
+  "pages:write",
+  "pipelines:write",
+  "queues:write",
+  "secrets_store:write",
+  "ssl_certs:write",
+  "user:read",
+  "vectorize:write",
+  "workers_kv:write",
+  "workers_observability:read",
+  "workers_observability_telemetry:write",
+  "workers_routes:write",
+  "workers_scripts:write",
+  "workers_tail:read",
+  "workers:write",
+  "zone:read",
+];
+
+export const OAUTH_CLIENT_ID = "6d8c2255-0773-45f6-b376-2914632e6f91";
+export const OAUTH_REDIRECT_URI = "http://localhost:9976/auth/callback";
+export const OAUTH_ENDPOINTS = {
+  authorize: "https://dash.cloudflare.com/oauth2/authorize",
+  token: "https://dash.cloudflare.com/oauth2/token",
+  revoke: "https://dash.cloudflare.com/oauth2/revoke",
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/OAuthClient.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/OAuthClient.ts
new file mode 100644
index 00000000000..2e9f4c7c8f9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/OAuthClient.ts
@@ -0,0 +1,315 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import crypto from "node:crypto";
+import http from "node:http";
+import {
+  OAUTH_CLIENT_ID,
+  OAUTH_ENDPOINTS,
+  OAUTH_REDIRECT_URI,
+} from "./AuthProvider.ts";
+
+export class OAuthError extends Data.TaggedError("OAuthError")<{
+  error: string;
+  errorDescription: string;
+}> {}
+
+export interface OAuthCredentials {
+  type: "oauth";
+  access: string;
+  refresh: string;
+  expires: number;
+  scopes: string[];
+}
+
+export interface Authorization {
+  url: string;
+  state: string;
+  verifier: string;
+}
+
+function generateState(length = 32): string {
+  return crypto.randomBytes(length).toString("base64url");
+}
+
+function generatePKCE(length = 96): {
+  verifier: string;
+  challenge: string;
+} {
+  const verifier = crypto.randomBytes(length).toString("base64url");
+  const challenge = crypto
+    .createHash("sha256")
+    .update(verifier)
+    .digest("base64url");
+  return { verifier, challenge };
+}
+
+function extractCredentials(json: {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  scope: string;
+}): OAuthCredentials {
+  return {
+    type: "oauth",
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1000,
+    scopes: json.scope.split(" "),
+  };
+}
+
+const tokenRequest = (
+  body: Record<string, string>,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  Effect.gen(function* () {
+    const res = yield* Effect.tryPromise({
+      try: () =>
+        fetch(OAUTH_ENDPOINTS.token, {
+          method: "POST",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+          },
+          body: new URLSearchParams(body).toString(),
+        }),
+      catch: (err) =>
+        new OAuthError({
+          error: "network_error",
+          errorDescription: `Token request failed: ${err}`,
+        }),
+    });
+
+    if (!res.ok) {
+      const json = yield* Effect.tryPromise({
+        try: () =>
+          res.json() as Promise<{ error: string; error_description: string }>,
+        catch: () =>
+          new OAuthError({
+            error: "parse_error",
+            errorDescription: `Token endpoint returned ${res.status}`,
+          }),
+      });
+      return yield* new OAuthError({
+        error: json.error,
+        errorDescription: json.error_description,
+      });
+    }
+
+    const json = yield* Effect.tryPromise({
+      try: () =>
+        res.json() as Promise<{
+          access_token: string;
+          refresh_token: string;
+          expires_in: number;
+          scope: string;
+        }>,
+      catch: () =>
+        new OAuthError({
+          error: "parse_error",
+          errorDescription: "Failed to parse token response",
+        }),
+    });
+    return extractCredentials(json);
+  });
+
+/**
+ * Generate an authorization URL with PKCE for the given scopes.
+ */
+export function authorize(scopes: string[]): Authorization {
+  const state = generateState();
+  const pkce = generatePKCE();
+  const url = new URL(OAUTH_ENDPOINTS.authorize);
+  url.searchParams.set("client_id", OAUTH_CLIENT_ID);
+  url.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", scopes.join(" "));
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", pkce.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return { url: url.toString(), state, verifier: pkce.verifier };
+}
+
+/**
+ * Exchange an authorization code for OAuth credentials.
+ */
+export const exchange = (
+  code: string,
+  verifier: string,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  tokenRequest({
+    grant_type: "authorization_code",
+    code,
+    code_verifier: verifier,
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
+  });
+
+/**
+ * Refresh expired OAuth credentials.
+ */
+export const refresh = (
+  credentials: OAuthCredentials,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  tokenRequest({
+    grant_type: "refresh_token",
+    refresh_token: credentials.refresh,
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
+  });
+
+/**
+ * Revoke OAuth credentials.
+ */
+export const revoke = (
+  credentials: OAuthCredentials,
+): Effect.Effect<void, OAuthError> =>
+  Effect.gen(function* () {
+    yield* Effect.tryPromise({
+      try: () =>
+        fetch(OAUTH_ENDPOINTS.revoke, {
+          method: "POST",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+          },
+          body: new URLSearchParams({
+            refresh_token: credentials.refresh,
+            client_id: OAUTH_CLIENT_ID,
+            redirect_uri: OAUTH_REDIRECT_URI,
+          }).toString(),
+        }),
+      catch: (err) =>
+        new OAuthError({
+          error: "network_error",
+          errorDescription: `Revoke request failed: ${err}`,
+        }),
+    });
+  });
+
+/**
+ * Start a local HTTP server to listen for the OAuth callback, exchange
+ * the authorization code, and return the credentials.
+ *
+ * Times out after 5 minutes.
+ */
+export const callback = (
+  authorization: Authorization,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  Effect.tryPromise({
+    try: () => callbackPromise(authorization),
+    catch: (err) => {
+      if (err instanceof OAuthError) return err;
+      return new OAuthError({
+        error: "callback_error",
+        errorDescription: `OAuth callback failed: ${err}`,
+      });
+    },
+  });
+
+function callbackPromise(
+  authorization: Authorization,
+): Promise<OAuthCredentials> {
+  const { pathname, port } = new URL(OAUTH_REDIRECT_URI);
+
+  return new Promise<OAuthCredentials>((resolve, reject) => {
+    const server = http.createServer(async (req, res) => {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+
+      if (url.pathname !== pathname) {
+        res.statusCode = 404;
+        res.end("Not Found");
+        return;
+      }
+
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      if (error) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(
+          new OAuthError({
+            error,
+            errorDescription: errorDescription ?? "An unknown error occurred.",
+          }),
+        );
+        return;
+      }
+
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code || !state) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(
+          new OAuthError({
+            error: "invalid_request",
+            errorDescription: "Missing code or state",
+          }),
+        );
+        return;
+      }
+
+      if (state !== authorization.state) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(
+          new OAuthError({
+            error: "invalid_request",
+            errorDescription: "Invalid state",
+          }),
+        );
+        return;
+      }
+
+      try {
+        const credentials = await Effect.runPromise(
+          exchange(code, authorization.verifier),
+        );
+        res.writeHead(302, {
+          Location: "https://alchemy.run/auth/success",
+        });
+        res.end();
+        cleanup();
+        resolve(credentials);
+      } catch (err) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(err);
+      }
+    });
+
+    const timeout = setTimeout(
+      () => {
+        cleanup();
+        reject(
+          new OAuthError({
+            error: "timeout",
+            errorDescription: "The authorization process timed out.",
+          }),
+        );
+      },
+      5 * 60 * 1000,
+    );
+
+    function cleanup() {
+      clearTimeout(timeout);
+      server.close();
+    }
+
+    server.on("error", (err) => {
+      cleanup();
+      reject(
+        new OAuthError({
+          error: "server_error",
+          errorDescription: `Failed to start callback server: ${err.message}`,
+        }),
+      );
+    });
+
+    server.listen(Number(port));
+  });
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Bridge.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Bridge.ts
new file mode 100644
index 00000000000..1ee77ddcbd9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Bridge.ts
@@ -0,0 +1,3 @@
+export * from "./Workers/InferEnv.ts";
+export * from "./Workers/Rpc.ts";
+export * from "./Workers/RpcAsync.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/Browser.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/Browser.ts
new file mode 100644
index 00000000000..4d8a5376c45
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/Browser.ts
@@ -0,0 +1,140 @@
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { BrowserBinding, type BrowserClient } from "./BrowserBinding.ts";
+
+type BrowserTypeId = typeof BrowserTypeId;
+const BrowserTypeId = "Cloudflare.Browser" as const;
+
+export type BrowserProps = {
+  /**
+   * Binding name used when `Browser` is bound from inside a Worker init phase
+   * (`yield* Cloudflare.Browser(...)`). When passed through
+   * `Worker({ env: { ... } })`, the object key remains the binding name.
+   *
+   * @default "BROWSER"
+   */
+  name?: string;
+};
+
+/**
+ * The Effect yielded when a `Browser` marker is used inside a Worker init
+ * phase: it attaches the `browser` binding to the surrounding Worker and
+ * resolves to the runtime {@link BrowserClient}.
+ */
+type BindEffect = Effect.Effect<BrowserClient, never, BrowserBinding>;
+
+/**
+ * Marker for a Cloudflare Browser Rendering binding.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.Browser(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link BrowserClient} — no separate
+ * `.bind(...)` step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `Fetcher` in the `env`
+ * position), but it is iterable as one when `yield*`-ed.
+ */
+export interface Browser {
+  kind: BrowserTypeId;
+  name: string;
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, BrowserClient>;
+}
+
+export const isBrowser = (value: unknown): value is Browser =>
+  typeof value === "object" && (value as Browser)?.kind === BrowserTypeId;
+
+/**
+ * A Cloudflare Browser Rendering binding for launching headless browser
+ * sessions from Workers via `@cloudflare/puppeteer`.
+ *
+ * @binding
+ *
+ * @section Effect-style Worker (recommended)
+ * @example Render a page title with managed browser cleanup
+ * ```typescript
+ * import puppeteer from "@cloudflare/puppeteer";
+ * import * as Effect from "effect/Effect";
+ *
+ * Cloudflare.Worker(
+ *   "BrowserWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const browser = yield* Cloudflare.Browser({ name: "BROWSER" });
+ *
+ *     return {
+ *       fetch: browser.withBrowser(puppeteer, (browser) =>
+ *         Effect.gen(function* () {
+ *           const page = yield* Effect.tryPromise(() => browser.newPage());
+ *           yield* Effect.tryPromise(() => page.goto("https://example.com"));
+ *           const title = yield* Effect.tryPromise(() => page.title());
+ *           return Response.json({ title });
+ *         }),
+ *       ),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.BrowserBindingLive)),
+ * );
+ * ```
+ *
+ * @section Worker binding metadata
+ * @example
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: {
+ *     BROWSER: Cloudflare.Browser(),
+ *   },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { BROWSER: Fetcher }
+ * ```
+ *
+ * @example Async-style worker with the raw runtime binding
+ * ```typescript
+ * import puppeteer from "@cloudflare/puppeteer";
+ * import type { WorkerEnv } from "../alchemy.run.ts";
+ *
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     const browser = await puppeteer.launch(env.BROWSER);
+ *     const page = await browser.newPage();
+ *     await page.goto("https://example.com");
+ *     const screenshot = await page.screenshot();
+ *     await browser.close();
+ *
+ *     return new Response(screenshot, {
+ *       headers: { "content-type": "image/png" },
+ *     });
+ *   },
+ * };
+ * ```
+ *
+ * @see https://developers.cloudflare.com/browser-rendering/workers-binding-api/
+ */
+export const Browser: {
+  (props?: BrowserProps): Browser;
+  /**
+   * Bind an existing `Browser` marker to the surrounding Worker, returning the
+   * runtime client. Equivalent to `yield* browser` — prefer yielding the marker
+   * directly.
+   */
+  bind: typeof BrowserBinding.bind;
+} = Object.assign(
+  (props?: BrowserProps): Browser => {
+    const self: Browser = {
+      kind: BrowserTypeId,
+      name: props?.name ?? "BROWSER",
+      asEffect: () => BrowserBinding.bind(self),
+      [Symbol.iterator]: () => new SingleShotGen(BrowserBinding.bind(self)),
+    };
+    return self;
+  },
+  {
+    bind: (...args: Parameters<typeof BrowserBinding.bind>) =>
+      BrowserBinding.bind(...args),
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/BrowserBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/BrowserBinding.ts
new file mode 100644
index 00000000000..2c7a4068867
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/BrowserBinding.ts
@@ -0,0 +1,128 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Browser as BrowserLike } from "./Browser.ts";
+
+export class BrowserError extends Data.TaggedError("BrowserError")<{
+  message: string;
+  cause: unknown;
+}> {}
+
+export interface BrowserHandle {
+  close(): Promise<void>;
+}
+
+export interface BrowserPuppeteer<Browser extends BrowserHandle> {
+  launch(binding: cf.Fetcher): Promise<Browser>;
+}
+
+/**
+ * Effect-native client for a Cloudflare Browser Rendering binding.
+ *
+ * Browser Rendering's Workers binding is consumed by `@cloudflare/puppeteer`.
+ * Alchemy keeps Puppeteer as a caller-provided dependency while wrapping
+ * launch and cleanup in Effects.
+ */
+export interface BrowserClient {
+  /**
+   * Effect resolving to the raw Cloudflare Browser Rendering runtime binding.
+   */
+  raw: Effect.Effect<cf.Fetcher, never, WorkerEnvironment>;
+  /**
+   * Launch a Browser Rendering session through `@cloudflare/puppeteer`.
+   */
+  launch<Browser extends BrowserHandle>(
+    puppeteer: BrowserPuppeteer<Browser>,
+  ): Effect.Effect<Browser, BrowserError, WorkerEnvironment>;
+  /**
+   * Launch a browser, run an Effect with it, and close it afterward.
+   */
+  withBrowser<Browser extends BrowserHandle, A, E, R>(
+    puppeteer: BrowserPuppeteer<Browser>,
+    use: (browser: Browser) => Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, BrowserError | E, WorkerEnvironment | R>;
+}
+
+export class BrowserBinding extends Binding.Service<
+  BrowserBinding,
+  (browser: BrowserLike) => Effect.Effect<BrowserClient>
+>()("Cloudflare.Browser.Binding") {}
+
+export const BrowserBindingLive = Layer.effect(
+  BrowserBinding,
+  Effect.gen(function* () {
+    const Policy = yield* BrowserBindingPolicy;
+
+    return Effect.fn(function* (browser: BrowserLike) {
+      yield* Policy(browser);
+      // Cloudflare exposes Browser Rendering as a service-style binding for
+      // @cloudflare/puppeteer; workers-types has no narrower interface.
+      const raw = WorkerEnvironment.useSync(
+        (env) => (env as Record<string, cf.Fetcher>)[browser.name]!,
+      );
+      return makeBrowserClient(raw);
+    });
+  }),
+);
+
+export class BrowserBindingPolicy extends Binding.Policy<
+  BrowserBindingPolicy,
+  (browser: BrowserLike) => Effect.Effect<void>
+>()("Cloudflare.Browser.Binding") {}
+
+export const BrowserBindingPolicyLive = BrowserBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, browser: BrowserLike) {
+    if (isWorker(host)) {
+      yield* host.bind(browser.name, {
+        bindings: [
+          {
+            type: "browser",
+            name: browser.name,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`BrowserBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
+
+const tryPromise = <T>(fn: () => Promise<T>): Effect.Effect<T, BrowserError> =>
+  Effect.tryPromise({
+    try: fn,
+    catch: (error) =>
+      new BrowserError({
+        message:
+          error instanceof Error
+            ? error.message
+            : "Unknown Browser Rendering error",
+        cause: error,
+      }),
+  });
+
+/** @internal */
+export const makeBrowserClient = (
+  raw: Effect.Effect<cf.Fetcher, never, WorkerEnvironment>,
+): BrowserClient => {
+  const launch = <Browser extends BrowserHandle>(
+    puppeteer: BrowserPuppeteer<Browser>,
+  ) =>
+    raw.pipe(
+      Effect.flatMap((binding) => tryPromise(() => puppeteer.launch(binding))),
+    );
+
+  return {
+    raw,
+    launch,
+    withBrowser: (puppeteer, use) =>
+      Effect.acquireUseRelease(launch(puppeteer), use, (browser) =>
+        tryPromise(() => browser.close()),
+      ),
+  } satisfies BrowserClient;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/index.ts
new file mode 100644
index 00000000000..7fa30ba378e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Browser/index.ts
@@ -0,0 +1,11 @@
+export * from "./Browser.ts";
+export {
+  BrowserBinding,
+  BrowserBindingLive,
+  BrowserBindingPolicy,
+  BrowserBindingPolicyLive,
+  BrowserError,
+  type BrowserClient,
+  type BrowserHandle,
+  type BrowserPuppeteer,
+} from "./BrowserBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/CloudflareEnvironment.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/CloudflareEnvironment.ts
new file mode 100644
index 00000000000..6381fe7eacd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/CloudflareEnvironment.ts
@@ -0,0 +1,50 @@
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  CLOUDFLARE_AUTH_PROVIDER_NAME,
+  type CloudflareAuthConfig,
+  type CloudflareResolvedCredentials,
+} from "./Auth/AuthProvider.ts";
+
+export class CloudflareEnvironment extends Context.Service<
+  CloudflareEnvironment,
+  CloudflareResolvedCredentials
+>()("Cloudflare::CloudflareEnvironment") {}
+
+const CLOUDFLARE_ACCOUNT_ID = Config.string("CLOUDFLARE_ACCOUNT_ID");
+
+export const fromEnv = () =>
+  Layer.effect(
+    CloudflareEnvironment,
+    Effect.gen(function* () {
+      const accountId = yield* CLOUDFLARE_ACCOUNT_ID.pipe(
+        Config.option,
+        Config.map(Option.getOrUndefined),
+      );
+      return { account: accountId } as any;
+    }),
+  );
+
+export const fromProfile = () =>
+  Layer.effect(
+    CloudflareEnvironment,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        CloudflareAuthConfig,
+        CloudflareResolvedCredentials
+      >(CLOUDFLARE_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      // `loadOrConfigure` reads the persisted config under the canonical
+      // provider name (`Cloudflare`); only runs `configure` (and persists the
+      // result) if no stored config exists.
+      const config = yield* profile.loadOrConfigure(auth, profileName, { ci });
+      return yield* auth.read(profileName, config as CloudflareAuthConfig);
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/Container.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/Container.ts
new file mode 100644
index 00000000000..f85924ef711
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/Container.ts
@@ -0,0 +1,318 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Config from "effect/Config";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { HttpServer, type HttpEffect } from "../../Http.ts";
+import * as Output from "../../Output.ts";
+import { Platform } from "../../Platform.ts";
+import * as Server from "../../Server/index.ts";
+import type { Fetcher } from "../Fetcher.ts";
+import type {
+  ContainerApplication,
+  ContainerApplicationProps,
+  ContainerServices,
+  ContainerShape,
+} from "./ContainerApplication.ts";
+import { bindContainer } from "./ContainerBinding.ts";
+
+export const ContainerTypeId = "Cloudflare.Container";
+export type ContainerTypeId = typeof ContainerTypeId;
+
+export const isContainer = <T>(value: T): value is T & Container =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  value.Type === ContainerTypeId;
+
+export class ContainerError extends Data.TaggedError("ContainerError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export interface ContainerStartupOptions extends cf.ContainerStartupOptions {}
+
+export interface ContainerProps extends ContainerApplicationProps {
+  main: string;
+}
+
+export type Container = {
+  get running(): Effect.Effect<boolean>;
+  start(options?: ContainerStartupOptions): Effect.Effect<void>;
+  monitor(): Effect.Effect<void, ContainerError>;
+  destroy(error?: any): Effect.Effect<void>;
+  signal(signo: number): Effect.Effect<void>;
+  getTcpPort(port: number): Effect.Effect<Fetcher>;
+  setInactivityTimeout(durationMs: number | bigint): Effect.Effect<void>;
+  interceptOutboundHttp(addr: string, binding: Fetcher): Effect.Effect<void>;
+  interceptAllOutboundHttp(binding: Fetcher): Effect.Effect<void>;
+};
+
+/**
+ * A Cloudflare Container that runs a long-lived process alongside a
+ * Durable Object.
+ *
+ * Containers always use the **Container Layer** pattern — the class
+ * and `.make()` must live in separate files. A Container must be
+ * bound to a Durable Object, and the DO imports the class to get a
+ * typed handle. If the class and `.make()` lived in the same file,
+ * the DO's bundle would pull in all of the container's runtime
+ * dependencies (process spawners, Node APIs, SDKs, etc.), which
+ * would bloat the bundle and likely break the Cloudflare Workers
+ * runtime. Keeping them separate ensures the bundler only includes
+ * the tiny class in the DO's output.
+ *
+ * See the {@link https://alchemy.run/concepts/platform | Platform
+ * concept} page for how this fits into the async / effect / layer
+ * progression.
+ *
+ * @section Container Layer
+ * Define the class and `.make()` in separate files. The class
+ * declares the container's identity, configuration, and typed
+ * shape. `.make()` provides the runtime implementation as a
+ * default export. Use `Container.of` to construct the typed
+ * shape — it ensures your implementation matches the methods
+ * declared on the class.
+ *
+ * @example Container class
+ * ```typescript
+ * // src/Sandbox.ts
+ * export class Sandbox extends Cloudflare.Container<
+ *   Sandbox,
+ *   {
+ *     exec: (cmd: string) => Effect.Effect<{
+ *       exitCode: number;
+ *       stdout: string;
+ *       stderr: string;
+ *     }>;
+ *   }
+ * >()(
+ *   "Sandbox",
+ *   { main: import.meta.filename },
+ * ) {}
+ * ```
+ *
+ * @example Container .make()
+ * ```typescript
+ * // src/Sandbox.runtime.ts
+ * export default Sandbox.make(
+ *   Effect.gen(function* () {
+ *     const cp = yield* ChildProcessSpawner;
+ *
+ *     return Sandbox.of({
+ *       exec: (cmd) =>
+ *         cp.spawn(ChildProcess.make(cmd, { shell: true })).pipe(
+ *           Effect.map(({ exitCode, stdout, stderr }) => ({
+ *             exitCode, stdout, stderr,
+ *           })),
+ *           Effect.scoped,
+ *         ),
+ *       fetch: Effect.succeed(
+ *         HttpServerResponse.text("Hello from container!"),
+ *       ),
+ *     });
+ *   }),
+ * );
+ * ```
+ *
+ * @section Configuration
+ * The props object accepts `main` (entrypoint file), `instanceType`
+ * (compute size), `runtime` (`"bun"` or `"node"`), and
+ * `observability` settings. Use `Stack.useSync` to read the
+ * surrounding stack at declaration time and pick a beefier
+ * `instanceType` in prod while keeping the cheap `dev` instance for
+ * preview environments.
+ *
+ * @example Stage-dependent configuration
+ * ```typescript
+ * export class Sandbox extends Cloudflare.Container<Sandbox>()(
+ *   "Sandbox",
+ *   Stack.useSync((stack) => ({
+ *     main: import.meta.filename,
+ *     instanceType: stack.stage === "prod" ? "standard-1" : "dev",
+ *     observability: { logs: { enabled: true } },
+ *   })),
+ * ) {}
+ * ```
+ *
+ * @section Stack-level wiring
+ * The `.make()` `export default` is the side-effect that registers
+ * the container's runtime. It must be reachable from your
+ * `alchemy.run.ts` so the bundler emits the runtime entrypoint.
+ * Provide it on the Stack's generator with `Effect.provide`.
+ *
+ * @example Wiring SandboxLive into the Stack
+ * ```typescript
+ * // alchemy.run.ts
+ * import SandboxLive from "./src/Sandbox.runtime.ts";
+ *
+ * export default Alchemy.Stack(
+ *   "MyApp",
+ *   { providers: Cloudflare.providers(), state: Cloudflare.state() },
+ *   Effect.gen(function* () {
+ *     const worker = yield* Worker;
+ *     return { url: worker.url };
+ *   }).pipe(Effect.provide(SandboxLive)),
+ * );
+ * ```
+ *
+ * @section Calling from a Durable Object
+ * Use `Cloudflare.Container.bind(Sandbox)` in the **outer** init
+ * phase of a Durable Object — only the class is imported, so the
+ * DO bundle stays tiny. Then `Cloudflare.start(sandbox)` in the
+ * **inner** per-instance phase ensures the container is running
+ * and gives you a typed handle that exposes every method declared
+ * on the container's shape **plus** a `getTcpPort` helper.
+ *
+ * @example Binding and starting a container from a DO
+ * ```typescript
+ * export default class Agent extends Cloudflare.DurableObjectNamespace<Agent>()(
+ *   "Agents",
+ *   Effect.gen(function* () {
+ *     // OUTER (init): only the class is referenced — the runtime
+ *     // implementation in `Sandbox.runtime.ts` is tree-shaken out
+ *     // of this DO's bundle.
+ *     const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+ *
+ *     return Effect.gen(function* () {
+ *       // INNER (per-instance): start the container and expose RPC.
+ *       const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+ *
+ *       return {
+ *         exec: (cmd: string) => container.exec(cmd),
+ *       };
+ *     });
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Starting from a Durable Object
+ * Use `Cloudflare.Container.bind` in the outer init phase to bind
+ * the container class, then `Cloudflare.start` in the inner
+ * per-instance phase to start it. Because the DO only imports the
+ * class, the runtime implementation is completely excluded from the
+ * DO's bundle.
+ *
+ * @example Binding and starting a container
+ * ```typescript
+ * // init (outer Effect) — only imports the class
+ * const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+ *
+ * // per-instance (inner Effect)
+ * return Effect.gen(function* () {
+ *   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+ *
+ *   return {
+ *     exec: (cmd: string) => container.exec(cmd),
+ *   };
+ * });
+ * ```
+ *
+ * @section HTTP Requests to Container Ports
+ * Use `getTcpPort` to get a `fetch` handle for a specific port on
+ * the running container. This lets you make HTTP requests to
+ * servers running inside the container process.
+ *
+ * @example Fetching from a container port
+ * ```typescript
+ * const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+ * const { fetch } = yield* container.getTcpPort(3000);
+ *
+ * const response = yield* fetch(
+ *   HttpClientRequest.get("http://container/health"),
+ * );
+ * ```
+ */
+export const Container: Platform<
+  ContainerApplication,
+  ContainerServices,
+  ContainerShape,
+  Server.ProcessContext,
+  Container
+> & {
+  bind: typeof bindContainer;
+} = Platform(
+  "Cloudflare.Container",
+  {
+    createRuntimeContext: (id: string): Server.ProcessContext => {
+      const runners: Effect.Effect<void, never, any>[] = [];
+      const env: Record<string, any> = {};
+
+      const serve = <Req = never>(handler: HttpEffect<Req>) =>
+        Effect.sync(() => {
+          runners.push(
+            Effect.gen(function* () {
+              const httpServer = yield* Effect.serviceOption(HttpServer).pipe(
+                Effect.map(Option.getOrUndefined),
+              );
+              if (httpServer) {
+                yield* httpServer.serve(handler);
+                yield* Effect.never;
+              } else {
+                // this should only happen at plantime, validate?
+              }
+            }).pipe(Effect.orDie),
+          );
+        });
+
+      return {
+        Type: ContainerTypeId,
+        LogicalId: id,
+        id,
+        env,
+        set: (bindingId: string, output: Output.Output) =>
+          Effect.sync(() => {
+            const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
+            env[key] = output.pipe(
+              Output.map((value) => JSON.stringify(value)),
+            );
+            return key;
+          }),
+        get: <T>(key: string) =>
+          Config.string(key)
+
+            .pipe(
+              Effect.flatMap((value) =>
+                Effect.try({
+                  try: () => JSON.parse(value) as T,
+                  catch: (error) => error as Error,
+                }),
+              ),
+              Effect.catch((cause) =>
+                Effect.die(
+                  new Error(`Failed to get environment variable: ${key}`, {
+                    cause,
+                  }),
+                ),
+              ),
+            ),
+        run: ((effect: Effect.Effect<void, never, any>) =>
+          Effect.sync(() => {
+            runners.push(effect);
+          })) as unknown as Server.ProcessContext["run"],
+        serve,
+        exports: Effect.sync(() => ({
+          default: Effect.all(
+            runners.map((eff) =>
+              Effect.forever(
+                eff.pipe(
+                  // Log and ignore errors (daemon mode, it should just re-run)
+                  Effect.tapError((err) => Effect.logError(err)),
+                  Effect.ignore,
+                  // TODO(sam): ignore cause? for now, let that actually kill the server
+                  // Effect.ignoreCause
+                ),
+              ),
+            ),
+            {
+              concurrency: "unbounded",
+            },
+          ),
+        })),
+      } as Server.ProcessContext;
+    },
+  },
+  {
+    bind: bindContainer,
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/ContainerApplication.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/ContainerApplication.ts
new file mode 100644
index 00000000000..5752bdc7697
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/ContainerApplication.ts
@@ -0,0 +1,1298 @@
+import * as Containers from "@distilled.cloud/cloudflare/containers";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schedule from "effect/Schedule";
+import type * as rolldown from "rolldown";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import {
+  dockerBuild,
+  materializeDockerfile,
+  pushImage,
+  writeContextFiles,
+} from "../../Bundle/Docker.ts";
+import {
+  findCwdForBundle,
+  getStableContextDir,
+} from "../../Bundle/TempRoot.ts";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import {
+  type Main,
+  type PlatformProps,
+  type PlatformServices,
+} from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { Self } from "../../Self.ts";
+import * as Server from "../../Server/index.ts";
+import { Stack } from "../../Stack.ts";
+import { sha256Object } from "../../Util/sha256.ts";
+import { normalizeNulls } from "../../Util/stable.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { CloudflareLogs, type TelemetryFilter } from "../Logs.ts";
+import type { Providers } from "../Providers.ts";
+import { Container, ContainerTypeId } from "./Container.ts";
+
+export { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+
+export namespace ContainerApplication {
+  export type InstanceType = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["instanceType"]
+  >;
+  export type SchedulingPolicy = NonNullable<
+    Containers.CreateContainerApplicationRequest["schedulingPolicy"]
+  >;
+  export type Observability = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["observability"]
+  >;
+  export type Secret = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["secrets"]
+  >[number];
+  export type Disk = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["disk"]
+  >;
+  export type EnvironmentVariable = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["environmentVariables"]
+  >[number];
+  export type Label = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["labels"]
+  >[number];
+  export type Network = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["network"]
+  >;
+  export type Dns = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["dns"]
+  >;
+  export type Port = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["ports"]
+  >[number];
+  export type Check = NonNullable<
+    Containers.CreateContainerApplicationRequest["configuration"]["checks"]
+  >[number];
+  export type Constraints = {
+    tier?: number;
+  };
+  export type Affinities = {
+    colocation?: "datacenter";
+  };
+  export type Configuration =
+    Containers.CreateContainerApplicationRequest["configuration"];
+  export interface Rollout {
+    strategy?: "rolling" | "immediate";
+    kind?: "full_auto";
+    stepPercentage?: number;
+  }
+}
+
+export interface ContainerApplicationProps extends PlatformProps {
+  /**
+   * Main entrypoint for the container program. This file is bundled and
+   * added to the Docker image as the container's entrypoint.
+   */
+  main?: string;
+  /**
+   * Exported handler symbol inside the bundled module.
+   * @default "default"
+   */
+  handler?: string;
+  /**
+   * Runtime environment for the container program.
+   *
+   * @default "bun"
+   */
+  runtime?: "bun" | "node";
+  /**
+   * Module specifiers that Rolldown should mark as external when bundling
+   * the container entrypoint. The matching packages are installed inside the
+   * image via the runtime's package manager (`bun add` for `runtime: "bun"`,
+   * `npm install` for `runtime: "node"`) before the entrypoint runs.
+   *
+   * Use this for native dependencies that must not be bundled (e.g. `sharp`,
+   * `impit`) or for packages that intentionally ship in the base image.
+   *
+   * Install inside the image is controlled by {@link autoInstallExternals}
+   * (default `true`); set it to `false` if your custom `dockerfile` already
+   * installs these packages and you want to avoid the redundant step.
+   */
+  external?: string[];
+  /**
+   * Whether to auto-install the packages listed in {@link external} inside
+   * the container image (via `bun add` or `npm install`) before running the
+   * entrypoint.
+   *
+   * @default true
+   *
+   * Set to `false` when your custom `dockerfile` already installs these
+   * packages (for example, via a base image that pre-installs `sharp`), to
+   * avoid the redundant install step.
+   */
+  autoInstallExternals?: boolean;
+  /**
+   * Human-readable application name. If omitted, Alchemy derives a deterministic
+   * physical name from the stack, stage, and logical ID.
+   */
+  name?: string;
+  /**
+   * Inline Dockerfile used as the base for building the container image.
+   * Alchemy appends statements to copy the bundled program and set the
+   * entrypoint. If omitted, a default base image matching the runtime is used.
+   */
+  dockerfile?: string;
+  /**
+   * Initial number of instances to maintain.
+   * @default 1
+   */
+  instances?: number;
+  /**
+   * Maximum number of instances the application may scale to.
+   * @default 1
+   */
+  maxInstances?: number;
+  /**
+   * Scheduling policy used by Cloudflare's containers control plane.
+   * @default "default"
+   */
+  schedulingPolicy?: ContainerApplication.SchedulingPolicy;
+  /**
+   * Instance type for each deployment.
+   * @default "dev"
+   */
+  instanceType?: ContainerApplication.InstanceType;
+  /**
+   * Observability settings for the deployment.
+   */
+  observability?: ContainerApplication.Observability;
+  /**
+   * SSH public keys to install into the deployment.
+   */
+  sshPublicKeyIds?: string[];
+  /**
+   * Secrets exposed to the container runtime as environment variables.
+   */
+  secrets?: ContainerApplication.Secret[];
+  /**
+   * CPU allocation override for each deployment.
+   */
+  vcpu?: number;
+  /**
+   * Memory allocation override for each deployment.
+   */
+  memory?: string;
+  /**
+   * Disk allocation override for each deployment.
+   */
+  disk?: ContainerApplication.Disk;
+  /**
+   * Plain environment variables passed to the container runtime.
+   */
+  environmentVariables?: ContainerApplication.EnvironmentVariable[];
+  /**
+   * Labels attached to the deployment.
+   */
+  labels?: ContainerApplication.Label[];
+  /**
+   * Network configuration for the deployment.
+   */
+  network?: ContainerApplication.Network;
+  /**
+   * Command override for the container image.
+   */
+  command?: string[];
+  /**
+   * Entrypoint override for the container image.
+   */
+  entrypoint?: string[];
+  /**
+   * DNS configuration for the deployment.
+   */
+  dns?: ContainerApplication.Dns;
+  /**
+   * Exposed ports for the deployment.
+   */
+  ports?: ContainerApplication.Port[];
+  /**
+   * Health and readiness checks for the deployment.
+   */
+  checks?: ContainerApplication.Check[];
+  /**
+   * Resource constraints for the application.
+   */
+  constraints?: ContainerApplication.Constraints;
+  /**
+   * Affinity hints for scheduling.
+   */
+  affinities?: ContainerApplication.Affinities;
+  /**
+   * Progressive rollout settings applied after updates.
+   */
+  rollout?: ContainerApplication.Rollout;
+  /**
+   * Container registry host to use for generated Dockerfile builds.
+   * @default "registry.cloudflare.com"
+   */
+  registryId?: string;
+  /**
+   * Environment variables passed to the container runtime.
+   */
+  env?: Record<string, any>;
+  /**
+   * Exports passed to the container runtime.
+   */
+  exports?: string[];
+}
+
+export type ContainerServices =
+  | ContainerApplication
+  | PlatformServices
+  | Server.ProcessServices;
+
+export type ContainerShape = Main<ContainerServices>;
+
+/**
+ * @internal
+ */
+export interface ContainerApplication<Shape = unknown> extends Resource<
+  ContainerTypeId,
+  ContainerApplicationProps,
+  {
+    applicationId: string;
+    applicationName: string;
+    accountId: string;
+    schedulingPolicy: ContainerApplication.SchedulingPolicy;
+    instances: number;
+    maxInstances: number;
+    constraints: ContainerApplication.Constraints | undefined;
+    affinities: ContainerApplication.Affinities | undefined;
+    configuration: ContainerApplication.Configuration;
+    durableObjects:
+      | {
+          namespaceId: string;
+        }
+      | undefined;
+    createdAt: string;
+    version: number;
+    hash?: {
+      image: string;
+    };
+  },
+  {
+    /**
+     * Durable Object namespace attached to the container application.
+     */
+    durableObjects?: {
+      namespaceId: string;
+    };
+    env?: Record<string, any>;
+  },
+  Providers
+> {
+  /** @internal phantom */
+  Shape: Shape;
+}
+
+const resolveDurableObjectApplicationRecovery = ({
+  namespaceId,
+  expectedName,
+  existingName,
+}: {
+  namespaceId: string;
+  expectedName: string;
+  existingName: string | undefined;
+}) => {
+  if (!existingName) {
+    return {
+      canAdopt: false as const,
+      message: `Container application for Durable Object namespace "${namespaceId}" already exists but could not be found for adoption.`,
+    };
+  }
+  if (existingName !== expectedName) {
+    return {
+      canAdopt: false as const,
+      message: `Existing container application "${existingName}" is already attached to Durable Object namespace "${namespaceId}". Use that application name to adopt it.`,
+    };
+  }
+  return {
+    canAdopt: true as const,
+  };
+};
+
+const containerApplicationReadinessSchedule = Schedule.exponential(150).pipe(
+  Schedule.both(Schedule.recurs(10)),
+);
+
+const isContainerApplicationNotFound = (
+  error: unknown,
+): error is Containers.ContainerApplicationNotFound =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  error._tag === "ContainerApplicationNotFound";
+
+export const retryForContainerApplicationReadiness = <A, E, R>(
+  operation: string,
+  applicationId: string,
+  effect: Effect.Effect<A, E, R>,
+) =>
+  effect.pipe(
+    Effect.tapError((error) =>
+      isContainerApplicationNotFound(error)
+        ? Effect.logDebug(
+            `Cloudflare Container ${operation}: application ${applicationId} not found yet, retrying`,
+          )
+        : Effect.void,
+    ),
+    Effect.retry({
+      while: isContainerApplicationNotFound,
+      schedule: containerApplicationReadinessSchedule,
+    }),
+  );
+
+export const ContainerProvider = () =>
+  Provider.effect(
+    Container,
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const { accountId } = yield* CloudflareEnvironment;
+      const { dotAlchemy } = yield* AlchemyContext;
+      const fs = yield* FileSystem.FileSystem;
+      const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+      const createContainerApplication =
+        yield* Containers.createContainerApplication;
+      const updateContainerApplication =
+        yield* Containers.updateContainerApplication;
+      const deleteContainerApplication =
+        yield* Containers.deleteContainerApplication;
+      const getContainerApplication = yield* Containers.getContainerApplication;
+      const listContainerApplications =
+        yield* Containers.listContainerApplications;
+      const createContainerRegistryCredentials =
+        yield* Containers.createContainerRegistryCredentials;
+      const createContainerApplicationRollout =
+        yield* Containers.createContainerApplicationRollout;
+      const telemetry = yield* CloudflareLogs;
+
+      const createApplicationName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          return (
+            name ??
+            (yield* createPhysicalName({
+              id,
+              lowercase: true,
+            }))
+          );
+        });
+
+      const findApplicationByName = Effect.fnUntraced(function* (name: string) {
+        return yield* listContainerApplications({ accountId }).pipe(
+          Effect.map((apps) => apps.find((app) => app.name === name)),
+        );
+      });
+
+      const findApplicationByNamespace = Effect.fnUntraced(function* (
+        namespaceId: string,
+      ) {
+        return yield* listContainerApplications({ accountId }).pipe(
+          Effect.map((apps) =>
+            apps.find((app) => app.durableObjects?.namespaceId === namespaceId),
+          ),
+        );
+      });
+
+      const desiredConfiguration = (
+        props: ContainerApplicationProps,
+        imageRef: string,
+      ) =>
+        normalizeNulls({
+          image: imageRef,
+          instanceType: props.instanceType,
+          observability: props.observability,
+          sshPublicKeyIds: props.sshPublicKeyIds,
+          secrets: props.secrets,
+          vcpu: props.vcpu,
+          memory: props.memory,
+          disk: props.disk,
+          environmentVariables: props.environmentVariables,
+          labels: props.labels,
+          network: props.network,
+          command: props.command,
+          entrypoint: props.entrypoint,
+          dns: props.dns,
+          ports: props.ports,
+          checks: props.checks,
+        }) as ContainerApplication.Configuration;
+
+      const computeImageHash = Effect.fnUntraced(function* (
+        id: string,
+        props: ContainerApplicationProps,
+      ) {
+        const main = props.main;
+        if (!main) {
+          return yield* Effect.fail(
+            new Error("Container requires a `main` entrypoint."),
+          );
+        }
+        const runtime = props.runtime ?? "bun";
+        const { files, hash: bundleHash } = yield* bundleProgram({
+          id,
+          main,
+          runtime,
+          handler: props.handler,
+          isExternal: props.isExternal,
+          external: props.external,
+        });
+
+        const finalDockerfile = buildFinalDockerfile(
+          props.dockerfile,
+          runtime,
+          props.external,
+          props.autoInstallExternals,
+        );
+        const imageHash = (yield* sha256Object({
+          bundleHash,
+          dockerfile: finalDockerfile,
+        })).slice(0, 16);
+
+        const name = yield* createApplicationName(id, props.name);
+        const registryId = props.registryId ?? "registry.cloudflare.com";
+        const repositoryName = name.toLowerCase();
+        const imageRef = `${registryId}/${accountId}/${repositoryName}:${imageHash}`;
+
+        return { files, imageRef, imageHash };
+      });
+
+      const bundleProgram = Effect.fnUntraced(function* ({
+        main,
+        runtime,
+        handler = "default",
+        isExternal = false,
+        external = [],
+      }: {
+        id: string;
+        main: string;
+        runtime: "bun" | "node";
+        handler: string | undefined;
+        isExternal?: boolean;
+        external?: string[];
+      }) {
+        const realMain = yield* fs.realPath(main);
+        const cwd = yield* findCwdForBundle(realMain);
+
+        const buildBundle = Effect.fnUntraced(function* (
+          entry: string,
+          plugins?: rolldown.RolldownPluginOption,
+        ) {
+          return yield* Bundle.build(
+            {
+              input: entry,
+              cwd,
+              external: [
+                "cloudflare:workers",
+                "cloudflare:workflows",
+                ...(runtime === "bun" ? ["bun", "bun:*"] : []),
+                ...external,
+              ],
+              platform: "node",
+              resolve: {
+                conditionNames:
+                  runtime === "bun"
+                    ? ["bun", "import", "module", "default"]
+                    : ["node", "import", "module", "default"],
+              },
+              plugins,
+              treeshake: true,
+            },
+            {
+              format: "esm",
+              sourcemap: false,
+              minify: true,
+              entryFileNames: "index.js",
+            },
+          );
+        });
+
+        const bundleOutput = isExternal
+          ? yield* buildBundle(realMain)
+          : yield* buildBundle(
+              realMain,
+              virtualEntryPlugin(
+                (importPath) => `
+${
+  runtime === "bun"
+    ? `
+import { BunServices } from "@effect/platform-bun";
+import { BunHttpServer } from "alchemy/Http";
+const HttpServer = BunHttpServer;
+`
+    : `
+import { NodeServices } from "@effect/platform-node";
+import { NodeHttpServer } from "alchemy/Http";
+const HttpServer = NodeHttpServer;
+`
+}
+import { Stack } from "alchemy/Stack";
+import { makeEntrypointLayer } from "alchemy/Runtime";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Context from "effect/Context";
+import { MinimumLogLevel } from "effect/References";
+
+import ${handler === "default" ? "entrypoint" : `{ ${handler} as entrypoint }`} from ${JSON.stringify(importPath)};
+
+const tag = Context.Service("${Self.key}")
+const layer = makeEntrypointLayer(tag, entrypoint);
+
+const platform = Layer.mergeAll(
+  ${runtime === "bun" ? "BunServices.layer" : "NodeServices.layer"},
+  FetchHttpClient.layer,
+  // TODO(sam): wire this up to telemetry more directly
+  Logger.layer([Logger.consolePretty()]),
+);
+
+const stack = Layer.succeed(Stack, {
+  name: ${JSON.stringify(stack.name)},
+  stage: ${JSON.stringify(stack.stage)},
+  bindings: {},
+  resources: {}
+});
+
+const serverEffect = tag.pipe(
+  Effect.flatMap(func => func.RuntimeContext.exports),
+  Effect.flatMap(exports => exports.default),
+  Effect.provide(
+    layer.pipe(
+      Layer.provideMerge(stack),
+      Layer.provideMerge(HttpServer()),
+      Layer.provideMerge(platform),
+      Layer.provideMerge(
+        Layer.succeed(
+          MinimumLogLevel,
+          process.env.DEBUG ? "Debug" : "Info",
+        )
+      ),
+    )
+  ),
+  Effect.scoped
+);
+
+console.log("Container bootstrap starting...");
+await Effect.runPromise(serverEffect).catch((err) => {
+  console.error("Container bootstrap failed:", err);
+  process.exit(1);
+})`,
+              ),
+            );
+
+        // Rolldown can emit multiple chunk files (entry + shared chunks).
+        // Return every file so downstream code can materialize all of them
+        // into the Docker build context — dropping any of them produces a
+        // `Cannot find module './chunk-XXX.js'` runtime crash inside the
+        // container (with zero stdout, because it crashes before any user
+        // code runs).
+        const files = bundleOutput.files.map((f) => ({
+          path: f.path,
+          content:
+            typeof f.content === "string"
+              ? new TextEncoder().encode(f.content)
+              : f.content,
+        }));
+
+        return { files, hash: bundleOutput.hash };
+      });
+
+      const buildFinalDockerfile = (
+        userDockerfile: string | undefined,
+        runtime: "bun" | "node",
+        external: string[] = [],
+        autoInstallExternals = true,
+      ): string => {
+        const base =
+          userDockerfile?.trim() ??
+          (runtime === "bun" ? "FROM oven/bun:1" : "FROM node:22-slim");
+        const runtimeBin = runtime === "bun" ? "bun" : "node";
+        const installCmd = runtime === "bun" ? "bun add" : "npm install";
+        const installStep =
+          autoInstallExternals && external.length > 0
+            ? `RUN ${installCmd} ${external.join(" ")}`
+            : "";
+        return [
+          base,
+          "",
+          "WORKDIR /app",
+          ...(installStep ? [installStep, ""] : []),
+          "COPY index.mjs /app/index.mjs",
+          // Copy any additional rolldown chunks (`chunk-XXX.js`,
+          // `BunServices-YYY.js`, …). The glob matches zero or more files;
+          // non-trivial bundles always emit at least one chunk, minimal
+          // bundles emit none and the COPY no-ops.
+          "COPY *.js /app/",
+          `ENTRYPOINT ["${runtimeBin}", "/app/index.mjs"]`,
+          "",
+        ].join("\n");
+      };
+
+      const buildAndPushImage = Effect.fnUntraced(function* (
+        id: string,
+        props: ContainerApplicationProps,
+        files: ReadonlyArray<{ path: string; content: Uint8Array }>,
+        imageRef: string,
+        session?: { note: (message: string) => Effect.Effect<void> },
+      ) {
+        const runtime = props.runtime ?? "bun";
+
+        yield* Effect.logInfo(
+          `Cloudflare Container image: building ${imageRef}`,
+        );
+        if (session) {
+          yield* session.note(`Building container image ${imageRef}...`);
+        }
+
+        const contextDir = yield* getStableContextDir(
+          process.cwd(),
+          dotAlchemy,
+          `${id}-container`,
+        );
+        const finalDockerfile = buildFinalDockerfile(
+          props.dockerfile,
+          runtime,
+          props.external,
+          props.autoInstallExternals,
+        );
+        yield* materializeDockerfile(finalDockerfile, contextDir);
+        yield* writeContextFiles(
+          contextDir,
+          files.map((f, i) => ({
+            // Keep the entry rename to `index.mjs` so the Dockerfile
+            // ENTRYPOINT (`ENTRYPOINT ["bun", "/app/index.mjs"]`) stays
+            // valid; preserve rolldown-assigned fileNames for every other
+            // chunk so intra-bundle relative imports resolve at runtime.
+            path: i === 0 ? "index.mjs" : f.path,
+            content: f.content,
+          })),
+        );
+        yield* dockerBuild({
+          tag: imageRef,
+          context: contextDir,
+          platform: "linux/amd64",
+        });
+
+        yield* Effect.logInfo(
+          `Cloudflare Container image: pushing ${imageRef}`,
+        );
+        if (session) {
+          yield* session.note(`Pushing container image ${imageRef}...`);
+        }
+
+        const registryId = props.registryId ?? "registry.cloudflare.com";
+        const credentials = yield* createContainerRegistryCredentials({
+          accountId,
+          registryId,
+          permissions: ["pull", "push"],
+          expirationMinutes: 60,
+        });
+        const username = credentials.username ?? (credentials as any).user;
+        if (!username) {
+          return yield* Effect.fail(
+            new Error(
+              "Cloudflare registry credentials did not include a username.",
+            ),
+          );
+        }
+
+        yield* pushImage(imageRef, {
+          username,
+          password: credentials.password,
+          server: registryId,
+        });
+      });
+
+      const maybeCreateRollout = Effect.fnUntraced(function* ({
+        applicationId,
+        configuration,
+        rollout,
+      }: {
+        applicationId: string;
+        configuration: ContainerApplication.Configuration;
+        rollout: ContainerApplication.Rollout | undefined;
+      }) {
+        const strategy = rollout?.strategy ?? "immediate";
+        const stepPercentage =
+          strategy === "immediate" ? 100 : (rollout?.stepPercentage ?? 25);
+
+        yield* retryForContainerApplicationReadiness(
+          "rollout",
+          applicationId,
+          createContainerApplicationRollout({
+            accountId,
+            applicationId,
+            description:
+              strategy === "immediate"
+                ? "Immediate update"
+                : "Progressive update",
+            strategy: "rolling",
+            kind: rollout?.kind ?? "full_auto",
+            stepPercentage,
+            targetConfiguration: configuration,
+          }),
+        );
+      });
+
+      const createApplication = Effect.fnUntraced(function* ({
+        id,
+        news,
+        name,
+        configuration,
+        durableObjects,
+        session,
+      }: {
+        id: string;
+        news: ContainerApplicationProps;
+        name: string;
+        configuration: ContainerApplication.Configuration;
+        durableObjects:
+          | {
+              namespaceId: string;
+            }
+          | undefined;
+        session: { note: (message: string) => Effect.Effect<void> };
+      }) {
+        const describeError = (error: unknown) => {
+          if (error instanceof Error) {
+            return JSON.stringify(
+              Object.fromEntries(
+                Object.getOwnPropertyNames(error).map((key) => [
+                  key,
+                  (error as unknown as Record<string, unknown>)[key],
+                ]),
+              ),
+              null,
+              2,
+            );
+          }
+          return String(error);
+        };
+
+        // Engine has cleared us via `read` (foreign-named applications are
+        // surfaced as `Unowned`). Re-fetch the existing application to fold
+        // it into the upsert path.
+        const existingByName = yield* findApplicationByName(name);
+
+        if (existingByName) {
+          yield* Effect.logInfo(
+            `Cloudflare Container create: adopting existing application ${name}`,
+          );
+          return yield* upsertApplication({
+            id,
+            news,
+            existing: toAttributes(existingByName),
+            session,
+          });
+        }
+
+        yield* Effect.logInfo(
+          `Cloudflare Container create: creating application ${name}`,
+        );
+        yield* session.note(`Creating container application ${name}...`);
+        const adoptExistingByName = Effect.gen(function* () {
+          yield* Effect.logInfo(
+            `Cloudflare Container create: application ${name} already exists, adopting`,
+          );
+          const existing = yield* findApplicationByName(name);
+          if (!existing) {
+            return yield* Effect.fail(
+              new Error(
+                `Container application "${name}" already exists but could not be found for adoption.`,
+              ),
+            );
+          }
+          return yield* upsertApplication({
+            id,
+            news,
+            existing: toAttributes(existing),
+            session,
+          });
+        });
+
+        const application = yield* createContainerApplication({
+          accountId,
+          name,
+          instances: news.instances ?? 1,
+          maxInstances: news.maxInstances ?? 1,
+          schedulingPolicy: news.schedulingPolicy ?? "default",
+          constraints: news.constraints ?? {},
+          affinities: news.affinities,
+          configuration,
+          durableObjects,
+        }).pipe(
+          Effect.catchTag("DurableObjectAlreadyHasApplication", () =>
+            durableObjects
+              ? Effect.gen(function* () {
+                  const existing = yield* findApplicationByNamespace(
+                    durableObjects.namespaceId,
+                  );
+                  const recovery = resolveDurableObjectApplicationRecovery({
+                    namespaceId: durableObjects.namespaceId,
+                    expectedName: name,
+                    existingName: existing?.name,
+                  });
+                  if (!recovery.canAdopt) {
+                    return yield* Effect.fail(new Error(recovery.message));
+                  }
+                  if (!existing) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `Container application for Durable Object namespace "${durableObjects.namespaceId}" already exists but could not be found for adoption.`,
+                      ),
+                    );
+                  }
+                  return yield* upsertApplication({
+                    id,
+                    news,
+                    existing: toAttributes(existing),
+                    session,
+                  });
+                })
+              : Effect.fail(
+                  new Error(
+                    "Durable Object namespace already has a container application. Set AdoptPolicy to adopt it.",
+                  ),
+                ),
+          ),
+          Effect.catchIf(
+            (e) =>
+              "message" in (e as any) &&
+              String((e as any).message).includes("already exists"),
+            () => adoptExistingByName,
+          ),
+          Effect.tapError((error) =>
+            Effect.logError(
+              `Cloudflare Container create error: ${describeError(error)}`,
+            ),
+          ),
+        );
+
+        return "applicationId" in application
+          ? application
+          : toAttributes(application);
+      });
+
+      const upsertApplication = Effect.fnUntraced(function* ({
+        id,
+        news,
+        existing,
+        session,
+      }: {
+        id: string;
+        news: ContainerApplicationProps;
+        existing: ContainerApplication["Attributes"];
+        session: { note: (message: string) => Effect.Effect<void> };
+      }) {
+        yield* Effect.logInfo(
+          `Cloudflare Container update: preparing ${existing.applicationName}`,
+        );
+        const { files, imageRef, imageHash } = yield* computeImageHash(
+          id,
+          news,
+        );
+        const configuration = desiredConfiguration(news, imageRef);
+
+        if (imageHash !== existing.hash?.image) {
+          yield* buildAndPushImage(id, news, files, imageRef, session);
+        }
+
+        yield* session.note(
+          `Updating container application ${existing.applicationName}...`,
+        );
+        const application = yield* retryForContainerApplicationReadiness(
+          "update",
+          existing.applicationId,
+          updateContainerApplication({
+            accountId,
+            applicationId: existing.applicationId,
+            instances: news.instances ?? 1,
+            maxInstances: news.maxInstances ?? 1,
+            schedulingPolicy: news.schedulingPolicy ?? "default",
+            constraints: news.constraints ?? {},
+            affinities: news.affinities,
+            configuration,
+          }),
+        );
+        const updated = toAttributes(application);
+        if (!deepEqual(existing.configuration, configuration)) {
+          yield* Effect.logInfo(
+            `Cloudflare Container update: creating rollout for ${updated.applicationName}`,
+          );
+          yield* maybeCreateRollout({
+            applicationId: updated.applicationId,
+            configuration,
+            rollout: news.rollout,
+          });
+        }
+        return { ...updated, configuration, hash: { image: imageHash } };
+      });
+
+      const getDurableObjects = (
+        bindings: ResourceBinding<ContainerApplication["Binding"]>[],
+      ) => {
+        const dos = bindings.flatMap((b) =>
+          b.data.durableObjects ? [b.data.durableObjects] : [],
+        );
+        // A single DO namespace may appear in multiple bindings (e.g. when
+        // a Container is referenced by several resources). Dedupe by namespaceId.
+        const uniqueDos = dos.filter(
+          (d, i, arr) =>
+            arr.findIndex((other) => other.namespaceId === d.namespaceId) === i,
+        );
+        if (uniqueDos.length === 0) {
+          return Effect.succeed(undefined);
+        }
+        if (uniqueDos.length === 1) {
+          return Effect.succeed(uniqueDos[0]);
+        }
+        return Effect.die(
+          new Error(
+            `A Container can only be bound to one Durable Object namespace. Found ${uniqueDos.length} unique namespaces in bindings: ${uniqueDos.map((d) => d.namespaceId).join(", ")}`,
+          ),
+        );
+      };
+
+      return Container.Provider.of({
+        stables: ["applicationId", "accountId"],
+        diff: Effect.fnUntraced(function* ({
+          id,
+          olds = {},
+          news = {},
+          output,
+          newBindings,
+          oldBindings,
+        }) {
+          if (!isResolved(news) || !isResolved(newBindings)) {
+            return undefined;
+          }
+
+          const name = yield* createApplicationName(id, news.name);
+          const oldName = output?.applicationName
+            ? output.applicationName
+            : yield* createApplicationName(id, olds.name);
+
+          if (
+            (output?.accountId ?? accountId) !== accountId ||
+            name !== oldName
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          const hasDurableObjects =
+            (yield* getDurableObjects(newBindings)) !== undefined;
+          const hadDurableObjects =
+            (yield* getDurableObjects(oldBindings)) !== undefined;
+          if (hasDurableObjects !== hadDurableObjects) {
+            return { action: "replace" } as const;
+          }
+
+          if (!output) {
+            return undefined;
+          }
+
+          const { imageHash } = yield* computeImageHash(id, news);
+          if (imageHash !== output.hash?.image) {
+            return { action: "update" } as const;
+          }
+        }),
+        precreate: Effect.fnUntraced(function* ({ id, news = {}, session }) {
+          const name = yield* createApplicationName(id, news.name);
+          yield* Effect.logInfo(
+            `Cloudflare Container precreate: starting ${name}`,
+          );
+
+          const { files, imageRef, imageHash } = yield* computeImageHash(
+            id,
+            news,
+          );
+          const configuration = desiredConfiguration(news, imageRef);
+          yield* buildAndPushImage(id, news, files, imageRef, session);
+
+          // Precreate intentionally omits the Durable Object attachment so the
+          // worker can bind to this application id and break the circular
+          // dependency. The final create step recreates the application with the
+          // resolved namespace when needed.
+          const result = yield* createApplication({
+            id,
+            news,
+            name,
+            configuration,
+            durableObjects: undefined,
+            session: {
+              ...session,
+              note: (message) =>
+                session.note(message.replace("Creating", "Pre-creating")),
+            },
+          });
+          return {
+            ...("applicationId" in result ? result : toAttributes(result)),
+            hash: { image: imageHash },
+          };
+        }),
+        reconcile: Effect.fnUntraced(function* ({
+          id,
+          news = {},
+          bindings,
+          output,
+          session,
+        }) {
+          const name = yield* createApplicationName(id, news.name);
+          yield* Effect.logInfo(
+            `Cloudflare Container reconcile: starting ${name}`,
+          );
+          const durableObjects = yield* getDurableObjects(bindings);
+          const { files, imageRef, imageHash } = yield* computeImageHash(
+            id,
+            news,
+          );
+          const configuration = desiredConfiguration(news, imageRef);
+
+          // Observe — re-fetch the cached application to confirm it still
+          // exists. Cloudflare reports a deleted container application as
+          // `ContainerApplicationNotFound`; we fall back to a name lookup
+          // so we can recover from out-of-band deletes or partial state
+          // persistence failures.
+          let existing: ContainerApplication["Attributes"] | undefined;
+          if (output?.applicationId) {
+            existing = yield* getContainerApplication({
+              accountId: output.accountId,
+              applicationId: output.applicationId,
+            }).pipe(
+              Effect.map((app) => ({
+                ...toAttributes(app),
+                hash: output.hash,
+              })),
+              Effect.catchTag("ContainerApplicationNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+          if (!existing) {
+            const found = yield* findApplicationByName(name);
+            if (found) {
+              existing = {
+                ...toAttributes(found),
+                hash: output?.hash,
+              };
+            }
+          }
+
+          // Special case: precreate produced an application without the
+          // durable object attachment, but the real reconcile now has one
+          // (or vice versa). The DO attachment is immutable, so we delete
+          // and recreate. Adoption-by-namespace is preferred when an app
+          // already owns the namespace.
+          if (existing && !deepEqual(existing.durableObjects, durableObjects)) {
+            if (durableObjects) {
+              const owner = yield* findApplicationByNamespace(
+                durableObjects.namespaceId,
+              );
+              const recovery = resolveDurableObjectApplicationRecovery({
+                namespaceId: durableObjects.namespaceId,
+                expectedName: name,
+                existingName: owner?.name,
+              });
+              if (recovery.canAdopt) {
+                if (!owner) {
+                  return yield* Effect.fail(
+                    new Error(
+                      `Container application for Durable Object namespace "${durableObjects.namespaceId}" already exists but could not be found for adoption.`,
+                    ),
+                  );
+                }
+                return yield* upsertApplication({
+                  id,
+                  news,
+                  existing: toAttributes(owner),
+                  session,
+                });
+              }
+            }
+            yield* Effect.logInfo(
+              `Cloudflare Container reconcile: recreating ${name} to attach durable object binding`,
+            );
+            yield* session.note(
+              `Recreating container application ${name} with durable object binding...`,
+            );
+            yield* deleteContainerApplication({
+              accountId: existing.accountId,
+              applicationId: existing.applicationId,
+            }).pipe(
+              Effect.catchTag(
+                "ContainerApplicationNotFound",
+                () => Effect.void,
+              ),
+            );
+            if (imageHash !== existing.hash?.image) {
+              yield* buildAndPushImage(id, news, files, imageRef, session);
+            }
+            const result = yield* createApplication({
+              id,
+              news,
+              name,
+              configuration,
+              durableObjects,
+              session,
+            });
+            return {
+              ...("applicationId" in result ? result : toAttributes(result)),
+              hash: { image: imageHash },
+            };
+          }
+
+          // Sync — application exists with correct DO attachment. Apply
+          // the desired configuration (image + scheduling + secrets, etc.)
+          // through the upsert path, which builds and pushes the image
+          // only when the hash changed and creates a rollout if the
+          // configuration drifted.
+          if (existing) {
+            return yield* upsertApplication({
+              id,
+              news,
+              existing,
+              session,
+            });
+          }
+
+          // Ensure — no application exists. Build and push the image,
+          // then create. `createApplication` itself tolerates concurrent
+          // creates by adopting an existing application with the same
+          // name or namespace.
+          yield* buildAndPushImage(id, news, files, imageRef, session);
+          const result = yield* createApplication({
+            id,
+            news,
+            name,
+            configuration,
+            durableObjects,
+            session,
+          });
+          return {
+            ...("applicationId" in result ? result : toAttributes(result)),
+            hash: { image: imageHash },
+          };
+        }),
+        delete: Effect.fnUntraced(function* ({ output }) {
+          yield* Effect.logInfo(
+            `Cloudflare Container delete: deleting ${output.applicationName}`,
+          );
+          yield* deleteContainerApplication({
+            accountId: output.accountId,
+            applicationId: output.applicationId,
+          }).pipe(
+            Effect.catchTag("ContainerApplicationNotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fnUntraced(function* ({ id, olds, output }) {
+          const readByName = (name: string) =>
+            Effect.gen(function* () {
+              yield* Effect.logInfo(
+                `Cloudflare Container read: looking up ${name}`,
+              );
+              const existing = yield* findApplicationByName(name);
+              if (!existing) {
+                yield* Effect.logInfo(
+                  `Cloudflare Container read: ${name} not found`,
+                );
+                return undefined;
+              }
+              return {
+                ...toAttributes(existing),
+                hash: output?.hash,
+              };
+            });
+
+          let attrs: ContainerApplication["Attributes"] | undefined;
+          if (output?.applicationId) {
+            yield* Effect.logInfo(
+              `Cloudflare Container read: checking ${output.applicationName}`,
+            );
+            attrs = yield* getContainerApplication({
+              accountId: output.accountId,
+              applicationId: output.applicationId,
+            }).pipe(
+              Effect.map((app) => ({
+                ...toAttributes(app),
+                hash: output.hash,
+              })),
+              Effect.catchTag("ContainerApplicationNotFound", () =>
+                readByName(output.applicationName),
+              ),
+            );
+            // If we matched by id from prior state, treat as owned.
+            return attrs;
+          }
+
+          const name = yield* createApplicationName(id, olds?.name);
+          attrs = yield* readByName(name);
+          if (!attrs) return undefined;
+          // Cloudflare container applications carry no ownership signal that
+          // we can read back from the API, so a name match is not proof of
+          // ownership. Brand it `Unowned` so the engine surfaces
+          // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+          return Unowned(attrs);
+        }),
+        tail: ({ output }) =>
+          telemetry.tailStream({
+            accountId: output.accountId,
+            filters: containerFilters(output.applicationId),
+          }),
+        logs: ({ output, options }) =>
+          telemetry.queryLogs({
+            accountId: output.accountId,
+            filters: containerFilters(output.applicationId),
+            options,
+          }),
+      });
+    }),
+  );
+
+const containerFilters = (applicationId: string): TelemetryFilter[] => [
+  {
+    key: "$metadata.type",
+    operation: "eq",
+    type: "string",
+    value: "cf-container",
+  },
+  {
+    key: "$metadata.service",
+    operation: "eq",
+    type: "string",
+    value: applicationId,
+  },
+];
+
+const toAttributes = (
+  application:
+    | Containers.CreateContainerApplicationResponse
+    | Containers.UpdateContainerApplicationResponse
+    | Containers.GetContainerApplicationResponse,
+): ContainerApplication["Attributes"] => ({
+  applicationId: application.id,
+  applicationName: application.name,
+  accountId: application.accountId,
+  schedulingPolicy: application.schedulingPolicy,
+  instances: application.instances,
+  maxInstances: application.maxInstances,
+  constraints: normalizeNulls(
+    application.constraints as ContainerApplication.Constraints | undefined,
+  ),
+  affinities: normalizeNulls(
+    application.affinities as ContainerApplication.Affinities | undefined,
+  ),
+  configuration: normalizeNulls(
+    application.configuration as ContainerApplication.Configuration,
+  ),
+  durableObjects: normalizeNulls(application.durableObjects) as
+    | { namespaceId: string }
+    | undefined,
+  createdAt: application.createdAt,
+  version: application.version,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/ContainerBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/ContainerBinding.ts
new file mode 100644
index 00000000000..4c5537c00da
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/ContainerBinding.ts
@@ -0,0 +1,79 @@
+import * as Effect from "effect/Effect";
+import { type Rpc } from "../../Rpc.ts";
+import {
+  fromCloudflareFetcher,
+  toCloudflareFetcher,
+  type Fetcher,
+} from "../Fetcher.ts";
+import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
+import { Worker } from "../Workers/Worker.ts";
+import type { Container } from "./Container.ts";
+import type { ContainerApplication } from "./ContainerApplication.ts";
+
+export const bindContainer = Effect.fnUntraced(function* <Shape, Req = never>(
+  containerEff:
+    | (ContainerApplication & Rpc<Shape>)
+    | Effect.Effect<ContainerApplication & Rpc<Shape>, never, Req>,
+) {
+  const namespace = yield* DurableObjectNamespace;
+
+  const container =
+    "asEffect" in containerEff
+      ? yield* containerEff as any as Effect.Effect<
+          ContainerApplication & Rpc<Shape>
+        >
+      : Effect.isEffect(containerEff)
+        ? yield* containerEff as unknown as Effect.Effect<
+            ContainerApplication & Rpc<Shape>
+          >
+        : containerEff;
+
+  yield* container.bind`${namespace}`({
+    durableObjects: {
+      namespaceId: namespace.namespaceId,
+    },
+  });
+
+  const worker = yield* Worker;
+  const className = namespace.name;
+
+  yield* worker.bind`${container.LogicalId}`({
+    containers: [{ className }],
+  });
+
+  // TODO(sam): register this in the Container Execution Context
+  // const _httpEffect = yield* init;
+  return Effect.gen(function* () {
+    const state = yield* DurableObjectState;
+    return {
+      running: Effect.sync(() => state.container!.running ?? false),
+      destroy: (error?: any) =>
+        Effect.promise(() => state.container!.destroy(error)),
+      signal: (signo: number) =>
+        Effect.sync(() => state.container!.signal(signo)),
+      getTcpPort: (port: number) =>
+        Effect.sync(() =>
+          fromCloudflareFetcher(state.container!.getTcpPort(port)),
+        ),
+      setInactivityTimeout: (durationMs: number | bigint) =>
+        Effect.sync(() => state.container!.setInactivityTimeout(durationMs)),
+      interceptOutboundHttp: (addr: string, binding: Fetcher) =>
+        toCloudflareFetcher(binding).pipe(
+          Effect.map((binding) =>
+            state.container!.interceptOutboundHttp(addr, binding),
+          ),
+        ),
+      interceptAllOutboundHttp: (binding: Fetcher) =>
+        toCloudflareFetcher(binding).pipe(
+          Effect.map((binding) =>
+            state.container!.interceptAllOutboundHttp(binding),
+          ),
+        ),
+      monitor: () =>
+        Effect.promise(() => state.container?.monitor() ?? Promise.resolve()),
+      start: (options?: ContainerStartupOptions) =>
+        Effect.sync(() => state.container!.start(options)),
+    } satisfies Container as Shape;
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/StartContainer.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/StartContainer.ts
new file mode 100644
index 00000000000..fc3488d031d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/StartContainer.ts
@@ -0,0 +1,86 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { type Fetcher } from "../Fetcher.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
+import {
+  type Container,
+  ContainerError,
+  type ContainerStartupOptions,
+} from "./Container.ts";
+/**
+ * Runs the Container in a Durable Object and monitors it, providing a durable fetch and RPC interface to it.
+ */
+export const start = Effect.fnUntraced(function* <
+  Shape extends Container,
+  Req = never,
+>(
+  containerEff: Effect.Effect<Shape, never, Req | DurableObjectState>,
+  options?: ContainerStartupOptions,
+) {
+  const container = yield* containerEff;
+
+  const ensureRunning = Effect.gen(function* () {
+    if (yield* container.running) return;
+    yield* Effect.logInfo("Container not running, starting...");
+    yield* container.start(options);
+    yield* Effect.logInfo("Container started, launching monitor");
+    yield* Effect.forkDetach(
+      container.monitor().pipe(
+        Effect.flatMap(() => Effect.logInfo("Container monitor exited")),
+        Effect.catchTag("ContainerError", (error) =>
+          Effect.logError(`Container monitor error: ${error.message}`),
+        ),
+      ),
+    );
+  });
+
+  yield* ensureRunning;
+
+  const startupBackoff = Schedule.exponential(100, 1.5).pipe(
+    Schedule.modifyDelay((_, delay) =>
+      Effect.succeed(Duration.max(delay, Duration.seconds(2))),
+    ),
+  );
+
+  const getTcpPort = (portNumber: number) =>
+    Effect.succeed({
+      fetch: ((
+        request:
+          | HttpClientRequest.HttpClientRequest
+          | HttpServerRequest.HttpServerRequest,
+      ) =>
+        ensureRunning.pipe(
+          Effect.andThen(() => container.getTcpPort(portNumber)),
+          Effect.andThen((port: Fetcher) => port.fetch(request as any)),
+          Effect.catchDefect((defect: unknown) =>
+            Effect.fail(
+              new ContainerError({
+                message: `Container not ready on port ${portNumber}: ${defect}`,
+              }),
+            ),
+          ),
+          Effect.tapError((err) =>
+            Effect.logDebug(`Container fetch error (will retry): ${err}`),
+          ),
+          Effect.retry({ schedule: startupBackoff }),
+        )) as {
+        (
+          request: HttpClientRequest.HttpClientRequest,
+        ): Effect.Effect<HttpClientResponse.HttpClientResponse>;
+        (
+          request: HttpServerRequest.HttpServerRequest,
+        ): Effect.Effect<HttpServerResponse.HttpServerResponse>;
+      },
+    });
+
+  return {
+    ...container,
+    getTcpPort,
+    fetch: getTcpPort(3000),
+  };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/index.ts
new file mode 100644
index 00000000000..b525f5e576e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Container/index.ts
@@ -0,0 +1,4 @@
+export * from "./Container.ts";
+export * from "./ContainerApplication.ts";
+export * from "./ContainerBinding.ts";
+export * from "./StartContainer.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Credentials.ts
new file mode 100644
index 00000000000..00dade0842c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Credentials.ts
@@ -0,0 +1,74 @@
+import {
+  apiKeyCredentials,
+  apiTokenCredentials,
+  Credentials,
+  oauthCredentials,
+} from "@distilled.cloud/cloudflare/Credentials";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  CLOUDFLARE_AUTH_PROVIDER_NAME,
+  type CloudflareAuthConfig,
+  type CloudflareResolvedCredentials,
+} from "./Auth/AuthProvider.ts";
+
+export { Credentials, fromEnv } from "@distilled.cloud/cloudflare/Credentials";
+
+/**
+ * Build a `Credentials` layer that resolves Cloudflare credentials via the
+ * Alchemy AuthProvider using the configured profile (defaults to "default",
+ * overridable with the `ALCHEMY_PROFILE` env/config value).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    Credentials,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        CloudflareAuthConfig,
+        CloudflareResolvedCredentials
+      >(CLOUDFLARE_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+
+      return profile.loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as CloudflareAuthConfig),
+        ),
+        Effect.map((creds) =>
+          Match.value(creds).pipe(
+            Match.when({ type: "apiToken" }, (c) =>
+              apiTokenCredentials({
+                apiToken: Redacted.value(c.apiToken),
+              }),
+            ),
+            Match.when({ type: "apiKey" }, (c) =>
+              apiKeyCredentials({
+                apiKey: Redacted.value(c.apiKey),
+                email: Redacted.value(c.email),
+              }),
+            ),
+            Match.when({ type: "oauth" }, (c) =>
+              oauthCredentials({
+                accessToken: Redacted.value(c.accessToken),
+                expiresAt: c.expires,
+              }),
+            ),
+            Match.exhaustive,
+          ),
+        ),
+        Effect.mapError(
+          (e) =>
+            new ConfigError({
+              message: `Failed to resolve Cloudflare credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+      );
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Clone.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Clone.ts
new file mode 100644
index 00000000000..a849dbe093a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Clone.ts
@@ -0,0 +1,42 @@
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { exportD1Database } from "./D1Export.ts";
+import { importD1Database } from "./D1Import.ts";
+
+export interface CloneD1DatabaseOptions {
+  accountId: string;
+  sourceDatabaseId: string;
+  targetDatabaseId: string;
+}
+
+/**
+ * Clone a D1 database by exporting from the source and importing into the
+ * target. Fetches the SQL dump from the export's signed URL and streams the
+ * payload through the import flow.
+ */
+export const cloneD1Database = (options: CloneD1DatabaseOptions) =>
+  Effect.gen(function* () {
+    const exportResult = yield* exportD1Database({
+      accountId: options.accountId,
+      databaseId: options.sourceDatabaseId,
+    });
+
+    const client = yield* HttpClient.HttpClient;
+    const dumpRes = yield* client
+      .execute(HttpClientRequest.get(exportResult.signedUrl))
+      .pipe(Effect.orDie);
+    if (dumpRes.status < 200 || dumpRes.status >= 300) {
+      return yield* Effect.die(
+        `Failed to fetch D1 export dump (${dumpRes.status})`,
+      );
+    }
+    const sqlData = yield* dumpRes.text.pipe(Effect.orDie);
+
+    return yield* importD1Database({
+      accountId: options.accountId,
+      databaseId: options.targetDatabaseId,
+      sqlData,
+      filename: exportResult.filename,
+    });
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Connection.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Connection.ts
new file mode 100644
index 00000000000..c4a1b9c2ec6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Connection.ts
@@ -0,0 +1,170 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { WorkerEnvironment } from "../Workers/Worker.ts";
+import type { D1Database } from "./D1Database.ts";
+import { DatabaseBinding } from "./D1DatabaseBinding.ts";
+
+/**
+ * Effect-native wrapper around a Cloudflare D1 prepared statement.
+ *
+ * Construction (`prepare`) and binding (`bind`) are synchronous —
+ * they're plan builders and don't touch D1. Only the executors
+ * (`all`, `first`, `run`, `raw`) round-trip to the database, and
+ * those return Effects so they participate in the Effect runtime.
+ */
+export class D1PreparedStatement {
+  /** @internal */
+  constructor(
+    private readonly query: string,
+    private readonly binds: ReadonlyArray<unknown>,
+    private readonly rawEff: Effect.Effect<runtime.D1Database>,
+  ) {}
+
+  /**
+   * Return a new prepared statement bound to `values`. Subsequent
+   * calls replace the previous binding, matching the underlying
+   * Cloudflare runtime semantics.
+   */
+  bind(...values: unknown[]): D1PreparedStatement {
+    return new D1PreparedStatement(this.query, values, this.rawEff);
+  }
+
+  /** Run the query and return all matching rows. */
+  all<T = unknown>(): Effect.Effect<
+    runtime.D1Result<T>,
+    never,
+    RuntimeContext
+  > {
+    return this.withRuntime((stmt) => stmt.all<T>());
+  }
+
+  /** Run the query and return the first row, or `null` if no rows. */
+  first<T = unknown>(): Effect.Effect<T | null, never, RuntimeContext>;
+  first<T = unknown>(
+    column: string,
+  ): Effect.Effect<T | null, never, RuntimeContext>;
+  first<T = unknown>(
+    column?: string,
+  ): Effect.Effect<T | null, never, RuntimeContext> {
+    return this.withRuntime((stmt) =>
+      column !== undefined ? stmt.first<T>(column) : stmt.first<T>(),
+    );
+  }
+
+  /** Run the query as a mutation; returns row metadata. */
+  run<T = unknown>(): Effect.Effect<
+    runtime.D1Result<T>,
+    never,
+    RuntimeContext
+  > {
+    return this.withRuntime((stmt) => stmt.run<T>());
+  }
+
+  /** Run the query and return rows as flat arrays. */
+  raw<T = unknown[]>(): Effect.Effect<T[], never, RuntimeContext>;
+  raw<T = unknown[]>(options: {
+    columnNames: true;
+  }): Effect.Effect<[string[], ...T[]], never, RuntimeContext>;
+  raw<T = unknown[]>(options?: {
+    columnNames: true;
+  }): Effect.Effect<T[] | [string[], ...T[]], never, RuntimeContext> {
+    return this.withRuntime((stmt) =>
+      options
+        ? stmt.raw<T>(options)
+        : (stmt.raw<T>() as Promise<T[] | [string[], ...T[]]>),
+    );
+  }
+
+  /**
+   * Materialize the underlying Cloudflare prepared statement against
+   * a concrete D1 binding. Used by `D1ConnectionClient.batch` to
+   * collect statements for a single transactional call.
+   *
+   * @internal
+   */
+  _build(raw: runtime.D1Database): runtime.D1PreparedStatement {
+    const stmt = raw.prepare(this.query);
+    return this.binds.length > 0 ? stmt.bind(...this.binds) : stmt;
+  }
+
+  private withRuntime<A>(
+    fn: (stmt: runtime.D1PreparedStatement) => Promise<A>,
+  ): Effect.Effect<A, never, RuntimeContext> {
+    return Effect.flatMap(this.rawEff, (raw) =>
+      Effect.promise(() => fn(this._build(raw))),
+    ) as Effect.Effect<A, never, RuntimeContext>;
+  }
+}
+
+export interface D1ConnectionClient {
+  /**
+   * An Effect that resolves to the raw underlying Cloudflare D1Database binding.
+   * Use this when you need direct access for libraries like Better Auth.
+   */
+  raw: Effect.Effect<runtime.D1Database, never, RuntimeContext>;
+  /**
+   * Prepare a SQL statement. Returns synchronously — the network
+   * round-trip happens when you yield one of the statement's
+   * executors (`all`, `first`, `run`, `raw`).
+   */
+  prepare: (query: string) => D1PreparedStatement;
+  /**
+   * Execute raw SQL without prepared statements.
+   */
+  exec: (
+    query: string,
+  ) => Effect.Effect<runtime.D1ExecResult, never, RuntimeContext>;
+  /**
+   * Send multiple prepared statements in a single call.
+   * Statements execute sequentially and are rolled back on failure.
+   */
+  batch: <T = unknown>(
+    statements: D1PreparedStatement[],
+  ) => Effect.Effect<runtime.D1Result<T>[], never, RuntimeContext>;
+}
+
+export class D1Connection extends Binding.Service<
+  D1Connection,
+  (database: D1Database) => Effect.Effect<D1ConnectionClient>
+>()("Cloudflare.D1.Connection") {}
+
+export const D1ConnectionLive = Layer.effect(
+  D1Connection,
+  Effect.gen(function* () {
+    const Policy = yield* D1ConnectionPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (database: D1Database) {
+      yield* Policy(database);
+      const rawEff = Effect.sync(
+        () => (env as Record<string, runtime.D1Database>)[database.LogicalId]!,
+      );
+
+      return {
+        raw: rawEff,
+        prepare: (query: string) => new D1PreparedStatement(query, [], rawEff),
+        exec: (query: string) =>
+          Effect.flatMap(rawEff, (raw) =>
+            Effect.promise(() => raw.exec(query)),
+          ),
+        batch: <T = unknown>(statements: D1PreparedStatement[]) =>
+          Effect.flatMap(rawEff, (raw) =>
+            Effect.promise(() =>
+              raw.batch<T>(statements.map((s) => s._build(raw))),
+            ),
+          ),
+      } satisfies D1ConnectionClient;
+    });
+  }),
+);
+
+export class D1ConnectionPolicy extends Binding.Policy<
+  D1ConnectionPolicy,
+  (database: D1Database) => Effect.Effect<void>
+>()("Cloudflare.D1.Connection") {}
+
+export const D1ConnectionPolicyLive =
+  D1ConnectionPolicy.layer.succeed(DatabaseBinding);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Database.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Database.ts
new file mode 100644
index 00000000000..adda9f36b0e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Database.ts
@@ -0,0 +1,651 @@
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import * as Effect from "effect/Effect";
+
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { listSqlFiles, readSqlFile } from "../../Sql/SqlFile.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { cloneD1Database } from "./D1Clone.ts";
+import { importD1Database } from "./D1Import.ts";
+import { applyMigrations } from "./D1Migrations.ts";
+
+export const isD1Database = (value: unknown): value is D1Database =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.D1Database";
+
+export type Jurisdiction = "default" | "eu" | "fedramp";
+export type PrimaryLocationHint =
+  | "wnam"
+  | "enam"
+  | "weur"
+  | "eeur"
+  | "apac"
+  | "oc";
+
+const DEFAULT_MIGRATIONS_TABLE = "d1_migrations";
+
+export type CloneSource =
+  | D1Database
+  | { databaseId: string }
+  | { name: string };
+
+export type DatabaseProps = {
+  /**
+   * Name of the database. If omitted, a unique name will be generated.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Region in which the primary copy of the data is stored. Cannot be
+   * changed after creation — updating this property triggers a replacement.
+   *
+   * - `wnam` — Western North America
+   * - `enam` — Eastern North America
+   * - `weur` — Western Europe
+   * - `eeur` — Eastern Europe
+   * - `apac` — Asia Pacific
+   * - `oc`   — Oceania
+   */
+  primaryLocationHint?: PrimaryLocationHint;
+  /**
+   * Read replication configuration. The only mutable property after
+   * creation; toggling `mode` triggers an in-place update.
+   *
+   * @default { mode: "disabled" }
+   */
+  readReplication?: {
+    mode: "auto" | "disabled";
+  };
+  /**
+   * Jurisdiction in which the database data is guaranteed to be stored.
+   * Cannot be changed after creation.
+   *
+   * @default "default"
+   */
+  jurisdiction?: Jurisdiction;
+  /**
+   * Directory containing `.sql` migration files. Files are sorted by their
+   * numeric prefix (e.g. `0001_init.sql`, `0002_add_users.sql`) and applied
+   * in order. Pending migrations are detected on each deploy and applied as
+   * part of `update`. Equivalent to wrangler's `migrations_dir`.
+   */
+  migrationsDir?: string;
+  /**
+   * Name of the table used to track applied migrations. Useful for
+   * compatibility with frameworks that expect a specific name (e.g.
+   * `drizzle_migrations`).
+   *
+   * The table schema is the wrangler-compatible
+   * `(id TEXT PRIMARY KEY, name TEXT, applied_at TEXT)`. A pre-existing
+   * legacy 2-column table is migrated in place.
+   *
+   * @default "d1_migrations"
+   */
+  migrationsTable?: string;
+  /**
+   * Paths to additional `.sql` files to import after migrations are
+   * applied. Each file is uploaded via Cloudflare's D1 import API and
+   * hashed; only files whose contents change are re-imported on subsequent
+   * deploys.
+   *
+   * @see https://developers.cloudflare.com/d1/best-practices/import-export-data/
+   */
+  importFiles?: string[];
+  /**
+   * Clone data from an existing database during creation by exporting the
+   * source and importing it into the new database. Only applied during the
+   * `create` phase.
+   *
+   * Accepts:
+   * - another `D1Database` resource (uses its `databaseId`)
+   * - `{ databaseId }` — clone by explicit UUID
+   * - `{ name }` — look up the source by name and clone it
+   */
+  clone?: CloneSource;
+};
+
+export type D1Database = Resource<
+  "Cloudflare.D1Database",
+  DatabaseProps,
+  {
+    databaseId: string;
+    databaseName: string;
+    jurisdiction: Jurisdiction;
+    readReplication: { mode: "auto" | "disabled" } | undefined;
+    accountId: string;
+    migrationsDir: string | undefined;
+    migrationsTable: string | undefined;
+    migrationsHashes: Record<string, string>;
+    importHashes: Record<string, string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare D1 serverless SQL database built on SQLite.
+ *
+ * D1 is a serverless relational database that runs at the edge. Create a
+ * database as a resource, then bind it to a Worker to run SQL queries.
+ *
+ * @section Creating a Database
+ * @example Basic database
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db");
+ * ```
+ *
+ * @example Database with location hint
+ * The primary copy of the data is stored in the chosen region; reads can be
+ * served closer to users when read replication is enabled.
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db", {
+ *   primaryLocationHint: "wnam",
+ * });
+ * ```
+ *
+ * @example Database with read replication
+ * Read replication is the only mutable property after creation — toggling it
+ * triggers an update rather than a replacement.
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db", {
+ *   readReplication: { mode: "auto" },
+ * });
+ * ```
+ *
+ * @example Database in a specific jurisdiction
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db", {
+ *   jurisdiction: "eu",
+ * });
+ * ```
+ *
+ * @section Migrations
+ * Point `migrationsDir` at a folder of `.sql` files. Files are sorted by
+ * numeric prefix (e.g. `0001_`, `0002_`) and applied in order. Already-applied
+ * migrations are skipped on subsequent deploys; new files are detected
+ * automatically and applied as part of the next update.
+ *
+ * Migration tracking uses the wrangler-compatible
+ * `(id TEXT PRIMARY KEY, name TEXT, applied_at TEXT)` schema. The resource
+ * also detects and upgrades a legacy 2-column tracking table in place if one
+ * already exists.
+ *
+ * @example Apply migrations from a directory
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db", {
+ *   migrationsDir: "./migrations",
+ * });
+ * ```
+ *
+ * @example Custom migrations table (e.g. for Drizzle)
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db", {
+ *   migrationsDir: "./migrations",
+ *   migrationsTable: "drizzle_migrations",
+ * });
+ * ```
+ *
+ * @section Importing SQL
+ * Use `importFiles` to seed the database with raw `.sql` files via Cloudflare's
+ * D1 import API. Each file is hashed; only files whose contents change are
+ * re-imported on subsequent deploys.
+ *
+ * @example Seed a database with SQL files
+ * ```typescript
+ * const db = yield* Cloudflare.D1Database("my-db", {
+ *   importFiles: ["./seed/users.sql", "./seed/posts.sql"],
+ * });
+ * ```
+ *
+ * @section Cloning a Database
+ * `clone` performs a full export → import from a source database during
+ * creation. It accepts a `D1Database` resource, a `{ databaseId }`, or a
+ * `{ name }` to look up by name.
+ *
+ * @example Clone by passing the source resource directly
+ * ```typescript
+ * const source = yield* Cloudflare.D1Database("source-db");
+ * const cloned = yield* Cloudflare.D1Database("cloned-db", {
+ *   clone: source,
+ * });
+ * ```
+ *
+ * @example Clone by databaseId
+ * ```typescript
+ * const cloned = yield* Cloudflare.D1Database("cloned-db", {
+ *   clone: { databaseId: "abcdef12-3456-7890-abcd-ef1234567890" },
+ * });
+ * ```
+ *
+ * @example Clone by name
+ * ```typescript
+ * const cloned = yield* Cloudflare.D1Database("cloned-db", {
+ *   clone: { name: "source-db" },
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Using D1 inside a Worker
+ * ```typescript
+ * const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ * // Run a query
+ * const results = yield* db.prepare("SELECT * FROM users WHERE id = ?")
+ *   .bind(userId)
+ *   .all();
+ *
+ * // Execute a mutation
+ * yield* db.prepare("INSERT INTO users (id, name) VALUES (?, ?)")
+ *   .bind(newId, name)
+ *   .run();
+ * ```
+ *
+ * @see https://developers.cloudflare.com/d1/
+ */
+export const D1Database = Resource<D1Database>("Cloudflare.D1Database");
+
+export const DatabaseProvider = () =>
+  Provider.effect(
+    D1Database,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createDb = yield* d1.createDatabase;
+      const getDb = yield* d1.getDatabase;
+      const patchDb = yield* d1.patchDatabase;
+      const deleteDb = yield* d1.deleteDatabase;
+      const listDbs = yield* d1.listDatabases;
+      // rootDir for resolving relative `importFiles` paths
+      const rootDir = process.cwd();
+
+      const createDatabaseName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          return name ?? (yield* createPhysicalName({ id }));
+        });
+
+      return {
+        stables: ["databaseId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const name = yield* createDatabaseName(id, news.name);
+          const oldName = output?.databaseName
+            ? output.databaseName
+            : yield* createDatabaseName(id, olds.name);
+          const oldJurisdiction =
+            output?.jurisdiction ?? olds.jurisdiction ?? "default";
+          if (
+            oldName !== name ||
+            oldJurisdiction !== (news.jurisdiction ?? "default") ||
+            (olds.primaryLocationHint !== news.primaryLocationHint &&
+              news.primaryLocationHint !== undefined)
+          ) {
+            return { action: "replace" } as const;
+          }
+          const oldReplicationMode =
+            output?.readReplication?.mode ??
+            olds.readReplication?.mode ??
+            "disabled";
+          const newReplicationMode = news.readReplication?.mode ?? "disabled";
+          if (oldReplicationMode !== newReplicationMode) {
+            return { action: "update" } as const;
+          }
+          // Detect migration/import file drift.
+          if (news.migrationsDir) {
+            const newHashes = yield* hashMigrations(news.migrationsDir);
+            const oldHashes = output?.migrationsHashes ?? {};
+            if (!recordsEqual(newHashes, oldHashes)) {
+              return { action: "update" } as const;
+            }
+            if (
+              (news.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE) !==
+              (output?.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE)
+            ) {
+              return { action: "update" } as const;
+            }
+          } else if (
+            output?.migrationsHashes &&
+            Object.keys(output.migrationsHashes).length > 0
+          ) {
+            // migrationsDir was removed but state still tracks migrations: nothing
+            // to do remotely (we never un-apply), but no diff needed either.
+          }
+          if (news.importFiles?.length) {
+            const newHashes = yield* hashImports(news.importFiles, rootDir);
+            const oldHashes = output?.importHashes ?? {};
+            if (!recordsEqual(newHashes, oldHashes)) {
+              return { action: "update" } as const;
+            }
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.databaseId) {
+            return yield* getDb({
+              accountId: output.accountId,
+              databaseId: output.databaseId,
+            }).pipe(
+              Effect.map((db) => ({
+                databaseId: db.uuid ?? output.databaseId,
+                databaseName: db.name ?? output.databaseName,
+                jurisdiction: output.jurisdiction,
+                // Distilled widened generated string enums to open unions.
+                readReplication: (db.readReplication ?? undefined) as
+                  | { mode: "auto" | "disabled" }
+                  | undefined,
+                accountId: output.accountId,
+                migrationsDir: output.migrationsDir,
+                migrationsTable: output.migrationsTable,
+                migrationsHashes: output.migrationsHashes,
+                importHashes: output.importHashes,
+              })),
+              Effect.catchTag("DatabaseNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+          const name = yield* createDatabaseName(id, olds?.name);
+          const dbs = yield* listDbs({ accountId, name });
+          const match = dbs.result.find((db) => db.name === name);
+          if (match) {
+            return {
+              databaseId: match.uuid!,
+              databaseName: match.name ?? name,
+              jurisdiction: (olds?.jurisdiction ?? "default") as Jurisdiction,
+              readReplication: olds?.readReplication,
+              accountId,
+              migrationsDir: olds?.migrationsDir,
+              migrationsTable: olds?.migrationsTable,
+              migrationsHashes: {},
+              importHashes: {},
+            };
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          const name = yield* createDatabaseName(id, news.name);
+          const jurisdiction = news.jurisdiction ?? "default";
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — re-fetch the cached database; fall back to a name
+          // lookup so we recover from out-of-band deletes or partial
+          // state-persistence failures (the create call may have written
+          // the database but lost the result before persist).
+          let observed:
+            | {
+                uuid?: string | null;
+                name?: string | null;
+                // Distilled widened generated string enums to open unions.
+                readReplication?: { mode: string } | null;
+              }
+            | undefined;
+          if (output?.databaseId) {
+            observed = yield* getDb({
+              accountId: acct,
+              databaseId: output.databaseId,
+            }).pipe(
+              Effect.catchTag("DatabaseNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+          if (!observed) {
+            const dbs = yield* listDbs({ accountId: acct, name });
+            observed = dbs.result.find((db) => db.name === name);
+          }
+
+          // Ensure — create if missing. Cloudflare returns
+          // `InvalidProperty` when a database with the same name already
+          // exists; we tolerate the race by re-listing to find it.
+          let databaseId: string;
+          let databaseName: string;
+          const isFirstCreation = !observed;
+          if (!observed) {
+            const db = yield* createDb({
+              accountId: acct,
+              name,
+              jurisdiction:
+                jurisdiction !== "default" ? jurisdiction : undefined,
+              primaryLocationHint: news.primaryLocationHint,
+            }).pipe(
+              Effect.catchTag("InvalidProperty", () =>
+                Effect.gen(function* () {
+                  const dbs = yield* listDbs({ accountId: acct, name });
+                  const match = dbs.result.find((db) => db.name === name);
+                  if (match) {
+                    return match;
+                  }
+                  return yield* Effect.die(
+                    `Database with name "${name}" already exists but could not be found`,
+                  );
+                }),
+              ),
+            );
+            databaseId = db.uuid!;
+            databaseName = db.name ?? name;
+          } else {
+            databaseId = observed.uuid ?? output!.databaseId;
+            databaseName = observed.name ?? name;
+          }
+
+          // Sync read replication — the only mutable property on the
+          // database resource itself. Always patch with the desired mode
+          // so adoption converges drifted state.
+          const desiredReplicationMode =
+            news.readReplication?.mode ?? "disabled";
+          const observedReplicationMode =
+            observed?.readReplication?.mode ?? "disabled";
+          if (
+            isFirstCreation
+              ? desiredReplicationMode !== "disabled"
+              : observedReplicationMode !== desiredReplicationMode
+          ) {
+            const updated = yield* patchDb({
+              accountId: acct,
+              databaseId,
+              readReplication: { mode: desiredReplicationMode },
+            });
+            databaseId = updated.uuid ?? databaseId;
+            databaseName = updated.name ?? databaseName;
+          }
+
+          // Clone is a one-shot seed performed only on first creation.
+          // Re-running it on an existing database would clobber data.
+          if (isFirstCreation && news.clone) {
+            const sourceId = yield* resolveCloneSource(
+              news.clone,
+              acct,
+              listDbs,
+            );
+            yield* cloneD1Database({
+              accountId: acct,
+              sourceDatabaseId: sourceId,
+              targetDatabaseId: databaseId,
+            });
+          }
+
+          // Sync migrations — `applyMigrations` is itself idempotent (it
+          // skips already-applied entries), so this works for both first
+          // create and ongoing updates.
+          const migrationsTable =
+            news.migrationsTable ??
+            output?.migrationsTable ??
+            DEFAULT_MIGRATIONS_TABLE;
+          const migrationsHashes = news.migrationsDir
+            ? yield* runMigrations(
+                acct,
+                databaseId,
+                news.migrationsDir,
+                migrationsTable,
+              )
+            : isFirstCreation
+              ? {}
+              : (output?.migrationsHashes ?? {});
+
+          // Sync imports — `runImports` skips files whose hash matches
+          // previously-imported state. On first create the previous map
+          // is empty so all listed files import.
+          const importHashes = news.importFiles?.length
+            ? yield* runImports(
+                acct,
+                databaseId,
+                news.importFiles,
+                rootDir,
+                output?.importHashes ?? {},
+              )
+            : {};
+
+          return {
+            databaseId,
+            databaseName,
+            jurisdiction: (output?.jurisdiction ??
+              jurisdiction) as Jurisdiction,
+            readReplication: news.readReplication,
+            accountId: acct,
+            migrationsDir: news.migrationsDir,
+            migrationsTable: news.migrationsDir ? migrationsTable : undefined,
+            migrationsHashes,
+            importHashes,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteDb({
+            accountId: output.accountId,
+            databaseId: output.databaseId,
+          }).pipe(Effect.catchTag("DatabaseNotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+/**
+ * Resolve a clone source spec into a concrete database UUID. Looks up by
+ * name through `listDatabases` when only a name is provided.
+ */
+const resolveCloneSource = (
+  source: CloneSource,
+  accountId: string,
+  listDbs: (input: {
+    accountId: string;
+    name?: string;
+  }) => Effect.Effect<d1.ListDatabasesResponse, d1.ListDatabasesError, never>,
+) =>
+  Effect.gen(function* () {
+    if ("databaseId" in source && source.databaseId) {
+      // At lifecycle time, Output<string> attributes have resolved to strings.
+      return source.databaseId as unknown as string;
+    }
+    if ("name" in source && source.name) {
+      const name = source.name as unknown as string;
+      const dbs = yield* listDbs({ accountId, name });
+      const match = dbs.result.find((db) => db.name === name);
+      if (!match?.uuid) {
+        return yield* Effect.die(
+          `Source database "${name}" not found for cloning`,
+        );
+      }
+      return match.uuid;
+    }
+    return yield* Effect.die(
+      "Invalid clone source: must provide databaseId or name",
+    );
+  });
+
+/**
+ * Read all migration files from `migrationsDir`, run pending migrations,
+ * and return the per-file content hashes for state tracking.
+ */
+const runMigrations = (
+  accountId: string,
+  databaseId: string,
+  migrationsDir: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const files = yield* listSqlFiles(migrationsDir);
+    if (files.length > 0) {
+      yield* applyMigrations({
+        accountId,
+        databaseId,
+        migrationsTable,
+        migrationsFiles: files,
+      });
+    }
+    const hashes: Record<string, string> = {};
+    for (const file of files) hashes[file.id] = file.hash;
+    return hashes;
+  });
+
+/**
+ * Read each `importFiles` entry and run it through the D1 import flow,
+ * skipping files whose hash matches the previously-imported hash.
+ */
+const runImports = (
+  accountId: string,
+  databaseId: string,
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+  previous: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = { ...previous };
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      if (previous[filePath] === file.hash) {
+        hashes[filePath] = file.hash;
+        continue;
+      }
+      yield* importD1Database({
+        accountId,
+        databaseId,
+        sqlData: file.sql,
+        filename: file.id,
+      });
+      hashes[filePath] = file.hash;
+    }
+    // Drop entries for files no longer listed.
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+      if (!tracked.has(key)) delete hashes[key];
+    }
+    return hashes;
+  });
+
+/**
+ * Hash all `.sql` files in `migrationsDir` without applying them; used by
+ * `diff` to detect drift relative to previously-applied state.
+ */
+const hashMigrations = (migrationsDir: string) =>
+  listSqlFiles(migrationsDir).pipe(
+    Effect.map((files) => {
+      const hashes: Record<string, string> = {};
+      for (const file of files) hashes[file.id] = file.hash;
+      return hashes;
+    }),
+  );
+
+const hashImports = (importFiles: ReadonlyArray<string>, rootDir: string) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = {};
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      hashes[filePath] = file.hash;
+    }
+    return hashes;
+  });
+
+const recordsEqual = (
+  a: Record<string, string>,
+  b: Record<string, string>,
+): boolean => {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (a[k] !== b[k]) return false;
+  }
+  return true;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1DatabaseBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1DatabaseBinding.ts
new file mode 100644
index 00000000000..3a8133b8e57
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1DatabaseBinding.ts
@@ -0,0 +1,25 @@
+import * as Effect from "effect/Effect";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker } from "../Workers/Worker.ts";
+import type { D1Database } from "./D1Database.ts";
+
+export const DatabaseBinding = Effect.fn(function* (
+  host: ResourceLike,
+  database: D1Database,
+) {
+  if (isWorker(host)) {
+    yield* host.bind`${database}`({
+      bindings: [
+        {
+          type: "d1",
+          name: database.LogicalId,
+          databaseId: database.databaseId,
+        },
+      ],
+    });
+  } else {
+    return yield* Effect.die(
+      new Error(`DatabaseBinding does not support runtime '${host.Type}'`),
+    );
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Export.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Export.ts
new file mode 100644
index 00000000000..a7ba14d0a96
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Export.ts
@@ -0,0 +1,66 @@
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+
+export interface ExportD1DatabaseOptions {
+  accountId: string;
+  databaseId: string;
+  dumpOptions?: {
+    tables?: string[];
+    noSchema?: boolean;
+    noData?: boolean;
+  };
+}
+
+export interface ExportD1DatabaseResult {
+  filename: string;
+  signedUrl: string;
+}
+
+/**
+ * Initiates an export of a Cloudflare D1 database and returns a signed
+ * download URL. Recursively polls with the bookmark until the export
+ * completes or fails.
+ */
+export const exportD1Database = (
+  options: ExportD1DatabaseOptions,
+): Effect.Effect<
+  ExportD1DatabaseResult,
+  d1.ExportDatabaseError,
+  Credentials | HttpClient.HttpClient
+> =>
+  Effect.gen(function* () {
+    const exportDb = yield* d1.exportDatabase;
+
+    const poll = (
+      currentBookmark?: string,
+    ): Effect.Effect<ExportD1DatabaseResult, d1.ExportDatabaseError, never> =>
+      Effect.gen(function* () {
+        const data = yield* exportDb({
+          accountId: options.accountId,
+          databaseId: options.databaseId,
+          outputFormat: "polling",
+          currentBookmark,
+          dumpOptions: options.dumpOptions,
+        });
+
+        if (data.status === "complete" && data.result) {
+          if (!data.result.filename || !data.result.signedUrl) {
+            return yield* Effect.die(
+              "D1 export completed but missing filename/signedUrl",
+            );
+          }
+          return {
+            filename: data.result.filename,
+            signedUrl: data.result.signedUrl,
+          };
+        }
+        if (data.status === "error") {
+          return yield* Effect.die(data.error ?? "Error during D1 export");
+        }
+        return yield* poll(data.atBookmark ?? undefined);
+      });
+
+    return yield* poll();
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Import.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Import.ts
new file mode 100644
index 00000000000..d0e7e1bd492
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Import.ts
@@ -0,0 +1,156 @@
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import {
+  Credentials,
+  formatHeaders,
+} from "@distilled.cloud/cloudflare/Credentials";
+import crypto from "node:crypto";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+export interface ImportD1DatabaseOptions {
+  accountId: string;
+  databaseId: string;
+  sqlData: string | Uint8Array;
+  filename?: string;
+}
+
+export interface ImportD1DatabaseResult {
+  filename: string;
+  numQueries: number;
+}
+
+interface ImportPollingResponse {
+  at_bookmark?: string | null;
+  error?: string | null;
+  filename?: string | null;
+  messages?: string[] | null;
+  result?: {
+    final_bookmark?: string | null;
+    num_queries?: number | null;
+  } | null;
+  status?: "complete" | "error" | null;
+  success?: boolean | null;
+  upload_url?: string | null;
+}
+
+const md5 = (data: string | Uint8Array): string =>
+  crypto.createHash("md5").update(data).digest("hex");
+
+const importEndpoint = (
+  apiBaseUrl: string,
+  accountId: string,
+  databaseId: string,
+) => `${apiBaseUrl}/accounts/${accountId}/d1/database/${databaseId}/import`;
+
+/**
+ * Import SQL into a D1 database via the multi-step Cloudflare flow:
+ *   1. POST `action: "init"` -> returns presigned `upload_url`
+ *   2. PUT raw SQL to `upload_url`
+ *   3. POST `action: "ingest"` -> returns `at_bookmark`
+ *   4. POST `action: "poll"` until `status === "complete"`
+ */
+export const importD1Database = (options: ImportD1DatabaseOptions) =>
+  Effect.gen(function* () {
+    const credentialsEff = yield* Credentials;
+    const credentials = yield* credentialsEff;
+    const authHeaders = formatHeaders(credentials);
+    const url = importEndpoint(
+      credentials.apiBaseUrl,
+      options.accountId,
+      options.databaseId,
+    );
+    const client = yield* HttpClient.HttpClient;
+
+    const postJson = (
+      body: unknown,
+    ): Effect.Effect<ImportPollingResponse, never, never> =>
+      Effect.gen(function* () {
+        const req = HttpClientRequest.post(url).pipe(
+          HttpClientRequest.setHeaders(authHeaders),
+          HttpClientRequest.bodyJsonUnsafe(body),
+        );
+        const res = yield* client.execute(req).pipe(Effect.orDie);
+        if (res.status < 200 || res.status >= 300) {
+          const text = yield* res.text.pipe(Effect.orElseSucceed(() => ""));
+          return yield* Effect.die(
+            `D1 import request failed (${res.status}): ${text}`,
+          );
+        }
+        const text = yield* res.text.pipe(Effect.orDie);
+        const json = JSON.parse(text) as { result: ImportPollingResponse };
+        return json.result;
+      });
+
+    const etag = md5(options.sqlData);
+
+    // Step 1: init via the typed d1 client
+    const initDb = yield* d1.importDatabase;
+    const init = yield* initDb({
+      accountId: options.accountId,
+      databaseId: options.databaseId,
+      action: "init",
+      etag,
+    });
+
+    if (!init.uploadUrl) {
+      return yield* Effect.die(
+        init.error ?? "Failed to get upload URL for D1 import",
+      );
+    }
+    const uploadFilename = options.filename ?? init.filename ?? "import.sql";
+
+    // Step 2: PUT to the presigned upload URL
+    const bytes =
+      typeof options.sqlData === "string"
+        ? new TextEncoder().encode(options.sqlData)
+        : options.sqlData;
+    const putReq = HttpClientRequest.put(init.uploadUrl).pipe(
+      HttpClientRequest.bodyUint8Array(bytes, "application/sql"),
+    );
+    const putRes = yield* client.execute(putReq).pipe(Effect.orDie);
+    if (putRes.status < 200 || putRes.status >= 300) {
+      const text = yield* putRes.text.pipe(Effect.orElseSucceed(() => ""));
+      return yield* Effect.die(
+        `Failed to upload SQL file to D1 (${putRes.status}): ${text}`,
+      );
+    }
+
+    // Step 3: ingest
+    const ingest = yield* postJson({
+      action: "ingest",
+      etag,
+      filename: init.filename,
+    });
+    if (!ingest.at_bookmark) {
+      return yield* Effect.die(
+        ingest.error ?? "Ingest response missing bookmark",
+      );
+    }
+
+    // Step 4: poll until complete
+    const poll = (
+      bookmark: string,
+    ): Effect.Effect<ImportD1DatabaseResult, never, never> =>
+      Effect.gen(function* () {
+        const data = yield* postJson({
+          action: "poll",
+          current_bookmark: bookmark,
+        });
+        if (data.status === "complete" && data.result) {
+          return {
+            filename: data.filename ?? uploadFilename,
+            numQueries: data.result.num_queries ?? 0,
+          };
+        }
+        if (data.status === "error") {
+          return yield* Effect.die(data.error ?? "Error during D1 import");
+        }
+        if (!data.at_bookmark) {
+          return yield* Effect.die("D1 import poll missing bookmark");
+        }
+        return yield* poll(data.at_bookmark);
+      });
+
+    return yield* poll(ingest.at_bookmark);
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Migrations.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Migrations.ts
new file mode 100644
index 00000000000..5e4a6859846
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/D1Migrations.ts
@@ -0,0 +1,229 @@
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import * as Effect from "effect/Effect";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+import type { SqlFile } from "../../Sql/SqlFile.ts";
+
+export interface ApplyMigrationsOptions {
+  accountId: string;
+  databaseId: string;
+  migrationsTable: string;
+  migrationsFiles: ReadonlyArray<SqlFile>;
+}
+
+interface TableColumn {
+  name: string;
+  type: string;
+  pk: number;
+}
+
+interface SchemaInfo {
+  exists: boolean;
+  hasIdColumn: boolean;
+  hasNameColumn: boolean;
+  isLegacySchema: boolean;
+  columns: TableColumn[];
+}
+
+const executeSQL = (
+  accountId: string,
+  databaseId: string,
+  sql: string,
+): Effect.Effect<
+  d1.QueryDatabaseResponse,
+  d1.QueryDatabaseError,
+  Credentials | HttpClient.HttpClient
+> =>
+  Effect.gen(function* () {
+    const queryDb = yield* d1.queryDatabase;
+    return yield* queryDb({ accountId, databaseId, sql });
+  });
+
+const detectSchema = (
+  accountId: string,
+  databaseId: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const result = yield* executeSQL(
+      accountId,
+      databaseId,
+      `PRAGMA table_info(${migrationsTable});`,
+    ).pipe(Effect.option);
+
+    const columns: TableColumn[] = [];
+    if (result._tag === "Some") {
+      const rows = (result.value.result[0]?.results ?? []) as Array<{
+        name: string;
+        type: string;
+        pk: number;
+      }>;
+      for (const row of rows) {
+        columns.push({ name: row.name, type: row.type, pk: row.pk });
+      }
+    }
+
+    if (columns.length === 0) {
+      return {
+        exists: false,
+        hasIdColumn: false,
+        hasNameColumn: false,
+        isLegacySchema: false,
+        columns,
+      } satisfies SchemaInfo;
+    }
+
+    const names = columns.map((c) => c.name);
+    const hasIdColumn = names.includes("id");
+    const hasNameColumn = names.includes("name");
+    const isLegacySchema =
+      columns.length === 2 && !(hasIdColumn && hasNameColumn);
+
+    return {
+      exists: true,
+      hasIdColumn,
+      hasNameColumn,
+      isLegacySchema,
+      columns,
+    } satisfies SchemaInfo;
+  });
+
+const migrateLegacySchema = (
+  accountId: string,
+  databaseId: string,
+  migrationsTable: string,
+  schema: SchemaInfo,
+) =>
+  Effect.gen(function* () {
+    const primaryColumn =
+      schema.columns.find((c) => c.pk === 1)?.name ?? schema.columns[0]?.name;
+    if (!primaryColumn) {
+      return yield* Effect.die(
+        "Cannot migrate legacy migration table: no columns found",
+      );
+    }
+    const tempTable = `${migrationsTable}_temp_migration`;
+    yield* executeSQL(
+      accountId,
+      databaseId,
+      `CREATE TABLE ${tempTable} (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        applied_at TEXT NOT NULL
+      );`,
+    );
+    yield* executeSQL(
+      accountId,
+      databaseId,
+      `INSERT INTO ${tempTable} (id, name, applied_at)
+       SELECT
+         printf('%05d', row_number() OVER (ORDER BY applied_at)) as id,
+         ${primaryColumn} as name,
+         applied_at
+       FROM ${migrationsTable}
+       ORDER BY applied_at;`,
+    );
+    yield* executeSQL(accountId, databaseId, `DROP TABLE ${migrationsTable};`);
+    yield* executeSQL(
+      accountId,
+      databaseId,
+      `ALTER TABLE ${tempTable} RENAME TO ${migrationsTable};`,
+    );
+  });
+
+const ensureMigrationsTable = (
+  accountId: string,
+  databaseId: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const schema = yield* detectSchema(accountId, databaseId, migrationsTable);
+    if (!schema.exists) {
+      yield* executeSQL(
+        accountId,
+        databaseId,
+        `CREATE TABLE ${migrationsTable} (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          applied_at TEXT NOT NULL
+        );`,
+      );
+      return;
+    }
+    if (schema.isLegacySchema || !schema.hasIdColumn || !schema.hasNameColumn) {
+      yield* migrateLegacySchema(
+        accountId,
+        databaseId,
+        migrationsTable,
+        schema,
+      );
+    }
+  });
+
+const getAppliedMigrations = (
+  accountId: string,
+  databaseId: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const result = yield* executeSQL(
+      accountId,
+      databaseId,
+      `SELECT name FROM ${migrationsTable};`,
+    );
+    const rows = (result.result[0]?.results ?? []) as Array<{ name: string }>;
+    return new Set(rows.map((r) => r.name));
+  });
+
+const getNextSeq = (
+  accountId: string,
+  databaseId: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const result = yield* executeSQL(
+      accountId,
+      databaseId,
+      `SELECT id FROM ${migrationsTable} ORDER BY id;`,
+    );
+    const rows = (result.result[0]?.results ?? []) as Array<{ id: string }>;
+    let max = 0;
+    for (const { id } of rows) {
+      if (/^\d+$/.test(id)) {
+        max = Math.max(max, Number.parseInt(id, 10));
+      }
+    }
+    return max + 1;
+  });
+
+/**
+ * Apply pending D1 migrations in order. Uses the wrangler-compatible
+ * 3-column schema `(id TEXT PK, name TEXT, applied_at TEXT)`.
+ */
+export const applyMigrations = (options: ApplyMigrationsOptions) =>
+  Effect.gen(function* () {
+    const { accountId, databaseId, migrationsTable, migrationsFiles } = options;
+    yield* ensureMigrationsTable(accountId, databaseId, migrationsTable);
+    const applied = yield* getAppliedMigrations(
+      accountId,
+      databaseId,
+      migrationsTable,
+    );
+    let nextSeq = yield* getNextSeq(accountId, databaseId, migrationsTable);
+
+    for (const migration of migrationsFiles) {
+      if (applied.has(migration.id)) continue;
+      const migrationId = nextSeq.toString().padStart(5, "0");
+      nextSeq += 1;
+      // D1 over HTTP doesn't support transactions; run migration + record
+      // in a single batched query.
+      yield* executeSQL(
+        accountId,
+        databaseId,
+        [
+          migration.sql,
+          `INSERT INTO ${migrationsTable} (id, name, applied_at) VALUES ('${migrationId}', '${migration.id}', datetime('now'));`,
+        ].join("\n"),
+      );
+    }
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/index.ts
new file mode 100644
index 00000000000..d12ede2ae68
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/D1/index.ts
@@ -0,0 +1,3 @@
+export * from "./D1Connection.ts";
+export * from "./D1Database.ts";
+export * from "./D1DatabaseBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsBinding.ts
new file mode 100644
index 00000000000..685f977f205
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsBinding.ts
@@ -0,0 +1,123 @@
+import {
+  Credentials,
+  fromApiToken,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { type HttpClient } from "effect/unstable/http/HttpClient";
+import type * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { ApiTokenPermissionGroupRef } from "../ApiToken/Common.ts";
+import type { Zone } from "../Zone/Zone.ts";
+
+/**
+ * Runtime accessor for a DNS binding's token, obtained by binding the
+ * {@link AccountApiToken}'s `value` output in the Worker's Init phase. Reads the
+ * value back from the Worker's environment at runtime. DNS record operations
+ * are zone-scoped (the `zoneId` is passed per call), so the account id is not
+ * needed at runtime.
+ */
+export interface DnsToken {
+  /** The token's plaintext value (injected as a `secret_text` binding). */
+  value: Effect.Effect<Redacted.Redacted<string>>;
+}
+
+/**
+ * Bind an {@link AccountApiToken}'s `value` output into the Worker (as a
+ * `secret_text` binding) and return the {@link DnsToken} accessor.
+ */
+export const bindDnsToken = (token: AccountApiToken) =>
+  Effect.gen(function* () {
+    const value = yield* token.value;
+    return { value } satisfies DnsToken;
+  });
+
+/**
+ * Resolve credentials from a bound token and provide them (plus the
+ * fetch-based HTTP client) to a raw SDK operation.
+ */
+export const authorizeDns =
+  (token: DnsToken) =>
+  <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient>,
+  ): Effect.Effect<A, E, RuntimeContext> =>
+    token.value.pipe(
+      Effect.flatMap((value) =>
+        eff.pipe(
+          Effect.provide(
+            fromApiToken({ apiToken: Redacted.value(value) }).pipe(
+              Layer.provideMerge(FetchHttpClient.layer),
+            ),
+          ),
+        ),
+      ),
+    );
+
+/**
+ * Shared runtime body for a DNS binding: create a token scoped to the requested
+ * zone, attach the (narrow) policy, bind the token's value and the zone's id
+ * into the Worker, then build the client. Pass the result to
+ * `Layer.effect(<Binding>, ...)`.
+ *
+ * The zone's `zoneId` is bound into the Worker at init time, so the resulting
+ * client closes over it and callers never pass it per request — the
+ * provisioned token only grants access to that one zone anyway.
+ */
+export const makeDnsClient = <C>(
+  Policy: Binding.Policy<
+    any,
+    any,
+    (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+  >,
+  tokenId: string,
+  makeClient: (token: DnsToken, zoneId: Effect.Effect<string>) => C,
+) =>
+  Effect.gen(function* () {
+    const Token = yield* AccountApiToken;
+    const attach = yield* Policy;
+
+    return Effect.fn(function* (zone: Zone) {
+      const token = yield* Token(tokenId);
+      yield* attach(token, zone);
+      const zoneId = yield* zone.zoneId;
+      return makeClient(yield* bindDnsToken(token), zoneId);
+    });
+  });
+
+/**
+ * Build the deploy-time policy layer for a DNS binding: attach an allow policy
+ * with the given permission groups, scoped to the requested zone
+ * (`com.cloudflare.api.account.zone.<zoneId>`).
+ */
+export const makeDnsPolicyLive = <Self, Id extends string>(
+  Policy: Binding.Policy<
+    Self,
+    Id,
+    (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+  >,
+  sid: string,
+  permissionGroups: ApiTokenPermissionGroupRef[],
+) =>
+  Policy.layer.succeed((_host, token, zone) =>
+    token.bind`${sid}(${zone})`({
+      policies: [
+        {
+          effect: "allow",
+          permissionGroups,
+          resources: zone.zoneId.pipe(
+            Output.flatMap(
+              (zoneId) =>
+                Output.interpolate`com.cloudflare.api.account.zone.${zoneId}`,
+            ),
+            Output.map((zoneId) => ({
+              [zoneId]: "*",
+            })),
+          ),
+        },
+      ],
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsRead.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsRead.ts
new file mode 100644
index 00000000000..190835e538e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsRead.ts
@@ -0,0 +1,129 @@
+import type {
+  GetRecordError,
+  GetRecordResponse,
+  ListRecordsError,
+  ListRecordsRequest,
+  ListRecordsResponse,
+} from "@distilled.cloud/cloudflare/dns";
+import * as dns from "@distilled.cloud/cloudflare/dns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Zone } from "../Zone/Zone.ts";
+import {
+  authorizeDns,
+  type DnsToken,
+  makeDnsClient,
+  makeDnsPolicyLive,
+} from "./DnsBinding.ts";
+
+/** List-records request, minus the zone id (bound at `.bind(zone)` time). */
+export type ListRecordsRequestInput = Omit<ListRecordsRequest, "zoneId">;
+
+/**
+ * Read-only DNS record operations. Backed by the `DNS Read` permission group.
+ * The zone is fixed when the client is bound, so no `zoneId` is passed per call.
+ */
+export interface DnsReadClient {
+  /** Fetch a single DNS record by id. */
+  getDnsRecord(
+    dnsRecordId: string,
+  ): Effect.Effect<GetRecordResponse, GetRecordError, RuntimeContext>;
+  /** List the DNS records in the bound zone. */
+  listDnsRecords(
+    request?: ListRecordsRequestInput,
+  ): Effect.Effect<ListRecordsResponse, ListRecordsError, RuntimeContext>;
+}
+
+/** Build the read-only client over a bound token and zone id. */
+export const dnsReadClient = (
+  token: DnsToken,
+  zoneId: Effect.Effect<string>,
+): DnsReadClient => {
+  const authorize = authorizeDns(token);
+  return {
+    getDnsRecord: Effect.fn("Cloudflare.Dns.getDnsRecord")(
+      function* (dnsRecordId) {
+        return yield* authorize(
+          dns.getRecord({ zoneId: yield* zoneId, dnsRecordId }),
+        );
+      },
+    ),
+    listDnsRecords: Effect.fn("Cloudflare.Dns.listDnsRecords")(
+      function* (request) {
+        return yield* authorize(
+          dns.listRecords({ zoneId: yield* zoneId, ...request }),
+        );
+      },
+    ),
+  };
+};
+
+/**
+ * Binding that lets a Worker read Cloudflare DNS records at runtime.
+ *
+ * Creates a least-privilege {@link AccountApiToken} with only the `DNS Read`
+ * permission, scoped to the single zone passed to `bind`, and binds its value
+ * into the Worker so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Reading DNS records at runtime
+ * @example Read records from inside a Worker
+ * Bind the client in the Worker's Init phase and provide {@link DnsReadLive}.
+ * The zone is fixed by `.bind(zone)` — the provisioned token only grants
+ * access to that zone, so calls take no `zoneId`. Pass the {@link Zone}
+ * resource directly (it's an `Effect`), or `yield* Zone` for a resolved value.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const Zone = Cloudflare.Zone("MyZone", { name: "example.com" });
+ *
+ * export class DnsReaderWorker extends Cloudflare.Worker<DnsReaderWorker>()(
+ *   "DnsReaderWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Init phase — bind the read client scoped to the zone.
+ *     const dns = yield* Cloudflare.DnsRead.bind(Zone);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { result } = yield* dns.listDnsRecords({ type: "A" });
+ *         const record = yield* dns.getDnsRecord(result[0].id);
+ *         return yield* HttpServerResponse.json({ id: record.id });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.DnsReadLive)),
+ * ) {}
+ * ```
+ */
+export class DnsRead extends Binding.Service<
+  DnsRead,
+  (zone: Zone) => Effect.Effect<DnsReadClient>
+>()("Cloudflare.DnsRead") {}
+
+/**
+ * Deploy-time policy for {@link DnsRead}. Attaches the `DNS Read` permission to
+ * the token via its binding contract.
+ */
+export class DnsReadPolicy extends Binding.Policy<
+  DnsReadPolicy,
+  (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+>()("Cloudflare.DnsRead") {}
+
+/** Runtime layer for {@link DnsRead}. */
+export const DnsReadLive = Layer.effect(
+  DnsRead,
+  makeDnsClient(DnsReadPolicy, "DnsReadToken", dnsReadClient),
+);
+
+/** Live deploy-time policy layer for {@link DnsReadPolicy}. */
+export const DnsReadPolicyLive = makeDnsPolicyLive(
+  DnsReadPolicy,
+  "Cloudflare.DnsRead",
+  ["DNS Read"],
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsReadWrite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsReadWrite.ts
new file mode 100644
index 00000000000..08c5141cdef
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsReadWrite.ts
@@ -0,0 +1,99 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Zone } from "../Zone/Zone.ts";
+import {
+  type DnsToken,
+  makeDnsClient,
+  makeDnsPolicyLive,
+} from "./DnsBinding.ts";
+import { dnsReadClient, type DnsReadClient } from "./DnsRead.ts";
+import { dnsWriteClient, type DnsWriteClient } from "./DnsWrite.ts";
+
+/** Combined read + write DNS record operations. */
+export interface DnsReadWriteClient extends DnsReadClient, DnsWriteClient {}
+
+/** Build the combined read + write client over a bound token and zone id. */
+export const dnsReadWriteClient = (
+  token: DnsToken,
+  zoneId: Effect.Effect<string>,
+): DnsReadWriteClient => ({
+  ...dnsReadClient(token, zoneId),
+  ...dnsWriteClient(token, zoneId),
+});
+
+/**
+ * Binding that lets a Worker perform the full Cloudflare DNS record CRUD
+ * surface at runtime.
+ *
+ * Creates a least-privilege {@link AccountApiToken} with both the `DNS Read`
+ * and `DNS Write` permissions, scoped to the single zone passed to `bind`, and
+ * binds its value into the Worker so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Managing DNS records at runtime
+ * @example Full CRUD from inside a Worker
+ * Bind the client in the Worker's Init phase and provide
+ * {@link DnsReadWriteLive}. The zone is fixed by `.bind(zone)` — the
+ * provisioned token only grants access to that zone, so calls take no
+ * `zoneId`. Pass the {@link Zone} resource directly (it's an `Effect`), or
+ * `yield* Zone` for a resolved value.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const Zone = Cloudflare.Zone("MyZone", { name: "example.com" });
+ *
+ * export class DnsWorker extends Cloudflare.Worker<DnsWorker>()(
+ *   "DnsWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Init phase — bind the full CRUD client scoped to the zone.
+ *     const dns = yield* Cloudflare.DnsReadWrite.bind(Zone);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { result } = yield* dns.createDnsRecord({
+ *           type: "A",
+ *           name: "app.example.com",
+ *           content: "192.0.2.1",
+ *           ttl: 1,
+ *         });
+ *         const record = yield* dns.getDnsRecord(result.id);
+ *         yield* dns.deleteDnsRecord(result.id);
+ *         return yield* HttpServerResponse.json({ id: record.id });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.DnsReadWriteLive)),
+ * ) {}
+ * ```
+ */
+export class DnsReadWrite extends Binding.Service<
+  DnsReadWrite,
+  (zone: Zone) => Effect.Effect<DnsReadWriteClient>
+>()("Cloudflare.DnsReadWrite") {}
+
+/**
+ * Deploy-time policy for {@link DnsReadWrite}. Attaches both the `DNS Read` and
+ * `DNS Write` permissions to the token via its binding contract.
+ */
+export class DnsReadWritePolicy extends Binding.Policy<
+  DnsReadWritePolicy,
+  (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+>()("Cloudflare.DnsReadWrite") {}
+
+/** Runtime layer for {@link DnsReadWrite}. */
+export const DnsReadWriteLive = Layer.effect(
+  DnsReadWrite,
+  makeDnsClient(DnsReadWritePolicy, "DnsReadWriteToken", dnsReadWriteClient),
+);
+
+/** Live deploy-time policy layer for {@link DnsReadWritePolicy}. */
+export const DnsReadWritePolicyLive = makeDnsPolicyLive(
+  DnsReadWritePolicy,
+  "Cloudflare.DnsReadWrite",
+  ["DNS Read", "DNS Write"],
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsWrite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsWrite.ts
new file mode 100644
index 00000000000..8d083fc65ad
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/DnsWrite.ts
@@ -0,0 +1,209 @@
+import type {
+  BatchRecordError,
+  BatchRecordRequest,
+  BatchRecordResponse,
+  CreateRecordError,
+  CreateRecordRequest,
+  CreateRecordResponse,
+  DeleteRecordError,
+  DeleteRecordResponse,
+  PatchRecordError,
+  PatchRecordRequest,
+  PatchRecordResponse,
+  UpdateRecordError,
+  UpdateRecordRequest,
+  UpdateRecordResponse,
+} from "@distilled.cloud/cloudflare/dns";
+import * as dns from "@distilled.cloud/cloudflare/dns";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Zone } from "../Zone/Zone.ts";
+import {
+  authorizeDns,
+  type DnsToken,
+  makeDnsClient,
+  makeDnsPolicyLive,
+} from "./DnsBinding.ts";
+
+/** Create-record request, minus the zone id (bound at `.bind(zone)` time). */
+export type CreateRecordRequestInput = Omit<CreateRecordRequest, "zoneId">;
+
+/** Update-record request, minus the zone id and record id. */
+export type UpdateRecordRequestInput = Omit<
+  UpdateRecordRequest,
+  "zoneId" | "dnsRecordId"
+>;
+
+/** Patch-record request, minus the zone id and record id. */
+export type PatchRecordRequestInput = Omit<
+  PatchRecordRequest,
+  "zoneId" | "dnsRecordId"
+>;
+
+/** Batch-records request, minus the zone id (bound at `.bind(zone)` time). */
+export type BatchRecordRequestInput = Omit<BatchRecordRequest, "zoneId">;
+
+/**
+ * Mutating DNS record operations. Backed by the `DNS Write` permission group.
+ * The zone is fixed when the client is bound, so no `zoneId` is passed per call.
+ */
+export interface DnsWriteClient {
+  /** Create a DNS record. */
+  createDnsRecord(
+    request: CreateRecordRequestInput,
+  ): Effect.Effect<CreateRecordResponse, CreateRecordError, RuntimeContext>;
+  /** Overwrite (PUT) a DNS record. */
+  updateDnsRecord(
+    dnsRecordId: string,
+    request: UpdateRecordRequestInput,
+  ): Effect.Effect<UpdateRecordResponse, UpdateRecordError, RuntimeContext>;
+  /** Partially update (PATCH) a DNS record. */
+  patchDnsRecord(
+    dnsRecordId: string,
+    request: PatchRecordRequestInput,
+  ): Effect.Effect<PatchRecordResponse, PatchRecordError, RuntimeContext>;
+  /** Delete a DNS record by id. */
+  deleteDnsRecord(
+    dnsRecordId: string,
+  ): Effect.Effect<DeleteRecordResponse, DeleteRecordError, RuntimeContext>;
+  /** Apply a batch of create / update / patch / delete operations atomically. */
+  batchDnsRecords(
+    request: BatchRecordRequestInput,
+  ): Effect.Effect<BatchRecordResponse, BatchRecordError, RuntimeContext>;
+}
+
+/** Build the write client over a bound token and zone id. */
+export const dnsWriteClient = (
+  token: DnsToken,
+  zoneId: Effect.Effect<string>,
+): DnsWriteClient => {
+  const authorize = authorizeDns(token);
+  return {
+    createDnsRecord: Effect.fn("Cloudflare.Dns.createDnsRecord")(
+      function* (request) {
+        return yield* authorize(
+          dns.createRecord({ zoneId: yield* zoneId, ...request }),
+        );
+      },
+    ),
+    updateDnsRecord: Effect.fn("Cloudflare.Dns.updateDnsRecord")(
+      function* (dnsRecordId, request) {
+        return yield* authorize(
+          dns.updateRecord({ zoneId: yield* zoneId, dnsRecordId, ...request }),
+        );
+      },
+    ),
+    patchDnsRecord: Effect.fn("Cloudflare.Dns.patchDnsRecord")(
+      function* (dnsRecordId, request) {
+        return yield* authorize(
+          dns.patchRecord({ zoneId: yield* zoneId, dnsRecordId, ...request }),
+        );
+      },
+    ),
+    deleteDnsRecord: Effect.fn("Cloudflare.Dns.deleteDnsRecord")(
+      function* (dnsRecordId) {
+        return yield* authorize(
+          dns.deleteRecord({ zoneId: yield* zoneId, dnsRecordId }),
+        );
+      },
+    ),
+    batchDnsRecords: Effect.fn("Cloudflare.Dns.batchDnsRecords")(
+      function* (request) {
+        return yield* authorize(
+          dns.batchRecord({ zoneId: yield* zoneId, ...request }),
+        );
+      },
+    ),
+  };
+};
+
+/**
+ * Binding that lets a Worker create, update, and delete Cloudflare DNS records
+ * at runtime.
+ *
+ * Creates a least-privilege {@link AccountApiToken} with only the `DNS Write`
+ * permission, scoped to the single zone passed to `bind`, and binds its value
+ * into the Worker so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Mutating DNS records at runtime
+ * @example Create, update, and delete records from inside a Worker
+ * Bind the client in the Worker's Init phase and provide {@link DnsWriteLive}.
+ * The zone is fixed by `.bind(zone)` — the provisioned token only grants
+ * access to that zone, so calls take no `zoneId`. Pass the {@link Zone}
+ * resource directly (it's an `Effect`), or `yield* Zone` for a resolved value.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * const Zone = Cloudflare.Zone("MyZone", { name: "example.com" });
+ *
+ * export class DnsWriterWorker extends Cloudflare.Worker<DnsWriterWorker>()(
+ *   "DnsWriterWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Init phase — bind the write client scoped to the zone.
+ *     const dns = yield* Cloudflare.DnsWrite.bind(Zone);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { result } = yield* dns.createDnsRecord({
+ *           type: "A",
+ *           name: "app.example.com",
+ *           content: "192.0.2.1",
+ *           ttl: 1,
+ *           proxied: true,
+ *         });
+ *         yield* dns.updateDnsRecord(result.id, {
+ *           type: "A",
+ *           name: "app.example.com",
+ *           content: "192.0.2.2",
+ *           ttl: 1,
+ *         });
+ *         yield* dns.deleteDnsRecord(result.id);
+ *         return yield* HttpServerResponse.json({ id: result.id });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.DnsWriteLive)),
+ * ) {}
+ * ```
+ *
+ * @example Apply a batch of changes atomically
+ * ```typescript
+ * yield* dns.batchDnsRecords({
+ *   posts: [{ type: "A", name: "a.example.com", content: "192.0.2.1", ttl: 1 }],
+ *   deletes: [{ id: oldRecordId }],
+ * });
+ * ```
+ */
+export class DnsWrite extends Binding.Service<
+  DnsWrite,
+  (zone: Zone) => Effect.Effect<DnsWriteClient>
+>()("Cloudflare.DnsWrite") {}
+
+/**
+ * Deploy-time policy for {@link DnsWrite}. Attaches the `DNS Write` permission
+ * to the token via its binding contract.
+ */
+export class DnsWritePolicy extends Binding.Policy<
+  DnsWritePolicy,
+  (token: AccountApiToken, zone: Zone) => Effect.Effect<void>
+>()("Cloudflare.DnsWrite") {}
+
+/** Runtime layer for {@link DnsWrite}. */
+export const DnsWriteLive = Layer.effect(
+  DnsWrite,
+  makeDnsClient(DnsWritePolicy, "DnsWriteToken", dnsWriteClient),
+);
+
+/** Live deploy-time policy layer for {@link DnsWritePolicy}. */
+export const DnsWritePolicyLive = makeDnsPolicyLive(
+  DnsWritePolicy,
+  "Cloudflare.DnsWrite",
+  ["DNS Write"],
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/index.ts
new file mode 100644
index 00000000000..5ec6f176e81
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Dns/index.ts
@@ -0,0 +1,4 @@
+export * from "./DnsBinding.ts";
+export * from "./DnsRead.ts";
+export * from "./DnsReadWrite.ts";
+export * from "./DnsWrite.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/EdgeSession.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/EdgeSession.ts
new file mode 100644
index 00000000000..b45e7b3b6ea
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/EdgeSession.ts
@@ -0,0 +1,154 @@
+import { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { Access } from "./Access.ts";
+import { CloudflareEnvironment } from "./CloudflareEnvironment.ts";
+
+/**
+ * A "remote binding" as understood by the Cloudflare Workers
+ * edge-preview API. We reuse the distilled request schema so the
+ * shape tracks Cloudflare's surface.
+ */
+type EdgeMetadata = NonNullable<
+  NonNullable<workers.CreateScriptEdgePreviewRequest["metadata"]>
+>;
+export type EdgeBinding = NonNullable<
+  NonNullable<EdgeMetadata["bindings"]>
+>[number];
+
+export class EdgeSessionError extends Data.TaggedError("EdgeSessionError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export interface EdgeSessionOptions {
+  /**
+   * Name used as the preview script identifier on Cloudflare's side.
+   * Shows up as the hostname: `{scriptName}.{subdomain}.workers.dev`.
+   */
+  readonly scriptName: string;
+  /** ES-module worker script(s). The first file is the entrypoint. */
+  readonly files: ReadonlyArray<File>;
+  /** Remote bindings attached to the preview worker. */
+  readonly bindings: ReadonlyArray<EdgeBinding>;
+  /** @default "2025-04-28" */
+  readonly compatibilityDate?: string;
+}
+
+/**
+ * Information needed to call a running edge-preview worker. Attach
+ * `headers` (including the `cf-workers-preview-token`) and fetch
+ * `url` or a path under it.
+ */
+export interface EdgeSessionHandle {
+  readonly url: string;
+  readonly headers: Record<string, string>;
+}
+
+const DEFAULT_COMPATIBILITY_DATE = "2025-04-28";
+
+const wrap = <A, E, R>(effect: Effect.Effect<A, E, R>, message: string) =>
+  effect.pipe(
+    Effect.mapError((cause) => new EdgeSessionError({ message, cause })),
+  );
+
+/**
+ * Ask Cloudflare for a preview upload token. Some accounts return an
+ * `exchangeUrl` that must be GET'd to swap the session token for a
+ * short-lived upload token; when present we do the swap, falling back
+ * to the original if the exchange fails.
+ */
+const createUploadToken = Effect.gen(function* () {
+  const env = yield* CloudflareEnvironment;
+  const http = yield* HttpClient.HttpClient;
+  const createSubdomainEdgePreviewSession =
+    yield* workers.createSubdomainEdgePreviewSession;
+  const { token, exchangeUrl } = yield* createSubdomainEdgePreviewSession({
+    accountId: env.accountId,
+  });
+  if (!exchangeUrl) return token;
+  const json = yield* http.get(exchangeUrl).pipe(
+    Effect.flatMap((r) => r.json),
+    Effect.timeout(30_000),
+    Effect.catch(() => Effect.succeed(null as unknown)),
+  );
+  if (
+    typeof json === "object" &&
+    json !== null &&
+    "token" in json &&
+    typeof (json as Record<string, unknown>).token === "string"
+  ) {
+    return (json as { token: string }).token;
+  }
+  return token;
+});
+
+const uploadScript = (options: EdgeSessionOptions, uploadToken: string) =>
+  Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const createScriptEdgePreview = yield* workers.createScriptEdgePreview;
+    return yield* createScriptEdgePreview({
+      accountId: env.accountId,
+      scriptName: options.scriptName,
+      cfPreviewUploadConfigToken: uploadToken,
+      wranglerSessionConfig: { workersDev: true, minimalMode: true },
+      metadata: {
+        compatibilityDate:
+          options.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE,
+        bindings: options.bindings as EdgeMetadata["bindings"],
+        mainModule: options.files[0]!.name,
+      },
+      // Distilled's generated schema expects a mutable array; our
+      // public surface keeps `readonly` so callers can pass a frozen
+      // tuple without a cast on their side.
+      files: options.files.slice(),
+    }).pipe(Effect.timeout(30_000));
+  });
+
+const workerHost = (scriptName: string) =>
+  Effect.gen(function* () {
+    const env = yield* CloudflareEnvironment;
+    const getSubdomain = yield* workers.getSubdomain;
+    const { subdomain } = yield* getSubdomain({ accountId: env.accountId });
+    return `${scriptName}.${subdomain}.workers.dev`;
+  });
+
+/**
+ * Upload a short-lived preview worker to Cloudflare's edge and
+ * return its URL plus the headers needed to reach it.
+ *
+ * Preview workers are ephemeral: they live only while a client keeps
+ * sending requests with the returned preview token and expire soon
+ * after. Nothing is deployed or billed.
+ */
+export const createEdgeSession = (
+  options: EdgeSessionOptions,
+): Effect.Effect<
+  EdgeSessionHandle,
+  EdgeSessionError,
+  CloudflareEnvironment | HttpClient.HttpClient | Credentials | Access
+> =>
+  Effect.gen(function* () {
+    const [{ previewToken }, { url, headers }] = yield* Effect.all(
+      [
+        createUploadToken.pipe(Effect.flatMap((t) => uploadScript(options, t))),
+        workerHost(options.scriptName).pipe(
+          Effect.flatMap(
+            Effect.fn(function* (host) {
+              const headers = yield* Access.use((access) =>
+                access.getAccessHeaders(host),
+              );
+              return { url: `https://${host}`, headers };
+            }),
+          ),
+        ),
+      ],
+      { concurrency: "unbounded" },
+    );
+    return {
+      url,
+      headers: { ...headers, "cf-workers-preview-token": previewToken },
+    } satisfies EdgeSessionHandle;
+  }).pipe((e) => wrap(e, "Failed to create edge preview session"));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailAddress.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailAddress.ts
new file mode 100644
index 00000000000..03091969036
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailAddress.ts
@@ -0,0 +1,155 @@
+import * as emailRouting from "@distilled.cloud/cloudflare/email-routing";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+export type EmailAddressProps = {
+  /**
+   * The email address to register as a verified destination on the
+   * account. Cloudflare sends a verification email to this address; the
+   * recipient must click the link before the address can receive routed
+   * mail or be used as a verified sender.
+   *
+   * Changing this property triggers a replacement.
+   */
+  email: string;
+};
+
+export type EmailAddress = Resource<
+  "Cloudflare.EmailAddress",
+  EmailAddressProps,
+  {
+    addressId: string;
+    email: string;
+    accountId: string;
+    verified: boolean;
+    verifiedAt: string | undefined;
+    created: string | undefined;
+    modified: string | undefined;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A verified destination email address on the account.
+ *
+ * Destination addresses are account-scoped (not zone-scoped). They are used
+ * as forwarding targets in `EmailRule` actions and can also serve as the
+ * `destinationAddress` on a `send_email` Worker binding.
+ *
+ * @section Registering an Address
+ * @example Register a destination address
+ * ```typescript
+ * const ops = yield* Cloudflare.EmailAddress("Ops", {
+ *   email: "ops@example.com",
+ * });
+ * ```
+ *
+ * Cloudflare sends a verification email when the address is first created.
+ * The address must be verified before it can receive routed mail.
+ */
+export const EmailAddress = Resource<EmailAddress>("Cloudflare.EmailAddress");
+
+const toAttrs = (
+  accountId: string,
+  result: {
+    id?: string | null;
+    email?: string | null;
+    verified?: string | null;
+    created?: string | null;
+    modified?: string | null;
+  },
+) => ({
+  addressId: result.id ?? "",
+  email: result.email ?? "",
+  accountId,
+  verified: Boolean(result.verified),
+  verifiedAt: result.verified ?? undefined,
+  created: result.created ?? undefined,
+  modified: result.modified ?? undefined,
+});
+
+export const EmailAddressProvider = () =>
+  Provider.effect(
+    EmailAddress,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const create = yield* emailRouting.createAddress;
+      const get = yield* emailRouting.getAddress;
+      const del = yield* emailRouting.deleteAddress;
+
+      return {
+        stables: ["addressId", "accountId", "email"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!output) return undefined;
+          if (output.accountId !== accountId) {
+            return { action: "replace" } as const;
+          }
+          if (!isResolved(news)) return undefined;
+          if (news.email !== output.email) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const identifier =
+            output?.addressId ??
+            (olds?.email ? encodeURIComponent(olds.email) : undefined);
+          if (!identifier) return undefined;
+          const acct = output?.accountId ?? accountId;
+          return yield* get({
+            accountId: acct,
+            destinationAddressIdentifier: identifier,
+          }).pipe(
+            Effect.map((r) => toAttrs(acct, r)),
+            Effect.catch(() => Effect.succeed(undefined)),
+          );
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const acct = output?.accountId ?? accountId;
+          const email = news.email;
+
+          // Observe — by addressId if known, else by email lookup.
+          let observed: ReturnType<typeof toAttrs> | undefined =
+            output?.addressId
+              ? yield* get({
+                  accountId: acct,
+                  destinationAddressIdentifier: output.addressId,
+                }).pipe(
+                  Effect.map((r) => toAttrs(acct, r)),
+                  Effect.catch(() => Effect.succeed(undefined)),
+                )
+              : undefined;
+
+          if (!observed) {
+            observed = yield* get({
+              accountId: acct,
+              destinationAddressIdentifier: encodeURIComponent(email),
+            }).pipe(
+              Effect.map((r) => toAttrs(acct, r)),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+          }
+
+          // Ensure — register the address if it doesn't already exist.
+          if (!observed) {
+            const created = yield* create({ accountId: acct, email });
+            observed = toAttrs(acct, created);
+          }
+
+          return observed;
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!output?.addressId) return;
+          yield* del({
+            accountId: output.accountId,
+            destinationAddressIdentifier: output.addressId,
+          }).pipe(Effect.catch(() => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailRouting.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailRouting.ts
new file mode 100644
index 00000000000..d525968bc63
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailRouting.ts
@@ -0,0 +1,138 @@
+import * as emailRouting from "@distilled.cloud/cloudflare/email-routing";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { resolveZoneId, type ZoneReference } from "../Zone/index.ts";
+
+export type EmailRoutingStatus =
+  | "ready"
+  | "unconfigured"
+  | "misconfigured"
+  | "misconfigured/locked"
+  | "unlocked";
+
+export type EmailRoutingProps = {
+  /**
+   * Zone to enable email routing on. Accepts a zone id, a zone name
+   * (`example.com`), or a `{ zoneId, name? }` object.
+   */
+  zone: ZoneReference;
+  /**
+   * Whether to enable Email Routing on the zone.
+   *
+   * @default true
+   */
+  enabled?: boolean;
+};
+
+export type EmailRouting = Resource<
+  "Cloudflare.EmailRouting",
+  EmailRoutingProps,
+  {
+    routingId: string;
+    zoneId: string;
+    name: string;
+    enabled: boolean;
+    status: EmailRoutingStatus | undefined;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * Enables Cloudflare Email Routing on a zone. This is the prerequisite for
+ * receiving mail at any address on the domain and for sending email from a
+ * Worker via `send_email` bindings.
+ *
+ * @section Enabling Email Routing
+ * @example Enable on a zone you own
+ * ```typescript
+ * const routing = yield* Cloudflare.EmailRouting("Routing", {
+ *   zone: "example.com",
+ * });
+ * ```
+ */
+export const EmailRouting = Resource<EmailRouting>("Cloudflare.EmailRouting");
+
+export const EmailRoutingProvider = () =>
+  Provider.effect(
+    EmailRouting,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const enable = yield* emailRouting.enableEmailRouting;
+      const disable = yield* emailRouting.disableEmailRouting;
+      const get = yield* emailRouting.getEmailRouting;
+
+      const resolve = (zone: ZoneReference) =>
+        resolveZoneId({
+          accountId,
+          zone,
+          hostname: typeof zone === "string" ? zone : (zone.name ?? ""),
+        });
+
+      return {
+        stables: ["zoneId", "routingId"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!output) return undefined;
+          if (!isResolved(news)) return undefined;
+          const zoneId = yield* resolve(news.zone);
+          if (zoneId !== output.zoneId) {
+            return { action: "replace" } as const;
+          }
+          if ((news.enabled ?? true) !== output.enabled) {
+            return { action: "update" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.zoneId) return undefined;
+          const result = yield* get({ zoneId: output.zoneId });
+          return {
+            routingId: result.id,
+            zoneId: output.zoneId,
+            name: result.name,
+            enabled: result.enabled,
+            status: (result.status ?? undefined) as
+              | EmailRoutingStatus
+              | undefined,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const zoneId = output?.zoneId ?? (yield* resolve(news.zone));
+          const desired = news.enabled ?? true;
+
+          if (desired) {
+            const result = yield* enable({ zoneId, body: {} });
+            return {
+              routingId: result.id,
+              zoneId,
+              name: result.name,
+              enabled: result.enabled,
+              status: (result.status ?? undefined) as
+                | EmailRoutingStatus
+                | undefined,
+            };
+          } else {
+            const result = yield* disable({ zoneId, body: {} });
+            return {
+              routingId: result.id,
+              zoneId,
+              name: result.name,
+              enabled: result.enabled,
+              status: (result.status ?? undefined) as
+                | EmailRoutingStatus
+                | undefined,
+            };
+          }
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* disable({ zoneId: output.zoneId, body: {} }).pipe(
+            Effect.catch(() => Effect.void),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailRule.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailRule.ts
new file mode 100644
index 00000000000..7dbc756d5b7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/EmailRule.ts
@@ -0,0 +1,210 @@
+import * as emailRouting from "@distilled.cloud/cloudflare/email-routing";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { resolveZoneId, type ZoneReference } from "../Zone/index.ts";
+
+export type EmailMatcher =
+  | { type: "all" }
+  | { type: "literal"; field: "to"; value: string };
+
+export type EmailAction =
+  | { type: "drop" }
+  | { type: "forward"; value: string[] }
+  | { type: "worker"; value: string[] };
+
+export type EmailRuleProps = {
+  /**
+   * Zone the rule lives on.
+   */
+  zone: ZoneReference;
+  /**
+   * Display name for the rule.
+   */
+  name?: string;
+  /**
+   * Whether the rule is active. Disabled rules are evaluated last and
+   * effectively skipped.
+   *
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Lower priority numbers run first.
+   *
+   * @default 0
+   */
+  priority?: number;
+  /**
+   * Matchers that define which inbound emails trigger this rule.
+   */
+  matchers: EmailMatcher[];
+  /**
+   * Actions to take for matched emails.
+   */
+  actions: EmailAction[];
+};
+
+export type EmailRule = Resource<
+  "Cloudflare.EmailRule",
+  EmailRuleProps,
+  {
+    ruleId: string;
+    zoneId: string;
+    name: string;
+    enabled: boolean;
+    priority: number;
+    matchers: EmailMatcher[];
+    actions: EmailAction[];
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Email Routing rule.
+ *
+ * Rules forward inbound mail matching `matchers` to the listed actions
+ * (forward to a verified destination, drop, or hand off to a Worker).
+ *
+ * @section Forwarding Mail
+ * @example Forward `info@` to a verified destination
+ * ```typescript
+ * const rule = yield* Cloudflare.EmailRule("InfoForward", {
+ *   zone: "example.com",
+ *   matchers: [{ type: "literal", field: "to", value: "info@example.com" }],
+ *   actions: [{ type: "forward", value: ["ops@example.com"] }],
+ * });
+ * ```
+ */
+export const EmailRule = Resource<EmailRule>("Cloudflare.EmailRule");
+
+const normalize = (
+  rule: {
+    id?: string | null;
+    name?: string | null;
+    enabled?: boolean | null;
+    priority?: number | null;
+    // Distilled widened generated string enums to open unions (`string & {}`);
+    // the runtime values are still the known variants, narrowed below.
+    matchers?:
+      | {
+          type: string;
+          field?: string | null;
+          value?: string | null;
+        }[]
+      | null;
+    actions?: { type: string; value?: string[] | null }[] | null;
+  },
+  zoneId: string,
+) => ({
+  ruleId: rule.id ?? "",
+  zoneId,
+  name: rule.name ?? "",
+  enabled: rule.enabled ?? true,
+  priority: rule.priority ?? 0,
+  matchers: (rule.matchers ?? []).map(
+    (m): EmailMatcher =>
+      m.type === "all"
+        ? { type: "all" }
+        : { type: "literal", field: "to", value: m.value ?? "" },
+  ),
+  actions: (rule.actions ?? []).map(
+    (a): EmailAction =>
+      a.type === "drop"
+        ? { type: "drop" }
+        : a.type === "forward"
+          ? { type: "forward", value: a.value ?? [] }
+          : { type: "worker", value: a.value ?? [] },
+  ),
+});
+
+export const EmailRuleProvider = () =>
+  Provider.effect(
+    EmailRule,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const create = yield* emailRouting.createRule;
+      const update = yield* emailRouting.updateRule;
+      const get = yield* emailRouting.getRule;
+      const del = yield* emailRouting.deleteRule;
+
+      const resolve = (zone: ZoneReference) =>
+        resolveZoneId({
+          accountId,
+          zone,
+          hostname: typeof zone === "string" ? zone : (zone.name ?? ""),
+        });
+
+      return {
+        stables: ["ruleId", "zoneId"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!output) return undefined;
+          if (!isResolved(news)) return undefined;
+          const zoneId = yield* resolve(news.zone);
+          if (zoneId !== output.zoneId) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.ruleId || !output?.zoneId) return undefined;
+          return yield* get({
+            zoneId: output.zoneId,
+            ruleIdentifier: output.ruleId,
+          }).pipe(
+            Effect.map((r) => normalize(r, output.zoneId)),
+            Effect.catch(() => Effect.succeed(undefined)),
+          );
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const zoneId = output?.zoneId ?? (yield* resolve(news.zone));
+          const body = {
+            actions: news.actions.map((a) =>
+              a.type === "drop"
+                ? { type: a.type }
+                : { type: a.type, value: a.value },
+            ),
+            matchers: news.matchers.map((m) =>
+              m.type === "all"
+                ? { type: "all" as const }
+                : {
+                    type: "literal" as const,
+                    field: "to" as const,
+                    value: m.value,
+                  },
+            ),
+            enabled: news.enabled ?? true,
+            name: news.name ?? "",
+            priority: news.priority ?? 0,
+          };
+
+          if (output?.ruleId) {
+            const result = yield* update({
+              zoneId,
+              ruleIdentifier: output.ruleId,
+              ...body,
+            }).pipe(
+              Effect.catch(() =>
+                create({ zoneId, ...body }).pipe(Effect.map((r) => r)),
+              ),
+            );
+            return normalize(result, zoneId);
+          }
+
+          const result = yield* create({ zoneId, ...body });
+          return normalize(result, zoneId);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!output?.ruleId) return;
+          yield* del({
+            zoneId: output.zoneId,
+            ruleIdentifier: output.ruleId,
+          }).pipe(Effect.catch(() => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/SendEmail.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/SendEmail.ts
new file mode 100644
index 00000000000..5e68741a652
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/SendEmail.ts
@@ -0,0 +1,95 @@
+import * as Effect from "effect/Effect";
+import { SendEmailBinding } from "./SendEmailBinding.ts";
+
+type SendEmailTypeId = typeof SendEmailTypeId;
+const SendEmailTypeId = "Cloudflare.SendEmail" as const;
+
+export type SendEmailProps = {
+  /**
+   * Restrict the Worker to send to a single verified destination address.
+   *
+   * Mutually exclusive with `allowedDestinationAddresses`. The destination
+   * must be a verified address on the account (see {@link EmailAddress}).
+   */
+  destinationAddress?: string;
+  /**
+   * Restrict the Worker to send to one of these verified destination addresses.
+   *
+   * Mutually exclusive with `destinationAddress`.
+   */
+  allowedDestinationAddresses?: string[];
+  /**
+   * Restrict the Worker to send from one of these sender addresses.
+   *
+   * The sender domain must have Email Routing configured (see
+   * {@link EmailRouting}) and the addresses must be verified.
+   */
+  allowedSenderAddresses?: string[];
+};
+
+/**
+ * A Cloudflare Workers `send_email` binding descriptor.
+ *
+ * `SendEmail` is a Worker-only binding — it does not create any cloud-side
+ * resource. The descriptor names the binding and records optional
+ * destination/sender restrictions; the actual `send_email` entry is attached
+ * to the Worker via {@link SendEmailBinding}.
+ *
+ * @resource
+ *
+ * @section Binding to a Worker
+ * @example Send to any verified destination
+ * ```typescript
+ * const Email = Cloudflare.SendEmail("Email");
+ *
+ * // in the Worker effect:
+ * const email = yield* Cloudflare.SendEmail.bind(Email);
+ * yield* email.send({
+ *   from: "noreply@example.com",
+ *   to: "user@example.com",
+ *   subject: "Hello",
+ *   text: "Hi from Alchemy",
+ * });
+ * ```
+ *
+ * @example Restrict the sender address
+ * ```typescript
+ * const Ops = Cloudflare.SendEmail("OpsEmail", {
+ *   allowedSenderAddresses: ["noreply@example.com"],
+ *   destinationAddress: "ops@example.com",
+ * });
+ * ```
+ */
+export type SendEmail = SendEmailProps & {
+  kind: SendEmailTypeId;
+  name: string;
+};
+
+export const isSendEmail = (value: unknown): value is SendEmail =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as SendEmail).kind === SendEmailTypeId;
+
+export const SendEmail: {
+  (id: string, props?: SendEmailProps): Effect.Effect<SendEmail>;
+  /**
+   * Bind this `send_email` descriptor to the surrounding Worker. Returns a
+   * typed runtime client for sending email.
+   */
+  bind: typeof SendEmailBinding.bind;
+} = Object.assign(
+  Effect.fnUntraced(function* (id: string, props?: SendEmailProps) {
+    return {
+      kind: SendEmailTypeId,
+      name: id,
+      destinationAddress: props?.destinationAddress,
+      allowedDestinationAddresses: props?.allowedDestinationAddresses,
+      allowedSenderAddresses: props?.allowedSenderAddresses,
+    } satisfies SendEmail;
+  }),
+  {
+    bind: (...args: Parameters<typeof SendEmailBinding.bind>) =>
+      SendEmailBinding.bind(...args),
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/SendEmailBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/SendEmailBinding.ts
new file mode 100644
index 00000000000..d962969b37c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/SendEmailBinding.ts
@@ -0,0 +1,126 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { SendEmail } from "./SendEmail.ts";
+
+/**
+ * Email body shape for the builder-form `send` call. Either `text`, `html`,
+ * or both must be provided.
+ */
+export interface SendEmailMessage {
+  from: string | runtime.EmailAddress;
+  to: string | string[];
+  subject: string;
+  replyTo?: string | runtime.EmailAddress;
+  cc?: string | string[];
+  bcc?: string | string[];
+  headers?: Record<string, string>;
+  text?: string;
+  html?: string;
+  attachments?: runtime.EmailAttachment[];
+}
+
+export class SendEmailError extends Data.TaggedError("SendEmailError")<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+export interface SendEmailClient {
+  /**
+   * The raw runtime `SendEmail` binding. Use this when you need direct
+   * access to the Cloudflare object (e.g. to send a pre-built
+   * `EmailMessage` from `cloudflare:email`).
+   */
+  raw: Effect.Effect<runtime.SendEmail, never, RuntimeContext>;
+  /**
+   * Send an email using the builder form. Equivalent to calling
+   * `env.<name>.send({ from, to, subject, text, html, ... })`.
+   */
+  send(
+    message: SendEmailMessage,
+  ): Effect.Effect<runtime.EmailSendResult, SendEmailError, RuntimeContext>;
+  /**
+   * Send a raw `EmailMessage` (constructed via `cloudflare:email`).
+   */
+  sendRaw(
+    message: runtime.EmailMessage,
+  ): Effect.Effect<runtime.EmailSendResult, SendEmailError, RuntimeContext>;
+}
+
+/**
+ * A typed runtime accessor for a Cloudflare `send_email` Worker binding.
+ *
+ * @binding
+ */
+export class SendEmailBinding extends Binding.Service<
+  SendEmailBinding,
+  (sender: SendEmail) => Effect.Effect<SendEmailClient>
+>()("Cloudflare.SendEmail.Binding") {}
+
+export const SendEmailBindingLive = Layer.effect(
+  SendEmailBinding,
+  Effect.gen(function* () {
+    const bind = yield* SendEmailBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fnUntraced(function* (sender: SendEmail) {
+      yield* bind(sender);
+
+      const raw = Effect.sync(
+        () => (env as Record<string, runtime.SendEmail>)[sender.name]!,
+      );
+
+      const tryPromise = <T>(
+        fn: () => Promise<T>,
+      ): Effect.Effect<T, SendEmailError> =>
+        Effect.tryPromise({
+          try: fn,
+          catch: (error: any) =>
+            new SendEmailError({
+              message: error?.message ?? "Unknown send_email error",
+              cause: error,
+            }),
+        });
+
+      return {
+        raw,
+        send: (message: SendEmailMessage) =>
+          raw.pipe(Effect.flatMap((s) => tryPromise(() => s.send(message)))),
+        sendRaw: (message: runtime.EmailMessage) =>
+          raw.pipe(Effect.flatMap((s) => tryPromise(() => s.send(message)))),
+      } satisfies SendEmailClient;
+    });
+  }),
+);
+
+export class SendEmailBindingPolicy extends Binding.Policy<
+  SendEmailBindingPolicy,
+  (sender: SendEmail) => Effect.Effect<void>
+>()("Cloudflare.SendEmail.Binding") {}
+
+export const SendEmailBindingPolicyLive = SendEmailBindingPolicy.layer.succeed(
+  Effect.fnUntraced(function* (host: ResourceLike, sender: SendEmail) {
+    if (isWorker(host)) {
+      yield* host.bind(sender.name, {
+        bindings: [
+          {
+            type: "send_email",
+            name: sender.name,
+            destinationAddress: sender.destinationAddress,
+            allowedDestinationAddresses: sender.allowedDestinationAddresses,
+            allowedSenderAddresses: sender.allowedSenderAddresses,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`SendEmailBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/index.ts
new file mode 100644
index 00000000000..d2d31095631
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Email/index.ts
@@ -0,0 +1,5 @@
+export * from "./EmailAddress.ts";
+export * from "./EmailRouting.ts";
+export * from "./EmailRule.ts";
+export * from "./SendEmail.ts";
+export * from "./SendEmailBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Fetcher.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Fetcher.ts
new file mode 100644
index 00000000000..28b5cacfc0f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Fetcher.ts
@@ -0,0 +1,329 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as FiberSet from "effect/FiberSet";
+import { pipe } from "effect/Function";
+import * as Latch from "effect/Latch";
+import * as Scope from "effect/Scope";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import {
+  HttpClientError,
+  TransportError,
+} from "effect/unstable/http/HttpClientError";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import type { HttpServerError } from "effect/unstable/http/HttpServerError";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as Socket from "effect/unstable/socket/Socket";
+
+export type SocketAddress = cf.SocketAddress;
+
+export type SocketOptions = cf.SocketOptions;
+
+export interface Fetcher {
+  fetch(
+    request: HttpClientRequest.HttpClientRequest,
+  ): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError>;
+  fetch(
+    request: HttpServerRequest.HttpServerRequest,
+  ): Effect.Effect<HttpServerResponse.HttpServerResponse, HttpServerError>;
+
+  connect(
+    address: SocketAddress | string,
+    options?: SocketOptions,
+  ): Socket.Socket;
+}
+
+export const toCloudflareFetcher = Effect.fnUntraced(function* (
+  fetcher: Fetcher,
+) {
+  const context = yield* Effect.context();
+  return {
+    fetch: (input, init) =>
+      fetcher
+        .fetch(
+          HttpServerRequest.fromWeb(
+            new Request(input as any, init as any) as any as Request,
+          ),
+        )
+        .pipe(
+          Effect.map(
+            (response) =>
+              HttpServerResponse.toWeb(response, {
+                context,
+              }) as any as cf.Response,
+          ),
+          Effect.provideContext(context),
+          Effect.runPromise,
+        ),
+    connect() {
+      // TODO
+      throw new Error("toCloudflareFetcher does not support connect()");
+    },
+  } satisfies cf.Fetcher;
+});
+
+export const fromCloudflareFetcher = (fetcher: cf.Fetcher): Fetcher => {
+  const fetch = (request: Request) =>
+    Effect.promise((signal) =>
+      fetcher.fetch(request as any as cf.Request, {
+        signal: signal as cf.AbortSignal,
+      }),
+    );
+
+  return {
+    connect: (address, options) =>
+      fromCloudflareSocket(fetcher.connect(address, options)),
+    fetch: (
+      request:
+        | HttpClientRequest.HttpClientRequest
+        | HttpServerRequest.HttpServerRequest,
+    ): any =>
+      HttpClientRequest.isHttpClientRequest(request)
+        ? pipe(
+            HttpServerRequest.toWeb(
+              HttpServerRequest.fromClientRequest(request),
+            ),
+            Effect.flatMap(fetch),
+            Effect.map((response) =>
+              HttpClientResponse.fromWeb(request, response as any as Response),
+            ),
+            Effect.catch((error) =>
+              Effect.succeed(
+                HttpClientResponse.fromWeb(
+                  request,
+                  new Response(error.message, {
+                    status:
+                      error._tag === "InternalError"
+                        ? 500
+                        : error._tag === "RequestParseError"
+                          ? 400
+                          : 404,
+                  }),
+                ),
+              ),
+            ),
+          )
+        : pipe(
+            HttpServerRequest.toWeb(request),
+            Effect.flatMap(fetch),
+            Effect.map((response) => {
+              if ((response as any).status === 101) {
+                return HttpServerResponse.setBody(
+                  HttpServerResponse.empty({ status: 101 }),
+                  HttpBody.raw(response),
+                );
+              }
+              return HttpServerResponse.fromWeb(response as any as Response);
+            }),
+          ),
+  };
+};
+
+/**
+ * Adapt anything that exposes a server-shaped `fetch` (e.g. a Durable Object
+ * stub, a Worker service binding) into an Effect `HttpClient`. Lets HttpApi
+ * clients address bindings without a base URL via `transformClient`.
+ */
+export const toHttpClient = (fetcher: {
+  fetch: (
+    request: HttpServerRequest.HttpServerRequest,
+  ) => Effect.Effect<HttpServerResponse.HttpServerResponse, HttpServerError>;
+}) =>
+  HttpClient.make((request) => {
+    return fetcher.fetch(HttpServerRequest.fromClientRequest(request)).pipe(
+      Effect.map((response) => {
+        return HttpClientResponse.fromWeb(
+          request,
+          HttpServerResponse.toWeb(response),
+        );
+      }),
+      Effect.mapError(
+        (cause) =>
+          new HttpClientError({
+            reason: new TransportError({
+              request,
+              cause,
+              description: "Fetcher-backed HttpClient request failed",
+            }),
+          }),
+      ),
+    );
+  });
+
+export const fromCloudflareSocket = (cfSocket: cf.Socket): Socket.Socket => {
+  const latch = Latch.makeUnsafe(false);
+  let currentFiberSet: FiberSet.FiberSet<any, any> | undefined;
+  let writerRef: WritableStreamDefaultWriter<Uint8Array> | undefined;
+  const encoder = new TextEncoder();
+  const closeError = (code: number, closeReason?: string) =>
+    new Socket.SocketError({
+      reason: new Socket.SocketCloseError({ code, closeReason }),
+    });
+
+  const runRaw = <_, E, R>(
+    handler: (_: string | Uint8Array) => Effect.Effect<_, E, R> | void,
+    opts?: { readonly onOpen?: Effect.Effect<void> | undefined },
+  ): Effect.Effect<void, Socket.SocketError | E, R> =>
+    Effect.scopedWith(
+      Effect.fnUntraced(function* (scope) {
+        // Cloudflare exposes connection establishment as a promise rather than an
+        // event emitter, so we normalize that into the same SocketOpenError shape
+        // Effect uses for the official adapters.
+        yield* Effect.tryPromise({
+          try: () => cfSocket.opened,
+          catch: (cause) =>
+            new Socket.SocketError({
+              reason: new Socket.SocketOpenError({
+                kind: "Unknown",
+                cause,
+              }),
+            }),
+        });
+
+        const reader = cfSocket.readable.getReader();
+        // Mirror `fromTransformStream`: the reader is scoped to a single `runRaw`
+        // invocation and is always cancelled when that scope closes.
+        yield* Scope.addFinalizer(
+          scope,
+          Effect.promise(() => reader.cancel()),
+        );
+
+        const fiberSet = yield* FiberSet.make<
+          any,
+          E | Socket.SocketError
+        >().pipe(Scope.provide(scope));
+        const runFork = yield* FiberSet.runtime(fiberSet)<R>();
+
+        // Keep the remote-close watcher inside the FiberSet instead of attaching a
+        // raw `.then(...)` callback. That matches Effect's pattern of keeping all
+        // background work scoped and lets `FiberSet.join` observe close outcomes.
+        yield* Effect.tryPromise({
+          try: async () => {
+            await cfSocket.closed;
+            throw closeError(1000);
+          },
+          catch: (cause) =>
+            Socket.isSocketError(cause) ? cause : closeError(1006),
+        }).pipe(FiberSet.run(fiberSet));
+
+        // The read loop itself follows `fromTransformStream`: fork the loop into
+        // the FiberSet so handler effects can run concurrently while `join`
+        // remains the single completion point for the socket session.
+        yield* Effect.tryPromise({
+          try: async () => {
+            while (true) {
+              const { done, value } = await reader.read();
+              if (done) {
+                throw closeError(1000);
+              }
+              const result = handler(value);
+              if (Effect.isEffect(result)) {
+                runFork(result);
+              }
+            }
+          },
+          catch: (cause) =>
+            Socket.isSocketError(cause)
+              ? cause
+              : new Socket.SocketError({
+                  reason: new Socket.SocketReadError({ cause }),
+                }),
+        }).pipe(FiberSet.run(fiberSet));
+
+        currentFiberSet = fiberSet;
+        // Writers are gated on the latch exactly like the official adapters so a
+        // caller cannot send data before the read side has been fully installed.
+        latch.openUnsafe();
+        if (opts?.onOpen) yield* opts.onOpen;
+
+        return yield* Effect.catchFilter(
+          FiberSet.join(fiberSet),
+          Socket.SocketCloseError.filterClean(
+            (code) => code === 1000 || code === 1006,
+          ),
+          () => Effect.void,
+        );
+      }),
+    ).pipe(
+      Effect.ensuring(
+        Effect.sync(() => {
+          latch.closeUnsafe();
+          currentFiberSet = undefined;
+        }),
+      ),
+    );
+
+  const run = <_, E, R>(
+    handler: (_: Uint8Array) => Effect.Effect<_, E, R> | void,
+    opts?: { readonly onOpen?: Effect.Effect<void> | undefined },
+  ): Effect.Effect<void, Socket.SocketError | E, R> =>
+    runRaw(
+      (data) =>
+        typeof data === "string"
+          ? handler(encoder.encode(data))
+          : handler(data),
+      opts,
+    );
+
+  const decoder = new TextDecoder();
+  const runString = <_, E, R>(
+    handler: (_: string) => Effect.Effect<_, E, R> | void,
+    opts?: { readonly onOpen?: Effect.Effect<void> | undefined },
+  ): Effect.Effect<void, Socket.SocketError | E, R> =>
+    runRaw(
+      (data) =>
+        typeof data === "string"
+          ? handler(data)
+          : handler(decoder.decode(data)),
+      opts,
+    );
+
+  const write = (
+    chunk: Uint8Array | string | Socket.CloseEvent,
+  ): Effect.Effect<void, Socket.SocketError> =>
+    latch.whenOpen(
+      Effect.suspend(() => {
+        if (Socket.isCloseEvent(chunk)) {
+          // `fromTransformStream` signals a local close by completing the
+          // FiberSet's deferred rather than trying to force stream semantics that
+          // don't exist. We do the same here so `runRaw` unwinds through `join`.
+          return Deferred.fail(
+            currentFiberSet!.deferred,
+            closeError(chunk.code, chunk.reason),
+          );
+        }
+        if (!writerRef) {
+          writerRef = cfSocket.writable.getWriter();
+        }
+        const data = typeof chunk === "string" ? encoder.encode(chunk) : chunk;
+        return Effect.tryPromise({
+          try: () => writerRef!.write(data),
+          catch: (cause) =>
+            new Socket.SocketError({
+              reason: new Socket.SocketWriteError({ cause }),
+            }),
+        });
+      }),
+    );
+
+  const writer = Effect.acquireRelease(Effect.succeed(write), () =>
+    // Treat writer shutdown as best-effort cleanup. Cloudflare may already have
+    // closed the writable side by the time the scope releases.
+    Effect.promise(async () => {
+      if (writerRef) {
+        await writerRef.close().catch(() => {});
+      }
+    }),
+  );
+
+  return Socket.Socket.of({
+    [Socket.TypeId]: Socket.TypeId,
+    run,
+    runRaw,
+    runString,
+    writer,
+  });
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/Hyperdrive.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/Hyperdrive.ts
new file mode 100644
index 00000000000..08de1e28d85
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/Hyperdrive.ts
@@ -0,0 +1,376 @@
+import * as hyperdrive from "@distilled.cloud/cloudflare/hyperdrive";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Redacted from "effect/Redacted";
+
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { HyperdriveBinding } from "./HyperdriveBinding.ts";
+
+export type HyperdriveScheme = "postgres" | "postgresql" | "mysql";
+
+/**
+ * Origin configuration for a public PostgreSQL or MySQL database.
+ */
+export type HyperdrivePublicOrigin = {
+  scheme: HyperdriveScheme;
+  host: string;
+  port?: number;
+  database: string;
+  user: string;
+  /**
+   * Database password.
+   */
+  password: Redacted.Redacted<string>;
+};
+
+/**
+ * Origin configuration for a database fronted by Cloudflare Access.
+ */
+export type HyperdriveAccessOrigin = {
+  scheme: HyperdriveScheme;
+  host: string;
+  database: string;
+  user: string;
+  password: Redacted.Redacted<string>;
+  accessClientId: Redacted.Redacted<string>;
+  accessClientSecret: Redacted.Redacted<string>;
+};
+
+export type HyperdriveOrigin = HyperdrivePublicOrigin | HyperdriveAccessOrigin;
+
+export type HyperdriveCaching = {
+  /**
+   * Whether caching is disabled.
+   * @default false
+   */
+  disabled?: boolean;
+  /**
+   * Maximum duration items should persist in the cache, in seconds.
+   * @default 60
+   */
+  maxAge?: number;
+  /**
+   * Number of seconds the cache may serve a stale response while revalidating.
+   * @default 15
+   */
+  staleWhileRevalidate?: number;
+};
+
+export type HyperdriveMtls = {
+  caCertificateId?: string;
+  mtlsCertificateId?: string;
+  /**
+   * @default "require"
+   */
+  sslmode?: "require" | "verify-ca" | "verify-full";
+};
+
+export type HyperdriveDevOrigin = HyperdrivePublicOrigin & {
+  /**
+   * @default "prefer"
+   */
+  sslmode?: "disable" | "prefer" | "require" | "verify-ca" | "verify-full";
+};
+
+export type HyperdriveProps = {
+  /**
+   * Name of the Hyperdrive configuration. If omitted, a unique name will be
+   * generated.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Database connection origin. Hyperdrive supports public Postgres/MySQL
+   * databases and databases fronted by Cloudflare Access.
+   */
+  origin: HyperdriveOrigin;
+  /**
+   * Caching configuration.
+   */
+  caching?: HyperdriveCaching;
+  /**
+   * mTLS configuration.
+   */
+  mtls?: HyperdriveMtls;
+  /**
+   * The (soft) maximum number of connections Hyperdrive is allowed to make to
+   * the origin database.
+   */
+  originConnectionLimit?: number;
+  /**
+   * Local development overrides. When the stack runs in dev mode
+   * connect to a locally running database
+   */
+  dev?: HyperdriveDevOrigin;
+};
+
+export type Hyperdrive = Resource<
+  "Cloudflare.Hyperdrive",
+  HyperdriveProps,
+  {
+    hyperdriveId: string;
+    name: string;
+    accountId: string;
+    origin: HyperdriveOrigin;
+    mtls: HyperdriveMtls;
+    dev: HyperdriveDevOrigin | undefined;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Hyperdrive configuration.
+ *
+ * Hyperdrive accelerates and pools connections to existing PostgreSQL or
+ * MySQL databases, exposing them to Workers via a binding. Create a config
+ * as a resource, then bind it to a Worker to obtain a connection string.
+ *
+ * @section Creating a Hyperdrive
+ * @example Public Postgres origin
+ * ```typescript
+ * const hd = yield* Cloudflare.Hyperdrive("my-pg", {
+ *   origin: {
+ *     scheme: "postgres",
+ *     host: "db.example.com",
+ *     port: 5432,
+ *     database: "app",
+ *     user: "app",
+ *     password: alchemy.secret.env.DB_PASSWORD,
+ *   },
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Using Hyperdrive inside a Worker
+ * ```typescript
+ * const hd = yield* Cloudflare.Hyperdrive.bind(MyDB);
+ * const url = yield* hd.connectionString;
+ * ```
+ */
+export const Hyperdrive = Resource<Hyperdrive>("Cloudflare.Hyperdrive")({
+  bind: HyperdriveBinding.bind,
+});
+
+export const isHyperdrive = (value: unknown): value is Hyperdrive =>
+  Predicate.hasProperty(value, "Type") &&
+  value.Type === "Cloudflare.Hyperdrive";
+
+export const HyperdriveProvider = () =>
+  Provider.effect(
+    Hyperdrive,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createConfig = yield* hyperdrive.createConfig;
+      const getConfig = yield* hyperdrive.getConfig;
+      const updateConfig = yield* hyperdrive.updateConfig;
+      const deleteConfig = yield* hyperdrive.deleteConfig;
+      const listConfigs = yield* hyperdrive.listConfigs;
+
+      const createConfigName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          if (name) return name;
+          return yield* createPhysicalName({ id, lowercase: true });
+        });
+
+      const findByName = (name: string) =>
+        Effect.gen(function* () {
+          const list = yield* listConfigs({ accountId });
+          return list.result.find((c) => c.name === name);
+        });
+
+      return {
+        // The `hyperdriveId` is not marked as stable because if you start in dev mode, the ID will change on first deploy.
+        stables: ["accountId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          const ctx = yield* AlchemyContext;
+          if (ctx.dev) return undefined;
+
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const name = yield* createConfigName(id, news.name);
+          const oldName = output?.name
+            ? output.name
+            : yield* createConfigName(id, olds.name);
+          if (oldName !== name) {
+            return { action: "replace" } as const;
+          }
+          if (!isHyperdriveId(output?.hyperdriveId)) {
+            return { action: "update" };
+          }
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const ctx = yield* AlchemyContext;
+          if (ctx.dev) {
+            return output;
+          }
+
+          if (isHyperdriveId(output?.hyperdriveId)) {
+            return yield* getConfig({
+              accountId: output.accountId,
+              hyperdriveId: output.hyperdriveId,
+            }).pipe(
+              Effect.map((c) => ({
+                hyperdriveId: c.id,
+                name: c.name,
+                accountId: output.accountId,
+                origin: {
+                  ...c.origin,
+                  password: olds?.origin?.password,
+                } as HyperdriveOrigin,
+                mtls: {
+                  caCertificateId: c.mtls?.caCertificateId ?? undefined,
+                  mtlsCertificateId: c.mtls?.mtlsCertificateId ?? undefined,
+                  sslmode: c.mtls?.sslmode ?? undefined,
+                } as HyperdriveMtls,
+                dev: output?.dev,
+              })),
+              Effect.catchTag("HyperdriveConfigNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+          const name = yield* createConfigName(id, olds?.name);
+          const match = yield* findByName(name);
+          if (match) {
+            return {
+              hyperdriveId: match.id,
+              name: match.name,
+              accountId,
+              origin: {
+                ...match.origin,
+                password: olds?.origin?.password,
+              } as HyperdriveOrigin,
+              mtls: {
+                caCertificateId: match.mtls?.caCertificateId ?? undefined,
+                mtlsCertificateId: match.mtls?.mtlsCertificateId ?? undefined,
+                sslmode: match.mtls?.sslmode ?? undefined,
+              } as HyperdriveMtls,
+              dev: output?.dev,
+            };
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const name = output?.name ?? (yield* createConfigName(id, news.name));
+
+          const ctx = yield* AlchemyContext;
+          if (ctx.dev) {
+            return {
+              hyperdriveId:
+                output?.hyperdriveId ?? `dev:${crypto.randomUUID()}`,
+              name,
+              accountId: output?.accountId ?? accountId,
+              origin: news.origin,
+              mtls: news.mtls ?? {},
+              dev: news.dev,
+            };
+          }
+
+          const requestBody = {
+            origin: toRequestOrigin(news.origin),
+            caching: news.caching,
+            mtls: news.mtls,
+            originConnectionLimit: news.originConnectionLimit,
+          };
+
+          // Observe + ensure. When we know the hyperdriveId we go straight
+          // to update; otherwise we createConfig and fall back to "find by
+          // name then update" if Cloudflare reports the name is already in
+          // use (race or a cold-start adoption).
+          const synced = isHyperdriveId(output?.hyperdriveId)
+            ? yield* updateConfig({
+                accountId: output.accountId,
+                hyperdriveId: output.hyperdriveId,
+                name: output.name,
+                ...requestBody,
+              })
+            : yield* createConfig({ accountId, name, ...requestBody }).pipe(
+                Effect.catchTag("InvalidHyperdriveConfig", (originalError) =>
+                  Effect.gen(function* () {
+                    const match = yield* findByName(name);
+                    if (!match) {
+                      return yield* Effect.fail(originalError);
+                    }
+                    return yield* updateConfig({
+                      accountId,
+                      hyperdriveId: match.id,
+                      name,
+                      ...requestBody,
+                    });
+                  }),
+                ),
+              );
+
+          return {
+            hyperdriveId: synced.id,
+            name: synced.name,
+            accountId: output?.accountId ?? accountId,
+            origin: news.origin,
+            mtls: news.mtls ?? {},
+            dev: news.dev,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!isHyperdriveId(output.hyperdriveId)) return;
+
+          yield* deleteConfig({
+            accountId: output.accountId,
+            hyperdriveId: output.hyperdriveId,
+          }).pipe(
+            Effect.catchIf(
+              (e) =>
+                e._tag === "HyperdriveConfigNotFound" ||
+                (e._tag === "CloudflareHttpError" && e.status === 404),
+              () => Effect.void,
+            ),
+          );
+        }),
+      };
+    }),
+  );
+
+export const defaultPort = (scheme: HyperdriveScheme): number =>
+  scheme === "mysql" ? 3306 : 5432;
+
+const unwrap = (v: string | Redacted.Redacted<string>): string =>
+  Redacted.isRedacted(v) ? Redacted.value(v) : v;
+
+const isHyperdriveId = (maybeId: string | undefined): maybeId is string =>
+  typeof maybeId === "string" && !maybeId.startsWith("dev:");
+
+/**
+ * Build the request body shape that the distilled `createConfig`/`updateConfig`
+ * methods accept. Secrets are unwrapped here because the distilled TS types
+ * declare `password`/`access_client_secret` as plain strings even though the
+ * runtime schema also accepts `Redacted<string>`.
+ */
+const toRequestOrigin = (origin: HyperdriveOrigin) => {
+  if ("accessClientId" in origin) {
+    return {
+      accessClientId: unwrap(origin.accessClientId),
+      accessClientSecret: unwrap(origin.accessClientSecret),
+      database: origin.database,
+      host: origin.host,
+      password: unwrap(origin.password),
+      scheme: origin.scheme,
+      user: origin.user,
+    };
+  }
+  return {
+    database: origin.database,
+    host: origin.host,
+    password: unwrap(origin.password),
+    port: origin.port ?? defaultPort(origin.scheme),
+    scheme: origin.scheme,
+    user: origin.user,
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/HyperdriveBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/HyperdriveBinding.ts
new file mode 100644
index 00000000000..b22e9aafc73
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/HyperdriveBinding.ts
@@ -0,0 +1,165 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Hyperdrive } from "./Hyperdrive.ts";
+import { defaultPort, type HyperdriveDevOrigin } from "./Hyperdrive.ts";
+
+export interface HyperdriveBindingClient {
+  /**
+   * The raw runtime `Hyperdrive` binding. Use this when integrating with a
+   * driver that wants direct access to the Cloudflare object.
+   */
+  raw: Effect.Effect<runtime.Hyperdrive, never, RuntimeContext>;
+  /**
+   * A valid DB connection string for use with a driver/ORM.
+   */
+  connectionString: Effect.Effect<
+    Redacted.Redacted<string>,
+    never,
+    RuntimeContext
+  >;
+  /**
+   * Hostname valid only within the current Worker invocation.
+   */
+  host: Effect.Effect<string, never, RuntimeContext>;
+  /**
+   * Port to pair with `host`.
+   */
+  port: Effect.Effect<number, never, RuntimeContext>;
+  /**
+   * Database user.
+   */
+  user: Effect.Effect<string, never, RuntimeContext>;
+  /**
+   * Randomly generated password valid only within the current Worker
+   * invocation.
+   */
+  password: Effect.Effect<Redacted.Redacted<string>, never, RuntimeContext>;
+  /**
+   * Database name.
+   */
+  database: Effect.Effect<string, never, RuntimeContext>;
+}
+
+/**
+ * A typed accessor for a Cloudflare Hyperdrive runtime binding inside a
+ * Worker. Provides the same shape as the raw `Hyperdrive` runtime object
+ * (connection string, host, port, user, password, database) plus a `raw`
+ * escape hatch for libraries that want direct access.
+ *
+ * @example Bind Hyperdrive in a Worker
+ * ```typescript
+ * const hd = yield* Cloudflare.Hyperdrive.bind(MyHyperdrive);
+ * const url = yield* hd.connectionString;
+ * ```
+ *
+ * @binding
+ */
+export class HyperdriveBinding extends Binding.Service<
+  HyperdriveBinding,
+  (hyperdrive: Hyperdrive) => Effect.Effect<HyperdriveBindingClient>
+>()("Cloudflare.Hyperdrive.Binding") {}
+
+export const HyperdriveBindingLive = Layer.effect(
+  HyperdriveBinding,
+  Effect.gen(function* () {
+    const Policy = yield* HyperdriveBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (hyperdrive: Hyperdrive) {
+      yield* Policy(hyperdrive);
+      const hd = Effect.sync(
+        () =>
+          (env as Record<string, runtime.Hyperdrive>)[hyperdrive.LogicalId]!,
+      );
+
+      return {
+        raw: hd,
+        connectionString: hd.pipe(
+          Effect.map((hd) => Redacted.make(hd.connectionString)),
+        ),
+        host: hd.pipe(Effect.map((hd) => hd.host)),
+        port: hd.pipe(Effect.map((hd) => hd.port)),
+        user: hd.pipe(Effect.map((hd) => hd.user)),
+        password: hd.pipe(Effect.map((hd) => Redacted.make(hd.password))),
+        database: hd.pipe(Effect.map((hd) => hd.database)),
+      } satisfies HyperdriveBindingClient;
+    });
+  }),
+);
+
+export class HyperdriveBindingPolicy extends Binding.Policy<
+  HyperdriveBindingPolicy,
+  (hyperdrive: Hyperdrive) => Effect.Effect<void>
+>()("Cloudflare.Hyperdrive.Binding") {}
+
+export const HyperdriveBindingPolicyLive = HyperdriveBindingPolicy.layer.effect(
+  Effect.gen(function* () {
+    return Effect.fn(function* (host: ResourceLike, hyperdrive: Hyperdrive) {
+      if (!isWorker(host)) {
+        return yield* Effect.die(
+          new Error(
+            `HyperdriveBinding does not support runtime '${host.Type}'`,
+          ),
+        );
+      }
+
+      yield* host.bind`${hyperdrive}`({
+        bindings: [
+          {
+            type: "hyperdrive",
+            name: hyperdrive.LogicalId,
+            id: hyperdrive.hyperdriveId as unknown as string,
+          },
+        ],
+        hyperdrives: getHyperdriveDevOrigin(hyperdrive),
+      });
+    });
+  }),
+);
+
+export const getHyperdriveDevOrigin = (hyperdrive: Hyperdrive) => {
+  const origin = Output.map(
+    Output.all(hyperdrive.dev, hyperdrive.origin, hyperdrive.mtls),
+    ([dev, origin, mtls]): Required<HyperdriveDevOrigin> => {
+      if (dev) {
+        return {
+          scheme: dev.scheme,
+          host: dev.host,
+          port: dev.port ?? defaultPort(dev.scheme),
+          user: dev.user,
+          database: dev.database,
+          password: dev.password,
+          sslmode: dev.sslmode ?? "prefer",
+        };
+      }
+      if ("accessClientId" in origin) {
+        throw new Error(
+          `Hyperdrive instance ${hyperdrive.LogicalId} has an origin that requires Cloudflare Access. This is not supported in development mode. ` +
+            "Select a different origin or set the `dev` property to an origin that does not require Cloudflare Access.",
+        );
+      }
+      return {
+        scheme: origin.scheme,
+        host: origin.host,
+        port: origin.port ?? defaultPort(origin.scheme),
+        user: origin.user,
+        database: origin.database,
+        password: origin.password,
+        sslmode: mtls?.sslmode ?? "require",
+      };
+    },
+  );
+  return Output.map(
+    Output.all(hyperdrive.hyperdriveId, Output.asOutput(origin)),
+    ([id, origin]) => ({
+      [id]: origin,
+    }),
+  ) as unknown as Record<string, Required<HyperdriveDevOrigin>>;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/index.ts
new file mode 100644
index 00000000000..b124a113cec
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Hyperdrive/index.ts
@@ -0,0 +1,2 @@
+export * from "./Hyperdrive.ts";
+export * from "./HyperdriveBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/Images.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/Images.ts
new file mode 100644
index 00000000000..a1a94be4f2b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/Images.ts
@@ -0,0 +1,134 @@
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { ImagesBinding, type ImagesClient } from "./ImagesBinding.ts";
+
+type ImagesTypeId = typeof ImagesTypeId;
+const ImagesTypeId = "Cloudflare.Images" as const;
+
+export type ImagesProps = {
+  /**
+   * Binding name used when `Images` is bound from inside a Worker init phase
+   * (`yield* Cloudflare.Images(...)`). When passed through
+   * `Worker({ env: { ... } })`, the object key remains the binding name.
+   *
+   * @default "IMAGES"
+   */
+  name?: string;
+};
+
+/**
+ * The Effect yielded when an `Images` marker is used inside a Worker init
+ * phase: it attaches the `images` binding to the surrounding Worker and
+ * resolves to the runtime {@link ImagesClient}.
+ */
+type BindEffect = Effect.Effect<ImagesClient, never, ImagesBinding>;
+
+/**
+ * Marker for a Cloudflare Images binding.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.Images(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link ImagesClient} — no separate `.bind(...)`
+ * step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `ImagesBinding` in the
+ * `env` position), but it is iterable as one when `yield*`-ed.
+ */
+export interface Images {
+  kind: ImagesTypeId;
+  name: string;
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, ImagesClient>;
+}
+
+export const isImages = (value: unknown): value is Images =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as Images).kind === ImagesTypeId;
+
+/**
+ * A Cloudflare Images binding for image transformation and manipulation inside
+ * Workers.
+ *
+ * The Effect-native interface (`Cloudflare.Images.bind(...)`) returns an
+ * `ImagesClient` whose methods take Effect `Stream.Stream<Uint8Array>`
+ * inputs and return `Effect`s — `info`, `input(...).transform(...)
+ * .draw(...).output(...)`. The runtime conversion to Cloudflare's
+ * `ReadableStream` is handled internally.
+ *
+ * @section Effect-style Worker (recommended)
+ * @example Read image format and dimensions from the request body
+ * ```typescript
+ * import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+ *
+ * Cloudflare.Worker("ImageWorker", { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const images = yield* Cloudflare.Images({ name: "PIPELINE" });
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         // request.stream is Stream.Stream<Uint8Array>
+ *         const info = yield* images.info(request.stream);
+ *         return yield* HttpServerResponse.json(info);
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.ImagesBindingLive)),
+ * );
+ * ```
+ *
+ * @example Transform an image — chainable pipeline, single Effect at the end
+ * ```typescript
+ * const result = yield* (yield* images.input(request.stream))
+ *   .transform({ width: 128 })
+ *   .output({ format: "image/jpeg" });
+ *
+ * const response = yield* result.response;
+ * ```
+ *
+ * @section Binding to a Worker (declarative)
+ * @example
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: { MEDIA: Cloudflare.Images({ name: "PIPELINE" }) },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { MEDIA: ImagesBinding }
+ * ```
+ *
+ * Inside the Worker, the raw Cloudflare runtime binding is reachable via
+ * `client.raw` if you need to call `info()` / `input()` directly with
+ * `async`/`await`. The Effect-native interface is preferred — it returns
+ * tagged `ImagesError`s, threads `WorkerEnvironment`, and lets you stream
+ * Effect `Stream<Uint8Array>` sources without manual conversion.
+ *
+ * @see https://developers.cloudflare.com/images/transform-images/bindings/
+ */
+export const Images: {
+  (props?: ImagesProps): Images;
+  /**
+   * Bind an existing `Images` marker to the surrounding Worker, returning the
+   * Effect-native client. Equivalent to `yield* images` — prefer yielding the
+   * marker directly.
+   */
+  bind: typeof ImagesBinding.bind;
+} = Object.assign(
+  (props?: ImagesProps): Images => {
+    const self: Images = {
+      kind: ImagesTypeId,
+      name: props?.name ?? "IMAGES",
+      asEffect: () => ImagesBinding.bind(self),
+      [Symbol.iterator]: () => new SingleShotGen(ImagesBinding.bind(self)),
+    };
+    return self;
+  },
+  {
+    bind: (...args: Parameters<typeof ImagesBinding.bind>) =>
+      ImagesBinding.bind(...args),
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/ImagesBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/ImagesBinding.ts
new file mode 100644
index 00000000000..e65b9d1e713
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/ImagesBinding.ts
@@ -0,0 +1,192 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type Images as ImagesLike } from "./Images.ts";
+
+export class ImagesError extends Data.TaggedError("ImagesError")<{
+  message: string;
+  code?: number;
+  cause: unknown;
+}> {}
+
+/**
+ * Effect-native handle to the result of `input(...).output(...)`.
+ * Mirrors the runtime `ImageTransformationResult` but exposes side
+ * effects (response/image/contentType reads) as plain sync effects.
+ */
+export interface ImageTransformationResultClient {
+  raw: cf.ImageTransformationResult;
+  response: Effect.Effect<cf.Response>;
+  contentType: Effect.Effect<string>;
+  image(
+    options?: cf.ImageTransformationOutputOptions,
+  ): Effect.Effect<cf.ReadableStream<Uint8Array>>;
+}
+
+/**
+ * Effect-native chainable transformer. `transform`/`draw` are pure
+ * (return a new client wrapping the next runtime transformer);
+ * `output` is the only step that crosses into Cloudflare's runtime
+ * and therefore returns an Effect.
+ */
+export interface ImageTransformerClient {
+  raw: cf.ImageTransformer;
+  transform(transform: cf.ImageTransform): ImageTransformerClient;
+  draw<E = never, R = never>(
+    image: Stream.Stream<Uint8Array, E, R> | ImageTransformerClient,
+    options?: cf.ImageDrawOptions,
+  ): Effect.Effect<ImageTransformerClient, never, R>;
+  output(
+    options: cf.ImageOutputOptions,
+  ): Effect.Effect<ImageTransformationResultClient, ImagesError>;
+}
+
+/**
+ * Effect-native client for a Cloudflare Images binding.
+ *
+ * Wraps the runtime {@link cf.ImagesBinding} so each method returns
+ * an Effect tagged with {@link ImagesError}. Use
+ * `Cloudflare.Images.bind(images)` inside a Worker's init phase.
+ */
+export interface ImagesClient {
+  /** Effect resolving to the raw Cloudflare runtime binding. */
+  raw: Effect.Effect<cf.ImagesBinding, never, RuntimeContext>;
+  /**
+   * Read image format and dimensions from a stream of bytes.
+   * Fails with {@link ImagesError} (code 9412) if the input is not
+   * a recognized image.
+   */
+  info<E = never, R = never>(
+    stream: Stream.Stream<Uint8Array, E, R>,
+    options?: cf.ImageInputOptions,
+  ): Effect.Effect<cf.ImageInfoResponse, ImagesError, RuntimeContext | R>;
+  /**
+   * Begin a transformation pipeline. Subsequent `.transform()` /
+   * `.draw()` calls are pure; `.output(opts)` runs the pipeline.
+   */
+  input<E = never, R = never>(
+    stream: Stream.Stream<Uint8Array, E, R>,
+    options?: cf.ImageInputOptions,
+  ): Effect.Effect<ImageTransformerClient, never, RuntimeContext | R>;
+}
+
+export class ImagesBinding extends Binding.Service<
+  ImagesBinding,
+  (images: ImagesLike) => Effect.Effect<ImagesClient>
+>()("Cloudflare.Images.Binding") {}
+
+export const ImagesBindingLive = Layer.effect(
+  ImagesBinding,
+  Effect.gen(function* () {
+    const Policy = yield* ImagesBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (images: ImagesLike) {
+      yield* Policy(images);
+      const raw = Effect.sync(
+        // this must be lazy because the WorkerEnvironment is not available yet
+        () => (env as Record<string, cf.ImagesBinding>)[images.name]!,
+      );
+
+      return {
+        raw,
+        info: (stream, options) =>
+          Effect.gen(function* () {
+            const binding = yield* raw;
+            const readable = yield* toCfReadable(stream);
+            return yield* tryPromise(() => binding.info(readable, options));
+          }),
+        input: (stream, options) =>
+          Effect.gen(function* () {
+            const binding = yield* raw;
+            const readable = yield* toCfReadable(stream);
+            return wrapTransformer(binding.input(readable, options));
+          }),
+      } satisfies ImagesClient;
+    });
+  }),
+);
+
+export class ImagesBindingPolicy extends Binding.Policy<
+  ImagesBindingPolicy,
+  (images: ImagesLike) => Effect.Effect<void>
+>()("Cloudflare.Images.Binding") {}
+
+export const ImagesBindingPolicyLive = ImagesBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, images: ImagesLike) {
+    if (isWorker(host)) {
+      yield* host.bind(images.name, {
+        bindings: [
+          {
+            type: "images",
+            name: images.name,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`ImagesBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
+
+const tryPromise = <T>(fn: () => Promise<T>): Effect.Effect<T, ImagesError> =>
+  Effect.tryPromise({
+    try: fn,
+    catch: (error: any) =>
+      new ImagesError({
+        message: error?.message ?? "Unknown error",
+        code: typeof error?.code === "number" ? error.code : undefined,
+        cause: error,
+      }),
+  });
+
+/**
+ * Convert an Effect `Stream<Uint8Array>` into the `cf.ReadableStream<Uint8Array>`
+ * shape that the Cloudflare Images runtime binding expects. The two
+ * `ReadableStream` types only differ at the type level; at runtime they
+ * are the same Web Streams API.
+ */
+const toCfReadable = <E, R>(
+  stream: Stream.Stream<Uint8Array, E, R>,
+): Effect.Effect<cf.ReadableStream<Uint8Array>, never, R> =>
+  Stream.toReadableStreamEffect(stream).pipe(
+    Effect.map((s) => s as unknown as cf.ReadableStream<Uint8Array>),
+  );
+
+const isTransformerClient = (image: unknown): image is ImageTransformerClient =>
+  typeof image === "object" && image !== null && "raw" in image;
+
+const wrapTransformer = (raw: cf.ImageTransformer): ImageTransformerClient => ({
+  raw,
+  transform: (transform) => wrapTransformer(raw.transform(transform)),
+  draw: <E, R>(
+    image: Stream.Stream<Uint8Array, E, R> | ImageTransformerClient,
+    options?: cf.ImageDrawOptions,
+  ): Effect.Effect<ImageTransformerClient, never, R> => {
+    if (isTransformerClient(image)) {
+      return Effect.succeed(wrapTransformer(raw.draw(image.raw, options)));
+    }
+    return toCfReadable(image).pipe(
+      Effect.map((readable) => wrapTransformer(raw.draw(readable, options))),
+    );
+  },
+  output: (options) =>
+    tryPromise(() => raw.output(options)).pipe(Effect.map(wrapResult)),
+});
+
+const wrapResult = (
+  raw: cf.ImageTransformationResult,
+): ImageTransformationResultClient => ({
+  raw,
+  response: Effect.sync(() => raw.response()),
+  contentType: Effect.sync(() => raw.contentType()),
+  image: (options) => Effect.sync(() => raw.image(options)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/index.ts
new file mode 100644
index 00000000000..8c17c6f8359
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Images/index.ts
@@ -0,0 +1,2 @@
+export * from "./Images.ts";
+export * from "./ImagesBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/KVNamespace.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/KVNamespace.ts
new file mode 100644
index 00000000000..84756d9ae0d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/KVNamespace.ts
@@ -0,0 +1,216 @@
+import * as kv from "@distilled.cloud/cloudflare/kv";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { KVNamespaceBinding } from "./KVNamespaceBinding.ts";
+
+export const isKVNamespace = (value: unknown): value is KVNamespace =>
+  typeof value === "object" &&
+  (value as any)?.Type === "Cloudflare.KVNamespace";
+
+export type KVNamespaceProps = {
+  /**
+   * A human-readable string name for the namespace.
+   * If omitted, a unique name will be generated.
+   * @default ${app}-${stage}-${id}
+   */
+  title?: string;
+};
+
+export type KVNamespace = Resource<
+  "Cloudflare.KVNamespace",
+  KVNamespaceProps,
+  {
+    title: string;
+    namespaceId: string;
+    supportsUrlEncoding: boolean | undefined;
+    accountId: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Workers KV namespace for key-value storage at the edge.
+ *
+ * KV provides eventually-consistent, low-latency reads with global
+ * replication. Create a namespace as a resource, then bind it to a Worker
+ * to get/put values at runtime.
+ *
+ * @section Creating a Namespace
+ * @example Basic KV namespace
+ * ```typescript
+ * const kv = yield* Cloudflare.KVNamespace("MyKV");
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Using KV inside a Worker
+ * ```typescript
+ * const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ * // Read a value
+ * const value = yield* kv.get("my-key");
+ *
+ * // Write a value
+ * yield* kv.put("my-key", "hello world");
+ * ```
+ */
+export const KVNamespace = Resource<KVNamespace>("Cloudflare.KVNamespace")({
+  bind: KVNamespaceBinding.bind,
+});
+
+export const KVNamespaceProvider = () =>
+  Provider.effect(
+    KVNamespace,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createNamespace = yield* kv.createNamespace;
+      const updateNamespace = yield* kv.updateNamespace;
+      const deleteNamespace = yield* kv.deleteNamespace;
+      const getNamespaceFn = yield* kv.getNamespace;
+
+      const createTitle = (id: string, title: string | undefined) =>
+        Effect.gen(function* () {
+          return title ?? (yield* createPhysicalName({ id }));
+        });
+
+      // Cloudflare's `listNamespaces` accepts no title/prefix filter, so
+      // adoption-by-name has to scan every page. Use the paginated
+      // `.items` stream off the un-yielded operation method (yielding
+      // `kv.listNamespaces` collapses it to a single-page call).
+      const findNamespaceByTitle = (title: string) =>
+        kv.listNamespaces.items({ accountId }).pipe(
+          Stream.filter((ns) => ns.title === title),
+          Stream.runHead,
+          Effect.map(Option.getOrUndefined),
+        );
+
+      return {
+        stables: ["namespaceId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const title = yield* createTitle(id, news.title);
+          const oldTitle =
+            output?.title ?? (yield* createTitle(id, olds.title));
+          if (title !== oldTitle) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          const title = yield* createTitle(id, news.title);
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — re-fetch the cached namespace; fall back to a title
+          // scan so we recover from out-of-band deletes or partial state
+          // persistence failures.
+          let observed:
+            | {
+                id: string;
+                title: string;
+                supportsUrlEncoding?: boolean | null | undefined;
+              }
+            | undefined;
+          if (output?.namespaceId) {
+            observed = yield* getNamespaceFn({
+              accountId: acct,
+              namespaceId: output.namespaceId,
+            }).pipe(
+              Effect.catchTag("NamespaceNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+
+          // Ensure — create if missing. Cloudflare returns
+          // `NamespaceTitleAlreadyExists` on a concurrent create; tolerate
+          // by adopting the namespace with the same title.
+          if (!observed) {
+            observed = yield* createNamespace({
+              accountId: acct,
+              title,
+            }).pipe(
+              Effect.catchTag("NamespaceTitleAlreadyExists", () =>
+                Effect.gen(function* () {
+                  const match = yield* findNamespaceByTitle(title);
+                  if (match) {
+                    return match;
+                  }
+                  return yield* Effect.die(
+                    `Namespace with title "${title}" already exists but could not be found`,
+                  );
+                }),
+              ),
+            );
+          }
+
+          // Sync — KV's only mutable property is the title. Rename only
+          // when the observed title drifts from desired so we avoid
+          // unnecessary API calls on every reconcile.
+          let namespaceId = observed.id;
+          let resolvedTitle = observed.title;
+          let supportsUrlEncoding = observed.supportsUrlEncoding ?? undefined;
+          if (observed.title !== title) {
+            const renamed = yield* updateNamespace({
+              accountId: acct,
+              namespaceId: observed.id,
+              title,
+            });
+            namespaceId = renamed.id;
+            resolvedTitle = renamed.title;
+            supportsUrlEncoding = renamed.supportsUrlEncoding ?? undefined;
+          }
+
+          return {
+            title: resolvedTitle,
+            namespaceId,
+            supportsUrlEncoding,
+            accountId: acct,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteNamespace({
+            accountId: output.accountId,
+            namespaceId: output.namespaceId,
+          }).pipe(Effect.catchTag("NamespaceNotFound", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.namespaceId) {
+            return yield* getNamespaceFn({
+              accountId: output.accountId,
+              namespaceId: output.namespaceId,
+            }).pipe(
+              Effect.map((namespace) => ({
+                title: namespace.title,
+                namespaceId: namespace.id,
+                supportsUrlEncoding: namespace.supportsUrlEncoding ?? undefined,
+                accountId: output.accountId,
+              })),
+              Effect.catchTag("NamespaceNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+          }
+          const title = yield* createTitle(id, olds?.title);
+          const match = yield* findNamespaceByTitle(title);
+          if (match) {
+            return {
+              title: match.title,
+              namespaceId: match.id,
+              supportsUrlEncoding: match.supportsUrlEncoding ?? undefined,
+              accountId,
+            };
+          }
+          return undefined;
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/KVNamespaceBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/KVNamespaceBinding.ts
new file mode 100644
index 00000000000..1395653daf0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/KVNamespaceBinding.ts
@@ -0,0 +1,301 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { KVNamespace } from "./KVNamespace.ts";
+
+export class KVNamespaceError extends Data.TaggedError("KVNamespaceError")<{
+  message: string;
+  cause: Error;
+}> {}
+
+export interface KVNamespaceClient<Key extends string = string> {
+  raw: Effect.Effect<runtime.KVNamespace, never, WorkerEnvironment>;
+  get(
+    key: Key,
+    options?: Partial<KVNamespaceGetOptions<undefined>>,
+  ): Effect.Effect<string | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Key,
+    type: "text",
+  ): Effect.Effect<string | null, KVNamespaceError, RuntimeContext>;
+  get<ExpectedValue = unknown>(
+    key: Key,
+    type: "json",
+  ): Effect.Effect<ExpectedValue | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Key,
+    type: "arrayBuffer",
+  ): Effect.Effect<ArrayBuffer | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Key,
+    type: "stream",
+  ): Effect.Effect<ReadableStream | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Key,
+    options?: KVNamespaceGetOptions<"text">,
+  ): Effect.Effect<string | null, KVNamespaceError, RuntimeContext>;
+  get<ExpectedValue = unknown>(
+    key: Key,
+    options?: KVNamespaceGetOptions<"json">,
+  ): Effect.Effect<ExpectedValue | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Key,
+    options?: KVNamespaceGetOptions<"arrayBuffer">,
+  ): Effect.Effect<ArrayBuffer | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Key,
+    options?: KVNamespaceGetOptions<"stream">,
+  ): Effect.Effect<ReadableStream | null, KVNamespaceError, RuntimeContext>;
+  get(
+    key: Array<Key>,
+    type: "text",
+  ): Effect.Effect<
+    Map<string, string | null>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  get<ExpectedValue = unknown>(
+    key: Array<Key>,
+    type: "json",
+  ): Effect.Effect<
+    Map<string, ExpectedValue | null>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  get(
+    key: Array<Key>,
+    options?: Partial<KVNamespaceGetOptions<undefined>>,
+  ): Effect.Effect<
+    Map<string, string | null>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  get(
+    key: Array<Key>,
+    options?: KVNamespaceGetOptions<"text">,
+  ): Effect.Effect<
+    Map<string, string | null>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  get<ExpectedValue = unknown>(
+    key: Array<Key>,
+    options?: KVNamespaceGetOptions<"json">,
+  ): Effect.Effect<
+    Map<string, ExpectedValue | null>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  list<Metadata = unknown>(
+    options?: KVNamespaceListOptions,
+  ): Effect.Effect<
+    KVNamespaceListResult<Metadata, Key>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  put(
+    key: Key,
+    value: string | ArrayBuffer | ArrayBufferView | ReadableStream,
+    options?: KVNamespacePutOptions,
+  ): Effect.Effect<void, KVNamespaceError, RuntimeContext>;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    options?: Partial<KVNamespaceGetOptions<undefined>>,
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<string, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    type: "text",
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<string, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(
+    key: Key,
+    type: "json",
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    type: "arrayBuffer",
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<ArrayBuffer, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    type: "stream",
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<ReadableStream, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    options: KVNamespaceGetOptions<"text">,
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<string, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(
+    key: Key,
+    options: KVNamespaceGetOptions<"json">,
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    options: KVNamespaceGetOptions<"arrayBuffer">,
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<ArrayBuffer, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Key,
+    options: KVNamespaceGetOptions<"stream">,
+  ): Effect.Effect<
+    KVNamespaceGetWithMetadataResult<ReadableStream, Metadata>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Array<Key>,
+    type: "text",
+  ): Effect.Effect<
+    Map<string, KVNamespaceGetWithMetadataResult<string, Metadata>>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(
+    key: Array<Key>,
+    type: "json",
+  ): Effect.Effect<
+    Map<string, KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Array<Key>,
+    options?: Partial<KVNamespaceGetOptions<undefined>>,
+  ): Effect.Effect<
+    Map<string, KVNamespaceGetWithMetadataResult<string, Metadata>>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<Metadata = unknown>(
+    key: Array<Key>,
+    options?: KVNamespaceGetOptions<"text">,
+  ): Effect.Effect<
+    Map<string, KVNamespaceGetWithMetadataResult<string, Metadata>>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  getWithMetadata<ExpectedValue = unknown, Metadata = unknown>(
+    key: Array<Key>,
+    options?: KVNamespaceGetOptions<"json">,
+  ): Effect.Effect<
+    Map<string, KVNamespaceGetWithMetadataResult<ExpectedValue, Metadata>>,
+    KVNamespaceError,
+    RuntimeContext
+  >;
+  delete(key: Key): Effect.Effect<void, KVNamespaceError, RuntimeContext>;
+}
+
+export class KVNamespaceBinding extends Binding.Service<
+  KVNamespaceBinding,
+  (bucket: KVNamespace) => Effect.Effect<KVNamespaceClient>
+>()("Cloudflare.KVNamespace") {}
+
+export const KVNamespaceBindingLive = Layer.effect(
+  KVNamespaceBinding,
+  Effect.gen(function* () {
+    const bind = yield* KVNamespaceBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (bucket: KVNamespace) {
+      yield* bind(bucket);
+      const raw = Effect.sync(
+        // this must be lazy because the WorkerEnvironment is not available yet
+        () => (env as Record<string, runtime.KVNamespace>)[bucket.LogicalId],
+      );
+      const tryPromise = <T>(
+        fn: () => Promise<T>,
+      ): Effect.Effect<T, KVNamespaceError> =>
+        Effect.tryPromise({
+          try: fn,
+          catch: (error: any) =>
+            new KVNamespaceError({
+              message: error.message ?? "Unknown error",
+              cause: error,
+            }),
+        });
+
+      const use = <T>(
+        fn: (raw: runtime.KVNamespace<string>) => Promise<T>,
+      ): Effect.Effect<T, KVNamespaceError> =>
+        raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
+
+      // @ts-expect-error
+      return {
+        raw: raw,
+        // @ts-expect-error
+        get: (...args: Parameters<runtime.KVNamespace["get"]>) =>
+          use((raw) => raw.get(...args)),
+        // @ts-expect-error
+        getWithMetadata: (
+          ...args: Parameters<runtime.KVNamespace["getWithMetadata"]>
+        ) => use((raw) => raw.getWithMetadata(...args)),
+        // @ts-expect-error
+        put: (...args: Parameters<runtime.KVNamespace["put"]>) =>
+          use((raw) => raw.put(...args)),
+        list: (...args: Parameters<runtime.KVNamespace["list"]>) =>
+          use((raw) => raw.list(...args)),
+        delete: (...args: Parameters<runtime.KVNamespace["delete"]>) =>
+          use((raw) => raw.delete(...args)),
+      } satisfies KVNamespaceClient as KVNamespaceClient;
+    });
+  }),
+);
+
+export class KVNamespaceBindingPolicy extends Binding.Policy<
+  KVNamespaceBindingPolicy,
+  (bucket: KVNamespace) => Effect.Effect<void>
+>()("Cloudflare.KVNamespace") {}
+
+export const KVNamespaceBindingPolicyLive =
+  KVNamespaceBindingPolicy.layer.succeed(
+    Effect.fn(function* (host: ResourceLike, namespace: KVNamespace) {
+      if (isWorker(host)) {
+        yield* host.bind`${namespace}`({
+          bindings: [
+            {
+              type: "kv_namespace",
+              name: namespace.LogicalId,
+              namespaceId: namespace.namespaceId,
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(`BucketBinding does not support runtime '${host.Type}'`),
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/index.ts
new file mode 100644
index 00000000000..08f1364f05d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/KV/index.ts
@@ -0,0 +1,2 @@
+export * from "./KVNamespace.ts";
+export * from "./KVNamespaceBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Local.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Local.ts
new file mode 100644
index 00000000000..dfadcd23794
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Local.ts
@@ -0,0 +1,23 @@
+import * as Layer from "effect/Layer";
+import * as RpcServer from "../Local/RpcServer.ts";
+import { CloudflareAuth } from "./Auth/AuthProvider.ts";
+import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
+import * as Credentials from "./Credentials.ts";
+import {
+  LocalWorkerProvider,
+  localRuntimeServices,
+} from "./Workers/LocalWorkerProvider.ts";
+
+const cloudflareServices = Layer.provide(
+  Layer.merge(
+    Credentials.fromAuthProvider(),
+    CloudflareEnvironment.fromProfile(),
+  ),
+  CloudflareAuth,
+);
+
+LocalWorkerProvider().pipe(
+  Layer.provide(localRuntimeServices()),
+  Layer.provide(cloudflareServices),
+  RpcServer.launch,
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Logs.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Logs.ts
new file mode 100644
index 00000000000..ff35c53ee3c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Logs.ts
@@ -0,0 +1,236 @@
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import type * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Queue from "effect/Queue";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as Socket from "effect/unstable/socket/Socket";
+import type { LogLine, LogsInput } from "../Provider.ts";
+
+const DEFAULT_LOOKBACK_MS = 1 * 60 * 60 * 1000;
+
+export interface TelemetryFilter {
+  key: string;
+  operation:
+    | "eq"
+    | "neq"
+    | "includes"
+    | "not_includes"
+    | "starts_with"
+    | "gt"
+    | "gte"
+    | "lt"
+    | "lte"
+    | "in"
+    | "not_in";
+  type: "string" | "number" | "boolean";
+  value?: string | number | boolean;
+}
+
+interface TailEventMessage {
+  eventTimestamp?: number;
+  wallTime: number;
+  cpuTime: number;
+  truncated: boolean;
+  outcome: string;
+  scriptName: string;
+  exceptions: {
+    name: string;
+    message: string;
+    stack: string;
+    timestamp: string;
+  }[];
+  logs: {
+    message: string[];
+    level: string;
+    timestamp: string;
+  }[];
+  event:
+    | {
+        request: { method: string; url: string };
+        response?: { status: number };
+      }
+    | null
+    | undefined;
+}
+
+const parseEvents = (
+  response: workers.QueryObservabilityTelemetryResponse,
+): LogLine[] => {
+  const lines: LogLine[] = [];
+  if (response.events?.events) {
+    for (const event of response.events.events) {
+      const ts = new Date(event.timestamp);
+      const meta = event.$metadata;
+      const msg =
+        meta.message ??
+        (meta.level === "error"
+          ? `error: ${meta.error ?? "unknown"}`
+          : `${meta.level ?? "log"}`);
+      lines.push({ timestamp: ts, message: msg });
+    }
+  }
+  return lines;
+};
+
+export const CloudflareLogs = Effect.gen(function* () {
+  const queryTelemetry = yield* workers.queryObservabilityTelemetry;
+  const createScriptTail = yield* workers.createScriptTail;
+  const deleteScriptTail = yield* workers.deleteScriptTail;
+
+  const queryLogs = (opts: {
+    accountId: string;
+    filters: TelemetryFilter[];
+    options: LogsInput;
+  }) =>
+    Effect.gen(function* () {
+      const now = Date.now();
+      const limit = opts.options.limit ?? 100;
+
+      if (opts.options.since) {
+        const response = yield* queryTelemetry({
+          accountId: opts.accountId,
+          queryId: "events",
+          view: "events",
+          timeframe: { from: opts.options.since.getTime(), to: now },
+          limit,
+          parameters: {
+            filters: opts.filters,
+            // orderBy: { value: "timestamp", order: "desc" },
+          },
+        });
+        return parseEvents(response);
+      }
+
+      const response = yield* queryTelemetry({
+        accountId: opts.accountId,
+        queryId: "events",
+        view: "events",
+        timeframe: { from: now - DEFAULT_LOOKBACK_MS, to: now },
+        limit,
+        parameters: {
+          filters: opts.filters,
+        },
+      });
+
+      return parseEvents(response);
+    });
+
+  /**
+   * Open a real-time Workers tail session against `scriptName` and
+   * surface its messages as a {@link LogLine} stream. The websocket is
+   * automatically reconnected (with `Stream.repeat`) when Cloudflare
+   * closes it after its idle window.
+   */
+  const tailScript = (opts: { accountId: string; scriptName: string }) => {
+    const runTailSession = Effect.gen(function* () {
+      const { id: tailId, url } = yield* createScriptTail({
+        scriptName: opts.scriptName,
+        accountId: opts.accountId,
+        body: { filters: [] },
+      });
+
+      const socket = yield* Socket.makeWebSocket(url, {
+        protocols: ["trace-v1"],
+      });
+
+      const queue = yield* Queue.make<LogLine, Cause.Done>();
+
+      yield* socket
+        .runRaw((raw) => {
+          const text =
+            typeof raw === "string" ? raw : new TextDecoder().decode(raw);
+          const data: TailEventMessage = JSON.parse(text);
+          const eventTs = new Date(data.eventTimestamp ?? Date.now());
+
+          if (data.event && "request" in data.event) {
+            const reqEvent = data.event;
+            const pathname = (() => {
+              try {
+                return new URL(reqEvent.request.url).pathname;
+              } catch {
+                return reqEvent.request.url;
+              }
+            })();
+            const status = reqEvent.response?.status ?? 500;
+            Queue.offerUnsafe(queue, {
+              timestamp: eventTs,
+              message: `${reqEvent.request.method} ${pathname} > ${status} (cpu: ${Math.round(data.cpuTime)}ms, wall: ${Math.round(data.wallTime)}ms)`,
+            });
+          }
+
+          for (const log of data.logs) {
+            const msg = log.message.join(" ");
+            Queue.offerUnsafe(queue, {
+              timestamp: new Date(log.timestamp),
+              message: log.level === "log" ? msg : `${log.level}: ${msg}`,
+            });
+          }
+
+          for (const exception of data.exceptions) {
+            Queue.offerUnsafe(queue, {
+              timestamp: new Date(exception.timestamp),
+              message: `${exception.name} ${exception.message}\n${exception.stack}`,
+            });
+          }
+        })
+        .pipe(
+          Effect.ensuring(
+            Effect.all([
+              deleteScriptTail({
+                scriptName: opts.scriptName,
+                id: tailId,
+                accountId: opts.accountId,
+              }).pipe(Effect.ignore),
+              Queue.end(queue),
+            ]),
+          ),
+          Effect.ignore,
+          Effect.forkChild(),
+        );
+
+      return Stream.fromQueue(queue);
+    });
+
+    return Stream.unwrap(runTailSession).pipe(
+      Stream.repeat(Schedule.spaced("1 second")),
+    );
+  };
+
+  const tailStream = (opts: {
+    accountId: string;
+    filters: TelemetryFilter[];
+  }) => {
+    const poll = (since: number): Stream.Stream<LogLine, any> =>
+      Stream.unwrap(
+        Effect.gen(function* () {
+          yield* Effect.sleep("2 seconds");
+          const now = Date.now();
+
+          const response = yield* queryTelemetry({
+            accountId: opts.accountId,
+            queryId: "events",
+            view: "events",
+            timeframe: { from: since, to: now },
+            limit: 100,
+            parameters: {
+              filters: opts.filters,
+              orderBy: { value: "timestamp", order: "asc" },
+            },
+          });
+
+          const lines = parseEvents(response);
+          const nextSince =
+            lines.length > 0
+              ? Math.max(...lines.map((l) => l.timestamp.getTime())) + 1
+              : since;
+
+          return Stream.concat(Stream.fromIterable(lines), poll(nextSince));
+        }),
+      );
+
+    return poll(Date.now());
+  };
+
+  return { queryLogs, tailScript, tailStream };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Providers.ts
new file mode 100644
index 00000000000..483df7fd1c1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Providers.ts
@@ -0,0 +1,233 @@
+import { Retry } from "@distilled.cloud/cloudflare";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import * as Layer from "effect/Layer";
+import * as Ref from "effect/Ref";
+import * as Schedule from "effect/Schedule";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
+import { Command } from "../Build/Command.ts";
+import * as Build from "../Build/index.ts";
+import { KeyPair, KeyPairProvider } from "../KeyPair.ts";
+import * as Provider from "../Provider.ts";
+import { Random, RandomProvider } from "../Random.ts";
+import * as Access from "./Access.ts";
+import * as AiGateway from "./AiGateway/index.ts";
+import * as AnalyticsEngine from "./AnalyticsEngine/index.ts";
+import * as ApiToken from "./ApiToken/index.ts";
+import * as Artifacts from "./Artifacts/index.ts";
+import { CloudflareAuth } from "./Auth/AuthProvider.ts";
+import * as Browser from "./Browser/index.ts";
+import * as CloudflareEnvironment from "./CloudflareEnvironment.ts";
+import * as Containers from "./Container/index.ts";
+import * as Credentials from "./Credentials.ts";
+import * as D1 from "./D1/index.ts";
+import * as Dns from "./Dns/index.ts";
+import * as Email from "./Email/index.ts";
+import * as Hyperdrive from "./Hyperdrive/index.ts";
+import * as Images from "./Images/index.ts";
+import * as KV from "./KV/index.ts";
+import * as Queue from "./Queue/index.ts";
+import * as R2 from "./R2/index.ts";
+import * as RateLimit from "./RateLimit/index.ts";
+import * as SecretsStore from "./SecretsStore/index.ts";
+import * as Tunnel from "./Tunnel/index.ts";
+import * as Vectorize from "./Vectorize/index.ts";
+import * as VpcService from "./VpcService/index.ts";
+import * as Workers from "./Workers/index.ts";
+import * as Workflows from "./Workers/Workflow.ts";
+import * as Zaraz from "./Zaraz/index.ts";
+import * as Zone from "./Zone/index.ts";
+
+export { Credentials } from "@distilled.cloud/cloudflare/Credentials";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "Cloudflare",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Cloudflare providers, bindings, and credentials for Worker-based stacks.
+ */
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      ApiToken.AccountApiToken,
+      ApiToken.UserApiToken,
+      AiGateway.AiGateway,
+      AiGateway.AiGatewayBindingPolicy,
+      AnalyticsEngine.AnalyticsEngineDatasetBindingPolicy,
+      Artifacts.ArtifactsBindingPolicy,
+      Browser.BrowserBindingPolicy,
+      Command,
+      Containers.Container,
+      D1.D1ConnectionPolicy,
+      D1.D1Database,
+      Dns.DnsReadPolicy,
+      Dns.DnsReadWritePolicy,
+      Dns.DnsWritePolicy,
+      Email.EmailAddress,
+      Email.EmailRouting,
+      Email.EmailRule,
+      Email.SendEmailBindingPolicy,
+      Hyperdrive.Hyperdrive,
+      Hyperdrive.HyperdriveBindingPolicy,
+      Images.ImagesBindingPolicy,
+      KV.KVNamespace,
+      KV.KVNamespaceBindingPolicy,
+      Queue.Queue,
+      Queue.QueueBindingPolicy,
+      Queue.QueueConsumer,
+      Queue.QueueEventSourcePolicy,
+      R2.R2Bucket,
+      R2.R2BucketBindingPolicy,
+      RateLimit.RateLimitBindingPolicy,
+      SecretsStore.SecretBindingPolicy,
+      SecretsStore.SecretsStore,
+      SecretsStore.Secret,
+      Tunnel.Tunnel,
+      Tunnel.TunnelReadPolicy,
+      Tunnel.TunnelReadWritePolicy,
+      Tunnel.TunnelWritePolicy,
+      Vectorize.VectorizeIndexBindingPolicy,
+      Vectorize.VectorizeIndex,
+      Vectorize.VectorizeMetadataIndex,
+      VpcService.VpcService,
+      KeyPair,
+      Random,
+      Workers.BindWorkerPolicy,
+      Workers.CronEventSourcePolicy,
+      Workers.FetchPolicy,
+      Workers.Worker,
+      Workflows.WorkflowResource,
+      Zaraz.ZarazConfig,
+      Zone.Zone,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        ApiToken.AccountApiTokenProvider(),
+        ApiToken.UserApiTokenProvider(),
+        AiGateway.AiGatewayProvider(),
+        AiGateway.AiGatewayBindingPolicyLive,
+        AnalyticsEngine.AnalyticsEngineDatasetBindingPolicyLive,
+        Artifacts.ArtifactsBindingPolicyLive,
+        Browser.BrowserBindingPolicyLive,
+        Containers.ContainerProvider(),
+        D1.D1ConnectionPolicyLive,
+        D1.DatabaseProvider(),
+        Dns.DnsReadPolicyLive,
+        Dns.DnsReadWritePolicyLive,
+        Dns.DnsWritePolicyLive,
+        Email.EmailAddressProvider(),
+        Email.EmailRoutingProvider(),
+        Email.EmailRuleProvider(),
+        Email.SendEmailBindingPolicyLive,
+        Hyperdrive.HyperdriveBindingPolicyLive,
+        Hyperdrive.HyperdriveProvider(),
+        Images.ImagesBindingPolicyLive,
+        KV.KVNamespaceBindingPolicyLive,
+        KV.KVNamespaceProvider(),
+        Queue.QueueBindingPolicyLive,
+        Queue.QueueEventSourcePolicyLive,
+        Queue.QueueProvider(),
+        Queue.QueueConsumerProvider(),
+        R2.R2BucketBindingPolicyLive,
+        R2.R2BucketProvider(),
+        RateLimit.RateLimitBindingPolicyLive,
+        SecretsStore.SecretBindingPolicyLive,
+        SecretsStore.SecretsStoreProvider(),
+        SecretsStore.StoreSecretProvider(),
+        Tunnel.TunnelProvider(),
+        Tunnel.TunnelReadPolicyLive,
+        Tunnel.TunnelReadWritePolicyLive,
+        Tunnel.TunnelWritePolicyLive,
+        Vectorize.VectorizeIndexBindingPolicyLive,
+        Vectorize.VectorizeIndexProvider(),
+        Vectorize.VectorizeMetadataIndexProvider(),
+        VpcService.VpcServiceProvider(),
+        Workers.BindWorkerPolicyLive,
+        Workers.CronEventSourcePolicyLive,
+        Workers.FetchPolicyLive,
+        Workers.WorkerProvider(),
+        Workflows.WorkflowProvider(),
+        Zaraz.ZarazConfigProvider(),
+        Zone.ZoneProvider(),
+      ),
+    ),
+    Layer.provideMerge(
+      Layer.mergeAll(
+        Build.CommandProvider(),
+        KeyPairProvider(),
+        RandomProvider(),
+      ),
+    ),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(CloudflareEnvironment.fromProfile()),
+    Layer.provideMerge(CloudflareAuth),
+    Layer.provideMerge(Access.AccessLive),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    // Apply a blanket retry policy to every Cloudflare API call. Extends
+    // `Retry.makeDefault`'s transient detection (throttling / 5xx /
+    // network) with one Cloudflare-specific misleadingly-tagged
+    // transient case the SDK doesn't yet mark retryable — see
+    // `cloudflareRetryFactory` below. Without this, the matching brief
+    // CF infrastructure blips surface as test failures and resource
+    // leaks.
+    //
+    // Deliberately narrow: we ONLY add cases where the message
+    // unambiguously indicates a transient infrastructure failure (not
+    // a real auth/permission failure). Auto-retrying ambiguous cases
+    // like `Unauthorized: Authentication error` would silently loop on
+    // genuinely invalid tokens.
+    //
+    // TODO(distilled): once
+    // https://github.com/alchemy-run/distilled/pull/233 lands, this
+    // wrapper can collapse back to `Retry.makeDefault`.
+    Layer.provideMerge(Layer.succeed(Retry.Retry, cloudflareRetryFactory)),
+    Layer.orDie,
+  );
+
+const cloudflareRetryFactory: Retry.Factory = (lastError) => {
+  const defaults = Retry.makeDefault(lastError);
+  return {
+    while: (error) =>
+      defaults.while?.(error) === true || isMisleadinglyTaggedTransient(error),
+    schedule: pipe(
+      Schedule.exponential(Duration.millis(250), 2),
+      Schedule.modifyDelay(
+        Effect.fnUntraced(function* (duration) {
+          const error = yield* Ref.get(lastError);
+          // Throttling errors (429): honor a 500ms floor matching the
+          // distilled default.
+          const isThrottling =
+            (error as { _tag?: unknown })?._tag === "TooManyRequests";
+          if (isThrottling && Duration.toMillis(duration) < 500) {
+            return Duration.toMillis(Duration.millis(500));
+          }
+          return Duration.toMillis(duration);
+        }),
+      ),
+      Retry.capped(Duration.seconds(5)),
+      Retry.jittered,
+      Schedule.both(Schedule.recurs(8)),
+    ),
+  };
+};
+
+const isMisleadinglyTaggedTransient = (error: unknown): boolean => {
+  if (!error || typeof error !== "object") return false;
+  const tag = (error as { _tag?: unknown })._tag;
+  const message = ((error as { message?: unknown }).message ?? "") as string;
+  // CF code 10001: "Method not allowed for token" is a real permission
+  // failure (NOT retryable), but the same code is also returned with
+  // message "internal error" during Cloudflare-side hiccups. The two
+  // messages are unambiguously distinct, so we can safely retry only
+  // the internal-error variant.
+  if (tag === "Forbidden" && /internal error/i.test(message)) return true;
+  return false;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/Queue.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/Queue.ts
new file mode 100644
index 00000000000..f0ca02cf021
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/Queue.ts
@@ -0,0 +1,227 @@
+import * as queues from "@distilled.cloud/cloudflare/queues";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { QueueBinding } from "./QueueBinding.ts";
+
+export const isQueue = (value: unknown): value is Queue =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.Queue";
+
+export type QueueProps = {
+  /**
+   * Name of the queue. If omitted, a unique name will be generated.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+};
+
+export type Queue = Resource<
+  "Cloudflare.Queue",
+  QueueProps,
+  {
+    queueId: string;
+    queueName: string;
+    accountId: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Queue for reliable message passing between Workers.
+ *
+ * Queues enable you to send and receive messages with guaranteed delivery.
+ * Create a queue as a resource, then bind it to a Worker to send messages
+ * at runtime. Register a consumer to process messages.
+ *
+ * @section Creating a Queue
+ * @example Basic queue
+ * ```typescript
+ * const queue = yield* Cloudflare.Queue("MyQueue");
+ * ```
+ *
+ * @example Queue with explicit name
+ * ```typescript
+ * const queue = yield* Cloudflare.Queue("MyQueue", {
+ *   name: "my-app-queue",
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * In an Effect-style Worker, use `Cloudflare.QueueBinding.bind` in
+ * the init phase and provide `Cloudflare.QueueBindingLive` in the
+ * runtime layer. The returned `QueueSender` exposes `send` and
+ * `sendBatch`.
+ *
+ * @example Sending messages from a Worker
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ *
+ * export const Queue = Cloudflare.Queue("Queue");
+ *
+ * export default Cloudflare.Worker(
+ *   "Worker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     const queue = yield* Cloudflare.QueueBinding.bind(Queue);
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         if (request.url === "/queue/send" && request.method === "POST") {
+ *           const text = yield* request.text;
+ *           yield* queue.send({ text, sentAt: Date.now() }).pipe(Effect.orDie);
+ *           return yield* HttpServerResponse.json(
+ *             { sent: { text } },
+ *             { status: 202 },
+ *           );
+ *         }
+ *         return HttpServerResponse.text("Not Found", { status: 404 });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.QueueBindingLive)),
+ * );
+ * ```
+ */
+export const Queue = Resource<Queue>("Cloudflare.Queue")({
+  bind: QueueBinding.bind,
+});
+
+export const QueueProvider = () =>
+  Provider.effect(
+    Queue,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createQueue = yield* queues.createQueue;
+      const getQueue = yield* queues.getQueue;
+      const deleteQueue = yield* queues.deleteQueue;
+
+      const createQueueName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          if (name) return name;
+          return (yield* createPhysicalName({
+            id,
+            maxLength: 63,
+          })).toLowerCase();
+        });
+
+      // Cloudflare's `listQueues` accepts no name/prefix filter, so
+      // adoption-by-name has to scan every page. Use the paginated
+      // `.items` stream off the un-yielded operation method.
+      const findQueueByName = (queueName: string) =>
+        queues.listQueues.items({ accountId }).pipe(
+          Stream.filter((q) => q.queueName === queueName),
+          Stream.runHead,
+          Effect.map(Option.getOrUndefined),
+        );
+
+      return {
+        stables: ["queueId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const name = yield* createQueueName(id, news.name);
+          const oldName = output?.queueName
+            ? output.queueName
+            : yield* createQueueName(id, olds.name);
+          if (name !== oldName) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          const queueName = yield* createQueueName(id, news.name);
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — re-fetch the cached queue; fall back to a name scan
+          // when the cached id is gone (out-of-band delete or partial
+          // state-persistence failure).
+          let observed:
+            | { queueId?: string | null; queueName?: string | null }
+            | undefined;
+          if (output?.queueId) {
+            observed = yield* getQueue({
+              accountId: acct,
+              queueId: output.queueId,
+            }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+          }
+          if (!observed) {
+            observed = yield* findQueueByName(queueName);
+          }
+
+          // Ensure — create if missing. Cloudflare returns a generic
+          // failure when the queue name is taken; tolerate by adopting
+          // the queue with the same name so reconciles converge after a
+          // crashed peer.
+          if (!observed) {
+            observed = yield* createQueue({
+              accountId: acct,
+              queueName,
+            }).pipe(
+              Effect.catch(() =>
+                Effect.gen(function* () {
+                  const match = yield* findQueueByName(queueName);
+                  if (match && match.queueId && match.queueName) {
+                    return match;
+                  }
+                  return yield* Effect.die(
+                    `Queue "${queueName}" already exists but could not be found`,
+                  );
+                }),
+              ),
+            );
+          }
+
+          // Sync — Cloudflare Queues have no mutable per-queue settings
+          // here (the queue name itself is treated as a replace by diff),
+          // so observed state is the answer.
+          return {
+            queueId: observed.queueId!,
+            queueName: observed.queueName!,
+            accountId: acct,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteQueue({
+            accountId: output.accountId,
+            queueId: output.queueId,
+          }).pipe(Effect.catch(() => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.queueId) {
+            return yield* getQueue({
+              accountId: output.accountId,
+              queueId: output.queueId,
+            }).pipe(
+              Effect.map((queue) => ({
+                queueId: queue.queueId!,
+                queueName: queue.queueName!,
+                accountId: output.accountId,
+              })),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+          }
+          const queueName = yield* createQueueName(id, olds?.name);
+          const match = yield* findQueueByName(queueName);
+          if (match && match.queueId && match.queueName) {
+            return {
+              queueId: match.queueId,
+              queueName: match.queueName,
+              accountId,
+            };
+          }
+          return undefined;
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueBinding.ts
new file mode 100644
index 00000000000..ce1fabbb64d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueBinding.ts
@@ -0,0 +1,144 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Queue } from "./Queue.ts";
+
+export interface QueueSender {
+  raw: Effect.Effect<any, never, RuntimeContext>;
+  send(
+    body: unknown,
+    options?: { contentType?: "json" | "text" },
+  ): Effect.Effect<void, QueueSendError, RuntimeContext>;
+  sendBatch(
+    messages: ReadonlyArray<{
+      body: unknown;
+      contentType?: "json" | "text";
+    }>,
+  ): Effect.Effect<void, QueueSendError, RuntimeContext>;
+}
+
+import * as Data from "effect/Data";
+
+export class QueueSendError extends Data.TaggedError("QueueSendError")<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+/**
+ * Binding service that turns a {@link Queue} resource into a typed
+ * {@link QueueSender} you can call from a Worker's runtime Effect.
+ *
+ * @section Sending Messages
+ * Bind the queue in the Worker's init phase, then use `send` for
+ * single messages or `sendBatch` for many messages in one call.
+ * Messages can be any JSON-serializable value.
+ *
+ * @example Producer route
+ * ```typescript
+ * const queue = yield* Cloudflare.QueueBinding.bind(Queue);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     yield* queue.send({ text: "hi", sentAt: Date.now() });
+ *     return HttpServerResponse.empty({ status: 202 });
+ *   }),
+ * };
+ * ```
+ *
+ * @example Sending a batch
+ * ```typescript
+ * yield* queue.sendBatch([
+ *   { body: { event: "click", id: 1 } },
+ *   { body: { event: "click", id: 2 } },
+ *   { body: "raw text", contentType: "text" },
+ * ]);
+ * ```
+ *
+ * Provide {@link QueueBindingLive} in the worker's runtime layer to
+ * resolve the underlying Cloudflare queue at request time.
+ */
+export class QueueBinding extends Binding.Service<
+  QueueBinding,
+  (queue: Queue) => Effect.Effect<QueueSender>
+>()("Cloudflare.Queue") {}
+
+export const QueueBindingLive = Layer.effect(
+  QueueBinding,
+  Effect.gen(function* () {
+    const bind = yield* QueueBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (queue: Queue) {
+      yield* bind(queue);
+      const raw = Effect.sync(
+        () => (env as Record<string, any>)[queue.LogicalId],
+      );
+
+      const tryPromise = <T>(
+        fn: () => Promise<T>,
+      ): Effect.Effect<T, QueueSendError> =>
+        Effect.tryPromise({
+          try: fn,
+          catch: (error: any) =>
+            new QueueSendError({
+              message: error?.message ?? "Unknown queue error",
+              cause: error,
+            }),
+        });
+
+      return {
+        raw,
+        send: (body: unknown, options?: { contentType?: "json" | "text" }) =>
+          raw.pipe(
+            Effect.flatMap((q) => tryPromise(() => q.send(body, options))),
+          ),
+        sendBatch: (
+          messages: ReadonlyArray<{
+            body: unknown;
+            contentType?: "json" | "text";
+          }>,
+        ) =>
+          raw.pipe(
+            Effect.flatMap((q) =>
+              tryPromise(() =>
+                q.sendBatch(
+                  messages.map((m) => ({
+                    body: m.body,
+                    ...(m.contentType ? { contentType: m.contentType } : {}),
+                  })),
+                ),
+              ),
+            ),
+          ),
+      } satisfies QueueSender;
+    });
+  }),
+);
+
+export class QueueBindingPolicy extends Binding.Policy<
+  QueueBindingPolicy,
+  (queue: Queue) => Effect.Effect<void>
+>()("Cloudflare.Queue") {}
+
+export const QueueBindingPolicyLive = QueueBindingPolicy.layer.succeed(
+  Effect.fnUntraced(function* (host: ResourceLike, queue: Queue) {
+    if (isWorker(host)) {
+      yield* host.bind`${queue}`({
+        bindings: [
+          {
+            type: "queue",
+            name: queue.LogicalId,
+            queueName: queue.queueName,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`QueueBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueConsumer.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueConsumer.ts
new file mode 100644
index 00000000000..9495576bb41
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueConsumer.ts
@@ -0,0 +1,463 @@
+import * as queues from "@distilled.cloud/cloudflare/queues";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+// ~60s budget — Worker reconcile uploads typically land in 2–10s,
+// but a fresh container/asset deploy can stretch that.
+const queueHandlerReadinessSchedule = Schedule.spaced("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(30)),
+);
+
+export type QueueConsumerProps = {
+  /**
+   * The queue ID to attach the consumer to.
+   */
+  queueId: string;
+  /**
+   * Name of the Worker script that will consume messages.
+   */
+  scriptName: string;
+  /**
+   * Optional dead letter queue name for failed messages.
+   */
+  deadLetterQueue?: string;
+  /**
+   * Consumer settings.
+   */
+  settings?: {
+    /**
+     * The maximum number of messages per batch.
+     * @default 10
+     */
+    batchSize?: number;
+    /**
+     * The maximum number of concurrent consumer invocations.
+     */
+    maxConcurrency?: number;
+    /**
+     * The maximum number of retries for a message.
+     * @default 3
+     */
+    maxRetries?: number;
+    /**
+     * The maximum time to wait for a batch to fill, in milliseconds.
+     * @default 5000
+     */
+    maxWaitTimeMs?: number;
+    /**
+     * The number of seconds to wait before retrying a message.
+     */
+    retryDelay?: number;
+  };
+};
+
+export type QueueConsumer = Resource<
+  "Cloudflare.QueueConsumer",
+  QueueConsumerProps,
+  {
+    consumerId: string;
+    queueId: string;
+    scriptName: string;
+    accountId: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Queue Consumer that processes messages from a Queue.
+ *
+ * Register a Worker as a consumer of a Queue. The Worker's `queue()`
+ * handler will be invoked with batches of messages.
+ *
+ * Cloudflare allows at most one Worker consumer per queue (HTTP-pull
+ * consumers can coexist). The reconciler enforces this: if the queue
+ * already has a Worker consumer pointing at a different script, the
+ * deploy fails with a clear error rather than silently adopting it.
+ *
+ * @section Registering a Consumer
+ * @example Basic consumer
+ * ```typescript
+ * const queue = yield* Cloudflare.Queue("MyQueue");
+ * const worker = yield* Cloudflare.Worker("Worker", { ... });
+ *
+ * yield* Cloudflare.QueueConsumer("MyConsumer", {
+ *   queueId: queue.queueId,
+ *   scriptName: "my-worker",
+ * });
+ * ```
+ *
+ * @example Consumer with settings
+ * ```typescript
+ * yield* Cloudflare.QueueConsumer("MyConsumer", {
+ *   queueId: queue.queueId,
+ *   scriptName: "my-worker",
+ *   settings: {
+ *     batchSize: 50,
+ *     maxRetries: 5,
+ *     maxWaitTimeMs: 10000,
+ *   },
+ * });
+ * ```
+ */
+export const QueueConsumer = Resource<QueueConsumer>(
+  "Cloudflare.QueueConsumer",
+);
+
+type ObservedConsumer = {
+  consumerId: string;
+  script: string | undefined;
+};
+
+const toObserved = (c: {
+  consumerId?: string | null;
+  scriptName?: string | null;
+  type?: "worker" | "http_pull" | null;
+}): ObservedConsumer | undefined =>
+  c.consumerId && c.type === "worker"
+    ? { consumerId: c.consumerId, script: c.scriptName ?? undefined }
+    : undefined;
+
+export const QueueConsumerProvider = () =>
+  Provider.effect(
+    QueueConsumer,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createConsumer = yield* queues.createConsumer;
+      const getConsumer = yield* queues.getConsumer;
+      const updateConsumer = yield* queues.updateConsumer;
+      const deleteConsumer = yield* queues.deleteConsumer;
+
+      // Cloudflare allows a single Worker consumer per queue, so the
+      // first match in the paginated stream is the only one. Using
+      // `.items` defeats single-page lookups that would otherwise
+      // miss late-arriving consumers under eventual consistency.
+      const findWorkerConsumer = (acct: string, queueId: string) =>
+        queues.listConsumers.items({ accountId: acct, queueId }).pipe(
+          Stream.map(toObserved),
+          Stream.filter((c): c is ObservedConsumer => c !== undefined),
+          Stream.runHead,
+          Effect.map(Option.getOrUndefined),
+        );
+
+      return {
+        stables: ["consumerId", "accountId"],
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          // Queue change requires replacement — consumerId is bound
+          // to a queue and the API has no "move consumer" verb.
+          if (output?.queueId && news.queueId !== output.queueId) {
+            return { action: "replace", deleteFirst: true } as const;
+          }
+          // Settings / DLQ / script drift is an update. We DON'T
+          // escalate scriptName changes to `replace` because the
+          // engine resolves cross-resource Output<string> refs (a
+          // sibling Worker's `workerName`) lazily — when the upstream
+          // Worker is created in the same plan, `news` is partially
+          // unresolved at diff time and `isResolved(news)` short-
+          // circuits up top. Falling through to "update" lets the
+          // engine call reconcile with fully-resolved `news`, where
+          // we detect script drift and rebuild the consumer in
+          // place (Cloudflare's PUT silently ignores `script_name`
+          // changes, so reconcile does delete-then-create).
+          if (
+            JSON.stringify(olds.settings ?? {}) !==
+              JSON.stringify(news.settings ?? {}) ||
+            (olds.deadLetterQueue ?? undefined) !==
+              (news.deadLetterQueue ?? undefined) ||
+            (output?.scriptName !== undefined &&
+              news.scriptName !== output.scriptName)
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const acct = output?.accountId ?? accountId;
+          const queueId =
+            output?.queueId ?? (news.queueId as unknown as string);
+
+          // Observe — prefer the cached consumerId, then fall back to
+          // listConsumers (paginated) to recover from out-of-band
+          // deletes or partial state-persistence failures. Track
+          // whether the observation came from the cached id or the
+          // list scan: a different-script worker consumer found via
+          // the list scan is potentially foreign (state was lost,
+          // someone else attached the consumer), and silently
+          // updating it could clobber another team's wiring.
+          let observed: ObservedConsumer | undefined;
+          let owned = false;
+          if (output?.consumerId) {
+            const fetched = yield* getConsumer({
+              accountId: acct,
+              queueId,
+              consumerId: output.consumerId,
+            }).pipe(
+              Effect.catchTag("ConsumerNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+            if (fetched) {
+              observed = toObserved(fetched);
+              owned = observed !== undefined;
+            }
+          }
+          if (!observed) {
+            observed = yield* findWorkerConsumer(acct, queueId);
+          }
+
+          // Owned consumer pointing at a different script: rebuild
+          // it in place. Cloudflare's PUT consumer silently ignores
+          // `script_name` changes on existing consumers (the live
+          // record stays pinned to the original worker), and the
+          // platform allows only one Worker consumer per queue, so
+          // the only path to re-point is delete-then-create.
+          if (
+            owned &&
+            observed &&
+            observed.script !== undefined &&
+            observed.script !== news.scriptName
+          ) {
+            yield* deleteConsumer({
+              accountId: acct,
+              queueId,
+              consumerId: observed.consumerId,
+            }).pipe(Effect.catchTag("ConsumerNotFound", () => Effect.void));
+            // Wait for Cloudflare's worker subsystem to drop its
+            // claim on the old script so createConsumer below
+            // doesn't race the queue↔script propagation lag.
+            yield* getConsumer({
+              accountId: acct,
+              queueId,
+              consumerId: observed.consumerId,
+            }).pipe(
+              Effect.flatMap(() => Effect.fail("still-attached" as const)),
+              Effect.catchTag("ConsumerNotFound", () => Effect.void),
+              Effect.retry({
+                while: (e) => e === "still-attached",
+                schedule: Schedule.spaced("1 second").pipe(
+                  Schedule.both(Schedule.recurs(30)),
+                ),
+              }),
+              Effect.ignore,
+            );
+            observed = undefined;
+            owned = false;
+          }
+
+          // Refuse to take over a foreign consumer on the state-loss
+          // path. With `owned=false` we found this via the list scan
+          // and the script mismatch means it belongs to another
+          // resource or was created out-of-band — silent adoption
+          // would clobber that.
+          if (
+            observed &&
+            !owned &&
+            observed.script !== undefined &&
+            observed.script !== news.scriptName
+          ) {
+            return yield* Effect.die(
+              `Cloudflare queue "${queueId}" already has a worker ` +
+                `consumer for script "${observed.script}", but this ` +
+                `resource is configured for "${news.scriptName}" and ` +
+                `local state for the consumer was missing. Each queue ` +
+                `can have only one worker consumer — delete the ` +
+                `existing one, update scriptName to match, or restore ` +
+                `the consumer's state entry before redeploying.`,
+            );
+          }
+
+          // Ensure — create if missing. ConsumerAlreadyExists is the
+          // race signal: another reconcile or peer beat us to it.
+          // Re-run the lookup; the paginated stream tolerates the
+          // single-page eventual-consistency window the previous
+          // implementation missed.
+          let consumerId: string;
+          if (!observed) {
+            const created = yield* createConsumer({
+              accountId: acct,
+              queueId,
+              scriptName: news.scriptName,
+              type: "worker",
+              deadLetterQueue: news.deadLetterQueue,
+              settings: news.settings,
+            }).pipe(
+              // The sibling Worker resource pre-creates a placeholder
+              // script with no `queue` handler; Cloudflare returns
+              // code 11001 until the real reconcile uploads the
+              // handler. Retry until the upload propagates (capped),
+              // then surface a real failure if it never does.
+              Effect.tapError((e) =>
+                e._tag === "QueueHandlerMissing"
+                  ? Effect.logDebug(
+                      `QueueConsumer create: worker ` +
+                        `"${news.scriptName}" has no queue handler ` +
+                        `yet (code 11001), retrying`,
+                    )
+                  : Effect.void,
+              ),
+              Effect.retry({
+                while: (e) => e._tag === "QueueHandlerMissing",
+                schedule: queueHandlerReadinessSchedule,
+              }),
+              Effect.catchTag("ConsumerAlreadyExists", (cause) =>
+                Effect.gen(function* () {
+                  const match = yield* findWorkerConsumer(acct, queueId);
+                  if (!match) {
+                    return yield* Effect.die(
+                      `Cloudflare reported a worker consumer already ` +
+                        `exists on queue "${queueId}", but listConsumers ` +
+                        `returned none. Retry the deploy; if this ` +
+                        `persists, the queue is in an inconsistent ` +
+                        `state. Underlying error: ${cause.message}`,
+                    );
+                  }
+                  if (
+                    match.script !== undefined &&
+                    match.script !== news.scriptName
+                  ) {
+                    return yield* Effect.die(
+                      `Cloudflare queue "${queueId}" already has a ` +
+                        `worker consumer for script "${match.script}", ` +
+                        `but this resource is configured for ` +
+                        `"${news.scriptName}". Each queue can have only ` +
+                        `one worker consumer — delete the existing one ` +
+                        `or update scriptName to match before redeploying.`,
+                    );
+                  }
+                  return match;
+                }),
+              ),
+            );
+            consumerId = created.consumerId!;
+          } else {
+            consumerId = observed.consumerId;
+          }
+
+          // Sync — Cloudflare replaces all mutable fields on
+          // updateConsumer, so always issue this so adoption converges
+          // and settings drift gets corrected on every reconcile.
+          // updateConsumer hits the same "queue handler missing" race
+          // window as create when the worker is mid-upload, so apply
+          // the same bounded retry.
+          yield* updateConsumer({
+            accountId: acct,
+            queueId,
+            consumerId,
+            scriptName: news.scriptName,
+            type: "worker",
+            settings: news.settings,
+            deadLetterQueue: news.deadLetterQueue,
+          }).pipe(
+            Effect.retry({
+              while: (e) => e._tag === "QueueHandlerMissing",
+              schedule: queueHandlerReadinessSchedule,
+            }),
+          );
+
+          yield* getConsumer({ accountId: acct, queueId, consumerId }).pipe(
+            Effect.flatMap((fetched) =>
+              toObserved(fetched)?.script === news.scriptName
+                ? Effect.void
+                : Effect.fail("ScriptUnbound" as const),
+            ),
+            Effect.catchTag("ConsumerNotFound", () =>
+              Effect.fail("ScriptUnbound" as const),
+            ),
+            Effect.retry({
+              while: (e) => e === "ScriptUnbound",
+              schedule: queueHandlerReadinessSchedule,
+            }),
+          );
+
+          return {
+            consumerId,
+            queueId,
+            scriptName: news.scriptName!,
+            accountId: acct,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteConsumer({
+            accountId: output.accountId,
+            queueId: output.queueId,
+            consumerId: output.consumerId,
+          }).pipe(Effect.catchTag("ConsumerNotFound", () => Effect.void));
+
+          // Block until Cloudflare's worker subsystem stops claiming
+          // the script as a queue consumer. Without this the
+          // sibling Worker.delete races on `QueueConsumerConflict`
+          // (code 10064) — `deleteConsumer` returns success on the
+          // queue subsystem before the script-side view propagates.
+          yield* getConsumer({
+            accountId: output.accountId,
+            queueId: output.queueId,
+            consumerId: output.consumerId,
+          }).pipe(
+            Effect.flatMap(() => Effect.fail("still-attached" as const)),
+            Effect.catchTag("ConsumerNotFound", () => Effect.void),
+            Effect.retry({
+              while: (e) => e === "still-attached",
+              schedule: Schedule.spaced("1 second").pipe(
+                Schedule.both(Schedule.recurs(30)),
+              ),
+            }),
+            Effect.ignore,
+          );
+        }),
+        read: Effect.fn(function* ({ output }) {
+          if (output?.consumerId) {
+            const fetched = yield* getConsumer({
+              accountId: output.accountId,
+              queueId: output.queueId,
+              consumerId: output.consumerId,
+            }).pipe(
+              Effect.catchTag("ConsumerNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+            if (fetched) {
+              return {
+                consumerId: fetched.consumerId!,
+                queueId: output.queueId,
+                scriptName:
+                  ("scriptName" in fetched &&
+                  typeof fetched.scriptName === "string"
+                    ? fetched.scriptName
+                    : output.scriptName) ?? output.scriptName,
+                accountId: output.accountId,
+              };
+            }
+          }
+          // Fallback: a state loss can leave us without a consumerId
+          // even though the consumer is still alive on Cloudflare. The
+          // queue allows only one worker consumer, so finding it via
+          // listConsumers is unambiguous.
+          if (output?.queueId && output?.accountId) {
+            const match = yield* findWorkerConsumer(
+              output.accountId,
+              output.queueId,
+            );
+            if (match) {
+              return {
+                consumerId: match.consumerId,
+                queueId: output.queueId,
+                scriptName: match.script ?? output.scriptName,
+                accountId: output.accountId,
+              };
+            }
+          }
+          return undefined;
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueEventSource.ts
new file mode 100644
index 00000000000..c64df86af2f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/QueueEventSource.ts
@@ -0,0 +1,262 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Cause from "effect/Cause";
+import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import type { FunctionContext } from "../../Serverless/Function.ts";
+import * as DurationUtil from "../../Util/Duration.ts";
+import { isWorker, isWorkerEvent } from "../Workers/Worker.ts";
+import type { Queue } from "./Queue.ts";
+import { QueueConsumer } from "./QueueConsumer.ts";
+
+/**
+ * Subscriber settings — the same shape Cloudflare's `QueueConsumer`
+ * accepts. `messages(queue, props).subscribe(...)` passes these
+ * through to the auto-created `Cloudflare.QueueConsumer` so a single
+ * call captures both runtime and deploy-time intent.
+ */
+export interface MessagesProps {
+  /** Maximum messages per batch. */
+  batchSize?: number;
+  /** Maximum concurrent invocations. */
+  maxConcurrency?: number;
+  /** Maximum delivery attempts before dead-lettering. */
+  maxRetries?: number;
+  /**
+   * Wait time before flushing a partial batch. Rounded up to whole
+   * milliseconds when forwarded to Cloudflare.
+   */
+  maxWaitTime?: Duration.Input;
+  /**
+   * Backoff applied to a retry. Rounded up to whole seconds when
+   * forwarded to Cloudflare.
+   */
+  retryDelay?: Duration.Input;
+  /** Optional dead-letter queue name. */
+  deadLetterQueue?: string;
+}
+
+/**
+ * Convert a {@link MessagesProps} (with `Duration.Input` time fields)
+ * into the numeric settings shape Cloudflare's `QueueConsumer` API
+ * expects. `maxWaitTime` is rounded up to whole milliseconds and
+ * `retryDelay` to whole seconds.
+ *
+ * Exposed for testing and for callers that want to mirror the
+ * conversion when wiring `QueueConsumer` directly.
+ */
+export const toConsumerSettings = (props: MessagesProps) => ({
+  batchSize: props.batchSize,
+  maxConcurrency: props.maxConcurrency,
+  maxRetries: props.maxRetries,
+  maxWaitTimeMs: DurationUtil.toMillis(props.maxWaitTime),
+  retryDelay: DurationUtil.toSeconds(props.retryDelay),
+});
+
+/**
+ * A single queue message handed to the subscribe handler. Mirrors
+ * Cloudflare's runtime `Message<Body>` shape so per-message
+ * `ack()` / `retry()` semantics match the platform docs.
+ */
+export type QueueMessage<Body = unknown> = cf.Message<Body>;
+
+/**
+ * Subscribe to a Cloudflare Queue with an Effect stream handler.
+ *
+ * Mirrors `AWS.SQS.messages(queue).subscribe(...)` on the
+ * Cloudflare side. Wires both halves of the consumer in one call:
+ *
+ * - **Runtime**: registers a `queue` event listener on the Worker.
+ *   Each batch is piped through `process` as a `Stream.Stream`.
+ * - **Deploy-time**: yields a `Cloudflare.QueueConsumer` resource
+ *   so Cloudflare actually dispatches messages from `queue` to
+ *   this Worker. No manual `QueueConsumer` wiring needed in
+ *   `alchemy.run.ts`.
+ *
+ * Acking semantics: if `process` succeeds, every message in the
+ * batch is `ack()`ed; if it fails, every message is `retry()`ed
+ * and Cloudflare applies `maxRetries` / `retryDelay` from the
+ * settings before dead-lettering. Per-message control is still
+ * available by calling `msg.ack()` / `msg.retry()` inside the
+ * handler.
+ *
+ * @example
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Duration from "effect/Duration";
+ * import * as Effect from "effect/Effect";
+ * import * as Stream from "effect/Stream";
+ *
+ * yield* Cloudflare.messages<MyEvent>(queueResource, {
+ *   batchSize: 25,
+ *   maxRetries: 3,
+ *   maxWaitTime: "5 seconds",
+ *   retryDelay: Duration.seconds(30),
+ * }).subscribe((stream) =>
+ *   Stream.runForEach(stream, (msg) =>
+ *     Effect.log(`event ${msg.body.id}`),
+ *   ),
+ * );
+ * ```
+ */
+export const messages = <Body = unknown>(
+  queue: Queue,
+  props: MessagesProps = {},
+) => ({
+  subscribe: <Req = never>(
+    process: (
+      stream: Stream.Stream<QueueMessage<Body>>,
+    ) => Effect.Effect<void, unknown, Req>,
+  ) =>
+    QueueEventSource.use((source) => source<Body, Req>(queue, props, process)),
+});
+
+// `Req` is the handler's requirements. The service registers the
+// handler with the Worker's runtime context, where the runtime
+// machinery provides bindings and `WorkerEnvironment` when the
+// dispatch fires — so the requirement is satisfied at handler
+// invocation, NOT at subscribe time. We drop `Req` from the return
+// to keep init effects clean (mirrors `AWS.SQS.QueueEventSourceService`).
+export type QueueEventSourceService = <Body = unknown, Req = never>(
+  queue: Queue,
+  props: MessagesProps,
+  process: (
+    stream: Stream.Stream<QueueMessage<Body>>,
+  ) => Effect.Effect<void, unknown, Req>,
+) => Effect.Effect<void, never, never>;
+
+/**
+ * Service tag for the Cloudflare Queue event source. Provided by
+ * {@link QueueEventSourceLive} on the Worker's runtime layer.
+ */
+export class QueueEventSource extends Context.Service<
+  QueueEventSource,
+  QueueEventSourceService
+>()("Cloudflare.Queue.QueueEventSource") {}
+
+/**
+ * Deploy-time policy that yields a `Cloudflare.QueueConsumer`
+ * resource pointing the host Worker at the queue. Provided in
+ * `Cloudflare.providers()` and used by {@link QueueEventSourceLive}
+ * via `yield* QueueEventSourcePolicy(...)`. At runtime the policy
+ * is absent, so the call is a no-op.
+ */
+export class QueueEventSourcePolicy extends Binding.Policy<
+  QueueEventSourcePolicy,
+  (queue: Queue, props: MessagesProps) => Effect.Effect<void>
+>()("Cloudflare.Queue.QueueEventSource") {}
+
+export const QueueEventSourcePolicyLive = QueueEventSourcePolicy.layer.succeed(
+  // Cast: yielding `QueueConsumer(...)` requires the Cloudflare
+  // `Providers` services, which the deploy-time stack provides
+  // when this policy runs (the worker's init scope inherits the
+  // stack's services). `Binding.Policy.layer.succeed` types the
+  // body as `Effect<void, never, never>` to keep most policies
+  // simple; we step around that constraint here because we
+  // genuinely need to spawn a sibling resource at deploy time.
+  ((host: ResourceLike, queue: Queue, props: MessagesProps) =>
+    Effect.gen(function* () {
+      if (!isWorker(host)) {
+        return yield* Effect.die(
+          `Cloudflare.messages(...).subscribe(...) is only supported on ` +
+            `Cloudflare.Worker hosts (got '${host.Type}').`,
+        );
+      }
+      // Yield the QueueConsumer resource as a sibling of the
+      // Worker. The engine creates / updates / destroys it
+      // alongside the Worker's lifecycle; the consumer's
+      // reconciler waits for the Worker upload to expose the
+      // `queue` handler before completing (see PR #257 for the
+      // 11001 retry).
+      yield* QueueConsumer(`${queue.LogicalId}Consumer`, {
+        queueId: queue.queueId,
+        scriptName: host.workerName,
+        settings: toConsumerSettings(props),
+        deadLetterQueue: props.deadLetterQueue,
+      });
+    })) as unknown as (
+    host: ResourceLike,
+    queue: Queue,
+    props: MessagesProps,
+  ) => Effect.Effect<void>,
+);
+
+/**
+ * Runtime layer for {@link messages}. Wires each
+ * `messages(queue).subscribe(...)` call in the Worker init phase to
+ * a `queue` event listener on the runtime context, and asks the
+ * deploy-time policy ({@link QueueEventSourcePolicy}, provided in
+ * `Cloudflare.providers()`) to yield the matching
+ * `Cloudflare.QueueConsumer` resource.
+ *
+ * Provide alongside other Cloudflare runtime layers (e.g.
+ * `QueueBindingLive`) on the Worker effect.
+ */
+export const QueueEventSourceLive = Layer.effect(
+  QueueEventSource,
+  Effect.gen(function* () {
+    const policy = yield* QueueEventSourcePolicy;
+    return Effect.fn(function* <Body, Req>(
+      queue: Queue,
+      props: MessagesProps,
+      process: (
+        stream: Stream.Stream<QueueMessage<Body>>,
+      ) => Effect.Effect<void, unknown, Req>,
+    ) {
+      // Deploy-time: ensure the QueueConsumer resource exists. At
+      // runtime this Layer's `policy` resolves to the no-op variant
+      // (Binding.Policy provides that automatically via
+      // `Effect.serviceOption`), so this becomes a no-op.
+      yield* policy(queue, props);
+
+      // Resolve the runtime context per-call rather than at layer
+      // construction. Capturing it on the layer would leak the
+      // requirement past `PlatformServices` exclusion when the
+      // Worker typechecks its init effect.
+      const ctx = (yield* RuntimeContext) as unknown as FunctionContext;
+      // Capture the queue-name accessor once; the listener body
+      // re-resolves it per event via `yield* QueueName`. A worker
+      // can consume multiple queues — each subscribe registers its
+      // own listener and they all see every queue event, so the
+      // queue-name match is what scopes the handler.
+      const QueueName = yield* queue.queueName;
+
+      yield* ctx.listen<void, Req>((event) => {
+        if (!isWorkerEvent(event) || event.type !== "queue") return;
+        const batch = event.input as cf.MessageBatch<Body>;
+
+        return Effect.gen(function* () {
+          const queueName = yield* QueueName;
+          if (batch.queue !== queueName) return;
+
+          yield* process(Stream.fromIterable(batch.messages)).pipe(
+            Effect.tap(() =>
+              Effect.sync(() => {
+                for (const msg of batch.messages) msg.ack();
+              }),
+            ),
+            Effect.onError((cause) =>
+              Effect.sync(() => {
+                // Surface the failure so the operator sees what
+                // tripped the retry path; without this the only
+                // signal is the message reappearing on the next
+                // attempt.
+                console.error(
+                  `[QueueEventSource] handler failed on queue ` +
+                    `"${queueName}": ${Cause.pretty(cause)}`,
+                );
+                for (const msg of batch.messages) msg.retry();
+              }),
+            ),
+            Effect.catchCause(() => Effect.void),
+          );
+        });
+      });
+    }) as QueueEventSourceService;
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/index.ts
new file mode 100644
index 00000000000..99737978565
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Queue/index.ts
@@ -0,0 +1,4 @@
+export * from "./Queue.ts";
+export * from "./QueueBinding.ts";
+export * from "./QueueConsumer.ts";
+export * from "./QueueEventSource.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/R2Bucket.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/R2Bucket.ts
new file mode 100644
index 00000000000..fc7a280157e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/R2Bucket.ts
@@ -0,0 +1,878 @@
+import * as r2 from "@distilled.cloud/cloudflare/r2";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type * as Cloudflare from "../Providers.ts";
+import * as Zone from "../Zone/index.ts";
+import { R2BucketBinding } from "./R2BucketBinding.ts";
+
+export const isR2Bucket = (value: unknown): value is R2Bucket =>
+  typeof value === "object" && (value as any)?.Type === "Cloudflare.R2Bucket";
+
+export type R2BucketName = string;
+
+export type R2BucketCustomDomainZone = Zone.ZoneReference;
+
+export type R2BucketCustomDomain = {
+  /**
+   * Custom domain name to attach to the bucket.
+   */
+  name: string;
+  /**
+   * Zone that contains the custom domain. If omitted, the zone is inferred
+   * from `domain`. Pass a zone ID string, a hostname in the zone, or any object
+   * with a `zoneId` attribute such as `Cloudflare.Zone`.
+   */
+  zone?: R2BucketCustomDomainZone;
+  /**
+   * Whether public bucket access is enabled at this custom domain.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Allowlist of TLS ciphers in BoringSSL format.
+   */
+  ciphers?: string[];
+  /**
+   * Minimum TLS version accepted by the custom domain.
+   * @default "1.0"
+   */
+  minTLS?: "1.0" | "1.1" | "1.2" | "1.3";
+};
+
+export type R2BucketLifecycleCondition =
+  | {
+      type: "Age";
+      /**
+       * Maximum age of an object, in seconds, before the rule's action applies.
+       */
+      maxAge: number;
+    }
+  | {
+      type: "Date";
+      /**
+       * Absolute date (ISO 8601) at which the rule's action applies.
+       */
+      date: string;
+    };
+
+export type R2BucketLifecycleRule = {
+  /**
+   * Unique identifier for the rule within the bucket.
+   */
+  id: string;
+  /**
+   * Whether the rule is enabled.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Object key prefix the rule applies to. Use `""` (or omit) to match all
+   * objects in the bucket.
+   * @default ""
+   */
+  prefix?: string;
+  /**
+   * Abort incomplete multipart uploads after the configured age.
+   */
+  abortMultipartUploadsTransition?: {
+    condition?: { type: "Age"; maxAge: number };
+  };
+  /**
+   * Delete matching objects after the configured age or on a specific date.
+   */
+  deleteObjectsTransition?: {
+    condition?: R2BucketLifecycleCondition;
+  };
+  /**
+   * Transition matching objects to a different storage class. Cloudflare R2
+   * only supports transitioning to `InfrequentAccess` today.
+   */
+  storageClassTransitions?: {
+    condition: R2BucketLifecycleCondition;
+    storageClass: "InfrequentAccess";
+  }[];
+};
+
+export type R2BucketProps = {
+  /**
+   * Name of the bucket. If omitted, a unique name will be generated.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Storage class for newly uploaded objects.
+   * @default "Standard"
+   */
+  storageClass?: R2Bucket.StorageClass;
+  /**
+   * Jurisdiction where objects in this bucket are guaranteed to be stored.
+   * @default "default"
+   */
+  jurisdiction?: R2Bucket.Jurisdiction;
+  /**
+   * Location hint for the bucket.
+   */
+  locationHint?: R2Bucket.Location;
+  /**
+   * Custom domains to attach to the bucket. Pass an empty array (or omit)
+   * to remove all custom domains.
+   */
+  domains?: R2BucketCustomDomain[];
+  /**
+   * Object lifecycle rules applied to the bucket. Pass an empty array (or
+   * omit) to clear all lifecycle rules. See the Cloudflare R2 docs for
+   * supported transitions.
+   */
+  lifecycleRules?: R2BucketLifecycleRule[];
+};
+
+export type R2Bucket = Resource<
+  "Cloudflare.R2Bucket",
+  R2BucketProps,
+  {
+    bucketName: R2BucketName;
+    storageClass: R2Bucket.StorageClass;
+    jurisdiction: R2Bucket.Jurisdiction;
+    location: R2Bucket.Location | undefined;
+    accountId: string;
+    domains: R2Bucket.CustomDomain[];
+    lifecycleRules: R2Bucket.LifecycleRule[];
+  },
+  never,
+  Cloudflare.Providers
+>;
+
+/**
+ * A Cloudflare R2 object storage bucket with S3-compatible API.
+ *
+ * R2 provides zero-egress-fee object storage. Create a bucket as a resource,
+ * then bind it to a Worker to read and write objects at runtime.
+ *
+ * @section Creating a Bucket
+ * @example Basic R2 bucket
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket");
+ * ```
+ *
+ * @example Bucket with location hint
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   locationHint: "wnam",
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Reading and writing objects
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket.bind(MyBucket);
+ *
+ * // Write an object
+ * yield* bucket.put("hello.txt", "Hello, World!");
+ *
+ * // Read an object
+ * const object = yield* bucket.get("hello.txt");
+ * if (object) {
+ *   const text = yield* object.text();
+ * }
+ * ```
+ *
+ * @example Streaming upload with content length
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket.bind(MyBucket);
+ *
+ * yield* bucket.put("upload.bin", request.stream, {
+ *   contentLength: Number(request.headers["content-length"] ?? 0),
+ * });
+ * ```
+ *
+ * @section Custom Domains
+ *
+ * Attach one or more custom domains to serve bucket objects from a hostname
+ * you control. The domain's zone must already exist in your Cloudflare
+ * account; the zone is inferred from the hostname when omitted, or you can
+ * pass a `Cloudflare.Zone` resource, a zone ID, or any hostname inside the
+ * zone via the `zone` field.
+ *
+ * @example Single custom domain
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [{ name: "assets.example.com" }],
+ * });
+ * ```
+ *
+ * @example Multiple custom domains
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [
+ *     { name: "assets.example.com" },
+ *     { name: "static.example.com" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Disable a custom domain without removing it
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [{ name: "assets.example.com", enabled: false }],
+ * });
+ * ```
+ *
+ * @example Custom domain with explicit zone and TLS settings
+ * ```typescript
+ * const zone = yield* Cloudflare.Zone("ExampleZone", {
+ *   name: "example.com",
+ * });
+ *
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   domains: [
+ *     {
+ *       name: "assets.example.com",
+ *       zone,
+ *       minTLS: "1.2",
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Object Lifecycle Rules
+ *
+ * Configure lifecycle rules to automatically delete objects, abort
+ * incomplete multipart uploads, or transition objects to InfrequentAccess
+ * storage. Pass an empty array (or omit) to clear all rules. See the
+ * [Cloudflare R2 docs](https://developers.cloudflare.com/r2/buckets/object-lifecycles/)
+ * for details and limits (max 1000 rules per bucket).
+ *
+ * @example Delete objects 30 days after upload
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   lifecycleRules: [
+ *     {
+ *       id: "expire-old-objects",
+ *       deleteObjectsTransition: {
+ *         condition: { type: "Age", maxAge: 60 * 60 * 24 * 30 },
+ *       },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Transition to InfrequentAccess after 60 days, delete after 365
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   lifecycleRules: [
+ *     {
+ *       id: "archive-then-delete",
+ *       prefix: "logs/",
+ *       storageClassTransitions: [
+ *         {
+ *           condition: { type: "Age", maxAge: 60 * 60 * 24 * 60 },
+ *           storageClass: "InfrequentAccess",
+ *         },
+ *       ],
+ *       deleteObjectsTransition: {
+ *         condition: { type: "Age", maxAge: 60 * 60 * 24 * 365 },
+ *       },
+ *     },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Abort incomplete multipart uploads after 7 days
+ * ```typescript
+ * const bucket = yield* Cloudflare.R2Bucket("MyBucket", {
+ *   lifecycleRules: [
+ *     {
+ *       id: "abort-stale-uploads",
+ *       abortMultipartUploadsTransition: {
+ *         condition: { type: "Age", maxAge: 60 * 60 * 24 * 7 },
+ *       },
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const R2Bucket = Resource<R2Bucket>("Cloudflare.R2Bucket")({
+  bind: R2BucketBinding.bind,
+});
+
+export declare namespace R2Bucket {
+  export type StorageClass = "Standard" | "InfrequentAccess";
+  export type Jurisdiction = "default" | "eu" | "fedramp";
+  export type Location = "apac" | "eeur" | "enam" | "weur" | "wnam" | "oc";
+  export type LifecycleRule = {
+    id: string;
+    enabled: boolean;
+    prefix: string;
+    abortMultipartUploadsTransition:
+      | { condition: { type: "Age"; maxAge: number } | undefined }
+      | undefined;
+    deleteObjectsTransition:
+      | { condition: R2BucketLifecycleCondition | undefined }
+      | undefined;
+    storageClassTransitions:
+      | {
+          condition: R2BucketLifecycleCondition;
+          storageClass: "InfrequentAccess";
+        }[]
+      | undefined;
+  };
+  export type CustomDomain = {
+    domain: string;
+    zoneId: string | undefined;
+    enabled: boolean;
+    ciphers: string[] | undefined;
+    minTLS: "1.0" | "1.1" | "1.2" | "1.3" | undefined;
+    status:
+      | {
+          ownership:
+            | "pending"
+            | "active"
+            | "deactivated"
+            | "blocked"
+            | "error"
+            | "unknown";
+          ssl:
+            | "initializing"
+            | "pending"
+            | "active"
+            | "deactivated"
+            | "error"
+            | "unknown";
+        }
+      | undefined;
+  };
+}
+
+export const R2BucketProvider = () =>
+  Provider.effect(
+    R2Bucket,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createBucket = yield* r2.createBucket;
+      const patchBucket = yield* r2.patchBucket;
+      const deleteBucket = yield* r2.deleteBucket;
+      const getBucket = yield* r2.getBucket;
+      const deleteObjects = yield* r2.deleteObjects;
+      const listBucketDomainCustoms = yield* r2.listBucketDomainCustoms;
+      const createBucketDomainCustom = yield* r2.createBucketDomainCustom;
+      const updateBucketDomainCustom = yield* r2.updateBucketDomainCustom;
+      const deleteBucketDomainCustom = yield* r2.deleteBucketDomainCustom;
+      const getBucketLifecycle = yield* r2.getBucketLifecycle;
+      const putBucketLifecycle = yield* r2.putBucketLifecycle;
+
+      const emptyBucket = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+      ) =>
+        r2.listObjects
+          .items({
+            accountId,
+            bucketName,
+            cfR2Jurisdiction: jurisdiction,
+            perPage: 1000,
+          })
+          .pipe(
+            Stream.filter(
+              (o): o is typeof o & { key: string } =>
+                typeof o.key === "string" && o.key !== "",
+            ),
+            Stream.map((o) => o.key),
+            Stream.runForEachArray((chunk) =>
+              deleteObjects({
+                accountId,
+                bucketName,
+                cfR2Jurisdiction: jurisdiction,
+                body: [...chunk],
+              }),
+            ),
+            Effect.catchTag("NoSuchBucket", () => Effect.void),
+          );
+
+      const createBucketName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          if (name) return name;
+          return (yield* createPhysicalName({
+            id,
+            maxLength: 63,
+          })).toLowerCase();
+        });
+
+      const normalizeLocation = (
+        location: string | undefined | null,
+      ): R2Bucket.Location | undefined => {
+        if (!location) return undefined;
+        return location.toLowerCase() as R2Bucket.Location;
+      };
+
+      const listCustomDomains = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+      ) =>
+        listBucketDomainCustoms({
+          accountId,
+          bucketName,
+          jurisdiction,
+        }).pipe(
+          Effect.retry({
+            while: isNoSuchBucket,
+            schedule: r2BucketEndpointConsistencySchedule,
+          }),
+          Effect.map((response) =>
+            response.domains.map(toCustomDomainAttributes),
+          ),
+          Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
+        );
+
+      const reconcileCustomDomains = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+        desired: R2BucketCustomDomain[],
+        previous: R2Bucket.CustomDomain[],
+      ) =>
+        Effect.gen(function* () {
+          const observed = yield* listCustomDomains(bucketName, jurisdiction);
+          if (!observed) {
+            return yield* Effect.fail(
+              new Error(
+                `Cannot reconcile custom domains for missing R2 bucket "${bucketName}"`,
+              ),
+            );
+          }
+          const observedByDomain = new Map(
+            observed.map((domain) => [domain.domain, domain]),
+          );
+          const desiredDomains = new Set(desired.map((domain) => domain.name));
+
+          // Remove domains that are no longer desired. Domains that keep the
+          // same hostname but move zones are intentionally skipped here and
+          // handled in the per-domain flow below.
+          yield* Effect.forEach(
+            previous,
+            (previousDomain) =>
+              desiredDomains.has(previousDomain.domain)
+                ? Effect.void
+                : deleteBucketDomainCustom({
+                    accountId,
+                    bucketName,
+                    domain: previousDomain.domain,
+                    jurisdiction,
+                  }).pipe(
+                    Effect.catchIf(
+                      isMissingCustomDomainOrBucket,
+                      () => Effect.void,
+                    ),
+                  ),
+            { concurrency: "unbounded" },
+          );
+
+          const applied = yield* Effect.forEach(
+            desired,
+            (domain) =>
+              Effect.gen(function* () {
+                const zoneId = yield* Zone.resolveZoneId({
+                  accountId,
+                  zone: domain.zone,
+                  hostname: domain.name,
+                });
+                const observedDomain = observedByDomain.get(domain.name);
+
+                if (
+                  observedDomain &&
+                  sameCustomDomainConfig(observedDomain, domain, zoneId)
+                ) {
+                  return observedDomain;
+                }
+
+                if (observedDomain && observedDomain.zoneId !== zoneId) {
+                  // Cloudflare does not mutate the zone for an existing custom
+                  // domain. This is not a duplicate of the stale-domain prune
+                  // above: the hostname is still desired, so that prune skips it
+                  // and this branch deletes only to recreate it in the new zone.
+                  yield* deleteBucketDomainCustom({
+                    accountId,
+                    bucketName,
+                    domain: domain.name,
+                    jurisdiction,
+                  }).pipe(
+                    Effect.catchIf(
+                      isMissingCustomDomainOrBucket,
+                      () => Effect.void,
+                    ),
+                  );
+                }
+
+                if (!observedDomain || observedDomain.zoneId !== zoneId) {
+                  const created = yield* createBucketDomainCustom({
+                    accountId,
+                    bucketName,
+                    jurisdiction,
+                    domain: domain.name,
+                    enabled: domain.enabled ?? true,
+                    zoneId,
+                    ciphers: domain.ciphers,
+                    minTLS: domain.minTLS,
+                  }).pipe(
+                    Effect.retry({
+                      while: isNoSuchBucket,
+                      schedule: r2BucketEndpointConsistencySchedule,
+                    }),
+                    Effect.retry({
+                      while: isDomainInUseConflict,
+                      schedule: r2CustomDomainConflictSchedule,
+                    }),
+                  );
+                  return toCustomDomainAttributes({ ...created, zoneId });
+                }
+
+                const updated = yield* updateBucketDomainCustom({
+                  accountId,
+                  bucketName,
+                  domain: domain.name,
+                  jurisdiction,
+                  enabled: domain.enabled ?? true,
+                  ciphers: domain.ciphers,
+                  minTLS: domain.minTLS,
+                }).pipe(
+                  Effect.retry({
+                    while: isNoSuchBucket,
+                    schedule: r2BucketEndpointConsistencySchedule,
+                  }),
+                );
+                return toCustomDomainAttributes({
+                  ...updated,
+                  enabled: updated.enabled ?? domain.enabled ?? true,
+                  zoneId,
+                });
+              }),
+            { concurrency: "unbounded" },
+          );
+
+          return applied.sort((a, b) => a.domain.localeCompare(b.domain));
+        });
+
+      const reconcileLifecycleRules = (
+        bucketName: string,
+        jurisdiction: R2Bucket.Jurisdiction,
+        desired: R2BucketLifecycleRule[],
+      ) =>
+        Effect.gen(function* () {
+          const observed = yield* getBucketLifecycle({
+            accountId,
+            bucketName,
+            jurisdiction,
+          }).pipe(
+            Effect.retry({
+              while: isNoSuchBucket,
+              schedule: r2BucketEndpointConsistencySchedule,
+            }),
+          );
+
+          const observedRules = (observed.rules ?? []).map(toLifecycleRule);
+          const desiredRules = desired.map(normalizeLifecycleRule);
+
+          if (deepEqual(observedRules, desiredRules)) {
+            return desiredRules;
+          }
+
+          yield* putBucketLifecycle({
+            accountId,
+            bucketName,
+            jurisdiction,
+            rules: desired.map(toLifecyclePutPayload),
+          }).pipe(
+            Effect.retry({
+              while: isNoSuchBucket,
+              schedule: r2BucketEndpointConsistencySchedule,
+            }),
+          );
+
+          return desiredRules;
+        });
+
+      return {
+        stables: ["bucketName", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const name = yield* createBucketName(id, news.name);
+          const oldName = output?.bucketName
+            ? output.bucketName
+            : yield* createBucketName(id, olds.name);
+          const oldJurisdiction =
+            output?.jurisdiction ?? olds.jurisdiction ?? "default";
+          const oldStorageClass =
+            output?.storageClass ?? olds.storageClass ?? "Standard";
+          if (
+            (output?.accountId ?? accountId) !== accountId ||
+            oldName !== name ||
+            oldJurisdiction !== (news.jurisdiction ?? "default") ||
+            olds.locationHint !== news.locationHint
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (oldStorageClass !== (news.storageClass ?? "Standard")) {
+            return {
+              action: "update",
+              stables: oldName === name ? ["bucketName"] : undefined,
+            } as const;
+          }
+          if (!deepEqual(olds.domains, news.domains)) {
+            return { action: "update" } as const;
+          }
+          if (!deepEqual(olds.lifecycleRules, news.lifecycleRules)) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          const name = yield* createBucketName(id, news.name);
+          const acct = output?.accountId ?? accountId;
+          const jurisdiction =
+            output?.jurisdiction ?? news.jurisdiction ?? "default";
+
+          // Observe — fetch the bucket. R2 reports a deleted bucket as
+          // `NoSuchBucket`; tolerate that so the reconciler falls
+          // through to the create path.
+          let observed = yield* getBucket({
+            accountId: acct,
+            bucketName: name,
+            jurisdiction,
+          }).pipe(
+            Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
+          );
+
+          // Ensure — create if missing. R2 reports a concurrent create
+          // (or partial state-persistence failure) as
+          // `BucketAlreadyExists`; tolerate by re-fetching the bucket.
+          if (!observed) {
+            observed = yield* createBucket({
+              accountId: acct,
+              name,
+              storageClass: news.storageClass,
+              jurisdiction: news.jurisdiction,
+              locationHint: news.locationHint,
+            }).pipe(
+              Effect.catchTag("BucketAlreadyExists", () =>
+                getBucket({
+                  accountId: acct,
+                  bucketName: name,
+                  jurisdiction: news.jurisdiction,
+                }),
+              ),
+            );
+          }
+
+          // Sync — storage class is the only mutable property; location
+          // and jurisdiction are immutable (the diff function flags those
+          // as `replace`). Only patch when the desired class drifts from
+          // observed to avoid unnecessary API calls.
+          const desiredStorageClass = news.storageClass ?? "Standard";
+          const observedStorageClass = observed.storageClass ?? "Standard";
+          if (observedStorageClass !== desiredStorageClass) {
+            observed = yield* patchBucket({
+              accountId: acct,
+              bucketName: observed.name!,
+              storageClass: desiredStorageClass,
+              jurisdiction: observed.jurisdiction ?? jurisdiction,
+            });
+          }
+
+          const attrs = {
+            bucketName: observed.name!,
+            // Distilled widened generated string enums to open unions.
+            storageClass: (observed.storageClass ??
+              "Standard") as R2Bucket.StorageClass,
+            jurisdiction: (observed.jurisdiction ??
+              "default") as R2Bucket.Jurisdiction,
+            location: normalizeLocation(observed.location),
+            accountId: acct,
+          };
+
+          const domains = yield* reconcileCustomDomains(
+            attrs.bucketName,
+            attrs.jurisdiction,
+            news.domains ?? [],
+            output?.domains ?? [],
+          );
+
+          const lifecycleRules = yield* reconcileLifecycleRules(
+            attrs.bucketName,
+            attrs.jurisdiction,
+            news.lifecycleRules ?? [],
+          );
+
+          return {
+            ...attrs,
+            domains,
+            lifecycleRules,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          for (const domain of output.domains ?? []) {
+            yield* deleteBucketDomainCustom({
+              accountId: output.accountId,
+              bucketName: output.bucketName,
+              domain: domain.domain,
+              jurisdiction: output.jurisdiction,
+            }).pipe(
+              Effect.catchIf(isMissingCustomDomainOrBucket, () => Effect.void),
+            );
+          }
+          yield* emptyBucket(output.bucketName, output.jurisdiction);
+          yield* deleteBucket({
+            accountId: output.accountId,
+            bucketName: output.bucketName,
+            jurisdiction: output.jurisdiction,
+          }).pipe(Effect.catchTag("NoSuchBucket", () => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const name =
+            output?.bucketName ?? (yield* createBucketName(id, olds?.name));
+          const acct = output?.accountId ?? accountId;
+          return yield* getBucket({
+            accountId: acct,
+            bucketName: name,
+            jurisdiction: output?.jurisdiction ?? olds?.jurisdiction,
+          }).pipe(
+            Effect.map((bucket) => ({
+              bucketName: bucket.name!,
+              // Distilled widened generated string enums to open unions.
+              storageClass: (bucket.storageClass ??
+                "Standard") as R2Bucket.StorageClass,
+              jurisdiction: (bucket.jurisdiction ??
+                "default") as R2Bucket.Jurisdiction,
+              location: normalizeLocation(bucket.location),
+              accountId: acct,
+              domains: output?.domains ?? [],
+              lifecycleRules: output?.lifecycleRules ?? [],
+            })),
+            Effect.catchTag("NoSuchBucket", () => Effect.succeed(undefined)),
+          );
+        }),
+      };
+    }),
+  );
+
+// R2 can make a newly-created bucket visible to `getBucket` before its
+// sub-resource endpoints (custom domains, lifecycle) accept it. Retry only
+// that narrow `NoSuchBucket` lag here; not-found sub-resources are still
+// treated as terminal for idempotent deletes.
+const r2BucketEndpointConsistencySchedule = Schedule.exponential(100).pipe(
+  Schedule.both(Schedule.recurs(5)),
+);
+
+// Distilled widened generated string enums to open unions (`string & {}`); the
+// API only ever returns the known variants, narrowed in `toCustomDomainAttributes`.
+type CustomDomainResponse = {
+  domain: string;
+  zoneId?: string | null;
+  enabled?: boolean | null;
+  ciphers?: string[] | null;
+  minTLS?: string | null;
+  status?: { ownership: string; ssl: string } | null;
+};
+
+const toCustomDomainAttributes = (
+  domain: CustomDomainResponse,
+): R2Bucket.CustomDomain => ({
+  domain: domain.domain,
+  zoneId: domain.zoneId ?? undefined,
+  enabled: domain.enabled ?? true,
+  ciphers: domain.ciphers ?? undefined,
+  minTLS: (domain.minTLS ?? undefined) as R2Bucket.CustomDomain["minTLS"],
+  status: (domain.status ?? undefined) as R2Bucket.CustomDomain["status"],
+});
+
+const sameCustomDomainConfig = (
+  observed: R2Bucket.CustomDomain | undefined,
+  desired: R2BucketCustomDomain,
+  zoneId: string,
+): boolean =>
+  observed !== undefined &&
+  observed.zoneId === zoneId &&
+  observed.enabled === (desired.enabled ?? true) &&
+  deepEqual(observed.ciphers, desired.ciphers) &&
+  observed.minTLS === desired.minTLS;
+
+const isMissingCustomDomainOrBucket = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  (("status" in error && (error as { status: unknown }).status === 404) ||
+    ("_tag" in error &&
+      ((error as { _tag: unknown })._tag === "DomainNotFound" ||
+        (error as { _tag: unknown })._tag === "NoSuchBucket")));
+
+type LifecycleRuleResponse = NonNullable<
+  r2.GetBucketLifecycleResponse["rules"]
+>[number];
+
+const toLifecycleRule = (
+  rule: LifecycleRuleResponse,
+): R2Bucket.LifecycleRule => ({
+  id: rule.id,
+  enabled: rule.enabled,
+  prefix: rule.conditions.prefix ?? "",
+  abortMultipartUploadsTransition: rule.abortMultipartUploadsTransition
+    ? { condition: rule.abortMultipartUploadsTransition.condition ?? undefined }
+    : undefined,
+  deleteObjectsTransition: rule.deleteObjectsTransition
+    ? { condition: rule.deleteObjectsTransition.condition ?? undefined }
+    : undefined,
+  storageClassTransitions: rule.storageClassTransitions ?? undefined,
+});
+
+const normalizeLifecycleRule = (
+  rule: R2BucketLifecycleRule,
+): R2Bucket.LifecycleRule => ({
+  id: rule.id,
+  enabled: rule.enabled ?? true,
+  prefix: rule.prefix ?? "",
+  abortMultipartUploadsTransition: rule.abortMultipartUploadsTransition
+    ? { condition: rule.abortMultipartUploadsTransition.condition }
+    : undefined,
+  deleteObjectsTransition: rule.deleteObjectsTransition
+    ? { condition: rule.deleteObjectsTransition.condition }
+    : undefined,
+  storageClassTransitions: rule.storageClassTransitions,
+});
+
+const toLifecyclePutPayload = (
+  rule: R2BucketLifecycleRule,
+): NonNullable<r2.PutBucketLifecycleRequest["rules"]>[number] => ({
+  id: rule.id,
+  enabled: rule.enabled ?? true,
+  conditions: { prefix: rule.prefix ?? "" },
+  abortMultipartUploadsTransition: rule.abortMultipartUploadsTransition,
+  deleteObjectsTransition: rule.deleteObjectsTransition,
+  storageClassTransitions: rule.storageClassTransitions,
+});
+
+const isNoSuchBucket = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  (error as { _tag: unknown })._tag === "NoSuchBucket";
+
+// Cloudflare keys a custom domain to a single bucket at the zone level. After a
+// domain is deleted, re-attaching the same hostname can transiently 409 with
+// "Domain already in use" until the prior association is fully released. Treat
+// that narrow conflict as eventual consistency and retry it on create.
+const isDomainInUseConflict = (error: unknown): boolean =>
+  typeof error === "object" &&
+  error !== null &&
+  "_tag" in error &&
+  (error as { _tag: unknown })._tag === "Conflict" &&
+  "message" in error &&
+  typeof (error as { message: unknown }).message === "string" &&
+  (error as { message: string }).message.toLowerCase().includes("in use");
+
+// Releasing a custom domain after delete can lag a few seconds, so give the
+// conflict a longer, bounded budget than the bucket-endpoint lag above.
+const r2CustomDomainConflictSchedule = Schedule.spaced("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(8)),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/R2BucketBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/R2BucketBinding.ts
new file mode 100644
index 00000000000..49e92715e47
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/R2BucketBinding.ts
@@ -0,0 +1,334 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as Binding from "../../Binding.ts";
+import * as Output from "../../Output.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { getRawStream } from "../../Util/Stream.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { R2Bucket } from "./R2Bucket.ts";
+
+export interface R2Object extends Omit<runtime.R2Object, "writeHttpMetadata"> {
+  writeHttpMetadata(headers: Headers): Effect.Effect<void>;
+}
+
+export interface R2ObjectBody extends R2Object {
+  get body(): Stream.Stream<Uint8Array, R2Error>;
+  get bodyUsed(): boolean;
+  arrayBuffer(): Effect.Effect<ArrayBuffer, R2Error>;
+  bytes(): Effect.Effect<Uint8Array, R2Error>;
+  text(): Effect.Effect<string, R2Error>;
+  json<T>(): Effect.Effect<T, R2Error>;
+  blob(): Effect.Effect<runtime.Blob, R2Error>;
+}
+
+export type R2GetOptions = runtime.R2GetOptions;
+export type R2PutOptions = runtime.R2PutOptions & {
+  contentLength?: number;
+};
+
+export type R2ListOptions = runtime.R2ListOptions;
+export type R2Objects = {
+  objects: R2Object[];
+  delimitedPrefixes: string[];
+} & (
+  | {
+      truncated: true;
+      cursor: string;
+    }
+  | {
+      truncated: false;
+    }
+);
+export type R2Conditional = runtime.R2Conditional;
+
+export class R2Error extends Data.TaggedError("R2Error")<{
+  message: string;
+  cause: Error;
+}> {}
+
+export interface R2MultipartUpload {
+  raw: runtime.R2MultipartUpload;
+  readonly key: string;
+  readonly uploadId: string;
+  uploadPart(
+    partNumber: number,
+    value: ReadableStream | (ArrayBuffer | ArrayBufferView) | string | Blob,
+    options?: R2UploadPartOptions,
+  ): Effect.Effect<R2UploadedPart, R2Error>;
+  abort(): Effect.Effect<void, R2Error>;
+  complete(uploadedParts: R2UploadedPart[]): Effect.Effect<R2Object, R2Error>;
+}
+export type R2MultipartOptions = runtime.R2MultipartOptions;
+export type R2UploadedPart = runtime.R2UploadedPart;
+export interface R2UploadPartOptions extends runtime.R2UploadPartOptions {}
+
+export interface R2BucketClient {
+  raw: Effect.Effect<runtime.R2Bucket, never, RuntimeContext>;
+  head(key: string): Effect.Effect<R2Object | null, R2Error, RuntimeContext>;
+  get(
+    key: string,
+    options: R2GetOptions & {
+      onlyIf: runtime.R2Conditional | Headers;
+    },
+  ): Effect.Effect<R2ObjectBody | R2Object | null, R2Error, RuntimeContext>;
+  get(
+    key: string,
+    options?: R2GetOptions,
+  ): Effect.Effect<R2ObjectBody | null, R2Error, RuntimeContext>;
+  put<Err = never>(
+    key: string,
+    value:
+      | ReadableStream
+      | ArrayBuffer
+      | ArrayBufferView
+      | string
+      | null
+      | Blob
+      | Stream.Stream<Uint8Array, Err>,
+    options?: R2PutOptions & {
+      onlyIf: R2Conditional | Headers;
+      contentLength?: number;
+    },
+  ): Effect.Effect<R2Object | null, R2Error | Err, RuntimeContext>;
+  put<Err = never>(
+    key: string,
+    value:
+      | ReadableStream
+      | ArrayBuffer
+      | ArrayBufferView
+      | string
+      | null
+      | Blob,
+    options?: R2PutOptions,
+  ): Effect.Effect<R2Object, R2Error | Err, RuntimeContext>;
+  put<Err = never>(
+    key: string,
+    value:
+      | ReadableStream
+      | ArrayBuffer
+      | ArrayBufferView
+      | string
+      | null
+      | Blob
+      | Stream.Stream<Uint8Array, Err>,
+    options: R2PutOptions & {
+      contentLength: number;
+    },
+  ): Effect.Effect<R2Object, R2Error | Err, RuntimeContext>;
+  delete(keys: string | string[]): Effect.Effect<void, R2Error, RuntimeContext>;
+  list(
+    options?: R2ListOptions,
+  ): Effect.Effect<R2Objects, R2Error, RuntimeContext>;
+  createMultipartUpload(
+    key: string,
+    options?: R2MultipartOptions,
+  ): Effect.Effect<R2MultipartUpload, R2Error, RuntimeContext>;
+  resumeMultipartUpload(
+    key: string,
+    uploadId: string,
+  ): Effect.Effect<R2MultipartUpload, R2Error, RuntimeContext>;
+}
+
+export class R2BucketBinding extends Binding.Service<
+  R2BucketBinding,
+  (bucket: R2Bucket) => Effect.Effect<R2BucketClient>
+>()("Cloudflare.R2Bucket") {}
+
+export const R2BucketBindingLive = Layer.effect(
+  R2BucketBinding,
+  Effect.gen(function* () {
+    const bind = yield* R2BucketBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (bucket: R2Bucket) {
+      yield* bind(bucket);
+      const raw = Effect.sync(
+        () => (env as Record<string, runtime.R2Bucket>)[bucket.LogicalId]!,
+      );
+      const tryPromise = <T>(fn: () => Promise<T>): Effect.Effect<T, R2Error> =>
+        Effect.tryPromise({
+          try: fn,
+          catch: (error: any) =>
+            new R2Error({
+              message: error.message ?? "Unknown error",
+              cause: error,
+            }),
+        });
+
+      const use = <T>(
+        fn: (raw: runtime.R2Bucket) => Promise<T>,
+      ): Effect.Effect<T, R2Error> =>
+        raw.pipe(Effect.flatMap((raw) => tryPromise(() => fn(raw))));
+
+      const wrapR2Object = (object: runtime.R2Object): R2Object => ({
+        ...object,
+        writeHttpMetadata: (headers: Headers) =>
+          Effect.sync(() => object.writeHttpMetadata(headers)),
+      });
+      const wrapR2ObjectBody = (
+        object: runtime.R2ObjectBody,
+      ): R2ObjectBody => ({
+        ...wrapR2Object(object),
+        body: Stream.fromReadableStream({
+          evaluate: () =>
+            object.body as any as ReadableStream<Uint8Array<ArrayBufferLike>>,
+          onError: (error: any) =>
+            new R2Error({
+              message: error.message ?? "Unknown error",
+              cause: error,
+            }),
+        }),
+        bodyUsed: object.bodyUsed,
+        arrayBuffer: () => tryPromise(() => object.arrayBuffer()),
+        bytes: () => tryPromise(() => object.bytes()),
+        text: () => tryPromise(() => object.text()),
+        json: <T>() => tryPromise(() => object.json<T>()),
+        blob: () => tryPromise(() => object.blob()),
+      });
+
+      const wrapR2Objects = (objects: runtime.R2Objects): R2Objects =>
+        ({
+          objects: objects.objects.map(wrapR2Object),
+          delimitedPrefixes: objects.delimitedPrefixes,
+          ...("cursor" in objects ? { cursor: objects.cursor } : {}),
+          ...("truncated" in objects ? { truncated: objects.truncated } : {}),
+        }) as R2Objects;
+
+      const wrapR2ObjectOrBody = (
+        object: runtime.R2Object | runtime.R2ObjectBody | null,
+      ): R2Object | R2ObjectBody | null =>
+        object === null
+          ? object
+          : isR2ObjectBody(object)
+            ? wrapR2ObjectBody(object)
+            : wrapR2Object(object);
+
+      const wrapR2MultipartUpload = (
+        upload: runtime.R2MultipartUpload,
+      ): R2MultipartUpload => ({
+        ...upload,
+        raw: upload,
+        uploadId: upload.uploadId,
+        abort: () => tryPromise(() => upload.abort()),
+        complete: (uploadedParts: R2UploadedPart[]) =>
+          tryPromise(() => upload.complete(uploadedParts)).pipe(
+            Effect.map(wrapR2Object),
+          ),
+        uploadPart: (
+          partNumber: number,
+          value:
+            | ReadableStream
+            | ArrayBuffer
+            | ArrayBufferView
+            | string
+            | Blob
+            | Stream.Stream<Uint8Array>,
+          options?: R2UploadPartOptions,
+        ) =>
+          tryPromise(() =>
+            upload.uploadPart(
+              partNumber,
+              Stream.isStream(value)
+                ? value.pipe(Stream.toReadableStream())
+                : (value as any),
+              options,
+            ),
+          ),
+      });
+
+      const isR2ObjectBody = (object: any): object is runtime.R2ObjectBody =>
+        object !== null && typeof object === "object" && "body" in object;
+
+      return {
+        raw: raw,
+        head: (key: string) =>
+          use((raw) => raw.head(key)).pipe(
+            Effect.map((object) => (object ? wrapR2Object(object) : object)),
+          ),
+        get: (key: string, options?: R2GetOptions) =>
+          use((raw) => raw.get(key, options)).pipe(
+            Effect.map(wrapR2ObjectOrBody),
+          ) as any,
+        // @ts-expect-error
+        put: (
+          key: string,
+          value:
+            | ReadableStream
+            | ArrayBuffer
+            | ArrayBufferView
+            | string
+            | null
+            | Blob
+            | Stream.Stream<Uint8Array>,
+          options?: R2PutOptions & {
+            onlyIf: R2Conditional | Headers;
+            contentLength?: number;
+          },
+        ) =>
+          use((raw) => {
+            if (Stream.isStream(value)) {
+              const rawStream = getRawStream(value);
+              if (rawStream) {
+                return raw.put(key, rawStream as any, options);
+              } else if (!options?.contentLength) {
+                throw new Error("Content length is required");
+              }
+              // content length myst be known, so we pipe through fixed length stream
+              // TODO(sam): is it more efficient to just assign the contentLength as a property?
+              const readable = Stream.toReadableStream(value).pipeThrough(
+                new FixedLengthStream(options.contentLength),
+              );
+              return raw.put(key, readable as any);
+            }
+            return raw.put(key, value as any, options);
+          }).pipe(Effect.map(wrapR2ObjectOrBody)) as any,
+        delete: (keys: string | string[]) => use((raw) => raw.delete(keys)),
+        list: (options?: R2ListOptions) =>
+          use((raw) => raw.list(options)).pipe(Effect.map(wrapR2Objects)),
+        createMultipartUpload: (key: string, options?: R2MultipartOptions) =>
+          use((raw) => raw.createMultipartUpload(key, options)).pipe(
+            Effect.map(wrapR2MultipartUpload),
+          ),
+        resumeMultipartUpload: (key: string, uploadId: string) =>
+          raw.pipe(
+            Effect.map((raw) => raw.resumeMultipartUpload(key, uploadId)),
+            Effect.map(wrapR2MultipartUpload),
+          ),
+      } satisfies R2BucketClient as R2BucketClient;
+    });
+  }),
+);
+
+export class R2BucketBindingPolicy extends Binding.Policy<
+  R2BucketBindingPolicy,
+  (bucket: R2Bucket) => Effect.Effect<void>
+>()("Cloudflare.R2Bucket") {}
+
+export const R2BucketBindingPolicyLive = R2BucketBindingPolicy.layer.succeed(
+  Effect.fnUntraced(function* (host: ResourceLike, bucket: R2Bucket) {
+    if (isWorker(host)) {
+      yield* host.bind`${bucket}`({
+        bindings: [
+          {
+            type: "r2_bucket",
+            name: bucket.LogicalId,
+            bucketName: bucket.bucketName,
+            jurisdiction: bucket.jurisdiction.pipe(
+              Output.map((jurisdiction) =>
+                jurisdiction === "default" ? undefined : jurisdiction,
+              ),
+            ),
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`BucketBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/index.ts
new file mode 100644
index 00000000000..52159aa81cc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/R2/index.ts
@@ -0,0 +1,2 @@
+export * from "./R2Bucket.ts";
+export * from "./R2BucketBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/RateLimit.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/RateLimit.ts
new file mode 100644
index 00000000000..f07b3db37f6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/RateLimit.ts
@@ -0,0 +1,160 @@
+import type * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { RateLimitBinding, type RateLimitClient } from "./RateLimitBinding.ts";
+
+type RateLimitTypeId = typeof RateLimitTypeId;
+const RateLimitTypeId = "Cloudflare.RateLimit" as const;
+
+export type RateLimitPeriod = 10 | 60;
+
+export type RateLimitProps = {
+  /**
+   * Binding name used when `RateLimit` is bound from inside a Worker init
+   * phase (`yield* Cloudflare.RateLimit(...)`). When passed through
+   * `Worker({ env: { ... } })`, the object key remains the binding name.
+   *
+   * @default "RATE_LIMIT"
+   */
+  name?: string;
+  /**
+   * Positive integer or string that uniquely identifies this rate limit
+   * configuration.
+   */
+  namespaceId: number | string;
+  /**
+   * Simple rate limiting configuration.
+   */
+  simple: {
+    /**
+     * The number of requests allowed within the period.
+     */
+    limit: number;
+    /**
+     * The period, in seconds, over which requests are counted.
+     */
+    period: RateLimitPeriod;
+  };
+};
+
+/**
+ * The Effect yielded when a `RateLimit` is used inside a Worker init phase:
+ * it attaches the `ratelimit` binding to the surrounding Worker and resolves
+ * to the runtime {@link RateLimitClient}.
+ */
+type BindEffect = Effect.Effect<RateLimitClient, never, RateLimitBinding>;
+
+/**
+ * A Cloudflare Rate Limit binding marker.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.RateLimit(...)`) attaches the binding to the surrounding
+ * Worker and returns the runtime {@link RateLimitClient} — no separate
+ * `.bind(...)` step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native `cf.RateLimit` in the
+ * `env` position), but it is iterable as one when `yield*`-ed.
+ */
+export interface RateLimit {
+  kind: RateLimitTypeId;
+  name: string;
+  namespaceId: string;
+  simple: {
+    limit: number;
+    period: RateLimitPeriod;
+  };
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, RateLimitClient>;
+}
+
+export const isRateLimit = (value: unknown): value is RateLimit =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as RateLimit).kind === RateLimitTypeId;
+
+/**
+ * A Cloudflare Rate Limit binding for counting arbitrary keys inside Workers.
+ *
+ * Rate Limit bindings are configured directly on Workers and do not have a
+ * standalone provisioning API. The Worker provider sees this object in
+ * `env: { ... }` and emits the corresponding `{ type: "ratelimit" }` metadata
+ * binding to the script.
+ *
+ * @section Declaring on a Worker's env
+ * @example Async (non-Effect) Worker
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: {
+ *     THROTTLE: Cloudflare.RateLimit({
+ *       namespaceId: 1001,
+ *       simple: { limit: 10, period: 60 },
+ *     }),
+ *   },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ * //   { THROTTLE: RateLimit } — the native Cloudflare binding
+ *
+ * // worker.ts
+ * export default {
+ *   fetch: async (req: Request, env: WorkerEnv) => {
+ *     const { success } = await env.THROTTLE.limit({ key: "ip" });
+ *     return new Response(success ? "ok" : "rate limited");
+ *   },
+ * };
+ * ```
+ *
+ * @section Binding inside an Effect-native Worker
+ * @example yield* RateLimit does the binding
+ * ```typescript
+ * Cloudflare.Worker("Worker", { main: "./src/worker.ts" },
+ *   Effect.gen(function* () {
+ *     // Attaches the binding to this Worker AND returns the runtime client.
+ *     const throttle = yield* Cloudflare.RateLimit({
+ *       namespaceId: 1001,
+ *       simple: { limit: 10, period: 60 },
+ *     });
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const { success } = yield* throttle.limit({ key: "ip" });
+ *         return HttpServerResponse.text(success ? "ok" : "rate limited");
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(Cloudflare.RateLimitBindingLive)),
+ * );
+ * ```
+ *
+ * @see https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/
+ */
+export const RateLimit: {
+  (props: RateLimitProps): RateLimit;
+  /**
+   * Bind an existing `RateLimit` marker to the surrounding Worker, returning
+   * the runtime client. Equivalent to `yield* rateLimit` — prefer yielding the
+   * marker directly.
+   */
+  bind: typeof RateLimitBinding.bind;
+} = Object.assign(
+  (props: RateLimitProps): RateLimit => {
+    const self: RateLimit = {
+      kind: RateLimitTypeId,
+      name: props.name ?? "RATE_LIMIT",
+      namespaceId: String(props.namespaceId),
+      simple: {
+        limit: props.simple.limit,
+        period: props.simple.period,
+      },
+      asEffect: () => RateLimitBinding.bind(self),
+      [Symbol.iterator]: () => new SingleShotGen(RateLimitBinding.bind(self)),
+    };
+    return self;
+  },
+  {
+    bind: (...args: Parameters<typeof RateLimitBinding.bind>) =>
+      RateLimitBinding.bind(...args),
+  },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/RateLimitBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/RateLimitBinding.ts
new file mode 100644
index 00000000000..1fc7b9b905c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/RateLimitBinding.ts
@@ -0,0 +1,90 @@
+/// <reference types="@cloudflare/workers-types" />
+
+import type * as cf from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import { type RateLimit as RateLimitLike } from "./RateLimit.ts";
+
+export class RateLimitError extends Data.TaggedError("RateLimitError")<{
+  message: string;
+  cause: unknown;
+}> {}
+
+export interface RateLimitClient {
+  raw: Effect.Effect<cf.RateLimit, never, WorkerEnvironment>;
+  limit(
+    options: Parameters<cf.RateLimit["limit"]>[0],
+  ): Effect.Effect<
+    Awaited<ReturnType<cf.RateLimit["limit"]>>,
+    RateLimitError,
+    WorkerEnvironment
+  >;
+}
+
+export class RateLimitBinding extends Binding.Service<
+  RateLimitBinding,
+  (rateLimit: RateLimitLike) => Effect.Effect<RateLimitClient>
+>()("Cloudflare.RateLimit.Binding") {}
+
+export const RateLimitBindingLive = Layer.effect(
+  RateLimitBinding,
+  Effect.gen(function* () {
+    const Policy = yield* RateLimitBindingPolicy;
+
+    return Effect.fn(function* (rateLimit: RateLimitLike) {
+      yield* Policy(rateLimit);
+      const raw = WorkerEnvironment.useSync(
+        (env) => (env as Record<string, cf.RateLimit>)[rateLimit.name]!,
+      );
+      return {
+        raw,
+        limit: (options) =>
+          raw.pipe(
+            Effect.flatMap((binding) =>
+              Effect.tryPromise({
+                try: () => binding.limit(options),
+                catch: (error) =>
+                  new RateLimitError({
+                    message:
+                      error instanceof Error
+                        ? error.message
+                        : "Unknown RateLimit error",
+                    cause: error,
+                  }),
+              }),
+            ),
+          ),
+      } satisfies RateLimitClient;
+    });
+  }),
+);
+
+export class RateLimitBindingPolicy extends Binding.Policy<
+  RateLimitBindingPolicy,
+  (rateLimit: RateLimitLike) => Effect.Effect<void>
+>()("Cloudflare.RateLimit.Binding") {}
+
+export const RateLimitBindingPolicyLive = RateLimitBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, rateLimit: RateLimitLike) {
+    if (isWorker(host)) {
+      yield* host.bind(rateLimit.name, {
+        bindings: [
+          {
+            type: "ratelimit",
+            name: rateLimit.name,
+            namespaceId: rateLimit.namespaceId,
+            simple: rateLimit.simple,
+          } as any,
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`RateLimitBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/index.ts
new file mode 100644
index 00000000000..dda854f33fb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/RateLimit/index.ts
@@ -0,0 +1,2 @@
+export * from "./RateLimit.ts";
+export * from "./RateLimitBinding.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/Secret.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/Secret.ts
new file mode 100644
index 00000000000..a90dccd5292
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/Secret.ts
@@ -0,0 +1,302 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { SecretBinding } from "./SecretBinding.ts";
+export type StoreSecretProps = {
+  /**
+   * The Secrets Store that owns this secret.
+   */
+  store: {
+    storeId: string;
+    accountId: string;
+  };
+  /**
+   * The name of the secret within the store.
+   * If omitted, the resource's logical ID is used.
+   */
+  name?: string;
+  /**
+   * The secret value. Treated as redacted and never logged.
+   */
+  value: Redacted.Redacted<string>;
+  /**
+   * Services allowed to reference this secret.
+   * @default ["workers"]
+   */
+  scopes?: string[];
+  /**
+   * Optional free-form description.
+   */
+  comment?: string;
+};
+
+export type Secret = Resource<
+  "Cloudflare.SecretsStore.Secret",
+  StoreSecretProps,
+  {
+    secretId: string;
+    secretName: string;
+    storeId: string;
+    accountId: string;
+    status: SecretStatus;
+    scopes: string[];
+    comment: string | undefined;
+  },
+  never,
+  Providers
+>;
+
+export type SecretStatus = "pending" | "active" | "deleted";
+
+// Distilled widened generated string enums to open unions (`string & {}`); the
+// API only ever returns the known variants, so narrow at the boundary.
+const asSecretStatus = (status: string): SecretStatus => status as SecretStatus;
+
+/**
+ * A single secret stored inside a Cloudflare Secrets Store.
+ *
+ * The secret value is treated as redacted and is only ever sent to
+ * Cloudflare at create time. Updating `scopes` or `comment` issues a
+ * PATCH; changing `value` or `name` replaces the secret.
+ *
+ * @section Creating a Secret
+ * @example Basic Secret
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * const apiKey = yield* Cloudflare.StoreSecret("ApiKey", {
+ *   store,
+ *   value: Redacted.make(process.env.API_KEY!),
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Reading a secret at runtime
+ * ```typescript
+ * const apiKey = yield* Cloudflare.StoreSecret.bind(ApiKey);
+ * // `apiKey` is itself an Effect that resolves to the secret value:
+ * const value = yield* apiKey;
+ * // Or call `.get()` explicitly:
+ * const value = yield* apiKey.get();
+ * ```
+ */
+export const Secret = Resource<Secret>("Cloudflare.SecretsStore.Secret")({
+  bind: SecretBinding.bind,
+});
+
+const resolveScopes = (scopes: string[] | undefined): string[] =>
+  scopes && scopes.length > 0 ? scopes : ["workers"];
+
+const resolveName = (id: string, name: string | undefined): string =>
+  name ?? id;
+
+export const StoreSecretProvider = () =>
+  Provider.effect(
+    Secret,
+    Effect.gen(function* () {
+      const createStoreSecret = yield* secretsStore.createStoreSecret;
+      const patchStoreSecret = yield* secretsStore.patchStoreSecret;
+      const deleteStoreSecret = yield* secretsStore.deleteStoreSecret;
+      const getStoreSecret = yield* secretsStore.getStoreSecret;
+      const listStoreSecrets = secretsStore.listStoreSecrets;
+
+      return {
+        stables: ["secretId", "secretName", "storeId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {} as any, news, output }) {
+          if (!isResolved(news)) return undefined;
+          const oldStoreId = output?.storeId ?? olds.store?.storeId;
+          const newStoreId = news.store.storeId;
+          const oldName = output?.secretName ?? resolveName(id, olds.name);
+          const newName = resolveName(id, news.name);
+          if (oldStoreId !== newStoreId || oldName !== newName) {
+            return { action: "replace" } as const;
+          }
+          const oldValue = olds.value ? Redacted.value(olds.value) : undefined;
+          const newValue = Redacted.value(news.value);
+          if (oldValue !== newValue) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const name = resolveName(id, news.name);
+          const scopes = resolveScopes(news.scopes);
+          const accountId = news.store.accountId;
+          const storeId = news.store.storeId;
+
+          // Observe — re-fetch the cached secret; fall back to a name
+          // scan over the store so we recover from out-of-band deletes
+          // or partial state-persistence failures.
+          let observed:
+            | {
+                id: string;
+                name: string;
+                storeId: string;
+                status: string;
+                comment?: string | null;
+              }
+            | undefined;
+          if (output?.secretId) {
+            observed = yield* getStoreSecret({
+              accountId: output.accountId,
+              storeId: output.storeId,
+              secretId: output.secretId,
+            }).pipe(
+              Effect.catchTag("SecretNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+              Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
+            );
+          }
+          if (!observed) {
+            observed = yield* listStoreSecrets
+              .items({ accountId, storeId })
+              .pipe(
+                Stream.filter((s) => s.name === name),
+                Stream.runHead,
+                Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
+                Effect.map(Option.getOrUndefined),
+              );
+          }
+
+          // Ensure — create if missing. Cloudflare reports a concurrent
+          // create as `SecretNameAlreadyExists`; tolerate by re-listing
+          // the store and adopting the secret with the same name. The
+          // value can't be read back from the API; we trust an
+          // identically-named secret reflects the same intent.
+          if (!observed) {
+            const created = yield* createStoreSecret({
+              accountId,
+              storeId,
+              body: [
+                {
+                  name,
+                  scopes,
+                  value: Redacted.value(news.value),
+                  comment: news.comment,
+                },
+              ],
+            }).pipe(
+              Effect.catchTag("SecretNameAlreadyExists", () =>
+                Effect.succeed(undefined),
+              ),
+            );
+            if (created) {
+              const secret = created.result[0]!;
+              return {
+                secretId: secret.id,
+                secretName: secret.name,
+                storeId: secret.storeId,
+                accountId,
+                status: asSecretStatus(secret.status),
+                scopes,
+                comment: secret.comment ?? undefined,
+              };
+            }
+            const existing = yield* listStoreSecrets
+              .items({ accountId, storeId })
+              .pipe(
+                Stream.filter((s) => s.name === name),
+                Stream.runHead,
+                Effect.map(Option.getOrUndefined),
+              );
+            if (!existing) {
+              return yield* Effect.die(
+                new Error(
+                  `Secret '${name}' reported as already existing in store ${storeId} but could not be found on lookup.`,
+                ),
+              );
+            }
+            observed = existing;
+          }
+
+          const patched = yield* patchStoreSecret({
+            accountId,
+            storeId,
+            secretId: observed.id,
+            scopes,
+            comment: news.comment,
+            value: Redacted.value(news.value),
+          });
+          return {
+            secretId: observed.id,
+            secretName: observed.name,
+            storeId: observed.storeId,
+            accountId,
+            status: asSecretStatus(patched.status),
+            scopes,
+            comment: patched.comment ?? undefined,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteStoreSecret({
+            accountId: output.accountId,
+            storeId: output.storeId,
+            secretId: output.secretId,
+          }).pipe(
+            Effect.tap(() => Effect.log(`deleted ${output.secretId}`)),
+            Effect.tapError(Console.log),
+            Effect.catchTag("SecretNotFound", () => Effect.void),
+            Effect.catchTag("StoreNotFound", () => Effect.void),
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+          if (output?.secretId) {
+            return yield* getStoreSecret({
+              accountId: output.accountId,
+              storeId: output.storeId,
+              secretId: output.secretId,
+            }).pipe(
+              Effect.map((secret) => ({
+                secretId: secret.id,
+                secretName: secret.name,
+                storeId: secret.storeId,
+                accountId: output.accountId,
+                status: asSecretStatus(secret.status),
+                scopes: output.scopes,
+                comment: secret.comment ?? undefined,
+              })),
+              Effect.catchTag("SecretNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+              Effect.catchTag("StoreNotFound", () => Effect.succeed(undefined)),
+            );
+          }
+          if (!olds?.store) return undefined;
+          const name = resolveName(id, olds.name);
+          const match = yield* listStoreSecrets
+            .items({
+              accountId: olds.store.accountId,
+              storeId: olds.store.storeId,
+            })
+            .pipe(
+              Stream.filter((s) => s.name === name),
+              Stream.runHead,
+              Effect.catchTag("StoreNotFound", () => Effect.succeedNone),
+              Effect.map(Option.getOrUndefined),
+            );
+          if (!match) return undefined;
+          // Secrets carry no ownership signal (Cloudflare doesn't expose
+          // tags on store secrets), so a name match is not proof we own
+          // it. Brand it `Unowned` so the engine surfaces
+          // `OwnedBySomeoneElse` unless the caller opted in via `--adopt`.
+          return Unowned({
+            secretId: match.id,
+            secretName: match.name,
+            storeId: match.storeId,
+            accountId: olds.store.accountId,
+            status: asSecretStatus(match.status),
+            scopes: resolveScopes(olds.scopes),
+            comment: match.comment ?? undefined,
+          });
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/SecretBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/SecretBinding.ts
new file mode 100644
index 00000000000..5381d993bdb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/SecretBinding.ts
@@ -0,0 +1,105 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { Secret } from "./Secret.ts";
+
+export class SecretError extends Data.TaggedError("SecretError")<{
+  message: string;
+  cause: Error;
+}> {}
+
+/**
+ * A bound secret. The client itself is an `Effect` that resolves to the
+ * secret's current value, so you can `yield* apiKey` directly. Use `.get()`
+ * for the same thing as a callable, or `.raw` for the underlying
+ * `SecretsStoreSecret` binding.
+ */
+export interface SecretClient extends Effect.Effect<
+  Redacted.Redacted<string>,
+  SecretError,
+  RuntimeContext
+> {
+  /**
+   * Effect that resolves to the raw Cloudflare `SecretsStoreSecret` binding.
+   */
+  raw: Effect.Effect<runtime.SecretsStoreSecret, never, RuntimeContext>;
+  /**
+   * Read the current value of the secret.
+   */
+  get(): Effect.Effect<Redacted.Redacted<string>, SecretError, RuntimeContext>;
+}
+
+export class SecretBinding extends Binding.Service<
+  SecretBinding,
+  (secret: Secret) => Effect.Effect<SecretClient>
+>()("Cloudflare.SecretsStore.Secret") {}
+
+export const SecretBindingLive = Layer.effect(
+  SecretBinding,
+  Effect.gen(function* () {
+    const bind = yield* SecretBindingPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (secret: Secret) {
+      yield* bind(secret);
+      const raw = Effect.sync(
+        () =>
+          (env as Record<string, runtime.SecretsStoreSecret>)[secret.LogicalId],
+      );
+      const tryPromise = <T>(
+        fn: () => Promise<T>,
+      ): Effect.Effect<T, SecretError> =>
+        Effect.tryPromise({
+          try: fn,
+          catch: (error: any) =>
+            new SecretError({
+              message: error.message ?? "Unknown error",
+              cause: error,
+            }),
+        });
+
+      const getEffect = raw.pipe(
+        Effect.flatMap((raw) =>
+          tryPromise(() => raw.get().then(Redacted.make)),
+        ),
+      );
+
+      return Object.assign(getEffect, {
+        raw,
+        get: () => getEffect,
+      });
+    });
+  }),
+);
+
+export class SecretBindingPolicy extends Binding.Policy<
+  SecretBindingPolicy,
+  (secret: Secret) => Effect.Effect<void>
+>()("Cloudflare.SecretsStore.Secret") {}
+
+export const SecretBindingPolicyLive = SecretBindingPolicy.layer.succeed(
+  Effect.fn(function* (host: ResourceLike, secret: Secret) {
+    if (isWorker(host)) {
+      yield* host.bind`${secret}`({
+        bindings: [
+          {
+            type: "secrets_store_secret",
+            name: secret.LogicalId,
+            secretName: secret.secretName,
+            storeId: secret.storeId,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`SecretBinding does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/SecretsStore.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/SecretsStore.ts
new file mode 100644
index 00000000000..a90b21632f7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/SecretsStore.ts
@@ -0,0 +1,144 @@
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as Effect from "effect/Effect";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+export type SecretsStore = Resource<
+  "Cloudflare.SecretsStore",
+  {},
+  {
+    storeId: string;
+    storeName: string;
+    accountId: string;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Secrets Store, a per-account container for secrets that
+ * can be bound into Workers with full redaction and audit support.
+ *
+ * Cloudflare enforces a limit of **one Secrets Store per account**.
+ * Deleting a store changes its ID and permanently destroys all secrets
+ * inside it. Because of this, the provider always **adopts** an existing
+ * store rather than creating a new one, and **never deletes** the store
+ * on teardown. The `read` lifecycle reports the existing account store
+ * (if any) as plain attrs, so the engine silently adopts it on cold
+ * start and `create` is only ever invoked when no store exists yet.
+ * Once it exists it is treated as account-level infrastructure that
+ * outlives any single stack.
+ *
+ * @section Creating a Store
+ * @example Basic Secrets Store (adopts existing or creates one)
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore");
+ * ```
+ *
+ * @example Adopt a specific named store
+ * ```typescript
+ * const store = yield* Cloudflare.SecretsStore("MyStore", {
+ *   name: "production-secrets",
+ * });
+ * ```
+ */
+export const SecretsStore = Resource<SecretsStore>("Cloudflare.SecretsStore");
+
+export const SecretsStoreProvider = () =>
+  Provider.effect(
+    SecretsStore,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createStore = yield* secretsStore.createStore;
+      const listStores = yield* secretsStore.listStores;
+
+      return {
+        stables: ["storeId", "storeName", "accountId"],
+        // The engine calls `read` whenever there's no prior state. Cloudflare
+        // allows exactly one Secrets Store per account, so any account that's
+        // ever provisioned one must reuse it. Returning the existing store as
+        // plain attrs makes the engine silently adopt it; `create` is only
+        // ever invoked when no store exists yet.
+        read: Effect.fn(function* ({ output }) {
+          const stores = yield* listStores({
+            accountId: output?.accountId ?? accountId,
+          });
+          const match = output?.storeId
+            ? stores.result.find((s) => s.id === output.storeId)
+            : stores.result[0];
+          if (!match) return undefined;
+          return {
+            storeId: match.id,
+            storeName: match.name,
+            accountId: output?.accountId ?? accountId,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ output }) {
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — Cloudflare permits exactly one Secrets Store per
+          // account. List the account's stores; reuse the cached one if
+          // it still exists, otherwise reuse the first one.
+          const stores = yield* listStores({ accountId: acct });
+          const observed = output?.storeId
+            ? (stores.result.find((s) => s.id === output.storeId) ??
+              stores.result[0])
+            : stores.result[0];
+
+          if (observed) {
+            return {
+              storeId: observed.id,
+              storeName: observed.name,
+              accountId: acct,
+            };
+          }
+
+          // Ensure — no store yet. Create the default. Cloudflare reports
+          // a concurrent create as `MaximumStoresExceeded`; tolerate by
+          // re-listing and adopting the now-existing store.
+          const response = yield* createStore({
+            accountId: acct,
+            // `default_secrets_store` is the name Cloudflare uses for an
+            // account's default Secrets Store.
+            name: "default_secrets_store",
+          }).pipe(
+            Effect.catchTag("MaximumStoresExceeded", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+          if (response) {
+            return {
+              storeId: response.id,
+              storeName: response.name,
+              accountId: acct,
+            };
+          }
+
+          const after = yield* listStores({ accountId: acct });
+          const first = after.result[0];
+          if (first) {
+            return {
+              storeId: first.id,
+              storeName: first.name,
+              accountId: acct,
+            };
+          }
+
+          return yield* Effect.die(
+            new Error(
+              `Cloudflare reported MaximumStoresExceeded for account ${acct} but no store could be listed.`,
+            ),
+          );
+        }),
+        delete: Effect.fn(function* () {
+          // Intentional no-op. Cloudflare only allows one Secrets Store per
+          // account and deleting it permanently destroys all secrets inside.
+          // The store is treated as shared, account-level infrastructure that
+          // should never be torn down by a single stack.
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/index.ts
new file mode 100644
index 00000000000..5474b7044f6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/SecretsStore/index.ts
@@ -0,0 +1,3 @@
+export * from "./Secret.ts";
+export * from "./SecretBinding.ts";
+export * from "./SecretsStore.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Api.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Api.ts
new file mode 100644
index 00000000000..5d63113ef5c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Api.ts
@@ -0,0 +1,350 @@
+import { Redacted } from "effect";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
+import crypto from "node:crypto";
+import {
+  BearerTokenValidator,
+  StateApi,
+  StateAuthLive,
+} from "../../State/HttpStateApi.ts";
+import { Secret } from "../SecretsStore/Secret.ts";
+import { SecretBindingLive } from "../SecretsStore/SecretBinding.ts";
+import { Worker } from "../Workers/Worker.ts";
+import Store from "./Store.ts";
+import { AuthToken } from "./Token.ts";
+
+export const STATE_STORE_SCRIPT_NAME = "alchemy-state-store" as const;
+
+/**
+ * Version of the deployed Cloudflare State Store worker contract.
+ *
+ * Bump this whenever the wire format or runtime behaviour of the
+ * worker changes in a way that an older deployed copy can no longer
+ * satisfy. Clients query `/version` on the deployed worker and
+ * compare against this constant; a mismatch (or 404) triggers a
+ * forced redeploy via the bootstrap flow.
+ */
+export const STATE_STORE_VERSION = 7 as const;
+
+/**
+ * Hard-coded OTLP/HTTP endpoints. Point at the public ingest relay
+ * defined in `stacks/otel.ts` (bound to `otel.alchemy.run`), which
+ * forwards to Axiom with the bearer token attached server-side. Hard-
+ * coded on purpose: the worker has no env-var plumbing and the relay
+ * is account-level infra that lives outside any single deploy.
+ */
+// const OTEL_TRACES_URL = "https://otel.alchemy.run/v1/traces";
+// const OTEL_METRICS_URL = "https://otel.alchemy.run/v1/metrics";
+// const OTEL_LOGS_URL = "https://otel.alchemy.run/v1/logs";
+
+/**
+ * OTLP traces + metrics + logs Layer for the state-store worker.
+ * Mirrors the CLI's `TelemetryLive` so every signal the worker emits
+ * (`Effect.withSpan`, runtime metrics, `Effect.log*`) ships to the
+ * same Axiom datasets as deploy-time CLI signals. Resource attributes
+ * brand each signal with the worker's service name + contract version
+ * so they're easy to slice in Axiom.
+ */
+// const otelResource = {
+//   serviceName: STATE_STORE_SCRIPT_NAME,
+//   serviceVersion: String(STATE_STORE_VERSION),
+//   attributes: {
+//     "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
+//     "alchemy.state_store.version": STATE_STORE_VERSION,
+//   },
+// } as const;
+
+// const TelemetryLive = Layer.mergeAll(
+//   OtlpTracer.layer({
+//     url: OTEL_TRACES_URL,
+//     resource: otelResource,
+//     exportInterval: "1 second",
+//   }),
+//   OtlpMetrics.layer({
+//     url: OTEL_METRICS_URL,
+//     resource: otelResource,
+//     exportInterval: "1 second",
+//   }),
+//   // Replace (don't merge with) the default stdout logger so worker logs
+//   // ship to Axiom instead of just `wrangler tail`.
+//   OtlpLogger.layer({
+//     url: OTEL_LOGS_URL,
+//     resource: otelResource,
+//     exportInterval: "1 second",
+//     mergeWithExisting: false,
+//   }),
+// ).pipe(
+//   Layer.provide(OtlpSerialization.layerJson),
+//   Layer.provide(FetchHttpClient.layer),
+// );
+
+/**
+ * Path on disk to *this* file, used as the worker's bundling entry.
+ *
+ * When running from source (e.g. dev / monorepo), `import.meta.url` points
+ * at `Api.ts` and we can use it directly. When the alchemy CLI is run from
+ * its published `bin/alchemy.js` bundle, this module is inlined into the
+ * CLI bundle and `import.meta.url` resolves to `bin/alchemy.js` — which
+ * has no `default` export and breaks the worker bundler with
+ * `[MISSING_EXPORT] "default" is not exported by "bin/alchemy.js"`.
+ *
+ * In the bundled case, fall back to the published source file shipped
+ * alongside the CLI under `../src/Cloudflare/StateStore/Api.ts`.
+ */
+export default Worker(
+  "Api",
+  {
+    name: STATE_STORE_SCRIPT_NAME,
+    main: import.meta.filename,
+    url: true,
+    compatibility: {
+      flags: ["nodejs_compat"],
+      date: "2026-03-17",
+    },
+  },
+  Effect.gen(function* () {
+    const remoteSecret = yield* Secret.bind(AuthToken);
+    const store = yield* Store;
+
+    const bearerTokenValidator = Layer.succeed(
+      BearerTokenValidator,
+      BearerTokenValidator.of({
+        // @ts-expect-error - TODO(sam): fix RuntimeContext color here
+        validate: Effect.fnUntraced(function* (token) {
+          const expected = yield* remoteSecret.get();
+          return !!expected &&
+            timingSafeEqual(token.trim(), Redacted.value(expected).trim())
+            ? yield* Effect.void
+            : yield* Effect.fail(new HttpApiError.Unauthorized());
+        }),
+      }),
+    );
+
+    const versionApi = HttpApiBuilder.group(StateApi, "version", (handlers) =>
+      handlers.handle("getVersion", () =>
+        Effect.succeed({ version: STATE_STORE_VERSION }).pipe(
+          Effect.withSpan("state_store.getVersion", {
+            attributes: { "alchemy.state_store.op": "getVersion" },
+          }),
+        ),
+      ),
+    );
+
+    const stateApi = HttpApiBuilder.group(StateApi, "state", (handlers) =>
+      handlers
+        .handle("listStacks", () =>
+          store
+            .getByName(Store.ROOT_DO_NAME)
+            .listStacks()
+            .pipe(
+              Effect.withSpan("state_store.listStacks", {
+                attributes: { "alchemy.state_store.op": "listStacks" },
+              }),
+            ),
+        )
+        .handle("listStages", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .listStages()
+            .pipe(
+              Effect.withSpan("state_store.listStages", {
+                attributes: {
+                  "alchemy.state_store.op": "listStages",
+                  "alchemy.state_store.stack": params.stack,
+                },
+              }),
+            ),
+        )
+        .handle("listResources", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .listResources({ stage: params.stage })
+            .pipe(
+              Effect.withSpan("state_store.listResources", {
+                attributes: {
+                  "alchemy.state_store.op": "listResources",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                },
+              }),
+            ),
+        )
+        .handle("getState", ({ params }) => {
+          const fqn = decodeURIComponent(params.fqn);
+          return store
+            .getByName(params.stack)
+            .get({ stage: params.stage, fqn })
+            .pipe(
+              Effect.withSpan("state_store.getState", {
+                attributes: {
+                  "alchemy.state_store.op": "getState",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                  "alchemy.state_store.fqn": fqn,
+                },
+              }),
+            );
+        })
+        .handle("setState", ({ params, payload }) => {
+          const fqn = decodeURIComponent(params.fqn);
+          return store
+            .getByName(params.stack)
+            .set({ stage: params.stage, fqn, value: payload as any })
+            .pipe(
+              Effect.tap(() =>
+                store
+                  .getByName(Store.ROOT_DO_NAME)
+                  .registerStack({ stack: params.stack }),
+              ),
+              Effect.withSpan("state_store.setState", {
+                attributes: {
+                  "alchemy.state_store.op": "setState",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                  "alchemy.state_store.fqn": fqn,
+                },
+              }),
+            );
+        })
+        .handle("deleteState", ({ params }) => {
+          const fqn = decodeURIComponent(params.fqn);
+          // The DO method is `remove`, not `delete` — `delete` is
+          // reserved by Cloudflare's RPC stub proxy.
+          return store
+            .getByName(params.stack)
+            .remove({ stage: params.stage, fqn })
+            .pipe(
+              Effect.asVoid,
+              Effect.withSpan("state_store.deleteState", {
+                attributes: {
+                  "alchemy.state_store.op": "deleteState",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                  "alchemy.state_store.fqn": fqn,
+                },
+              }),
+            );
+        })
+        .handle("getReplacedResources", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .getReplacedResources({ stage: params.stage })
+            .pipe(
+              Effect.withSpan("state_store.getReplacedResources", {
+                attributes: {
+                  "alchemy.state_store.op": "getReplacedResources",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                },
+              }),
+            ),
+        )
+        .handle("getStackOutput", ({ params }) =>
+          store
+            .getByName(params.stack)
+            .getOutput({ stage: params.stage })
+            .pipe(
+              Effect.withSpan("state_store.getStackOutput", {
+                attributes: {
+                  "alchemy.state_store.op": "getStackOutput",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                },
+              }),
+            ),
+        )
+        .handle("setStackOutput", ({ params, payload }) =>
+          store
+            .getByName(params.stack)
+            .setOutput({ stage: params.stage, value: payload as any })
+            .pipe(
+              Effect.tap(() =>
+                store
+                  .getByName(Store.ROOT_DO_NAME)
+                  .registerStack({ stack: params.stack }),
+              ),
+              Effect.withSpan("state_store.setStackOutput", {
+                attributes: {
+                  "alchemy.state_store.op": "setStackOutput",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": params.stage,
+                },
+              }),
+            ),
+        )
+        .handle("deleteStack", ({ params, query }) =>
+          store
+            .getByName(params.stack)
+            .deleteStack(
+              query.stage === undefined ? {} : { stage: query.stage },
+            )
+            .pipe(
+              Effect.flatMap(() =>
+                query.stage === undefined
+                  ? store
+                      .getByName(Store.ROOT_DO_NAME)
+                      .unregisterStack({ stack: params.stack })
+                  : Effect.void,
+              ),
+              Effect.asVoid,
+              Effect.withSpan("state_store.deleteStack", {
+                attributes: {
+                  "alchemy.state_store.op": "deleteStack",
+                  "alchemy.state_store.stack": params.stack,
+                  "alchemy.state_store.stage": query.stage ?? "",
+                  "alchemy.state_store.scope":
+                    query.stage === undefined ? "stack" : "stage",
+                },
+              }),
+            ),
+        ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(StateApi).pipe(
+        Layer.provide(stateApi),
+        Layer.provide(versionApi),
+        Layer.provide(StateAuthLive),
+        Layer.provide(bearerTokenValidator),
+        // The state-store worker never serves files, so HttpPlatform's
+        // file-response surface is stubbed.
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]),
+        HttpRouter.toHttpEffect,
+        // Effect.provide(TelemetryLive),
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(SecretBindingLive))),
+);
+
+/**
+ * Stub `HttpPlatform` for the worker. The state-store API never
+ * issues file responses, so both surface methods die if invoked. Lets
+ * us avoid pulling in a `FileSystem` dependency that workers don't
+ * have.
+ */
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+  fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+  fileWebResponse: () =>
+    Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+
+/**
+ * Timing-safe string comparison using the Workers runtime's built-in
+ * `crypto.subtle.timingSafeEqual`.
+ *
+ * @see https://developers.cloudflare.com/workers/examples/protect-against-timing-attacks/
+ */
+const timingSafeEqual = (a: string, b: string): boolean => {
+  const encoder = new TextEncoder();
+  const aBytes = encoder.encode(a);
+  const bBytes = encoder.encode(b);
+  if (aBytes.byteLength !== bBytes.byteLength) return false;
+  // @ts-expect-error - TODO(sam)
+  return crypto.subtle.timingSafeEqual(aBytes, bBytes);
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/State.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/State.ts
new file mode 100644
index 00000000000..9ab4edbd68c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/State.ts
@@ -0,0 +1,866 @@
+import * as SecretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import crypto from "node:crypto";
+
+import * as Config from "effect/Config";
+import { isHttpClientError } from "effect/unstable/http/HttpClientError";
+import { adopt } from "../../AdoptPolicy.ts";
+import { AuthError } from "../../Auth/AuthProvider.ts";
+import {
+  CredentialsStore,
+  CredentialsStoreLive,
+} from "../../Auth/Credentials.ts";
+import { ALCHEMY_PROFILE, ProfileLive } from "../../Auth/Profile.ts";
+import * as Cloudflare from "../../Cloudflare/Providers.ts";
+import { deploy } from "../../Deploy.ts";
+import * as Output from "../../Output.ts";
+import * as Alchemy from "../../Stack.ts";
+import { StateApi } from "../../State/HttpStateApi.ts";
+import {
+  checkHttpStateStoreAuth,
+  makeHttpStateStore,
+  type HttpStateStoreCredentials,
+} from "../../State/HttpStateStore.ts";
+import { makeLocalState } from "../../State/LocalState.ts";
+import { State, type StateService } from "../../State/State.ts";
+import {
+  recordStateStoreInit,
+  recordStateStoreOp,
+} from "../../Telemetry/Metrics.ts";
+import * as Clank from "../../Util/Clank.ts";
+import * as Access from "../Access.ts";
+import { CloudflareAuth } from "../Auth/AuthProvider.ts";
+import * as CloudflareEnvironment from "../CloudflareEnvironment.ts";
+import * as Credentials from "../Credentials.ts";
+import { EdgeSessionError, createEdgeSession } from "../EdgeSession.ts";
+import Api, { STATE_STORE_SCRIPT_NAME, STATE_STORE_VERSION } from "./Api.ts";
+import { AuthToken, AuthTokenSecretName, TokenValue } from "./Token.ts";
+
+const CI = Config.boolean("CI").pipe(Config.withDefault(false));
+
+/** Filename used for stored credentials under the profile directory. */
+const CREDENTIALS_FILE = "cloudflare-state-store";
+
+export const state = () =>
+  Layer.effect(
+    State,
+    Effect.gen(function* () {
+      const isCI = yield* CI;
+      const scriptName = STATE_STORE_SCRIPT_NAME;
+      const profileName = yield* ALCHEMY_PROFILE;
+      const localStage = `${profileName}_${scriptName}`;
+      const credStore = yield* CredentialsStore;
+      const context = yield* Effect.context<Effect.Services<typeof init>>();
+
+      const init = Effect.gen(function* () {
+        if (yield* hasLocalStack(localStage)) {
+          // if there's still a local stack, then we need to finish the bootstrap
+          // TODO(sam): what if the local stack was
+          return yield* deployWithLocalState({
+            scriptName,
+            profileName,
+            isCI,
+            force: false,
+          });
+        }
+
+        const ensureLatest = ({
+          url,
+          authToken,
+        }: {
+          url: string;
+          authToken: string;
+        }) =>
+          Effect.gen(function* () {
+            const { matches, expected, observed } =
+              yield* checkStateStoreVersion(url);
+
+            if (observed === undefined) {
+              const shouldDeploy = yield* Clank.confirm({
+                message: `Cloudflare State Store '${scriptName}' is not available. Do you want to deploy it?`,
+              });
+              if (shouldDeploy) {
+                return yield* bootstrap({
+                  workerName: scriptName,
+                  profile: profileName,
+                });
+              } else {
+                return yield* Effect.die(new Clank.PromptCancelled());
+              }
+            }
+
+            const httpState = yield* ensureAccess({ url, authToken });
+            if (matches) {
+              return httpState;
+            } else if (isCI) {
+              return yield* Effect.die(
+                new AuthError({
+                  message: `Cloudflare State store not found. Run 'alchemy bootstrap cloudflare --profile <your-ci-profile>' to deploy it first.`,
+                }),
+              );
+            } else {
+              const shouldDeploy = yield* Clank.confirm({
+                message:
+                  `Cloudflare State Store '${scriptName}' is out of date ` +
+                  `(expected v${expected}, observed v${observed ?? "unknown"})`,
+              });
+              if (shouldDeploy) {
+                const stateStoreOptions = yield* deployStateStore({
+                  stage: scriptName,
+                  state: httpState,
+                  force: false,
+                });
+                return yield* makeCloudflareStateStore(stateStoreOptions);
+              } else {
+                return yield* Effect.die(new Clank.PromptCancelled());
+              }
+            }
+          });
+
+        const ensureAccess = (credentials: HttpStateStoreCredentials) =>
+          Effect.gen(function* () {
+            const isAuth = yield* checkHttpStateStoreAuth(credentials);
+            if (!isAuth) {
+              // our token is wrong, force a refresh
+              yield* Clank.info(
+                `Cloudflare State store authentication failed, refreshing credentials...`,
+              );
+              const credentials = yield* loginWithCloudflare(profileName, true);
+              if (!(yield* checkHttpStateStoreAuth(credentials))) {
+                return yield* Effect.die(
+                  new AuthError({
+                    message: `Cloudflare State store authentication failed, after refreshing credentials.`,
+                  }),
+                );
+              }
+              return yield* makeCloudflareStateStore(credentials);
+            }
+            return yield* makeCloudflareStateStore(credentials);
+          });
+
+        const credentials = yield* credStore.read<HttpStateStoreCredentials>(
+          profileName,
+          CREDENTIALS_FILE,
+        );
+        if (credentials) {
+          return yield* ensureLatest(credentials);
+        }
+        const workerExists = yield* isStateStoreAvailable(scriptName);
+        if (workerExists) {
+          return yield* ensureLatest(
+            yield* loginWithCloudflare(profileName, false),
+          );
+        } else if (isCI) {
+          // TODO(sam): do we want to support bootstrapping the state store from CI?
+          // for now - just die here
+          return yield* Effect.die(
+            new AuthError({
+              message: `Cloudflare State store not found. Run 'alchemy bootstrap cloudflare --profile <your-ci-profile>' to deploy it first.`,
+            }),
+          );
+        } else {
+          return yield* Clank.confirm({
+            message:
+              "Cloudflare State Store not found. Do you want to deploy it?",
+          }).pipe(
+            Effect.flatMap((shouldDeploy) =>
+              shouldDeploy
+                ? bootstrap()
+                : Effect.die(new Clank.PromptCancelled()),
+            ),
+          );
+        }
+      }).pipe(recordStateStoreInit, Effect.orDie);
+
+      return yield* Effect.cached(init.pipe(Effect.provideContext(context)));
+    }),
+  ).pipe(
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(CloudflareEnvironment.fromProfile()),
+    Layer.provideMerge(CloudflareAuth),
+    Layer.provideMerge(Access.AccessLive),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.orDie,
+  );
+
+export interface BootstrapOptions {
+  /** @default "alchemy-state-store" */
+  workerName?: string;
+  /** @default false */
+  force?: boolean;
+  /** @default "default" */
+  profile?: string;
+}
+
+export const bootstrap = (options: BootstrapOptions = {}) =>
+  Effect.gen(function* () {
+    const isCI = yield* CI;
+    const profileName = options.profile ?? (yield* ALCHEMY_PROFILE);
+    const scriptName = options.workerName ?? STATE_STORE_SCRIPT_NAME;
+    const force = options.force ?? false;
+    const localStage = `${profileName}_${scriptName}`;
+    yield* Effect.annotateCurrentSpan({
+      "alchemy.state_store.script_name": scriptName,
+      "alchemy.state_store.profile": profileName,
+      "alchemy.state_store.force": force,
+      "alchemy.state_store.ci": isCI,
+    });
+    yield* annotateAccountHash();
+
+    if (yield* hasLocalStack(localStage)) {
+      // if there's a local stack still, we can assume we did not finish hoisting it, so finish that
+      yield* Clank.info(
+        `Resuming Cloudflare State Store '${scriptName}' deployment...`,
+      );
+      // resume deployment
+      return yield* deployWithLocalState({
+        scriptName,
+        profileName,
+        isCI,
+        force,
+      }).pipe(
+        Effect.tap(() =>
+          Clank.success(`Cloudflare State Store '${scriptName}' is ready.`),
+        ),
+      );
+    }
+
+    const workerExists = yield* isStateStoreAvailable(scriptName);
+    if (workerExists) {
+      // this is a regular update, let's check if it needs an update and refresh credentials
+      if (!force) {
+        yield* Clank.info(
+          `Worker '${scriptName}' already exists; adopting and refreshing credentials. ` +
+            `Use --force to redeploy.`,
+        );
+      }
+      const credentials = yield* loginWithCloudflare(
+        profileName,
+        // force refresh during
+        true,
+      );
+      const { url, authToken } = credentials;
+      if (!isCI) {
+        // we don't write credentials in CI because the file system is ephemeral
+        const store = yield* CredentialsStore;
+        yield* store.write<HttpStateStoreCredentials>(
+          profileName,
+          CREDENTIALS_FILE,
+          credentials,
+        );
+      }
+      const { matches, expected, observed } =
+        yield* checkStateStoreVersion(url);
+      const httpState = yield* makeCloudflareStateStore({ url, authToken });
+      if (!matches || force) {
+        if (matches && force) {
+          yield* Clank.info(
+            `Cloudflare State Store '${scriptName}' is up to date; force redeploying...`,
+          );
+        } else {
+          yield* Clank.info(
+            `Cloudflare State Store '${scriptName}' is out of date ` +
+              `(expected v${expected}, observed v${observed ?? "unknown"}); redeploying...`,
+          );
+        }
+        return yield* makeCloudflareStateStore(
+          yield* deployStateStore({
+            stage: scriptName,
+            state: httpState,
+            force,
+          }),
+        );
+      } else {
+        return httpState;
+      }
+    } else {
+      // fresh deploy - deploy from local for the first time
+      yield* Clank.info(`Deploying Cloudflare State Store '${scriptName}'...`);
+      return yield* deployWithLocalState({
+        scriptName,
+        profileName,
+        isCI,
+        force,
+      }).pipe(
+        Effect.tap(() =>
+          Clank.success(`Cloudflare State Store '${scriptName}' is ready.`),
+        ),
+      );
+    }
+  }).pipe(
+    Effect.withSpan("state_store.bootstrap", {
+      attributes: {
+        "alchemy.state_store.op": "bootstrap",
+        "alchemy.state_store.script_name":
+          options.workerName ?? STATE_STORE_SCRIPT_NAME,
+      },
+    }),
+  );
+
+const deployStateStore = ({
+  stage,
+  state,
+  force,
+}: {
+  stage: string;
+  state: StateService;
+  force?: boolean;
+}) =>
+  Effect.gen(function* () {
+    yield* annotateAccountHash();
+    // deploy it with local state (which we will then hoist into the Cloudflare state store)
+    const stateLayer = Layer.succeed(State, Effect.succeed(state));
+    const { url, authToken } = yield* deploy({
+      // use the script name as the stage name (so the user can have multiple state stores)
+      stage,
+      force,
+      stack: Alchemy.Stack(
+        "CloudflareStateStore",
+        {
+          providers: Cloudflare.providers(),
+          state: stateLayer,
+        },
+        Effect.gen(function* () {
+          const token = yield* TokenValue;
+          const api = yield* Api;
+          yield* AuthToken; // make sure it's in the Secrets Store
+
+          // Surface the bearer token so tests and clients can authenticate
+          // after deploy. The underlying value lives in the Cloudflare
+          // Secrets Store; this output carries the same generated string.
+          return {
+            url: api.url.as<string>(),
+            authToken: token.text.pipe(Output.map(Redacted.value)),
+          };
+        }),
+      ),
+    }).pipe(
+      // The Cloudflare State Store is account-level infrastructure that
+      // outlives any single deploy: its underlying Secrets Store and
+      // auth-token secret may already exist from a previous (possibly
+      // partially-failed) bootstrap. Opt in to adoption so the
+      // resources reconcile in place instead of failing on conflict.
+      adopt(true),
+      // TODO(sam): we should not need to do this, but types do complain. fix deploy
+      Effect.provide(stateLayer),
+    );
+
+    yield* writeCredentials(url, authToken);
+
+    // Cloudflare's worker upload is eventually consistent: the deploy
+    // call returns as soon as the script upload is accepted, but the
+    // edge can keep serving the previous version for several seconds
+    // afterwards. Block here until `/version` reports the version this
+    // CLI was built against — otherwise downstream steps (syncing
+    // local state into the deployed store, version probes during
+    // adoption) end up talking to the old worker and may either
+    // observe stale data or trip the staleness check and recurse into
+    // another redeploy.
+    yield* waitForStateStoreVersion(url);
+    return { url, authToken };
+  }).pipe(
+    Effect.withSpan("state_store.deploy", {
+      attributes: {
+        "alchemy.state_store.op": "deploy",
+      },
+    }),
+    recordStateStoreOp("deploy"),
+  );
+
+const deployWithLocalState = ({
+  scriptName,
+  isCI,
+  force,
+  profileName,
+}: {
+  scriptName: string;
+  isCI: boolean;
+  force: boolean;
+  profileName: string;
+}) =>
+  Effect.gen(function* () {
+    const localState = yield* makeLocalState();
+    const localStage = `${profileName}_${scriptName}`;
+    const remoteStage = scriptName;
+    const { authToken } = yield* deployStateStore({
+      stage: localStage,
+      state: localState,
+      force,
+    });
+
+    const { url } = yield* loginWithCloudflare(profileName, force);
+    const httpState = yield* makeCloudflareStateStore({ url, authToken });
+
+    yield* hoistBootstrapStack({
+      source: {
+        state: localState,
+        stage: localStage,
+      },
+      destination: {
+        state: httpState,
+        stage: remoteStage,
+      },
+    });
+
+    yield* localState.deleteStack({
+      stack: "CloudflareStateStore",
+      stage: localStage,
+    });
+
+    return httpState;
+  }).pipe(
+    Effect.withSpan("state_store.finish_bootstrap", {
+      attributes: {
+        "alchemy.state_store.op": "finish_bootstrap",
+        "alchemy.state_store.ci": isCI,
+      },
+    }),
+  );
+
+// check if there's a local stack that wasn't properly hoisted
+const hasLocalStack = (stage: string) =>
+  Effect.gen(function* () {
+    const localState = yield* makeLocalState();
+    return yield* Effect.map(
+      localState.listStages("CloudflareStateStore"),
+      // key off the profile name to avoid conflicts with other profiles
+      (stages) => stages.includes(stage),
+    );
+  });
+
+/**
+ * Non-destructively copy every resource in the
+ * `CloudflareStateStore/<scriptName>` stack from `source` into
+ * `destination`, leaving every other stack in `destination` untouched.
+ *
+ * This intentionally does not delete anything from `destination`: at
+ * bootstrap time the destination is the user's live remote state
+ * store, and removing entries that happen to be missing locally would
+ * be catastrophic.
+ */
+const hoistBootstrapStack = Effect.fnUntraced(function* ({
+  source,
+  destination,
+}: {
+  source: {
+    state: StateService;
+    stage: string;
+  };
+  destination: {
+    state: StateService;
+    stage: string;
+  };
+}) {
+  const stack = "CloudflareStateStore";
+  const fqns = yield* source.state.list({ stack, stage: source.stage });
+  yield* Effect.annotateCurrentSpan({
+    "alchemy.state_store.stack": stack,
+    "alchemy.state_store.stage": source.stage,
+    "alchemy.state_store.resources.count": fqns.length,
+  });
+  yield* Effect.forEach(
+    fqns,
+    Effect.fnUntraced(function* (fqn) {
+      const value = yield* source.state.get({
+        stack,
+        stage: source.stage,
+        fqn,
+      });
+      if (value) {
+        yield* destination.state
+          .set({
+            stack,
+            stage: destination.stage,
+            fqn,
+            value,
+          })
+          .pipe(
+            Effect.retry({
+              while: (error) =>
+                isHttpClientError(error.cause) &&
+                // worker can 404 for a bit on first deploy, retry these
+                error.cause.response?.status === 404,
+              schedule: Schedule.fixed(200),
+            }),
+          );
+      }
+    }),
+    { concurrency: "unbounded" },
+  );
+}, Effect.withSpan("state_store.hoist_bootstrap_stack"));
+
+/**
+ * Log in to a Cloudflare-deployed HTTP state-store.
+ *
+ * 1. Find the single account-wide Secrets Store.
+ * 2. Upload a short-lived edge-preview worker that binds the
+ *    auth-token secret and returns its value.
+ * 3. Derive the state-store worker URL from
+ *    {@link STATE_STORE_SCRIPT_NAME} and the account's workers.dev
+ *    subdomain.
+ * 4. Persist `{ url, token }` under the `http-state-store`
+ *    credentials file.
+ *
+ * Requirements are covered by the Cloudflare provider stack —
+ * `CloudflareEnvironment`, `Credentials`, `HttpClient`, and
+ * `FileSystem`.
+ */
+export const loginWithCloudflare = (profileName: string, force: boolean) =>
+  Effect.gen(function* () {
+    const credStore = yield* CredentialsStore;
+    const isCI = yield* CI;
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+
+    if (!force) {
+      // try and read from the cached credentials first if not forcing (force will always refresh)
+      const credentials = yield* credStore.read<HttpStateStoreCredentials>(
+        profileName,
+        CREDENTIALS_FILE,
+      );
+      if (credentials) {
+        return credentials;
+      }
+    }
+
+    // 1. Locate the single Secrets Store on the account.
+    const stores = yield* SecretsStore.listStores({ accountId });
+    const store = stores.result[0];
+    if (!store) {
+      return yield* Effect.fail(
+        new AuthError({
+          message:
+            "No Secrets Store found on this account. Deploy the state store first.",
+        }),
+      );
+    }
+
+    // 2. Fetch the auth-token from Secrets Store with a temporary edge-preview worker
+    const authToken = yield* readSecretViaEdge(
+      STATE_STORE_SCRIPT_NAME,
+      store.id,
+      AuthTokenSecretName,
+    ).pipe(
+      Effect.retry({
+        while: isWorkersPreviewConfigurationError,
+        schedule: Schedule.exponential(200).pipe(
+          Schedule.both(Schedule.recurs(15)),
+        ),
+      }),
+    );
+
+    // 3. Derive the deployed worker URL.
+    const { subdomain } = yield* workers.getSubdomain({ accountId });
+    const url = `https://${STATE_STORE_SCRIPT_NAME}.${subdomain}.workers.dev`;
+
+    if (!isCI) {
+      // 4. Persist credentials. The profile entry is managed by
+      //    `loadOrConfigure` when this is invoked through `configure`.
+      yield* credStore
+        .write<HttpStateStoreCredentials>(profileName, CREDENTIALS_FILE, {
+          url,
+          authToken: authToken.trim(),
+        })
+        .pipe(
+          Effect.mapError(
+            (e) =>
+              new AuthError({
+                message: "Failed to write credentials",
+                cause: e,
+              }),
+          ),
+        );
+
+      yield* Clank.success(
+        `HTTP state store credentials saved for '${profileName}'.`,
+      );
+      yield* Clank.info(`  url:     ${url}`);
+    }
+
+    return {
+      url,
+      authToken: authToken.trim(),
+    };
+  }).pipe(
+    Effect.catchTag("EdgeSessionError", (e) =>
+      Effect.fail(
+        new AuthError({
+          message: `Edge-preview secret read failed: ${e.message}`,
+          cause: e.cause,
+        }),
+      ),
+    ),
+    Effect.withSpan("state_store.login", {
+      attributes: {
+        "alchemy.state_store.op": "login",
+        "alchemy.state_store.script_name": STATE_STORE_SCRIPT_NAME,
+      },
+    }),
+  );
+
+const isStateStoreAvailable = (scriptName: string = "alchemy-state-store") =>
+  Effect.gen(function* () {
+    // otherwise, the remote one might exist
+    const { accountId } = yield* CloudflareEnvironment.CloudflareEnvironment;
+    return yield* workers.getScriptSetting({ accountId, scriptName }).pipe(
+      Effect.map((setting) => setting !== undefined),
+      Effect.catchTag("WorkerNotFound", () => Effect.succeed(false)),
+    );
+  });
+
+const makeCloudflareStateStore = Effect.fnUntraced(function* ({
+  url,
+  authToken,
+}: {
+  url: string;
+  authToken: string;
+}) {
+  const access = yield* Access.Access;
+  const accessHeaders = yield* access.getAccessHeaders(new URL(url).host);
+  return yield* makeHttpStateStore({
+    url,
+    authToken,
+    transformClient: HttpClientRequest.setHeaders(accessHeaders),
+    id: "cloudflare-http",
+  });
+});
+
+class StateStoreVersionNotReady extends Error {
+  readonly _tag = "StateStoreVersionNotReady";
+  constructor(
+    readonly expected: number,
+    readonly observed: number | undefined,
+  ) {
+    super(
+      `Cloudflare State Store version not ready (expected v${expected}, observed v${observed ?? "unknown"}).`,
+    );
+  }
+}
+
+const waitForStateStoreVersion = (url: string) =>
+  Effect.gen(function* () {
+    const { matches, expected, observed } = yield* checkStateStoreVersion(url);
+    if (!matches) {
+      return yield* Effect.fail(
+        new StateStoreVersionNotReady(expected, observed),
+      );
+    }
+  }).pipe(
+    Effect.retry({
+      while: (error) => error instanceof StateStoreVersionNotReady,
+      // Edge propagation is usually sub-second; poll fast and cap the
+      // overall wait at ~10s so we fail loudly if something is really
+      // wrong rather than silently hanging.
+      schedule: Schedule.spaced("200 millis").pipe(
+        Schedule.both(Schedule.recurs(50)),
+      ),
+    }),
+    Effect.withSpan("state_store.wait_for_version", {
+      attributes: {
+        "alchemy.state_store.op": "wait_for_version",
+        "alchemy.state_store.url": url,
+        "alchemy.state_store.expected_version": STATE_STORE_VERSION,
+      },
+    }),
+  );
+
+const checkStateStoreVersion = (url: string) =>
+  Effect.gen(function* () {
+    const client = yield* HttpApiClient.make(StateApi, { baseUrl: url });
+    const isAvailable = yield* Effect.cached(
+      isStateStoreAvailable(STATE_STORE_SCRIPT_NAME),
+    );
+    // The /version route may 404 transiently after a fresh deploy
+    // while Cloudflare propagates the new script to the edge, and may
+    // also surface transport-level blips on cold workers.dev hosts.
+    // Retry the probe itself for ~10s before giving up — only after
+    // exhausting that budget do we collapse to `undefined` and let
+    // the caller treat it as a version mismatch.
+    const result = yield* client.version.getVersion().pipe(
+      Effect.catchTag("HttpClientError", (e) =>
+        // if we get a 404 here, it means we assumed the worker shoudl exist, but it does not
+        // we should do a check to see if it does
+        e.response?.status === 404
+          ? isAvailable.pipe(
+              Effect.flatMap((isAvailable) =>
+                // if the worker is available, then we should assume it was recently created and retry by propagating the error
+                // otherwise, return undefined (we don't know the version, there is no worker)
+                isAvailable ? Effect.fail(e) : Effect.succeed(undefined),
+              ),
+            )
+          : Effect.fail(e),
+      ),
+      Effect.retry({
+        schedule: Schedule.spaced("250 millis").pipe(
+          Schedule.both(Schedule.recurs(40)),
+        ),
+      }),
+      Effect.catch(() => Effect.succeed(undefined)),
+    );
+    const matches = result?.version === STATE_STORE_VERSION;
+    yield* Effect.annotateCurrentSpan({
+      "alchemy.state_store.expected_version": STATE_STORE_VERSION,
+      "alchemy.state_store.observed_version": result?.version ?? -1,
+      "alchemy.state_store.version_match": matches,
+    });
+    return {
+      matches,
+      expected: STATE_STORE_VERSION,
+      observed: result?.version,
+    };
+  }).pipe(
+    Effect.withSpan("state_store.check_version", {
+      attributes: { "alchemy.state_store.op": "check_version" },
+    }),
+  );
+
+/**
+ * Tiny ES-module worker that reads `env.SECRET.get()` and echoes it
+ * back. Uploaded as an ephemeral edge-preview, called once, then
+ * discarded — see {@link readSecretViaEdge}.
+ */
+const SECRET_PROBE_SOURCE = `export default {
+  async fetch(_request, env) {
+    try {
+      const value = await env.SECRET.get();
+      return new Response(value ?? "", { status: 200, headers: { "content-type": "text/plain" } });
+    } catch (e) {
+      return new Response("Error: " + (e && e.message ? e.message : String(e)), { status: 500 });
+    }
+  },
+};`;
+
+/**
+ * Upload an ephemeral edge-preview build of the given (already
+ * deployed) script that binds the requested Secrets Store secret,
+ * call it once with the preview token, and return the decoded value.
+ * The Cloudflare REST API deliberately hides secret values; only
+ * worker bindings can resolve them, so this is the out-of-band path.
+ *
+ * `scriptName` MUST be a script that is already deployed on the
+ * account with workers.dev enabled — the `cf-workers-preview-token`
+ * header swaps our probe code in for an existing route, it does not
+ * create one. Using an undeployed name (or a deployed script that
+ * doesn't have workers.dev enabled) makes the workers.dev edge serve
+ * a generic Cloudflare 400 HTML error page instead of routing to the
+ * preview. The state-store script itself satisfies both conditions.
+ */
+const readSecretViaEdge = (
+  scriptName: string,
+  storeId: string,
+  secretName: string,
+) =>
+  Effect.gen(function* () {
+    const http = yield* HttpClient.HttpClient;
+    const file = new File([SECRET_PROBE_SOURCE], "worker.js", {
+      type: "application/javascript+module",
+    });
+    const session = yield* createEdgeSession({
+      scriptName,
+      files: [file],
+      bindings: [
+        { type: "secrets_store_secret", name: "SECRET", secretName, storeId },
+      ],
+    });
+    const response = yield* http.get(session.url, {
+      headers: session.headers,
+    });
+    if (response.status !== 200) {
+      const body = yield* response.text.pipe(
+        Effect.catch(() => Effect.succeed("")),
+      );
+      // TEMP(sam): dump the full body so we can capture the exact
+      // Cloudflare error page when the probe fails in the wild. Drop
+      // this once we've confirmed the routing fix covers all the
+      // observed failure modes.
+      yield* Effect.logWarning(
+        `Secret probe failed (${response.status}) at ${session.url}\n${body}`,
+      );
+      return yield* Effect.fail(
+        new EdgeSessionError({
+          message: `Secret probe returned ${response.status}: ${body.slice(0, 200)}`,
+        }),
+      );
+    }
+    return yield* response.text;
+  }).pipe(
+    Effect.mapError((cause) =>
+      cause instanceof EdgeSessionError
+        ? cause
+        : new EdgeSessionError({ message: "Failed to read secret", cause }),
+    ),
+    Effect.withSpan("state_store.read_secret_via_edge", {
+      attributes: {
+        "alchemy.state_store.op": "read_secret_via_edge",
+        "alchemy.state_store.script_name": scriptName,
+        "alchemy.state_store.secret_name": secretName,
+      },
+    }),
+  );
+
+const writeCredentials = (url: string, authToken: string) =>
+  Effect.gen(function* () {
+    const profileName = yield* ALCHEMY_PROFILE;
+    const credStore = yield* CredentialsStore;
+    yield* credStore.write<HttpStateStoreCredentials>(
+      profileName,
+      CREDENTIALS_FILE,
+      {
+        url,
+        authToken,
+      },
+    );
+  });
+
+const isWorkersPreviewConfigurationError = (error: unknown) =>
+  error instanceof EdgeSessionError &&
+  (error.message.includes("Invalid Workers Preview configuration") ||
+    error.message.includes("Error 1031"));
+
+/**
+ * SHA-256 hex digest of the Cloudflare account ID. Used as a stable
+ * pseudonymous identifier on telemetry spans so the dashboard can
+ * count distinct state-store deployments without leaking the raw
+ * accountId. Mirrors the `alchemy.git.origin_hash` pattern in
+ * `Telemetry/Attributes.ts`.
+ */
+const hashAccountId = (accountId: string) =>
+  Effect.sync(() =>
+    crypto.createHash("sha256").update(accountId).digest("hex"),
+  );
+
+/**
+ * Best-effort Cloudflare-account-hash annotation on the current span.
+ * Resolves the accountId from {@link CloudflareEnvironment} and
+ * attaches `alchemy.cloudflare.account_hash` to whichever span is
+ * active. Silently no-ops if the environment isn't resolvable so
+ * State-store layer construction still succeeds in degraded paths.
+ *
+ * `noTrack` controls whether the hash is attached:
+ *   - `true`  — never annotate (caller-level opt-out).
+ *   - `false` — always annotate, regardless of env.
+ *   - `undefined` — fall back to the `NO_TRACK` env var; default off.
+ */
+const annotateAccountHash = (noTrack?: boolean) =>
+  Effect.gen(function* () {
+    if (noTrack === true) return;
+    if (noTrack === undefined) {
+      const fromEnv = yield* Config.boolean("NO_TRACK").pipe(
+        Config.withDefault(false),
+      );
+      if (fromEnv) return;
+    }
+    const env = yield* Effect.serviceOption(
+      CloudflareEnvironment.CloudflareEnvironment,
+    );
+    if (env._tag !== "Some") return;
+    const hash = yield* hashAccountId(env.value.accountId);
+    yield* Effect.annotateCurrentSpan("alchemy.cloudflare.account_hash", hash);
+  }).pipe(Effect.catch(() => Effect.void));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Store.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Store.ts
new file mode 100644
index 00000000000..e22d2c619a6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Store.ts
@@ -0,0 +1,314 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+import { pipe } from "effect/Function";
+import type {
+  ReplacedResourceState,
+  ResourceState,
+} from "../../State/ResourceState.ts";
+import { encodeState } from "../../State/StateEncoding.ts";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
+import { EncryptionKey } from "./Token.ts";
+
+export default class Store extends DurableObjectNamespace<Store>()(
+  "Store",
+  Effect.gen(function* () {
+    // Outer (class-level) phase — resolve the binding factory once.
+    // The actual secret read happens inside each DO instance below,
+    // since `SecretClient.get()` needs the per-instance worker env.
+    const encryptionSecret = yield* Secret.Secret.bind(EncryptionKey);
+
+    return Effect.gen(function* () {
+      // Inner (per-instance) phase — set up storage and the AES key.
+      // The key is imported once per DO boot and reused thereafter.
+      const doState = yield* DurableObjectState;
+      const storage = doState.storage;
+
+      const keyHex = yield* encryptionSecret
+        .get()
+        .pipe(Effect.map(Redacted.value), Effect.orDie);
+      const cryptoKey = yield* Effect.tryPromise(() =>
+        crypto.subtle.importKey(
+          "raw",
+          Buffer.from(keyHex, "hex"),
+          { name: "AES-CTR" },
+          false,
+          ["encrypt", "decrypt"],
+        ),
+      ).pipe(Effect.orDie);
+
+      const encryptValue = (value: unknown) =>
+        Effect.tryPromise(async () => {
+          const plaintext = new TextEncoder().encode(
+            JSON.stringify(encodeState(value)),
+          );
+          const counter = crypto.getRandomValues(allocBytes(NONCE_BYTES));
+          const ct = new Uint8Array(
+            await crypto.subtle.encrypt(
+              { name: "AES-CTR", counter, length: 64 },
+              cryptoKey,
+              plaintext,
+            ),
+          );
+          // Frame as a single base64 string: nonce || ciphertext.
+          return Buffer.concat([counter, ct]).toString("base64");
+        }).pipe(Effect.orDie);
+
+      const decryptEntry = (entry: string) =>
+        Effect.tryPromise(async () => {
+          const framed = Buffer.from(entry, "base64");
+          const counter = framed.subarray(0, NONCE_BYTES);
+          const ciphertext = framed.subarray(NONCE_BYTES);
+          let pt;
+          try {
+            pt = await crypto.subtle.decrypt(
+              { name: "AES-CTR", counter, length: 64 },
+              cryptoKey,
+              ciphertext,
+            );
+          } catch (error) {
+            // We return undefined here because in 2.0.0-beta.45, we rotated encryption keys unnecessarily.
+            // So, we catch a decryption error here and return undefined instead.
+            // The engine should reconcile, hopefully, but users may lose some data
+            console.error(
+              "Error decrypting entry. Returning undefined instead.",
+              error,
+            );
+            return undefined;
+          }
+          return JSON.parse(new TextDecoder().decode(pt)) as ResourceState;
+        }).pipe(Effect.orDie);
+
+      return {
+        // -- Root DO methods -----------------------------------------
+
+        /**
+         * (Root DO only) List every stack name ever registered.
+         */
+        listStacks: Effect.fnUntraced(function* () {
+          const entries = yield* storage.list<number>({
+            prefix: STACK_INDEX_PREFIX,
+          });
+          const stacks: string[] = [];
+          for (const key of entries.keys()) {
+            stacks.push(key.slice(STACK_INDEX_PREFIX.length));
+          }
+          return stacks;
+        }),
+
+        /**
+         * (Root DO only) Register a stack name. Idempotent — safe to
+         * call on every `set` to the corresponding stack DO.
+         */
+        registerStack: ({ stack }: { stack: string }) =>
+          storage.put(`${STACK_INDEX_PREFIX}${stack}`, 1),
+
+        /**
+         * (Root DO only) Remove a stack name from the global index.
+         */
+        unregisterStack: ({ stack }: { stack: string }) =>
+          storage.delete(`${STACK_INDEX_PREFIX}${stack}`),
+
+        // -- Stack DO methods ----------------------------------------
+
+        /** (Stack DO only) List stages with at least one resource. */
+        listStages: () =>
+          storage
+            .list<string>({
+              prefix: RESOURCE_PREFIX,
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const stages = new Set<string>();
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) stages.add(parsed.stage);
+                }
+                return [...stages];
+              }),
+            ),
+
+        /** (Stack DO only) List every resource FQN in a stage. */
+        listResources: ({ stage }: { stage: string }) =>
+          storage
+            .list<string>({
+              prefix: stagePrefix(stage),
+            })
+            .pipe(
+              Effect.map((entries) => {
+                const fqns: string[] = [];
+                for (const key of entries.keys()) {
+                  const parsed = parseResourceKey(key);
+                  if (parsed) fqns.push(parsed.fqn);
+                }
+                return fqns;
+              }),
+            ),
+
+        /**
+         * (Stack DO only) Get a resource by (stage, fqn). Returns
+         * null if missing.
+         */
+        get: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage
+            .get<string>(resourceKey(stage, fqn))
+            .pipe(
+              Effect.flatMap((entry) =>
+                entry == null ? Effect.succeed(undefined) : decryptEntry(entry),
+              ),
+            ),
+
+        /**
+         * (Stack DO only) Persist a resource. Returns the stored
+         * value unchanged.
+         */
+        set: ({
+          stage,
+          fqn,
+          value,
+        }: {
+          stage: string;
+          fqn: string;
+          value: ResourceState;
+        }) =>
+          encryptValue(value).pipe(
+            Effect.flatMap((encrypted) =>
+              storage
+                .put<string>(resourceKey(stage, fqn), encrypted)
+                .pipe(Effect.asVoid),
+            ),
+            Effect.map(() => value),
+          ),
+
+        /**
+         * (Stack DO only) Delete a resource. Idempotent.
+         *
+         * Exposed as `remove` (not `delete`) because Cloudflare's
+         * Durable Object RPC stub reserves `delete` and refuses to
+         * proxy the call, surfacing as "RPC receiver does not
+         * implement the method 'delete'".
+         */
+        remove: ({ stage, fqn }: { stage: string; fqn: string }) =>
+          storage.delete(resourceKey(stage, fqn)),
+
+        /**
+         * (Stack DO only) Delete every resource in this stack, or every
+         * resource in a single stage when specified.
+         */
+        deleteStack: ({ stage }: { stage?: string } = {}) =>
+          stage === undefined
+            ? storage.deleteAll()
+            : storage.list<string>({ prefix: stagePrefix(stage) }).pipe(
+                Effect.flatMap((entries) => {
+                  const keys = [...entries.keys(), stackOutputKey(stage)];
+                  return storage.delete(keys).pipe(Effect.asVoid);
+                }),
+              ),
+
+        /**
+         * (Stack DO only) Read the persisted stack output for `stage`.
+         * Returns `undefined` when the stage has not been deployed.
+         */
+        getOutput: ({ stage }: { stage: string }) =>
+          storage
+            .get<string>(stackOutputKey(stage))
+            .pipe(
+              Effect.flatMap((entry) =>
+                entry == null ? Effect.succeed(undefined) : decryptEntry(entry),
+              ),
+            ),
+
+        /**
+         * (Stack DO only) Persist the resolved stack output for
+         * `stage`. Returns the stored value unchanged.
+         */
+        setOutput: ({ stage, value }: { stage: string; value: any }) =>
+          encryptValue(value).pipe(
+            Effect.flatMap((encrypted) =>
+              storage
+                .put<string>(stackOutputKey(stage), encrypted)
+                .pipe(Effect.asVoid),
+            ),
+            Effect.map(() => value),
+          ),
+
+        /**
+         * (Stack DO only) Return every resource in a stage whose
+         * `status === "replaced"`. Each entry is decrypted so the
+         * `status` field can be inspected.
+         */
+        getReplacedResources: ({ stage }: { stage: string }) =>
+          pipe(
+            storage.list<string>({ prefix: stagePrefix(stage) }),
+            Effect.map((entries) =>
+              [...entries.values()].filter((e): e is string => !!e),
+            ),
+            Effect.flatMap(
+              Effect.forEach(decryptEntry, { concurrency: "unbounded" }),
+            ),
+            Effect.map((decoded) =>
+              decoded.filter(
+                (d): d is ReplacedResourceState => d?.status === "replaced",
+              ),
+            ),
+          ),
+      };
+    });
+  }),
+) {
+  /**
+   * Well-known DO name whose sole job is to track the set of stacks
+   * that have ever had resources written. `listStacks` queries it;
+   * every `set` asks it to register the stack (idempotent).
+   */
+  static readonly ROOT_DO_NAME = "__root__" as const;
+}
+
+/** NUL byte separator for composite keys. */
+const SEP = "\x00";
+
+/** Key prefix for resource entries in a stack DO. */
+const RESOURCE_PREFIX = `r${SEP}`;
+
+/** Key prefix for stack-output entries in a stack DO. */
+const STACK_OUTPUT_PREFIX = `o${SEP}`;
+
+/** Key prefix for stack-index entries in the root DO. */
+const STACK_INDEX_PREFIX = "s:";
+
+/** AES-CTR counter block length. */
+const NONCE_BYTES = 16;
+
+/** Build the resource key inside a *stack DO*. */
+const resourceKey = (stage: string, fqn: string) =>
+  `${RESOURCE_PREFIX}${stage}${SEP}${fqn}`;
+
+/** Prefix matching every resource key inside a specific stage. */
+const stagePrefix = (stage: string) => `${RESOURCE_PREFIX}${stage}${SEP}`;
+
+/** Build the stack-output key inside a *stack DO*. */
+const stackOutputKey = (stage: string) => `${STACK_OUTPUT_PREFIX}${stage}`;
+
+/**
+ * Parse a resource key back into its (stage, fqn) tuple. Returns
+ * undefined for keys that do not match the expected shape.
+ */
+const parseResourceKey = (
+  key: string,
+): { stage: string; fqn: string } | undefined => {
+  if (!key.startsWith(RESOURCE_PREFIX)) return undefined;
+  const rest = key.slice(RESOURCE_PREFIX.length);
+  const sep = rest.indexOf(SEP);
+  if (sep < 0) return undefined;
+  return { stage: rest.slice(0, sep), fqn: rest.slice(sep + 1) };
+};
+
+/**
+ * Allocate a `Uint8Array` over a fresh `ArrayBuffer` (not shared) so
+ * the resulting buffer satisfies Web Crypto's `BufferSource` type
+ * constraint under strict DOM typings.
+ */
+const allocBytes = (size: number): Uint8Array<ArrayBuffer> =>
+  new Uint8Array(new ArrayBuffer(size));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Token.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Token.ts
new file mode 100644
index 00000000000..08776963ea9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/Token.ts
@@ -0,0 +1,68 @@
+import { Random } from "../../Random.ts";
+import * as Effect from "effect/Effect";
+import * as Secret from "../SecretsStore/Secret.ts";
+import { SecretsStore } from "../SecretsStore/SecretsStore.ts";
+
+/**
+ * The account-wide Secrets Store that backs every secret used by the
+ * state store worker. `SecretsStore` adopts the single store that
+ * already exists on the account, or creates one if none exists.
+ */
+export const Store = SecretsStore("StateStoreSecrets");
+
+/**
+ * The randomly generated bearer token value. Generated once on create
+ * and persisted in alchemy state, so subsequent deploys keep the same
+ * value unless the resource is replaced.
+ */
+export const TokenValue = Random("StateStoreAuthTokenValue");
+
+/**
+ * The name of the secret in the Cloudflare Secrets Store that contains the bearer token.
+ */
+export const AuthTokenSecretName = "AlchemyStateStoreToken" as const;
+
+/**
+ * The bearer token used to authenticate every request to the state
+ * store worker. The value comes from {@link TokenValue} and lives in
+ * the account-wide Cloudflare Secrets Store so it can be bound into
+ * the worker without bundling the raw string.
+ */
+export const AuthToken = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* TokenValue;
+  return yield* Secret.Secret(AuthTokenSecretName, {
+    name: AuthTokenSecretName,
+    store,
+    value: random.text,
+  });
+});
+
+/**
+ * A 32-byte (256-bit) random value, hex-encoded, that seeds the
+ * AES-CTR key used to encrypt resource state at rest. Generated once
+ * and persisted, so the ciphertext stored by the Durable Object can
+ * always be decrypted by subsequent worker boots.
+ */
+export const EncryptionKeyValue = Random("StateStoreEncryptionKeyValue", {
+  bytes: 32,
+});
+
+export const EncryptionKeySecretName =
+  "AlchemyStateStoreEncryptionKey" as const;
+
+/**
+ * The encryption key secret. The raw hex-encoded bytes live inside
+ * Cloudflare's Secrets Store; the Durable Object binds to it at
+ * runtime to derive an AES-CTR `CryptoKey` via Web Crypto's
+ * `subtle.importKey`.
+ */
+export const EncryptionKey = Effect.gen(function* () {
+  const store = yield* Store;
+  const random = yield* EncryptionKeyValue;
+  return yield* Secret.Secret("StateStoreEncryptionKey", {
+    name: EncryptionKeySecretName,
+    store,
+    value: random.text,
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/index.ts
new file mode 100644
index 00000000000..9a4c16349cc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/StateStore/index.ts
@@ -0,0 +1 @@
+export { bootstrap, state, type BootstrapOptions } from "./State.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/Tunnel.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/Tunnel.ts
new file mode 100644
index 00000000000..50bd4db7c45
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/Tunnel.ts
@@ -0,0 +1,369 @@
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+export type TunnelProps = {
+  /**
+   * Name for the tunnel. If omitted, a unique name will be generated.
+   *
+   * Tunnel names are immutable -- changing the name triggers replacement.
+   *
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Secret used by the tunnel connector. If omitted, Cloudflare generates one.
+   * Must be at least 32 bytes encoded as base64.
+   */
+  tunnelSecret?: Redacted.Redacted<string>;
+  /**
+   * Where the tunnel configuration lives.
+   * - `"cloudflare"` - managed remotely via the API (default)
+   * - `"local"` - managed via a YAML file on the origin
+   *
+   * @default "cloudflare"
+   */
+  configSrc?: "cloudflare" | "local";
+  /**
+   * Ingress rules describing how requests are routed. Must end with a
+   * catch-all rule (e.g. `{ service: "http_status:404" }`). Only honored when
+   * `configSrc` is `"cloudflare"`.
+   */
+  ingress?: Tunnel.IngressRule[];
+  /**
+   * Origin request configuration applied to all rules. Only honored when
+   * `configSrc` is `"cloudflare"`.
+   */
+  originRequest?: Tunnel.OriginRequestConfig;
+  /**
+   * Whether to adopt an existing tunnel with the same name when create fails.
+   *
+   * @default false
+   */
+  adopt?: boolean;
+};
+
+export declare namespace Tunnel {
+  /**
+   * Ingress rule describing how a hostname or path is routed.
+   */
+  export interface IngressRule {
+    hostname?: string;
+    service: string;
+    path?: string;
+    originRequest?: OriginRequestConfig;
+  }
+  /**
+   * Origin request configuration applied per-rule or globally.
+   */
+  export interface OriginRequestConfig {
+    connectTimeout?: number;
+    tlsTimeout?: number;
+    tcpKeepAlive?: number;
+    noHappyEyeballs?: boolean;
+    keepAliveConnections?: number;
+    keepAliveTimeout?: number;
+    http2Origin?: boolean;
+    httpHostHeader?: string;
+    caPool?: string;
+    noTLSVerify?: boolean;
+    disableChunkedEncoding?: boolean;
+    proxyType?: string;
+    matchSNItoHost?: boolean;
+    originServerName?: string;
+  }
+}
+
+export type Tunnel = Resource<
+  "Cloudflare.Tunnel",
+  TunnelProps,
+  {
+    tunnelId: string;
+    tunnelName: string;
+    accountTag: string | undefined;
+    accountId: string;
+    createdAt: string | undefined;
+    deletedAt: string | undefined;
+    configSrc: "cloudflare" | "local";
+    token: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Tunnel that establishes a secure connection from your origin to
+ * Cloudflare's edge.
+ *
+ * @section Creating a Tunnel
+ * @example Basic tunnel
+ * ```typescript
+ * const tunnel = yield* Cloudflare.Tunnel("MyTunnel");
+ * // Run the connector with: cloudflared tunnel run --token <Redacted.value(tunnel.token)>
+ * ```
+ *
+ * @example Tunnel with ingress rules
+ * ```typescript
+ * const tunnel = yield* Cloudflare.Tunnel("Web", {
+ *   ingress: [
+ *     { hostname: "app.example.com", service: "http://localhost:3000" },
+ *     { service: "http_status:404" },
+ *   ],
+ * });
+ * ```
+ *
+ * @section Managing Tunnels at Runtime
+ * The `Tunnel` resource manages a single, statically-declared tunnel as part of
+ * a stack. To create, read, update, or delete tunnels *on the fly* from inside
+ * a deployed Worker, bind one of the runtime tunnel clients instead. Each
+ * provisions a least-privilege {@link AccountApiToken} and injects it into the
+ * Worker:
+ *
+ * - {@link TunnelRead} — read-only (`get`, `list`, `getToken`,
+ *   `getConfiguration`); scoped to `Cloudflare Tunnel Read`.
+ * - {@link TunnelWrite} — mutating (`create`, `update`, `delete`,
+ *   `putConfiguration`); scoped to `Cloudflare Tunnel Write`.
+ * - {@link TunnelReadWrite} — the full CRUD surface; scoped to both.
+ *
+ * @example Create a tunnel on demand from a Worker
+ * ```typescript
+ * // init
+ * const tunnels = yield* Cloudflare.TunnelReadWrite.bind();
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ *     const token = yield* tunnels.getToken(tunnel.id!);
+ *     return HttpServerResponse.json({ id: tunnel.id, token });
+ *   }),
+ * };
+ * ```
+ */
+export const Tunnel = Resource<Tunnel>("Cloudflare.Tunnel");
+
+export const TunnelProvider = () =>
+  Provider.effect(
+    Tunnel,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createTunnel = yield* zeroTrust.createTunnelCloudflared;
+      const getTunnel = yield* zeroTrust.getTunnelCloudflared;
+      const deleteTunnel = yield* zeroTrust.deleteTunnelCloudflared;
+      const putConfiguration =
+        yield* zeroTrust.putTunnelCloudflaredConfiguration;
+      const getToken = yield* zeroTrust.getTunnelCloudflaredToken;
+      const listTunnels = zeroTrust.listTunnels;
+
+      const createTunnelName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          if (name) return name;
+          return yield* createPhysicalName({ id });
+        });
+
+      const writeConfiguration = (
+        tunnelId: string,
+        ingress: Tunnel.IngressRule[] | undefined,
+        originRequest: Tunnel.OriginRequestConfig | undefined,
+      ) =>
+        Effect.gen(function* () {
+          if (!ingress && !originRequest) return;
+          yield* putConfiguration({
+            accountId,
+            tunnelId,
+            config: { ingress, originRequest },
+          });
+        });
+
+      const findTunnelByName = (name: string) =>
+        listTunnels
+          .items({
+            accountId,
+            name,
+            isDeleted: false,
+            tunTypes: ["cfd_tunnel"],
+          })
+          .pipe(
+            Stream.filter((t) => t.name === name && !t.deletedAt),
+            Stream.runHead,
+            Effect.map(Option.getOrUndefined),
+          );
+
+      return {
+        stables: ["tunnelId", "accountTag", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const name = yield* createTunnelName(id, news.name);
+          const oldName = output?.tunnelName
+            ? output.tunnelName
+            : yield* createTunnelName(id, olds.name);
+          if (name !== oldName) {
+            return { action: "replace" } as const;
+          }
+          const oldSecret = olds.tunnelSecret
+            ? Redacted.value(olds.tunnelSecret)
+            : undefined;
+          const newSecret = news.tunnelSecret
+            ? Redacted.value(news.tunnelSecret)
+            : undefined;
+          if (oldSecret !== newSecret) {
+            return { action: "replace" } as const;
+          }
+          if (
+            (olds.configSrc ?? "cloudflare") !==
+            (news.configSrc ?? "cloudflare")
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          const name = yield* createTunnelName(id, news.name);
+          const configSrc = news.configSrc ?? output?.configSrc ?? "cloudflare";
+          const tunnelSecret = news.tunnelSecret
+            ? Redacted.value(news.tunnelSecret)
+            : undefined;
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — re-fetch the cached tunnel; fall back to a name
+          // lookup so we recover from out-of-band deletes or partial
+          // state-persistence failures.
+          let observed:
+            | {
+                id?: string | null;
+                name?: string | null;
+                accountTag?: string | null;
+                createdAt?: string | null;
+                deletedAt?: string | null;
+              }
+            | undefined;
+          if (output?.tunnelId) {
+            observed = yield* getTunnel({
+              accountId: acct,
+              tunnelId: output.tunnelId,
+            }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+          }
+          if (!observed) {
+            observed = yield* findTunnelByName(name);
+          }
+
+          // Ensure — create if missing. Cloudflare rejects a duplicate
+          // name with a generic error; tolerate by adopting the
+          // existing tunnel when the caller opted into adoption.
+          if (!observed || !observed.id) {
+            observed = yield* createTunnel({
+              accountId: acct,
+              name,
+              configSrc,
+              tunnelSecret,
+            }).pipe(
+              Effect.catch((err) =>
+                Effect.gen(function* () {
+                  if (!news.adopt) return yield* Effect.fail(err);
+                  const existing = yield* findTunnelByName(name);
+                  if (!existing || !existing.id) {
+                    return yield* Effect.fail(err);
+                  }
+                  return existing;
+                }),
+              ),
+            );
+          }
+
+          // Sync — when the tunnel is managed in Cloudflare, push the
+          // desired ingress + originRequest configuration. The PUT is
+          // idempotent: equal payloads converge to the same state, so we
+          // always push to apply drift.
+          if (configSrc !== "local") {
+            yield* writeConfiguration(
+              observed.id!,
+              news.ingress,
+              news.originRequest,
+            );
+          }
+
+          const token = yield* getToken({
+            accountId: acct,
+            tunnelId: observed.id!,
+          });
+
+          return {
+            tunnelId: observed.id!,
+            tunnelName: observed.name ?? name,
+            accountTag: observed.accountTag ?? undefined,
+            accountId: acct,
+            createdAt: observed.createdAt ?? undefined,
+            deletedAt: observed.deletedAt ?? undefined,
+            configSrc,
+            token: Redacted.make(token),
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteTunnel({
+            accountId: output.accountId,
+            tunnelId: output.tunnelId,
+          }).pipe(Effect.catch(() => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.tunnelId) {
+            return yield* getTunnel({
+              accountId: output.accountId,
+              tunnelId: output.tunnelId,
+            }).pipe(
+              Effect.flatMap((t) =>
+                getToken({
+                  accountId: output.accountId,
+                  tunnelId: output.tunnelId,
+                }).pipe(
+                  Effect.map((token) => ({
+                    tunnelId: t.id ?? output.tunnelId,
+                    tunnelName: t.name ?? output.tunnelName,
+                    accountTag: t.accountTag ?? output.accountTag,
+                    accountId: output.accountId,
+                    createdAt: t.createdAt ?? output.createdAt,
+                    deletedAt: t.deletedAt ?? output.deletedAt,
+                    configSrc: ((
+                      t as { configSrc?: "cloudflare" | "local" | null }
+                    ).configSrc ??
+                      output.configSrc ??
+                      "cloudflare") as "cloudflare" | "local",
+                    token: Redacted.make(token),
+                  })),
+                ),
+              ),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+          }
+          const name = yield* createTunnelName(id, olds?.name);
+          const existing = yield* findTunnelByName(name);
+          if (!existing || !existing.id) return undefined;
+          const token = yield* getToken({
+            accountId,
+            tunnelId: existing.id,
+          });
+          return {
+            tunnelId: existing.id,
+            tunnelName: existing.name ?? name,
+            accountTag: existing.accountTag ?? undefined,
+            accountId,
+            createdAt: existing.createdAt ?? undefined,
+            deletedAt: existing.deletedAt ?? undefined,
+            configSrc: ((
+              existing as { configSrc?: "cloudflare" | "local" | null }
+            ).configSrc ?? "cloudflare") as "cloudflare" | "local",
+            token: Redacted.make(token),
+          };
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelBinding.ts
new file mode 100644
index 00000000000..ed3b5664630
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelBinding.ts
@@ -0,0 +1,114 @@
+import {
+  Credentials,
+  fromApiToken,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import type * as Binding from "../../Binding.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { ApiTokenPermissionGroupRef } from "../ApiToken/Common.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { Worker } from "../Workers/Worker.ts";
+
+/**
+ * Runtime accessors for a tunnel binding's token, obtained by binding the
+ * {@link AccountApiToken}'s outputs in the Worker's Init phase. Each accessor
+ * reads the value back from the Worker's environment at runtime.
+ */
+export interface TunnelToken {
+  /** The token's plaintext value (injected as a `secret_text` binding). */
+  value: Effect.Effect<Redacted.Redacted<string>>;
+  /** The account id the token is scoped to. */
+  accountId: Effect.Effect<string>;
+}
+
+/**
+ * Bind an {@link AccountApiToken}'s outputs into the Worker so they can be read
+ * at runtime: `token.value` is injected as a `secret_text` binding and
+ * `token.accountId` as `plain_text`. Returns the {@link TunnelToken} accessors.
+ */
+export const bindTunnelToken = (token: AccountApiToken) =>
+  Effect.gen(function* () {
+    const value = yield* token.value;
+    const accountId = yield* token.accountId;
+    return { value, accountId } satisfies TunnelToken;
+  });
+
+/**
+ * Resolve credentials from a bound token and provide them (plus the
+ * fetch-based HTTP client) to a raw SDK operation.
+ */
+export const authorizeWith =
+  (token: TunnelToken) =>
+  <A, E>(
+    eff: Effect.Effect<A, E, Credentials | HttpClient>,
+  ): Effect.Effect<A, E, RuntimeContext> =>
+    token.value.pipe(
+      Effect.flatMap((value) =>
+        eff.pipe(
+          Effect.provide(
+            fromApiToken({ apiToken: Redacted.value(value) }).pipe(
+              Layer.provideMerge(FetchHttpClient.layer),
+            ),
+          ),
+        ),
+      ),
+    );
+
+/**
+ * Shared runtime body for a tunnel binding: create a scoped token, attach the
+ * (narrow) policy, bind the token's outputs into the Worker, then build the
+ * client. Pass the result to `Layer.effect(<Binding>, ...)`.
+ */
+export const makeTunnelClient = <C>(
+  Policy: Binding.Policy<
+    any,
+    any,
+    (token: AccountApiToken) => Effect.Effect<void>
+  >,
+  makeClient: (token: TunnelToken) => C,
+) =>
+  Effect.gen(function* () {
+    const Token = yield* AccountApiToken;
+    const attach = yield* Policy;
+
+    return Effect.fn(function* () {
+      const ctx = yield* Worker;
+      const token = yield* Token(`${ctx.LogicalId}Token`);
+      yield* attach(token);
+      return makeClient(yield* bindTunnelToken(token));
+    });
+  });
+
+/**
+ * Build the deploy-time policy layer for a tunnel binding: attach an allow
+ * policy with the given permission groups to the binding's token.
+ */
+export const makeTunnelPolicyLive = <Self, Id extends string>(
+  Policy: Binding.Policy<
+    Self,
+    Id,
+    (token: AccountApiToken) => Effect.Effect<void>
+  >,
+  sid: string,
+  permissionGroups: ApiTokenPermissionGroupRef[],
+) =>
+  Policy.layer.effect(
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      return (_host, token) =>
+        token.bind(sid, {
+          policies: [
+            {
+              effect: "allow",
+              permissionGroups,
+              resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+            },
+          ],
+        });
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelRead.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelRead.ts
new file mode 100644
index 00000000000..144213ae06b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelRead.ts
@@ -0,0 +1,168 @@
+import type {
+  GetTunnelCloudflaredConfigurationError,
+  GetTunnelCloudflaredConfigurationResponse,
+  GetTunnelCloudflaredError,
+  GetTunnelCloudflaredResponse,
+  GetTunnelCloudflaredTokenError,
+  GetTunnelCloudflaredTokenResponse,
+  ListTunnelCloudflaredsError,
+  ListTunnelCloudflaredsRequest,
+  ListTunnelCloudflaredsResponse,
+} from "@distilled.cloud/cloudflare/zero-trust";
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Worker } from "../Workers/Worker.ts";
+import {
+  authorizeWith,
+  makeTunnelClient,
+  makeTunnelPolicyLive,
+  type TunnelToken,
+} from "./TunnelBinding.ts";
+
+/** List-tunnels request, minus the account id (supplied by the binding). */
+export type ListTunnelsRequest = Omit<
+  ListTunnelCloudflaredsRequest,
+  "accountId"
+>;
+
+/**
+ * Read-only tunnel operations. Backed by the `Cloudflare Tunnel Read`
+ * permission group.
+ */
+export interface TunnelReadClient {
+  /** Fetch a single tunnel by id. */
+  get(
+    tunnelId: string,
+  ): Effect.Effect<
+    GetTunnelCloudflaredResponse,
+    GetTunnelCloudflaredError,
+    RuntimeContext
+  >;
+  /** List tunnels in the account. */
+  list(
+    request?: ListTunnelsRequest,
+  ): Effect.Effect<
+    ListTunnelCloudflaredsResponse,
+    ListTunnelCloudflaredsError,
+    RuntimeContext
+  >;
+  /** Fetch the connector token used to run the tunnel. */
+  getToken(
+    tunnelId: string,
+  ): Effect.Effect<
+    GetTunnelCloudflaredTokenResponse,
+    GetTunnelCloudflaredTokenError,
+    RuntimeContext
+  >;
+  /** Read the remotely-managed configuration (ingress rules) for a tunnel. */
+  getConfiguration(
+    tunnelId: string,
+  ): Effect.Effect<
+    GetTunnelCloudflaredConfigurationResponse,
+    GetTunnelCloudflaredConfigurationError,
+    RuntimeContext
+  >;
+}
+
+/** Build the read-only client over a bound token. */
+export const readClient = (token: TunnelToken): TunnelReadClient => {
+  const authorize = authorizeWith(token);
+  return {
+    get: Effect.fn("Cloudflare.Tunnel.get")(function* (tunnelId) {
+      const accountId = yield* token.accountId;
+      return yield* authorize(
+        zeroTrust.getTunnelCloudflared({ accountId, tunnelId }),
+      );
+    }),
+    list: Effect.fn("Cloudflare.Tunnel.list")(function* (request) {
+      const accountId = yield* token.accountId;
+      return yield* authorize(
+        zeroTrust.listTunnelCloudflareds({ accountId, ...request }),
+      );
+    }),
+    getToken: Effect.fn("Cloudflare.Tunnel.getToken")(function* (tunnelId) {
+      const accountId = yield* token.accountId;
+      return yield* authorize(
+        zeroTrust.getTunnelCloudflaredToken({ accountId, tunnelId }),
+      );
+    }),
+    getConfiguration: Effect.fn("Cloudflare.Tunnel.getConfiguration")(
+      function* (tunnelId) {
+        const accountId = yield* token.accountId;
+        return yield* authorize(
+          zeroTrust.getTunnelCloudflaredConfiguration({ accountId, tunnelId }),
+        );
+      },
+    ),
+  };
+};
+
+/**
+ * Binding that lets a Worker read Cloudflare Tunnels at runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with only the `Cloudflare Tunnel
+ * Read` permission and binds its outputs into the Worker (the token value as a
+ * `secret_text` binding) so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Reading tunnels at runtime
+ * @example Bind the read client
+ * Bind once in the Init phase; every method is available on the returned client.
+ * ```typescript
+ * const tunnels = yield* Cloudflare.TunnelRead.bind();
+ * ```
+ *
+ * @example List tunnels
+ * ```typescript
+ * const { result } = yield* tunnels.list({ isDeleted: false });
+ * ```
+ *
+ * @example Fetch a tunnel and its connector token
+ * `getToken` returns the plaintext token used to run `cloudflared`.
+ * ```typescript
+ * const tunnel = yield* tunnels.get(tunnelId);
+ * const token = yield* tunnels.getToken(tunnelId);
+ * ```
+ *
+ * @example Read the ingress configuration
+ * ```typescript
+ * const { config } = yield* tunnels.getConfiguration(tunnelId);
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelReadLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelReadLive)
+ * ```
+ */
+export class TunnelRead extends Binding.Service<
+  TunnelRead,
+  () => Effect.Effect<TunnelReadClient, never, Worker>
+>()("Cloudflare.TunnelRead") {}
+
+/**
+ * Deploy-time policy for {@link TunnelRead}. Attaches the `Cloudflare Tunnel
+ * Read` permission to the token via its binding contract.
+ */
+export class TunnelReadPolicy extends Binding.Policy<
+  TunnelReadPolicy,
+  (token: AccountApiToken) => Effect.Effect<void>
+>()("Cloudflare.TunnelRead") {}
+
+/** Runtime layer for {@link TunnelRead}. */
+export const TunnelReadLive = Layer.effect(
+  TunnelRead,
+  makeTunnelClient(TunnelReadPolicy, readClient),
+);
+
+/** Live deploy-time policy layer for {@link TunnelReadPolicy}. */
+export const TunnelReadPolicyLive = makeTunnelPolicyLive(
+  TunnelReadPolicy,
+  "Cloudflare.TunnelRead",
+  ["Cloudflare Tunnel Read"],
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelReadWrite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelReadWrite.ts
new file mode 100644
index 00000000000..9547e2ad717
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelReadWrite.ts
@@ -0,0 +1,88 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Worker } from "../Workers/Worker.ts";
+import {
+  makeTunnelClient,
+  makeTunnelPolicyLive,
+  type TunnelToken,
+} from "./TunnelBinding.ts";
+import { readClient, type TunnelReadClient } from "./TunnelRead.ts";
+import { writeClient, type TunnelWriteClient } from "./TunnelWrite.ts";
+
+/** Combined read + write tunnel operations. */
+export interface TunnelReadWriteClient
+  extends TunnelReadClient, TunnelWriteClient {}
+
+/** Build the combined read + write client over a bound token. */
+export const readWriteClient = (token: TunnelToken): TunnelReadWriteClient => ({
+  ...readClient(token),
+  ...writeClient(token),
+});
+
+/**
+ * Binding that lets a Worker perform the full Cloudflare Tunnel CRUD surface at
+ * runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with both the `Cloudflare Tunnel
+ * Read` and `Cloudflare Tunnel Write` permissions and binds its outputs into
+ * the Worker (the token value as a `secret_text` binding) so runtime code can
+ * authenticate.
+ *
+ * @binding
+ *
+ * @section Managing tunnels at runtime
+ * @example Create, configure, and delete a tunnel from a request handler
+ * ```typescript
+ * // init
+ * const tunnels = yield* Cloudflare.TunnelReadWrite.bind();
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ *     yield* tunnels.putConfiguration(tunnel.id!, {
+ *       ingress: [
+ *         { hostname: "app.example.com", service: "http://localhost:3000" },
+ *         { service: "http_status:404" },
+ *       ],
+ *     });
+ *     const token = yield* tunnels.getToken(tunnel.id!);
+ *     return HttpServerResponse.json({ id: tunnel.id, token });
+ *   }),
+ * };
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelReadWriteLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelReadWriteLive)
+ * ```
+ */
+export class TunnelReadWrite extends Binding.Service<
+  TunnelReadWrite,
+  () => Effect.Effect<TunnelReadWriteClient, never, Worker>
+>()("Cloudflare.TunnelReadWrite") {}
+
+/**
+ * Deploy-time policy for {@link TunnelReadWrite}. Attaches both the `Cloudflare
+ * Tunnel Read` and `Cloudflare Tunnel Write` permissions to the token via its
+ * binding contract.
+ */
+export class TunnelReadWritePolicy extends Binding.Policy<
+  TunnelReadWritePolicy,
+  (token: AccountApiToken) => Effect.Effect<void>
+>()("Cloudflare.TunnelReadWrite") {}
+
+/** Runtime layer for {@link TunnelReadWrite}. */
+export const TunnelReadWriteLive = Layer.effect(
+  TunnelReadWrite,
+  makeTunnelClient(TunnelReadWritePolicy, readWriteClient),
+);
+
+/** Live deploy-time policy layer for {@link TunnelReadWritePolicy}. */
+export const TunnelReadWritePolicyLive = makeTunnelPolicyLive(
+  TunnelReadWritePolicy,
+  "Cloudflare.TunnelReadWrite",
+  ["Cloudflare Tunnel Read", "Cloudflare Tunnel Write"],
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelWrite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelWrite.ts
new file mode 100644
index 00000000000..b636c87a0e7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/TunnelWrite.ts
@@ -0,0 +1,194 @@
+import type {
+  CreateTunnelCloudflaredError,
+  CreateTunnelCloudflaredRequest,
+  CreateTunnelCloudflaredResponse,
+  DeleteTunnelCloudflaredError,
+  DeleteTunnelCloudflaredResponse,
+  PatchTunnelCloudflaredError,
+  PatchTunnelCloudflaredRequest,
+  PatchTunnelCloudflaredResponse,
+  PutTunnelCloudflaredConfigurationError,
+  PutTunnelCloudflaredConfigurationRequest,
+  PutTunnelCloudflaredConfigurationResponse,
+} from "@distilled.cloud/cloudflare/zero-trust";
+import * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { RuntimeContext } from "../../RuntimeContext.ts";
+import type { AccountApiToken } from "../ApiToken/AccountApiToken.ts";
+import type { Worker } from "../Workers/Worker.ts";
+import {
+  authorizeWith,
+  makeTunnelClient,
+  makeTunnelPolicyLive,
+  type TunnelToken,
+} from "./TunnelBinding.ts";
+
+/** Create-tunnel request, minus the account id (supplied by the binding). */
+export type CreateTunnelRequest = Omit<
+  CreateTunnelCloudflaredRequest,
+  "accountId"
+>;
+
+/** Update-tunnel request, minus the account id and tunnel id (positional). */
+export type UpdateTunnelRequest = Omit<
+  PatchTunnelCloudflaredRequest,
+  "accountId" | "tunnelId"
+>;
+
+/** Tunnel configuration body, minus the account id and tunnel id (positional). */
+export type TunnelConfiguration = NonNullable<
+  PutTunnelCloudflaredConfigurationRequest["config"]
+>;
+
+/**
+ * Mutating tunnel operations. Backed by the `Cloudflare Tunnel Write`
+ * permission group.
+ */
+export interface TunnelWriteClient {
+  /** Create a new tunnel. */
+  create(
+    request: CreateTunnelRequest,
+  ): Effect.Effect<
+    CreateTunnelCloudflaredResponse,
+    CreateTunnelCloudflaredError,
+    RuntimeContext
+  >;
+  /** Update a tunnel's mutable fields (name, secret). */
+  update(
+    tunnelId: string,
+    request: UpdateTunnelRequest,
+  ): Effect.Effect<
+    PatchTunnelCloudflaredResponse,
+    PatchTunnelCloudflaredError,
+    RuntimeContext
+  >;
+  /** Delete a tunnel by id. */
+  delete(
+    tunnelId: string,
+  ): Effect.Effect<
+    DeleteTunnelCloudflaredResponse,
+    DeleteTunnelCloudflaredError,
+    RuntimeContext
+  >;
+  /** Replace the remotely-managed configuration (ingress rules) for a tunnel. */
+  putConfiguration(
+    tunnelId: string,
+    config: TunnelConfiguration,
+  ): Effect.Effect<
+    PutTunnelCloudflaredConfigurationResponse,
+    PutTunnelCloudflaredConfigurationError,
+    RuntimeContext
+  >;
+}
+
+/** Build the write client over a bound token. */
+export const writeClient = (token: TunnelToken): TunnelWriteClient => {
+  const authorize = authorizeWith(token);
+  return {
+    create: Effect.fn("Cloudflare.Tunnel.create")(function* (request) {
+      const accountId = yield* token.accountId;
+      return yield* authorize(
+        zeroTrust.createTunnelCloudflared({ accountId, ...request }),
+      );
+    }),
+    update: Effect.fn("Cloudflare.Tunnel.update")(
+      function* (tunnelId, request) {
+        const accountId = yield* token.accountId;
+        return yield* authorize(
+          zeroTrust.patchTunnelCloudflared({ accountId, tunnelId, ...request }),
+        );
+      },
+    ),
+    delete: Effect.fn("Cloudflare.Tunnel.delete")(function* (tunnelId) {
+      const accountId = yield* token.accountId;
+      return yield* authorize(
+        zeroTrust.deleteTunnelCloudflared({ accountId, tunnelId }),
+      );
+    }),
+    putConfiguration: Effect.fn("Cloudflare.Tunnel.putConfiguration")(
+      function* (tunnelId, config) {
+        const accountId = yield* token.accountId;
+        return yield* authorize(
+          zeroTrust.putTunnelCloudflaredConfiguration({
+            accountId,
+            tunnelId,
+            config,
+          }),
+        );
+      },
+    ),
+  };
+};
+
+/**
+ * Binding that lets a Worker create, update, and delete Cloudflare Tunnels at
+ * runtime.
+ *
+ * Creates a scoped {@link AccountApiToken} with only the `Cloudflare Tunnel
+ * Write` permission and binds its outputs into the Worker (the token value as a
+ * `secret_text` binding) so runtime code can authenticate.
+ *
+ * @binding
+ *
+ * @section Mutating tunnels at runtime
+ * @example Bind the write client
+ * Bind once in the Init phase; every method is available on the returned client.
+ * ```typescript
+ * const tunnels = yield* Cloudflare.TunnelWrite.bind();
+ * ```
+ *
+ * @example Create a tunnel
+ * ```typescript
+ * const tunnel = yield* tunnels.create({ name: "on-demand-tunnel" });
+ * ```
+ *
+ * @example Push ingress configuration
+ * ```typescript
+ * yield* tunnels.putConfiguration(tunnel.id!, {
+ *   ingress: [
+ *     { hostname: "app.example.com", service: "http://localhost:3000" },
+ *     { service: "http_status:404" },
+ *   ],
+ * });
+ * ```
+ *
+ * @example Rename and delete a tunnel
+ * ```typescript
+ * yield* tunnels.update(tunnel.id!, { name: "renamed-tunnel" });
+ * yield* tunnels.delete(tunnel.id!);
+ * ```
+ *
+ * @section Runtime Layer
+ * Provide {@link TunnelWriteLive} in the Worker's runtime layer.
+ * ```typescript
+ * Effect.provide(Cloudflare.TunnelWriteLive)
+ * ```
+ */
+export class TunnelWrite extends Binding.Service<
+  TunnelWrite,
+  () => Effect.Effect<TunnelWriteClient, never, Worker>
+>()("Cloudflare.TunnelWrite") {}
+
+/**
+ * Deploy-time policy for {@link TunnelWrite}. Attaches the `Cloudflare Tunnel
+ * Write` permission to the token via its binding contract.
+ */
+export class TunnelWritePolicy extends Binding.Policy<
+  TunnelWritePolicy,
+  (token: AccountApiToken) => Effect.Effect<void>
+>()("Cloudflare.TunnelWrite") {}
+
+/** Runtime layer for {@link TunnelWrite}. */
+export const TunnelWriteLive = Layer.effect(
+  TunnelWrite,
+  makeTunnelClient(TunnelWritePolicy, writeClient),
+);
+
+/** Live deploy-time policy layer for {@link TunnelWritePolicy}. */
+export const TunnelWritePolicyLive = makeTunnelPolicyLive(
+  TunnelWritePolicy,
+  "Cloudflare.TunnelWrite",
+  ["Cloudflare Tunnel Write"],
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/index.ts
new file mode 100644
index 00000000000..36bcd8eed48
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Tunnel/index.ts
@@ -0,0 +1,5 @@
+export * from "./Tunnel.ts";
+export * from "./TunnelBinding.ts";
+export * from "./TunnelRead.ts";
+export * from "./TunnelReadWrite.ts";
+export * from "./TunnelWrite.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeIndex.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeIndex.ts
new file mode 100644
index 00000000000..5a0b6a80f9f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeIndex.ts
@@ -0,0 +1,262 @@
+import * as vectorize from "@distilled.cloud/cloudflare/vectorize";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { VectorizeIndexBinding } from "./VectorizeIndexBinding.ts";
+
+const VectorizeIndexTypeId = "Cloudflare.VectorizeIndex" as const;
+type VectorizeIndexTypeId = typeof VectorizeIndexTypeId;
+
+export type DistanceMetric = "cosine" | "euclidean" | "dot-product";
+
+export type VectorizePreset =
+  | "@cf/baai/bge-small-en-v1.5"
+  | "@cf/baai/bge-base-en-v1.5"
+  | "@cf/baai/bge-large-en-v1.5"
+  | "openai/text-embedding-ada-002"
+  | "cohere/embed-multilingual-v2.0"
+  // Keep the union open so new Cloudflare presets aren't blocked by stale types.
+  | (string & {});
+
+const DEFAULT_METRIC: DistanceMetric = "cosine";
+
+export type VectorizeIndexProps = {
+  /**
+   * Name of the index. If omitted, a unique name will be generated.
+   * Must be lowercase alphanumeric with hyphens. Changing it triggers a
+   * replacement.
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Number of dimensions for each vector stored in the index. Required
+   * unless `preset` is provided. Cannot be changed after creation —
+   * updating this property triggers a replacement.
+   */
+  dimensions?: number;
+  /**
+   * Distance metric used for similarity search. Cannot be changed after
+   * creation — updating this property triggers a replacement.
+   * @default "cosine"
+   */
+  metric?: DistanceMetric;
+  /**
+   * A managed embedding model preset that fixes `dimensions` and `metric`
+   * to match the named model. Mutually exclusive with `dimensions`/`metric`.
+   * Cannot be changed after creation — updating this triggers a replacement.
+   */
+  preset?: VectorizePreset;
+  /**
+   * Human-readable description of the index. Vectorize has no update API,
+   * so changing the description triggers a replacement.
+   */
+  description?: string;
+};
+
+export type VectorizeIndexAttributes = {
+  indexName: string;
+  dimensions: number | undefined;
+  metric: DistanceMetric | undefined;
+  description: string | undefined;
+  accountId: string;
+  createdOn: string | undefined;
+  modifiedOn: string | undefined;
+};
+
+export type VectorizeIndex = Resource<
+  VectorizeIndexTypeId,
+  VectorizeIndexProps,
+  VectorizeIndexAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Vectorize index for storing and querying vector embeddings.
+ *
+ * Vectorize is a globally distributed vector database. Create an index as a
+ * resource, then bind it to a Worker to insert, upsert, and query vectors.
+ *
+ * A Vectorize index is identified by its name and is immutable: its
+ * dimensions, metric, preset, and description are all fixed at creation.
+ * Changing any of them triggers a replacement.
+ *
+ * @section Creating an Index
+ * @example Index with explicit dimensions and metric
+ * ```typescript
+ * const index = yield* Cloudflare.VectorizeIndex("my-index", {
+ *   dimensions: 768,
+ *   metric: "cosine",
+ * });
+ * ```
+ *
+ * @example Index from a managed embedding model preset
+ * A preset fixes the dimensions and metric to match the named model.
+ * ```typescript
+ * const index = yield* Cloudflare.VectorizeIndex("my-index", {
+ *   preset: "@cf/baai/bge-base-en-v1.5",
+ * });
+ * ```
+ *
+ * @example Index with a description
+ * ```typescript
+ * const index = yield* Cloudflare.VectorizeIndex("my-index", {
+ *   dimensions: 1536,
+ *   metric: "euclidean",
+ *   description: "Product catalog embeddings",
+ * });
+ * ```
+ *
+ * @section Binding to a Worker
+ * @example Querying an index inside a Worker
+ * ```typescript
+ * const index = yield* Cloudflare.VectorizeConnection.bind(MyIndex);
+ *
+ * // Insert vectors
+ * yield* index.upsert([
+ *   { id: "1", values: [0.1, 0.2, 0.3], metadata: { title: "doc" } },
+ * ]);
+ *
+ * // Query the nearest neighbors
+ * const matches = yield* index.query([0.1, 0.2, 0.3], { topK: 5 });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/vectorize/
+ */
+export const VectorizeIndex = Resource<VectorizeIndex>(VectorizeIndexTypeId)({
+  bind: VectorizeIndexBinding.bind,
+});
+
+/**
+ * Returns true if the given value is a VectorizeIndex resource.
+ */
+export const isVectorizeIndex = (value: unknown): value is VectorizeIndex =>
+  Predicate.hasProperty(value, "Type") && value.Type === VectorizeIndexTypeId;
+
+export const VectorizeIndexProvider = () =>
+  Provider.effect(
+    VectorizeIndex,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createIndex = yield* vectorize.createIndex;
+      const getIndex = yield* vectorize.getIndex;
+      const deleteIndex = yield* vectorize.deleteIndex;
+
+      const createIndexName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          return name ?? (yield* createPhysicalName({ id, lowercase: true }));
+        });
+
+      const buildConfig = (
+        news: VectorizeIndexProps,
+      ): vectorize.CreateIndexRequest["config"] =>
+        news.preset !== undefined
+          ? // `VectorizePreset` is intentionally open (`| (string & {})`) so
+            // new Cloudflare presets aren't blocked by stale types. The
+            // distilled type is the strict-at-release-time union; cast
+            // through for the API call.
+            ({
+              preset: news.preset as never,
+            } as vectorize.CreateIndexRequest["config"])
+          : {
+              dimensions: news.dimensions!,
+              metric: news.metric ?? DEFAULT_METRIC,
+            };
+
+      return {
+        stables: ["indexName", "accountId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const name = yield* createIndexName(id, news.name);
+          const oldName = output?.indexName
+            ? output.indexName
+            : yield* createIndexName(id, olds.name);
+          if (
+            oldName !== name ||
+            (news.preset ?? undefined) !== (olds.preset ?? undefined) ||
+            (news.dimensions ?? undefined) !== (olds.dimensions ?? undefined) ||
+            (news.metric ?? DEFAULT_METRIC) !==
+              (olds.metric ?? DEFAULT_METRIC) ||
+            (news.description ?? undefined) !== (olds.description ?? undefined)
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const acct = output?.accountId ?? accountId;
+          const name =
+            output?.indexName ?? (yield* createIndexName(id, olds?.name));
+          return yield* getIndex({ accountId: acct, indexName: name }).pipe(
+            Effect.map((index) => toAttributes(index, name, acct)),
+            Effect.catchTag(["NotFound", "Gone"], () =>
+              Effect.succeed(undefined),
+            ),
+          );
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {} }) {
+          const indexName = yield* createIndexName(id, news.name);
+
+          // Observe — read the live index by name. The name is the stable
+          // identifier; fall back through a NotFound to the create path so
+          // we recover from out-of-band deletes or partial state-persistence.
+          let observed = yield* getIndex({
+            accountId,
+            indexName,
+          }).pipe(
+            Effect.catchTag(["NotFound", "Gone"], () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+          // Ensure — create if missing. Cloudflare returns 409 Conflict when
+          // an index with the same name already exists; tolerate the race by
+          // re-reading it.
+          if (!observed) {
+            observed = yield* createIndex({
+              accountId,
+              name: indexName,
+              config: buildConfig(news),
+              description: news.description,
+            }).pipe(
+              Effect.catchTag("IndexAlreadyExists", () =>
+                getIndex({ accountId, indexName }),
+              ),
+            );
+          }
+
+          return toAttributes(observed, indexName, accountId);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteIndex({
+            accountId: output.accountId,
+            indexName: output.indexName,
+          }).pipe(Effect.catchTag(["NotFound", "Gone"], () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const toAttributes = (
+  index: vectorize.GetIndexResponse | vectorize.CreateIndexResponse,
+  name: string,
+  accountId: string,
+): VectorizeIndexAttributes => ({
+  indexName: index.name ?? name,
+  dimensions: index.config?.dimensions,
+  // Distilled widened generated string enums to open unions (`string & {}`).
+  metric: index.config?.metric as DistanceMetric | undefined,
+  description: index.description ?? undefined,
+  accountId,
+  createdOn: index.createdOn ?? undefined,
+  modifiedOn: index.modifiedOn ?? undefined,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeIndexBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeIndexBinding.ts
new file mode 100644
index 00000000000..7a11bc1d185
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeIndexBinding.ts
@@ -0,0 +1,103 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { isWorker, WorkerEnvironment } from "../Workers/Worker.ts";
+import type { VectorizeIndex } from "./VectorizeIndex.ts";
+
+export interface VectorizeIndexClient {
+  /**
+   * An Effect that resolves to the raw underlying Cloudflare Vectorize
+   * binding. Use this for direct access not covered by the helpers below.
+   */
+  raw: Effect.Effect<runtime.Vectorize>;
+  /** Get information about the bound index (dimensions, vector count). */
+  describe: () => Effect.Effect<runtime.VectorizeIndexInfo>;
+  /** Find the nearest neighbors of `vector`. */
+  query: (
+    vector: runtime.VectorFloatArray | number[],
+    options?: runtime.VectorizeQueryOptions,
+  ) => Effect.Effect<runtime.VectorizeMatches>;
+  /** Find the nearest neighbors of an existing vector by its id. */
+  queryById: (
+    vectorId: string,
+    options?: runtime.VectorizeQueryOptions,
+  ) => Effect.Effect<runtime.VectorizeMatches>;
+  /** Insert vectors. Throws if any provided id already exists. */
+  insert: (
+    vectors: runtime.VectorizeVector[],
+  ) => Effect.Effect<runtime.VectorizeAsyncMutation>;
+  /** Upsert vectors, replacing any existing vectors with matching ids. */
+  upsert: (
+    vectors: runtime.VectorizeVector[],
+  ) => Effect.Effect<runtime.VectorizeAsyncMutation>;
+  /** Delete vectors by id. */
+  deleteByIds: (ids: string[]) => Effect.Effect<runtime.VectorizeAsyncMutation>;
+  /** Fetch vectors by id. */
+  getByIds: (ids: string[]) => Effect.Effect<runtime.VectorizeVector[]>;
+}
+
+export class VectorizeIndexBinding extends Binding.Service<
+  VectorizeIndexBinding,
+  (index: VectorizeIndex) => Effect.Effect<VectorizeIndexClient>
+>()("Cloudflare.Vectorize.IndexBinding") {}
+
+export const VectorizeIndexBindingLive = Layer.effect(
+  VectorizeIndexBinding,
+  Effect.gen(function* () {
+    const Policy = yield* VectorizeIndexBindingPolicy;
+
+    return Effect.fn(function* (index: VectorizeIndex) {
+      yield* Policy(index);
+      const rawEff = yield* Effect.serviceOption(WorkerEnvironment).pipe(
+        Effect.map(Option.getOrUndefined),
+        Effect.map((env) => env?.[index.LogicalId]! as runtime.Vectorize),
+        Effect.cached,
+      );
+
+      const withRuntime = <A>(fn: (raw: runtime.Vectorize) => Promise<A>) =>
+        Effect.flatMap(rawEff, (raw) => Effect.promise(() => fn(raw)));
+
+      return {
+        raw: rawEff,
+        describe: () => withRuntime((raw) => raw.describe()),
+        query: (vector, options) =>
+          withRuntime((raw) => raw.query(vector, options)),
+        queryById: (vectorId, options) =>
+          withRuntime((raw) => raw.queryById(vectorId, options)),
+        insert: (vectors) => withRuntime((raw) => raw.insert(vectors)),
+        upsert: (vectors) => withRuntime((raw) => raw.upsert(vectors)),
+        deleteByIds: (ids) => withRuntime((raw) => raw.deleteByIds(ids)),
+        getByIds: (ids) => withRuntime((raw) => raw.getByIds(ids)),
+      } satisfies VectorizeIndexClient;
+    });
+  }),
+);
+
+export class VectorizeIndexBindingPolicy extends Binding.Policy<
+  VectorizeIndexBindingPolicy,
+  (index: VectorizeIndex) => Effect.Effect<void>
+>()("Cloudflare.Vectorize.IndexBinding") {}
+
+export const VectorizeIndexBindingPolicyLive =
+  VectorizeIndexBindingPolicy.layer.succeed(
+    Effect.fn(function* (host: ResourceLike, index: VectorizeIndex) {
+      if (isWorker(host)) {
+        yield* host.bind`${index}`({
+          bindings: [
+            {
+              type: "vectorize",
+              name: index.LogicalId,
+              indexName: index.indexName,
+            },
+          ],
+        });
+      } else {
+        return yield* Effect.die(
+          new Error(`IndexBinding does not support runtime '${host.Type}'`),
+        );
+      }
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeMetadataIndex.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeMetadataIndex.ts
new file mode 100644
index 00000000000..f663f19f622
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/VectorizeMetadataIndex.ts
@@ -0,0 +1,208 @@
+import * as vectorize from "@distilled.cloud/cloudflare/vectorize";
+import * as Effect from "effect/Effect";
+
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+export type MetadataIndexType = "string" | "number" | "boolean";
+
+export type VectorizeMetadataIndexProps = {
+  /**
+   * Name of the parent Vectorize index. Pass `index.indexName` from a
+   * `VectorizeIndex` to track the dependency. Changing the parent index
+   * triggers a replacement.
+   */
+  indexName: string;
+  /**
+   * The metadata property to index. Filter expressions in `query` use this
+   * name (e.g. `{ category: { $eq: "books" } }`). Cannot be changed after
+   * creation — updating triggers a replacement.
+   */
+  propertyName: string;
+  /**
+   * The type of metadata values stored under `propertyName`. Cannot be
+   * changed after creation — updating triggers a replacement.
+   */
+  indexType: MetadataIndexType;
+};
+
+export type VectorizeMetadataIndexAttributes = {
+  propertyName: string;
+  indexType: MetadataIndexType;
+  indexName: string;
+  accountId: string;
+  mutationId: string | undefined;
+};
+
+export type VectorizeMetadataIndex = Resource<
+  "Cloudflare.VectorizeMetadataIndex",
+  VectorizeMetadataIndexProps,
+  VectorizeMetadataIndexAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A metadata index on a Cloudflare Vectorize index.
+ *
+ * Metadata indexes enable filtering query results by metadata properties.
+ * Without a metadata index on a property, that property cannot be used in
+ * the `filter` of a `query()` call.
+ *
+ * A metadata index is identified by its parent index and `propertyName` and
+ * is immutable — changing the property name, type, or parent index triggers
+ * a replacement.
+ *
+ * @section Creating a Metadata Index
+ * @example Index a string metadata property
+ * ```typescript
+ * const index = yield* Cloudflare.VectorizeIndex("my-index", {
+ *   dimensions: 768,
+ *   metric: "cosine",
+ * });
+ *
+ * yield* Cloudflare.VectorizeMetadataIndex("CategoryMetaIndex", {
+ *   indexName: index.indexName,
+ *   propertyName: "category",
+ *   indexType: "string",
+ * });
+ * ```
+ *
+ * @example Index a numeric metadata property
+ * ```typescript
+ * yield* Cloudflare.VectorizeMetadataIndex("PriceMetaIndex", {
+ *   indexName: index.indexName,
+ *   propertyName: "price",
+ *   indexType: "number",
+ * });
+ * ```
+ *
+ * @see https://developers.cloudflare.com/vectorize/reference/metadata-filtering/
+ */
+export const VectorizeMetadataIndex = Resource<VectorizeMetadataIndex>(
+  "Cloudflare.VectorizeMetadataIndex",
+);
+
+export const VectorizeMetadataIndexProvider = () =>
+  Provider.effect(
+    VectorizeMetadataIndex,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createMetadataIndex = yield* vectorize.createIndexMetadataIndex;
+      const deleteMetadataIndex = yield* vectorize.deleteIndexMetadataIndex;
+      const listMetadataIndexes = yield* vectorize.listIndexMetadataIndexes;
+
+      const findExisting = (
+        acct: string,
+        indexName: string,
+        propertyName: string,
+      ) =>
+        listMetadataIndexes({
+          accountId: acct,
+          indexName,
+        }).pipe(
+          Effect.map((res) => {
+            const index = res.metadataIndexes?.find(
+              (m) => m.propertyName === propertyName,
+            );
+            return index
+              ? {
+                  propertyName: index.propertyName,
+                  indexType:
+                    index.indexType?.toLowerCase() as MetadataIndexType,
+                }
+              : undefined;
+          }),
+          Effect.catchTag(["NotFound", "Gone"], () =>
+            Effect.succeed(undefined),
+          ),
+        );
+
+      return {
+        stables: ["propertyName", "indexName", "accountId"],
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const newIndexName = news.indexName;
+          const oldIndexName = output?.indexName ?? olds.indexName;
+          if (
+            (oldIndexName ?? newIndexName) !== newIndexName ||
+            (olds.propertyName ?? news.propertyName) !== news.propertyName ||
+            (olds.indexType ?? news.indexType) !== news.indexType
+          ) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const acct = output?.accountId ?? accountId;
+          const indexName = output?.indexName ?? olds?.indexName;
+          const propertyName = output?.propertyName ?? olds?.propertyName;
+          if (!indexName || !propertyName) return undefined;
+          const existing = yield* findExisting(acct, indexName, propertyName);
+          if (!existing?.propertyName || !existing.indexType) return undefined;
+          return {
+            propertyName: existing.propertyName,
+            indexType: existing.indexType,
+            indexName,
+            accountId: acct,
+            mutationId: output?.mutationId,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const acct = output?.accountId ?? accountId;
+          const indexName = news.indexName;
+
+          // Observe — list metadata indexes on the parent and look for one
+          // matching propertyName.
+          const existing = yield* findExisting(
+            acct,
+            indexName,
+            news.propertyName,
+          );
+
+          // Ensure — create if missing. Cloudflare returns 409 Conflict on
+          // duplicate; tolerate the race by reusing the prior mutationId.
+          let mutationId = output?.mutationId;
+          if (!existing) {
+            const created = yield* createMetadataIndex({
+              accountId: acct,
+              indexName,
+              propertyName: news.propertyName,
+              indexType: news.indexType,
+            }).pipe(
+              Effect.catchTag("MetadataIndexAlreadyExists", () =>
+                Effect.succeed({ mutationId: output?.mutationId }),
+              ),
+            );
+            mutationId = created.mutationId ?? undefined;
+          }
+
+          return {
+            propertyName: news.propertyName,
+            indexType: news.indexType,
+            indexName,
+            accountId: acct,
+            mutationId,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteMetadataIndex({
+            accountId: output.accountId,
+            indexName: output.indexName,
+            propertyName: output.propertyName,
+          }).pipe(
+            Effect.catchTag(
+              ["NotFound", "Gone", "MetadataIndexNotFound"],
+              () => Effect.void,
+            ),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/index.ts
new file mode 100644
index 00000000000..a2c5de7dab5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Vectorize/index.ts
@@ -0,0 +1,3 @@
+export * from "./VectorizeIndex.ts";
+export * from "./VectorizeIndexBinding.ts";
+export * from "./VectorizeMetadataIndex.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/VpcService.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/VpcService.ts
new file mode 100644
index 00000000000..d31e0b01a05
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/VpcService.ts
@@ -0,0 +1,317 @@
+import * as connectivity from "@distilled.cloud/cloudflare/connectivity";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+
+export type VpcServiceProps = {
+  /**
+   * Display name for the VPC service. If omitted, a unique name is generated.
+   *
+   * @default ${app}-${stage}-${id}
+   */
+  name?: string;
+  /**
+   * Service protocol. Currently only `"http"` is supported.
+   *
+   * @default "http"
+   */
+  serviceType?: "http";
+  /**
+   * Port that Workers should reach for plain HTTP traffic.
+   */
+  httpPort?: number;
+  /**
+   * Port that Workers should reach for HTTPS traffic.
+   */
+  httpsPort?: number;
+  /**
+   * Host the service is reachable at -- IPv4, IPv6, dual stack, or hostname.
+   */
+  host: VpcService.Host;
+  /**
+   * Whether to adopt an existing VPC service with the same name when create
+   * fails because of a name conflict.
+   *
+   * @default false
+   */
+  adopt?: boolean;
+};
+
+export declare namespace VpcService {
+  /**
+   * Host the VPC service is reachable at.
+   */
+  export type Host = IPv4Host | IPv6Host | DualStackHost | HostnameHost;
+  export interface IPv4Host {
+    ipv4: string;
+    network: Network;
+  }
+  export interface IPv6Host {
+    ipv6: string;
+    network: Network;
+  }
+  export interface DualStackHost {
+    ipv4: string;
+    ipv6: string;
+    network: Network;
+  }
+  export interface HostnameHost {
+    hostname: string;
+    resolverNetwork: ResolverNetwork;
+  }
+  export interface Network {
+    tunnelId: string;
+  }
+  export interface ResolverNetwork extends Network {
+    resolverIps?: string[];
+  }
+}
+
+export type VpcServiceAttributes = {
+  serviceId: string;
+  serviceName: string;
+  serviceType: "http" | "tcp";
+  httpPort: number | undefined;
+  httpsPort: number | undefined;
+  host: VpcService.Host;
+  accountId: string;
+  createdAt: number | undefined;
+  updatedAt: number | undefined;
+};
+
+export type VpcService = Resource<
+  "Cloudflare.VpcService",
+  VpcServiceProps,
+  VpcServiceAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare VPC service that exposes a private host (IP or hostname)
+ * reachable through a Cloudflare Tunnel for Workers VPC.
+ *
+ * @section Creating a VPC Service
+ * @example Hostname through a tunnel
+ * ```typescript
+ * const tunnel = yield* Cloudflare.Tunnel("MyTunnel");
+ * const service = yield* Cloudflare.VpcService("Internal", {
+ *   host: {
+ *     hostname: "internal.example.com",
+ *     resolverNetwork: { tunnelId: tunnel.tunnelId, resolverIps: ["10.0.0.53"] },
+ *   },
+ * });
+ * ```
+ *
+ * @example IPv4 with explicit ports
+ * ```typescript
+ * const service = yield* Cloudflare.VpcService("DevServer", {
+ *   httpPort: 5173,
+ *   host: { ipv4: "192.168.1.100", network: { tunnelId: tunnel.tunnelId } },
+ * });
+ * ```
+ */
+export const VpcService = Resource<VpcService>("Cloudflare.VpcService");
+
+export const VpcServiceProvider = () =>
+  Provider.effect(
+    VpcService,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const createService = yield* connectivity.createDirectoryService;
+      const getService = yield* connectivity.getDirectoryService;
+      const updateService = yield* connectivity.updateDirectoryService;
+      const deleteService = yield* connectivity.deleteDirectoryService;
+      const listServices = connectivity.listDirectoryServices;
+
+      const createServiceName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          if (name) return name;
+          return yield* createPhysicalName({
+            id,
+            lowercase: true,
+            maxLength: 63,
+          });
+        });
+
+      const findServiceByName = (name: string) =>
+        listServices.items({ accountId }).pipe(
+          Stream.filter((s) => s.name === name),
+          Stream.runHead,
+          Effect.map(Option.getOrUndefined),
+        );
+
+      return {
+        stables: ["serviceId", "accountId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" } as const;
+          }
+          const name = yield* createServiceName(id, news.name);
+          const oldName = output?.serviceName
+            ? output.serviceName
+            : yield* createServiceName(id, olds?.name);
+          if (name !== oldName) {
+            return { action: "update" } as const;
+          }
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const name = yield* createServiceName(id, news.name);
+          const acct = output?.accountId ?? accountId;
+
+          // Observe — re-fetch the cached service; fall back to a name
+          // scan so we recover from out-of-band deletes or partial state
+          // persistence failures.
+          let observed: connectivity.GetDirectoryServiceResponse | undefined;
+          if (output?.serviceId) {
+            observed = yield* getService({
+              accountId: acct,
+              serviceId: output.serviceId,
+            }).pipe(Effect.catch(() => Effect.succeed(undefined)));
+          }
+          if (!observed) {
+            const match = yield* findServiceByName(name);
+            observed = match as
+              | connectivity.GetDirectoryServiceResponse
+              | undefined;
+          }
+
+          // Ensure — create if missing. Cloudflare rejects a duplicate
+          // name with a generic error; tolerate by adopting the existing
+          // service (when the caller opted in) and re-applying the
+          // desired configuration.
+          if (!observed || !observed.serviceId) {
+            const result = yield* createService({
+              accountId: acct,
+              name,
+              type: news.serviceType ?? "http",
+              httpPort: news.httpPort,
+              httpsPort: news.httpsPort,
+              host: news.host,
+            }).pipe(
+              Effect.catch((err: unknown) =>
+                Effect.gen(function* () {
+                  if (!news.adopt) return yield* Effect.fail(err as never);
+                  const existing = yield* findServiceByName(name);
+                  if (!existing || !existing.serviceId) {
+                    return yield* Effect.fail(err as never);
+                  }
+                  return yield* updateService({
+                    accountId: acct,
+                    serviceId: existing.serviceId,
+                    name,
+                    type: news.serviceType ?? "http",
+                    httpPort: news.httpPort,
+                    httpsPort: news.httpsPort,
+                    host: news.host,
+                  });
+                }),
+              ),
+            );
+            return formatVpcService(result, acct);
+          }
+
+          // Sync — the Cloudflare update API replaces all mutable fields
+          // (name, ports, host) atomically, so always issue it so
+          // adoption and routine updates converge.
+          const result = yield* updateService({
+            accountId: acct,
+            serviceId: observed.serviceId,
+            name,
+            type: news.serviceType ?? observed.type ?? "http",
+            httpPort: news.httpPort,
+            httpsPort: news.httpsPort,
+            host: news.host,
+          });
+          return formatVpcService(result, acct);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteService({
+            accountId: output.accountId,
+            serviceId: output.serviceId,
+          }).pipe(Effect.catch(() => Effect.void));
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.serviceId) {
+            return yield* getService({
+              accountId: output.accountId,
+              serviceId: output.serviceId,
+            }).pipe(
+              Effect.map((s) => formatVpcService(s, output.accountId)),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+          }
+          const name = yield* createServiceName(id, olds?.name);
+          const existing = yield* findServiceByName(name);
+          if (!existing || !existing.serviceId) return undefined;
+          return formatVpcService(existing, accountId);
+        }),
+      };
+    }),
+  );
+
+export const formatVpcService = (
+  service: {
+    serviceId?: string | null;
+    name: string;
+    // Distilled widened generated string enums to open unions (`string & {}`);
+    // the API only ever returns the known variants here.
+    type: string;
+    createdAt?: string | null;
+    updatedAt?: string | null;
+    httpPort?: number | null;
+    httpsPort?: number | null;
+    host: connectivity.GetDirectoryServiceResponse["host"];
+  },
+  accountId: string,
+): VpcServiceAttributes => {
+  let host: VpcService.Host;
+  if ("hostname" in service.host) {
+    host = {
+      hostname: service.host.hostname,
+      resolverNetwork: {
+        tunnelId: service.host.resolverNetwork.tunnelId,
+        resolverIps: service.host.resolverNetwork.resolverIps ?? undefined,
+      },
+    };
+  } else if ("ipv4" in service.host && "ipv6" in service.host) {
+    host = {
+      ipv4: service.host.ipv4,
+      ipv6: service.host.ipv6,
+      network: { tunnelId: service.host.network.tunnelId },
+    };
+  } else if ("ipv4" in service.host) {
+    host = {
+      ipv4: service.host.ipv4,
+      network: { tunnelId: service.host.network.tunnelId },
+    };
+  } else {
+    host = {
+      ipv6: service.host.ipv6,
+      network: { tunnelId: service.host.network.tunnelId },
+    };
+  }
+  return {
+    serviceId: service.serviceId!,
+    serviceName: service.name,
+    serviceType: service.type as "http" | "tcp",
+    httpPort: service.httpPort ?? undefined,
+    httpsPort: service.httpsPort ?? undefined,
+    host,
+    accountId,
+    createdAt: service.createdAt
+      ? new Date(service.createdAt).getTime()
+      : undefined,
+    updatedAt: service.updatedAt
+      ? new Date(service.updatedAt).getTime()
+      : undefined,
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/VpcServiceRef.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/VpcServiceRef.ts
new file mode 100644
index 00000000000..5b706a790a8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/VpcServiceRef.ts
@@ -0,0 +1,66 @@
+import * as connectivity from "@distilled.cloud/cloudflare/connectivity";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { formatVpcService, type VpcServiceAttributes } from "./VpcService.ts";
+
+export type VpcServiceRefProps =
+  | {
+      /**
+       * The Cloudflare-assigned ID for the VPC service.
+       */
+      serviceId: string;
+    }
+  | {
+      /**
+       * The display name of the VPC service.
+       */
+      name: string;
+    };
+
+/**
+ * Reference to an existing VPC service. Same shape as the resource's outputs.
+ */
+export type VpcServiceRef = VpcServiceAttributes;
+
+/**
+ * Reference an existing Cloudflare VPC service without managing its lifecycle.
+ *
+ * @example Reference by ID
+ * ```typescript
+ * const service = yield* Cloudflare.VpcServiceRef({
+ *   serviceId: "123e4567-e89b-12d3-a456-426614174000",
+ * });
+ * ```
+ *
+ * @example Reference by name
+ * ```typescript
+ * const service = yield* Cloudflare.VpcServiceRef({
+ *   name: "my-vpc-service",
+ * });
+ * ```
+ */
+export const VpcServiceRef = (props: VpcServiceRefProps) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    if ("name" in props) {
+      const match = yield* connectivity.listDirectoryServices
+        .items({ accountId })
+        .pipe(
+          Stream.filter((s) => s.name === props.name),
+          Stream.runHead,
+          Effect.map(Option.getOrUndefined),
+        );
+      if (!match) {
+        return yield* Effect.die(`VPC service "${props.name}" not found`);
+      }
+      return formatVpcService(match, accountId);
+    }
+    const result = yield* connectivity.getDirectoryService({
+      accountId,
+      serviceId: props.serviceId,
+    });
+    return formatVpcService(result, accountId);
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/index.ts
new file mode 100644
index 00000000000..0b8bbc0a936
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/VpcService/index.ts
@@ -0,0 +1,2 @@
+export * from "./VpcService.ts";
+export * from "./VpcServiceRef.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/StaticSite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/StaticSite.ts
new file mode 100644
index 00000000000..ee1a825a4d4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/StaticSite.ts
@@ -0,0 +1,166 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { Command, type CommandProps } from "../../Build/Command.ts";
+import type { InputProps } from "../../Input.ts";
+import * as Namespace from "../../Namespace.ts";
+import type { AssetsConfig } from "../Workers/Assets.ts";
+import {
+  Worker,
+  type WorkerAssetsConfig,
+  type WorkerBindingProps,
+  type WorkerProps,
+} from "../Workers/Worker.ts";
+
+export interface StaticSiteProps<Bindings extends WorkerBindingProps = {}>
+  extends
+    Omit<WorkerProps<Bindings, WorkerAssetsConfig>, "assets" | "dev">,
+    Omit<CommandProps, "env"> {
+  /**
+   * Optional configuration for static asset routing behavior.
+   * Supports `runWorkerFirst`, `htmlHandling`, `notFoundHandling`, etc.
+   */
+  assetsConfig?: AssetsConfig;
+  dev?: {
+    command: string;
+  };
+}
+
+export type StaticSite = ReturnType<typeof StaticSite>;
+
+/**
+ * A Cloudflare Worker that serves static assets built by a shell command.
+ *
+ * `StaticSite` runs a build command (e.g. `npm run build`), content-hashes
+ * the output directory, and deploys the result as a Cloudflare Worker with
+ * static assets. Use this when your site has its own build step that
+ * produces a directory of files — Hugo, Zola, Eleventy, or any custom
+ * pipeline.
+ *
+ * For Vite-based projects, prefer `Cloudflare.Vite` which handles
+ * building automatically.
+ *
+ * @resource
+ *
+ * @section Basic Usage
+ * Point `command` at your build script, `outdir` at where it writes
+ * output, and `main` at a Worker entrypoint that serves the assets.
+ * Alchemy runs the command, hashes the output, and deploys the
+ * Worker bound to the built assets.
+ *
+ * The Worker receives an `ASSETS` binding it can delegate to. A
+ * minimal passthrough Worker looks like:
+ *
+ * ```typescript
+ * // src/worker.ts
+ * export default {
+ *   fetch: (request: Request, env: { ASSETS: Fetcher }) =>
+ *     env.ASSETS.fetch(request),
+ * };
+ * ```
+ *
+ * @example Deploying a Hugo site
+ * ```typescript
+ * const site = yield* Cloudflare.StaticSite("Blog", {
+ *   command: "hugo --minify",
+ *   outdir: "public",
+ *   main: "./src/worker.ts",
+ * });
+ * ```
+ *
+ * @section Asset Configuration
+ * Use `assetsConfig` to control how Cloudflare handles routing for
+ * your static files — HTML handling, not-found behavior, etc.
+ *
+ * @example SPA-style routing
+ * ```typescript
+ * const site = yield* Cloudflare.StaticSite("App", {
+ *   command: "npm run build",
+ *   outdir: "dist",
+ *   main: "./src/worker.ts",
+ *   assetsConfig: {
+ *     htmlHandling: "auto-trailing-slash",
+ *     notFoundHandling: "single-page-application",
+ *   },
+ * });
+ * ```
+ *
+ * @section Building from a Subdirectory
+ * Set `cwd` to run the build command in a subdirectory (e.g. a
+ * monorepo package). `outdir` is resolved relative to `cwd`.
+ *
+ * @example Building a frontend in a monorepo
+ * ```typescript
+ * const site = yield* Cloudflare.StaticSite("Web", {
+ *   cwd: "apps/web",
+ *   command: "npm run build",
+ *   outdir: "dist",
+ *   main: "apps/web/worker.ts",
+ * });
+ * ```
+ *
+ * @section Custom Rebuild Scope
+ * By default, all non-gitignored files are hashed to decide whether
+ * the build should re-run. Use `memo` to narrow the scope.
+ *
+ * @example Narrowing the memo scope
+ * ```typescript
+ * const site = yield* Cloudflare.StaticSite("Docs", {
+ *   command: "npm run build",
+ *   outdir: "dist",
+ *   main: "./src/worker.ts",
+ *   memo: {
+ *     include: ["content/**", "templates/**", "config.toml"],
+ *   },
+ * });
+ * ```
+ */
+export const StaticSite = <
+  const Bindings extends WorkerBindingProps = {},
+  Req = never,
+>(
+  id: string,
+  propsEff:
+    | InputProps<StaticSiteProps<Bindings>>
+    | Effect.Effect<InputProps<StaticSiteProps<Bindings>>, never, Req>,
+) =>
+  Effect.gen(function* () {
+    const props = Effect.isEffect(propsEff)
+      ? propsEff
+      : Effect.succeed(propsEff);
+
+    // TODO(sam): local dev/hmr support?
+    const build = yield* Command(
+      "Build",
+      Effect.map(props, (props) => ({
+        command: props.command,
+        cwd: props.cwd,
+        memo: props.memo,
+        outdir: props.outdir,
+        env: props.env
+          ? Object.fromEntries(
+              Object.entries(props.env).flatMap(([k, v]) => {
+                if (v === undefined) return [];
+                if (typeof v === "string" || Redacted.isRedacted(v))
+                  return [[k, v]];
+                return [[k, JSON.stringify(v)]];
+              }),
+            )
+          : undefined,
+      })),
+    );
+
+    return yield* Worker<Bindings, WorkerAssetsConfig, Req>(
+      "Worker",
+      Effect.map(props, (props) => ({
+        ...props,
+        assets: {
+          path: build.outdir,
+          hash: build.hash,
+          config: props.assetsConfig,
+        },
+        // Omit the dev command from WorkerProps since it's different from WorkerProps["dev"].
+        // TODO: we'll need to update this when we add local dev support for StaticSite.
+        dev: undefined,
+      })),
+    );
+  }).pipe(Namespace.push(id));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/Vite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/Vite.ts
new file mode 100644
index 00000000000..97dc32eb60d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/Vite.ts
@@ -0,0 +1,132 @@
+import * as Effect from "effect/Effect";
+import type { MemoOptions } from "../../Build/Memo.ts";
+import type { InputProps } from "../../Input.ts";
+import {
+  Worker,
+  type WorkerAssetsConfig,
+  type WorkerBindingProps,
+  type WorkerProps,
+} from "../Workers/Worker.ts";
+
+export interface ViteProps<
+  Bindings extends WorkerBindingProps = {},
+> extends Omit<WorkerProps<Bindings>, "vite" | "main"> {
+  /**
+   * Root directory passed to Vite's `root` option.
+   * Defaults to the current working directory (`process.cwd()`).
+   */
+  rootDir?: string;
+  /**
+   * Controls which files are hashed to decide whether a rebuild is needed.
+   * By default every non-gitignored file in `cwd` is hashed, plus the nearest
+   * lockfile. Provide explicit globs to narrow the scope.
+   *
+   * @see {@link MemoOptions}
+   */
+  memo?: MemoOptions;
+}
+
+/**
+ * A Cloudflare Worker deployed from a Vite project.
+ *
+ * `Vite` uses the Cloudflare Vite plugin to build both the server bundle
+ * and client assets in a single `vite build` invocation — no manual
+ * `main` entrypoint, build command, output directory, or Wrangler
+ * configuration required.
+ *
+ * Input files are content-hashed (respecting `.gitignore` by default) so
+ * unchanged projects skip the build and deploy entirely.
+ *
+ * @resource
+ *
+ * @section Deploying a Static Site
+ * For a pure static site (no SSR), a single call is all you need.
+ * Vite builds the project and Alchemy deploys the output as a
+ * Cloudflare Worker with static assets.
+ *
+ * @example Static Vite site
+ * ```typescript
+ * const site = yield* Cloudflare.Vite("Website");
+ * ```
+ *
+ * @section SSR Frameworks
+ * For SSR frameworks like TanStack Start, SolidStart, or Nuxt, enable
+ * `nodejs_compat` so the server bundle can use Node.js APIs.
+ *
+ * @example TanStack Start
+ * ```typescript
+ * const app = yield* Cloudflare.Vite("TanStackStart", {
+ *   compatibility: {
+ *     flags: ["nodejs_compat"],
+ *   },
+ * });
+ * ```
+ *
+ * @example SolidStart with worker-first routing
+ * ```typescript
+ * const app = yield* Cloudflare.Vite("SolidStart", {
+ *   compatibility: {
+ *     flags: ["nodejs_compat"],
+ *   },
+ *   assets: {
+ *     config: { runWorkerFirst: true },
+ *   },
+ * });
+ * ```
+ *
+ * @section Single-Page Applications
+ * For SPAs (React, Vue, etc.), configure asset handling so all
+ * routes fall back to `index.html`.
+ *
+ * @example Vue SPA
+ * ```typescript
+ * const app = yield* Cloudflare.Vite("Vue", {
+ *   compatibility: {
+ *     flags: ["nodejs_compat"],
+ *   },
+ *   assets: {
+ *     config: {
+ *       htmlHandling: "auto-trailing-slash",
+ *       notFoundHandling: "single-page-application",
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * @section Custom Rebuild Scope
+ * By default, every non-gitignored file is hashed to decide whether
+ * a rebuild is needed. Use `memo` to narrow the scope when your
+ * project has large directories that don't affect the build output.
+ *
+ * @example Narrowing the memo scope
+ * ```typescript
+ * const site = yield* Cloudflare.Vite("Docs", {
+ *   memo: {
+ *     include: ["src/**", "content/**", "package.json"],
+ *   },
+ * });
+ * ```
+ */
+export const Vite = <
+  const Bindings extends WorkerBindingProps = {},
+  Req = never,
+>(
+  id: string,
+  propsEff?:
+    | InputProps<ViteProps<Bindings>>
+    | Effect.Effect<InputProps<ViteProps<Bindings>>, never, Req>,
+) =>
+  Worker<Bindings, WorkerAssetsConfig, Req>(
+    id,
+    Effect.map(
+      Effect.isEffect(propsEff) ? propsEff : Effect.succeed(propsEff),
+      (props) => ({
+        ...props,
+        main: undefined!,
+        vite: {
+          rootDir: props?.rootDir,
+          memo: props?.memo,
+        },
+      }),
+    ),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/index.ts
new file mode 100644
index 00000000000..8eebcdf3c51
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Website/index.ts
@@ -0,0 +1,2 @@
+export * from "./StaticSite.ts";
+export * from "./Vite.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Assets.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Assets.ts
new file mode 100644
index 00000000000..186127caf19
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Assets.ts
@@ -0,0 +1,271 @@
+import createIgnore from "@alchemy.run/node-utils/ignore";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import type { PlatformError } from "effect/PlatformError";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { sha256, sha256Object } from "../../Util/index.ts";
+
+const MAX_ASSET_SIZE = 1024 * 1024 * 25; // 25MB
+const MAX_ASSET_COUNT = 20_000;
+
+export interface Assets {
+  kind: "Cloudflare.Workers.Assets";
+}
+
+export const isAssets = (value: any): value is Assets =>
+  value?.kind === "Cloudflare.Workers.Assets";
+
+export interface AssetsConfig extends Exclude<
+  Exclude<workers.PutScriptRequest["metadata"]["assets"], undefined>["config"],
+  undefined
+> {}
+
+export interface AssetReadResult {
+  directory: string;
+  config: AssetsConfig | undefined;
+  manifest: Record<string, { hash: string; size: number }>;
+  _headers: string | undefined;
+  _redirects: string | undefined;
+  hash: string;
+}
+
+export interface AssetsProps {
+  directory: string;
+  config?: AssetsConfig;
+}
+
+export type ValidationError =
+  | AssetTooLargeError
+  | TooManyAssetsError
+  | AssetNotFoundError
+  | FailedToReadAssetError;
+
+export class AssetTooLargeError extends Data.TaggedError("AssetTooLargeError")<{
+  message: string;
+  name: string;
+  size: number;
+}> {}
+
+export class TooManyAssetsError extends Data.TaggedError("TooManyAssetsError")<{
+  message: string;
+  directory: string;
+  count: number;
+}> {}
+
+export class AssetNotFoundError extends Data.TaggedError("AssetNotFoundError")<{
+  message: string;
+  hash: string;
+}> {}
+
+export class FailedToReadAssetError extends Data.TaggedError(
+  "FailedToReadAssetError",
+)<{
+  message: string;
+  name: string;
+  cause: PlatformError;
+}> {}
+
+const getContentType = (name: string) => {
+  if (name.endsWith(".html")) return "text/html";
+  if (name.endsWith(".txt")) return "text/plain";
+  if (name.endsWith(".sql")) return "text/sql";
+  if (name.endsWith(".json")) return "application/json";
+  if (name.endsWith(".js") || name.endsWith(".mjs")) {
+    // Browsers only accept JavaScript module scripts when the MIME type is a
+    // "JavaScript MIME type" (e.g. text/javascript). application/javascript+module
+    // is not valid and causes strict module loading to fail.
+    return "text/javascript; charset=utf-8";
+  }
+  if (name.endsWith(".css")) return "text/css";
+  if (name.endsWith(".wasm")) return "application/wasm";
+  if (name.endsWith(".png")) return "image/png";
+  if (name.endsWith(".svg")) return "image/svg+xml";
+  if (name.endsWith(".ico")) return "image/x-icon";
+  return "application/octet-stream";
+};
+
+const maybeReadString = Effect.fnUntraced(function* (file: string) {
+  const fs = yield* FileSystem.FileSystem;
+  return yield* fs.readFileString(file).pipe(
+    Effect.catchIf(
+      (error) =>
+        error._tag === "PlatformError" && error.reason._tag === "NotFound",
+      () => Effect.succeed(undefined),
+    ),
+  );
+});
+
+const createIgnoreMatcher = (patterns: string[]) => {
+  const matcher = createIgnore().add(patterns);
+  return (file: string) => matcher.ignores(file);
+};
+
+export const readAssets = Effect.fnUntraced(function* (props: AssetsProps) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const resolvedDirectory = path.resolve(props.directory);
+  const [files, ignore, _headers, _redirects] = yield* Effect.all([
+    fs.readDirectory(resolvedDirectory, { recursive: true }),
+    maybeReadString(path.join(resolvedDirectory, ".assetsignore")),
+    maybeReadString(path.join(resolvedDirectory, "_headers")),
+    maybeReadString(path.join(resolvedDirectory, "_redirects")),
+  ]);
+  const ignores = createIgnoreMatcher([
+    ".assetsignore",
+    "_headers",
+    "_redirects",
+    ...(ignore
+      ?.split("\n")
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0 && !line.startsWith("#")) ?? []),
+  ]);
+  const manifest = new Map<string, { hash: string; size: number }>();
+  let count = 0;
+  yield* Effect.forEach(
+    files,
+    Effect.fnUntraced(function* (name) {
+      if (ignores(name)) {
+        return;
+      }
+      const file = path.join(resolvedDirectory, name);
+      const stat = yield* fs.stat(file);
+      if (stat.type !== "File") {
+        return;
+      }
+      const size = Number(stat.size);
+      if (size > MAX_ASSET_SIZE) {
+        return yield* new AssetTooLargeError({
+          message: `Asset ${name} is too large (the maximum size is ${MAX_ASSET_SIZE / 1024 / 1024} MB; this asset is ${size / 1024 / 1024} MB)`,
+          name,
+          size,
+        });
+      }
+      const hash = yield* fs.readFile(file).pipe(
+        Effect.flatMap(sha256),
+        Effect.map((hash) => hash.slice(0, 32)),
+      );
+      count++;
+      if (count > MAX_ASSET_COUNT) {
+        return yield* new TooManyAssetsError({
+          message: `Too many assets (the maximum count is ${MAX_ASSET_COUNT}; this directory has ${count} assets)`,
+          directory: props.directory,
+          count,
+        });
+      }
+      manifest.set(
+        (name.startsWith("/") ? name : `/${name}`).replaceAll("\\", "/"),
+        {
+          hash,
+          size,
+        },
+      );
+    }),
+  );
+  const sortedManifest = Object.fromEntries(
+    Array.from(manifest.entries()).sort((a, b) => a[0].localeCompare(b[0])),
+  );
+  // Hash only inputs that affect what gets uploaded — the file
+  // manifest, asset config, and the special `_headers` / `_redirects`
+  // files. `directory` is deliberately excluded: identical bytes at a
+  // different absolute path must produce the same hash, otherwise
+  // diffing across machines (CI runner → local laptop, monorepo
+  // root → workspace root, etc.) spuriously reports "changed" and
+  // causes both unnecessary re-uploads and `NotFound` failures when
+  // the previously-recorded path is gone.
+  const hash = yield* sha256Object({
+    config: props.config,
+    manifest: sortedManifest,
+    _headers,
+    _redirects,
+  });
+  return {
+    directory: props.directory,
+    config: props.config,
+    manifest: sortedManifest,
+    _headers,
+    _redirects,
+    hash,
+  };
+});
+
+export const uploadAssets = Effect.fnUntraced(function* (
+  accountId: string,
+  workerName: string,
+  assets: AssetReadResult,
+  { note }: ScopedPlanStatusSession,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const createScriptAssetUpload = yield* workers.createScriptAssetUpload;
+  const createAssetUpload = yield* workers.createAssetUpload;
+
+  yield* note("Checking assets...");
+  const session = yield* createScriptAssetUpload({
+    accountId,
+    scriptName: workerName,
+    manifest: assets.manifest,
+  });
+  if (!session.buckets?.length) {
+    return { jwt: session.jwt ?? undefined };
+  }
+  if (!session.jwt) {
+    return { jwt: undefined };
+  }
+  const uploadJwt = session.jwt;
+  let uploaded = 0;
+  const total = session.buckets.flat().length;
+  yield* note(`Uploaded ${uploaded} of ${total} assets...`);
+  const assetsByHash = new Map<string, string>();
+  for (const [name, { hash }] of Object.entries(assets.manifest)) {
+    assetsByHash.set(hash, name);
+  }
+  let jwt: string | undefined | null;
+  const directory = path.resolve(assets.directory);
+  yield* Effect.forEach(
+    session.buckets,
+    Effect.fnUntraced(function* (bucket) {
+      const body: Record<string, File> = {};
+      yield* Effect.forEach(
+        bucket,
+        Effect.fnUntraced(function* (hash) {
+          const name = assetsByHash.get(hash);
+          if (!name) {
+            return yield* new AssetNotFoundError({
+              message: `Asset ${hash} not found in manifest`,
+              hash,
+            });
+          }
+          const file = yield* fs.readFile(path.join(directory, name)).pipe(
+            Effect.mapError(
+              (error) =>
+                new FailedToReadAssetError({
+                  message: `Failed to read asset ${name}: ${error.message}`,
+                  name,
+                  cause: error,
+                }),
+            ),
+          );
+          body[hash] = new File([Buffer.from(file).toString("base64")], hash, {
+            type: getContentType(name),
+          });
+        }),
+      );
+      const result = yield* createAssetUpload({
+        accountId,
+        base64: true,
+        body,
+        jwtToken: uploadJwt,
+      });
+
+      uploaded += bucket.length;
+      yield* note(`Uploaded ${uploaded} of ${total} assets...`);
+      if (result.jwt) {
+        jwt = result.jwt;
+      }
+    }),
+  );
+  return { jwt: jwt ?? undefined };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Compatibility.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Compatibility.ts
new file mode 100644
index 00000000000..beeeecc1fe0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Compatibility.ts
@@ -0,0 +1,12 @@
+import type { WorkerProps } from "./Worker.ts";
+
+// TODO: figure out why the later one from workerd breaks
+const DEFAULT_COMPATIBILITY_DATE = "2026-03-17";
+
+export const getCompatibility = (props: WorkerProps) => ({
+  date: props.compatibility?.date ?? DEFAULT_COMPATIBILITY_DATE,
+  flags: [
+    ...(props.compatibility?.flags ?? []),
+    ...(props.isExternal ? [] : ["nodejs_compat"]),
+  ].filter((value, index, self) => self.indexOf(value) === index),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/ConfigProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/ConfigProvider.ts
new file mode 100644
index 00000000000..75dbd7178ca
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/ConfigProvider.ts
@@ -0,0 +1,9 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+
+import cloudflare_workers from "./cloudflare_workers.ts";
+
+export const WorkerConfigProvider = () =>
+  cloudflare_workers.pipe(
+    Effect.map(({ env }) => ConfigProvider.fromUnknown(env)),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/CronEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/CronEventSource.ts
new file mode 100644
index 00000000000..e0eb6eca9c8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/CronEventSource.ts
@@ -0,0 +1,89 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Binding from "../../Binding.ts";
+import type { ResourceLike } from "../../Resource.ts";
+import { RuntimeContext } from "../../RuntimeContext.ts";
+import type { FunctionContext } from "../../Serverless/Function.ts";
+import { isWorker, isWorkerEvent } from "./Worker.ts";
+
+/**
+ * Subscribe to Cloudflare Cron Triggers with an Effect handler.
+ *
+ * This wires both pieces of a scheduled Worker:
+ *
+ * - **Runtime**: registers a `scheduled` listener on the Worker.
+ * - **Deploy-time**: attaches the cron expression to the host Worker.
+ *
+ * @example
+ * ```typescript
+ * yield* Cloudflare.cron("0 12 * * *").subscribe((controller) =>
+ *   Effect.log(`scheduled at ${controller.scheduledTime}`),
+ * );
+ * ```
+ */
+export const cron = (expression: string) => ({
+  subscribe: <Req = never>(
+    process: (
+      controller: cf.ScheduledController,
+    ) => Effect.Effect<void, unknown, Req>,
+  ) => CronEventSource.use((source) => source(expression, process)),
+});
+
+export type CronEventSourceService = <Req = never>(
+  expression: string,
+  process: (
+    controller: cf.ScheduledController,
+  ) => Effect.Effect<void, unknown, Req>,
+) => Effect.Effect<void, never, never>;
+
+export class CronEventSource extends Context.Service<
+  CronEventSource,
+  CronEventSourceService
+>()("Cloudflare.Workers.CronEventSource") {}
+
+export class CronEventSourcePolicy extends Binding.Policy<
+  CronEventSourcePolicy,
+  (expression: string) => Effect.Effect<void>
+>()("Cloudflare.Workers.CronEventSource") {}
+
+export const CronEventSourcePolicyLive = CronEventSourcePolicy.layer.succeed(
+  Effect.fnUntraced(function* (host: ResourceLike, expression: string) {
+    if (isWorker(host)) {
+      yield* host.bind(`Cron(${expression})`, {
+        crons: [expression],
+      });
+    } else {
+      return yield* Effect.die(
+        `Cloudflare.cron(...).subscribe(...) is only supported on ` +
+          `Cloudflare.Worker hosts (got '${host.Type}').`,
+      );
+    }
+  }),
+);
+
+export const CronEventSourceLive = Layer.effect(
+  CronEventSource,
+  Effect.gen(function* () {
+    const policy = yield* CronEventSourcePolicy;
+    return Effect.fn(function* <Req>(
+      expression: string,
+      process: (
+        controller: cf.ScheduledController,
+      ) => Effect.Effect<void, unknown, Req>,
+    ) {
+      yield* policy(expression);
+
+      const ctx = (yield* RuntimeContext) as unknown as FunctionContext;
+      yield* ctx.listen<void, Req>((event) => {
+        if (!isWorkerEvent(event) || event.type !== "scheduled") return;
+
+        const controller = event.input as cf.ScheduledController;
+        if (controller.cron !== expression) return;
+
+        return process(controller).pipe(Effect.catchCause(() => Effect.void));
+      });
+    }) as CronEventSourceService;
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectBridge.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectBridge.ts
new file mode 100644
index 00000000000..0b647400d65
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectBridge.ts
@@ -0,0 +1,191 @@
+import type * as cf from "@cloudflare/workers-types";
+import type { DurableObject as DurableObjectClass } from "cloudflare:workers";
+
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+
+import { HttpServerResponse } from "effect/unstable/http";
+import type {
+  DurableObjectExport,
+  DurableObjectShape,
+} from "./DurableObjectNamespace.ts";
+import {
+  DurableObjectState,
+  fromDurableObjectState,
+} from "./DurableObjectState.ts";
+import { isScopeEjected, makeRequestEffect } from "./HttpServer.ts";
+import { fromWebSocket } from "./WebSocket.ts";
+import { getWorkerExport, handleRpcExit } from "./WorkerBridge.ts";
+
+/**
+ * Create a DurableObjectBridge class that proxies RPC method calls through
+ * the Effect runtime, encoding success/fail/stream results as RPC envelopes.
+ *
+ * Accepts the `DurableObject` base class and a `getExport` resolver so the
+ * implementation lives in real TypeScript instead of a generated string template.
+ */
+export const makeDurableObjectBridge =
+  (
+    DurableObject: typeof DurableObjectClass,
+    {
+      entrypoint,
+      stack,
+    }: {
+      entrypoint: Effect.Effect<Record<string, any>>;
+      stack: {
+        name: string;
+        stage: string;
+      };
+    },
+  ) =>
+  (className: string) =>
+    class DurableObjectBridge extends DurableObject {
+      #state;
+      #globalContext;
+      #exported;
+      #instance;
+      constructor(state: cf.DurableObjectState, env: any) {
+        super(state as any, env);
+        this.#state = state;
+
+        const { globalContext, exported } =
+          getWorkerExport<DurableObjectExport>({
+            entrypoint,
+            stack,
+            exportName: className,
+          });
+
+        this.#globalContext = globalContext;
+        this.#exported = exported;
+
+        this.#instance = state.blockConcurrencyWhile(() =>
+          this.#exported.pipe(
+            Effect.flatMap(({ constructor, services }) =>
+              constructor.pipe(
+                Effect.provide(
+                  Layer.succeed(
+                    DurableObjectState,
+                    fromDurableObjectState(this.#state),
+                  ).pipe(Layer.provideMerge(Layer.succeedContext(services))),
+                ),
+                Effect.map((instance) => ({ instance, services })),
+              ),
+            ),
+            Effect.provide(this.#globalContext),
+            Effect.runPromise,
+          ),
+        );
+
+        return new Proxy(this, {
+          get: (target, prop) => {
+            const bind = (f: any) =>
+              typeof f === "function" ? f.bind(target) : f;
+            if (typeof prop !== "string") return bind((target as any)[prop]);
+            if (prop in target) return bind((target as any)[prop]);
+            return async (...args: any[]) =>
+              this.#execute((instance) => {
+                const method = instance[prop as keyof DurableObjectShape];
+                if (typeof method === "function") {
+                  const result = (method as any)(...args);
+                  // A streaming RPC method returns a `Stream` directly rather
+                  // than an `Effect`. Lift it into the success channel so the
+                  // resulting `Exit.value` is the `Stream` and `handleRpcExit`
+                  // can encode it as a stream envelope instead of trying to run
+                  // it as an effect.
+                  return Stream.isStream(result)
+                    ? Effect.succeed(result)
+                    : result;
+                } else if (Effect.isEffect(method)) {
+                  return method;
+                } else {
+                  return Effect.succeed(method);
+                }
+              }, handleRpcExit);
+          },
+        });
+      }
+
+      async #execute(
+        fn: (instance: DurableObjectShape) => Effect.Effect<any, any, any>,
+        onExit?: (exit: Exit.Exit<any, any>) => Promise<any>,
+      ) {
+        const scope = Scope.makeUnsafe();
+
+        const { instance, services } = await this.#instance;
+
+        return fn(instance)
+          .pipe(
+            Effect.provide(
+              Layer.succeed(
+                DurableObjectState,
+                fromDurableObjectState(this.#state),
+              ).pipe(
+                Layer.provideMerge(Layer.succeed(Scope.Scope, scope)),
+                Layer.provideMerge(Layer.succeedContext(services)),
+                Layer.provideMerge(this.#globalContext),
+              ),
+            ),
+            Effect.runPromiseExit,
+          )
+          .then(
+            onExit ??
+              ((exit) =>
+                exit._tag === "Success"
+                  ? Promise.resolve(exit.value)
+                  : Promise.reject(Cause.squash(exit.cause))),
+          )
+          .finally(() =>
+            isScopeEjected(scope)
+              ? undefined
+              : Scope.close(scope, Exit.void).pipe(
+                  Effect.runPromise,
+                  (promise) => this.ctx.waitUntil(promise),
+                ),
+          );
+      }
+
+      async fetch(request: Request): Promise<any> {
+        return this.#execute((instance) =>
+          instance.fetch
+            ? makeRequestEffect(request as any, instance.fetch)
+            : Effect.succeed(
+                HttpServerResponse.text("Not implemented", {
+                  status: 404,
+                }),
+              ),
+        );
+      }
+
+      async alarm(alarmInfo?: cf.AlarmInvocationInfo) {
+        return this.#execute((instance) => instance.alarm!(alarmInfo));
+      }
+
+      async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer) {
+        return this.#execute(
+          (instance) =>
+            instance.webSocketMessage?.(fromWebSocket(ws as any), message) ??
+            Effect.void,
+        );
+      }
+
+      async webSocketClose(
+        ws: WebSocket,
+        code: number,
+        reason: string,
+        wasClean: boolean,
+      ) {
+        return this.#execute(
+          (instance) =>
+            instance.webSocketClose?.(
+              fromWebSocket(ws as any),
+              code,
+              reason,
+              wasClean,
+            ) ?? Effect.void,
+        );
+      }
+    } as any;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectNamespace.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectNamespace.ts
new file mode 100644
index 00000000000..37c883802f7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectNamespace.ts
@@ -0,0 +1,932 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { HttpServerError } from "effect/unstable/http/HttpServerError";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import type { Dependencies } from "../../Dependencies.ts";
+import type { HttpEffect } from "../../Http.ts";
+import type { Input } from "../../Input.ts";
+import * as Output from "../../Output.ts";
+import { ALCHEMY_PHASE } from "../../Phase.ts";
+import type { PlatformServices } from "../../Platform.ts";
+import { effectClass, taggedFunction } from "../../Util/effect.ts";
+import { asEffect } from "../../Util/types.ts";
+import { DurableObjectState } from "./DurableObjectState.ts";
+import { makeRpcStub } from "./Rpc.ts";
+import { type DurableWebSocket } from "./WebSocket.ts";
+import { Worker, WorkerEnvironment, type WorkerServices } from "./Worker.ts";
+
+export interface DurableObjectExport {
+  readonly kind: "durableObject";
+  readonly constructor: Effect.Effect<
+    DurableObjectShape,
+    never,
+    DurableObjectState
+  >;
+  readonly services: Context.Context<never>;
+}
+
+export const isDurableObjectExport = (
+  value: unknown,
+): value is DurableObjectExport =>
+  typeof value === "object" && (value as any)?.kind === "durableObject";
+
+export type DurableObjectId = cf.DurableObjectId;
+export type DurableObjectJurisdiction = cf.DurableObjectJurisdiction;
+export type DurableObjectNamespaceGetDurableObjectOptions =
+  cf.DurableObjectNamespaceGetDurableObjectOptions;
+
+export type AlarmInvocationInfo = cf.AlarmInvocationInfo;
+
+type TypeId = "Cloudflare.DurableObjectNamespace";
+const TypeId = "Cloudflare.DurableObjectNamespace";
+
+export const isDurableObjectNamespaceLike = (
+  value: unknown,
+): value is DurableObjectNamespaceLike =>
+  typeof value === "object" && (value as any)?.kind === TypeId;
+
+export interface DurableObjectNamespaceLike<Shape = any> {
+  kind: TypeId;
+  name: string;
+  /** @internal phantom */
+  className?: string;
+  /** @internal phantom */
+  scriptName?: Input<string>;
+  /** @internal phantom */
+  Shape?: Shape;
+}
+
+export interface DurableObjectNamespace<
+  Shape = unknown,
+> extends DurableObjectNamespaceLike<Shape> {
+  Type: TypeId;
+  name: string;
+  namespaceId: Output.Output<string>;
+  getByName: (name: string) => DurableObjectStub<Shape>;
+  newUniqueId: () => DurableObjectId;
+  idFromName: (name: string) => DurableObjectId;
+  idFromString: (id: string) => DurableObjectId;
+  get: (
+    id: DurableObjectId,
+    options?: DurableObjectNamespaceGetDurableObjectOptions,
+  ) => DurableObjectStub<Shape>;
+  jurisdiction: (
+    jurisdiction: DurableObjectJurisdiction,
+  ) => DurableObjectNamespace<Shape>;
+}
+
+export interface DurableObjectShape {
+  fetch?: HttpEffect<DurableObjectState>;
+  alarm?: (
+    alarmInfo?: AlarmInvocationInfo,
+  ) => Effect.Effect<void, never, never>;
+  webSocketMessage?: (
+    socket: DurableWebSocket,
+    message: string | ArrayBuffer,
+  ) => Effect.Effect<void>;
+  webSocketClose?: (
+    socket: DurableWebSocket,
+    code: number,
+    reason: string,
+    wasClean: boolean,
+  ) => Effect.Effect<void>;
+}
+
+export type DurableObjectServices =
+  | DurableObjectNamespace
+  | DurableObjectState
+  | WorkerServices
+  | WorkerEnvironment
+  | PlatformServices;
+
+export interface DurableObjectNamespaceProps {
+  /**
+   * Name of the exported `DurableObject` class.
+   *
+   * @default name
+   */
+  className?: string;
+  /**
+   * Worker script that hosts the Durable Object class. Omit this when the
+   * namespace is hosted by the Worker that declares the binding.
+   */
+  scriptName?: Input<string> | undefined;
+  // environment?: string | undefined;
+  // sqlite?: boolean | undefined;
+  // namespaceId?: string | undefined;
+}
+
+export interface DurableObjectNamespaceClass extends Effect.Effect<
+  DurableObjectNamespace,
+  never,
+  DurableObjectNamespace
+> {
+  <Self, Shape>(): {
+    <Name extends string>(
+      name: Name,
+    ): Effect.Effect<DurableObjectNamespace<Self>, never, Worker | Self> & {
+      new (_: never): Shape & {
+        /** @internal */
+        "~alchemy/name": Name;
+      };
+      from(
+        scriptName: Input<string>,
+      ): Effect.Effect<DurableObjectNamespace<Self>, never, Worker>;
+      from<Req = never>(
+        worker:
+          | Dependencies<Self>
+          | Effect.Effect<Dependencies<Self>, never, Req>,
+      ): Effect.Effect<DurableObjectNamespace<Self>, never, Worker | Req>;
+      make<InitReq = never>(
+        impl: Effect.Effect<
+          Effect.Effect<Shape, never, DurableObjectServices>,
+          never,
+          InitReq
+        >,
+      ): Layer.Layer<
+        Self,
+        never,
+        Worker | Exclude<InitReq, DurableObjectServices>
+      >;
+    };
+  };
+  <Self>(): {
+    <Shape, InitReq = never>(
+      name: string,
+      impl: Effect.Effect<
+        Effect.Effect<Shape, never, DurableObjectServices>,
+        never,
+        InitReq
+      >,
+    ): Effect.Effect<
+      DurableObjectNamespace<Self>,
+      never,
+      Worker | Exclude<InitReq, DurableObjectServices>
+    > & {
+      new (_: never): Shape;
+    };
+  };
+  <Shape>(
+    name: string,
+    props?: DurableObjectNamespaceProps,
+  ): DurableObjectNamespaceLike<Shape>;
+  <Shape, InitReq = never>(
+    name: string,
+    impl: Effect.Effect<
+      Effect.Effect<Shape, never, DurableObjectServices>,
+      never,
+      InitReq
+    >,
+  ): Effect.Effect<
+    DurableObjectNamespace<Shape>,
+    never,
+    Worker | Exclude<InitReq, DurableObjectServices>
+  >;
+}
+
+export class DurableObjectNamespaceScope extends Context.Service<
+  DurableObjectNamespaceScope,
+  DurableObjectNamespace
+>()("Cloudflare.DurableObjectNamespace") {}
+
+/**
+ * A Cloudflare Durable Object namespace that manages globally unique, stateful
+ * instances with WebSocket hibernation support.
+ *
+ * A Durable Object uses a two-phase pattern with two nested `Effect.gen`
+ * blocks. The outer Effect resolves shared dependencies (other DOs,
+ * containers, etc.). The inner Effect runs once per instance and returns
+ * the object's public methods and WebSocket handlers.
+ *
+ * ```typescript
+ * Effect.gen(function* () {
+ *   // Phase 1: resolve shared dependencies
+ *   const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ *   return Effect.gen(function* () {
+ *     // Phase 2: per-instance setup and public API
+ *     const state = yield* Cloudflare.DurableObjectState;
+ *
+ *     return {
+ *       save: (data: string) => db.exec("INSERT ..."),
+ *       fetch: Effect.gen(function* () { ... }),
+ *       webSocketMessage: Effect.fnUntraced(function* (ws, msg) { ... }),
+ *     };
+ *   });
+ * })
+ * ```
+ *
+ * There are two ways to define a Durable Object. See the
+ * {@link https://alchemy.run/concepts/platform | Platform concept} page
+ * for the full explanation.
+ *
+ * - **Inline** — Effect implementation passed directly, single file.
+ * - **Modular** — class and implementation in separate files for tree-shaking.
+ *
+ * @resource
+ *
+ * @section Inline Durable Objects
+ * Pass the Effect implementation as the second argument. This is the
+ * simplest approach — everything lives in one file. Convenient when
+ * the DO doesn't need to be referenced by other Workers or DOs that
+ * would pull in its runtime dependencies.
+ *
+ * @example Inline Durable Object
+ * ```typescript
+ * export default class Counter extends Cloudflare.DurableObjectNamespace<Counter>()(
+ *   "Counter",
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ *     return Effect.gen(function* () {
+ *       const state = yield* Cloudflare.DurableObjectState;
+ *       const count = (yield* state.storage.get<number>("count")) ?? 0;
+ *
+ *       return {
+ *         // runtime: use them
+ *         increment: () =>
+ *           Effect.gen(function* () {
+ *             const next = count + 1;
+ *             yield* state.storage.put("count", next);
+ *             return next;
+ *           }),
+ *         get: () => Effect.succeed(count),
+ *       };
+ *     });
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Modular Durable Objects
+ * When a Worker and a DO reference each other, or multiple Workers
+ * bind the same DO, define the class separately from its `.make()`
+ * call. The class is a lightweight identifier; `.make()` provides
+ * the runtime implementation as an `export default`. Rolldown treats
+ * `.make()` as pure, so the bundler tree-shakes it and all its
+ * runtime dependencies out of any consumer's bundle.
+ *
+ * The class and `.make()` can live in the same file. This is the
+ * same pattern used by `Worker` and `Container`.
+ *
+ * @example Modular Durable Object (class + .make() in one file)
+ * ```typescript
+ * // src/Counter.ts
+ * export class Counter extends Cloudflare.DurableObjectNamespace<Counter>()(
+ *   "Counter",
+ * ) {}
+ *
+ * export default Counter.make(
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ *     return Effect.gen(function* () {
+ *       const state = yield* Cloudflare.DurableObjectState;
+ *       const count = (yield* state.storage.get<number>("count")) ?? 0;
+ *
+ *       return {
+ *         // runtime: use them
+ *         increment: () =>
+ *           Effect.gen(function* () {
+ *             const next = count + 1;
+ *             yield* state.storage.put("count", next);
+ *             yield* db.prepare("INSERT INTO logs (count) VALUES (?)").bind(next).run();
+ *             return next;
+ *           }),
+ *         get: () => Effect.succeed(count),
+ *       };
+ *     });
+ *   }),
+ * );
+ * ```
+ *
+ * @example Binding a modular DO from a Worker
+ * ```typescript
+ * // imports Counter; bundler tree-shakes .make()
+ * import Counter from "./Counter.ts";
+ *
+ * // init
+ * const counters = yield* Counter;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const counter = counters.getByName("user-123");
+ *     return HttpServerResponse.text(String(yield* counter.get()));
+ *   }),
+ * };
+ * ```
+ *
+ * @section Cross-Worker Binding
+ * A Durable Object is _hosted_ by exactly one Worker, but any
+ * number of other Workers can bind to the same DO. This is how
+ * you share state across Workers: one Worker hosts the DO, every
+ * other Worker addresses it by `scriptName` and gets a typed stub.
+ *
+ * To make this type-safe, the **host Worker** must declare the DO
+ * as part of its public contract via the third type argument to
+ * `Cloudflare.Worker<Self, Bindings, Deps>()`. `Deps` is the set
+ * of DO classes (or other Workers) the script exposes for other
+ * scripts to bind to.
+ *
+ * @example Host Worker declares the DO in its contract
+ * ```typescript
+ * // workerA.ts — hosts Counter
+ * import { Counter, CounterLive } from "./object.ts";
+ *
+ * //                                       ^^^^^^^ declared as part of WorkerA's public contract
+ * export class WorkerA extends Cloudflare.Worker<WorkerA, {}, Counter>()(
+ *   "WorkerA",
+ *   { main: import.meta.filename },
+ * ) {}
+ *
+ * // WorkerA's Layer also provides the DO's Live implementation.
+ * export default WorkerA.make(
+ *   Effect.gen(function* () {
+ *     const counter = yield* Counter;
+ *     return { fetch: Effect.gen(function* () { ... }) };
+ *   }).pipe(Effect.provide(CounterLive)),
+ * );
+ * ```
+ *
+ * @example Consumer Worker binds the DO via `Counter.from(WorkerA)`
+ * ```typescript
+ * // workerB.ts — binds to the same Counter, hosted by WorkerA
+ * import { Counter } from "./object.ts";
+ * import { WorkerA } from "./workerA.ts";
+ *
+ * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+ *   "WorkerB",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     //              ^^^^^^^^^^^^ scriptName-bound stub of WorkerA's Counter
+ *     const counter = yield* Counter.from(WorkerA);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const value = yield* counter.getByName("shared").get();
+ *         return HttpServerResponse.text(String(value));
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * :::tip
+ * The `, Counter` in `Worker<WorkerA, {}, Counter>` is what makes
+ * `Counter.from(WorkerA)` type-check. You can still bind across
+ * scripts without it (the runtime works either way), but consumers
+ * will get a TypeScript error because `WorkerA` doesn't declare
+ * `Counter` as part of its public contract.
+ * :::
+ *
+ * Only the host Worker's Stack provides `CounterLive` — the
+ * consumer Worker just imports the `Counter` class as a typed
+ * identifier. Rolldown tree-shakes `CounterLive` (and its
+ * dependencies) out of WorkerB's bundle.
+ *
+ * @section Using `.from(Self)` Inside the Host
+ * Inside the host Worker, `yield* Counter` and
+ * `yield* Counter.from(Self)` resolve to the same local namespace.
+ * The `.from(Self)` form is preferred — especially in code that
+ * may be extracted into a reusable Layer — because it makes the
+ * scriptName explicit and lets the same Layer shape work whether
+ * the consumer is the host or another script.
+ *
+ * @example `Counter.from(WorkerA)` inside WorkerA itself
+ * ```typescript
+ * // workerA.ts — host uses `.from(Self)` instead of bare `yield* Counter`
+ * export default WorkerA.make(
+ *   Effect.gen(function* () {
+ *     const counter = yield* Counter.from(WorkerA); // same as `yield* Counter`
+ *     return { fetch: Effect.gen(function* () { ... }) };
+ *   }).pipe(Effect.provide(CounterLive)),
+ * );
+ * ```
+ *
+ * A Worker can also host its **own isolated** namespace this way.
+ * If a second host Worker declares `Counter` in its contract and
+ * provides `CounterLive`, the DO instances under that script are
+ * separate from the original host's — same class, two namespaces.
+ *
+ * @example Two hosts, two isolated namespaces
+ * ```typescript
+ * // workerC.ts — another host of Counter, isolated from WorkerA
+ * export class WorkerC extends Cloudflare.Worker<WorkerC, {}, Counter>()(
+ *   "WorkerC",
+ *   { main: import.meta.filename },
+ * ) {}
+ *
+ * export default WorkerC.make(
+ *   Effect.gen(function* () {
+ *     // .from(WorkerC) binds to WorkerC's own Counter namespace —
+ *     // writes here are NOT visible from WorkerA's Counter.
+ *     const counter = yield* Counter.from(WorkerC);
+ *     return { fetch: Effect.gen(function* () { ... }) };
+ *   }).pipe(Effect.provide(CounterLive)),
+ * );
+ * ```
+ *
+ * @section RPC Methods
+ * Any function you return from the inner Effect becomes an RPC method
+ * that Workers can call through a stub. Methods must return an `Effect`.
+ * The caller gets a fully typed stub — if your DO returns `increment`
+ * and `get`, the stub exposes `counter.increment()` and `counter.get()`.
+ *
+ * @example Defining RPC methods
+ * ```typescript
+ * return {
+ *   increment: () => Effect.succeed(++count),
+ *   get: () => Effect.succeed(count),
+ *   reset: () => Effect.sync(() => { count = 0; }),
+ * };
+ * ```
+ *
+ * @section Returning Streams from RPC
+ * RPC methods can return an Effect `Stream` and the caller will see
+ * the chunks as they're produced. Combine with `Stream.schedule` to
+ * pace emission, or with `Stream.fromQueue` to bridge an inbound
+ * subscription.
+ *
+ * @example Streaming sequential numbers
+ * ```typescript
+ * import * as Schedule from "effect/Schedule";
+ * import * as Stream from "effect/Stream";
+ *
+ * return {
+ *   tick: (n: number) =>
+ *     Stream.iterate(0, (i) => i + 1).pipe(
+ *       Stream.take(n),
+ *       Stream.schedule(Schedule.spaced("100 millis")),
+ *     ),
+ * };
+ * ```
+ *
+ * @example Forwarding the stream as a chunked HTTP response
+ * ```typescript
+ * // in a Worker fetch handler
+ * const counter = counters.getByName("tick");
+ * const stream = counter.tick(5).pipe(
+ *   Stream.map((i) => `${i}\n`),
+ *   Stream.encodeText,
+ * );
+ * return HttpServerResponse.stream(stream, {
+ *   headers: { "content-type": "text/plain" },
+ * });
+ * ```
+ *
+ * @section Worker → DO HTTP forwarding
+ * In addition to RPC methods, the typed stub exposes a `fetch`
+ * method that forwards an `HttpServerRequest` straight to the DO.
+ * The DO's own `fetch` Effect produces the response — useful for
+ * WebSocket upgrades and other request-shaped interactions.
+ *
+ * @example Forwarding an HTTP request to a DO
+ * ```typescript
+ * const room = rooms.getByName(roomId);
+ * return yield* room.fetch(request);
+ * ```
+ *
+ * @section Accessing Instance State
+ * Each Durable Object instance has its own transactional key-value
+ * storage via `Cloudflare.DurableObjectState`. Use `storage.get` and
+ * `storage.put` inside the inner Effect to persist data across requests
+ * and restarts.
+ *
+ * @example Reading and writing durable storage
+ * ```typescript
+ * const state = yield* Cloudflare.DurableObjectState;
+ *
+ * yield* state.storage.put("counter", 42);
+ * const value = yield* state.storage.get("counter");
+ * ```
+ *
+ * @section WebSocket Hibernation
+ * Durable Objects support WebSocket hibernation — the runtime can
+ * evict the object from memory while keeping connections open. Use
+ * `Cloudflare.upgrade()` to accept a connection, and return
+ * `webSocketMessage` / `webSocketClose` handlers to process events
+ * when the object wakes back up.
+ *
+ * @example Accepting a WebSocket connection
+ * ```typescript
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const [response, socket] = yield* Cloudflare.upgrade();
+ *     socket.serializeAttachment({ id: crypto.randomUUID() });
+ *     return response;
+ *   }),
+ * };
+ * ```
+ *
+ * @example Handling messages and close events
+ * ```typescript
+ * return {
+ *   webSocketMessage: Effect.fnUntraced(function* (
+ *     socket: Cloudflare.DurableWebSocket,
+ *     message: string | Uint8Array,
+ *   ) {
+ *     const text = typeof message === "string"
+ *       ? message
+ *       : new TextDecoder().decode(message);
+ *     // process the message
+ *   }),
+ *   webSocketClose: Effect.fnUntraced(function* (
+ *     ws: Cloudflare.DurableWebSocket,
+ *     code: number,
+ *     reason: string,
+ *   ) {
+ *     yield* ws.close(code, reason);
+ *   }),
+ * };
+ * ```
+ *
+ * @example Recovering sessions after hibernation
+ * Place the rehydration loop **inside the inner `Effect.gen`** so
+ * it runs every time the DO instance is reconstructed (including
+ * after Cloudflare wakes the DO from hibernation).
+ *
+ * ```typescript
+ * return Effect.gen(function* () {
+ *   const state = yield* Cloudflare.DurableObjectState;
+ *   const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+ *
+ *   // Rehydrate the in-memory session map after hibernation.
+ *   for (const socket of yield* state.getWebSockets()) {
+ *     const data = socket.deserializeAttachment<{ id: string }>();
+ *     if (data) sessions.set(data.id, socket);
+ *   }
+ *
+ *   return {
+ *     fetch: Effect.gen(function* () {
+ *       const [response, socket] = yield* Cloudflare.upgrade();
+ *       const id = crypto.randomUUID();
+ *       socket.serializeAttachment({ id });
+ *       sessions.set(id, socket);
+ *       return response;
+ *     }),
+ *     webSocketMessage: Effect.fnUntraced(function* (socket, message) {
+ *       const text =
+ *         typeof message === "string" ? message : new TextDecoder().decode(message);
+ *       for (const peer of sessions.values()) {
+ *         yield* peer.send(text);
+ *       }
+ *     }),
+ *   };
+ * });
+ * ```
+ *
+ * @section Scheduled Alarms
+ * Each Durable Object can have a single alarm timestamp. Alchemy
+ * layers a small SQLite-backed scheduler on top via
+ * `Cloudflare.scheduleEvent` and `Cloudflare.processScheduledEvents`,
+ * so you can register many named events with arbitrary payloads and
+ * fire them from a single `alarm` handler.
+ *
+ * @example Scheduling and processing events
+ * ```typescript
+ * // schedule from a request or message handler
+ * yield* Cloudflare.scheduleEvent(
+ *   "reminder-1",
+ *   new Date(Date.now() + 60_000),
+ *   { message: "your meeting starts in a minute" },
+ * );
+ *
+ * return {
+ *   alarm: () =>
+ *     Effect.gen(function* () {
+ *       const fired = yield* Cloudflare.processScheduledEvents;
+ *       for (const event of fired) {
+ *         const payload = event.payload as { message: string };
+ *         // dispatch / broadcast / persist...
+ *       }
+ *     }),
+ * };
+ * ```
+ *
+ * @section Using from a Worker
+ * Yield the DO class in your Worker's init phase to get a namespace
+ * handle. Call `getByName` or `getById` to get a typed stub, then
+ * call any RPC method or forward an HTTP request with `fetch`.
+ *
+ * @example Calling RPC methods
+ * ```typescript
+ * // init
+ * const counters = yield* Counter;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const counter = counters.getByName("user-123");
+ *     yield* counter.increment();
+ *     const value = yield* counter.get();
+ *     return HttpServerResponse.text(String(value));
+ *   }),
+ * };
+ * ```
+ *
+ * @example Forwarding an HTTP request
+ * ```typescript
+ * // init
+ * const rooms = yield* Room;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const request = yield* HttpServerRequest;
+ *     const room = rooms.getByName(roomId);
+ *     return yield* room.fetch(request);
+ *   }),
+ * };
+ * ```
+ *
+ * @section Binding in an Async Worker
+ * When using an Async Worker (plain `async fetch` handler, no Effect
+ * runtime), declare Durable Objects in the `bindings` prop of the
+ * Worker resource. Pass a `DurableObjectNamespace` reference with a
+ * `className` matching the exported `DurableObject` subclass in your
+ * worker source file. If `className` is omitted, it defaults to the
+ * namespace name. Use `Cloudflare.InferEnv` to get a fully typed
+ * `env` object that includes the namespace.
+ *
+ * @example Declaring a DO binding in the stack
+ * ```typescript
+ * // alchemy.run.ts
+ * import type { Counter } from "./src/worker.ts";
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: {
+ *     Counter: Cloudflare.DurableObjectNamespace<Counter>("Counter"),
+ *   },
+ * });
+ * ```
+ *
+ * @example Using the DO from a plain async handler
+ * ```typescript
+ * // src/worker.ts
+ * import { DurableObject } from "cloudflare:workers";
+ * import type { WorkerEnv } from "../alchemy.run.ts";
+ *
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     const counter = env.Counter.getByName("my-counter");
+ *     const count = await counter.increment();
+ *     return new Response(JSON.stringify({ count }));
+ *   },
+ * };
+ *
+ * export class Counter extends DurableObject {
+ *   private counter = 0;
+ *   async increment() {
+ *     return ++this.counter;
+ *   }
+ * }
+ * ```
+ *
+ * @section Cross-Script Binding in an Async Worker
+ * Async Workers can also bind to a Durable Object hosted by another
+ * Worker script. The host Worker declares and exports the DO class. The
+ * consumer Worker declares a `DurableObjectNamespace` with `scriptName`
+ * set to the host Worker's script name.
+ *
+ * Cross-script async bindings are references only: the consumer uploads
+ * the binding metadata, but Alchemy does not drive class migrations for
+ * the foreign class. Deploy the host first so Cloudflare can verify that
+ * the target script exports the requested class.
+ *
+ * @example Host Worker owns the Durable Object class
+ * ```typescript
+ * const host = yield* Cloudflare.Worker("Host", {
+ *   main: "./src/host.ts",
+ *   bindings: {
+ *     Counter: Cloudflare.DurableObjectNamespace<Counter>("Counter"),
+ *   },
+ * });
+ * ```
+ *
+ * @example Consumer Worker binds to the host script
+ * ```typescript
+ * const consumer = yield* Cloudflare.Worker("Consumer", {
+ *   main: "./src/consumer.ts",
+ *   bindings: {
+ *     Counter: Cloudflare.DurableObjectNamespace<Counter>("Counter", {
+ *       scriptName: host.workerName,
+ *     }),
+ *   },
+ * });
+ * ```
+ *
+ * @example Binding to a different exported class name
+ * ```typescript
+ * const consumer = yield* Cloudflare.Worker("Consumer", {
+ *   main: "./src/consumer.ts",
+ *   bindings: {
+ *     Counter: Cloudflare.DurableObjectNamespace<Counter>("Counter", {
+ *       className: "CounterV2",
+ *       scriptName: host.workerName,
+ *     }),
+ *   },
+ * });
+ * ```
+ */
+export const DurableObjectNamespace: DurableObjectNamespaceClass =
+  taggedFunction(
+    DurableObjectNamespaceScope,
+    function (
+      ...args:
+        | []
+        | [
+            name: string,
+            props?: DurableObjectNamespaceProps,
+            // phantom argument
+            isClassForm?: true,
+          ]
+        | [
+            name: string,
+            impl: Effect.Effect<
+              Effect.Effect<
+                DurableObjectNamespace<any>,
+                never,
+                DurableObjectState
+              >
+            >,
+            // phantom argument
+            isClassForm?: true,
+          ]
+    ) {
+      if (args.length === 0) {
+        return (name: string, propsOrImpl?: any) =>
+          // @ts-expect-error
+          DurableObjectNamespace(name, propsOrImpl, true);
+      }
+      const namespace = args[0];
+      const isClassForm = args[2] === true;
+      const propsOrImpl = args[1];
+      const tag = Context.Service(namespace);
+
+      const binding = (scriptName?: Input<string>) =>
+        Effect.gen(function* () {
+          const worker = yield* Worker;
+
+          yield* worker.bind`${namespace}`({
+            // TODO(sam): automate class migrations, probably in the provider
+            bindings: [
+              {
+                type: "durable_object_namespace",
+                name: namespace,
+                className: namespace,
+                scriptName,
+              },
+            ],
+          });
+
+          const binding = yield* Effect.all([
+            WorkerEnvironment,
+            ALCHEMY_PHASE,
+          ]).pipe(
+            Effect.flatMap(([env, phase]) => {
+              if (env === undefined || phase === "plan") {
+                // should be fine to return undefined here (it is only undefined at plantime)
+                return Effect.succeed(undefined);
+              }
+              const ns = env[namespace];
+              if (!ns) {
+                return Effect.die(
+                  new Error(`DurableObjectNamespace '${namespace}' not found`),
+                );
+              } else if (typeof ns.getByName === "function") {
+                return Effect.succeed(ns);
+              } else {
+                return Effect.die(
+                  new Error(
+                    `DurableObjectNamespace '${namespace}' is not a DurableObjectNamespace`,
+                  ),
+                );
+              }
+            }),
+          );
+
+          return {
+            Type: TypeId,
+            LogicalId: namespace,
+            name: namespace,
+            namespaceId: worker.durableObjectNamespaces.pipe(
+              Output.map(
+                (durableObjectNamespaces) =>
+                  durableObjectNamespaces?.[namespace],
+              ),
+            ),
+            getByName: (name: string) => makeRpcStub(binding.getByName(name)),
+            // newUniqueId: () => use((ns) => ns.newUniqueId()),
+            // idFromName: (name: string) => use((ns) => ns.idFromName(name)),
+            // idFromString: (id: string) => use((ns) => ns.idFromString(id)),
+            // get: (
+            //   id: cf.DurableObjectId,
+            //   options?: cf.DurableObjectNamespaceGetDurableObjectOptions,
+            // ) => use((ns) => makeRpcStub(ns.get(id, options))),
+            // jurisdiction: (jurisdiction: cf.DurableObjectJurisdiction) =>
+            //   use((ns) => ns.jurisdiction(jurisdiction) as any),
+          };
+        });
+
+      const make = Effect.fnUntraced(function* (
+        impl: Effect.Effect<
+          Effect.Effect<DurableObjectShape, never, DurableObjectState>
+        >,
+      ) {
+        // Register the local DO binding (no `scriptName`) and obtain the
+        // namespace handle. We provide this same handle as
+        // `DurableObjectNamespaceScope` to the user's constructor effect
+        // and also return it so a `Layer.effect(tag, make(impl))` Layer
+        // resolves the tag to a concrete namespace value.
+        const self = yield* binding();
+        yield* (yield* Worker).export(namespace, {
+          kind: "durableObject",
+          // initialize the object's constructor (apply infra dependencies)
+          constructor: yield* impl.pipe(
+            Effect.provideService(DurableObjectNamespaceScope, self as any),
+          ),
+          // grab the object's infra dependencies so we can apply them when calling the instance's methods
+          services: yield* Effect.context<Effect.Services<typeof impl>>(),
+        } satisfies DurableObjectExport);
+        return self;
+      });
+
+      if (!isClassForm && !Effect.isEffect(args[1])) {
+        // this is an in-line, async only DO (no implementation, props only)
+        return {
+          kind: TypeId,
+          name: namespace,
+          className:
+            (args[1] as DurableObjectNamespaceProps)?.className || namespace,
+          scriptName: (args[1] as DurableObjectNamespaceProps)?.scriptName,
+        };
+      } else if (Effect.isEffect(propsOrImpl)) {
+        // inline Effect DO
+        return effectClass(
+          Effect.tap(binding(), () => make(propsOrImpl as any)),
+        );
+      } else {
+        // Tagged Effect DO. Yielding the class resolves the `tag`, which
+        // forces the `CounterLive` Layer (built by `Counter.make(impl)`) to
+        // run so `worker.export(namespace, …)` is invoked — without this,
+        // the class would never be registered with the Worker's exports
+        // map and the deployed bundle would have no DO class for
+        // Cloudflare to instantiate.
+        return class extends effectClass(
+          tag as Effect.Effect<any, never, any>,
+        ) {
+          static make = <Req = never>(
+            impl: Effect.Effect<
+              Effect.Effect<DurableObjectShape, never, DurableObjectState | Req>
+            >,
+          ) => Layer.effect(tag, make(impl as any));
+
+          static from = (
+            worker: string | Worker | Effect.Effect<Worker, any, any>,
+          ) => {
+            // Resolve `worker` to an Effect that yields the actual Worker
+            // instance (or a plain string scriptName).
+            //
+            // A class produced by `Cloudflare.Worker<T>()(...)` exposes
+            // `asEffect()` returning the Self tag — yielding that tag
+            // resolves to the live Worker instance whose `workerName`
+            // is a `PropExpr`, which is what we need so the engine can:
+            //   1) Track WorkerB → WorkerA as a binding-level upstream
+            //      dependency (so WorkerA reconciles first).
+            //   2) Persist `scriptName` as a real value (not `undefined`)
+            //      on the cross-script binding so the migration code in
+            //      Worker.ts can detect it and skip emitting class
+            //      migrations for the foreign class.
+            // Plain Effects and string literals are passed through as-is.
+            const resolved: Effect.Effect<Worker | string, any, any> =
+              typeof worker === "string"
+                ? Effect.succeed(worker)
+                : asEffect(worker);
+
+            return resolved.pipe(
+              Effect.flatMap((w) =>
+                binding(typeof w === "string" ? w : w.workerName),
+              ),
+            );
+          };
+        };
+      }
+    },
+  ) as any;
+
+export type DurableObjectStub<Shape> = {
+  // TODO(sam): do we need to transform? hopefully not
+  [key in keyof Shape]: Shape[key];
+} & {
+  fetch: (
+    request: HttpServerRequest.HttpServerRequest,
+  ) => Effect.Effect<
+    HttpServerResponse.HttpServerResponse,
+    HttpServerError,
+    never
+  >;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectState.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectState.ts
new file mode 100644
index 00000000000..d630dc64cc8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectState.ts
@@ -0,0 +1,63 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import {
+  fromDurableObjectStorage,
+  type DurableObjectStorage,
+} from "./DurableObjectStorage.ts";
+import { fromWebSocket, type DurableWebSocket } from "./WebSocket.ts";
+
+export class DurableObjectState extends Context.Service<
+  DurableObjectState,
+  {
+    readonly id: cf.DurableObjectId;
+    readonly storage: DurableObjectStorage;
+    container?: cf.Container;
+    blockConcurrencyWhile<T>(
+      callback: () => Effect.Effect<T>,
+    ): Effect.Effect<T>;
+    acceptWebSocket(ws: DurableWebSocket, tags?: string[]): Effect.Effect<void>;
+    getWebSockets(tag?: string): Effect.Effect<DurableWebSocket[]>;
+    setWebSocketAutoResponse(
+      maybeReqResp?: cf.WebSocketRequestResponsePair,
+    ): Effect.Effect<void>;
+    getWebSocketAutoResponse(): Effect.Effect<cf.WebSocketRequestResponsePair | null>;
+    getWebSocketAutoResponseTimestamp(
+      ws: cf.WebSocket,
+    ): Effect.Effect<Date | null>;
+    setHibernatableWebSocketEventTimeout(
+      timeoutMs?: number,
+    ): Effect.Effect<void>;
+    getHibernatableWebSocketEventTimeout(): Effect.Effect<number | null>;
+    getTags(ws: cf.WebSocket): Effect.Effect<string[]>;
+    abort(reason?: string): Effect.Effect<void>;
+  }
+>()("Cloudflare.DurableObjectState") {}
+
+export const fromDurableObjectState = (
+  state: cf.DurableObjectState,
+): DurableObjectState["Service"] => ({
+  id: state.id,
+  container: state.container,
+  storage: fromDurableObjectStorage(state.storage),
+  blockConcurrencyWhile: <T>(callback: () => Effect.Effect<T>) =>
+    Effect.tryPromise(() =>
+      state.blockConcurrencyWhile(() => Effect.runPromise(callback())),
+    ),
+  acceptWebSocket: (ws: DurableWebSocket, tags?: string[]) =>
+    Effect.sync(() => state.acceptWebSocket(ws.ws, tags)),
+  getWebSockets: (tag?: string) =>
+    Effect.sync(() => state.getWebSockets(tag).map(fromWebSocket)),
+  setWebSocketAutoResponse: (maybeReqResp?: cf.WebSocketRequestResponsePair) =>
+    Effect.sync(() => state.setWebSocketAutoResponse(maybeReqResp)),
+  getWebSocketAutoResponse: () =>
+    Effect.sync(() => state.getWebSocketAutoResponse()),
+  getWebSocketAutoResponseTimestamp: (ws: cf.WebSocket) =>
+    Effect.sync(() => state.getWebSocketAutoResponseTimestamp(ws)),
+  setHibernatableWebSocketEventTimeout: (timeoutMs?: number) =>
+    Effect.sync(() => state.setHibernatableWebSocketEventTimeout(timeoutMs)),
+  getHibernatableWebSocketEventTimeout: () =>
+    Effect.sync(() => state.getHibernatableWebSocketEventTimeout()),
+  getTags: (ws: cf.WebSocket) => Effect.sync(() => state.getTags(ws)),
+  abort: (reason?: string) => Effect.sync(() => state.abort(reason)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectStorage.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectStorage.ts
new file mode 100644
index 00000000000..9fcc55a100c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DurableObjectStorage.ts
@@ -0,0 +1,264 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+
+// ---------------------------------------------------------------------------
+// SqlStorage — Effect-native wrapper around cf.SqlStorage
+// ---------------------------------------------------------------------------
+
+export type SqlStorageValue = cf.SqlStorageValue;
+
+export interface SqlCursor<
+  T extends Record<string, SqlStorageValue>,
+> extends Stream.Stream<T> {
+  next(): Effect.Effect<
+    { done?: false; value: T } | { done: true; value?: never }
+  >;
+  toArray(): Effect.Effect<T[]>;
+  one(): Effect.Effect<T>;
+  raw<U extends SqlStorageValue[]>(): Stream.Stream<U>;
+  readonly columnNames: string[];
+  readonly rowsRead: Effect.Effect<number>;
+  readonly rowsWritten: Effect.Effect<number>;
+}
+
+export interface SqlStorage {
+  /**
+   * The raw underlying Cloudflare SqlStorage binding.
+   *
+   * Use this when you need direct access for libraries that already support
+   * Cloudflare Durable Object SQLite storage.
+   */
+  readonly raw: cf.SqlStorage;
+  exec<T extends Record<string, SqlStorageValue>>(
+    query: string,
+    ...bindings: any[]
+  ): Effect.Effect<SqlCursor<T>>;
+  readonly databaseSize: number;
+}
+
+const fromSqlCursor = <T extends Record<string, SqlStorageValue>>(
+  cursor: cf.SqlStorageCursor<T>,
+): SqlCursor<T> => {
+  const stream = Stream.fromIterableEffect(Effect.sync(() => cursor));
+  return Object.assign(stream, {
+    next: () => Effect.sync(() => cursor.next()),
+    toArray: () => Effect.sync(() => cursor.toArray()),
+    one: () => Effect.sync(() => cursor.one()),
+    raw: <U extends SqlStorageValue[]>() =>
+      Stream.fromIterableEffect(Effect.sync(() => cursor.raw<U>())),
+    get columnNames() {
+      return cursor.columnNames;
+    },
+    rowsRead: Effect.sync(() => cursor.rowsRead),
+    rowsWritten: Effect.sync(() => cursor.rowsWritten),
+  }) as SqlCursor<T>;
+};
+
+const fromSqlStorage = (sql: cf.SqlStorage): SqlStorage => ({
+  raw: sql,
+  exec: <T extends Record<string, SqlStorageValue>>(
+    query: string,
+    ...bindings: any[]
+  ): Effect.Effect<SqlCursor<T>> =>
+    Effect.sync(() => fromSqlCursor(sql.exec<T>(query, ...bindings))),
+  get databaseSize() {
+    return sql.databaseSize;
+  },
+});
+
+// ---------------------------------------------------------------------------
+// DurableObjectTransaction
+// ---------------------------------------------------------------------------
+
+export interface DurableObjectTransaction {
+  get<T = unknown>(
+    key: string,
+    options?: cf.DurableObjectGetOptions,
+  ): Effect.Effect<T | undefined>;
+  get<T = unknown>(
+    keys: string[],
+    options?: cf.DurableObjectGetOptions,
+  ): Effect.Effect<Map<string, T>>;
+  list<T = unknown>(
+    options?: cf.DurableObjectListOptions,
+  ): Effect.Effect<Map<string, T>>;
+  put<T>(
+    key: string,
+    value: T,
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<void>;
+  put<T>(
+    entries: Record<string, T>,
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<void>;
+  delete(
+    key: string,
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<boolean>;
+  delete(
+    keys: string[],
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<number>;
+  rollback(): Effect.Effect<void>;
+  getAlarm(
+    options?: cf.DurableObjectGetAlarmOptions,
+  ): Effect.Effect<number | null>;
+  setAlarm(
+    scheduledTime: number | Date,
+    options?: cf.DurableObjectSetAlarmOptions,
+  ): Effect.Effect<void>;
+  deleteAlarm(options?: cf.DurableObjectSetAlarmOptions): Effect.Effect<void>;
+}
+
+// ---------------------------------------------------------------------------
+// DurableObjectStorage
+// ---------------------------------------------------------------------------
+
+export interface DurableObjectStorage {
+  get<T = unknown>(
+    key: string,
+    options?: cf.DurableObjectGetOptions,
+  ): Effect.Effect<T | undefined>;
+  get<T = unknown>(
+    keys: string[],
+    options?: cf.DurableObjectGetOptions,
+  ): Effect.Effect<Map<string, T>>;
+  list<T = unknown>(
+    options?: cf.DurableObjectListOptions,
+  ): Effect.Effect<Map<string, T>>;
+  put<T>(
+    key: string,
+    value: T,
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<void>;
+  put<T>(
+    entries: Record<string, T>,
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<void>;
+  delete(
+    key: string,
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<boolean>;
+  delete(
+    keys: string[],
+    options?: cf.DurableObjectPutOptions,
+  ): Effect.Effect<number>;
+  deleteAll(options?: cf.DurableObjectPutOptions): Effect.Effect<void>;
+  transaction<T>(
+    closure: (txn: DurableObjectTransaction) => Effect.Effect<T>,
+  ): Effect.Effect<T>;
+  getAlarm(
+    options?: cf.DurableObjectGetAlarmOptions,
+  ): Effect.Effect<number | null>;
+  setAlarm(
+    scheduledTime: number | Date,
+    options?: cf.DurableObjectSetAlarmOptions,
+  ): Effect.Effect<void>;
+  deleteAlarm(options?: cf.DurableObjectSetAlarmOptions): Effect.Effect<void>;
+  sync(): Effect.Effect<void>;
+  sql: SqlStorage;
+  kv: cf.SyncKvStorage;
+  transactionSync<T>(closure: () => T): T;
+  getCurrentBookmark(): Effect.Effect<string>;
+  getBookmarkForTime(timestamp: number | Date): Effect.Effect<string>;
+  onNextSessionRestoreBookmark(bookmark: string): Effect.Effect<string>;
+}
+
+// ---------------------------------------------------------------------------
+// Constructors from raw Cloudflare types
+// ---------------------------------------------------------------------------
+
+export const fromDurableObjectTransaction = (
+  txn: cf.DurableObjectTransaction,
+): DurableObjectTransaction => ({
+  get: ((keyOrKeys: string | string[], options?: cf.DurableObjectGetOptions) =>
+    Effect.tryPromise(() => txn.get(keyOrKeys as any, options))) as any,
+  list: (options?: cf.DurableObjectListOptions) =>
+    Effect.tryPromise(() => txn.list(options)),
+  put: ((
+    keyOrEntries: string | Record<string, unknown>,
+    valueOrOptions?: unknown,
+    maybeOptions?: cf.DurableObjectPutOptions,
+  ) =>
+    typeof keyOrEntries === "string"
+      ? Effect.tryPromise(() =>
+          txn.put(keyOrEntries, valueOrOptions, maybeOptions),
+        )
+      : Effect.tryPromise(() =>
+          txn.put(
+            keyOrEntries,
+            valueOrOptions as cf.DurableObjectPutOptions | undefined,
+          ),
+        )) as any,
+  delete: ((
+    keyOrKeys: string | string[],
+    options?: cf.DurableObjectPutOptions,
+  ) => Effect.tryPromise(() => txn.delete(keyOrKeys as any, options))) as any,
+  rollback: () => Effect.sync(() => txn.rollback()),
+  getAlarm: (options?: cf.DurableObjectGetAlarmOptions) =>
+    Effect.tryPromise(() => txn.getAlarm(options)),
+  setAlarm: (
+    scheduledTime: number | Date,
+    options?: cf.DurableObjectSetAlarmOptions,
+  ) => Effect.tryPromise(() => txn.setAlarm(scheduledTime, options)),
+  deleteAlarm: (options?: cf.DurableObjectSetAlarmOptions) =>
+    Effect.tryPromise(() => txn.deleteAlarm(options)),
+});
+
+export const fromDurableObjectStorage = (
+  storage: cf.DurableObjectStorage,
+): DurableObjectStorage => ({
+  get: ((keyOrKeys: string | string[], options?: cf.DurableObjectGetOptions) =>
+    Effect.tryPromise(() => storage.get(keyOrKeys as any, options))) as any,
+  list: (options?: cf.DurableObjectListOptions) =>
+    Effect.tryPromise(() => storage.list(options)),
+  put: ((
+    keyOrEntries: string | Record<string, unknown>,
+    valueOrOptions?: unknown,
+    maybeOptions?: cf.DurableObjectPutOptions,
+  ) =>
+    typeof keyOrEntries === "string"
+      ? Effect.tryPromise(() =>
+          storage.put(keyOrEntries, valueOrOptions, maybeOptions),
+        )
+      : Effect.tryPromise(() =>
+          storage.put(
+            keyOrEntries,
+            valueOrOptions as cf.DurableObjectPutOptions | undefined,
+          ),
+        )) as any,
+  delete: ((
+    keyOrKeys: string | string[],
+    options?: cf.DurableObjectPutOptions,
+  ) =>
+    Effect.tryPromise(() => storage.delete(keyOrKeys as any, options))) as any,
+  deleteAll: (options?: cf.DurableObjectPutOptions) =>
+    Effect.tryPromise(() => storage.deleteAll(options)),
+  transaction: <T>(
+    closure: (txn: DurableObjectTransaction) => Effect.Effect<T>,
+  ) =>
+    Effect.tryPromise(() =>
+      storage.transaction((txn) =>
+        Effect.runPromise(closure(fromDurableObjectTransaction(txn))),
+      ),
+    ),
+  getAlarm: (options?: cf.DurableObjectGetAlarmOptions) =>
+    Effect.tryPromise(() => storage.getAlarm(options)),
+  setAlarm: (
+    scheduledTime: number | Date,
+    options?: cf.DurableObjectSetAlarmOptions,
+  ) => Effect.tryPromise(() => storage.setAlarm(scheduledTime, options)),
+  deleteAlarm: (options?: cf.DurableObjectSetAlarmOptions) =>
+    Effect.tryPromise(() => storage.deleteAlarm(options)),
+  sync: () => Effect.tryPromise(() => storage.sync()),
+  sql: fromSqlStorage(storage.sql),
+  kv: storage.kv,
+  transactionSync: <T>(closure: () => T) => storage.transactionSync(closure),
+  getCurrentBookmark: () =>
+    Effect.tryPromise(() => storage.getCurrentBookmark()),
+  getBookmarkForTime: (timestamp: number | Date) =>
+    Effect.tryPromise(() => storage.getBookmarkForTime(timestamp)),
+  onNextSessionRestoreBookmark: (bookmark: string) =>
+    Effect.tryPromise(() => storage.onNextSessionRestoreBookmark(bookmark)),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DynamicWorkerLoader.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DynamicWorkerLoader.ts
new file mode 100644
index 00000000000..f607e5dfab9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/DynamicWorkerLoader.ts
@@ -0,0 +1,328 @@
+import * as Effect from "effect/Effect";
+import { SingleShotGen } from "effect/Utils";
+import { ALCHEMY_PHASE } from "../../Phase.ts";
+import { fromCloudflareFetcher, type Fetcher } from "../Fetcher.ts";
+import { makeRpcStub } from "./Rpc.ts";
+import { Worker, WorkerEnvironment } from "./Worker.ts";
+
+type DynamicWorkerTypeId = "Cloudflare.DynamicWorker";
+const DynamicWorkerTypeId: DynamicWorkerTypeId = "Cloudflare.DynamicWorker";
+
+/**
+ * Options for loading a dynamic worker at runtime.
+ */
+export interface DynamicWorkerLoadOptions {
+  /**
+   * Compatibility date for the dynamic worker runtime.
+   */
+  compatibilityDate: string;
+  /**
+   * Name of the main module entry point (must match a key in `modules`).
+   */
+  mainModule: string;
+  /**
+   * Map of module names to source code strings.
+   */
+  modules: Record<string, string>;
+  /**
+   * Environment bindings to pass to the dynamic worker.
+   */
+  env?: Record<string, unknown>;
+  /**
+   * Controls outbound network access. Set to `null` to block all outbound
+   * fetch/connect calls. Pass an RPC stub to intercept them.
+   */
+  globalOutbound?: null | unknown;
+}
+
+/**
+ * An entrypoint stub on a loaded dynamic worker.
+ * Extends `Fetcher` for Effect-native HTTP, and proxies arbitrary
+ * RPC method calls as Effects.
+ */
+export type DynamicWorkerEntrypoint<Shape = unknown> = Fetcher & {
+  [K in keyof Shape]: Shape[K];
+};
+
+/**
+ * A loaded dynamic worker instance. Extends `Fetcher` for Effect-native
+ * HTTP on the default entrypoint, plus `.getEntrypoint()` for named ones.
+ */
+export interface DynamicWorkerInstance extends Fetcher {
+  /**
+   * Get a named entrypoint (or the default entrypoint if no name is given).
+   * Returns a Fetcher + RPC stub where every method call yields an Effect.
+   */
+  getEntrypoint<Shape = unknown>(name?: string): DynamicWorkerEntrypoint<Shape>;
+}
+
+/**
+ * The runtime handle obtained by `yield* Cloudflare.DynamicWorkerLoader(name)`.
+ * Provides a `.load()` method for spinning up isolated dynamic workers.
+ */
+export interface DynamicWorkerLoaderHandle {
+  Type: DynamicWorkerTypeId;
+  name: string;
+  /**
+   * Load a dynamic worker with the given options. The returned instance
+   * exposes `.getEntrypoint()` and `.fetch()` for calling into the worker.
+   */
+  load(options: DynamicWorkerLoadOptions): DynamicWorkerInstance;
+}
+
+/**
+ * The native `worker_loader` runtime binding shape, as seen by an async
+ * (non-Effect) Worker that declares the loader through `env`. `InferEnv` maps
+ * a `DynamicWorkerLoader` marker in `env` to this type.
+ */
+export interface DynamicWorkerLoaderBinding {
+  load(options: DynamicWorkerLoadOptions): {
+    getEntrypoint(name?: string): {
+      fetch(request: Request): Promise<Response>;
+      [method: string]: unknown;
+    };
+  };
+}
+
+/**
+ * The Effect yielded when a `DynamicWorkerLoader` marker is used inside a
+ * Worker init phase: it registers the `worker_loader` binding on the
+ * surrounding Worker and resolves to a {@link DynamicWorkerLoaderHandle}.
+ */
+type BindEffect = ReturnType<typeof bindLoader>;
+
+/**
+ * Marker for a Cloudflare Worker Loader binding.
+ *
+ * It is a plain data structure (so it can be declared directly on a Worker's
+ * `env`) that is **also** yieldable inside an Effect-native Worker. Yielding it
+ * (`yield* Cloudflare.DynamicWorkerLoader(name)`) registers the binding on the
+ * surrounding Worker and returns a {@link DynamicWorkerLoaderHandle} with
+ * `.load()` — no separate `.bind(...)` step required.
+ *
+ * The divergence is achieved via `[Symbol.iterator]`: the object is not an
+ * `Effect` (so `InferEnv` resolves it to the native
+ * {@link DynamicWorkerLoaderBinding} in the `env` position), but it is iterable
+ * as one when `yield*`-ed.
+ */
+export interface DynamicWorkerLoader {
+  kind: DynamicWorkerTypeId;
+  name: string;
+  asEffect(): BindEffect;
+  [Symbol.iterator](): SingleShotGen<BindEffect, DynamicWorkerLoaderHandle>;
+}
+
+export const isDynamicWorkerLoader = (
+  value: unknown,
+): value is DynamicWorkerLoader =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as DynamicWorkerLoader).kind === DynamicWorkerTypeId;
+
+/**
+ * Load and run ephemeral Workers at runtime from inline JavaScript
+ * modules.
+ *
+ * `DynamicWorkerLoader` registers a `worker_loader` binding on the
+ * parent Worker at deploy time. At runtime you call `.load()` with
+ * inline module source code and get back a fully typed Worker
+ * instance you can `fetch` or call RPC methods on. Each loaded
+ * Worker runs in its own isolate with full sandboxing.
+ *
+ * This is useful for evaluating user-provided code, running
+ * untrusted plugins, or dynamically generating Workers from
+ * templates.
+ *
+ * @resource
+ *
+ * @section Creating a Loader
+ * Yield `Cloudflare.DynamicWorkerLoader(name)` in your Worker's init
+ * phase to register the binding and get back a runtime handle. The
+ * string argument becomes the binding name on the deployed Worker.
+ *
+ * @example Registering a loader (effect-native Worker)
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+ * import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ * import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+ *
+ * export default class EvalWorker extends Cloudflare.Worker<EvalWorker>()(
+ *   "EvalWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // Registers the `worker_loader` binding on this Worker and returns the
+ *     // runtime handle in one step — no separate `.bind(...)`.
+ *     const loader = yield* Cloudflare.DynamicWorkerLoader("LOADER");
+ *
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const request = yield* HttpServerRequest;
+ *         const code = yield* request.text;
+ *
+ *         // Spin up an isolated, sandboxed Worker from inline source.
+ *         const worker = loader.load({
+ *           compatibilityDate: "2026-01-28",
+ *           mainModule: "worker.js",
+ *           modules: {
+ *             "worker.js": `export default {
+ *               async fetch(req) {
+ *                 const result = (0, eval)(await req.text());
+ *                 return new Response(String(result));
+ *               }
+ *             }`,
+ *           },
+ *           globalOutbound: null, // block outbound network access
+ *         });
+ *
+ *         // Call the loaded Worker over Effect-native HTTP.
+ *         const response = yield* worker.fetch(
+ *           HttpClientRequest.post("https://worker/").pipe(
+ *             HttpClientRequest.bodyText(code),
+ *           ),
+ *         );
+ *         return HttpServerResponse.fromClientResponse(response);
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @example Declaring on env (async Worker)
+ * ```typescript
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: { LOADER: Cloudflare.DynamicWorkerLoader() },
+ * });
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ *
+ * // worker.ts
+ * export default {
+ *   async fetch(req: Request, env: WorkerEnv) {
+ *     const worker = env.LOADER.load({
+ *       compatibilityDate: "2026-01-28",
+ *       mainModule: "worker.js",
+ *       modules: { "worker.js": "export default { fetch: () => new Response('ok') }" },
+ *     });
+ *     return worker.getEntrypoint().fetch(req);
+ *   },
+ * };
+ * ```
+ *
+ * @section Loading a Worker
+ * Call `loader.load()` with a compatibility date, a main module
+ * name, and a map of module names to source code strings. The
+ * returned instance exposes `.fetch()` for HTTP and RPC methods
+ * for named entrypoints.
+ *
+ * @example Loading and calling a dynamic Worker
+ * ```typescript
+ * const worker = loader.load({
+ *   compatibilityDate: "2026-01-28",
+ *   mainModule: "worker.js",
+ *   modules: {
+ *     "worker.js": `export default {
+ *       async fetch(request) {
+ *         return new Response("Hello from dynamic worker!");
+ *       }
+ *     }`,
+ *   },
+ * });
+ *
+ * const response = yield* worker.fetch(
+ *   HttpClientRequest.get("https://worker/"),
+ * );
+ * ```
+ *
+ * @section Sandboxing
+ * Set `globalOutbound` to `null` to block all outbound network
+ * access from the dynamic Worker, or pass an RPC stub to intercept
+ * and proxy outbound requests.
+ *
+ * @example Blocking outbound access
+ * ```typescript
+ * const worker = loader.load({
+ *   compatibilityDate: "2026-01-28",
+ *   mainModule: "worker.js",
+ *   modules: {
+ *     "worker.js": `export default {
+ *       async fetch(req) {
+ *         // fetch() calls from here will fail
+ *         return new Response("sandboxed");
+ *       }
+ *     }`,
+ *   },
+ *   globalOutbound: null,
+ * });
+ * ```
+ *
+ * @section Named Entrypoints
+ * If the dynamic Worker exports named entrypoints, use
+ * `.getEntrypoint(name)` to get a typed stub for calling its
+ * methods.
+ *
+ * @example Calling a named entrypoint
+ * ```typescript
+ * const worker = loader.load({ ... });
+ * const api = worker.getEntrypoint<{ greet: (name: string) => Effect.Effect<string> }>("api");
+ * const greeting = yield* api.greet("world");
+ * ```
+ */
+export const DynamicWorkerLoader = (name = "LOADER"): DynamicWorkerLoader => {
+  const self: DynamicWorkerLoader = {
+    kind: DynamicWorkerTypeId,
+    name,
+    asEffect: () => bindLoader(name),
+    [Symbol.iterator]: () => new SingleShotGen(bindLoader(name)),
+  };
+  return self;
+};
+
+const bindLoader = Effect.fnUntraced(function* (name: string) {
+  const worker = yield* Worker;
+
+  yield* worker.bind`${name}`({
+    bindings: [{ type: "worker_loader", name } as any],
+  });
+
+  const binding = yield* Effect.all([WorkerEnvironment, ALCHEMY_PHASE]).pipe(
+    Effect.flatMap(([env, phase]) => {
+      if (env === undefined || phase === "plan") {
+        return Effect.succeed(undefined as any);
+      }
+      const loader = env[name];
+      if (!loader) {
+        return Effect.die(
+          new Error(`DynamicWorker '${name}' not found in env`),
+        );
+      }
+      return Effect.succeed(loader);
+    }),
+  );
+
+  const handle: DynamicWorkerLoaderHandle = {
+    Type: DynamicWorkerTypeId,
+    name,
+    load: (options: DynamicWorkerLoadOptions): DynamicWorkerInstance =>
+      wrapLoadedWorker(binding.load(options)),
+  };
+
+  return handle;
+});
+
+const wrapEntrypoint = <Shape>(raw: any): DynamicWorkerEntrypoint<Shape> =>
+  Object.assign(makeRpcStub<any>(raw), fromCloudflareFetcher(raw));
+
+const wrapLoadedWorker = (raw: any): DynamicWorkerInstance => {
+  const defaultEntrypoint = fromCloudflareFetcher(raw.getEntrypoint());
+  return {
+    ...defaultEntrypoint,
+    getEntrypoint: <Shape>(name?: string) =>
+      wrapEntrypoint<Shape>(
+        name ? raw.getEntrypoint(name) : raw.getEntrypoint(),
+      ),
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Fetch.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Fetch.ts
new file mode 100644
index 00000000000..f26d38882db
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Fetch.ts
@@ -0,0 +1,142 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import * as Stream from "effect/Stream";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import * as UrlParams from "effect/unstable/http/UrlParams";
+import * as Binding from "../../Binding.ts";
+import { isWorker, type Worker, WorkerEnvironment } from "./Worker.ts";
+
+export class Fetch extends Binding.Service<
+  Fetch,
+  (
+    worker: Worker,
+  ) => Effect.Effect<
+    (
+      request: HttpClientRequest.HttpClientRequest,
+    ) => Effect.Effect<
+      HttpClientResponse.HttpClientResponse,
+      HttpClientError.RequestError
+    >
+  >
+>()("Cloudflare.Fetch") {}
+
+export const FetchLive = Layer.effect(
+  Fetch,
+  Effect.gen(function* () {
+    const Policy = yield* FetchPolicy;
+    const env = yield* WorkerEnvironment;
+
+    return Effect.fn(function* (worker: Worker) {
+      yield* Policy(worker);
+      const fetcher = (env as Record<string, runtime.Fetcher>)[
+        worker.LogicalId
+      ];
+
+      return (request: HttpClientRequest.HttpClientRequest) =>
+        doFetch(fetcher, request);
+    });
+  }),
+);
+
+const doFetch = (
+  fetcher: runtime.Fetcher,
+  request: HttpClientRequest.HttpClientRequest,
+): Effect.Effect<
+  HttpClientResponse.HttpClientResponse,
+  HttpClientError.RequestError
+> => {
+  const urlResult = UrlParams.makeUrl(
+    request.url,
+    request.urlParams,
+    request.hash.pipe(Option.getOrUndefined),
+  );
+  if (Result.isFailure(urlResult)) {
+    return Effect.fail(
+      new HttpClientError.InvalidUrlError({
+        request,
+        cause: urlResult.failure,
+        description: "Failed to construct URL",
+      }),
+    );
+  }
+  const url = urlResult.success;
+
+  const send = (body: BodyInit | undefined) =>
+    Effect.mapError(
+      Effect.map(
+        Effect.tryPromise({
+          try: () =>
+            fetcher.fetch(
+              url.toString() as runtime.RequestInfo,
+              {
+                method: request.method,
+                headers: request.headers as unknown as runtime.HeadersInit,
+                body,
+                duplex: request.body._tag === "Stream" ? "half" : undefined,
+              } as runtime.RequestInit,
+            ) as unknown as Promise<Response>,
+          catch: (cause) => cause,
+        }),
+        (response) => HttpClientResponse.fromWeb(request, response),
+      ),
+      (cause) =>
+        new HttpClientError.TransportError({
+          request,
+          cause,
+          description: "Service binding fetch failed",
+        }),
+    );
+
+  switch (request.body._tag) {
+    case "Raw":
+    case "Uint8Array":
+      return send(request.body.body as BodyInit);
+    case "FormData":
+      return send(request.body.formData);
+    case "Stream":
+      return Effect.flatMap(
+        Effect.mapError(
+          Stream.toReadableStreamEffect(request.body.stream),
+          (cause) =>
+            new HttpClientError.EncodeError({
+              request,
+              cause,
+              description: "Failed to encode stream body",
+            }),
+        ),
+        send,
+      );
+    default:
+      return send(undefined);
+  }
+};
+
+export class FetchPolicy extends Binding.Policy<
+  FetchPolicy,
+  (worker: Worker) => Effect.Effect<void>
+>()("Cloudflare.Fetch") {}
+
+export const FetchPolicyLive = FetchPolicy.layer.succeed(
+  Effect.fn(function* (host) {
+    if (isWorker(host)) {
+      yield* host.bind`${host}`({
+        bindings: [
+          {
+            type: "service",
+            name: host.LogicalId,
+            service: host.workerName,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`FetchPolicy does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/HttpServer.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/HttpServer.ts
new file mode 100644
index 00000000000..54003ed9359
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/HttpServer.ts
@@ -0,0 +1,79 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Scope from "effect/Scope";
+import * as EffectHttp from "effect/unstable/http/HttpEffect";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as Http from "../../Http.ts";
+import { Request } from "./Request.ts";
+import { isWorkerEvent, type WorkerServices } from "./Worker.ts";
+
+export type HttpEffect = Http.HttpEffect<WorkerServices>;
+
+export const makeRequestHandler =
+  <Req = never>(
+    handler: Http.HttpEffect<Req> | Effect.Effect<Http.HttpEffect<Req>>,
+  ) =>
+  (event: any) =>
+    isWorkerEvent(event) && event.type === "fetch"
+      ? makeRequestEffect(event.input, handler)
+      : undefined;
+
+export const makeRequestEffect = <Req = never>(
+  webRequest: cf.Request,
+  handler: Http.HttpEffect<Req> | Effect.Effect<Http.HttpEffect<Req>>,
+) => {
+  const safeHandler = Http.safeHttpEffect(handler);
+  return Effect.gen(function* () {
+    const request = HttpServerRequest.fromWeb(
+      webRequest as any as globalThis.Request,
+    ).modify({
+      remoteAddress: Option.fromUndefinedOr(
+        webRequest.headers.get("cf-connecting-ip") ?? undefined,
+      ),
+    });
+
+    Object.defineProperty(request, "raw", {
+      get: () =>
+        Object.assign(request.stream, {
+          raw: webRequest.body,
+        }),
+    });
+
+    return yield* toHandledWebResponse(safeHandler).pipe(
+      Effect.provide([
+        Layer.succeed(HttpServerRequest.HttpServerRequest, request),
+        Layer.succeed(Request, webRequest as any),
+      ]),
+    );
+  }) as any;
+};
+
+const toHandledWebResponse = <Req>(
+  handler: Effect.Effect<HttpServerResponse.HttpServerResponse, never, Req>,
+) =>
+  Effect.gen(function* () {
+    // `toHandled` exposes the final response through this callback, not its
+    // return value. Keep the assignment isolated here so callers get Response.
+    const context = yield* Effect.context();
+    const webResponse = yield* Deferred.make<Response>();
+
+    yield* EffectHttp.toHandled(handler, (request, response) =>
+      Deferred.succeed(
+        webResponse,
+        // Conversion to web response with options matches `EffectHttp.toWebHandler`'s callback.
+        HttpServerResponse.toWeb(EffectHttp.scopeTransferToStream(response), {
+          withoutBody: request.method === "HEAD",
+          context,
+        }),
+      ),
+    );
+    return yield* Deferred.await(webResponse);
+  });
+
+const scopeEjected = Symbol.for("effect/http/HttpEffect/scopeEjected");
+
+export const isScopeEjected = (scope: Scope.Scope) => scopeEjected in scope;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/InferEnv.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/InferEnv.ts
new file mode 100644
index 00000000000..907c5ced62c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/InferEnv.ts
@@ -0,0 +1,89 @@
+/// <reference types="@cloudflare/workers-types" />
+
+import type * as Effect from "effect/Effect";
+import type { Redacted } from "effect/Redacted";
+import type * as Stream from "effect/Stream";
+import type { Rpc } from "../../Rpc.ts";
+import type * as Cloudflare from "../index.ts";
+import type { RpcErrorEnvelope, RpcStreamEnvelope } from "./Rpc.ts";
+import type { Worker } from "./Worker.ts";
+
+export type InferEnv<W> =
+  W extends Effect.Effect<infer A, infer _E, infer _R>
+    ? InferEnv<A>
+    : W extends Worker<any>
+      ? InferEnv<Exclude<W["Props"]["env"], undefined>>
+      : {
+          [k in keyof W]: GetBindingType<W[k]>;
+        };
+
+export type GetBindingType<T> =
+  T extends Effect.Effect<infer A, infer _E, infer _R>
+    ? GetBindingType<A>
+    : T extends Cloudflare.Assets
+      ? Service
+      : T extends Rpc<infer Shape extends object>
+        ? RpcWireShape<Shape> & Service
+        : T extends Cloudflare.D1Database
+          ? D1Database
+          : T extends Cloudflare.R2Bucket
+            ? R2Bucket
+            : T extends Cloudflare.KVNamespace
+              ? KVNamespace
+              : T extends Cloudflare.Queue
+                ? Queue<unknown>
+                : T extends Cloudflare.AiGateway
+                  ? Ai
+                  : T extends Cloudflare.SendEmail
+                    ? SendEmail
+                    : T extends Cloudflare.AnalyticsEngineDataset
+                      ? AnalyticsEngineDataset
+                      : T extends Cloudflare.Artifacts
+                        ? Artifacts
+                        : T extends Cloudflare.RateLimit
+                          ? RateLimit
+                          : T extends Cloudflare.Images
+                            ? ImagesBinding
+                            : T extends Cloudflare.Browser
+                              ? Fetcher
+                              : T extends Cloudflare.Hyperdrive
+                                ? Hyperdrive
+                                : T extends Cloudflare.DynamicWorkerLoader
+                                  ? Cloudflare.DynamicWorkerLoaderBinding
+                                  : T extends Cloudflare.DurableObjectNamespaceLike
+                                    ? DurableObjectNamespace<
+                                        Exclude<T["Shape"], undefined>
+                                      >
+                                    : T extends Redacted<any>
+                                      ? // redacteds are always stored as secret_text, so are always string
+                                        // we JSON.stringify when not a Redacted<string>
+                                        string
+                                      : T;
+
+/**
+ * Cloudflare service-binding wire shape for an Effect-native Worker.
+ *
+ * Effect/Stream return values are encoded as envelopes on the wire (see
+ * `RpcErrorEnvelope`, `RpcStreamEnvelope`), so the mapped types reflect what
+ * the raw binding actually resolves to. `fetch` is dropped from the user
+ * shape and re-introduced via `Service` so callers get the standard
+ * `(input, init?) => Promise<Response>` signature.
+ *
+ * Use {@link toPromiseApi} to wrap a binding into a Promise<T>-flavored view
+ * where envelopes are decoded for you.
+ */
+export type RpcWireShape<Shape> = {
+  [K in keyof Shape as K extends "fetch" ? never : K]: Shape[K] extends (
+    ...args: infer A
+  ) => Effect.Effect<infer T, any, any>
+    ? (...args: A) => Promise<T | RpcErrorEnvelope>
+    : Shape[K] extends (...args: infer A) => Stream.Stream<any, any, any>
+      ? (...args: A) => Promise<RpcStreamEnvelope | RpcErrorEnvelope>
+      : Shape[K] extends Effect.Effect<infer T, any, any>
+        ? Promise<T | RpcErrorEnvelope>
+        : Shape[K] extends Stream.Stream<any, any, any>
+          ? Promise<RpcStreamEnvelope | RpcErrorEnvelope>
+          : Shape[K] extends (...args: infer A) => infer R
+            ? (...args: A) => Promise<Awaited<R>>
+            : Promise<Shape[K]>;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/LocalWorkerProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/LocalWorkerProvider.ts
new file mode 100644
index 00000000000..20e5593bd85
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/LocalWorkerProvider.ts
@@ -0,0 +1,647 @@
+import {
+  layerRuntime,
+  Runtime,
+  RuntimeError,
+  type BindingHook,
+  type BindingServices,
+  type HyperdriveOrigin,
+  type Module,
+  type Assets as RuntimeAssets,
+  type DurableObjectNamespace as RuntimeDurableObjectNamespace,
+  type RuntimeServices,
+} from "@distilled.cloud/cloudflare-runtime";
+import {
+  Ai,
+  AnalyticsEngine,
+  Artifacts,
+  Assets,
+  Browser,
+  D1,
+  Data,
+  DispatchNamespace,
+  DurableObjectNamespace,
+  Hyperdrive,
+  Images,
+  Json,
+  KvNamespace,
+  MtlsCertificate,
+  Pipelines,
+  R2Bucket,
+  RateLimit,
+  SendEmail,
+  Service,
+  Text,
+  Vectorize,
+  VersionMetadata,
+  WasmModule,
+  WorkerLoader,
+  Workflows,
+} from "@distilled.cloud/cloudflare-runtime/bindings";
+import * as WorkerProxy from "@distilled.cloud/cloudflare-runtime/proxy/WorkerProxy";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Equal from "effect/Equal";
+import * as Exit from "effect/Exit";
+import * as Fiber from "effect/Fiber";
+import * as Hash from "effect/Hash";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import type * as Bundle from "../../Bundle/Bundle.ts";
+import { isResolved } from "../../Diff.ts";
+import * as RpcProvider from "../../Local/RpcProvider.ts";
+import type { ResourceBinding } from "../../Resource.ts";
+import { Stack } from "../../Stack.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { WorkerAssetsConfig, WorkerProps } from "../Workers/Worker.ts";
+import { getCompatibility } from "./Compatibility.ts";
+import * as Vite from "./Vite.ts";
+import { Worker } from "./Worker.ts";
+import { getCronBindings } from "./WorkerAsyncBindings.ts";
+import type { WorkerBinding } from "./WorkerBinding.ts";
+import { WorkerBundle, type WorkerBundleOptions } from "./WorkerBundle.ts";
+import { createWorkerName } from "./WorkerName.ts";
+
+export class WorkerValidationError extends Schema.TaggedErrorClass<WorkerValidationError>()(
+  "WorkerValidationError",
+  {
+    message: Schema.String,
+    hint: Schema.optional(Schema.String),
+    value: Schema.Unknown,
+  },
+) {}
+
+export const localRuntimeServices = () =>
+  RpcProvider.providerServicesEffect(
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const { dotAlchemy } = yield* AlchemyContext;
+      const path = yield* Path.Path;
+      return layerRuntime({
+        api: {
+          accountId,
+        },
+        storage: {
+          directory: path.join(dotAlchemy, "local"),
+        },
+      });
+    }),
+  );
+
+export const LocalWorkerProvider = () =>
+  RpcProvider.effect(
+    Worker,
+    import.meta.resolve(
+      // `import.meta.resolve(<string>)` is a runtime API — TypeScript's
+      // `rewriteRelativeImportExtensions` does NOT touch the string literal, so
+      // we have to pick the right extension ourselves. `import.meta.url` reflects
+      // the actual on-disk extension of *this* file (`.ts` when loaded from
+      // `src/` under Bun or vitest, `.js` when loaded from the compiled `lib/`
+      // under Node), which is exactly the signal we need.
+      import.meta.url.endsWith(".ts") ? "../Local.ts" : "../Local.js",
+      import.meta.url,
+    ),
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const bundler = yield* WorkerBundle;
+      const runtime = yield* Runtime;
+      const stack = yield* Stack;
+      const path = yield* Path.Path;
+      const workerProxy = yield* WorkerProxy.WorkerProxy;
+      const proxyInstances = new Map<
+        string,
+        {
+          serverOptions: WorkerConfig["dev"];
+          instance: WorkerProxy.WorkerProxyInstance;
+          scope: Scope.Closeable;
+        }
+      >();
+
+      const startProxy = Effect.fn(function* (
+        id: string,
+        serverOptions: WorkerConfig["dev"],
+      ) {
+        const scope = yield* Scope.fork(rootScope);
+        const instance = yield* workerProxy
+          .serve(serverOptions)
+          .pipe(Scope.provide(scope));
+        proxyInstances.set(id, { serverOptions, instance, scope });
+        return instance;
+      });
+
+      const stopProxy = Effect.fn(function* (id: string) {
+        const existing = proxyInstances.get(id);
+        if (existing) {
+          yield* Scope.close(existing.scope, Exit.void);
+          proxyInstances.delete(id);
+        }
+      });
+
+      const maybeStartProxy = Effect.fn(function* (
+        id: string,
+        serverOptions: WorkerConfig["dev"],
+      ) {
+        const existing = proxyInstances.get(id);
+        if (existing) {
+          if (Equal.equals(existing.serverOptions, serverOptions)) {
+            return existing.instance;
+          }
+          yield* stopProxy(id);
+        }
+        return yield* startProxy(id, serverOptions);
+      });
+
+      const toRuntimeModules = Effect.fn(function* (
+        bundle: Bundle.BundleOutput,
+      ) {
+        const modules: Module[] = [];
+        for (const file of bundle.files) {
+          const ext = path.extname(file.path);
+          const type = moduleTypeFromExtension(ext);
+          if (type === "SourceMap") continue;
+          if (type === "Data" || type === "Wasm") {
+            if (!(file.content instanceof Uint8Array)) {
+              return yield* new WorkerValidationError({
+                message: `Expected Uint8Array for ${file.path} (${type})`,
+                value: file.content,
+              });
+            }
+            modules.push({
+              name: file.path,
+              type,
+              content: file.content,
+            });
+          } else {
+            if (typeof file.content !== "string") {
+              return yield* new WorkerValidationError({
+                message: `Expected string for ${file.path} (${type})`,
+                value: file.content,
+              });
+            }
+            modules.push({
+              name: file.path,
+              type,
+              content: file.content,
+            });
+          }
+        }
+        return modules;
+      });
+
+      const serveScoped = Effect.fnUntraced(function* (
+        worker: WorkerConfig,
+        bundle: Bundle.BundleOutput,
+        proxy: WorkerProxy.WorkerProxyInstance,
+      ) {
+        const scope = yield* Effect.scope.pipe(Effect.flatMap(Scope.fork));
+        const url = yield* runtime
+          .start({
+            name: worker.name,
+            compatibilityDate: worker.compatibility.date,
+            compatibilityFlags: worker.compatibility.flags,
+            bindings: worker.workerBindings as never,
+            hyperdrives: worker.hyperdrives,
+            durableObjectNamespaces: toRuntimeDurableObjectNamespaces(
+              worker.durableObjectNamespaces,
+            ),
+            modules: yield* toRuntimeModules(bundle),
+            assets: toRuntimeAssets(worker.assets),
+          })
+          .pipe(Scope.provide(scope));
+        const previous = workerdScopes.get(worker.id);
+        if (previous) {
+          yield* Effect.forkDetach(Scope.close(previous, Exit.void));
+        }
+        workerdScopes.set(worker.id, scope);
+        yield* proxy.set(url);
+        return url;
+      });
+
+      const buildConfig = Effect.fn(function* ({
+        id,
+        props,
+        bindings,
+      }: {
+        id: string;
+        props: WorkerProps;
+        bindings: ResourceBinding<Worker["Binding"]>[];
+      }) {
+        const name = yield* createWorkerName(id, props.name);
+        const compatibility = getCompatibility(props);
+        const workerBindings: BindingHook<BindingServices>[] = [
+          Text.local("ALCHEMY_PHASE", "runtime"),
+          Text.local("ALCHEMY_STACK_NAME", stack.name),
+          Text.local("ALCHEMY_STAGE", stack.stage),
+          ...Object.entries(props.env ?? {}).map(([key, value]) => {
+            const unredacted = Redacted.isRedacted(value)
+              ? Redacted.value(value)
+              : value;
+            return typeof unredacted === "string"
+              ? Text.local(key, unredacted)
+              : Json.local(key, unredacted);
+          }),
+        ];
+        const durableObjectNamespaces: Record<string, string> = {};
+        const hyperdrives: Record<string, Required<HyperdriveOrigin>> = {};
+        for (const { data } of bindings) {
+          for (const binding of data.bindings ?? []) {
+            if (
+              binding.type === "durable_object_namespace" &&
+              // The `durableObjectNamespaces` property is only used to declare DOs in this worker.
+              // Otherwise, it's a cross-worker durable object binding, which cloudflare-runtime handles automatically.
+              (!binding.scriptName || binding.scriptName === name)
+            ) {
+              // Reuse the existing namespace id if it was provided, otherwise generate a new one.
+              // `workerd` uses this for the object's storage path, so it must be safe to use as a file name.
+              durableObjectNamespaces[binding.className] =
+                binding.namespaceId ??
+                encodeURIComponent(`${id}-${binding.className}`);
+            }
+            workerBindings.push(yield* toRuntimeBinding(binding));
+          }
+          if (data.hyperdrives) {
+            for (const [id, origin] of Object.entries(data.hyperdrives)) {
+              hyperdrives[id] = {
+                scheme: origin.scheme,
+                host: origin.host,
+                port: origin.port,
+                user: origin.user,
+                database: origin.database,
+                password: Redacted.isRedacted(origin.password)
+                  ? Redacted.value(origin.password)
+                  : origin.password,
+                sslmode: origin.sslmode,
+              };
+            }
+          }
+        }
+        return {
+          id,
+          name,
+          compatibility,
+          workerBindings,
+          durableObjectNamespaces,
+          hyperdrives,
+          bundleOptions: {
+            id,
+            main: props.main!,
+            compatibility,
+            entry: props.isExternal
+              ? { kind: "external" }
+              : { kind: "effect", exports: (props.exports ?? {}) as any },
+            stack: { name: stack.name, stage: stack.stage },
+            extraOptions: props.build,
+          } satisfies WorkerBundleOptions,
+          assets: props.assets,
+          dev: {
+            ...props.dev,
+            // This is the default. Vite and cloudflare-runtime will retry if unavailable, unless `strictPort` is true.
+            port: props.dev?.port ?? 1337,
+          },
+        };
+      });
+
+      type WorkerConfig = Effect.Success<ReturnType<typeof buildConfig>>;
+
+      const runServer = Effect.fnUntraced(function* (worker: WorkerConfig) {
+        let start = Date.now();
+        let status: "start" | "update" = "start";
+        const proxy = yield* maybeStartProxy(worker.id, worker.dev);
+        yield* bundler.watch(worker.bundleOptions).pipe(
+          Stream.tap((event) => {
+            if (event._tag === "Start") {
+              start = Date.now();
+              if (status === "update") {
+                return Effect.all([
+                  Effect.log(`[${worker.id}] Rebuilding`),
+                  // This tells the proxy to queue requests until the updated worker is ready.
+                  Effect.forkChild(proxy.unset()),
+                ]);
+              }
+            } else if (event._tag === "Error") {
+              return Effect.logError(
+                `[${worker.id}] Bundle error`,
+                event.error,
+              );
+            }
+            return Effect.void;
+          }),
+          Stream.filterMap((event) =>
+            event._tag === "Success"
+              ? Result.succeed(event.output)
+              : Result.failVoid,
+          ),
+          Stream.mapEffect((bundle) =>
+            serveScoped(worker, bundle, proxy).pipe(
+              Effect.exit,
+              Effect.tap((exit) => {
+                if (exit._tag === "Success") {
+                  const message = Effect.log(
+                    `[${worker.id}] ${status === "update" ? "Updated" : "Started"} in ${Math.round(Date.now() - start)}ms`,
+                  );
+                  status = "update";
+                  return message;
+                } else {
+                  return Effect.logError(
+                    `[${worker.id}] Error`,
+                    Cause.squash(exit.cause),
+                  );
+                }
+              }),
+            ),
+          ),
+          Stream.runDrain,
+          Effect.forkScoped,
+        );
+        return proxy.url.toString();
+      });
+
+      const rootScope = yield* Effect.scope;
+      const workerdScopes = new Map<string, Scope.Closeable>();
+
+      const context = yield* Effect.context<RuntimeServices>();
+      const instances = new Map<
+        string,
+        {
+          hash: number;
+          fiber: Fiber.Fiber<
+            Worker["Attributes"],
+            Bundle.BundleError | WorkerValidationError | RuntimeError
+          >;
+          scope: Scope.Closeable;
+        }
+      >();
+
+      const runInstance = Effect.fn(function* (options: {
+        id: string;
+        props: WorkerProps;
+        bindings: ResourceBinding<Worker["Binding"]>[];
+      }) {
+        const { props, bindings } = options;
+        const config = yield* buildConfig(options);
+        let url: string;
+        if (props.vite) {
+          const devServer = yield* Vite.viteDev(
+            props.vite.rootDir,
+            props.env ?? {},
+            {
+              compatibilityDate: config.compatibility.date,
+              compatibilityFlags: config.compatibility.flags,
+              worker: {
+                name: config.name,
+                bindings: config.workerBindings,
+                durableObjectNamespaces: toRuntimeDurableObjectNamespaces(
+                  config.durableObjectNamespaces,
+                ),
+                hyperdrives: config.hyperdrives,
+                assets: toRuntimeAssets(config.assets),
+              },
+              context,
+            },
+            config.dev,
+          );
+          url = devServer.resolvedUrls!.local[0];
+        } else {
+          url = yield* runServer(config);
+        }
+        return {
+          workerId: config.name,
+          workerName: config.name,
+          logpush: undefined,
+          url,
+          tags: [],
+          durableObjectNamespaces: config.durableObjectNamespaces,
+          domains: [url],
+          crons: Array.from(
+            new Set([...getCronBindings(bindings), ...(props.crons ?? [])]),
+          ),
+          accountId,
+        } satisfies Worker["Attributes"];
+      });
+
+      return {
+        diff: Effect.fn(function* ({ id, news, newBindings, output }) {
+          if (!isResolved(news) || !isResolved(newBindings)) return undefined;
+          const options = {
+            id,
+            props: news,
+            bindings: newBindings,
+          };
+          const hash = Hash.structure(options);
+          if (instances.get(options.id)?.hash === hash) {
+            return { action: "noop" };
+          }
+          const name = yield* createWorkerName(id, news.name);
+          return {
+            action: "update",
+            stables: output?.workerName === name ? ["workerName"] : undefined,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, bindings }) {
+          const options = { id, props: news, bindings };
+          const hash = Hash.structure(options);
+          const existing = instances.get(options.id);
+          if (existing) {
+            if (existing.hash === hash) {
+              yield* Effect.log(
+                `[${options.id}] No changes, using existing instance`,
+              );
+              return yield* Fiber.join(existing.fiber);
+            }
+            yield* Effect.log(
+              `[${options.id}] Changes detected, interrupting existing instance`,
+            );
+            yield* Fiber.interrupt(existing.fiber);
+            yield* Scope.close(existing.scope, Exit.void);
+            instances.delete(options.id);
+          }
+          const scope = yield* Scope.fork(rootScope);
+          const fiber = yield* runInstance(options).pipe(
+            Effect.forkDetach,
+            Scope.provide(scope),
+          );
+          instances.set(options.id, { hash, fiber, scope });
+          return yield* Fiber.join(fiber).pipe(
+            Effect.onExit((exit) =>
+              Effect.sync(() => {
+                if (exit._tag === "Failure") {
+                  instances.delete(options.id);
+                }
+              }),
+            ),
+          );
+        }),
+        delete: Effect.fn(function* ({ id }) {
+          const existing = instances.get(id);
+          if (existing) {
+            yield* Fiber.interrupt(existing.fiber);
+            yield* Scope.close(existing.scope, Exit.void);
+            instances.delete(id);
+          }
+        }),
+      };
+    }),
+  );
+
+const toRuntimeBinding = Effect.fnUntraced(function* (b: WorkerBinding) {
+  const unsupported = () =>
+    new WorkerValidationError({
+      message: `${b.type} bindings are not supported in local mode`,
+      value: b,
+    });
+  switch (b.type) {
+    case "ai":
+      return Ai.remote(b.name);
+    case "analytics_engine":
+      return AnalyticsEngine.local(b.name, b.dataset);
+    case "artifacts":
+      return Artifacts.remote(b.name, b.namespace);
+    case "assets":
+      return Assets.local(b.name);
+    case "browser":
+      return Browser.remote(b.name);
+    case "d1":
+      return D1.remote(b.name, b.databaseId);
+    case "data_blob":
+      return Data.local(b.name, Buffer.from(b.part));
+    case "dispatch_namespace":
+      return DispatchNamespace.remote({
+        binding: b.name,
+        namespace: b.namespace,
+      });
+    case "durable_object_namespace":
+      return DurableObjectNamespace.local({
+        binding: b.name,
+        className: b.className,
+        scriptName: b.scriptName,
+      });
+    case "hyperdrive":
+      return Hyperdrive.local(b.name, b.id);
+    case "images":
+      return Images.remote(b.name);
+    case "inherit":
+      return yield* unsupported();
+    case "json":
+      return Json.local(b.name, b.json);
+    case "kv_namespace":
+      return KvNamespace.remote(b.name, b.namespaceId);
+    case "mtls_certificate":
+      return MtlsCertificate.remote(b.name, b.certificateId);
+    case "pipelines":
+      return Pipelines.remote(b.name, b.pipeline);
+    case "plain_text":
+      return Text.local(b.name, b.text);
+    case "queue":
+      return yield* unsupported();
+    case "r2_bucket":
+      return R2Bucket.remote(b.name, b.bucketName, b.jurisdiction);
+    case "ratelimit":
+      return RateLimit.local({
+        binding: b.name,
+        simple: b.simple,
+        namespaceId: b.namespaceId,
+      });
+    case "secret_key":
+      return yield* unsupported();
+    case "secret_text":
+      return Text.local(b.name, b.text);
+    case "secrets_store_secret":
+      return yield* unsupported();
+    case "send_email":
+      return SendEmail.remote({
+        binding: b.name,
+        destinationAddress: b.destinationAddress,
+        allowedDestinationAddresses: b.allowedDestinationAddresses,
+        allowedSenderAddresses: b.allowedSenderAddresses,
+      });
+    case "service":
+      return Service.local({ binding: b.name, scriptName: b.service });
+    case "text_blob":
+      return Data.local(b.name, Buffer.from(b.part));
+    case "vectorize":
+      return Vectorize.remote(b.name, b.indexName);
+    case "version_metadata":
+      return VersionMetadata.local(b.name);
+    case "wasm_module":
+      return WasmModule.local(b.name, Buffer.from(b.part));
+    case "worker_loader":
+      return WorkerLoader.local(b.name);
+    case "workflow":
+      return Workflows.local({
+        binding: b.name,
+        workflowName: b.workflowName,
+        className: b.className,
+        scriptName: b.scriptName,
+      });
+    default:
+      return yield* unsupported();
+  }
+});
+
+const toRuntimeAssets = (
+  assets: WorkerAssetsConfig | undefined,
+): RuntimeAssets | undefined => {
+  if (!assets) return undefined;
+  if (typeof assets === "string") {
+    return {
+      directory: assets,
+    };
+  }
+  return {
+    directory: "directory" in assets ? assets.directory : assets.path,
+    headers: assets.config?.headers,
+    redirects: assets.config?.redirects,
+    // Distilled widened generated string enums to open unions (`string & {}`);
+    // the API only ever returns the known variants here.
+    htmlHandling: assets.config?.htmlHandling as
+      | "none"
+      | "auto-trailing-slash"
+      | "force-trailing-slash"
+      | "drop-trailing-slash"
+      | undefined,
+    notFoundHandling: assets.config?.notFoundHandling as
+      | "none"
+      | "404-page"
+      | "single-page-application"
+      | undefined,
+    runWorkerFirst: assets.config?.runWorkerFirst,
+    serveDirectly: assets.config?.serveDirectly,
+  };
+};
+
+const toRuntimeDurableObjectNamespaces = (
+  namespaces: Record<string, string>,
+): RuntimeDurableObjectNamespace[] => {
+  return Object.entries(namespaces).map(([className, namespaceId]) => ({
+    className,
+    uniqueKey: namespaceId,
+    sql: true,
+  }));
+};
+
+const moduleTypeFromExtension = (ext: string): Module["type"] | "SourceMap" => {
+  switch (ext) {
+    case ".wasm":
+      return "Wasm";
+    case ".txt":
+    case ".html":
+    case ".sql":
+    case ".custom":
+      return "Text";
+    case ".bin":
+      return "Data";
+    case ".mjs":
+    case ".js":
+      return "ESModule";
+    case ".cjs":
+      return "CommonJsModule";
+    case ".map":
+      return "SourceMap";
+    default:
+      return "Text";
+  }
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Request.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Request.ts
new file mode 100644
index 00000000000..138394d96b6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Request.ts
@@ -0,0 +1,5 @@
+import * as Context from "effect/Context";
+
+export class Request extends Context.Service<Request, globalThis.Request>()(
+  "Request",
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Rpc.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Rpc.ts
new file mode 100644
index 00000000000..d36f1afeaa8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Rpc.ts
@@ -0,0 +1,372 @@
+import type * as cf from "@cloudflare/workers-types";
+
+import * as Cause from "effect/Cause";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Sink from "effect/Sink";
+import * as Stream from "effect/Stream";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import {
+  RpcClient,
+  RpcSerialization,
+  type Rpc,
+  type RpcGroup,
+} from "effect/unstable/rpc";
+import type * as RpcClientError from "effect/unstable/rpc/RpcClientError";
+import * as Socket from "effect/unstable/socket/Socket";
+import { isYieldableEffect } from "../../Util/effect.ts";
+import { fromCloudflareFetcher } from "../Fetcher.ts";
+
+export const StreamTag = "~alchemy/rpc/stream";
+export const ErrorTag = "~alchemy/rpc/error";
+export const StreamErrorTag = "~alchemy/rpc/stream-error";
+
+type StreamEncoding = "bytes" | "jsonl";
+
+export type RpcStreamEnvelope = {
+  _tag: typeof StreamTag;
+  encoding: StreamEncoding;
+  body: ReadableStream<Uint8Array>;
+};
+
+export class RpcDecodeError extends Data.TaggedError("RpcDecodeError")<{
+  readonly cause: unknown;
+}> {
+  override get message() {
+    return this.cause instanceof Error
+      ? this.cause.message
+      : String(this.cause);
+  }
+}
+
+export class RpcCallError extends Data.TaggedError("RpcCallError")<{
+  readonly method: string;
+  readonly cause: unknown;
+}> {
+  override get message() {
+    return `RPC call to "${this.method}" failed: ${
+      this.cause instanceof Error ? this.cause.message : String(this.cause)
+    }`;
+  }
+}
+
+export class RpcRemoteStreamError extends Data.TaggedError(
+  "RpcRemoteStreamError",
+)<{
+  readonly error: unknown;
+}> {}
+
+export type RpcErrorEnvelope = {
+  _tag: typeof ErrorTag;
+  error: unknown;
+};
+
+export type RpcStreamErrorMarker = {
+  _tag: typeof StreamErrorTag;
+  error: unknown;
+};
+
+export const isRpcStreamErrorMarker = (
+  value: unknown,
+): value is RpcStreamErrorMarker =>
+  typeof value === "object" &&
+  value !== null &&
+  "_tag" in value &&
+  value._tag === StreamErrorTag &&
+  "error" in value;
+
+export const isRpcErrorEnvelope = (value: unknown): value is RpcErrorEnvelope =>
+  typeof value === "object" &&
+  value !== null &&
+  "_tag" in value &&
+  value._tag === ErrorTag &&
+  "error" in value;
+
+/**
+ * Normalize an error value into a plain, structured-clone-safe object.
+ * Tagged errors keep `_tag` and all own enumerable fields.
+ * Plain `Error` instances keep `name`, `message`, and `stack`.
+ */
+export const encodeRpcError = (error: unknown): unknown => {
+  if (error === null || error === undefined) return error;
+  if (typeof error !== "object") return error;
+
+  const obj = error as Record<string, unknown>;
+  if ("_tag" in obj && typeof obj._tag === "string") {
+    const out: Record<string, unknown> = {};
+    for (const key of Object.keys(obj)) {
+      out[key] = obj[key];
+    }
+    if (error instanceof Error && !("message" in out)) {
+      out.message = (error as Error).message;
+    }
+    return out;
+  }
+
+  if (error instanceof Error) {
+    return { name: error.name, message: error.message, stack: error.stack };
+  }
+
+  return error;
+};
+
+export const isRpcStreamEnvelope = (
+  value: unknown,
+): value is RpcStreamEnvelope =>
+  typeof value === "object" &&
+  value !== null &&
+  "_tag" in value &&
+  value._tag === StreamTag &&
+  "encoding" in value &&
+  (value.encoding === "bytes" || value.encoding === "jsonl") &&
+  "body" in value &&
+  value.body instanceof ReadableStream;
+
+export const fromRpcReadableStream = (
+  body: ReadableStream<Uint8Array>,
+  encoding: StreamEncoding,
+): Stream.Stream<
+  any,
+  Socket.SocketError | RpcDecodeError | RpcRemoteStreamError
+> => {
+  const stream = Stream.fromReadableStream({
+    evaluate: () => body,
+    onError: (cause) =>
+      Socket.isSocketError(cause)
+        ? cause
+        : new Socket.SocketError({
+            reason: new Socket.SocketReadError({ cause }),
+          }),
+  });
+
+  if (encoding === "bytes") {
+    return stream;
+  }
+
+  return stream.pipe(
+    Stream.decodeText,
+    Stream.splitLines,
+    Stream.filter((line) => line.length > 0),
+    Stream.mapEffect((line) =>
+      Effect.try({
+        try: () => JSON.parse(line),
+        catch: (cause) => new RpcDecodeError({ cause }),
+      }),
+    ),
+    Stream.flatMap((value) =>
+      isRpcStreamErrorMarker(value)
+        ? Stream.fail(new RpcRemoteStreamError({ error: value.error }))
+        : Stream.succeed(value),
+    ),
+  );
+};
+
+export const fromRpcStreamEnvelope = (
+  envelope: RpcStreamEnvelope,
+): Stream.Stream<
+  any,
+  Socket.SocketError | RpcDecodeError | RpcRemoteStreamError
+> => fromRpcReadableStream(envelope.body, envelope.encoding);
+
+export const decodeRpcValue = (value: unknown) => {
+  if (isRpcStreamEnvelope(value)) {
+    return fromRpcReadableStream(value.body, value.encoding);
+  }
+
+  if (value instanceof ReadableStream) {
+    return fromRpcReadableStream(value, "bytes");
+  }
+
+  return value;
+};
+
+/**
+ * Decode an RPC return value, lifting error envelopes into the Effect
+ * error channel so that remote `Effect.fail(...)` values are recoverable.
+ */
+export const decodeRpcResult = (
+  value: unknown,
+): Effect.Effect<unknown, unknown> => {
+  if (isRpcErrorEnvelope(value)) {
+    return Effect.fail(value.error);
+  }
+  return Effect.succeed(decodeRpcValue(value));
+};
+
+/**
+ * Wrap a Cloudflare service-binding stub (or an `Effect` that resolves
+ * to one — useful when the stub depends on a service like
+ * `WorkerEnvironment` that's only available at *exec* phase) into an
+ * Effect-typed RPC client.
+ *
+ * `Service.fetch`/`Service.connect` are passed through eagerly when the
+ * stub is already resolved; everything else is treated as an RPC method
+ * whose dispatch is deferred until call time, so the user effect runs in
+ * the right runtime layer (which is what `bindWorker` actually wants —
+ * its methods are called at exec, even though it's *defined* at init).
+ */
+export const makeRpcStub = <Shape>(
+  stubSource: unknown | Effect.Effect<unknown, never, never>,
+): Shape => {
+  const isLazy = isYieldableEffect(stubSource);
+  const eagerFetcher = isLazy
+    ? undefined
+    : fromCloudflareFetcher(stubSource as cf.Fetcher);
+  const proxyTarget: object = eagerFetcher ?? {};
+
+  return new Proxy(proxyTarget, {
+    get: (target: any, prop) => {
+      if (!isLazy && prop in target) return target[prop];
+      if (typeof prop !== "string" && typeof prop !== "symbol") {
+        return target[prop];
+      }
+      return (...args: any[]) =>
+        asEffectOrStream(
+          Effect.gen(function* () {
+            const stub = isLazy
+              ? yield* stubSource as Effect.Effect<any>
+              : stubSource;
+            return yield* Effect.tryPromise({
+              try: () => (stub as any)[prop](...args),
+              catch: (cause) =>
+                new RpcCallError({ method: String(prop), cause }),
+            }).pipe(Effect.flatMap(decodeRpcResult));
+          }),
+        );
+    },
+  }) as Shape;
+};
+
+// Effect's internal Stream brand. `Stream.isStream` recognises a value by
+// this property and reads its `channel`. A `makeRpcStub` method can't know
+// synchronously whether the remote method returns a value or a `Stream`
+// (the call is async), yet its declared type mirrors the DO `Shape`
+// verbatim — value methods are typed `Effect<A>`, streaming methods `Stream<A>`.
+// We satisfy BOTH by handing back the call `Effect` augmented with the Stream
+// brand + channel, so the single return value can be `yield*`-ed / `.pipe`d as
+// an Effect (value methods, e.g. `stub.put(k, v).pipe(Effect.orDie)`) AND piped
+// through `Stream.*` combinators (streaming methods, e.g.
+// `stub.tick(n).pipe(Stream.map(...))`).
+const StreamTypeId = "~effect/Stream";
+
+const asEffectOrStream = (
+  call: Effect.Effect<unknown, unknown>,
+): Effect.Effect<unknown, unknown> => {
+  const streamForm = Stream.unwrap(
+    Effect.map(call, (value) =>
+      Stream.isStream(value) ? value : Stream.succeed(value),
+    ),
+  );
+  return Object.assign(call, {
+    [StreamTypeId]: streamForm[StreamTypeId],
+    channel: streamForm.channel,
+  });
+};
+
+export const toRpcStream = (stream: Stream.Stream<any, any, any>) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const [head, rest] = yield* Stream.peel(stream, Sink.head());
+
+      if (Option.isSome(head) && head.value instanceof Uint8Array) {
+        return {
+          _tag: StreamTag,
+          encoding: "bytes",
+          body: Stream.toReadableStream(
+            rest.pipe(Stream.prepend([head.value])),
+          ),
+        } satisfies RpcStreamEnvelope;
+      }
+
+      const body = Option.isSome(head)
+        ? rest.pipe(Stream.prepend([head.value]))
+        : rest;
+
+      return {
+        _tag: StreamTag,
+        encoding: "jsonl",
+        body: Stream.toReadableStream(
+          appendStreamErrors(
+            body.pipe(Stream.map((value) => JSON.stringify(value) + "\n")),
+          ).pipe(Stream.encodeText),
+        ),
+      } satisfies RpcStreamEnvelope;
+    }),
+  ).pipe(
+    Effect.catchCause((cause) => {
+      const failReason = cause.reasons.find(Cause.isFailReason);
+      if (failReason) {
+        return Effect.succeed({
+          _tag: StreamTag,
+          encoding: "jsonl",
+          body: Stream.toReadableStream(
+            Stream.succeed(encodeStreamErrorMarker(cause)).pipe(
+              Stream.encodeText,
+            ),
+          ),
+        } satisfies RpcStreamEnvelope);
+      }
+      return Effect.die(Cause.squash(cause));
+    }),
+  );
+
+const encodeStreamErrorMarker = (cause: Cause.Cause<unknown>): string => {
+  const failReason = cause.reasons.find(Cause.isFailReason);
+  const error = failReason ? encodeRpcError(failReason.error) : undefined;
+  return (
+    JSON.stringify({
+      _tag: StreamErrorTag,
+      error,
+    } satisfies RpcStreamErrorMarker) + "\n"
+  );
+};
+
+const appendStreamErrors = (s: Stream.Stream<string, unknown>) =>
+  s.pipe(
+    Stream.catchCause((cause) =>
+      Stream.succeed(encodeStreamErrorMarker(cause)),
+    ),
+  );
+
+export const bindEffectRpc = <Rpcs extends Rpc.Any>(
+  namespace: { readonly getByName: (id: string) => { readonly fetch: any } },
+  group: RpcGroup.RpcGroup<Rpcs>,
+  options?: {
+    /**
+     * Override the rpc serialization layer. Defaults to NDJSON, which
+     * is required when any rpc in the group is a streaming rpc.
+     */
+    readonly serialization?: Layer.Layer<RpcSerialization.RpcSerialization>;
+  },
+): {
+  readonly getByName: (
+    id: string,
+  ) => Effect.Effect<
+    RpcClient.RpcClient<Rpcs, RpcClientError.RpcClientError>,
+    never,
+    Rpc.MiddlewareClient<Rpcs>
+  >;
+} => {
+  const serialization = options?.serialization ?? RpcSerialization.layerNdjson;
+
+  return {
+    // Wrap the cached `RpcClient` Effect in a chainable Proxy so callers
+    // can `yield* counter.getByName(id).method(args)` directly. The proxy
+    // records the `.method(args)` ops and replays them against the
+    // resolved client when the chain is yielded.
+    getByName: Effect.fnUntraced(function* (id: string) {
+      const httpClient = HttpClient.layerMergedContext(
+        Effect.sync(() => {
+          const stub = namespace.getByName(id);
+          return HttpClient.make((request) => stub.fetch(request));
+        }),
+      );
+      const protocol = RpcClient.layerProtocolHttp({
+        url: "http://alchemy-rpc/",
+      }).pipe(Layer.provide(serialization), Layer.provide(httpClient));
+      return yield* RpcClient.make(group).pipe(Effect.provide(protocol));
+    }) as any,
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcAsync.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcAsync.ts
new file mode 100644
index 00000000000..b655637f054
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcAsync.ts
@@ -0,0 +1,118 @@
+import type * as Effect from "effect/Effect";
+import type * as Stream from "effect/Stream";
+import type { Rpc } from "../../Rpc.ts";
+import { isRpcErrorEnvelope, isRpcStreamEnvelope } from "../Bridge.ts";
+
+export type RpcAsync<Shape> = {
+  [K in keyof Shape as K extends "fetch" ? never : K]: Shape[K] extends (
+    ...args: infer A
+  ) => Effect.Effect<infer T, any, any>
+    ? (...args: A) => Promise<T>
+    : Shape[K] extends (...args: infer A) => Stream.Stream<any, any, any>
+      ? (...args: A) => Promise<ReadableStream<Uint8Array>>
+      : Shape[K] extends Effect.Effect<infer T, any, any>
+        ? Promise<T>
+        : Shape[K] extends Stream.Stream<any, any, any>
+          ? Promise<ReadableStream<Uint8Array>>
+          : Shape[K] extends (...args: infer A) => infer R
+            ? (...args: A) => Promise<Awaited<R>>
+            : Promise<Shape[K]>;
+};
+
+/**
+ * Wrap a Cloudflare Worker RPC stub in a `Promise<T>`-shaped proxy so callers
+ * outside the Effect runtime (TanStack Start route handlers, plain Workers,
+ * test code) can `await` RPC methods directly.
+ *
+ * The proxy:
+ * - leaves `fetch` / `connect` / `Symbol.dispose` and other non-string keys
+ *   passing through to the underlying binding unchanged,
+ * - turns each `Effect<T>` / `Stream<T>` method into a `Promise<T>` /
+ *   `Promise<ReadableStream<Uint8Array>>`,
+ * - unwraps the wire envelopes produced by the Effect-side RPC bridge:
+ *   `RpcErrorEnvelope` is rethrown via {@link decodeRpcThrowable} so
+ *   `try/catch` sees an `Error` (or a tagged error object), and
+ *   `RpcStreamEnvelope` is flattened to its `ReadableStream` body.
+ *
+ * @example Three ways to reach a value from a plain Worker — direct binding, fetch, RPC
+ * ```ts
+ * import { toRpcAsync } from "alchemy/Cloudflare/Bridge";
+ * import type Backend from "./backend.ts";
+ *
+ * interface Env {
+ *   BUCKET: R2Bucket;
+ *   BACKEND: Service<Backend>;
+ * }
+ *
+ * export default {
+ *   async fetch(request: Request, env: Env): Promise<Response> {
+ *     const url = new URL(request.url);
+ *     const key = url.searchParams.get("key");
+ *     const via = url.searchParams.get("via") ?? "binding";
+ *     if (!key) return new Response("Missing 'key'", { status: 400 });
+ *
+ *     // option 1 — use the async binding directly
+ *     if (via === "binding") {
+ *       const object = await env.BUCKET.get(key);
+ *       if (!object) return new Response("Not found", { status: 404 });
+ *       return new Response(object.body);
+ *     }
+ *
+ *     // option 2 — call the Effect worker's fetch handler
+ *     if (via === "fetch") {
+ *       return env.BACKEND.fetch(
+ *         `https://backend/?key=${encodeURIComponent(key)}`,
+ *       );
+ *     }
+ *
+ *     // option 3 — call an Effect worker RPC method as a Promise
+ *     const backend = toRpcAsync<Backend>(env.BACKEND);
+ *     const value = await backend.hello(key);
+ *     if (value === null) return new Response("Not found", { status: 404 });
+ *     return new Response(value);
+ *   },
+ * };
+ * ```
+ */
+export const toRpcAsync = <W>(stub: any): RpcAsync<Rpc.Shape<W>> & Service =>
+  new Proxy(stub, {
+    get: (target, prop) => {
+      // `Service` methods (fetch/connect) and any non-string keys (Symbol.dispose, etc.)
+      // pass through to the underlying Cloudflare binding unchanged.
+      if (typeof prop !== "string" || prop === "fetch" || prop === "connect") {
+        const value = (target as any)[prop];
+        return typeof value === "function" ? value.bind(target) : value;
+      }
+
+      return async (...args: unknown[]) => {
+        const result = await (target as any)[prop](...args);
+        if (isRpcErrorEnvelope(result)) {
+          throw decodeRpcThrowable(result.error);
+        }
+        if (isRpcStreamEnvelope(result)) {
+          return result.body;
+        }
+        return result;
+      };
+    },
+  }) as any;
+
+/**
+ * Reconstruct a throwable from {@link encodeRpcError}'s wire form. Plain
+ * `Error` payloads are rebuilt as `Error` instances so `.message`/`.name`/
+ * `.stack` survive. Tagged errors (anything with a `_tag`) and primitives
+ * are thrown as-is so `try { ... } catch (e) { if (e._tag === ...) }` keeps
+ * working.
+ */
+const decodeRpcThrowable = (error: unknown): unknown => {
+  if (error === null || typeof error !== "object") return error;
+  const obj = error as Record<string, unknown>;
+  if ("_tag" in obj) return obj;
+  if (typeof obj.message === "string" || typeof obj.name === "string") {
+    const e = new Error(typeof obj.message === "string" ? obj.message : "");
+    if (typeof obj.name === "string") e.name = obj.name;
+    if (typeof obj.stack === "string") e.stack = obj.stack;
+    return e;
+  }
+  return error;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcDurableObjectNamespace.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcDurableObjectNamespace.ts
new file mode 100644
index 00000000000..501b02e59e5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcDurableObjectNamespace.ts
@@ -0,0 +1,502 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import type * as Layer from "effect/Layer";
+import type { Rpc, RpcGroup } from "effect/unstable/rpc";
+import * as RpcClient from "effect/unstable/rpc/RpcClient";
+import * as RpcClientError from "effect/unstable/rpc/RpcClientError";
+import type { Dependencies } from "../../Dependencies.ts";
+import type { HttpEffect } from "../../Http.ts";
+import type { Input } from "../../Input.ts";
+import { effectClass, taggedFunction } from "../../Util/effect.ts";
+import {
+  DurableObjectNamespace,
+  type DurableObjectNamespaceLike,
+  type DurableObjectNamespaceProps,
+  type DurableObjectNamespace as DurableObjectNamespaceType,
+  type DurableObjectServices,
+} from "./DurableObjectNamespace.ts";
+import type { DurableObjectState } from "./DurableObjectState.ts";
+import { bindEffectRpc } from "./Rpc.ts";
+import type { Worker as WorkerService } from "./Worker.ts";
+
+/**
+ * The runtime value bound to a typed rpc Durable Object namespace.
+ * Same shape as the underlying {@link DurableObjectNamespaceType} for
+ * binding metadata (name, namespaceId, kind), but `getByName(id)`
+ * returns a typed Effect `RpcClient` over the rpc server living on
+ * the DO's `fetch` handler.
+ */
+export interface RpcDurableObjectNamespace<
+  Self,
+  Rpcs extends Rpc.Any = Rpc.Any,
+> extends Omit<
+  DurableObjectNamespaceType<{ fetch: HttpEffect<DurableObjectState> }>,
+  "getByName" | "get" | "Shape"
+> {
+  /** @internal phantom — keeps `Self` reachable through the inferred type */
+  Self?: Self;
+  readonly getByName: (
+    id: string,
+  ) => Effect.Effect<
+    RpcClient.RpcClient<Rpcs, RpcClientError.RpcClientError>,
+    never,
+    Rpc.MiddlewareClient<Rpcs>
+  >;
+}
+
+// Context tag carrying the surrounding `RpcDurableObjectNamespace`
+// inside an rpc DO impl. Yield it from within a DO handler to refer
+// back to the surrounding namespace (e.g. to fan a call out to
+// sibling instances). Documented as part of the main
+// `RpcDurableObjectNamespace` JSDoc below.
+export class RpcDurableObjectNamespaceScope extends Context.Service<
+  RpcDurableObjectNamespaceScope,
+  RpcDurableObjectNamespace<unknown>
+>()("Cloudflare.RpcDurableObjectNamespace") {}
+
+export interface RpcDurableObjectNamespaceClass extends Effect.Effect<
+  RpcDurableObjectNamespace<unknown>,
+  never,
+  RpcDurableObjectNamespaceScope
+> {
+  /**
+   * Class-based forms: `class Counter extends RpcDurableObjectNamespace<Counter>()(...)`.
+   *
+   * Modular (no impl):
+   * ```ts
+   * class Counter extends RpcDurableObjectNamespace<Counter>()(
+   *   "Counter",
+   *   { schema: CounterRpcs },
+   * ) {}
+   * export const CounterLive = Counter.make(/* impl *\/);
+   * ```
+   * Inline impl:
+   * ```ts
+   * class Counter extends RpcDurableObjectNamespace<Counter>()(
+   *   "Counter",
+   *   { schema: CounterRpcs },
+   *   Effect.gen(function* () { ... }),
+   * ) {}
+   * ```
+   */
+  <Self>(): {
+    /** Modular form: separate `static make(impl)` + `static from(scriptName | Worker)`. */
+    <Rpcs extends Rpc.Any>(
+      name: string,
+      props: { readonly schema: RpcGroup.RpcGroup<Rpcs> },
+    ): Effect.Effect<
+      RpcDurableObjectNamespace<Self, Rpcs>,
+      never,
+      WorkerService | Self
+    > & {
+      new (_: never): {};
+      from(
+        scriptName: Input<string>,
+      ): Effect.Effect<
+        RpcDurableObjectNamespace<Self, Rpcs>,
+        never,
+        WorkerService
+      >;
+      from<Req = never>(
+        worker:
+          | Dependencies<Self>
+          | Effect.Effect<Dependencies<Self>, never, Req>,
+      ): Effect.Effect<
+        RpcDurableObjectNamespace<Self, Rpcs>,
+        never,
+        WorkerService | Req
+      >;
+      make<InnerR = never, InitReq = never>(
+        impl: Effect.Effect<
+          Effect.Effect<
+            Effect.Effect<HttpEffect<InnerR>, never, InnerR>,
+            never,
+            DurableObjectServices
+          >,
+          never,
+          InitReq
+        >,
+      ): Layer.Layer<
+        Self,
+        never,
+        WorkerService | Exclude<InitReq | InnerR, DurableObjectServices>
+      >;
+    };
+    /** Inline-impl form. */
+    <Rpcs extends Rpc.Any, InnerR = never, InitReq = never>(
+      name: string,
+      props: { readonly schema: RpcGroup.RpcGroup<Rpcs> },
+      impl: Effect.Effect<
+        Effect.Effect<
+          Effect.Effect<HttpEffect<InnerR>, never, InnerR>,
+          never,
+          DurableObjectServices
+        >,
+        never,
+        InitReq
+      >,
+    ): Effect.Effect<
+      RpcDurableObjectNamespace<Self, Rpcs>,
+      never,
+      WorkerService | Exclude<InitReq | InnerR, DurableObjectServices>
+    > & {
+      new (_: never): {};
+    };
+  };
+  /** Descriptor-only form, for `worker.bind` declarations */
+  <Rpcs extends Rpc.Any>(
+    name: string,
+    props: {
+      readonly schema: RpcGroup.RpcGroup<Rpcs>;
+    } & Partial<DurableObjectNamespaceProps>,
+  ): DurableObjectNamespaceLike<{ fetch: HttpEffect<DurableObjectState> }>;
+  /** Bare form: `(name, { schema }, impl)` */
+  <Rpcs extends Rpc.Any, InnerR = never, InitReq = never>(
+    name: string,
+    props: { readonly schema: RpcGroup.RpcGroup<Rpcs> },
+    impl: Effect.Effect<
+      Effect.Effect<
+        Effect.Effect<HttpEffect<InnerR>, never, InnerR>,
+        never,
+        DurableObjectServices
+      >,
+      never,
+      InitReq
+    >,
+  ): Effect.Effect<
+    RpcDurableObjectNamespace<unknown, Rpcs>,
+    never,
+    WorkerService | Exclude<InitReq | InnerR, DurableObjectServices>
+  >;
+}
+
+/**
+ * `RpcDurableObjectNamespace` is sugar over {@link DurableObjectNamespace}
+ * for Durable Objects whose surface is a typed Effect `RpcGroup`. The
+ * DO serves an `RpcServer.toHttpEffect(group)` on its own `fetch`, and
+ * consumers see `namespace.getByName(id)` as a typed `RpcClient`
+ * directly — no manual client wiring.
+ *
+ * Use this over alchemy's built-in DO method bridge whenever values
+ * crossing the DO boundary contain `Schema.Class` instances. The
+ * built-in bridge `JSON.stringify`s every method return value, which
+ * strips class identity (e.g. an `effect/ai` `Response.Usage` instance
+ * becomes a plain struct on the consumer side). With
+ * `RpcDurableObjectNamespace`, both ends go through the same
+ * `RpcSerialization` codec, so `Schema.decode` reconstructs class
+ * instances correctly.
+ *
+ * @resource
+ *
+ * @section Defining the rpc group
+ * @example DO-scoped rpc schemas
+ * The DO instance *is* the session, so the group payloads typically
+ * don't include any per-session identifier — only the per-call inputs.
+ * ```typescript
+ * import * as Schema from "effect/Schema";
+ * import { Rpc, RpcGroup } from "effect/unstable/rpc";
+ *
+ * const setTitle = Rpc.make("setTitle", {
+ *   success: Schema.Void,
+ *   payload: { title: Schema.String },
+ * });
+ *
+ * const getTitle = Rpc.make("getTitle", {
+ *   success: Schema.String,
+ *   payload: {},
+ * });
+ *
+ * export class CounterRpcs extends RpcGroup.make(setTitle, getTitle) {}
+ * ```
+ *
+ * @section Implementing the Durable Object
+ * @example Class form (recommended)
+ * Mirrors `Cloudflare.DurableObjectNamespace<Self>()(...)` — same
+ * outer/inner Effect pattern. The outer Effect resolves shared deps;
+ * the per-instance inner Effect returns the
+ * `RpcServer.toHttpEffect(schema)`-piped Effect directly.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ * import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+ * import { CounterRpcs } from "./rpcs.ts";
+ *
+ * export default class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+ *   "Counter",
+ *   { schema: CounterRpcs },
+ *   Effect.gen(function* () {
+ *     // outer init: shared deps for all instances
+ *     return Effect.gen(function* () {
+ *       // per-instance init: state + handlers
+ *       const state = yield* Cloudflare.DurableObjectState;
+ *       const handlers = CounterRpcs.toLayer({
+ *         setTitle: ({ title }) => state.storage.put("title", title),
+ *         getTitle: () =>
+ *           Effect.map(state.storage.get<string>("title"), (t) => t ?? ""),
+ *       });
+ *       return RpcServer.toHttpEffect(CounterRpcs).pipe(
+ *         Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+ *       );
+ *     });
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Calling the DO from a Worker
+ * @example Typed rpc client at the call site
+ * `yield* Counter` resolves to a value whose `getByName(id)` returns
+ * an `Effect<RpcClient<CounterRpcs>>`. Each rpc method is a typed
+ * Effect/Stream factory — no `RpcClient.make` setup needed. Yield
+ * the client inside a per-request `Effect.scoped` handler so it's
+ * freed with the request.
+ * ```typescript
+ * import Counter from "./counter.ts";
+ *
+ * Effect.gen(function* () {
+ *   const counters = yield* Counter;
+ *   const client = yield* counters.getByName("global");
+ *   yield* client.setTitle({ title: "Hello" });
+ *   const title = yield* client.getTitle({});
+ *   return title;
+ * }).pipe(Effect.scoped);
+ * ```
+ *
+ * @section Modular form: separate the class from its runtime
+ * @example Class declaration with no impl + `static make(impl)`
+ * The inline class form above bundles the runtime into the class
+ * declaration. The two-arg form `(name, { schema })` declares the
+ * class as a pure tagged identifier; provide the runtime separately
+ * via `Class.make(impl)`. Consumer Workers can import the class for
+ * binding (`Counter.from(HostWorker)`) without pulling the runtime
+ * into their bundle.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ * import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+ * import { CounterRpcs } from "./rpcs.ts";
+ *
+ * export class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+ *   "Counter",
+ *   { schema: CounterRpcs },
+ * ) {}
+ *
+ * // Only the host script imports this default export.
+ * export default Counter.make(
+ *   Effect.gen(function* () {
+ *     return Effect.gen(function* () {
+ *       const state = yield* Cloudflare.DurableObjectState;
+ *       const handlers = CounterRpcs.toLayer({
+ *         setTitle: ({ title }) => state.storage.put("title", title),
+ *         getTitle: () =>
+ *           Effect.map(state.storage.get<string>("title"), (t) => t ?? ""),
+ *       });
+ *       return RpcServer.toHttpEffect(CounterRpcs).pipe(
+ *         Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+ *       );
+ *     });
+ *   }),
+ * );
+ * ```
+ *
+ * @section Cross-script binding via `Counter.from(Worker)`
+ * @example Hosting on WorkerA, binding from WorkerB
+ * The host Worker declares `Counter` in its `Deps` (third type
+ * arg of `Worker<Self, Bindings, Deps>` or second of
+ * `RpcWorker<Self, Deps>`) and provides `CounterLive`. Any other
+ * Worker uses `Counter.from(HostWorker)` to bind to the same DO
+ * instances — writes through `HostWorker.getByName(name)` are
+ * visible from `Counter.from(HostWorker).getByName(name)`.
+ * ```typescript
+ * // host worker (declares + provides Counter)
+ * import CounterLive, { Counter } from "./counter.ts";
+ *
+ * export class WorkerA extends Cloudflare.Worker<WorkerA, {}, Counter>()(
+ *   "WorkerA",
+ *   { main: import.meta.filename },
+ * ) {}
+ *
+ * export default WorkerA.make(
+ *   Effect.gen(function* () {
+ *     const counters = yield* Counter; // local host binding
+ *     // ... fetch handler ...
+ *   }).pipe(Effect.provide(CounterLive)),
+ * );
+ *
+ * // consumer worker (binds via .from)
+ * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+ *   "WorkerB",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     const counters = yield* Counter.from(WorkerA);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         const client = yield* counters.getByName("shared");
+ *         yield* client.setTitle({ title: "via WorkerB" });
+ *         return HttpServerResponse.text("ok");
+ *       }).pipe(Effect.scoped),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @example Self-hosted isolated namespace
+ * A Worker that declares `Counter` in its own `Deps` and provides
+ * `CounterLive` hosts its own isolated namespace — instances under
+ * it are separate from any other host's. Use `Counter.from(Self)`
+ * inside the host to be explicit about which script's namespace
+ * you're binding to.
+ * ```typescript
+ * export class WorkerC extends Cloudflare.Worker<WorkerC, {}, Counter>()(
+ *   "WorkerC",
+ *   { main: import.meta.filename },
+ * ) {}
+ *
+ * export default WorkerC.make(
+ *   Effect.gen(function* () {
+ *     const counters = yield* Counter.from(WorkerC); // explicit self
+ *     // ... fetch handler ...
+ *   }).pipe(Effect.provide(CounterLive)),
+ * );
+ * ```
+ *
+ * @section Yielding the surrounding namespace from inside a DO
+ * @example `yield* RpcDurableObjectNamespace` inside the DO impl
+ * Lets a DO instance refer to its own namespace — e.g. to fan a call
+ * out to sibling instances. Mirrors `yield* DurableObjectNamespace`
+ * on the regular `DurableObjectNamespace`.
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const self = yield* Cloudflare.RpcDurableObjectNamespace;
+ *   const peer = yield* self.getByName("peer-1");
+ *   yield* peer.setTitle({ title: "Sibling call" });
+ * }).pipe(Effect.scoped);
+ * ```
+ */
+export const RpcDurableObjectNamespace: RpcDurableObjectNamespaceClass =
+  taggedFunction(RpcDurableObjectNamespaceScope, (...args: any[]) => {
+    // Class-form: zero args returns the inner builder. Inner-arg arity
+    // distinguishes modular (`(name, { schema })`, no impl — `static
+    // from`/`static make` provide the runtime) from inline-impl
+    // (`(name, { schema }, impl)`).
+    if (args.length === 0) {
+      return (...inner: any[]) => {
+        if (inner.length === 2) {
+          const [name, props] = inner as [
+            string,
+            { readonly schema: RpcGroup.RpcGroup<any> },
+          ];
+          return buildModular(name, props.schema);
+        }
+        const [name, props, impl] = inner as [
+          string,
+          { readonly schema: RpcGroup.RpcGroup<any> },
+          Effect.Effect<Effect.Effect<any>>,
+        ];
+        return build(name, props, impl);
+      };
+    }
+    // Descriptor-only form: `(name, { schema })` — no impl.
+    if (args.length === 2) {
+      const [name, props] = args as [
+        string,
+        {
+          readonly schema: RpcGroup.RpcGroup<any>;
+        } & Partial<DurableObjectNamespaceProps>,
+      ];
+      return {
+        kind: "Cloudflare.DurableObjectNamespace" as const,
+        name,
+        className: props?.className,
+      } satisfies DurableObjectNamespaceLike<any>;
+    }
+    // Bare form: `(name, { schema }, impl)`.
+    const [name, props, impl] = args as [
+      string,
+      { readonly schema: RpcGroup.RpcGroup<any> },
+      Effect.Effect<Effect.Effect<any>>,
+    ];
+    return build(name, props, impl);
+  }) as any;
+
+// Wrap a raw `DurableObjectNamespace` so its `getByName` returns a typed
+// Effect `RpcClient` (via `bindEffectRpc`) instead of the built-in
+// method-bridge stub. Used in every branch that produces a yieldable
+// `RpcDurableObjectNamespace` value.
+const rpcWrap = (
+  rawNs: DurableObjectNamespaceType<any>,
+  schema: RpcGroup.RpcGroup<any>,
+): RpcDurableObjectNamespace<any> => {
+  const rpcView = bindEffectRpc(rawNs as any, schema);
+  return Object.assign({}, rawNs, {
+    getByName: rpcView.getByName,
+  }) as unknown as RpcDurableObjectNamespace<any>;
+};
+
+// The user's inner Effect resolves to `Effect<HttpEffect>`; the
+// underlying `DurableObjectNamespace` expects `Effect<{ fetch:
+// HttpEffect }>` (a `DurableObjectShape`). Map through both layers to
+// box the http effect in the `{ fetch }` shape.
+const wrapImpl = (impl: Effect.Effect<Effect.Effect<any>>) =>
+  impl.pipe(
+    Effect.map((inner) =>
+      inner.pipe(Effect.map((fetch: HttpEffect<any>) => ({ fetch }))),
+    ),
+  ) as Effect.Effect<Effect.Effect<any>>;
+
+const build = (
+  name: string,
+  props: { readonly schema: RpcGroup.RpcGroup<any> },
+  impl: Effect.Effect<Effect.Effect<any>>,
+) => {
+  // Inline-impl class form: delegate to `DurableObjectNamespace`'s
+  // inline class form, then expose the rpc-wrapped view at yield
+  // time. No `static from`/`static make` because the impl is provided
+  // eagerly here (consumers wanting cross-script binding use the
+  // modular form below).
+  const underlying = (DurableObjectNamespace as any)()(name, wrapImpl(impl));
+  const underlyingEff: Effect.Effect<
+    DurableObjectNamespaceType<any>,
+    never,
+    any
+  > = (underlying as { asEffect(): Effect.Effect<any, never, any> }).asEffect();
+  const rpcBound = underlyingEff.pipe(
+    Effect.map((rawNs) => rpcWrap(rawNs, props.schema)),
+  ) as unknown as Effect.Effect<RpcDurableObjectNamespace<any>>;
+  return effectClass(rpcBound);
+};
+
+const buildModular = (name: string, schema: RpcGroup.RpcGroup<any>) => {
+  // Delegate to `DurableObjectNamespace<Self>()(name)` (no-impl class
+  // form) so we inherit its Self-tag plumbing for free:
+  //   - yielding the class resolves to the live namespace via the tag
+  //     (populated by `static make(impl)`'s Layer)
+  //   - `static from(scriptName | Worker)` registers a foreign-script
+  //     binding on the surrounding worker and yields a fresh handle
+  // We just rpc-wrap each output so consumers see a typed `getByName`.
+  const Underlying: any = (DurableObjectNamespace as any)()(name);
+  const underlyingEff: Effect.Effect<
+    DurableObjectNamespaceType<any>,
+    never,
+    any
+  > = (Underlying as { asEffect(): Effect.Effect<any, never, any> }).asEffect();
+
+  return class extends effectClass(
+    underlyingEff.pipe(
+      Effect.map((rawNs) => rpcWrap(rawNs, schema)),
+    ) as unknown as Effect.Effect<RpcDurableObjectNamespace<any>>,
+  ) {
+    static make = (impl: Effect.Effect<Effect.Effect<any>>) =>
+      Underlying.make(wrapImpl(impl));
+
+    static from = (
+      worker: string | object | Effect.Effect<any, any, any>,
+    ): Effect.Effect<RpcDurableObjectNamespace<any>, any, any> =>
+      Underlying.from(worker).pipe(
+        Effect.map((rawNs: DurableObjectNamespaceType<any>) =>
+          rpcWrap(rawNs, schema),
+        ),
+      );
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcWorker.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcWorker.ts
new file mode 100644
index 00000000000..b7a219278b0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/RpcWorker.ts
@@ -0,0 +1,562 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import {
+  type Rpc,
+  RpcClient,
+  type RpcGroup,
+  RpcSerialization,
+} from "effect/unstable/rpc";
+import type * as RpcClientError from "effect/unstable/rpc/RpcClientError";
+import type { Dependencies } from "../../Dependencies.ts";
+import type { HttpEffect } from "../../Http.ts";
+import type { Rpc as RpcShape } from "../../Rpc.ts";
+import { effectClass, taggedFunction } from "../../Util/effect.ts";
+import type { Worker, WorkerProps } from "./Worker.ts";
+import { Worker as WorkerCtor, WorkerEnvironment } from "./Worker.ts";
+
+/**
+ * Props for {@link RpcWorker}. Same shape as {@link WorkerProps} with
+ * an additional `schema` field carrying the rpc group definition.
+ */
+export type RpcWorkerProps<Rpcs extends Rpc.Any> = Omit<
+  WorkerProps,
+  "schema"
+> & {
+  /**
+   * The {@link RpcGroup.RpcGroup} served on this worker's `fetch`
+   * handler. The same value should be importable by any consumer of
+   * the worker (other workers or scripts using `RpcClient.make`).
+   */
+  readonly schema: RpcGroup.RpcGroup<Rpcs>;
+};
+
+// Context tag carrying the surrounding `RpcWorker` value, so
+// `yield* RpcWorker` inside the impl resolves to the worker itself
+// (mirrors `yield* Worker` semantics inside `Cloudflare.Worker`).
+// Documented as part of the main `RpcWorker` JSDoc below.
+export class RpcWorkerScope extends Context.Service<RpcWorkerScope, Worker>()(
+  "Cloudflare.RpcWorker",
+) {}
+
+// Symbol used internally to stash the rpc `RpcGroup` schema on the
+// `effectClass` that `RpcWorker(...)` returns, so `RpcWorker.bind`
+// can recover it when handed the class later.
+const SchemaSymbol = Symbol.for("alchemy.RpcWorker.schema");
+
+// Phantom carrier — `RpcWorker.bind` uses `Rpcs` to type the returned
+// rpc client. We don't tie it to a specific `Effect.R` since the
+// requirements come from the underlying `Cloudflare.Worker` factory
+// and shouldn't leak into the Stack-side service signature.
+//
+// `Deps` mirrors `Cloudflare.Worker<Self, Bindings, Deps>` — declares
+// the DOs / Workers this script publishes for cross-script binding so
+// `Counter.from(WorkerA)` type-checks from another script.
+export interface RpcWorkerYieldable<
+  Self,
+  Rpcs extends Rpc.Any,
+  Deps = never,
+> extends Effect.Effect<
+  Worker<{}> & RpcShape<Self> & Dependencies<Deps>,
+  never,
+  any
+> {
+  /** @internal */
+  readonly [SchemaSymbol]: RpcGroup.RpcGroup<Rpcs>;
+}
+
+/**
+ * Type of the {@link RpcWorker} constructor. Mirrors the class-form
+ * signature of {@link Worker} so `class X extends RpcWorker<X>()(...)`
+ * works identically and the resulting worker is `Rpc<Self>`-typed for
+ * binding consumers.
+ */
+export interface RpcWorkerClass extends Effect.Effect<
+  Worker,
+  never,
+  RpcWorkerScope
+> {
+  /**
+   * Class-based form: `class X extends RpcWorker<X>()(name, props, impl)`.
+   *
+   * The optional second type argument `Deps` mirrors
+   * `Cloudflare.Worker<Self, Bindings, Deps>` — it declares the DOs
+   * this Worker publishes for cross-script binding so consumers can
+   * write `Counter.from(WorkerA)` and have it type-check. `Rpcs` is
+   * always inferred from `props.schema`.
+   *
+   * Yielding the class in a Stack returns the {@link Worker} resource
+   * (so `worker.url`, `worker.workerName`, etc. work as usual). To get
+   * a typed `RpcClient` for *this* worker's rpc group from inside
+   * another worker's init, call {@link RpcWorker.bind}.
+   */
+  <Self, Deps = never>(): {
+    /**
+     * Modular form (no impl). Mirrors `Cloudflare.Worker<Self>()(id, props)`.
+     * Use `WorkerClass.make(impl)` to provide the runtime as a
+     * `Layer.Layer<Self>` so consumers that don't host the worker can
+     * import the class without pulling its runtime into their bundle.
+     */
+    <Rpcs extends Rpc.Any>(
+      id: string,
+      props: RpcWorkerProps<Rpcs>,
+    ): RpcWorkerYieldable<Self, Rpcs, Deps> & {
+      new (_: never): {};
+      make<InnerR = never, InitReq = never>(
+        impl: Effect.Effect<
+          Effect.Effect<HttpEffect<InnerR>, never, InnerR>,
+          never,
+          InitReq
+        >,
+      ): Layer.Layer<Self, never, Exclude<InitReq | InnerR, never>>;
+    };
+    /** Inline-impl form. */
+    <Rpcs extends Rpc.Any, InnerR = never, InitReq = never>(
+      id: string,
+      props: RpcWorkerProps<Rpcs>,
+      impl: Effect.Effect<
+        Effect.Effect<HttpEffect<InnerR>, never, InnerR>,
+        never,
+        InitReq
+      >,
+    ): RpcWorkerYieldable<Self, Rpcs, Deps> & {
+      // Phantom — `class X extends RpcWorker<X>()(...)` carries `X`
+      // through the result type via `Rpc<Self>` on the binding side;
+      // the instance shape itself is empty (no methods exposed on
+      // `new X(...)` — everything goes through `fetch`).
+      new (_: never): {};
+    };
+  };
+
+  /**
+   * Bind a typed Effect rpc client to a worker resource, using the
+   * worker's declared rpc {@link RpcGroup.RpcGroup} schema. Mirrors
+   * `Cloudflare.R2Bucket.bind(MyBucket)` and friends.
+   *
+   * Yield once at **init** — the result is a normal `RpcClient` you
+   * can call directly from any per-request handler. Internally each
+   * method invocation builds a fresh underlying `RpcClient` (through
+   * a Proxy) because Cloudflare rejects I/O objects created on a
+   * previous request; this is hidden from the consumer.
+   *
+   * Pair with {@link RpcWorker} on the server side; both ends share
+   * the same schema so values round-trip through one `Schema` codec.
+   *
+   * @example
+   * ```ts
+   * // INIT: register the binding once and get the typed client
+   * const tasks = yield* Cloudflare.RpcWorker.bind(TaskWorker);
+   *
+   * // PER-REQUEST: call methods directly
+   * proxyGetTask: ({ id }) => tasks.getTask({ id }),
+   * ```
+   */
+  readonly bind: <Self, Rpcs extends Rpc.Any>(
+    workerEff: RpcWorkerYieldable<Self, Rpcs>,
+  ) => Effect.Effect<
+    RpcClient.RpcClient<Rpcs, RpcClientError.RpcClientError> & RpcShape<Self>,
+    never,
+    Worker
+  >;
+}
+
+/** @internal helper — exposed as `RpcWorker.bind` below. */
+const bind = <Self, Rpcs extends Rpc.Any>(
+  workerEff: RpcWorkerYieldable<Self, Rpcs>,
+): Effect.Effect<
+  RpcClient.RpcClient<Rpcs, RpcClientError.RpcClientError> & RpcShape<Self>,
+  never,
+  Worker
+> =>
+  Effect.gen(function* () {
+    const schema = (workerEff as unknown as Record<symbol, unknown>)[
+      SchemaSymbol
+    ] as RpcGroup.RpcGroup<Rpcs> | undefined;
+    if (!schema) {
+      return yield* Effect.die(
+        new Error(
+          "RpcWorker.bind: passed value isn't an RpcWorker class — no schema attached.",
+        ),
+      );
+    }
+    const worker = (yield* workerEff) as Worker;
+    // Register the service binding on the surrounding worker at INIT.
+    // Mirrors `Cloudflare.bindWorker` — yielding the class is *not*
+    // enough; we need an explicit `self.bind\`${worker}\`(...)` so
+    // workerd surfaces the stub on `env` at request time.
+    const self = yield* WorkerCtor;
+    yield* self.bind`${worker}`({
+      bindings: [
+        {
+          type: "service",
+          name: worker.LogicalId,
+          service: worker.workerName,
+        },
+      ],
+    });
+
+    // Build a per-call factory that wraps the Cloudflare service-
+    // binding stub (Promise-based fetch) into an Effect `HttpClient`,
+    // then `RpcClient.make` over that transport. Each call gets its
+    // own `RpcClient` because Cloudflare rejects I/O objects (the
+    // stub.fetch body) that were created on a previous request.
+    const makeFreshClient = Effect.gen(function* () {
+      const env = yield* WorkerEnvironment;
+      const stub = (env as Record<string, { fetch: typeof fetch }>)[
+        worker.LogicalId
+      ];
+      const httpClient = HttpClient.make((req) =>
+        Effect.promise((signal) =>
+          stub.fetch(
+            new Request(req.url, {
+              method: req.method,
+              headers: new Headers(req.headers as any),
+              body: (req.body as any)?.body ?? undefined,
+              signal,
+            }),
+          ),
+        ).pipe(Effect.map((res) => HttpClientResponse.fromWeb(req, res))),
+      );
+      const protocol = RpcClient.layerProtocolHttp({
+        url: "http://alchemy-rpc-worker/",
+      }).pipe(
+        Layer.provide(RpcSerialization.layerNdjson),
+        Layer.provide(Layer.succeed(HttpClient.HttpClient, httpClient)),
+      );
+      return yield* RpcClient.make(schema).pipe(Effect.provide(protocol));
+    });
+
+    // Return a Proxy that LOOKS like an `RpcClient<Rpcs>` but defers
+    // the actual `RpcClient` construction to call time. Mirrors
+    // `makeRpcStub` from `./Rpc.ts`: each method invocation builds a
+    // fresh client, runs the call inside `Effect.scoped`, and tears
+    // the client's scope down with the call. From the consumer's
+    // perspective this is a normal `RpcClient`:
+    //
+    //   const tasks = yield* Cloudflare.RpcWorker.bind(TaskWorker);
+    //   yield* tasks.getTask({ id: "abc" });
+    return new Proxy(
+      {},
+      {
+        get: (_target, method) => {
+          if (typeof method !== "string") return undefined;
+          return (...args: unknown[]) =>
+            Effect.gen(function* () {
+              const client = yield* makeFreshClient;
+              const fn = (
+                client as unknown as Record<
+                  string,
+                  (...a: unknown[]) => Effect.Effect<unknown, unknown, unknown>
+                >
+              )[method];
+              return yield* fn(...args);
+            }).pipe(Effect.scoped);
+        },
+      },
+    ) as RpcClient.RpcClient<Rpcs, RpcClientError.RpcClientError> &
+      RpcShape<Self>;
+  });
+
+/**
+ * `RpcWorker` is a thin sugar over {@link Worker} for the common case
+ * where a worker's entire `fetch` surface is a typed Effect `RpcGroup`.
+ * It takes the rpc `schema` directly in props alongside `main`, and
+ * accepts an init Effect that returns the already-piped
+ * `RpcServer.toHttpEffect(...)`-producing Effect (no `{ fetch }`
+ * wrapper) — the wrapper plugs it into the worker's `fetch` for you.
+ *
+ * Functionally identical to writing `Cloudflare.Worker(...)` with
+ * `return { fetch: RpcServer.toHttpEffect(schema).pipe(...) }`; use
+ * whichever style you prefer.
+ *
+ * The class form (`class X extends Cloudflare.RpcWorker<X>()(...)`)
+ * carries `Self` through the result type as `Rpc<Self>`, so other
+ * workers binding to this one see the rpc shape pinned to `Self`.
+ *
+ * @resource
+ *
+ * @section Defining the rpc group
+ * @example Pure schema description
+ * The rpc group and its schemas live outside any worker so both the
+ * server (`RpcWorker`) and any consumers (`RpcClient.make` /
+ * `RpcDurableObjectNamespace`) import the same value.
+ * ```typescript
+ * import * as Schema from "effect/Schema";
+ * import { Rpc, RpcGroup } from "effect/unstable/rpc";
+ *
+ * export class TaskNotFound extends Schema.TaggedClass<TaskNotFound>()(
+ *   "TaskNotFound",
+ *   { id: Schema.String },
+ * ) {}
+ *
+ * const getTask = Rpc.make("getTask", {
+ *   payload: { id: Schema.String },
+ *   success: Schema.String,
+ *   error: TaskNotFound,
+ * });
+ *
+ * export class TaskRpcs extends RpcGroup.make(getTask) {}
+ * ```
+ *
+ * @section Implementing the worker
+ * @example Class form (recommended)
+ * Mirrors `Cloudflare.Worker<Self>()(...)` — `class X extends ...`
+ * works the same. The init Effect builds a handlers `Layer` from the
+ * group and returns the `RpcServer.toHttpEffect(schema)`-piped Effect
+ * directly.
+ * ```typescript
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ * import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+ * import { TaskRpcs } from "./rpcs.ts";
+ *
+ * export default class Worker extends Cloudflare.RpcWorker<Worker>()(
+ *   "Worker",
+ *   { main: import.meta.filename, schema: TaskRpcs },
+ *   Effect.gen(function* () {
+ *     const handlers = TaskRpcs.toLayer({
+ *       getTask: ({ id }) => Effect.succeed(`task-${id}`),
+ *     });
+ *     return RpcServer.toHttpEffect(TaskRpcs).pipe(
+ *       Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
+ *     );
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @example NDJSON for streaming rpcs
+ * If any rpc in the group is a streaming rpc, the wire serialization
+ * must be `RpcSerialization.layerNdjson` — streaming rpcs need
+ * newline framing on the wire.
+ * ```typescript
+ * return RpcServer.toHttpEffect(ChatRpcs).pipe(
+ *   Effect.provide(handlers),
+ *   Effect.provide(RpcSerialization.layerNdjson),
+ * );
+ * ```
+ *
+ * @section Modular form: separate the class from its runtime
+ * @example Class declaration with no impl + `static make(impl)`
+ * The inline class form above bundles the runtime into the class
+ * declaration. The two-arg form `(id, props)` declares the class
+ * as a pure tagged identifier; provide the runtime separately via
+ * `WorkerClass.make(impl)` so consumers can import the class for
+ * binding without pulling the host's runtime into their bundle.
+ * ```typescript
+ * export class TaskWorker extends Cloudflare.RpcWorker<TaskWorker>()(
+ *   "TaskWorker",
+ *   { main: import.meta.filename, schema: TaskRpcs },
+ * ) {}
+ *
+ * // Only the host script imports this default export; consumers
+ * // import the class above for `RpcWorker.bind(TaskWorker)`.
+ * export default TaskWorker.make(
+ *   Effect.gen(function* () {
+ *     const handlers = TaskRpcs.toLayer({
+ *       getTask: ({ id }) => Effect.succeed(`task-${id}`),
+ *     });
+ *     return RpcServer.toHttpEffect(TaskRpcs).pipe(
+ *       Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
+ *     );
+ *   }),
+ * );
+ * ```
+ *
+ * @section Hosting a Durable Object for cross-script binding
+ * @example `RpcWorker<Self, Deps>()` declares published DOs
+ * The optional second type argument `Deps` mirrors
+ * `Cloudflare.Worker<Self, Bindings, Deps>` — it declares the DOs
+ * this Worker publishes for cross-script binding. With `Counter`
+ * named in `Deps`, any other Worker can write
+ * `Counter.from(TaskWorker)` and have it type-check.
+ * ```typescript
+ * import { Counter } from "./counter.ts";
+ *
+ * export class TaskWorker extends Cloudflare.RpcWorker<TaskWorker, Counter>()(
+ *   "TaskWorker",
+ *   { main: import.meta.filename, schema: TaskRpcs },
+ * ) {}
+ * ```
+ * See {@link RpcDurableObjectNamespace} for the consumer side
+ * (`Counter.from(TaskWorker)`).
+ *
+ * @section Binding it from another worker
+ * @example `Cloudflare.RpcWorker.bind(WorkerClass)`
+ * Inside another worker's init, `RpcWorker.bind(WorkerClass)`
+ * registers the service binding on the surrounding worker and returns
+ * a typed `RpcClient` you can call directly from any per-request
+ * handler. Internally each method invocation builds a fresh underlying
+ * client (because Cloudflare rejects cross-request reuse of the
+ * stub I/O), but that's hidden behind a Proxy so the consumer sees a
+ * normal `RpcClient`.
+ * ```typescript
+ * import TaskWorker from "./task-worker.ts";
+ *
+ * export default class Caller extends Cloudflare.RpcWorker<Caller>()(
+ *   "Caller",
+ *   { main: import.meta.filename, schema: CallerRpcs },
+ *   Effect.gen(function* () {
+ *     // INIT: register binding, get the typed client
+ *     const tasks = yield* Cloudflare.RpcWorker.bind(TaskWorker);
+ *
+ *     const handlers = CallerRpcs.toLayer({
+ *       // PER-REQUEST: just call methods directly
+ *       proxyGetTask: ({ id }) => tasks.getTask({ id }),
+ *     });
+ *     return RpcServer.toHttpEffect(CallerRpcs).pipe(
+ *       Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
+ *     );
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Driving it from a test
+ * @example `Test.make` + `RpcClient.make`
+ * The same `RpcGroup` drives a typed client. `Test.make` deploys the
+ * stack once for the file; each test yields the deploy handle for its
+ * URL and calls procedures directly.
+ * ```typescript
+ * import { expect } from "@effect/vitest";
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Test from "alchemy/Test/Vitest";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ * import * as Schedule from "effect/Schedule";
+ * import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+ * import * as RpcClient from "effect/unstable/rpc/RpcClient";
+ * import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+ * import Stack from "../alchemy.run.ts";
+ * import { TaskRpcs } from "../src/rpcs.ts";
+ *
+ * const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+ *   providers: Cloudflare.providers(),
+ * });
+ * const stack = beforeAll(deploy(Stack));
+ * afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+ *
+ * const layer = (url: string) =>
+ *   RpcClient.layerProtocolHttp({ url }).pipe(
+ *     Layer.provide(FetchHttpClient.layer),
+ *     Layer.provide(
+ *       Layer.succeed(RpcSerialization.RpcSerialization, RpcSerialization.json),
+ *     ),
+ *   );
+ *
+ * test(
+ *   "getTask",
+ *   Effect.gen(function* () {
+ *     const { url } = yield* stack;
+ *     yield* Effect.gen(function* () {
+ *       const client = yield* RpcClient.make(TaskRpcs);
+ *       const result = yield* client
+ *         .getTask({ id: "abc" })
+ *         .pipe(Effect.retry({ schedule: Schedule.exponential("500 millis"), times: 5 }));
+ *       expect(result).toBe("task-abc");
+ *     }).pipe(Effect.scoped, Effect.provide(layer(url)));
+ *   }),
+ * );
+ * ```
+ *
+ * @section Yielding the surrounding worker from inside the impl
+ * @example `yield* RpcWorker` inside the init effect
+ * Mirrors `yield* DurableObjectNamespace` — yield the tag to access
+ * the surrounding worker.
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const self = yield* Cloudflare.RpcWorker;
+ * });
+ * ```
+ */
+export const RpcWorker: RpcWorkerClass = (() => {
+  const fn = (...args: any[]) => {
+    // Class-form: zero args returns the inner builder. Inner-arg arity
+    // distinguishes modular (`(id, props)`, no impl — `static make(impl)`
+    // provides the runtime) from inline-impl (`(id, props, impl)`).
+    if (args.length === 0) {
+      return (...inner: any[]) => {
+        if (inner.length === 2) {
+          const [id, props] = inner as [string, RpcWorkerProps<any>];
+          return buildModular(id, props);
+        }
+        const [id, props, impl] = inner as [
+          string,
+          RpcWorkerProps<any>,
+          Effect.Effect<Effect.Effect<HttpEffect<any>>>,
+        ];
+        return build(id, props, impl);
+      };
+    }
+    // Bare form: `(name, props, impl)`.
+    const [id, props, impl] = args as [
+      string,
+      RpcWorkerProps<any>,
+      Effect.Effect<Effect.Effect<HttpEffect<any>>>,
+    ];
+    return build(id, props, impl);
+  };
+
+  const tagged = taggedFunction(RpcWorkerScope, fn as any) as any;
+  tagged.bind = bind;
+  return tagged;
+})() as any;
+
+const wrapImpl = (impl: Effect.Effect<Effect.Effect<HttpEffect<any>>>) =>
+  // The user's inner Effect resolves to `HttpEffect`; the underlying
+  // `Cloudflare.Worker` expects `{ fetch: HttpEffect }`. Box it.
+  Effect.map(
+    impl,
+    (fetch) => ({ fetch }) as unknown as { fetch: HttpEffect<any> },
+  );
+
+const buildModular = (id: string, props: RpcWorkerProps<any>) => {
+  const { schema, ...workerProps } = props;
+  // Delegate to `Cloudflare.Worker<Self>()(id, props)` (modular form)
+  // so we inherit its `static make(impl)` plumbing for free. We just
+  // wrap the user's HttpEffect-returning impl into the `{ fetch }`
+  // shape `Cloudflare.Worker` expects, and stash the rpc schema on
+  // the class so `RpcWorker.bind(WorkerClass)` can recover it.
+  const Underlying: any = (WorkerCtor as any)()(id, workerProps);
+  const klass = class extends effectClass(
+    (Underlying as { asEffect(): Effect.Effect<Worker> }).asEffect(),
+  ) {
+    static make = (
+      impl: Effect.Effect<Effect.Effect<HttpEffect<any>>>,
+    ): Layer.Layer<any, never, any> => Underlying.make(wrapImpl(impl));
+  } as unknown as Record<symbol | string, unknown>;
+  klass[SchemaSymbol] = schema;
+  return klass;
+};
+
+const build = (
+  id: string,
+  props: RpcWorkerProps<any>,
+  impl: Effect.Effect<Effect.Effect<HttpEffect<any>>>,
+) => {
+  const { schema, ...workerProps } = props;
+
+  // Wrap the user's HttpEffect-returning Effect into the `{ fetch }`
+  // shape `Cloudflare.Worker` expects.
+  const wrappedImpl = Effect.map(
+    impl,
+    (fetch) => ({ fetch }) as unknown as { fetch: HttpEffect<any> },
+  );
+
+  // Delegate registration / binding metadata to the underlying
+  // `Cloudflare.Worker`. The returned `effectClass`, when yielded,
+  // produces the standard `Worker` resource (so `worker.url`,
+  // `worker.workerName`, etc. all work as usual).
+  const underlying = (WorkerCtor as any)()(id, workerProps, wrappedImpl);
+
+  // Re-wrap as our own `effectClass` so we can stash the rpc schema
+  // on the class for `RpcWorker.bind` to recover later. (Re-using
+  // `effectClass` here means `class X extends RpcWorker<X>()(...)`
+  // still works.)
+  const klass = effectClass(
+    (underlying as { asEffect(): Effect.Effect<Worker> }).asEffect(),
+  ) as unknown as Record<symbol, unknown>;
+  klass[SchemaSymbol] = schema;
+  return klass;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/ScheduledEvents.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/ScheduledEvents.ts
new file mode 100644
index 00000000000..704bed697d0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/ScheduledEvents.ts
@@ -0,0 +1,185 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { DurableObjectState } from "./DurableObjectState.ts";
+import type { SqlStorageValue } from "./DurableObjectStorage.ts";
+
+// ---------------------------------------------------------------------------
+// Scheduled Events — SQLite-backed cron/timer for Durable Objects
+// ---------------------------------------------------------------------------
+
+const INIT_TABLE_SQL = `
+CREATE TABLE IF NOT EXISTS alchemy_scheduled_events (
+  id TEXT PRIMARY KEY,
+  run_at INTEGER NOT NULL,
+  repeat_ms INTEGER,
+  payload TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_alchemy_scheduled_events_run_at
+  ON alchemy_scheduled_events (run_at);
+`;
+
+const ensureTable = Effect.gen(function* () {
+  const ctx = yield* DurableObjectState;
+  yield* ctx.storage.sql.exec(INIT_TABLE_SQL);
+});
+
+export interface ScheduledEvent {
+  id: string;
+  runAt: Date;
+  repeatMs?: number;
+  payload: unknown;
+}
+
+interface EventRow extends Record<string, SqlStorageValue> {
+  id: string;
+  run_at: number;
+  repeat_ms: number | null;
+  payload: string;
+}
+
+const toScheduledEvent = (row: EventRow): ScheduledEvent => ({
+  id: row.id,
+  runAt: new Date(row.run_at),
+  repeatMs: row.repeat_ms ?? undefined,
+  payload: JSON.parse(row.payload) as unknown,
+});
+
+/**
+ * Schedule (or reschedule) a named event on the current Durable Object.
+ *
+ * The event is persisted in a SQLite table and the DO alarm is set to
+ * the earliest pending `runAt`. If an event with the same `id` already
+ * exists it is replaced (upsert).
+ *
+ * @param id      Stable identifier for the event (used for upsert / cancel).
+ * @param runAt   When the event should fire.
+ * @param payload Arbitrary JSON-serialisable data delivered to the alarm handler.
+ * @param repeatMs If set, the event re-schedules itself this many ms after each fire.
+ */
+export const scheduleEvent = Effect.fnUntraced(function* (
+  id: string,
+  runAt: Date,
+  payload: unknown,
+  repeatMs?: number,
+) {
+  yield* ensureTable;
+  const ctx = yield* DurableObjectState;
+
+  yield* ctx.storage.sql.exec(
+    `INSERT OR REPLACE INTO alchemy_scheduled_events (id, run_at, repeat_ms, payload)
+     VALUES (?, ?, ?, ?)`,
+    id,
+    runAt.getTime(),
+    repeatMs ?? null,
+    JSON.stringify(payload),
+  );
+
+  yield* reconcileAlarm;
+});
+
+/**
+ * Cancel a previously scheduled event by id. No-op if the event does not exist.
+ */
+export const cancelEvent = Effect.fnUntraced(function* (id: string) {
+  yield* ensureTable;
+  const ctx = yield* DurableObjectState;
+
+  yield* ctx.storage.sql.exec(
+    `DELETE FROM alchemy_scheduled_events WHERE id = ?`,
+    id,
+  );
+
+  yield* reconcileAlarm;
+});
+
+/**
+ * List all currently scheduled events, ordered by `runAt` ascending.
+ */
+export const listEvents: Effect.Effect<
+  ScheduledEvent[],
+  never,
+  DurableObjectState
+> = Effect.gen(function* () {
+  yield* ensureTable;
+  const ctx = yield* DurableObjectState;
+
+  const cursor = yield* ctx.storage.sql.exec<EventRow>(
+    `SELECT id, run_at, repeat_ms, payload FROM alchemy_scheduled_events ORDER BY run_at ASC`,
+  );
+
+  return yield* cursor.pipe(Stream.map(toScheduledEvent), Stream.runCollect);
+});
+
+/**
+ * Process all events whose `runAt` <= now. Returns the fired events.
+ *
+ * - One-shot events are deleted after firing.
+ * - Repeating events have their `runAt` bumped by `repeatMs`.
+ * - The DO alarm is re-set to the next pending event (if any).
+ *
+ * Call this from your Durable Object's `alarm` handler:
+ *
+ * ```ts
+ * alarm: () => Effect.gen(function* () {
+ *   const fired = yield* Cloudflare.processScheduledEvents;
+ *   for (const event of fired) {
+ *     // handle each event
+ *   }
+ * })
+ * ```
+ */
+export const processScheduledEvents: Effect.Effect<
+  ScheduledEvent[],
+  never,
+  DurableObjectState
+> = Effect.gen(function* () {
+  yield* ensureTable;
+  const ctx = yield* DurableObjectState;
+  const now = Date.now();
+
+  const cursor = yield* ctx.storage.sql.exec<EventRow>(
+    `SELECT id, run_at, repeat_ms, payload FROM alchemy_scheduled_events WHERE run_at <= ? ORDER BY run_at ASC`,
+    now,
+  );
+
+  const fired = yield* cursor.pipe(
+    Stream.mapEffect((row) =>
+      (row.repeat_ms != null
+        ? ctx.storage.sql.exec(
+            `UPDATE alchemy_scheduled_events SET run_at = ? WHERE id = ?`,
+            now + row.repeat_ms,
+            row.id,
+          )
+        : ctx.storage.sql.exec(
+            `DELETE FROM alchemy_scheduled_events WHERE id = ?`,
+            row.id,
+          )
+      ).pipe(Effect.as(toScheduledEvent(row))),
+    ),
+    Stream.runCollect,
+  );
+
+  yield* reconcileAlarm;
+  return fired;
+});
+
+/**
+ * Set the DO alarm to the earliest pending event, or clear it if none remain.
+ */
+const reconcileAlarm: Effect.Effect<void, never, DurableObjectState> =
+  Effect.gen(function* () {
+    const ctx = yield* DurableObjectState;
+
+    const next = yield* (yield* ctx.storage.sql.exec<{
+      run_at: number;
+    }>(
+      `SELECT run_at FROM alchemy_scheduled_events ORDER BY run_at ASC LIMIT 1`,
+    )).pipe(Stream.take(1), Stream.runHead);
+
+    if (Option.isSome(next)) {
+      yield* ctx.storage.setAlarm(next.value.run_at);
+    } else {
+      yield* ctx.storage.deleteAlarm();
+    }
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Vite.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Vite.ts
new file mode 100644
index 00000000000..a8f696fd027
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Vite.ts
@@ -0,0 +1,116 @@
+import cloudflare, {
+  type CloudflareVitePluginOptions,
+} from "@distilled.cloud/cloudflare-vite-plugin";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import type * as vite from "vite";
+
+export const viteDev = (
+  rootDir: string = process.cwd(),
+  env: Record<string, unknown>,
+  pluginOptions: CloudflareVitePluginOptions,
+  serverOptions: vite.ServerOptions,
+) =>
+  Effect.acquireRelease(
+    Effect.promise(async () => {
+      const vite = await loadVite(rootDir);
+      const devServer = await vite.createServer({
+        root: rootDir,
+        define: getDefine(env),
+        plugins: [cloudflare(pluginOptions)],
+        server: serverOptions,
+      });
+      await devServer.listen();
+      return devServer;
+    }),
+    (devServer) =>
+      Effect.promise(async () => {
+        await devServer.close();
+      }),
+  );
+
+export const viteBuild = (
+  rootDir: string = process.cwd(),
+  env: Record<string, unknown>,
+  pluginOptions: CloudflareVitePluginOptions,
+) =>
+  Effect.promise(async () => {
+    let serverBundle: vite.Rolldown.OutputBundle | undefined;
+    let assetsDirectory: string | undefined;
+    const vite = await loadVite(rootDir);
+    const builder = await vite.createBuilder(
+      {
+        root: rootDir,
+        define: getDefine(env),
+        plugins: [
+          cloudflare(pluginOptions),
+          {
+            name: "output:ssr",
+            applyToEnvironment(environment) {
+              return environment.name === "ssr";
+            },
+            generateBundle(_outputOptions, bundle) {
+              serverBundle = bundle;
+            },
+          },
+          {
+            name: "output:client",
+            applyToEnvironment(environment) {
+              return environment.name === "client";
+            },
+            generateBundle(outputOptions) {
+              assetsDirectory = outputOptions.dir;
+            },
+          },
+        ],
+      },
+      // This is the `useLegacyBuilder` option. The Vite CLI implementation uses `null` here.
+      // Originally we used `undefined` here, but this caused the static site build to fail.
+      // https://github.com/vitejs/vite/blob/a07a4bd052ac75f916391c999c408ad5f2867e61/packages/vite/src/node/cli.ts#L367
+      null,
+    );
+    await builder.buildApp();
+    return {
+      serverBundle,
+      assetsDirectory,
+    };
+  });
+
+// Emulate `vite build` env semantics for `props.env`: only
+// keys with Vite's default `VITE_` prefix are inlined into
+// the bundle as `import.meta.env.*`. `Redacted` values are
+// unwrapped — by prefixing with `VITE_` the user is opting
+// them into the public bundle.
+const getDefine = (env: Record<string, unknown>) =>
+  Object.fromEntries(
+    Object.entries(env).flatMap(([key, raw]) => {
+      if (!key.startsWith("VITE_")) return [];
+      const value = Redacted.isRedacted(raw) ? Redacted.value(raw) : raw;
+      return [[`import.meta.env.${key}`, JSON.stringify(value)] as const];
+    }),
+  );
+
+type ViteModule = typeof import("vite");
+
+/**
+ * Dynamically load Vite from the project root. Falls back to the bundled
+ * copy if the project doesn't have its own Vite installation.
+ */
+async function loadVite(
+  projectRoot: string = process.cwd(),
+): Promise<ViteModule> {
+  try {
+    const require = createRequire(path.join(projectRoot, "package.json"));
+    const vitePath = require.resolve("vite");
+    // On Windows, absolute paths must be file:// URLs for ESM import().
+    const viteUrl = pathToFileURL(vitePath);
+    return await import(/* @vite-ignore */ viteUrl.href);
+  } catch {
+    // Fallback: try to import vite from the global node_modules (works for non-linked installs)
+    // The fallback is a bare specifier and works as-is.
+    return await import("vite");
+  }
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WebSocket.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WebSocket.ts
new file mode 100644
index 00000000000..c6f7bdf38e7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WebSocket.ts
@@ -0,0 +1,45 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { DurableObjectState } from "./DurableObjectState.ts";
+
+export type RawWebSocket = cf.WebSocket;
+
+export interface DurableWebSocket {
+  readonly ws: RawWebSocket;
+  send(data: string | Uint8Array): Effect.Effect<void>;
+  close(code: number, reason: string): Effect.Effect<void>;
+  serializeAttachment<T>(value: T): void;
+  deserializeAttachment<T>(): T | null;
+}
+
+export const fromWebSocket = (ws: RawWebSocket): DurableWebSocket => ({
+  ws,
+  send: (data) => Effect.sync(() => ws.send(data as any)),
+  close: (code, reason) => Effect.sync(() => ws.close(code, reason)),
+  serializeAttachment: (value) => ws.serializeAttachment(value),
+  deserializeAttachment: () => ws.deserializeAttachment() as any,
+});
+
+// declare global {
+//   const WebSocketPair: new () => [cf.WebSocket, cf.WebSocket];
+// }
+
+export const upgrade = Effect.fnUntraced(function* () {
+  const _Response = Response as any as typeof cf.Response;
+  const ctx = yield* DurableObjectState;
+  // @ts-expect-error
+  const [client, server] = new WebSocketPair();
+  const serverSocket = fromWebSocket(server);
+  yield* ctx.acceptWebSocket(serverSocket);
+  const rawResponse = new _Response(null, {
+    status: 101,
+    webSocket: client,
+  });
+  const effectResponse = HttpServerResponse.setBody(
+    HttpServerResponse.empty({ status: 101 }),
+    HttpBody.raw(rawResponse),
+  );
+  return [effectResponse, serverSocket] as const;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Worker.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Worker.ts
new file mode 100644
index 00000000000..b19610cfa6d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Worker.ts
@@ -0,0 +1,2306 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as zones from "@distilled.cloud/cloudflare/zones";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import * as crypto from "node:crypto";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import * as Artifacts from "../../Artifacts.ts";
+import { hashDirectory, type MemoOptions } from "../../Build/Memo.ts";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import type { InputProps } from "../../Input.ts";
+import { Platform, type Main, type PlatformProps } from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource, type ResourceBinding } from "../../Resource.ts";
+import { Stack } from "../../Stack.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { HyperdriveDevOrigin } from "../Hyperdrive/Hyperdrive.ts";
+import { CloudflareLogs } from "../Logs.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  readAssets,
+  uploadAssets,
+  type Assets,
+  type AssetsConfig,
+  type AssetsProps,
+} from "./Assets.ts";
+import { getCompatibility } from "./Compatibility.ts";
+import { isDurableObjectExport } from "./DurableObjectNamespace.ts";
+import {
+  LocalWorkerProvider,
+  localRuntimeServices,
+} from "./LocalWorkerProvider.ts";
+import { Request } from "./Request.ts";
+import * as Vite from "./Vite.ts";
+import {
+  bindWorkerAsyncBindings,
+  getCronBindings,
+} from "./WorkerAsyncBindings.ts";
+import type {
+  WorkerBinding,
+  WorkerBindingResource,
+  WorkerBindings,
+  WorkerSettingsBinding,
+} from "./WorkerBinding.ts";
+import { WorkerBundle } from "./WorkerBundle.ts";
+import { createWorkerName } from "./WorkerName.ts";
+import {
+  makeWorkerRuntimeContext,
+  type WorkerRuntimeContext,
+} from "./WorkerRuntimeContext.ts";
+
+export const WorkerTypeId = "Cloudflare.Worker";
+export type WorkerTypeId = typeof WorkerTypeId;
+
+export const isWorker = <T>(value: T): value is T & Worker =>
+  typeof value === "object" &&
+  value !== null &&
+  "Type" in value &&
+  value.Type === WorkerTypeId;
+
+export class WorkerEnvironment extends Context.Service<
+  WorkerEnvironment,
+  Record<string, any>
+>()("Cloudflare.Workers.WorkerEnvironment") {}
+
+export class WorkerExecutionContext extends Context.Service<
+  WorkerExecutionContext,
+  cf.ExecutionContext
+>()("Cloudflare.Workers.WorkerExecutionContext") {}
+
+export type WorkerEvent = Exclude<
+  {
+    [type in keyof cf.ExportedHandler]: {
+      kind: "Cloudflare.Workers.WorkerEvent";
+      type: type;
+      input: Parameters<Exclude<cf.ExportedHandler[type], undefined>>[0];
+      env: Parameters<Exclude<cf.ExportedHandler[type], undefined>>[1];
+      context: Parameters<Exclude<cf.ExportedHandler[type], undefined>>[2];
+    };
+  }[keyof cf.ExportedHandler],
+  undefined
+>;
+
+export const isWorkerEvent = (value: any): value is WorkerEvent =>
+  value?.kind === "Cloudflare.Workers.WorkerEvent";
+
+/**
+ * Assets configuration that includes a pre-computed hash.
+ * When hash is provided, it's used directly for diffing instead of computing from directory contents.
+ * This is useful when integrating with Build resources that produce a deterministic hash.
+ */
+export interface AssetsWithHash {
+  /**
+   * Path to the assets directory.
+   */
+  path: string;
+  /**
+   * Pre-computed hash of the assets. When provided, this hash is used for diffing
+   * to determine if the worker needs to be redeployed.
+   */
+  hash: string;
+  /**
+   * Optional assets configuration.
+   */
+  config?: AssetsConfig;
+}
+
+export interface WorkerObservability extends Exclude<
+  workers.PutScriptRequest["metadata"]["observability"],
+  undefined
+> {}
+
+export interface WorkerLimits extends Exclude<
+  workers.PutScriptRequest["metadata"]["limits"],
+  undefined
+> {}
+
+export type WorkerPlacement = Exclude<
+  workers.PutScriptRequest["metadata"]["placement"],
+  undefined
+>;
+
+export const ExportedHandlerMethods = [
+  "fetch",
+  "tail",
+  "trace",
+  "tailStream",
+  "scheduled",
+  "test",
+  "email",
+  "queue",
+] as const satisfies (keyof cf.ExportedHandler)[];
+
+export type WorkerServices =
+  | Worker
+  | Request
+  | WorkerExecutionContext
+  | WorkerEnvironment;
+
+export type WorkerShape = Main<WorkerServices>;
+
+export type WorkerEnv = Record<
+  string,
+  | string
+  | number
+  | boolean
+  | null
+  | readonly unknown[]
+  | { readonly [key: string]: unknown }
+  | Redacted.Redacted<string>
+>;
+
+export type WorkerBindingProps = {
+  [bindingName in string]:
+    | WorkerBindingResource
+    | Effect.Effect<WorkerBindingResource, any, any>;
+};
+
+type NormalizedBindings<
+  Bindings extends WorkerBindingProps = {},
+  AssetsConfig extends WorkerAssetsConfig | undefined = undefined,
+> = {
+  [B in keyof Bindings]: Bindings[B] extends Effect.Effect<
+    infer T extends WorkerBindingResource,
+    any,
+    any
+  >
+    ? T extends Redacted.Redacted<infer T> | Config.Config<infer T>
+      ? T
+      : T
+    : Extract<Bindings[B], WorkerBindingResource>;
+} & (undefined extends AssetsConfig ? {} : { ASSETS: Assets });
+
+export type WorkerAssetsConfig = string | AssetsProps | AssetsWithHash;
+
+export interface WorkerProps<
+  Bindings extends WorkerBindingProps = any,
+  Assets extends WorkerAssetsConfig | undefined =
+    | WorkerAssetsConfig
+    | undefined,
+> extends PlatformProps {
+  /**
+   * Worker name override. If omitted, Alchemy derives a deterministic physical
+   * name from the stack, stage, and logical ID.
+   */
+  name?: string;
+  /**
+   * Whether to enable a workers.dev URL for this worker
+   * @default true
+   */
+  url?: boolean;
+  /**
+   * Static assets to serve. Can be:
+   * - A string path to the assets directory
+   * - An AssetsProps object with directory and config
+   * - An object with path and hash (e.g., from a Build resource)
+   */
+  assets?: Assets;
+  subdomain?: {
+    enabled?: boolean;
+    previewsEnabled?: boolean;
+  };
+  /** @internal used by Cloudflare.Vite resource */
+  vite?: {
+    rootDir?: string;
+    memo?: MemoOptions;
+  };
+  logpush?: boolean;
+  /**
+   * Cloudflare Workers Observability settings. Controls Workers Logs
+   * (`logs`) and Workers Traces (`traces`), each with their own
+   * `enabled`, `headSamplingRate`, and `persist` toggles.
+   *
+   * If omitted, defaults to `{ enabled: true, logs: { enabled: true,
+   * invocationLogs: true } }`. Traces are off by default — opt in via
+   * `traces: { enabled: true, ... }`.
+   */
+  observability?: WorkerObservability;
+  tags?: string[];
+  /**
+   * Path to the Worker's entry module. Bundled with rolldown before
+   * upload. Mutually exclusive with {@link script} — provide exactly one.
+   */
+  main?: string;
+  /**
+   * Raw module source for the Worker. When provided, bundling is bypassed
+   * entirely and this string is uploaded as a single ESM module
+   * (`main.js`). Useful for tiny inline workers (tests, fixtures,
+   * one-offs) and any case where you've already produced the final
+   * bundle elsewhere. Mutually exclusive with {@link main}.
+   */
+  script?: string;
+  compatibility?: {
+    date?: string;
+    flags?: ("nodejs_compat" | "nodejs_als" | (string & {}))[];
+  };
+  limits?: WorkerLimits;
+  placement?: WorkerPlacement;
+  exports?: string[];
+  /**
+   * Environment variables and native Cloudflare Bindings to bind to
+   * the Worker. Accepts:
+   *
+   * - Resource references (R2 bucket, KV namespace, D1 database,
+   *   another Worker, Durable Object, etc.) — emitted as the
+   *   corresponding native binding.
+   * - `effect/Config` values (`Config.redacted`, `Config.string`,
+   *   `Config.number`, …) — resolved at deploy time and bound as
+   *   `secret_text` on Cloudflare regardless of the `Config`
+   *   constructor used. See
+   *   {@link https://v2.alchemy.run/concepts/secrets | Concepts › Secrets and Variables}.
+   * - Literal values — routed by shape: `Redacted<string>` →
+   *   `secret_text`, `string` → `plain_text`, anything else → `json`.
+   *
+   * In Effect-native Workers you can alternatively `yield*` a
+   * `Config` in the Init phase to register the binding implicitly;
+   * `env` is the only option for async (non-Effect) Workers.
+   */
+  env?: Bindings;
+  /**
+   * Cron expressions that trigger the Worker's scheduled handler.
+   *
+   * Pass an empty array to remove all Cron Triggers.
+   */
+  crons?: string[];
+  /**
+   * One or more custom hostnames (e.g. `"app.example.com"`) to bind to this
+   * Worker. The Cloudflare Zone is inferred from the hostname — the zone must
+   * already exist in the account.
+   */
+  domain?: string | string[];
+  /**
+   * Extra bundler options applied on top of the standard rolldown input/output
+   * options used to build this Worker. See {@link Bundle.BundleExtraOptions}.
+   */
+  build?: Bundle.BundleExtraOptions;
+  /**
+   * Options for the local dev server that runs this Worker under `alchemy dev`.
+   * Each Worker is served on its own port.
+   */
+  dev?: {
+    /**
+     * Host the local dev server binds to.
+     * @default "localhost"
+     */
+    host?: string;
+    /**
+     * Port the local dev server listens on. If the port is unavailable, the
+     * next free port is used unless {@link strictPort} is `true`.
+     * @default 1337
+     */
+    port?: number;
+    /**
+     * When `true`, fail instead of falling back to another port if {@link port}
+     * is already in use.
+     * @default false
+     */
+    strictPort?: boolean;
+  };
+}
+
+export type Worker<Bindings extends WorkerBindings = any> = Resource<
+  WorkerTypeId,
+  WorkerProps<Bindings>,
+  {
+    workerId: string;
+    workerName: string;
+    logpush: boolean | undefined;
+    url: string | undefined;
+    tags: string[] | undefined;
+    durableObjectNamespaces: Record<string, string>;
+    accountId: string;
+    domains: string[];
+    crons: string[];
+    hash?: {
+      assets: string | undefined;
+      bundle: string | undefined;
+      input: string | undefined;
+    };
+  },
+  {
+    bindings?: WorkerBinding[];
+    containers?: { className: string }[];
+    crons?: string[];
+    hyperdrives?: Record<string, Required<HyperdriveDevOrigin>>;
+  },
+  Providers
+>;
+
+/**
+ * A Cloudflare Worker host with deploy-time binding support and runtime export
+ * collection.
+ *
+ * A Worker follows a two-phase pattern. The outer `Effect.gen` runs at
+ * deploy time to bind resources (KV, R2, Durable Objects, etc.). It returns
+ * an object whose properties are the Worker's runtime handlers — `fetch` for
+ * HTTP requests and any additional RPC methods.
+ *
+ * ```typescript
+ * Effect.gen(function* () {
+ *   // Phase 1: bind resources (runs at deploy time)
+ *   const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *   return {
+ *     // Phase 2: runtime handlers (runs on each request)
+ *     fetch: Effect.gen(function* () {
+ *       const value = yield* kv.get("key");
+ *       return HttpServerResponse.text(value ?? "not found");
+ *     }),
+ *   };
+ * })
+ * ```
+ *
+ * There are three ways to define a Worker, from simplest to most
+ * flexible. See the {@link https://alchemy.run/concepts/platform | Platform concept}
+ * page for the full explanation.
+ *
+ * - **Async** — plain `async fetch` handler, no Effect runtime in the bundle.
+ * - **Effect** — Effect implementation passed directly, single file.
+ * - **Layer** — class and `.make()` in a single file; Rolldown tree-shakes `.make()` from consumers.
+ *
+ * @section Async Workers
+ * You don't have to use Effect for your runtime code. If you create
+ * a Worker resource with `main` pointing at a file but provide no
+ * `Effect.gen` implementation, Alchemy bundles and deploys that file
+ * as-is. Your handler is a plain `async fetch` — no Effect runtime
+ * is included in the bundle.
+ *
+ * Use the `env` prop to declare which resources, `Config` values,
+ * and literal env vars are available at runtime, and
+ * `Cloudflare.InferEnv` to extract a fully typed `env` object from
+ * them.
+ *
+ * See the {@link https://alchemy.run/guides/async-worker | Async Workers Guide}
+ * for a comprehensive walkthrough of all binding types (R2, D1,
+ * Durable Objects, Assets, and more).
+ *
+ * @example Defining an async Worker in your stack
+ * ```typescript
+ * // alchemy.run.ts
+ * const db = yield* Cloudflare.D1Database("DB");
+ * const bucket = yield* Cloudflare.R2Bucket("Bucket");
+ *
+ * export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+ *
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   env: { db, bucket },
+ * });
+ * ```
+ *
+ * @example Writing the async handler
+ * ```typescript
+ * // src/worker.ts
+ * import type { WorkerEnv } from "../alchemy.run.ts";
+ *
+ * export default {
+ *   async fetch(request: Request, env: WorkerEnv) {
+ *     if (request.method === "GET") {
+ *       const object = await env.bucket.get("key");
+ *       return new Response(object?.body ?? null);
+ *     }
+ *     return new Response("Not Found", { status: 404 });
+ *   },
+ * };
+ * ```
+ *
+ * @section Effect Workers
+ * Pass the Effect implementation as the third argument. This is the
+ * simplest Effect-based approach — everything lives in one file.
+ * Convenient for standalone Workers that don't need to be referenced
+ * by other Workers.
+ *
+ * @example Worker Effect
+ * ```typescript
+ * export default class MyWorker extends Cloudflare.Worker<MyWorker>()(
+ *   "MyWorker",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *     return {
+ *       // runtime: use them
+ *       fetch: Effect.gen(function* () {
+ *         const value = yield* kv.get("key");
+ *         return HttpServerResponse.text(value ?? "not found");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Worker Layer
+ * When two Workers need to reference each other (e.g. WorkerA calls
+ * WorkerB and vice versa), or you simply want optimal tree-shaking,
+ * define the Worker class separately from its `.make()` call. The
+ * class is a lightweight identifier; `.make()` provides the runtime
+ * implementation as an `export default`. Rolldown treats `.make()`
+ * as pure, so any Worker that imports the class to bind it will not
+ * pull in the `.make()` dependencies — the bundler tree-shakes
+ * them away entirely.
+ *
+ * The class and `.make()` can live in the same file. This is the
+ * same pattern used by `Container` and `DurableObjectNamespace`,
+ * and is recommended for any cross-Worker or cross-DO bindings.
+ *
+ * @example Worker Layer (class + .make() in one file)
+ * ```typescript
+ * // src/WorkerB.ts
+ * export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+ *   "WorkerB",
+ *   { main: import.meta.filename },
+ * ) {}
+ *
+ * export default WorkerB.make(
+ *   Effect.gen(function* () {
+ *     // init: bind resources
+ *     const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ *     return {
+ *       // runtime: use them
+ *       greet: (name: string) =>
+ *         Effect.gen(function* () {
+ *           yield* kv.put("last-greeted", name);
+ *           return `Hello ${name}`;
+ *         }),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
+ * @example Binding a Worker Layer from another Worker
+ * ```typescript
+ * // src/WorkerA.ts — imports WorkerB; bundler tree-shakes .make()
+ * import WorkerB from "./WorkerB.ts";
+ *
+ * export default class WorkerA extends Cloudflare.Worker<WorkerA>()(
+ *   "WorkerA",
+ *   { main: import.meta.filename },
+ *   Effect.gen(function* () {
+ *     const b = yield* Cloudflare.Worker.bind(WorkerB);
+ *     return {
+ *       fetch: Effect.gen(function* () {
+ *         return yield* b.greet("world");
+ *       }),
+ *     };
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Configuration
+ * The props object controls compatibility flags, static assets, and
+ * build options. These are evaluated at deploy time.
+ *
+ * @example Enabling Node.js compatibility
+ * ```typescript
+ * {
+ *   main: import.meta.filename,
+ *   compatibility: {
+ *     flags: ["nodejs_compat"],
+ *     date: "2026-03-17",
+ *   },
+ * }
+ * ```
+ *
+ * @example Serving static assets
+ * ```typescript
+ * {
+ *   main: import.meta.filename,
+ *   assets: "./public",
+ * }
+ * ```
+ *
+ * @section Observability
+ * Cloudflare Workers Observability is on by default — `logs.enabled` and
+ * `logs.invocationLogs` are turned on if you don't pass an `observability`
+ * prop. Pass the prop yourself to tune sampling, enable persistence, or
+ * turn on the new `traces` channel (the same toggle the dashboard's
+ * Observability tab writes).
+ *
+ * Field names match the Cloudflare API (camelCased): `headSamplingRate`,
+ * `invocationLogs`, etc.
+ *
+ * @example Enabling logs and traces
+ * ```typescript
+ * {
+ *   main: import.meta.filename,
+ *   observability: {
+ *     enabled: true,
+ *     headSamplingRate: 1,
+ *     logs: {
+ *       enabled: true,
+ *       invocationLogs: true,
+ *       headSamplingRate: 1,
+ *       persist: true,
+ *     },
+ *     traces: {
+ *       enabled: true,
+ *       headSamplingRate: 1,
+ *       persist: true,
+ *     },
+ *   },
+ * }
+ * ```
+ *
+ * @section R2 Bucket
+ * Bind an R2 bucket in the init phase with `Cloudflare.R2Bucket.bind`.
+ * The returned handle exposes `get`, `put`, `delete`, and `list`
+ * methods you can call in your runtime handlers.
+ *
+ * @example Binding and using R2
+ * ```typescript
+ * // init
+ * const bucket = yield* Cloudflare.R2Bucket.bind(MyBucket);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const request = yield* HttpServerRequest;
+ *     const key = request.url.split("/").pop()!;
+ *
+ *     if (request.method === "GET") {
+ *       const object = yield* bucket.get(key);
+ *       return object
+ *         ? HttpServerResponse.text(yield* object.text())
+ *         : HttpServerResponse.empty({ status: 404 });
+ *     }
+ *
+ *     yield* bucket.put(key, request.stream);
+ *     return HttpServerResponse.empty({ status: 201 });
+ *   }),
+ * };
+ * ```
+ *
+ * @section KV Namespace
+ * Bind a KV namespace with `Cloudflare.KVNamespace.bind`. KV provides
+ * eventually-consistent, low-latency key-value reads replicated
+ * globally across Cloudflare's edge.
+ *
+ * @example Binding and using KV
+ * ```typescript
+ * // init
+ * const kv = yield* Cloudflare.KVNamespace.bind(MyKV);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const value = yield* kv.get("my-key");
+ *     return HttpServerResponse.text(value ?? "not found");
+ *   }),
+ * };
+ * ```
+ *
+ * @section D1 Database
+ * Bind a D1 database with `Cloudflare.D1Connection.bind`. D1 is a
+ * serverless SQLite database — use `prepare` to build parameterized
+ * queries and `all`, `first`, or `run` to execute them.
+ *
+ * @example Binding and querying D1
+ * ```typescript
+ * // init
+ * const db = yield* Cloudflare.D1Connection.bind(MyDB);
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const results = yield* db
+ *       .prepare("SELECT * FROM users WHERE id = ?")
+ *       .bind(userId)
+ *       .all();
+ *     return yield* HttpServerResponse.json(results);
+ *   }),
+ * };
+ * ```
+ *
+ * @section Durable Objects
+ * Yield a `DurableObjectNamespace` class in the init phase to get a
+ * namespace handle. Call `getByName` or `getById` to get a typed RPC
+ * stub, then call its methods from your runtime handlers.
+ *
+ * @example Using a Durable Object
+ * ```typescript
+ * // init
+ * const counters = yield* Counter;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const counter = counters.getByName("user-123");
+ *     const value = yield* counter.increment();
+ *     return HttpServerResponse.text(String(value));
+ *   }),
+ * };
+ * ```
+ *
+ * @section Containers
+ * Containers run long-lived processes alongside Durable Objects. Bind
+ * one with `Cloudflare.Container.bind` and start it with
+ * `Cloudflare.start`. You can call typed methods on the running
+ * container or make HTTP requests to its exposed ports.
+ *
+ * @example Binding and starting a Container
+ * ```typescript
+ * // init (inside a DurableObjectNamespace)
+ * const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+ *
+ * return Effect.gen(function* () {
+ *   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+ *
+ *   return {
+ *     exec: (cmd: string) => container.exec(cmd),
+ *     fetch: Effect.gen(function* () {
+ *       const { fetch } = yield* container.getTcpPort(3000);
+ *       const res = yield* fetch(HttpClientRequest.get("http://container/"));
+ *       return HttpServerResponse.fromClientResponse(res);
+ *     }),
+ *   };
+ * });
+ * ```
+ *
+ * @section Dynamic Workers
+ * `DynamicWorkerLoader` lets you spin up ephemeral Workers at runtime
+ * from inline JavaScript modules. This is useful for sandboxing
+ * user-provided code or running untrusted scripts in isolation.
+ *
+ * @example Loading a dynamic Worker
+ * ```typescript
+ * // init
+ * const loader = yield* Cloudflare.DynamicWorkerLoader("Loader");
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const worker = loader.load({
+ *       compatibilityDate: "2026-01-28",
+ *       mainModule: "worker.js",
+ *       modules: {
+ *         "worker.js": `export default {
+ *           async fetch(req) { return new Response("sandboxed"); }
+ *         }`,
+ *       },
+ *     });
+ *
+ *     const res = yield* worker.fetch(
+ *       HttpClientRequest.get("https://worker/"),
+ *     );
+ *     return HttpServerResponse.fromClientResponse(res);
+ *   }),
+ * };
+ * ```
+ */
+export const Worker: Platform<
+  Worker,
+  WorkerServices,
+  WorkerShape,
+  WorkerRuntimeContext
+> & {
+  <
+    const Bindings extends WorkerBindingProps = {},
+    const Assets extends WorkerAssetsConfig | undefined = undefined,
+    Req = never,
+  >(
+    id: string,
+    props:
+      | InputProps<WorkerProps<Bindings, Assets>>
+      | Effect.Effect<InputProps<WorkerProps<Bindings, Assets>>, never, Req>,
+  ): Effect.Effect<
+    Worker<{
+      [binding in keyof NormalizedBindings<
+        Bindings,
+        Assets
+      >]: NormalizedBindings<Bindings, Assets>[binding];
+    }>,
+    never,
+    Req | Providers
+  >;
+} = Platform(WorkerTypeId, {
+  // Both hooks are wrapped in arrows so the imported references are resolved
+  // at call time rather than at module-load time. Worker.ts forms import
+  // cycles with both WorkerAsyncBindings.ts (which imports `isWorker` here)
+  // and WorkerRuntimeContext.ts (which imports `WorkerTypeId`/`WorkerEnvironment`
+  // here). Reading either binding eagerly here hits TDZ when Bun loads the
+  // package from node_modules in a different module-init order than the local
+  // workspace.
+  onCreate: (resource, props) =>
+    bindWorkerAsyncBindings(resource as Worker, props),
+  createRuntimeContext: (id) => makeWorkerRuntimeContext(id),
+});
+
+class MissingDurableObjectNamespaces extends Data.TaggedError(
+  "MissingDurableObjectNamespaces",
+)<{
+  scriptName: string;
+  expected: string[];
+}> {}
+
+const selectLayer = <
+  LayerLive extends Layer.Layer<any, any, any>,
+  LayerDev extends Layer.Layer<any, any, any>,
+>(input: {
+  live: () => LayerLive;
+  dev: () => LayerDev;
+}): Layer.Layer<
+  Layer.Success<LayerLive | LayerDev>,
+  Layer.Error<LayerLive | LayerDev>,
+  Layer.Services<LayerLive | LayerDev> | AlchemyContext
+> =>
+  Layer.unwrap(
+    AlchemyContext.useSync((context) =>
+      context.dev ? input.dev() : input.live(),
+    ),
+  );
+
+export const WorkerProvider = () =>
+  selectLayer({
+    live: LiveWorkerProvider,
+    dev: () => Layer.provide(LocalWorkerProvider(), localRuntimeServices()),
+  });
+
+export const LiveWorkerProvider = () =>
+  Provider.effect(
+    Worker,
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+
+      const { accountId } = yield* CloudflareEnvironment;
+      const bundler = yield* WorkerBundle;
+      const stack = yield* Stack;
+
+      const createScriptSubdomain = yield* workers.createScriptSubdomain;
+      const deleteScript = yield* workers.deleteScript;
+      const getScriptSubdomain = yield* workers.getScriptSubdomain;
+      const getScriptSchedule = yield* workers.getScriptSchedule;
+      const getScriptSettings = yield* workers.getScriptScriptAndVersionSetting;
+      const getSubdomain = yield* workers.getSubdomain;
+      const putScript = yield* workers.putScript;
+      const putScriptSchedule = yield* workers.putScriptSchedule;
+      const putDomain = yield* workers.putDomain;
+      const listDomains = yield* workers.listDomains;
+      const deleteDomain = yield* workers.deleteDomain;
+      const listZones = yield* zones.listZones;
+      const telemetry = yield* CloudflareLogs;
+
+      const getAccountSubdomain = (accountId: string) =>
+        getSubdomain({
+          accountId,
+        }).pipe(Effect.map((result) => result.subdomain));
+
+      // Toggle the workers.dev subdomain via `POST /subdomain` with
+      // `enabled: true | false`. Mirrors the upstream Alchemy
+      // implementation in `.vendor/alchemy/.../worker-subdomain.ts`.
+      // When enabling we also set `previewsEnabled: true` so the
+      // script is reachable both at its stable workers.dev URL and at
+      // version-preview URLs; on disable we send just `enabled: false`.
+      const setWorkerSubdomain = (name: string, enabled: boolean) =>
+        createScriptSubdomain({
+          accountId,
+          scriptName: name,
+          enabled,
+          previewsEnabled: enabled ? true : undefined,
+        });
+
+      // Convert non-ASCII hostnames (emoji, IDN, etc.) to punycode so the
+      // Cloudflare API receives the form it stores domains in. `new URL(...)`
+      // does IDNA via WHATWG URL parsing — `📦.alchemy.run` → `xn--5z8h.alchemy.run`.
+      const toPunycode = (hostname: string): string => {
+        try {
+          return new URL(`https://${hostname}`).hostname;
+        } catch {
+          return hostname;
+        }
+      };
+
+      const normalizeDomains = (
+        domain: string | string[] | undefined,
+      ): string[] =>
+        domain === undefined
+          ? []
+          : Array.from(
+              new Set(
+                (Array.isArray(domain) ? domain : [domain]).map(toPunycode),
+              ),
+            );
+
+      const normalizeCrons = (crons: string[] | undefined): string[] =>
+        Array.from(new Set(crons ?? []));
+
+      const getWorkerCrons = (scriptName: string) =>
+        getScriptSchedule({
+          accountId,
+          scriptName,
+        }).pipe(
+          Effect.map((response) =>
+            normalizeCrons(response.schedules.map((schedule) => schedule.cron)),
+          ),
+          Effect.catchTag("WorkerNotFound", () => Effect.succeed([])),
+        );
+
+      const reconcileCrons = (
+        scriptName: string,
+        desired: string[],
+        previous: string[],
+        session: ScopedPlanStatusSession,
+      ) =>
+        Effect.gen(function* () {
+          const live = yield* getWorkerCrons(scriptName);
+          const desiredSorted = [...desired].sort();
+          const liveSorted = [...live].sort();
+          const changed =
+            desiredSorted.length !== liveSorted.length ||
+            desiredSorted.some((cron, index) => cron !== liveSorted[index]);
+
+          if (!changed) return live;
+
+          if (desired.length > 0 || previous.length > 0 || live.length > 0) {
+            yield* session.note(
+              `Reconciling Cron Triggers (${desired.length}) ...`,
+            );
+          }
+
+          const result = yield* putScriptSchedule({
+            accountId,
+            scriptName,
+            body: desired.map((cron) => ({ cron })),
+          }).pipe(
+            Effect.retry({
+              while: (error: { _tag?: string }) =>
+                error?._tag === "WorkerNotFound",
+              schedule: Schedule.exponential(200).pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
+          );
+          return normalizeCrons(
+            result.schedules.map((schedule) => schedule.cron),
+          );
+        });
+
+      /**
+       * Infer the Cloudflare Zone ID for a given hostname by listing the
+       * account's zones and matching the hostname against each zone's name —
+       * walking up the DNS label hierarchy until a match is found.
+       */
+      const inferZoneIdForHostname = (
+        hostname: string,
+        zoneCache: Map<string, string>,
+      ) =>
+        Effect.gen(function* () {
+          const cached = zoneCache.get(hostname);
+          if (cached) return cached;
+
+          const zoneList = yield* listZones({}).pipe(
+            Effect.map((response) => response.result ?? []),
+          );
+          for (const zone of zoneList) {
+            zoneCache.set(zone.name, zone.id);
+          }
+
+          const parts = hostname.split(".");
+          for (let i = 0; i < parts.length - 1; i++) {
+            const candidate = parts.slice(i).join(".");
+            const match = zoneList.find((z) => z.name === candidate);
+            if (match) {
+              zoneCache.set(hostname, match.id);
+              return match.id;
+            }
+          }
+          return yield* Effect.die(
+            `Could not infer Cloudflare Zone for hostname "${hostname}". ` +
+              "Ensure the parent zone exists in this account.",
+          );
+        });
+
+      const reconcileDomains = (scriptName: string, desired: string[]) =>
+        Effect.gen(function* () {
+          // Always query the live state of domains attached to *this*
+          // Worker rather than trusting `_previous` from local state.
+          // State may have been wiped, populated by another machine, or
+          // simply be out of date. Without this we PUT domains that are
+          // already registered to this same Worker and Cloudflare
+          // returns a confusing "hostname already in use" error.
+          const liveAll = yield* listDomains({
+            accountId,
+            service: scriptName,
+          }).pipe(
+            Effect.map((r) =>
+              (r.result ?? []).flatMap((d) =>
+                d.id && d.hostname && d.zoneId
+                  ? [
+                      {
+                        id: d.id,
+                        hostname: d.hostname,
+                        zoneId: d.zoneId,
+                        service: d.service ?? undefined,
+                      },
+                    ]
+                  : [],
+              ),
+            ),
+            Effect.catch(() => Effect.succeed([])),
+          );
+
+          const desiredSet = new Set(desired);
+          const liveByHostname = new Map(liveAll.map((d) => [d.hostname, d]));
+
+          // Detach what's no longer wanted. Use the live list so we
+          // don't try to delete domains we no longer track.
+          const toRemove = liveAll.filter((d) => !desiredSet.has(d.hostname));
+          yield* Effect.all(
+            toRemove.map((d) =>
+              deleteDomain({ accountId, domainId: d.id }).pipe(
+                Effect.catchTag("DomainNotFound", () => Effect.void),
+              ),
+            ),
+            { concurrency: "unbounded" },
+          );
+
+          if (desired.length === 0) return [];
+
+          const zoneCache = new Map<string, string>();
+
+          // Attach `hostname` to this Worker. Skip the PUT entirely if
+          // the hostname is already attached to *this* Worker — that's a
+          // no-op for Cloudflare and avoids the "already in use" 409.
+          // If it's attached to a *different* Worker, refuse with a
+          // clear message rather than silently re-routing traffic.
+          const attachDomain = Effect.fnUntraced(function* (hostname: string) {
+            const live = liveByHostname.get(hostname);
+            if (live) {
+              return {
+                hostname: live.hostname,
+                id: live.id,
+                zoneId: live.zoneId,
+              };
+            }
+
+            // Not attached to this Worker — but it could still belong
+            // to another Worker. Check before we try to PUT so we can
+            // emit a helpful error instead of the raw 409.
+            const otherOwner = yield* listDomains({
+              accountId,
+              hostname,
+            }).pipe(
+              Effect.map((r) =>
+                (r.result ?? []).find(
+                  (d) => d.hostname === hostname && d.service !== scriptName,
+                ),
+              ),
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+            if (otherOwner?.id) {
+              return yield* Effect.die(
+                new Error(
+                  `Cannot attach hostname '${hostname}' to Worker '${scriptName}': ` +
+                    `it is already attached to Worker '${otherOwner.service ?? "<unknown>"}'. ` +
+                    `Detach it from that Worker first, or pick a different hostname.`,
+                ),
+              );
+            }
+
+            const zoneId = yield* inferZoneIdForHostname(hostname, zoneCache);
+            // Same eventual-consistency window as `setWorkerSubdomain`:
+            // PUT /accounts/.../workers/domains right after `putScript`
+            // can return `WorkerNotFound` until Cloudflare's script
+            // registry has propagated. Retry on that specific tag.
+            const res = yield* putDomain({
+              accountId,
+              hostname,
+              service: scriptName,
+              zoneId,
+            }).pipe(
+              Effect.retry({
+                while: (error: { _tag?: string }) =>
+                  error?._tag === "WorkerNotFound",
+                schedule: Schedule.exponential(200).pipe(
+                  Schedule.both(Schedule.recurs(15)),
+                ),
+              }),
+            );
+            return {
+              hostname,
+              id: res.id ?? "",
+              zoneId: res.zoneId ?? zoneId,
+            };
+          });
+
+          const applied = yield* Effect.all(desired.map(attachDomain), {
+            concurrency: "unbounded",
+          });
+          return applied;
+        });
+
+      const createAlchemyWorkerTags = (id: string) => [
+        `alchemy:stack:${stack.name}`,
+        `alchemy:stage:${stack.stage}`,
+        `alchemy:id:${id}`,
+      ];
+
+      const hasAlchemyWorkerTags = (
+        id: string,
+        tags: readonly string[] | undefined,
+      ) => {
+        const actualTags = new Set(tags ?? []);
+        return createAlchemyWorkerTags(id).every((tag) => actualTags.has(tag));
+      };
+
+      const getDurableObjectNamespaces = (
+        bindings: readonly WorkerSettingsBinding[] | null | undefined,
+      ) => {
+        const namespaces = Object.fromEntries(
+          (bindings ?? []).flatMap((binding) =>
+            binding.type === "durable_object_namespace" &&
+            binding.className &&
+            binding.namespaceId
+              ? [[binding.className, binding.namespaceId]]
+              : [],
+          ),
+        );
+        return namespaces;
+      };
+
+      const getExpectedDurableObjectClassNames = (
+        bindings: readonly WorkerBinding[] | undefined,
+        workerName: string,
+      ) =>
+        Array.from(
+          new Set(
+            bindings?.flatMap((binding) =>
+              binding.type === "durable_object_namespace" &&
+              binding.className &&
+              (binding.scriptName === undefined ||
+                binding.scriptName === workerName)
+                ? [binding.className]
+                : [],
+            ) ?? [],
+          ),
+        );
+
+      const getWorkerSettingsWithDurableObjects = Effect.fnUntraced(function* (
+        scriptName: string,
+        expectedClassNames: readonly string[],
+      ) {
+        return yield* getScriptSettings({
+          accountId,
+          scriptName,
+        }).pipe(
+          Effect.map((settings) => {
+            const namespaces = getDurableObjectNamespaces(settings.bindings);
+            const missing = expectedClassNames.filter(
+              (className) => !namespaces[className],
+            );
+            if (missing.length > 0) {
+              return Effect.fail(
+                new MissingDurableObjectNamespaces({
+                  scriptName,
+                  expected: missing,
+                }),
+              );
+            }
+            return Effect.succeed({
+              settings,
+              durableObjectNamespaces: namespaces,
+            });
+          }),
+          Effect.flatten,
+          Effect.retry({
+            while: (error) => error._tag === "MissingDurableObjectNamespaces",
+            schedule: Schedule.exponential(100).pipe(
+              Schedule.both(Schedule.recurs(20)),
+            ),
+          }),
+        );
+      });
+
+      const prepareAssets = Effect.fnUntraced(function* (
+        assets: WorkerProps["assets"],
+      ) {
+        if (!assets) {
+          return undefined;
+        }
+
+        if (
+          typeof assets === "object" &&
+          "path" in assets &&
+          "hash" in assets
+        ) {
+          return yield* readAssets({
+            directory: assets.path as string,
+            config: assets.config,
+          });
+        }
+
+        // Handle string path or AssetsProps
+        return yield* readAssets(
+          typeof assets === "string" ? { directory: assets } : assets,
+        );
+      });
+
+      const prepareBundle = (id: string, props: WorkerProps) =>
+        bundler
+          .build({
+            id,
+            main: props.main!,
+            compatibility: getCompatibility(props),
+            entry: props.isExternal
+              ? {
+                  kind: "external",
+                }
+              : {
+                  kind: "effect",
+                  exports: (props.exports ?? {}) as any,
+                },
+            stack: { name: stack.name, stage: stack.stage },
+            extraOptions: props.build,
+          })
+          .pipe(Artifacts.cached("build"));
+
+      const hashScript = (script: string) =>
+        Effect.sync(() =>
+          crypto.createHash("sha256").update(script).digest("hex"),
+        );
+
+      const viteBuild = Effect.fnUntraced(function* (props: WorkerProps) {
+        const compatibility = getCompatibility(props);
+        const { assetsDirectory, serverBundle } = yield* Vite.viteBuild(
+          props.vite?.rootDir,
+          Object.fromEntries(
+            (yield* Effect.all(
+              Object.entries(props.env ?? {}).map(
+                Effect.fnUntraced(function* ([key, value]) {
+                  return [
+                    key,
+                    typeof value === "string"
+                      ? value
+                      : Redacted.isRedacted(value) &&
+                          typeof Redacted.value(value) === "string"
+                        ? Redacted.value(value)
+                        : Config.isConfig(value) || Effect.isEffect(value)
+                          ? yield* value
+                          : undefined,
+                  ];
+                }),
+              ),
+            )).filter(([_, value]) => value !== undefined),
+          ),
+          {
+            compatibilityDate: compatibility.date,
+            compatibilityFlags: compatibility.flags,
+          },
+        );
+
+        if (!assetsDirectory && !serverBundle) {
+          return yield* Effect.die(
+            new Error("Vite build produced neither server nor client output"),
+          );
+        }
+        const [assets, bundle] = yield* Effect.all(
+          [
+            assetsDirectory
+              ? readAssets({
+                  directory: assetsDirectory,
+                  config:
+                    typeof props.assets === "object" && "config" in props.assets
+                      ? props.assets.config
+                      : undefined,
+                })
+              : Effect.succeed(undefined),
+            serverBundle
+              ? Bundle.bundleOutputFromRolldownOutputBundle(serverBundle)
+              : Effect.succeed(undefined),
+          ],
+          { concurrency: "unbounded" },
+        );
+        return { assets, bundle };
+      });
+
+      const prepareAssetsAndBundle = (
+        id: string,
+        props: WorkerProps,
+        opts: { skipAssetsRead?: boolean } = {},
+      ) =>
+        Effect.gen(function* () {
+          if (props.script !== undefined) {
+            const [assets, bundleHash] = yield* Effect.all(
+              [
+                opts.skipAssetsRead
+                  ? Effect.succeed(undefined)
+                  : prepareAssets(props.assets),
+                hashScript(props.script),
+              ],
+              { concurrency: "unbounded" },
+            );
+            return {
+              assets,
+              bundle: {
+                files: [{ path: "main.js", content: props.script }],
+                hash: bundleHash,
+              },
+            };
+          }
+          if (props.vite) {
+            const [{ assets, bundle }, input] = yield* Effect.all(
+              [
+                viteBuild(props),
+                // hashDirectory expects `{ cwd, memo }`. The vite props
+                // store the project root under `rootDir`, so map it
+                // here. Without this, `cwd` falls back to
+                // `process.cwd()` and the input hash is computed over
+                // the wrong directory tree (often the entire monorepo
+                // root), making it both slow and unable to detect
+                // changes scoped to the actual Vite project.
+                hashDirectory({
+                  cwd: props.vite.rootDir,
+                  memo: props.vite.memo,
+                }),
+              ],
+              { concurrency: "unbounded" },
+            );
+            return { assets, bundle, input };
+          }
+          const [assets, bundle] = yield* Effect.all(
+            [
+              opts.skipAssetsRead
+                ? Effect.succeed(undefined)
+                : prepareAssets(props.assets),
+              prepareBundle(id, props),
+            ],
+            { concurrency: "unbounded" },
+          );
+          return { assets, bundle };
+        }).pipe(
+          Effect.map(({ assets, bundle, input }) => ({
+            assets,
+            bundle: {
+              main: bundle?.files[0].path,
+              files: bundle?.files.map(
+                (file) =>
+                  new File([file.content as BlobPart], file.path, {
+                    type: contentTypeFromExtension(path.extname(file.path)),
+                  }),
+              ),
+            },
+            hash: {
+              assets: assets?.hash,
+              bundle: bundle?.hash,
+              input,
+            } satisfies Worker["Attributes"]["hash"],
+          })),
+        );
+
+      const putWorker = Effect.fnUntraced(function* (
+        id: string,
+        news: WorkerProps,
+        bindings: ResourceBinding<Worker["Binding"]>[],
+        olds: WorkerProps | undefined,
+        output: Worker["Attributes"] | undefined,
+        session: ScopedPlanStatusSession,
+        existingSettings?: workers.GetScriptScriptAndVersionSettingResponse,
+      ) {
+        const name = yield* createWorkerName(id, news.name);
+        yield* Effect.logInfo(
+          `Cloudflare Worker ${olds ? "update" : "create"}: preparing bundle for ${name}`,
+        );
+        // If the caller handed us a precomputed asset hash that matches
+        // what we previously stored, we can skip walking the directory
+        // entirely and tell Cloudflare to keep the assets it already
+        // has bound to this script. The disk read is the expensive
+        // part; the script PUT happens either way.
+        const previousAssetsHash = output?.hash?.assets;
+        const precomputedAssetsHash =
+          news.assets &&
+          typeof news.assets === "object" &&
+          "path" in news.assets &&
+          "hash" in news.assets
+            ? (news.assets.hash as string)
+            : undefined;
+        const assetsConfigFromProps =
+          news.assets &&
+          typeof news.assets === "object" &&
+          "config" in news.assets
+            ? news.assets.config
+            : undefined;
+        const skipAssetsRead =
+          precomputedAssetsHash !== undefined &&
+          precomputedAssetsHash === previousAssetsHash;
+        const {
+          assets,
+          bundle,
+          hash: preparedHash,
+        } = yield* prepareAssetsAndBundle(id, news, { skipAssetsRead });
+        // When the caller supplied a precomputed hash (e.g. via
+        // `Build.Command`), store *that* hash in output state so the
+        // next diff can short-circuit by comparing it directly. The
+        // hash that `readAssets` produces is the manifest-derived
+        // hash, which is shaped differently from any upstream
+        // build-input hash and will never match it on the next pass.
+        const hash = {
+          ...preparedHash,
+          assets: precomputedAssetsHash ?? preparedHash.assets,
+        } satisfies Worker["Attributes"]["hash"];
+        const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
+        const expectedDurableObjectClassNames =
+          getExpectedDurableObjectClassNames(metadataBindings, name);
+        let metadataAssets:
+          | workers.PutScriptRequest["metadata"]["assets"]
+          | undefined;
+        let keepAssets = false;
+        if (skipAssetsRead) {
+          // Hash matched what's already on Cloudflare: keep the
+          // existing asset manifest and skip the upload session.
+          yield* Effect.logInfo(
+            `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
+          );
+          keepAssets = true;
+          metadataAssets = assetsConfigFromProps
+            ? { config: assetsConfigFromProps }
+            : undefined;
+          metadataBindings.push({
+            type: "assets",
+            name: "ASSETS",
+          });
+        } else if (assets) {
+          // We had to read the directory. Even after the read, the
+          // computed hash may match what's already deployed (e.g.
+          // legacy `string` / `AssetsProps` shapes that don't carry a
+          // precomputed hash, or a precomputed hash that disagreed with
+          // disk). In that case still keep the existing manifest and
+          // skip the upload session — Cloudflare's content-addressed
+          // session would no-op on every byte anyway.
+          if (assets.hash === previousAssetsHash) {
+            yield* Effect.logInfo(
+              `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
+            );
+            keepAssets = true;
+            metadataAssets = { config: assets.config };
+          } else {
+            yield* Effect.logInfo(
+              `Cloudflare Worker ${olds ? "update" : "create"}: uploading assets for ${name}`,
+            );
+            const { jwt } = yield* uploadAssets(
+              accountId,
+              name,
+              assets,
+              session,
+            );
+            metadataAssets = {
+              jwt,
+              config: assets.config,
+            };
+          }
+          metadataBindings.push({
+            type: "assets",
+            name: "ASSETS",
+          });
+        }
+        metadataBindings.push(
+          {
+            type: "plain_text",
+            name: "ALCHEMY_PHASE",
+            text: "runtime",
+          },
+          {
+            type: "plain_text",
+            name: "ALCHEMY_STACK_NAME",
+            text: stack.name,
+          },
+          {
+            type: "plain_text",
+            name: "ALCHEMY_STAGE",
+            text: stack.stage,
+          },
+        );
+        // Add environment variables as metadata bindings
+        if (news.env) {
+          for (const [key, value] of Object.entries(news.env)) {
+            if (value === undefined) continue;
+            if (metadataBindings.some((b) => b.name === key)) continue;
+            if (Redacted.isRedacted(value)) {
+              const unredacted = Redacted.value(value);
+              metadataBindings.push({
+                type: "secret_text",
+                name: key,
+                text:
+                  typeof unredacted === "string"
+                    ? unredacted
+                    : JSON.stringify(unredacted),
+              });
+            } else if (typeof value === "string") {
+              metadataBindings.push({
+                type: "plain_text",
+                name: key,
+                text: value,
+              });
+            } else {
+              metadataBindings.push({
+                type: "json",
+                name: key,
+                json: value,
+              });
+            }
+          }
+        }
+        yield* Effect.logInfo(
+          `Cloudflare Worker ${olds ? "update" : "create"}: uploading script for ${name}`,
+        );
+        const size =
+          bundle.files
+            ?.filter((file) => !file.name.endsWith(".map"))
+            .reduce((acc, file) => acc + file.size, 0) ?? 0;
+        const sizeKB = size / 1024;
+        const sizeMB = sizeKB / 1024;
+        const bundleSize = `${sizeKB > 1024 ? `${sizeMB.toFixed(2)} MB` : `${sizeKB.toFixed(2)} KB`}`;
+        yield* session.note(`Uploading worker (${bundleSize}) ...`);
+
+        // Read existing worker settings for migration tracking
+        const oldSettings =
+          existingSettings ??
+          (yield* getScriptSettings({
+            accountId,
+            scriptName: name,
+          }).pipe(
+            Effect.map((s) => s as typeof s | undefined),
+            Effect.catch(() => Effect.succeed(undefined)),
+          ));
+
+        const oldTags = Array.from(new Set(oldSettings?.tags ?? []));
+        const oldBindings = oldSettings?.bindings ?? [];
+
+        // Parse alchemy:do:{logicalId}:{className} tags
+        const oldDoClassNameByLogicalId = getDurableObjectTagMap(oldTags);
+        const currentDoBindings = getDurableObjectBindings(bindings, name);
+        const currentDoClassNameByLogicalId = Object.fromEntries(
+          currentDoBindings.map((binding) => [
+            binding.logicalId,
+            binding.className,
+          ]),
+        );
+
+        // Parse alchemy:migration-tag:{version}
+        const oldMigrationTag = oldTags.flatMap((tag) =>
+          tag.startsWith("alchemy:migration-tag:")
+            ? [tag.slice("alchemy:migration-tag:".length)]
+            : [],
+        )[0];
+        const newMigrationTag = bumpMigrationTagVersion(oldMigrationTag);
+
+        // Compute deleted classes
+        const deletedClasses: string[] = [];
+        for (const [logicalId, className] of Object.entries(
+          oldDoClassNameByLogicalId,
+        )) {
+          if (!currentDoClassNameByLogicalId[logicalId]) {
+            deletedClasses.push(className);
+          }
+        }
+
+        // Backward compatibility for old workers that have DO bindings but no
+        // alchemy:do tags yet. Cross-script bindings (`scriptName` set to
+        // anything other than this worker) are NEVER candidates for
+        // delete-class migrations — the class lives on the foreign script
+        // and we don't own its lifecycle.
+        if (Object.keys(oldDoClassNameByLogicalId).length === 0) {
+          for (const oldBinding of oldBindings) {
+            const ownedLocally =
+              !("scriptName" in oldBinding) || oldBinding.scriptName === name;
+            if (
+              oldBinding.type === "durable_object_namespace" &&
+              "className" in oldBinding &&
+              oldBinding.className &&
+              ownedLocally &&
+              !currentDoBindings.some(
+                (binding) => binding.bindingName === oldBinding.name,
+              )
+            ) {
+              deletedClasses.push(oldBinding.className);
+            }
+          }
+        }
+
+        // Collect container-backed class names so we can send container metadata
+        const containerClassNames = new Set(
+          bindings.flatMap((b) =>
+            (b.data.containers ?? []).map((c) => c.className),
+          ),
+        );
+
+        // Compute new and renamed classes
+        const newClasses: string[] = [];
+        const newSqliteClasses: string[] = [];
+        const renamedClasses: { from: string; to: string }[] = [];
+        for (const binding of currentDoBindings) {
+          const previousClassName =
+            oldDoClassNameByLogicalId[binding.logicalId];
+          if (!previousClassName) {
+            // Default all new Durable Object classes to SQLite. Cloudflare
+            // recommends SQLite for new namespaces, and container-backed
+            // Durable Objects require it.
+            newSqliteClasses.push(binding.className);
+          } else if (previousClassName !== binding.className) {
+            renamedClasses.push({
+              from: previousClassName,
+              to: binding.className,
+            });
+          }
+        }
+
+        yield* Effect.logInfo(
+          `Cloudflare Worker put: durable object reconciliation ${JSON.stringify(
+            {
+              oldDoClassNameByLogicalId,
+              currentDoClassNameByLogicalId,
+              deletedClasses,
+              renamedClasses,
+              newSqliteClasses,
+            },
+          )}`,
+        );
+
+        // Build alchemy:do:{logicalId}:{className} tags for each DO binding
+        const alchemyDoTags: string[] = [];
+        for (const binding of currentDoBindings) {
+          alchemyDoTags.push(
+            `alchemy:do:${binding.logicalId}:${binding.className}`,
+          );
+        }
+
+        const metadataTags = Array.from(
+          new Set([
+            ...createAlchemyWorkerTags(id),
+            ...alchemyDoTags,
+            ...(newMigrationTag
+              ? [`alchemy:migration-tag:${newMigrationTag}`]
+              : []),
+            ...(news.tags ?? []),
+          ]),
+        );
+
+        const migrations = {
+          oldTag: oldMigrationTag,
+          newTag: newMigrationTag,
+          newClasses,
+          deletedClasses,
+          renamedClasses,
+          transferredClasses: [] as { from: string; to: string }[],
+          newSqliteClasses,
+        };
+
+        const metadataContainers = [...containerClassNames].map(
+          (className) => ({
+            className,
+          }),
+        );
+
+        const compatibility = getCompatibility(news);
+        const metadata: workers.PutScriptRequest["metadata"] = {
+          assets: metadataAssets,
+          bindings: metadataBindings,
+          bodyPart: undefined,
+          compatibilityDate: compatibility.date,
+          compatibilityFlags: compatibility.flags,
+          containers:
+            metadataContainers.length > 0 ? metadataContainers : undefined,
+          keepAssets,
+          keepBindings: undefined,
+          limits: news.limits,
+          logpush: news.logpush,
+          mainModule: bundle.main,
+          migrations,
+          observability: news.observability ?? {
+            enabled: true,
+            logs: {
+              enabled: true,
+              invocationLogs: true,
+            },
+          },
+          placement: news.placement,
+          tags: metadataTags,
+          tailConsumers: undefined,
+          usageModel: undefined,
+        };
+        const worker = yield* putScript({
+          accountId,
+          scriptName: name,
+          metadata,
+          files: bundle.files,
+        }).pipe(
+          Effect.catch((err) => {
+            // When adopting a Worker managed by Wrangler (or after a previous
+            // deploy with mismatched migrations), the old_tag precondition
+            // fails. The only way to discover the actual tag is through the
+            // error message — getScriptSettings is meant to return it but
+            // doesn't at runtime.
+            const msg = String(
+              typeof err === "object" && err !== null && "message" in err
+                ? err.message
+                : err,
+            );
+            const expectedTag = msg.match(
+              /when expected tag is ['"]?([^'"]+)['"]?/,
+            )?.[1];
+            if (expectedTag) {
+              return putScript({
+                accountId,
+                scriptName: name,
+                metadata: {
+                  ...metadata,
+                  migrations: {
+                    ...migrations,
+                    oldTag: expectedTag,
+                    newTag: bumpMigrationTagVersion(expectedTag),
+                  },
+                },
+                files: bundle.files,
+              });
+            }
+            return Effect.fail(err as any);
+          }),
+        );
+        const { settings, durableObjectNamespaces } =
+          yield* getWorkerSettingsWithDurableObjects(
+            name,
+            expectedDurableObjectClassNames,
+          );
+        // Reconcile workers.dev subdomain against observed cloud state.
+        // We can't diff `news.url` against `olds.url` here because both
+        // default to `undefined` (meaning "enable") — that comparison
+        // would skip the API call on every deploy where the user never
+        // explicitly set `url`, leaving the subdomain in whatever state
+        // Cloudflare currently has it (disabled by default, or whatever
+        // a previous failed/external action left it as).
+        const desiredSubdomainEnabled = news.url !== false;
+        const observedSubdomain = yield* getScriptSubdomain({
+          accountId,
+          scriptName: name,
+        }).pipe(
+          Effect.orElseSucceed<workers.GetScriptSubdomainResponse>(() => ({
+            enabled: false,
+            previewsEnabled: false,
+          })),
+        );
+        if (
+          desiredSubdomainEnabled !== observedSubdomain.enabled ||
+          desiredSubdomainEnabled !== observedSubdomain.previewsEnabled
+        ) {
+          yield* session.note(
+            `${desiredSubdomainEnabled ? "Enabling" : "Disabling"} workers.dev subdomain...`,
+          );
+          // Cloudflare's script registry is eventually consistent — for the
+          // first few hundred ms after `putScript` returns, POST /subdomain
+          // can still get back `WorkerNotFound` (a generic "unknown error"
+          // body), or a bare 500 surfaced as `InternalServerError` /
+          // `UnknownCloudflareError` (code 10013). Bigger uploads race harder.
+          // Retry the subdomain toggle on those transient tags with a short
+          // exponential backoff; same pattern we use elsewhere in this
+          // provider for DO-namespace propagation and for `putScript` itself.
+          yield* setWorkerSubdomain(name, desiredSubdomainEnabled).pipe(
+            Effect.retry({
+              while: (error: { _tag?: string }) =>
+                error?._tag === "WorkerNotFound" ||
+                error?._tag === "InternalServerError" ||
+                error?._tag === "UnknownCloudflareError",
+              schedule: Schedule.exponential(200).pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
+          );
+        }
+        const desiredDomains = normalizeDomains(news.domain);
+        const previousDomains = output?.domains ?? [];
+        if (desiredDomains.length > 0 || previousDomains.length > 0) {
+          yield* session.note(
+            `Reconciling custom domains (${desiredDomains.length}) ...`,
+          );
+        }
+        const reconciled = yield* reconcileDomains(name, desiredDomains);
+        const workersDevUrl =
+          news.url !== false
+            ? `https://${name}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+            : undefined;
+        const domains = [
+          ...reconciled.map((d) => `https://${d.hostname}`),
+          ...(workersDevUrl ? [workersDevUrl] : []),
+        ];
+        const crons = yield* reconcileCrons(
+          name,
+          normalizeCrons([...getCronBindings(bindings), ...(news.crons ?? [])]),
+          output?.crons ?? [],
+          session,
+        );
+        return {
+          workerId: worker.id ?? name,
+          workerName: name,
+          logpush: worker.logpush ?? undefined,
+          url: domains[0],
+          tags: settings.tags ?? metadata.tags,
+          durableObjectNamespaces,
+          accountId,
+          domains,
+          crons,
+          hash,
+        } satisfies Worker["Attributes"];
+      });
+
+      const hasChanged = Effect.fnUntraced(function* (
+        id: string,
+        props: WorkerProps,
+        output: Worker["Attributes"],
+      ) {
+        if (props.script !== undefined) {
+          const scriptHash = yield* hashScript(props.script);
+          if (scriptHash !== output.hash?.bundle) {
+            return true;
+          }
+          if (!props.assets) {
+            return false;
+          }
+          const assetsHash =
+            typeof props.assets === "object" &&
+            "path" in props.assets &&
+            "hash" in props.assets
+              ? (props.assets.hash as string)
+              : undefined;
+          if (assetsHash === undefined) {
+            return true;
+          }
+          return assetsHash !== output.hash?.assets;
+        }
+        if (props.vite) {
+          const input = yield* hashDirectory({
+            cwd: props.vite.rootDir,
+            memo: props.vite.memo,
+          });
+          return input !== output.hash?.input;
+        }
+        const bundleHash = yield* prepareBundle(id, props).pipe(
+          Effect.map((b) => b.hash),
+        );
+        if (bundleHash !== output.hash?.bundle) {
+          return true;
+        }
+        if (!props.assets) {
+          return false;
+        }
+        // We deliberately don't read the assets directory during diff.
+        // For `AssetsWithHash` (the documented contract) the upstream
+        // `Build.Command` already gave us an authoritative hash — we
+        // just compare strings. Reading the directory here would
+        // (a) hash the same tree twice per apply (`putWorker` reads
+        // again when an upload is actually required), and (b) crash
+        // when the prior state was written on a different machine
+        // and `path` doesn't exist locally — blocking any local
+        // reapply even though the precomputed hash is right there
+        // in props.
+        //
+        // For the legacy `string` / `AssetsProps` shapes there's no
+        // hash in props to compare against, so we conservatively
+        // assume the assets changed; `putWorker` will read once,
+        // hash, and use `keepAssets` if it turns out nothing actually
+        // changed.
+        const assetsHash =
+          typeof props.assets === "object" &&
+          "path" in props.assets &&
+          "hash" in props.assets
+            ? (props.assets.hash as string)
+            : undefined;
+        if (assetsHash === undefined) {
+          return true;
+        }
+        return assetsHash !== output.hash?.assets;
+      });
+
+      return Worker.Provider.of({
+        stables: ["workerId", "workerName"],
+        diff: Effect.fnUntraced(function* ({
+          id,
+          news,
+          olds,
+          output,
+          newBindings,
+        }) {
+          if (!isResolved(news)) return undefined;
+          if ((output?.accountId ?? accountId) !== accountId) {
+            return { action: "replace" };
+          }
+          const workerName = yield* createWorkerName(id, news.name);
+          const oldWorkerName = output?.workerName
+            ? output.workerName
+            : yield* createWorkerName(id, olds?.name);
+          if (workerName !== oldWorkerName) {
+            return { action: "replace" };
+          }
+          if (!output) {
+            return;
+          }
+          const newDomains = normalizeDomains(news.domain)
+            .map((h) => `https://${h}`)
+            .sort();
+          const oldDomains = (output?.domains ?? [])
+            .filter((u) => !u.endsWith(".workers.dev"))
+            .sort();
+          const domainsChanged =
+            newDomains.length !== oldDomains.length ||
+            newDomains.some((d, i) => d !== oldDomains[i]);
+          const newCrons = normalizeCrons([
+            ...(Array.isArray(newBindings)
+              ? getCronBindings(
+                  newBindings as ResourceBinding<Worker["Binding"]>[],
+                )
+              : []),
+            ...(news.crons ?? []),
+          ]).sort();
+          const oldCrons = [...(output?.crons ?? [])].sort();
+          const cronsChanged =
+            newCrons.length !== oldCrons.length ||
+            newCrons.some((cron, index) => cron !== oldCrons[index]);
+          if (
+            domainsChanged ||
+            cronsChanged ||
+            (yield* hasChanged(id, news, output))
+          ) {
+            return {
+              action: "update",
+              stables:
+                oldWorkerName === workerName ? ["workerName"] : undefined,
+            };
+          }
+        }),
+        precreate: Effect.fnUntraced(function* ({ id, news, session }) {
+          const name = yield* createWorkerName(id, news.name);
+          const exportMap = (news.exports ?? {}) as Record<string, unknown>;
+          const durableObjects = Object.keys(exportMap)
+            .filter((logicalId) => isDurableObjectExport(exportMap[logicalId]))
+            .map((logicalId) => ({
+              logicalId,
+              className: logicalId,
+            }));
+          const doClasses = durableObjects.map((binding) => binding.className);
+          const containers = doClasses.map((className) => ({ className }));
+          const alchemyDoTags = durableObjects.map(
+            ({ logicalId, className }) =>
+              `alchemy:do:${logicalId}:${className}`,
+          );
+          const tags = Array.from(
+            new Set([
+              ...createAlchemyWorkerTags(id),
+              ...alchemyDoTags,
+              ...(news.tags ?? []),
+            ]),
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker precreate: starting ${name}`,
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker precreate: durable objects ${JSON.stringify(
+              durableObjects,
+            )}`,
+          );
+          const existingSettings = yield* getScriptSettings({
+            accountId,
+            scriptName: name,
+          }).pipe(
+            Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
+          );
+          let durableObjectNamespaces = getDurableObjectNamespaces(
+            existingSettings?.bindings,
+          );
+
+          if (existingSettings) {
+            // Engine has already cleared this resource for write via
+            // `read` + AdoptPolicy. Either we own it (matching tags) or
+            // the user opted in to a takeover (`--adopt` / `adopt(true)`).
+            yield* Effect.logInfo(
+              `Cloudflare Worker precreate: reusing existing ${name}`,
+            );
+          } else {
+            yield* session.note("Pre-creating worker...");
+            const mainModule = "main.js";
+            const placeholderScript = `${doClasses.length > 0 ? 'import { DurableObject } from "cloudflare:workers";\n\n' : ""}export default { fetch() { return new Response("Alchemy worker is being deployed...") } };\n${doClasses
+              .map(
+                (className) =>
+                  `export class ${className} extends DurableObject {}`,
+              )
+              .join("\n")}`;
+            yield* putScript({
+              accountId,
+              scriptName: name,
+              metadata: {
+                mainModule,
+                bindings:
+                  doClasses.length > 0
+                    ? doClasses.map((className) => ({
+                        type: "durable_object_namespace" as const,
+                        name: className,
+                        className,
+                      }))
+                    : undefined,
+                ...getCompatibility(news),
+                containers,
+                migrations:
+                  doClasses.length > 0
+                    ? {
+                        oldTag: undefined,
+                        newTag: undefined,
+                        newClasses: [],
+                        deletedClasses: [],
+                        renamedClasses: [],
+                        transferredClasses: [],
+                        newSqliteClasses: doClasses,
+                      }
+                    : undefined,
+                observability: news.observability ?? {
+                  enabled: true,
+                  logs: {
+                    enabled: true,
+                    invocationLogs: true,
+                  },
+                },
+                tags,
+              },
+              files: [
+                new File([placeholderScript], mainModule, {
+                  type: "application/javascript+module",
+                }),
+              ],
+            }).pipe(
+              // Cloudflare's PUT /workers/scripts/{name} intermittently
+              // returns code 10002 / "An unknown error has occurred" on the
+              // first put for a fresh worker name. Surfaced as the shared
+              // `InternalServerError` upstream (alchemy-run/distilled#290).
+              // Also match `UnknownCloudflareError` for older
+              // @distilled.cloud/cloudflare versions that haven't picked
+              // up the patch yet.
+              Effect.retry({
+                while: (e: any) =>
+                  e._tag === "InternalServerError" ||
+                  e._tag === "UnknownCloudflareError",
+                schedule: Schedule.exponential(1000).pipe(
+                  Schedule.both(Schedule.recurs(5)),
+                ),
+              }),
+            );
+            if (doClasses.length > 0) {
+              ({ durableObjectNamespaces } =
+                yield* getWorkerSettingsWithDurableObjects(name, doClasses));
+            }
+          }
+
+          if (existingSettings && doClasses.length > 0) {
+            ({ durableObjectNamespaces } =
+              yield* getWorkerSettingsWithDurableObjects(name, doClasses));
+          }
+
+          return {
+            workerId: name,
+            workerName: name,
+            logpush: existingSettings?.logpush ?? undefined,
+            url: undefined,
+            tags: existingSettings?.tags ?? tags,
+            durableObjectNamespaces,
+            accountId,
+            domains: [],
+            crons: [],
+          } satisfies Worker["Attributes"];
+        }),
+        read: Effect.fnUntraced(
+          function* ({ id, output, olds }) {
+            const workerName =
+              output?.workerName ?? (yield* createWorkerName(id, olds?.name));
+            yield* Effect.logInfo(
+              `Cloudflare Worker read: checking ${workerName}`,
+            );
+            // We deliberately don't call `listScripts({ accountId })` here:
+            // it pulls every Worker on the account back through a strict
+            // schema decode, and a single existing Worker the schema doesn't
+            // know about (e.g. `placement_mode: "targeted"`) breaks the
+            // entire read. `getScriptSettings` already fails with
+            // `WorkerNotFound` if the script doesn't exist, which the
+            // surrounding `Effect.catchTag` turns into `undefined` — that's
+            // all the existence check we need.
+            const [subdomain, settings, domainsList] = yield* Effect.all([
+              getScriptSubdomain({
+                accountId,
+                scriptName: workerName,
+              }),
+              getScriptSettings({
+                accountId,
+                scriptName: workerName,
+              }),
+              listDomains({
+                accountId,
+                service: workerName,
+              }).pipe(Effect.map((r) => r.result ?? [])),
+            ]);
+            // Preserve the order the user provided in `olds.domain`. The
+            // Cloudflare API returns domains in non-deterministic order,
+            // which would cause downstream `worker.domains[0]` reads to flip
+            // between deploys. Drift (domains we don't know about) is
+            // appended after the user-ordered ones.
+            const userOrder = normalizeDomains(olds?.domain);
+            const orderedHostnames = [
+              ...userOrder.flatMap(
+                (h) =>
+                  domainsList.find((d) => d.hostname === h)?.hostname ?? [],
+              ),
+              ...domainsList.flatMap((d) =>
+                d.hostname && !userOrder.includes(d.hostname)
+                  ? [d.hostname]
+                  : [],
+              ),
+            ];
+            const workersDevUrl = subdomain.enabled
+              ? `https://${workerName}.${yield* getAccountSubdomain(accountId)}.workers.dev`
+              : undefined;
+            const domains = [
+              ...orderedHostnames.map((h) => `https://${h}`),
+              ...(workersDevUrl ? [workersDevUrl] : []),
+            ];
+            const crons = yield* getWorkerCrons(workerName);
+            yield* Effect.logInfo(
+              `Cloudflare Worker read: found ${workerName}`,
+            );
+            const attrs = {
+              accountId,
+              workerId: workerName,
+              workerName,
+              logpush: settings.logpush ?? undefined,
+              url: domains[0],
+              tags: settings.tags ?? undefined,
+              durableObjectNamespaces: getDurableObjectNamespaces(
+                settings.bindings,
+              ),
+              domains,
+              crons,
+            } satisfies Worker["Attributes"];
+
+            // Centralized ownership decision: the engine routes `read`'s
+            // return value based on `AdoptPolicy`. We hand it the attrs
+            // either as-is (owned: alchemy tags identify this stack/stage/id,
+            // safe to silently adopt even without `--adopt`) or branded with
+            // `Unowned` (caller must opt in via `--adopt` or the engine
+            // raises `OwnedBySomeoneElse`).
+            return hasAlchemyWorkerTags(id, settings.tags ?? [])
+              ? attrs
+              : Unowned(attrs);
+          },
+          (effect) =>
+            effect.pipe(
+              Effect.catchTag("WorkerNotFound", () =>
+                Effect.succeed(undefined),
+              ),
+            ),
+        ),
+        reconcile: Effect.fnUntraced(function* ({
+          id,
+          news,
+          olds,
+          bindings,
+          output,
+          session,
+        }) {
+          const name =
+            output?.workerName ?? (yield* createWorkerName(id, news.name));
+          const durableObjects = getDurableObjectBindings(bindings, name).map(
+            ({ logicalId, className }) => ({
+              logicalId,
+              className,
+            }),
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: starting ${name}`,
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: durable objects ${JSON.stringify(
+              durableObjects,
+            )}`,
+          );
+
+          // Observe — fetch the script's current settings if it already exists.
+          // `putWorker` is a true upsert against the Cloudflare API; the
+          // existing settings inform asset/migration decisions and let the
+          // reconciler converge whether the worker is brand-new, adopted, or
+          // an in-place update.
+          const existingSettings = yield* getScriptSettings({
+            accountId,
+            scriptName: name,
+          }).pipe(
+            Effect.catchTag("WorkerNotFound", () => Effect.succeed(undefined)),
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: existing durable object tags ${JSON.stringify(
+              (existingSettings?.tags ?? []).filter((tag) =>
+                tag.startsWith("alchemy:do:"),
+              ),
+            )}`,
+          );
+          yield* Effect.logInfo(
+            `Cloudflare Worker reconcile: previous durable object tags ${JSON.stringify(
+              (output?.tags ?? []).filter((tag) =>
+                tag.startsWith("alchemy:do:"),
+              ),
+            )}`,
+          );
+          return yield* putWorker(
+            id,
+            news,
+            bindings,
+            olds,
+            output,
+            session,
+            existingSettings,
+          );
+        }),
+        delete: Effect.fnUntraced(function* ({ output }) {
+          yield* Effect.logInfo(
+            `Cloudflare Worker delete: deleting ${output.workerName}`,
+          );
+          // Look up live domain IDs rather than trusting persisted state.
+          // We no longer track `{ id, zoneId }` on the output; fetching
+          // straight from Cloudflare handles both the normal case and
+          // adopted workers whose domains we never recorded.
+          const liveDomains = yield* listDomains({
+            accountId: output.accountId,
+            service: output.workerName,
+          }).pipe(
+            Effect.map((r) => r.result ?? []),
+            Effect.catch(() => Effect.succeed([])),
+          );
+          if (liveDomains.length) {
+            yield* Effect.all(
+              liveDomains.flatMap((d) =>
+                d.id
+                  ? [
+                      deleteDomain({
+                        accountId: output.accountId,
+                        domainId: d.id,
+                      }).pipe(
+                        Effect.catchTag("DomainNotFound", () => Effect.void),
+                      ),
+                    ]
+                  : [],
+              ),
+              { concurrency: "unbounded" },
+            );
+          }
+          yield* deleteScript({
+            accountId: output.accountId,
+            scriptName: output.workerName,
+            // Force teardown of queue consumers, durable object classes, and
+            // service bindings hanging off this worker. Without `force`, those
+            // conditions raise QueueConsumerConflict / ServiceBindingConflict
+            // and leave the script in CF. Alchemy is the source of truth for
+            // the worker, so we want a hard delete on teardown.
+            force: true,
+          }).pipe(Effect.catchTag("WorkerNotFound", () => Effect.void));
+        }),
+        tail: ({ output }) =>
+          telemetry.tailScript({
+            accountId: output.accountId,
+            scriptName: output.workerName,
+          }),
+        logs: ({ output, options }) =>
+          telemetry.queryLogs({
+            accountId: output.accountId,
+            filters: [
+              {
+                key: "$workers.scriptName",
+                operation: "eq",
+                type: "string",
+                value: output.workerName,
+              },
+            ],
+            options,
+          }),
+      });
+    }),
+  );
+
+const contentTypeFromExtension = (extension: string) => {
+  switch (extension) {
+    case ".wasm":
+      return "application/wasm";
+    case ".txt":
+    case ".html":
+    case ".sql":
+    case ".custom":
+      return "text/plain";
+    case ".bin":
+      return "application/octet-stream";
+    case ".mjs":
+    case ".js":
+      return "application/javascript+module";
+    case ".cjs":
+      return "application/javascript";
+    case ".map":
+      return "application/source-map";
+    default:
+      return "application/octet-stream";
+  }
+};
+
+function bumpMigrationTagVersion(
+  oldTag: string | undefined,
+): string | undefined {
+  if (!oldTag) return undefined;
+  const version = oldTag.match(/^(alchemy:)?v(\d+)$/)?.[2];
+  if (!version) return "alchemy:v1";
+  return `alchemy:v${parseInt(version, 10) + 1}`;
+}
+
+function getDurableObjectBindings(
+  bindings: ReadonlyArray<ResourceBinding>,
+  workerName: string,
+) {
+  // Resource authors (and the `make`/`yield* Tag`/plan-vs-apply machinery)
+  // can register the same DO binding multiple times under the same logical
+  // id — `binding()` is a plain `worker.bind` and intentionally has no
+  // dedup. Collapse duplicates here so each `(logicalId, bindingName,
+  // className)` tuple appears at most once. We also exclude cross-script
+  // references: a `scriptName` pointing to *another* worker means this
+  // worker just references a foreign class — ship the binding to
+  // Cloudflare, but don't drive class migrations for it.
+  const seen = new Set<string>();
+  return bindings.flatMap((binding) =>
+    (binding.data.bindings ?? []).flatMap((item: WorkerBinding) => {
+      if (
+        item.type !== "durable_object_namespace" ||
+        !("className" in item) ||
+        !item.className
+      ) {
+        return [];
+      }
+      if (item.scriptName !== undefined && item.scriptName !== workerName) {
+        return [];
+      }
+      const dedupKey = `${binding.sid}::${item.name}::${item.className}`;
+      if (seen.has(dedupKey)) return [];
+      seen.add(dedupKey);
+      return [
+        {
+          logicalId: binding.sid,
+          bindingName: item.name,
+          className: item.className,
+        },
+      ];
+    }),
+  );
+}
+
+function getDurableObjectTagMap(tags: ReadonlyArray<string>) {
+  return Object.fromEntries(
+    tags.flatMap((tag) => {
+      if (!tag.startsWith("alchemy:do:")) {
+        return [];
+      }
+      const parts = tag.split(":");
+      const logicalId = parts[2];
+      const className = parts.slice(3).join(":");
+      return logicalId && className ? [[logicalId, className]] : [];
+    }),
+  );
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerAsyncBindings.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerAsyncBindings.ts
new file mode 100644
index 00000000000..0e2ed554e02
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerAsyncBindings.ts
@@ -0,0 +1,225 @@
+import type { PutScriptRequest } from "@distilled.cloud/cloudflare/workers";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { InputProps } from "../../Input.ts";
+import * as Output from "../../Output.ts";
+import type { ResourceBinding } from "../../Resource.ts";
+import { isYieldableEffectLike } from "../../Util/effect.ts";
+import { asEffect } from "../../Util/types.ts";
+import { isAiGateway } from "../AiGateway/AiGateway.ts";
+import { isAnalyticsEngineDataset } from "../AnalyticsEngine/AnalyticsEngineDataset.ts";
+import { isArtifacts } from "../Artifacts/Artifacts.ts";
+import { isBrowser } from "../Browser/Browser.ts";
+import { isD1Database } from "../D1/D1Database.ts";
+import { isSendEmail } from "../Email/SendEmail.ts";
+import { isHyperdrive } from "../Hyperdrive/Hyperdrive.ts";
+import { getHyperdriveDevOrigin } from "../Hyperdrive/HyperdriveBinding.ts";
+import { isImages } from "../Images/Images.ts";
+import { isKVNamespace } from "../KV/KVNamespace.ts";
+import { isQueue } from "../Queue/Queue.ts";
+import { isR2Bucket } from "../R2/R2Bucket.ts";
+import { isRateLimit } from "../RateLimit/RateLimit.ts";
+import { isVectorizeIndex } from "../Vectorize/VectorizeIndex.ts";
+import { isAssets } from "./Assets.ts";
+import { isDurableObjectNamespaceLike } from "./DurableObjectNamespace.ts";
+import { isDynamicWorkerLoader } from "./DynamicWorkerLoader.ts";
+import type { WorkerBindingProps } from "./Worker.ts";
+import { isWorker, type Worker, type WorkerProps } from "./Worker.ts";
+import type { WorkerBinding, WorkerBindingResource } from "./WorkerBinding.ts";
+
+export const bindWorkerAsyncBindings = Effect.fnUntraced(function* (
+  resource: Worker,
+  props: InputProps<WorkerProps<WorkerBindingProps>>,
+) {
+  if (props.env) {
+    for (const bindingName in props.env) {
+      // @ts-expect-error
+      const bindingEff = props.env?.[bindingName] as
+        | WorkerBindingResource
+        | Effect.Effect<WorkerBindingResource>;
+      // Bindings can be passed as a plain resource value, an Effect that
+      // yields a resource, or an effect-class (e.g. a `Cloudflare.Worker`
+      // class). Resolve the yieldable forms before deriving binding metadata.
+      const binding = isYieldableEffectLike(bindingEff)
+        ? ((yield* bindingEff as Effect.Effect<unknown>) as WorkerBindingResource)
+        : bindingEff;
+
+      const bindingMeta: InputProps<WorkerBinding> | undefined =
+        yield* asEffect(toBinding(bindingName, binding));
+
+      if (bindingMeta) {
+        yield* resource.bind`${bindingName}`({
+          bindings: [bindingMeta],
+          hyperdrives: isHyperdrive(binding)
+            ? getHyperdriveDevOrigin(binding)
+            : undefined,
+        });
+      } else {
+        return yield* Effect.die(`Unknown binding type: ${bindingName}`);
+      }
+    }
+  }
+});
+
+type BindingSpec = InputProps<
+  Exclude<PutScriptRequest["metadata"]["bindings"], undefined>[number]
+>;
+
+const toBinding = (
+  bindingName: string,
+  binding: WorkerBindingResource,
+): BindingSpec | Effect.Effect<BindingSpec> | undefined => {
+  // narrowing to Config<unknown> doesn't work for us, we need any
+  const isConfig: (a: any) => a is Config.Config<any> = Config.isConfig;
+  // narrowing to Redacted<unknown> doesn't work for us, we need any
+  const isRedacted: (a: any) => a is Redacted.Redacted<any> =
+    Redacted.isRedacted;
+
+  if (typeof binding === "string") {
+    return {
+      type: "plain_text",
+      name: bindingName,
+      text: binding,
+    };
+  } else if (isRedacted(binding)) {
+    const val = Redacted.value(binding);
+    if (typeof val === "string") {
+      return {
+        type: "secret_text",
+        name: bindingName,
+        text: val,
+      };
+    } else {
+      return {
+        type: "secret_text",
+        name: bindingName,
+        text: JSON.stringify(val),
+      };
+    }
+  } else if (isConfig(binding)) {
+    return binding.pipe(
+      Effect.flatMap((json) => {
+        const b = toBinding(bindingName, json)!;
+        return Effect.isEffect(b) ? b : Effect.succeed(b);
+      }),
+      Effect.orDie,
+    );
+  } else if (isAssets(binding)) {
+    return {
+      type: "assets",
+      name: bindingName,
+    };
+  } else if (isArtifacts(binding)) {
+    return {
+      type: "artifacts",
+      name: bindingName,
+      namespace: binding.namespace,
+    };
+  } else if (isImages(binding)) {
+    return {
+      type: "images",
+      name: bindingName,
+    };
+  } else if (isBrowser(binding)) {
+    return {
+      type: "browser",
+      name: bindingName,
+    };
+  } else if (isAnalyticsEngineDataset(binding)) {
+    return {
+      type: "analytics_engine",
+      name: bindingName,
+      dataset: binding.dataset,
+    };
+  } else if (isRateLimit(binding)) {
+    return {
+      type: "ratelimit",
+      name: bindingName,
+      namespaceId: binding.namespaceId,
+      simple: binding.simple,
+    };
+  } else if (isSendEmail(binding)) {
+    return {
+      type: "send_email",
+      name: bindingName,
+      destinationAddress: binding.destinationAddress,
+      allowedDestinationAddresses: binding.allowedDestinationAddresses,
+      allowedSenderAddresses: binding.allowedSenderAddresses,
+    };
+  } else if (isDurableObjectNamespaceLike(binding)) {
+    return {
+      type: "durable_object_namespace",
+      name: bindingName,
+      className: binding.className ?? binding.name,
+      scriptName: binding.scriptName,
+    };
+  } else if (isD1Database(binding)) {
+    return {
+      type: "d1",
+      databaseId: binding.databaseId,
+      name: bindingName,
+    };
+  } else if (isR2Bucket(binding)) {
+    return {
+      type: "r2_bucket",
+      name: bindingName,
+      bucketName: binding.bucketName,
+      jurisdiction: binding.jurisdiction.pipe(
+        Output.map((jurisdiction) =>
+          jurisdiction === "default" ? undefined : jurisdiction,
+        ),
+      ),
+    };
+  } else if (isKVNamespace(binding)) {
+    return {
+      type: "kv_namespace",
+      name: bindingName,
+      namespaceId: binding.namespaceId,
+    };
+  } else if (isQueue(binding)) {
+    return {
+      type: "queue",
+      name: bindingName,
+      queueName: binding.queueName,
+    };
+  } else if (isAiGateway(binding)) {
+    return {
+      type: "ai",
+      name: bindingName,
+    };
+  } else if (isHyperdrive(binding)) {
+    return {
+      type: "hyperdrive",
+      name: bindingName,
+      id: binding.hyperdriveId,
+    };
+  } else if (isWorker(binding)) {
+    return {
+      type: "service",
+      name: bindingName,
+      service: binding.workerName,
+    };
+  } else if (isVectorizeIndex(binding)) {
+    return {
+      type: "vectorize",
+      name: bindingName,
+      indexName: binding.indexName,
+    };
+  } else if (isDynamicWorkerLoader(binding)) {
+    return {
+      type: "worker_loader",
+      name: bindingName,
+    } as any;
+  } else {
+    return {
+      type: "json",
+      name: bindingName,
+      json: binding,
+    };
+  }
+};
+
+export const getCronBindings = (
+  bindings: ReadonlyArray<ResourceBinding<Worker["Binding"]>>,
+) => Array.from(new Set(bindings.flatMap((b) => b.data.crons ?? [])));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBinding.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBinding.ts
new file mode 100644
index 00000000000..cd6bdd3ec2e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBinding.ts
@@ -0,0 +1,119 @@
+import type * as workers from "@distilled.cloud/cloudflare/workers";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { Json } from "effect/Schema";
+import * as Binding from "../../Binding.ts";
+import type { Rpc } from "../../Rpc.ts";
+import { isYieldableEffectLike } from "../../Util/effect.ts";
+import type { AiGateway } from "../AiGateway/AiGateway.ts";
+import { AnalyticsEngineDataset } from "../AnalyticsEngine/AnalyticsEngineDataset.ts";
+import { Artifacts } from "../Artifacts/Artifacts.ts";
+import { Browser } from "../Browser/Browser.ts";
+import type { D1Database } from "../D1/D1Database.ts";
+import { SendEmail } from "../Email/SendEmail.ts";
+import { Hyperdrive } from "../Hyperdrive/Hyperdrive.ts";
+import { Images } from "../Images/Images.ts";
+import type { KVNamespace } from "../KV/KVNamespace.ts";
+import type { Queue } from "../Queue/Queue.ts";
+import type { R2Bucket } from "../R2/R2Bucket.ts";
+import type { RateLimit } from "../RateLimit/RateLimit.ts";
+import type { VectorizeIndex } from "../Vectorize/VectorizeIndex.ts";
+import type { Assets } from "./Assets.ts";
+import type { DurableObjectNamespaceLike } from "./DurableObjectNamespace.ts";
+import type { DynamicWorkerLoader } from "./DynamicWorkerLoader.ts";
+import { makeRpcStub } from "./Rpc.ts";
+import { isWorker, Worker, WorkerEnvironment } from "./Worker.ts";
+
+export type WorkerBinding = Exclude<
+  workers.PutScriptRequest["metadata"]["bindings"],
+  undefined
+>[number];
+
+export type WorkerSettingsBinding = Exclude<
+  workers.GetScriptScriptAndVersionSettingResponse["bindings"],
+  null | undefined
+>[number];
+
+export type WorkerBindingResource =
+  // Config values
+  | Json
+  | Redacted.Redacted<Json>
+  | Config.Config<Json>
+  // CF resources
+  | Assets
+  | R2Bucket
+  | D1Database
+  | KVNamespace
+  | Queue
+  | AiGateway
+  | AnalyticsEngineDataset
+  | SendEmail
+  | Artifacts
+  | RateLimit
+  | Browser
+  | Images
+  | Hyperdrive
+  | VectorizeIndex
+  | Worker
+  | DynamicWorkerLoader
+  | DurableObjectNamespaceLike<any>;
+
+export type WorkerBindings = {
+  [bindingName in string]: WorkerBindingResource;
+};
+
+export const bindWorker = Effect.fnUntraced(function* <Shape, Req = never>(
+  workerEff:
+    | (Worker & Rpc<Shape>)
+    | Effect.Effect<Worker & Rpc<Shape>, never, Req>,
+) {
+  // Worker classes and regular Effects are both yieldable here.
+  const worker = isYieldableEffectLike(workerEff)
+    ? yield* workerEff as Effect.Effect<Worker & Rpc<Shape>, never, Req>
+    : workerEff;
+  const self = yield* Worker;
+  yield* self.bind`${worker}`({
+    bindings: [
+      {
+        type: "service",
+        name: worker.LogicalId,
+        service: worker.workerName,
+      },
+    ],
+  });
+
+  // `bindWorker` runs at *init* phase (both at plantime and at runtime
+  // cold-start). `WorkerEnvironment` only exists at exec phase on the
+  // deployed worker, so we hand `makeRpcStub` an `Effect<stub>` that
+  // resolves the binding lazily on each method call.
+  const stubEff = WorkerEnvironment.pipe(
+    Effect.map((env) => (env as Record<string, unknown>)[worker.LogicalId]),
+  );
+  return makeRpcStub<Shape>(stubEff);
+});
+
+export class BindWorkerPolicy extends Binding.Policy<
+  BindWorkerPolicy,
+  (worker: Worker) => Effect.Effect<void>
+>()("Cloudflare.Worker.Bind") {}
+
+export const BindWorkerPolicyLive = BindWorkerPolicy.layer.succeed(
+  Effect.fn(function* (host, worker: Worker) {
+    if (isWorker(host)) {
+      yield* host.bind`${worker}`({
+        bindings: [
+          {
+            type: "service",
+            name: worker.LogicalId,
+            service: worker.workerName,
+          },
+        ],
+      });
+    } else {
+      return yield* Effect.die(
+        new Error(`BindWorkerPolicy does not support runtime '${host.Type}'`),
+      );
+    }
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBridge.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBridge.ts
new file mode 100644
index 00000000000..3390de6b16c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBridge.ts
@@ -0,0 +1,323 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import type { DurableObject, WorkerEntrypoint } from "cloudflare:workers";
+import * as Cause from "effect/Cause";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { pipe } from "effect/Function";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import { MinimumLogLevel } from "effect/References";
+import * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { ExecutionContext } from "../../ExecutionContext.ts";
+import { makeEntrypointLayer } from "../../Runtime.ts";
+import { Self } from "../../Self.ts";
+import { Stack } from "../../Stack.ts";
+import cloudflare_workers from "./cloudflare_workers.ts";
+import { isScopeEjected } from "./HttpServer.ts";
+import {
+  ErrorTag,
+  type RpcErrorEnvelope,
+  type RpcStreamEnvelope,
+  encodeRpcError,
+  toRpcStream,
+} from "./Rpc.ts";
+import {
+  ExportedHandlerMethods,
+  Worker,
+  WorkerEnvironment,
+  WorkerExecutionContext,
+} from "./Worker.ts";
+import type { WorkerRuntimeContext } from "./WorkerRuntimeContext.ts";
+
+/**
+ * Makes the WorkerEntrypoint class and bridges to Effect fetch and RPC calls.
+ */
+export const makeWorkerBridge = (
+  Base: typeof WorkerEntrypoint | typeof DurableObject,
+  {
+    stack,
+    entrypoint,
+  }: {
+    stack: {
+      name: string;
+      stage: string;
+    };
+    entrypoint: any;
+  },
+) => {
+  const { globalContext, exported, shape } = getWorkerExport({
+    entrypoint,
+    stack,
+    exportName: "default",
+  });
+
+  const processEvent = (
+    eff: Effect.Effect<
+      readonly [Effect.Effect<any, any, any>, Context.Context<never>],
+      any,
+      any
+    >,
+    ctx: cf.ExecutionContext,
+  ) => {
+    const scope = Scope.makeUnsafe();
+    return eff
+      .pipe(
+        Effect.flatMap(([eff, context]) =>
+          Effect.provide(
+            eff,
+            pipe(
+              Layer.succeedContext(context),
+              Layer.provideMerge(Layer.succeedContext(context)),
+              Layer.provideMerge(Layer.succeed(WorkerExecutionContext, ctx)),
+              Layer.provideMerge(
+                Layer.succeed(ExecutionContext, {
+                  scope,
+                  cache: {},
+                }),
+              ),
+            ),
+          ),
+        ),
+        Effect.provide(
+          Layer.provideMerge(globalContext, Layer.succeed(Scope.Scope, scope)),
+        ),
+        Effect.runPromiseExit,
+      )
+      .finally(() =>
+        isScopeEjected(scope)
+          ? undefined
+          : Scope.close(scope, Exit.void).pipe(Effect.runPromise, (promise) =>
+              ctx.waitUntil(promise),
+            ),
+      );
+  };
+  class WorkerBridge extends Base {
+    constructor(
+      public readonly ctx: any,
+      public readonly env: any,
+    ) {
+      super(ctx, env);
+
+      for (const methodName of ExportedHandlerMethods) {
+        (this as any)[methodName] = async (input: any) =>
+          exported
+            .pipe(
+              Effect.map((_default) => _default[methodName]),
+              Effect.map(
+                (f) =>
+                  f(input, this.env, this.ctx) as [
+                    Effect.Effect<any>,
+                    Context.Context<never>,
+                  ],
+              ),
+              (eff) => processEvent(eff, this.ctx),
+            )
+            .then((exit) =>
+              exit._tag === "Success"
+                ? Promise.resolve(exit.value)
+                : Promise.reject(Cause.squash(exit.cause)),
+            );
+      }
+
+      return new Proxy(this, {
+        get: (target, prop) => {
+          if (typeof prop !== "string") return (target as any)[prop];
+          if (prop in target) return (target as any)[prop];
+          return (...args: unknown[]) =>
+            shape
+              .pipe(
+                Effect.map((shape: any) => shape[prop]),
+                Effect.flatMap((dispatcher) => {
+                  if (typeof dispatcher !== "function") {
+                    return Effect.die(
+                      new Error(
+                        `Method "${prop}" not found on worker. ` +
+                          `Make sure it's returned from the worker's default export.`,
+                      ),
+                    );
+                  }
+                  const result = dispatcher(...args);
+                  // A streaming RPC method returns a `Stream` directly rather
+                  // than an `Effect`. Lift it into the success channel so the
+                  // inner effect resolves to the `Stream` and `handleRpcExit`
+                  // can encode it as a stream envelope. Anything else is the
+                  // `Effect` it claims to be (its resolved value may itself be
+                  // a `Stream`, which `handleRpcExit` also handles).
+                  return Effect.succeed([
+                    Stream.isStream(result)
+                      ? Effect.succeed(result)
+                      : (result as Effect.Effect<any>),
+                    Context.empty(),
+                  ] as const);
+                }),
+                (eff) => processEvent(eff, this.ctx),
+              )
+              .then(handleRpcExit);
+        },
+      });
+    }
+  }
+
+  // Stub prototype methods so Cloudflare's script-validate detects the
+  // standard handler set; per-instance overrides above are what actually
+  // run.
+  for (const method of ExportedHandlerMethods) {
+    Object.defineProperty(WorkerBridge.prototype, method, {
+      value: function () {
+        throw new Error(
+          `Bridge method '${method}' was called before instance setup`,
+        );
+      },
+      writable: true,
+      configurable: true,
+    });
+  }
+
+  return WorkerBridge;
+};
+
+export const getWorkerExport = <Export = any>({
+  entrypoint,
+  stack,
+  exportName,
+}: {
+  entrypoint: any;
+  stack: { name: string; stage: string };
+  exportName: string;
+}) => {
+  const tag = Self as any as Context.Service<
+    never,
+    Worker & {
+      RuntimeContext: WorkerRuntimeContext;
+    }
+  >;
+
+  const runtimeContext = tag.pipe(Effect.map((func) => func.RuntimeContext));
+  const shape = runtimeContext.pipe(Effect.map((context) => context.shape()));
+  const exported = runtimeContext.pipe(
+    Effect.flatMap((context) => context.exports),
+    Effect.flatMap((exports) =>
+      Effect.isEffect(exports[exportName])
+        ? exports[exportName]
+        : Effect.succeed(exports[exportName]),
+    ),
+  ) as Effect.Effect<Export>;
+
+  const layer = makeEntrypointLayer(tag, entrypoint);
+
+  const platform = Layer.mergeAll(
+    NodeServices.layer,
+    FetchHttpClient.layer,
+    // TODO(sam): wire this up to telemetry more directly
+    Logger.layer([Logger.consolePretty()]),
+  );
+
+  const globalContext = Layer.unwrap(
+    cloudflare_workers.pipe(
+      Effect.map(({ env }) =>
+        layer.pipe(
+          Layer.provideMerge(
+            Layer.succeed(Stack, {
+              name: stack.name,
+              stage: stack.stage,
+              bindings: {},
+              resources: {},
+              actions: {},
+            }),
+          ),
+          Layer.provideMerge(platform),
+          Layer.provideMerge(
+            Layer.succeed(
+              ConfigProvider.ConfigProvider,
+              ConfigProvider.orElse(
+                ConfigProvider.fromUnknown({ ALCHEMY_PHASE: "runtime" }),
+                ConfigProvider.fromUnknown(env),
+              ),
+            ),
+          ),
+          Layer.provideMerge(Layer.succeed(WorkerEnvironment, env)),
+          Layer.provideMerge(
+            Layer.succeed(
+              MinimumLogLevel,
+              (env as any).DEBUG ? "Debug" : "Info",
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+
+  return {
+    globalContext,
+    exported,
+    shape,
+  };
+};
+
+export const makeRpcProxy = (
+  self: any,
+  userShape: Effect.Effect<any>,
+  processEvent: (
+    eff: Effect.Effect<[Effect.Effect<any>, Context.Context<never>]>,
+  ) => Promise<any>,
+) =>
+  new Proxy(self, {
+    get: (target, prop) => {
+      if (typeof prop !== "string") return (target as any)[prop];
+      if (prop in target) return (target as any)[prop];
+      return (...args: unknown[]) =>
+        userShape
+          .pipe(
+            Effect.map((shape) => shape[prop]),
+            Effect.flatMap((dispatcher) => {
+              if (typeof dispatcher !== "function") {
+                return Effect.die(
+                  new Error(
+                    `Method "${prop}" not found on worker. ` +
+                      `Make sure it's returned from the worker's default export.`,
+                  ),
+                );
+              }
+              const result = dispatcher(...args);
+              // A streaming RPC method returns a `Stream` directly rather than
+              // an `Effect`. Lift it into the success channel so the resulting
+              // `Exit.value` is the `Stream` and `handleRpcExit` can encode it
+              // as a stream envelope. Anything else is the `Effect` it claims
+              // to be and is run normally (its resolved value may itself be a
+              // `Stream`, which `handleRpcExit` also handles).
+              return Stream.isStream(result)
+                ? Effect.succeed(result)
+                : (result as Effect.Effect<any>);
+            }),
+            processEvent,
+          )
+          .then(handleRpcExit);
+    },
+  });
+
+export const handleRpcExit = async (exit: Exit.Exit<any, any>) => {
+  if (exit._tag === "Success") {
+    if (Stream.isStream(exit.value)) {
+      return await Effect.runPromise(
+        toRpcStream(exit.value) as Effect.Effect<RpcStreamEnvelope>,
+      );
+    }
+    return exit.value;
+  }
+  const failReason = exit.cause.reasons.find(Cause.isFailReason);
+  if (failReason) {
+    return {
+      _tag: ErrorTag,
+      error: encodeRpcError(failReason.error),
+    } satisfies RpcErrorEnvelope;
+  }
+  const dieReason = exit.cause.reasons.find(Cause.isDieReason);
+  throw (
+    dieReason?.defect ?? new Error("RPC method failed with an unexpected cause")
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBundle.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBundle.ts
new file mode 100644
index 00000000000..9c0fa050814
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerBundle.ts
@@ -0,0 +1,193 @@
+import cloudflareRolldown from "@distilled.cloud/cloudflare-rolldown-plugin";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import { flow } from "effect/Function";
+import type * as Path from "effect/Path";
+import * as Stream from "effect/Stream";
+import { fileURLToPath } from "node:url";
+import path from "pathe";
+import type * as rolldown from "rolldown";
+import * as Bundle from "../../Bundle/Bundle.ts";
+import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
+import {
+  isDurableObjectExport,
+  type DurableObjectExport,
+} from "./DurableObjectNamespace.ts";
+import { isWorkflowExport, type WorkflowExport } from "./Workflow.ts";
+
+export interface WorkerBundleOptions {
+  id: string;
+  main: string;
+  compatibility: {
+    date: string;
+    flags: string[];
+  };
+  entry:
+    | {
+        kind: "external";
+      }
+    | {
+        kind: "effect";
+        exports: Record<string, DurableObjectExport | WorkflowExport>;
+      };
+  stack: { name: string; stage: string };
+  extraOptions: Bundle.BundleExtraOptions | undefined;
+}
+
+export const WorkerBundle = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const context = yield* Effect.context<FileSystem.FileSystem | Path.Path>();
+  const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
+
+  const makeOptions = Effect.fnUntraced(function* (
+    options: WorkerBundleOptions,
+  ) {
+    const realMain = yield* sanitizeMain(options.main);
+    const inputOptions: rolldown.InputOptions = {
+      input: realMain,
+      // Forever-devtool native modules that vite/chokidar reference behind
+      // runtime guards. Rolldown resolves before tree-shaking, so the dead
+      // `require('../pkg')` (lightningcss < 1.32) and `require('fsevents')`
+      // (darwin-only) trip [UNRESOLVED_IMPORT] before DCE can prune them.
+      // See rolldown/tsdown#212.
+      external: ["lightningcss", "fsevents"],
+      cwd: yield* findCwdForBundle(realMain).pipe(
+        Effect.mapError(
+          (cause) =>
+            new Bundle.BundleError({
+              message: `Failed to find cwd for bundle: ${realMain}`,
+              cause,
+            }),
+        ),
+        Effect.provide(context),
+      ),
+      plugins: [
+        cloudflareRolldown({
+          compatibilityDate: options.compatibility.date,
+          compatibilityFlags: options.compatibility.flags,
+        }),
+        options.entry.kind === "effect"
+          ? [
+              virtualEntryPlugin(
+                makeEffectVirtualEntry(options.entry.exports, options.stack),
+              ),
+            ]
+          : undefined,
+      ],
+      checks: {
+        // Suppress unresolved import warnings for unrelated AWS packages
+        unresolvedImport: false,
+        // Suppress warning caused by static import of `@effect/platform-node/NodeServices` in `WorkerBridge.ts`
+        ineffectiveDynamicImport: false,
+      },
+    };
+    const outputOptions: rolldown.OutputOptions = {
+      format: "esm",
+      sourcemap: "hidden",
+      minify: true,
+      keepNames: true,
+      dir: `.alchemy/bundles/${options.id}`,
+    };
+    return { inputOptions, outputOptions, extraOptions: options.extraOptions };
+  });
+
+  const sanitizeMain = (main: string) =>
+    Effect.sync(() => {
+      try {
+        return fileURLToPath(main);
+      } catch {
+        return main;
+      }
+    }).pipe(
+      Effect.flatMap((p) => fs.realPath(p)),
+      //* fix windows paths
+      Effect.map((p) => path.resolve(p)),
+      Effect.mapError(
+        (cause) =>
+          new Bundle.BundleError({
+            message: `Failed to find real path for bundle: ${main}`,
+            cause,
+          }),
+      ),
+    );
+
+  return {
+    build: flow(
+      makeOptions,
+      Effect.flatMap((resolved) =>
+        Bundle.build(
+          resolved.inputOptions,
+          resolved.outputOptions,
+          resolved.extraOptions,
+        ),
+      ),
+    ),
+    watch: flow(
+      makeOptions,
+      Stream.fromEffect,
+      Stream.flatMap((resolved) =>
+        Bundle.watch(
+          resolved.inputOptions,
+          resolved.outputOptions,
+          resolved.extraOptions,
+        ),
+      ),
+    ),
+  };
+});
+
+export const makeEffectVirtualEntry = (
+  exports: Record<string, DurableObjectExport | WorkflowExport>,
+  stack: { name: string; stage: string },
+) => {
+  const doClasses: string[] = [];
+  const wfClasses: string[] = [];
+  for (const [className, entry] of Object.entries(exports)) {
+    if (isDurableObjectExport(entry)) {
+      doClasses.push(className);
+    } else if (isWorkflowExport(entry)) {
+      wfClasses.push(className);
+    }
+  }
+  const hasDoClasses = doClasses.length > 0;
+  const hasWfClasses = wfClasses.length > 0;
+  return (importPath: string) => `
+import * as Effect from "effect/Effect";
+
+import { env, DurableObject, WorkerEntrypoint${hasWfClasses ? ", WorkflowEntrypoint" : ""} } from "cloudflare:workers";
+import { makeDurableObjectBridge, makeWorkerBridge${hasWfClasses ? ", makeWorkflowBridge" : ""} } from "alchemy/Cloudflare";
+import { makeEntrypointLayer } from "alchemy/Runtime";
+
+import entrypoint from ${JSON.stringify(importPath)};
+
+const meta = {
+  entrypoint,
+  stack: {
+    name: ${JSON.stringify(stack.name)},
+    stage: ${JSON.stringify(stack.stage)},
+  },
+};
+
+export default makeWorkerBridge(WorkerEntrypoint, meta);
+
+// export class proxy stubs for Durable Objects and Workflows
+${[
+  ...(hasDoClasses
+    ? [
+        "const DurableObjectBridge = makeDurableObjectBridge(DurableObject, meta);",
+        ...doClasses.map(
+          (id) => `export class ${id} extends DurableObjectBridge("${id}") {}`,
+        ),
+      ]
+    : []),
+  ...(hasWfClasses
+    ? [
+        "const WorkflowBridgeFn = makeWorkflowBridge(WorkflowEntrypoint, meta);",
+        ...wfClasses.map(
+          (id) => `export class ${id} extends WorkflowBridgeFn("${id}") {}`,
+        ),
+      ]
+    : []),
+].join("\n")}
+`;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerName.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerName.ts
new file mode 100644
index 00000000000..3ed929f3a0c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerName.ts
@@ -0,0 +1,10 @@
+import * as Effect from "effect/Effect";
+import { createPhysicalName } from "../../PhysicalName.ts";
+
+export const createWorkerName = (id: string, name: string | undefined) =>
+  name
+    ? Effect.succeed(name)
+    : createPhysicalName({
+        id,
+        maxLength: 54,
+      }).pipe(Effect.map((name) => name.toLowerCase()));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerRuntimeContext.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerRuntimeContext.ts
new file mode 100644
index 00000000000..eb4804b2a8d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkerRuntimeContext.ts
@@ -0,0 +1,159 @@
+import type * as cf from "@cloudflare/workers-types";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import type { HttpEffect } from "../../Http.ts";
+import * as Output from "../../Output.ts";
+import type * as Serverless from "../../Serverless/index.ts";
+import { makeRequestHandler } from "./HttpServer.ts";
+import {
+  ExportedHandlerMethods,
+  WorkerEnvironment,
+  WorkerTypeId,
+  type WorkerEvent,
+} from "./Worker.ts";
+
+export interface WorkerRuntimeContext extends Serverless.FunctionContext {
+  export(name: string, value: any): Effect.Effect<void>;
+  shape: () => Record<string, any>;
+}
+
+export const makeWorkerRuntimeContext = (id: string): WorkerRuntimeContext => {
+  const listeners: Effect.Effect<Serverless.FunctionListener>[] = [];
+  const exports: Record<string, any> = {};
+  const env: Record<string, any> = {};
+  let userShape: Record<string, unknown> | undefined;
+
+  const ctx = {
+    Type: WorkerTypeId,
+    id,
+    env,
+    shape: () => userShape!,
+    get: (key: string) =>
+      Effect.serviceOption(WorkerEnvironment).pipe(
+        Effect.map(Option.getOrUndefined),
+        // Key is already canonical (see RuntimeContext.sanitizeKey).
+        Effect.map((env) => env?.[key]),
+        Effect.map((json) => {
+          if (json === undefined) {
+            return undefined;
+          }
+          try {
+            const value = JSON.parse(json);
+            // The `set` path serializes Redacted values as
+            // `{_tag: "Redacted", value: ...}`. After JSON.parse the
+            // result is a plain object — `Redacted.isRedacted` would
+            // always return `false` on it — so detect the marker shape
+            // and rebuild the Redacted wrapper. Plain values pass
+            // through unchanged.
+            if (
+              typeof value === "object" &&
+              value?._tag === "Redacted" &&
+              "value" in value
+            ) {
+              return Redacted.make((value as { value: unknown }).value);
+            }
+            return value;
+          } catch {
+            return json;
+          }
+        }),
+      ) as any,
+    set: (key: string, output: Output.Output) =>
+      Effect.sync(() => {
+        // Preserve `Redacted`-ness across the Output → env → Cloudflare
+        // binding boundary so the put-worker loop can deploy secrets via
+        // `secret_text` instead of leaking them as `plain_text`. The JSON
+        // payload still carries the `{_tag: "Redacted", …}` marker so the
+        // runtime `get` accessor can rebuild the wrapper after Cloudflare
+        // hands the binding back as a plain string.
+        env[key] = output.pipe(
+          Output.map((value) =>
+            Redacted.isRedacted(value)
+              ? Redacted.make(
+                  JSON.stringify({
+                    _tag: "Redacted",
+                    value: Redacted.value(value),
+                  }),
+                )
+              : JSON.stringify(value),
+          ),
+        );
+        return key;
+      }),
+    serve: <Req = never>(
+      handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+      options?: { shape?: Record<string, unknown> },
+    ) => {
+      // Capture the user's full default-export shape so `exports` can
+      // expose any non-handler methods on it as RPC methods on the
+      // deployed `WorkerEntrypoint` subclass — see `__rpc__` below.
+      if (options?.shape) userShape = options.shape;
+      return ctx.listen(makeRequestHandler(handler));
+    },
+    listen: ((
+      handler:
+        | Serverless.FunctionListener
+        | Effect.Effect<Serverless.FunctionListener>,
+    ) =>
+      Effect.sync(() =>
+        Effect.isEffect(handler)
+          ? listeners.push(handler)
+          : listeners.push(Effect.succeed(handler)),
+      )) as any as Serverless.FunctionContext["listen"],
+    export: (name: string, value: any) =>
+      Effect.sync(() => {
+        exports[name] = value;
+      }),
+    planServices: Layer.succeed(WorkerEnvironment, {}),
+    exports: Effect.gen(function* () {
+      const handlers = yield* Effect.all(listeners, {
+        concurrency: "unbounded",
+      });
+      const services = yield* Effect.context();
+
+      const dispatch =
+        (type: WorkerEvent["type"]) =>
+        (request: any, env: unknown, context: cf.ExecutionContext) => {
+          const event: WorkerEvent = {
+            kind: "Cloudflare.Workers.WorkerEvent",
+            type,
+            input: request,
+            env,
+            context,
+          };
+          for (const handler of handlers) {
+            const eff = handler(event);
+            if (Effect.isEffect(eff)) {
+              return [eff, services];
+            }
+          }
+          return [
+            Effect.die(
+              new Error(`No event handler found for event type '${type}'`),
+            ),
+            services,
+          ];
+        };
+
+      // RPC method dispatchers — one per non-handler method on the user's
+      // shape. Each dispatcher is invoked by the WorkerEntrypoint bridge
+      // as `dispatcher(args, ctx)`: `args` are the user-facing call args,
+      // `ctx` is the `this.ctx` that Cloudflare hands the bridge per RPC
+      // request. The dispatcher runs the user effect with the same runtime
+      // layer the fetch path uses, then envelope-encodes the result so
+      // `Effect.fail` round-trips as `RpcErrorEnvelope` and `Stream` as
+      // `RpcStreamEnvelope` (consumers wrap the binding with
+      // `toPromiseApi`/`bindWorker` to decode).
+
+      return {
+        ...exports,
+        default: Object.fromEntries(
+          ExportedHandlerMethods.map((method) => [method, dispatch(method)]),
+        ),
+      };
+    }),
+  };
+  return ctx;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Workflow.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Workflow.ts
new file mode 100644
index 00000000000..55e2acef0b6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/Workflow.ts
@@ -0,0 +1,559 @@
+import * as workflows from "@distilled.cloud/cloudflare/workflows";
+import type { ConfigError } from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { AlchemyContext } from "../../AlchemyContext.ts";
+import { ALCHEMY_PHASE } from "../../Phase.ts";
+import type { PlatformServices } from "../../Platform.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { effectClass, taggedFunction } from "../../Util/effect.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import { Worker, WorkerEnvironment, type WorkerServices } from "./Worker.ts";
+
+type WorkflowTypeId = "Cloudflare.Workflow";
+const WorkflowTypeId: WorkflowTypeId = "Cloudflare.Workflow";
+
+// ---------------------------------------------------------------------------
+// Runtime services -- provided by the bridge when the workflow executes
+// ---------------------------------------------------------------------------
+
+/**
+ * Service that carries the current workflow event payload.
+ * `yield* WorkflowEvent` inside a workflow body to access it.
+ */
+export class WorkflowEvent extends Context.Service<
+  WorkflowEvent,
+  {
+    payload: unknown;
+    timestamp: Date;
+    instanceId: string;
+  }
+>()("Cloudflare.WorkflowEvent") {}
+
+/**
+ * Internal service that wraps the Cloudflare `WorkflowStep` object.
+ * Not accessed directly by users -- use `task`, `sleep`, `sleepUntil` instead.
+ */
+export class WorkflowStep extends Context.Service<
+  WorkflowStep,
+  {
+    do<T>(name: string, effect: Effect.Effect<T>): Effect.Effect<T>;
+    sleep(name: string, duration: string | number): Effect.Effect<void>;
+    sleepUntil(name: string, timestamp: Date | number): Effect.Effect<void>;
+  }
+>()("Cloudflare.WorkflowStep") {}
+
+// ---------------------------------------------------------------------------
+// User-facing step primitives
+// ---------------------------------------------------------------------------
+
+/**
+ * Execute a named, durable workflow step. The effect is run inside the
+ * Cloudflare step transaction so its result is automatically persisted
+ * and replayed on retries.
+ *
+ * Any services the inner effect requires (e.g. `WorkerEnvironment` from a
+ * binding like `kv.put` / `kv.get`) are threaded through automatically by
+ * capturing the surrounding workflow body's context and providing it to
+ * the inner effect before it runs inside `step.do`.
+ */
+export const task = <T, R = never>(
+  name: string,
+  effect: Effect.Effect<T, never, R>,
+): Effect.Effect<T, never, WorkflowStep | R> =>
+  Effect.gen(function* () {
+    const step = yield* WorkflowStep;
+    const context = yield* Effect.context<R>();
+    return yield* step.do(name, effect.pipe(Effect.provide(context)));
+  });
+
+/**
+ * Pause the workflow for the given duration.
+ */
+export const sleep = (
+  name: string,
+  duration: string | number,
+): Effect.Effect<void, never, WorkflowStep> =>
+  WorkflowStep.pipe(
+    Effect.flatMap((step) => step.sleep(name, duration)),
+    Effect.orDie,
+  );
+
+/**
+ * Pause the workflow until the given timestamp.
+ */
+export const sleepUntil = (
+  name: string,
+  timestamp: Date | number,
+): Effect.Effect<void, never, WorkflowStep> =>
+  WorkflowStep.pipe(
+    Effect.flatMap((step) => step.sleepUntil(name, timestamp)),
+    Effect.orDie,
+  );
+
+/**
+ * The services available inside a workflow run body.
+ *
+ * `WorkerEnvironment` is provided to the body at runtime by the workflow
+ * export wrapper (see `make(env)` below), so users can access env bindings
+ * from inside workflow steps via `yield* WorkerEnvironment` — the type must
+ * reflect that or `yield* WorkerEnvironment` fails to type-check inside a
+ * body even though it succeeds at runtime.
+ */
+export type WorkflowRunServices = WorkflowEvent | WorkflowStep | WorkerServices;
+
+export type WorkflowServices = WorkflowRunServices | PlatformServices;
+
+/**
+ * Metadata stored in the worker export map to distinguish workflow exports
+ * from durable object exports at bundle-generation time.
+ */
+export interface WorkflowExport {
+  readonly kind: "workflow";
+  readonly make: (env: unknown) => Effect.Effect<WorkflowImpl<any, any>>;
+}
+
+/**
+ * A workflow implementation is a function from a typed `Input` payload to
+ * an Effect that produces the workflow's `Result`. The Effect requires
+ * `WorkflowRunServices` (event + step + env) to execute.
+ */
+export type WorkflowImpl<Input = unknown, Result = unknown> = (
+  input: Input,
+) => Effect.Effect<Result, never, WorkflowServices>;
+
+export const isWorkflowExport = (value: unknown): value is WorkflowExport =>
+  typeof value === "object" &&
+  value !== null &&
+  "kind" in value &&
+  (value as any).kind === "workflow";
+
+/**
+ * Type guard for workflow binding metadata in the Worker binding contract.
+ */
+export const isWorkflowBinding = (binding: {
+  type: string;
+}): binding is {
+  type: "workflow";
+  name: string;
+  workflowName: string;
+  className: string;
+  scriptName?: string;
+} => binding.type === "workflow";
+
+/**
+ * Handle returned to the caller at deploy/bind time. Allows starting
+ * workflow instances and checking their status from the Api layer.
+ */
+export interface WorkflowHandle<Input = unknown, Result = unknown> {
+  Type: WorkflowTypeId;
+  name: string;
+  create(input: Input): Effect.Effect<WorkflowInstance<Result>>;
+  get(instanceId: string): Effect.Effect<WorkflowInstance<Result>>;
+}
+
+export interface WorkflowInstance<Result = unknown> {
+  id: string;
+  status(): Effect.Effect<WorkflowInstanceStatus<Result>>;
+  pause(): Effect.Effect<void>;
+  resume(): Effect.Effect<void>;
+  terminate(): Effect.Effect<void>;
+}
+
+export interface WorkflowInstanceStatus<Result = unknown> {
+  status: string;
+  output?: Result;
+  error?: { name: string; message: string } | null;
+}
+
+export interface WorkflowClass extends Effect.Effect<
+  WorkflowHandle,
+  never,
+  WorkflowHandle
+> {
+  <_Self>(): {
+    <Input = unknown, Result = unknown, InitReq = never>(
+      name: string,
+      impl: Effect.Effect<WorkflowImpl<Input, Result>, ConfigError, InitReq>,
+    ): Effect.Effect<
+      WorkflowHandle<Input, Result>,
+      never,
+      Worker | Exclude<InitReq, WorkflowServices>
+    > & {
+      new (_: never): WorkflowImpl<Input, Result>;
+    };
+  };
+  <Input = unknown, Result = unknown, InitReq = never>(
+    name: string,
+    impl: Effect.Effect<WorkflowImpl<Input, Result>, ConfigError, InitReq>,
+  ): Effect.Effect<
+    WorkflowHandle<Input, Result>,
+    never,
+    Worker | Exclude<InitReq, WorkflowServices>
+  >;
+}
+
+export class WorkflowScope extends Context.Service<
+  WorkflowScope,
+  WorkflowHandle
+>()("Cloudflare.Workflow") {}
+
+/**
+ * A Cloudflare Workflow that orchestrates durable, multi-step tasks with
+ * automatic retries and at-least-once delivery.
+ *
+ * A Workflow follows the same two-phase pattern as Workers and Durable
+ * Objects. The outer `Effect.gen` resolves shared dependencies. The inner
+ * `Effect.fn` is the workflow body — a function from a typed `input`
+ * payload to an Effect that runs steps using `task`, `sleep`, and
+ * `sleepUntil`.
+ *
+ * ```typescript
+ * Effect.gen(function* () {
+ *   // Phase 1: resolve dependencies
+ *   const notifier = yield* NotificationService;
+ *
+ *   return Effect.fn(function* (input: { orderId: string }) {
+ *     // Phase 2: workflow body (durable steps)
+ *     const result = yield* Cloudflare.task("process", doWork(input.orderId));
+ *     yield* Cloudflare.sleep("cooldown", "10 seconds");
+ *     return result;
+ *   });
+ * })
+ * ```
+ *
+ * @resource
+ *
+ * @section Defining a Workflow
+ * @example Minimal workflow
+ * ```typescript
+ * export default class MyWorkflow extends Cloudflare.Workflow<MyWorkflow>()(
+ *   "MyWorkflow",
+ *   Effect.gen(function* () {
+ *     return Effect.fn(function* (input: { name: string }) {
+ *       return { received: input.name };
+ *     });
+ *   }),
+ * ) {}
+ * ```
+ *
+ * @section Step Primitives
+ * @example Running a named task
+ * ```typescript
+ * const result = yield* Cloudflare.task(
+ *   "process-order",
+ *   Effect.succeed({ orderId: "abc", total: 42 }),
+ * );
+ * ```
+ *
+ * @example Sleeping between steps
+ * ```typescript
+ * yield* Cloudflare.sleep("cooldown", "30 seconds");
+ * ```
+ *
+ * @example Accessing env bindings inside a task
+ * Bind a resource (e.g. `KVNamespace`, `R2Bucket`) in the workflow's
+ * outer init phase to get a typed Effect-native client, then use it
+ * directly inside `task`. `task` threads the binding's service
+ * requirement (`WorkerEnvironment`) through automatically so the inner
+ * Effect needs no extra plumbing.
+ *
+ * ```typescript
+ * Effect.gen(function* () {
+ *   const kv = yield* Cloudflare.KVNamespace.bind(KV);
+ *
+ *   return Effect.fn(function* (input: { roomId: string; message: string }) {
+ *     const { roomId, message } = input;
+ *
+ *     const stored = yield* Cloudflare.task(
+ *       "kv-roundtrip",
+ *       Effect.gen(function* () {
+ *         const key = `workflow:${roomId}`;
+ *         yield* kv.put(key, message);
+ *         return yield* kv.get(key);
+ *       }).pipe(Effect.orDie),
+ *     );
+ *
+ *     return stored;
+ *   });
+ * });
+ * ```
+ *
+ * @section Starting and Monitoring Instances
+ * @example Creating an instance from a Worker
+ * ```typescript
+ * const workflow = yield* MyWorkflow;
+ * const instance = yield* workflow.create({ orderId: "abc" });
+ * ```
+ *
+ * @example Checking instance status
+ * ```typescript
+ * const workflow = yield* MyWorkflow;
+ * const handle = yield* workflow.get(instanceId);
+ * const status = yield* handle.status();
+ * ```
+ *
+ * @section Triggering from a Worker
+ * Wire the workflow into HTTP routes so callers can fire instances
+ * and poll for completion.
+ *
+ * @example Workflow start + status routes
+ * ```typescript
+ * // src/worker.ts
+ * const notifier = yield* MyWorkflow;
+ *
+ * return {
+ *   fetch: Effect.gen(function* () {
+ *     const request = yield* HttpServerRequest;
+ *
+ *     if (request.url.startsWith("/workflow/start/")) {
+ *       const id = request.url.split("/").pop()!;
+ *       const instance = yield* notifier.create({ id });
+ *       return HttpServerResponse.json({ instanceId: instance.id });
+ *     }
+ *
+ *     if (request.url.startsWith("/workflow/status/")) {
+ *       const id = request.url.split("/").pop()!;
+ *       const instance = yield* notifier.get(id);
+ *       return HttpServerResponse.json(yield* instance.status());
+ *     }
+ *
+ *     return HttpServerResponse.text("Not Found", { status: 404 });
+ *   }),
+ * };
+ * ```
+ *
+ * @section Testing Workflows
+ * Workflows run asynchronously, so tests start an instance and
+ * poll until it reaches a terminal status. A simple recipe with
+ * `alchemy/Test/Bun`:
+ *
+ * @example Polling for workflow completion
+ * ```typescript
+ * test(
+ *   "workflow completes",
+ *   Effect.gen(function* () {
+ *     const { url } = yield* stack;
+ *
+ *     const start = yield* HttpClient.post(`${url}/workflow/start/x`);
+ *     const { instanceId } = (yield* start.json) as { instanceId: string };
+ *
+ *     let status: { status: string } | undefined;
+ *     const deadline = Date.now() + 60_000;
+ *     while (Date.now() < deadline) {
+ *       const res = yield* HttpClient.get(
+ *         `${url}/workflow/status/${instanceId}`,
+ *       );
+ *       status = (yield* res.json) as { status: string };
+ *       if (status.status === "complete" || status.status === "errored") {
+ *         break;
+ *       }
+ *       yield* Effect.sleep("2 seconds");
+ *     }
+ *
+ *     expect(status?.status).toBe("complete");
+ *   }),
+ *   { timeout: 120_000 },
+ * );
+ * ```
+ */
+export const Workflow: WorkflowClass = taggedFunction(WorkflowScope, ((
+  ...args: [] | [name: string, impl: Effect.Effect<WorkflowImpl<any, any>>]
+) =>
+  args.length === 0
+    ? Workflow
+    : effectClass(
+        Effect.gen(function* () {
+          const [name, impl] = args;
+          const worker = yield* Worker;
+
+          // Add the workflow binding to the Worker metadata
+          yield* worker.bind`${name}`({
+            bindings: [
+              {
+                type: "workflow",
+                name,
+                workflowName: name,
+                className: name,
+              },
+            ],
+          });
+
+          // Create the Workflow API resource (putWorkflow / deleteWorkflow)
+          yield* WorkflowResource(name, {
+            workflowName: name,
+            className: name,
+            scriptName: worker.workerName,
+          });
+
+          const services =
+            yield* Effect.context<Effect.Services<typeof impl>>();
+
+          const binding = yield* Effect.all([
+            WorkerEnvironment,
+            ALCHEMY_PHASE,
+          ]).pipe(
+            Effect.flatMap(([env, phase]) => {
+              if (env === undefined || phase === "plan") {
+                return Effect.succeed(undefined as any);
+              }
+              const wf = env[name];
+              if (!wf) {
+                return Effect.die(
+                  new Error(`Workflow '${name}' not found in env`),
+                );
+              }
+              return Effect.succeed(wf);
+            }),
+          );
+
+          const self: WorkflowHandle<any, any> = {
+            Type: WorkflowTypeId,
+            name,
+            create: (input: unknown) =>
+              Effect.tryPromise(() => binding.create({ params: input })).pipe(
+                Effect.map(wrapInstance),
+                Effect.orDie,
+              ),
+            get: (instanceId: string) =>
+              Effect.tryPromise(() => binding.get(instanceId)).pipe(
+                Effect.map(wrapInstance),
+                Effect.orDie,
+              ),
+          };
+
+          const fn = yield* impl.pipe(
+            Effect.provideService(WorkflowScope, self as any),
+          );
+
+          yield* worker.export(name, {
+            kind: "workflow",
+            make: (env: unknown) =>
+              Effect.succeed(((input: unknown) =>
+                fn(input).pipe(
+                  Effect.provideService(
+                    WorkerEnvironment,
+                    env as Record<string, any>,
+                  ),
+                )) as WorkflowImpl<any, any>).pipe(
+                Effect.provideContext(services),
+              ),
+          } satisfies WorkflowExport);
+
+          return self;
+        }),
+      )) as any);
+
+// ---------------------------------------------------------------------------
+// WorkflowResource -- manages the Cloudflare Workflows API lifecycle
+// ---------------------------------------------------------------------------
+
+export interface WorkflowResourceProps {
+  workflowName: string;
+  className: string;
+  scriptName: string;
+}
+
+export interface WorkflowResourceAttrs {
+  workflowId: string;
+  workflowName: string;
+  className: string;
+  scriptName: string;
+  accountId: string;
+}
+
+const WorkflowResourceTypeId = "Cloudflare.Workflow";
+
+export interface WorkflowResource extends Resource<
+  typeof WorkflowResourceTypeId,
+  WorkflowResourceProps,
+  WorkflowResourceAttrs
+> {}
+
+export const WorkflowResource = Resource<WorkflowResource>(
+  WorkflowResourceTypeId,
+);
+
+export const WorkflowProvider = () =>
+  Provider.effect(
+    WorkflowResource,
+    Effect.gen(function* () {
+      const ctx = yield* AlchemyContext;
+      const { accountId } = yield* CloudflareEnvironment;
+      const putWorkflow = yield* workflows.putWorkflow;
+      const deleteWorkflow = yield* workflows.deleteWorkflow;
+
+      return WorkflowResource.Provider.of({
+        // The `workflowId` is no longer marked as stable because if you start in dev mode, the ID will change on first deploy.
+        stables: ["accountId"],
+        diff: Effect.fnUntraced(function* ({ output }) {
+          // If the workflowId starts with "dev:", and we're not in dev mode, trigger an update so the workflow is created.
+          if (output?.workflowId.startsWith("dev:") && !ctx.dev) {
+            return { action: "update" };
+          }
+        }),
+        reconcile: Effect.fnUntraced(function* ({ news, output }) {
+          const acct = output?.accountId ?? accountId;
+          yield* Effect.logInfo(
+            `Cloudflare Workflow reconcile: ${news.workflowName}`,
+          );
+          if (ctx.dev) {
+            return {
+              workflowId: output?.workflowId ?? `dev:${crypto.randomUUID()}`,
+              accountId,
+              workflowName: news.workflowName,
+              className: news.className,
+              scriptName: news.scriptName,
+            };
+          }
+          // Cloudflare's `putWorkflow` is a true PUT-as-upsert: identical
+          // payloads converge to the same state and a missing workflow is
+          // created on the spot. There is no separate observe step needed
+          // — the API is naturally reconciler-shaped.
+          const result = yield* putWorkflow({
+            accountId: acct,
+            workflowName: news.workflowName,
+            className: news.className,
+            scriptName: news.scriptName,
+          });
+          return {
+            workflowId: result.id,
+            workflowName: result.name,
+            className: result.className,
+            scriptName: result.scriptName,
+            accountId: acct,
+          };
+        }),
+        delete: Effect.fnUntraced(function* ({ output }) {
+          yield* Effect.logInfo(
+            `Cloudflare Workflow delete: ${output.workflowName}`,
+          );
+          yield* deleteWorkflow({
+            accountId: output.accountId,
+            workflowName: output.workflowName,
+          }).pipe(Effect.catchTag("WorkflowNotFound", () => Effect.void));
+        }),
+      });
+    }),
+  );
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const wrapInstance = <Result>(raw: any): WorkflowInstance<Result> => ({
+  id: raw.id,
+  status: () =>
+    Effect.tryPromise(() => raw.status()).pipe(
+      Effect.map((s: any) => ({
+        status: s.status as string,
+        output: s.output as Result,
+        error: s.error,
+      })),
+      Effect.orDie,
+    ),
+  pause: () => Effect.tryPromise(() => raw.pause()).pipe(Effect.orDie),
+  resume: () => Effect.tryPromise(() => raw.resume()).pipe(Effect.orDie),
+  terminate: () => Effect.tryPromise(() => raw.terminate()).pipe(Effect.orDie),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkflowBridge.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkflowBridge.ts
new file mode 100644
index 00000000000..f31378c61a0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/WorkflowBridge.ts
@@ -0,0 +1,92 @@
+import * as Effect from "effect/Effect";
+import {
+  WorkflowEvent as WorkflowEventService,
+  type WorkflowExport,
+  type WorkflowImpl,
+  WorkflowStep,
+} from "./Workflow.ts";
+import { getWorkerExport } from "./WorkerBridge.ts";
+
+/**
+ * Create a WorkflowBridge class that extends `WorkflowEntrypoint` and
+ * delegates the `run(event, step)` call to the Effect-native workflow body
+ * registered via `worker.export(...)`.
+ *
+ * The bridge provides `WorkflowEvent` and `WorkflowStep` as Effect
+ * services so the user writes `yield* WorkflowEvent` and `yield* task(...)`
+ * instead of receiving callback parameters.
+ */
+export const makeWorkflowBridge =
+  (
+    WorkflowEntrypoint: abstract new (
+      ctx: unknown,
+      env: unknown,
+    ) => { run(event: any, step: any): Promise<unknown> },
+    {
+      entrypoint,
+      stack,
+    }: {
+      entrypoint: Effect.Effect<Record<string, any>>;
+      stack: { name: string; stage: string };
+    },
+  ) =>
+  (className: string) =>
+    class WorkflowBridge extends WorkflowEntrypoint {
+      readonly fn: Promise<WorkflowImpl<unknown, unknown>>;
+
+      constructor(ctx: unknown, env: unknown) {
+        super(ctx, env);
+
+        const { globalContext, exported } = getWorkerExport<WorkflowExport>({
+          entrypoint,
+          stack,
+          exportName: className,
+        });
+
+        this.fn = exported.pipe(
+          Effect.flatMap((wf) => wf.make(env)),
+          Effect.provide(globalContext),
+          Effect.runPromise,
+        ) as Promise<WorkflowImpl<unknown, unknown>>;
+      }
+
+      async run(event: any, step: any): Promise<unknown> {
+        const fn = await this.fn;
+        return Effect.runPromise(
+          fn(event.payload).pipe(
+            Effect.provideService(
+              WorkflowEventService,
+              wrapWorkflowEvent(event),
+            ),
+            Effect.provideService(WorkflowStep, wrapWorkflowStep(step)),
+          ) as Effect.Effect<unknown>,
+        );
+      }
+    };
+
+const wrapWorkflowEvent = (
+  event: any,
+): { payload: unknown; timestamp: Date; instanceId: string } => ({
+  payload: event.payload,
+  timestamp:
+    event.timestamp instanceof Date
+      ? event.timestamp
+      : new Date(event.timestamp),
+  instanceId: event.instanceId ?? "",
+});
+
+const wrapWorkflowStep = (step: any): WorkflowStep["Service"] => ({
+  do: <T>(name: string, effect: Effect.Effect<T>): Effect.Effect<T> =>
+    Effect.tryPromise(
+      () => step.do(name, () => Effect.runPromise(effect)) as Promise<T>,
+    ),
+  sleep: (name: string, duration: string | number): Effect.Effect<void> =>
+    Effect.tryPromise(() => step.sleep(name, duration)),
+  sleepUntil: (name: string, timestamp: Date | number): Effect.Effect<void> =>
+    Effect.tryPromise(() =>
+      step.sleepUntil(
+        name,
+        timestamp instanceof Date ? timestamp.toISOString() : timestamp,
+      ),
+    ),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/cloudflare_workers.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/cloudflare_workers.ts
new file mode 100644
index 00000000000..e1692ae3337
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/cloudflare_workers.ts
@@ -0,0 +1,17 @@
+import * as Effect from "effect/Effect";
+
+const cloudflare_workers: Effect.Effect<typeof import("cloudflare:workers")> =
+  /** @__PURE__ #__PURE__ */ Effect.promise(() =>
+    import("cloudflare:workers").catch(
+      () =>
+        ({
+          env: {},
+          DurableObject: class {},
+          WorkflowEntrypoint: class {
+            async run() {}
+          },
+        }) as any,
+    ),
+  );
+
+export default cloudflare_workers;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/index.ts
new file mode 100644
index 00000000000..d1ebbe24272
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Workers/index.ts
@@ -0,0 +1,23 @@
+export * from "./Assets.ts";
+export * from "./ConfigProvider.ts";
+export * from "./CronEventSource.ts";
+export * from "./DurableObjectBridge.ts";
+export * from "./DurableObjectNamespace.ts";
+export * from "./DurableObjectState.ts";
+export * from "./DurableObjectStorage.ts";
+export * from "./DynamicWorkerLoader.ts";
+export * from "./Fetch.ts";
+export * from "./HttpServer.ts";
+export * from "./InferEnv.ts";
+export * from "./LocalWorkerProvider.ts";
+export * from "./Request.ts";
+export * from "./Rpc.ts";
+export * from "./RpcDurableObjectNamespace.ts";
+export * from "./RpcWorker.ts";
+export * from "./ScheduledEvents.ts";
+export * from "./WebSocket.ts";
+export * from "./Worker.ts";
+export * from "./WorkerBinding.ts";
+export * from "./WorkerBridge.ts";
+export * from "./Workflow.ts";
+export * from "./WorkflowBridge.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/ZarazConfig.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/ZarazConfig.ts
new file mode 100644
index 00000000000..1d7dc5064e6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/ZarazConfig.ts
@@ -0,0 +1,403 @@
+import * as zaraz from "@distilled.cloud/cloudflare/zaraz";
+import * as Effect from "effect/Effect";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  stripNullFields,
+  stripUndefinedFields,
+  unwrapRedacted,
+} from "../../Util/data.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { resolveZoneId, type ZoneReference } from "../Zone/index.ts";
+import { defineZarazEvents } from "./ZarazEventTypes.ts";
+
+export type ZarazWorkflow = zaraz.GetWorkflowResponse;
+export type ZarazSettings = zaraz.PutConfigRequest["settings"];
+export type ZarazAnalytics = NonNullable<zaraz.PutConfigRequest["analytics"]>;
+export type ZarazConsent = NonNullable<zaraz.PutConfigRequest["consent"]>;
+
+export type ZarazConfigProps = {
+  /**
+   * Zone whose Zaraz config should be managed. Accepts a zone id, a zone name
+   * (`example.com`), or a `{ zoneId, name? }` object.
+   */
+  zone: ZoneReference;
+  /**
+   * Data layer compatibility mode.
+   */
+  dataLayer?: boolean;
+  /**
+   * Key used for Zaraz debug mode. Defaults to the current zone config value.
+   */
+  debugKey?: string;
+  /**
+   * Zaraz settings to merge into the current zone config.
+   */
+  settings?: Partial<ZarazSettings>;
+  /**
+   * Zaraz tools keyed by tool id. When omitted, existing tools are retained.
+   */
+  tools?: Record<string, unknown>;
+  /**
+   * Zaraz triggers keyed by trigger id. When omitted, existing triggers are
+   * retained.
+   */
+  triggers?: Record<string, unknown>;
+  /**
+   * Zaraz variables keyed by variable id. When omitted, existing variables are
+   * retained. Secret variable values are not returned by Cloudflare reads.
+   */
+  variables?: Record<string, unknown>;
+  /**
+   * Cloudflare Monitoring settings.
+   */
+  analytics?: ZarazAnalytics;
+  /**
+   * Zaraz consent management configuration.
+   */
+  consent?: ZarazConsent;
+  /**
+   * Single Page Application support.
+   */
+  historyChange?: boolean;
+  /**
+   * Zaraz workflow mode. When omitted, the current workflow is retained.
+   */
+  workflow?: ZarazWorkflow;
+  /**
+   * Whether destroy should restore Cloudflare's default Zaraz config.
+   *
+   * By default, destroy only removes this resource from Alchemy state and keeps
+   * the current zone-level Zaraz config intact.
+   * If `workflow` is set, `delete: true` restores the workflow to real-time
+   * mode, Cloudflare's default.
+   * @default false
+   */
+  delete?: boolean;
+};
+
+export type ZarazConfig = Resource<
+  "Cloudflare.ZarazConfig",
+  ZarazConfigProps,
+  ZarazConfigAttributes,
+  never,
+  Providers
+>;
+
+export type ZarazConfigAttributes = {
+  /**
+   * Cloudflare zone id.
+   */
+  zoneId: string;
+  /**
+   * Data layer compatibility mode.
+   */
+  dataLayer: boolean;
+  /**
+   * Key used for Zaraz debug mode.
+   */
+  debugKey: string;
+  /**
+   * General Zaraz settings.
+   */
+  settings: zaraz.GetConfigResponse["settings"];
+  /**
+   * Zaraz tools keyed by tool id.
+   */
+  tools: Record<string, unknown>;
+  /**
+   * Zaraz triggers keyed by trigger id.
+   */
+  triggers: Record<string, unknown>;
+  /**
+   * Zaraz variables keyed by variable id.
+   */
+  variables: Record<string, unknown>;
+  /**
+   * Zaraz internal version of the config.
+   */
+  zarazVersion: number;
+  /**
+   * Cloudflare Monitoring settings.
+   */
+  analytics?: zaraz.GetConfigResponse["analytics"];
+  /**
+   * Consent management configuration.
+   */
+  consent?: zaraz.GetConfigResponse["consent"];
+  /**
+   * Single Page Application support.
+   */
+  historyChange?: boolean | null;
+  /**
+   * Current Zaraz workflow mode.
+   */
+  workflow: ZarazWorkflow;
+};
+
+/**
+ * A Cloudflare Zaraz zone configuration.
+ *
+ * Cloudflare Zaraz is an edge-managed third-party tool manager and analytics
+ * event pipeline. See the
+ * {@link https://developers.cloudflare.com/zaraz/ | Cloudflare Zaraz docs} and
+ * {@link https://developers.cloudflare.com/zaraz/web-api/ | Web API docs}.
+ *
+ * Zaraz is a zone-level singleton. This resource reconciles the current zone
+ * config and workflow to the desired values while retaining existing settings
+ * for fields omitted from props.
+ *
+ * Destroy keeps the current Zaraz config by default to avoid wiping unrelated
+ * zone-level analytics setup. Set `delete: true` to restore Cloudflare's
+ * default Zaraz config on destroy.
+ *
+ * @section Managing Zaraz
+ * @example Enable data layer compatibility
+ * ```typescript
+ * const zaraz = yield* Cloudflare.ZarazConfig("Analytics", {
+ *   zone: "example.com",
+ *   dataLayer: true,
+ * });
+ * ```
+ *
+ * @example Update Zaraz settings
+ * ```typescript
+ * const zaraz = yield* Cloudflare.ZarazConfig("Analytics", {
+ *   zone: "example.com",
+ *   settings: {
+ *     autoInjectScript: true,
+ *     hideIPAddress: true,
+ *   },
+ * });
+ * ```
+ *
+ * @example Enable preview workflow
+ * ```typescript
+ * const zaraz = yield* Cloudflare.ZarazConfig("Analytics", {
+ *   zone: "example.com",
+ *   workflow: "preview",
+ * });
+ * ```
+ */
+export const ZarazConfig = Object.assign(
+  Resource<ZarazConfig>("Cloudflare.ZarazConfig"),
+  {
+    /**
+     * Define a type-only contract for the events sent through this Zaraz config.
+     *
+     * The returned value carries only types. Browser code should use
+     * Cloudflare's injected `window.zaraz` API at runtime.
+     */
+    events: defineZarazEvents,
+  },
+);
+
+type ConfigResponse =
+  | zaraz.GetConfigResponse
+  | zaraz.PutConfigResponse
+  | zaraz.GetDefaultResponse;
+
+const toAttributes = (
+  zoneId: string,
+  config: ConfigResponse,
+  workflow: ZarazWorkflow,
+): ZarazConfig["Attributes"] => ({
+  zoneId,
+  dataLayer: config.dataLayer,
+  debugKey: config.debugKey,
+  settings: config.settings,
+  tools: config.tools,
+  triggers: config.triggers,
+  variables: config.variables,
+  zarazVersion: config.zarazVersion,
+  analytics: config.analytics,
+  consent: config.consent,
+  historyChange: config.historyChange,
+  workflow,
+});
+
+const fromAttributes = (attrs: ZarazConfigAttributes): ConfigResponse => ({
+  dataLayer: attrs.dataLayer,
+  debugKey: attrs.debugKey,
+  settings: attrs.settings,
+  tools: attrs.tools,
+  triggers: attrs.triggers,
+  variables: attrs.variables,
+  zarazVersion: attrs.zarazVersion,
+  analytics: attrs.analytics,
+  consent: attrs.consent,
+  historyChange: attrs.historyChange,
+});
+
+const desiredConfig = (
+  observed: ConfigResponse,
+  props: ZarazConfigProps,
+): ConfigResponse => ({
+  dataLayer: props.dataLayer ?? observed.dataLayer,
+  debugKey: props.debugKey ?? observed.debugKey,
+  settings: {
+    ...stripNullFields(observed.settings),
+    ...props.settings,
+  },
+  tools: props.tools ?? observed.tools,
+  triggers: props.triggers ?? observed.triggers,
+  variables: props.variables ?? observed.variables,
+  zarazVersion: observed.zarazVersion,
+  analytics:
+    props.analytics ??
+    (observed.analytics ? stripNullFields(observed.analytics) : undefined),
+  consent:
+    props.consent ??
+    (observed.consent ? stripNullFields(observed.consent) : undefined),
+  historyChange: props.historyChange ?? observed.historyChange,
+});
+
+const toPutConfig = (
+  zoneId: string,
+  config: ConfigResponse,
+): zaraz.PutConfigRequest =>
+  stripUndefinedFields({
+    zoneId,
+    dataLayer: config.dataLayer,
+    debugKey: config.debugKey,
+    settings: stripNullFields(config.settings) as ZarazSettings,
+    tools: unwrapRedacted(config.tools) as Record<string, unknown>,
+    triggers: unwrapRedacted(config.triggers) as Record<string, unknown>,
+    variables: unwrapRedacted(config.variables) as Record<string, unknown>,
+    zarazVersion: config.zarazVersion,
+    analytics: config.analytics
+      ? (stripNullFields(config.analytics) as ZarazAnalytics)
+      : undefined,
+    consent: config.consent
+      ? (stripNullFields(config.consent) as ZarazConsent)
+      : undefined,
+    historyChange: config.historyChange ?? undefined,
+  }) as zaraz.PutConfigRequest;
+
+const comparableConfig = (config: ConfigResponse) => {
+  const { zoneId: _, ...request } = toPutConfig("", config);
+  return request;
+};
+
+const configForCompare = (
+  observed: ConfigResponse,
+  oldProps: ZarazConfigProps | undefined,
+  props: ZarazConfigProps,
+): ConfigResponse => {
+  if (
+    props.variables === undefined ||
+    oldProps?.variables === undefined ||
+    !deepEqual(oldProps.variables, props.variables)
+  ) {
+    return observed;
+  }
+
+  // If props already requested these variables in the previous state, compare
+  // against props instead of Cloudflare's readback because secret variable
+  // values are intentionally write-only in the Zaraz API.
+  return {
+    ...observed,
+    variables: props.variables,
+  };
+};
+
+export const ZarazConfigProvider = () =>
+  Provider.effect(
+    ZarazConfig,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const getConfig = yield* zaraz.getConfig;
+      const putConfig = yield* zaraz.putConfig;
+      const getDefault = yield* zaraz.getDefault;
+      const getWorkflow = yield* zaraz.getWorkflow;
+      // Cloudflare's OpenAPI operation name is `putZaraz`, but the endpoint
+      // updates the zone's Zaraz workflow mode.
+      const putWorkflow = yield* zaraz.putZaraz;
+
+      const resolve = (zone: ZoneReference) =>
+        resolveZoneId({
+          accountId,
+          zone,
+          hostname: typeof zone === "string" ? zone : (zone.name ?? ""),
+        });
+
+      const observe = (zoneId: string) =>
+        Effect.all({
+          config: getConfig({ zoneId }),
+          workflow: getWorkflow({ zoneId }),
+        }).pipe(
+          Effect.map(({ config, workflow }) =>
+            toAttributes(zoneId, config, workflow),
+          ),
+        );
+
+      return {
+        stables: ["zoneId"],
+        diff: Effect.fn(function* ({ olds, news, output }) {
+          if (!output) return undefined;
+          if (!isResolved(news)) return undefined;
+
+          const zoneId = yield* resolve(news.zone);
+          if (zoneId !== output.zoneId) {
+            return { action: "replace" } as const;
+          }
+
+          const outputConfig = fromAttributes(output);
+          const comparableOutput = configForCompare(outputConfig, olds, news);
+          const desired = desiredConfig(outputConfig, news);
+          const desiredWorkflow = news.workflow ?? output.workflow;
+          if (
+            desiredWorkflow !== output.workflow ||
+            !deepEqual(
+              comparableConfig(comparableOutput),
+              comparableConfig(desired),
+            )
+          ) {
+            return { action: "update" } as const;
+          }
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          const zoneId =
+            output?.zoneId ?? (olds ? yield* resolve(olds.zone) : undefined);
+          if (!zoneId) return undefined;
+          return yield* observe(zoneId);
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const zoneId = output?.zoneId ?? (yield* resolve(news.zone));
+          const observed = yield* observe(zoneId);
+          const observedConfig = fromAttributes(observed);
+          const desired = desiredConfig(observedConfig, news);
+          const desiredWorkflow = news.workflow ?? observed.workflow;
+
+          const updatedConfig = deepEqual(
+            comparableConfig(observedConfig),
+            comparableConfig(desired),
+          )
+            ? observedConfig
+            : yield* putConfig(toPutConfig(zoneId, desired));
+          const updatedWorkflow =
+            desiredWorkflow === observed.workflow
+              ? observed.workflow
+              : yield* putWorkflow({
+                  zoneId,
+                  workflow: desiredWorkflow,
+                });
+
+          return toAttributes(zoneId, updatedConfig, updatedWorkflow);
+        }),
+        delete: Effect.fn(function* ({ output, olds }) {
+          if (olds.delete !== true) return;
+          const defaults = yield* getDefault({ zoneId: output.zoneId });
+          yield* putConfig(toPutConfig(output.zoneId, defaults));
+          if (olds.workflow !== undefined) {
+            yield* putWorkflow({
+              zoneId: output.zoneId,
+              workflow: "realtime",
+            });
+          }
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/ZarazEventTypes.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/ZarazEventTypes.ts
new file mode 100644
index 00000000000..b6ae0a91687
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/ZarazEventTypes.ts
@@ -0,0 +1,257 @@
+import type { Simplify } from "effect/Types";
+
+/**
+ * Type-only helpers for Cloudflare Zaraz events.
+ *
+ * These declarations are not an Alchemy EventSource resource and do not send
+ * events at runtime. They only model the browser-side `window.zaraz` API and
+ * Zaraz HTTP event payloads so application code can share an event contract
+ * with infrastructure code.
+ */
+
+/**
+ * A map of Zaraz event names to the properties accepted by each event.
+ *
+ * Use `undefined` for events that do not accept custom properties.
+ */
+export type ZarazEventMap = Record<string, object | undefined>;
+
+type RequireAtLeastOne<T extends object> = {
+  readonly [K in keyof T]-?: Required<Pick<T, K>> & Partial<Omit<T, K>>;
+}[keyof T];
+
+/**
+ * Product properties supported by Cloudflare Zaraz ecommerce events.
+ */
+export type ZarazEcommerceProduct = {
+  readonly product_id?: string;
+  readonly sku?: string;
+  readonly category?: string;
+  readonly name?: string;
+  readonly brand?: string;
+  readonly variant?: string;
+  readonly price?: number;
+  readonly currency?: string;
+  readonly value?: number;
+  readonly quantity?: number;
+  readonly coupon?: string;
+  readonly position?: number;
+};
+
+/**
+ * Order and checkout properties supported by Cloudflare Zaraz ecommerce events.
+ */
+export type ZarazEcommerceOrder = {
+  readonly checkout_id?: string;
+  readonly order_id?: string;
+  readonly affiliation?: string;
+  readonly total?: number;
+  readonly revenue?: number;
+  readonly shipping?: number;
+  readonly tax?: number;
+  readonly discount?: number;
+  readonly coupon?: string;
+  readonly currency?: string;
+  readonly products?: readonly ZarazEcommerceProduct[];
+};
+
+export type ZarazEcommercePromotion = {
+  readonly creative?: string;
+};
+
+export type ZarazEcommerceSearch = {
+  readonly query?: string;
+};
+
+export type ZarazEcommerceCheckoutStep = {
+  readonly step?: number;
+};
+
+export type ZarazEcommercePayment = {
+  readonly payment_type?: string;
+};
+
+export type ZarazEcommerceRefund = {
+  readonly amount?: number;
+  readonly amount_refunded?: number;
+  readonly currency?: string;
+  readonly refund_reason?: string;
+};
+
+/**
+ * Standard ecommerce events supported by Cloudflare's `zaraz.ecommerce()` API.
+ */
+export type ZarazEcommerceEvents = {
+  readonly "Product List Viewed": RequireAtLeastOne<
+    Pick<ZarazEcommerceOrder, "products">
+  >;
+  readonly "Products Searched": RequireAtLeastOne<ZarazEcommerceSearch>;
+  readonly "Product Clicked": RequireAtLeastOne<ZarazEcommerceProduct>;
+  readonly "Product Added": RequireAtLeastOne<ZarazEcommerceProduct>;
+  readonly "Product Added to Wishlist": RequireAtLeastOne<ZarazEcommerceProduct>;
+  readonly "Product Removed": RequireAtLeastOne<ZarazEcommerceProduct>;
+  readonly "Product Viewed": RequireAtLeastOne<ZarazEcommerceProduct>;
+  readonly "Cart Viewed": RequireAtLeastOne<ZarazEcommerceOrder>;
+  readonly "Checkout Started": RequireAtLeastOne<ZarazEcommerceOrder>;
+  readonly "Checkout Step Viewed": RequireAtLeastOne<ZarazEcommerceCheckoutStep>;
+  readonly "Checkout Step Completed": RequireAtLeastOne<ZarazEcommerceCheckoutStep>;
+  readonly "Payment Info Entered": RequireAtLeastOne<ZarazEcommercePayment>;
+  readonly "Order Completed": RequireAtLeastOne<ZarazEcommerceOrder>;
+  readonly "Order Updated": RequireAtLeastOne<ZarazEcommerceOrder>;
+  readonly "Order Refunded": RequireAtLeastOne<
+    ZarazEcommerceOrder & ZarazEcommerceRefund
+  >;
+  readonly "Order Cancelled": RequireAtLeastOne<ZarazEcommerceOrder>;
+  readonly "Clicked Promotion": RequireAtLeastOne<ZarazEcommercePromotion>;
+  readonly "Viewed Promotion": RequireAtLeastOne<ZarazEcommercePromotion>;
+  readonly "Shipping Info Entered": RequireAtLeastOne<ZarazEcommerceOrder>;
+};
+
+declare const ZarazEventContractTypeId: unique symbol;
+
+/**
+ * Type-only contract for an application's Zaraz events.
+ *
+ * The runtime value is intentionally empty. Application browser code should
+ * import derived types and call Cloudflare's injected `window.zaraz` API rather
+ * than importing Alchemy runtime code into the client bundle.
+ */
+export type ZarazEventContract<
+  Events extends ZarazEventMap,
+  EcommerceEvents extends ZarazEventMap = {},
+> = {
+  readonly [ZarazEventContractTypeId]: {
+    readonly events: Events;
+    readonly ecommerceEvents: EcommerceEvents;
+  };
+};
+
+/**
+ * Define an application's Zaraz event contract.
+ *
+ * @example
+ * ```typescript
+ * const zaraz = Cloudflare.ZarazConfig.events<{
+ *   Login: { method: "google" | "email" | "email-link" };
+ *   "Button Clicked": { button_label: string; context?: string };
+ * }>();
+ *
+ * const zarazWithEcommerce = Cloudflare.ZarazConfig.events<{
+ *   Login: { method: "google" | "email" | "email-link" };
+ * }>({ ecommerce: true });
+ *
+ * export type AppZarazEvents = Cloudflare.InferZarazEvents<typeof zaraz>;
+ * ```
+ */
+export function defineZarazEvents<const Events extends ZarazEventMap>(options: {
+  readonly ecommerce: true;
+}): ZarazEventContract<Events, ZarazEcommerceEvents>;
+export function defineZarazEvents<
+  const Events extends ZarazEventMap,
+>(options?: { readonly ecommerce?: false }): ZarazEventContract<Events, {}>;
+export function defineZarazEvents<
+  const Events extends ZarazEventMap,
+>(_options?: {
+  readonly ecommerce?: boolean;
+}): ZarazEventContract<Events, ZarazEventMap> {
+  return {} as ZarazEventContract<Events, {}>;
+}
+
+export type InferZarazEvents<Contract> =
+  Contract extends ZarazEventContract<infer Events, ZarazEventMap>
+    ? Events
+    : never;
+
+export type InferZarazEcommerceEvents<Contract> =
+  Contract extends ZarazEventContract<ZarazEventMap, infer EcommerceEvents>
+    ? EcommerceEvents
+    : never;
+
+export type ZarazEventName<Events extends ZarazEventMap> = Extract<
+  keyof Events,
+  string
+>;
+
+export type ZarazEventProperties<
+  Events extends ZarazEventMap,
+  Name extends ZarazEventName<Events>,
+> = Events[Name];
+
+type ZarazEventPropertiesArgs<Properties> = [Properties] extends [undefined]
+  ? [properties?: undefined]
+  : undefined extends Properties
+    ? [properties?: Exclude<Properties, undefined>]
+    : [properties: Properties];
+
+/**
+ * Type for Cloudflare's injected `window.zaraz.track` function.
+ */
+export type ZarazTrack<Events extends ZarazEventMap> = <
+  const Name extends ZarazEventName<Events>,
+>(
+  eventName: Name,
+  ...args: ZarazEventPropertiesArgs<Events[Name]>
+) => Promise<void>;
+
+/**
+ * Type for Cloudflare's injected `window.zaraz.ecommerce` function.
+ */
+export type ZarazEcommerce<Events extends ZarazEventMap> = ZarazTrack<Events>;
+
+export type ZarazSetScope = "page" | "session" | "persist";
+
+/**
+ * Type for Cloudflare's injected browser-side Zaraz API.
+ */
+export type ZarazWebApi<
+  Events extends ZarazEventMap,
+  EcommerceEvents extends ZarazEventMap = {},
+> = {
+  set: (
+    name: string,
+    value: unknown,
+    options?: { scope?: ZarazSetScope },
+  ) => void;
+  track: ZarazTrack<Events>;
+  ecommerce: ZarazEcommerce<EcommerceEvents>;
+  preview: (debugKey: string) => Promise<void>;
+  debug: (debugKey: string) => Promise<void>;
+  showConsentModal: () => Promise<void>;
+  pageVariables: Record<string, unknown>;
+};
+
+export type ZarazSystem = {
+  cookies?: Record<string, unknown>;
+  device?: {
+    ip?: string;
+    resolution?: string;
+    viewport?: string;
+    language?: string;
+    "user-agent"?: string;
+  };
+  page?: {
+    title?: string;
+    url?: string;
+    referrer?: string;
+    encoding?: string;
+  };
+};
+
+export type ZarazClientProperties<
+  Events extends ZarazEventMap,
+  Name extends ZarazEventName<Events> = ZarazEventName<Events>,
+> =
+  Name extends ZarazEventName<Events>
+    ? Events[Name] extends undefined
+      ? { readonly __zarazTrack: Name }
+      : Simplify<Events[Name] & { readonly __zarazTrack: Name }>
+    : never;
+
+export type ZarazHttpEvent<Events extends ZarazEventMap> = {
+  readonly client: ZarazClientProperties<Events>;
+  readonly system?: ZarazSystem;
+};
+
+export type ZarazHttpEventsPayload<Events extends ZarazEventMap> = {
+  readonly events: readonly ZarazHttpEvent<Events>[];
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/index.ts
new file mode 100644
index 00000000000..0aa9591f1a1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zaraz/index.ts
@@ -0,0 +1,25 @@
+export * from "./ZarazConfig.ts";
+export type {
+  InferZarazEcommerceEvents,
+  InferZarazEvents,
+  ZarazClientProperties,
+  ZarazEcommerce,
+  ZarazEcommerceCheckoutStep,
+  ZarazEcommerceEvents,
+  ZarazEcommerceOrder,
+  ZarazEcommercePayment,
+  ZarazEcommerceProduct,
+  ZarazEcommercePromotion,
+  ZarazEcommerceRefund,
+  ZarazEcommerceSearch,
+  ZarazEventContract,
+  ZarazEventMap,
+  ZarazEventName,
+  ZarazEventProperties,
+  ZarazHttpEvent,
+  ZarazHttpEventsPayload,
+  ZarazSetScope,
+  ZarazSystem,
+  ZarazTrack,
+  ZarazWebApi,
+} from "./ZarazEventTypes.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/Zone.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/Zone.ts
new file mode 100644
index 00000000000..ff5ca015326
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/Zone.ts
@@ -0,0 +1,349 @@
+import * as zones from "@distilled.cloud/cloudflare/zones";
+import * as Array from "effect/Array";
+import * as Effect from "effect/Effect";
+import * as Equivalence from "effect/Equivalence";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import { stripNullFields } from "../../Util/data.ts";
+import { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
+import type { Providers } from "../Providers.ts";
+import { findZoneByName } from "./lookup.ts";
+
+export type ZoneType = "full" | "partial" | "secondary" | "internal";
+export type ZoneStatus = "initializing" | "pending" | "active" | "moved";
+
+/** Metadata about the zone (Cloudflare `meta`). */
+export type ZoneMeta = {
+  /** @deprecated Always `false`. */
+  cdnOnly: boolean | undefined;
+  /** Number of allowed custom certificates. */
+  customCertificateQuota: number | undefined;
+  /** @deprecated Always `true`. */
+  dnsOnly: boolean | undefined;
+  /** Whether the zone is on Cloudflare's Foundation DNS plan. */
+  foundationDns: boolean | undefined;
+  /** Number of allowed Page Rules. */
+  pageRuleQuota: number | undefined;
+  /** Whether the zone has been flagged for phishing. */
+  phishingDetected: boolean | undefined;
+  /** Onboarding step the zone is currently on. */
+  step: number | undefined;
+};
+
+/** The owner of the zone (Cloudflare `owner`). */
+export type ZoneOwner = {
+  /** Owner identifier. */
+  id: string | undefined;
+  /** Owner name. */
+  name: string | undefined;
+  /** Owner type (e.g. `user`, `organization`). */
+  type: string | undefined;
+};
+
+/** An organizational unit (tenant) the zone belongs to. */
+export type ZoneTenant = {
+  /** Tenant identifier. */
+  id: string | undefined;
+  /** Tenant name. */
+  name: string | undefined;
+};
+
+/** The immediate parent organizational unit of the zone. */
+export type ZoneTenantUnit = {
+  /** Tenant unit identifier. */
+  id: string | undefined;
+};
+
+/**
+ * Common shape returned by a managed {@link Zone} resource — anything that
+ * needs to point at a Cloudflare Zone can accept this.
+ *
+ * Mirrors Cloudflare's zone object. `zoneId` and `accountId` are Alchemy's
+ * flattened identifiers (Cloudflare exposes these as `id` and `account.id`);
+ * every other field keeps Cloudflare's own (camelCased) name.
+ */
+export type ZoneAttributes = {
+  /** Zone identifier (Cloudflare `id`). Stable across updates. */
+  zoneId: string;
+  /** The fully-qualified domain name (e.g. `example.com`). */
+  name: string;
+  /** Identifier of the account the zone belongs to (Cloudflare `account.id`). */
+  accountId: string;
+  /** Name of the account the zone belongs to (Cloudflare `account.name`). */
+  accountName: string | undefined;
+  /**
+   * Zone type. A full zone hosts its DNS at Cloudflare; a partial zone is a
+   * partner/CNAME setup.
+   */
+  type: ZoneType;
+  /** The zone status on Cloudflare. */
+  status: ZoneStatus | undefined;
+  /**
+   * Whether the zone is DNS-only (Cloudflare's proxy/security features
+   * disabled).
+   */
+  paused: boolean;
+  /** The name servers Cloudflare assigns to the zone. */
+  nameServers: string[];
+  /** The original name servers before the domain moved to Cloudflare. */
+  originalNameServers: string[] | undefined;
+  /** Custom (vanity) name servers. Business/Enterprise plans only. */
+  vanityNameServers: string[] | undefined;
+  /** The last time proof of ownership was detected and the zone activated. */
+  activatedOn: string | undefined;
+  /** When the zone was created. */
+  createdOn: string;
+  /**
+   * The interval (in seconds) until development mode expires (positive) or
+   * since it last expired (negative). `0` if never enabled.
+   */
+  developmentMode: number;
+  /** When the zone was last modified. */
+  modifiedOn: string;
+  /** The DNS host at the time of switching to Cloudflare. */
+  originalDnshost: string | undefined;
+  /** The registrar for the domain at the time of switching to Cloudflare. */
+  originalRegistrar: string | undefined;
+  /** Allows the customer to use a custom apex (tenants-only configuration). */
+  cnameSuffix: string | undefined;
+  /** Verification key for partial zone setup. */
+  verificationKey: string | undefined;
+  /** Metadata about the zone. */
+  meta: ZoneMeta;
+  /** The owner of the zone. */
+  owner: ZoneOwner;
+  /** The root organizational unit (tenant) the zone belongs to. */
+  tenant: ZoneTenant | undefined;
+  /** The immediate parent organizational unit of the zone. */
+  tenantUnit: ZoneTenantUnit | undefined;
+};
+
+export type ZoneProps = {
+  /**
+   * The fully-qualified zone name (e.g. `example.com`). Stable — changing it
+   * triggers a replacement.
+   */
+  name: string;
+  /**
+   * Zone type. Full zones host their own DNS at Cloudflare; partial zones are
+   * partner/CNAME setups.
+   * @default "full"
+   */
+  type?: ZoneType;
+  /**
+   * Pause Cloudflare's proxy on the zone (DNS-only).
+   * @default false
+   */
+  paused?: boolean;
+  /**
+   * Custom (vanity) name servers. Business/Enterprise only.
+   */
+  vanityNameServers?: string[];
+};
+
+export type Zone = Resource<
+  "Cloudflare.Zone",
+  ZoneProps,
+  ZoneAttributes,
+  never,
+  Providers
+>;
+
+/**
+ * A Cloudflare Zone (DNS domain) managed by Alchemy.
+ *
+ * Zones default to **retain** on removal — destroying the stack does NOT
+ * delete the zone in Cloudflare. Opt in to actual deletion by wrapping the
+ * resource (or the whole stack) in {@link destroy}() from
+ * `alchemy/RemovalPolicy`.
+ *
+ * @section Creating a Zone
+ * @example Create a new zone
+ * ```typescript
+ * const zone = yield* Cloudflare.Zone("MyZone", {
+ *   name: "example.com",
+ * });
+ * ```
+ *
+ * @example Allow destruction
+ * ```typescript
+ * import { destroy } from "alchemy/RemovalPolicy";
+ * yield* Cloudflare.Zone("MyZone", { name: "example.com" }).pipe(destroy());
+ * ```
+ *
+ * @section Adopting an existing Zone
+ * @example Take over a zone that already exists in Cloudflare
+ * ```typescript
+ * import { adopt } from "alchemy/AdoptPolicy";
+ * // A zone carries no ownership markers, so the engine refuses to take over a
+ * // pre-existing zone unless you opt in with `adopt(true)`.
+ * const zone = yield* Cloudflare.Zone("MyZone", {
+ *   name: "example.com",
+ * }).pipe(adopt(true));
+ * // zone.zoneId, zone.nameServers, zone.accountId, ...
+ * ```
+ */
+export const Zone = Resource<Zone>("Cloudflare.Zone", {
+  defaultRemovalPolicy: "retain",
+});
+
+export const ZoneProvider = () =>
+  Provider.effect(
+    Zone,
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const get = yield* zones.getZone;
+      const create = yield* zones.createZone;
+      const patch = yield* zones.patchZone;
+      const del = yield* zones.deleteZone;
+
+      return {
+        stables: ["name", "zoneId", "accountId"],
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!output) return undefined;
+          if (!isResolved(news)) return undefined;
+          if (news.name !== output.name) {
+            return { action: "replace" } as const;
+          }
+          const desiredType = news.type ?? "full";
+          const desiredPaused = news.paused ?? false;
+          const desiredVanity = news.vanityNameServers ?? [];
+          if (
+            desiredType !== output.type ||
+            desiredPaused !== output.paused ||
+            !stringArrayEq(desiredVanity, output.vanityNameServers ?? [])
+          ) {
+            return { action: "update" } as const;
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ output, olds }) {
+          const name = output?.name ?? olds?.name;
+          // Owned path: we have persisted state (our own zoneId) — refresh it.
+          if (output?.zoneId) {
+            const result = yield* get({ zoneId: output.zoneId }).pipe(
+              Effect.catch(() => Effect.succeed(undefined)),
+            );
+            if (result) return toZoneAttributes(result, accountId);
+          }
+          // Adoption path: no state of our own, but a zone with this name
+          // already exists in the cloud. Cloudflare zones carry no ownership
+          // markers we can inspect, so we cannot prove we created it — brand
+          // it `Unowned` so the engine refuses to take over unless `adopt` is
+          // set.
+          if (name) {
+            const match = yield* findZoneByName({ accountId, name });
+            if (!match) return undefined;
+            const result = yield* get({ zoneId: match.id });
+            return Unowned(toZoneAttributes(result, accountId));
+          }
+          return undefined;
+        }),
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // 1. Observe — do we have a live zone for this name?
+          let zoneId = output?.zoneId;
+          if (!zoneId) {
+            const match = yield* findZoneByName({
+              accountId,
+              name: news.name,
+            });
+            zoneId = match?.id;
+          }
+
+          // 2. Ensure — create if missing.
+          if (!zoneId) {
+            zoneId = yield* create({
+              account: { id: accountId },
+              name: news.name,
+              type: news.type ?? "full",
+            }).pipe(
+              Effect.map((created) => created.id),
+              // A concurrent deploy (or a prior crashed run) may have created
+              // the zone between our observe and create — recover by resolving
+              // its id rather than failing the reconcile.
+              Effect.catchTag("ZoneAlreadyExists", () =>
+                findZoneByName({ accountId, name: news.name }).pipe(
+                  Effect.flatMap((match) =>
+                    match
+                      ? Effect.succeed(match.id)
+                      : Effect.fail(
+                          new Error(
+                            `Cloudflare reported zone ${news.name} already exists but it could not be found`,
+                          ),
+                        ),
+                  ),
+                ),
+              ),
+            );
+          }
+
+          // 3. Sync — apply mutable settings (type/paused/vanity NS).
+          const observed = yield* get({ zoneId });
+          const desiredType = news.type ?? "full";
+          const desiredPaused = news.paused ?? false;
+          const desiredVanity = news.vanityNameServers ?? [];
+          const needsPatch =
+            (observed.type ?? "full") !== desiredType ||
+            (observed.paused ?? false) !== desiredPaused ||
+            !stringArrayEq(observed.vanityNameServers ?? [], desiredVanity);
+
+          if (needsPatch) {
+            yield* patch({
+              zoneId,
+              type: desiredType,
+              paused: desiredPaused,
+              vanityNameServers: desiredVanity,
+            });
+          }
+
+          const final = yield* get({ zoneId });
+          return toZoneAttributes(final, accountId);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          if (!output.zoneId) return;
+          yield* del({ zoneId: output.zoneId }).pipe(
+            // Zone already gone — idempotent delete.
+            Effect.catchTag("InvalidZoneIdentifier", () => Effect.void),
+          );
+        }),
+      };
+    }),
+  );
+
+/** @internal — shape a distilled zones API result into `ZoneAttributes`. */
+export const toZoneAttributes = (
+  result: zones.GetZoneResponse,
+  fallbackAccountId: string,
+): ZoneAttributes => {
+  // Cloudflare returns `null` for absent fields; drop them so every optional
+  // attribute is simply `undefined` (matching `ZoneAttributes`).
+  const z = stripNullFields(result);
+  return {
+    zoneId: z.id,
+    name: z.name,
+    accountId: z.account.id ?? fallbackAccountId,
+    accountName: z.account.name,
+    type: z.type ?? "full",
+    status: z.status,
+    paused: z.paused ?? false,
+    nameServers: z.nameServers,
+    originalNameServers: z.originalNameServers,
+    vanityNameServers: z.vanityNameServers,
+    activatedOn: z.activatedOn,
+    createdOn: z.createdOn,
+    developmentMode: z.developmentMode,
+    modifiedOn: z.modifiedOn,
+    originalDnshost: z.originalDnshost,
+    originalRegistrar: z.originalRegistrar,
+    cnameSuffix: z.cnameSuffix,
+    verificationKey: z.verificationKey,
+    meta: z.meta,
+    owner: z.owner,
+    tenant: z.tenant,
+    tenantUnit: z.tenantUnit,
+  } as ZoneAttributes;
+};
+
+const stringArrayEq = Array.makeEquivalence(Equivalence.String);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/index.ts
new file mode 100644
index 00000000000..33bcdeac840
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/index.ts
@@ -0,0 +1,2 @@
+export * from "./lookup.ts";
+export * from "./Zone.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/lookup.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/lookup.ts
new file mode 100644
index 00000000000..eed9e23ae43
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Zone/lookup.ts
@@ -0,0 +1,101 @@
+import {
+  Credentials,
+  formatHeaders,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as Effect from "effect/Effect";
+
+/**
+ * Reference to an existing Cloudflare Zone. Accepts:
+ *   - a zone id (32 hex characters),
+ *   - a zone name (`example.com`), or
+ *   - a `{ zoneId, name? }` object (e.g. the output of a `Zone` resource or
+ *     {@link importZone}).
+ */
+export type ZoneReference = string | { zoneId: string; name?: string };
+
+export const isZoneId = (zone: string): boolean => /^[a-f0-9]{32}$/i.test(zone);
+
+export const matchesZoneHostname = (
+  zoneName: string,
+  hostname: string,
+): boolean => hostname === zoneName || hostname.endsWith(`.${zoneName}`);
+
+export const resolveZoneId = ({
+  accountId,
+  zone,
+  hostname,
+}: {
+  accountId: string;
+  zone: ZoneReference | undefined;
+  hostname: string;
+}) =>
+  Effect.gen(function* () {
+    if (typeof zone === "object") return zone.zoneId;
+    if (typeof zone === "string" && isZoneId(zone)) return zone;
+
+    const lookup = zone ?? hostname;
+    for (const candidate of zoneNameCandidates(lookup)) {
+      const match = yield* findZoneByName({ accountId, name: candidate });
+      if (match) return match.id;
+    }
+    return yield* Effect.fail(
+      new Error(`Cloudflare zone not found for ${lookup}`),
+    );
+  });
+
+type ZoneListItem = {
+  id: string;
+  name: string;
+  account: { id?: string | null };
+};
+
+type ZoneListResponse = {
+  success: boolean;
+  errors?: { message?: string }[];
+  result?: ZoneListItem[];
+};
+
+export const findZoneByName = ({
+  accountId,
+  name,
+}: {
+  accountId: string;
+  name: string;
+}): Effect.Effect<ZoneListItem | undefined, Error, Credentials> =>
+  Effect.gen(function* () {
+    const credentialsEffect = yield* Credentials;
+    const credentials = yield* credentialsEffect;
+    const url = new URL(`${credentials.apiBaseUrl}/zones`);
+    url.searchParams.set("account.id", accountId);
+    url.searchParams.set("name", name);
+    url.searchParams.set("per_page", "1");
+
+    const json = yield* Effect.tryPromise({
+      try: async () => {
+        const response = await fetch(url, {
+          headers: formatHeaders(credentials),
+        });
+        return (await response.json()) as ZoneListResponse;
+      },
+      catch: (cause) => new Error(`Failed to list Cloudflare zones`, { cause }),
+    });
+
+    if (!json.success) {
+      return yield* Effect.fail(
+        new Error(
+          json.errors?.map((error) => error.message).join(", ") ??
+            `Failed to list Cloudflare zones`,
+        ),
+      );
+    }
+
+    return json.result?.find(
+      (candidate) =>
+        candidate.name === name && candidate.account.id === accountId,
+    );
+  });
+
+const zoneNameCandidates = (hostname: string): string[] => {
+  const parts = hostname.split(".");
+  return parts.slice(0, -1).map((_, index) => parts.slice(index).join("."));
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/index.ts
new file mode 100644
index 00000000000..1d9680f8260
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/index.ts
@@ -0,0 +1,29 @@
+export * from "./AiGateway/index.ts";
+export * from "./AnalyticsEngine/index.ts";
+export * from "./ApiToken/index.ts";
+export * from "./Artifacts/index.ts";
+export * from "./Browser/index.ts";
+export * from "./CloudflareEnvironment.ts";
+export * from "./Container/index.ts";
+export * from "./D1/index.ts";
+export * from "./Dns/index.ts";
+export * from "./EdgeSession.ts";
+export * from "./Fetcher.ts";
+export * from "./Email/index.ts";
+export * from "./Hyperdrive/index.ts";
+export * from "./Images/index.ts";
+export * from "./KV/index.ts";
+export * from "./Providers.ts";
+export * from "./Queue/index.ts";
+export * from "./R2/index.ts";
+export * from "./RateLimit/index.ts";
+export * from "./SecretsStore/index.ts";
+export * from "./StateStore/index.ts";
+export * from "./Tunnel/index.ts";
+export * from "./Vectorize/index.ts";
+export * from "./VpcService/index.ts";
+export * from "./Website/index.ts";
+export * from "./Workers/index.ts";
+export * from "./Workers/RpcAsync.ts";
+export * from "./Zaraz/index.ts";
+export * from "./Zone/index.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/stream.ts b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/stream.ts
new file mode 100644
index 00000000000..cf6764acee9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Cloudflare/stream.ts
@@ -0,0 +1,20 @@
+import type * as runtime from "@cloudflare/workers-types";
+import * as Predicate from "effect/Predicate";
+import * as Stream from "effect/Stream";
+
+type ReplaceEffectStream<T> =
+  T extends Stream.Stream<any> ? runtime.ReadableStream<any> : T;
+
+/**
+ * If the value is an Effect stream, converts it to a ReadableStream.
+ * Otherwise, returns the value unchanged.
+ */
+export function replaceEffectStream<T>(value: T): ReplaceEffectStream<T> {
+  if (isEffectStream(value)) {
+    return Stream.toReadableStream(value) as ReplaceEffectStream<T>;
+  }
+  return value as ReplaceEffectStream<T>;
+}
+
+const isEffectStream = (value: unknown): value is Stream.Stream<any> =>
+  Predicate.hasProperty(value, "~effect/Stream");
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Construct.ts b/.repos/alchemy-effect/packages/alchemy/src/Construct.ts
new file mode 100644
index 00000000000..45784697c1d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Construct.ts
@@ -0,0 +1,71 @@
+import * as Effect from "effect/Effect";
+import * as Namespace from "./Namespace.ts";
+
+/**
+ * Create a reusable construct that composes child resources under a shared
+ * namespace.
+ *
+ * `Construct.fn` wraps a generator function and automatically pushes the
+ * construct `id` onto the current namespace so nested resources become stable
+ * children of the construct.
+ *
+ * @section Creating Constructs
+ * @example Simple Reusable Construct
+ * ```typescript
+ * import * as Construct from "alchemy/Construct";
+ * import { Bucket } from "alchemy/AWS/S3";
+ *
+ * export const Logs = Construct.fn(function* (
+ *   id: string,
+ *   props: { forceDestroy?: boolean },
+ * ) {
+ *   const bucket = yield* Bucket("Bucket", {
+ *     forceDestroy: props.forceDestroy,
+ *   });
+ *
+ *   return { bucket };
+ * });
+ * ```
+ *
+ * @example Composing Website Resources
+ * ```typescript
+ * export const App = Construct.fn(function* (
+ *   id: string,
+ *   props: { sourcePath: string },
+ * ) {
+ *   const site = yield* StaticSite("Web", {
+ *     sourcePath: props.sourcePath,
+ *     cdn: false,
+ *   });
+ *
+ *   const router = yield* Router("Router", {
+ *     routes: {
+ *       "/*": site.routeTarget,
+ *     },
+ *   });
+ *
+ *   return { site, router };
+ * });
+ * ```
+ */
+export const fn: {
+  <Eff extends Effect.Effect<any, any, any>, AEff, Props extends object>(
+    body: (id: string, props: Props) => Generator<Eff, AEff, never>,
+  ): (
+    id: string,
+    props: Props,
+  ) => Effect.Effect<
+    AEff,
+    [Eff] extends [never]
+      ? never
+      : [Eff] extends [Effect.Effect<infer _A, infer E, infer _R>]
+        ? E
+        : never,
+    [Eff] extends [never]
+      ? never
+      : [Eff] extends [Effect.Effect<infer _A, infer _E, infer R>]
+        ? R
+        : never
+  >;
+} = (body) => (id, props) =>
+  Effect.gen(() => body(id, props)).pipe(Namespace.push(id));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Dependencies.ts b/.repos/alchemy-effect/packages/alchemy/src/Dependencies.ts
new file mode 100644
index 00000000000..42c5cd23b7f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Dependencies.ts
@@ -0,0 +1,10 @@
+import type * as Types from "effect/Types";
+
+export interface Dependencies<A> {
+  /**
+   * Contravariant because it's checked as input to a function (E.g. Counter.from(WorkerA))
+   *
+   * @internal phantom type used to tag the dependencies of a resource
+   */
+  "~alchemy/dependencies": Types.Contravariant<A>;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Deploy.ts b/.repos/alchemy-effect/packages/alchemy/src/Deploy.ts
new file mode 100644
index 00000000000..d5b765d3cf6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Deploy.ts
@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import type * as Scope from "effect/Scope";
+import { AlchemyContext } from "./AlchemyContext.ts";
+import * as Apply from "./Apply.ts";
+import type { Input } from "./Input.ts";
+import * as Plan from "./Plan.ts";
+import { evalStack, type CompiledStack, type StackEffect } from "./Stack.ts";
+import { Stage } from "./Stage.ts";
+
+export const deploy = <A>({
+  stack,
+  stage,
+  dev,
+  scope,
+  force,
+}: {
+  stack: StackEffect<CompiledStack<A>, Stage | AlchemyContext>;
+  stage: string;
+  dev?: boolean;
+  /** See {@link evalStack} — when set, scoped resources outlive `deploy`. */
+  scope?: Scope.Scope;
+  force?: boolean;
+}) =>
+  evalStack(
+    stack,
+    (stack) =>
+      Effect.gen(function* () {
+        const plan = yield* Plan.make(stack, { force });
+        const output = yield* Apply.apply(plan);
+        return output as Input.Resolve<A>;
+      }),
+    { stage, dev, scope },
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Destroy.ts b/.repos/alchemy-effect/packages/alchemy/src/Destroy.ts
new file mode 100644
index 00000000000..bf0a37beaf3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Destroy.ts
@@ -0,0 +1,35 @@
+import { Effect } from "effect";
+import type * as Scope from "effect/Scope";
+import type { AlchemyContext } from "./AlchemyContext.ts";
+import * as Apply from "./Apply.ts";
+import * as Plan from "./Plan.ts";
+import type { CompiledStack, StackEffect } from "./Stack.ts";
+import { evalStack } from "./Stack.ts";
+import type { Stage } from "./Stage.ts";
+
+export const destroy = ({
+  stack,
+  stage,
+  dev,
+  scope,
+}: {
+  stack: StackEffect<CompiledStack, Stage | AlchemyContext>;
+  stage: string;
+  dev?: boolean;
+  /** See {@link evalStack} — when set, scoped resources outlive `destroy`. */
+  scope?: Scope.Scope;
+}) =>
+  evalStack(
+    stack,
+    (stack) =>
+      Plan.make({
+        ...stack,
+        // zero these out (destroy will treat all as orphans)
+        // TODO(sam): probably better to have Plan.destroy and Plan.update
+        resources: {},
+        bindings: {},
+        actions: {},
+        output: {},
+      }).pipe(Effect.flatMap(Apply.apply)),
+    { stage, dev, scope },
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Diff.ts b/.repos/alchemy-effect/packages/alchemy/src/Diff.ts
new file mode 100644
index 00000000000..d9cd66c5172
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Diff.ts
@@ -0,0 +1,176 @@
+import * as Effect from "effect/Effect";
+import type { Input } from "./Input.ts";
+import * as Output from "./Output.ts";
+import type { BindingNode } from "./Plan.ts";
+import type { ResourceBinding } from "./Resource.ts";
+import { isPrimitive } from "./Util/data.ts";
+
+export type Diff = NoopDiff | UpdateDiff | ReplaceDiff;
+
+export interface NoopDiff {
+  action: "noop";
+  stables?: undefined;
+}
+
+export interface UpdateDiff {
+  action: "update";
+  /** properties that won't change as part of this update */
+  stables?: string[];
+}
+
+export interface ReplaceDiff {
+  action: "replace";
+  deleteFirst?: boolean;
+  stables?: undefined;
+}
+
+/**
+ * Returns true when `value` (or any nested leaf) is still an unresolved
+ * plan-time expression — i.e. an `Output`/`Expr` or an `Effect` that was
+ * not fully evaluated by `resolveInput` in Plan.ts.
+ *
+ * Use at the top of a provider `diff` to short-circuit before field access:
+ *
+ * ```ts
+ * if (!isResolved(news)) return undefined;
+ * const resolved = news as MyProps;
+ * ```
+ */
+export const hasUnresolvedInputs = <T>(value: Input<NoInfer<T>>): value is T =>
+  _hasUnresolved(value);
+
+export const isResolved = <T>(value: Input<T>): value is T =>
+  !_hasUnresolved(value);
+
+const _hasUnresolved = (value: unknown): boolean => {
+  if (value == null || isPrimitive(value)) return false;
+  if (Output.isExpr(value) || Effect.isEffect(value)) return true;
+  if (Array.isArray(value)) return value.some(_hasUnresolved);
+  if (typeof value === "object") {
+    return Object.values(value as Record<string, unknown>).some(_hasUnresolved);
+  }
+  return false;
+};
+
+export const somePropsAreDifferent = <Props extends Record<string, any>>(
+  olds: Props,
+  news: Props,
+  props: (keyof Props)[],
+) => {
+  for (const prop of props) {
+    if (olds[prop] !== news[prop]) {
+      return true;
+    }
+  }
+  return false;
+};
+
+export const anyPropsAreDifferent = <Props extends Record<string, any>>(
+  olds: Props,
+  news: Props,
+) => {
+  for (const prop in olds) {
+    if (olds[prop] !== news[prop]) {
+      return true;
+    }
+  }
+  for (const prop in news) {
+    if (!(prop in olds)) {
+      return true;
+    }
+  }
+  return false;
+};
+
+export const havePropsChanged = <Props extends object>(
+  oldProps: Props | undefined,
+  newProps: Props,
+) =>
+  Output.hasOutputs(newProps) ||
+  JSON.stringify(canonicalize(oldProps ?? {}, false)) !==
+    JSON.stringify(canonicalize(newProps ?? {}, false));
+
+export type DeepEqualOptions = {
+  /**
+   * When true, treat `null` and `undefined` as equivalent at any depth.
+   * Useful when comparing cloud-API responses (which often return `null`
+   * for unconfigured optional fields) against desired-state shapes built
+   * from `props?.x` (which leave the same fields `undefined`).
+   *
+   * @default false
+   */
+  stripNullish?: boolean;
+};
+
+/**
+ * Sort-keys deep equality for plain data (objects, arrays, primitives).
+ * Use in provider `diff` handlers instead of ad-hoc `JSON.stringify` comparisons.
+ *
+ * By default, `null` and `undefined` are treated as distinct. Pass
+ * `{ stripNullish: true }` to opt into treating them as equivalent.
+ */
+export const deepEqual = (
+  a: unknown,
+  b: unknown,
+  options?: DeepEqualOptions,
+): boolean =>
+  JSON.stringify(canonicalize(a, options?.stripNullish ?? false)) ===
+  JSON.stringify(canonicalize(b, options?.stripNullish ?? false));
+
+const canonicalize = (value: unknown, stripNullish: boolean): unknown => {
+  if (stripNullish && value == null) return undefined;
+  if (Array.isArray(value)) {
+    return value.map((v) => canonicalize(v, stripNullish));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value)
+        .filter(([, nested]) => !stripNullish || nested != null)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, nested]) => [key, canonicalize(nested, stripNullish)]),
+    );
+  }
+  return value;
+};
+
+/**
+ * Collapse bindings that share the same `sid`, keeping the last occurrence.
+ *
+ * The same binding can be recorded more than once on a target resource — e.g.
+ * a KV namespace bound to both a Worker and a Workflow ends up pushed twice to
+ * `stack.bindings[fqn]`. `diffBindings` already collapses these implicitly via
+ * its `Map` keyed by `sid`, so the `reconcile` path never observes duplicates.
+ * Use this helper to give a provider's `diff` handler the same de-duplicated
+ * binding set, keeping plan-time hashing consistent with deploy-time.
+ */
+export const dedupeBindings = <B extends ResourceBinding>(bindings: B[]): B[] =>
+  Array.from(new Map(bindings.map((b) => [b.sid, b])).values());
+
+export const diffBindings = (
+  oldBindings: ResourceBinding[],
+  newBindings: ResourceBinding[],
+): BindingNode[] => {
+  const oldMap = new Map(oldBindings.map((b) => [b.sid, b]));
+  const newMap = new Map(newBindings.map((b) => [b.sid, b]));
+  return [
+    ...Array.from(oldMap)
+      .filter(([sid]) => !newMap.has(sid))
+      .map(([sid, old]) => ({
+        sid,
+        action: "delete" as const,
+        data: old.data,
+      })),
+    ...Array.from(newMap).map(([sid, binding]) => {
+      const old = oldMap.get(sid);
+      return {
+        sid,
+        action: (!old
+          ? "create"
+          : havePropsChanged(old.data, binding.data)
+            ? "update"
+            : "noop") as BindingNode["action"],
+        data: binding.data,
+      };
+    }),
+  ];
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Postgres.ts b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Postgres.ts
new file mode 100644
index 00000000000..15f36f21bed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Postgres.ts
@@ -0,0 +1,78 @@
+import * as PgClient from "@effect/sql-pg/PgClient";
+import type { AnyRelations, EmptyRelations } from "drizzle-orm";
+import type { EffectPgDatabase } from "drizzle-orm/effect-postgres";
+import * as PgDrizzle from "drizzle-orm/effect-postgres";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { ExecutionContext } from "../ExecutionContext.ts";
+import { proxyChain } from "../Util/proxy-chain.ts";
+
+/**
+ * Open a Drizzle/Postgres database from a connection URL using the
+ * `drizzle-orm/effect-postgres` integration.
+ *
+ * Returns a chainable Proxy over `EffectPgDatabase` (via `proxyChain`) —
+ * every property read records a step, every call records args, and the
+ * chain is replayed against the resolved drizzle db when it's finally
+ * yielded as an Effect. Callers don't need a separate `yield* conn` step:
+ *
+ * ```typescript
+ * const db = yield* Drizzle.postgres(hd.connectionString);
+ *
+ * fetch: Effect.gen(function* () {
+ *   const rows = yield* db.select().from(users);
+ * });
+ * ```
+ *
+ * Behind the scenes the actual connect work is wrapped in `Effect.cached`,
+ * so the pool is built at most once per JS realm. Yielding the
+ * connection string is also deferred until first query, so deploy /
+ * plan-time invocations (where `WorkerEnvironment` isn't provided)
+ * never trigger a real connection attempt.
+ *
+ * The PgClient pool is built against an isolated, never-closing `Scope`
+ * so it outlives whatever scope this helper is yielded under. In a
+ * Cloudflare Worker the surrounding `Cloudflare.Worker` runs init
+ * inside `Effect.scoped`, which closes after returning the exports
+ * object — without an isolated scope, the pool's `end` finalizer
+ * would fire there and every subsequent request would see "Cannot
+ * use a pool after end".
+ *
+ * @binding
+ */
+
+export const postgres = <
+  TRelations extends AnyRelations = EmptyRelations,
+  E = never,
+  R = never,
+>(
+  connectionString: Effect.Effect<Redacted.Redacted<string>, E, R>,
+  config?: PgDrizzle.EffectDrizzlePgConfig<TRelations>,
+) =>
+  Effect.sync(function () {
+    const symbol = Symbol();
+
+    return proxyChain<
+      EffectPgDatabase<TRelations> & {
+        $client: PgClient.PgClient;
+      }
+    >(
+      Effect.gen(function* () {
+        const ctx = yield* ExecutionContext;
+        return yield* (ctx.cache[symbol] ??= yield* Effect.gen(function* () {
+          const pgCtx = yield* Layer.buildWithScope(
+            PgClient.layer({ url: yield* connectionString }),
+            ctx.scope,
+          );
+          return yield* PgDrizzle.makeWithDefaults(config).pipe(
+            Effect.provideContext(pgCtx),
+          );
+        }).pipe(Effect.cached));
+      }) as Effect.Effect<
+        EffectPgDatabase<TRelations> & {
+          $client: PgClient.PgClient;
+        }
+      >,
+    );
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Providers.ts
new file mode 100644
index 00000000000..b1bd11e3a3e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Providers.ts
@@ -0,0 +1,53 @@
+import * as Layer from "effect/Layer";
+import * as Provider from "../Provider.ts";
+import { Schema, SchemaProvider } from "./Schema.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "Drizzle",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Build-time providers for managing Drizzle schemas as Alchemy resources.
+ * Drizzle.Schema regenerates migration SQL via drizzle-kit's programmatic
+ * API on every deploy when the source schema changes.
+ *
+ * @example
+ * ```typescript
+ * import * as Alchemy from "alchemy";
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Drizzle from "alchemy/Drizzle";
+ * import * as Neon from "alchemy/Neon";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ *
+ * export default Alchemy.Stack(
+ *   "MyStack",
+ *   {
+ *     providers: Layer.mergeAll(
+ *       Cloudflare.providers(),
+ *       Drizzle.providers(),
+ *       Neon.providers(),
+ *     ),
+ *     state: Alchemy.localState(),
+ *   },
+ *   Effect.gen(function* () {
+ *     const schema = yield* Drizzle.Schema("app-schema", {
+ *       schema: "./src/schema.ts",
+ *     });
+ *     const project = yield* Neon.Project("app-db");
+ *     const branch = yield* Neon.Branch("app-branch", {
+ *       project,
+ *       migrationsDir: schema.out,
+ *     });
+ *     return { branchId: branch.branchId };
+ *   }),
+ * );
+ * ```
+ */
+export const providers = () =>
+  Layer.effect(Providers, Provider.collection([Schema])).pipe(
+    Layer.provide(SchemaProvider()),
+    Layer.orDie,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Schema.ts b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Schema.ts
new file mode 100644
index 00000000000..07adafc9fd8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/Schema.ts
@@ -0,0 +1,279 @@
+import * as crypto from "node:crypto";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { isResolved } from "../Diff.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import type { Providers } from "./Providers.ts";
+
+export type Dialect = "postgres" | "mysql" | "sqlite";
+
+export type SchemaProps = {
+  /**
+   * Path to the schema module, relative to the current working directory.
+   * The module is loaded via dynamic `import()` so drizzle-kit can introspect
+   * the table definitions, then diffed against the latest snapshot under
+   * `out` to detect changes.
+   *
+   * @example "./src/schema.ts"
+   */
+  schema: string;
+  /**
+   * Output directory for generated migrations. Each migration is written as
+   * `{out}/{timestamp}_migration/{migration.sql, snapshot.json}`. Pass this
+   * value through to `Neon.Branch`/`Cloudflare.D1Database` as `migrationsDir`
+   * to apply pending migrations on deploy.
+   *
+   * @default "./migrations"
+   */
+  out?: string;
+  /**
+   * SQL dialect to generate migrations for. Selects which `drizzle-kit/api-*`
+   * module is loaded.
+   *
+   * @default "postgres"
+   */
+  dialect?: Dialect;
+};
+
+export type Schema = Resource<
+  "Drizzle.Schema",
+  SchemaProps,
+  {
+    /** Absolute path to the migrations directory. */
+    out: string;
+    /**
+     * sha256 of the latest snapshot.json. Stable across deploys when the
+     * schema is unchanged; bumps trigger an update which regenerates pending
+     * migration SQL. Downstream `migrationsDir` consumers read this to
+     * detect drift and reapply.
+     */
+    snapshotHash: string;
+    /** Names of all migration directories under `out`, in order. */
+    migrations: string[];
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Drizzle schema managed as an Alchemy resource.
+ *
+ * Wraps drizzle-kit's programmatic API (`generateDrizzleJson` /
+ * `generateMigration`) so migration SQL is regenerated as part of `alchemy
+ * deploy` whenever the source schema changes. The output directory is
+ * intended to be passed straight to a database resource's `migrationsDir`,
+ * giving you a single deploy-driven flow:
+ *
+ * ```typescript
+ * const schema = yield* Drizzle.Schema("app-schema", {
+ *   schema: "./src/schema.ts",
+ * });
+ *
+ * const branch = yield* Neon.Branch("app-branch", {
+ *   project,
+ *   migrationsDir: schema.out,
+ * });
+ * ```
+ *
+ * `Drizzle.Schema` runs first (because `Neon.Branch` depends on its `out`
+ * output), regenerates pending migration files, and `Neon.Branch` then
+ * applies them transactionally.
+ *
+ * The resource is delete-safe: removing it from the stack does **not** wipe
+ * the migrations directory, since migration files are typically checked in
+ * and shared with other environments.
+ */
+export const Schema = Resource<Schema>("Drizzle.Schema");
+
+const dialectModule = (dialect: Dialect): string => {
+  switch (dialect) {
+    case "postgres":
+      return "drizzle-kit/api-postgres";
+    case "mysql":
+      return "drizzle-kit/api-mysql";
+    case "sqlite":
+      return "drizzle-kit/api-sqlite";
+  }
+};
+
+const sha = (s: string) => crypto.createHash("sha256").update(s).digest("hex");
+
+const tsStamp = () =>
+  new Date().toISOString().replace(/[-:T]/g, "").slice(0, 14);
+
+export const SchemaProvider = () =>
+  Provider.effect(
+    Schema,
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      const resolveOut = (p: SchemaProps) =>
+        path.resolve(process.cwd(), p.out ?? "./migrations");
+
+      const resolveSchema = (p: SchemaProps) =>
+        path.resolve(process.cwd(), p.schema);
+
+      const loadSchemaModule = (p: SchemaProps) =>
+        Effect.tryPromise({
+          try: () =>
+            import(/* @vite-ignore */ resolveSchema(p)) as Promise<
+              Record<string, unknown>
+            >,
+          catch: (cause) =>
+            new Error(`Failed to import schema at ${p.schema}: ${cause}`),
+        });
+
+      const loadKit = (dialect: Dialect) =>
+        Effect.tryPromise({
+          try: () =>
+            import(/* @vite-ignore */ dialectModule(dialect)) as Promise<{
+              generateDrizzleJson: (
+                imports: Record<string, unknown>,
+                prevId?: string,
+                schemaFilters?: string[],
+              ) => Promise<unknown>;
+              generateMigration: (
+                prev: unknown,
+                cur: unknown,
+              ) => Promise<string[]>;
+            }>,
+          catch: (cause) =>
+            new Error(
+              `Failed to load drizzle-kit/${dialect} (is drizzle-kit installed?): ${cause}`,
+            ),
+        });
+
+      // List `<ts>_*` migration directories under `out`, sorted by numeric
+      // prefix. Returns an empty array if `out` doesn't exist.
+      const listMigrationDirs = (out: string) =>
+        Effect.gen(function* () {
+          const exists = yield* fs.exists(out);
+          if (!exists) return [] as string[];
+          const entries = yield* fs.readDirectory(out);
+          return entries.filter((name) => /^\d+_/.test(name)).sort();
+        });
+
+      const readLatestSnapshot = (out: string) =>
+        Effect.gen(function* () {
+          const dirs = yield* listMigrationDirs(out);
+          for (const dir of [...dirs].reverse()) {
+            const snapshotPath = path.join(out, dir, "snapshot.json");
+            const exists = yield* fs.exists(snapshotPath);
+            if (!exists) continue;
+            const text = yield* fs.readFileString(snapshotPath);
+            return { snapshot: JSON.parse(text) as unknown, hash: sha(text) };
+          }
+          return undefined;
+        });
+
+      /**
+       * Run drizzle-kit's diff against the latest stored snapshot and
+       * return whether any SQL statements would be emitted. Used by both
+       * `diff` (to decide whether the resource actually needs an update)
+       * and `regenerate` (to decide whether to write a new migration dir).
+       */
+      const detectDrift = (props: SchemaProps) =>
+        Effect.gen(function* () {
+          const out = resolveOut(props);
+          const dialect = props.dialect ?? "postgres";
+          const kit = yield* loadKit(dialect);
+          const schemaModule = yield* loadSchemaModule(props);
+          const cur = yield* Effect.tryPromise({
+            try: () => kit.generateDrizzleJson(schemaModule),
+            catch: (cause) =>
+              new Error(`drizzle-kit generateDrizzleJson failed: ${cause}`),
+          });
+
+          const prevEntry = yield* readLatestSnapshot(out);
+          // For the initial migration, drizzle-kit needs an *empty* snapshot
+          // produced by `generateDrizzleJson({})`, not a bare `{}` — the
+          // snapshot has internal fields (`ddl`, etc.) that the differ reads.
+          const prev =
+            prevEntry?.snapshot ??
+            (yield* Effect.tryPromise({
+              try: () => kit.generateDrizzleJson({}),
+              catch: (cause) =>
+                new Error(
+                  `drizzle-kit generateDrizzleJson (empty baseline) failed: ${cause}`,
+                ),
+            }));
+          const sqlStatements = yield* Effect.tryPromise({
+            try: () => kit.generateMigration(prev, cur),
+            catch: (cause) =>
+              new Error(`drizzle-kit generateMigration failed: ${cause}`),
+          });
+          return { out, cur, prevEntry, sqlStatements };
+        });
+
+      /**
+       * Generate a new migration directory if the schema has drifted from
+       * the latest snapshot. Returns the new state regardless.
+       */
+      const regenerate = (props: SchemaProps) =>
+        Effect.gen(function* () {
+          const { out, cur, sqlStatements } = yield* detectDrift(props);
+
+          if (sqlStatements.length > 0) {
+            yield* fs.makeDirectory(out, { recursive: true });
+            const dirName = `${tsStamp()}_migration`;
+            const dirPath = path.join(out, dirName);
+            yield* fs.makeDirectory(dirPath, { recursive: true });
+            const sql =
+              sqlStatements.join("\n--> statement-breakpoint\n") + "\n";
+            yield* fs.writeFileString(path.join(dirPath, "migration.sql"), sql);
+            yield* fs.writeFileString(
+              path.join(dirPath, "snapshot.json"),
+              JSON.stringify(cur, null, 2),
+            );
+          }
+
+          const migrations = yield* listMigrationDirs(out);
+          const latest = yield* readLatestSnapshot(out);
+          return {
+            out,
+            snapshotHash: latest?.hash ?? sha(JSON.stringify(cur)),
+            migrations,
+          };
+        });
+
+      return {
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (!output) return undefined;
+          // Only flag an update when drizzle-kit would emit new SQL —
+          // otherwise downstream resources (e.g. Neon.Branch) would see
+          // `schema.out` as an unresolved Output during plan and cascade
+          // into spurious updates of their own.
+          const { sqlStatements } = yield* detectDrift(news);
+          if (sqlStatements.length === 0) return undefined;
+          return { action: "update" } as const;
+        }),
+        read: Effect.fn(function* ({ olds, output }) {
+          if (!output) return undefined;
+          const out = resolveOut(olds ?? ({} as SchemaProps));
+          const exists = yield* fs.exists(out);
+          if (!exists) return undefined;
+          const latest = yield* readLatestSnapshot(out);
+          const migrations = yield* listMigrationDirs(out);
+          return {
+            out,
+            snapshotHash: latest?.hash ?? output.snapshotHash,
+            migrations,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+          yield* session.note(
+            `${output ? "Regenerating" : "Generating"} drizzle migrations for ${news.schema}`,
+          );
+          return yield* regenerate(news);
+        }),
+        delete: Effect.fn(function* () {
+          // Migrations are typically checked in; do not delete on resource
+          // teardown.
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Drizzle/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/index.ts
new file mode 100644
index 00000000000..5a62b54e858
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Drizzle/index.ts
@@ -0,0 +1,3 @@
+export * from "./Postgres.ts";
+export * from "./Providers.ts";
+export * from "./Schema.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/ExecutionContext.ts b/.repos/alchemy-effect/packages/alchemy/src/ExecutionContext.ts
new file mode 100644
index 00000000000..6e3221f5e33
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/ExecutionContext.ts
@@ -0,0 +1,18 @@
+import * as Context from "effect/Context";
+import type { Scope } from "effect/Scope";
+
+/**
+ * The context of an execution in the runtime.
+ *
+ * E.g. the context of a request/event being handled in a Worker or Lambda Function.
+ * E.g. in a serverful environment, it has the lifetime of the whole runtime.
+ */
+export class ExecutionContext extends Context.Service<
+  ExecutionContext,
+  {
+    scope: Scope;
+    cache: {
+      [key: symbol | string]: any;
+    };
+  }
+>()("ExecutionContext") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/FQN.ts b/.repos/alchemy-effect/packages/alchemy/src/FQN.ts
new file mode 100644
index 00000000000..dd673a2701d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/FQN.ts
@@ -0,0 +1,94 @@
+import type { NamespaceNode } from "./Namespace.ts";
+
+/**
+ * Separator used in FQN strings.
+ */
+export const FQN_SEPARATOR = "/";
+
+/**
+ * Encode an FQN for safe filesystem storage.
+ * Replaces `/` (FQN separator) with `__` to avoid subdirectory creation.
+ */
+export const encodeFqn = (fqn: string): string =>
+  fqn.replaceAll(FQN_SEPARATOR, "__");
+
+/**
+ * Decode a filename back to FQN.
+ */
+export const decodeFqn = (filename: string): string =>
+  filename.replaceAll("__", FQN_SEPARATOR);
+
+/**
+ * Convert a NamespaceNode chain to an array of namespace IDs, from root to leaf.
+ *
+ * @example
+ * ```ts
+ * const ns = { Id: "Child", Parent: { Id: "Parent", Parent: { Id: "Root" } } };
+ * toPath(ns); // ["Root", "Parent", "Child"]
+ * ```
+ */
+export const toPath = (ns: NamespaceNode | undefined): string[] => {
+  if (!ns) return [];
+  const path: string[] = [];
+  let current: NamespaceNode | undefined = ns;
+  while (current) {
+    path.unshift(current.Id);
+    current = current.Parent;
+  }
+  return path;
+};
+
+/**
+ * Create a fully-qualified name (FQN) from a namespace and logical ID.
+ * The FQN is a flat key suitable for state storage.
+ *
+ * @example
+ * ```ts
+ * const ns = { Id: "Child", Parent: { Id: "Parent" } };
+ * toFqn(ns, "MyResource"); // "Parent/Child/MyResource"
+ * toFqn(undefined, "MyResource"); // "MyResource"
+ * ```
+ */
+export const toFqn = (
+  ns: NamespaceNode | undefined,
+  logicalId: string,
+): string => {
+  const path = toPath(ns);
+  path.push(logicalId);
+  return path.join(FQN_SEPARATOR);
+};
+
+/**
+ * Parse an FQN back into namespace path segments and the logical ID.
+ *
+ * @example
+ * ```ts
+ * parseFqn("Parent/Child/MyResource"); // { path: ["Parent", "Child"], logicalId: "MyResource" }
+ * parseFqn("MyResource"); // { path: [], logicalId: "MyResource" }
+ * ```
+ */
+export const parseFqn = (
+  fqn: string,
+): { path: string[]; logicalId: string } => {
+  const parts = fqn.split(FQN_SEPARATOR);
+  const logicalId = parts.pop()!;
+  return { path: parts, logicalId };
+};
+
+/**
+ * Reconstruct a NamespaceNode chain from a path array.
+ *
+ * @example
+ * ```ts
+ * fromPath(["Parent", "Child"]);
+ * // { Id: "Child", Parent: { Id: "Parent" } }
+ * ```
+ */
+export const fromPath = (path: string[]): NamespaceNode | undefined => {
+  if (path.length === 0) return undefined;
+  let node: NamespaceNode | undefined;
+  for (const id of path) {
+    node = { Id: id, Parent: node };
+  }
+  return node;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/AuthProvider.ts
new file mode 100644
index 00000000000..f74e3a8f02c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/AuthProvider.ts
@@ -0,0 +1,313 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+const options: Array<{
+  value: GitHubAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "gh-cli",
+    label: "GitHub CLI",
+    hint: "delegate to `gh auth token` (run `gh auth login` first)",
+  },
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "GITHUB_ACCESS_TOKEN or GITHUB_TOKEN",
+  },
+  {
+    value: "stored",
+    label: "Personal Access Token",
+    hint: "enter PAT interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+export type GitHubAuthConfig =
+  | { method: "env" }
+  | { method: "stored" }
+  | { method: "gh-cli" };
+
+export interface GitHubStoredCredentials {
+  type: "pat";
+  token: string;
+}
+
+export interface GitHubResolvedCredentials {
+  type: "token";
+  token: Redacted.Redacted<string>;
+  source: { type: GitHubAuthConfig["method"]; details?: string };
+}
+
+export const GITHUB_AUTH_PROVIDER_NAME = "GitHub";
+
+class GhCliError extends Error {
+  readonly _tag = "GhCliError";
+}
+
+/**
+ * Layer that registers the GitHub {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the GitHub
+ * `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `gh-cli`: shells out to `gh auth token` (recommended).
+ * - `env`: reads `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN`.
+ * - `stored`: prompts for a PAT and writes it to `~/.alchemy/credentials`.
+ *
+ * Browser/device OAuth is intentionally not implemented: GitHub's
+ * OAuth App flow requires a `client_secret` we cannot ship, and
+ * device flow is exactly what `gh auth login` already does.
+ */
+export const GitHubAuth = AuthProviderLayer<
+  GitHubAuthConfig,
+  GitHubResolvedCredentials
+>()(
+  GITHUB_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+    const cp = yield* ChildProcessSpawner;
+
+    const ghCliToken = (): Effect.Effect<string, AuthError> =>
+      Effect.gen(function* () {
+        const handle = yield* cp.spawn(
+          ChildProcess.make("gh", ["auth", "token"], { shell: false }),
+        );
+        const [exitCode, stdout, stderr] = yield* Effect.all(
+          [
+            handle.exitCode,
+            Stream.mkString(Stream.decodeText(handle.stdout)),
+            Stream.mkString(Stream.decodeText(handle.stderr)),
+          ],
+          { concurrency: 3 },
+        );
+        if (exitCode !== 0) {
+          return yield* Effect.fail(
+            new GhCliError(
+              `gh auth token exited with ${exitCode}: ${stderr.trim() || stdout.trim()}`,
+            ),
+          );
+        }
+        const token = stdout.trim();
+        if (!token) {
+          return yield* Effect.fail(
+            new GhCliError("gh auth token returned empty output"),
+          );
+        }
+        return token;
+      }).pipe(
+        Effect.scoped,
+        Effect.mapError((e) =>
+          e instanceof GhCliError
+            ? new AuthError({ message: e.message, cause: e })
+            : new AuthError({
+                message:
+                  "Could not invoke `gh`. Install GitHub CLI from https://cli.github.com/ and run `gh auth login`.",
+                cause: e,
+              }),
+        ),
+      );
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const token = yield* Clank.password({
+        message:
+          "GitHub Personal Access Token (needs `repo` scope; `workflow` for Actions)",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      yield* store.write<GitHubStoredCredentials>(profileName, "gh-stored", {
+        type: "pat",
+        token,
+      });
+      yield* Clank.success("GitHub: credentials saved.");
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "GitHub authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("gh-cli", () =>
+              ghCliToken().pipe(
+                Effect.as({ method: "gh-cli" as const }),
+                Effect.mapError(
+                  (e) =>
+                    new AuthError({
+                      message: `gh CLI not available: ${e.message}`,
+                      cause: e,
+                    }),
+                ),
+              ),
+            ),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: GitHubAuthConfig,
+    ): Effect.Effect<GitHubResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const access = yield* getEnvRedacted("GITHUB_ACCESS_TOKEN");
+            if (access) {
+              return {
+                type: "token" as const,
+                token: access,
+                source: {
+                  type: "env" as const,
+                  details: "GITHUB_ACCESS_TOKEN",
+                },
+              };
+            }
+            const token = yield* getEnvRedacted("GITHUB_TOKEN");
+            if (token) {
+              return {
+                type: "token" as const,
+                token,
+                source: { type: "env" as const, details: "GITHUB_TOKEN" },
+              };
+            }
+            return yield* new AuthError({
+              message:
+                "GitHub env credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+            });
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store.read<GitHubStoredCredentials>(profileName, "gh-stored").pipe(
+            Effect.flatMap((creds) =>
+              creds == null
+                ? Effect.fail(
+                    new AuthError({
+                      message:
+                        "GitHub stored credentials not found. Run: alchemy login --configure",
+                    }),
+                  )
+                : Effect.succeed({
+                    type: "token" as const,
+                    token: Redacted.make(creds.token),
+                    source: { type: "stored" as const },
+                  }),
+            ),
+          ),
+        ),
+        Match.when({ method: "gh-cli" }, () =>
+          ghCliToken().pipe(
+            Effect.map((token) => ({
+              type: "token" as const,
+              token: Redacted.make(token),
+              source: { type: "gh-cli" as const },
+            })),
+          ),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: GitHubAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "gh-cli" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "gh-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("GitHub: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: GitHubAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "gh-cli" }, () =>
+            ghCliToken().pipe(
+              Effect.tap(() =>
+                Clank.success("GitHub: gh CLI authentication available."),
+              ),
+              Effect.asVoid,
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<GitHubStoredCredentials>(profileName, "gh-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: GitHubAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+            Console.log(`  source: ${sourceStr}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Comment.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Comment.ts
new file mode 100644
index 00000000000..dbe04e4f1b5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Comment.ts
@@ -0,0 +1,249 @@
+import { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { dedent } from "../Util/dedent.ts";
+import * as GitHub from "./Providers.ts";
+
+export interface CommentProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Issue or Pull Request number to comment on.
+   */
+  issueNumber: number;
+
+  /**
+   * Comment body (supports GitHub Markdown).
+   *
+   * The body is automatically dedented, so you can use indented template
+   * literals without worrying about leading whitespace. Accepts
+   * `Output<string>` at the call site via `Output.interpolate` to embed
+   * resource attributes that are not yet resolved.
+   */
+  body: string;
+
+  /**
+   * Whether to allow deletion of the comment when the resource is destroyed.
+   * By default, comments are never deleted to preserve discussion history.
+   * @default false
+   */
+  allowDelete?: boolean;
+
+  /**
+   * GitHub API token. If not provided, falls back to
+   * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` environment variables.
+   */
+  token?: string;
+}
+
+export interface Comment extends Resource<
+  "GitHub.Comment",
+  CommentProps,
+  {
+    /**
+     * The numeric ID of the comment in GitHub.
+     */
+    commentId: number;
+
+    /**
+     * URL to view the comment in a browser.
+     */
+    htmlUrl: string;
+
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+  },
+  never,
+  GitHub.Providers
+> {}
+
+/**
+ * A GitHub issue or pull request comment.
+ *
+ * `Comment` manages the lifecycle of a single comment on an issue or pull
+ * request. Comments are created on the first deploy and updated in place on
+ * subsequent deploys when the `body` changes. By default, comments are never
+ * deleted to preserve discussion history — set `allowDelete: true` to opt in.
+ *
+ * Authentication is resolved in order: explicit `token` prop,
+ * `GITHUB_ACCESS_TOKEN` env var, `GITHUB_TOKEN` env var. The token needs
+ * `repo` scope for private repositories or `public_repo` for public ones.
+ *
+ * @section Creating Comments
+ * @example Comment on an Issue
+ * ```typescript
+ * const comment = yield* GitHub.Comment("issue-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This is a comment created by Alchemy!",
+ * });
+ * ```
+ *
+ * @example Comment on a Pull Request
+ * ```typescript
+ * const prComment = yield* GitHub.Comment("pr-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 456,
+ *   body: "## Deployment Status\n\nSuccessfully deployed to staging!",
+ * });
+ * ```
+ *
+ * @section Updating Comments
+ * Deploy with the same logical ID and a different `body` to update the
+ * existing comment in place rather than creating a new one.
+ *
+ * @example Update Comment Content
+ * ```typescript
+ * const comment = yield* GitHub.Comment("status-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 789,
+ *   body: "Deployment completed successfully!",
+ * });
+ * ```
+ *
+ * @section Deleting Comments
+ * @example Allow Comment Deletion
+ * ```typescript
+ * const comment = yield* GitHub.Comment("temp-comment", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   issueNumber: 123,
+ *   body: "This comment can be deleted",
+ *   allowDelete: true,
+ * });
+ * ```
+ *
+ * @section CI Preview Comments
+ * A common pattern is posting a preview-deployment URL on every pull request.
+ * The comment auto-updates on each push because the logical ID stays the same.
+ *
+ * @example PR Preview Comment
+ * ```typescript
+ * if (process.env.PULL_REQUEST) {
+ *   yield* GitHub.Comment("preview-comment", {
+ *     owner: "my-org",
+ *     repository: "my-repo",
+ *     issueNumber: Number(process.env.PULL_REQUEST),
+ *     body: Output.interpolate`
+ *       ## Preview Deployed
+ *
+ *       **URL:** ${website.url}
+ *     `,
+ *   });
+ * }
+ * ```
+ */
+export const Comment = Resource<Comment>("GitHub.Comment");
+
+function resolveToken(props: CommentProps): string | undefined {
+  return (
+    props.token ?? process.env.GITHUB_ACCESS_TOKEN ?? process.env.GITHUB_TOKEN
+  );
+}
+
+function createClient(props: CommentProps): Octokit {
+  return new Octokit({ auth: resolveToken(props) });
+}
+
+export const CommentProvider = () =>
+  Provider.succeed(Comment, {
+    stables: ["commentId"],
+
+    reconcile: Effect.fn(function* ({ news, output }) {
+      const octokit = createClient(news);
+      const body = dedent(news.body);
+
+      // Observe — GitHub assigns `comment_id` server-side. Probe for live
+      // state via the cached id; a 404 (deleted out-of-band, or never
+      // created) collapses to "no observed comment" so we converge by
+      // posting a fresh one.
+      const observedId = output?.commentId
+        ? yield* Effect.tryPromise({
+            try: async () => {
+              try {
+                const { data } = await octokit.rest.issues.getComment({
+                  owner: news.owner,
+                  repo: news.repository,
+                  comment_id: output.commentId,
+                });
+                return data.id;
+              } catch (error: any) {
+                if (error.status === 404) return undefined;
+                throw error;
+              }
+            },
+            catch: (e) => e as Error,
+          })
+        : undefined;
+
+      // Ensure — when no live comment exists, POST creates one.
+      if (observedId === undefined) {
+        const { data } = yield* Effect.tryPromise(() =>
+          octokit.rest.issues.createComment({
+            owner: news.owner,
+            repo: news.repository,
+            issue_number: news.issueNumber,
+            body,
+          }),
+        );
+        return {
+          commentId: data.id,
+          htmlUrl: data.html_url,
+          updatedAt: data.updated_at,
+        };
+      }
+
+      // Sync — PATCH the existing comment with the desired body. GitHub's
+      // updateComment is idempotent for identical bodies (returns same
+      // updatedAt), so we always issue the call rather than diffing.
+      const { data } = yield* Effect.tryPromise(() =>
+        octokit.rest.issues.updateComment({
+          owner: news.owner,
+          repo: news.repository,
+          comment_id: observedId,
+          body,
+        }),
+      );
+      return {
+        commentId: data.id,
+        htmlUrl: data.html_url,
+        updatedAt: data.updated_at,
+      };
+    }),
+
+    delete: Effect.fn(function* ({ olds, output }) {
+      if (!olds.allowDelete) {
+        return;
+      }
+
+      const octokit = createClient(olds);
+
+      yield* Effect.tryPromise(async () => {
+        try {
+          await octokit.rest.issues.deleteComment({
+            owner: olds.owner,
+            repo: olds.repository,
+            comment_id: output.commentId,
+          });
+        } catch (error: any) {
+          if (error.status !== 404) {
+            throw error;
+          }
+        }
+      });
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Credentials.ts
new file mode 100644
index 00000000000..f410ea6e553
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Credentials.ts
@@ -0,0 +1,98 @@
+import { Octokit } from "@octokit/rest";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { AuthError, getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  GITHUB_AUTH_PROVIDER_NAME,
+  type GitHubAuthConfig,
+  type GitHubResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export interface GitHubCredentialsService {
+  readonly token: Redacted.Redacted<string>;
+  readonly octokit: () => Octokit;
+}
+
+export class GitHubCredentials extends Context.Service<
+  GitHubCredentials,
+  GitHubCredentialsService
+>()("GitHub::Credentials") {}
+
+const make = (token: Redacted.Redacted<string>): GitHubCredentialsService => ({
+  token,
+  octokit: () => new Octokit({ auth: Redacted.value(token) }),
+});
+
+/**
+ * Build a `GitHubCredentials` layer from a literal token. Useful for
+ * tests or when callers already have a PAT in hand.
+ */
+export const fromToken = (token: string | Redacted.Redacted<string>) =>
+  Layer.succeed(
+    GitHubCredentials,
+    make(typeof token === "string" ? Redacted.make(token) : token),
+  );
+
+/**
+ * Build a `GitHubCredentials` layer that reads the token from
+ * `GITHUB_ACCESS_TOKEN` or `GITHUB_TOKEN` at layer build time.
+ */
+export const fromEnv = () =>
+  Layer.effect(
+    GitHubCredentials,
+    Effect.gen(function* () {
+      const access = yield* Config.redacted("GITHUB_ACCESS_TOKEN").pipe(
+        Config.option,
+      );
+      const token = yield* Config.redacted("GITHUB_TOKEN").pipe(Config.option);
+      const value =
+        access._tag === "Some"
+          ? access.value
+          : token._tag === "Some"
+            ? token.value
+            : undefined;
+      if (value == null) {
+        return yield* new AuthError({
+          message:
+            "GitHub credentials not found. Set GITHUB_ACCESS_TOKEN or GITHUB_TOKEN.",
+        });
+      }
+      return make(value);
+    }).pipe(Effect.orDie),
+  );
+
+/**
+ * Build a `GitHubCredentials` layer that resolves a token via the
+ * Alchemy AuthProvider for the configured profile (defaults to
+ * `default`, overridable with `ALCHEMY_PROFILE`).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    GitHubCredentials,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        GitHubAuthConfig,
+        GitHubResolvedCredentials
+      >(GITHUB_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as GitHubAuthConfig),
+        ),
+        Effect.map((creds) => make(creds.token)),
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: `Failed to resolve GitHub credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+      );
+    }).pipe(Effect.orDie),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Providers.ts
new file mode 100644
index 00000000000..b613274be83
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Providers.ts
@@ -0,0 +1,36 @@
+import * as Layer from "effect/Layer";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
+import * as Provider from "../Provider.ts";
+import { GitHubAuth } from "./AuthProvider.ts";
+import { Comment, CommentProvider } from "./Comment.ts";
+import * as Credentials from "./Credentials.ts";
+import { Secret, SecretProvider } from "./Secret.ts";
+import { Variable, VariableProvider } from "./Variable.ts";
+
+export { GitHubCredentials } from "./Credentials.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "GitHub",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * GitHub providers (Secret, Variable) plus the GitHub AuthProvider that
+ * `alchemy login` discovers.
+ */
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([Comment, Secret, Variable]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(CommentProvider(), SecretProvider(), VariableProvider()),
+    ),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(GitHubAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.orDie,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Secret.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Secret.ts
new file mode 100644
index 00000000000..e8b8eed26bd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Secret.ts
@@ -0,0 +1,261 @@
+import type { Octokit } from "@octokit/rest";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { GitHubCredentials } from "./Credentials.ts";
+import type * as GitHub from "./Providers.ts";
+
+export interface SecretProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Secret name (e.g. `AWS_ROLE_ARN`).
+   */
+  name: string;
+
+  /**
+   * Secret value. Wrap with `Redacted.make` to prevent the value from
+   * appearing in logs or state.
+   */
+  value: Redacted.Redacted;
+
+  /**
+   * Optional environment name. When set the secret is scoped to that
+   * GitHub Actions environment instead of the whole repository.
+   */
+  environment?: string;
+}
+
+export interface Secret extends Resource<
+  "GitHub.Secret",
+  SecretProps,
+  {
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+  },
+  never,
+  GitHub.Providers
+> {}
+
+/**
+ * A GitHub Actions repository or environment secret.
+ *
+ * `Secret` manages the lifecycle of an encrypted secret in GitHub Actions.
+ * Secrets are encrypted using the repository's (or environment's) public
+ * key via `libsodium` before being stored. The resource is idempotent —
+ * calling it with the same name will update the secret value in place.
+ *
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
+ *
+ * @section Repository Secrets
+ * Store secrets accessible to all GitHub Actions workflows in the
+ * repository.
+ *
+ * @example Create a Repository Secret
+ * ```typescript
+ * yield* GitHub.Secret("aws-role", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @section Environment Secrets
+ * Scope a secret to a specific GitHub Actions environment (e.g.
+ * `production`, `staging`). Environment secrets require environment
+ * protection rules to be satisfied before workflows can access them.
+ *
+ * @example Create an Environment Secret
+ * ```typescript
+ * yield* GitHub.Secret("deploy-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DEPLOY_KEY",
+ *   value: Redacted.make("my-secret-value"),
+ * });
+ * ```
+ *
+ * @section Wiring with Other Resources
+ * A common pattern is wiring the output of another resource — like an
+ * IAM role ARN or a database URL — directly into a GitHub secret so
+ * that CI workflows can use it.
+ *
+ * @example Store an IAM Role ARN for CI
+ * ```typescript
+ * const role = yield* AWS.IAM.Role("ci-role", { ... });
+ *
+ * yield* GitHub.Secret("ci-role-arn", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_ROLE_ARN",
+ *   value: Redacted.make(role.roleArn),
+ * });
+ * ```
+ *
+ * @example Store Multiple Secrets
+ * ```typescript
+ * yield* GitHub.Secret("db-url", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "DATABASE_URL",
+ *   value: Redacted.make(database.connectionString),
+ * });
+ *
+ * yield* GitHub.Secret("api-key", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   environment: "production",
+ *   name: "API_KEY",
+ *   value: Redacted.make(apiKey),
+ * });
+ * ```
+ */
+export const Secret = Resource<Secret>("GitHub.Secret");
+
+const getOctokit = Effect.gen(function* () {
+  const creds = yield* GitHubCredentials;
+  return creds.octokit();
+});
+
+async function encryptValue(
+  plaintext: string,
+  publicKey: string,
+): Promise<string> {
+  const mod = await import("libsodium-wrappers");
+  // Bun/ESM interop: the actual sodium API lives on `.default` when the
+  // CJS module is wrapped, but is the module itself under other loaders.
+  const sodium: typeof import("libsodium-wrappers") =
+    (mod as any).default ?? mod;
+  await sodium.ready;
+  const binKey = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+  const binMessage = sodium.from_string(plaintext);
+  const encrypted = sodium.crypto_box_seal(binMessage, binKey);
+  return sodium.to_base64(encrypted, sodium.base64_variants.ORIGINAL);
+}
+
+export const SecretProvider = () =>
+  Provider.succeed(Secret, {
+    reconcile: Effect.fn(function* ({ news, olds }) {
+      const octokit = yield* getOctokit;
+
+      // Observe — there's no API to read a secret's value back, so we can
+      // only observe its location (repo vs. environment, environment name).
+      // If the location changed, the previous secret is orphaned: delete
+      // it before upserting the new one, otherwise it stays in GitHub as
+      // dead state.
+      if (olds !== undefined) {
+        const wasEnv = !!olds.environment;
+        const isEnv = !!news.environment;
+        if (wasEnv !== isEnv || olds.environment !== news.environment) {
+          yield* deleteSecret(octokit, olds);
+        }
+      }
+
+      // Ensure & Sync — `createOrUpdate*Secret` is upsert-style: it
+      // creates the secret if absent and overwrites it if present. The
+      // value is encrypted client-side with the repo/environment public
+      // key, so we re-encrypt and re-upload on every reconcile (Redacted
+      // values can't be diffed across runs anyway).
+      yield* upsertSecret(octokit, news);
+      return { updatedAt: new Date().toISOString() };
+    }),
+
+    delete: Effect.fn(function* ({ olds }) {
+      const octokit = yield* getOctokit;
+      yield* deleteSecret(octokit, olds);
+    }),
+  });
+
+const upsertSecret = Effect.fn(function* (
+  octokit: Octokit,
+  props: SecretProps,
+) {
+  const plaintext = Redacted.value(props.value);
+  const isEnv = !!props.environment;
+
+  const publicKey = yield* Effect.tryPromise(async () => {
+    if (isEnv) {
+      const { data } = await octokit.rest.actions.getEnvironmentPublicKey({
+        owner: props.owner,
+        repo: props.repository,
+        environment_name: props.environment!,
+      });
+      return data;
+    }
+    const { data } = await octokit.rest.actions.getRepoPublicKey({
+      owner: props.owner,
+      repo: props.repository,
+    });
+    return data;
+  });
+
+  const encrypted = yield* Effect.tryPromise(() =>
+    encryptValue(plaintext, publicKey.key),
+  );
+
+  yield* Effect.tryPromise(async () => {
+    if (isEnv) {
+      await octokit.rest.actions.createOrUpdateEnvironmentSecret({
+        owner: props.owner,
+        repo: props.repository,
+        environment_name: props.environment!,
+        secret_name: props.name,
+        encrypted_value: encrypted,
+        key_id: publicKey.key_id,
+      });
+    } else {
+      await octokit.rest.actions.createOrUpdateRepoSecret({
+        owner: props.owner,
+        repo: props.repository,
+        secret_name: props.name,
+        encrypted_value: encrypted,
+        key_id: publicKey.key_id,
+      });
+    }
+  });
+});
+
+const deleteSecret = Effect.fn(function* (
+  octokit: Octokit,
+  props: SecretProps,
+) {
+  yield* Effect.tryPromise(async () => {
+    try {
+      if (props.environment) {
+        await octokit.rest.actions.deleteEnvironmentSecret({
+          owner: props.owner,
+          repo: props.repository,
+          environment_name: props.environment,
+          secret_name: props.name,
+        });
+      } else {
+        await octokit.rest.actions.deleteRepoSecret({
+          owner: props.owner,
+          repo: props.repository,
+          secret_name: props.name,
+        });
+      }
+    } catch (error: any) {
+      if (error.status !== 404) {
+        throw error;
+      }
+    }
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Secrets.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Secrets.ts
new file mode 100644
index 00000000000..999a31bfb31
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Secrets.ts
@@ -0,0 +1,90 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+import type { Input } from "../Input.ts";
+import * as Output from "../Output.ts";
+import { Secret } from "./Secret.ts";
+
+export interface SecretsProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Optional environment name. When set every secret is scoped to that
+   * GitHub Actions environment instead of the whole repository.
+   */
+  environment?: string;
+
+  /**
+   * Map of secret name to value. Plain strings are wrapped with
+   * `Redacted.make`; already-redacted values are passed through.
+   */
+  secrets: Record<string, Input<string | Redacted.Redacted<string>>>;
+}
+
+/**
+ * Bulk-creates a set of {@link Secret}s in the same repository (and
+ * optionally the same environment).
+ *
+ * Each entry in `secrets` becomes one `GitHub.Secret` resource, using the
+ * map key as both the alchemy logical id and the secret name.
+ *
+ * @example
+ * ```ts
+ * yield* GitHub.Secrets({
+ *   owner: "alchemy-run",
+ *   repository: "alchemy-effect",
+ *   secrets: {
+ *     AXIOM_INGEST_TOKEN: tokenValue,
+ *     AXIOM_DATASET_TRACES: traces.name,
+ *   },
+ * });
+ * ```
+ */
+export const Secrets = ({
+  owner,
+  repository,
+  environment,
+  secrets,
+}: SecretsProps) =>
+  Effect.all(
+    Object.entries(secrets).map(([name, value]) =>
+      Secret(name, {
+        owner,
+        repository,
+        environment,
+        name,
+        value: liftValue(value),
+      }),
+    ),
+  );
+
+// Accepts a plain string, an existing `Redacted<string>`, or an `Output`
+// of either. We must lift via `Output.map` for the `Output` case so the
+// inner string gets wrapped after the engine resolves it — otherwise the
+// `Redacted.make(output)` path produces `Redacted<Output<...>>`, which
+// later double-wraps to `Redacted<Redacted<string>>` and stringifies to
+// `<redacted>` inside `sodium.from_string`.
+const liftValue = (
+  value: Input<string | Redacted.Redacted<string>>,
+): Input<Redacted.Redacted<string>> =>
+  Output.isOutput(value)
+    ? Output.map(
+        value as Output.Output<string | Redacted.Redacted<string>>,
+        toRedacted,
+      )
+    : toRedacted(value as string | Redacted.Redacted<string>);
+
+const toRedacted = (
+  value: string | Redacted.Redacted<string>,
+): Redacted.Redacted<string> =>
+  Redacted.isRedacted(value)
+    ? (value as Redacted.Redacted<string>)
+    : Redacted.make(value);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Variable.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Variable.ts
new file mode 100644
index 00000000000..c4a90dda7a6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Variable.ts
@@ -0,0 +1,181 @@
+import * as Effect from "effect/Effect";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { GitHubCredentials } from "./Credentials.ts";
+import type * as GitHub from "./Providers.ts";
+
+export interface VariableProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Variable name (e.g. `AWS_ROLE_ARN`).
+   */
+  name: string;
+
+  /**
+   * Variable value.
+   */
+  value: string;
+}
+
+export interface Variable extends Resource<
+  "GitHub.Variable",
+  VariableProps,
+  {
+    /**
+     * ISO-8601 timestamp of the last update.
+     */
+    updatedAt: string;
+  },
+  never,
+  GitHub.Providers
+> {}
+
+/**
+ * A GitHub Actions repository variable.
+ *
+ * `Variable` manages the lifecycle of a plain-text configuration variable
+ * in GitHub Actions. Variables are visible in workflow logs and are
+ * suitable for non-sensitive configuration like region names, environment
+ * labels, or feature flags. For sensitive values, use `GitHub.Secret`
+ * instead.
+ *
+ * Authentication is resolved via the `GitHubCredentials` service supplied
+ * by `GitHub.providers()` (which uses the Alchemy AuthProvider — env,
+ * stored PAT, `gh` CLI, or OAuth). The token needs `repo` scope for
+ * private repositories or `public_repo` for public ones.
+ *
+ * @section Repository Variables
+ * Store variables accessible to all GitHub Actions workflows in the
+ * repository.
+ *
+ * @example Create a Repository Variable
+ * ```typescript
+ * yield* GitHub.Variable("aws-region", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_REGION",
+ *   value: "us-east-1",
+ * });
+ * ```
+ *
+ * @section Wiring with Other Resources
+ * Pass output attributes from other resources into GitHub variables so
+ * that CI workflows can reference them.
+ *
+ * @example Store a Worker URL for CI
+ * ```typescript
+ * const worker = yield* Cloudflare.Worker("Api", { ... });
+ *
+ * yield* GitHub.Variable("api-url", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "API_URL",
+ *   value: worker.url!,
+ * });
+ * ```
+ *
+ * @example Multiple Variables
+ * ```typescript
+ * yield* GitHub.Variable("region", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "AWS_REGION",
+ *   value: "us-east-1",
+ * });
+ *
+ * yield* GitHub.Variable("stage", {
+ *   owner: "my-org",
+ *   repository: "my-repo",
+ *   name: "DEPLOY_STAGE",
+ *   value: "production",
+ * });
+ * ```
+ */
+export const Variable = Resource<Variable>("GitHub.Variable");
+
+const getOctokit = Effect.gen(function* () {
+  const creds = yield* GitHubCredentials;
+  return creds.octokit();
+});
+
+export const VariableProvider = () =>
+  Provider.succeed(Variable, {
+    reconcile: Effect.fn(function* ({ news }) {
+      const octokit = yield* getOctokit;
+
+      // Observe — `name` is the path identifier for repo variables; ask
+      // GitHub directly for the live row. A 404 means it doesn't exist
+      // (deleted out-of-band, or never created), so we converge by
+      // creating it; otherwise we PATCH the value.
+      const observed = yield* Effect.tryPromise({
+        try: async () => {
+          try {
+            const { data } = await octokit.rest.actions.getRepoVariable({
+              owner: news.owner,
+              repo: news.repository,
+              name: news.name,
+            });
+            return data;
+          } catch (error: any) {
+            if (error.status === 404) return undefined;
+            throw error;
+          }
+        },
+        catch: (e) => e as Error,
+      });
+
+      // Ensure — POST creates the variable.
+      if (observed === undefined) {
+        yield* Effect.tryPromise(() =>
+          octokit.rest.actions.createRepoVariable({
+            owner: news.owner,
+            repo: news.repository,
+            name: news.name,
+            value: news.value,
+          }),
+        );
+        return { updatedAt: new Date().toISOString() };
+      }
+
+      // Sync — PATCH the value if it drifted; skip the call when the
+      // observed value already matches to keep the API quiet.
+      if (observed.value !== news.value) {
+        yield* Effect.tryPromise(() =>
+          octokit.rest.actions.updateRepoVariable({
+            owner: news.owner,
+            repo: news.repository,
+            name: news.name,
+            value: news.value,
+          }),
+        );
+      }
+      return { updatedAt: new Date().toISOString() };
+    }),
+
+    delete: Effect.fn(function* ({ olds }) {
+      const octokit = yield* getOctokit;
+
+      yield* Effect.tryPromise(async () => {
+        try {
+          await octokit.rest.actions.deleteRepoVariable({
+            owner: olds.owner,
+            repo: olds.repository,
+            name: olds.name,
+          });
+        } catch (error: any) {
+          if (error.status !== 404) {
+            throw error;
+          }
+        }
+      });
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/Variables.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Variables.ts
new file mode 100644
index 00000000000..6ae788b7410
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/Variables.ts
@@ -0,0 +1,54 @@
+import * as Effect from "effect/Effect";
+
+import type { Input } from "../Input.ts";
+import { Variable } from "./Variable.ts";
+
+export interface VariablesProps {
+  /**
+   * Repository owner (user or organization).
+   */
+  owner: string;
+
+  /**
+   * Repository name.
+   */
+  repository: string;
+
+  /**
+   * Map of variable name to value. Each entry becomes one
+   * `GitHub.Variable` resource, using the map key as both the alchemy
+   * logical id and the variable name.
+   */
+  variables: Record<string, Input<string>>;
+}
+
+/**
+ * Bulk-creates a set of {@link Variable}s in the same repository.
+ *
+ * Plural counterpart of {@link import("./Secrets.ts").Secrets}, for
+ * non-sensitive values like region names, role ARNs, environment labels,
+ * or feature flags.
+ *
+ * @example
+ * ```ts
+ * yield* GitHub.Variables({
+ *   owner: "alchemy-run",
+ *   repository: "alchemy-effect",
+ *   variables: {
+ *     AWS_ROLE_ARN: role.roleArn,
+ *     AWS_REGION: region,
+ *   },
+ * });
+ * ```
+ */
+export const Variables = ({ owner, repository, variables }: VariablesProps) =>
+  Effect.all(
+    Object.entries(variables).map(([name, value]) =>
+      Variable(name, {
+        owner,
+        repository,
+        name,
+        value,
+      }),
+    ),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/GitHub/index.ts b/.repos/alchemy-effect/packages/alchemy/src/GitHub/index.ts
new file mode 100644
index 00000000000..e0adea98ade
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/GitHub/index.ts
@@ -0,0 +1,8 @@
+export * as Auth from "./AuthProvider.ts";
+export * from "./Comment.ts";
+export { GitHubCredentials, fromEnv, fromToken } from "./Credentials.ts";
+export * from "./Providers.ts";
+export * from "./Secret.ts";
+export * from "./Secrets.ts";
+export * from "./Variable.ts";
+export * from "./Variables.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Http.ts b/.repos/alchemy-effect/packages/alchemy/src/Http.ts
new file mode 100644
index 00000000000..e6a4c95d891
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Http.ts
@@ -0,0 +1,127 @@
+import * as Cause from "effect/Cause";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import type { Scope } from "effect/Scope";
+import type { HttpBodyError } from "effect/unstable/http/HttpBody";
+import type { HttpServerError } from "effect/unstable/http/HttpServerError";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export type HttpEffect<Req = never> = Effect.Effect<
+  HttpServerResponse.HttpServerResponse,
+  HttpServerError | HttpBodyError,
+  HttpServerRequest | Scope | Req
+>;
+
+export const serve = <Req = never>(
+  handler: Effect.Effect<
+    HttpServerResponse.HttpServerResponse,
+    HttpServerError | HttpBodyError,
+    HttpServerRequest | Scope | Req
+  >,
+) =>
+  Effect.serviceOption(HttpServer).pipe(
+    Effect.map(Option.getOrUndefined),
+    Effect.flatMap((http) => (http ? http.serve(handler) : Effect.void)),
+  );
+
+export class HttpServer extends Context.Service<
+  HttpServer,
+  {
+    serve: <Req = never>(
+      handler: Effect.Effect<
+        HttpServerResponse.HttpServerResponse,
+        HttpServerError | HttpBodyError,
+        Req
+      >,
+      options?: {
+        port?: number;
+      },
+    ) => Effect.Effect<void, never, Exclude<Req, HttpServerRequest> | Scope>;
+  }
+>()("HttpServer") {}
+
+export const safeHttpEffect = <Req = never>(
+  handler: HttpEffect<Req> | Effect.Effect<HttpEffect<Req>>,
+): Effect.Effect<
+  HttpServerResponse.HttpServerResponse,
+  never,
+  Req | HttpServerRequest | Scope
+> =>
+  Effect.catchCause(
+    handler.pipe(
+      // @ts-expect-error
+      Effect.flatMap((response) =>
+        HttpServerResponse.isHttpServerResponse(response)
+          ? Effect.succeed(response)
+          : response,
+      ),
+    ) as any as HttpEffect<Req>,
+    (cause) => {
+      // ClientAbort interrupts are not real failures — the client closed
+      // the connection. Skip logging and respond with 499 if applicable.
+      if (Cause.hasInterruptsOnly(cause)) {
+        return Effect.succeed(HttpServerResponse.empty({ status: 499 }));
+      }
+      // Log the full cause server-side so operators can debug, but return
+      // a generic 500 to the client. Causes can contain sensitive data
+      // (prompt contents, API keys baked into error messages, internal
+      // file paths) and should never be echoed back to the network.
+      return Effect.logError("HTTP handler failed", cause).pipe(
+        Effect.as(
+          HttpServerResponse.text("Internal Server Error", {
+            status: 500,
+            statusText: "Internal Server Error",
+          }),
+        ),
+      );
+    },
+  );
+
+export const resolvePort = (options: { port?: number } | undefined) =>
+  options?.port !== undefined
+    ? Effect.succeed(options.port)
+    : Config.number("PORT").pipe(Config.withDefault(3000));
+
+export const BunHttpServer = () =>
+  Layer.effect(
+    HttpServer,
+    Effect.gen(function* () {
+      const BunHttpServerPlatform = yield* Effect.promise(
+        () => import("@effect/platform-bun/BunHttpServer"),
+      );
+      return {
+        serve: (handler, options) =>
+          Effect.gen(function* () {
+            const port = yield* resolvePort(options);
+            const server = yield* BunHttpServerPlatform.make({ port });
+            yield* server.serve(safeHttpEffect(handler));
+          }).pipe(Effect.orDie),
+      };
+    }),
+  );
+
+export const NodeHttpServer = () =>
+  Layer.effect(
+    HttpServer,
+    Effect.gen(function* () {
+      const NodeHttpServerPlatform = yield* Effect.promise(
+        () => import("@effect/platform-node/NodeHttpServer"),
+      );
+      const NodeHttp = yield* Effect.promise(() => import("node:http"));
+      return {
+        serve: (handler, options) =>
+          Effect.gen(function* () {
+            const port = yield* resolvePort(options);
+            const server = yield* NodeHttpServerPlatform.make(
+              NodeHttp.createServer,
+              { port },
+            );
+            yield* server.serve(safeHttpEffect(handler));
+          }).pipe(Effect.orDie),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Input.ts b/.repos/alchemy-effect/packages/alchemy/src/Input.ts
new file mode 100644
index 00000000000..5430cfb2567
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Input.ts
@@ -0,0 +1,93 @@
+import type { Config } from "effect/Config";
+import type { Effect } from "effect/Effect";
+import type * as S from "effect/Schema";
+import type { Primitive } from ".//Util/data.ts";
+import type { Output } from "./Output.ts";
+
+export type Function = (...args: any[]) => any;
+export type Constructor = new (...args: any[]) => any;
+type PolicyLike = { kind: "alchemy/Policy" };
+
+export type Input<T> =
+  | T
+  | Output<T>
+  | Config<T>
+  // TODO(sam): extract Requirements in Resource
+  | Effect<T, any, any>
+  | (T extends S.Schema<any>
+      ? never
+      :
+          | Output<T, any>
+          | (T extends Primitive
+              ? never
+              : T extends any[]
+                ? number extends T["length"]
+                  ? Input<T[number]>[]
+                  : Inputs<T>
+                : T extends object
+                  ? { [K in keyof T]: Input<T[K]> }
+                  : never));
+
+export type InputProps<
+  T extends Record<string, any>,
+  Static extends keyof T = never,
+> = {
+  [K in keyof T]: K extends Static ? T[K] : Input<T[K]>;
+};
+
+export declare namespace Input {
+  export type Resolve<T> = T extends {
+    Type: string;
+    Attributes: infer Attributes;
+  }
+    ? {
+        [K in keyof Attributes]: Resolve<Attributes[K]>;
+      }
+    : T extends Output<infer U>
+      ? U
+      : T extends
+            | Primitive
+            | Constructor
+            | Function
+            | S.Schema<any>
+            | PolicyLike
+        ? T
+        : T extends any[]
+          ? ResolveArray<T>
+          : T extends Record<string, any>
+            ? {
+                [k in keyof T]: Input.Resolve<T[k]>;
+              }
+            : never;
+
+  export type ResolveArray<T extends any[]> = number extends T["length"]
+    ? Resolve<T[number]>[]
+    : ResolveTuple<T>;
+
+  export type ResolveTuple<
+    T extends any[],
+    // TODO(sam): I added the accumulator because it resolved infinite type instantiation
+    Accum extends any[] = [],
+  > = T extends [infer H, ...infer Tail]
+    ? ResolveTuple<Tail, [...Accum, Input.Resolve<H>]>
+    : Accum;
+
+  export type ResolveProps<Props extends Record<string, any>> = {
+    [k in keyof Props]: Input.Resolve<Props[k]>;
+  };
+
+  export type ResolveOpaque<T> =
+    // use true extends IsOut to avoid distribution in the case where we have an Out<T>
+    // because T is a clean type, e.g. Input<SubnetProps> should just be SubnetProps (don't bother resolving the recursive input type variants)
+    true extends IsOut<T> ? ResolveOut<T> : Resolve<T>;
+  export type IsOut<T> = T extends Output<infer _U> ? true : never;
+
+  export type ResolveOut<T> = T extends Output<infer U> ? U : never;
+}
+
+export type Inputs<T extends any[], Out extends any[] = []> = T extends [
+  infer H,
+  ...infer T,
+]
+  ? Inputs<T, [...Out, Input<H>]>
+  : Out;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/InstanceId.ts b/.repos/alchemy-effect/packages/alchemy/src/InstanceId.ts
new file mode 100644
index 00000000000..231a88e748c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/InstanceId.ts
@@ -0,0 +1,19 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+
+/** A 16-byte (128-bit) random hex-encoded string representing an physical instance of a logical resource */
+export class InstanceId extends Context.Service<InstanceId, string>()(
+  "instance-id",
+) {}
+
+/**
+ * @returns Hex-encoded instance ID (16 random bytes)
+ */
+export const generateInstanceId = () =>
+  Effect.sync(() => {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes)
+      .map((b) => b.toString(16).padStart(2, "0"))
+      .join("");
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/KeyPair.ts b/.repos/alchemy-effect/packages/alchemy/src/KeyPair.ts
new file mode 100644
index 00000000000..d693759371e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/KeyPair.ts
@@ -0,0 +1,146 @@
+import * as NodeCrypto from "node:crypto";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Provider from "./Provider.ts";
+import { Resource } from "./Resource.ts";
+
+export type KeyPairAlgorithm = "ed25519" | "rsa" | "ec";
+
+export interface KeyPairProps {
+  /**
+   * Key algorithm used to generate the pair.
+   * @default "ed25519"
+   */
+  algorithm?: KeyPairAlgorithm;
+  /**
+   * Modulus length in bits. Only used when {@link algorithm} is `"rsa"`.
+   * @default 2048
+   */
+  modulusLength?: number;
+  /**
+   * Named curve. Only used when {@link algorithm} is `"ec"`.
+   * @default "P-256"
+   */
+  namedCurve?: string;
+}
+
+export type KeyPair = Resource<
+  "Alchemy.KeyPair",
+  KeyPairProps,
+  {
+    algorithm: KeyPairAlgorithm;
+    privateKey: Redacted.Redacted<string>;
+    publicKey: string;
+  }
+>;
+
+/**
+ * A deterministic-in-state public/private keypair generator.
+ *
+ * The keypair is generated once on first reconcile and then persisted in
+ * state so subsequent deploys keep the same keys unless the resource is
+ * replaced. `privateKey` is PEM-encoded `pkcs8` and `publicKey` is
+ * PEM-encoded `spki`.
+ *
+ * @resource
+ *
+ * @section Generating a Keypair
+ * @example Default ed25519 keypair
+ * ```typescript
+ * const keys = yield* KeyPair("signing-key");
+ * // keys.privateKey: Redacted<string>  (PEM pkcs8)
+ * // keys.publicKey:  string            (PEM spki)
+ * // keys.algorithm:  "ed25519"
+ * ```
+ *
+ * @example RSA keypair
+ * ```typescript
+ * const keys = yield* KeyPair("rsa-key", {
+ *   algorithm: "rsa",
+ *   modulusLength: 2048,
+ * });
+ * ```
+ *
+ * @example EC keypair on a named curve
+ * ```typescript
+ * const keys = yield* KeyPair("ec-key", {
+ *   algorithm: "ec",
+ *   namedCurve: "P-256",
+ * });
+ * ```
+ *
+ * @section Consuming the Keys
+ * @example Pass the private key to a Worker as a secret
+ * ```typescript
+ * const keys = yield* KeyPair("signing-key");
+ * export const Worker = Cloudflare.Worker("Worker", {
+ *   main: "./src/worker.ts",
+ *   bindings: {
+ *     SIGNING_KEY: keys.privateKey,
+ *     PUBLIC_KEY: keys.publicKey,
+ *   },
+ * });
+ * ```
+ */
+export const KeyPair = Resource<KeyPair>("Alchemy.KeyPair");
+
+const pemEncoding = {
+  privateKeyEncoding: { type: "pkcs8", format: "pem" },
+  publicKeyEncoding: { type: "spki", format: "pem" },
+} as const;
+
+const generate = (
+  props: KeyPairProps,
+): {
+  privateKey: string;
+  publicKey: string;
+  algorithm: KeyPairAlgorithm;
+} => {
+  const algorithm = props.algorithm ?? "ed25519";
+  if (algorithm === "rsa") {
+    const { privateKey, publicKey } = NodeCrypto.generateKeyPairSync("rsa", {
+      modulusLength: props.modulusLength ?? 2048,
+      ...pemEncoding,
+    });
+    return { algorithm, privateKey, publicKey };
+  }
+  if (algorithm === "ec") {
+    const { privateKey, publicKey } = NodeCrypto.generateKeyPairSync("ec", {
+      namedCurve: props.namedCurve ?? "P-256",
+      ...pemEncoding,
+    });
+    return { algorithm, privateKey, publicKey };
+  }
+  const { privateKey, publicKey } = NodeCrypto.generateKeyPairSync(
+    "ed25519",
+    pemEncoding,
+  );
+  return { algorithm, privateKey, publicKey };
+};
+
+export const KeyPairProvider = () =>
+  Provider.succeed(KeyPair, {
+    reconcile: Effect.fn(function* ({ news = {}, output }) {
+      // Observe — there is no remote state. The cached `output` is the
+      // authoritative current value; once minted the keypair is preserved
+      // across reconciles to keep it stable.
+      if (output?.privateKey && output?.publicKey) {
+        return output;
+      }
+
+      // Ensure — no observed value: mint a fresh keypair. The next
+      // reconcile will see this in `output` and short-circuit above.
+      const generated = yield* Effect.sync(() => generate(news));
+      return {
+        algorithm: generated.algorithm,
+        privateKey: Redacted.make(generated.privateKey),
+        publicKey: generated.publicKey,
+      };
+    }),
+    delete: Effect.fn(function* () {
+      return undefined;
+    }),
+    read: Effect.fn(function* ({ output }) {
+      return output;
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/ConfigMap.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/ConfigMap.ts
new file mode 100644
index 00000000000..1b4230eeacb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/ConfigMap.ts
@@ -0,0 +1,59 @@
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import { metadataWithNamespace } from "./common.ts";
+import { Object, type ObjectRef } from "./Object.ts";
+
+export interface ConfigMapProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | ObjectRef;
+  /**
+   * Optional explicit config map name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Config map string data.
+   */
+  data?: Record<string, string>;
+  /**
+   * Config map labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Config map annotations.
+   */
+  annotations?: Record<string, string>;
+}
+
+/**
+ * A Kubernetes config map bound to an EKS cluster.
+ *
+ * @example Create a config map
+ * ```typescript
+ * const config = yield* ConfigMap("app-config", {
+ *   cluster,
+ *   namespace: "default",
+ *   data: {
+ *     LOG_LEVEL: "debug",
+ *   },
+ * });
+ * ```
+ */
+export const ConfigMap = (id: string, props: ConfigMapProps) =>
+  Object(id, {
+    cluster: props.cluster,
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: metadataWithNamespace(props.namespace, {
+      name: props.name,
+      labels: props.labels,
+      annotations: props.annotations,
+    }),
+    body: {
+      data: props.data,
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Deployment.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Deployment.ts
new file mode 100644
index 00000000000..fb30bf05b03
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Deployment.ts
@@ -0,0 +1,123 @@
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import { metadataWithNamespace, objectNameOf } from "./common.ts";
+import { Object, type ObjectRef } from "./Object.ts";
+
+export interface ContainerPort {
+  containerPort: number;
+  name?: string;
+}
+
+export interface ContainerEnvVar {
+  name: string;
+  value: string;
+}
+
+export interface ContainerResourceList {
+  cpu?: string;
+  memory?: string;
+}
+
+export interface ContainerResources {
+  requests?: ContainerResourceList;
+  limits?: ContainerResourceList;
+}
+
+export interface ContainerSpec {
+  name: string;
+  image: string;
+  command?: string[];
+  args?: string[];
+  env?: ContainerEnvVar[];
+  ports?: ContainerPort[];
+  resources?: ContainerResources;
+}
+
+export interface DeploymentProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | ObjectRef;
+  /**
+   * Optional explicit deployment name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Deployment labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Pod labels. Defaults to `labels`.
+   */
+  podLabels?: Record<string, string>;
+  /**
+   * Replica count.
+   * @default 1
+   */
+  replicas?: number;
+  /**
+   * Service account name for the pod template.
+   */
+  serviceAccountName?: string | { name: string } | ObjectRef;
+  /**
+   * Container specs for the pod template.
+   */
+  containers: ContainerSpec[];
+}
+
+/**
+ * A Kubernetes deployment bound to an EKS cluster.
+ *
+ * @example Deploy a simple workload
+ * ```typescript
+ * const app = yield* Deployment("api", {
+ *   cluster,
+ *   namespace: "default",
+ *   containers: [
+ *     {
+ *       name: "api",
+ *       image: "nginx:latest",
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const Deployment = (id: string, props: DeploymentProps) => {
+  const name = props.name ?? id;
+  const labels = props.labels ?? {
+    "app.kubernetes.io/name": name,
+  };
+  const podLabels = props.podLabels ?? labels;
+
+  return Object(id, {
+    cluster: props.cluster,
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata: metadataWithNamespace(props.namespace, {
+      name,
+      labels,
+    }),
+    body: {
+      spec: {
+        replicas: props.replicas ?? 1,
+        selector: {
+          matchLabels: podLabels,
+        },
+        template: {
+          metadata: {
+            labels: podLabels,
+          },
+          spec: {
+            serviceAccountName: props.serviceAccountName
+              ? objectNameOf(props.serviceAccountName)
+              : undefined,
+            containers: props.containers,
+          },
+        },
+      },
+    },
+  });
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Job.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Job.ts
new file mode 100644
index 00000000000..c30e21623f2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Job.ts
@@ -0,0 +1,82 @@
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import { metadataWithNamespace, objectNameOf } from "./common.ts";
+import { Object, type ObjectRef } from "./Object.ts";
+import type { ContainerSpec } from "./Deployment.ts";
+
+export interface JobProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | ObjectRef;
+  /**
+   * Optional explicit job name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Job labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Restart policy.
+   * @default "Never"
+   */
+  restartPolicy?: "Never" | "OnFailure";
+  /**
+   * Service account name for the pod template.
+   */
+  serviceAccountName?: string | { name: string } | ObjectRef;
+  /**
+   * Pod containers.
+   */
+  containers: ContainerSpec[];
+}
+
+/**
+ * A Kubernetes job bound to an EKS cluster.
+ *
+ * @example Run a one-shot job
+ * ```typescript
+ * const job = yield* Job("seed", {
+ *   cluster,
+ *   namespace: "default",
+ *   containers: [
+ *     {
+ *       name: "seed",
+ *       image: "busybox:latest",
+ *       command: ["/bin/sh", "-lc"],
+ *       args: ["echo hello"],
+ *     },
+ *   ],
+ * });
+ * ```
+ */
+export const Job = (id: string, props: JobProps) =>
+  Object(id, {
+    cluster: props.cluster,
+    apiVersion: "batch/v1",
+    kind: "Job",
+    metadata: metadataWithNamespace(props.namespace, {
+      name: props.name,
+      labels: props.labels,
+    }),
+    body: {
+      spec: {
+        template: {
+          metadata: {
+            labels: props.labels,
+          },
+          spec: {
+            restartPolicy: props.restartPolicy ?? "Never",
+            serviceAccountName: props.serviceAccountName
+              ? objectNameOf(props.serviceAccountName)
+              : undefined,
+            containers: props.containers,
+          },
+        },
+      },
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Namespace.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Namespace.ts
new file mode 100644
index 00000000000..b61f8aa8485
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Namespace.ts
@@ -0,0 +1,49 @@
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import type * as Effect from "effect/Effect";
+import { Object, type ObjectRef } from "./Object.ts";
+
+export interface NamespaceProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Optional explicit namespace name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Namespace labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Namespace annotations.
+   */
+  annotations?: Record<string, string>;
+}
+
+export interface Namespace extends ObjectRef {
+  kind: "Namespace";
+  namespace: undefined;
+}
+
+/**
+ * A Kubernetes namespace bound to an EKS cluster.
+ *
+ * @example Create a namespace
+ * ```typescript
+ * const ns = yield* Namespace("demo", {
+ *   cluster,
+ * });
+ * ```
+ */
+export const Namespace = (id: string, props: NamespaceProps) =>
+  Object(id, {
+    cluster: props.cluster,
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+      name: props.name,
+      labels: props.labels,
+      annotations: props.annotations,
+    },
+  }) as Effect.Effect<Namespace>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Object.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Object.ts
new file mode 100644
index 00000000000..50dc53849f5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Object.ts
@@ -0,0 +1,99 @@
+import * as Effect from "effect/Effect";
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import {
+  kubernetesBindingSid,
+  kubernetesObjectKey,
+  toKubernetesObjectRef,
+  type KubernetesObjectDefinition,
+  type KubernetesObjectMetadata,
+} from "./types.ts";
+
+export interface ObjectProps {
+  /**
+   * Target EKS cluster that will own this Kubernetes object.
+   */
+  cluster: Cluster;
+  /**
+   * Kubernetes API version.
+   */
+  apiVersion: string;
+  /**
+   * Kubernetes kind.
+   */
+  kind: string;
+  /**
+   * Object metadata. `name` defaults to the logical id.
+   */
+  metadata?: Omit<KubernetesObjectMetadata, "name"> & {
+    name?: string;
+  };
+  /**
+   * Extra top-level fields merged into the final Kubernetes object.
+   */
+  body?: Record<string, unknown>;
+}
+
+export interface ObjectRef {
+  cluster: Cluster;
+  apiVersion: string;
+  kind: string;
+  name: string;
+  namespace: string | undefined;
+  key: string;
+  object: KubernetesObjectDefinition;
+}
+
+/**
+ * Binds a Kubernetes object definition onto an `AWS.EKS.Cluster`.
+ *
+ * This is the low-level escape hatch for TypeScript-defined Kubernetes objects.
+ *
+ * @example Bind a raw Kubernetes object
+ * ```typescript
+ * const object = yield* Object("demo", {
+ *   cluster,
+ *   apiVersion: "v1",
+ *   kind: "ConfigMap",
+ *   metadata: {
+ *     namespace: "default",
+ *   },
+ *   body: {
+ *     data: {
+ *       EXAMPLE: "true",
+ *     },
+ *   },
+ * });
+ * ```
+ */
+const KubernetesObject = Effect.fn(function* (id: string, props: ObjectProps) {
+  const object = {
+    apiVersion: props.apiVersion,
+    kind: props.kind,
+    metadata: {
+      name: props.metadata?.name ?? id,
+      namespace: props.metadata?.namespace,
+      labels: props.metadata?.labels,
+      annotations: props.metadata?.annotations,
+    },
+    ...props.body,
+  } satisfies KubernetesObjectDefinition;
+
+  yield* props.cluster.bind(kubernetesBindingSid(object), {
+    type: "kubernetes-object",
+    object,
+  });
+
+  const ref = toKubernetesObjectRef(object);
+
+  return {
+    cluster: props.cluster,
+    apiVersion: ref.apiVersion,
+    kind: ref.kind,
+    name: ref.name,
+    namespace: ref.namespace,
+    key: kubernetesObjectKey(ref),
+    object,
+  } satisfies ObjectRef;
+});
+
+export { KubernetesObject as Object };
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Service.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Service.ts
new file mode 100644
index 00000000000..9ff183e119d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/Service.ts
@@ -0,0 +1,78 @@
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import { metadataWithNamespace } from "./common.ts";
+import { Object, type ObjectRef } from "./Object.ts";
+
+export interface ServicePort {
+  port: number;
+  targetPort?: number;
+  protocol?: "TCP" | "UDP";
+  name?: string;
+}
+
+export interface ServiceProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | ObjectRef;
+  /**
+   * Optional explicit service name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Service type.
+   * @default "ClusterIP"
+   */
+  type?: "ClusterIP" | "NodePort" | "LoadBalancer";
+  /**
+   * Selector labels for backing pods.
+   */
+  selector: Record<string, string>;
+  /**
+   * Service ports.
+   */
+  ports: ServicePort[];
+  /**
+   * Service labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Service annotations.
+   */
+  annotations?: Record<string, string>;
+}
+
+/**
+ * A Kubernetes service bound to an EKS cluster.
+ *
+ * @example Expose a deployment on a ClusterIP service
+ * ```typescript
+ * const service = yield* Service("api", {
+ *   cluster,
+ *   namespace: "default",
+ *   selector: { "app.kubernetes.io/name": "api" },
+ *   ports: [{ port: 80, targetPort: 8080 }],
+ * });
+ * ```
+ */
+export const Service = (id: string, props: ServiceProps) =>
+  Object(id, {
+    cluster: props.cluster,
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: metadataWithNamespace(props.namespace, {
+      name: props.name,
+      labels: props.labels,
+      annotations: props.annotations,
+    }),
+    body: {
+      spec: {
+        type: props.type ?? "ClusterIP",
+        selector: props.selector,
+        ports: props.ports,
+      },
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/ServiceAccount.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/ServiceAccount.ts
new file mode 100644
index 00000000000..5e8ce5b1761
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/ServiceAccount.ts
@@ -0,0 +1,49 @@
+import type { Cluster } from "../AWS/EKS/Cluster.ts";
+import { metadataWithNamespace } from "./common.ts";
+import { Object, type ObjectRef } from "./Object.ts";
+
+export interface ServiceAccountProps {
+  /**
+   * Target EKS cluster.
+   */
+  cluster: Cluster;
+  /**
+   * Namespace name or namespace helper result.
+   */
+  namespace: string | { name: string } | ObjectRef;
+  /**
+   * Optional explicit service account name. Defaults to the logical id.
+   */
+  name?: string;
+  /**
+   * Service account labels.
+   */
+  labels?: Record<string, string>;
+  /**
+   * Service account annotations.
+   */
+  annotations?: Record<string, string>;
+}
+
+/**
+ * A Kubernetes service account bound to an EKS cluster.
+ *
+ * @example Create a service account
+ * ```typescript
+ * const sa = yield* ServiceAccount("api", {
+ *   cluster,
+ *   namespace: "default",
+ * });
+ * ```
+ */
+export const ServiceAccount = (id: string, props: ServiceAccountProps) =>
+  Object(id, {
+    cluster: props.cluster,
+    apiVersion: "v1",
+    kind: "ServiceAccount",
+    metadata: metadataWithNamespace(props.namespace, {
+      name: props.name,
+      labels: props.labels,
+      annotations: props.annotations,
+    }),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/client.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/client.ts
new file mode 100644
index 00000000000..609deb68351
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/client.ts
@@ -0,0 +1,298 @@
+import { Credentials } from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import { AwsClient } from "aws4fetch";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as https from "node:https";
+import {
+  buildKubernetesObjectPath,
+  chunkByApplyRank,
+  kubernetesObjectKey,
+  sortRefsForDelete,
+  toKubernetesObjectRef,
+  type KubernetesObjectDefinition,
+  type KubernetesObjectRef,
+} from "./types.ts";
+
+export class KubernetesApiError extends Data.TaggedError("KubernetesApiError")<{
+  method: string;
+  path: string;
+  statusCode: number;
+  body: string;
+}> {}
+
+export interface KubernetesClusterConnection {
+  clusterName: string;
+  endpoint: string;
+  certificateAuthorityData: string;
+}
+
+const fieldManager = "alchemy";
+
+const createBearerToken = Effect.fn(function* (clusterName: string) {
+  const credentials = yield* yield* Credentials;
+  const region = yield* Region;
+
+  const client = new AwsClient({
+    accessKeyId: Redacted.value(credentials.accessKeyId),
+    secretAccessKey: Redacted.value(credentials.secretAccessKey),
+    sessionToken: credentials.sessionToken
+      ? Redacted.value(credentials.sessionToken)
+      : undefined,
+    service: "sts",
+    region,
+  });
+
+  const presigned = yield* Effect.tryPromise(() =>
+    client.sign(
+      new Request(
+        `https://sts.${region}.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15&X-Amz-Expires=60`,
+        {
+          headers: {
+            "x-k8s-aws-id": clusterName,
+          },
+        },
+      ),
+      {
+        aws: {
+          signQuery: true,
+          allHeaders: true,
+        },
+      },
+    ),
+  );
+
+  return `k8s-aws-v1.${Buffer.from(presigned.url).toString("base64url")}`;
+});
+
+const requestJson = Effect.fn(function* ({
+  connection,
+  method,
+  path,
+  body,
+}: {
+  connection: KubernetesClusterConnection;
+  method: string;
+  path: string;
+  body?: Record<string, unknown>;
+}) {
+  const token = yield* createBearerToken(connection.clusterName);
+  const url = new URL(path, connection.endpoint);
+  const payload = body ? JSON.stringify(body) : undefined;
+
+  return yield* Effect.tryPromise({
+    try: () =>
+      new Promise<unknown>((resolve, reject) => {
+        const request = https.request(
+          {
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port || 443,
+            path: `${url.pathname}${url.search}`,
+            method,
+            headers: {
+              Authorization: `Bearer ${token}`,
+              Accept: "application/json",
+              ...(payload
+                ? {
+                    "Content-Type": "application/apply-patch+yaml",
+                    "Content-Length": Buffer.byteLength(payload),
+                  }
+                : {}),
+            },
+            ca: Buffer.from(
+              connection.certificateAuthorityData,
+              "base64",
+            ).toString("utf8"),
+          },
+          (response) => {
+            const chunks: Buffer[] = [];
+            response.on("data", (chunk) => {
+              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            response.on("end", () => {
+              const responseBody = Buffer.concat(chunks).toString("utf8");
+              const statusCode = response.statusCode ?? 500;
+
+              if (statusCode < 200 || statusCode >= 300) {
+                reject(
+                  new KubernetesApiError({
+                    method,
+                    path,
+                    statusCode,
+                    body: responseBody,
+                  }),
+                );
+                return;
+              }
+
+              if (!responseBody.trim()) {
+                resolve(undefined);
+                return;
+              }
+
+              try {
+                resolve(JSON.parse(responseBody));
+              } catch {
+                resolve(responseBody);
+              }
+            });
+          },
+        );
+
+        request.on("error", reject);
+        if (payload) {
+          request.write(payload);
+        }
+        request.end();
+      }),
+    catch: (error) =>
+      error instanceof KubernetesApiError
+        ? error
+        : new Error(
+            `Failed Kubernetes ${method} ${path}: ${error instanceof Error ? error.message : String(error)}`,
+          ),
+  });
+});
+
+export const readObject = Effect.fn(function* ({
+  connection,
+  object,
+}: {
+  connection: KubernetesClusterConnection;
+  object: KubernetesObjectRef;
+}) {
+  return yield* requestJson({
+    connection,
+    method: "GET",
+    path: buildKubernetesObjectPath(object),
+  });
+});
+
+export const applyObject = Effect.fn(function* ({
+  connection,
+  object,
+}: {
+  connection: KubernetesClusterConnection;
+  object: KubernetesObjectDefinition;
+}) {
+  const path = `${buildKubernetesObjectPath(toKubernetesObjectRef(object))}?fieldManager=${fieldManager}&force=true`;
+
+  return yield* requestJson({
+    connection,
+    method: "PATCH",
+    path,
+    body: object,
+  });
+});
+
+export const deleteObject = Effect.fn(function* ({
+  connection,
+  object,
+}: {
+  connection: KubernetesClusterConnection;
+  object: KubernetesObjectRef;
+}) {
+  yield* requestJson({
+    connection,
+    method: "DELETE",
+    path: buildKubernetesObjectPath(object),
+  }).pipe(
+    Effect.catchIf(
+      (error): error is KubernetesApiError =>
+        error instanceof KubernetesApiError,
+      (error) => (error.statusCode === 404 ? Effect.void : Effect.fail(error)),
+    ),
+  );
+});
+
+export const reconcileObjects = Effect.fn(function* ({
+  connection,
+  previousObjects,
+  desiredObjects,
+}: {
+  connection: KubernetesClusterConnection;
+  previousObjects: ReadonlyArray<KubernetesObjectRef>;
+  desiredObjects: ReadonlyArray<KubernetesObjectDefinition>;
+}) {
+  const desiredRefs = desiredObjects.map(toKubernetesObjectRef);
+  const desiredKeys = new Set(desiredRefs.map(kubernetesObjectKey));
+
+  const removedObjects = previousObjects.filter(
+    (object) => !desiredKeys.has(kubernetesObjectKey(object)),
+  );
+
+  for (const object of sortRefsForDelete(removedObjects)) {
+    yield* deleteObject({
+      connection,
+      object,
+    });
+  }
+
+  for (const chunk of chunkByApplyRank(desiredObjects)) {
+    yield* Effect.forEach(
+      chunk,
+      (object) =>
+        applyObject({
+          connection,
+          object,
+        }),
+      {
+        concurrency: "unbounded",
+      },
+    );
+  }
+
+  return desiredRefs;
+});
+
+export const deleteObjects = Effect.fn(function* ({
+  connection,
+  objects,
+}: {
+  connection: KubernetesClusterConnection;
+  objects: ReadonlyArray<KubernetesObjectRef>;
+}) {
+  for (const object of sortRefsForDelete(objects)) {
+    yield* deleteObject({
+      connection,
+      object,
+    });
+  }
+});
+
+export const createClient = (connection: KubernetesClusterConnection) => ({
+  readObject: (object: KubernetesObjectRef) =>
+    readObject({
+      connection,
+      object,
+    }),
+  applyObject: (object: KubernetesObjectDefinition) =>
+    applyObject({
+      connection,
+      object,
+    }),
+  deleteObject: (object: KubernetesObjectRef) =>
+    deleteObject({
+      connection,
+      object,
+    }),
+  reconcileObjects: ({
+    previousObjects,
+    desiredObjects,
+  }: {
+    previousObjects: ReadonlyArray<KubernetesObjectRef>;
+    desiredObjects: ReadonlyArray<KubernetesObjectDefinition>;
+  }) =>
+    reconcileObjects({
+      connection,
+      previousObjects,
+      desiredObjects,
+    }),
+  deleteObjects: (objects: ReadonlyArray<KubernetesObjectRef>) =>
+    deleteObjects({
+      connection,
+      objects,
+    }),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/common.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/common.ts
new file mode 100644
index 00000000000..4c77a21219e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/common.ts
@@ -0,0 +1,23 @@
+import type { ObjectRef } from "./Object.ts";
+
+export const namespaceNameOf = (
+  namespace: string | { name: string } | ObjectRef,
+): string => (typeof namespace === "string" ? namespace : namespace.name);
+
+export const objectNameOf = (
+  object: string | { name: string } | ObjectRef,
+): string => (typeof object === "string" ? object : object.name);
+
+export const metadataWithNamespace = (
+  namespace: string | { name: string } | ObjectRef,
+  metadata?: {
+    name?: string;
+    labels?: Record<string, string>;
+    annotations?: Record<string, string>;
+  },
+) => ({
+  name: metadata?.name,
+  namespace: namespaceNameOf(namespace),
+  labels: metadata?.labels,
+  annotations: metadata?.annotations,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/index.ts
new file mode 100644
index 00000000000..f0513043942
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/index.ts
@@ -0,0 +1,11 @@
+export * from "./Object.ts";
+
+export * from "./client.ts";
+export * from "./common.ts";
+export * from "./ConfigMap.ts";
+export * from "./Deployment.ts";
+export * from "./Job.ts";
+export * from "./Namespace.ts";
+export * from "./Service.ts";
+export * from "./ServiceAccount.ts";
+export * from "./types.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/types.ts b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/types.ts
new file mode 100644
index 00000000000..d14ff9ad090
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Kubernetes/types.ts
@@ -0,0 +1,177 @@
+export interface KubernetesObjectMetadata {
+  name: string;
+  namespace?: string;
+  labels?: Record<string, string>;
+  annotations?: Record<string, string>;
+}
+
+export type KubernetesObjectDefinition = {
+  apiVersion: string;
+  kind: string;
+  metadata: KubernetesObjectMetadata;
+} & Record<string, unknown>;
+
+export interface KubernetesObjectRef {
+  apiVersion: string;
+  kind: string;
+  name: string;
+  namespace?: string;
+}
+
+export interface KubernetesObjectBinding {
+  type: "kubernetes-object";
+  object: KubernetesObjectDefinition;
+}
+
+type KubernetesObjectScope = "Cluster" | "Namespaced";
+
+interface KubernetesObjectKindSpec {
+  plural: string;
+  scope: KubernetesObjectScope;
+  applyRank: number;
+}
+
+const supportedKinds: Record<string, KubernetesObjectKindSpec> = {
+  "v1/Namespace": {
+    plural: "namespaces",
+    scope: "Cluster",
+    applyRank: 10,
+  },
+  "v1/ServiceAccount": {
+    plural: "serviceaccounts",
+    scope: "Namespaced",
+    applyRank: 20,
+  },
+  "v1/ConfigMap": {
+    plural: "configmaps",
+    scope: "Namespaced",
+    applyRank: 30,
+  },
+  "v1/Service": {
+    plural: "services",
+    scope: "Namespaced",
+    applyRank: 40,
+  },
+  "apps/v1/Deployment": {
+    plural: "deployments",
+    scope: "Namespaced",
+    applyRank: 50,
+  },
+  "batch/v1/Job": {
+    plural: "jobs",
+    scope: "Namespaced",
+    applyRank: 60,
+  },
+};
+
+const objectTypeKey = (
+  input: Pick<KubernetesObjectRef, "apiVersion" | "kind">,
+) => `${input.apiVersion}/${input.kind}`;
+
+export const getKubernetesKindSpec = (
+  input: Pick<KubernetesObjectRef, "apiVersion" | "kind">,
+) => {
+  const spec = supportedKinds[objectTypeKey(input)];
+  if (!spec) {
+    throw new Error(
+      `Unsupported Kubernetes object ${input.apiVersion}/${input.kind}`,
+    );
+  }
+  return spec;
+};
+
+export const toKubernetesObjectRef = (
+  object: KubernetesObjectDefinition,
+): KubernetesObjectRef => ({
+  apiVersion: object.apiVersion,
+  kind: object.kind,
+  name: object.metadata.name,
+  namespace: object.metadata.namespace,
+});
+
+export const kubernetesObjectKey = (
+  input: Pick<
+    KubernetesObjectRef,
+    "apiVersion" | "kind" | "name" | "namespace"
+  >,
+) =>
+  [
+    input.apiVersion,
+    input.kind,
+    input.namespace ?? "_cluster",
+    input.name,
+  ].join("/");
+
+export const kubernetesBindingSid = (object: KubernetesObjectDefinition) =>
+  `Kubernetes.Object(${kubernetesObjectKey(toKubernetesObjectRef(object))})`;
+
+const compareRefs = (a: KubernetesObjectRef, b: KubernetesObjectRef) =>
+  kubernetesObjectKey(a).localeCompare(kubernetesObjectKey(b));
+
+export const sortObjectsForApply = (
+  objects: ReadonlyArray<KubernetesObjectDefinition>,
+) =>
+  [...objects].sort(
+    (a, b) =>
+      getKubernetesKindSpec(a).applyRank - getKubernetesKindSpec(b).applyRank ||
+      compareRefs(toKubernetesObjectRef(a), toKubernetesObjectRef(b)),
+  );
+
+export const sortRefsForDelete = (
+  objects: ReadonlyArray<KubernetesObjectRef>,
+) =>
+  [...objects].sort(
+    (a, b) =>
+      getKubernetesKindSpec(b).applyRank - getKubernetesKindSpec(a).applyRank ||
+      compareRefs(a, b),
+  );
+
+export const chunkByApplyRank = (
+  objects: ReadonlyArray<KubernetesObjectDefinition>,
+) => {
+  const chunks: KubernetesObjectDefinition[][] = [];
+
+  for (const object of sortObjectsForApply(objects)) {
+    const rank = getKubernetesKindSpec(object).applyRank;
+    const current = chunks[chunks.length - 1];
+    if (!current) {
+      chunks.push([object]);
+      continue;
+    }
+
+    const currentRank = getKubernetesKindSpec(current[0]).applyRank;
+    if (currentRank === rank) {
+      current.push(object);
+    } else {
+      chunks.push([object]);
+    }
+  }
+
+  return chunks;
+};
+
+export const buildKubernetesObjectPath = (
+  input: Pick<
+    KubernetesObjectRef,
+    "apiVersion" | "kind" | "name" | "namespace"
+  >,
+) => {
+  const spec = getKubernetesKindSpec(input);
+  const [group, version] = input.apiVersion.includes("/")
+    ? input.apiVersion.split("/", 2)
+    : [undefined, input.apiVersion];
+
+  const base = group ? `/apis/${group}/${version}` : `/api/${version}`;
+
+  if (spec.scope === "Namespaced") {
+    if (!input.namespace) {
+      throw new Error(
+        `Kubernetes object ${input.apiVersion}/${input.kind}/${input.name} requires a namespace`,
+      );
+    }
+
+    return `${base}/namespaces/${input.namespace}/${spec.plural}/${input.name}`;
+  }
+
+  return `${base}/${spec.plural}/${input.name}`;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcProvider.ts
new file mode 100644
index 00000000000..5f7a9e56459
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcProvider.ts
@@ -0,0 +1,146 @@
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
+import type { Scope } from "effect/Scope";
+import * as Stream from "effect/Stream";
+import { InstanceId } from "../InstanceId.ts";
+import type { Platform } from "../Platform.ts";
+import * as Provider from "../Provider.ts";
+import type { ResourceClass, ResourceLike } from "../Resource.ts";
+import { Stack } from "../Stack.ts";
+import { Stage } from "../Stage.ts";
+import { RpcProviderProxy } from "./RpcProviderProxy.ts";
+
+/**
+ * Constructs an RpcProvider for a given resource.
+ *
+ * An RpcProvider is a resource provider that can run in a separate process.
+ * This is used for local development so that the resource provider and its state can outlive the user's code when it is hot-reloaded.
+ * If the {@link RpcProviderProxy} is provided, the provider is run in a separate process, which we communicate with here using a websocket.
+ * Otherwise, the given effect is used to construct the provider directly.
+ *
+ * @note If the provider is running in a separate process, you may not need to construct all of its layers in this process.
+ *       You can use {@link providerServices} or {@link providerServicesEffect} to construct such layers only when they are needed.
+ *
+ * @example
+ * ```ts
+ * export const MyProvider = RpcProvider.effect(
+ *   MyResource,
+ *   import.meta.resolve("./my-rpc-provider-server.ts"),
+ *   Effect.gen(function* () {
+ *     return {
+ *       diff: ...,
+ *       reconcile: ...,
+ *       delete: ...,
+ *     }
+ *   })
+ * )
+ * ```
+ *
+ * @param cls - The tag of the resource class to construct a provider for.
+ * @param serverEntryUrl - The main file for the server entry point, if the provider is to be run in a separate process. This is typically obtained using `import.meta.url` or `import.meta.resolve`.
+ * @param eff - The Effect to use to construct the provider.
+ * @returns A layer containing the RpcProvider.
+ */
+export const effect = <
+  R extends ResourceLike,
+  Req = never,
+  ReadReq = never,
+  DiffReq = never,
+  PrecreateReq = never,
+  ReconcileReq = never,
+  DeleteReq = never,
+  TailReq = never,
+  LogsReq = never,
+>(
+  cls: ResourceClass<R> | Platform<R, any, any, any, any>,
+  serverEntryUrl: string,
+  eff: Effect.Effect<
+    Provider.ProviderService<
+      R,
+      ReadReq,
+      DiffReq,
+      PrecreateReq,
+      ReconcileReq,
+      DeleteReq,
+      TailReq,
+      LogsReq
+    >,
+    never,
+    Req
+  >,
+) =>
+  Provider.effect(
+    cls,
+    Effect.gen(function* () {
+      const client = yield* Effect.serviceOption(RpcProviderProxy);
+      const stack = yield* Stack;
+
+      if (client._tag === "None") {
+        const provider = yield* eff;
+        return new Proxy(provider, {
+          get: (target, prop) => {
+            const value = (target as any)[prop];
+            if (!Predicate.isFunction(value)) return value;
+            return (...args: any[]) => {
+              const result = value(...args);
+              const services = Layer.mergeAll(
+                layerFallback(Stack, stack),
+                layerFallback(Stage, stack.stage),
+                Predicate.hasProperty(args[0], "instanceId") &&
+                  Predicate.isString(args[0].instanceId)
+                  ? layerFallback(InstanceId, args[0].instanceId)
+                  : Layer.empty,
+              );
+              return result.pipe(
+                Stream.isStream(result)
+                  ? Stream.provide(services)
+                  : Effect.provide(services),
+              );
+            };
+          },
+        });
+      }
+      return yield* client.value.get(serverEntryUrl, cls.Type);
+    }),
+  );
+
+const layerFallback = <I, S>(
+  service: Context.Key<I, S>,
+  defaultValue: NoInfer<S>,
+) =>
+  Layer.effect(
+    service,
+    Effect.serviceOption(service).pipe(
+      Effect.map(Option.getOrElse(() => defaultValue)),
+    ),
+  );
+
+/**
+ * Conditionally constructs a layer for use by an RpcProvider.
+ * If the {@link RpcProviderProxy} is present in context, the layer is empty because it will not be used in this process.
+ * Otherwise, the given layer is returned.
+ * @param self - The layer that is used by the RpcProvider.
+ * @returns A layer that is empty if the {@link RpcProviderProxy} is present in context, otherwise the given layer.
+ */
+export const providerServices = <ROut, E, RIn>(
+  self: Layer.Layer<ROut, E, RIn>,
+): Layer.Layer<ROut, E, RIn> => providerServicesEffect(Effect.succeed(self));
+
+/**
+ * Conditionally constructs a layer for use by an RpcProvider.
+ * If the {@link RpcProviderProxy} is present in context, the layer is empty because it will not be used in this process.
+ * Otherwise, the given layer is returned.
+ * @param self - An effect which returns a layer that is used by the RpcProvider.
+ */
+export const providerServicesEffect = <A, E1, R1, E, R>(
+  self: Effect.Effect<Layer.Layer<A, E1, R1>, E, R>,
+): Layer.Layer<A, E | E1, R1 | Exclude<R, Scope>> =>
+  Effect.serviceOption(RpcProviderProxy).pipe(
+    Effect.flatMap((client) =>
+      client._tag === "None" ? self : (Effect.succeed(Layer.empty) as never),
+    ),
+    Layer.unwrap,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcProviderProxy.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcProviderProxy.ts
new file mode 100644
index 00000000000..395f4050076
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcProviderProxy.ts
@@ -0,0 +1,86 @@
+import { newWebSocketRpcSession, type RpcStub } from "capnweb";
+import * as Cache from "effect/Cache";
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { AlchemyContext } from "../AlchemyContext.ts";
+import type { ProviderService } from "../Provider.ts";
+import type { ResourceLike } from "../Resource.ts";
+import { Stack } from "../Stack.ts";
+import { unwrapRpcHandlers } from "./RpcSerialization.ts";
+import type { RpcProxyApi } from "./RpcServer.ts";
+import type { RpcSpawnPayload } from "./RpcSpawner.ts";
+
+export class RpcProviderProxy extends Context.Service<
+  RpcProviderProxy,
+  {
+    readonly get: <R extends ResourceLike>(
+      serverEntryUrl: string,
+      providerName: R["Type"],
+    ) => Effect.Effect<ProviderService<R>, never, AlchemyContext | Stack>;
+  }
+>()("alchemy/Local/RpcProviderProxy") {}
+
+export const SPAWNER_URL_ENV_KEY = "ALCHEMY_RPC_SPAWNER_URL" as const;
+
+const make = Effect.fnUntraced(function* (spawnerUrl: string) {
+  const client = yield* HttpClient.HttpClient;
+
+  const getSession = Effect.fnUntraced(
+    function* (serverEntryUrl: string) {
+      const alchemyContext = yield* AlchemyContext;
+      const stack = yield* Stack;
+      const payload: RpcSpawnPayload = {
+        serverEntryUrl,
+        alchemyContext,
+        stack: { name: stack.name, stage: stack.stage },
+      };
+      const response = yield* client.post(spawnerUrl, {
+        body: yield* HttpBody.json(payload),
+      });
+      const websocketUrl = yield* response.text;
+      return newWebSocketRpcSession(websocketUrl) as RpcStub<RpcProxyApi>;
+    },
+    (effect, serverEntryUrl) =>
+      Effect.catch(effect, (error) =>
+        Effect.die(
+          new Error(
+            `Failed to create provider RPC session for "${serverEntryUrl}"`,
+            {
+              cause: error,
+            },
+          ),
+        ),
+      ),
+  );
+
+  const cache = yield* Cache.make({
+    lookup: getSession,
+    capacity: Infinity,
+    requireServicesAt: "lookup",
+  });
+
+  return RpcProviderProxy.of({
+    get: Effect.fnUntraced(function* (mainUrl, providerName) {
+      const session = yield* cache.lookup(mainUrl);
+      const provider = yield* Effect.promise(
+        () =>
+          session.getProvider(providerName) as ReturnType<
+            RpcProxyApi["getProvider"]
+          >,
+      );
+      return unwrapRpcHandlers(provider, ["tail"]);
+    }),
+  });
+});
+
+export const layer = (url: string) => Layer.effect(RpcProviderProxy, make(url));
+
+export const fromEnv = () =>
+  Layer.effect(
+    RpcProviderProxy,
+    Config.string(SPAWNER_URL_ENV_KEY).pipe(Effect.flatMap(make)),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcSerialization.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcSerialization.ts
new file mode 100644
index 00000000000..2e062358ea0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcSerialization.ts
@@ -0,0 +1,225 @@
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { flow } from "effect/Function";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as NodeUtil from "node:util";
+import * as Output from "../Output.ts";
+
+type RpcEffectHandler<Args extends Array<any>, Success, Error> = (
+  ...args: Args
+) => Effect.Effect<Success, Error>;
+
+type RpcWrappedEffectHandler<Args extends Array<any>, Success, Error> = (
+  args: Args,
+) => Promise<RpcSerializedExit<Success, Error>>;
+
+type RpcStreamHandler<Args extends Array<any>, Success, Error> = (
+  ...args: Args
+) => Stream.Stream<Success, Error>;
+
+type RpcWrappedStreamHandler<Args extends Array<any>, Success, Error> = (
+  args: Args,
+) => RpcSerializedStream<Success, Error>;
+
+type RpcSerializedStream<Success, _Error> = ReadableStream<Success>;
+
+type RpcSerializedExit<Success, Error> =
+  | { _tag: "Success"; value: Success }
+  | { _tag: "Failure"; cause: Array<RpcSerializedCause<Error>> };
+
+type RpcSerializedCause<Error> =
+  | { _tag: "Fail"; error: Error }
+  | { _tag: "Die"; defect: unknown }
+  | { _tag: "Interrupt"; fiberId: number | undefined };
+
+export type RpcWrapped<T> =
+  T extends RpcEffectHandler<infer Args, infer Success, infer Error>
+    ? RpcWrappedEffectHandler<Args, Success, Error>
+    : T extends RpcStreamHandler<infer Args, infer Success, infer Error>
+      ? RpcWrappedStreamHandler<Args, Success, Error>
+      : T extends Record<string, any>
+        ? { [K in keyof T]: RpcWrapped<T[K]> }
+        : T;
+
+export type RpcUnwrapped<T> =
+  T extends RpcWrappedEffectHandler<infer Args, infer Success, infer Error>
+    ? RpcEffectHandler<Args, Success, Error>
+    : T extends RpcWrappedStreamHandler<infer Args, infer Success, infer Error>
+      ? RpcStreamHandler<Args, Success, Error>
+      : T extends Record<string, any>
+        ? { [K in keyof T]: RpcUnwrapped<T[K]> }
+        : T;
+
+export const wrapRpcHandlers = <T extends Record<string, any>>(
+  handlers: T,
+  streamKeys?: Array<keyof T>,
+): RpcWrapped<T> => {
+  return Object.fromEntries(
+    Object.entries(handlers).map(([key, value]) => [
+      key,
+      typeof value === "function"
+        ? streamKeys?.includes(key)
+          ? wrapRpcStreamHandler(value)
+          : wrapRpcEffectHandler(value)
+        : typeof value === "object" && value !== null
+          ? wrapRpcHandlers(value)
+          : value,
+    ]),
+  ) as RpcWrapped<T>;
+};
+
+export const unwrapRpcHandlers = <T extends Record<string, any>>(
+  handlers: RpcWrapped<T>,
+  streamKeys?: Array<keyof T>,
+): RpcUnwrapped<T> => {
+  return Object.fromEntries(
+    Object.entries(handlers).map(([key, value]) => [
+      key,
+      typeof value === "function"
+        ? streamKeys?.includes(key)
+          ? unwrapRpcStreamHandler(value)
+          : unwrapRpcEffectHandler(value)
+        : typeof value === "object" && value !== null
+          ? unwrapRpcHandlers(value)
+          : value,
+    ]),
+  ) as RpcUnwrapped<T>;
+};
+
+const serializeError = Schema.encodeSync(Schema.Defect);
+
+const wrapRpcEffectHandler = <Args extends Array<any>, Success, Error>(
+  handler: RpcEffectHandler<Args, Success, Error>,
+): RpcWrappedEffectHandler<Args, Success, Error> =>
+  flow(
+    (args) => deserializeRpcArgs(args) as Args,
+    (args) => handler(...args),
+    Effect.exit,
+    Effect.map((exit): RpcSerializedExit<Success, Error> => {
+      if (exit._tag === "Success") {
+        return { _tag: "Success", value: exit.value };
+      }
+      return {
+        _tag: "Failure",
+        cause: exit.cause.reasons.map((reason): RpcSerializedCause<Error> => {
+          switch (reason._tag) {
+            case "Fail":
+              return { _tag: "Fail", error: serializeError(reason.error) };
+            case "Die":
+              return { _tag: "Die", defect: serializeError(reason.defect) };
+            case "Interrupt":
+              return { _tag: "Interrupt", fiberId: reason.fiberId };
+          }
+        }),
+      };
+    }),
+    Effect.runPromise,
+  );
+
+const wrapRpcStreamHandler = <Args extends Array<any>, Success, Error>(
+  handler: RpcStreamHandler<Args, Success, Error>,
+): RpcWrappedStreamHandler<Args, Success, Error> =>
+  flow(
+    (args) => deserializeRpcArgs(args) as Args,
+    (args) => handler(...args),
+    (stream) => Stream.toReadableStream(stream),
+  );
+
+const unwrapRpcEffectHandler = <Args extends Array<any>, Success, Error>(
+  handler: RpcWrappedEffectHandler<Args, Success, Error>,
+): RpcEffectHandler<Args, Success, Error> =>
+  flow(
+    (...args) => serializeRpcArgs(args) as Args,
+    (args) => Effect.promise(() => handler(args)),
+    Effect.flatMap((exit): Exit.Exit<Success, Error> => {
+      if (exit._tag === "Success") {
+        return Exit.succeed(exit.value);
+      }
+      return Exit.failCause(
+        Cause.fromReasons(
+          exit.cause.map((reason): Cause.Reason<Error> => {
+            switch (reason._tag) {
+              case "Fail":
+                return Cause.makeFailReason(reason.error);
+              case "Die":
+                return Cause.makeDieReason(reason.defect);
+              case "Interrupt":
+                return Cause.makeInterruptReason(reason.fiberId);
+            }
+          }),
+        ),
+      );
+    }),
+  );
+
+const unwrapRpcStreamHandler = <Args extends Array<any>, Success, Error>(
+  handler: RpcWrappedStreamHandler<Args, Success, Error>,
+): RpcStreamHandler<Args, Success, Error> =>
+  flow(
+    (...args) => serializeRpcArgs(args) as Args,
+    (args) => handler(args),
+    (stream) =>
+      Stream.fromReadableStream({
+        evaluate: () => stream,
+        onError: (error) => error as Error,
+      }),
+  );
+
+const serializeRpcArgs = (value: unknown): unknown => {
+  if (Redacted.isRedacted(value)) {
+    return { _tag: "Redacted", value: Redacted.value(value) };
+  }
+  if (Output.isOutput(value)) {
+    return {
+      _tag: "Output",
+      description: NodeUtil.inspect(value),
+    };
+  }
+  if (typeof value === "function") {
+    return null;
+  }
+  if (Array.isArray(value)) {
+    return value.map(serializeRpcArgs);
+  }
+  if (value && typeof value === "object" && !("toJSON" in value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => [
+        key,
+        serializeRpcArgs(child),
+      ]),
+    );
+  }
+  return value;
+};
+
+const deserializeRpcArgs = (value: unknown): unknown => {
+  if (Array.isArray(value)) {
+    return value.map(deserializeRpcArgs);
+  } else if (typeof value === "object" && value !== null) {
+    // These values are serialized as `{_tag: "Redacted", value: ...}` and `{_tag: "Output", description: ...}`,
+    // so we need to detect them manually - Redacted.isRedacted and Output.isOutput do not work.
+    if ("_tag" in value && value._tag === "Redacted" && "value" in value) {
+      return Redacted.make(value.value);
+    } else if (
+      "_tag" in value &&
+      value._tag === "Output" &&
+      "description" in value &&
+      typeof value.description === "string"
+    ) {
+      return new Output.NamedExpr(
+        new Output.EffectExpr(Output.VoidExpr, () => Effect.never),
+        value.description,
+      );
+    }
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => [
+        key,
+        deserializeRpcArgs(child),
+      ]),
+    );
+  }
+  return value;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServer.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServer.ts
new file mode 100644
index 00000000000..aed964cefce
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServer.ts
@@ -0,0 +1,138 @@
+import * as Console from "effect/Console";
+import * as Context from "effect/Context";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type * as Scope from "effect/Scope";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import type { ProviderService } from "../Provider.ts";
+import type { ResourceLike } from "../Resource.ts";
+import {
+  platformLayer,
+  PlatformServices,
+  runMain,
+} from "../Util/PlatformServices.ts";
+import * as RpcSerialization from "./RpcSerialization.ts";
+import * as RpcServerEnvironment from "./RpcServerEnvironment.ts";
+import {
+  makeServerRpcSession,
+  type ServerRpcSession,
+  type ServerWebSocketLike,
+} from "./RpcServerSession.ts";
+
+/**
+ * A service that exposes one or more resource providers over RPC.
+ * This returns `never` because it is meant to be used with `Layer.launch` (see {@link launch}).
+ */
+export class RpcServer extends Context.Service<RpcServer, never>()(
+  "alchemy/Local/RpcServer",
+) {}
+
+/**
+ * The RPC API that is implemented by the server and consumed by {@link RpcProviderProxy}.
+ */
+export interface RpcProxyApi {
+  /**
+   * Retrieves a provider from the RPC server context.
+   * The consumer must unwrap the provider using {@link RpcSerialization.unwrapRpcHandlers} before using it.
+   */
+  readonly getProvider: <R extends ResourceLike>(
+    type: R["Type"],
+  ) => Promise<RpcSerialization.RpcWrapped<ProviderService<R>>>;
+}
+
+const serverPlatformLayer = platformLayer({
+  bun: async () => {
+    const { RpcServerBun } = await import("./RpcServerBun.ts");
+    return RpcServerBun;
+  },
+  node: async () => {
+    const { RpcServerNode } = await import("./RpcServerNode.ts");
+    return RpcServerNode;
+  },
+});
+
+/**
+ * Launches an RPC server that serves the given providers.
+ * Alchemy globals such as `AlchemyContext`, `Profile`, and `Stack` are inherited from the parent via {@link RpcServerEnvironment.fromEnv} and should not be provided manually.
+ * `PlatformServices` and `HttpClient` are also included.
+ *
+ * @example
+ * ```ts
+ * RpcServer.launch(
+ *   Layer.merge(
+ *     FunctionProvider,
+ *     QueueProvider,
+ *   ),
+ * );
+ * ```
+ *
+ * @param providers - A layer containing the providers to serve.
+ */
+export const launch = <ROut, E>(
+  providers: Layer.Layer<
+    ROut,
+    E,
+    | Scope.Scope
+    | RpcServerEnvironment.RpcEnvironmentServices
+    | PlatformServices
+    | HttpClient
+  >,
+) =>
+  serverPlatformLayer.pipe(
+    Layer.provide(providers),
+    Layer.provide(RpcServerEnvironment.fromEnv()),
+    Layer.provide(Layer.merge(PlatformServices, FetchHttpClient.layer)),
+    Layer.launch,
+    Effect.scoped,
+    runMain,
+  );
+
+/**
+ * Constructs an `RpcServer` layer using the given server implementation.
+ * @param serve - A function that spawns a websocket server and returns its URL.
+ * @returns An `RpcServer` layer.
+ */
+export const layerServer = (
+  serve: (handlers: {
+    /** Creates a new RPC session over the given websocket. */
+    createRpcSession: (
+      ws: ServerWebSocketLike,
+    ) => ServerRpcSession<RpcProxyApi>;
+    /** Called when the parent connection, indicated by the `/parent` path, is established. */
+    parentConnected: () => void;
+    /** Called when the parent disconnects. The server will shut down when this is called. */
+    parentDisconnected: () => void;
+  }) => Effect.Effect<{ readonly url: string }, never, Scope.Scope>,
+) =>
+  Layer.effect(
+    RpcServer,
+    Effect.gen(function* () {
+      const context = yield* Effect.context();
+      const connected = yield* Deferred.make<void>();
+      const disconnected = yield* Deferred.make<void>();
+      const { url } = yield* serve({
+        createRpcSession: (ws) =>
+          makeServerRpcSession<RpcProxyApi>(ws, {
+            getProvider: async <R extends ResourceLike>(type: R["Type"]) => {
+              const provider = context.mapUnsafe.get(type);
+              if (!provider) {
+                throw new Error(`Provider "${type}" not found`);
+              }
+              return RpcSerialization.wrapRpcHandlers(
+                provider as ProviderService<R>,
+                ["tail"],
+              );
+            },
+          }),
+        parentConnected: () => Deferred.doneUnsafe(connected, Effect.void),
+        parentDisconnected: () =>
+          Deferred.doneUnsafe(disconnected, Effect.void),
+      });
+      yield* Console.log(`<ALCHEMY_RPC_ADDRESS>${url}</ALCHEMY_RPC_ADDRESS>`);
+      yield* Deferred.await(connected).pipe(Effect.timeout("10 seconds")); // TODO(john): should the timeout be shorter?
+      yield* Deferred.await(disconnected);
+      return yield* Effect.interrupt;
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerBun.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerBun.ts
new file mode 100644
index 00000000000..1cd369f115c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerBun.ts
@@ -0,0 +1,59 @@
+import * as Effect from "effect/Effect";
+import * as RpcServer from "./RpcServer.ts";
+import type { ServerRpcSession } from "./RpcServerSession.ts";
+
+export const RpcServerBun = RpcServer.layerServer(
+  Effect.fnUntraced(function* ({
+    parentConnected,
+    parentDisconnected,
+    createRpcSession,
+  }) {
+    const server = yield* Effect.sync(() =>
+      Bun.serve<
+        { type: "session"; session: ServerRpcSession<any> } | { type: "parent" }
+      >({
+        port: 0,
+        fetch: (request, server) => {
+          const url = new URL(request.url);
+          if (
+            server.upgrade(request, {
+              data:
+                url.pathname === "/parent" ? { type: "parent" } : undefined!,
+            })
+          ) {
+            return;
+          }
+          return new Response("Upgrade failed", { status: 400 });
+        },
+        websocket: {
+          open: (ws) => {
+            if (ws.data && ws.data.type === "parent") {
+              parentConnected();
+            } else {
+              ws.data = {
+                type: "session",
+                session: createRpcSession(ws),
+              };
+            }
+          },
+          message: (ws, message) => {
+            if (ws.data.type === "session") {
+              ws.data.session.dispatch.message(message);
+            }
+          },
+          close: (ws, code, reason) => {
+            if (ws.data.type === "session") {
+              ws.data.session.dispatch.close(code, reason);
+            } else if (ws.data.type === "parent") {
+              parentDisconnected();
+            }
+          },
+        },
+      }),
+    );
+    yield* Effect.addFinalizer(() => Effect.sync(() => server.stop(true)));
+    return {
+      url: `ws://${server.hostname}:${server.port}`,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerEnvironment.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerEnvironment.ts
new file mode 100644
index 00000000000..7a9195de48d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerEnvironment.ts
@@ -0,0 +1,55 @@
+import * as Config from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { AlchemyContext } from "../AlchemyContext.ts";
+import { AuthProviders } from "../Auth/AuthProvider.ts";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive, withProfileOverride } from "../Auth/Profile.ts";
+import { Stack } from "../Stack.ts";
+import { Stage } from "../Stage.ts";
+import { loadConfigProvider } from "../Util/ConfigProvider.ts";
+
+export interface RpcServerEnvironment {
+  alchemyContext: AlchemyContext["Service"];
+  profile: string | undefined;
+  envFile: string | undefined;
+  stack: {
+    name: string;
+    stage: string;
+  };
+}
+
+export type RpcEnvironmentServices = Layer.Success<ReturnType<typeof layer>>;
+
+export const layer = (environment: RpcServerEnvironment) =>
+  Layer.mergeAll(
+    ProfileLive,
+    CredentialsStoreLive,
+    Layer.succeed(AuthProviders, {}),
+    ConfigProvider.layer(
+      loadConfigProvider(Option.fromNullishOr(environment.envFile)).pipe(
+        Effect.map((base) => withProfileOverride(base, environment.profile)),
+      ),
+    ),
+    Layer.succeed(AlchemyContext, environment.alchemyContext),
+    Layer.succeed(Stack, {
+      name: environment.stack.name,
+      stage: environment.stack.stage,
+      resources: {},
+      bindings: {},
+      actions: {},
+    }),
+    Layer.succeed(Stage, environment.stack.stage),
+  );
+
+export const RPC_SERVER_ENVIRONMENT_KEY =
+  "ALCHEMY_RPC_SERVER_ENVIRONMENT" as const;
+
+export const fromEnv = () =>
+  Config.string(RPC_SERVER_ENVIRONMENT_KEY).pipe(
+    Config.map(JSON.parse),
+    Effect.map((environment) => layer(environment)),
+    Layer.unwrap,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerNode.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerNode.ts
new file mode 100644
index 00000000000..96ecd822620
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerNode.ts
@@ -0,0 +1,58 @@
+import * as Effect from "effect/Effect";
+import { WebSocketServer, type Server } from "ws";
+import * as RpcServer from "./RpcServer.ts";
+
+export const RpcServerNode = RpcServer.layerServer(
+  Effect.fnUntraced(function* ({
+    parentConnected,
+    parentDisconnected,
+    createRpcSession,
+  }) {
+    const server = new WebSocketServer({ host: "127.0.0.1", port: 0 });
+    const url = yield* Effect.callback<string>((resume) => {
+      server.on("connection", (ws, req) => {
+        if (req.url?.startsWith("/parent")) {
+          parentConnected();
+          ws.on("close", () => {
+            parentDisconnected();
+          });
+          return;
+        }
+        const session = createRpcSession(ws);
+        ws.on("message", (data) => {
+          session.dispatch.message(data.toString());
+        });
+        ws.on("close", (code, reason) => {
+          session.dispatch.close(code, reason.toString());
+        });
+      });
+      server.on("error", (error) => {
+        resume(Effect.die(error));
+      });
+      server.on("listening", () => {
+        resume(getServerAddress(server));
+      });
+    });
+    yield* Effect.addFinalizer(() => Effect.sync(() => server.close()));
+    return { url };
+  }),
+);
+
+function getServerAddress(server: Server): Effect.Effect<string> {
+  const address = server.address();
+  if (
+    typeof address === "object" &&
+    address !== null &&
+    "address" in address &&
+    "port" in address
+  ) {
+    return Effect.succeed(
+      `ws://${address.address === "::" ? "localhost" : address.address}:${address.port}`,
+    );
+  }
+  return Effect.die(
+    new Error(
+      `Server address is not an object with address and port properties: ${JSON.stringify(address)}`,
+    ),
+  );
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerSession.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerSession.ts
new file mode 100644
index 00000000000..66ed081b299
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcServerSession.ts
@@ -0,0 +1,87 @@
+import { RpcSession, type RpcCompatible, type RpcTransport } from "capnweb";
+
+/**
+ * A platform-agnostic interface for a server-side WebSocket.
+ */
+export interface ServerWebSocketLike {
+  send: (message: string) => any | Promise<any>;
+  close: (code?: number, reason?: string) => void;
+}
+
+/**
+ * Represents a websocket RPC session with capnweb.
+ * Use the `dispatch` object to handle messages that are received from the client.
+ */
+export type ServerRpcSession<T extends RpcCompatible<T>> = ReturnType<
+  typeof makeServerRpcSession<T>
+>;
+
+/**
+ * Constructs a ServerRpcSession using capnweb.
+ * @param ws - The WebSocket to use for the session.
+ * @param main - The main object to use for the session.
+ * @returns A ServerRpcSession.
+ */
+export function makeServerRpcSession<T extends RpcCompatible<T>>(
+  ws: ServerWebSocketLike,
+  main: T,
+) {
+  const { transport, dispatch } = makeWebSocketRpcTransport(ws);
+  const session = new RpcSession(transport, main);
+  return { session, dispatch };
+}
+
+function makeWebSocketRpcTransport(ws: ServerWebSocketLike) {
+  let receiveQueue: Array<string> = [];
+  let receiveResolver: ((value: string) => void) | undefined;
+  let receiveRejecter: ((reason: unknown) => void) | undefined;
+  let error: unknown | undefined;
+  return {
+    transport: {
+      send: async (message: string) => await ws.send(message),
+      receive: async () => {
+        const next = receiveQueue.shift();
+        if (next) {
+          return next;
+        } else if (error) {
+          throw error;
+        }
+        return new Promise<string>((resolve, reject) => {
+          receiveResolver = resolve;
+          receiveRejecter = reject;
+        });
+      },
+      abort: (reason: unknown) => {
+        const message =
+          reason instanceof Error ? reason.message : String(reason);
+        ws.close(3000, message);
+        error ??= reason;
+      },
+    } satisfies RpcTransport,
+    dispatch: {
+      message: (data: string | Buffer<ArrayBuffer>) => {
+        if (error) {
+          return;
+        }
+        data = typeof data === "string" ? data : data.toString("utf-8");
+        if (receiveResolver) {
+          receiveResolver(data);
+          receiveResolver = undefined;
+          receiveRejecter = undefined;
+        } else {
+          receiveQueue.push(data);
+        }
+      },
+      close: (code: number, reason: string) => {
+        if (!error) {
+          error = new Error(`WebSocket closed with code ${code}: ${reason}`);
+          if (receiveRejecter) {
+            receiveRejecter(error);
+            receiveRejecter = undefined;
+            receiveResolver = undefined;
+          }
+        }
+      },
+    },
+  };
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Local/RpcSpawner.ts b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcSpawner.ts
new file mode 100644
index 00000000000..9083ae851df
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Local/RpcSpawner.ts
@@ -0,0 +1,196 @@
+import { exitHook } from "@alchemy.run/node-utils/exit-hook";
+import * as Cache from "effect/Cache";
+import * as Context from "effect/Context";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type { PlatformError } from "effect/PlatformError";
+import * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+import * as HttpServer from "effect/unstable/http/HttpServer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+import * as NodeChildProcess from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { httpServer } from "../Util/PlatformServices.ts";
+import {
+  RPC_SERVER_ENVIRONMENT_KEY,
+  type RpcServerEnvironment,
+} from "./RpcServerEnvironment.ts";
+
+export class RpcSpawner extends Context.Service<
+  RpcSpawner,
+  {
+    readonly url: string;
+  }
+>()("alchemy/Local/RpcSpawner") {}
+
+export interface RpcSpawnPayload extends Pick<
+  RpcServerEnvironment,
+  "alchemyContext" | "stack"
+> {
+  serverEntryUrl: string;
+}
+
+export const make = Effect.fnUntraced(function* ({
+  profile,
+  envFile,
+}: Pick<RpcServerEnvironment, "profile" | "envFile">) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const scope = yield* Effect.scope;
+  const cache = yield* Cache.make({
+    lookup: (payload: RpcSpawnPayload) =>
+      spawn(payload).pipe(Scope.provide(scope)),
+    capacity: Infinity,
+  });
+
+  const spawn = Effect.fnUntraced(function* ({
+    serverEntryUrl,
+    alchemyContext,
+    stack,
+  }: RpcSpawnPayload) {
+    const bin = typeof globalThis.Bun !== "undefined" ? "bun" : "node";
+    const main = fileURLToPath(serverEntryUrl);
+    const environment: RpcServerEnvironment = {
+      profile,
+      envFile,
+      alchemyContext,
+      stack,
+    };
+    const command = ChildProcess.make(
+      bin,
+      {
+        bun: ["run", main],
+        // Under Node, transparently strip TypeScript types so that `.ts`
+        // entry points work the same way they do under Bun. Mirrors what
+        // `dev.ts` already does for the outer process, so the dev experience
+        // is symmetric on both runtimes whether the entry came from `src/`
+        // (dev/tests) or `lib/` (published packages).
+        node: main.endsWith(".ts")
+          ? [
+              "--experimental-transform-types",
+              "--no-warnings=ExperimentalWarning",
+              main,
+            ]
+          : [main],
+      }[bin],
+      {
+        stdout: "pipe",
+        stderr: "inherit",
+        detached: false,
+        env: {
+          [RPC_SERVER_ENVIRONMENT_KEY]: JSON.stringify(environment),
+        },
+        extendEnv: true,
+      },
+    );
+    const handle = yield* spawner.spawn(command);
+    const unregister = exitHook(() => {
+      killProcessGroup(handle.pid, "SIGKILL");
+    });
+    const kill = handle
+      .kill({ forceKillAfter: "500 millis" })
+      .pipe(Effect.tap(() => Effect.sync(unregister)));
+    yield* Effect.addFinalizer(() => kill.pipe(Effect.ignore));
+    const url = yield* getRpcAddress(handle.stdout);
+    const ws = yield* Effect.acquireRelease(
+      Effect.sync(() => new WebSocket(new URL("/parent", url))),
+      (ws) => Effect.sync(() => ws.close()),
+    );
+    return {
+      url,
+      isRunning: Effect.zipWith(
+        handle.isRunning,
+        Effect.sync(
+          () =>
+            ws.readyState === WebSocket.CONNECTING ||
+            ws.readyState === WebSocket.OPEN,
+        ),
+        (a, b) => a && b,
+        { concurrent: true },
+      ),
+      kill,
+    };
+  });
+
+  const register = Effect.fnUntraced(function* (
+    payload: RpcSpawnPayload,
+    attempt = 0,
+  ): Effect.fn.Return<string, PlatformError> {
+    const child = yield* Cache.get(cache, payload);
+    if (yield* child.isRunning) {
+      return child.url;
+    }
+    if (attempt > 3) {
+      return yield* Effect.die(
+        new Error(
+          `Failed to spawn RPC server for "${payload.serverEntryUrl}" after ${attempt} attempts.`,
+        ),
+      );
+    }
+    yield* child.kill;
+    yield* Cache.invalidate(cache, payload);
+    return yield* register(payload, attempt + 1);
+  });
+
+  const server = yield* HttpServer.HttpServer;
+
+  yield* server.serve(
+    Effect.gen(function* () {
+      const request = yield* HttpServerRequest;
+      const payload = (yield* request.json) as unknown as RpcSpawnPayload;
+      const url = yield* register(payload);
+      return HttpServerResponse.text(url);
+    }),
+  );
+
+  return RpcSpawner.of({
+    url: HttpServer.formatAddress(server.address),
+  });
+});
+
+export const layerServer = (
+  environment: Pick<RpcServerEnvironment, "profile" | "envFile">,
+) =>
+  Layer.effect(RpcSpawner, make(environment)).pipe(Layer.provide(httpServer()));
+
+const RPC_ADDRESS_REGEX =
+  /(<ALCHEMY_RPC_ADDRESS>)(.+)(<\/ALCHEMY_RPC_ADDRESS>)/;
+
+const getRpcAddress = (stdout: Stream.Stream<Uint8Array, PlatformError>) =>
+  Effect.gen(function* () {
+    const address = yield* Deferred.make<string>();
+    let done = false;
+    yield* stdout.pipe(
+      Stream.decodeText,
+      Stream.splitLines,
+      Stream.runForEach((line) => {
+        if (done) {
+          console.log(line);
+        } else {
+          const match = line.match(RPC_ADDRESS_REGEX);
+          if (match) {
+            done = true;
+            return Deferred.succeed(address, match[2]);
+          }
+        }
+        return Effect.void;
+      }),
+      Effect.forkScoped,
+    );
+    return yield* Deferred.await(address);
+  });
+
+const killProcessGroup = (pid: number, signal: NodeJS.Signals) => {
+  try {
+    if (process.platform === "win32") {
+      NodeChildProcess.execSync(`taskkill /pid ${pid} /T /F`);
+    } else {
+      process.kill(-pid, signal);
+    }
+  } catch {
+    // ignore errors during best-effort cleanup
+  }
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Namespace.ts b/.repos/alchemy-effect/packages/alchemy/src/Namespace.ts
new file mode 100644
index 00000000000..027dccedde6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Namespace.ts
@@ -0,0 +1,64 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+
+export interface NamespaceNode {
+  Id: string;
+  Parent?: NamespaceNode;
+}
+
+export class Namespace extends Context.Service<Namespace, NamespaceNode>()(
+  "Alchemy/Namespace",
+) {}
+
+export function push<const Id extends string, A, Err = never, Req = never>(
+  id: Id,
+  eff: Effect.Effect<A, Err, Req>,
+): Effect.Effect<A, Err, Req>;
+
+export function push<const Id extends string>(
+  id: Id,
+): <A, Err = never, Req = never>(
+  eff: Effect.Effect<A, Err, Req>,
+) => Effect.Effect<A, Err, Req>;
+
+export function push(id: string, eff?: Effect.Effect<any, any, any>) {
+  return eff
+    ? Effect.flatMap(CurrentNamespace, (parent) =>
+        Effect.provideService(eff, Namespace, {
+          Id: id,
+          Parent: parent,
+        }),
+      )
+    : (eff: Effect.Effect<any, any, any>) => push(id, eff);
+}
+
+export const set = (namespace: string | NamespaceNode) =>
+  Effect.provideService(
+    Namespace,
+    typeof namespace === "string" ? { Id: namespace } : namespace,
+  );
+
+export const CurrentNamespace = Effect.serviceOption(Namespace)
+
+  .pipe(Effect.map(Option.getOrUndefined));
+
+export const CurrentChain = CurrentNamespace.pipe(
+  Effect.map(function findRoot(ns): string[] {
+    if (ns?.Parent) {
+      return [ns.Id, ...findRoot(ns.Parent)];
+    }
+    return ns ? [ns.Id] : [];
+  }),
+);
+
+export const Parent = Namespace.pipe(Effect.map((ns) => ns?.Parent));
+
+export const Root = Namespace.pipe(
+  Effect.map(function findRoot(ns) {
+    if (ns.Parent) {
+      return findRoot(ns.Parent);
+    }
+    return ns;
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/AuthProvider.ts
new file mode 100644
index 00000000000..52e355dc448
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/AuthProvider.ts
@@ -0,0 +1,223 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import { getEnvRedacted, retryOnce } from "../Auth/Env.ts";
+import { Profile } from "../Auth/Profile.ts";
+import * as Clank from "../Util/Clank.ts";
+
+export const NEON_AUTH_PROVIDER_NAME = "Neon";
+
+export type NeonAuthConfig = { method: "env" } | { method: "stored" };
+
+export type NeonStoredCredentials = {
+  type: "apiKey";
+  apiKey: string;
+};
+
+export type NeonResolvedCredentials = {
+  type: "apiKey";
+  apiKey: Redacted.Redacted<string>;
+  source: { type: NeonAuthConfig["method"]; details?: string };
+};
+
+const options: Array<{
+  value: NeonAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "env",
+    label: "Environment Variable",
+    hint: "NEON_API_KEY",
+  },
+  {
+    value: "stored",
+    label: "API Key",
+    hint: "enter interactively, stored in ~/.alchemy/credentials",
+  },
+];
+
+/**
+ * Layer that registers the Neon {@link AuthProvider} into the
+ * {@link AuthProviders} registry.
+ */
+export const NeonAuth = AuthProviderLayer<
+  NeonAuthConfig,
+  NeonResolvedCredentials
+>()(
+  NEON_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const profiles = yield* Profile;
+    const store = yield* CredentialsStore;
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const apiKey = yield* Clank.password({
+        message: "Neon API Key",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      yield* store.write<NeonStoredCredentials>(profileName, "neon-stored", {
+        type: "apiKey",
+        apiKey,
+      });
+      yield* Clank.success("Neon: credentials saved.");
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Neon authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: NeonAuthConfig,
+    ): Effect.Effect<NeonResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const apiKey = yield* getEnvRedacted("NEON_API_KEY");
+            if (!apiKey) {
+              return yield* new AuthError({
+                message: "Neon env credentials not found. Set NEON_API_KEY.",
+              });
+            }
+            return {
+              type: "apiKey" as const,
+              apiKey,
+              source: { type: "env" as const },
+            };
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store.read<NeonStoredCredentials>(profileName, "neon-stored").pipe(
+            Effect.flatMap((creds) =>
+              creds == null
+                ? Effect.fail(
+                    new AuthError({
+                      message:
+                        "Neon stored credentials not found. Run: alchemy-effect login --configure",
+                    }),
+                  )
+                : Effect.succeed({
+                    type: "apiKey" as const,
+                    apiKey: Redacted.make(creds.apiKey),
+                    source: { type: "stored" as const },
+                  }),
+            ),
+          ),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: NeonAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "neon-stored")
+            .pipe(
+              Effect.andThen(Clank.success("Neon: stored credentials removed")),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: NeonAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () =>
+            // If NEON_API_KEY isn't set, fall through to the interactive picker
+            // so the user can switch to `stored` (or be told to set the env var)
+            // instead of silently failing later in `read`. The new selection is
+            // persisted to the profile so subsequent logins don't re-prompt.
+            getEnvRedacted("NEON_API_KEY").pipe(
+              Effect.flatMap((apiKey) =>
+                apiKey
+                  ? Effect.void
+                  : Effect.gen(function* () {
+                      const next = yield* configureInteractive(profileName);
+                      const existing = yield* profiles.getProfile(profileName);
+                      yield* profiles.setProfile(profileName, {
+                        ...existing,
+                        [NEON_AUTH_PROVIDER_NAME]: next,
+                      });
+                    }),
+              ),
+            ),
+          ),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<NeonStoredCredentials>(profileName, "neon-stored")
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: NeonAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(`  apiKey: ${displayRedacted(creds.apiKey, 9)}`),
+            Console.log(`  source: ${sourceStr}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/Branch.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/Branch.ts
new file mode 100644
index 00000000000..8a70f571ea7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/Branch.ts
@@ -0,0 +1,608 @@
+import {
+  createProjectBranch,
+  deleteProjectBranch,
+  getConnectionURI,
+  getProjectBranch,
+  listProjectBranchDatabases,
+  listProjectBranches,
+  type ListProjectBranchesOutput,
+  updateProjectBranch,
+} from "@distilled.cloud/neon";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../Diff.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { applyMigrations, runSql } from "./Migrations.ts";
+import { parsePostgresOrigin, type PostgresOrigin } from "./PostgresOrigin.ts";
+import { type Project, waitForOperations } from "./Project.ts";
+import type { Providers } from "./Providers.ts";
+import { listSqlFiles, readSqlFile } from "../Sql/SqlFile.ts";
+
+const findBranchByName = (projectId: string, name: string) =>
+  Effect.gen(function* () {
+    const matches: ListProjectBranchesOutput["branches"][number][] = [];
+    let cursor: string | undefined;
+    do {
+      const page = yield* listProjectBranches({
+        project_id: projectId,
+        search: name,
+        ...(cursor !== undefined ? { cursor } : {}),
+      });
+      for (const b of page.branches) {
+        if (b.name === name) matches.push(b);
+      }
+      cursor = page.pagination?.next;
+    } while (cursor);
+    return matches;
+  });
+
+const DEFAULT_MIGRATIONS_TABLE = "neon_migrations";
+
+export type BranchSource =
+  | Project
+  | { projectId: string }
+  | { project: Project };
+
+export type ParentBranchSource =
+  | Branch
+  | { branchId: string }
+  | { name: string };
+
+export type BranchEndpointConfig = {
+  type: "read_only" | "read_write";
+  autoscalingLimitMinCu?: number;
+  autoscalingLimitMaxCu?: number;
+  suspendTimeoutSeconds?: number;
+};
+
+export type BranchProps = {
+  /**
+   * The Neon project (or `{ projectId }`) to create the branch in.
+   */
+  project: BranchSource;
+  /**
+   * Branch name. If omitted, a unique name is generated from
+   * `${app}-${stage}-${id}`.
+   */
+  name?: string;
+  /**
+   * The parent branch to fork from. Accepts a `Branch`, a
+   * `{ branchId }`, or `{ name }` to look up by name. Defaults to the
+   * project's default branch.
+   */
+  parentBranch?: ParentBranchSource;
+  /**
+   * A Log Sequence Number on the parent branch. The new branch is created
+   * with parent data as of this LSN.
+   */
+  parentLsn?: string;
+  /**
+   * An ISO-8601 timestamp identifying a point in time on the parent branch
+   * to fork from.
+   */
+  parentTimestamp?: string;
+  /**
+   * Whether the branch is protected from deletion / mutation.
+   *
+   * @default false
+   */
+  protected?: boolean;
+  /**
+   * Initialization source.
+   *
+   * - `parent-data` (default) — copy schema and data from the parent.
+   * - `schema-only` — copy only the schema.
+   */
+  initSource?: "schema-only" | "parent-data";
+  /**
+   * RFC-3339 timestamp at which Neon should auto-delete the branch.
+   * Useful for ephemeral preview branches.
+   */
+  expiresAt?: string;
+  /**
+   * Endpoints to create for the branch. At least one `read-write` endpoint
+   * is required to connect to the branch.
+   *
+   * @default [{ type: "read_write" }]
+   */
+  endpoints?: BranchEndpointConfig[];
+  /**
+   * Directory containing `.sql` migration files. Files are sorted by their
+   * numeric prefix (e.g. `0001_init.sql`) and applied in order against the
+   * branch.
+   */
+  migrationsDir?: string;
+  /**
+   * Name of the table used to track applied migrations.
+   *
+   * @default "neon_migrations"
+   */
+  migrationsTable?: string;
+  /**
+   * Paths to additional `.sql` files to apply after migrations.
+   */
+  importFiles?: string[];
+};
+
+export type Branch = Resource<
+  "Neon.Branch",
+  BranchProps,
+  {
+    branchId: string;
+    branchName: string;
+    projectId: string;
+    parentBranchId: string | undefined;
+    parentLsn: string | undefined;
+    parentTimestamp: string | undefined;
+    initSource: "schema-only" | "parent-data" | undefined;
+    protected: boolean;
+    default: boolean;
+    expiresAt: string | undefined;
+    databaseName: string;
+    roleName: string;
+    /** Postgres connection URI for the branch's primary database. */
+    connectionUri: string;
+    /** Pooled connection URI (uses pgbouncer). */
+    pooledConnectionUri: string;
+    /**
+     * Parsed connection components ready to feed into a Postgres origin
+     * — e.g. `Cloudflare.Hyperdrive`'s `origin` prop. Points at the
+     * direct (non-pooled) endpoint, which is the recommended target
+     * when fronting Neon with another pooler like Hyperdrive.
+     */
+    origin: PostgresOrigin;
+    migrationsDir: string | undefined;
+    migrationsTable: string | undefined;
+    migrationsHashes: Record<string, string>;
+    importHashes: Record<string, string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A branch of a Neon project.
+ *
+ * Branches are first-class, copy-on-write copies of a parent branch — they
+ * share storage with the parent until the new branch starts diverging.
+ *
+ * @section Branching from a project's default branch
+ * @example Basic branch
+ * ```typescript
+ * const project = yield* Neon.Project("my-project");
+ * const dev = yield* Neon.Branch("dev-branch", { project });
+ * ```
+ *
+ * @section Branching from another branch
+ * @example Branch off another branch
+ * ```typescript
+ * const dev = yield* Neon.Branch("dev", { project });
+ * const featureBranch = yield* Neon.Branch("feature", {
+ *   project,
+ *   parentBranch: dev,
+ * });
+ * ```
+ *
+ * @section Point-in-time branches
+ * @example Branch from a parent at a specific LSN
+ * ```typescript
+ * const branch = yield* Neon.Branch("at-lsn", {
+ *   project,
+ *   parentLsn: "0/3FA01B0",
+ * });
+ * ```
+ *
+ * @section Migrations on a branch
+ * @example Apply migrations on the branch only
+ * ```typescript
+ * const featureBranch = yield* Neon.Branch("feature", {
+ *   project,
+ *   migrationsDir: "./migrations",
+ * });
+ * ```
+ *
+ * @see https://neon.tech/docs/manage/branches/
+ */
+export const Branch = Resource<Branch>("Neon.Branch");
+
+const resolveProjectId = (source: BranchSource): string => {
+  if ("projectId" in source && source.projectId) {
+    return source.projectId as unknown as string;
+  }
+  if ("project" in source && source.project) {
+    return source.project.projectId as unknown as string;
+  }
+  throw new Error(
+    "Invalid Neon project source: must be a Project, { projectId }, or { project }",
+  );
+};
+
+const resolveParentBranchId = (
+  source: ParentBranchSource | undefined,
+  projectId: string,
+) =>
+  Effect.gen(function* () {
+    if (!source) return undefined as string | undefined;
+    if ("branchId" in source && source.branchId) {
+      return source.branchId as unknown as string;
+    }
+    if ("name" in source && source.name) {
+      const matches = yield* findBranchByName(projectId, source.name);
+      if (matches.length === 0) {
+        return yield* Effect.die(
+          `Parent branch "${source.name}" not found in project ${projectId}`,
+        );
+      }
+      if (matches.length > 1) {
+        return yield* Effect.die(
+          `Multiple branches with name "${source.name}" in project ${projectId}`,
+        );
+      }
+      return matches[0]!.id;
+    }
+    return undefined as string | undefined;
+  });
+
+const buildEndpoints = (endpoints: BranchEndpointConfig[] | undefined) => {
+  const list = endpoints ?? [{ type: "read_write" as const }];
+  return list.map((e) => ({
+    type: e.type,
+    autoscaling_limit_min_cu: e.autoscalingLimitMinCu,
+    autoscaling_limit_max_cu: e.autoscalingLimitMaxCu,
+    suspend_timeout_seconds: e.suspendTimeoutSeconds,
+  }));
+};
+
+const fetchConnection = (
+  projectId: string,
+  branchId: string,
+  databaseName: string,
+  roleName: string,
+) =>
+  Effect.gen(function* () {
+    const direct = yield* getConnectionURI({
+      project_id: projectId,
+      branch_id: branchId,
+      database_name: databaseName,
+      role_name: roleName,
+      pooled: false,
+    });
+    const pooled = yield* getConnectionURI({
+      project_id: projectId,
+      branch_id: branchId,
+      database_name: databaseName,
+      role_name: roleName,
+      pooled: true,
+    });
+    return { uri: direct.uri, pooled: pooled.uri };
+  });
+
+export const BranchProvider = () =>
+  Provider.effect(
+    Branch,
+    Effect.gen(function* () {
+      const rootDir = process.cwd();
+
+      const createBranchName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          return name ?? (yield* createPhysicalName({ id }));
+        });
+
+      return {
+        stables: ["branchId", "projectId"],
+        diff: Effect.fn(function* ({ id, olds, news, output }) {
+          if (!isResolved(news)) return undefined;
+          if (
+            news.parentLsn !== undefined &&
+            output?.parentLsn !== news.parentLsn
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            news.parentTimestamp !== undefined &&
+            output?.parentTimestamp !== news.parentTimestamp
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            output?.initSource !== undefined &&
+            output.initSource !== (news.initSource ?? "parent-data")
+          ) {
+            return { action: "replace" } as const;
+          }
+          const newName = yield* createBranchName(id, news.name);
+          const oldName = output?.branchName
+            ? output.branchName
+            : yield* createBranchName(id, olds.name);
+          if (
+            newName !== oldName ||
+            (news.protected ?? false) !== (output?.protected ?? false) ||
+            (news.expiresAt ?? undefined) !== (output?.expiresAt ?? undefined)
+          ) {
+            return { action: "update" } as const;
+          }
+          if (news.migrationsDir) {
+            const newHashes = yield* hashMigrations(news.migrationsDir);
+            if (!recordsEqual(newHashes, output?.migrationsHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+            if (
+              (news.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE) !==
+              (output?.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE)
+            ) {
+              return { action: "update" } as const;
+            }
+          }
+          if (news.importFiles?.length) {
+            const newHashes = yield* hashImports(news.importFiles, rootDir);
+            if (!recordsEqual(newHashes, output?.importHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.branchId) {
+            return yield* getProjectBranch({
+              project_id: output.projectId,
+              branch_id: output.branchId,
+            }).pipe(
+              Effect.map(({ branch }) => ({
+                ...output,
+                branchName: branch.name,
+                protected: branch.protected,
+                default: branch.default,
+                expiresAt: branch.expires_at,
+              })),
+              Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+            );
+          }
+          if (!olds?.project) return undefined;
+          const projectId = resolveProjectId(olds.project as BranchSource);
+          const name = yield* createBranchName(id, olds.name);
+          const matches = yield* findBranchByName(projectId, name);
+          const match = matches[0];
+          if (!match) return undefined;
+          const dbs = yield* listProjectBranchDatabases({
+            project_id: projectId,
+            branch_id: match.id,
+          });
+          const db = dbs.databases[0];
+          if (!db) return undefined;
+          const conn = yield* fetchConnection(
+            projectId,
+            match.id,
+            db.name,
+            db.owner_name,
+          );
+          return {
+            branchId: match.id,
+            branchName: match.name,
+            projectId,
+            parentBranchId: match.parent_id,
+            parentLsn: match.parent_lsn,
+            parentTimestamp: match.parent_timestamp,
+            initSource: match.init_source as
+              | "schema-only"
+              | "parent-data"
+              | undefined,
+            protected: match.protected,
+            default: match.default,
+            expiresAt: match.expires_at,
+            databaseName: db.name,
+            roleName: db.owner_name,
+            connectionUri: conn.uri,
+            pooledConnectionUri: conn.pooled,
+            origin: parsePostgresOrigin(conn.uri),
+            migrationsDir: olds?.migrationsDir,
+            migrationsTable: olds?.migrationsTable,
+            migrationsHashes: {},
+            importHashes: {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const newName = yield* createBranchName(id, news.name);
+
+          // Ensure — when no prior output exists we create the branch;
+          // otherwise sync the mutable scalar fields on the existing
+          // branch via updateProjectBranch.
+          const branchInfo = output
+            ? yield* updateProjectBranch({
+                project_id: output.projectId,
+                branch_id: output.branchId,
+                branch: {
+                  name: newName !== output.branchName ? newName : undefined,
+                  protected: news.protected,
+                  expires_at: news.expiresAt ?? null,
+                },
+              }).pipe(
+                Effect.map((r) => ({
+                  branchId: output.branchId,
+                  branchName: r.branch.name,
+                  projectId: output.projectId,
+                  parentBranchId: output.parentBranchId,
+                  parentLsn: output.parentLsn,
+                  parentTimestamp: output.parentTimestamp,
+                  initSource: output.initSource,
+                  protected: r.branch.protected,
+                  default: output.default,
+                  expiresAt: r.branch.expires_at,
+                  databaseName: output.databaseName,
+                  roleName: output.roleName,
+                  connectionUri: output.connectionUri,
+                  pooledConnectionUri: output.pooledConnectionUri,
+                  origin: output.origin,
+                })),
+              )
+            : yield* Effect.gen(function* () {
+                const projectId = resolveProjectId(
+                  news.project as BranchSource,
+                );
+                const parentBranchId = yield* resolveParentBranchId(
+                  news.parentBranch as ParentBranchSource | undefined,
+                  projectId,
+                );
+                const created = yield* createProjectBranch({
+                  project_id: projectId,
+                  branch: {
+                    name: newName,
+                    parent_id: parentBranchId,
+                    parent_lsn: news.parentLsn,
+                    parent_timestamp: news.parentTimestamp,
+                    init_source: news.initSource,
+                    protected: news.protected,
+                    expires_at: news.expiresAt,
+                  },
+                  endpoints: buildEndpoints(news.endpoints),
+                });
+                yield* waitForOperations(created.operations);
+
+                const db = created.databases[0];
+                if (!db) {
+                  return yield* Effect.die(
+                    `Neon branch ${created.branch.id} created with no databases`,
+                  );
+                }
+                const conn = yield* fetchConnection(
+                  projectId,
+                  created.branch.id,
+                  db.name,
+                  db.owner_name,
+                );
+                return {
+                  branchId: created.branch.id,
+                  branchName: created.branch.name,
+                  projectId: created.branch.project_id,
+                  parentBranchId: created.branch.parent_id,
+                  parentLsn: created.branch.parent_lsn,
+                  parentTimestamp: created.branch.parent_timestamp,
+                  initSource: created.branch.init_source as
+                    | "schema-only"
+                    | "parent-data"
+                    | undefined,
+                  protected: created.branch.protected,
+                  default: created.branch.default,
+                  expiresAt: created.branch.expires_at,
+                  databaseName: db.name,
+                  roleName: db.owner_name,
+                  connectionUri: conn.uri,
+                  pooledConnectionUri: conn.pooled,
+                  origin: parsePostgresOrigin(conn.uri),
+                };
+              });
+
+          const connectionUri = Redacted.make(branchInfo.connectionUri);
+          const migrationsTable =
+            news.migrationsTable ??
+            output?.migrationsTable ??
+            DEFAULT_MIGRATIONS_TABLE;
+          const migrationsHashes = news.migrationsDir
+            ? yield* runMigrations(
+                connectionUri,
+                news.migrationsDir,
+                migrationsTable,
+              )
+            : (output?.migrationsHashes ?? {});
+          const importHashes = news.importFiles?.length
+            ? yield* runImports(
+                connectionUri,
+                news.importFiles,
+                rootDir,
+                output?.importHashes ?? {},
+              )
+            : {};
+
+          return {
+            ...branchInfo,
+            migrationsDir: news.migrationsDir,
+            migrationsTable: news.migrationsDir ? migrationsTable : undefined,
+            migrationsHashes,
+            importHashes,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteProjectBranch({
+            project_id: output.projectId,
+            branch_id: output.branchId,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const runMigrations = (
+  connectionUri: Redacted.Redacted<string>,
+  migrationsDir: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const files = yield* listSqlFiles(migrationsDir);
+    if (files.length > 0) {
+      yield* applyMigrations({
+        connectionUri,
+        migrationsTable,
+        migrationsFiles: files,
+      });
+    }
+    const hashes: Record<string, string> = {};
+    for (const file of files) hashes[file.id] = file.hash;
+    return hashes;
+  });
+
+const runImports = (
+  connectionUri: Redacted.Redacted<string>,
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+  previous: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = { ...previous };
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      if (previous[filePath] === file.hash) {
+        hashes[filePath] = file.hash;
+        continue;
+      }
+      yield* runSql(connectionUri, file.sql);
+      hashes[filePath] = file.hash;
+    }
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+      if (!tracked.has(key)) delete hashes[key];
+    }
+    return hashes;
+  });
+
+const hashMigrations = (migrationsDir: string) =>
+  listSqlFiles(migrationsDir).pipe(
+    Effect.map((files) => {
+      const hashes: Record<string, string> = {};
+      for (const file of files) hashes[file.id] = file.hash;
+      return hashes;
+    }),
+  );
+
+const hashImports = (importFiles: ReadonlyArray<string>, rootDir: string) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = {};
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      hashes[filePath] = file.hash;
+    }
+    return hashes;
+  });
+
+const recordsEqual = (
+  a: Record<string, string>,
+  b: Record<string, string>,
+): boolean => {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (a[k] !== b[k]) return false;
+  }
+  return true;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/Credentials.ts
new file mode 100644
index 00000000000..89bd541ee7f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/Credentials.ts
@@ -0,0 +1,46 @@
+import { ConfigError } from "@distilled.cloud/core/errors";
+import { Credentials } from "@distilled.cloud/neon";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  NEON_AUTH_PROVIDER_NAME,
+  type NeonAuthConfig,
+  type NeonResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export { Credentials } from "@distilled.cloud/neon";
+
+const DEFAULT_BASE_URL = "https://console.neon.tech/api/v2";
+
+export const fromAuthProvider = () =>
+  Layer.effect(
+    Credentials,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        NeonAuthConfig,
+        NeonResolvedCredentials
+      >(NEON_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as NeonAuthConfig),
+        ),
+        Effect.map((creds) => ({
+          apiKey: creds.apiKey,
+          apiBaseUrl: DEFAULT_BASE_URL,
+        })),
+        Effect.mapError(
+          (e) =>
+            new ConfigError({
+              message: `Failed to resolve Neon credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+      );
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/Migrations.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/Migrations.ts
new file mode 100644
index 00000000000..aeaca2ab4e1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/Migrations.ts
@@ -0,0 +1,128 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { Client } from "pg";
+import type { SqlFile } from "../Sql/SqlFile.ts";
+
+export class PgError extends Data.TaggedError("PgError")<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+export interface ApplyMigrationsOptions {
+  connectionUri: Redacted.Redacted<string>;
+  migrationsTable: string;
+  migrationsFiles: ReadonlyArray<SqlFile>;
+}
+
+/**
+ * Strip query-string SSL flags from a Neon connection URI. Neon's URIs
+ * include `sslmode=require` and `channel_binding=require`, which trigger
+ * a deprecation warning from `pg-connection-string`:
+ *
+ *   SECURITY WARNING: The SSL modes 'prefer', 'require', and 'verify-ca'
+ *   are treated as aliases for 'verify-full'.
+ *
+ * We control SSL programmatically via the `ssl` option below, so removing
+ * the conflicting query params silences the warning without changing the
+ * effective behavior.
+ */
+const stripSslQueryParams = (uri: string): string => {
+  try {
+    const url = new URL(uri);
+    url.searchParams.delete("sslmode");
+    url.searchParams.delete("channel_binding");
+    return url.toString();
+  } catch {
+    return uri;
+  }
+};
+
+const withClient = <A, E>(
+  connectionUri: Redacted.Redacted<string>,
+  fn: (client: Client) => Promise<A>,
+): Effect.Effect<A, PgError | E> =>
+  Effect.tryPromise({
+    try: async () => {
+      const client = new Client({
+        connectionString: stripSslQueryParams(Redacted.value(connectionUri)),
+        ssl: { rejectUnauthorized: false },
+      });
+      await client.connect();
+      try {
+        return await fn(client);
+      } finally {
+        await client.end().catch(() => {});
+      }
+    },
+    catch: (cause) =>
+      new PgError({
+        message: cause instanceof Error ? cause.message : String(cause),
+        cause,
+      }),
+  });
+
+const ensureMigrationsTable = (client: Client, migrationsTable: string) =>
+  client.query(
+    `CREATE TABLE IF NOT EXISTS "${migrationsTable}" (
+       id TEXT PRIMARY KEY,
+       name TEXT NOT NULL,
+       applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+     );`,
+  );
+
+const getApplied = (client: Client, migrationsTable: string) =>
+  client
+    .query<{ name: string }>(`SELECT name FROM "${migrationsTable}";`)
+    .then((r) => new Set(r.rows.map((row) => row.name)));
+
+const getNextSeq = (client: Client, migrationsTable: string) =>
+  client
+    .query<{ id: string }>(`SELECT id FROM "${migrationsTable}";`)
+    .then((r) => {
+      let max = 0;
+      for (const { id } of r.rows) {
+        if (/^\d+$/.test(id)) {
+          max = Math.max(max, Number.parseInt(id, 10));
+        }
+      }
+      return max + 1;
+    });
+
+/**
+ * Apply pending Postgres migrations in order, tracked in `migrationsTable`.
+ * Each migration runs inside a transaction together with the bookkeeping
+ * INSERT so partial application is impossible.
+ */
+export const applyMigrations = (options: ApplyMigrationsOptions) =>
+  withClient(options.connectionUri, async (client) => {
+    await ensureMigrationsTable(client, options.migrationsTable);
+    const applied = await getApplied(client, options.migrationsTable);
+    let nextSeq = await getNextSeq(client, options.migrationsTable);
+
+    for (const file of options.migrationsFiles) {
+      if (applied.has(file.id)) continue;
+      const migrationId = nextSeq.toString().padStart(5, "0");
+      nextSeq += 1;
+      await client.query("BEGIN");
+      try {
+        await client.query(file.sql);
+        await client.query(
+          `INSERT INTO "${options.migrationsTable}" (id, name) VALUES ($1, $2);`,
+          [migrationId, file.id],
+        );
+        await client.query("COMMIT");
+      } catch (err) {
+        await client.query("ROLLBACK").catch(() => {});
+        throw err;
+      }
+    }
+  });
+
+/**
+ * Run a single SQL script against the database (used for `importFiles`).
+ */
+export const runSql = (connectionUri: Redacted.Redacted<string>, sql: string) =>
+  withClient(connectionUri, async (client) => {
+    await client.query(sql);
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/NeonEnvironment.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/NeonEnvironment.ts
new file mode 100644
index 00000000000..f16e1b96dc7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/NeonEnvironment.ts
@@ -0,0 +1,32 @@
+import * as Config from "effect/Config";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  NEON_AUTH_PROVIDER_NAME,
+  type NeonAuthConfig,
+  type NeonResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export class NeonEnvironment extends Context.Service<
+  NeonEnvironment,
+  NeonResolvedCredentials
+>()("Neon::NeonEnvironment") {}
+
+export const fromProfile = () =>
+  Layer.effect(
+    NeonEnvironment,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        NeonAuthConfig,
+        NeonResolvedCredentials
+      >(NEON_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const config = yield* profile.loadOrConfigure(auth, profileName, { ci });
+      return yield* auth.read(profileName, config as NeonAuthConfig);
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/PostgresOrigin.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/PostgresOrigin.ts
new file mode 100644
index 00000000000..4bada59aa50
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/PostgresOrigin.ts
@@ -0,0 +1,41 @@
+import * as Redacted from "effect/Redacted";
+
+/**
+ * The shape `Cloudflare.Hyperdrive` and other Postgres consumers accept
+ * as `origin`. Materialized on `Neon.Project` and `Neon.Branch` so callers
+ * can wire databases into Hyperdrive directly:
+ *
+ * ```typescript
+ * const branch = yield* Neon.Branch("preview", { project });
+ * const hd = yield* Cloudflare.Hyperdrive("preview-hd", {
+ *   origin: branch.origin,
+ * });
+ * ```
+ */
+export type PostgresOrigin = {
+  scheme: "postgres" | "postgresql" | "mysql";
+  host: string;
+  port: number;
+  database: string;
+  user: string;
+  password: Redacted.Redacted<string>;
+};
+
+/**
+ * Parse a Postgres connection URI into the structured origin shape.
+ * Used to derive `branch.origin` / `project.origin` from the API
+ * response's `connectionUri`.
+ */
+export const parsePostgresOrigin = (uri: string): PostgresOrigin => {
+  const url = new URL(uri);
+  const scheme: PostgresOrigin["scheme"] =
+    url.protocol === "postgresql:" ? "postgresql" : "postgres";
+  return {
+    scheme,
+    host: url.hostname,
+    port: url.port ? Number(url.port) : 5432,
+    database: url.pathname.replace(/^\//, ""),
+    user: decodeURIComponent(url.username),
+    password: Redacted.make(decodeURIComponent(url.password)),
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/Project.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/Project.ts
new file mode 100644
index 00000000000..b30c1edbe78
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/Project.ts
@@ -0,0 +1,670 @@
+import {
+  type CreateProjectOutput,
+  deleteProject,
+  getConnectionURI,
+  getProject,
+  getProjectOperation,
+  listProjectBranchDatabases,
+  listProjectBranches,
+  listProjects,
+  type ListProjectsOutput,
+  createProject as sdkCreateProject,
+  updateProject,
+} from "@distilled.cloud/neon";
+import * as Console from "effect/Console";
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../Diff.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import * as Provider from "../Provider.ts";
+import { Resource } from "../Resource.ts";
+import { applyMigrations, runSql } from "./Migrations.ts";
+import { parsePostgresOrigin, type PostgresOrigin } from "./PostgresOrigin.ts";
+import type { Providers } from "./Providers.ts";
+import {
+  listSqlFiles,
+  readSqlFile,
+  hashMigrations,
+  hashImports,
+} from "../Sql/SqlFile.ts";
+
+type NeonOperationStatus =
+  | "scheduling"
+  | "running"
+  | "finished"
+  | "failed"
+  | "error"
+  | "cancelling"
+  | "cancelled"
+  | "skipped";
+
+export class OperationFailed extends Data.TaggedError("OperationFailed")<{
+  operationId: string;
+  action: string;
+  status: NeonOperationStatus;
+  error?: string;
+}> {}
+
+class OperationPending extends Data.TaggedError("OperationPending")<{
+  operationId: string;
+}> {}
+
+const isOperationComplete = (status: NeonOperationStatus): boolean =>
+  status === "finished" ||
+  status === "failed" ||
+  status === "error" ||
+  status === "cancelled" ||
+  status === "skipped";
+
+/**
+ * Wait for the given operations to reach a terminal state. Polls every
+ * 500ms with exponential backoff up to ~30s per operation.
+ */
+export const waitForOperations = (
+  operations: ReadonlyArray<{
+    readonly id: string;
+    readonly project_id: string;
+    readonly action: string;
+    readonly status: NeonOperationStatus;
+    readonly error?: string;
+  }>,
+) =>
+  Effect.gen(function* () {
+    for (const op of operations) {
+      if (isOperationComplete(op.status)) {
+        if (op.status === "failed" || op.status === "error") {
+          return yield* new OperationFailed({
+            operationId: op.id,
+            action: op.action,
+            status: op.status,
+            error: op.error,
+          });
+        }
+        continue;
+      }
+      yield* getProjectOperation({
+        project_id: op.project_id,
+        operation_id: op.id,
+      }).pipe(
+        Effect.flatMap(
+          ({
+            operation,
+          }): Effect.Effect<void, OperationFailed | OperationPending> => {
+            const status = operation.status as NeonOperationStatus;
+            if (status === "failed" || status === "error") {
+              return Effect.fail(
+                new OperationFailed({
+                  operationId: operation.id,
+                  action: operation.action,
+                  status,
+                  error: operation.error,
+                }),
+              );
+            }
+            if (!isOperationComplete(status)) {
+              return Effect.fail(new OperationPending({ operationId: op.id }));
+            }
+            return Effect.void;
+          },
+        ),
+        Effect.retry({
+          while: (e: unknown) => {
+            const tag = (e as { _tag?: string })._tag;
+            return (
+              tag === "OperationPending" ||
+              tag === "TooManyRequests" ||
+              tag === "ServiceUnavailable" ||
+              tag === "InternalServerError" ||
+              tag === "BadGateway" ||
+              tag === "GatewayTimeout"
+            );
+          },
+          schedule: Schedule.both(
+            Schedule.exponential(Duration.millis(500), 1.5),
+            Schedule.recurs(60),
+          ),
+        }),
+        Effect.catchTag("OperationPending", () => Effect.void),
+      );
+    }
+  });
+
+const findProjectByName = (name: string) =>
+  Effect.gen(function* () {
+    const matches: ListProjectsOutput["projects"][number][] = [];
+    let cursor: string | undefined;
+    while (true) {
+      const page = yield* listProjects({
+        search: name,
+        ...(cursor !== undefined ? { cursor } : {}),
+      });
+      for (const p of page.projects) {
+        if (p.name === name) matches.push(p);
+      }
+      const nextCursor = page.pagination?.cursor;
+      // Neon returns a `pagination.cursor` on every response — it's the
+      // `created_at` of the last row, not a "has next page" flag — so we
+      // can't loop on cursor presence alone or we spin forever re-fetching
+      // empty/identical pages. Stop once a page comes back empty or the
+      // cursor stops advancing.
+      if (
+        page.projects.length === 0 ||
+        nextCursor === undefined ||
+        nextCursor === cursor
+      ) {
+        break;
+      }
+      cursor = nextCursor;
+    }
+    return matches;
+  });
+
+export type NeonRegion =
+  | "aws-us-east-1"
+  | "aws-us-east-2"
+  | "aws-us-west-2"
+  | "aws-eu-central-1"
+  | "aws-eu-west-2"
+  | "aws-ap-southeast-1"
+  | "aws-ap-southeast-2"
+  | "aws-sa-east-1"
+  | "azure-eastus2"
+  | "azure-westus3"
+  | "azure-gwc";
+
+export type NeonPgVersion = 14 | 15 | 16 | 17 | 18;
+
+const DEFAULT_MIGRATIONS_TABLE = "neon_migrations";
+const DEFAULT_REGION: NeonRegion = "aws-us-east-1";
+const DEFAULT_PG_VERSION: NeonPgVersion = 17;
+
+export type ProjectProps = {
+  /**
+   * Name of the project. If omitted, a unique name is generated from
+   * `${app}-${stage}-${id}`.
+   */
+  name?: string;
+  /**
+   * Region where the project is provisioned. Cannot be changed after
+   * creation.
+   *
+   * @default "aws-us-east-1"
+   */
+  region?: NeonRegion;
+  /**
+   * Postgres version. Cannot be changed after creation.
+   *
+   * @default 17
+   */
+  pgVersion?: NeonPgVersion;
+  /**
+   * Name of the default branch. Defaults to Neon's default ("main"). Cannot
+   * be changed after creation.
+   */
+  defaultBranchName?: string;
+  /**
+   * Name of the default role created with the project. Defaults to
+   * `neondb_owner`. Cannot be changed after creation.
+   */
+  roleName?: string;
+  /**
+   * Name of the default database created with the project. Defaults to
+   * `neondb`. Cannot be changed after creation.
+   */
+  databaseName?: string;
+  /**
+   * Number of seconds of WAL history retained on the project for
+   * point-in-time branching/restore.
+   *
+   * @default 86400
+   */
+  historyRetentionSeconds?: number;
+  /**
+   * Optional Neon organization ID. Cannot be changed after creation.
+   */
+  orgId?: string;
+  /**
+   * Enable Postgres logical replication on the project. Once enabled,
+   * Neon does not support disabling it again.
+   *
+   * @default false
+   * @see https://neon.tech/docs/guides/logical-replication-neon
+   */
+  enableLogicalReplication?: boolean;
+  /**
+   * Directory containing `.sql` migration files. Files are sorted by their
+   * numeric prefix (e.g. `0001_init.sql`) and applied in order against the
+   * default branch's primary database.
+   */
+  migrationsDir?: string;
+  /**
+   * Name of the table used to track applied migrations.
+   *
+   * @default "neon_migrations"
+   */
+  migrationsTable?: string;
+  /**
+   * Paths to additional `.sql` files to apply after migrations. Each file
+   * is hashed; only files whose contents change are re-applied on
+   * subsequent deploys.
+   */
+  importFiles?: string[];
+};
+
+export type Project = Resource<
+  "Neon.Project",
+  ProjectProps,
+  {
+    projectId: string;
+    projectName: string;
+    region: NeonRegion;
+    pgVersion: NeonPgVersion;
+    defaultBranchId: string;
+    defaultBranchName: string;
+    databaseName: string;
+    roleName: string;
+    /** Postgres connection URI for the default branch + database. */
+    connectionUri: string;
+    /** Pooled connection URI (uses pgbouncer). */
+    pooledConnectionUri: string;
+    /**
+     * Parsed connection components ready to feed into a Postgres origin
+     * — e.g. `Cloudflare.Hyperdrive`'s `origin` prop. Points at the
+     * direct (non-pooled) endpoint, which is the recommended target
+     * when fronting Neon with another pooler like Hyperdrive.
+     */
+    origin: PostgresOrigin;
+    historyRetentionSeconds: number;
+    enableLogicalReplication: boolean;
+    migrationsDir: string | undefined;
+    migrationsTable: string | undefined;
+    migrationsHashes: Record<string, string>;
+    importHashes: Record<string, string>;
+  },
+  never,
+  Providers
+>;
+
+/**
+ * A Neon serverless Postgres project.
+ *
+ * Creating a project also provisions the project's default branch (named
+ * "main" by default), an initial role, an initial database, and a
+ * read-write compute endpoint, exposed as `connectionUri`.
+ *
+ * @section Creating a Project
+ * @example Basic project
+ * ```typescript
+ * const project = yield* Neon.Project("my-project");
+ * ```
+ *
+ * @example Project with explicit region and PG version
+ * ```typescript
+ * const project = yield* Neon.Project("my-project", {
+ *   region: "aws-eu-central-1",
+ *   pgVersion: 17,
+ * });
+ * ```
+ *
+ * @example Project with logical replication enabled
+ * ```typescript
+ * const project = yield* Neon.Project("my-project", {
+ *   enableLogicalReplication: true,
+ * });
+ * ```
+ *
+ * @section Migrations and seed data
+ * @example Apply migrations and seed files
+ * ```typescript
+ * const project = yield* Neon.Project("my-project", {
+ *   migrationsDir: "./migrations",
+ *   importFiles: ["./seed/users.sql"],
+ * });
+ * ```
+ *
+ * @section Branching
+ * @example Create a branch off the project's default branch
+ * ```typescript
+ * const project = yield* Neon.Project("my-project");
+ * const dev = yield* Neon.Branch("dev-branch", { project });
+ * ```
+ *
+ * @see https://neon.tech/docs/manage/projects/
+ */
+export const Project = Resource<Project>("Neon.Project");
+
+const getRoleName = (creation: CreateProjectOutput) =>
+  creation.roles.find((r) => !r.protected)?.name ?? creation.roles[0]?.name;
+
+const getDatabaseName = (creation: CreateProjectOutput) =>
+  creation.databases[0]?.name ?? "neondb";
+
+const resolveConnection = (
+  projectId: string,
+  branchId: string,
+  databaseName: string,
+  roleName: string,
+) =>
+  Effect.gen(function* () {
+    const direct = yield* getConnectionURI({
+      project_id: projectId,
+      branch_id: branchId,
+      database_name: databaseName,
+      role_name: roleName,
+      pooled: false,
+    });
+    const pooled = yield* getConnectionURI({
+      project_id: projectId,
+      branch_id: branchId,
+      database_name: databaseName,
+      role_name: roleName,
+      pooled: true,
+    });
+    return { uri: direct.uri, pooled: pooled.uri };
+  });
+
+export const ProjectProvider = () =>
+  Provider.effect(
+    Project,
+    Effect.gen(function* () {
+      const rootDir = process.cwd();
+
+      const createProjectName = (id: string, name: string | undefined) =>
+        Effect.gen(function* () {
+          return name ?? (yield* createPhysicalName({ id }));
+        });
+
+      return {
+        stables: ["projectId", "defaultBranchId"],
+        diff: Effect.fn(function* ({ id, olds = {}, news = {}, output }) {
+          if (!isResolved(news)) return undefined;
+          const name = yield* createProjectName(id, news.name);
+          const oldName = output?.projectName
+            ? output.projectName
+            : yield* createProjectName(id, olds.name);
+          if (
+            oldName !== name ||
+            (news.region ?? DEFAULT_REGION) !==
+              (output?.region ?? olds.region ?? DEFAULT_REGION) ||
+            (news.pgVersion ?? DEFAULT_PG_VERSION) !==
+              (output?.pgVersion ?? olds.pgVersion ?? DEFAULT_PG_VERSION) ||
+            (news.defaultBranchName ?? output?.defaultBranchName) !==
+              output?.defaultBranchName
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (
+            (news.historyRetentionSeconds ?? 86400) !==
+            (output?.historyRetentionSeconds ?? 86400)
+          ) {
+            return { action: "update" } as const;
+          }
+          if (
+            (news.enableLogicalReplication ?? false) !==
+            (output?.enableLogicalReplication ?? false)
+          ) {
+            return { action: "update" } as const;
+          }
+          if (news.migrationsDir) {
+            const newHashes = yield* hashMigrations(news.migrationsDir);
+            if (!recordsEqual(newHashes, output?.migrationsHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+            if (
+              (news.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE) !==
+              (output?.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE)
+            ) {
+              return { action: "update" } as const;
+            }
+          }
+          if (news.importFiles?.length) {
+            const newHashes = yield* hashImports(news.importFiles, rootDir);
+            if (!recordsEqual(newHashes, output?.importHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+          }
+          return undefined;
+        }),
+        read: Effect.fn(function* ({ id, output, olds }) {
+          if (output?.projectId) {
+            return yield* getProject({ project_id: output.projectId }).pipe(
+              Effect.map(({ project }) => ({
+                ...output,
+                projectName: project.name,
+                historyRetentionSeconds: project.history_retention_seconds,
+                enableLogicalReplication:
+                  project.settings?.enable_logical_replication === true,
+              })),
+              Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+            );
+          }
+          const name = yield* createProjectName(id, olds?.name);
+          const matches = yield* findProjectByName(name);
+          const match = matches[0];
+          if (!match) return undefined;
+          const branches = yield* listProjectBranches({
+            project_id: match.id,
+            search: olds?.defaultBranchName ?? "main",
+          });
+          const defaultBranch =
+            branches.branches.find((b) => b.default) ?? branches.branches[0];
+          if (!defaultBranch) return undefined;
+          const databases = yield* listProjectBranchDatabases({
+            project_id: match.id,
+            branch_id: defaultBranch.id,
+          });
+          const db = databases.databases[0];
+          if (!db) return undefined;
+          const conn = yield* resolveConnection(
+            match.id,
+            defaultBranch.id,
+            db.name,
+            db.owner_name,
+          );
+          return {
+            projectId: match.id,
+            projectName: match.name,
+            region: match.region_id as NeonRegion,
+            pgVersion: match.pg_version as NeonPgVersion,
+            defaultBranchId: defaultBranch.id,
+            defaultBranchName: defaultBranch.name,
+            databaseName: db.name,
+            roleName: db.owner_name,
+            connectionUri: conn.uri,
+            pooledConnectionUri: conn.pooled,
+            origin: parsePostgresOrigin(conn.uri),
+            historyRetentionSeconds: match.history_retention_seconds ?? 86400,
+            enableLogicalReplication:
+              match.settings?.enable_logical_replication === true,
+            migrationsDir: olds?.migrationsDir,
+            migrationsTable: olds?.migrationsTable,
+            migrationsHashes: {},
+            importHashes: {},
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+          // Ensure — when no prior output exists we create the project
+          // (and let `read` upstream decide adoption); otherwise update
+          // the mutable scalar fields on the existing project.
+          const projectInfo = output
+            ? yield* updateProject({
+                project_id: output.projectId,
+                project: {
+                  name: news.name,
+                  history_retention_seconds: news.historyRetentionSeconds,
+                  settings:
+                    (news.enableLogicalReplication ?? false) !==
+                    (output.enableLogicalReplication ?? false)
+                      ? {
+                          enable_logical_replication:
+                            news.enableLogicalReplication ?? false,
+                        }
+                      : undefined,
+                },
+              }).pipe(
+                Effect.map((r) => ({
+                  projectId: output.projectId,
+                  projectName: r.project.name,
+                  region: output.region,
+                  pgVersion: output.pgVersion,
+                  defaultBranchId: output.defaultBranchId,
+                  defaultBranchName: output.defaultBranchName,
+                  databaseName: output.databaseName,
+                  roleName: output.roleName,
+                  connectionUri: output.connectionUri,
+                  pooledConnectionUri: output.pooledConnectionUri,
+                  origin: output.origin,
+                  historyRetentionSeconds:
+                    r.project.history_retention_seconds ??
+                    output.historyRetentionSeconds,
+                  enableLogicalReplication:
+                    r.project.settings?.enable_logical_replication === true,
+                })),
+              )
+            : yield* Effect.gen(function* () {
+                const name = yield* createProjectName(id, news.name);
+                const created = yield* sdkCreateProject({
+                  project: {
+                    name,
+                    region_id: news.region,
+                    pg_version: news.pgVersion,
+                    branch: {
+                      name: news.defaultBranchName,
+                      role_name: news.roleName,
+                      database_name: news.databaseName,
+                    },
+                    history_retention_seconds: news.historyRetentionSeconds,
+                    org_id: news.orgId,
+                    settings: news.enableLogicalReplication
+                      ? { enable_logical_replication: true }
+                      : undefined,
+                  },
+                });
+                yield* waitForOperations(created.operations);
+
+                const branchId = created.branch.id;
+                const databaseName = getDatabaseName(created);
+                const roleName = getRoleName(created) ?? "neondb_owner";
+                const conn = yield* resolveConnection(
+                  created.project.id,
+                  branchId,
+                  databaseName,
+                  roleName,
+                );
+                return {
+                  projectId: created.project.id,
+                  projectName: created.project.name,
+                  region: created.project.region_id as NeonRegion,
+                  pgVersion: created.project.pg_version as NeonPgVersion,
+                  defaultBranchId: branchId,
+                  defaultBranchName: created.branch.name,
+                  databaseName,
+                  roleName,
+                  connectionUri: conn.uri,
+                  pooledConnectionUri: conn.pooled,
+                  origin: parsePostgresOrigin(conn.uri),
+                  historyRetentionSeconds:
+                    created.project.history_retention_seconds ?? 86400,
+                  enableLogicalReplication:
+                    created.project.settings?.enable_logical_replication ===
+                    true,
+                };
+              });
+
+          const connectionUri = Redacted.make(projectInfo.connectionUri);
+          const migrationsTable =
+            news.migrationsTable ??
+            output?.migrationsTable ??
+            DEFAULT_MIGRATIONS_TABLE;
+          const migrationsHashes = news.migrationsDir
+            ? yield* runMigrations(
+                connectionUri,
+                news.migrationsDir,
+                migrationsTable,
+              )
+            : (output?.migrationsHashes ?? {});
+          const importHashes = news.importFiles?.length
+            ? yield* runImports(
+                connectionUri,
+                news.importFiles,
+                rootDir,
+                output?.importHashes ?? {},
+              )
+            : {};
+
+          return {
+            ...projectInfo,
+            migrationsDir: news.migrationsDir,
+            migrationsTable: news.migrationsDir ? migrationsTable : undefined,
+            migrationsHashes,
+            importHashes,
+          };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteProject({ project_id: output.projectId }).pipe(
+            Effect.tapError(Console.log),
+            Effect.catchTag("NotFound", () => Effect.void),
+          );
+        }),
+      };
+    }),
+  );
+
+const runMigrations = (
+  connectionUri: Redacted.Redacted<string>,
+  migrationsDir: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const files = yield* listSqlFiles(migrationsDir);
+    if (files.length > 0) {
+      yield* applyMigrations({
+        connectionUri,
+        migrationsTable,
+        migrationsFiles: files,
+      });
+    }
+    const hashes: Record<string, string> = {};
+    for (const file of files) hashes[file.id] = file.hash;
+    return hashes;
+  });
+
+const runImports = (
+  connectionUri: Redacted.Redacted<string>,
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+  previous: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = { ...previous };
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      if (previous[filePath] === file.hash) {
+        hashes[filePath] = file.hash;
+        continue;
+      }
+      yield* runSql(connectionUri, file.sql);
+      hashes[filePath] = file.hash;
+    }
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+      if (!tracked.has(key)) delete hashes[key];
+    }
+    return hashes;
+  });
+
+const recordsEqual = (
+  a: Record<string, string>,
+  b: Record<string, string>,
+): boolean => {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (a[k] !== b[k]) return false;
+  }
+  return true;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/Providers.ts
new file mode 100644
index 00000000000..303a5fa4322
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/Providers.ts
@@ -0,0 +1,57 @@
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
+import * as Provider from "../Provider.ts";
+import { NeonAuth } from "./AuthProvider.ts";
+import { Branch, BranchProvider } from "./Branch.ts";
+import * as Credentials from "./Credentials.ts";
+import { NeonEnvironment, fromProfile } from "./NeonEnvironment.ts";
+import { Project, ProjectProvider } from "./Project.ts";
+
+export { NeonEnvironment } from "./NeonEnvironment.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "Neon",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Build a layer that registers all Neon resource providers, the Neon
+ * `AuthProvider`, the resolved `Credentials`, and an `HttpClient`. Include
+ * this from your stack alongside other cloud `providers()` layers.
+ *
+ * @example
+ * ```typescript
+ * import * as Alchemy from "alchemy";
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ * import * as Neon from "alchemy/Neon";
+ * import * as Effect from "effect/Effect";
+ * import * as Layer from "effect/Layer";
+ *
+ * export default Alchemy.Stack(
+ *   "MyStack",
+ *   {
+ *     providers: Layer.mergeAll(Cloudflare.providers(), Neon.providers()),
+ *     state: Alchemy.localState(),
+ *   },
+ *   Effect.gen(function* () {
+ *     const project = yield* Neon.Project("app-db");
+ *     const branch = yield* Neon.Branch("app-branch", { project });
+ *     return { branchId: branch.branchId };
+ *   }),
+ * );
+ * ```
+ */
+export const providers = () =>
+  Layer.effect(Providers, Provider.collection([Project, Branch])).pipe(
+    Layer.provide(Layer.mergeAll(ProjectProvider(), BranchProvider())),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(fromProfile()),
+    Layer.provideMerge(NeonAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.provideMerge(FetchHttpClient.layer),
+    Layer.orDie,
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Neon/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Neon/index.ts
new file mode 100644
index 00000000000..98cf1d3d6b4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Neon/index.ts
@@ -0,0 +1,5 @@
+export * from "./Branch.ts";
+export * from "./NeonEnvironment.ts";
+export * from "./PostgresOrigin.ts";
+export * from "./Project.ts";
+export * from "./Providers.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Output.ts b/.repos/alchemy-effect/packages/alchemy/src/Output.ts
new file mode 100644
index 00000000000..967d27d8fa9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Output.ts
@@ -0,0 +1,770 @@
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import type { Pipeable } from "effect/Pipeable";
+import * as Redacted from "effect/Redacted";
+import { SingleShotGen } from "effect/Utils";
+import { getRefMetadata, isRef, type Ref } from "./Ref.ts";
+import { isResource, type Resource, type ResourceLike } from "./Resource.ts";
+import { RuntimeContext, sanitizeKey } from "./RuntimeContext.ts";
+import { Stack } from "./Stack.ts";
+import { Stage } from "./Stage.ts";
+import * as State from "./State/State.ts";
+import { isPrimitive } from "./Util/data.ts";
+
+const inspect = Symbol.for("nodejs.util.inspect.custom");
+
+export const of = <R extends ResourceLike>(
+  resource: Ref<R> | R,
+): R extends ResourceLike
+  ? ResourceExpr<R["Attributes"]>
+  : RefExpr<R["Attributes"]> => {
+  if (isRef(resource)) {
+    const metadata = getRefMetadata(resource);
+    return new RefExpr(metadata.stack, metadata.stage, metadata.id) as any;
+  }
+  return new ResourceExpr(resource) as any;
+};
+
+export const asOutput = <T>(t: T | Output<T> | Effect.Effect<T>): Output<T> =>
+  isOutput(t)
+    ? t
+    : Effect.isEffect(t)
+      ? new EffectExpr(VoidExpr, () => t)
+      : new LiteralExpr(t);
+
+export const isOutput = (value: any): value is Output<any> =>
+  value &&
+  (typeof value === "object" || typeof value === "function") &&
+  ExprSymbol in value;
+
+export interface Output<A = any, Req = any> extends Pipeable {
+  /** @internal phantom */
+  readonly kind: string;
+  /** @internal phantom */
+  readonly A: A;
+  /** @internal phantom */
+  readonly req: Req;
+  /** @internal phantom */
+  [Symbol.iterator](): Iterator<
+    Effect.Effect<void, never, Req>,
+    Accessor<A>,
+    void
+  >;
+  bind(id: string): Effect.Effect<Effect.Effect<A>, never, RuntimeContext>;
+  asEffect(): Effect.Effect<Accessor<A>, never, Req>;
+  as<T>(): Output<T, Req>;
+}
+
+export interface Accessor<A> extends Effect.Effect<A> {}
+
+export type ToOutput<A, Req = never> = [Extract<A, object>] extends [never]
+  ? Output<A, Req>
+  : [Extract<A, any[]>] extends [never]
+    ? ObjectExpr<
+        {
+          [attr in keyof A]: A[attr];
+        },
+        Req
+      >
+    : ArrayExpr<Extract<A, any[]>, Req>;
+
+export const ExprSymbol = Symbol.for("alchemy/Expr");
+
+export const isExpr = (value: any): value is Expr<any> =>
+  value &&
+  (typeof value === "object" || typeof value === "function") &&
+  ExprSymbol in value;
+
+export type Expr<A = any, Req = any> =
+  | AllExpr<Expr<A, Req>[]>
+  | ApplyExpr<any, A, Req>
+  | EffectExpr<any, A, Req>
+  | FlatMapExpr<any, A, Req>
+  | LiteralExpr<A>
+  | NamedExpr<A, Req>
+  | PropExpr<A, keyof A, Req>
+  | ResourceExpr<A, Req>
+  | RefExpr<A>
+  | StackRefExpr<A>;
+
+export abstract class BaseExpr<A = any, Req = any> implements Output<A, Req> {
+  declare readonly kind: any;
+  declare readonly A: A;
+  declare readonly src: ResourceLike;
+  declare readonly req: Req;
+  // we use a kind tag instead of instanceof to protect ourselves from duplicate alchemy module imports
+  constructor() {}
+  as<T>(): Output<T, Req> {
+    return this as any;
+  }
+
+  [Symbol.iterator](): Iterator<
+    Effect.Effect<void, never, Req>,
+    Accessor<A>,
+    void
+  > {
+    // @ts-expect-error - TODO(sam): fix this (works at runtime, but maybe indicates a bad assumption)
+    return new SingleShotGen(this.asEffect());
+  }
+
+  asEffect(): any {
+    return this.bind(this.toString());
+  }
+
+  public bind(id: string): any {
+    // `set`/`get` store keys verbatim, so canonicalize here (the caller's job).
+    const key = sanitizeKey(id);
+    return RuntimeContext.pipe(
+      Effect.flatMap((ctx) =>
+        Effect.map(ctx.set(key, this), (k) => ctx.get<A>(k)),
+      ),
+    );
+  }
+
+  public pipe(...fns: any[]): any {
+    // @ts-expect-error
+    return pipe(this, ...fns);
+  }
+  public abstract [inspect](): string;
+  public toString(): string {
+    return this[inspect]();
+  }
+}
+export type ObjectExpr<A, Req = any> = Output<A, Req> & {
+  [Prop in keyof Exclude<A, undefined>]-?: ToOutput<
+    Exclude<A, undefined>[Prop] | Extract<A, undefined>,
+    Req
+  >;
+};
+
+export type ArrayExpr<A extends any[], Req = any> = Output<A, Req> & {
+  [i in Extract<keyof A, number>]: ToOutput<A[i], Req>;
+};
+
+export const isResourceExpr = <Value = any, Req = any>(
+  node: Expr<Value, Req> | any,
+): node is ResourceExpr<Value, Req> => node?.kind === "ResourceExpr";
+
+export class ResourceExpr<Value, Req = never> extends BaseExpr<Value, Req> {
+  readonly kind = "ResourceExpr";
+  constructor(
+    readonly src: ResourceLike,
+    readonly stables?: Record<string, any>,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return this.src.LogicalId;
+  }
+}
+
+export const isPropExpr = <A = any, Prop extends keyof A = keyof A, Req = any>(
+  node: any,
+): node is PropExpr<A, Prop, Req> => node?.kind === "PropExpr";
+
+export class PropExpr<
+  A = any,
+  Id extends keyof A = keyof A,
+  Req = any,
+> extends BaseExpr<A[Id], Req> {
+  readonly kind = "PropExpr";
+  constructor(
+    public readonly expr: Expr<A, Req>,
+    public readonly identifier: Id,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return `${this.expr[inspect]()}.${this.identifier.toString()}`;
+  }
+}
+
+export const literal = <A>(value: A) => new LiteralExpr(value);
+
+export const isLiteralExpr = <A = any>(node: any): node is LiteralExpr<A> =>
+  node?.kind === "LiteralExpr";
+
+export class LiteralExpr<A> extends BaseExpr<A, never> {
+  readonly kind = "LiteralExpr";
+  constructor(public readonly value: A) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return String(this.value);
+  }
+}
+
+export const VoidExpr = new LiteralExpr(void 0);
+
+export const map: {
+  <A, B>(
+    fn: (value: A) => B,
+  ): <Req>(output: Output<A, Req>) => ToOutput<B, Req>;
+  <A, B, Req>(output: Output<A, Req>, fn: (value: A) => B): ToOutput<B, Req>;
+} = (<A, B, Req>(
+  ...args: [fn: (value: A) => B] | [output: Output<A, Req>, fn: (value: A) => B]
+) =>
+  args.length === 1
+    ? <Req>(output: Output<A, Req>): ToOutput<B, Req> =>
+        new ApplyExpr(output as Expr<A, Req>, args[0]) as any
+    : new ApplyExpr(args[0] as any, args[1])) as any;
+
+//Output.ApplyExpr<any, any, ResourceLike, any>
+export const isApplyExpr = <In = any, Out = any, Req = any>(
+  node: Output<Out, Req>,
+): node is ApplyExpr<In, Out, Req> => node?.kind === "ApplyExpr";
+
+export class ApplyExpr<A, B, Req = never> extends BaseExpr<B, Req> {
+  readonly kind = "ApplyExpr";
+  constructor(
+    public readonly expr: Expr<A, Req>,
+    public readonly f: (value: A) => B,
+  ) {
+    super();
+    return proxy(this);
+  }
+
+  [inspect](): string {
+    return `${this.expr[inspect]()}.map(${this.f.toString()})`;
+  }
+}
+
+export const mapEffect =
+  <A, B, Req2>(fn: (value: A) => Effect.Effect<B, never, Req2>) =>
+  <Req>(output: Output<A, Req>): ToOutput<B, Req | Req2> =>
+    new EffectExpr(output as Expr<A, Req>, fn) as any;
+
+export const flatMap: {
+  <A, B, Req2>(
+    fn: (value: A) => Output<B, Req2>,
+  ): <Req>(output: Output<A, Req>) => ToOutput<B, Req | Req2>;
+  <A, B, Req, Req2>(
+    output: Output<A, Req>,
+    fn: (value: A) => Output<B, Req2>,
+  ): ToOutput<B, Req | Req2>;
+} = (<A, B, Req, Req2>(
+  ...args:
+    | [fn: (value: A) => Output<B, Req2>]
+    | [output: Output<A, Req>, fn: (value: A) => Output<B, Req2>]
+) =>
+  args.length === 1
+    ? <Req>(output: Output<A, Req>): ToOutput<B, Req | Req2> =>
+        new FlatMapExpr(output as Expr<A, Req>, args[0]) as any
+    : new FlatMapExpr(args[0] as any, args[1])) as any;
+
+export const isFlatMapExpr = <In = any, Out = any, Req = any, Req2 = any>(
+  node: any,
+): node is FlatMapExpr<In, Out, Req, Req2> => node?.kind === "FlatMapExpr";
+
+export class FlatMapExpr<A, B, Req = never, Req2 = never> extends BaseExpr<
+  B,
+  Req | Req2
+> {
+  readonly kind = "FlatMapExpr";
+  constructor(
+    public readonly expr: Expr<A, Req>,
+    public readonly f: (value: A) => Output<B, Req2>,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return `${this.expr[inspect]()}.flatMap(${this.f.toString()})`;
+  }
+}
+
+export const isEffectExpr = <In = any, Out = any, Req = any, Req2 = any>(
+  node: any,
+): node is EffectExpr<In, Out, Req, Req2> => node?.kind === "EffectExpr";
+
+export class EffectExpr<A, B, Req = never, Req2 = never> extends BaseExpr<
+  B,
+  Req
+> {
+  readonly kind = "EffectExpr";
+  constructor(
+    public readonly expr: Expr<A, Req>,
+    public readonly f: (value: A) => Effect.Effect<B, never, Req2>,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return `${this.expr[inspect]()}.mapEffect(${this.f.toString()})`;
+  }
+}
+
+export const isNamedExpr = <A = any, Req = any>(
+  node: any,
+): node is NamedExpr<A, Req> => node?.kind === "NamedExpr";
+
+/**
+ * Wraps another `Expr` and overrides its `toString()` / inspect output.
+ *
+ * `BaseExpr` derives the binding id from `this.toString()`, so
+ * wrapping an expression in `NamedExpr` makes that derived id stable and
+ * caller-controlled (e.g. an env var name like `"API_KEY"`).
+ */
+export class NamedExpr<A, Req = never> extends BaseExpr<A, Req> {
+  readonly kind = "NamedExpr";
+  constructor(
+    public readonly expr: Expr<A, Req>,
+    public readonly bindingName: string,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return this.bindingName;
+  }
+}
+
+export const named = <A, Req>(
+  expr: Output<A, Req>,
+  name: string,
+): Output<A, Req> => new NamedExpr(expr as Expr<A, Req>, name) as any;
+
+export const all = <Outs extends (Output | Expr)[]>(...outs: Outs) =>
+  new AllExpr(outs as any) as unknown as All<Outs>;
+
+export type All<Outs extends (Output | Expr)[]> = number extends Outs["length"]
+  ? [Outs[number]] extends [
+      Output<infer V, infer Req> | Expr<infer V, infer Req>,
+    ]
+    ? Output<V, Req>
+    : never
+  : Tuple<Outs>;
+
+type Tuple<
+  Outs extends (Output | Expr)[],
+  Values extends any[] = [],
+  Req = never,
+> = Outs extends [infer H, ...infer Tail extends (Output | Expr)[]]
+  ? H extends Output<infer V, infer Req2>
+    ? Tuple<Tail, [...Values, V], Req | Req2>
+    : never
+  : Output<Values, Req>;
+
+export const isAllExpr = <Outs extends Expr[] = Expr[]>(
+  node: any,
+): node is AllExpr<Outs> => node?.kind === "AllExpr";
+
+export class AllExpr<Outs extends Expr[]> extends BaseExpr<Outs> {
+  readonly kind = "AllExpr";
+  constructor(public readonly outs: Outs) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return `all(${this.outs.map((out) => out[inspect]()).join(", ")})`;
+  }
+}
+
+export const isRefExpr = <A = any>(node: any): node is RefExpr<A> =>
+  node?.kind === "RefExpr";
+
+export class RefExpr<A> extends BaseExpr<A, never> {
+  readonly kind = "RefExpr";
+  constructor(
+    public readonly stack: string | undefined,
+    public readonly stage: string | undefined,
+    public readonly resourceId: string,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return `ref(${this.resourceId}, { stack: ${this.stack}, stage: ${this.stage} })`;
+  }
+}
+
+export const isStackRefExpr = <A = any>(node: any): node is StackRefExpr<A> =>
+  node?.kind === "StackRefExpr";
+
+/**
+ * A reference to the persisted output of a Stack at `(stack, stage)`.
+ *
+ * Resolved at evaluation time by reading `state.getOutput({ stack,
+ * stage })`. Distinct from {@link RefExpr}, which references a
+ * single resource's attributes within a stack/stage. `stage` may be
+ * `undefined`, in which case it falls back to the current stage.
+ */
+export class StackRefExpr<A> extends BaseExpr<A, never> {
+  readonly kind = "StackRefExpr";
+  constructor(
+    public readonly stack: string,
+    public readonly stage: string | undefined,
+  ) {
+    super();
+    return proxy(this);
+  }
+  [inspect](): string {
+    return `stackRef(${this.stack}${
+      this.stage ? `, { stage: ${this.stage} }` : ""
+    })`;
+  }
+}
+
+/**
+ * Build an `Output<A>` referencing the persisted output of another
+ * Stack. The returned Effect resolves to a lazy `Output<A>` whose
+ * value is read from the state store at plan/apply time.
+ *
+ * Returns `Effect<Output<A>>` (not `Output<A>` directly) so that
+ * `yield* Output.stackRef(...)` reads ergonomically inside an Effect
+ * generator and lines up with `Resource.ref` and `Stack.stage.<name>`.
+ */
+export const stackRef = <A>(
+  stack: string,
+  options: { stage?: string } = {},
+): Effect.Effect<Output<A, never>> =>
+  Effect.succeed(new StackRefExpr<A>(stack, options.stage) as any);
+
+export const filter = <Outs extends any[]>(...outs: Outs) =>
+  outs.filter(isOutput) as unknown as Filter<Outs>;
+
+export type Filter<Outs extends any[]> = number extends Outs["length"]
+  ? Output<
+      Extract<Outs[number], Output>["value"],
+      Extract<Outs[number], Output>["req"]
+    >
+  : FilterTuple<Outs>;
+
+export type FilterTuple<
+  Outs extends (Output | Expr)[],
+  Values extends any[] = [],
+> = Outs extends [infer H, ...infer Tail extends (Output | Expr)[]]
+  ? H extends Output<infer V>
+    ? FilterTuple<Tail, [...Values, V]>
+    : FilterTuple<Tail, Values>
+  : Output<Values>;
+
+export const interpolate = <Args extends any[]>(
+  template: TemplateStringsArray,
+  ...args: Args
+): All<Args> extends Output<any, infer Req> ? Output<string, Req> : never =>
+  all(...args.map((arg) => (isOutput(arg) ? arg : literal(arg)))).pipe(
+    map((args) =>
+      template
+        .map((str, i) => str + (args[i] == null ? "" : String(args[i])))
+        .join(""),
+    ),
+  ) as any;
+
+function proxy(self: any): any {
+  const target = Object.assign(() => {}, self);
+  if (inspect in self) {
+    Object.defineProperty(target, inspect, {
+      value: self[inspect].bind(self),
+      configurable: true,
+    });
+  }
+  const proxy = new Proxy(target, {
+    has: (_, prop) =>
+      prop === ExprSymbol || prop === inspect ? true : prop in self,
+    get: (target, prop) =>
+      prop === Symbol.toPrimitive
+        ? (hint: string) => {
+            // Any JS-level coercion of an unresolved Output produces a
+            // placeholder that *looks* like a real value but isn't:
+            //
+            //   - `string` / `default` hints (`${output}`, `output + ""`,
+            //     `==` against a primitive) previously fell through to
+            //     `self.toString()` and returned the inspect form
+            //     (e.g. "tunnel.tunnelId"). The bogus string flowed
+            //     into resource props and into the cloud — only
+            //     surfacing as an opaque downstream error (see PR
+            //     description for a real Cloudflare DNS landing).
+            //
+            //   - `number` hint (`+output`, `output * 2`,
+            //     `Math.max(0, output)`) previously returned NaN, which
+            //     propagates silently through arithmetic and lands as
+            //     "the API rejected a NaN field" much later.
+            //
+            // All three hints fail loud at the coercion site with a
+            // pointer to the right composition API.
+            throw new Error(
+              `Cannot coerce Output<${self[inspect]()}> to a ` +
+                `${hint === "number" ? "number" : "string"} via JS coercion. ` +
+                `Use Output.interpolate\`...\` or Output.map(output, fn) ` +
+                `to compose Outputs — the value isn't known until deploy time.`,
+            );
+          }
+        : prop === ExprSymbol
+          ? self
+          : prop === inspect
+            ? target[inspect]
+            : isResourceExpr(self) && self.stables && prop in self.stables
+              ? self.stables[prop as keyof typeof self.stables]
+              : prop in self
+                ? typeof self[prop as keyof typeof self] === "function" &&
+                  !("kind" in self)
+                  ? new PropExpr(proxy, prop as never)
+                  : self[prop as keyof typeof self]
+                : new PropExpr(proxy, prop as never),
+    apply: (_, thisArg, args) => {
+      if (isPropExpr(self)) {
+        // Method-style combinators on an Output proxy. `map`/`apply` and
+        // `mapEffect`/`effect` are aliases that mirror the standalone
+        // `Output.map` / `Output.mapEffect` / `Output.flatMap` functions.
+        if (self.identifier === "map" || self.identifier === "apply") {
+          return new ApplyExpr(self.expr, args[0]);
+        } else if (
+          self.identifier === "mapEffect" ||
+          self.identifier === "effect"
+        ) {
+          return new EffectExpr(self.expr, args[0]);
+        } else if (self.identifier === "flatMap") {
+          return new FlatMapExpr(self.expr, args[0]);
+        }
+      }
+      return undefined;
+    },
+  });
+  return proxy;
+}
+
+/// Evaluation
+
+export class MissingSourceError extends Data.TaggedError("MissingSourceError")<{
+  message: string;
+  srcId: string;
+}> {}
+
+export class InvalidReferenceError extends Data.TaggedError(
+  "InvalidReferenceError",
+)<{
+  message: string;
+  stack: string;
+  stage: string;
+  resourceId: string;
+}> {}
+
+export const evaluate: <A, Req = never>(
+  expr: Output<A, Req> | A,
+  upstream: {
+    [Id in string]: any;
+  },
+) => Effect.Effect<
+  A,
+  InvalidReferenceError | MissingSourceError,
+  State.State | Req
+> = (expr, upstream) =>
+  Effect.gen(function* () {
+    if (isResource(expr)) {
+      const srcId = expr.FQN;
+      const src = upstream[srcId as keyof typeof upstream];
+      if (!src) {
+        // type-safety should prevent this but let the caller decide how to handle it
+        return yield* new MissingSourceError({
+          message: `Source ${srcId} not found`,
+          srcId,
+        });
+      }
+      return src;
+    } else if (isOutput(expr)) {
+      if (isResourceExpr(expr)) {
+        const srcId = expr.src.FQN;
+        const src = upstream[srcId as keyof typeof upstream];
+        if (!src) {
+          // type-safety should prevent this but let the caller decide how to handle it
+          return yield* new MissingSourceError({
+            message: `Source ${srcId} not found`,
+            srcId,
+          });
+        }
+        return src;
+      } else if (isLiteralExpr(expr)) {
+        return expr.value;
+      } else if (isApplyExpr(expr)) {
+        return expr.f(yield* evaluate(expr.expr, upstream));
+      } else if (isEffectExpr(expr)) {
+        // TODO(sam): the same effect shoudl be memoized so that it's not run multiple times
+        return yield* expr.f(yield* evaluate(expr.expr, upstream));
+      } else if (isFlatMapExpr(expr)) {
+        // Resolve the source, hand it to `f` to produce a new Output, then
+        // recursively evaluate that Output (flattening one level).
+        const value = yield* evaluate(expr.expr, upstream);
+        return yield* evaluate(expr.f(value), upstream);
+      } else if (isAllExpr(expr)) {
+        return yield* Effect.all(
+          expr.outs.map((out) => evaluate(out, upstream)),
+        );
+      } else if (isPropExpr(expr)) {
+        return (yield* evaluate(expr.expr, upstream))?.[expr.identifier];
+      } else if (isNamedExpr(expr)) {
+        return yield* evaluate(expr.expr, upstream);
+      } else if (isRefExpr(expr)) {
+        const state = yield* yield* State.State;
+        const stack = expr.stack ?? (yield* Stack).name;
+        const stage = expr.stage ?? (yield* Stage);
+        const resource = yield* state.get({
+          stack,
+          stage,
+          fqn: expr.resourceId,
+        });
+        if (!resource) {
+          return yield* Effect.fail(
+            new InvalidReferenceError({
+              message: `Reference to '${expr.resourceId}' in stack '${stack}' and stage '${stage}' not found. Have you deployed '${stage}' or '${stack}'?`,
+              stack,
+              stage,
+              resourceId: expr.resourceId,
+            }),
+          );
+        }
+        // RefExpr targets persisted resources; tasks aren't cross-stack
+        // referenceable. Return the resource's output attrs, otherwise the
+        // task's output value, otherwise undefined.
+        return (resource as any).attr ?? (resource as any).output;
+      } else if (isStackRefExpr(expr)) {
+        const state = yield* yield* State.State;
+        const stack = expr.stack;
+        const stage = expr.stage ?? (yield* Stage);
+        const output = yield* state.getOutput({ stack, stage });
+        if (output == null) {
+          return yield* Effect.fail(
+            new InvalidReferenceError({
+              message: `Reference to stack '${stack}' at stage '${stage}' not found. Have you deployed stage '${stage}' of '${stack}'?`,
+              stack,
+              stage,
+              resourceId: stack,
+            }),
+          );
+        }
+        return output;
+      }
+    }
+    if (Array.isArray(expr)) {
+      return yield* Effect.all(expr.map((item) => evaluate(item, upstream)));
+    } else if (Redacted.isRedacted(expr)) {
+      return expr;
+    } else if (Duration.isDuration(expr)) {
+      // Opaque value — see resolveInput in Plan.ts for rationale.
+      return expr;
+    } else if (typeof expr === "object" && expr !== null) {
+      return Object.fromEntries(
+        yield* Effect.all(
+          Object.entries(expr).map(([key, value]) =>
+            evaluate(value, upstream).pipe(Effect.map((value) => [key, value])),
+          ),
+        ),
+      );
+    }
+    return expr;
+  }) as Effect.Effect<any>;
+
+export const hasOutputs = (value: any): value is Output<any, any> =>
+  Object.keys(upstreamAny(value)).length > 0;
+
+export const upstreamAny = (
+  value: any,
+): {
+  [ID in string]: Resource;
+} => {
+  if (isResource(value)) {
+    return { [value.FQN]: value as Resource };
+  } else if (isExpr(value)) {
+    return upstream(value);
+  } else if (Array.isArray(value)) {
+    return Object.assign({}, ...value.map(resolveUpstream));
+  } else if (
+    value &&
+    (typeof value === "object" || typeof value === "function")
+  ) {
+    return Object.assign(
+      {},
+      ...Object.values(value).map((value) => resolveUpstream(value)),
+    );
+  }
+  return {};
+};
+
+// TODO(sam): add a type
+export const upstream = <E extends Output<any, any>>(expr: E): any => {
+  if (isResource(expr)) {
+    return {
+      [(expr as unknown as Resource).FQN]: expr,
+    };
+  } else if (isResourceExpr(expr)) {
+    return {
+      [expr.src.FQN]: expr.src,
+    };
+  } else if (isPropExpr(expr)) {
+    return upstream(expr.expr);
+  } else if (isAllExpr(expr)) {
+    return Object.assign({}, ...expr.outs.map((out) => upstream(out)));
+  } else if (
+    isEffectExpr(expr) ||
+    isApplyExpr(expr) ||
+    isFlatMapExpr(expr) ||
+    isNamedExpr(expr)
+  ) {
+    return upstream(expr.expr);
+  } else if (Array.isArray(expr)) {
+    return expr.map(upstream).reduce(toObject, {});
+  } else if (typeof expr === "object" && expr !== null) {
+    return Object.values(expr)
+      .map((v) => upstream(v))
+      .reduce(toObject, {});
+  }
+  return {};
+};
+
+// TODO(sam): add a type
+export const resolveUpstream = <const A>(value: A): any => {
+  if (isPrimitive(value)) {
+    return {} as any;
+  } else if (isResource(value)) {
+    return { [(value as unknown as Resource).FQN]: value } as any;
+  } else if (isOutput(value)) {
+    return upstream(value) as any;
+  } else if (Array.isArray(value)) {
+    return Object.fromEntries(
+      value.map((v) => resolveUpstream(v)).flatMap(Object.entries),
+    ) as any;
+  } else if (typeof value === "object" || typeof value === "function") {
+    return Object.fromEntries(
+      Object.values(value as any)
+        .map(resolveUpstream)
+        .flatMap(Object.entries),
+    ) as any;
+  }
+  return {} as any;
+};
+
+const toObject = <A, B>(acc: B, v: A) => ({
+  ...acc,
+  ...v,
+});
+
+export const log = <A>(_value: A) =>
+  Effect.gen(function* () {
+    // TODO(sam): implement a log effect
+  });
+
+export const toEnvKey = <const ID extends string, const Suffix extends string>(
+  id: ID,
+  suffix: Suffix,
+) => `${replace(toUpper(id))}_${replace(toUpper(suffix))}` as const;
+
+export const toUpper = <const S extends string>(str: S) =>
+  str.toUpperCase() as string extends S ? S : Uppercase<S>;
+
+const replace = <const S extends string>(str: S) =>
+  str.replace(/-/g, "_") as Replace<S>;
+
+type Replace<S extends string, Accum extends string = ""> = string extends S
+  ? S
+  : S extends ""
+    ? Accum
+    : S extends `${infer S}${infer Rest}`
+      ? S extends "-"
+        ? Replace<Rest, `${Accum}_`>
+        : Replace<Rest, `${Accum}${S}`>
+      : Accum;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Phase.ts b/.repos/alchemy-effect/packages/alchemy/src/Phase.ts
new file mode 100644
index 00000000000..ad7355b7b6e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Phase.ts
@@ -0,0 +1,15 @@
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+
+export type AlchemyPhase = "plan" | "runtime";
+
+export const ALCHEMY_PHASE = Config.string("ALCHEMY_PHASE").pipe(
+  Config.withDefault("plan"),
+  Config.mapOrFail((value) => {
+    if (value !== "plan" && value !== "runtime") {
+      return Effect.die(new Error(`Invalid ALCHEMY_PHASE: ${value}`));
+    }
+    return Effect.succeed(value as AlchemyPhase);
+  }),
+  Effect.orDie,
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/PhysicalName.ts b/.repos/alchemy-effect/packages/alchemy/src/PhysicalName.ts
new file mode 100644
index 00000000000..ce6ca880f1c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/PhysicalName.ts
@@ -0,0 +1,62 @@
+import * as Effect from "effect/Effect";
+import { base32 } from ".//Util/base32.ts";
+import { InstanceId } from "./InstanceId.ts";
+import { Stack } from "./Stack.ts";
+import { Stage } from "./Stage.ts";
+
+export const createPhysicalName = Effect.fn(function* ({
+  id,
+  prefix: _prefix,
+  // 16 base32 characters = 80 bits of entropy = 4 × 10⁻⁷
+  instanceId,
+  suffixLength = 16,
+  maxLength = 64,
+  delimiter = "-",
+  lowercase = false,
+}: {
+  id: string;
+  /**
+   * Prefix to add to the physical name.
+   *
+   * @default ${app.name}-${sanitizedId}-${app.stage}-
+   */
+  prefix?: string;
+  /**
+   * Hex-encoded instance ID (16 random bytes)
+   *
+   * @default - the InstanceID set by the engine in Context
+   */
+  instanceId?: string;
+  suffixLength?: number;
+  /**
+   * Maximum length of the physical name.
+   *
+   * If the name exceeds this length, the human-friendly portion of the name will be truncated to maxLength-suffixLength
+   */
+  maxLength?: number;
+  /** @default - "-" */
+  delimiter?: string;
+  /** Whether to lowercase the physical name. @default false */
+  lowercase?: boolean;
+}) {
+  // Always generate DNS-compatible names (letters, numbers, and hyphens only).
+  // This ensures physical names work across all services including S3 buckets.
+  const sanitize = (name: string) =>
+    (lowercase ? name.toLowerCase() : name).replaceAll(
+      lowercase ? /[^a-z0-9-]/g : /[^a-zA-Z0-9-]/g,
+      delimiter,
+    );
+  const stack = yield* Stack;
+  const stage = yield* Stage;
+  const prefix =
+    _prefix ?? `${stack.name}${delimiter}${id}${delimiter}${stage}${delimiter}`;
+  const randomId = base32(
+    Buffer.from(instanceId ?? (yield* InstanceId), "hex"),
+  );
+  const suffix = randomId.slice(0, suffixLength);
+  const name = `${prefix}${suffix}`;
+  if (maxLength && name.length > maxLength) {
+    return sanitize(`${prefix.slice(0, maxLength - suffix.length)}${suffix}`);
+  }
+  return sanitize(name);
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Plan.ts b/.repos/alchemy-effect/packages/alchemy/src/Plan.ts
new file mode 100644
index 00000000000..0c48a773db1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Plan.ts
@@ -0,0 +1,1451 @@
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import { asEffect } from ".//Util/types.ts";
+import { isAction, type ActionLike } from "./Action.ts";
+import {
+  AdoptPolicy,
+  OwnedBySomeoneElse,
+  stripUnowned,
+  Unowned,
+} from "./AdoptPolicy.ts";
+import { AlchemyContext } from "./AlchemyContext.ts";
+import {
+  Artifacts,
+  ArtifactStore,
+  createArtifactStore,
+  ensureArtifactStore,
+  makeScopedArtifacts,
+} from "./Artifacts.ts";
+import {
+  dedupeBindings,
+  diffBindings,
+  havePropsChanged,
+  isResolved,
+  type NoopDiff,
+  type UpdateDiff,
+} from "./Diff.ts";
+import { parseFqn } from "./FQN.ts";
+import { generateInstanceId, InstanceId } from "./InstanceId.ts";
+import * as Output from "./Output.ts";
+import {
+  findProviderByType,
+  Provider,
+  type ProviderService,
+} from "./Provider.ts";
+import {
+  isResource,
+  type ResourceBinding,
+  type ResourceLike,
+} from "./Resource.ts";
+import { type StackSpec } from "./Stack.ts";
+import {
+  isActionState,
+  State,
+  type ActionState,
+  type CreatedResourceState,
+  type CreatingResourceState,
+  type RanActionState,
+  type ReplacedResourceState,
+  type ReplacingResourceState,
+  type ResourceState,
+  type UpdatedResourceState,
+  type UpdatingReourceState,
+} from "./State/index.ts";
+import { hashInput } from "./Util/hash.ts";
+import { findCycleMembers } from "./Util/scc.ts";
+
+export type PlanError = never;
+
+export const isCRUD = (node: any): node is CRUD => {
+  return (
+    node &&
+    typeof node === "object" &&
+    (node.action === "create" ||
+      node.action === "update" ||
+      node.action === "replace" ||
+      node.action === "noop")
+  );
+};
+
+/**
+ * A node in the plan that represents a resource CRUD operation.
+ */
+export type CRUD<R extends ResourceLike = ResourceLike> =
+  | Create<R>
+  | Update<R>
+  | Delete<R>
+  | Replace<R>
+  | NoopUpdate<R>;
+
+export type Apply<R extends ResourceLike = ResourceLike> =
+  | Create<R>
+  | Update<R>
+  | Replace<R>
+  | NoopUpdate<R>;
+
+export type BindingAction = "create" | "update" | "delete" | "noop";
+
+export interface BindingNode<Data = any> extends ResourceBinding {
+  action: BindingAction;
+  data: Data;
+}
+
+export interface BaseNode<
+  R extends ResourceLike<string> = ResourceLike<string>,
+> {
+  resource: R;
+  provider: ProviderService<R>;
+  downstream: string[];
+  bindings: BindingNode<R["Binding"]>[];
+}
+
+export interface Create<
+  R extends ResourceLike = ResourceLike,
+> extends BaseNode<R> {
+  action: "create";
+  props: R["Props"];
+  state: CreatingResourceState | undefined;
+}
+
+export interface Update<
+  R extends ResourceLike = ResourceLike,
+> extends BaseNode<R> {
+  action: "update";
+  props: R["Props"];
+  state:
+    | CreatedResourceState
+    | UpdatedResourceState
+    | UpdatingReourceState
+    // the props can change after creating the replacement resource,
+    // so Apply needs to handle updates and then continue with cleaning up the replaced graph
+    | ReplacedResourceState;
+}
+
+export interface Delete<
+  R extends ResourceLike = ResourceLike,
+> extends BaseNode<R> {
+  action: "delete";
+  // a resource can be deleted no matter what state it's in
+  state: ResourceState;
+}
+
+export interface NoopUpdate<
+  R extends ResourceLike = ResourceLike,
+> extends BaseNode<R> {
+  action: "noop";
+  state: CreatedResourceState | UpdatedResourceState;
+}
+
+export interface Replace<
+  R extends ResourceLike = ResourceLike,
+> extends BaseNode<R> {
+  action: "replace";
+  props: any;
+  deleteFirst: boolean;
+  restart?: boolean;
+  state:
+    | CreatingResourceState
+    | CreatedResourceState
+    | UpdatingReourceState
+    | UpdatedResourceState
+    | ReplacingResourceState
+    | ReplacedResourceState;
+}
+
+// ── Tasks ──────────────────────────────────────────────────────────────────
+//
+// Tasks live in the same FQN namespace as resources and participate in the
+// same DAG (downstream/upstream edges, cycle detection). Their plan nodes
+// have a different shape because they have no provider lifecycle.
+
+export type ActionApply<T extends ActionLike = ActionLike> =
+  | ActionRun<T>
+  | ActionNoop<T>;
+
+export interface ActionNodeBase<T extends ActionLike = ActionLike> {
+  readonly kind: "action";
+  def: T;
+  downstream: string[];
+}
+
+export interface ActionRun<
+  T extends ActionLike = ActionLike,
+> extends ActionNodeBase<T> {
+  action: "run";
+  /** Input expression — resolved against tracker outputs during apply. */
+  input: T["Input"];
+  /** Previous state, if any. `undefined` on the first run. */
+  state: ActionState | undefined;
+  /** True when `--force` triggered the re-run regardless of input drift. */
+  forced: boolean;
+}
+
+export interface ActionNoop<
+  T extends ActionLike = ActionLike,
+> extends ActionNodeBase<T> {
+  action: "noop";
+  state: RanActionState;
+}
+
+export interface ActionDelete<
+  T extends ActionLike = ActionLike,
+> extends ActionNodeBase<T> {
+  action: "delete";
+  state: ActionState;
+}
+
+export type Plan<Output = any> = {
+  resources: {
+    [id in string]: Apply<any>;
+  };
+  /**
+   * Tasks scheduled for this apply. Keyed by FQN, same namespace as
+   * `resources` — Apply's scheduler merges both into a single DAG.
+   */
+  actions: {
+    [id in string]: ActionApply;
+  };
+  deletions: {
+    [id in string]?: Delete<ResourceLike>;
+  };
+  /** Tasks whose state should be dropped (no body invoked on removal). */
+  actionDeletions: {
+    [id in string]?: ActionDelete;
+  };
+  output: Output;
+  /**
+   * FQNs of resources that participate in a strongly-connected component
+   * of the upstream dependency graph (or have a self-edge). The scheduler
+   * uses this to decide whether an `update` node must publish its prior
+   * attr early to break the cycle, or can simply wait for upstreams and
+   * publish a fresh attr (the common, linear case).
+   */
+  cycleMembers: ReadonlySet<string>;
+};
+
+export interface MakePlanOptions {
+  force?: boolean;
+}
+
+export const make = <A>(
+  stack: StackSpec<A>,
+  options: MakePlanOptions = {},
+): Effect.Effect<Plan<A>, never, State> =>
+  // @ts-expect-error
+  Effect.gen(function* () {
+    const state = yield* yield* State;
+
+    const resources = Object.values(stack.resources);
+    const actions = Object.values(stack.actions ?? {});
+
+    // TODO(sam): rename terminology to Stack
+    const stackName = stack.name;
+    const stage = stack.stage;
+
+    // Resolve the effective adoption setting for this plan. AdoptPolicy
+    // (provided by the CLI or scoped via `adopt(...)`) takes precedence; if
+    // unset, fall back to the AlchemyContext's `adopt` default; otherwise
+    // adoption is disabled.
+    const shouldAdopt = Effect.gen(function* () {
+      const fromService = yield* Effect.serviceOption(AdoptPolicy);
+      if (Option.isSome(fromService)) return fromService.value;
+      const ctx = yield* Effect.serviceOption(AlchemyContext);
+      return Option.match(ctx, {
+        onNone: () => false,
+        onSome: (c) => c.adopt,
+      });
+    });
+
+    const resourceFqns = yield* state.list({
+      stack: stackName,
+      stage: stage,
+    });
+    const oldResources = yield* Effect.all(
+      resourceFqns.map((fqn) =>
+        state.get({ stack: stackName, stage: stage, fqn }),
+      ),
+      { concurrency: "unbounded" },
+    );
+
+    const resolvedResources: Record<string, Effect.Effect<any>> = {};
+
+    const resolveResource = (
+      resourceExpr: Output.ResourceExpr<any, any>,
+    ): Effect.Effect<any> =>
+      Effect.gen(function* () {
+        // Tasks share the ResourceExpr machinery but have no provider /
+        // stable-properties story at plan time. Leave the expression
+        // unsubstituted — Apply resolves it from the tracker at run time.
+        if (isAction(resourceExpr.src as any)) {
+          return resourceExpr;
+        }
+        // @ts-expect-error
+        return yield* (resolvedResources[resourceExpr.src.FQN] ??=
+          yield* Effect.cached(
+            Effect.gen(function* () {
+              const resource = resourceExpr.src;
+
+              const provider = yield* findProviderByType(resource.Type);
+              const props = yield* resolveInput(resource.Props);
+              const persisted = yield* state.get({
+                stack: stackName,
+                stage: stage,
+                fqn: resource.FQN,
+              });
+              const oldState: ResourceState | undefined = isActionState(
+                persisted,
+              )
+                ? undefined
+                : (persisted as ResourceState | undefined);
+
+              if (!oldState || oldState.status === "creating") {
+                return resourceExpr;
+              }
+
+              const oldProps =
+                oldState.status === "updating"
+                  ? oldState.old.props
+                  : oldState.props;
+
+              const oldBindings = oldState.bindings ?? [];
+              // Collapse duplicate bindings by sid so the binding set handed to
+              // `diff` matches what `reconcile` receives (see `dedupeBindings`).
+              const newBindings = dedupeBindings(
+                stack.bindings[resource.FQN] ?? [],
+              );
+
+              const diff = yield* provider.diff
+                ? provider
+                    .diff({
+                      id: resource.LogicalId,
+                      olds: oldProps,
+                      instanceId: oldState.instanceId,
+                      news: props,
+                      output: oldState.attr,
+                      oldBindings,
+                      newBindings,
+                    })
+                    .pipe(providePlanScope(resource.FQN, oldState.instanceId))
+                : Effect.succeed(undefined);
+
+              const stables: string[] = [
+                ...(provider.stables ?? []),
+                ...(diff?.stables ?? []),
+              ];
+
+              const withStables = (output: any) =>
+                stables.length > 0
+                  ? new Output.ResourceExpr(
+                      resourceExpr.src,
+                      Object.fromEntries(
+                        stables.map((stable) => [stable, output?.[stable]]),
+                      ),
+                    )
+                  : // if there are no stable properties, treat every property as changed
+                    resourceExpr;
+
+              if (diff == null) {
+                if (havePropsChanged(oldProps, props)) {
+                  // the props have changed but the provider did not provide any hints as to what is stable
+                  // so we must assume everything has changed
+                  return withStables(oldState?.attr);
+                }
+              } else if (diff.action === "update") {
+                return withStables(oldState?.attr);
+              } else if (diff.action === "replace") {
+                return resourceExpr;
+              }
+              if (
+                oldState.status === "created" ||
+                oldState.status === "updated" ||
+                oldState.status === "replaced"
+              ) {
+                // we can safely return the attributes if we know they have stabilized
+                return oldState?.attr;
+              } else {
+                // we must assume the resource doesn't exist if it hasn't stabilized
+                return resourceExpr;
+              }
+            }),
+          ));
+      });
+
+    const resolveInput = (input: any): Effect.Effect<any> =>
+      Effect.gen(function* () {
+        if (!input) {
+          return input;
+        } else if (Output.isExpr(input)) {
+          return yield* resolveOutput(input);
+        } else if (Redacted.isRedacted(input)) {
+          return input;
+        } else if (Duration.isDuration(input)) {
+          // Duration is an opaque value; walking its internal `.value`
+          // would destroy the prototype and produce a plain `{ value: ... }`
+          // object that downstream consumers can't interpret.
+          return input;
+        } else if (Array.isArray(input)) {
+          return yield* Effect.all(input.map(resolveInput), {
+            concurrency: "unbounded",
+          });
+        } else if (isResource(input)) {
+          // Resource objects have dynamic properties (path, hash, etc.) that are
+          // created on-demand by a Proxy getter and aren't enumerable via Object.entries.
+          // Resolve the ResourceExpr to get the actual resource output, then continue
+          // resolving any nested outputs in the result.
+          const resourceExpr = Output.of(input);
+          const resolved = yield* resolveOutput(resourceExpr);
+          return yield* resolveInput(resolved);
+        } else if (typeof input === "object") {
+          return Object.fromEntries(
+            yield* Effect.all(
+              Object.entries(input).map(([key, value]) =>
+                resolveInput(value).pipe(Effect.map((value) => [key, value])),
+              ),
+              { concurrency: "unbounded" },
+            ),
+          );
+        }
+        return input;
+      });
+
+    const resolveOutput = (expr: Output.Expr<any>): Effect.Effect<any> =>
+      Effect.gen(function* () {
+        if (Output.isResourceExpr(expr)) {
+          return yield* resolveResource(expr);
+        } else if (Output.isPropExpr(expr)) {
+          const upstream = yield* resolveOutput(expr.expr);
+          return upstream?.[expr.identifier];
+        } else if (Output.isApplyExpr(expr)) {
+          const upstream = yield* resolveOutput(expr.expr);
+          return Output.hasOutputs(upstream) ? expr : expr.f(upstream);
+        } else if (Output.isEffectExpr(expr)) {
+          const upstream = yield* resolveOutput(expr.expr);
+          return Output.hasOutputs(upstream) ? expr : yield* expr.f(upstream);
+        } else if (Output.isFlatMapExpr(expr)) {
+          const upstream = yield* resolveOutput(expr.expr);
+          // Source still unresolved -> keep the flatMap intact for a later pass.
+          // Otherwise run `f` to produce the next Output and resolve into it.
+          return Output.hasOutputs(upstream)
+            ? expr
+            : yield* resolveOutput(
+                Output.asOutput(expr.f(upstream)) as Output.Expr<any>,
+              );
+        } else if (Output.isAllExpr(expr)) {
+          return yield* Effect.all(expr.outs.map(resolveOutput), {
+            concurrency: "unbounded",
+          });
+        } else if (Output.isLiteralExpr(expr)) {
+          return expr.value;
+        } else if (Output.isRefExpr(expr)) {
+          const refStack = expr.stack ?? stackName;
+          const refStage = expr.stage ?? stage;
+          const refState = yield* state
+            .get({
+              stack: refStack,
+              stage: refStage,
+              fqn: expr.resourceId,
+            })
+            .pipe(Effect.orDie);
+          if (!refState) {
+            return yield* Effect.die(
+              new Output.InvalidReferenceError({
+                message: `Reference to '${expr.resourceId}' in stack '${refStack}' and stage '${refStage}' not found. Have you deployed '${refStage}' of '${refStack}'?`,
+                stack: refStack,
+                stage: refStage,
+                resourceId: expr.resourceId,
+              }),
+            );
+          }
+          return (refState as any).attr ?? (refState as any).output;
+        } else if (Output.isStackRefExpr(expr)) {
+          const refStack = expr.stack;
+          const refStage = expr.stage ?? stage;
+          const output = yield* state
+            .getOutput({
+              stack: refStack,
+              stage: refStage,
+            })
+            .pipe(Effect.orDie);
+          if (output == null) {
+            return yield* Effect.die(
+              new Output.InvalidReferenceError({
+                message: `Reference to stack '${refStack}' at stage '${refStage}' not found. Have you deployed stage '${refStage}' of '${refStack}'?`,
+                stack: refStack,
+                stage: refStage,
+                resourceId: refStack,
+              }),
+            );
+          }
+          return output;
+        } else if (Output.isNamedExpr(expr)) {
+          return yield* resolveOutput(expr.expr);
+        }
+        return yield* Effect.die(
+          new Error("Not implemented yet" + (expr as any).kind),
+        );
+      });
+
+    // map of resource FQN -> its downstream dependencies (resources that depend on it)
+    const oldDownstreamDependencies: {
+      [fqn: string]: string[];
+    } = Object.fromEntries(
+      oldResources
+        .filter((resource) => !!resource)
+        .map((resource) => [resource.fqn, resource.downstream]),
+    );
+
+    // Build a set of FQNs for the new resources to detect orphans
+    const newResourceFqns = new Set(resources.map((r) => r.FQN));
+    const newActionFqns = new Set(actions.map((t) => t.FQN));
+    // Unified set used wherever the DAG must include both kinds.
+    const newNodeFqns = new Set<string>([...newResourceFqns, ...newActionFqns]);
+
+    // Map FQN -> list of upstream FQNs (resources this one depends on via props).
+    // Tasks contribute upstream edges through their `Input` expression.
+    const newUpstreamDependencies: {
+      [fqn: string]: string[];
+    } = Object.fromEntries([
+      ...resources.map(
+        (resource) =>
+          [
+            resource.FQN,
+            Object.values(Output.upstreamAny(resource.Props)).map((r) => r.FQN),
+          ] as const,
+      ),
+      ...actions.map(
+        (action) =>
+          [
+            action.FQN,
+            Object.values(Output.upstreamAny(action.Input)).map((r) => r.FQN),
+          ] as const,
+      ),
+    ]);
+
+    // Map FQN -> list of upstream FQNs from bindings
+    const bindingUpstreamDependencies: {
+      [fqn: string]: string[];
+    } = Object.fromEntries(
+      resources.map((resource) => [
+        resource.FQN,
+        Object.values(
+          Output.upstreamAny(stack.bindings[resource.FQN] ?? []),
+        ).map((r) => r.FQN),
+      ]),
+    );
+
+    // Combined prop + binding upstream for the desired graph, including
+    // references to resources outside the current graph so delete validation can
+    // tell whether any surviving resource still points at an orphan.
+    const rawUpstreamDependencies: {
+      [fqn: string]: string[];
+    } = Object.fromEntries<string[]>([
+      ...resources.map((resource): [string, string[]] => {
+        const fqn = resource.FQN;
+        const propDeps = newUpstreamDependencies[fqn] ?? [];
+        const bindDeps = bindingUpstreamDependencies[fqn] ?? [];
+        return [fqn, [...new Set([...propDeps, ...bindDeps])]];
+      }),
+      // Actions have no bindings — their upstream is purely their input.
+      ...actions.map((action): [string, string[]] => {
+        const fqn = action.FQN;
+        return [fqn, newUpstreamDependencies[fqn] ?? []];
+      }),
+    ]);
+
+    // Combined prop + binding upstream, filtered to resources/tasks in this
+    // graph for scheduling and cycle detection.
+    const allUpstreamDependencies: {
+      [fqn: string]: string[];
+    } = Object.fromEntries([
+      ...resources.map((resource) => {
+        const fqn = resource.FQN;
+        const deps = rawUpstreamDependencies[fqn] ?? [];
+        return [fqn, deps.filter((dep) => newNodeFqns.has(dep))] as const;
+      }),
+      ...actions.map((action) => {
+        const fqn = action.FQN;
+        const deps = newUpstreamDependencies[fqn] ?? [];
+        return [fqn, deps.filter((dep) => newNodeFqns.has(dep))] as const;
+      }),
+    ]);
+
+    // Resources that participate in a cycle when both prop and binding
+    // edges are considered. Used below to decide whether an acyclic
+    // binding edge should also become a downstream edge.
+    const combinedCycleMembers = findCycleMembers(allUpstreamDependencies);
+
+    // Map FQN -> list of downstream FQNs (resources/actions that depend on
+    // this one).
+    //
+    // Prop edges always become downstream edges — they can't form cycles
+    // (the resource graph is a DAG by construction once props are fully
+    // resolved). Binding edges become downstream edges too, except when
+    // they participate in a cycle in the combined graph: mutual bindings
+    // (A binds to B's data, B binds to A's data) intentionally do not
+    // create downstream edges, so deletion does not deadlock waiting on
+    // each other (see the "binding-only cycles inside a construct" test
+    // in `plan.test.ts`).
+    //
+    // Including acyclic binding edges is required for cloud APIs that
+    // enforce the binding at the provider level — e.g. a Cloudflare
+    // Worker with a `service` binding to another Worker cannot delete
+    // the upstream worker until the downstream worker's binding has been
+    // removed. Without the binding edge in `downstream`, the two delete
+    // concurrently and the upstream delete fails with
+    // `ServiceBindingConflict`.
+    //
+    // Actions don't have bindings, so for action upstreams we use only
+    // prop edges (which collapse to `newUpstreamDependencies` lookups).
+    const computeDownstream = (upFqn: string): string[] => {
+      const downstream: string[] = [];
+      for (const [downFqn, upstreams] of Object.entries(
+        rawUpstreamDependencies,
+      )) {
+        if (downFqn === upFqn) continue;
+        if (!upstreams.includes(upFqn)) continue;
+        const isPropEdge = (newUpstreamDependencies[downFqn] ?? []).includes(
+          upFqn,
+        );
+        if (isPropEdge) {
+          downstream.push(downFqn);
+          continue;
+        }
+        // Binding-only edge — exclude when both endpoints sit inside
+        // the same SCC of the combined graph.
+        if (
+          combinedCycleMembers.has(upFqn) &&
+          combinedCycleMembers.has(downFqn)
+        ) {
+          continue;
+        }
+        downstream.push(downFqn);
+      }
+      return downstream;
+    };
+
+    const newDownstreamDependencies: {
+      [fqn: string]: string[];
+    } = Object.fromEntries([
+      ...resources.map(
+        (resource) => [resource.FQN, computeDownstream(resource.FQN)] as const,
+      ),
+      ...actions.map(
+        (action) => [action.FQN, computeDownstream(action.FQN)] as const,
+      ),
+    ]);
+
+    const resourceGraph = Object.fromEntries(
+      (yield* Effect.all(
+        resources.map(
+          Effect.fn("plan.diff.resource")(function* (resource) {
+            const provider = yield* findProviderByType(resource.Type);
+            const id = resource.LogicalId;
+            const fqn = resource.FQN;
+            const news = yield* resolveInput(resource.Props);
+            const downstream = newDownstreamDependencies[fqn] ?? [];
+
+            // Collapse duplicate bindings by sid so the binding set handed to
+            // `diff` matches what `reconcile` receives (see `dedupeBindings`).
+            const newBindings: ResourceBinding[] = dedupeBindings(
+              yield* resolveInput(stack.bindings[fqn] ?? []),
+            );
+            const persisted = yield* state.get({
+              stack: stackName,
+              stage: stage,
+              fqn,
+            });
+            // A Task previously held this FQN. Treat as if there were no
+            // prior state — the Task's row will be reaped by `actionDeletions`
+            // below and the resource starts from scratch.
+            let oldState: ResourceState | undefined = isActionState(persisted)
+              ? undefined
+              : (persisted as ResourceState | undefined);
+
+            // Engine-level adoption. When there is no prior state, always
+            // consult `provider.read` (if implemented) so the engine — not
+            // each lifecycle method — owns the existence/ownership decision.
+            //
+            // The provider returns one of:
+            //   - `undefined`        → resource doesn't exist; create it
+            //   - plain attrs        → exists and is owned by us; silent adopt
+            //   - `Unowned(attrs)`   → exists but is *not* ours
+            //
+            // Routing:
+            //   - owned                          → persist `created` state
+            //                                      from attrs and continue
+            //                                      through the normal diff
+            //                                      path (so subsequent props
+            //                                      drift produces an update).
+            //   - unowned + adopt enabled        → take over: persist `created`
+            //                                      state and let the next
+            //                                      update overwrite tags / etc.
+            //   - unowned + adopt disabled       → fail with
+            //                                      `OwnedBySomeoneElse`.
+            // After a cold-start adoption (engine just discovered an
+            // existing cloud resource via `read`), force the engine's
+            // normal `update` path so the provider can re-sync ownership
+            // tags, configuration, etc. against the desired props.
+            // Adoption persists state with `props: news`, so the default
+            // diff sees no drift and would noop — which would leave any
+            // foreign-owned tags / divergent config in place. Forcing
+            // update keeps the deploy idempotent: if cloud state already
+            // matches news, the provider's update is a no-op write.
+            //
+            // Skip the adoption probe entirely when `news` still contains
+            // unresolved upstream Outputs (e.g. a `streamArn` referencing
+            // a stream being created in the same plan). Calling `read` with
+            // an unresolved value would surface as `ParseError` from the
+            // SDK protocol layer. Resources whose props depend on
+            // not-yet-created upstreams cannot themselves be pre-existing
+            // — there's nothing to adopt.
+            let forceUpdateAfterAdoption = false;
+            if (oldState === undefined && provider.read && isResolved(news)) {
+              const adoptInstanceId = yield* generateInstanceId();
+              const readResult = yield* provider
+                .read({
+                  id,
+                  instanceId: adoptInstanceId,
+                  olds: news,
+                  output: undefined,
+                })
+                .pipe(providePlanScope(fqn, adoptInstanceId));
+              if (readResult !== undefined) {
+                const isUnowned = Unowned.is(readResult);
+                if (isUnowned && !(yield* shouldAdopt)) {
+                  return yield* new OwnedBySomeoneElse({
+                    message:
+                      `Cannot adopt resource '${fqn}' (${resource.Type}): ` +
+                      "it exists in the cloud but is not owned by this " +
+                      "stack/stage/logical-id. Re-run with `--adopt` (or " +
+                      "wrap the effect in `adopt(true)`) to take it over.",
+                    resourceType: resource.Type,
+                    logicalId: id,
+                  });
+                }
+                const adoptedState = {
+                  status: "created" as const,
+                  fqn,
+                  logicalId: id,
+                  instanceId: adoptInstanceId,
+                  namespace: resource.Namespace,
+                  resourceType: resource.Type,
+                  props: news,
+                  attr: stripUnowned(readResult),
+                  providerVersion: provider.version ?? 0,
+                  bindings: [],
+                  downstream,
+                  removalPolicy: resource.RemovalPolicy,
+                } satisfies CreatedResourceState;
+                yield* state.set({
+                  stack: stackName,
+                  stage: stage,
+                  fqn,
+                  value: adoptedState,
+                });
+                oldState = adoptedState;
+                forceUpdateAfterAdoption = true;
+              }
+            }
+
+            const oldBindings = oldState?.bindings ?? [];
+            const bindingDiffs = diffBindings(oldBindings, newBindings);
+
+            const Node = <T extends Apply>(
+              node: Omit<
+                T,
+                "provider" | "resource" | "bindings" | "downstream"
+              >,
+            ) =>
+              ({
+                ...node,
+                provider,
+                resource,
+                bindings: bindingDiffs,
+                downstream,
+              }) as any as T;
+
+            // Plan against the persisted state we have, not the ideal final state we
+            // hoped to reach last time. Recovery is expressed by mapping each
+            // intermediate state back onto a fresh CRUD action.
+            if (oldState === undefined) {
+              return Node<Create>({
+                action: "create",
+                props: news,
+                state: oldState,
+              });
+            } else if (
+              oldState.status === "creating" &&
+              oldState.attr === undefined
+            ) {
+              // A create may have succeeded before state persistence failed. If the
+              // provider can recover an attribute snapshot, keep driving the same
+              // create instead of starting over blindly.
+              if (provider.read) {
+                const attr = yield* provider
+                  .read({
+                    id,
+                    instanceId: oldState.instanceId,
+                    olds: oldState.props,
+                    output: oldState.attr,
+                  })
+                  .pipe(providePlanScope(fqn, oldState.instanceId));
+                if (attr) {
+                  return Node<Create>({
+                    action: "create",
+                    props: news,
+                    state: { ...oldState, attr },
+                  });
+                }
+              }
+            }
+
+            // Diff against whatever props represent the best-known current attempt.
+            // For replacement recovery that means the top-level replacement props,
+            // not the older generations stored under `old`.
+            const oldProps = oldState.props;
+
+            const diff = yield* asEffect(
+              provider
+                ?.diff?.({
+                  id,
+                  olds: oldProps,
+                  instanceId: oldState.instanceId,
+                  output: oldState.attr,
+                  news,
+                  oldBindings,
+                  newBindings,
+                })
+                .pipe(providePlanScope(fqn, oldState.instanceId)),
+            ).pipe(
+              Effect.map(
+                (diff) =>
+                  diff ??
+                  ({
+                    action:
+                      havePropsChanged(oldProps, news) ||
+                      bindingDiffs.some((b) => b.action !== "noop")
+                        ? "update"
+                        : "noop",
+                  } as UpdateDiff | NoopDiff),
+              ),
+              Effect.map((diff) =>
+                options.force && diff.action === "noop"
+                  ? ({
+                      action: "update",
+                    } satisfies UpdateDiff)
+                  : diff,
+              ),
+              // After a cold-start adoption (silent or takeover), force at
+              // least an update so the provider re-syncs ownership tags /
+              // config against the desired props (otherwise the engine
+              // would noop and any drift between the existing cloud
+              // resource and `news` — including foreign-owned tags after a
+              // takeover — would persist).
+              Effect.map((diff) =>
+                forceUpdateAfterAdoption && diff.action === "noop"
+                  ? ({ action: "update" } satisfies UpdateDiff)
+                  : diff,
+              ),
+            );
+
+            if (oldState.status === "creating") {
+              if (diff.action === "noop") {
+                // we're in the creating state and props are un-changed
+                // let's just continue where we left off
+                return Node<Create>({
+                  action: "create",
+                  props: news,
+                  state: oldState,
+                });
+              } else if (diff.action === "update") {
+                // props have changed in a way that is updatable
+                // again, just continue with the create
+                // TODO(sam): should we maybe try an update instead?
+                return Node<Create>({
+                  action: "create",
+                  props: news,
+                  state: oldState,
+                });
+              } else {
+                // props have changed in an incompatible way
+                // because it's possible that an un-updatable resource has already been created
+                // we must use a replace step to create a new one and delete the potential old one
+                return Node<Replace>({
+                  action: "replace",
+                  props: news,
+                  deleteFirst: diff.deleteFirst ?? false,
+                  state: oldState,
+                });
+              }
+            } else if (oldState.status === "updating") {
+              // Updating already targets the live resource, so noop/update both mean
+              // "finish the interrupted update". Only a replace diff escalates it
+              // into a fresh replacement.
+              if (diff.action === "update" || diff.action === "noop") {
+                // we can continue where we left off
+                return Node<Update>({
+                  action: "update",
+                  props: news,
+                  state: oldState,
+                });
+              } else {
+                // we started to update a resource but now believe we should replace it
+                return Node<Replace>({
+                  action: "replace",
+                  deleteFirst: diff.deleteFirst ?? false,
+                  props: news,
+                  // TODO(sam): can Apply handle replacements when the oldState is UpdatingResourceState?
+                  // -> or should we do a provider.read to try and reconcile back to UpdatedResourceState?
+                  state: oldState,
+                });
+              }
+            } else if (oldState.status === "replacing") {
+              // The replacement candidate is still being created. Noop/update keep
+              // driving the same generation; replace means that candidate itself is
+              // now obsolete and must be wrapped in a new outer generation.
+              if (diff.action === "noop") {
+                // this is the stable case - noop means just continue with the replacement
+                return Node<Replace>({
+                  action: "replace",
+                  deleteFirst: oldState.deleteFirst,
+                  props: news,
+                  state: oldState,
+                });
+              } else if (diff.action === "update") {
+                // potential problem here - the props have changed since we tried to replace,
+                // but not enough to trigger another replacement. the resource provider should
+                // be designed as idempotent to converge to the right state when creating the new resource
+                // the newly generated instanceId is intended to assist with this
+                return Node<Replace>({
+                  action: "replace",
+                  deleteFirst: oldState.deleteFirst,
+                  props: news,
+                  state: oldState,
+                });
+              } else {
+                // The in-flight replacement candidate itself now needs replacement.
+                // Mark this as a restart so Apply creates a fresh generation instead
+                // of resuming the old replacement instance.
+                return Node<Replace>({
+                  restart: true,
+                  action: "replace",
+                  deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
+                  props: news,
+                  state: oldState,
+                });
+              }
+            } else if (oldState.status === "replaced") {
+              // The new resource already exists. Noop means "just let GC finish",
+              // update means "mutate the current replacement before GC finishes",
+              // and replace means "the current replacement also became obsolete".
+              if (diff.action === "noop") {
+                // this is the stable case - noop means just continue cleaning up the replacement
+                return Node<Replace>({
+                  action: "replace",
+                  deleteFirst: oldState.deleteFirst,
+                  props: news,
+                  state: oldState,
+                });
+              } else if (diff.action === "update") {
+                // the replacement has been created but now also needs to be updated
+                // the resource provider should:
+                // 1. Update the newly created replacement resource
+                // 2. Then proceed as normal to delete the replaced resources (after all downstream references are updated)
+                return Node<Update>({
+                  action: "update",
+                  props: news,
+                  state: oldState,
+                });
+              } else {
+                // Cleanup is still pending, but the current "new" resource has already
+                // become obsolete. Start another replacement generation and preserve
+                // the existing replaced node as part of the recursive old chain.
+                return Node<Replace>({
+                  restart: true,
+                  action: "replace",
+                  deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
+                  props: news,
+                  state: oldState,
+                });
+              }
+            } else if (oldState.status === "deleting") {
+              // we're in a partially deleted state, it is unclear whether it was or was not deleted
+              // so continue by re-creating it with the same instanceId and desired props
+              return Node<Create>({
+                action: "create",
+                props: news,
+                state: {
+                  ...oldState,
+                  status: "creating",
+                  props: news,
+                },
+              });
+            } else if (diff.action === "update") {
+              // Stable created/updated resources follow the normal CRUD mapping.
+              return Node<Update>({
+                action: "update",
+                props: news,
+                state: oldState,
+              });
+            } else if (diff.action === "replace") {
+              return Node<Replace>({
+                action: "replace",
+                props: news,
+                state: oldState,
+                deleteFirst: diff?.deleteFirst ?? false,
+              });
+            } else {
+              return Node<NoopUpdate>({
+                action: "noop",
+                state: oldState,
+              });
+            }
+          }),
+        ),
+        { concurrency: "unbounded" },
+      )).map((update) => [update.resource.FQN, update]),
+    ) as Plan["resources"];
+
+    // ── Action plan nodes ────────────────────────────────────────────────
+    const actionGraph = Object.fromEntries(
+      (yield* Effect.all(
+        actions.map(
+          Effect.fn("plan.diff.action")(function* (action) {
+            const fqn = action.FQN;
+            const downstream = newDownstreamDependencies[fqn] ?? [];
+            const resolvedInput = yield* resolveInput(action.Input);
+            const inputHash = yield* hashInput(resolvedInput);
+            const oldState = yield* state.get({
+              stack: stackName,
+              stage,
+              fqn,
+            });
+
+            if (oldState && !isActionState(oldState)) {
+              // FQN collision with a resource — surface as a fatal error so
+              // the user resolves it before we touch anything.
+              return [
+                fqn,
+                {
+                  kind: "action",
+                  action: "run",
+                  def: action,
+                  input: action.Input,
+                  state: undefined,
+                  downstream,
+                  forced: false,
+                } satisfies ActionRun,
+              ] as const;
+            }
+
+            const prior = oldState as ActionState | undefined;
+            const sameInput =
+              prior?.status === "ran" && prior.inputHash === inputHash;
+            if (sameInput && !options.force) {
+              return [
+                fqn,
+                {
+                  kind: "action",
+                  action: "noop",
+                  def: action,
+                  state: prior as RanActionState,
+                  downstream,
+                } satisfies ActionNoop,
+              ] as const;
+            }
+            return [
+              fqn,
+              {
+                kind: "action",
+                action: "run",
+                def: action,
+                input: action.Input,
+                state: prior,
+                downstream,
+                forced: !!options.force,
+              } satisfies ActionRun,
+            ] as const;
+          }),
+        ),
+        { concurrency: "unbounded" },
+      )) as ReadonlyArray<readonly [string, ActionApply]>,
+    ) as Plan["actions"];
+
+    // SCC membership of the combined upstream graph. Apply uses it to
+    // decide whether an update node must publish its prior attr early to
+    // break a cycle, or can simply wait for upstreams like a DAG node
+    // (the common case). Computed once, above, for the downstream graph.
+    const cycleMembers = combinedCycleMembers;
+
+    // Detect unsatisfiable dependency cycles among create/replace nodes.
+    // Update/noop nodes signal their Deferred before waitForDeps when in a
+    // cycle so they cannot deadlock. Create/replace nodes only signal
+    // early when they have a precreate handler. Simulate the concurrent
+    // execution: precreate nodes are immediately "resolved", then
+    // iteratively resolve any node whose deps are all resolved. Remaining
+    // nodes would deadlock.
+    {
+      const createReplaceNodes = new Set(
+        Object.entries(resourceGraph)
+          .filter(
+            ([_, node]) =>
+              node.action === "create" || node.action === "replace",
+          )
+          .map(([fqn]) => fqn),
+      );
+
+      if (createReplaceNodes.size > 0) {
+        const hasPrecreate = new Set(
+          [...createReplaceNodes].filter(
+            (fqn) => !!resourceGraph[fqn]?.provider?.precreate,
+          ),
+        );
+
+        const resolved = new Set(hasPrecreate);
+        let changed = true;
+        while (changed) {
+          changed = false;
+          for (const fqn of createReplaceNodes) {
+            if (resolved.has(fqn)) continue;
+            const deps = (allUpstreamDependencies[fqn] ?? []).filter((dep) =>
+              createReplaceNodes.has(dep),
+            );
+            if (deps.every((dep) => resolved.has(dep))) {
+              resolved.add(fqn);
+              changed = true;
+            }
+          }
+        }
+
+        const deadlocked = [...createReplaceNodes].filter(
+          (fqn) => !resolved.has(fqn),
+        );
+        if (deadlocked.length > 0) {
+          const missingPrecreate = deadlocked.filter(
+            (fqn) => !hasPrecreate.has(fqn),
+          );
+          return yield* Effect.die(
+            new UnsatisfiedResourceCycle({
+              message:
+                `Circular dependency detected that cannot be resolved: [${deadlocked.join(", ")}]. ` +
+                `Resources lacking a precreate handler: [${missingPrecreate.join(", ")}]. ` +
+                `All resources in a dependency cycle must implement precreate to allow early signaling.`,
+              cycle: deadlocked,
+              missingPrecreate,
+            }),
+          );
+        }
+      }
+    }
+
+    // Task deletions: state rows previously written by tasks that no
+    // longer appear in the stack. The body is NOT invoked — we just drop
+    // the row.
+    const actionDeletions: Plan["actionDeletions"] = Object.fromEntries(
+      (yield* Effect.all(
+        (yield* state.list({ stack: stackName, stage })).map(
+          Effect.fn("plan.diff.actionDeletion")(function* (fqn) {
+            if (newActionFqns.has(fqn) || newResourceFqns.has(fqn)) return;
+            const persisted = yield* state.get({
+              stack: stackName,
+              stage,
+              fqn,
+            });
+            if (!isActionState(persisted)) return;
+            const { logicalId } = parseFqn(fqn);
+            return [
+              fqn,
+              {
+                kind: "action",
+                action: "delete",
+                state: persisted,
+                downstream: persisted.downstream ?? [],
+                def: {
+                  Kind: "action",
+                  Namespace: persisted.namespace,
+                  FQN: fqn,
+                  LogicalId: logicalId,
+                  Type: persisted.actionType,
+                  Input: persisted.input,
+                  Run: () => undefined as any,
+                  Output: undefined as any,
+                } satisfies ActionLike,
+              } satisfies ActionDelete,
+            ] as const;
+          }),
+        ),
+        { concurrency: "unbounded" },
+      )).filter((v): v is NonNullable<typeof v> => !!v),
+    );
+
+    const deletions = Object.fromEntries(
+      (yield* Effect.all(
+        (yield* state.list({ stack: stackName, stage: stage })).map(
+          Effect.fn("plan.diff.deletion")(function* (fqn) {
+            if (newResourceFqns.has(fqn) || newActionFqns.has(fqn)) {
+              return;
+            }
+            const persisted = yield* state.get({
+              stack: stackName,
+              stage: stage,
+              fqn,
+            });
+            // Tasks are routed through `actionDeletions` above.
+            if (isActionState(persisted)) return;
+            const oldState = persisted as ResourceState | undefined;
+            let attr: any = oldState?.attr;
+            if (oldState) {
+              const { logicalId } = parseFqn(fqn);
+              const resourceType = oldState.resourceType;
+              const provider = yield* findProviderByType(resourceType);
+              if (oldState.attr === undefined) {
+                if (provider.read) {
+                  attr = yield* provider
+                    .read({
+                      id: logicalId,
+                      instanceId: oldState.instanceId,
+                      olds: oldState.props as never,
+                      output: oldState.attr as never,
+                    })
+                    .pipe(providePlanScope(fqn, oldState.instanceId));
+                }
+              }
+              return [
+                fqn,
+                {
+                  action: "delete",
+                  state: { ...oldState, attr },
+                  provider: provider,
+                  resource: {
+                    Namespace: oldState.namespace,
+                    FQN: fqn,
+                    LogicalId: logicalId,
+                    Type: oldState.resourceType,
+                    Attributes: attr,
+                    Props: oldState.props,
+                    Binding: undefined!,
+                    Provider: Provider(resourceType),
+                    RemovalPolicy: oldState.removalPolicy,
+                    RuntimeContext: undefined!,
+                    Providers: undefined,
+                  } as ResourceLike,
+                  downstream: oldDownstreamDependencies[fqn] ?? [],
+                  bindings: oldState.bindings.map((binding) => ({
+                    sid: binding.sid,
+                    action: "delete" as const,
+                    data: binding.data,
+                  })),
+                } satisfies Delete,
+              ] as const;
+            }
+          }),
+        ),
+        { concurrency: "unbounded" },
+      )).filter((v) => !!v),
+    );
+
+    for (const resourceFqn of Object.keys(deletions)) {
+      const dependencies = Object.entries(rawUpstreamDependencies)
+        .filter(
+          ([survivorFqn, upstream]) =>
+            survivorFqn in resourceGraph && upstream.includes(resourceFqn),
+        )
+        .map(([survivorFqn]) => survivorFqn);
+      if (dependencies.length > 0) {
+        return yield* new DeleteResourceHasDownstreamDependencies({
+          message: `Resource ${resourceFqn} has downstream dependencies`,
+          resourceId: resourceFqn,
+          dependencies,
+        });
+      }
+    }
+
+    return {
+      resources: resourceGraph,
+      actions: actionGraph,
+      deletions,
+      actionDeletions,
+      output: stack.output,
+      cycleMembers,
+    } satisfies Plan<A> as Plan<A>;
+  }).pipe(
+    ensureArtifactStore,
+    Effect.withSpan("plan.make", {
+      attributes: {
+        "alchemy.stack": stack.name,
+        "alchemy.stage": stack.stage,
+        "alchemy.resources.count": Object.keys(stack.resources).length,
+        "alchemy.force": !!options.force,
+      },
+    }),
+  );
+
+const providePlanScope =
+  (fqn: string, instanceId: string) =>
+  <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E, Exclude<R, InstanceId | Artifacts>> =>
+    Effect.serviceOption(ArtifactStore).pipe(
+      Effect.map(Option.getOrElse(createArtifactStore)),
+      Effect.flatMap((store) =>
+        effect.pipe(
+          Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)),
+          Effect.provideService(InstanceId, instanceId),
+        ),
+      ),
+    ) as Effect.Effect<A, E, Exclude<R, InstanceId | Artifacts>>;
+
+export class DeleteResourceHasDownstreamDependencies extends Data.TaggedError(
+  "DeleteResourceHasDownstreamDependencies",
+)<{
+  message: string;
+  resourceId: string;
+  dependencies: string[];
+}> {}
+
+export class UnsatisfiedResourceCycle extends Data.TaggedError(
+  "UnsatisfiedResourceCycle",
+)<{
+  message: string;
+  cycle: string[];
+  missingPrecreate: string[];
+}> {}
+
+// TODO(sam): compare props
+// oldBinding.props !== newBinding.props;
+
+/**
+ * Print a plan in a human-readable format that shows the graph topology.
+ */
+export const printPlan = (plan: Plan): string => {
+  const lines: string[] = [];
+  const allNodes = { ...plan.resources, ...plan.deletions };
+
+  // Build reverse mapping: upstream -> downstream
+  const upstreamMap: Record<string, string[]> = {};
+  for (const [id] of Object.entries(allNodes)) {
+    upstreamMap[id] = [];
+  }
+  for (const [id, node] of Object.entries(allNodes)) {
+    if (!node) continue;
+    for (const downstreamId of node.state?.downstream ?? []) {
+      if (upstreamMap[downstreamId]) {
+        upstreamMap[downstreamId].push(id);
+      }
+    }
+  }
+
+  // Action symbols
+  const actionSymbol = (action: string) => {
+    switch (action) {
+      case "create":
+        return "+";
+      case "update":
+        return "~";
+      case "delete":
+        return "-";
+      case "replace":
+        return "±";
+      case "noop":
+        return "=";
+      default:
+        return "?";
+    }
+  };
+
+  // Print header
+  lines.push(
+    "╔════════════════════════════════════════════════════════════════╗",
+  );
+  lines.push(
+    "║                           PLAN                                 ║",
+  );
+  lines.push(
+    "╠════════════════════════════════════════════════════════════════╣",
+  );
+  lines.push(
+    "║ Legend: + create, ~ update, - delete, ± replace, = noop,       ║",
+  );
+  lines.push(
+    "║         λ run task, · skip task                                ║",
+  );
+  lines.push(
+    "╚════════════════════════════════════════════════════════════════╝",
+  );
+  lines.push("");
+
+  // Print resources section
+  lines.push(
+    "┌─ Resources ────────────────────────────────────────────────────┐",
+  );
+  const resourceIds = Object.keys(plan.resources).sort();
+  for (const id of resourceIds) {
+    const node = plan.resources[id];
+    const symbol = actionSymbol(node.action);
+    const type = node.resource?.type ?? "unknown";
+    const downstream = node.state?.downstream?.length
+      ? ` → [${node.state?.downstream.join(", ")}]`
+      : "";
+    lines.push(`│ [${symbol}] ${id} (${type})${downstream}`);
+  }
+  if (resourceIds.length === 0) {
+    lines.push("│ (none)");
+  }
+  lines.push(
+    "└────────────────────────────────────────────────────────────────┘",
+  );
+  lines.push("");
+
+  // Print tasks section
+  lines.push(
+    "┌─ Tasks ────────────────────────────────────────────────────────┐",
+  );
+  const taskIds = Object.keys(plan.actions ?? {}).sort();
+  for (const id of taskIds) {
+    const node = plan.actions[id];
+    const symbol = node.action === "run" ? "λ" : "·";
+    const type = node.def.Type;
+    const downstream = node.downstream.length
+      ? ` → [${node.downstream.join(", ")}]`
+      : "";
+    lines.push(`│ [${symbol}] ${id} (${type})${downstream}`);
+  }
+  if (taskIds.length === 0) {
+    lines.push("│ (none)");
+  }
+  lines.push(
+    "└────────────────────────────────────────────────────────────────┘",
+  );
+  lines.push("");
+
+  // Print deletions section
+  lines.push(
+    "┌─ Deletions ────────────────────────────────────────────────────┐",
+  );
+  const deletionIds = Object.keys(plan.deletions).sort();
+  for (const id of deletionIds) {
+    const node = plan.deletions[id]!;
+    const type = node.resource?.Type ?? "unknown";
+    const downstream = node.state.downstream?.length
+      ? ` → [${node.state.downstream.join(", ")}]`
+      : "";
+    lines.push(`│ [-] ${id} (${type})${downstream}`);
+  }
+  const taskDeletionIds = Object.keys(plan.actionDeletions ?? {}).sort();
+  for (const id of taskDeletionIds) {
+    const node = plan.actionDeletions[id]!;
+    lines.push(`│ [-] ${id} (${node.def.Type}) [action]`);
+  }
+  if (deletionIds.length === 0 && taskDeletionIds.length === 0) {
+    lines.push("│ (none)");
+  }
+  lines.push(
+    "└────────────────────────────────────────────────────────────────┘",
+  );
+  lines.push("");
+
+  return lines.join("\n");
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/AuthProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/AuthProvider.ts
new file mode 100644
index 00000000000..c44e989b7b0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/AuthProvider.ts
@@ -0,0 +1,285 @@
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
+import {
+  AuthError,
+  AuthProviderLayer,
+  type ConfigureContext,
+} from "../Auth/AuthProvider.ts";
+import { CredentialsStore, displayRedacted } from "../Auth/Credentials.ts";
+import {
+  getEnvRedactedRequired,
+  getEnvRequired,
+  retryOnce,
+} from "../Auth/Env.ts";
+import * as Clank from "../Util/Clank.ts";
+
+/**
+ * Canonical name registered in {@link AuthProviders}. Use this key to look
+ * up the PlanetScale {@link AuthProvider} from inside provider Layers.
+ */
+export const PLANETSCALE_AUTH_PROVIDER_NAME = "Planetscale";
+
+const options: Array<{
+  value: PlanetscaleAuthConfig["method"];
+  label: string;
+  hint?: string;
+}> = [
+  {
+    value: "env",
+    label: "Environment Variables",
+    hint: "PLANETSCALE_API_TOKEN_ID + PLANETSCALE_API_TOKEN + PLANETSCALE_ORGANIZATION",
+  },
+  {
+    value: "stored",
+    label: "Service Token",
+    hint: "enter service token interactively, stored in ~/.alchemy/credentials",
+  },
+  //todo(pear): add planetscale oauth
+];
+
+/**
+ * Auth configuration persisted in `~/.alchemy/profiles.json` for the
+ * PlanetScale provider.
+ *
+ * - `env`: read credentials from environment variables at resolution time.
+ * - `stored`: read credentials from `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+ *
+ * OAuth is intentionally not implemented because PlanetScale does not
+ * publish a redirect-based OAuth client; service tokens are the canonical
+ * credential.
+ */
+export type PlanetscaleAuthConfig = { method: "env" } | { method: "stored" };
+
+/**
+ * apiToken credentials persisted to disk for `method: "stored"`.
+ * Stored under the file key `"planetscale-stored"`.
+ */
+export interface PlanetscaleStoredCredentials {
+  type: "apiToken";
+  tokenId: string;
+  token: string;
+  organization: string;
+}
+
+/**
+ * Resolved in-memory PlanetScale credentials returned by
+ * {@link AuthProviderImpl.read}.
+ */
+export interface PlanetscaleResolvedCredentials {
+  type: "apiToken";
+  tokenId: Redacted.Redacted<string>;
+  token: Redacted.Redacted<string>;
+  organization: string;
+  source: {
+    type: PlanetscaleAuthConfig["method"];
+    details?: string;
+  };
+}
+
+/**
+ * Layer that registers the PlanetScale {@link AuthProvider} into the
+ * {@link AuthProviders} registry when built. Include this in the
+ * PlanetScale `providers()` layer so `alchemy login` can discover it.
+ *
+ * Supported methods:
+ * - `env`: reads `PLANETSCALE_API_TOKEN_ID`/`PLANETSCALE_API_TOKEN`/`PLANETSCALE_ORGANIZATION`.
+ * - `stored`: prompts for a service token interactively and writes it to
+ *   `~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+ */
+export const PlanetscaleAuth = AuthProviderLayer<
+  PlanetscaleAuthConfig,
+  PlanetscaleResolvedCredentials
+>()(
+  PLANETSCALE_AUTH_PROVIDER_NAME,
+  Effect.gen(function* () {
+    const store = yield* CredentialsStore;
+
+    const loginStored = Effect.fnUntraced(function* (profileName: string) {
+      const tokenId = yield* Clank.text({
+        message: "Planetscale Service Token ID",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      const token = yield* Clank.password({
+        message: "Planetscale Service Token",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      const organization = yield* Clank.text({
+        message: "Planetscale Organization (URL slug)",
+        validate: (v) => (v.length === 0 ? "Required" : undefined),
+      }).pipe(retryOnce);
+
+      yield* store.write<PlanetscaleStoredCredentials>(
+        profileName,
+        "planetscale-stored",
+        {
+          type: "apiToken",
+          tokenId,
+          token,
+          organization,
+        },
+      );
+      yield* Clank.success("Planetscale: credentials saved.");
+      return { method: "stored" as const };
+    });
+
+    const configureInteractive = (profileName: string) =>
+      Clank.select({
+        message: "Planetscale authentication method",
+        options,
+      }).pipe(
+        Effect.flatMap((method) =>
+          Match.value(method).pipe(
+            Match.when("env", () => Effect.succeed({ method: "env" as const })),
+            Match.when("stored", () => loginStored(profileName)),
+            Match.exhaustive,
+          ),
+        ),
+      );
+
+    const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
+      Effect.gen(function* () {
+        if (ctx.ci) {
+          return { method: "env" as const };
+        }
+        return yield* configureInteractive(profileName);
+      }).pipe(
+        Effect.mapError(
+          (e) =>
+            new AuthError({
+              message: "failed to configure credentials",
+              cause: e,
+            }),
+        ),
+      );
+
+    const resolveCredentials = (
+      profileName: string,
+      config: PlanetscaleAuthConfig,
+    ): Effect.Effect<PlanetscaleResolvedCredentials, AuthError> =>
+      Match.value(config).pipe(
+        Match.when(
+          { method: "env" },
+          Effect.fnUntraced(function* () {
+            const tokenId = yield* getEnvRedactedRequired(
+              "PLANETSCALE_API_TOKEN_ID",
+            );
+            const token = yield* getEnvRedactedRequired(
+              "PLANETSCALE_API_TOKEN",
+            );
+            const organization = yield* getEnvRequired(
+              "PLANETSCALE_ORGANIZATION",
+            );
+
+            return {
+              type: "apiToken" as const,
+              tokenId,
+              token,
+              organization,
+              source: {
+                type: "env" as const,
+                details: "PLANETSCALE_API_TOKEN_ID/PLANETSCALE_API_TOKEN",
+              },
+            } satisfies PlanetscaleResolvedCredentials;
+          }),
+        ),
+        Match.when({ method: "stored" }, () =>
+          store
+            .read<PlanetscaleStoredCredentials>(
+              profileName,
+              "planetscale-stored",
+            )
+            .pipe(
+              Effect.flatMap((creds) =>
+                creds == null
+                  ? Effect.fail(
+                      new AuthError({
+                        message:
+                          "Planetscale stored credentials not found. Run: alchemy login --configure",
+                      }),
+                    )
+                  : Effect.succeed({
+                      type: "apiToken" as const,
+                      tokenId: Redacted.make(creds.tokenId),
+                      token: Redacted.make(creds.token),
+                      organization: creds.organization,
+                      source: {
+                        type: "stored" as const,
+                        details: undefined,
+                      },
+                    } satisfies PlanetscaleResolvedCredentials),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const logout = (profileName: string, config: PlanetscaleAuthConfig) =>
+      Match.value(config).pipe(
+        Match.when({ method: "env" }, () => Effect.void),
+        Match.when({ method: "stored" }, () =>
+          store
+            .delete(profileName, "planetscale-stored")
+            .pipe(
+              Effect.andThen(
+                Clank.success("Planetscale: stored credentials removed"),
+              ),
+            ),
+        ),
+        Match.exhaustive,
+      );
+
+    const login = (profileName: string, config: PlanetscaleAuthConfig) =>
+      Match.value(config)
+        .pipe(
+          Match.when({ method: "env" }, () => Effect.void),
+          Match.when({ method: "stored" }, () =>
+            store
+              .read<PlanetscaleStoredCredentials>(
+                profileName,
+                "planetscale-stored",
+              )
+              .pipe(
+                Effect.flatMap((creds) =>
+                  creds == null ? loginStored(profileName) : Effect.void,
+                ),
+              ),
+          ),
+          Match.exhaustive,
+        )
+        .pipe(
+          Effect.mapError(
+            (e) => new AuthError({ message: "login failed", cause: e }),
+          ),
+        );
+
+    const prettyPrint = (profileName: string, config: PlanetscaleAuthConfig) =>
+      resolveCredentials(profileName, config).pipe(
+        Effect.tap((creds) => {
+          const sourceStr = creds.source.details
+            ? `${creds.source.type} - ${creds.source.details}`
+            : creds.source.type;
+          return Effect.all([
+            Console.log(`  tokenId: ${displayRedacted(creds.token, 3)}`),
+            Console.log(`  token: ${displayRedacted(creds.token, 6)}`),
+            Console.log(`  organization: ${creds.organization}`),
+            Console.log(`  source: ${sourceStr}`),
+          ]);
+        }),
+        Effect.catch((e) =>
+          Console.error(`  Failed to retrieve credentials: ${e}`),
+        ),
+      );
+
+    return {
+      configure: configureCredentials,
+      logout,
+      login,
+      prettyPrint,
+      read: resolveCredentials,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Branch.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Branch.ts
new file mode 100644
index 00000000000..0c1ef1c5f34
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Branch.ts
@@ -0,0 +1,508 @@
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import { Unowned } from "../AdoptPolicy.ts";
+import { isResolved } from "../Diff.ts";
+import { createPhysicalName } from "../PhysicalName.ts";
+import * as Provider from "../Provider.ts";
+import type { ResourceClass, ResourceLike } from "../Resource.ts";
+import { hashImports, hashMigrations } from "../Sql/SqlFile.ts";
+import { ensureMySQLProductionBranchClusterSize } from "./MySQL/MySQLClusterSize.ts";
+import {
+  ensurePostgresProductionBranchClusterSize,
+  toPostgresClusterSku,
+} from "./Postgres/PostgresClusterSize.ts";
+import {
+  DEFAULT_MIGRATIONS_TABLE,
+  PlanetscaleConflict,
+  isKnownError,
+  recordsEqual,
+  waitForBranchReady,
+} from "./Util.ts";
+
+/**
+ * Props shared between {@link MySQLBranch} and {@link PostgresBranch}. The
+ * `database` and `parentBranch` fields are typed by each engine's resource.
+ */
+export interface BaseBranchProps {
+  /**
+   * Branch name. If omitted, a name is generated from the stack/stage/id.
+   */
+  name?: string;
+
+  /**
+   * If provided, restores the backup's schema and data to the new branch.
+   * Ignored if the branch already exists.
+   */
+  backupId?: string;
+
+  /**
+   * If provided, restores the last successful backup's schema and data.
+   * Ignored if the branch already exists.
+   */
+  seedData?: "last_successful_backup";
+
+  /**
+   * Whether safe migrations are enabled on the branch.
+   */
+  safeMigrations?: boolean;
+
+  /**
+   * Region in which to create the branch. Defaults to the database's
+   * region. The actual region is validated on adopt/update.
+   */
+  region?: { slug: string };
+
+  /**
+   * Directory containing `.sql` migration files. Files are sorted by numeric
+   * prefix (for example `0001_init.sql`) and applied in order against this
+   * branch.
+   */
+  migrationsDir?: string;
+
+  /**
+   * Name of the table used to track applied migrations.
+   * @default "__alchemy_migrations"
+   */
+  migrationsTable?: string;
+
+  /**
+   * Paths to additional `.sql` files to apply after migrations. Each file is
+   * hashed; only files whose contents change are re-applied on later deploys.
+   */
+  importFiles?: string[];
+}
+
+/**
+ * Attributes shared between {@link MySQLBranch} and {@link PostgresBranch}.
+ */
+export interface BaseBranchAttributes {
+  /** The branch name. */
+  name: string;
+  /** The PlanetScale organization slug. */
+  organization: string;
+  /** The database name. */
+  database: string;
+  /** The parent branch name. */
+  parentBranch: string;
+  /** Whether this is a production branch. */
+  production: boolean;
+  /** Time at which the branch was created (ISO 8601). */
+  createdAt: string;
+  /** Time at which the branch was last updated (ISO 8601). */
+  updatedAt: string;
+  /** HTML URL for accessing the branch in the dashboard. */
+  htmlUrl: string;
+  /** The region of the branch as reported by PlanetScale. */
+  region: { slug: string };
+  /** Directory containing migration files, if configured. */
+  migrationsDir: string | undefined;
+  /** Table used to track applied migrations, if configured. */
+  migrationsTable: string | undefined;
+  /** Content hashes for the last applied migration files. */
+  migrationsHashes: Record<string, string>;
+  /** Content hashes for the last applied import files. */
+  importHashes: Record<string, string>;
+}
+
+// Runtime-resolved Database/Branch references. `news.database` can be a
+// plain string OR (after resolution) the Database resource's attributes —
+// which contain plain values for `name` / `organization`. The static
+// Database type has those fields as `Output<...>`, so we cast through a
+// structural shape here.
+type DatabaseRef = string | { name: string; organization?: string };
+type BranchRef = string | { name: string };
+
+const resolveDatabase = (
+  database: unknown,
+): { name: string; organization?: string } => {
+  const ref = database as DatabaseRef | undefined;
+  if (!ref) return { name: "" };
+  return typeof ref === "string"
+    ? { name: ref }
+    : { name: ref.name, organization: ref.organization };
+};
+
+const resolveParent = (parent: unknown): string => {
+  const ref = parent as BranchRef | undefined;
+  return !ref ? "main" : typeof ref === "string" ? ref : ref.name;
+};
+
+const createBranchName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return (
+      name ??
+      (yield* createPhysicalName({ id, lowercase: true, maxLength: 63 }))
+    );
+  });
+
+/**
+ * Shape of the engine-specific migration runners used by
+ * {@link makeBranchProvider}. MySQL and Postgres each supply their own
+ * implementations in their respective `*Migrations.ts` modules.
+ */
+export interface BranchMigrationRunners {
+  runMigrations: (
+    target: { organization: string; database: string; branch: string },
+    migrationsDir: string,
+    migrationsTable: string,
+  ) => Effect.Effect<Record<string, string>, any, any>;
+  runImports: (
+    target: { organization: string; database: string; branch: string },
+    importFiles: string[],
+    rootDir: string,
+    previousHashes: Record<string, string>,
+  ) => Effect.Effect<Record<string, string>, any, any>;
+}
+
+/**
+ * Build a branch provider for a specific PlanetScale engine. The
+ * caller supplies the typed `Resource` token and the engine's migration
+ * runners; everything else (observe / ensure / sync / delete) is shared.
+ */
+export const makeBranchProvider = <R extends ResourceLike>(opts: {
+  resource: ResourceClass<R>;
+  expectedKind: "mysql" | "postgresql";
+  engineLabel: string;
+  runners: BranchMigrationRunners;
+}) =>
+  Provider.effect(
+    opts.resource,
+    Effect.gen(function* () {
+      const rootDir = yield* Effect.sync(() => process.cwd());
+      const createBranch = yield* ops.createBranch;
+      const getBranch = yield* ops.getBranch;
+      const updateBranch = yield* ops.updateBranch;
+      const deleteBranch = yield* ops.deleteBranch;
+      const promoteBranch = yield* ops.promoteBranch;
+      const demoteBranch = yield* ops.demoteBranch;
+      const enableSafe = yield* ops.enableSafeMigrations;
+      const disableSafe = yield* ops.disableSafeMigrations;
+      const { runMigrations, runImports } = opts.runners;
+
+      return {
+        stables: ["organization", "database"],
+
+        diff: Effect.fn(function* ({ news, olds, output }: any) {
+          if (!isResolved(news)) return undefined;
+
+          const newDb = resolveDatabase(news.database).name;
+          const oldDbRef = output?.database ?? olds.database;
+          if (oldDbRef) {
+            const oldDb = resolveDatabase(oldDbRef).name;
+            if (newDb !== oldDb) {
+              return { action: "replace" } as const;
+            }
+          }
+
+          const newParent = resolveParent(news.parentBranch);
+          const oldParent =
+            output?.parentBranch ?? resolveParent(olds.parentBranch);
+          if (newParent !== oldParent) {
+            return { action: "replace" } as const;
+          }
+
+          if (
+            news.region?.slug &&
+            output?.region?.slug &&
+            news.region.slug !== output.region.slug
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          if (news.migrationsDir) {
+            const newHashes = yield* hashMigrations(news.migrationsDir);
+            if (!recordsEqual(newHashes, output?.migrationsHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+            if (
+              (news.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE) !==
+              (output?.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE)
+            ) {
+              return { action: "update" } as const;
+            }
+          }
+          if (news.importFiles?.length) {
+            const newHashes = yield* hashImports(news.importFiles, rootDir);
+            if (!recordsEqual(newHashes, output?.importHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+          }
+
+          return undefined;
+        }),
+
+        read: Effect.fn(function* ({ id, olds, output }: any) {
+          // If we have neither a cached output nor a usable `olds.database`
+          // there's no way to identify which branch to refresh — most often
+          // this is destroy of a partially-created resource whose props
+          // never got fully persisted. Return `undefined` so the engine
+          // treats it as already-gone and drops the state entry.
+          if (!output && !olds?.database) {
+            return undefined;
+          }
+          const dbInfo = output
+            ? { name: output.database, organization: output.organization }
+            : resolveDatabase(olds.database);
+          const { organization: envOrg } = yield* Credentials;
+          const organization =
+            output?.organization ?? dbInfo.organization ?? envOrg;
+          const databaseName = output?.database ?? dbInfo.name;
+          const branchName =
+            output?.name ?? (yield* createBranchName(id, olds.name));
+
+          return yield* getBranch({
+            organization,
+            database: databaseName,
+            branch: branchName,
+          }).pipe(
+            Effect.map((data) => {
+              const attrs = {
+                name: data.name,
+                organization,
+                database: databaseName,
+                parentBranch: data.parent_branch ?? "main",
+                production: data.production,
+                createdAt: data.created_at,
+                updatedAt: data.updated_at,
+                htmlUrl: data.html_url,
+                region: { slug: data.region.slug },
+                migrationsDir: output?.migrationsDir ?? olds?.migrationsDir,
+                migrationsTable:
+                  output?.migrationsTable ?? olds?.migrationsTable,
+                migrationsHashes: output?.migrationsHashes ?? {},
+                importHashes: output?.importHashes ?? {},
+              } satisfies BaseBranchAttributes;
+
+              return output ? attrs : Unowned(attrs);
+            }),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }: any) {
+          const { organization: envOrg } = yield* Credentials;
+          const dbInfo = resolveDatabase(news.database);
+          const organization =
+            output?.organization ?? dbInfo.organization ?? envOrg;
+          const databaseName = output?.database ?? dbInfo.name;
+          const desiredBranchName = yield* createBranchName(id, news.name);
+          const observedBranchName = output?.name ?? desiredBranchName;
+          const parentBranchName = resolveParent(news.parentBranch);
+
+          // If parentBranch is a plain string (an unmanaged branch reference),
+          // wait for it to be ready before we touch the child branch. When it
+          // is a Branch resource, Alchemy's resource graph already guarantees
+          // readiness before this resource's inputs are resolved.
+          if (news.parentBranch && typeof news.parentBranch === "string") {
+            yield* waitForBranchReady(
+              organization,
+              databaseName,
+              parentBranchName,
+              session,
+            );
+          }
+
+          // Observe — fetch the live branch state.
+          let current = yield* getBranch({
+            organization,
+            database: databaseName,
+            branch: observedBranchName,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+          // Ensure — if missing, create. The parent must be ready before
+          // the child can fork from it. PostgreSQL short cluster sizes need
+          // to be expanded against the parent's region so the API call lands
+          // with a valid sku.
+          if (!current) {
+            const parent = yield* waitForBranchReady(
+              organization,
+              databaseName,
+              parentBranchName,
+              session,
+            );
+            const parentClusterSize = news.clusterSize
+              ? parent.kind === "postgresql"
+                ? toPostgresClusterSku({
+                    size: news.clusterSize,
+                    region: parent.region.slug,
+                  })
+                : news.clusterSize
+              : undefined;
+            yield* session.note("Creating branch...");
+            current = yield* createBranch({
+              organization,
+              database: databaseName,
+              name: desiredBranchName,
+              parent_branch: parentBranchName,
+              backup_id: news.backupId,
+              seed_data: news.seedData,
+              region: news.region?.slug,
+              cluster_size: parentClusterSize,
+            });
+          }
+
+          if (current.kind !== opts.expectedKind) {
+            return yield* Effect.fail(
+              new PlanetscaleConflict({
+                message:
+                  `Planetscale branch "${current.name}" (database "${databaseName}") has kind ` +
+                  `"${current.kind}" but this resource is a ${opts.engineLabel}. ` +
+                  `Use the matching ${current.kind === "mysql" ? "MySQLBranch" : "PostgresBranch"} ` +
+                  `resource instead.`,
+              }),
+            );
+          }
+
+          yield* waitForBranchReady(
+            organization,
+            databaseName,
+            current.name,
+            session,
+          );
+
+          // Sync name — branch names are mutable. Continue subsequent syncs
+          // under the name returned by the API.
+          if (current.name !== desiredBranchName) {
+            current = yield* updateBranch({
+              organization,
+              database: databaseName,
+              branch: current.name,
+              new_name: desiredBranchName,
+            });
+          }
+
+          const branchName = current.name;
+
+          // Sync production status before branch settings that depend on it.
+          // PlanetScale only supports explicit branch promotion/demotion for MySQL.
+          if (opts.expectedKind === "mysql") {
+            const desiredProduction = news.isProduction ?? false;
+            if (current.production !== desiredProduction) {
+              current = desiredProduction
+                ? yield* promoteBranch({
+                    organization,
+                    database: databaseName,
+                    branch: branchName,
+                  })
+                : yield* demoteBranch({
+                    organization,
+                    database: databaseName,
+                    branch: branchName,
+                  });
+            }
+          }
+
+          // Sync safeMigrations — observed via `current.safe_migrations`,
+          // skip the API call entirely on no-op.
+          if (
+            news.safeMigrations !== undefined &&
+            current.safe_migrations !== news.safeMigrations
+          ) {
+            if (news.safeMigrations) {
+              yield* enableSafe({
+                organization,
+                database: databaseName,
+                branch: branchName,
+              });
+            } else {
+              yield* disableSafe({
+                organization,
+                database: databaseName,
+                branch: branchName,
+              });
+            }
+          }
+
+          // Sync clusterSize — only meaningful on production branches.
+          if (news.clusterSize) {
+            if (current.kind === "postgresql") {
+              yield* ensurePostgresProductionBranchClusterSize(
+                organization,
+                databaseName,
+                branchName,
+                news.clusterSize,
+              );
+            } else {
+              yield* ensureMySQLProductionBranchClusterSize(
+                organization,
+                databaseName,
+                branchName,
+                news.clusterSize,
+              );
+            }
+          }
+
+          // Re-read so the returned attributes reflect any mutation.
+          const updated = yield* getBranch({
+            organization,
+            database: databaseName,
+            branch: branchName,
+          });
+
+          const migrationTarget = {
+            organization,
+            database: databaseName,
+            branch: updated.name,
+          };
+
+          const migrationsTable =
+            news.migrationsTable ??
+            output?.migrationsTable ??
+            DEFAULT_MIGRATIONS_TABLE;
+          const migrationsHashes = news.migrationsDir
+            ? yield* runMigrations(
+                migrationTarget,
+                news.migrationsDir,
+                migrationsTable,
+              )
+            : (output?.migrationsHashes ?? {});
+          const importHashes = news.importFiles?.length
+            ? yield* runImports(
+                migrationTarget,
+                news.importFiles,
+                rootDir,
+                output?.importHashes ?? {},
+              )
+            : {};
+
+          return {
+            name: updated.name,
+            organization,
+            database: databaseName,
+            parentBranch: updated.parent_branch ?? parentBranchName,
+            production: updated.production,
+            createdAt: updated.created_at,
+            updatedAt: updated.updated_at,
+            htmlUrl: updated.html_url,
+            region: { slug: updated.region.slug },
+            migrationsDir: news.migrationsDir,
+            migrationsTable: news.migrationsDir ? migrationsTable : undefined,
+            migrationsHashes,
+            importHashes,
+          } satisfies BaseBranchAttributes;
+        }),
+
+        delete: Effect.fn(function* ({ output }: any) {
+          // If `read` returned undefined (e.g. destroy of a partially-
+          // created branch whose props never finished persisting), there
+          // is nothing addressable to delete. Drop the state entry.
+          if (!output) return;
+          yield* deleteBranch({
+            organization: output.organization,
+            database: output.database,
+            branch: output.name,
+          }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+            Effect.catchIf(
+              isKnownError(
+                "UnprocessableEntity",
+                "The default branch cannot be deleted.",
+              ),
+              () => Effect.void,
+            ),
+          );
+        }),
+      } as any;
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Credentials.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Credentials.ts
new file mode 100644
index 00000000000..95527ef7006
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Credentials.ts
@@ -0,0 +1,96 @@
+import {
+  Credentials,
+  DEFAULT_API_BASE_URL,
+} from "@distilled.cloud/planetscale/Credentials";
+import { ConfigError } from "@distilled.cloud/core/errors";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { getAuthProvider } from "../Auth/AuthProvider.ts";
+import { ALCHEMY_PROFILE, Profile } from "../Auth/Profile.ts";
+import {
+  PLANETSCALE_AUTH_PROVIDER_NAME,
+  type PlanetscaleAuthConfig,
+  type PlanetscaleResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export {
+  Credentials,
+  CredentialsFromEnv,
+  DEFAULT_API_BASE_URL,
+} from "@distilled.cloud/planetscale/Credentials";
+
+/**
+ * Build a PlanetScale `Credentials` Layer from an explicit token. Useful for
+ * tests or when the caller already has credentials in hand.
+ *
+ * @example
+ * ```ts
+ * Effect.provide(
+ *   Planetscale.fromToken({
+ *     tokenId: "abcd1234",
+ *     token: "api-token-secret",
+ *     organization: "my-org",
+ *   }),
+ * )
+ * ```
+ */
+export const fromToken = (input: {
+  tokenId: string | Redacted.Redacted<string>;
+  token: string | Redacted.Redacted<string>;
+  organization: string;
+  apiBaseUrl?: string;
+}) =>
+  Layer.succeed(Credentials, {
+    tokenId:
+      typeof input.token === "string"
+        ? Redacted.make(input.token)
+        : input.token,
+    token:
+      typeof input.token === "string"
+        ? Redacted.make(input.token)
+        : input.token,
+    organization: input.organization,
+    apiBaseUrl: input.apiBaseUrl ?? DEFAULT_API_BASE_URL,
+  });
+
+/**
+ * Build a PlanetScale `Credentials` Layer that resolves credentials via the
+ * Alchemy AuthProvider using the configured profile (defaults to "default",
+ * overridable with the `ALCHEMY_PROFILE` env/config value).
+ */
+export const fromAuthProvider = () =>
+  Layer.effect(
+    Credentials,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        PlanetscaleAuthConfig,
+        PlanetscaleResolvedCredentials
+      >(PLANETSCALE_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+      const apiBaseUrl = yield* Config.string("PLANETSCALE_API_BASE_URL").pipe(
+        Config.withDefault(DEFAULT_API_BASE_URL),
+      );
+
+      return yield* profile.loadOrConfigure(auth, profileName, { ci }).pipe(
+        Effect.flatMap((config) =>
+          auth.read(profileName, config as PlanetscaleAuthConfig),
+        ),
+        Effect.map((creds) => ({
+          tokenId: creds.tokenId,
+          token: creds.token,
+          organization: creds.organization,
+          apiBaseUrl,
+        })),
+        Effect.mapError(
+          (e) =>
+            new ConfigError({
+              message: `Failed to resolve Planetscale credentials for profile '${profileName}': ${(e as { message?: string }).message ?? String(e)}`,
+            }),
+        ),
+      );
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Database.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Database.ts
new file mode 100644
index 00000000000..253fd18b1a0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Database.ts
@@ -0,0 +1,129 @@
+/**
+ * Region selector for a PlanetScale Database.
+ */
+export interface DatabaseRegion {
+  /**
+   * Region slug (e.g. `"us-east"`, `"eu-west"`, `"gcp-us-central1"`).
+   * @see https://planetscale.com/docs/concepts/regions#available-regions
+   */
+  slug: "us-east" | "eu-west" | "gcp-us-central1" | (string & {});
+}
+
+/**
+ * Properties shared between {@link MySQLDatabase} and
+ * {@link PostgresDatabase}. Engine-specific props live on the per-engine
+ * resource types.
+ */
+export interface BaseDatabaseProps {
+  /**
+   * Database name. Must be lowercase. If omitted, a unique name will be
+   * generated from the stack/stage/logical-id.
+   */
+  name?: string;
+
+  /**
+   * Region where the database will be created. Cannot be changed after
+   * creation. If omitted, the organization's default region is used.
+   */
+  region?: DatabaseRegion;
+
+  /**
+   * Number of replicas for the database. `0` for non-HA, `2+` for HA.
+   * Create-only.
+   */
+  replicas?: number;
+
+  /**
+   * Whether deploy requests must be approved by a database administrator
+   * other than the request creator.
+   */
+  requireApprovalForDeploy?: boolean;
+
+  /**
+   * Whether to limit branch creation to the same region as the one
+   * selected during database creation.
+   */
+  restrictBranchRegion?: boolean;
+
+  /**
+   * Whether the web console can be used on the production branch.
+   */
+  productionBranchWebConsole?: boolean;
+
+  /**
+   * The default branch of the database.
+   * @default "main"
+   */
+  defaultBranch?: string;
+
+  /**
+   * Directory containing `.sql` migration files. Files are sorted by numeric
+   * prefix (for example `0001_init.sql`) and applied in order against the
+   * default branch.
+   */
+  migrationsDir?: string;
+
+  /**
+   * Name of the table used to track applied migrations.
+   * @default "planetscale_migrations"
+   */
+  migrationsTable?: string;
+
+  /**
+   * Paths to additional `.sql` files to apply after migrations. Each file is
+   * hashed; only files whose contents change are re-applied on later deploys.
+   */
+  importFiles?: string[];
+}
+
+/**
+ * Output attributes shared by both database engines.
+ */
+export interface BaseDatabaseAttributes {
+  /** The unique identifier of the database. */
+  id: string;
+  /** The name of the database. */
+  name: string;
+  /** The PlanetScale organization slug that owns the database. */
+  organization: string;
+  /** The current state of the database. */
+  state: string;
+  /** The default branch name. */
+  defaultBranch: string;
+  /** The plan tier (e.g. `"hobby"`, `"scaler"`). */
+  plan: string;
+  /** Time at which the database was created (ISO 8601). */
+  createdAt: string;
+  /** Time at which the database was last updated (ISO 8601). */
+  updatedAt: string;
+  /** HTML URL for accessing the database in the dashboard. */
+  htmlUrl: string;
+  /** The region of the database as reported by PlanetScale. */
+  region: DatabaseRegion;
+  /** The cluster size that was actually applied. */
+  clusterSize: string;
+  /** Directory containing migration files, if configured. */
+  migrationsDir: string | undefined;
+  /** Table used to track applied migrations, if configured. */
+  migrationsTable: string | undefined;
+  /** Content hashes for the last applied migration files. */
+  migrationsHashes: Record<string, string>;
+  /** Content hashes for the last applied import files. */
+  importHashes: Record<string, string>;
+  /**
+   * Whether deploy requests must be approved by a database administrator
+   * other than the request creator.
+   */
+  requireApprovalForDeploy: boolean;
+
+  /**
+   * Whether to limit branch creation to the same region as the one
+   * selected during database creation.
+   */
+  restrictBranchRegion: boolean;
+
+  /**
+   * Whether the web console can be used on the production branch.
+   */
+  productionBranchWebConsole: boolean;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLBranch.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLBranch.ts
new file mode 100644
index 00000000000..31707e5dd6d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLBranch.ts
@@ -0,0 +1,112 @@
+import { Resource } from "../../Resource.ts";
+import {
+  type BaseBranchAttributes,
+  type BaseBranchProps,
+  makeBranchProvider,
+} from "../Branch.ts";
+import type { Providers } from "../Providers.ts";
+import type { MySQLClusterSize } from "./MySQLClusterSize.ts";
+import { runMySQLImports, runMySQLMigrations } from "./MySQLMigrations.ts";
+import type { MySQLDatabase } from "./MySQLDatabase.ts";
+
+/**
+ * Properties for creating or updating a {@link MySQLBranch}.
+ */
+export interface MySQLBranchProps extends BaseBranchProps {
+  /**
+   * Whether the branch should be a production branch.
+   */
+  isProduction: boolean;
+
+  /**
+   * The MySQL database. Either a string database name or a
+   * {@link MySQLDatabase} resource.
+   */
+  database: string | MySQLDatabase;
+
+  /**
+   * MySQL cluster size for the branch. Required if `backupId` is provided.
+   * For non-production branches must be `"PS_DEV"`.
+   */
+  clusterSize?: MySQLClusterSize;
+
+  /**
+   * Parent branch — either a string name or another {@link MySQLBranch}.
+   * @default "main"
+   */
+  parentBranch?: string | MySQLBranch;
+}
+
+/**
+ * Output attributes of a deployed {@link MySQLBranch}.
+ */
+export interface MySQLBranchAttributes extends BaseBranchAttributes {}
+
+/**
+ * A PlanetScale branch of a {@link MySQLDatabase}. For PostgreSQL branches
+ * use {@link PostgresBranch} instead.
+ *
+ * @section Creating a Branch
+ * @example Branch from main
+ * ```typescript
+ * const branch = yield* Planetscale.MySQLBranch("Feature123", {
+ *   database: "my-db",
+ *   parentBranch: "main",
+ *   isProduction: false,
+ * });
+ * ```
+ *
+ * @example Branch from a MySQLDatabase resource
+ * ```typescript
+ * const db = yield* Planetscale.MySQLDatabase("MyDb", { clusterSize: "PS_10" });
+ * const branch = yield* Planetscale.MySQLBranch("Feature456", {
+ *   database: db,
+ *   parentBranch: "main",
+ *   isProduction: false,
+ * });
+ * ```
+ *
+ * @section Restoring from Backup
+ * @example Branch restored from a backup
+ * ```typescript
+ * const branch = yield* Planetscale.MySQLBranch("Restored", {
+ *   database: "my-db",
+ *   parentBranch: "main",
+ *   isProduction: true,
+ *   backupId: "backup-123",
+ *   clusterSize: "PS_10",
+ * });
+ * ```
+ *
+ * @section Migrations and seed data
+ * @example Apply migrations on a branch
+ * ```typescript
+ * const branch = yield* Planetscale.MySQLBranch("Feature123", {
+ *   database: db,
+ *   parentBranch: "main",
+ *   isProduction: false,
+ *   migrationsDir: "./migrations",
+ *   importFiles: ["./seed.sql"],
+ * });
+ * ```
+ */
+export type MySQLBranch = Resource<
+  "Planetscale.MySQLBranch",
+  MySQLBranchProps,
+  MySQLBranchAttributes,
+  never,
+  Providers
+>;
+
+export const MySQLBranch = Resource<MySQLBranch>("Planetscale.MySQLBranch");
+
+export const MySQLBranchProvider = () =>
+  makeBranchProvider({
+    resource: MySQLBranch,
+    expectedKind: "mysql",
+    engineLabel: "MySQLBranch",
+    runners: {
+      runMigrations: runMySQLMigrations,
+      runImports: runMySQLImports,
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLClusterSize.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLClusterSize.ts
new file mode 100644
index 00000000000..b43407e7000
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLClusterSize.ts
@@ -0,0 +1,102 @@
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import { pollUntil } from "../Util.ts";
+
+/**
+ * Available PlanetScale MySQL (Vitess) cluster sizes.
+ *
+ * `PS_*` sizes are backed by network-attached storage (NAS) and can be
+ * specified either as the short size (`"PS_10"`) or the API SKU
+ * (`"PS_10_AWS_X86"`)
+ *
+ * @see https://planetscale.com/docs/concepts/planetscale-skus
+ */
+export type MySQLClusterSize =
+  | "PS_DEV"
+  | "PS_5"
+  | "PS_10"
+  | "PS_20"
+  | "PS_40"
+  | "PS_80"
+  | "PS_160"
+  | "PS_320"
+  | "PS_400"
+  | "PS_640"
+  | "PS_700"
+  | "PS_900"
+  | "PS_1280"
+  | "PS_1400"
+  | "PS_1800"
+  | "PS_2100"
+  | "PS_2560"
+  | "PS_2700"
+  | "PS_2800"
+  | (string & {});
+
+/**
+ * Polls keyspaces in a branch until the named keyspace reports
+ * `resizing === false` (i.e. any in-flight resize has completed).
+ */
+export const waitForKeyspaceReady = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+  keyspace: string,
+) {
+  yield* pollUntil(
+    `keyspace "${keyspace}" not resizing`,
+    ops.listKeyspaces({ organization, database, branch }),
+    (page) => {
+      const ks = page.data.find((x) => x.name === keyspace);
+      // If keyspace is missing, treat as ready (caller will re-check)
+      return ks ? !ks.resizing : true;
+    },
+  );
+});
+
+/**
+ * Ensures the default keyspace of a MySQL production branch has the
+ * expected cluster size, triggering a resize if it doesn't. Cluster sizes
+ * can only be configured on production branches.
+ */
+export const ensureMySQLProductionBranchClusterSize = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+  expectedClusterSize: MySQLClusterSize,
+) {
+  const keyspaces = yield* ops.listKeyspaces({
+    organization,
+    database,
+    branch,
+    page: 1,
+    per_page: 100,
+  });
+  // Default keyspace is always the same name as the database.
+  const defaultKeyspace = keyspaces.data.find((x) => x.name === database);
+  if (!defaultKeyspace) {
+    return yield* Effect.die(`No default keyspace found for branch ${branch}`);
+  }
+
+  yield* waitForKeyspaceReady(
+    organization,
+    database,
+    branch,
+    defaultKeyspace.name,
+  );
+
+  if (defaultKeyspace.cluster_name !== expectedClusterSize) {
+    yield* ops.updateBranchClusterConfig({
+      organization,
+      database,
+      branch,
+      cluster_size: expectedClusterSize,
+    });
+    yield* waitForKeyspaceReady(
+      organization,
+      database,
+      branch,
+      defaultKeyspace.name,
+    );
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLDatabase.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLDatabase.ts
new file mode 100644
index 00000000000..605052e855d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLDatabase.ts
@@ -0,0 +1,446 @@
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { BaseDatabaseAttributes, BaseDatabaseProps } from "../Database.ts";
+import { runMySQLImports, runMySQLMigrations } from "./MySQLMigrations.ts";
+import { hashImports, hashMigrations } from "../../Sql/SqlFile.ts";
+import {
+  ensureMySQLProductionBranchClusterSize,
+  type MySQLClusterSize,
+} from "./MySQLClusterSize.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  DEFAULT_MIGRATIONS_TABLE,
+  PlanetscaleConflict,
+  recordsEqual,
+  waitForBranchReady,
+  waitForDatabaseReady,
+} from "../Util.ts";
+
+/**
+ * Properties for creating or updating a MySQL PlanetScale database.
+ */
+export interface MySQLDatabaseProps extends BaseDatabaseProps {
+  /**
+   * The MySQL database cluster size. Required.
+   * @see https://planetscale.com/docs/concepts/cluster-size
+   */
+  clusterSize: MySQLClusterSize;
+
+  /**
+   * Whether to copy migration data to new branches and in deploy requests.
+   */
+  automaticMigrations?: boolean;
+
+  /**
+   * Migration framework to use on the database.
+   */
+  migrationFramework?: string;
+
+  /**
+   * Name of the migration table.
+   */
+  migrationTableName?: string;
+
+  /**
+   * Whether data branching is allowed on the database.
+   */
+  allowDataBranching?: boolean;
+
+  /**
+   * Whether foreign key constraints are allowed on the database.
+   */
+  allowForeignKeyConstraints?: boolean;
+
+  /**
+   * Whether full queries should be collected from the database.
+   */
+  insightsRawQueries?: boolean;
+}
+
+/**
+ * Output attributes of a deployed MySQL PlanetScale database.
+ */
+export interface MySQLDatabaseAttributes extends BaseDatabaseAttributes {
+  /** Engine kind discriminator. */
+  kind: "mysql";
+
+  /**
+   * Whether to copy migration data to new branches and in deploy requests.
+   */
+  automaticMigrations: boolean;
+
+  /**
+   * Migration framework to use on the database.
+   */
+  migrationFramework?: string;
+
+  /**
+   * Name of the migration table.
+   */
+  migrationTableName?: string;
+
+  /**
+   * Whether data branching is allowed on the database.
+   */
+  allowDataBranching: boolean;
+
+  /**
+   * Whether foreign key constraints are allowed on the database.
+   */
+  allowForeignKeyConstraints: boolean;
+
+  /**
+   * Whether full queries should be collected from the database.
+   */
+  insightsRawQueries: boolean;
+}
+
+/**
+ * A MySQL PlanetScale database (powered by Vitess). For PostgreSQL use
+ * {@link PostgresDatabase} instead.
+ *
+ * @section Creating a MySQL Database
+ * @example Basic MySQL database
+ * ```typescript
+ * const db = yield* Planetscale.MySQLDatabase("MyDb", {
+ *   clusterSize: "PS_10",
+ * });
+ * ```
+ *
+ * @example MySQL with Vitess migration tooling
+ * ```typescript
+ * const db = yield* Planetscale.MySQLDatabase("MyDb", {
+ *   clusterSize: "PS_10",
+ *   automaticMigrations: true,
+ *   migrationFramework: "rails",
+ *   migrationTableName: "schema_migrations",
+ *   allowDataBranching: true,
+ * });
+ * ```
+ *
+ * @section Migrations and seed data
+ * @example Apply migrations and seed files
+ * ```typescript
+ * const db = yield* Planetscale.MySQLDatabase("MyDb", {
+ *   clusterSize: "PS_10",
+ *   migrationsDir: "./migrations/mysql",
+ *   importFiles: ["./seed/mysql.sql"],
+ * });
+ * ```
+ *
+ * @section Adoption
+ * @example Adopting an existing database
+ * ```typescript
+ * import { adopt } from "alchemy/AdoptPolicy";
+ *
+ * const db = yield* Planetscale.MySQLDatabase("Existing", {
+ *   name: "existing-db",
+ *   clusterSize: "PS_10",
+ * }).pipe(adopt());
+ * ```
+ */
+export type MySQLDatabase = Resource<
+  "Planetscale.MySQLDatabase",
+  MySQLDatabaseProps,
+  MySQLDatabaseAttributes,
+  never,
+  Providers
+>;
+
+export const MySQLDatabase = Resource<MySQLDatabase>(
+  "Planetscale.MySQLDatabase",
+);
+
+const createDatabaseName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return (
+      name ??
+      (yield* createPhysicalName({ id, lowercase: true, maxLength: 63 }))
+    );
+  });
+
+export const MySQLDatabaseProvider = () =>
+  Provider.effect(
+    MySQLDatabase,
+    Effect.gen(function* () {
+      const rootDir = yield* Effect.sync(() => process.cwd());
+      const createDb = yield* ops.createDatabase;
+      const getDb = yield* ops.getDatabase;
+      const updateSettings = yield* ops.updateDatabaseSettings;
+      const deleteDb = yield* ops.deleteDatabase;
+      const getBr = yield* ops.getBranch;
+      const createBr = yield* ops.createBranch;
+
+      return {
+        stables: ["id", "organization", "kind", "region"],
+
+        diff: Effect.fn(function* ({ news, olds, output }) {
+          if (!isResolved(news)) return undefined;
+
+          if (
+            news.region?.slug !== undefined &&
+            output?.region?.slug !== undefined &&
+            news.region.slug !== output.region.slug
+          ) {
+            return { action: "replace" } as const;
+          }
+          if (news.replicas !== olds.replicas) {
+            return { action: "replace" } as const;
+          }
+          if (news.migrationsDir) {
+            const newHashes = yield* hashMigrations(news.migrationsDir);
+            if (!recordsEqual(newHashes, output?.migrationsHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+            if (
+              (news.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE) !==
+              (output?.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE)
+            ) {
+              return { action: "update" } as const;
+            }
+          }
+          if (news.importFiles?.length) {
+            const newHashes = yield* hashImports(news.importFiles, rootDir);
+            if (!recordsEqual(newHashes, output?.importHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+          }
+          // Otherwise allow the engine to apply the default update logic.
+          return undefined;
+        }),
+
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const { organization } = yield* Credentials;
+          const databaseName =
+            output?.name ?? (yield* createDatabaseName(id, olds?.name));
+          return yield* getDb({
+            organization,
+            database: databaseName,
+          }).pipe(
+            Effect.flatMap((data) => {
+              if (data.kind !== "mysql") {
+                return Effect.fail(
+                  new PlanetscaleConflict({
+                    message:
+                      `Planetscale database "${data.name}" has kind "${data.kind}" but this resource ` +
+                      `is a MySQLDatabase. Use Planetscale.${data.kind === "postgresql" ? "PostgresDatabase" : data.kind}() instead, ` +
+                      `or delete the existing database and retry.`,
+                  }),
+                );
+              }
+              return Effect.succeed({
+                id: data.id,
+                name: data.name,
+                organization,
+                state: data.state,
+                defaultBranch: data.default_branch ?? "main",
+                plan: data.plan ?? "hobby",
+                createdAt: data.created_at,
+                updatedAt: data.updated_at,
+                htmlUrl: data.html_url,
+                region: { slug: data.region.slug },
+                migrationsDir: output?.migrationsDir ?? olds?.migrationsDir,
+                migrationsTable:
+                  output?.migrationsTable ?? olds?.migrationsTable,
+                migrationsHashes: output?.migrationsHashes ?? {},
+                importHashes: output?.importHashes ?? {},
+                kind: "mysql" as const,
+                clusterSize: output?.clusterSize ?? "",
+                requireApprovalForDeploy:
+                  data.require_approval_for_deploy ?? false,
+                restrictBranchRegion: data.restrict_branch_region ?? false,
+                insightsRawQueries: data.insights_raw_queries ?? false,
+                productionBranchWebConsole:
+                  data.production_branch_web_console ?? false,
+                automaticMigrations: data.automatic_migrations ?? false,
+                migrationFramework: data.migration_framework ?? undefined,
+                migrationTableName: data.migration_table_name ?? undefined,
+                allowDataBranching: data.allow_data_branching ?? false,
+                allowForeignKeyConstraints: data.foreign_keys_enabled ?? false,
+              });
+            }),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const { organization } = yield* Credentials;
+          const newName = yield* createDatabaseName(id, news.name);
+          const clusterSize = news.clusterSize;
+
+          // Observe — read live state under either the cached name (rename
+          // / refresh) or the freshly-derived name (greenfield). Observing
+          // unconditionally absorbs the race between `read` and `reconcile`
+          // — if a foreign actor (or a previously-failed-to-persist
+          // create) produced a database under the desired name in the
+          // meantime, we'll find it here and skip the duplicate create.
+          // Adoption routing has already been gated by `read` returning
+          // `Unowned`, so by the time we reach reconcile any observed
+          // database is fair game.
+          const observedName = output?.name ?? newName;
+          let observed = yield* getDb({
+            organization,
+            database: observedName,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+          // Ensure — if missing, create.
+          if (!observed) {
+            yield* session.note("Creating database...");
+            observed = yield* createDb({
+              organization,
+              name: newName,
+              region: news.region?.slug,
+              kind: "mysql",
+              cluster_size: clusterSize,
+              replicas: news.replicas,
+            });
+          }
+
+          // Wait for the database to finish provisioning before any
+          // downstream sync runs. PlanetScale reports `state: "pending"`
+          // for a while after createDatabase returns, during which branch
+          // operations on this database (including our own settings PATCH)
+          // race against the provisioning fiber.
+          yield* waitForDatabaseReady(organization, observed.name, session);
+
+          if (observed.kind !== "mysql") {
+            return yield* Effect.fail(
+              new PlanetscaleConflict({
+                message:
+                  `Planetscale database "${observed.name}" has kind "${observed.kind}" but this resource ` +
+                  `is a MySQLDatabase. Use Planetscale.${observed.kind === "postgresql" ? "PostgresDatabase" : observed.kind}() instead, ` +
+                  `or delete the existing database and retry.`,
+              }),
+            );
+          }
+
+          // Sync — ensure a non-`main` default branch exists before
+          // referencing it via `default_branch`. The branch is created
+          // empty (no cluster size yet); we'll size it below.
+          if (news.defaultBranch && news.defaultBranch !== "main") {
+            yield* waitForDatabaseReady(organization, observed.name, session);
+            const branchExists = yield* getBr({
+              organization,
+              database: observed.name,
+              branch: news.defaultBranch,
+            }).pipe(
+              Effect.map(() => true),
+              Effect.catchTag("NotFound", () => Effect.succeed(false)),
+            );
+            if (!branchExists) {
+              yield* createBr({
+                organization,
+                database: observed.name,
+                name: news.defaultBranch,
+                parent_branch: "main",
+                // create branch with cluster size to skip resizing when promoting the branch
+                cluster_size: clusterSize,
+              });
+            }
+          }
+
+          // Sync settings — `updateSettings` is upsert-shaped, so we can
+          // call it with the full desired payload on every reconcile.
+          const updated = yield* updateSettings({
+            organization,
+            database: observed.name,
+            new_name: newName !== observed.name ? newName : undefined,
+            automatic_migrations: news.automaticMigrations,
+            migration_framework: news.migrationFramework,
+            migration_table_name: news.migrationTableName,
+            allow_foreign_key_constraints: news.allowForeignKeyConstraints,
+            allow_data_branching: news.allowDataBranching,
+            require_approval_for_deploy: news.requireApprovalForDeploy,
+            restrict_branch_region: news.restrictBranchRegion,
+            insights_raw_queries: news.insightsRawQueries,
+            production_branch_web_console: news.productionBranchWebConsole,
+            default_branch: news.defaultBranch,
+          });
+
+          // Sync cluster size on the active default branch.
+          const branch = news.defaultBranch ?? updated.default_branch ?? "main";
+          yield* ensureMySQLProductionBranchClusterSize(
+            organization,
+            updated.name,
+            branch,
+            news.clusterSize,
+          );
+
+          const migrationTarget = {
+            organization,
+            database: updated.name,
+            branch,
+          };
+          if (news.migrationsDir || news.importFiles?.length) {
+            yield* waitForBranchReady(
+              organization,
+              updated.name,
+              branch,
+              session,
+            );
+          }
+          const migrationsTable =
+            news.migrationsTable ??
+            output?.migrationsTable ??
+            DEFAULT_MIGRATIONS_TABLE;
+          const migrationsHashes = news.migrationsDir
+            ? yield* runMySQLMigrations(
+                migrationTarget,
+                news.migrationsDir,
+                migrationsTable,
+              )
+            : (output?.migrationsHashes ?? {});
+          const importHashes = news.importFiles?.length
+            ? yield* runMySQLImports(
+                migrationTarget,
+                news.importFiles,
+                rootDir,
+                output?.importHashes ?? {},
+              )
+            : {};
+
+          return {
+            id: updated.id,
+            name: updated.name,
+            organization,
+            state: updated.state,
+            defaultBranch: updated.default_branch ?? branch,
+            plan: updated.plan ?? output?.plan ?? "hobby",
+            createdAt: updated.created_at,
+            updatedAt: updated.updated_at,
+            htmlUrl: updated.html_url,
+            region: { slug: updated.region.slug },
+            kind: "mysql" as const,
+            clusterSize,
+            migrationsDir: news.migrationsDir,
+            migrationsTable: news.migrationsDir ? migrationsTable : undefined,
+            migrationsHashes,
+            importHashes,
+            requireApprovalForDeploy:
+              updated.require_approval_for_deploy ?? false,
+            restrictBranchRegion: updated.restrict_branch_region ?? false,
+            insightsRawQueries: updated.insights_raw_queries ?? false,
+            productionBranchWebConsole:
+              updated.production_branch_web_console ?? false,
+            automaticMigrations: updated.automatic_migrations ?? false,
+            migrationFramework: updated.migration_framework ?? undefined,
+            migrationTableName: updated.migration_table_name ?? undefined,
+            allowDataBranching: updated.allow_data_branching ?? false,
+            allowForeignKeyConstraints: updated.foreign_keys_enabled ?? false,
+          } satisfies MySQLDatabaseAttributes;
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteDb({
+            organization: output.organization,
+            database: output.name,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLMigrations.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLMigrations.ts
new file mode 100644
index 00000000000..f1448f0d822
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLMigrations.ts
@@ -0,0 +1,271 @@
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { createConnection, type Connection } from "mysql2/promise";
+import { listSqlFiles, readSqlFile, type SqlFile } from "../../Sql/SqlFile.ts";
+
+const MIGRATION_PASSWORD_TTL_SECONDS = 600;
+
+export class MySQLMigrationError extends Data.TaggedError(
+  "Planetscale::MySQLMigrationError",
+)<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+export interface MySQLMigrationTarget {
+  organization: string;
+  database: string;
+  branch: string;
+}
+
+export const runMySQLMigrations = (
+  target: MySQLMigrationTarget,
+  migrationsDir: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const files = yield* listSqlFiles(migrationsDir);
+    if (files.length > 0) {
+      yield* applyMySQLMigrations({
+        target,
+        migrationsTable,
+        migrationsFiles: files,
+      });
+    }
+    const hashes: Record<string, string> = {};
+    for (const file of files) hashes[file.id] = file.hash;
+    return hashes;
+  });
+
+export const runMySQLImports = (
+  target: MySQLMigrationTarget,
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+  previous: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = { ...previous };
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      if (previous[filePath] === file.hash) {
+        hashes[filePath] = file.hash;
+        continue;
+      }
+      yield* runMySQLSql(target, file.sql);
+      hashes[filePath] = file.hash;
+    }
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+      if (!tracked.has(key)) delete hashes[key];
+    }
+    return hashes;
+  });
+
+interface ApplyMigrationsOptions {
+  target: MySQLMigrationTarget;
+  migrationsTable: string;
+  migrationsFiles: ReadonlyArray<SqlFile>;
+}
+
+const applyMySQLMigrations = (options: ApplyMigrationsOptions) =>
+  withMySQLConnection(options.target, (connection) =>
+    Effect.gen(function* () {
+      const table = quoteMySQLIdentifier(options.migrationsTable);
+      yield* mysqlQuery(
+        connection,
+        `CREATE TABLE IF NOT EXISTS ${table} (
+           id varchar(255) NOT NULL PRIMARY KEY,
+           name varchar(1024) NOT NULL,
+           applied_at timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP
+         );`,
+      );
+
+      const applied = yield* mysqlQueryRows<{ name: string }>(
+        connection,
+        `SELECT name FROM ${table};`,
+      ).pipe(Effect.map((rows) => new Set(rows.map((row) => row.name))));
+      let nextSeq = yield* getNextMySQLSeq(connection, table);
+
+      for (const file of options.migrationsFiles) {
+        if (applied.has(file.id)) continue;
+        const migrationId = nextSeq.toString().padStart(5, "0");
+        nextSeq += 1;
+        yield* Effect.gen(function* () {
+          yield* mysqlQuery(connection, "START TRANSACTION");
+          for (const statement of splitMySQLStatements(file.sql)) {
+            yield* mysqlQuery(connection, statement);
+          }
+          yield* mysqlExecute(
+            connection,
+            `INSERT INTO ${table} (id, name) VALUES (?, ?);`,
+            [migrationId, file.id],
+          );
+          yield* mysqlQuery(connection, "COMMIT");
+        }).pipe(
+          Effect.catch((error) =>
+            mysqlQuery(connection, "ROLLBACK").pipe(
+              Effect.catch(() => Effect.void),
+              Effect.andThen(Effect.fail(error)),
+            ),
+          ),
+        );
+      }
+    }),
+  );
+
+const runMySQLSql = (target: MySQLMigrationTarget, sql: string) =>
+  withMySQLConnection(target, (connection) =>
+    Effect.gen(function* () {
+      for (const statement of splitMySQLStatements(sql)) {
+        yield* mysqlQuery(connection, statement);
+      }
+    }),
+  );
+
+// Drizzle (and other migration tools) emit `--> statement-breakpoint` as a
+// separator between statements. PlanetScale's Vitess parser rejects the `-->`
+// token ("syntax error at position 2") because MySQL line comments require
+// whitespace after `--`. Split on the marker and run each statement
+// individually so the connector never sees the breakpoint comment.
+const STATEMENT_BREAKPOINT = /\r?\n\s*-->\s*statement-breakpoint\s*\r?\n?/g;
+
+const splitMySQLStatements = (sql: string): string[] =>
+  sql
+    .split(STATEMENT_BREAKPOINT)
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+
+const getNextMySQLSeq = (connection: Connection, table: string) =>
+  mysqlQueryRows<{ id: string }>(connection, `SELECT id FROM ${table};`).pipe(
+    Effect.map((rows) => {
+      let max = 0;
+      for (const { id } of rows) {
+        if (/^\d+$/.test(String(id))) {
+          max = Math.max(max, Number.parseInt(String(id), 10));
+        }
+      }
+      return max + 1;
+    }),
+  );
+
+const withMySQLConnection = <A, E, R>(
+  target: MySQLMigrationTarget,
+  use: (connection: Connection) => Effect.Effect<A, E, R>,
+) =>
+  withTemporaryMySQLPassword(target, (password) =>
+    Effect.acquireUseRelease(
+      Effect.tryPromise({
+        try: () =>
+          createConnection({
+            host: password.host,
+            user: password.username,
+            password: Redacted.value(password.password),
+            database: target.database,
+            multipleStatements: true,
+            ssl: { rejectUnauthorized: true },
+          }),
+        catch: toMigrationError,
+      }),
+      use,
+      (connection) =>
+        Effect.tryPromise({
+          try: () => connection.end(),
+          catch: toMigrationError,
+        }).pipe(Effect.catch(() => Effect.void)),
+    ),
+  );
+
+const withTemporaryMySQLPassword = <A, E, R>(
+  target: MySQLMigrationTarget,
+  use: (password: {
+    id: string;
+    host: string;
+    username: string;
+    password: Redacted.Redacted<string>;
+  }) => Effect.Effect<A, E, R>,
+) =>
+  Effect.acquireUseRelease(
+    Effect.gen(function* () {
+      const created = yield* ops.createPassword({
+        organization: target.organization,
+        database: target.database,
+        branch: target.branch,
+        role: "admin",
+        ttl: MIGRATION_PASSWORD_TTL_SECONDS,
+      });
+
+      return {
+        id: created.id,
+        host: created.access_host_url,
+        username: created.username,
+        password: created.plain_text,
+      };
+    }),
+    use,
+    (password) =>
+      ops
+        .deletePassword({
+          organization: target.organization,
+          database: target.database,
+          branch: target.branch,
+          id: password.id,
+        })
+        .pipe(
+          // Already-deleted passwords are a success: nothing to clean up.
+          Effect.catchTag("NotFound", () => Effect.void),
+          Effect.retry({
+            schedule: Schedule.exponential("500 millis").pipe(
+              Schedule.both(Schedule.recurs(5)),
+            ),
+          }),
+          // Migrations succeeded; don't fail the parent over a release-step
+          // hiccup. The password's TTL bounds the orphan window; log loudly
+          // so an operator can clean it up manually if needed.
+          Effect.catch((cause: unknown) =>
+            Effect.logWarning(
+              `Failed to delete temporary Planetscale migration password after retries. ` +
+                `It will expire via TTL (~${MIGRATION_PASSWORD_TTL_SECONDS}s). ` +
+                `organization=${target.organization} database=${target.database} ` +
+                `branch=${target.branch} id=${password.id}`,
+              cause,
+            ),
+          ),
+        ),
+  );
+
+const mysqlQuery = (connection: Connection, sql: string) =>
+  Effect.tryPromise({
+    try: () => connection.query(sql).then(() => undefined),
+    catch: toMigrationError,
+  });
+
+const mysqlExecute = (
+  connection: Connection,
+  sql: string,
+  values?: ReadonlyArray<string>,
+) =>
+  Effect.tryPromise({
+    try: () =>
+      connection
+        .execute(sql, values ? [...values] : undefined)
+        .then(() => undefined),
+    catch: toMigrationError,
+  });
+
+const mysqlQueryRows = <A>(connection: Connection, sql: string) =>
+  Effect.tryPromise({
+    try: () => connection.query(sql).then(([rows]) => rows as A[]),
+    catch: toMigrationError,
+  });
+
+const toMigrationError = (cause: unknown) =>
+  new MySQLMigrationError({
+    message: cause instanceof Error ? cause.message : String(cause),
+    cause,
+  });
+
+const quoteMySQLIdentifier = (identifier: string) =>
+  `\`${identifier.replaceAll("`", "``")}\``;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLOrigin.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLOrigin.ts
new file mode 100644
index 00000000000..46787e499e7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLOrigin.ts
@@ -0,0 +1,15 @@
+import * as Redacted from "effect/Redacted";
+
+/**
+ * The shape `Cloudflare.Hyperdrive` and other MySQL consumers accept as an
+ * origin. Materialized on `Planetscale.MySQLPassword` so callers can wire
+ * password credentials into Hyperdrive directly.
+ */
+export type MySQLOrigin = {
+  scheme: "mysql";
+  host: string;
+  port: number;
+  database: string;
+  user: string;
+  password: Redacted.Redacted<string>;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLPassword.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLPassword.ts
new file mode 100644
index 00000000000..320ec268fee
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/MySQLPassword.ts
@@ -0,0 +1,387 @@
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import type { MySQLBranch } from "./MySQLBranch.ts";
+import type { MySQLDatabase } from "./MySQLDatabase.ts";
+import type { MySQLOrigin } from "./MySQLOrigin.ts";
+
+/**
+ * Properties for creating or updating a PlanetScale MySQL password.
+ *
+ * Passwords are only meant for MySQL databases. For PostgreSQL,
+ * use {@link PostgresRole} instead.
+ */
+export interface MySQLPasswordProps {
+  /**
+   * Password name. If omitted, a unique name is generated from
+   * `${app}-${stage}-${id}`.
+   */
+  name?: string;
+
+  /**
+   * MySQL database — string name or {@link MySQLDatabase} resource.
+   */
+  database: string | MySQLDatabase;
+
+  /**
+   * Branch — string name or {@link MySQLBranch} resource.
+   * @default "main"
+   */
+  branch?: string | MySQLBranch;
+
+  /**
+   * The MySQL role granted to the password.
+   */
+  role: "reader" | "writer" | "admin" | "readwriter";
+
+  /**
+   * Whether the password is for a read replica.
+   */
+  replica?: boolean;
+
+  /**
+   * Time to live (seconds). The password is invalidated after this period.
+   */
+  ttl?: number;
+
+  /**
+   * IP CIDR ranges allowed to use this password.
+   */
+  cidrs?: string[];
+}
+
+/**
+ * Output attributes of a deployed PlanetScale password.
+ */
+export interface MySQLPasswordAttributes {
+  /** Unique identifier for the password (stable). */
+  id: string;
+  /** Password name. If omitted, a unique name is generated from `${app}-${stage}-${id}`. */
+  name: string;
+  /** ISO 8601 timestamp at which the password expires. `null` if no TTL. */
+  expiresAt: string | null;
+  /** Hostname for the database connection. */
+  host: string;
+  /** Username for database authentication. */
+  username: string;
+  /** Password for database authentication (Redacted). */
+  password: Redacted.Redacted<string>;
+  /** Parsed connection components ready to feed into Cloudflare Hyperdrive. */
+  origin: MySQLOrigin;
+  /** Resolved organization slug. */
+  organization: string;
+  /** Resolved database name. */
+  database: string;
+  /** Resolved branch name. */
+  branch: string;
+  /** The role granted. */
+  role: "reader" | "writer" | "admin" | "readwriter";
+  /** Whether this password is for a read replica. */
+  replica: boolean | undefined;
+  /** TTL in seconds (if set). */
+  ttl: number | undefined;
+  /** IP CIDR ranges allowed to use this password. */
+  cidrs: readonly string[] | undefined;
+}
+
+/**
+ * A PlanetScale password for accessing a MySQL database branch.
+ *
+ * For PostgreSQL databases, use {@link PostgresRole} instead.
+ *
+ * @section Creating a Password
+ * @example Reader password
+ * ```typescript
+ * const reader = yield* Planetscale.MySQLPassword("AppReader", {
+ *   database: "my-db",
+ *   role: "reader",
+ * });
+ * ```
+ *
+ * @example Writer password with TTL
+ * ```typescript
+ * const writer = yield* Planetscale.MySQLPassword("AppWriter", {
+ *   database: "my-db",
+ *   role: "writer",
+ *   ttl: 86400,
+ * });
+ * ```
+ *
+ * @example Admin password with IP allowlist
+ * ```typescript
+ * const admin = yield* Planetscale.MySQLPassword("Admin", {
+ *   database: "my-db",
+ *   role: "admin",
+ *   cidrs: ["203.0.113.0/24", "198.51.100.0/24"],
+ * });
+ * ```
+ */
+export type MySQLPassword = Resource<
+  "Planetscale.MySQLPassword",
+  MySQLPasswordProps,
+  MySQLPasswordAttributes,
+  never,
+  Providers
+>;
+
+export const MySQLPassword = Resource<MySQLPassword>(
+  "Planetscale.MySQLPassword",
+);
+
+// At runtime, Resource references in props are resolved to their full
+// attributes — so `news.database` (when a Database resource was passed)
+// is `{ name: string; organization: string; ... }` rather than the
+// statically-typed Resource (whose attributes are `Output<...>`). We
+// cast through structural shapes here.
+type DatabaseRef = string | { name: string; organization?: string };
+type BranchRef = string | { name: string };
+
+const resolveDatabaseName = (database: string | MySQLDatabase): string => {
+  const ref = database as unknown as DatabaseRef;
+  return typeof ref === "string" ? ref : ref.name;
+};
+
+const resolveDatabaseOrg = (
+  database: string | MySQLDatabase,
+): string | undefined => {
+  const ref = database as unknown as DatabaseRef;
+  return typeof ref === "string" ? undefined : ref.organization;
+};
+
+const resolveBranchName = (
+  branch: string | MySQLBranch | undefined,
+): string => {
+  const ref = branch as unknown as BranchRef | undefined;
+  return !ref ? "main" : typeof ref === "string" ? ref : ref.name;
+};
+
+const createPasswordName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return (
+      name ??
+      (yield* createPhysicalName({ id, lowercase: true, maxLength: 63 }))
+    );
+  });
+
+// Normalize the API's nullable `cidrs` field into the `string[] | undefined`
+// shape we persist so downstream comparisons line up regardless of the
+// API returning `null` vs `[]` vs an actual list.
+const normalizeCidrs = (
+  cidrs: readonly string[] | null | undefined,
+): readonly string[] | undefined =>
+  cidrs == null || cidrs.length === 0 ? undefined : cidrs;
+
+const buildAttributes = (
+  password: {
+    id: string;
+    name: string;
+    expires_at: string | null;
+    access_host_url: string;
+    username: string;
+    role: "reader" | "writer" | "admin" | "readwriter";
+    replica: boolean;
+    ttl_seconds: number | null;
+    cidrs: readonly string[] | null;
+  },
+  plaintext: Redacted.Redacted<string>,
+  context: {
+    organization: string;
+    database: string;
+    branch: string;
+  },
+): MySQLPasswordAttributes => ({
+  id: password.id,
+  name: password.name,
+  expiresAt: password.expires_at,
+  host: password.access_host_url,
+  username: password.username,
+  password: plaintext,
+  origin: {
+    scheme: "mysql",
+    host: password.access_host_url,
+    port: 3306,
+    database: context.database,
+    user: password.username,
+    password: plaintext,
+  },
+  organization: context.organization,
+  database: context.database,
+  branch: context.branch,
+  role: password.role,
+  replica: password.replica,
+  ttl: password.ttl_seconds ?? undefined,
+  cidrs: normalizeCidrs(password.cidrs),
+});
+
+export const MySQLPasswordProvider = () =>
+  Provider.effect(
+    MySQLPassword,
+    Effect.gen(function* () {
+      const createPwd = yield* ops.createPassword;
+      const getPwd = yield* ops.getPassword;
+      const updatePwd = yield* ops.updatePassword;
+      const deletePwd = yield* ops.deletePassword;
+
+      return {
+        stables: ["id"],
+
+        diff: Effect.fn(function* ({ olds = {}, news }) {
+          if (!isResolved(news)) return undefined;
+
+          // Replace on any immutable-in-place change; engine falls through
+          // to reconcile for everything else (which authoritatively diffs
+          // against observed cloud state).
+          if (news.role !== olds.role) return { action: "replace" } as const;
+          if (news.replica !== olds.replica) {
+            return { action: "replace" } as const;
+          }
+          if (news.ttl !== olds.ttl) return { action: "replace" } as const;
+
+          const newDb = resolveDatabaseName(news.database);
+          const oldDb = olds.database
+            ? resolveDatabaseName(olds.database)
+            : undefined;
+          if (oldDb && newDb !== oldDb) {
+            return { action: "replace" } as const;
+          }
+          const newBranch = resolveBranchName(news.branch);
+          const oldBranch = resolveBranchName(olds.branch);
+          if (newBranch !== oldBranch) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+
+        read: Effect.fn(function* ({ output }) {
+          // Adoption (no cached output) is impossible: the PlanetScale API
+          // never re-issues plaintext, so even if we found a matching live
+          // password by listing+name we couldn't deliver the `password`
+          // attribute. Fall through to greenfield create in `reconcile`.
+          if (!output) return undefined;
+
+          // Refresh — verify the cached password still exists and
+          // re-emit the persisted output (with plaintext intact).
+          // If it's gone, return undefined so the engine routes to
+          // reconcile, which will surface the unrecoverable-rotation
+          // condition explicitly.
+          return yield* getPwd({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+            id: output.id,
+          }).pipe(
+            Effect.map((password) =>
+              buildAttributes(password, output.password, {
+                organization: output.organization,
+                database: output.database,
+                branch: output.branch,
+              }),
+            ),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const newName = yield* createPasswordName(id, news.name);
+
+          // Identifiers — stable across update (diff replaces on
+          // database/branch changes), so we can pull from `output` first
+          // and fall back to `news` for greenfield.
+          const { organization: envOrg } = yield* Credentials;
+          const organization =
+            output?.organization ?? resolveDatabaseOrg(news.database) ?? envOrg;
+          const databaseName =
+            output?.database ?? resolveDatabaseName(news.database);
+          const branchName = output?.branch ?? resolveBranchName(news.branch);
+
+          // 1. Observe — read live state. The PlanetScale API has no
+          //    "lookup by name" path (names aren't unique within a branch)
+          //    so the only way to find the live password is by id. Without
+          //    a cached output we cannot observe and fall straight through
+          //    to ensure (greenfield create).
+          const observed = output
+            ? yield* getPwd({
+                organization,
+                database: databaseName,
+                branch: branchName,
+                id: output.id,
+              }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // 2. Ensure — create the password if it doesn't exist live.
+          //    This single branch covers greenfield (no output) AND the
+          //    out-of-band-deletion case (output cached but cloud lost it).
+          //    The latter is structurally a rotation: the new password
+          //    has a fresh id/host/username/plaintext that propagate
+          //    downstream through the dependency graph. There is no path
+          //    to recover the original plaintext, so recreating is the
+          //    only way to converge.
+          let live: ops.GetPasswordOutput;
+          let plaintext: Redacted.Redacted<string>;
+          if (observed) {
+            live = observed;
+            // We re-use the cached plaintext: the API never re-issues it.
+            plaintext = output!.password;
+          } else {
+            const created = yield* createPwd({
+              organization,
+              database: databaseName,
+              branch: branchName,
+              name: newName,
+              role: news.role,
+              replica: news.replica,
+              ttl: news.ttl,
+              cidrs: news.cidrs,
+            });
+            plaintext = created.plain_text;
+            live = created;
+          }
+
+          // 3. Sync — diff observed cloud state against desired and patch
+          //    only what changed. Only `name` and `cidrs` are mutable in
+          //    place; everything else triggers a replace via diff().
+          //    Skip the API entirely when there's no delta.
+          const wantsRename = newName !== live.name;
+          const observedCidrs = normalizeCidrs(live.cidrs);
+          const desiredCidrs = normalizeCidrs(news.cidrs);
+          const wantsCidrs = !deepEqual(desiredCidrs, observedCidrs);
+
+          if (wantsRename || wantsCidrs) {
+            live = yield* updatePwd({
+              organization,
+              database: databaseName,
+              branch: branchName,
+              id: live.id,
+              name: wantsRename ? newName : undefined,
+              cidrs: wantsCidrs ? news.cidrs : undefined,
+            });
+          }
+
+          // 4. Return — fresh attrs sourced from observed cloud state,
+          //    re-using cached plaintext when we didn't just create.
+          return buildAttributes(live, plaintext, {
+            organization,
+            database: databaseName,
+            branch: branchName,
+          });
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          yield* deletePwd({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+            id: output.id,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/index.ts
new file mode 100644
index 00000000000..f25fcc0c930
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/MySQL/index.ts
@@ -0,0 +1,5 @@
+export * from "./MySQLClusterSize.ts";
+export * from "./MySQLBranch.ts";
+export * from "./MySQLDatabase.ts";
+export * from "./MySQLOrigin.ts";
+export * from "./MySQLPassword.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresBranch.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresBranch.ts
new file mode 100644
index 00000000000..558520b6787
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresBranch.ts
@@ -0,0 +1,97 @@
+import { Resource } from "../../Resource.ts";
+import {
+  type BaseBranchAttributes,
+  type BaseBranchProps,
+  makeBranchProvider,
+} from "../Branch.ts";
+import type { Providers } from "../Providers.ts";
+import type { PostgresClusterSize } from "./PostgresClusterSize.ts";
+import type { PostgresDatabase } from "./PostgresDatabase.ts";
+import {
+  runPostgresImports,
+  runPostgresMigrations,
+} from "./PostgresMigrations.ts";
+
+/**
+ * Properties for creating or updating a {@link PostgresBranch}.
+ */
+export interface PostgresBranchProps extends BaseBranchProps {
+  /**
+   * The Postgres database. Either a string database name or a
+   * {@link PostgresDatabase} resource.
+   */
+  database: string | PostgresDatabase;
+
+  /**
+   * PostgreSQL cluster size for the branch. Required if `backupId` is provided.
+   * Short sizes are expanded using the target branch region.
+   */
+  clusterSize?: PostgresClusterSize;
+
+  /**
+   * Parent branch — either a string name or another {@link PostgresBranch}.
+   * @default "main"
+   */
+  parentBranch?: string | PostgresBranch;
+}
+
+/**
+ * Output attributes of a deployed {@link PostgresBranch}.
+ */
+export interface PostgresBranchAttributes extends BaseBranchAttributes {}
+
+/**
+ * A PlanetScale branch of a {@link PostgresDatabase}. For MySQL branches
+ * use {@link MySQLBranch} instead.
+ *
+ * @section Creating a Branch
+ * @example Branch from main
+ * ```typescript
+ * const branch = yield* Planetscale.PostgresBranch("Feature123", {
+ *   database: "my-db",
+ *   parentBranch: "main",
+ * });
+ * ```
+ *
+ * @example Branch from a PostgresDatabase resource
+ * ```typescript
+ * const db = yield* Planetscale.PostgresDatabase("MyDb", { clusterSize: "PS_10" });
+ * const branch = yield* Planetscale.PostgresBranch("Feature456", {
+ *   database: db,
+ *   parentBranch: "main",
+ * });
+ * ```
+ *
+ * @section Migrations and seed data
+ * @example Apply migrations on a branch
+ * ```typescript
+ * const branch = yield* Planetscale.PostgresBranch("Feature123", {
+ *   database: db,
+ *   parentBranch: "main",
+ *   migrationsDir: "./migrations",
+ *   importFiles: ["./seed.sql"],
+ * });
+ * ```
+ */
+export type PostgresBranch = Resource<
+  "Planetscale.PostgresBranch",
+  PostgresBranchProps,
+  PostgresBranchAttributes,
+  never,
+  Providers
+>;
+
+export const PostgresBranch = Resource<PostgresBranch>(
+  "Planetscale.PostgresBranch",
+);
+
+export const PostgresBranchProvider = () =>
+  makeBranchProvider({
+    resource: PostgresBranch,
+    expectedKind: "postgresql",
+    engineLabel: "PostgresBranch",
+    runners: {
+      runMigrations: runPostgresMigrations,
+      runImports: runPostgresImports,
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresClusterSize.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresClusterSize.ts
new file mode 100644
index 00000000000..e4268303156
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresClusterSize.ts
@@ -0,0 +1,125 @@
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import { pollUntil } from "../Util.ts";
+
+/**
+ * Available PlanetScale PostgreSQL cluster sizes.
+ *
+ * `PS_*` sizes are backed by network-attached storage (NAS) and can be
+ * specified either as the short size (`"PS_10"`) or the API SKU
+ * (`"PS_10_AWS_X86"`). Short NAS sizes are expanded to a SKU by
+ * {@link toPostgresClusterSku} using the target region and arch.
+ *
+ * @see https://planetscale.com/docs/postgres/pricing
+ */
+export type PostgresClusterSize =
+  | "PS_DEV"
+  | "PS_5"
+  | "PS_10"
+  | "PS_20"
+  | "PS_40"
+  | "PS_80"
+  | "PS_160"
+  | "PS_320"
+  | "PS_640"
+  | "PS_1280"
+  | "PS_2560"
+  | (string & {});
+
+/**
+ * Converts a {@link PostgresClusterSize} into the SKU string expected by
+ * the PlanetScale API.
+ *
+ * For NAS-backed clusters, the API expects a suffixed name like
+ * `PS_<size>_<provider>_<arch>`. Short `PS_*` sizes are expanded using the
+ * supplied region and arch.
+ *
+ * Metal-backed sizes (anything starting with `M`) are passed through
+ * unchanged. The short `M_*` form is not a valid SKU on its own — the API
+ * requires the full Metal SKU (e.g. `M6_640_AWS_INTEL_D_METAL_474`), which
+ * encodes the CPU series, provider, arch, and storage size
+ *
+ * Already-suffixed NAS sizes are also passed through unchanged.
+ */
+export function toPostgresClusterSku(input: {
+  size: PostgresClusterSize;
+  arch?: "x86" | "arm";
+  region?: string;
+}): string {
+  const size = input.size;
+  if (!size.startsWith("PS_") || size.match(/(AWS|GCP)/)) return size;
+  // Not all AWS regions start with "aws-", but all GCP regions start with "gcp-".
+  const provider = input.region?.startsWith("gcp") ? "GCP" : "AWS";
+  const arch = (input.arch ?? "x86").toUpperCase();
+  return `${size}_${provider}_${arch}`;
+}
+
+/**
+ * Polls branch change requests until all visible changes are in a terminal
+ * state (`completed` or `canceled`), or — if `changeId` is provided — until
+ * that specific change reaches a terminal state.
+ */
+export const waitForPendingPostgresChanges = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+  changeId?: string,
+) {
+  yield* pollUntil(
+    `changes for branch "${branch}"`,
+    ops.listBranchChangeRequests({
+      organization,
+      database,
+      branch,
+      page: 1,
+      per_page: 25,
+    }),
+    (page) => {
+      const isTerminal = (state: string) =>
+        state === "completed" || state === "canceled";
+
+      if (changeId) {
+        const change = page.data.find((change) => change.id === changeId);
+        return change ? isTerminal(change.state) : false;
+      }
+
+      return page.data.every((change) => isTerminal(change.state));
+    },
+  );
+});
+
+/**
+ * Ensures a PostgreSQL production branch has the expected cluster size,
+ * queuing the change via the change-request API if it doesn't.
+ */
+export const ensurePostgresProductionBranchClusterSize = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+  expectedClusterSize: PostgresClusterSize,
+) {
+  const data = yield* ops.getBranch({ organization, database, branch });
+
+  const sku = toPostgresClusterSku({
+    size: expectedClusterSize,
+    arch: data.cluster_architecture === "aarch64" ? "arm" : "x86",
+    region: data.region.slug,
+  });
+
+  if (data.cluster_name === sku) {
+    return;
+  }
+  yield* waitForPendingPostgresChanges(organization, database, branch);
+  const change = yield* ops.updateBranchChangeRequest({
+    organization,
+    database,
+    branch,
+    cluster_size: sku,
+  });
+  yield* waitForPendingPostgresChanges(
+    organization,
+    database,
+    branch,
+    change.id,
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresDatabase.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresDatabase.ts
new file mode 100644
index 00000000000..2b75944fd48
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresDatabase.ts
@@ -0,0 +1,404 @@
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  ensurePostgresProductionBranchClusterSize,
+  toPostgresClusterSku,
+  type PostgresClusterSize,
+} from "./PostgresClusterSize.ts";
+import type { BaseDatabaseAttributes, BaseDatabaseProps } from "../Database.ts";
+import {
+  runPostgresImports,
+  runPostgresMigrations,
+} from "./PostgresMigrations.ts";
+import { hashImports, hashMigrations } from "../../Sql/SqlFile.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  DEFAULT_MIGRATIONS_TABLE,
+  PlanetscaleConflict,
+  recordsEqual,
+  waitForBranchReady,
+  waitForDatabaseReady,
+} from "../Util.ts";
+
+/**
+ * Properties for creating or updating a PostgreSQL PlanetScale database.
+ */
+export interface PostgresDatabaseProps extends BaseDatabaseProps {
+  /**
+   * The PostgreSQL database cluster size. Required.
+   * Short sizes are expanded using the target region and architecture.
+   * @see https://planetscale.com/docs/postgres/pricing
+   */
+  clusterSize: PostgresClusterSize;
+
+  /**
+   * PostgreSQL major version. Defaults to the latest available major
+   * version.
+   */
+  majorVersion?: string;
+
+  /**
+   * CPU architecture. Cannot be changed after creation.
+   * @default "x86"
+   */
+  arch?: "x86" | "arm";
+}
+
+/**
+ * Output attributes of a deployed PostgreSQL PlanetScale database.
+ */
+export interface PostgresDatabaseAttributes extends BaseDatabaseAttributes {
+  /** Engine kind discriminator. */
+  kind: "postgresql";
+  /** PostgreSQL CPU architecture. */
+  arch: "x86" | "arm";
+}
+
+/**
+ * A PostgreSQL PlanetScale database. For MySQL, use {@link MySQLDatabase}
+ * instead.
+ *
+ * @section Creating a PostgreSQL Database
+ * @example Basic PostgreSQL database
+ * ```typescript
+ * const db = yield* Planetscale.PostgresDatabase("MyDb", {
+ *   clusterSize: "PS_10",
+ * });
+ * ```
+ *
+ * @section Migrations and seed data
+ * @example Apply migrations and seed files
+ * ```typescript
+ * const db = yield* Planetscale.PostgresDatabase("MyDb", {
+ *   clusterSize: "PS_10",
+ *   migrationsDir: "./migrations/postgres",
+ *   importFiles: ["./seed/postgres.sql"],
+ * });
+ * ```
+ *
+ * @section Adoption
+ * @example Adopting an existing database
+ * ```typescript
+ * import { adopt } from "alchemy/AdoptPolicy";
+ *
+ * const db = yield* Planetscale.PostgresDatabase("Existing", {
+ *   name: "existing-db",
+ *   clusterSize: "PS_10",
+ * }).pipe(adopt());
+ * ```
+ */
+export type PostgresDatabase = Resource<
+  "Planetscale.PostgresDatabase",
+  PostgresDatabaseProps,
+  PostgresDatabaseAttributes,
+  never,
+  Providers
+>;
+
+export const PostgresDatabase = Resource<PostgresDatabase>(
+  "Planetscale.PostgresDatabase",
+);
+
+const createDatabaseName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return (
+      name ??
+      (yield* createPhysicalName({ id, lowercase: true, maxLength: 63 }))
+    );
+  });
+
+export const PostgresDatabaseProvider = () =>
+  Provider.effect(
+    PostgresDatabase,
+    Effect.gen(function* () {
+      const rootDir = yield* Effect.sync(() => process.cwd());
+      const createDb = yield* ops.createDatabase;
+      const getDb = yield* ops.getDatabase;
+      const updateSettings = yield* ops.updateDatabaseSettings;
+      const deleteDb = yield* ops.deleteDatabase;
+      const getBr = yield* ops.getBranch;
+      const createBr = yield* ops.createBranch;
+
+      return {
+        stables: ["id", "organization", "kind", "region"],
+
+        diff: Effect.fn(function* ({ news, olds, output }) {
+          if (!isResolved(news)) return undefined;
+
+          if (
+            news.region?.slug &&
+            output?.region?.slug &&
+            news.region.slug !== output.region.slug
+          ) {
+            return { action: "replace" } as const;
+          }
+
+          if (news.replicas !== olds.replicas) {
+            return { action: "replace" } as const;
+          }
+
+          const oldArch = output?.arch ?? olds.arch ?? "x86";
+          if (news.arch && news.arch !== oldArch) {
+            return { action: "replace" } as const;
+          }
+
+          if (news.migrationsDir) {
+            const newHashes = yield* hashMigrations(news.migrationsDir);
+            if (!recordsEqual(newHashes, output?.migrationsHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+            if (
+              (news.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE) !==
+              (output?.migrationsTable ?? DEFAULT_MIGRATIONS_TABLE)
+            ) {
+              return { action: "update" } as const;
+            }
+          }
+          if (news.importFiles?.length) {
+            const newHashes = yield* hashImports(news.importFiles, rootDir);
+            if (!recordsEqual(newHashes, output?.importHashes ?? {})) {
+              return { action: "update" } as const;
+            }
+          }
+
+          // Otherwise allow the engine to apply the default update logic.
+          return undefined;
+        }),
+
+        read: Effect.fn(function* ({ id, output, olds }) {
+          const { organization } = yield* Credentials;
+          const databaseName =
+            output?.name ?? (yield* createDatabaseName(id, olds?.name));
+
+          const data = yield* getDb({
+            organization,
+            database: databaseName,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+          if (!data) return undefined;
+
+          if (data.kind !== "postgresql") {
+            return yield* Effect.fail(
+              new PlanetscaleConflict({
+                message:
+                  `Planetscale database "${data.name}" has kind "${data.kind}" but this resource ` +
+                  `is a PostgresDatabase. Use Planetscale.${data.kind === "mysql" ? "MySQLDatabase" : data.kind}() instead, ` +
+                  `or delete the existing database and retry.`,
+              }),
+            );
+          }
+
+          const defaultBranch = data.default_branch ?? "main";
+
+          // Observe `arch` and `clusterSize` from the default branch rather
+          // than echoing input.
+          const branch = yield* getBr({
+            organization,
+            database: data.name,
+            branch: defaultBranch,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+          const arch: "x86" | "arm" =
+            branch!.cluster_architecture === "aarch64" ? "arm" : "x86";
+          const clusterSize = branch!.cluster_name;
+
+          return {
+            id: data.id,
+            name: data.name,
+            organization,
+            state: data.state,
+            defaultBranch,
+            plan: data.plan ?? "hobby",
+            createdAt: data.created_at,
+            updatedAt: data.updated_at,
+            htmlUrl: data.html_url,
+            region: { slug: data.region.slug },
+            migrationsDir: output?.migrationsDir ?? olds?.migrationsDir,
+            migrationsTable: output?.migrationsTable ?? olds?.migrationsTable,
+            migrationsHashes: output?.migrationsHashes ?? {},
+            importHashes: output?.importHashes ?? {},
+            kind: "postgresql" as const,
+            clusterSize,
+            arch,
+            requireApprovalForDeploy: data.require_approval_for_deploy ?? false,
+            restrictBranchRegion: data.restrict_branch_region ?? false,
+            productionBranchWebConsole:
+              data.production_branch_web_console ?? false,
+          };
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const { organization } = yield* Credentials;
+          const newName = yield* createDatabaseName(id, news.name);
+          const clusterSize = toPostgresClusterSku({
+            size: news.clusterSize,
+            arch: news.arch,
+            region: news.region?.slug,
+          });
+
+          // Observe — read live state under either the cached name (rename
+          // / refresh) or the freshly-derived name (greenfield). Observing
+          // unconditionally absorbs the race between `read` and `reconcile`
+          // — if a foreign actor (or a previously-failed-to-persist
+          // create) produced a database under the desired name in the
+          // meantime, we'll find it here and skip the duplicate create.
+          // Adoption routing has already been gated by `read` returning
+          // `Unowned`, so by the time we reach reconcile any observed
+          // database is fair game.
+          const observedName = output?.name ?? newName;
+          let observed = yield* getDb({
+            organization,
+            database: observedName,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+          // Ensure — if missing, create.
+          if (!observed) {
+            yield* session.note("Creating database...");
+            observed = yield* createDb({
+              organization,
+              name: newName,
+              region: news.region?.slug,
+              kind: "postgresql",
+              cluster_size: clusterSize,
+              replicas: news.replicas,
+              major_version: news.majorVersion,
+            });
+          }
+
+          // Wait for the database to finish provisioning before any
+          // downstream sync runs. PlanetScale reports `state: "pending"`
+          // for a while after createDatabase returns, during which branch
+          // operations on this database (including our own settings PATCH)
+          // race against the provisioning fiber.
+          yield* waitForDatabaseReady(organization, observed.name, session);
+
+          if (observed.kind !== "postgresql") {
+            return yield* Effect.fail(
+              new PlanetscaleConflict({
+                message:
+                  `Planetscale database "${observed.name}" has kind "${observed.kind}" but this resource ` +
+                  `is a PostgresDatabase. Use Planetscale.${observed.kind === "mysql" ? "MySQLDatabase" : observed.kind}() instead, ` +
+                  `or delete the existing database and retry.`,
+              }),
+            );
+          }
+
+          // Sync — ensure a non-`main` default branch exists before
+          // referencing it via `default_branch`. The branch is created
+          // empty (no cluster size yet); we'll size it below.
+          if (news.defaultBranch && news.defaultBranch !== "main") {
+            yield* waitForDatabaseReady(organization, observed.name, session);
+            const branchExists = yield* getBr({
+              organization,
+              database: observed.name,
+              branch: news.defaultBranch,
+            }).pipe(
+              Effect.map(() => true),
+              Effect.catchTag("NotFound", () => Effect.succeed(false)),
+            );
+            if (!branchExists) {
+              yield* createBr({
+                organization,
+                database: observed.name,
+                name: news.defaultBranch,
+                parent_branch: "main",
+              });
+            }
+          }
+
+          // Sync settings — `updateSettings` is upsert-shaped, so we can
+          // call it with the full desired payload on every reconcile.
+          // Folds the rename in via `new_name` so we don't pay for a
+          // separate PATCH.
+          const updated = yield* updateSettings({
+            organization,
+            database: observed.name,
+            new_name: newName !== observed.name ? newName : undefined,
+            require_approval_for_deploy: news.requireApprovalForDeploy,
+            restrict_branch_region: news.restrictBranchRegion,
+            production_branch_web_console: news.productionBranchWebConsole,
+            default_branch: news.defaultBranch,
+          });
+
+          // Sync cluster size on the active default branch.
+          const branch = news.defaultBranch ?? updated.default_branch ?? "main";
+          yield* ensurePostgresProductionBranchClusterSize(
+            organization,
+            updated.name,
+            branch,
+            news.clusterSize,
+          );
+
+          const migrationTarget = {
+            organization,
+            database: updated.name,
+            branch,
+          };
+          if (news.migrationsDir || news.importFiles?.length) {
+            yield* waitForBranchReady(
+              organization,
+              updated.name,
+              branch,
+              session,
+            );
+          }
+          const migrationsTable =
+            news.migrationsTable ??
+            output?.migrationsTable ??
+            DEFAULT_MIGRATIONS_TABLE;
+          const migrationsHashes = news.migrationsDir
+            ? yield* runPostgresMigrations(
+                migrationTarget,
+                news.migrationsDir,
+                migrationsTable,
+              )
+            : (output?.migrationsHashes ?? {});
+          const importHashes = news.importFiles?.length
+            ? yield* runPostgresImports(
+                migrationTarget,
+                news.importFiles,
+                rootDir,
+                output?.importHashes ?? {},
+              )
+            : {};
+
+          return {
+            id: updated.id,
+            name: updated.name,
+            organization,
+            state: updated.state,
+            defaultBranch: updated.default_branch ?? branch,
+            plan: updated.plan ?? output?.plan ?? "hobby",
+            createdAt: updated.created_at,
+            updatedAt: updated.updated_at,
+            htmlUrl: updated.html_url,
+            region: { slug: updated.region.slug },
+            kind: "postgresql" as const,
+            clusterSize: clusterSize,
+            migrationsDir: news.migrationsDir,
+            migrationsTable: news.migrationsDir ? migrationsTable : undefined,
+            migrationsHashes,
+            importHashes,
+            arch: news.arch ?? output?.arch ?? "x86",
+            requireApprovalForDeploy:
+              updated.require_approval_for_deploy ?? false,
+            restrictBranchRegion: updated.restrict_branch_region ?? false,
+            productionBranchWebConsole:
+              updated.production_branch_web_console ?? false,
+          } satisfies PostgresDatabaseAttributes;
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteDb({
+            organization: output.organization,
+            database: output.name,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresDefaultRole.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresDefaultRole.ts
new file mode 100644
index 00000000000..5a0d968da62
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresDefaultRole.ts
@@ -0,0 +1,270 @@
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import { PlanetscaleConflict, waitForBranchReady } from "../Util.ts";
+import type { PostgresBranch } from "./PostgresBranch.ts";
+import type { PostgresDatabase } from "./PostgresDatabase.ts";
+import type { InheritedRole } from "./PostgresRole.ts";
+
+/**
+ * Properties for creating or updating the default PlanetScale PostgreSQL
+ * role for a branch.
+ *
+ * Default roles are only meant for PostgreSQL databases. For MySQL,
+ * use {@link MySQLPassword} instead.
+ */
+export interface PostgresDefaultRoleProps {
+  /**
+   * PostgreSQL database — string name or {@link PostgresDatabase} resource.
+   */
+  database: string | PostgresDatabase;
+
+  /**
+   * Branch — string name or {@link PostgresBranch} resource.
+   * @default "main"
+   */
+  branch?: string | PostgresBranch;
+
+  /**
+   * Whether to force-reset the default role if it already exists.
+   * Adopting an existing default role is not supported because the
+   * password is only returned at create time.
+   * @default false
+   */
+  forceReset?: boolean;
+}
+
+/**
+ * Output attributes of a deployed PlanetScale default role.
+ */
+export interface PostgresDefaultRoleAttributes {
+  /** Unique identifier for the role (stable). */
+  id: string;
+  /** The Postgres role name. */
+  name: string;
+  /** ISO 8601 timestamp at which the role expires. */
+  expiresAt: string | null;
+  /** Hostname for the database connection. */
+  host: string;
+  /** Username for database authentication. */
+  username: string;
+  /** Password for database authentication (Redacted). */
+  password: Redacted.Redacted<string>;
+  /** TTL in seconds (if set). */
+  ttl: number | null;
+  /** The database name. */
+  databaseName: string;
+  /** Direct connection URL for the database (Redacted). */
+  connectionUrl: Redacted.Redacted<string>;
+  /** Pooled connection URL via PSBouncer (Redacted). */
+  connectionUrlPooled: Redacted.Redacted<string>;
+  /** Inherited roles. */
+  inheritedRoles: InheritedRole[];
+  /** Resolved organization slug. */
+  organization: string;
+  /** Resolved database name (for delete). */
+  database: string;
+  /** Resolved branch name. */
+  branch: string;
+}
+
+/**
+ * The default PlanetScale PostgreSQL role for a database branch.
+ *
+ * @section Creating a Default Role
+ * @example Default role on the main branch
+ * ```typescript
+ * const db = yield* Planetscale.PostgresDatabase("MyDb", {
+ *   clusterSize: "PS_10",
+ * });
+ * const defaultRole = yield* Planetscale.PostgresDefaultRole("MainRole", {
+ *   database: db,
+ *   forceReset: true,
+ * });
+ * ```
+ */
+export type PostgresDefaultRole = Resource<
+  "Planetscale.PostgresDefaultRole",
+  PostgresDefaultRoleProps,
+  PostgresDefaultRoleAttributes,
+  never,
+  Providers
+>;
+
+export const PostgresDefaultRole = Resource<PostgresDefaultRole>(
+  "Planetscale.PostgresDefaultRole",
+);
+
+// Structural shapes for runtime-resolved Resource references — see
+// notes in Password.ts.
+type DatabaseRef = string | { name: string; organization?: string };
+type BranchRef = string | { name: string };
+
+const resolveDatabaseName = (database: string | PostgresDatabase): string => {
+  const ref = database as unknown as DatabaseRef;
+  return typeof ref === "string" ? ref : ref.name;
+};
+
+const resolveDatabaseOrg = (
+  database: string | PostgresDatabase,
+): string | undefined => {
+  const ref = database as unknown as DatabaseRef;
+  return typeof ref === "string" ? undefined : ref.organization;
+};
+
+const resolveBranchName = (
+  branch: string | PostgresBranch | undefined,
+): string => {
+  const ref = branch as unknown as BranchRef | undefined;
+  return !ref ? "main" : typeof ref === "string" ? ref : ref.name;
+};
+
+export const PostgresDefaultRoleProvider = () =>
+  Provider.effect(
+    PostgresDefaultRole,
+    Effect.gen(function* () {
+      const getDefault = yield* ops.getDefaultRole;
+      const resetDefault = yield* ops.resetDefaultRole;
+
+      return {
+        stables: ["id"],
+
+        diff: Effect.fn(function* ({ news, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+
+          const newDb = resolveDatabaseName(news.database);
+          const oldDb = olds.database
+            ? resolveDatabaseName(olds.database)
+            : undefined;
+          if (oldDb && newDb !== oldDb) {
+            return { action: "replace" } as const;
+          }
+          const newBranch = resolveBranchName(news.branch);
+          const oldBranch = resolveBranchName(olds.branch);
+          if (newBranch !== oldBranch) {
+            return { action: "replace" } as const;
+          }
+          return undefined;
+        }),
+
+        read: Effect.fn(function* ({ output }) {
+          // Adoption (no cached output) is impossible without destroying
+          // existing credentials. The engine routes adoption through
+          // `read`, but here we always defer to reconcile so the
+          // `forceReset` props flag remains the user-facing switch for
+          // takeover. Returning undefined makes the engine treat the
+          // resource as greenfield; reconcile then observes live state
+          // and either fails (no forceReset) or resets (forceReset).
+          if (!output) return undefined;
+
+          // Refresh — verify the default role still exists and re-emit
+          // the persisted output (with plaintext intact). If gone,
+          // return undefined so the engine routes through reconcile,
+          // which will recreate via reset.
+          return yield* getDefault({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+          }).pipe(
+            Effect.map(() => output),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const { organization: envOrg } = yield* Credentials;
+          const organization = resolveDatabaseOrg(news.database) ?? envOrg;
+          const databaseName = resolveDatabaseName(news.database);
+          const branchName = resolveBranchName(news.branch);
+
+          // 1. Observe — the default role is the singleton for this
+          //    (database, branch); we key on those rather than an id.
+          //    Observation runs unconditionally so the adoption guard
+          //    below fires on greenfield deploys against branches that
+          //    already have a default role (otherwise we would silently
+          //    `resetDefault` and destroy their credentials).
+          const observed = yield* getDefault({
+            organization,
+            database: databaseName,
+            branch: branchName,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+          // 2. Sync (no-op) — we own the role and it still exists in the
+          //    cloud. Default roles have nothing mutable in place: their
+          //    plaintext password isn't retrievable, so we re-emit the
+          //    persisted attributes unchanged. diff() forces a replace
+          //    when database/branch change.
+          if (output && observed) {
+            return output;
+          }
+
+          // 3. Adoption guard — observed exists but we have no prior
+          //    output (greenfield against a pre-existing default role).
+          //    Taking over requires a reset (which destroys the existing
+          //    password), so gate on an explicit forceReset opt-in.
+          if (observed && !news.forceReset) {
+            return yield* Effect.fail(
+              new PlanetscaleConflict({
+                message: `Default role already exists for database "${databaseName}" branch "${branchName}". Use forceReset: true to reset.`,
+              }),
+            );
+          }
+
+          // 4. Ensure — (re)create the default role. This branch runs
+          //    for greenfield (no output, no observed), drift recovery
+          //    (output cached but cloud state gone), and authorised
+          //    adoption (observed present + forceReset).
+          yield* waitForBranchReady(organization, databaseName, branchName);
+          const data = yield* resetDefault({
+            organization,
+            database: databaseName,
+            branch: branchName,
+          });
+
+          if (!data.password) {
+            return yield* Effect.die(
+              `Planetscale did not return a password for Default Role.`,
+            );
+          }
+
+          const password = Redacted.isRedacted(data.password)
+            ? Redacted.value(data.password)
+            : data.password;
+
+          const connectionUrl = `postgresql://${data.username}:${password}@${data.access_host_url}:5432/${data.database_name}?sslmode=verify-full`;
+          const connectionUrlPooled = `postgresql://${data.username}:${password}@${data.access_host_url}:6432/${data.database_name}?sslmode=verify-full`;
+
+          return {
+            id: data.id,
+            name: data.name,
+            expiresAt: data.expires_at,
+            host: data.access_host_url,
+            username: data.username,
+            password: Redacted.make(password),
+            ttl: data.ttl,
+            databaseName: data.database_name,
+            connectionUrl: Redacted.make(connectionUrl),
+            connectionUrlPooled: Redacted.make(connectionUrlPooled),
+            inheritedRoles: data.inherited_roles as InheritedRole[],
+            organization,
+            database: databaseName,
+            branch: branchName,
+          } satisfies PostgresDefaultRoleAttributes;
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          // No delete endpoint — reset to invalidate existing credentials.
+          yield* resetDefault({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+          }).pipe(Effect.catchTag("NotFound", () => Effect.void));
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresMigrations.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresMigrations.ts
new file mode 100644
index 00000000000..79004d1916e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresMigrations.ts
@@ -0,0 +1,256 @@
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+import { Client } from "pg";
+import { listSqlFiles, readSqlFile, type SqlFile } from "../../Sql/SqlFile.ts";
+
+const MIGRATION_ROLE_TTL_SECONDS = 600;
+
+export class PostgresMigrationError extends Data.TaggedError(
+  "Planetscale::PostgresMigrationError",
+)<{
+  message: string;
+  cause?: unknown;
+}> {}
+
+export interface PostgresMigrationTarget {
+  organization: string;
+  database: string;
+  branch: string;
+}
+
+export const runPostgresMigrations = (
+  target: PostgresMigrationTarget,
+  migrationsDir: string,
+  migrationsTable: string,
+) =>
+  Effect.gen(function* () {
+    const files = yield* listSqlFiles(migrationsDir);
+    if (files.length > 0) {
+      yield* applyPostgresMigrations({
+        target,
+        migrationsTable,
+        migrationsFiles: files,
+      });
+    }
+    const hashes: Record<string, string> = {};
+    for (const file of files) hashes[file.id] = file.hash;
+    return hashes;
+  });
+
+export const runPostgresImports = (
+  target: PostgresMigrationTarget,
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+  previous: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = { ...previous };
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      if (previous[filePath] === file.hash) {
+        hashes[filePath] = file.hash;
+        continue;
+      }
+      yield* runPostgresSql(target, file.sql);
+      hashes[filePath] = file.hash;
+    }
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+      if (!tracked.has(key)) delete hashes[key];
+    }
+    return hashes;
+  });
+
+interface ApplyMigrationsOptions {
+  target: PostgresMigrationTarget;
+  migrationsTable: string;
+  migrationsFiles: ReadonlyArray<SqlFile>;
+}
+
+const applyPostgresMigrations = (options: ApplyMigrationsOptions) =>
+  withPostgresClient(options.target, (client) =>
+    Effect.gen(function* () {
+      const table = quotePgIdentifier(options.migrationsTable);
+      yield* pgExec(
+        client,
+        `CREATE TABLE IF NOT EXISTS ${table} (
+           id TEXT PRIMARY KEY,
+           name TEXT NOT NULL,
+           applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+         );`,
+      );
+
+      const applied = yield* pgRows<{ name: string }>(
+        client,
+        `SELECT name FROM ${table};`,
+      ).pipe(Effect.map((rows) => new Set(rows.map((row) => row.name))));
+      let nextSeq = yield* getNextPgSeq(client, table);
+
+      for (const file of options.migrationsFiles) {
+        if (applied.has(file.id)) continue;
+        const migrationId = nextSeq.toString().padStart(5, "0");
+        nextSeq += 1;
+        yield* Effect.gen(function* () {
+          yield* pgExec(client, "BEGIN");
+          yield* pgExec(client, file.sql);
+          yield* pgExec(
+            client,
+            `INSERT INTO ${table} (id, name) VALUES ($1, $2);`,
+            [migrationId, file.id],
+          );
+          yield* pgExec(client, "COMMIT");
+        }).pipe(
+          Effect.catch((error) =>
+            pgExec(client, "ROLLBACK").pipe(
+              Effect.catch(() => Effect.void),
+              Effect.andThen(Effect.fail(error)),
+            ),
+          ),
+        );
+      }
+    }),
+  );
+
+const runPostgresSql = (target: PostgresMigrationTarget, sql: string) =>
+  withPostgresClient(target, (client) => pgExec(client, sql));
+
+const getNextPgSeq = (client: Client, table: string) =>
+  pgRows<{ id: string }>(client, `SELECT id FROM ${table};`).pipe(
+    Effect.map((rows) => {
+      let max = 0;
+      for (const { id } of rows) {
+        if (/^\d+$/.test(id)) {
+          max = Math.max(max, Number.parseInt(id, 10));
+        }
+      }
+      return max + 1;
+    }),
+  );
+
+const withPostgresClient = <A, E, R>(
+  target: PostgresMigrationTarget,
+  use: (client: Client) => Effect.Effect<A, E, R>,
+) =>
+  withTemporaryPostgresRole(target, (role) =>
+    Effect.acquireUseRelease(
+      Effect.gen(function* () {
+        const client = yield* Effect.sync(
+          () =>
+            new Client({
+              connectionString: stripPgSslQueryParams(
+                Redacted.value(role.connectionUrl),
+              ),
+              ssl: { rejectUnauthorized: true },
+            }),
+        );
+        yield* Effect.tryPromise({
+          try: () => client.connect(),
+          catch: toMigrationError,
+        });
+        return client;
+      }),
+      use,
+      (client) =>
+        Effect.tryPromise({
+          try: () => client.end(),
+          catch: toMigrationError,
+        }).pipe(Effect.catch(() => Effect.void)),
+    ),
+  );
+
+const withTemporaryPostgresRole = <A, E, R>(
+  target: PostgresMigrationTarget,
+  use: (role: {
+    id: string;
+    connectionUrl: Redacted.Redacted<string>;
+  }) => Effect.Effect<A, E, R>,
+) =>
+  Effect.acquireUseRelease(
+    Effect.gen(function* () {
+      const created = yield* ops.createRole({
+        organization: target.organization,
+        database: target.database,
+        branch: target.branch,
+        ttl: MIGRATION_ROLE_TTL_SECONDS,
+        inherited_roles: ["postgres"],
+      });
+
+      const password = created.password!;
+      const value = Redacted.value(password);
+      const connectionUrl = yield* Effect.sync(
+        () =>
+          `postgresql://${encodeURIComponent(created.username)}:${encodeURIComponent(value)}@${created.access_host_url}:5432/${created.database_name}?sslmode=verify-full`,
+      );
+      return {
+        id: created.id,
+        connectionUrl: Redacted.make(connectionUrl),
+      };
+    }),
+    use,
+    (role) =>
+      ops
+        .deleteRole({
+          organization: target.organization,
+          database: target.database,
+          branch: target.branch,
+          id: role.id,
+          successor: "postgres",
+        })
+        .pipe(
+          // Already-deleted roles are a success: nothing to clean up.
+          Effect.catchTag("NotFound", () => Effect.void),
+          Effect.retry({
+            schedule: Schedule.exponential("500 millis").pipe(
+              Schedule.both(Schedule.recurs(5)),
+            ),
+          }),
+          // Migrations succeeded; don't fail the parent over a release-step
+          // hiccup. The role's TTL bounds the orphan window; log loudly so
+          // an operator can clean it up manually if needed.
+          Effect.catch((cause: unknown) =>
+            Effect.logWarning(
+              `Failed to delete temporary Planetscale migration role after retries. ` +
+                `It will expire via TTL (~${MIGRATION_ROLE_TTL_SECONDS}s). ` +
+                `organization=${target.organization} database=${target.database} ` +
+                `branch=${target.branch} id=${role.id}`,
+              cause,
+            ),
+          ),
+        ),
+  );
+
+const pgExec = (client: Client, sql: string, values?: ReadonlyArray<unknown>) =>
+  Effect.tryPromise({
+    try: () =>
+      client.query(sql, values as Array<unknown>).then(() => undefined),
+    catch: toMigrationError,
+  });
+
+const pgRows = <A>(client: Client, sql: string) =>
+  Effect.tryPromise({
+    try: () => client.query(sql).then((result) => result.rows as A[]),
+    catch: toMigrationError,
+  });
+
+const toMigrationError = (cause: unknown) =>
+  new PostgresMigrationError({
+    message: cause instanceof Error ? cause.message : String(cause),
+    cause,
+  });
+
+const quotePgIdentifier = (identifier: string) =>
+  `"${identifier.replaceAll('"', '""')}"`;
+
+const stripPgSslQueryParams = (uri: string): string => {
+  try {
+    const url = new URL(uri);
+    url.searchParams.delete("sslmode");
+    url.searchParams.delete("channel_binding");
+    return url.toString();
+  } catch {
+    return uri;
+  }
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresOrigin.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresOrigin.ts
new file mode 100644
index 00000000000..1f4acdcbed1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresOrigin.ts
@@ -0,0 +1,15 @@
+import * as Redacted from "effect/Redacted";
+
+/**
+ * The shape `Cloudflare.Hyperdrive` and other Postgres consumers accept as an
+ * origin. Materialized on `Planetscale.PostgresRole` so callers can wire role
+ * credentials into Hyperdrive directly.
+ */
+export type PostgresOrigin = {
+  scheme: "postgres" | "postgresql";
+  host: string;
+  port: number;
+  database: string;
+  user: string;
+  password: Redacted.Redacted<string>;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresRole.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresRole.ts
new file mode 100644
index 00000000000..15ad36c75f0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/PostgresRole.ts
@@ -0,0 +1,469 @@
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { deepEqual, isResolved } from "../../Diff.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+import {
+  isKnownError,
+  PlanetscaleConflict,
+  waitForBranchReady,
+} from "../Util.ts";
+import type { PostgresBranch } from "./PostgresBranch.ts";
+import type { PostgresDatabase } from "./PostgresDatabase.ts";
+import type { PostgresOrigin } from "./PostgresOrigin.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+
+/**
+ * Built-in PostgreSQL roles that can be inherited from. Custom role names
+ * (referencing other Role resources) are also accepted.
+ */
+export type InheritedRole =
+  | "pscale_managed"
+  | "pg_checkpoint"
+  | "pg_create_subscription"
+  | "pg_maintain"
+  | "pg_monitor"
+  | "pg_read_all_data"
+  | "pg_read_all_settings"
+  | "pg_read_all_stats"
+  | "pg_signal_backend"
+  | "pg_stat_scan_tables"
+  | "pg_use_reserved_connections"
+  | "pg_write_all_data"
+  | "postgres"
+  | (string & {});
+
+type SDKInheritedRole =
+  | "pscale_managed"
+  | "pg_checkpoint"
+  | "pg_create_subscription"
+  | "pg_maintain"
+  | "pg_monitor"
+  | "pg_read_all_data"
+  | "pg_read_all_settings"
+  | "pg_read_all_stats"
+  | "pg_signal_backend"
+  | "pg_stat_scan_tables"
+  | "pg_use_reserved_connections"
+  | "pg_write_all_data"
+  | "postgres";
+
+/**
+ * Properties for creating or updating a PlanetScale PostgreSQL role.
+ *
+ * Roles are only meant for PostgreSQL databases. For MySQL,
+ * use {@link MySQLPassword} instead.
+ */
+export interface PostgresRoleProps {
+  /**
+   * Role name. If not provided, a physical name will be generated.
+   */
+  name?: string;
+  /**
+   * PostgreSQL database — string name or {@link PostgresDatabase} resource.
+   */
+  database: string | PostgresDatabase;
+
+  /**
+   * Branch — string name or {@link PostgresBranch} resource.
+   * @default "main"
+   */
+  branch?: string | PostgresBranch;
+
+  /**
+   * Time to live in seconds.
+   */
+  ttl?: number;
+
+  /**
+   * Roles to inherit from. Either a list of built-in role names, or
+   * another {@link PostgresRole} resource (whose `inheritedRoles` are reused).
+   */
+  inheritedRoles: InheritedRole[] | PostgresRole;
+
+  /**
+   * Successor role to reassign ownership to before dropping. Used during
+   * delete.
+   * @default "postgres"
+   */
+  successor?: string | PostgresRole;
+}
+
+/**
+ * Output attributes of a deployed PlanetScale role.
+ */
+export interface PostgresRoleAttributes {
+  /** Unique identifier for the role (stable). */
+  id: string;
+  /** The Postgres role name (assigned by PlanetScale). */
+  name: string;
+  /** ISO 8601 timestamp at which the role expires. */
+  expiresAt: string | null;
+  /** Hostname for the database connection. */
+  host: string;
+  /** Username for database authentication. */
+  username: string;
+  /** Password for database authentication (Redacted). */
+  password: Redacted.Redacted<string>;
+  /** The database name. */
+  database: string;
+  /** The Postgres database name inside the branch. */
+  databaseName: string;
+  /** Parsed connection components ready to feed into Cloudflare Hyperdrive. */
+  origin: PostgresOrigin;
+  /** Direct connection URL for the database (Redacted). */
+  connectionUrl: Redacted.Redacted<string>;
+  /** Pooled connection URL via PSBouncer (port 6432, Redacted). */
+  connectionUrlPooled: Redacted.Redacted<string>;
+  /** Inherited roles. */
+  inheritedRoles: InheritedRole[];
+  /** The successor role used during delete. */
+  successor: string;
+  /** Resolved organization slug. */
+  organization: string;
+  /** Resolved branch name. */
+  branch: string;
+  /** Time-to-live for the role in seconds. */
+  ttl: number | null;
+}
+
+/**
+ * A PlanetScale role for accessing a PostgreSQL database branch.
+ *
+ * For MySQL databases, use {@link MySQLPassword} instead.
+ *
+ * @section Creating a Role
+ * @example Postgres admin role
+ * ```typescript
+ * const admin = yield* Planetscale.PostgresRole("Admin", {
+ *   database: "my-db",
+ *   inheritedRoles: ["postgres"],
+ * });
+ * ```
+ *
+ * @example Read-only role
+ * ```typescript
+ * const reader = yield* Planetscale.PostgresRole("Reader", {
+ *   database: "my-db",
+ *   inheritedRoles: ["pg_read_all_data", "pg_read_all_settings"],
+ * });
+ * ```
+ *
+ * @example Role with TTL
+ * ```typescript
+ * const tempReader = yield* Planetscale.PostgresRole("TempReader", {
+ *   database: "my-db",
+ *   inheritedRoles: ["pg_read_all_data"],
+ *   ttl: 3600,
+ * });
+ * ```
+ */
+export type PostgresRole = Resource<
+  "Planetscale.PostgresRole",
+  PostgresRoleProps,
+  PostgresRoleAttributes,
+  never,
+  Providers
+>;
+
+export const PostgresRole = Resource<PostgresRole>("Planetscale.PostgresRole");
+
+// Structural shapes for runtime-resolved Resource references — see notes
+// in Password.ts.
+type DatabaseRef = string | { name: string; organization?: string };
+type BranchRef = string | { name: string };
+type RoleRef = string | { name: string; inheritedRoles: InheritedRole[] };
+
+const resolveDatabaseName = (database: string | PostgresDatabase): string => {
+  const ref = database as unknown as DatabaseRef;
+  return typeof ref === "string" ? ref : ref.name;
+};
+
+const resolveDatabaseOrg = (
+  database: string | PostgresDatabase,
+): string | undefined => {
+  const ref = database as unknown as DatabaseRef;
+  return typeof ref === "string" ? undefined : ref.organization;
+};
+
+const resolveBranchName = (
+  branch: string | PostgresBranch | undefined,
+): string => {
+  const ref = branch as unknown as BranchRef | undefined;
+  return !ref ? "main" : typeof ref === "string" ? ref : ref.name;
+};
+
+const resolveSuccessorName = (
+  successor: string | PostgresRole | undefined,
+): string => {
+  const ref = successor as unknown as RoleRef | undefined;
+  return !ref ? "postgres" : typeof ref === "string" ? ref : ref.name;
+};
+
+const resolveInheritedRoles = (
+  inheritedRoles: InheritedRole[] | PostgresRole,
+): InheritedRole[] => {
+  if (Array.isArray(inheritedRoles)) {
+    return inheritedRoles;
+  }
+  // At runtime, a Role passed in is its resolved attributes (with
+  // `inheritedRoles` as a plain array); statically `Role.inheritedRoles`
+  // is `Output<InheritedRole[]>`.
+  return (
+    inheritedRoles as unknown as RoleRef as { inheritedRoles: InheritedRole[] }
+  ).inheritedRoles;
+};
+
+const resolveName = (id: string, name: string | undefined) =>
+  Effect.gen(function* () {
+    return (
+      name ??
+      (yield* createPhysicalName({ id, lowercase: true, maxLength: 63 }))
+    );
+  });
+
+const buildAttributes = (
+  role: {
+    id: string;
+    name: string;
+    expires_at: string | null;
+    access_host_url: string;
+    username: string;
+    database_name: string;
+    ttl: number | null;
+  },
+  password: Redacted.Redacted<string>,
+  context: {
+    inheritedRoles: InheritedRole[];
+    successor: string;
+    organization: string;
+    database: string;
+    branch: string;
+  },
+): PostgresRoleAttributes => {
+  const passwordValue = Redacted.value(password);
+  const connectionUrl = `postgresql://${role.username}:${passwordValue}@${role.access_host_url}:5432/${role.database_name}?sslmode=verify-full`;
+  const connectionUrlPooled = `postgresql://${role.username}:${passwordValue}@${role.access_host_url}:6432/${role.database_name}?sslmode=verify-full`;
+
+  return {
+    id: role.id,
+    name: role.name,
+    expiresAt: role.expires_at,
+    host: role.access_host_url,
+    username: role.username,
+    password,
+    connectionUrl: Redacted.make(connectionUrl),
+    connectionUrlPooled: Redacted.make(connectionUrlPooled),
+    inheritedRoles: context.inheritedRoles,
+    successor: context.successor,
+    organization: context.organization,
+    database: context.database,
+    databaseName: role.database_name,
+    origin: {
+      scheme: "postgres",
+      host: role.access_host_url,
+      port: 5432,
+      database: role.database_name,
+      user: role.username,
+      password,
+    },
+    branch: context.branch,
+    ttl: role.ttl,
+  };
+};
+
+export const PostgresRoleProvider = () =>
+  Provider.effect(
+    PostgresRole,
+    Effect.gen(function* () {
+      const createRole = yield* ops.createRole;
+      const deleteRole = yield* ops.deleteRole;
+      const updateRole = yield* ops.updateRole;
+      const getRole = yield* ops.getRole;
+      const getBranch = yield* ops.getBranch;
+
+      return {
+        stables: ["id"],
+
+        diff: Effect.fn(function* ({ id, news, olds, output }) {
+          if (!isResolved(news)) return undefined;
+
+          // Successor is the only updatable property — everything else
+          // requires replacement.
+          if (news.ttl !== olds.ttl) {
+            return { action: "replace" } as const;
+          }
+          const newDb = resolveDatabaseName(news.database);
+          const oldDb = olds.database
+            ? resolveDatabaseName(olds.database)
+            : undefined;
+          if (oldDb && newDb !== oldDb) {
+            return { action: "replace" } as const;
+          }
+          const newBranch = resolveBranchName(news.branch);
+          const oldBranch = resolveBranchName(olds.branch);
+          if (newBranch !== oldBranch) {
+            return { action: "replace" } as const;
+          }
+          const newRoles = resolveInheritedRoles(news.inheritedRoles);
+          const oldRoles = output?.inheritedRoles ?? [];
+          if (!deepEqual(newRoles, oldRoles)) {
+            return { action: "replace" } as const;
+          }
+          const oldName = output?.name ?? (yield* resolveName(id, olds?.name));
+          const newName = yield* resolveName(id, news.name);
+
+          if (newName !== oldName) {
+            return { action: "update" } as const;
+          }
+
+          return undefined;
+        }),
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.id) return undefined;
+
+          return yield* getRole({
+            branch: output.branch,
+            database: output.database,
+            organization: output.organization,
+            id: output.id,
+          }).pipe(
+            Effect.map((token) =>
+              buildAttributes(token, output.password, {
+                inheritedRoles: token.inherited_roles as InheritedRole[],
+                successor: output.successor,
+                organization: output.organization,
+                database: output.database,
+                branch: token.branch.name,
+              }),
+            ),
+            Effect.catchTag("Forbidden", () => Effect.succeed(undefined)),
+            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+          );
+        }),
+
+        reconcile: Effect.fn(function* ({ id, news, output }) {
+          const { organization: envOrg } = yield* Credentials;
+          const organization = resolveDatabaseOrg(news.database) ?? envOrg;
+          const databaseName = resolveDatabaseName(news.database);
+          const branchName = resolveBranchName(news.branch);
+          const inheritedRoles = resolveInheritedRoles(news.inheritedRoles);
+          const successor = resolveSuccessorName(news.successor);
+          const desiredName = yield* resolveName(id, news.name);
+
+          // 1. Observe — fetch live state if we know the role id. Roles
+          //    can only be looked up by id; without a cached id there is
+          //    no way to find the live role, so we fall through to ensure.
+          const observed = output?.id
+            ? yield* getRole({
+                id: output.id,
+                branch: branchName,
+                organization,
+                database: databaseName,
+              }).pipe(
+                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+              )
+            : undefined;
+
+          // 2. Ensure — create if missing. Single branch covers both
+          //    greenfield (no output) and out-of-band-deletion (output
+          //    cached but cloud lost it). The latter is structurally a
+          //    rotation: the new role has fresh id/host/username/plaintext
+          //    that propagate downstream through the dependency graph.
+          //    There is no path to recover the original plaintext, so
+          //    recreating is the only way to converge.
+          //
+          //    Planetscale returns the plaintext password value exactly
+          //    once on create; on an observe-hit we re-use the cached
+          //    plaintext from output (which is why adoption requires
+          //    pre-existing state — see `read`).
+          let live: ops.GetRoleOutput | ops.CreateRoleOutput;
+          let plaintext: Redacted.Redacted<string>;
+          if (observed) {
+            live = observed;
+            plaintext = output!.password;
+          } else {
+            const branchInfo = yield* getBranch({
+              organization,
+              database: databaseName,
+              branch: branchName,
+            });
+            if (branchInfo.kind !== "postgresql") {
+              return yield* Effect.fail(
+                new PlanetscaleConflict({
+                  message: `Cannot create a Role on MySQL database "${databaseName}". Roles are only supported on PostgreSQL. Use Password for MySQL.`,
+                }),
+              );
+            }
+            if (!branchInfo.ready) {
+              yield* waitForBranchReady(organization, databaseName, branchName);
+            }
+            const created = yield* createRole({
+              name: desiredName,
+              branch: branchName,
+              organization,
+              database: databaseName,
+              ttl: news.ttl,
+              inherited_roles: inheritedRoles as SDKInheritedRole[],
+            });
+            if (!created.password) {
+              return yield* Effect.die(
+                `Planetscale did not return a password for Role "${desiredName}".`,
+              );
+            }
+            plaintext = created.password;
+            live = created;
+          }
+
+          // 3. Sync — only `name` is mutable in place; diff observed
+          //    against desired and skip the API call when nothing
+          //    changed. Everything else triggers a replace via diff().
+          if (live.name !== desiredName) {
+            live = yield* updateRole({
+              id: live.id,
+              branch: branchName,
+              organization,
+              database: databaseName,
+              name: desiredName,
+            });
+          }
+
+          // 4. Return — fresh attrs sourced from observed cloud state,
+          //    with cached or freshly-issued plaintext.
+          return buildAttributes(live, plaintext, {
+            inheritedRoles: live.inherited_roles as InheritedRole[],
+            successor,
+            organization,
+            database: databaseName,
+            branch: branchName,
+          });
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteRole({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+            id: output.id,
+            successor: output.successor,
+          }).pipe(
+            Effect.catchTag("NotFound", () => Effect.void),
+            // 422 (UnprocessableEntity): role is still referenced. Log a
+            // warning rather than failing — the role will be cleaned up
+            // when the database/branch is deleted.
+            Effect.catchIf(
+              isKnownError(
+                "UnprocessableEntity",
+                "Role is still referenced and cannot be dropped.",
+              ),
+              () => Effect.void,
+            ),
+          );
+        }),
+      };
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/index.ts
new file mode 100644
index 00000000000..d6032b23dfb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Postgres/index.ts
@@ -0,0 +1,6 @@
+export * from "./PostgresClusterSize.ts";
+export * from "./PostgresBranch.ts";
+export * from "./PostgresDatabase.ts";
+export * from "./PostgresDefaultRole.ts";
+export * from "./PostgresOrigin.ts";
+export * from "./PostgresRole.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Providers.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Providers.ts
new file mode 100644
index 00000000000..06e9ee47764
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Providers.ts
@@ -0,0 +1,80 @@
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive } from "../Auth/Profile.ts";
+import * as Provider from "../Provider.ts";
+import type { StackServices } from "../Stack.ts";
+import { PlanetscaleAuth } from "./AuthProvider.ts";
+import * as Credentials from "./Credentials.ts";
+import { MySQLBranch, MySQLBranchProvider } from "./MySQL/MySQLBranch.ts";
+import { MySQLDatabase, MySQLDatabaseProvider } from "./MySQL/MySQLDatabase.ts";
+import { MySQLPassword, MySQLPasswordProvider } from "./MySQL/MySQLPassword.ts";
+import {
+  PostgresBranch,
+  PostgresBranchProvider,
+} from "./Postgres/PostgresBranch.ts";
+import {
+  PostgresDatabase,
+  PostgresDatabaseProvider,
+} from "./Postgres/PostgresDatabase.ts";
+import {
+  PostgresDefaultRole,
+  PostgresDefaultRoleProvider,
+} from "./Postgres/PostgresDefaultRole.ts";
+import { PostgresRole, PostgresRoleProvider } from "./Postgres/PostgresRole.ts";
+
+/**
+ * Service tag bundling all PlanetScale providers + auth + credentials. Use
+ * `Planetscale.providers()` to materialize the full layer.
+ */
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "Planetscale",
+) {}
+
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+
+/**
+ * Build the complete PlanetScale providers Layer. Provide this on a Stack
+ * (or via `Effect.provide` at test time) to enable all PlanetScale
+ * resources, the AuthProvider registration, and credential resolution.
+ *
+ * @example
+ * ```ts
+ * Effect.provide(Planetscale.providers())
+ * ```
+ */
+export const providers = (): Layer.Layer<
+  Providers | Credentials.Credentials,
+  never,
+  StackServices
+> =>
+  Layer.effect(
+    Providers,
+    Provider.collection([
+      MySQLDatabase,
+      PostgresDatabase,
+      MySQLBranch,
+      PostgresBranch,
+      MySQLPassword,
+      PostgresRole,
+      PostgresDefaultRole,
+    ]),
+  ).pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        MySQLDatabaseProvider(),
+        PostgresDatabaseProvider(),
+        MySQLBranchProvider(),
+        PostgresBranchProvider(),
+        MySQLPasswordProvider(),
+        PostgresRoleProvider(),
+        PostgresDefaultRoleProvider(),
+      ),
+    ),
+    Layer.provideMerge(Credentials.fromAuthProvider()),
+    Layer.provideMerge(FetchHttpClient.layer),
+    Layer.provideMerge(PlanetscaleAuth),
+    Layer.provideMerge(ProfileLive),
+    Layer.provideMerge(CredentialsStoreLive),
+    Layer.orDie,
+  ) as Layer.Layer<Providers | Credentials.Credentials, never, StackServices>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Util.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Util.ts
new file mode 100644
index 00000000000..efab6fca13d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/Util.ts
@@ -0,0 +1,160 @@
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as Clock from "effect/Clock";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { ScopedPlanStatusSession } from "../Cli/Cli.ts";
+
+export const DEFAULT_MIGRATIONS_TABLE = "__alchemy_migrations";
+
+/**
+ * Tagged error raised when polling for a state predicate that has not yet
+ * been reached. Used internally with `Effect.retry` to drive long-running
+ * status waits.
+ */
+class NotReady extends Data.TaggedError("Planetscale::NotReady")<{
+  description: string;
+}> {}
+
+/**
+ * Tagged error raised by reconcilers when an immutable property of a live
+ * PlanetScale resource does not match the desired configuration (e.g.
+ * region, kind, parent_branch). User-recoverable: change the config to
+ * match, or replace/delete the existing resource and retry.
+ */
+export class PlanetscaleConflict extends Data.TaggedError(
+  "Planetscale::Conflict",
+)<{
+  message: string;
+}> {}
+
+/**
+ * Default polling schedule: 5s spaced retries with a 10-minute total
+ * budget (120 × 5s). Avoids the exponential-blowup trap where later
+ * iterations would wait hours, indistinguishable from a hang.
+ */
+const defaultSchedule = Schedule.spaced("5 seconds").pipe(
+  Schedule.both(Schedule.recurs(120)),
+);
+
+/**
+ * Generic polling helper that retries until `predicate(value)` returns true
+ * (or until the schedule is exhausted). Engine-specific helpers (e.g.
+ * `waitForKeyspaceReady`, `waitForPendingPostgresChanges`) are built on top
+ * of this primitive.
+ */
+export const pollUntil = <A, E, R>(
+  description: string,
+  fn: Effect.Effect<A, E, R>,
+  predicate: (value: A) => boolean,
+  schedule: Schedule.Schedule<unknown, unknown, never> = defaultSchedule,
+): Effect.Effect<A, E, R> =>
+  fn.pipe(
+    Effect.flatMap((value) =>
+      predicate(value)
+        ? Effect.succeed(value)
+        : Effect.fail(new NotReady({ description })),
+    ),
+    Effect.retry({
+      while: (e: any) => e?._tag === "Planetscale::NotReady",
+      schedule,
+    }),
+  ) as Effect.Effect<A, E, R>;
+
+/**
+ * Polls a branch via `getBranch` until it reports `ready === true`. Returns
+ * the final branch shape. `NotFound` during polling is treated as
+ * not-yet-ready (the branch is being provisioned by an upstream operation).
+ *
+ * If a `session` is supplied, each poll emits a note with elapsed seconds and
+ * expectation-setting so the CLI surfaces progress while we sit in the spaced
+ * retry loop.
+ */
+export const waitForBranchReady = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+  session?: ScopedPlanStatusSession,
+) {
+  const startedAt = yield* Clock.currentTimeMillis;
+  return yield* pollUntil(
+    `branch "${branch}" ready`,
+    Effect.gen(function* () {
+      if (session) {
+        const now = yield* Clock.currentTimeMillis;
+        const seconds = Math.floor((now - startedAt) / 1000);
+        yield* session.note(
+          `Waiting for branch to be ready... (${seconds} seconds elapsed; this can take a few minutes)`,
+        );
+      }
+      return yield* ops.getBranch({ organization, database, branch });
+    }).pipe(
+      Effect.catchTag("NotFound", () =>
+        Effect.fail(
+          new NotReady({ description: `branch "${branch}" not found yet` }),
+        ),
+      ),
+    ),
+    (data) => data.ready,
+  );
+});
+
+/**
+ * Polls a database via `getDatabase` until it reports `ready === true`.
+ * `NotFound` during polling is treated as not-yet-ready (the database is
+ * being provisioned by an upstream operation).
+ *
+ * If a `session` is supplied, each poll emits a note with elapsed seconds and
+ * expectation-setting so the CLI surfaces progress while we sit in the spaced
+ * retry loop.
+ */
+export const waitForDatabaseReady = Effect.fn(function* (
+  organization: string,
+  database: string,
+  session?: ScopedPlanStatusSession,
+) {
+  const startedAt = yield* Clock.currentTimeMillis;
+  return yield* pollUntil(
+    `database "${database}" ready`,
+    Effect.gen(function* () {
+      if (session) {
+        const now = yield* Clock.currentTimeMillis;
+        const seconds = Math.floor((now - startedAt) / 1000);
+        yield* session.note(
+          `Waiting for database to be ready... (${seconds} seconds elapsed; this can take a few minutes)`,
+        );
+      }
+      return yield* ops.getDatabase({ organization, database });
+    }).pipe(
+      Effect.catchTag("NotFound", () =>
+        Effect.fail(
+          new NotReady({
+            description: `database "${database}" not found yet`,
+          }),
+        ),
+      ),
+    ),
+    (data) => data.ready,
+  );
+});
+
+export const isKnownError =
+  (tag: string, message: string) => (error: unknown) =>
+    typeof error === "object" &&
+    error !== null &&
+    (error as { readonly _tag?: unknown })._tag === tag &&
+    (error as { readonly message?: unknown }).message === message;
+
+// todo: this repeats across Neon, D1, and PlanetScale resources so maybe we should move it to Diff? or Util?
+export const recordsEqual = (
+  a: Record<string, string>,
+  b: Record<string, string>,
+): boolean => {
+  const aKeys = Object.keys(a);
+  const bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (a[k] !== b[k]) return false;
+  }
+  return true;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Planetscale/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/index.ts
new file mode 100644
index 00000000000..ba333b6e4d5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Planetscale/index.ts
@@ -0,0 +1,18 @@
+export * as Auth from "./AuthProvider.ts";
+export {
+  type BaseBranchAttributes,
+  type BaseBranchProps,
+  makeBranchProvider,
+} from "./Branch.ts";
+export {
+  Credentials,
+  CredentialsFromEnv,
+  DEFAULT_API_BASE_URL,
+  fromAuthProvider,
+  fromToken,
+} from "./Credentials.ts";
+export * from "./Database.ts";
+export * from "./MySQL/index.ts";
+export * from "./Postgres/index.ts";
+export * from "./Providers.ts";
+export * from "./Util.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Platform.ts b/.repos/alchemy-effect/packages/alchemy/src/Platform.ts
new file mode 100644
index 00000000000..0691e8e8fe3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Platform.ts
@@ -0,0 +1,464 @@
+import * as ConfigError from "effect/Config";
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { pipe } from "effect/Function";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import type { Scope } from "effect/Scope";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import { SingleShotGen } from "effect/Utils";
+import type { PolicyLike } from "./Binding.ts";
+import type { Dependencies } from "./Dependencies.ts";
+import type { ExecutionContext } from "./ExecutionContext.ts";
+import type { HttpEffect } from "./Http.ts";
+import type { InputProps } from "./Input.ts";
+import * as Output from "./Output.ts";
+import { ALCHEMY_PHASE } from "./Phase.ts";
+import type { Provider, ProviderCollectionLike } from "./Provider.ts";
+import { Resource, type ResourceLike } from "./Resource.ts";
+import type { Rpc } from "./Rpc.ts";
+import {
+  CurrentRuntimeContext,
+  RuntimeContext,
+  sanitizeKey,
+  type BaseRuntimeContext,
+} from "./RuntimeContext.ts";
+import { Self } from "./Self.ts";
+import type { Stack, StackServices } from "./Stack.ts";
+import type { Stage } from "./Stage.ts";
+import { effectClass } from "./Util/effect.ts";
+
+export interface PlatformProps {
+  /**
+   * @internal type used to signal when this is an effect-native implementation
+   * @default false
+   */
+  isExternal?: boolean;
+}
+
+export type Main<InitServices = never> = void | {
+  fetch:
+    | HttpEffect<InitServices | PlatformServices>
+    | Effect.Effect<
+        HttpEffect<InitServices | PlatformServices>,
+        never,
+        InitServices | PlatformServices
+      >;
+};
+
+// services provided to the Resource
+export type PlatformServices =
+  | RuntimeContext
+  | ExecutionContext
+  | HttpClient
+  | PolicyLike
+  | Provider<any>
+  | ProviderCollectionLike
+  | Scope
+  | Stack
+  | StackServices
+  | Stage;
+
+export interface Platform<
+  Resource extends ResourceLike<string, PlatformProps>,
+  Services,
+  MainShape,
+  RuntimeContext extends BaseRuntimeContext,
+  BaseShape = {},
+> extends Effect.Effect<Resource & RuntimeContext, never, Resource> {
+  Type: Resource["Type"];
+  Provider: Provider<Resource>;
+
+  <Self, Shape, Deps = never>(): {
+    <PropsReq = never>(
+      id: string,
+      props:
+        | InputProps<Resource["Props"]>
+        | Effect.Effect<InputProps<Resource["Props"]>, never, PropsReq>,
+    ): Effect.Effect<
+      Resource & Rpc<Self> & Dependencies<Deps>,
+      never,
+      Resource["Providers"] | PropsReq
+    > & {
+      make<InitReq = never>(
+        impl: Effect.Effect<Shape, ConfigError.ConfigError, InitReq>,
+      ): Layer.Layer<
+        Self,
+        never,
+        | Resource["Providers"]
+        | Exclude<PropsReq | InitReq, Services | PlatformServices | Resource>
+      >;
+      new (_: never): MakeShape<Shape, BaseShape>;
+      of(shape: Shape & MainShape): MakeShape<Shape, BaseShape>;
+    };
+  };
+  <Self>(): {
+    <
+      Shape extends MainShape,
+      PropsReq = never,
+      InitReq extends Services | PlatformServices | Resource = never,
+    >(
+      id: string,
+      props:
+        | InputProps<Resource["Props"]>
+        | Effect.Effect<Resource["Props"], never, PropsReq>,
+      impl: Effect.Effect<Shape, ConfigError.ConfigError, InitReq>,
+    ): Effect.Effect<
+      Resource & Rpc<Self>,
+      never,
+      | Resource["Providers"]
+      | PropsReq
+      | Exclude<InitReq, Services | PlatformServices | Resource>
+    > & {
+      new (_: never): MakeShape<Shape, BaseShape>;
+    };
+    <Shape, PropsReq = never>(
+      id: string,
+      props:
+        | InputProps<Resource["Props"]>
+        | Effect.Effect<InputProps<Resource["Props"]>, never, PropsReq>,
+    ): Effect.Effect<
+      Resource & Rpc<Self>,
+      never,
+      Resource["Providers"] | PropsReq
+    > & {
+      make<InitReq extends Services | PlatformServices | Resource = never>(
+        impl: Effect.Effect<Shape, ConfigError.ConfigError, InitReq>,
+      ): Layer.Layer<
+        Self,
+        never,
+        | Resource["Providers"]
+        | Exclude<PropsReq | InitReq, Services | PlatformServices | Resource>
+      >;
+      new (_: never): MakeShape<Shape, BaseShape>;
+    } & (<InitReq extends Services | PlatformServices | Resource = never>(
+        impl: Effect.Effect<Shape, never, InitReq>,
+      ) => Effect.Effect<
+        Resource & Rpc<Self>,
+        never,
+        | Resource["Providers"]
+        | PropsReq
+        | Exclude<InitReq, Services | PlatformServices | Resource>
+      >);
+  };
+  // <PropsReq = never, InitReq extends Services | PlatformServices = never>(
+  //   id: string,
+  //   props:
+  //     | InputProps<Resource["Props"]>
+  //     | Effect.Effect<InputProps<Resource["Props"]>, never, PropsReq>,
+  // ): Effect.Effect<
+  //   Resource,
+  //   never,
+  //   | Resource["Providers"]
+  //   | PropsReq
+  //   | Exclude<InitReq, Services | PlatformServices>
+  // >;
+  <
+    Shape extends MainShape,
+    PropsReq = never,
+    InitReq extends Services | PlatformServices = never,
+  >(
+    id: string,
+    props:
+      | InputProps<Resource["Props"]>
+      | Effect.Effect<InputProps<Resource["Props"]>, never, PropsReq>,
+    impl: Effect.Effect<Shape, ConfigError.ConfigError, InitReq>,
+  ): Effect.Effect<
+    Resource & Rpc<Shape>,
+    never,
+    | Resource["Providers"]
+    | PropsReq
+    | Exclude<InitReq, Services | PlatformServices>
+  >;
+}
+
+type MakeShape<Shape, BaseShape> = Shape extends never | undefined | void
+  ? BaseShape
+  : Shape & BaseShape;
+
+export const Platform = <
+  R extends ResourceLike<
+    string,
+    | {
+        env?: Record<string, any>;
+        exports?: string[] | Record<string, any>;
+      }
+    | undefined
+  >,
+>(
+  type: R["Type"],
+  hooks: {
+    createRuntimeContext: (id: string) => BaseRuntimeContext;
+    onCreate?: (resource: R, props: any) => Effect.Effect<void>;
+  },
+  methods?: { [key: string]: any },
+): any => {
+  type Props = any;
+  type Impl = Effect.Effect<any>;
+
+  const resource = Resource(type);
+  const PlatformContext = RuntimeContext;
+
+  const constructor = (
+    id?: string,
+    props?: any,
+    impl?: Impl,
+    isTag = false,
+  ): any => {
+    if (!id) {
+      // impl was not provided inline, this is a tagged instance
+      // e.g.
+      // export class Sandbox extends Cloudflare.Container<Sandbox>()(..) {}
+      //
+      // export const SandboxLive = Sandbox.make(..)
+      return (id: string, props?: any, impl?: Impl) =>
+        constructor(id, props, impl, true);
+    } else if (!impl) {
+      const cls = makeClass(id, props);
+      const asEffect = () =>
+        (!isTag
+          ? // this is a non-tagged resource yielded without providing an implementation
+            // e.g.
+            // yield* Cloudflare.Worker("id", { main: "./src/worker.ts" })
+            //
+            // This is where we bridge to non-effect, e.g. bundling an ordinary worker
+            // export default {
+            //   fetch: (request: Request) => {
+            //     return new Response("Hello, world!");
+            //   }
+            // }
+            resource(
+              id,
+              Effect.isEffect(props)
+                ? Effect.map(props, (p: any) => ({ ...p, isExternal: true }))
+                : {
+                    ...props,
+                    isExternal: true,
+                  },
+            )
+          : Effect.flatMap(
+              // this is a tagged resource
+              Effect.serviceOption(cls.Self),
+              Option.match({
+                // we are likely running at runtime, so we create
+                onNone: () => resource(id, props),
+                onSome: Effect.succeed,
+              }),
+            )
+        ).pipe(
+          Effect.tap((resource) =>
+            hooks.onCreate
+              ? Effect.flatMap(
+                  // `props` may itself be an Effect (e.g. when wrapped by
+                  // `Cloudflare.Vite` via `Effect.map`); resolve it before
+                  // handing it to the hook so `onCreate` always sees the
+                  // plain props object — the second call site (in
+                  // `cls.make`) already does this.
+                  Effect.isEffect(props) ? props : Effect.succeed(props ?? {}),
+                  (resolved) => hooks.onCreate!(resource as R, resolved),
+                )
+              : Effect.void,
+          ),
+        );
+      return Object.assign(
+        function (impl: Impl) {
+          return cls.asEffect().pipe(Effect.provide(cls.make(impl)));
+        },
+        // we splice in the Effect so this can be yielded to indicate a non-Effect native instance
+        // e.g. here, we yield it - in this case we don't want to provide an implementation
+        // const worker = yield* Cloudflare.Worker("id", {
+        //  main: "./src/worker.ts"
+        // });
+        cls,
+        {
+          asEffect,
+          // @ts-expect-error
+          pipe: (...args: any[]) => asEffect().pipe(...args),
+          [Symbol.iterator]: () => new SingleShotGen(asEffect()),
+        },
+      );
+    } else {
+      // impl was provided inline, this is a non-tagged eager instance
+      // e.g.
+      // export default Cloudflare.Worker("id", { main: "./src/worker.ts" }, Effect.gen(function* () { .. })
+      const cls = makeClass(id, props);
+      return cls.asEffect().pipe(Effect.provide(cls.make(impl)), effectClass);
+    }
+  };
+
+  const makeClass = (id: string, props: Props) => {
+    return class Platform {
+      static readonly Self = Self(`${type}<${id}>`);
+      static readonly Platform = Context.Service<Platform, Platform>(
+        `Platform<${type}<${id}>>`,
+      );
+      static [Symbol.iterator](): Iterator<
+        Effect.Effect<void, never, Self>,
+        Resource,
+        void
+      > {
+        return new SingleShotGen(this.asEffect()) as any;
+      }
+      static asEffect() {
+        return this.Self;
+      }
+      static pipe(...args: any[]) {
+        // @ts-expect-error
+        return pipe(this, ...args);
+      }
+      static of = (shape: any) => shape;
+      static make = (impl: Impl) => {
+        // build the Layer once for the root Self
+        const SelfLayer = Layer.effect(
+          Self,
+          Effect.flatMap(
+            Effect.all([
+              Effect.isEffect(props) ? props : Effect.succeed(props ?? {}),
+              Effect.sync(() => hooks.createRuntimeContext(id)),
+              Effect.context<never>(),
+            ]),
+            Effect.fnUntraced(function* ([
+              props,
+              runtimeContext,
+              outerServices,
+            ]) {
+              const instance = Object.assign(
+                yield* resource(id, props as any).pipe(
+                  Effect.flatMap(
+                    (resource) =>
+                      hooks
+                        .onCreate?.(resource, props)
+                        .pipe(Effect.map(() => resource)) ??
+                      Effect.succeed(resource),
+                  ),
+                ),
+                runtimeContext,
+              );
+
+              yield* impl.pipe(
+                Effect.flatMap((impl) =>
+                  impl?.fetch
+                    ? // Hand the full impl to `serve` so the runtime can
+                      // expose any non-handler methods on the impl shape
+                      // (e.g. RPC methods on a Cloudflare Worker) alongside
+                      // the standard `fetch` handler.
+                      (runtimeContext.serve?.(impl.fetch, {
+                        shape: impl as Record<string, unknown>,
+                      }) ?? Effect.die("No serve handler"))
+                    : Effect.void,
+                ),
+
+                Effect.provide(
+                  Layer.effect(
+                    ConfigProvider.ConfigProvider,
+                    Effect.gen(function* () {
+                      // a Config Provider that we use to intercept config lookups and bind them to the RuntimeContext
+                      const configProvider =
+                        yield* ConfigProvider.ConfigProvider;
+                      const phase = yield* ALCHEMY_PHASE;
+
+                      return ConfigProvider.make(
+                        Effect.fnUntraced(function* (path) {
+                          const ctx = yield* CurrentRuntimeContext;
+                          // `set`/`get` store keys verbatim, so canonicalize the
+                          // logical config path here (the caller's job) before
+                          // handing it to the RuntimeContext.
+                          const key = sanitizeKey(
+                            path.map((p) => p.toString()).join("_"),
+                          );
+                          const node = yield* configProvider.get(path);
+                          if (phase === "plan" && node) {
+                            // bind it to the RuntimeContext if running in plan phase
+                            const output = Output.literal(
+                              Redacted.make(node.value),
+                            );
+                            yield* ctx?.set(key, output) ?? Effect.void;
+                            return node;
+                          } else if (phase === "runtime" && ctx) {
+                            // retrieve from the RuntimeContext if running in runtime phase
+                            const value =
+                              yield* ctx.get<Redacted.Redacted<string>>(key);
+                            if (value) {
+                              return ConfigProvider.makeValue(
+                                Redacted.isRedacted(value)
+                                  ? Redacted.value(value)
+                                  : value,
+                              );
+                            }
+                          }
+                          // fallback to the config provider otherwise
+                          return node;
+                        }),
+                      );
+                    }),
+                  ).pipe(
+                    Layer.provideMerge(
+                      Layer.mergeAll(
+                        Layer.succeed(Platform.Platform, runtimeContext),
+                        Layer.succeed(PlatformContext, runtimeContext),
+                        Layer.succeed(RuntimeContext, runtimeContext),
+                        Layer.succeed(resource.Self, instance),
+                        Layer.succeed(Platform.Self, instance),
+                        Layer.succeed(Self, instance),
+                        runtimeContext.planServices
+                          ? Layer.unwrap(
+                              ALCHEMY_PHASE.pipe(
+                                Effect.map((phase) =>
+                                  phase === "plan"
+                                    ? runtimeContext.planServices!
+                                    : Layer.empty,
+                                ),
+                              ),
+                            )
+                          : Layer.empty,
+                      ),
+                    ),
+                    Layer.provideMerge(Layer.succeedContext(outerServices)),
+                  ),
+                ),
+              );
+
+              instance.Props = {
+                ...props,
+                env: {
+                  ...props?.env,
+                  ...runtimeContext.env,
+                },
+                exports: runtimeContext.exports
+                  ? yield* runtimeContext.exports
+                  : undefined,
+              };
+
+              return Object.assign(instance, {
+                RuntimeContext: runtimeContext,
+              }) as R;
+            }),
+          ),
+        );
+        const self = Self as any; // TODO(sam): why do we need to cast?
+
+        return Layer.provideMerge(
+          Layer.mergeAll(
+            // sets the Context for all self-hierarchies
+            // Self
+            // Self<Cloudflare.Worker>
+            // Self<Cloudflare.Worker<Api>>
+            Layer.effect(Self<R>(type), self),
+            Layer.effect(Self<R>(`${type}<${id}>`), self),
+          ),
+          // provide here so we build once and just mirror
+          SelfLayer,
+        );
+      };
+    };
+  };
+
+  const instance = Object.assign(constructor, resource, {
+    Platform: Platform,
+    asEffect: () => resource.Self,
+    ...methods,
+  }) as any;
+  return instance;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Provider.ts b/.repos/alchemy-effect/packages/alchemy/src/Provider.ts
new file mode 100644
index 00000000000..ea81c60cff9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Provider.ts
@@ -0,0 +1,396 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import type * as Stream from "effect/Stream";
+import type { Artifacts } from "./Artifacts.ts";
+import type { Policy } from "./Binding.ts";
+import type { ScopedPlanStatusSession } from "./Cli/Cli.ts";
+import type { Diff } from "./Diff.ts";
+import type { Input } from "./Input.ts";
+import type { InstanceId } from "./InstanceId.ts";
+import type { Platform } from "./Platform.ts";
+import type {
+  ResourceBinding,
+  ResourceClass,
+  ResourceLike,
+} from "./Resource.ts";
+
+export interface Provider<
+  R extends ResourceLike = ResourceLike,
+> extends Effect.Effect<ProviderService<R>, never, Provider<R>> {
+  asEffect: () => Effect.Effect<ProviderService<R>, never, Provider<R>>;
+  [Symbol.iterator]: () => Effect.EffectIterator<Provider<R>>;
+  of: <
+    ReadReq = never,
+    DiffReq = never,
+    PrecreateReq = never,
+    ReconcileReq = never,
+    DeleteReq = never,
+    TailReq = never,
+    LogsReq = never,
+  >(
+    service: Omit<
+      ProviderService<
+        R,
+        ReadReq,
+        DiffReq,
+        PrecreateReq,
+        ReconcileReq,
+        DeleteReq,
+        TailReq,
+        LogsReq
+      >,
+      "Type"
+    >,
+  ) => ProviderService<
+    R,
+    ReadReq,
+    DiffReq,
+    PrecreateReq,
+    ReconcileReq,
+    DeleteReq,
+    TailReq,
+    LogsReq
+  >;
+}
+
+type LifecycleServices = InstanceId | Artifacts;
+
+export const Provider = <R extends ResourceLike>(
+  type: R["Type"],
+): Provider<R> =>
+  Context.Service<Provider<R>, ProviderService<R>>()(type) as any;
+
+type BindingData<Res extends ResourceLike> = [Res] extends [
+  { Binding: infer B },
+]
+  ? ResourceBinding<B>[]
+  : any[];
+
+type Props<Res extends ResourceLike> = keyof Res["Props"] extends never
+  ? Res["Props"] | undefined
+  : Res["Props"];
+
+export interface LogLine {
+  timestamp: Date;
+  message: string;
+}
+
+export interface LogsInput {
+  since?: Date;
+  limit?: number;
+}
+
+export interface ProviderService<
+  Res extends ResourceLike = ResourceLike,
+  ReadReq = never,
+  DiffReq = never,
+  PrecreateReq = never,
+  ReconcileReq = never,
+  DeleteReq = never,
+  TailReq = never,
+  LogsReq = never,
+> {
+  /**
+   * The version of the provider.
+   *
+   * @default 0
+   */
+  version?: number;
+  /**
+   * Returns a stream of log lines for a deployed resource.
+   * Used by `alchemy tail` to stream real-time logs.
+   */
+  tail?(input: {
+    id: string;
+    instanceId: string;
+    props: Props<Res>;
+    output: Res["Attributes"];
+  }): Stream.Stream<LogLine, any, TailReq>;
+  /**
+   * Queries historical logs for a deployed resource.
+   * Used by `alchemy logs` to fetch past log entries.
+   */
+  logs?(input: {
+    id: string;
+    instanceId: string;
+    props: Props<Res>;
+    output: Res["Attributes"];
+    options: LogsInput;
+  }): Effect.Effect<LogLine[], any, LogsReq>;
+  // watch();
+  // replace(): Effect.Effect<void, never, never>;
+  // different interface that is persistent, watching, reloads
+  // run?() {}
+  // branch?() {}
+  read?(input: {
+    id: string;
+    instanceId: string;
+    olds: Props<Res>;
+    // what is the ARN?
+    output: Res["Attributes"] | undefined; // current state -> synced state
+  }): Effect.Effect<Res["Attributes"] | undefined, any, ReadReq>;
+  /**
+   * Properties that are always stable across any update.
+   */
+  stables?: Extract<keyof Res["Attributes"], string>[];
+  diff?(input: {
+    id: string;
+    instanceId: string;
+    olds: Props<Res>;
+    // Note: we do not resolve (Res["Props"]) here because diff runs during plan
+    // -> we need a way for the diff handlers to work with Outputs
+    news: Input<Props<Res>>;
+    oldBindings: BindingData<Res>;
+    newBindings: Input<BindingData<Res>>;
+    output: Res["Attributes"] | undefined;
+  }): Effect.Effect<Diff | void, any, DiffReq>;
+  // dev?:() => Effect.Effect<void, any, DevReq>;
+  precreate?(input: {
+    id: string;
+    news: Props<Res>;
+    instanceId: string;
+    session: ScopedPlanStatusSession;
+    bindings: BindingData<Res>;
+  }): Effect.Effect<Res["Attributes"], any, PrecreateReq>;
+  /**
+   * Reconciles the desired state of a Resource with the live cloud state.
+   *
+   * This unified lifecycle method replaces the previous `create` and `update`
+   * pair. The engine dispatches `reconcile` for both intents — initial
+   * provisioning and subsequent updates — and providers must defensively
+   * handle every combination of inputs:
+   *
+   * - `output === undefined` and `olds === undefined` — first reconciliation
+   *   for this logical resource. Treat as a create. Must remain idempotent
+   *   because state persistence can fail after a successful API call.
+   * - `output !== undefined` and `olds === undefined` — engine adopted an
+   *   existing cloud resource (via {@link read}). The provider has never
+   *   written this resource through Alchemy before, so cannot rely on prior
+   *   props as a baseline.
+   * - `output !== undefined` and `olds !== undefined` — standard update
+   *   path with a known prior state.
+   *
+   * Ownership has already been verified upstream — by the time `reconcile`
+   * runs, the engine has confirmed (via `read` returning a non-`Unowned`
+   * value, or by writing the resource itself) that mutation is safe.
+   */
+  reconcile(input: {
+    id: string;
+    instanceId: string;
+    news: Props<Res>;
+    olds: Props<Res> | undefined;
+    output: Res["Attributes"] | undefined;
+    session: ScopedPlanStatusSession;
+    bindings: BindingData<Res>;
+  }): Effect.Effect<Res["Attributes"], any, ReconcileReq>;
+  delete(input: {
+    id: string;
+    instanceId: string;
+    olds: Props<Res>;
+    output: Res["Attributes"];
+    session: ScopedPlanStatusSession;
+    bindings: BindingData<Res>;
+  }): Effect.Effect<void, any, DeleteReq>;
+}
+
+export const effect = <
+  R extends ResourceLike,
+  Req = never,
+  ReadReq = never,
+  DiffReq = never,
+  PrecreateReq = never,
+  ReconcileReq = never,
+  DeleteReq = never,
+  TailReq = never,
+  LogsReq = never,
+>(
+  cls: ResourceClass<R> | Platform<R, any, any, any, any>,
+  eff: Effect.Effect<
+    ProviderService<
+      R,
+      ReadReq,
+      DiffReq,
+      PrecreateReq,
+      ReconcileReq,
+      DeleteReq,
+      TailReq,
+      LogsReq
+    >,
+    never,
+    Req
+  >,
+): Layer.Layer<
+  Provider<R>,
+  never,
+  Exclude<
+    Req | ReadReq | DiffReq | PrecreateReq | ReconcileReq | DeleteReq,
+    LifecycleServices
+  >
+> =>
+  // @ts-expect-error
+  Layer.effect(Provider(cls.Type), eff);
+
+export const succeed = <
+  R extends ResourceLike,
+  ReadReq = never,
+  DiffReq = never,
+  PrecreateReq = never,
+  ReconcileReq = never,
+  DeleteReq = never,
+  TailReq = never,
+  LogsReq = never,
+>(
+  cls: ResourceClass<R> | Platform<R, any, any, any, any>,
+  service: ProviderService<
+    R,
+    ReadReq,
+    DiffReq,
+    PrecreateReq,
+    ReconcileReq,
+    DeleteReq,
+    TailReq,
+    LogsReq
+  >,
+): Layer.Layer<
+  Provider<R>,
+  never,
+  Exclude<
+    ReadReq | DiffReq | PrecreateReq | ReconcileReq | DeleteReq,
+    LifecycleServices
+  >
+> =>
+  // @ts-expect-error
+  Layer.succeed(Provider(cls.Type), service);
+
+export interface ProviderCollectionLike {
+  kind: "ProviderCollection";
+}
+
+export interface ProviderCollectionShape<Identifier extends string>
+  extends
+    Context.ServiceClass.Shape<Identifier, ProviderCollectionService>,
+    ProviderCollectionLike {}
+
+export interface ProviderCollection<Self, Identifier extends string>
+  extends
+    Context.Service<Self, ProviderCollectionService>,
+    ProviderCollectionLike {
+  readonly key: Identifier;
+  new (_: never): ProviderCollectionShape<Identifier>;
+}
+
+export const ProviderCollection =
+  <Self>() =>
+  <const ProviderId extends string>(id: ProviderId) =>
+    Context.Service<Self, ProviderCollectionService>()(
+      id,
+    ) as ProviderCollection<Self, ProviderId>;
+
+export interface ProviderCollectionService {
+  kind: "ProviderCollection";
+  get<Resource extends ResourceLike>(
+    service: string,
+  ): ProviderService<Resource> | undefined;
+}
+
+export const collection = <
+  R extends
+    | ResourceClass<any>
+    | Platform<any, any, any, any, any>
+    | Policy<any, any, any>,
+>(
+  resources: R[],
+): Effect.Effect<
+  ProviderCollectionService,
+  never,
+  R extends ResourceClass<infer R> | Platform<infer R, any, any, any, any>
+    ? Provider<R>
+    : R extends Policy<infer Self, infer _I, infer _S>
+      ? Self
+      : never
+> =>
+  Effect.gen(function* () {
+    const context = yield* Effect.context();
+
+    const providers = Object.fromEntries(
+      yield* Effect.all(
+        resources.map((resource) =>
+          "Provider" in resource
+            ? resource.Provider.pipe(
+                Effect.map((provider) => [resource.Type, provider] as const),
+              )
+            : Effect.succeed([
+                resource.key,
+                context.mapUnsafe.get(resource.key),
+              ] as const),
+        ),
+        { concurrency: "unbounded" },
+      ),
+    );
+
+    return {
+      kind: "ProviderCollection" as const,
+      get: (service: string) => providers[service],
+    };
+  }) as any;
+
+const isProviderCollectionService = (
+  value: unknown,
+): value is ProviderCollectionService => {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "kind" in value &&
+    value.kind === "ProviderCollection"
+  );
+};
+
+export const findProviderByType: {
+  <R extends ResourceLike>(
+    resourceType: R["Type"],
+  ): Effect.Effect<ProviderService<R>>;
+  <P extends Policy<any, any, any>>(
+    policyType: P["key"],
+  ): Effect.Effect<Effect.Success<P>>;
+} = (type: string) =>
+  tryFindProviderByType(type).pipe(
+    Effect.flatMap(
+      Option.match({
+        onNone: () => Effect.die(`Provider not found for ${type}`),
+        onSome: (provider) => Effect.succeed(provider),
+      }),
+    ),
+  );
+
+export const tryFindProviderByType: {
+  <R extends ResourceLike>(
+    resourceType: R["Type"],
+  ): Effect.Effect<Option.Option<ProviderService<R>>>;
+  <P extends Policy<any, any, any>>(
+    policyType: P["key"],
+  ): Effect.Effect<Option.Option<Effect.Success<P>>>;
+} = Effect.fnUntraced(function* <R extends ResourceLike>(
+  resourceType: R["Type"],
+) {
+  const Tag = Provider<R>(resourceType) as unknown as Context.Service<
+    Provider<R>,
+    any
+  >;
+  const direct = yield* Effect.serviceOption(Tag);
+  if (Option.isSome(direct)) {
+    return direct;
+  }
+
+  const context = yield* Effect.context<never>();
+  for (const value of context.mapUnsafe.values()) {
+    if (isProviderCollectionService(value)) {
+      const provider = value.get(resourceType);
+      if (provider) {
+        return Option.some(provider);
+      }
+    }
+  }
+  return Option.none();
+}) as any;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Random.ts b/.repos/alchemy-effect/packages/alchemy/src/Random.ts
new file mode 100644
index 00000000000..55ac32373ce
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Random.ts
@@ -0,0 +1,60 @@
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Provider from "./Provider.ts";
+import { Resource } from "./Resource.ts";
+
+export interface RandomProps {
+  /**
+   * Number of random bytes to generate before hex encoding.
+   * @default 32
+   */
+  bytes?: number;
+}
+
+export type Random = Resource<
+  "Alchemy.Random",
+  RandomProps,
+  {
+    text: Redacted.Redacted<string>;
+  }
+>;
+
+export const makeRandom = (id: string, props?: RandomProps) =>
+  Random(id, props).pipe(Effect.map((rand) => rand.text));
+
+/**
+ * A deterministic-in-state random secret generator.
+ *
+ * The value is generated once on create and then persisted in state so
+ * subsequent deploys keep the same secret unless the resource is replaced.
+ */
+export const Random = Resource<Random>("Alchemy.Random");
+
+export const RandomProvider = () =>
+  Provider.succeed(Random, {
+    reconcile: ({ news = {}, output }) =>
+      Effect.sync(() => {
+        // Observe — there is no remote state. The cached `output.text` is
+        // the authoritative current value; once minted it is preserved
+        // across reconciles to keep the secret stable.
+        if (output?.text) {
+          return output;
+        }
+
+        // Ensure — no observed value: mint a fresh random secret and
+        // return it. The next reconcile will see this in `output` and
+        // short-circuit above.
+        const byteLength = news.bytes ?? 32;
+        const bytes = new Uint8Array(byteLength);
+        crypto.getRandomValues(bytes);
+        return {
+          text: Redacted.make(
+            Array.from(bytes)
+              .map((b) => b.toString(16).padStart(2, "0"))
+              .join(""),
+          ),
+        };
+      }),
+    delete: () => Effect.void,
+    read: ({ output }) => Effect.succeed(output),
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Ref.ts b/.repos/alchemy-effect/packages/alchemy/src/Ref.ts
new file mode 100644
index 00000000000..ba9174a9d54
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Ref.ts
@@ -0,0 +1,51 @@
+import * as Output from "./Output.ts";
+import type { ResourceLike } from "./Resource.ts";
+
+// special runtime-only symbol for probing the Ref proxy for its metadata
+const RefMetadata = Symbol.for("alchemy/RefMetadata");
+
+export const isRef = (s: any): s is Ref<any> =>
+  s && s[RefMetadata] !== undefined;
+
+export const getRefMetadata = <R extends ResourceLike>(
+  ref: Ref<R>,
+): RefMetadata<R> => (ref as any)[RefMetadata];
+
+export interface Ref<R extends ResourceLike = ResourceLike> {
+  /** @internal phantom */
+  Ref: R;
+}
+
+export interface RefMetadata<R extends ResourceLike> {
+  id: R["LogicalId"];
+  stack?: string;
+  stage?: string;
+}
+
+export const ref = <R extends ResourceLike>(
+  id: string,
+  {
+    stack,
+    stage,
+  }: {
+    stack?: string;
+    stage?: string;
+  } = {},
+): Ref<R> => {
+  const ref = new Proxy(
+    {},
+    {
+      get: (_, prop) => {
+        if (prop === RefMetadata) {
+          return {
+            stack,
+            stage,
+            id,
+          } satisfies RefMetadata<R>;
+        }
+        return (Output.of(ref) as any)[prop];
+      },
+    },
+  ) as Ref<R>;
+  return ref;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/RemovalPolicy.ts b/.repos/alchemy-effect/packages/alchemy/src/RemovalPolicy.ts
new file mode 100644
index 00000000000..de60a73e553
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/RemovalPolicy.ts
@@ -0,0 +1,51 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+
+export class RemovalPolicy extends Context.Service<
+  RemovalPolicy,
+  "retain" | "destroy"
+>()("RemovalPolicy") {}
+
+export const retain: {
+  (
+    enabled?: boolean,
+  ): <R, Req = never>(
+    enabled: Effect.Effect<R, never, Req>,
+  ) => Effect.Effect<R, never, Req>;
+  <Req = never>(
+    enabled: Effect.Effect<boolean, never, Req>,
+  ): <R, Req2 = never>(
+    a: Effect.Effect<R, never, Req2>,
+  ) => Effect.Effect<R, never, Req | Req2>;
+} = ((enabled: boolean | Effect.Effect<boolean, never, any> = true) =>
+  (eff: Effect.Effect<any, never, any>) =>
+    eff.pipe(
+      typeof enabled === "boolean"
+        ? Effect.provideService(RemovalPolicy, enabled ? "retain" : "destroy")
+        : Effect.provideServiceEffect(
+            RemovalPolicy,
+            enabled.pipe(Effect.map((a) => (a ? "retain" : "destroy"))),
+          ),
+    )) as any;
+
+export const destroy: {
+  (
+    enabled?: boolean,
+  ): <R, Req = never>(
+    enabled: Effect.Effect<R, never, Req>,
+  ) => Effect.Effect<R, never, Req>;
+  <Req = never>(
+    enabled: Effect.Effect<boolean, never, Req>,
+  ): <R, Req2 = never>(
+    a: Effect.Effect<R, never, Req2>,
+  ) => Effect.Effect<R, never, Req | Req2>;
+} = ((enabled: boolean | Effect.Effect<boolean, never, any> = true) =>
+  (eff: Effect.Effect<any, never, any>) =>
+    eff.pipe(
+      typeof enabled === "boolean"
+        ? Effect.provideService(RemovalPolicy, enabled ? "destroy" : "retain")
+        : Effect.provideServiceEffect(
+            RemovalPolicy,
+            enabled.pipe(Effect.map((a) => (a ? "destroy" : "retain"))),
+          ),
+    )) as any;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Resource.ts b/.repos/alchemy-effect/packages/alchemy/src/Resource.ts
new file mode 100644
index 00000000000..434bd0b74f1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Resource.ts
@@ -0,0 +1,319 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { pipeArguments, type Pipeable } from "effect/Pipeable";
+import { SingleShotGen } from "effect/Utils";
+import { toFqn } from "./FQN.ts";
+import type { Input, InputProps } from "./Input.ts";
+import { CurrentNamespace, type NamespaceNode } from "./Namespace.ts";
+import * as Output from "./Output.ts";
+import { Provider } from "./Provider.ts";
+import { ref as makeRef } from "./Ref.ts";
+import { RemovalPolicy } from "./RemovalPolicy.ts";
+import { Self } from "./Self.ts";
+import { Stack } from "./Stack.ts";
+
+export type ResourceConstructor<R extends ResourceLike, Req = never> = {
+  Type: R["Type"];
+  Props: R["Props"];
+  <const Methods extends { [key: string]: any }>(
+    methods: Methods,
+  ): ResourceClassWithMethods<R, Methods>;
+  (
+    id: string,
+    ...args: {} extends R["Props"]
+      ? [
+          props?: {
+            [prop in keyof R["Props"]]: Input<R["Props"][prop]>;
+          },
+        ]
+      : [
+          props: {
+            [prop in keyof R["Props"]]: Input<R["Props"][prop]>;
+          },
+        ]
+  ): Effect.Effect<R, never, Req>;
+  <PropsReq = never>(
+    id: string,
+    props: Effect.Effect<InputProps<R["Props"]>, never, PropsReq>,
+  ): Effect.Effect<R, never, PropsReq | Req>;
+};
+
+export type ResourceClassWithMethods<
+  R extends ResourceLike,
+  Methods extends { [key: string]: any },
+> = ResourceConstructor<
+  R,
+  R["Providers"] extends undefined ? Provider<R> : R["Providers"]
+> &
+  Effect.Effect<ResourceConstructor<R>> & {
+    Self: Self<R>;
+    Provider: Provider<R>;
+    ref(
+      id: string,
+      options?: { stage?: string; stack?: string },
+    ): Effect.Effect<R>;
+  } & Methods;
+
+export type ResourceClass<R extends ResourceLike> = ResourceConstructor<
+  R,
+  R["Providers"] extends undefined ? Provider<R> : R["Providers"]
+> &
+  Effect.Effect<ResourceConstructor<R>> & {
+    Self: Self<R>;
+    Provider: Provider<R>;
+    ref(
+      id: string,
+      options?: { stage?: string; stack?: string },
+    ): Effect.Effect<R>;
+  };
+
+export type LogicalId = string;
+
+export interface ResourceBinding<Data = any> {
+  sid: string;
+  data: Data;
+}
+
+export interface ResourceLike<
+  Type extends string = string,
+  Props extends object | undefined = any,
+  Attributes extends object = object,
+  Binding = any,
+  Providers = any,
+> {
+  /**
+   * Namespace containing this Resource.
+   */
+  Namespace: NamespaceNode | undefined;
+  /**
+   * Fully Qualified Name (namespace path + logical ID).
+   * Used as the unique key for state storage.
+   */
+  FQN: string;
+  /**
+   * Type of the Resource (e.g. AWS.Lambda.Function)
+   */
+  Type: Type;
+  /**
+   * Logical ID of the Resource (e.g. MyFunction)
+   */
+  LogicalId: LogicalId;
+  /**
+   * Properties of the Resource.
+   */
+  Props: Props;
+  /**
+   * Removal Policy of the Resource.
+   */
+  RemovalPolicy: RemovalPolicy["Service"];
+  /** @internal phantom */
+  Attributes: Attributes;
+  /** @internal phantom */
+  Binding: Binding;
+  /** @internal phantom */
+  Providers: Providers;
+}
+
+export const isResource = (value: any): value is ResourceLike => {
+  return typeof value === "object" && value !== null && "Type" in value;
+};
+
+export type Resource<
+  Type extends string = any,
+  Props extends object | undefined = any,
+  Attributes extends object = any,
+  Binding = never,
+  Providers = undefined,
+> = Pipeable &
+  ResourceLike<Type, Props, Attributes, Binding, Providers> & {
+    bind(sid: Input<string>, binding: Input<Binding>): Effect.Effect<void>;
+    bind(
+      template: TemplateStringsArray,
+      ...args: any[]
+    ): (binding: Input<Binding>) => Effect.Effect<void>;
+  } & {
+    [attr in keyof Attributes]-?: Output.Output<Attributes[attr], never>;
+  };
+
+export interface ResourceOptions {
+  /**
+   * Default removal policy for this resource type when the caller has not
+   * explicitly provided one via `RemovalPolicy` / `destroy()` / `retain()`.
+   *
+   * Useful for resources that wrap unrecoverable real-world identifiers
+   * (DNS zones, customer accounts, etc.) where the safe default is to
+   * leave the cloud object alone on stack destroy.
+   *
+   * @default "destroy"
+   */
+  defaultRemovalPolicy?: RemovalPolicy["Service"];
+}
+
+/**
+ * Creates a resource constructor for a concrete resource type.
+ *
+ * The returned constructor registers the resource on the current stack,
+ * resolves input props, exposes output attributes as `Output` expressions, and
+ * records bindings contributed by policies and event sources. Resource
+ * providers are attached separately through `.provider`.
+ */
+export function Resource<R extends ResourceLike>(
+  type: R["Type"],
+  options?: ResourceOptions,
+): ResourceClass<R> {
+  const defaultRemovalPolicy = options?.defaultRemovalPolicy ?? "destroy";
+  type Props = Input<R["Props"]>;
+  const self = Self<R>(type);
+  const constructor = (
+    id: string,
+    props: Props | Effect.Effect<Props> | undefined,
+  ) =>
+    Effect.gen(function* () {
+      const stack = yield* Stack;
+      const namespace = yield* CurrentNamespace;
+      const fqn = toFqn(namespace, id);
+
+      const existing = stack.resources[fqn];
+      if (existing) {
+        // // TODO(sam): check if props are different and die
+        return existing;
+      }
+      const bind = (
+        ...args:
+          | [sid: string, data: R["Binding"]]
+          | [template: TemplateStringsArray, ...args: any[]]
+      ) =>
+        typeof args[0] === "string"
+          ? Effect.gen(function* () {
+              const [sid, data] = args as [sid: string, data: R["Binding"]];
+              (stack.bindings[fqn] ??= []).push({
+                sid,
+                data,
+              });
+              return undefined;
+            })
+          : (data: R["Binding"]) => {
+              const stringifyBindArg = (arg: any): string | undefined => {
+                if (arg === undefined) {
+                  return undefined;
+                }
+
+                if (Array.isArray(arg)) {
+                  return arg
+                    .flatMap((item) => {
+                      const stringified = stringifyBindArg(item);
+                      return stringified === undefined ? [] : [stringified];
+                    })
+                    .join(", ");
+                }
+
+                if (
+                  arg &&
+                  (typeof arg === "object" || typeof arg === "function")
+                ) {
+                  if ("LogicalId" in arg && typeof arg.LogicalId === "string") {
+                    return arg.LogicalId;
+                  }
+
+                  if ("id" in arg && typeof arg.id === "string") {
+                    return arg.id;
+                  }
+                }
+
+                return String(arg);
+              };
+
+              return bind(
+                `${(args[0] as TemplateStringsArray)
+                  .flatMap((text, i) => {
+                    const stringified = stringifyBindArg(args[i + 1]);
+                    return stringified !== undefined
+                      ? [text, stringified]
+                      : [text];
+                  })
+                  .join("")}`,
+                data,
+              );
+            };
+
+      const target: any = {
+        Type: type,
+        Namespace: namespace,
+        FQN: fqn,
+        LogicalId: id,
+        Props: props,
+        Provider: ProviderTag as Provider<any>,
+        RemovalPolicy: yield* Effect.serviceOption(RemovalPolicy).pipe(
+          Effect.map(Option.getOrElse(() => defaultRemovalPolicy)),
+        ),
+        bind,
+        toString(this: typeof target) {
+          return `Resource<${this.Type}>(${this.LogicalId})`;
+        },
+        [Symbol.toPrimitive](this: typeof target, hint: string) {
+          return hint === "number" ? NaN : this.toString();
+        },
+      };
+
+      const Resource: R = (stack.resources[fqn] = new Proxy(target, {
+        set: (t, prop, value) => {
+          t[prop as keyof typeof t] = value;
+          return true;
+        },
+        get: (t, prop) =>
+          typeof prop === "symbol" || prop in t
+            ? t[prop as keyof typeof t]
+            : new Output.PropExpr<any, string>(Output.of(Resource), prop),
+      })) as R;
+      Resource.Props = Effect.isEffect(props)
+        ? yield* props.pipe(
+            Effect.provideService(Self, Resource),
+            Effect.provideService(Self(type), Resource),
+          )
+        : props;
+      return Resource;
+    });
+
+  const ProviderTag = Provider(type);
+
+  const Service = {
+    [Symbol.iterator]() {
+      return new SingleShotGen(this.asEffect());
+    },
+    pipe() {
+      return pipeArguments(this, arguments);
+    },
+    asEffect() {
+      return Effect.succeed((id: string, props: R["Props"]) =>
+        constructor(id, props),
+      );
+    },
+    /**
+     * Build a typed reference to a deployed instance of this resource
+     * — in the current stack/stage by default, or in another via
+     * `options`. Resolves to the same shape as `yield*
+     * MyResource("id", props)` so downstream code can read attributes
+     * (`ref.someAttr`) exactly the way it would for a locally-declared
+     * resource.
+     */
+    ref: (
+      id: string,
+      options?: { stage?: string; stack?: string },
+    ): Effect.Effect<R> =>
+      Effect.succeed(Output.of(makeRef<R>(id, options)) as unknown as R),
+
+    Type: type,
+    Provider: ProviderTag,
+    Self: self,
+  };
+
+  const ResourceClass = Object.assign(
+    (...args: [id: string, props: R["Props"]] | [methods: object]) =>
+      typeof args[0] === "object"
+        ? Object.assign(ResourceClass, args[0])
+        : constructor(...(args as [string, R["Props"]])),
+    Service,
+  ) as any;
+
+  return ResourceClass;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Rpc.ts b/.repos/alchemy-effect/packages/alchemy/src/Rpc.ts
new file mode 100644
index 00000000000..9fe8e9c42fa
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Rpc.ts
@@ -0,0 +1,25 @@
+import type * as Effect from "effect/Effect";
+
+export type Rpc<Shape> = {
+  "~alchemy/rpc": Shape;
+};
+
+/**
+ * Recover the user's RPC `Shape` from any of the forms a caller might pass
+ * to {@link toPromiseApi}:
+ *
+ *   - the Worker class value's type, e.g. `typeof Backend`, which extends
+ *     `Effect.Effect<Worker & Rpc<Shape>, …>`
+ *   - the unwrapped `Worker & Rpc<Shape>` type
+ *   - a bare `Shape` (when the caller types it explicitly)
+ */
+export declare namespace Rpc {
+  export type Shape<W> =
+    W extends Effect.Effect<infer R, any, any>
+      ? R extends Rpc<infer Shape>
+        ? Shape
+        : R
+      : W extends Rpc<infer Shape>
+        ? Shape
+        : W;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Runtime.ts b/.repos/alchemy-effect/packages/alchemy/src/Runtime.ts
new file mode 100644
index 00000000000..7a2fbebffe3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Runtime.ts
@@ -0,0 +1,38 @@
+/**
+ * Runtime helpers consumed by generated bundle entrypoints (Cloudflare
+ * Workers, Cloudflare Containers, AWS Lambda, …).
+ *
+ * Anything exported here runs *inside* the deployed function — keep the
+ * surface tiny and dependency-light.
+ */
+
+import * as Layer from "effect/Layer";
+
+/**
+ * Resolve the user's default-export entrypoint into a `Layer` for the
+ * bundled runtime.
+ *
+ * `entrypoint` may be any of:
+ *   - a `Layer` factory (`{ build: (...) => ... }`) — used as-is
+ *   - an effect-class with `asEffect()` (Alchemy `Platform`/`Worker` shape)
+ *   - a plain `Effect`
+ *
+ * Centralized so the inline ternary doesn't have to be re-emitted into
+ * every bundle template (and accidentally rewritten to `x : x` by a bulk
+ * replace, which silently swaps the class in for the Effect and bricks
+ * every deployed worker/lambda).
+ */
+export const makeEntrypointLayer = (
+  tag: any,
+  entrypoint: any,
+): Layer.Layer<any> => {
+  if (typeof entrypoint?.build === "function") {
+    return entrypoint;
+  }
+  return Layer.effect(
+    tag,
+    typeof entrypoint?.asEffect === "function"
+      ? entrypoint.asEffect()
+      : entrypoint,
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/RuntimeContext.ts b/.repos/alchemy-effect/packages/alchemy/src/RuntimeContext.ts
new file mode 100644
index 00000000000..88cbfebdd3a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/RuntimeContext.ts
@@ -0,0 +1,58 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import type { HttpEffect } from "./Http.ts";
+import type { Output } from "./Output.ts";
+
+export interface BaseRuntimeContext {
+  Type: string;
+  id: string;
+  env: Record<string, any>;
+  /**
+   * Read a value by its (already-canonical) key. The key is used verbatim;
+   * callers must {@link sanitizeKey} first. See {@link sanitizeKey}.
+   */
+  get<T>(key: string): Effect.Effect<T | undefined>;
+  /**
+   * Store an output under the given (already-canonical) key, returning the key.
+   * The key is used verbatim; callers must {@link sanitizeKey} first.
+   */
+  set(id: string, output: Output): Effect.Effect<string>;
+  exports?: Effect.Effect<Record<string, any>>;
+  serve?<Req = never>(
+    handler: HttpEffect<Req>,
+    options?: { shape?: Record<string, unknown> },
+  ): Effect.Effect<void, never, Req>;
+  shape?: () => Record<string, unknown>;
+  /** additional services to provide to the plan  */
+  planServices?: Layer.Layer<any>;
+}
+
+/**
+ * Canonicalize a logical key into a key that is safe to use as the name of an
+ * environment variable / binding (`[a-zA-Z][a-zA-Z0-9_]*`).
+ *
+ * `RuntimeContext.set`/`get` are dumb key/value stores: they read and write the
+ * key **verbatim**. It is the *caller's* responsibility to hand them a
+ * canonical key, since the caller is the one that knows the logical key may
+ * contain `.`/`-` (e.g. a dotted config name from `Platform`, or an
+ * `Output.toString()` like `"QueueSinkQueue.queueUrl"`). Callers run the key
+ * through this before calling `set`/`get` so both sides agree.
+ */
+export const sanitizeKey = (key: string): string =>
+  key.replaceAll(/[^a-zA-Z0-9]/g, "_");
+
+/**
+ * Context of the runtime environment.
+ *
+ * E.g. the context of a running Worker, Task, Process, Function
+ */
+export class RuntimeContext extends Context.Service<
+  RuntimeContext,
+  BaseRuntimeContext
+>()("RuntimeContext") {}
+
+export const CurrentRuntimeContext = Effect.serviceOption(RuntimeContext).pipe(
+  Effect.map(Option.getOrUndefined),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/BunSQLite.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/BunSQLite.ts
new file mode 100644
index 00000000000..40667b98f72
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/BunSQLite.ts
@@ -0,0 +1,132 @@
+import type { Database, SQLQueryBindings, Statement } from "bun:sqlite";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { SQLite } from "./SQLite.ts";
+import type { SQLiteConnection } from "./SQLiteConnection.ts";
+import { parseError } from "./SQLiteError.ts";
+import type { SQLiteStatement } from "./SQLiteStatement.ts";
+
+/**
+ * Layer that provides the SQLite service using Bun's native SQLite.
+ */
+export const BunSQLite: Layer.Layer<SQLite> = Layer.sync(SQLite, () => ({
+  open: (path: string) =>
+    Effect.gen(function* () {
+      const { Database } = yield* Effect.promise(() => import("bun:sqlite"));
+      const db = new Database(path);
+      // Enable WAL mode for better concurrent read performance
+      db.run("PRAGMA journal_mode = WAL;");
+      // Wait up to 30 seconds when database is locked before returning SQLITE_BUSY
+      db.run("PRAGMA busy_timeout = 30000;");
+      return fromDatabase(db);
+    }),
+}));
+
+/**
+ * Create a SQLiteConnection from a Bun SQLite Database.
+ */
+export const fromDatabase = (db: Database): SQLiteConnection => ({
+  prepare: <R>(sql: string) =>
+    Effect.try({
+      try: () => wrapStatement<R>(db.prepare(sql)),
+      catch: (e) =>
+        parseError(extractErrorCode(e), `Failed to prepare statement: ${e}`, e),
+    }),
+
+  exec: (sql: string) =>
+    Effect.try({
+      try: () => {
+        db.exec(sql);
+      },
+      catch: (e) =>
+        parseError(extractErrorCode(e), `Failed to execute SQL: ${e}`, e),
+    }),
+
+  transaction: <A, E>(
+    fn: (conn: SQLiteConnection) => Effect.Effect<A, E, never>,
+  ) => {
+    // For Bun's synchronous SQLite, we can use the same connection
+    // since everything runs synchronously within the transaction
+    const conn = fromDatabase(db);
+    return Effect.flatMap(
+      Effect.try({
+        try: () => db.transaction(() => Effect.runSync(fn(conn))),
+        catch: (e) =>
+          parseError(
+            extractErrorCode(e),
+            `Failed to create transaction: ${e}`,
+            e,
+          ),
+      }),
+      (txFn) =>
+        Effect.try({
+          try: () => txFn(),
+          catch: (e) =>
+            parseError(extractErrorCode(e), `Transaction failed:`, e),
+        }),
+    );
+  },
+
+  batch: (statements: Array<{ sql: string; params?: unknown[] }>) =>
+    Effect.try({
+      try: () => {
+        // Use Bun's transaction for atomic batch execution
+        db.transaction(() => {
+          for (const stmt of statements) {
+            const prepared = db.prepare(stmt.sql);
+            prepared.run(...((stmt.params ?? []) as SQLQueryBindings[]));
+          }
+        })();
+      },
+      catch: (e) =>
+        parseError(extractErrorCode(e), `Batch execution failed: ${e}`, e),
+    }),
+});
+
+/**
+ * Wrap a Bun SQLite Statement in the SqlStatement interface.
+ */
+const wrapStatement = <R>(stmt: Statement): SQLiteStatement<R> => ({
+  all: <T = R>(...params: unknown[]) =>
+    Effect.try({
+      try: () => stmt.all(...params) as T[],
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to execute statement.all: ${e}`,
+          e,
+        ),
+    }),
+
+  get: <T = R>(...params: unknown[]) =>
+    Effect.try({
+      try: () => stmt.get(...params) as T | undefined,
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to execute statement.get: ${e}`,
+          e,
+        ),
+    }),
+
+  run: (...params: unknown[]) =>
+    Effect.try({
+      try: () => {
+        stmt.run(...params);
+      },
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to execute statement.run: ${e}`,
+          e,
+        ),
+    }),
+});
+
+/**
+ * Extract error code from Bun's SQLiteError.
+ */
+const extractErrorCode = (e: unknown): string | undefined => {
+  const bunError = e as { code?: string };
+  return bunError?.code;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLite.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLite.ts
new file mode 100644
index 00000000000..1e8deab691d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLite.ts
@@ -0,0 +1,19 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+
+import type { SQLiteConnection } from "./SQLiteConnection.ts";
+import type { SQLiteErrorType } from "./SQLiteError.ts";
+
+export class SQLite extends Context.Service<SQLite, SQLiteService>()(
+  "SQLite",
+) {}
+
+/**
+ * SQLite service that provides database connection factory.
+ */
+export interface SQLiteService {
+  /**
+   * Open a SQLite database at the given path.
+   */
+  open(path: string): Effect.Effect<SQLiteConnection, SQLiteErrorType>;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteConnection.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteConnection.ts
new file mode 100644
index 00000000000..042ce358a79
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteConnection.ts
@@ -0,0 +1,55 @@
+import type * as Effect from "effect/Effect";
+import type { SQLiteErrorType } from "./SQLiteError.ts";
+import type { SQLiteStatement } from "./SQLiteStatement.ts";
+
+/**
+ * SQL database connection interface abstraction.
+ *
+ * This interface decouples from specific SQLite implementations (Bun, better-sqlite3, etc.)
+ * and uses Effects for all operations to support async interfaces in the future.
+ */
+export interface SQLiteConnection {
+  /**
+   * Prepare a SQL statement for execution.
+   */
+  prepare<R = unknown>(
+    sql: string,
+  ): Effect.Effect<SQLiteStatement<R>, SQLiteErrorType>;
+
+  /**
+   * Execute raw SQL statements (e.g., for DDL operations).
+   */
+  exec(sql: string): Effect.Effect<void, SQLiteErrorType>;
+
+  /**
+   * Execute a function within a transaction.
+   * If the effect fails, the transaction is rolled back.
+   * If the effect succeeds, the transaction is committed.
+   *
+   * The callback receives a connection that should be used for all operations
+   * within the transaction to avoid deadlocks with async implementations.
+   *
+   * Note: For synchronous implementations (like Bun SQLite), the effect
+   * must have no requirements (R = never). Async implementations may
+   * support effects with requirements.
+   */
+  transaction<A, E>(
+    fn: (conn: SQLiteConnection) => Effect.Effect<A, E, never>,
+  ): Effect.Effect<A, E | SQLiteErrorType, never>;
+
+  /**
+   * Execute a batch of SQL statements atomically.
+   *
+   * The batch is executed in its own logical database connection and the statements
+   * are wrapped in a transaction. This ensures that the batch is applied atomically:
+   * either all or no changes are applied.
+   *
+   * If any of the statements in the batch fails with an error, the batch is aborted,
+   * the transaction is rolled back and the effect fails.
+   *
+   * @param statements - Array of SQL statements with their parameters
+   */
+  batch(
+    statements: Array<{ sql: string; params?: unknown[] }>,
+  ): Effect.Effect<void, SQLiteErrorType>;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteError.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteError.ts
new file mode 100644
index 00000000000..4ad6d82ec40
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteError.ts
@@ -0,0 +1,904 @@
+import * as Data from "effect/Data";
+
+/**
+ * Base error properties shared by all SQLite errors.
+ */
+interface SQLiteErrorProps {
+  readonly message: string;
+  readonly cause?: unknown;
+}
+
+// =============================================================================
+// Primary Result Codes
+// =============================================================================
+
+/**
+ * SQLITE_ERROR (1) - Generic error code.
+ */
+export class SQLiteError extends Data.TaggedError(
+  "SQLITE_ERROR",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_INTERNAL (2) - Internal malfunction.
+ */
+export class SQLiteInternal extends Data.TaggedError(
+  "SQLITE_INTERNAL",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_PERM (3) - Access permission denied.
+ */
+export class SQLitePerm extends Data.TaggedError(
+  "SQLITE_PERM",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_ABORT (4) - Operation aborted.
+ */
+export class SQLiteAbort extends Data.TaggedError(
+  "SQLITE_ABORT",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_BUSY (5) - Database file is locked.
+ */
+export class SQLiteBusy extends Data.TaggedError(
+  "SQLITE_BUSY",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_LOCKED (6) - A table in the database is locked.
+ */
+export class SQLiteLocked extends Data.TaggedError(
+  "SQLITE_LOCKED",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_NOMEM (7) - Memory allocation failed.
+ */
+export class SQLiteNomem extends Data.TaggedError(
+  "SQLITE_NOMEM",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_READONLY (8) - Attempt to write a readonly database.
+ */
+export class SQLiteReadonly extends Data.TaggedError(
+  "SQLITE_READONLY",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_INTERRUPT (9) - Operation interrupted.
+ */
+export class SQLiteInterrupt extends Data.TaggedError(
+  "SQLITE_INTERRUPT",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_IOERR (10) - I/O error.
+ */
+export class SQLiteIoerr extends Data.TaggedError(
+  "SQLITE_IOERR",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_CORRUPT (11) - Database disk image is malformed.
+ */
+export class SQLiteCorrupt extends Data.TaggedError(
+  "SQLITE_CORRUPT",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_NOTFOUND (12) - Unknown opcode or table not found.
+ */
+export class SQLiteNotfound extends Data.TaggedError(
+  "SQLITE_NOTFOUND",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_FULL (13) - Database or disk is full.
+ */
+export class SQLiteFull extends Data.TaggedError(
+  "SQLITE_FULL",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_CANTOPEN (14) - Unable to open database file.
+ */
+export class SQLiteCantopen extends Data.TaggedError(
+  "SQLITE_CANTOPEN",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_PROTOCOL (15) - Database lock protocol error.
+ */
+export class SQLiteProtocol extends Data.TaggedError(
+  "SQLITE_PROTOCOL",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_EMPTY (16) - Internal use only.
+ */
+export class SQLiteEmpty extends Data.TaggedError(
+  "SQLITE_EMPTY",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_SCHEMA (17) - Database schema changed.
+ */
+export class SQLiteSchema extends Data.TaggedError(
+  "SQLITE_SCHEMA",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_TOOBIG (18) - String or BLOB exceeds size limit.
+ */
+export class SQLiteToobig extends Data.TaggedError(
+  "SQLITE_TOOBIG",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_CONSTRAINT (19) - Constraint violation.
+ */
+export class SQLiteConstraint extends Data.TaggedError(
+  "SQLITE_CONSTRAINT",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_MISMATCH (20) - Data type mismatch.
+ */
+export class SQLiteMismatch extends Data.TaggedError(
+  "SQLITE_MISMATCH",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_MISUSE (21) - Library used incorrectly.
+ */
+export class SQLiteMisuse extends Data.TaggedError(
+  "SQLITE_MISUSE",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_NOLFS (22) - Uses OS features not supported on host.
+ */
+export class SQLiteNolfs extends Data.TaggedError(
+  "SQLITE_NOLFS",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_AUTH (23) - Authorization denied.
+ */
+export class SQLiteAuth extends Data.TaggedError(
+  "SQLITE_AUTH",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_FORMAT (24) - Not used.
+ */
+export class SQLiteFormat extends Data.TaggedError(
+  "SQLITE_FORMAT",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_RANGE (25) - 2nd parameter to sqlite3_bind out of range.
+ */
+export class SQLiteRange extends Data.TaggedError(
+  "SQLITE_RANGE",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_NOTADB (26) - File opened that is not a database file.
+ */
+export class SQLiteNotadb extends Data.TaggedError(
+  "SQLITE_NOTADB",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_NOTICE (27) - Notifications from sqlite3_log().
+ */
+export class SQLiteNotice extends Data.TaggedError(
+  "SQLITE_NOTICE",
+)<SQLiteErrorProps> {}
+
+/**
+ * SQLITE_WARNING (28) - Warnings from sqlite3_log().
+ */
+export class SQLiteWarning extends Data.TaggedError(
+  "SQLITE_WARNING",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - ABORT
+// =============================================================================
+
+export class SQLiteAbortRollback extends Data.TaggedError(
+  "SQLITE_ABORT_ROLLBACK",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - AUTH
+// =============================================================================
+
+export class SQLiteAuthUser extends Data.TaggedError(
+  "SQLITE_AUTH_USER",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - BUSY
+// =============================================================================
+
+export class SQLiteBusyRecovery extends Data.TaggedError(
+  "SQLITE_BUSY_RECOVERY",
+)<SQLiteErrorProps> {}
+export class SQLiteBusySnapshot extends Data.TaggedError(
+  "SQLITE_BUSY_SNAPSHOT",
+)<SQLiteErrorProps> {}
+export class SQLiteBusyTimeout extends Data.TaggedError(
+  "SQLITE_BUSY_TIMEOUT",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - CANTOPEN
+// =============================================================================
+
+export class SQLiteCantopenConvpath extends Data.TaggedError(
+  "SQLITE_CANTOPEN_CONVPATH",
+)<SQLiteErrorProps> {}
+export class SQLiteCantopenDirtywal extends Data.TaggedError(
+  "SQLITE_CANTOPEN_DIRTYWAL",
+)<SQLiteErrorProps> {}
+export class SQLiteCantopenFullpath extends Data.TaggedError(
+  "SQLITE_CANTOPEN_FULLPATH",
+)<SQLiteErrorProps> {}
+export class SQLiteCantopenIsdir extends Data.TaggedError(
+  "SQLITE_CANTOPEN_ISDIR",
+)<SQLiteErrorProps> {}
+export class SQLiteCantopenNotempdir extends Data.TaggedError(
+  "SQLITE_CANTOPEN_NOTEMPDIR",
+)<SQLiteErrorProps> {}
+export class SQLiteCantopenSymlink extends Data.TaggedError(
+  "SQLITE_CANTOPEN_SYMLINK",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - CONSTRAINT
+// =============================================================================
+
+export class SQLiteConstraintCheck extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_CHECK",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintCommithook extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_COMMITHOOK",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintDatatype extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_DATATYPE",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintForeignkey extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_FOREIGNKEY",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintFunction extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_FUNCTION",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintNotnull extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_NOTNULL",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintPinned extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_PINNED",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintPrimarykey extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_PRIMARYKEY",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintRowid extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_ROWID",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintTrigger extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_TRIGGER",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintUnique extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_UNIQUE",
+)<SQLiteErrorProps> {}
+export class SQLiteConstraintVtab extends Data.TaggedError(
+  "SQLITE_CONSTRAINT_VTAB",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - CORRUPT
+// =============================================================================
+
+export class SQLiteCorruptIndex extends Data.TaggedError(
+  "SQLITE_CORRUPT_INDEX",
+)<SQLiteErrorProps> {}
+export class SQLiteCorruptSequence extends Data.TaggedError(
+  "SQLITE_CORRUPT_SEQUENCE",
+)<SQLiteErrorProps> {}
+export class SQLiteCorruptVtab extends Data.TaggedError(
+  "SQLITE_CORRUPT_VTAB",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - ERROR
+// =============================================================================
+
+export class SQLiteErrorMissingCollseq extends Data.TaggedError(
+  "SQLITE_ERROR_MISSING_COLLSEQ",
+)<SQLiteErrorProps> {}
+export class SQLiteErrorRetry extends Data.TaggedError(
+  "SQLITE_ERROR_RETRY",
+)<SQLiteErrorProps> {}
+export class SQLiteErrorSnapshot extends Data.TaggedError(
+  "SQLITE_ERROR_SNAPSHOT",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - IOERR
+// =============================================================================
+
+export class SQLiteIoerrAccess extends Data.TaggedError(
+  "SQLITE_IOERR_ACCESS",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrAuth extends Data.TaggedError(
+  "SQLITE_IOERR_AUTH",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrBeginAtomic extends Data.TaggedError(
+  "SQLITE_IOERR_BEGIN_ATOMIC",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrBlocked extends Data.TaggedError(
+  "SQLITE_IOERR_BLOCKED",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrCheckreservedlock extends Data.TaggedError(
+  "SQLITE_IOERR_CHECKRESERVEDLOCK",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrClose extends Data.TaggedError(
+  "SQLITE_IOERR_CLOSE",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrCommitAtomic extends Data.TaggedError(
+  "SQLITE_IOERR_COMMIT_ATOMIC",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrConvpath extends Data.TaggedError(
+  "SQLITE_IOERR_CONVPATH",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrCorruptfs extends Data.TaggedError(
+  "SQLITE_IOERR_CORRUPTFS",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrData extends Data.TaggedError(
+  "SQLITE_IOERR_DATA",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrDelete extends Data.TaggedError(
+  "SQLITE_IOERR_DELETE",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrDeleteNoent extends Data.TaggedError(
+  "SQLITE_IOERR_DELETE_NOENT",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrDirClose extends Data.TaggedError(
+  "SQLITE_IOERR_DIR_CLOSE",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrDirFsync extends Data.TaggedError(
+  "SQLITE_IOERR_DIR_FSYNC",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrFstat extends Data.TaggedError(
+  "SQLITE_IOERR_FSTAT",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrFsync extends Data.TaggedError(
+  "SQLITE_IOERR_FSYNC",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrGettemppath extends Data.TaggedError(
+  "SQLITE_IOERR_GETTEMPPATH",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrLock extends Data.TaggedError(
+  "SQLITE_IOERR_LOCK",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrMmap extends Data.TaggedError(
+  "SQLITE_IOERR_MMAP",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrNomem extends Data.TaggedError(
+  "SQLITE_IOERR_NOMEM",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrRdlock extends Data.TaggedError(
+  "SQLITE_IOERR_RDLOCK",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrRead extends Data.TaggedError(
+  "SQLITE_IOERR_READ",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrRollbackAtomic extends Data.TaggedError(
+  "SQLITE_IOERR_ROLLBACK_ATOMIC",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrSeek extends Data.TaggedError(
+  "SQLITE_IOERR_SEEK",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrShmlock extends Data.TaggedError(
+  "SQLITE_IOERR_SHMLOCK",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrShmmap extends Data.TaggedError(
+  "SQLITE_IOERR_SHMMAP",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrShmopen extends Data.TaggedError(
+  "SQLITE_IOERR_SHMOPEN",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrShmsize extends Data.TaggedError(
+  "SQLITE_IOERR_SHMSIZE",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrShortRead extends Data.TaggedError(
+  "SQLITE_IOERR_SHORT_READ",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrTruncate extends Data.TaggedError(
+  "SQLITE_IOERR_TRUNCATE",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrUnlock extends Data.TaggedError(
+  "SQLITE_IOERR_UNLOCK",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrVnode extends Data.TaggedError(
+  "SQLITE_IOERR_VNODE",
+)<SQLiteErrorProps> {}
+export class SQLiteIoerrWrite extends Data.TaggedError(
+  "SQLITE_IOERR_WRITE",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - LOCKED
+// =============================================================================
+
+export class SQLiteLockedSharedcache extends Data.TaggedError(
+  "SQLITE_LOCKED_SHAREDCACHE",
+)<SQLiteErrorProps> {}
+export class SQLiteLockedVtab extends Data.TaggedError(
+  "SQLITE_LOCKED_VTAB",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - NOTICE
+// =============================================================================
+
+export class SQLiteNoticeRecoverRollback extends Data.TaggedError(
+  "SQLITE_NOTICE_RECOVER_ROLLBACK",
+)<SQLiteErrorProps> {}
+export class SQLiteNoticeRecoverWal extends Data.TaggedError(
+  "SQLITE_NOTICE_RECOVER_WAL",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - READONLY
+// =============================================================================
+
+export class SQLiteReadonlyCantinit extends Data.TaggedError(
+  "SQLITE_READONLY_CANTINIT",
+)<SQLiteErrorProps> {}
+export class SQLiteReadonlyCantlock extends Data.TaggedError(
+  "SQLITE_READONLY_CANTLOCK",
+)<SQLiteErrorProps> {}
+export class SQLiteReadonlyDbmoved extends Data.TaggedError(
+  "SQLITE_READONLY_DBMOVED",
+)<SQLiteErrorProps> {}
+export class SQLiteReadonlyDirectory extends Data.TaggedError(
+  "SQLITE_READONLY_DIRECTORY",
+)<SQLiteErrorProps> {}
+export class SQLiteReadonlyRecovery extends Data.TaggedError(
+  "SQLITE_READONLY_RECOVERY",
+)<SQLiteErrorProps> {}
+export class SQLiteReadonlyRollback extends Data.TaggedError(
+  "SQLITE_READONLY_ROLLBACK",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Extended Result Codes - WARNING
+// =============================================================================
+
+export class SQLiteWarningAutoindex extends Data.TaggedError(
+  "SQLITE_WARNING_AUTOINDEX",
+)<SQLiteErrorProps> {}
+
+// =============================================================================
+// Unknown Error (fallback)
+// =============================================================================
+
+/**
+ * Fallback for unknown or unrecognized SQLite error codes.
+ */
+export class SQLiteUnknownError extends Data.TaggedError("SQLITE_UNKNOWN")<
+  SQLiteErrorProps & {
+    readonly code?: string;
+  }
+> {}
+
+// =============================================================================
+// Union Type
+// =============================================================================
+
+/**
+ * Union of all SQLite error types.
+ */
+export type SQLiteErrorType =
+  // Primary result codes
+  | SQLiteError
+  | SQLiteInternal
+  | SQLitePerm
+  | SQLiteAbort
+  | SQLiteBusy
+  | SQLiteLocked
+  | SQLiteNomem
+  | SQLiteReadonly
+  | SQLiteInterrupt
+  | SQLiteIoerr
+  | SQLiteCorrupt
+  | SQLiteNotfound
+  | SQLiteFull
+  | SQLiteCantopen
+  | SQLiteProtocol
+  | SQLiteEmpty
+  | SQLiteSchema
+  | SQLiteToobig
+  | SQLiteConstraint
+  | SQLiteMismatch
+  | SQLiteMisuse
+  | SQLiteNolfs
+  | SQLiteAuth
+  | SQLiteFormat
+  | SQLiteRange
+  | SQLiteNotadb
+  | SQLiteNotice
+  | SQLiteWarning
+  // Extended - ABORT
+  | SQLiteAbortRollback
+  // Extended - AUTH
+  | SQLiteAuthUser
+  // Extended - BUSY
+  | SQLiteBusyRecovery
+  | SQLiteBusySnapshot
+  | SQLiteBusyTimeout
+  // Extended - CANTOPEN
+  | SQLiteCantopenConvpath
+  | SQLiteCantopenDirtywal
+  | SQLiteCantopenFullpath
+  | SQLiteCantopenIsdir
+  | SQLiteCantopenNotempdir
+  | SQLiteCantopenSymlink
+  // Extended - CONSTRAINT
+  | SQLiteConstraintCheck
+  | SQLiteConstraintCommithook
+  | SQLiteConstraintDatatype
+  | SQLiteConstraintForeignkey
+  | SQLiteConstraintFunction
+  | SQLiteConstraintNotnull
+  | SQLiteConstraintPinned
+  | SQLiteConstraintPrimarykey
+  | SQLiteConstraintRowid
+  | SQLiteConstraintTrigger
+  | SQLiteConstraintUnique
+  | SQLiteConstraintVtab
+  // Extended - CORRUPT
+  | SQLiteCorruptIndex
+  | SQLiteCorruptSequence
+  | SQLiteCorruptVtab
+  // Extended - ERROR
+  | SQLiteErrorMissingCollseq
+  | SQLiteErrorRetry
+  | SQLiteErrorSnapshot
+  // Extended - IOERR
+  | SQLiteIoerrAccess
+  | SQLiteIoerrAuth
+  | SQLiteIoerrBeginAtomic
+  | SQLiteIoerrBlocked
+  | SQLiteIoerrCheckreservedlock
+  | SQLiteIoerrClose
+  | SQLiteIoerrCommitAtomic
+  | SQLiteIoerrConvpath
+  | SQLiteIoerrCorruptfs
+  | SQLiteIoerrData
+  | SQLiteIoerrDelete
+  | SQLiteIoerrDeleteNoent
+  | SQLiteIoerrDirClose
+  | SQLiteIoerrDirFsync
+  | SQLiteIoerrFstat
+  | SQLiteIoerrFsync
+  | SQLiteIoerrGettemppath
+  | SQLiteIoerrLock
+  | SQLiteIoerrMmap
+  | SQLiteIoerrNomem
+  | SQLiteIoerrRdlock
+  | SQLiteIoerrRead
+  | SQLiteIoerrRollbackAtomic
+  | SQLiteIoerrSeek
+  | SQLiteIoerrShmlock
+  | SQLiteIoerrShmmap
+  | SQLiteIoerrShmopen
+  | SQLiteIoerrShmsize
+  | SQLiteIoerrShortRead
+  | SQLiteIoerrTruncate
+  | SQLiteIoerrUnlock
+  | SQLiteIoerrVnode
+  | SQLiteIoerrWrite
+  // Extended - LOCKED
+  | SQLiteLockedSharedcache
+  | SQLiteLockedVtab
+  // Extended - NOTICE
+  | SQLiteNoticeRecoverRollback
+  | SQLiteNoticeRecoverWal
+  // Extended - READONLY
+  | SQLiteReadonlyCantinit
+  | SQLiteReadonlyCantlock
+  | SQLiteReadonlyDbmoved
+  | SQLiteReadonlyDirectory
+  | SQLiteReadonlyRecovery
+  | SQLiteReadonlyRollback
+  // Extended - WARNING
+  | SQLiteWarningAutoindex
+  // Unknown
+  | SQLiteUnknownError;
+
+// =============================================================================
+// Helper Functions
+// =============================================================================
+
+/**
+ * Type guard to check if an error is a SQLite error with a _tag.
+ */
+export const isSQLiteError = (error: unknown): error is SQLiteErrorType => {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "_tag" in error &&
+    typeof error._tag === "string" &&
+    error._tag.startsWith("SQLITE_")
+  );
+};
+
+/**
+ * Check if the error is retryable (busy or locked errors).
+ */
+export const isRetryable = (e: SQLiteErrorType): boolean => {
+  switch (e._tag) {
+    case "SQLITE_BUSY":
+    case "SQLITE_BUSY_RECOVERY":
+    case "SQLITE_BUSY_SNAPSHOT":
+    case "SQLITE_BUSY_TIMEOUT":
+    case "SQLITE_LOCKED":
+    case "SQLITE_LOCKED_SHAREDCACHE":
+    case "SQLITE_LOCKED_VTAB":
+      return true;
+    default:
+      return false;
+  }
+};
+
+/**
+ * Parse an error from a SQLite client into a typed error.
+ */
+export const parseError = (
+  code: string | undefined,
+  message: string,
+  cause?: unknown,
+): SQLiteErrorType => {
+  switch (code) {
+    // Primary result codes
+    case "SQLITE_ERROR":
+      return new SQLiteError({ message, cause });
+    case "SQLITE_INTERNAL":
+      return new SQLiteInternal({ message, cause });
+    case "SQLITE_PERM":
+      return new SQLitePerm({ message, cause });
+    case "SQLITE_ABORT":
+      return new SQLiteAbort({ message, cause });
+    case "SQLITE_BUSY":
+      return new SQLiteBusy({ message, cause });
+    case "SQLITE_LOCKED":
+      return new SQLiteLocked({ message, cause });
+    case "SQLITE_NOMEM":
+      return new SQLiteNomem({ message, cause });
+    case "SQLITE_READONLY":
+      return new SQLiteReadonly({ message, cause });
+    case "SQLITE_INTERRUPT":
+      return new SQLiteInterrupt({ message, cause });
+    case "SQLITE_IOERR":
+      return new SQLiteIoerr({ message, cause });
+    case "SQLITE_CORRUPT":
+      return new SQLiteCorrupt({ message, cause });
+    case "SQLITE_NOTFOUND":
+      return new SQLiteNotfound({ message, cause });
+    case "SQLITE_FULL":
+      return new SQLiteFull({ message, cause });
+    case "SQLITE_CANTOPEN":
+      return new SQLiteCantopen({ message, cause });
+    case "SQLITE_PROTOCOL":
+      return new SQLiteProtocol({ message, cause });
+    case "SQLITE_EMPTY":
+      return new SQLiteEmpty({ message, cause });
+    case "SQLITE_SCHEMA":
+      return new SQLiteSchema({ message, cause });
+    case "SQLITE_TOOBIG":
+      return new SQLiteToobig({ message, cause });
+    case "SQLITE_CONSTRAINT":
+      return new SQLiteConstraint({ message, cause });
+    case "SQLITE_MISMATCH":
+      return new SQLiteMismatch({ message, cause });
+    case "SQLITE_MISUSE":
+      return new SQLiteMisuse({ message, cause });
+    case "SQLITE_NOLFS":
+      return new SQLiteNolfs({ message, cause });
+    case "SQLITE_AUTH":
+      return new SQLiteAuth({ message, cause });
+    case "SQLITE_FORMAT":
+      return new SQLiteFormat({ message, cause });
+    case "SQLITE_RANGE":
+      return new SQLiteRange({ message, cause });
+    case "SQLITE_NOTADB":
+      return new SQLiteNotadb({ message, cause });
+    case "SQLITE_NOTICE":
+      return new SQLiteNotice({ message, cause });
+    case "SQLITE_WARNING":
+      return new SQLiteWarning({ message, cause });
+
+    // Extended - ABORT
+    case "SQLITE_ABORT_ROLLBACK":
+      return new SQLiteAbortRollback({ message, cause });
+
+    // Extended - AUTH
+    case "SQLITE_AUTH_USER":
+      return new SQLiteAuthUser({ message, cause });
+
+    // Extended - BUSY
+    case "SQLITE_BUSY_RECOVERY":
+      return new SQLiteBusyRecovery({ message, cause });
+    case "SQLITE_BUSY_SNAPSHOT":
+      return new SQLiteBusySnapshot({ message, cause });
+    case "SQLITE_BUSY_TIMEOUT":
+      return new SQLiteBusyTimeout({ message, cause });
+
+    // Extended - CANTOPEN
+    case "SQLITE_CANTOPEN_CONVPATH":
+      return new SQLiteCantopenConvpath({ message, cause });
+    case "SQLITE_CANTOPEN_DIRTYWAL":
+      return new SQLiteCantopenDirtywal({ message, cause });
+    case "SQLITE_CANTOPEN_FULLPATH":
+      return new SQLiteCantopenFullpath({ message, cause });
+    case "SQLITE_CANTOPEN_ISDIR":
+      return new SQLiteCantopenIsdir({ message, cause });
+    case "SQLITE_CANTOPEN_NOTEMPDIR":
+      return new SQLiteCantopenNotempdir({ message, cause });
+    case "SQLITE_CANTOPEN_SYMLINK":
+      return new SQLiteCantopenSymlink({ message, cause });
+
+    // Extended - CONSTRAINT
+    case "SQLITE_CONSTRAINT_CHECK":
+      return new SQLiteConstraintCheck({ message, cause });
+    case "SQLITE_CONSTRAINT_COMMITHOOK":
+      return new SQLiteConstraintCommithook({ message, cause });
+    case "SQLITE_CONSTRAINT_DATATYPE":
+      return new SQLiteConstraintDatatype({ message, cause });
+    case "SQLITE_CONSTRAINT_FOREIGNKEY":
+      return new SQLiteConstraintForeignkey({ message, cause });
+    case "SQLITE_CONSTRAINT_FUNCTION":
+      return new SQLiteConstraintFunction({ message, cause });
+    case "SQLITE_CONSTRAINT_NOTNULL":
+      return new SQLiteConstraintNotnull({ message, cause });
+    case "SQLITE_CONSTRAINT_PINNED":
+      return new SQLiteConstraintPinned({ message, cause });
+    case "SQLITE_CONSTRAINT_PRIMARYKEY":
+      return new SQLiteConstraintPrimarykey({ message, cause });
+    case "SQLITE_CONSTRAINT_ROWID":
+      return new SQLiteConstraintRowid({ message, cause });
+    case "SQLITE_CONSTRAINT_TRIGGER":
+      return new SQLiteConstraintTrigger({ message, cause });
+    case "SQLITE_CONSTRAINT_UNIQUE":
+      return new SQLiteConstraintUnique({ message, cause });
+    case "SQLITE_CONSTRAINT_VTAB":
+      return new SQLiteConstraintVtab({ message, cause });
+
+    // Extended - CORRUPT
+    case "SQLITE_CORRUPT_INDEX":
+      return new SQLiteCorruptIndex({ message, cause });
+    case "SQLITE_CORRUPT_SEQUENCE":
+      return new SQLiteCorruptSequence({ message, cause });
+    case "SQLITE_CORRUPT_VTAB":
+      return new SQLiteCorruptVtab({ message, cause });
+
+    // Extended - ERROR
+    case "SQLITE_ERROR_MISSING_COLLSEQ":
+      return new SQLiteErrorMissingCollseq({ message, cause });
+    case "SQLITE_ERROR_RETRY":
+      return new SQLiteErrorRetry({ message, cause });
+    case "SQLITE_ERROR_SNAPSHOT":
+      return new SQLiteErrorSnapshot({ message, cause });
+
+    // Extended - IOERR
+    case "SQLITE_IOERR_ACCESS":
+      return new SQLiteIoerrAccess({ message, cause });
+    case "SQLITE_IOERR_AUTH":
+      return new SQLiteIoerrAuth({ message, cause });
+    case "SQLITE_IOERR_BEGIN_ATOMIC":
+      return new SQLiteIoerrBeginAtomic({ message, cause });
+    case "SQLITE_IOERR_BLOCKED":
+      return new SQLiteIoerrBlocked({ message, cause });
+    case "SQLITE_IOERR_CHECKRESERVEDLOCK":
+      return new SQLiteIoerrCheckreservedlock({ message, cause });
+    case "SQLITE_IOERR_CLOSE":
+      return new SQLiteIoerrClose({ message, cause });
+    case "SQLITE_IOERR_COMMIT_ATOMIC":
+      return new SQLiteIoerrCommitAtomic({ message, cause });
+    case "SQLITE_IOERR_CONVPATH":
+      return new SQLiteIoerrConvpath({ message, cause });
+    case "SQLITE_IOERR_CORRUPTFS":
+      return new SQLiteIoerrCorruptfs({ message, cause });
+    case "SQLITE_IOERR_DATA":
+      return new SQLiteIoerrData({ message, cause });
+    case "SQLITE_IOERR_DELETE":
+      return new SQLiteIoerrDelete({ message, cause });
+    case "SQLITE_IOERR_DELETE_NOENT":
+      return new SQLiteIoerrDeleteNoent({ message, cause });
+    case "SQLITE_IOERR_DIR_CLOSE":
+      return new SQLiteIoerrDirClose({ message, cause });
+    case "SQLITE_IOERR_DIR_FSYNC":
+      return new SQLiteIoerrDirFsync({ message, cause });
+    case "SQLITE_IOERR_FSTAT":
+      return new SQLiteIoerrFstat({ message, cause });
+    case "SQLITE_IOERR_FSYNC":
+      return new SQLiteIoerrFsync({ message, cause });
+    case "SQLITE_IOERR_GETTEMPPATH":
+      return new SQLiteIoerrGettemppath({ message, cause });
+    case "SQLITE_IOERR_LOCK":
+      return new SQLiteIoerrLock({ message, cause });
+    case "SQLITE_IOERR_MMAP":
+      return new SQLiteIoerrMmap({ message, cause });
+    case "SQLITE_IOERR_NOMEM":
+      return new SQLiteIoerrNomem({ message, cause });
+    case "SQLITE_IOERR_RDLOCK":
+      return new SQLiteIoerrRdlock({ message, cause });
+    case "SQLITE_IOERR_READ":
+      return new SQLiteIoerrRead({ message, cause });
+    case "SQLITE_IOERR_ROLLBACK_ATOMIC":
+      return new SQLiteIoerrRollbackAtomic({ message, cause });
+    case "SQLITE_IOERR_SEEK":
+      return new SQLiteIoerrSeek({ message, cause });
+    case "SQLITE_IOERR_SHMLOCK":
+      return new SQLiteIoerrShmlock({ message, cause });
+    case "SQLITE_IOERR_SHMMAP":
+      return new SQLiteIoerrShmmap({ message, cause });
+    case "SQLITE_IOERR_SHMOPEN":
+      return new SQLiteIoerrShmopen({ message, cause });
+    case "SQLITE_IOERR_SHMSIZE":
+      return new SQLiteIoerrShmsize({ message, cause });
+    case "SQLITE_IOERR_SHORT_READ":
+      return new SQLiteIoerrShortRead({ message, cause });
+    case "SQLITE_IOERR_TRUNCATE":
+      return new SQLiteIoerrTruncate({ message, cause });
+    case "SQLITE_IOERR_UNLOCK":
+      return new SQLiteIoerrUnlock({ message, cause });
+    case "SQLITE_IOERR_VNODE":
+      return new SQLiteIoerrVnode({ message, cause });
+    case "SQLITE_IOERR_WRITE":
+      return new SQLiteIoerrWrite({ message, cause });
+
+    // Extended - LOCKED
+    case "SQLITE_LOCKED_SHAREDCACHE":
+      return new SQLiteLockedSharedcache({ message, cause });
+    case "SQLITE_LOCKED_VTAB":
+      return new SQLiteLockedVtab({ message, cause });
+
+    // Extended - NOTICE
+    case "SQLITE_NOTICE_RECOVER_ROLLBACK":
+      return new SQLiteNoticeRecoverRollback({ message, cause });
+    case "SQLITE_NOTICE_RECOVER_WAL":
+      return new SQLiteNoticeRecoverWal({ message, cause });
+
+    // Extended - READONLY
+    case "SQLITE_READONLY_CANTINIT":
+      return new SQLiteReadonlyCantinit({ message, cause });
+    case "SQLITE_READONLY_CANTLOCK":
+      return new SQLiteReadonlyCantlock({ message, cause });
+    case "SQLITE_READONLY_DBMOVED":
+      return new SQLiteReadonlyDbmoved({ message, cause });
+    case "SQLITE_READONLY_DIRECTORY":
+      return new SQLiteReadonlyDirectory({ message, cause });
+    case "SQLITE_READONLY_RECOVERY":
+      return new SQLiteReadonlyRecovery({ message, cause });
+    case "SQLITE_READONLY_ROLLBACK":
+      return new SQLiteReadonlyRollback({ message, cause });
+
+    // Extended - WARNING
+    case "SQLITE_WARNING_AUTOINDEX":
+      return new SQLiteWarningAutoindex({ message, cause });
+
+    // Unknown/default
+    default:
+      return new SQLiteUnknownError({ message, cause, code });
+  }
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteStatement.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteStatement.ts
new file mode 100644
index 00000000000..1e56171c495
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/SQLiteStatement.ts
@@ -0,0 +1,24 @@
+import * as Effect from "effect/Effect";
+import type { SQLiteErrorType } from "./SQLiteError.ts";
+
+/**
+ * A prepared SQL statement that can be executed multiple times.
+ */
+export interface SQLiteStatement<R = unknown> {
+  /**
+   * Execute the statement and return all matching rows.
+   */
+  all<T = R>(...params: unknown[]): Effect.Effect<T[], SQLiteErrorType>;
+
+  /**
+   * Execute the statement and return the first matching row.
+   */
+  get<T = R>(
+    ...params: unknown[]
+  ): Effect.Effect<T | undefined, SQLiteErrorType>;
+
+  /**
+   * Execute the statement for its side effects (INSERT, UPDATE, DELETE).
+   */
+  run(...params: unknown[]): Effect.Effect<void, SQLiteErrorType>;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/index.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/index.ts
new file mode 100644
index 00000000000..f8ce3783b5c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/index.ts
@@ -0,0 +1,6 @@
+export * from "./BunSQLite.ts";
+export * from "./libSQL.ts";
+export * from "./SQLite.ts";
+export * from "./SQLiteConnection.ts";
+export * from "./SQLiteError.ts";
+export * from "./SQLiteStatement.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/SQLite/libSQL.ts b/.repos/alchemy-effect/packages/alchemy/src/SQLite/libSQL.ts
new file mode 100644
index 00000000000..7a2c1c62887
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/SQLite/libSQL.ts
@@ -0,0 +1,194 @@
+import type { Client, InArgs, ResultSet, Row } from "@libsql/client";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { SQLite } from "./SQLite.ts";
+import type { SQLiteConnection } from "./SQLiteConnection.ts";
+import { parseError } from "./SQLiteError.ts";
+import type { SQLiteStatement } from "./SQLiteStatement.ts";
+
+/**
+ * Layer that provides the SQLite service using libsql.
+ *
+ * Note: This layer requires the @libsql/client package to be installed.
+ * Install with: bun add @libsql/client
+ */
+export const libSQL: Layer.Layer<SQLite> = Layer.sync(SQLite, () => ({
+  open: (path: string) =>
+    Effect.tryPromise({
+      try: async () => {
+        const { createClient } = await import("@libsql/client");
+        const url = path.startsWith("file:") ? path : `file:${path}`;
+        const client = createClient({ url });
+        // Enable WAL mode for better concurrent read performance
+        await client.execute("PRAGMA journal_mode = WAL;");
+        // Wait up to 30 seconds when database is locked before returning SQLITE_BUSY
+        await client.execute("PRAGMA busy_timeout = 30000;");
+        return fromClient(client);
+      },
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to open libsql database: ${e}`,
+          e,
+        ),
+    }),
+}));
+
+/**
+ * Create a SQLiteConnection from a libsql Client.
+ *
+ * @param executor - The executor to use for operations. In a transaction context,
+ *                   this should be the transaction object to avoid deadlocks.
+ */
+export const fromClient = (
+  client: Client,
+  executor: { execute: Client["execute"] } = client,
+): SQLiteConnection => ({
+  prepare: <R>(sql: string) => Effect.succeed(wrapStatement<R>(executor, sql)),
+
+  exec: (sql: string) =>
+    Effect.tryPromise({
+      try: () => executor.execute(sql),
+      catch: (e) =>
+        parseError(extractErrorCode(e), `Failed to execute SQL: ${e}`, e),
+    }),
+
+  transaction: <A, E>(
+    fn: (conn: SQLiteConnection) => Effect.Effect<A, E, never>,
+  ) =>
+    Effect.tryPromise({
+      try: async () => {
+        const tx = await client.transaction("write");
+        try {
+          // Create a connection that uses the transaction for all operations
+          const txConn = fromClient(client, tx);
+          const result = await Effect.runPromise(fn(txConn));
+          await tx.commit();
+          return result;
+        } catch (e) {
+          await tx.rollback();
+          throw e;
+        }
+      },
+      catch: (e) =>
+        parseError(extractErrorCode(e), `Transaction failed: ${e}`, e),
+    }) as Effect.Effect<
+      A,
+      E | import("./SQLiteError.ts").SQLiteErrorType,
+      never
+    >,
+
+  batch: (statements: Array<{ sql: string; params?: unknown[] }>) =>
+    Effect.tryPromise({
+      try: async () => {
+        // Use client.batch directly - it creates its own atomic transaction
+        await client.batch(
+          statements.map((stmt) => ({
+            sql: stmt.sql,
+            args: (stmt.params ?? []) as InArgs,
+          })),
+          "write",
+        );
+      },
+      catch: (e) =>
+        parseError(extractErrorCode(e), `Batch execution failed: ${e}`, e),
+    }),
+});
+
+/**
+ * Wrap a libsql statement in the SQLiteStatement interface.
+ *
+ * Unlike bun:sqlite, libsql doesn't have a prepared statement object.
+ * Instead, we store the SQL and execute it with parameters each time.
+ *
+ * @param executor - The executor to use (Client or Transaction)
+ * @param sql - The SQL query string
+ */
+const wrapStatement = <R>(
+  executor: { execute: Client["execute"] },
+  sql: string,
+): SQLiteStatement<R> => ({
+  all: <T = R>(...params: unknown[]) =>
+    Effect.tryPromise({
+      try: async () => {
+        const result = await executor.execute({
+          sql,
+          args: params as InArgs,
+        });
+        return resultSetToRows<T>(result);
+      },
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to execute statement.all: ${e}`,
+          e,
+        ),
+    }),
+
+  get: <T = R>(...params: unknown[]) =>
+    Effect.tryPromise({
+      try: async () => {
+        const result = await executor.execute({
+          sql,
+          args: params as InArgs,
+        });
+        const rows = resultSetToRows<T>(result);
+        return rows[0];
+      },
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to execute statement.get: ${e}`,
+          e,
+        ),
+    }),
+
+  run: (...params: unknown[]) =>
+    Effect.tryPromise({
+      try: async () => {
+        await executor.execute({
+          sql,
+          args: params as InArgs,
+        });
+      },
+      catch: (e) =>
+        parseError(
+          extractErrorCode(e),
+          `Failed to execute statement.run: ${e}`,
+          e,
+        ),
+    }),
+});
+
+/**
+ * Extract error code from libsql's LibsqlError.
+ * Prefers extendedCode if available for more specific error types.
+ */
+const extractErrorCode = (e: any): string | undefined => {
+  const libsqlError = e as { code?: string; extendedCode?: string };
+  const code = libsqlError?.extendedCode ?? libsqlError?.code;
+  if (code) {
+    return code;
+  }
+  // Match and parse the tag after "LibsqlError:"
+  const match = e.message.match(/LibsqlError:\s*([A-Z_]+):/);
+  const tag = match ? match[1] : undefined;
+  if (tag) {
+    return tag;
+  }
+  return tag;
+};
+
+/**
+ * Convert a libsql ResultSet to an array of row objects.
+ */
+function resultSetToRows<T>(result: ResultSet): T[] {
+  const columns = result.columns;
+  return result.rows.map((row: Row) => {
+    const obj: Record<string, unknown> = {};
+    for (let i = 0; i < columns.length; i++) {
+      obj[columns[i]] = row[i];
+    }
+    return obj as T;
+  });
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Schema.ts b/.repos/alchemy-effect/packages/alchemy/src/Schema.ts
new file mode 100644
index 00000000000..86c85ce23ef
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Schema.ts
@@ -0,0 +1,333 @@
+import type { Effect } from "effect/Effect";
+import * as S from "effect/Schema";
+import * as AST from "effect/SchemaAST";
+import type { Sink } from "effect/Sink";
+import type { Stream } from "effect/Stream";
+
+export * from "effect/Schema";
+
+export const isNullishSchema = (schema: S.Schema<any>) =>
+  isNullSchema(schema) || isUndefinedSchema(schema);
+export const isNullSchema = (schema: S.Schema<any>) => AST.isNull(schema.ast);
+export const isUndefinedSchema = (schema: S.Schema<any>) =>
+  AST.isUndefined(schema.ast);
+export const isBooleanSchema = (schema: S.Schema<any>) =>
+  AST.isBoolean(schema.ast);
+export const isStringSchema = (schema: S.Schema<any>) =>
+  AST.isString(schema.ast);
+export const isNumberSchema = (schema: S.Schema<any>) =>
+  AST.isNumber(schema.ast);
+
+export const isRecordLikeSchema = (schema: S.Schema<any>) =>
+  isMapSchema(schema) ||
+  isRecordSchema(schema) ||
+  isStructSchema(schema) ||
+  isClassSchema(schema) ||
+  false;
+
+export const isMapSchema = (schema: S.Schema<any>): boolean => {
+  const ast = schema.ast;
+  if (AST.isDeclaration(ast)) {
+    const typeConstructor = (ast.annotations as any)?.typeConstructor;
+    return typeConstructor?._tag === "ReadonlyMap";
+  }
+  return false;
+};
+
+export const isClassSchema = (schema: S.Schema<any>) => {
+  const ast = schema.ast;
+  if (AST.isDeclaration(ast)) {
+    return AST.isObjects(ast.typeParameters[0]);
+  }
+  return false;
+};
+
+export const isStructSchema = (schema: S.Schema<any>) => {
+  return AST.isObjects(schema.ast);
+};
+
+export const isRecordSchema = (schema: S.Schema<any>) => {
+  const ast = schema.ast;
+  return AST.isObjects(ast) && ast.indexSignatures?.length > 0;
+};
+
+export const isListSchema = (schema: S.Schema<any>) => {
+  return AST.isArrays(schema.ast);
+};
+
+export const isSetSchema = (schema: S.Schema<any>): boolean => {
+  const ast = schema.ast;
+  if (AST.isDeclaration(ast)) {
+    const typeConstructor = (ast.annotations as any)?.typeConstructor;
+    return typeConstructor?._tag === "ReadonlySet";
+  }
+  return false;
+};
+
+export const getSetValueAST = (schema: S.Schema<any>): AST.AST | undefined => {
+  const ast = schema.ast;
+  if (AST.isDeclaration(ast) && isSetSchema(schema)) {
+    return ast.typeParameters[0];
+  }
+  return undefined;
+};
+
+/** A Schema representing a Schema */
+export type Field = S.Top;
+export const Field = S.suspend(
+  (): [Field] extends [any] ? S.Schema<Field> : never => S.Any,
+);
+
+type FunctionType = (...args: any[]) => any;
+export type Function<F extends FunctionType = FunctionType> = S.Schema<F>;
+export const Function: <F extends FunctionType>() => Function<F> = S.suspend(
+  (): S.Schema<FunctionType> => S.Any,
+) as any;
+
+export type CreatedAt = Date;
+export const CreatedAt = S.Date.annotate({
+  description: "The timestamp of when this record was created",
+});
+
+export type UpdatedAt = Date;
+export const UpdatedAt = S.Date.annotate({
+  description: "The timestamp of when this record was last updated",
+});
+
+export type AnyClassSchema<
+  Self = any,
+  Fields extends S.Top & { fields: S.Struct.Fields } = S.Top & {
+    fields: S.Struct.Fields;
+  },
+> = S.Class<Self, Fields, any>;
+
+export type AnyClass = new (...args: any[]) => any;
+
+export type AnyErrorSchema = S.Class<any, any, any>;
+
+export type SchemaWithTemplate<
+  Schema extends S.Schema<any>,
+  References extends any[] = any[],
+> = Schema & {
+  template: TemplateStringsArray;
+  references: References;
+};
+
+export type SchemaExt =
+  | FunctionSchema
+  | EffectSchema
+  | StreamSchema
+  | SinkSchema;
+
+export interface SchemaExtBase<A> extends S.Schema<A> {
+  <References extends any[]>(
+    template: TemplateStringsArray,
+    ...references: References
+  ): SchemaWithTemplate<this, References>;
+}
+
+export interface FunctionSchema<
+  Input extends S.Top | undefined = S.Top | undefined,
+  Output extends S.Top = S.Top,
+> extends SchemaExtBase<
+  (
+    ...args: Input extends undefined
+      ? []
+      : [input: S.Schema.Type<Exclude<Input, undefined>>]
+  ) => S.Schema.Type<Output>
+> {
+  input: Input;
+  output: Output;
+}
+
+export interface EffectSchema<
+  A extends S.Top = S.Top,
+  Err extends S.Top = S.Top,
+  Req extends S.Top = S.Top,
+> extends SchemaExtBase<
+  Effect<S.Schema.Type<A>, S.Schema.Type<Err>, S.Schema.Type<Req>>
+> {
+  A: A;
+  Err: Err;
+  Req: Req;
+}
+
+export interface StreamSchema<
+  A extends S.Top = S.Top,
+  Err extends S.Top = S.Top,
+  Req extends S.Top = S.Top,
+> extends SchemaExtBase<
+  Stream<S.Schema.Type<A>, S.Schema.Type<Err>, S.Schema.Type<Req>>
+> {
+  A: A;
+  Err: Err;
+  Req: Req;
+}
+
+export interface SinkSchema<
+  A extends S.Top = S.Top,
+  In extends S.Top = S.Top,
+  L extends S.Top = S.Top,
+  Err extends S.Top = S.Top,
+  Req extends S.Top = S.Top,
+> extends SchemaExtBase<
+  Sink<
+    S.Schema.Type<A>,
+    S.Schema.Type<In>,
+    S.Schema.Type<L>,
+    S.Schema.Type<Err>,
+    S.Schema.Type<Req>
+  >
+> {
+  A: A;
+  In: In;
+  L: L;
+  Err: Err;
+  Req: Req;
+}
+
+export const makeExtSchema = <Schema extends SchemaExt>(
+  schema: Schema,
+): SchemaExt => {
+  const s = S.Any.annotate({
+    aspect: schema,
+  });
+  return new Proxy(() => {}, {
+    get: (_target, prop) => s[prop as keyof typeof s],
+    apply: (_target, _thisArg, [template, ...references]) => {
+      return S.annotate({
+        aspect: {
+          ...schema,
+          template,
+          references,
+        },
+      });
+    },
+  }) as any as SchemaExt;
+};
+
+// export type def = typeof def;
+
+export interface func<
+  Input extends undefined | S.Top | S.Top[],
+  Output extends S.Top,
+> extends S.Schema<
+  Input extends undefined
+    ? () => S.Schema.Type<Output>
+    : Input extends S.Top[]
+      ? (...args: TypeArray<Input>) => S.Schema.Type<Output>
+      : (input: S.Schema.Type<Extract<Input, S.Top>>) => S.Schema.Type<Output>
+> {}
+
+type TypeArray<T extends S.Top[]> = T extends [
+  infer Head,
+  ...infer Tail extends S.Top[],
+]
+  ? Head extends S.Top
+    ? [S.Schema.Type<Head>, ...TypeArray<Tail>]
+    : never
+  : [];
+
+export const func: {
+  <Output extends S.Schema<any>>(
+    output: Output,
+  ): func<undefined, Output> & {
+    <R extends any[]>(
+      template: TemplateStringsArray,
+      ...references: R
+    ): SchemaWithTemplate<func<undefined, Output>, R>;
+  };
+  <Input extends S.Schema<any>, Output extends S.Schema<any>>(
+    input: Input,
+    output: Output,
+  ): func<Input, Output> & {
+    <R extends any[]>(
+      template: TemplateStringsArray,
+      ...references: R
+    ): SchemaWithTemplate<func<Input, Output>, R>;
+  };
+  <const Args extends S.Schema<any>[], Output extends S.Schema<any>>(
+    args: Args,
+    output: Output,
+  ): func<Args, Output> & {
+    <R extends any[]>(
+      template: TemplateStringsArray,
+      ...references: R
+    ): SchemaWithTemplate<func<Args, Output>, R>;
+  };
+} = ((input: any, output: any) =>
+  S.Any.annotate({
+    aspect: {
+      type: "fn",
+      input: output ? input : undefined,
+      output: output ?? input,
+    },
+  })) as any;
+
+export interface effect<
+  A extends S.Top,
+  Err extends S.Top,
+  Req extends S.Top,
+> extends S.Schema<
+  Effect<S.Schema.Type<A>, S.Schema.Type<Err>, S.Schema.Type<Req>>
+> {}
+
+export const effect = <
+  A extends S.Schema<any>,
+  Err extends S.Schema<any> | S.Never = S.Never,
+  Req extends S.Schema<any> | S.Any = S.Any,
+>(
+  a: A,
+  err: Err = S.Never as any,
+  req: Req = S.Never as any,
+): effect<A, Err, Req> =>
+  S.Any.annotate({
+    aspect: {
+      type: "effect",
+      a: a,
+      err: err,
+      req: req,
+    },
+  });
+
+export const stream = <
+  A extends S.Schema<any>,
+  Err extends S.Schema<any> | S.Never = S.Never,
+  Req extends S.Schema<any> | S.Never = S.Never,
+>(
+  a: A,
+  err: Err = S.Never as any,
+  req: Req = S.Never as any,
+) =>
+  S.Any.annotate({
+    aspect: {
+      type: "stream",
+      a: a,
+      err: err,
+      req: req,
+    },
+  });
+
+export const sink = <
+  A extends S.Schema<any>,
+  In extends S.Schema<any>,
+  L extends S.Schema<any>,
+  Err extends S.Schema<any> | S.Never = S.Never,
+  Req extends S.Schema<any> | S.Never = S.Never,
+>(
+  a: A,
+  _in: In = S.Never as any,
+  l: L = S.Never as any,
+  err: Err = S.Never as any,
+  req: Req = S.Never as any,
+) =>
+  S.Any.annotate({
+    aspect: {
+      type: "sink",
+      a: a,
+      in: _in,
+      l: l,
+      err: err,
+      req: req,
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Self.ts b/.repos/alchemy-effect/packages/alchemy/src/Self.ts
new file mode 100644
index 00000000000..5475649f0db
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Self.ts
@@ -0,0 +1,10 @@
+import * as Context from "effect/Context";
+import { GenericService } from "./Util/service.ts";
+
+export interface Self<
+  R extends { Type: string } = { Type: string },
+> extends Context.ServiceClass<Self<R>, `Self<${R["Type"]}>`, R> {}
+
+export const Self = GenericService<{
+  <R extends { Type: string }>(type: R["Type"]): Self<R>;
+}>()("Alchemy::Self");
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Server/Process.ts b/.repos/alchemy-effect/packages/alchemy/src/Server/Process.ts
new file mode 100644
index 00000000000..e119993acda
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Server/Process.ts
@@ -0,0 +1,30 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { FileSystem } from "effect/FileSystem";
+import type { Path } from "effect/Path";
+import type { Stdio } from "effect/Stdio";
+import type { Terminal } from "effect/Terminal";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import type { BaseRuntimeContext } from "../RuntimeContext.ts";
+
+export type ProcessServices =
+  | ChildProcessSpawner
+  | FileSystem
+  | Path
+  | Stdio
+  | Terminal;
+
+export interface ProcessContext extends BaseRuntimeContext {
+  run: <Req = never, RunReq = never>(
+    effect: Effect.Effect<void, never, RunReq>,
+  ) => Effect.Effect<void, never, Req | RunReq>;
+}
+
+/**
+ * Long-running host loop registration (`run`). Provided by `Platform` when the
+ * execution context implements {@link ProcessContext}.
+ */
+export class ServerHost extends Context.Service<
+  ServerHost,
+  Pick<ProcessContext, "run">
+>()("Alchemy::ServerHost") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Server/S3BucketEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/Server/S3BucketEventSource.ts
new file mode 100644
index 00000000000..54378814903
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Server/S3BucketEventSource.ts
@@ -0,0 +1,100 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import type { Bucket } from "../AWS/S3/Bucket.ts";
+import type {
+  BucketNotification,
+  NotificationsProps,
+} from "../AWS/S3/BucketNotifications.ts";
+import * as S3 from "../AWS/S3/index.ts";
+import type { S3EventType } from "../AWS/S3/S3Event.ts";
+import * as SQS from "../AWS/SQS/index.ts";
+import * as Binding from "../Binding.ts";
+import { SQSQueueEventSource } from "./SQSQueueEventSource.ts";
+
+export const S3BucketEventSource = Layer.effect(
+  S3.BucketEventSource,
+  Effect.gen(function* () {
+    const Queue = yield* SQS.Queue;
+    const bind = yield* S3BucketEventSourcePolicy;
+
+    return Effect.fn(function* <
+      Events extends S3EventType[],
+      StreamReq = never,
+      Req = never,
+    >(
+      bucket: Bucket,
+      props: NotificationsProps<Events>,
+      process: (
+        stream: Stream.Stream<BucketNotification, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req>,
+    ) {
+      const queue = yield* Queue(`${bucket.LogicalId}-BucketEvents`);
+
+      yield* bind(bucket, {
+        queue,
+        events: props.events,
+      });
+
+      yield* SQS.messages(queue).subscribe((stream) =>
+        stream.pipe(
+          Stream.flatMap((record) =>
+            Stream.fromArray((JSON.parse(record.body) as S3.S3Event).Records),
+          ),
+          Stream.map((event) => ({
+            type: event.eventName as S3.S3EventType,
+            bucket: event.s3.bucket.name,
+            key: event.s3.object.key,
+            size: event.s3.object.size,
+            eTag: event.s3.object.eTag,
+          })),
+          process,
+        ),
+      );
+    }) as S3.BucketEventSourceService;
+  }),
+).pipe(Layer.provideMerge(SQSQueueEventSource));
+
+export class S3BucketEventSourcePolicy extends Binding.Policy<
+  S3BucketEventSourcePolicy,
+  (
+    bucket: S3.Bucket,
+    props: {
+      queue: SQS.Queue;
+      events?: S3.S3EventType[];
+    },
+  ) => Effect.Effect<void>
+>()("Process.S3BucketEventSource") {}
+
+export const S3BucketEventSourcePolicyLive =
+  /** @__PURE__ */
+  S3BucketEventSourcePolicy.layer.succeed(
+    (_ctx, bucket, { queue, events: Events = ["s3:ObjectCreated:*"] }) =>
+      Effect.all([
+        queue.bind(`AWS.SQS.SendMessage(${bucket.LogicalId})`, {
+          policyStatements: [
+            {
+              Sid: `AllowS3EventsFrom${bucket.LogicalId}`,
+              Effect: "Allow",
+              Action: ["sqs:SendMessage"],
+              Resource: [queue.queueArn],
+              Condition: {
+                ArnEquals: {
+                  "aws:SourceArn": bucket.bucketArn,
+                },
+              },
+            },
+          ],
+        }),
+        bucket.bind(`AWS.S3.NotificationConfiguration(${queue.LogicalId})`, {
+          notificationConfiguration: {
+            QueueConfigurations: [
+              {
+                QueueArn: queue.queueArn,
+                Events,
+              },
+            ],
+          },
+        }),
+      ]),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Server/SQSQueueEventSource.ts b/.repos/alchemy-effect/packages/alchemy/src/Server/SQSQueueEventSource.ts
new file mode 100644
index 00000000000..efd5aba9bee
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Server/SQSQueueEventSource.ts
@@ -0,0 +1,77 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+import { Region } from "@distilled.cloud/aws/Region";
+import * as SQS from "../AWS/SQS/index.ts";
+import { ServerHost } from "./Process.ts";
+
+export const SQSQueueEventSource = Layer.effect(
+  SQS.QueueEventSource,
+  Effect.gen(function* () {
+    const { run } = yield* ServerHost;
+    const region = yield* Region;
+
+    const ReceiveMessage = yield* SQS.ReceiveMessage;
+    const DeleteMessageBatch = yield* SQS.DeleteMessageBatch;
+
+    return Effect.fn(function* <StreamReq = never, Req = never>(
+      queue: SQS.Queue,
+      props: SQS.QueueEventSourceProps,
+      process: (
+        stream: Stream.Stream<SQS.SQSRecord, never, StreamReq>,
+      ) => Effect.Effect<void, never, Req | StreamReq>,
+    ) {
+      const QueueArn = yield* queue.queueArn;
+
+      const receiveMessage = yield* ReceiveMessage(queue);
+      const deleteMessageBatch = yield* DeleteMessageBatch(queue);
+
+      yield* run(
+        Effect.forever(
+          Effect.gen(function* () {
+            const queueArn = yield* QueueArn;
+            const result = yield* receiveMessage({
+              MaxNumberOfMessages: props.batchSize ?? 10,
+              WaitTimeSeconds: props.maximumBatchingWindowInSeconds,
+            });
+
+            const messages = result.Messages ?? [];
+            if (messages.length === 0) return;
+
+            yield* process(
+              Stream.fromArray(
+                messages.map((msg) => ({
+                  messageId: msg.MessageId!,
+                  receiptHandle: msg.ReceiptHandle!,
+                  body: msg.Body!,
+                  attributes: {
+                    ApproximateReceiveCount:
+                      msg.Attributes?.ApproximateReceiveCount!,
+                    SentTimestamp: msg.Attributes?.SentTimestamp!,
+                    SenderId: msg.Attributes?.SenderId!,
+                    ApproximateFirstReceiveTimestamp:
+                      msg.Attributes?.ApproximateFirstReceiveTimestamp!,
+                  },
+                  messageAttributes: {},
+                  md5OfBody: msg.MD5OfBody!,
+                  eventSource: "aws:sqs",
+                  eventSourceARN: queueArn,
+                  awsRegion: region,
+                })),
+              ),
+            ).pipe(Effect.orDie);
+
+            // TODO(sam): only delete messages that were successfully processed
+            yield* deleteMessageBatch({
+              Entries: messages.map((msg, i) => ({
+                Id: msg.MessageId ?? String(i),
+                ReceiptHandle: msg.ReceiptHandle!,
+              })),
+            });
+          }),
+        ).pipe(Effect.orDie),
+      );
+    }) as SQS.QueueEventSourceService;
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Server/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Server/index.ts
new file mode 100644
index 00000000000..f341b53a63f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Server/index.ts
@@ -0,0 +1,3 @@
+export * from "./Process.ts";
+export * from "./S3BucketEventSource.ts";
+export * from "./SQSQueueEventSource.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Serverless/Function.ts b/.repos/alchemy-effect/packages/alchemy/src/Serverless/Function.ts
new file mode 100644
index 00000000000..6a9781d00d4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Serverless/Function.ts
@@ -0,0 +1,27 @@
+import * as Effect from "effect/Effect";
+import type { HttpEffect } from "../Http.ts";
+import type { BaseRuntimeContext } from "../RuntimeContext.ts";
+
+export interface FunctionContext extends BaseRuntimeContext {
+  /**
+   * Register an HTTP handler. The optional `shape` payload is the user's
+   * full default-export shape — Cloudflare Workers use it to expose
+   * non-handler methods (e.g. `greet`) as RPC methods on the deployed
+   * `WorkerEntrypoint`. Other platforms (Lambda, etc.) ignore it.
+   */
+  serve<Req = never>(
+    handler: HttpEffect<Req>,
+    options?: { shape?: Record<string, unknown> },
+  ): Effect.Effect<void, never, Req>;
+  listen<A, Req = never>(
+    handler: FunctionListener<A, Req>,
+  ): Effect.Effect<void, never, Req>;
+  listen<A, Req = never, InitReq = never>(
+    effect: Effect.Effect<FunctionListener<A, Req>, never, InitReq>,
+  ): Effect.Effect<void, never, Req | InitReq>;
+  exports: Effect.Effect<Record<string, any>, never, never>;
+}
+
+export type FunctionListener<A = any, Req = never> = (
+  event: any,
+) => Effect.Effect<A, never, Req> | void;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Serverless/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Serverless/index.ts
new file mode 100644
index 00000000000..5359bbf60e0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Serverless/index.ts
@@ -0,0 +1 @@
+export * from "./Function.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Sql/SqlFile.ts b/.repos/alchemy-effect/packages/alchemy/src/Sql/SqlFile.ts
new file mode 100644
index 00000000000..f48e7c2a44c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Sql/SqlFile.ts
@@ -0,0 +1,77 @@
+import crypto from "node:crypto";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+export interface SqlFile {
+  id: string;
+  sql: string;
+  hash: string;
+}
+
+/**
+ * Recursively list `.sql` files under `directory`, sorted by their numeric
+ * prefix (e.g. `0001_init.sql`) and then by name.
+ */
+export const listSqlFiles = (directory: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const entries = yield* fs.readDirectory(directory, { recursive: true });
+
+    const sqlFiles = entries
+      .filter((name) => name.endsWith(".sql"))
+      .sort((a, b) => {
+        const aNum = getPrefix(a);
+        const bNum = getPrefix(b);
+        if (aNum !== null && bNum !== null) return aNum - bNum;
+        if (aNum !== null) return -1;
+        if (bNum !== null) return 1;
+        return a.localeCompare(b);
+      });
+
+    return yield* Effect.all(sqlFiles.map((id) => readSqlFile(directory, id)));
+  });
+
+/**
+ * Read a single `.sql` file relative to `directory` and compute its content
+ * hash. The `sql` field is marked non-enumerable so it isn't serialized into
+ * resource state.
+ */
+export const readSqlFile = (directory: string, name: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const sql = yield* fs.readFileString(path.resolve(directory, name));
+    const hash = crypto.createHash("sha256").update(sql).digest("hex");
+    const file: SqlFile = { id: name, sql, hash };
+    Object.defineProperty(file, "sql", { enumerable: false });
+    return file;
+  });
+
+export const hashMigrations = (migrationsDir: string) =>
+  listSqlFiles(migrationsDir).pipe(
+    Effect.map((files) => {
+      const hashes: Record<string, string> = {};
+      for (const file of files) hashes[file.id] = file.hash;
+      return hashes;
+    }),
+  );
+
+export const hashImports = (
+  importFiles: ReadonlyArray<string>,
+  rootDir: string,
+) =>
+  Effect.gen(function* () {
+    const hashes: Record<string, string> = {};
+    for (const filePath of importFiles) {
+      const file = yield* readSqlFile(rootDir, filePath);
+      hashes[filePath] = file.hash;
+    }
+    return hashes;
+  });
+
+const getPrefix = (name: string): number | null => {
+  const prefix = name.split("_")[0];
+  const num = Number.parseInt(prefix, 10);
+  return Number.isNaN(num) ? null : num;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Sql/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Sql/index.ts
new file mode 100644
index 00000000000..2c77bfdea0e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Sql/index.ts
@@ -0,0 +1 @@
+export * from "./SqlFile.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Stack.ts b/.repos/alchemy-effect/packages/alchemy/src/Stack.ts
new file mode 100644
index 00000000000..2aa4b2a180d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Stack.ts
@@ -0,0 +1,342 @@
+import { ConfigProvider } from "effect/ConfigProvider";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { FileSystem } from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import { Path } from "effect/Path";
+import * as Scope from "effect/Scope";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import type { ActionLike } from "./Action.ts";
+import { AlchemyContext, AlchemyContextLive } from "./AlchemyContext.ts";
+import { provideFreshArtifactStore } from "./Artifacts.ts";
+import { AuthProviders } from "./Auth/AuthProvider.ts";
+import { CredentialsStore, CredentialsStoreLive } from "./Auth/Credentials.ts";
+import { Profile, ProfileLive } from "./Auth/Profile.ts";
+import { Cli } from "./Cli/Cli.ts";
+import type { Input, InputProps } from "./Input.ts";
+import * as Output from "./Output.ts";
+import type { ResourceBinding, ResourceLike } from "./Resource.ts";
+import { Stage } from "./Stage.ts";
+import type { State } from "./State/State.ts";
+import { loadConfigProvider } from "./Util/ConfigProvider.ts";
+import { effectClass, taggedFunction } from "./Util/effect.ts";
+import { fileLogger } from "./Util/FileLogger.ts";
+import { PlatformServices } from "./Util/PlatformServices.ts";
+
+export type StackServices =
+  | Stack
+  | Stage
+  | Scope.Scope
+  | FileSystem
+  | Path
+  | AlchemyContext
+  | HttpClient
+  | ChildProcessSpawner
+  | AuthProviders
+  | Profile
+  | CredentialsStore
+  | Cli;
+
+export type StackEffect<A, Err = never, Req = never> = Effect.Effect<
+  A,
+  Err,
+  | PlatformServices
+  | HttpClient
+  | Scope.Scope
+  | AuthProviders
+  | AlchemyContext
+  | Cli
+  | Profile
+  | CredentialsStore
+  | State
+  | Req
+>;
+
+export type Stack = Context.ServiceClass.Shape<
+  "Stack",
+  Omit<StackSpec, "output">
+>;
+
+export interface StackProps<Req> {
+  providers: Layer.Layer<NoInfer<Req>, never, StackServices>;
+  state: Layer.Layer<State, never, StackServices>;
+}
+
+export const Stack: Context.ServiceClass<
+  Stack,
+  "Stack",
+  Omit<StackSpec, "output">
+> & {
+  make<A, Req>(
+    stack: {
+      Shape: A;
+    },
+    effect: Effect.Effect<
+      NoInfer<A extends object ? InputProps<A> : Input<A>>,
+      never,
+      Req
+    >,
+  ): Effect.Effect<CompiledStack<A>>;
+  <Self>(): {
+    <A, Req>(
+      stackName: string,
+      options: StackProps<NoInfer<Req>>,
+      eff: Effect.Effect<A, never, Req>,
+    ): Effect.Effect<Self> & {
+      new (_: never): A extends object ? A : {};
+      stage: {
+        [stage: string]: Effect.Effect<Self>;
+      };
+    };
+  };
+  <Self, Shape>(): {
+    Shape: Shape;
+    (stackName: string): Effect.Effect<Self> & {
+      new (_: never): Output.ToOutput<Shape>;
+      make: <A, Req>(
+        options: StackProps<NoInfer<Req>>,
+        effect: Effect.Effect<A, never, Req>,
+      ) => Effect.Effect<CompiledStack<A>>;
+      stage: {
+        [stage: string]: Effect.Effect<Self>;
+      };
+    };
+  };
+  <A, Req>(
+    stackName: string,
+    options: StackProps<NoInfer<Req>>,
+    eff: Effect.Effect<A, never, Req | StackServices>,
+  ): Effect.Effect<CompiledStack<A>>;
+} = Object.assign(
+  taggedFunction(
+    Context.Service<Stack, Omit<StackSpec, "output">>()("Stack"),
+    <A, Req>(
+      stackName?: string,
+      options?: StackProps<NoInfer<Req>>,
+      eff?: Effect.Effect<A, never, Req>,
+    ) => {
+      if (!stackName) {
+        return (stackName: string) =>
+          Object.assign(
+            // by default, reference the stack at the "current" stage of the importer
+            Output.stackRef<A>(stackName).pipe(effectClass),
+            {
+              stackName,
+              stage: createStageProxy(stackName),
+              state: options?.state,
+              providers: options?.providers,
+              make: <Req = never>(
+                options: StackProps<NoInfer<Req>>,
+                eff: Effect.Effect<A, never, Req>,
+              ) => Stack(stackName, options, eff),
+            },
+          );
+      }
+      return eff!.pipe(
+        make({
+          name: stackName,
+          ...options!,
+        }),
+        (eff) =>
+          Object.assign(eff, {
+            stackName,
+            stage: createStageProxy(stackName),
+            state: options?.state,
+            providers: options?.providers,
+          }),
+      );
+    },
+  ),
+) as any;
+
+const createStageProxy = (stackName: string) =>
+  new Proxy(
+    {},
+    {
+      get: (_, stage: string) => Output.stackRef(stackName, { stage }),
+    },
+  );
+
+export interface StackSpec<Output = any> {
+  name: string;
+  stage: string;
+  // @internal
+  resources: {
+    [logicalId: string]: ResourceLike;
+  };
+  bindings: {
+    [logicalId: string]: ResourceBinding[];
+  };
+  /** Tasks registered on the stack, keyed by FQN. */
+  actions: {
+    [logicalId: string]: ActionLike;
+  };
+  output: Output;
+}
+
+export interface CompiledStack<
+  Output = any,
+  Services = any,
+> extends StackSpec<Output> {
+  services: Context.Context<Services>;
+}
+
+export const StackName = Stack.use((stack) => Effect.succeed(stack.name));
+
+export interface MakeStackProps<ROut = never> {
+  name: string;
+  providers: Layer.Layer<ROut, never, StackServices>;
+  state: Layer.Layer<State, never, StackServices>;
+  /** @internal */
+  stack?: StackSpec;
+}
+
+export const make =
+  <ROut = never>(options: MakeStackProps<ROut>) =>
+  <A, Err = never, Req extends ROut | StackServices = never>(
+    effect: Effect.Effect<A, Err, Req>,
+  ) =>
+    Effect.scope.pipe(
+      Effect.flatMap((scope) => {
+        if (options.state == null) {
+          return Effect.die(
+            new Error(
+              `Stack "${options.name}" is missing a state store. ` +
+                `Add a \`state\` layer to the stack options, e.g.:\n` +
+                `  Alchemy.Stack("${options.name}", {\n` +
+                `    providers: Cloudflare.providers(),\n` +
+                `    state: Cloudflare.state(), // <-- required\n` +
+                `  }, ...)\n` +
+                `See https://v2.alchemy.run/concepts/state-store for available state stores.`,
+            ),
+          );
+        }
+        if (options.providers == null) {
+          return Effect.die(
+            new Error(
+              `Stack "${options.name}" is missing a providers layer. ` +
+                `Add a \`providers\` layer to the stack options, e.g.:\n` +
+                `  Alchemy.Stack("${options.name}", {\n` +
+                `    providers: Cloudflare.providers(), // <-- required\n` +
+                `    state: Cloudflare.state(),\n` +
+                `  }, ...)`,
+            ),
+          );
+        }
+        return options.providers.pipe(
+          Layer.provideMerge(options.state),
+          Layer.provideMerge(
+            Layer.effect(
+              Stack,
+              Stage.pipe(
+                Effect.map(
+                  (stage) =>
+                    options.stack ?? {
+                      name: options.name,
+                      stage,
+                      resources: {},
+                      bindings: {},
+                      actions: {},
+                    },
+                ),
+              ),
+            ),
+          ),
+          Layer.buildWithScope(scope),
+        );
+      }),
+      Effect.flatMap((context) =>
+        Effect.all([
+          effect,
+          Stack,
+          Effect.context<ROut | StackServices>(),
+        ]).pipe(
+          Effect.map(
+            ([output, stack, services]): CompiledStack<
+              A,
+              ROut | StackServices
+            > => ({
+              ...stack,
+              output,
+              services: Context.merge(services, context),
+            }),
+          ),
+          Effect.provideContext(context),
+        ),
+      ),
+    );
+
+export const CurrentStack = Effect.serviceOption(Stack)
+
+  .pipe(Effect.map(Option.getOrUndefined));
+
+const platform = Layer.mergeAll(
+  PlatformServices,
+  FetchHttpClient.layer,
+  Logger.layer([fileLogger("out")], { mergeWithExisting: true }),
+  Layer.provide(ProfileLive, PlatformServices),
+  Layer.provide(CredentialsStoreLive, PlatformServices),
+);
+// override alchemy state store, CLI/reporting, state, and Config
+const alchemy = (overrides?: { dev?: boolean }) =>
+  Layer.mergeAll(
+    // CLI.inkCLI(),
+    // optional
+    overrides?.dev
+      ? Layer.provide(
+          Layer.effect(
+            AlchemyContext,
+            AlchemyContext.useSync((ctx) => ({ ...ctx, dev: overrides.dev! })),
+          ),
+          AlchemyContextLive,
+        )
+      : AlchemyContextLive,
+  );
+
+export const evalStack = <A, B, StackErr, Err, Req>(
+  effect: StackEffect<CompiledStack<A>, StackErr, Stage | AlchemyContext>,
+  fn: (stack: CompiledStack<A>) => Effect.Effect<B, Err, Req>,
+  options: {
+    stage: string;
+    dev?: boolean;
+    /**
+     * Optional caller-supplied scope. When provided, scoped resources
+     * (e.g. the dev sidecar process) live until the caller closes this
+     * scope instead of being torn down when `evalStack` resolves. Used
+     * by the test harness so the sidecar survives across `beforeAll`,
+     * tests, and `afterAll`. When omitted, behaves as before with a
+     * private scope closed on completion.
+     */
+    scope?: Scope.Scope;
+  },
+) => {
+  const body = Effect.gen(function* () {
+    const stack = yield* effect;
+    const configProvider = yield* loadConfigProvider(Option.none());
+
+    return yield* fn(stack).pipe(
+      provideFreshArtifactStore,
+      Effect.provide(stack.services),
+      Effect.provide(Layer.succeed(ConfigProvider, configProvider)),
+    );
+  }).pipe(
+    Effect.provide(
+      Layer.effect(
+        AuthProviders,
+        Effect.serviceOption(AuthProviders).pipe(
+          Effect.map(Option.getOrElse(() => ({}))),
+        ),
+      ),
+    ),
+    Effect.provide(Layer.succeed(Stage, options.stage)),
+    Effect.provide(Layer.provideMerge(alchemy({ dev: options.dev }), platform)),
+  );
+
+  return options.scope === undefined
+    ? Effect.scoped(body)
+    : Scope.provide(body, options.scope);
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Stage.ts b/.repos/alchemy-effect/packages/alchemy/src/Stage.ts
new file mode 100644
index 00000000000..f9573a3d3a5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Stage.ts
@@ -0,0 +1,3 @@
+import * as Context from "effect/Context";
+
+export class Stage extends Context.Service<Stage, string>()("Stage") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/ActionState.ts b/.repos/alchemy-effect/packages/alchemy/src/State/ActionState.ts
new file mode 100644
index 00000000000..f0d3e5d8c22
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/ActionState.ts
@@ -0,0 +1,51 @@
+import type { NamespaceNode } from "../Namespace.ts";
+
+/**
+ * Persisted state for an {@link Action}. Actions share the same FQN
+ * namespace as resources but are discriminated by `kind: "action"`. The
+ * engine keys action state in the {@link State} store under the same `fqn`
+ * field as resources.
+ */
+export type ActionState = RunningActionState | RanActionState;
+
+export type ActionStatus = ActionState["status"];
+
+interface BaseActionState {
+  readonly kind: "action";
+  /** Type of the Action (e.g. "NightlySync"). Mirrors `resourceType` for resources. */
+  actionType: string;
+  /** Namespace of the Action. */
+  namespace: NamespaceNode | undefined;
+  /** Fully qualified name (namespace + logical id). */
+  fqn: string;
+  /** Logical id of the Action (stable across runs). */
+  logicalId: string;
+  /** Current status. */
+  status: ActionStatus;
+  /** FQNs of nodes that depend on this Action's output. */
+  downstream: string[];
+  /** Hash of the resolved input, used to skip noop runs. */
+  inputHash: string;
+  /** Resolved input snapshot from the most recent attempt. */
+  input: unknown;
+}
+
+/**
+ * The Action body has started but persistence after success has not yet
+ * occurred. On resume the engine treats this as "should run" since the
+ * effect may have completed but the output wasn't durably recorded.
+ */
+export interface RunningActionState extends BaseActionState {
+  status: "running";
+}
+
+/**
+ * The Action body completed and its output is durably persisted. Future
+ * plans skip the body when `inputHash` matches the new resolved input
+ * (unless `--force` is set).
+ */
+export interface RanActionState extends BaseActionState {
+  status: "ran";
+  /** Materialized output value returned by the Action body. */
+  output: unknown;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/HttpStateApi.ts b/.repos/alchemy-effect/packages/alchemy/src/State/HttpStateApi.ts
new file mode 100644
index 00000000000..58af9f70222
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/HttpStateApi.ts
@@ -0,0 +1,222 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiError from "effect/unstable/httpapi/HttpApiError";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import * as HttpApiMiddleware from "effect/unstable/httpapi/HttpApiMiddleware";
+import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
+import * as HttpApiSecurity from "effect/unstable/httpapi/HttpApiSecurity";
+
+/**
+ * Resource-state payload shape on the wire.
+ *
+ * Pinned to JSON encoding via {@link HttpApiSchema.asJson} so that both
+ * sides of the API agree on `Content-Type: application/json`. With a
+ * bare `Schema.Any` the server's payload-decoder map is keyed off the
+ * default content type only — any client request that arrives with a
+ * differently-shaped body (or a transport that drops the
+ * `Content-Type` header entirely) falls into the `payloadBy.get(
+ * contentType)` miss branch in `HttpApiBuilder.decodePayload` and
+ * surfaces as a confusing `415 Unsupported Media Type`. Annotating
+ * the schema makes the encoding explicit on both endpoints and the
+ * client encoder, so the wire format is unambiguous.
+ */
+export const ResourceStateSchema = Schema.Any.pipe(HttpApiSchema.asJson());
+
+export class BearerTokenValidator extends Context.Service<
+  BearerTokenValidator,
+  {
+    readonly validate: (
+      token: string,
+    ) => Effect.Effect<void, HttpApiError.Unauthorized>;
+  }
+>()("alchemy/State/BearerTokenValidator") {}
+
+export class StateAuth extends HttpApiMiddleware.Service<
+  StateAuth,
+  { requires: BearerTokenValidator }
+>()("alchemy/State/StateAuth", {
+  security: {
+    bearer: HttpApiSecurity.bearer,
+  },
+  error: HttpApiError.UnauthorizedNoContent,
+}) {}
+
+export const StateAuthLive: Layer.Layer<
+  StateAuth,
+  never,
+  BearerTokenValidator
+> = Layer.effect(
+  StateAuth,
+  Effect.gen(function* () {
+    const validator = yield* BearerTokenValidator;
+    return {
+      bearer: (httpEffect, { credential }) =>
+        validator
+          .validate(Redacted.value(credential))
+          .pipe(Effect.flatMap(() => httpEffect)),
+    };
+  }),
+);
+
+/** `stack` path segment for nested REST resources. */
+const StackParams = Schema.Struct({
+  stack: Schema.String,
+});
+
+/** Optional stage selector for stack deletion. */
+const OptionalStageQuery = Schema.Struct({
+  stage: Schema.optional(Schema.String),
+});
+
+/** `(stack, stage)` path segments shared by stage-scoped endpoints. */
+const StackStage = Schema.Struct({
+  stack: Schema.String,
+  stage: Schema.String,
+});
+
+/** `(stack, stage, fqn)` path segments for a single resource. */
+const ResourceKey = Schema.Struct({
+  stack: Schema.String,
+  stage: Schema.String,
+  fqn: Schema.String,
+});
+
+export const ListStacks = HttpApiEndpoint.get("listStacks", "/state/stacks", {
+  success: Schema.Array(Schema.String),
+});
+
+export const ListStages = HttpApiEndpoint.get(
+  "listStages",
+  "/state/stacks/:stack/stages",
+  {
+    params: StackParams,
+    success: Schema.Array(Schema.String),
+  },
+);
+
+export const ListResources = HttpApiEndpoint.get(
+  "listResources",
+  "/state/stacks/:stack/stages/:stage/resources",
+  {
+    params: StackStage,
+    success: Schema.Array(Schema.String),
+  },
+);
+
+export const GetState = HttpApiEndpoint.get(
+  "getState",
+  "/state/stacks/:stack/stages/:stage/resources/:fqn",
+  {
+    params: ResourceKey,
+    success: Schema.UndefinedOr(ResourceStateSchema),
+  },
+);
+
+export const SetState = HttpApiEndpoint.put(
+  "setState",
+  "/state/stacks/:stack/stages/:stage/resources/:fqn",
+  {
+    params: ResourceKey,
+    payload: ResourceStateSchema,
+    success: ResourceStateSchema,
+  },
+);
+
+export const DeleteState = HttpApiEndpoint.delete(
+  "deleteState",
+  "/state/stacks/:stack/stages/:stage/resources/:fqn",
+  {
+    params: ResourceKey,
+    success: HttpApiSchema.NoContent,
+  },
+);
+
+export const DeleteStack = HttpApiEndpoint.delete(
+  "deleteStack",
+  "/state/stacks/:stack",
+  {
+    params: StackParams,
+    query: OptionalStageQuery,
+    success: HttpApiSchema.NoContent,
+  },
+);
+
+export const GetReplacedResources = HttpApiEndpoint.get(
+  "getReplacedResources",
+  "/state/stacks/:stack/stages/:stage/replaced-resources",
+  {
+    params: StackStage,
+    success: Schema.Array(ResourceStateSchema),
+  },
+);
+
+export const GetStackOutput = HttpApiEndpoint.get(
+  "getStackOutput",
+  "/state/stacks/:stack/stages/:stage/output",
+  {
+    params: StackStage,
+    success: Schema.UndefinedOr(ResourceStateSchema),
+  },
+);
+
+export const SetStackOutput = HttpApiEndpoint.put(
+  "setStackOutput",
+  "/state/stacks/:stack/stages/:stage/output",
+  {
+    params: StackStage,
+    payload: ResourceStateSchema,
+    success: ResourceStateSchema,
+  },
+);
+
+/**
+ * Version of the State Store wire / behavioural contract.
+ *
+ * Bump this whenever the wire format or runtime behaviour of an HTTP
+ * state-store changes in a way that an older deployed copy can no
+ * longer satisfy. Clients query `/version` on the deployed worker and
+ * compare against this constant; a mismatch (or 404) triggers a
+ * forced redeploy via the bootstrap flow.
+ */
+export const STATE_STORE_VERSION = 5 as const;
+
+/** Response shape for the unauthenticated `/version` probe. */
+export const VersionResponse = Schema.Struct({
+  version: Schema.Number,
+});
+
+/**
+ * Unauthenticated probe so clients can detect a stale (or absent)
+ * deployed worker without holding a valid bearer token. The returned
+ * version is bumped whenever the wire / behavioural contract changes
+ * in a way that requires a redeploy.
+ */
+export const GetVersion = HttpApiEndpoint.get("getVersion", "/version", {
+  success: VersionResponse,
+});
+
+export class StateGroup extends HttpApiGroup.make("state")
+  .add(ListStacks)
+  .add(ListStages)
+  .add(ListResources)
+  .add(GetState)
+  .add(SetState)
+  .add(DeleteState)
+  .add(GetReplacedResources)
+  .add(DeleteStack)
+  .add(GetStackOutput)
+  .add(SetStackOutput)
+  .middleware(StateAuth) {}
+
+export class VersionGroup extends HttpApiGroup.make("version").add(
+  GetVersion,
+) {}
+
+export class StateApi extends HttpApi.make("alchemy-state")
+  .add(StateGroup)
+  .add(VersionGroup) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/HttpStateStore.ts b/.repos/alchemy-effect/packages/alchemy/src/State/HttpStateStore.ts
new file mode 100644
index 00000000000..78f0e261f1e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/HttpStateStore.ts
@@ -0,0 +1,242 @@
+import * as Effect from "effect/Effect";
+import { identity } from "effect/Function";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { StateApi } from "./HttpStateApi.ts";
+
+import type { ReplacedResourceState, ResourceState } from "./ResourceState.ts";
+import {
+  StateStoreError,
+  type PersistedState,
+  type StateService,
+} from "./State.ts";
+import { encodeState, reviveStateRecursive } from "./StateEncoding.ts";
+
+/**
+ * Persisted shape of an HTTP state store endpoint — `{ url, authToken }`.
+ * Stored in the credentials file alongside other per-profile secrets.
+ * Deliberately separate from {@link HttpStateStoreProps}: `id` and
+ * `transformClient` are deployment-time choices, not credentials.
+ */
+export interface HttpStateStoreCredentials {
+  url: string;
+  /** Bearer token used to authenticate every request. */
+  authToken: string;
+}
+
+export interface HttpStateStoreProps extends HttpStateStoreCredentials {
+  /**
+   * `StateService.id` slug for telemetry — e.g. `"http"` for a bare
+   * HTTP store, `"cloudflare-http"` for the Cloudflare-deployed
+   * variant. Required so every concrete deployment of this state-store
+   * shape shows up distinctly on the adoption dashboard.
+   */
+  id: string;
+  transformClient?: (
+    client: HttpClientRequest.HttpClientRequest,
+  ) => HttpClientRequest.HttpClientRequest;
+}
+
+export const checkHttpStateStoreAuth = ({
+  url,
+  authToken,
+}: {
+  url: string;
+  authToken: string;
+}) =>
+  Effect.gen(function* () {
+    const apiClient = yield* HttpApiClient.make(StateApi, {
+      baseUrl: url,
+      transformClient: HttpClient.mapRequest((req) =>
+        req.pipe(HttpClientRequest.bearerToken(authToken)),
+      ),
+    });
+    return yield* apiClient.state.listStacks().pipe(
+      Effect.map(() => true),
+      Effect.catchTag("Unauthorized", () => Effect.succeed(false)),
+      Effect.retry({
+        while: (error) =>
+          error._tag === "HttpClientError" &&
+          !!error.response &&
+          // worker can 404 for a bit on first deploy
+          (error.response.status === 404 || error.response.status >= 500),
+        schedule: Schedule.fixed(200),
+      }),
+    );
+  });
+
+export const makeHttpStateStore = ({
+  url,
+  authToken,
+  transformClient,
+  id,
+}: HttpStateStoreProps) =>
+  Effect.gen(function* () {
+    const apiClient = yield* HttpApiClient.make(StateApi, {
+      baseUrl: url,
+      transformClient: HttpClient.mapRequest((req) =>
+        req.pipe(
+          HttpClientRequest.bearerToken(authToken),
+          transformClient ?? identity,
+        ),
+      ),
+    });
+    const state = apiClient.state;
+
+    const service: StateService = {
+      id,
+      getVersion: () =>
+        apiClient.version.getVersion().pipe(
+          Effect.map((v) => v.version),
+          mapStateStoreError,
+        ),
+      listStacks: () =>
+        state.listStacks().pipe(
+          Effect.map((stacks) => [...stacks]),
+          mapStateStoreError,
+        ),
+      listStages: (stack) =>
+        state.listStages({ params: { stack } }).pipe(mapStateStoreError),
+      list: (request) =>
+        state.listResources({ params: request }).pipe(mapStateStoreError),
+      get: (request) =>
+        state
+          .getState({
+            params: {
+              stack: request.stack,
+              stage: request.stage,
+              fqn: encodeURIComponent(request.fqn),
+            },
+          })
+          .pipe(
+            Effect.map((s) =>
+              s == null
+                ? undefined
+                : (reviveStateRecursive(s) as ResourceState),
+            ),
+            mapStateStoreError,
+          ),
+      getReplacedResources: (request) =>
+        state.getReplacedResources({ params: request }).pipe(
+          Effect.map((resources) =>
+            resources.map(
+              (s) => reviveStateRecursive(s) as ReplacedResourceState,
+            ),
+          ),
+          mapStateStoreError,
+        ),
+      set: <V extends PersistedState>(request: {
+        stack: string;
+        stage: string;
+        fqn: string;
+        value: V;
+      }) =>
+        state
+          .setState({
+            params: {
+              stack: request.stack,
+              stage: request.stage,
+              fqn: encodeURIComponent(request.fqn),
+            },
+            payload: encodeState(request.value),
+          })
+          .pipe(
+            // Server echoes the stored value, but the client already
+            // has the canonical object (including any Redacted<T>
+            // instances); returning the input avoids a lossy round-trip.
+            Effect.map(() => request.value),
+            mapStateStoreError,
+          ),
+      delete: (request) =>
+        state
+          .deleteState({
+            params: {
+              stack: request.stack,
+              stage: request.stage,
+              fqn: encodeURIComponent(request.fqn),
+            },
+          })
+          .pipe(Effect.asVoid, mapStateStoreError),
+      deleteStack: (request) =>
+        state
+          .deleteStack({
+            params: { stack: request.stack },
+            query: request.stage === undefined ? {} : { stage: request.stage },
+          })
+          .pipe(Effect.asVoid, mapStateStoreError),
+      getOutput: (request) =>
+        state
+          .getStackOutput({
+            params: { stack: request.stack, stage: request.stage },
+          })
+          .pipe(
+            Effect.map((s) =>
+              s == null ? undefined : reviveStateRecursive(s),
+            ),
+            mapStateStoreError,
+          ),
+      setOutput: (request) =>
+        state
+          .setStackOutput({
+            params: { stack: request.stack, stage: request.stage },
+            payload: encodeState(request.value as any),
+          })
+          .pipe(
+            Effect.map(() => request.value),
+            mapStateStoreError,
+          ),
+    };
+    return service;
+  });
+
+/**
+ * Predicate over an `HttpClientError`-shaped failure that returns `true`
+ * for failures we expect to clear up on their own.
+ *
+ * We retry:
+ * - all transport-level errors (no `response` — DNS, TCP reset, TLS,
+ *   abort, etc.)
+ * - 408 (request timeout) and 429 (rate limit)
+ * - 404, which is normal in the seconds after a worker is first
+ *   deployed and the route hasn't propagated yet
+ * - every 5xx
+ *
+ * Anything else (400/401/403/etc.) is a real client-side problem and
+ * shouldn't be hidden behind retries.
+ */
+const isTransient = (e: any): boolean => {
+  if (e?._tag !== "HttpClientError") return false;
+  const status: number | undefined = e.response?.status;
+  if (status == null) return true;
+  if (status === 404 || status === 408 || status === 429) return true;
+  return status >= 500 && status < 600;
+};
+
+const retryTransient = <A, Err, Req>(eff: Effect.Effect<A, Err, Req>) =>
+  Effect.retry(eff, {
+    while: isTransient,
+    // Exponential backoff capped at 2s, max 5 attempts. Beyond that
+    // the issue isn't transient and we'd rather surface a hard
+    // failure than block the deploy indefinitely.
+    schedule: Schedule.exponential(100).pipe(
+      Schedule.either(Schedule.spaced("2 seconds")),
+      Schedule.both(Schedule.recurs(5)),
+    ),
+  });
+
+/** Collapse any client failure into a {@link StateStoreError}. */
+const mapStateStoreError = <A, E, R>(eff: Effect.Effect<A, E, R>) =>
+  eff.pipe(
+    retryTransient,
+    Effect.tapError(Effect.log),
+    Effect.catch((e: E) =>
+      Effect.fail(
+        new StateStoreError({
+          message: e instanceof Error ? e.message : String(e),
+          cause: e instanceof Error ? e : undefined,
+        }),
+      ),
+    ),
+  ) as Effect.Effect<A, StateStoreError, R>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/InMemoryState.ts b/.repos/alchemy-effect/packages/alchemy/src/State/InMemoryState.ts
new file mode 100644
index 00000000000..bce2ad57951
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/InMemoryState.ts
@@ -0,0 +1,115 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { recordStateStoreInit } from "../Telemetry/Metrics.ts";
+import { STATE_STORE_VERSION } from "./HttpStateApi.ts";
+import type { ResourceState } from "./ResourceState.ts";
+import { State, type PersistedState } from "./State.ts";
+
+type StackId = string;
+type StageId = string;
+type Fqn = string;
+
+export const inMemoryState = (
+  initialState: Record<
+    StackId,
+    Record<StageId, Record<Fqn, ResourceState>>
+  > = {},
+  initialOutputs: Record<StackId, Record<StageId, unknown>> = {},
+) =>
+  Layer.effect(
+    State,
+    Effect.cached(
+      InMemoryService(initialState, initialOutputs).pipe(recordStateStoreInit),
+    ),
+  );
+
+export const InMemoryService = (
+  state: Record<StackId, Record<StageId, Record<Fqn, ResourceState>>> = {},
+  outputs: Record<StackId, Record<StageId, unknown>> = {},
+) =>
+  State.of(
+    Effect.succeed({
+      id: "inmemory",
+      getVersion: () => Effect.succeed(STATE_STORE_VERSION),
+      listStacks: () => Effect.succeed(Array.from(Object.keys(state))),
+      listStages: (stack: string) =>
+        Effect.succeed(
+          Array.from(stack in state ? Object.keys(state[stack]) : []),
+        ),
+      get: ({
+        stack,
+        stage,
+        fqn,
+      }: {
+        stack: string;
+        stage: string;
+        fqn: string;
+      }) => Effect.succeed(state[stack]?.[stage]?.[fqn]),
+      getReplacedResources: ({
+        stack,
+        stage,
+      }: {
+        stack: string;
+        stage: string;
+      }) =>
+        Effect.succeed(
+          Array.from(Object.values(state[stack]?.[stage] ?? {}) ?? []).filter(
+            (s) => s.status === "replaced",
+          ),
+        ),
+      set: <V extends PersistedState>({
+        stack,
+        stage,
+        fqn,
+        value,
+      }: {
+        stack: string;
+        stage: string;
+        fqn: string;
+        value: V;
+      }) =>
+        Effect.sync(() => {
+          const stackState = (state[stack] ??= {});
+          const stageState = (stackState[stage] ??= {});
+          stageState[fqn] = value as ResourceState;
+          return value;
+        }),
+      delete: ({
+        stack,
+        stage,
+        fqn,
+      }: {
+        stack: string;
+        stage: string;
+        fqn: string;
+      }) => Effect.sync(() => delete state[stack]?.[stage]?.[fqn]),
+      deleteStack: ({ stack, stage }: { stack: string; stage?: string }) =>
+        Effect.sync(() => {
+          if (stage === undefined) {
+            delete state[stack];
+          } else {
+            delete state[stack]?.[stage];
+          }
+        }),
+      list: ({ stack, stage }: { stack: string; stage: string }) =>
+        Effect.succeed(
+          Array.from(Object.keys(state[stack]?.[stage] ?? {}) ?? []),
+        ),
+      getOutput: ({ stack, stage }: { stack: string; stage: string }) =>
+        Effect.succeed(outputs[stack]?.[stage]),
+      setOutput: ({
+        stack,
+        stage,
+        value,
+      }: {
+        stack: string;
+        stage: string;
+        value: unknown;
+      }) =>
+        Effect.sync(() => {
+          const stackOutputs = (outputs[stack] ??= {});
+          stackOutputs[stage] = value;
+          return value;
+        }),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/LocalState.ts b/.repos/alchemy-effect/packages/alchemy/src/State/LocalState.ts
new file mode 100644
index 00000000000..d9d6fd9e0b0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/LocalState.ts
@@ -0,0 +1,158 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import type { PlatformError } from "effect/PlatformError";
+import { decodeFqn, encodeFqn } from "../FQN.ts";
+import { recordStateStoreInit } from "../Telemetry/Metrics.ts";
+import { STATE_STORE_VERSION } from "./HttpStateApi.ts";
+import { State, StateStoreError, type StateService } from "./State.ts";
+import { encodeState, reviveState } from "./StateEncoding.ts";
+
+export const localState = () =>
+  Layer.effect(
+    State,
+    Effect.gen(function* () {
+      const context = yield* Effect.context<
+        FileSystem.FileSystem | Path.Path
+      >();
+
+      const make = makeLocalState().pipe(
+        recordStateStoreInit,
+        Effect.provideContext(context),
+      );
+
+      return yield* Effect.cached(make);
+    }),
+  );
+
+export const makeLocalState = () =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dotAlchemy = path.join(process.cwd(), ".alchemy");
+    const stateDir = path.join(dotAlchemy, "state");
+
+    const fail = (err: PlatformError) =>
+      Effect.fail(
+        new StateStoreError({
+          message: err.message,
+          cause: err,
+        }),
+      );
+
+    const recover = <T>(effect: Effect.Effect<T, PlatformError, never>) =>
+      effect.pipe(
+        Effect.catchTag("PlatformError", (e) =>
+          e.reason._tag === "NotFound" ? Effect.void : fail(e),
+        ),
+      );
+
+    const stageDir = ({ stack, stage }: { stack: string; stage: string }) =>
+      path.join(stateDir, stack, stage);
+
+    const resource = ({
+      stack,
+      stage,
+      fqn,
+    }: {
+      stack: string;
+      stage: string;
+      fqn: string;
+    }) => path.join(stateDir, stack, stage, `${encodeFqn(fqn)}.json`);
+
+    const outputFile = ({ stack, stage }: { stack: string; stage: string }) =>
+      path.join(stateDir, stack, stage, `__stack_output__.json`);
+
+    const created = new Set<string>();
+
+    const ensure = (dir: string) =>
+      created.has(dir)
+        ? Effect.succeed(void 0)
+        : fs
+            .makeDirectory(dir, { recursive: true })
+            .pipe(Effect.tap(() => Effect.sync(() => created.add(dir))));
+
+    const state: StateService = {
+      id: "local",
+      getVersion: () => Effect.succeed(STATE_STORE_VERSION),
+      listStacks: () =>
+        fs.readDirectory(stateDir).pipe(
+          recover,
+          Effect.map((files) => files ?? []),
+        ),
+      listStages: (stack: string) =>
+        fs.readDirectory(path.join(stateDir, stack)).pipe(
+          recover,
+          Effect.map((files) => files ?? []),
+        ),
+      get: (request) =>
+        fs.readFile(resource(request)).pipe(
+          Effect.map((file) => JSON.parse(file.toString(), reviveState)),
+          recover,
+        ),
+      getReplacedResources: Effect.fnUntraced(function* (request) {
+        return (yield* Effect.all(
+          (yield* state.list(request)).map((fqn) =>
+            state.get({
+              stack: request.stack,
+              stage: request.stage,
+              fqn,
+            }),
+          ),
+        )).filter((r) => r?.status === "replaced");
+      }),
+      set: (request) =>
+        ensure(stageDir(request)).pipe(
+          Effect.flatMap(() =>
+            fs.writeFileString(
+              resource(request),
+              JSON.stringify(encodeState(request.value), null, 2),
+            ),
+          ),
+          recover,
+          Effect.map(() => request.value),
+        ),
+      delete: (request) => fs.remove(resource(request)).pipe(recover),
+      deleteStack: ({ stack, stage }) =>
+        fs
+          .remove(
+            stage === undefined
+              ? path.join(stateDir, stack)
+              : stageDir({ stack, stage }),
+            { recursive: true },
+          )
+          .pipe(recover),
+      list: (request) =>
+        fs.readDirectory(stageDir(request)).pipe(
+          recover,
+          Effect.map((files) =>
+            (files ?? [])
+              // Filter the bookkeeping file before decoding — `decodeFqn`
+              // replaces `__` with `/`, which would turn the literal name
+              // `__stack_output__` into `/stack_output/` and slip past the
+              // filter, leaving the engine to look up a non-existent
+              // resource.
+              .filter((file) => file !== "__stack_output__.json")
+              .map((file) => decodeFqn(file.replace(/\.json$/, ""))),
+          ),
+        ),
+      getOutput: (request) =>
+        fs.readFile(outputFile(request)).pipe(
+          Effect.map((file) => JSON.parse(file.toString(), reviveState)),
+          recover,
+        ),
+      setOutput: (request) =>
+        ensure(stageDir(request)).pipe(
+          Effect.flatMap(() =>
+            fs.writeFileString(
+              outputFile(request),
+              JSON.stringify(encodeState(request.value as any), null, 2),
+            ),
+          ),
+          recover,
+          Effect.map(() => request.value),
+        ),
+    };
+    return state;
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/ResourceState.ts b/.repos/alchemy-effect/packages/alchemy/src/State/ResourceState.ts
new file mode 100644
index 00000000000..7c29578518f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/ResourceState.ts
@@ -0,0 +1,126 @@
+import type { NamespaceNode } from "../Namespace.ts";
+import type { RemovalPolicy } from "../RemovalPolicy.ts";
+import type { ResourceBinding } from "../Resource.ts";
+
+export type ResourceState =
+  | CreatingResourceState
+  | CreatedResourceState
+  | UpdatingReourceState
+  | UpdatedResourceState
+  | DeletingResourceState
+  | ReplacingResourceState
+  | ReplacedResourceState;
+
+export type Props = Record<string, any>;
+export type Attr = Record<string, any>;
+
+export type ResourceStatus = ResourceState["status"];
+export type ReplacementResourceState =
+  | ReplacingResourceState
+  | ReplacedResourceState;
+export type ReplacementOldResourceState =
+  | CreatingResourceState
+  | CreatedResourceState
+  | UpdatingReourceState
+  | UpdatedResourceState
+  | DeletingResourceState
+  | ReplacementResourceState;
+
+interface BaseResourceState {
+  /**
+   * Discriminator vs {@link ActionState}. Optional for back-compat: legacy
+   * persisted rows have no `kind` field and are implicitly resources.
+   */
+  readonly kind?: "resource";
+  /** Type of the Resource (e.g. AWS.Lambda.Function) */
+  resourceType: string;
+  /** Namespace of the Resource */
+  namespace: NamespaceNode | undefined;
+  /** Fully Qualified Name (namespace path + logical ID) */
+  fqn: string;
+  /** Logical ID of the Resource (stable across creates, updates, deletes and replaces) */
+  logicalId: string;
+  /** A unique randomly generated token used to seed ID generation (only changes when replaced) */
+  instanceId: string;
+  /** The version of the provider that was used to create/update the resource. */
+  providerVersion: number;
+  /** Current status of the logical Resource */
+  status: ResourceStatus;
+  /** List of FQNs of resources that depend on this resource */
+  downstream: string[];
+  /** List of Bindings attached to this Resource */
+  bindings: ResourceBinding[];
+  /** Desired state (input props) of this Resource */
+  props?: Props;
+  /** The output attributes of this Resource (if it has been created) */
+  attr?: Attr;
+  /** The removal policy of the resource */
+  removalPolicy?: RemovalPolicy["Service"];
+}
+
+export interface CreatingResourceState extends BaseResourceState {
+  status: "creating";
+  /** The new resource properties that are being (or have been) applied. */
+  props: Props;
+}
+
+export interface CreatedResourceState extends BaseResourceState {
+  status: "created";
+  /** The new resource properties that have been applied. */
+  props: Props;
+  /** The output attributes of the created resource */
+  attr: Attr;
+}
+
+export interface UpdatingReourceState extends BaseResourceState {
+  status: "updating";
+  /** The new resource properties that are being (or have been) applied. */
+  props: Props;
+  old: {
+    /** The old resource properties that have been successfully applied. */
+    props: Props;
+    /** List of Bindings attached to this Resource */
+    bindings: any[];
+    /** The old output properties that have been successfully applied. */
+    attr: Attr;
+    // TODO(sam): do I need to track the old downstream edges?
+    // downstream: string[];
+  };
+}
+
+export interface UpdatedResourceState extends BaseResourceState {
+  status: "updated";
+  /** The new resource properties that are being (or have been) applied. */
+  props: Props;
+  /** The output attributes of the created resource */
+  attr: Attr;
+}
+
+export interface DeletingResourceState extends BaseResourceState {
+  status: "deleting";
+  /** Attributes of the resource being deleted */
+  attr: Attr | undefined;
+}
+
+export interface ReplacingResourceState extends BaseResourceState {
+  status: "replacing";
+  /** Desired properties of the new resource (the replacement) */
+  props: Props;
+  /** Reference to the state of the old resource (the one being replaced) */
+  old: ReplacementOldResourceState;
+  /** Whether the resource should be deleted before or after replacements */
+  deleteFirst: boolean;
+}
+
+export interface ReplacedResourceState extends BaseResourceState {
+  status: "replaced";
+  /** Desired properties of the new resource (the replacement) */
+  props: Props;
+  /** Output attributes of the new resource (the replacement) */
+  attr: Attr;
+  /** Reference to the state of the old resource (the one being replaced) */
+  old: ReplacementOldResourceState;
+  /** Whether the resource should be deleted before or after replacements */
+  deleteFirst: boolean;
+  // .. will (finally) transition to `CreatedResourceState` after finalizing
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/State.ts b/.repos/alchemy-effect/packages/alchemy/src/State/State.ts
new file mode 100644
index 00000000000..1249680b388
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/State.ts
@@ -0,0 +1,135 @@
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import type { ActionState } from "./ActionState.ts";
+import type { ReplacedResourceState, ResourceState } from "./ResourceState.ts";
+
+/**
+ * Anything persistable under an FQN. Resources are discriminated by status
+ * strings ("creating", "created", …) and Tasks by `kind: "action"`.
+ */
+export type PersistedState = ResourceState | ActionState;
+
+export const isActionState = (
+  s: PersistedState | undefined,
+): s is ActionState => !!s && (s as any).kind === "action";
+
+export const isResourceState = (
+  s: PersistedState | undefined,
+): s is ResourceState => !!s && (s as any).kind !== "task";
+
+export class StateStoreError extends Data.TaggedError("StateStoreError")<{
+  message: string;
+  cause?: Error;
+}> {}
+
+export class State extends Context.Service<
+  State,
+  Effect.Effect<StateService>
+>()("alchemy/State") {}
+
+/**
+ * State service interface.
+ *
+ * Resources are keyed by FQN (namespace-qualified key) which includes
+ * the full namespace path plus the logical ID. The FQN is used as the
+ * storage key while logicalId remains available in the persisted state
+ * for provider operations.
+ */
+export interface StateService {
+  /**
+   * Stable identifier for the State store implementation, used for
+   * telemetry tagging (`alchemy.state_store.id`) so we can answer
+   * "which backends are people using" without hard-coding a closed
+   * union. Examples: `"local"`, `"inmemory"`, `"http"`,
+   * `"cloudflare-http"`. Third-party state stores should pick a short,
+   * stable, kebab-case slug.
+   */
+  readonly id: string;
+  /**
+   * Wire / behavioural contract version of this state-store
+   * implementation. For local / in-process stores this is the
+   * `STATE_STORE_VERSION` the CLI was built against; for HTTP-backed
+   * stores it is the version reported by the deployed `/version`
+   * probe.
+   */
+  getVersion(): Effect.Effect<number, StateStoreError, never>;
+  listStacks(): Effect.Effect<readonly string[], StateStoreError, never>;
+  listStages(
+    stack: string,
+  ): Effect.Effect<readonly string[], StateStoreError, never>;
+  /**
+   * Get a resource by its FQN (namespace-qualified key).
+   */
+  get(request: {
+    stack: string;
+    stage: string;
+    fqn: string;
+  }): Effect.Effect<PersistedState | undefined, StateStoreError, never>;
+  /**
+   * List top-level resources that are still in replacement cleanup.
+   *
+   * Any additional backlog from repeated replacements is stored recursively
+   * in the returned state's `old` chain.
+   */
+  getReplacedResources(request: {
+    stack: string;
+    stage: string;
+  }): Effect.Effect<
+    ReadonlyArray<ReplacedResourceState>,
+    StateStoreError,
+    never
+  >;
+  /**
+   * Set a resource by its FQN (namespace-qualified key).
+   */
+  set<V extends PersistedState>(request: {
+    stack: string;
+    stage: string;
+    fqn: string;
+    value: V;
+  }): Effect.Effect<V, StateStoreError, never>;
+  /**
+   * Delete a resource by its FQN (namespace-qualified key).
+   */
+  delete(request: {
+    stack: string;
+    stage: string;
+    fqn: string;
+  }): Effect.Effect<void, StateStoreError, never>;
+  /**
+   * Delete an entire stack, or a single stage when `stage` is provided.
+   */
+  deleteStack(request: {
+    stack: string;
+    stage?: string;
+  }): Effect.Effect<void, StateStoreError, never>;
+  /**
+   * List all resource FQNs in a stack/stage.
+   */
+  list(request: {
+    stack: string;
+    stage: string;
+  }): Effect.Effect<readonly string[], StateStoreError, never>;
+  /**
+   * Read the persisted stack output for `(stack, stage)`. Returns
+   * `undefined` when the stack has not been deployed (or has been
+   * destroyed) at this stage.
+   *
+   * Stack outputs are written by `apply` once the deploy succeeds and
+   * read by cross-stack references (`yield* OtherStack` /
+   * `OtherStack.stage.<name>` / `Output.stackRef(...)`).
+   */
+  getOutput(request: {
+    stack: string;
+    stage: string;
+  }): Effect.Effect<unknown, StateStoreError, never>;
+  /**
+   * Persist the resolved stack output for `(stack, stage)`.
+   */
+  setOutput(request: {
+    stack: string;
+    stage: string;
+    value: unknown;
+  }): Effect.Effect<unknown, StateStoreError, never>;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/StateEncoding.ts b/.repos/alchemy-effect/packages/alchemy/src/State/StateEncoding.ts
new file mode 100644
index 00000000000..8aab6026408
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/StateEncoding.ts
@@ -0,0 +1,141 @@
+import * as Duration from "effect/Duration";
+import * as Redacted from "effect/Redacted";
+import { isResource } from "../Resource.ts";
+
+/**
+ * JSON marker used to tag a `Redacted<T>` value when writing state.
+ * The reviver recognises objects with exactly this key and rebuilds
+ * the `Redacted` wrapper on read.
+ */
+export const REDACTED_MARKER = "__redacted__";
+
+/**
+ * JSON marker used to tag a `Duration` value when writing state.
+ * The reviver recognises objects with exactly this key and rebuilds
+ * a real `Duration` instance on read so that downstream code can call
+ * `Duration.toSeconds`, `Duration.toMillis`, etc. without first
+ * decoding `Duration.toJSON`'s `{_id,_tag,...}` shape.
+ */
+export const DURATION_MARKER = "__duration__";
+
+const decodeDuration = (encoded: unknown): Duration.Duration | undefined => {
+  if (encoded === null || typeof encoded !== "object") return undefined;
+  const json = encoded as {
+    _tag?: "Millis" | "Nanos" | "Infinity" | "NegativeInfinity";
+    millis?: number;
+    nanos?: string;
+  };
+  switch (json._tag) {
+    case "Millis":
+      return json.millis !== undefined
+        ? Duration.millis(json.millis)
+        : undefined;
+    case "Nanos":
+      return json.nanos !== undefined
+        ? Duration.nanos(BigInt(json.nanos))
+        : undefined;
+    case "Infinity":
+      return Duration.infinity;
+    case "NegativeInfinity":
+      return Duration.zero; // Effect treats negatives as zero clamp
+    default:
+      return undefined;
+  }
+};
+
+/**
+ * Recursively encode a state value for JSON serialisation.
+ *
+ * - `Redacted<T>` values are wrapped as `{ [REDACTED_MARKER]: <inner> }`
+ *   so the actual string is persisted rather than the `<redacted>`
+ *   placeholder produced by the default `toJSON`.
+ * - `Resource` instances are flattened to `{ id, type, props, attr }`
+ *   so persisted state matches the schema used by the loader.
+ * - Plain objects and arrays are walked structurally.
+ */
+export const encodeState = (value: unknown): unknown => {
+  if (
+    value === null ||
+    value === undefined ||
+    typeof value === "string" ||
+    typeof value === "number" ||
+    typeof value === "boolean"
+  )
+    return value;
+  if (Redacted.isRedacted(value)) {
+    return {
+      [REDACTED_MARKER]: encodeState(Redacted.value(value)),
+    };
+  }
+  if (Duration.isDuration(value)) {
+    // `JSON.stringify(Duration.seconds(N))` already invokes Duration.toJSON,
+    // but encodeState is also called for code paths that don't go through
+    // `JSON.stringify` (e.g. the HTTP state-store). Tag with our marker so
+    // the reviver can unambiguously rebuild a real Duration instance —
+    // Duration.toJSON's `{_id,_tag,...}` shape is NOT a valid Duration.Input.
+    return {
+      [DURATION_MARKER]: value.toJSON(),
+    };
+  }
+  if (isResource(value)) {
+    return {
+      id: value.LogicalId,
+      type: value.Type,
+      props: encodeState(value.Props),
+      attr: encodeState(value.Attributes),
+    };
+  }
+  if (Array.isArray(value)) return value.map(encodeState);
+  if (typeof value === "object") {
+    const result: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) {
+      result[k] = encodeState(v);
+    }
+    return result;
+  }
+  return value;
+};
+
+/**
+ * JSON reviver that rebuilds `Redacted<T>` values that were written
+ * through {@link encodeState}. Intended for use with `JSON.parse`.
+ */
+export const reviveState = (_key: string, value: unknown): unknown => {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value as Record<string, unknown>;
+    if (REDACTED_MARKER in obj) {
+      return Redacted.make(obj[REDACTED_MARKER]);
+    }
+    if (DURATION_MARKER in obj) {
+      const decoded = decodeDuration(obj[DURATION_MARKER]);
+      if (decoded !== undefined) return decoded;
+    }
+  }
+  return value;
+};
+
+/**
+ * Recursively walk an already-decoded value and rebuild `Redacted<T>`
+ * instances from `{ [REDACTED_MARKER]: <inner> }` envelopes. Mirror
+ * image of {@link encodeState} for callers that hold a parsed JS
+ * value rather than a JSON string (e.g. the HTTP state-store client,
+ * which receives values pre-parsed by `HttpApiClient`).
+ */
+export const reviveStateRecursive = (value: unknown): unknown => {
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(reviveStateRecursive);
+  const obj = value as Record<string, unknown>;
+  const keys = Object.keys(obj);
+  if (keys.length === 1 && keys[0] === REDACTED_MARKER) {
+    return Redacted.make(reviveStateRecursive(obj[REDACTED_MARKER]));
+  }
+  if (keys.length === 1 && keys[0] === DURATION_MARKER) {
+    const decoded = decodeDuration(obj[DURATION_MARKER]);
+    if (decoded !== undefined) return decoded;
+  }
+  const result: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(obj)) {
+    result[k] = reviveStateRecursive(v);
+  }
+  return result;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/Sync.ts b/.repos/alchemy-effect/packages/alchemy/src/State/Sync.ts
new file mode 100644
index 00000000000..f26ac1ddd6a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/Sync.ts
@@ -0,0 +1,89 @@
+import * as Effect from "effect/Effect";
+import { type StateService } from "./State.ts";
+
+/**
+ * Synchronize all state (every stack/stage/resource) from `source` into
+ * `destination` so that `destination` becomes a mirror of `source`.
+ *
+ * For each `{ stack, stage, fqn }` present in `source`, the resource is
+ * written into `destination`, overwriting any existing entry under the same
+ * key. Any keys present in `destination` but absent from `source` are
+ * deleted, ensuring the two stores end up structurally identical.
+ *
+ * Stacks are walked sequentially; stages within a stack and resources
+ * within a stage are processed concurrently for throughput.
+ */
+export const syncState = Effect.fnUntraced(function* (
+  source: StateService,
+  destination: StateService,
+  options?: {
+    stacks?: string[];
+    /**
+     * Maximum number of resources to copy in parallel within a single stage.
+     * @default "unbounded".
+     */
+    concurrency?: number | "unbounded";
+  },
+) {
+  const concurrency = options?.concurrency ?? "unbounded";
+  const [sourceStacks, destStacks] = yield* Effect.all([
+    source.listStacks(),
+    destination.listStacks(),
+  ]);
+  const sourceStackSet = new Set(
+    sourceStacks.filter((stack) => options?.stacks?.includes(stack) ?? true),
+  );
+
+  yield* Effect.forEach(
+    sourceStacks,
+    Effect.fnUntraced(function* (stack) {
+      const [sourceStages, destStages] = yield* Effect.all([
+        source.listStages(stack),
+        destination.listStages(stack),
+      ]);
+      const stages = union(sourceStages, destStages);
+
+      yield* Effect.forEach(
+        stages,
+        Effect.fnUntraced(function* (stage) {
+          const sourceFqns = yield* source.list({ stack, stage });
+          const destFqns = yield* destination.list({ stack, stage });
+
+          const sourceSet = new Set(sourceFqns);
+          const toDelete = destFqns.filter((fqn) => !sourceSet.has(fqn));
+
+          yield* Effect.all(
+            [
+              Effect.forEach(
+                sourceFqns,
+                Effect.fnUntraced(function* (fqn) {
+                  const value = yield* source.get({ stack, stage, fqn });
+                  if (value) {
+                    yield* destination.set({ stack, stage, fqn, value });
+                  }
+                }),
+                { concurrency },
+              ),
+              Effect.forEach(
+                toDelete,
+                (fqn) => destination.delete({ stack, stage, fqn }),
+                { concurrency },
+              ),
+            ],
+            { concurrency: "unbounded" },
+          );
+        }),
+        { concurrency: "unbounded" },
+      );
+    }),
+  );
+
+  yield* Effect.forEach(
+    destStacks.filter((stack) => !sourceStackSet.has(stack)),
+    (stack) => destination.deleteStack({ stack }),
+  );
+});
+
+const union = <T>(left: Iterable<T>, right: Iterable<T>) => [
+  ...new Set([...left, ...right]),
+];
diff --git a/.repos/alchemy-effect/packages/alchemy/src/State/index.ts b/.repos/alchemy-effect/packages/alchemy/src/State/index.ts
new file mode 100644
index 00000000000..0740be1b41e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/State/index.ts
@@ -0,0 +1,9 @@
+export * from "./HttpStateApi.ts";
+export * from "./HttpStateStore.ts";
+export * from "./InMemoryState.ts";
+export * from "./LocalState.ts";
+export * from "./ResourceState.ts";
+export * from "./State.ts";
+export * from "./ActionState.ts";
+export * from "./StateEncoding.ts";
+export * from "./Sync.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Tags.ts b/.repos/alchemy-effect/packages/alchemy/src/Tags.ts
new file mode 100644
index 00000000000..59f019969a3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Tags.ts
@@ -0,0 +1,113 @@
+import * as Effect from "effect/Effect";
+import { Stack } from "./Stack.ts";
+import { Stage } from "./Stage.ts";
+
+export type Tags =
+  | Record<string, string | undefined>
+  | [string, string][]
+  | { Key: string; Value: string }[];
+
+export const normalizeTags = (tags: Tags) =>
+  Array.isArray(tags)
+    ? Object.fromEntries(
+        tags.map((tag) =>
+          Array.isArray(tag) ? [tag[0], tag[1]] : [tag.Key, tag.Value],
+        ),
+      )
+    : tags;
+
+export const tagRecord = (tags: Tags | undefined): Record<string, string> =>
+  Object.fromEntries(
+    Object.entries(normalizeTags(tags ?? {})).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined,
+    ),
+  );
+
+export const hasTags = (expectedTags: Tags, tags: Tags | undefined) => {
+  const actualTags = normalizeTags(tags ?? []);
+  return Object.entries(normalizeTags(expectedTags)).every(
+    ([key, value]) => actualTags[key] === value,
+  );
+};
+
+export const createTagsList = (tags: Tags) =>
+  Object.entries(normalizeTags(tags))
+    .filter((t): t is [string, string] => t[1] !== undefined)
+    .map(([Key, Value]) => ({
+      Key,
+      Value,
+    }));
+
+export const createInternalTags = Effect.fnUntraced(function* (id: string) {
+  const stack = yield* Stack;
+  const stage = yield* Stage;
+  return {
+    "alchemy::stack": stack.name,
+    "alchemy::stage": stage,
+    "alchemy::id": id,
+  };
+});
+
+/**
+ * Creates AWS-compatible tag filters for finding resources by alchemy tags.
+ * Use with AWS describe APIs that accept Filter parameters.
+ */
+export const createAlchemyTagFilters = Effect.fnUntraced(function* (
+  id: string,
+) {
+  const stack = yield* Stack;
+  const stage = yield* Stage;
+  return [
+    { Name: "tag:alchemy::stack", Values: [stack.name] },
+    { Name: "tag:alchemy::stage", Values: [stage] },
+    { Name: "tag:alchemy::id", Values: [id] },
+  ];
+});
+
+/**
+ * Checks if a resource has the expected alchemy tags for this app/stage/id.
+ */
+export const hasAlchemyTags = Effect.fnUntraced(function* (
+  id: string,
+  tags: Tags | undefined,
+) {
+  const stack = yield* Stack;
+  const stage = yield* Stage;
+  const expectedTags = {
+    "alchemy::stack": stack.name,
+    "alchemy::stage": stage,
+    "alchemy::id": id,
+  };
+  return hasTags(expectedTags, tags);
+});
+
+export const diffTags = (
+  oldTags: Record<string, string>,
+  newTags: Record<string, string>,
+) => {
+  const removed: string[] = [];
+  const updated: { Key: string; Value: string }[] = [];
+  const added: { Key: string; Value: string }[] = [];
+  for (const key in oldTags) {
+    if (!(key in newTags)) {
+      removed.push(key);
+    } else if (oldTags[key] !== newTags[key]) {
+      updated.push({ Key: key, Value: newTags[key] });
+    }
+  }
+  for (const key in newTags) {
+    if (!(key in oldTags)) {
+      added.push({ Key: key, Value: newTags[key] });
+    } else if (oldTags[key] !== newTags[key]) {
+      updated.push({ Key: key, Value: newTags[key] });
+    }
+  }
+  return {
+    added,
+    removed,
+    updated,
+    upsert: [...added, ...updated].filter(
+      (tag, index, self) => self.findIndex((t) => t.Key === tag.Key) === index,
+    ),
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Attributes.ts b/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Attributes.ts
new file mode 100644
index 00000000000..3713e9b7464
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Attributes.ts
@@ -0,0 +1,216 @@
+import { exec } from "node:child_process";
+import * as crypto from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as nodePath from "node:path";
+
+import * as Effect from "effect/Effect";
+
+import packageJson from "../../package.json" with { type: "json" };
+
+const ALCHEMY_DIR = nodePath.join(os.homedir(), ".alchemy");
+const ID_PATH = nodePath.join(ALCHEMY_DIR, "id");
+const DISABLED_PATH = nodePath.join(ALCHEMY_DIR, "telemetry-disabled");
+
+/**
+ * OTel resource attributes describing the user, project, runtime, and
+ * environment running the alchemy CLI. Computed once per process and
+ * attached to every span and metric exported by `TelemetryLive`.
+ */
+export interface TelemetryAttributes {
+  readonly "alchemy.user.id": string;
+  readonly "alchemy.session.id": string;
+  readonly "alchemy.version": string;
+  readonly "alchemy.git.root_commit": string;
+  readonly "alchemy.git.origin_hash": string;
+  readonly "alchemy.git.branch_hash": string;
+  readonly "alchemy.runtime.name": string;
+  readonly "alchemy.runtime.version": string;
+  readonly "alchemy.ci.provider": string;
+  readonly "alchemy.ci": boolean;
+  readonly "host.arch": string;
+  readonly "os.type": string;
+  readonly "os.version": string;
+  readonly "host.cpus": number;
+  readonly "host.memory_mb": number;
+}
+
+const tryRead = (path: string): Effect.Effect<string | null> =>
+  Effect.tryPromise({
+    try: () => fs.readFile(path, "utf-8").then((s) => s.trim()),
+    catch: () => null as never,
+  }).pipe(Effect.catch(() => Effect.succeed(null)));
+
+const sha256Hex = (input: string): string =>
+  crypto.createHash("sha256").update(input).digest("hex");
+
+const hashStringOrEmpty = (input: string | null): string =>
+  input == null || input === "" ? "" : sha256Hex(input);
+
+const execCapture = (cmd: string): Effect.Effect<string | null> =>
+  Effect.callback<string | null>((resume) => {
+    exec(cmd, { timeout: 1500 }, (err, stdout) => {
+      if (err) {
+        resume(Effect.succeed(null));
+        return;
+      }
+      resume(Effect.succeed(stdout.toString().trim()));
+    });
+  });
+
+const getOrCreateUserId: Effect.Effect<string> = Effect.gen(function* () {
+  const existing = yield* tryRead(ID_PATH);
+  if (existing) return existing;
+
+  const id = crypto.randomUUID();
+  yield* Effect.tryPromise({
+    try: async () => {
+      await fs.mkdir(ALCHEMY_DIR, { recursive: true });
+      await fs.writeFile(ID_PATH, id);
+    },
+    catch: () => null as never,
+  }).pipe(Effect.catch(() => Effect.void));
+  return id;
+});
+
+const getRootCommitHash: Effect.Effect<string | null> = execCapture(
+  process.platform === "win32"
+    ? `git rev-list --max-parents=0 HEAD | ForEach-Object { if (-not (git cat-file -p $_ | Select-String "^parent ")) { $_ } }`
+    : `git rev-list --max-parents=0 HEAD | xargs -r -I{} sh -c 'git cat-file -p {} | grep -q "^parent " || echo {}'`,
+);
+
+const getGitOriginUrl: Effect.Effect<string | null> = execCapture(
+  "git config --get remote.origin.url",
+);
+
+const getBranchName: Effect.Effect<string | null> = execCapture(
+  "git rev-parse --abbrev-ref HEAD",
+);
+
+const getRuntime = (): { name: string; version: string } => {
+  const g = globalThis as unknown as {
+    Bun?: { version: string };
+    Deno?: { version?: { deno?: string } };
+  };
+  if (typeof g.Bun !== "undefined") {
+    return { name: "bun", version: g.Bun.version };
+  }
+  if (typeof g.Deno !== "undefined") {
+    return { name: "deno", version: g.Deno.version?.deno ?? "" };
+  }
+  if (globalThis.process?.versions?.node) {
+    return { name: "node", version: process.versions.node };
+  }
+  return { name: "", version: "" };
+};
+
+const CI_PROVIDERS = [
+  { env: "GITHUB_ACTIONS", provider: "GitHub Actions", isCI: true },
+  { env: "GITLAB_CI", provider: "GitLab CI", isCI: true },
+  { env: "CIRCLECI", provider: "CircleCI", isCI: true },
+  { env: "JENKINS_URL", provider: "Jenkins", isCI: true },
+  { env: "TRAVIS", provider: "Travis CI", isCI: true },
+  { env: "BUILDKITE", provider: "Buildkite", isCI: true },
+  { env: "NOW_BUILDER", provider: "Vercel", isCI: true },
+  { env: "VERCEL", provider: "Vercel", isCI: false },
+] as const;
+
+const getCIEnvironment = (): { provider: string; isCI: boolean } => {
+  for (const p of CI_PROVIDERS) {
+    if (process.env[p.env]) {
+      return { provider: p.provider, isCI: p.isCI };
+    }
+  }
+  return { provider: "", isCI: !!process.env.CI };
+};
+
+const TELEMETRY_DISABLED_ENV = (): boolean =>
+  !!process.env.ALCHEMY_TELEMETRY_DISABLED ||
+  !!process.env.DO_NOT_TRACK ||
+  !!process.env.NO_TRACK;
+
+/**
+ * `true` if telemetry is disabled via environment variable
+ * (`DO_NOT_TRACK`, `NO_TRACK`, `ALCHEMY_TELEMETRY_DISABLED`) or via a
+ * persisted opt-out file at `~/.alchemy/telemetry-disabled`.
+ */
+export const isTelemetryDisabled: Effect.Effect<boolean> = Effect.gen(
+  function* () {
+    if (TELEMETRY_DISABLED_ENV()) return true;
+    const persisted = yield* tryRead(DISABLED_PATH);
+    return persisted === "true";
+  },
+);
+
+/**
+ * Persists an opt-out so future invocations skip telemetry without needing
+ * an env var.
+ */
+export const setTelemetryDisabled: Effect.Effect<void> = Effect.tryPromise({
+  try: async () => {
+    await fs.mkdir(ALCHEMY_DIR, { recursive: true });
+    await fs.writeFile(DISABLED_PATH, "true");
+  },
+  catch: () => null as never,
+}).pipe(Effect.catch(() => Effect.void));
+
+export const setTelemetryEnabled: Effect.Effect<void> = Effect.tryPromise({
+  try: () => fs.rm(DISABLED_PATH, { force: true }),
+  catch: () => null as never,
+}).pipe(Effect.catch(() => Effect.void));
+
+const collectAttributesUncached: Effect.Effect<TelemetryAttributes> =
+  Effect.gen(function* () {
+    const [userId, rootCommit, originUrl, branch] = yield* Effect.all(
+      [
+        getOrCreateUserId,
+        getRootCommitHash,
+        getGitOriginUrl,
+        getBranchName,
+      ] as const,
+      { concurrency: "unbounded" },
+    );
+
+    const runtime = getRuntime();
+    const ci = getCIEnvironment();
+
+    return {
+      "alchemy.user.id": userId,
+      "alchemy.session.id":
+        process.env.ALCHEMY_TELEMETRY_SESSION_ID ?? crypto.randomUUID(),
+      "alchemy.version": packageJson.version,
+      "alchemy.git.root_commit": rootCommit ?? "",
+      "alchemy.git.origin_hash": hashStringOrEmpty(originUrl),
+      "alchemy.git.branch_hash": hashStringOrEmpty(branch),
+      "alchemy.runtime.name": runtime.name,
+      "alchemy.runtime.version": runtime.version,
+      "alchemy.ci.provider": ci.provider,
+      "alchemy.ci": ci.isCI,
+      "host.arch": os.arch(),
+      "os.type": os.platform(),
+      "os.version": os.release(),
+      "host.cpus": os.cpus().length,
+      "host.memory_mb": Math.round(os.totalmem() / 1024 / 1024),
+    } satisfies TelemetryAttributes;
+  });
+
+let cachedAttrs: TelemetryAttributes | undefined;
+
+/**
+ * Resolves the {@link TelemetryAttributes} for the current process. Cached
+ * so file I/O and `git` invocations only run once per CLI invocation; every
+ * subsequent caller gets the same record (and therefore the same session
+ * id).
+ */
+export const collectAttributes: Effect.Effect<TelemetryAttributes> =
+  Effect.suspend(() =>
+    cachedAttrs !== undefined
+      ? Effect.succeed(cachedAttrs)
+      : collectAttributesUncached.pipe(
+          Effect.tap((a) =>
+            Effect.sync(() => {
+              cachedAttrs = a;
+            }),
+          ),
+        ),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Layer.ts b/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Layer.ts
new file mode 100644
index 00000000000..1da5d5b720b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Layer.ts
@@ -0,0 +1,76 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as OtlpLogger from "effect/unstable/observability/OtlpLogger";
+import * as OtlpMetrics from "effect/unstable/observability/OtlpMetrics";
+import * as OtlpSerialization from "effect/unstable/observability/OtlpSerialization";
+import * as OtlpTracer from "effect/unstable/observability/OtlpTracer";
+
+import packageJson from "../../package.json" with { type: "json" };
+
+import { collectAttributes, isTelemetryDisabled } from "./Attributes.ts";
+
+const TRACES_URL = "https://otel.alchemy.run/v1/traces";
+const METRICS_URL = "https://otel.alchemy.run/v1/metrics";
+const LOGS_URL = "https://otel.alchemy.run/v1/logs";
+
+const SERVICE_NAME = "alchemy-cli";
+
+const buildOtlpLayer = (
+  attrs: Record<string, unknown>,
+): Layer.Layer<never, never, never> => {
+  const resource = {
+    serviceName: SERVICE_NAME,
+    serviceVersion: packageJson.version,
+    attributes: attrs,
+  };
+
+  // Short export intervals so even sub-second CLI invocations flush at
+  // least one batch before the process exits.
+  const tracer = OtlpTracer.layer({
+    url: TRACES_URL,
+    resource,
+    exportInterval: "1 second",
+  });
+  const metrics = OtlpMetrics.layer({
+    url: METRICS_URL,
+    resource,
+    exportInterval: "1 second",
+  });
+  // Replace (don't merge with) the default stdout logger here; downstream
+  // commands re-add their own `fileLogger`/`consolePretty` via
+  // `Logger.layer([...], { mergeWithExisting: true })`, which stacks on top
+  // of this OtlpLogger without resurrecting Effect's default stdout logger.
+  const logger = OtlpLogger.layer({
+    url: LOGS_URL,
+    resource,
+    exportInterval: "1 second",
+    mergeWithExisting: false,
+  });
+
+  return Layer.mergeAll(tracer, metrics, logger).pipe(
+    Layer.provide(OtlpSerialization.layerJson),
+    Layer.provide(FetchHttpClient.layer),
+  );
+};
+
+/**
+ * The CLI's telemetry layer. Builds an OTLP HTTP exporter that ships spans
+ * to {@link TRACES_URL} and metrics to {@link METRICS_URL}, attaching
+ * {@link collectAttributes} as resource-level attributes so every signal
+ * carries user/project/runtime context.
+ *
+ * If the user has opted out (via `DO_NOT_TRACK`, `NO_TRACK`,
+ * `ALCHEMY_TELEMETRY_DISABLED`, or `~/.alchemy/telemetry-disabled`), this
+ * resolves to {@link Layer.empty}. Effect's default `Tracer` is a no-op,
+ * so all `withSpan`/`Effect.fn` instrumentation in core stays free.
+ */
+export const TelemetryLive: Layer.Layer<never, never, never> = Layer.unwrap(
+  Effect.gen(function* () {
+    if (yield* isTelemetryDisabled) {
+      return Layer.empty;
+    }
+    const attrs = yield* collectAttributes;
+    return buildOtlpLayer(attrs as unknown as Record<string, unknown>);
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Metrics.ts b/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Metrics.ts
new file mode 100644
index 00000000000..641b5e62bfe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Telemetry/Metrics.ts
@@ -0,0 +1,181 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Metric from "effect/Metric";
+
+/**
+ * Counter for resource lifecycle operations. Tagged per call with
+ * `resource_type`, `op` (`precreate`/`create`/`update`/`delete`/`read`),
+ * and `status` (`success`/`error`).
+ */
+export const resourceCounter = Metric.counter("alchemy.resource.operations", {
+  description:
+    "Number of resource lifecycle operations dispatched by alchemy apply.",
+  incremental: true,
+});
+
+/**
+ * Histogram of how long each lifecycle operation takes.
+ */
+export const resourceDuration = Metric.timer("alchemy.resource.duration", {
+  description:
+    "Wall-clock duration of resource lifecycle operations dispatched by alchemy apply.",
+});
+
+/**
+ * Counter for CLI command invocations.
+ */
+export const cliCounter = Metric.counter("alchemy.cli.invocations", {
+  description: "Number of alchemy CLI command invocations.",
+  incremental: true,
+});
+
+/**
+ * Counter for Cloudflare State Store bootstrap/deploy operations.
+ * Tagged per call with `op` (e.g. `deploy`) and `status`
+ * (`success`/`error`) so that the deploy success rate of the
+ * state store itself can be tracked separately from regular
+ * resource lifecycle ops.
+ */
+export const stateStoreCounter = Metric.counter(
+  "alchemy.state_store.operations",
+  {
+    description:
+      "Number of Cloudflare State Store deploy/bootstrap operations dispatched by alchemy.",
+    incremental: true,
+  },
+);
+
+export type StateStoreOp = "deploy";
+
+/**
+ * Counter for State store layer construction. Tagged with `id` (the
+ * `StateService.id` slug) so we can answer "how many distinct projects
+ * are using each backend" from the corresponding `state_store.init`
+ * spans. Open-ended on purpose: third-party state stores get counted
+ * automatically by setting their `StateService.id`.
+ */
+export const stateStoreInitCounter = Metric.counter(
+  "alchemy.state_store.inits",
+  {
+    description: "Number of times a State store layer is constructed.",
+    incremental: true,
+  },
+);
+
+/**
+ * Wraps a resource lifecycle Effect to record a counter + timer entry,
+ * tagged with `resource_type`, `op`, and `status` (`success`/`error`).
+ *
+ * Usage:
+ * ```ts
+ * provider.reconcile(input).pipe(recordResourceOp(node.resource.Type, "create"))
+ * ```
+ */
+export const recordResourceOp =
+  (resourceType: string, op: ResourceOp) =>
+  <A, E, R>(self: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
+    Effect.suspend(() => {
+      const startNs = process.hrtime.bigint();
+      const baseAttrs = { resource_type: resourceType, op } as const;
+      return self.pipe(
+        Effect.onExit((exit) =>
+          recordOutcome(
+            baseAttrs,
+            Exit.isSuccess(exit) ? "success" : "error",
+            elapsed(startNs),
+          ),
+        ),
+      );
+    });
+
+/**
+ * Wraps a CLI command Effect to bump {@link cliCounter} with the
+ * outcome (`success`/`error`).
+ */
+export const recordCli =
+  (command: string) =>
+  <A, E, R>(self: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
+    self.pipe(
+      Effect.onExit((exit) =>
+        Metric.update(
+          Metric.withAttributes(cliCounter, {
+            command,
+            status: Exit.isSuccess(exit) ? "success" : "error",
+          }),
+          1,
+        ),
+      ),
+    );
+
+/**
+ * Wraps a Cloudflare State Store deploy/bootstrap Effect to bump
+ * {@link stateStoreCounter} with the outcome (`success`/`error`),
+ * tagged with the given `op`.
+ */
+export const recordStateStoreOp =
+  (op: StateStoreOp) =>
+  <A, E, R>(self: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
+    self.pipe(
+      Effect.onExit((exit) =>
+        Metric.update(
+          Metric.withAttributes(stateStoreCounter, {
+            op,
+            status: Exit.isSuccess(exit) ? "success" : "error",
+          }),
+          1,
+        ),
+      ),
+    );
+
+/**
+ * Wraps a State store construction Effect to:
+ *
+ * 1. Bump {@link stateStoreInitCounter} tagged with `id`.
+ * 2. Open a `state_store.init` span carrying
+ *    `alchemy.state_store.id` so Axiom (which can't query metric
+ *    datasets via APL) can group projects by backend.
+ *
+ * The `id` is read off the constructed `StateService.id` field, so any
+ * third-party state-store implementation gets tracked just by setting
+ * a stable slug there. Apply at every `Layer.effect(State, …)` site
+ * exactly once.
+ */
+export const recordStateStoreInit = <A extends { readonly id: string }, E, R>(
+  self: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R> =>
+  self.pipe(
+    Effect.tap((service) =>
+      Effect.all(
+        [
+          Metric.update(
+            Metric.withAttributes(stateStoreInitCounter, { id: service.id }),
+            1,
+          ),
+          Effect.annotateCurrentSpan("alchemy.state_store.id", service.id),
+        ],
+        { discard: true },
+      ),
+    ),
+    Effect.withSpan("state_store.init"),
+  );
+
+export type ResourceOp = "precreate" | "create" | "update" | "delete" | "read";
+
+const elapsed = (startNs: bigint): Duration.Duration =>
+  Duration.nanos(process.hrtime.bigint() - startNs);
+
+const recordOutcome = (
+  baseAttrs: { resource_type: string; op: ResourceOp },
+  status: "success" | "error",
+  duration: Duration.Duration,
+): Effect.Effect<void> => {
+  const attrs = { ...baseAttrs, status };
+  return Effect.all(
+    [
+      Metric.update(Metric.withAttributes(resourceCounter, attrs), 1),
+      Metric.update(Metric.withAttributes(resourceDuration, attrs), duration),
+    ],
+    { discard: true },
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Test/Bun.ts b/.repos/alchemy-effect/packages/alchemy/src/Test/Bun.ts
new file mode 100644
index 00000000000..e0ba0639255
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Test/Bun.ts
@@ -0,0 +1,220 @@
+import bun from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Scope from "effect/Scope";
+import type { HookOptions } from "node:test";
+
+import type { AlchemyContext } from "../AlchemyContext.ts";
+import type { CompiledStack } from "../Stack.ts";
+import type { Stage } from "../Stage.ts";
+import * as Core from "./Core.ts";
+
+export type MakeOptions<ROut = any> = Core.MakeOptions<ROut>;
+export type ScratchStack = Core.ScratchStack;
+export type TestEffect<A, R = never> = Core.TestEffect<A, R>;
+
+export interface TestApi {
+  test: TestFn;
+  beforeAll: BeforeAllFn;
+  beforeEach: BeforeEachFn;
+  afterAll: AfterAllFn;
+  afterEach: AfterEachFn;
+  deploy: <A>(
+    stack: TestEffect<CompiledStack<A>, Stage | AlchemyContext>,
+    options?: { stage?: string },
+  ) => ReturnType<typeof Core.deploy<A>>;
+  destroy: (
+    stack: TestEffect<CompiledStack, Stage | AlchemyContext>,
+    options?: { stage?: string },
+  ) => ReturnType<typeof Core.destroy>;
+}
+
+interface TestFn {
+  (name: string, eff: TestEffect<void>, options?: bun.TestOptions): void;
+  skip: (
+    name: string,
+    eff: TestEffect<void>,
+    options?: bun.TestOptions,
+  ) => void;
+  skipIf: (
+    condition: boolean,
+  ) => (name: string, eff: TestEffect<void>, options?: bun.TestOptions) => void;
+  only: (
+    name: string,
+    eff: TestEffect<void>,
+    options?: bun.TestOptions,
+  ) => void;
+  todo: (
+    name: string,
+    eff: TestEffect<void>,
+    options?: bun.TestOptions,
+  ) => void;
+  provider: ProviderFn;
+}
+
+interface ProviderFn {
+  (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: bun.TestOptions,
+  ): void;
+  skip: (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: bun.TestOptions,
+  ) => void;
+  skipIf: (
+    condition: boolean,
+  ) => (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: bun.TestOptions,
+  ) => void;
+}
+
+interface BeforeAllFn {
+  <A>(eff: TestEffect<A>, options?: HookOptions): Effect.Effect<A>;
+}
+
+interface BeforeEachFn {
+  (eff: TestEffect<void>, options?: HookOptions): void;
+}
+
+interface AfterAllFn {
+  (eff: TestEffect<any>, options?: HookOptions): void;
+  skipIf: (
+    predicate: boolean,
+  ) => (eff: TestEffect<any>, options?: HookOptions) => void;
+}
+
+interface AfterEachFn {
+  (eff: TestEffect<void>, options?: HookOptions): void;
+}
+
+const DEFAULT_HOOK_TIMEOUT: HookOptions = { timeout: 120_000 };
+
+/**
+ * Build the per-file test API. Configure providers / state once at the top of
+ * the test file:
+ *
+ * ```ts
+ * import * as Test from "alchemy/Test/Bun";
+ * import * as Cloudflare from "alchemy/Cloudflare";
+ *
+ * const { test, deploy, destroy, beforeAll, afterAll } = Test.make({
+ *   providers: Cloudflare.providers(),
+ *   state: Cloudflare.state(),
+ * });
+ * ```
+ */
+export const make = <ROut = any>(options: MakeOptions<ROut>): TestApi => {
+  // Single scope shared across `beforeAll`, every `test`, and `afterAll`.
+  // Scoped resources in dev mode (the Cloudflare sidecar process and its
+  // workerd children) must outlive a single `Effect.runPromise` boundary,
+  // otherwise the proxy is killed the moment `beforeAll(deploy(Stack))`
+  // resolves and every later `HttpClient.get(workerUrl)` hits a dead port.
+  // The scope is closed by `destroy(...)` (or never — the next test run
+  // reclaims any leaked sidecar via the lock file).
+  const sharedScope = Scope.makeUnsafe("sequential");
+  const runEff = <A>(eff: TestEffect<A>) => Core.run(eff, options, sharedScope);
+
+  const test = ((name, eff, opts) => {
+    bun.test(name, () => runEff(eff), opts);
+  }) as TestFn;
+
+  test.skip = (name, eff, opts) => {
+    bun.test.skip(name, () => runEff(eff), opts);
+  };
+  test.skipIf = (condition) => (name, eff, opts) => {
+    bun.test.skipIf(condition)(name, () => runEff(eff), opts);
+  };
+  test.only = (name, eff, opts) => {
+    bun.test.only(name, () => runEff(eff), opts);
+  };
+  test.todo = (name, eff, opts) => {
+    bun.test.todo(name, () => runEff(eff), opts);
+  };
+
+  const runProvider = (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+  ) => {
+    const scratch = Core.scratchStack(options, name);
+    return Core.run(
+      Core.withProviders(fn(scratch), options, scratch.name),
+      { ...options, state: scratch.state },
+      sharedScope,
+    );
+  };
+
+  const provider = ((name, fn, opts) => {
+    bun.test(name, () => runProvider(name, fn), opts);
+  }) as ProviderFn;
+  provider.skip = (name, fn, opts) => {
+    bun.test.skip(name, () => runProvider(name, fn), opts);
+  };
+  provider.skipIf = (condition) => (name, fn, opts) => {
+    bun.test.skipIf(condition)(name, () => runProvider(name, fn), opts);
+  };
+  test.provider = provider;
+
+  const beforeAll: BeforeAllFn = <A>(
+    eff: TestEffect<A>,
+    hookOptions?: HookOptions,
+  ) => {
+    let result: A;
+    bun.beforeAll(
+      () => runEff(eff).then((v) => (result = v)),
+      hookOptions ?? DEFAULT_HOOK_TIMEOUT,
+    );
+    return Effect.sync(() => result);
+  };
+
+  const beforeEach: BeforeEachFn = (eff, hookOptions) => {
+    bun.beforeEach(() => runEff(eff), hookOptions);
+  };
+
+  const afterAll = ((eff, hookOptions) => {
+    bun.afterAll(() => runEff(eff), hookOptions ?? DEFAULT_HOOK_TIMEOUT);
+  }) as AfterAllFn;
+  afterAll.skipIf = (predicate) => (eff, hookOptions) => {
+    if (predicate) return;
+    bun.afterAll(() => runEff(eff), hookOptions ?? DEFAULT_HOOK_TIMEOUT);
+  };
+
+  const afterEach: AfterEachFn = (eff, hookOptions) => {
+    bun.afterEach(() => runEff(eff), hookOptions);
+  };
+
+  // `destroy(Stack)` needs the dev sidecar alive so it can call `sidecar.stop`
+  // for each worker. We close the shared scope only AFTER destroy completes.
+  // `Scope.close` on an already-closed scope is a no-op, so it's safe for both
+  // the destroy wrapper AND the fallback cleanup hook below to call it.
+  const closeScope = Effect.suspend(() =>
+    Scope.close(sharedScope, Exit.void),
+  ).pipe(Effect.ignore);
+
+  // Fallback cleanup: if the user never calls `destroy(Stack)` (e.g.
+  // `NO_DESTROY=1`), nothing else closes the shared scope and the sidecar
+  // child process leaks past the test process. Register an `afterAll` that
+  // closes it. We defer registration to a microtask so it runs AFTER any
+  // user-registered `afterAll` (including `destroy(Stack)`); bun runs
+  // afterAll hooks in registration order.
+  queueMicrotask(() => {
+    bun.afterAll(() => Effect.runPromise(closeScope), DEFAULT_HOOK_TIMEOUT);
+  });
+
+  return {
+    test,
+    beforeAll,
+    beforeEach,
+    afterAll,
+    afterEach,
+    deploy: (stack, callOpts) =>
+      Core.deploy(options, stack, { ...callOpts, scope: sharedScope }),
+    destroy: (stack, callOpts) =>
+      Core.destroy(options, stack, { ...callOpts, scope: sharedScope }).pipe(
+        Effect.ensuring(closeScope),
+      ),
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Test/Core.ts b/.repos/alchemy-effect/packages/alchemy/src/Test/Core.ts
new file mode 100644
index 00000000000..121056e99fe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Test/Core.ts
@@ -0,0 +1,284 @@
+import { ConfigProvider } from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Scope from "effect/Scope";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+
+import { AdoptPolicy } from "../AdoptPolicy.ts";
+import { AlchemyContext, AlchemyContextLive } from "../AlchemyContext.ts";
+import { apply } from "../Apply.ts";
+import { provideFreshArtifactStore } from "../Artifacts.ts";
+import { AuthProviders } from "../Auth/AuthProvider.ts";
+import { CredentialsStoreLive } from "../Auth/Credentials.ts";
+import { ProfileLive, withProfileOverride } from "../Auth/Profile.ts";
+import { LoggingCli } from "../Cli/LoggingCli.ts";
+import { deploy as _deploy } from "../Deploy.ts";
+import { destroy as _destroy } from "../Destroy.ts";
+import type { Input } from "../Input.ts";
+import * as Plan from "../Plan.ts";
+import {
+  type CompiledStack,
+  make as makeStack,
+  Stack,
+  type StackEffect,
+  type StackServices,
+} from "../Stack.ts";
+import { Stage } from "../Stage.ts";
+import * as State from "../State/index.ts";
+import { TelemetryLive } from "../Telemetry/Layer.ts";
+import { loadConfigProvider } from "../Util/ConfigProvider.ts";
+import { PlatformServices } from "../Util/PlatformServices.ts";
+
+/**
+ * Configuration shared by every test in a file. Pass to `Test.make(...)`.
+ */
+export interface MakeOptions<ROut = any> {
+  /** Provider layer for the stack — e.g. `AWS.providers()`, `Cloudflare.providers()`. */
+  providers: Layer.Layer<ROut, never, StackServices>;
+  /** State store for top-level `deploy(Stack)` / `destroy(Stack)`; defaults to {@link State.localState}. */
+  state?: Layer.Layer<State.State, never, StackServices>;
+  /** Override `ALCHEMY_PROFILE`; otherwise resolved from env / .env. */
+  profile?: string;
+  /** Default stage for deploy/destroy (default `"test"`). */
+  stage?: string;
+  /**
+   * Engine-level adoption policy for this test run. When `true`, resources
+   * without prior state will be adopted from the cloud via `provider.read`
+   * (matching the CLI's `--adopt` flag). Defaults to `false`.
+   */
+  adopt?: boolean;
+  /**
+   * Run providers in local-dev mode (matching the CLI's `alchemy dev` flag).
+   * When `true`, resources like Cloudflare Workers run locally via workerd
+   * instead of being deployed to the cloud. When omitted, falls back to the
+   * `ALCHEMY_DEV` environment variable (`"1"` / `"true"` enable it).
+   */
+  dev?: boolean;
+}
+
+/** Resolve the effective `dev` flag from explicit options or `ALCHEMY_DEV`. */
+export const resolveDev = (options: { dev?: boolean }): boolean => {
+  if (options.dev !== undefined) return options.dev;
+  const env = process.env.ALCHEMY_DEV;
+  return env === "1" || env?.toLowerCase() === "true";
+};
+
+const overrideAlchemyContext = (overrides: { dev: boolean }) =>
+  Layer.effect(
+    AlchemyContext,
+    AlchemyContext.pipe(Effect.map((ctx) => ({ ...ctx, ...overrides }))),
+  );
+
+export type TestEffect<A, Req = never> = StackEffect<A, any, Req>;
+
+const platformLayer = Layer.mergeAll(
+  PlatformServices,
+  FetchHttpClient.layer,
+  Layer.provide(ProfileLive, PlatformServices),
+  Layer.provide(CredentialsStoreLive, PlatformServices),
+);
+
+const alchemyLayer = Layer.mergeAll(LoggingCli, AlchemyContextLive);
+
+/**
+ * Build the per-test runtime and return a self-contained Effect.
+ *
+ * Mirrors {@link "../bin/alchemy.ts"} composition: ConfigProvider via
+ * `loadConfigProvider` + `withProfileOverride`, an empty `AuthProviders`
+ * registry that the user's `providers` layer populates, the platform layers,
+ * and the configured state store. Adapters wrap this into runner-specific
+ * thunks (`bun.test` -> `runPromise`, `it.live` -> as-is).
+ *
+ * When `scope` is provided, scoped resources (like the Cloudflare dev
+ * sidecar) survive past this effect and are tied to the lifetime of the
+ * provided scope instead. The runner is responsible for closing it.
+ *
+ * When `scope` is omitted, the effect runs with `Effect.scoped` and any
+ * scoped resources are torn down as soon as it resolves.
+ */
+export const toEffect = <A>(
+  effect: TestEffect<A>,
+  options: MakeOptions,
+  scope?: Scope.Scope,
+): Effect.Effect<A, any, never> => {
+  const base = Effect.gen(function* () {
+    const cfg = yield* loadConfigProvider(Option.none());
+    const configProvider = withProfileOverride(cfg, options.profile);
+    return yield* effect.pipe(
+      provideFreshArtifactStore,
+      Effect.provide(Layer.succeed(ConfigProvider, configProvider)),
+    );
+  }).pipe(
+    Effect.provideService(AdoptPolicy, options.adopt ?? false),
+    Effect.provide(overrideAlchemyContext({ dev: resolveDev(options) })),
+    // `options.state` (e.g. `Cloudflare.state()`) itself requires
+    // `AuthProviders` to read credentials, so AuthProviders must be provided
+    // AFTER the state layer or the state layer's requirement is never
+    // satisfied — which surfaces as `Service not found: AuthProviders`.
+    Effect.provide(options.state ?? State.localState()),
+    Effect.provideService(AuthProviders, {}),
+    Effect.provide(Layer.provideMerge(alchemyLayer, platformLayer)),
+  );
+
+  return (
+    scope === undefined ? Effect.scoped(base) : Scope.provide(base, scope)
+  ) as Effect.Effect<A, any, never>;
+};
+
+/** Promise wrapper around {@link toEffect} for `bun.test`-style runners. */
+export const run = <A>(
+  effect: TestEffect<A>,
+  options: MakeOptions,
+  scope?: Scope.Scope,
+): Promise<A> => Effect.runPromise(toEffect(effect, options, scope));
+
+/**
+ * Wrap an effect so it runs with `options.providers` + a placeholder Stack +
+ * Stage in scope. Used by `test.provider` so user code can call provider SDK
+ * APIs (e.g. `DynamoDB.describeTable`) directly inside the test body.
+ */
+export const withProviders = <A, E, R, ROut>(
+  effect: Effect.Effect<A, E, R>,
+  options: MakeOptions<ROut>,
+  stackName: string,
+): Effect.Effect<A, E, Exclude<R, ROut | Stack | Stage>> =>
+  effect.pipe(
+    Effect.provide(options.providers as Layer.Layer<any, never, any>),
+    Effect.provide(
+      Layer.succeed(Stack, {
+        name: stackName,
+        stage: options.stage ?? "test",
+        resources: {},
+        bindings: {},
+        actions: {},
+      }),
+    ),
+    Effect.provide(Layer.succeed(Stage, options.stage ?? "test")),
+  ) as Effect.Effect<A, E, Exclude<R, ROut | Stack | Stage>>;
+
+/**
+ * Curried `deploy` for the test factory: bakes in the configured stage and
+ * adds the telemetry layer the CLI uses, so `beforeAll(deploy(Stack))` works
+ * the same way as `alchemy deploy`.
+ *
+ * `scope`, when supplied, is forwarded down so the dev sidecar (and other
+ * scoped resources) lives until the caller closes it instead of dying as
+ * soon as `deploy` resolves. The test harness uses this to keep workerd
+ * alive across `beforeAll` → tests → `afterAll`.
+ */
+export const deploy = <A>(
+  options: MakeOptions,
+  stack: TestEffect<CompiledStack<A>, Stage | AlchemyContext>,
+  callOptions?: { stage?: string; scope?: Scope.Scope },
+) =>
+  _deploy({
+    stack: stack as Effect.Effect<CompiledStack<A>, never, any>,
+    stage: callOptions?.stage ?? options.stage ?? "test",
+    dev: resolveDev(options),
+    scope: callOptions?.scope,
+  }).pipe(Effect.provide(TelemetryLive));
+
+export const destroy = (
+  options: MakeOptions,
+  stack: TestEffect<CompiledStack, Stage | AlchemyContext>,
+  callOptions?: { stage?: string; scope?: Scope.Scope },
+) =>
+  _destroy({
+    stack: stack as Effect.Effect<CompiledStack, never, any>,
+    stage: callOptions?.stage ?? options.stage ?? "test",
+    dev: resolveDev(options),
+    scope: callOptions?.scope,
+  }).pipe(Effect.provide(TelemetryLive));
+
+/**
+ * In-test scratch stack handed to `test.provider(name, (stack) => ...)`.
+ *
+ * Each scratch stack owns a private in-memory state store that is shared
+ * between successive `deploy`/`destroy` calls AND visible to the user's test
+ * body (so `yield* State` / `state.get(...)` see the same store the deploys
+ * mutated). This makes create / update / replace / delete paths exercisable
+ * without polluting `.alchemy/` or other tests in the same file.
+ */
+export interface ScratchStack<ROut = any> {
+  readonly name: string;
+  /** The shared in-memory state Layer for this scratch. @internal */
+  readonly state: Layer.Layer<State.State, never, never>;
+  deploy<A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<Input.Resolve<A>, any, Exclude<R, ROut | StackServices>>;
+  destroy(): Effect.Effect<void, any, never>;
+}
+
+const sanitizeStackName = (name: string) =>
+  name.replaceAll(/[^a-zA-Z0-9_]/g, "-").replace(/-+/g, "-");
+
+/**
+ * Build a fresh `ScratchStack` for `test.provider`. Allocates a private
+ * in-memory state store so the test is isolated from `.alchemy/` and from
+ * other tests in the same file.
+ */
+export const scratchStack = <ROut>(
+  options: MakeOptions<ROut>,
+  name: string,
+): ScratchStack<ROut> => {
+  const stage = options.stage ?? "test";
+  const stackName = sanitizeStackName(name);
+  const inMemory: Record<
+    string,
+    Record<string, Record<string, State.ResourceState>>
+  > = {};
+  const stateLayer = Layer.succeed(
+    State.State,
+    State.InMemoryService(inMemory),
+  );
+
+  const buildAndApply = (effect: Effect.Effect<any, any, any>) =>
+    (effect as Effect.Effect<any, any, never>).pipe(
+      makeStack({
+        name: stackName,
+        providers: options.providers,
+        state: stateLayer,
+      } as any) as any,
+      Effect.flatMap((compiled: any) =>
+        Plan.make(compiled).pipe(
+          Effect.flatMap(apply),
+          Effect.provide(compiled.services),
+        ),
+      ),
+      Effect.provide(Layer.succeed(Stage, stage)),
+      provideFreshArtifactStore,
+    );
+
+  return {
+    name: stackName,
+    state: stateLayer,
+    deploy: ((effect: Effect.Effect<any, any, any>) =>
+      buildAndApply(effect)) as ScratchStack<ROut>["deploy"],
+    destroy: () =>
+      Plan.make({
+        name: stackName,
+        stage,
+        resources: {},
+        bindings: {},
+        actions: {},
+        output: {},
+      }).pipe(
+        Effect.flatMap(apply),
+        Effect.asVoid,
+        Effect.provide(stateLayer),
+        Effect.provide(options.providers as Layer.Layer<any, never, any>),
+        Effect.provide(
+          Layer.succeed(Stack, {
+            name: stackName,
+            stage,
+            resources: {},
+            bindings: {},
+            actions: {},
+          }),
+        ),
+        Effect.provide(Layer.succeed(Stage, stage)),
+        provideFreshArtifactStore,
+      ) as Effect.Effect<void, any, never>,
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Test/TestState.ts b/.repos/alchemy-effect/packages/alchemy/src/Test/TestState.ts
new file mode 100644
index 00000000000..656c2c702c5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Test/TestState.ts
@@ -0,0 +1,35 @@
+import * as Layer from "effect/Layer";
+import { Stack } from "../Stack.ts";
+import * as State from "../State/index.ts";
+
+export const state = (resources: Record<string, State.ResourceState> = {}) =>
+  Layer.effect(
+    State.State,
+    Stack.useSync((stack) =>
+      State.InMemoryService({
+        [stack.name]: {
+          [stack.stage]: resources,
+        },
+      }),
+    ),
+  );
+
+export const defaultState = (
+  resources: Record<string, State.ResourceState> = {},
+  other?: {
+    [stack: string]: {
+      [stage: string]: {
+        [resourceId: string]: State.ResourceState;
+      };
+    };
+  },
+) =>
+  Layer.succeed(
+    State.State,
+    State.InMemoryService({
+      ["test-app"]: {
+        ["test-stage"]: resources,
+      },
+      ...other,
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Test/Vitest.ts b/.repos/alchemy-effect/packages/alchemy/src/Test/Vitest.ts
new file mode 100644
index 00000000000..3f477761d98
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Test/Vitest.ts
@@ -0,0 +1,220 @@
+import { it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Scope from "effect/Scope";
+import {
+  afterAll as vitestAfterAll,
+  afterEach as vitestAfterEach,
+  beforeAll as vitestBeforeAll,
+  beforeEach as vitestBeforeEach,
+} from "vitest";
+
+import type { AlchemyContext } from "../AlchemyContext.ts";
+import type { CompiledStack } from "../Stack.ts";
+import type { Stage } from "../Stage.ts";
+import * as Core from "./Core.ts";
+
+export type MakeOptions<ROut = any> = Core.MakeOptions<ROut>;
+export type ScratchStack = Core.ScratchStack;
+export type TestEffect<A, R = never> = Core.TestEffect<A, R>;
+
+type TestOptions = number | { timeout?: number };
+
+const timeoutOf = (opts: TestOptions | undefined): number | undefined =>
+  typeof opts === "number" ? opts : opts?.timeout;
+
+interface TestFn {
+  (name: string, eff: TestEffect<void>, options?: TestOptions): void;
+  skip: (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  skipIf: (
+    condition: boolean,
+  ) => (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  only: (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  todo: (name: string, eff: TestEffect<void>, options?: TestOptions) => void;
+  provider: ProviderFn;
+}
+
+interface ProviderFn {
+  (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: TestOptions,
+  ): void;
+  skip: (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: TestOptions,
+  ) => void;
+  skipIf: (
+    condition: boolean,
+  ) => (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+    options?: TestOptions,
+  ) => void;
+}
+
+interface BeforeAllFn {
+  <A>(eff: TestEffect<A>, options?: TestOptions): Effect.Effect<A>;
+}
+
+interface BeforeEachFn {
+  (eff: TestEffect<void>, options?: TestOptions): void;
+}
+
+interface AfterAllFn {
+  (eff: TestEffect<any>, options?: TestOptions): void;
+  skipIf: (
+    predicate: boolean,
+  ) => (eff: TestEffect<any>, options?: TestOptions) => void;
+}
+
+interface AfterEachFn {
+  (eff: TestEffect<void>, options?: TestOptions): void;
+}
+
+export interface TestApi {
+  test: TestFn;
+  beforeAll: BeforeAllFn;
+  beforeEach: BeforeEachFn;
+  afterAll: AfterAllFn;
+  afterEach: AfterEachFn;
+  deploy: <A>(
+    stack: TestEffect<CompiledStack<A>, Stage | AlchemyContext>,
+    options?: { stage?: string },
+  ) => ReturnType<typeof Core.deploy<A>>;
+  destroy: (
+    stack: TestEffect<CompiledStack, Stage | AlchemyContext>,
+    options?: { stage?: string },
+  ) => ReturnType<typeof Core.destroy>;
+}
+
+const DEFAULT_TIMEOUT = 120_000;
+
+/**
+ * Build the per-file test API. See {@link "./Bun.ts"} for the same shape
+ * over `bun:test`. Vitest variant uses `@effect/vitest`'s `it.live` so
+ * Effect-aware tests stay first-class.
+ */
+export const make = <ROut = any>(options: MakeOptions<ROut>): TestApi => {
+  // See `Test/Bun.ts` for the rationale: the dev sidecar must outlive a
+  // single `runPromise` boundary, so all hooks share one scope that's only
+  // closed after `destroy(...)` runs.
+  const sharedScope = Scope.makeUnsafe("sequential");
+  const wrap = <A>(eff: TestEffect<A>) =>
+    Core.toEffect(eff, options, sharedScope);
+  const runEff = <A>(eff: TestEffect<A>) => Core.run(eff, options, sharedScope);
+
+  const test = ((name, eff, opts) => {
+    it.live(name, () => wrap(eff), timeoutOf(opts));
+  }) as TestFn;
+
+  test.skip = (name, _eff, opts) => {
+    it.skip(name, () => {}, timeoutOf(opts));
+  };
+  test.skipIf = (condition) => (name, eff, opts) => {
+    if (condition) {
+      it.skip(name, () => {}, timeoutOf(opts));
+    } else {
+      it.live(name, () => wrap(eff), timeoutOf(opts));
+    }
+  };
+  test.only = (name, eff, opts) => {
+    it.only(name, () => wrap(eff) as Effect.Effect<any>, timeoutOf(opts));
+  };
+  test.todo = (name, _eff, _opts) => {
+    it.todo(name);
+  };
+
+  const wrapProvider = (
+    name: string,
+    fn: (stack: ScratchStack) => Effect.Effect<void, any, any>,
+  ) => {
+    const scratch = Core.scratchStack(options, name);
+    return Core.toEffect(
+      Core.withProviders(fn(scratch), options, scratch.name),
+      { ...options, state: scratch.state },
+      sharedScope,
+    );
+  };
+
+  const provider = ((name, fn, opts) => {
+    it.live(name, () => wrapProvider(name, fn), timeoutOf(opts));
+  }) as ProviderFn;
+  provider.skip = (name, _fn, opts) => {
+    it.skip(name, () => {}, timeoutOf(opts));
+  };
+  provider.skipIf = (condition) => (name, fn, opts) => {
+    if (condition) {
+      it.skip(name, () => {}, timeoutOf(opts));
+    } else {
+      it.live(name, () => wrapProvider(name, fn), timeoutOf(opts));
+    }
+  };
+  test.provider = provider;
+
+  const beforeAll: BeforeAllFn = <A>(
+    eff: TestEffect<A>,
+    hookOptions?: TestOptions,
+  ) => {
+    let result: A;
+    vitestBeforeAll(
+      () => runEff(eff).then((v) => (result = v)),
+      timeoutOf(hookOptions) ?? DEFAULT_TIMEOUT,
+    );
+    return Effect.sync(() => result);
+  };
+
+  const beforeEach: BeforeEachFn = (eff, hookOptions) => {
+    vitestBeforeEach(() => runEff(eff), timeoutOf(hookOptions));
+  };
+
+  const afterAll = ((eff, hookOptions) => {
+    vitestAfterAll(
+      () => runEff(eff),
+      timeoutOf(hookOptions) ?? DEFAULT_TIMEOUT,
+    );
+  }) as AfterAllFn;
+  afterAll.skipIf = (predicate) => (eff, hookOptions) => {
+    if (predicate) return;
+    vitestAfterAll(
+      () => runEff(eff),
+      timeoutOf(hookOptions) ?? DEFAULT_TIMEOUT,
+    );
+  };
+
+  const afterEach: AfterEachFn = (eff, hookOptions) => {
+    vitestAfterEach(() => runEff(eff), timeoutOf(hookOptions));
+  };
+
+  // `destroy(Stack)` needs the dev sidecar alive so it can call `sidecar.stop`.
+  // `Scope.close` on an already-closed scope is a no-op, so the destroy
+  // wrapper AND the fallback cleanup hook below can both call it safely.
+  const closeScope = Effect.suspend(() =>
+    Scope.close(sharedScope, Exit.void),
+  ).pipe(Effect.ignore);
+
+  // Fallback cleanup: if the user never calls `destroy(Stack)` (e.g.
+  // `NO_DESTROY=1`), nothing else closes the shared scope and the sidecar
+  // child process leaks past the test process. Register an `afterAll` that
+  // closes it. We defer registration to a microtask so it runs AFTER any
+  // user-registered `afterAll` (including `destroy(Stack)`); vitest runs
+  // afterAll hooks in registration order.
+  queueMicrotask(() => {
+    vitestAfterAll(() => Effect.runPromise(closeScope), DEFAULT_TIMEOUT);
+  });
+
+  return {
+    test,
+    beforeAll,
+    beforeEach,
+    afterAll,
+    afterEach,
+    deploy: (stack, callOpts) =>
+      Core.deploy(options, stack, { ...callOpts, scope: sharedScope }),
+    destroy: (stack, callOpts) =>
+      Core.destroy(options, stack, { ...callOpts, scope: sharedScope }).pipe(
+        Effect.ensuring(closeScope),
+      ),
+  };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Test/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Test/index.ts
new file mode 100644
index 00000000000..dcd17c347c8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Test/index.ts
@@ -0,0 +1 @@
+export * from "./TestState.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/Clank.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/Clank.ts
new file mode 100644
index 00000000000..f3a16e4e800
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/Clank.ts
@@ -0,0 +1,77 @@
+import * as p from "@clack/prompts";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { ChildProcess } from "effect/unstable/process";
+
+export class PromptCancelled extends Data.TaggedError("PromptCancelled") {}
+export const retryIfCancelled = Effect.retry({
+  while: (e: unknown) => e instanceof PromptCancelled,
+});
+
+/**
+ * Wraps a clack prompt (which returns a `Promise<T | symbol>` where the
+ * symbol indicates user cancellation) in an Effect.
+ *
+ * Returns `undefined` if the user cancels (Ctrl+C / Escape).
+ *
+ * Uses `Effect.callback` so fiber interruption propagates via the abort
+ * signal to any async resources we own; the clack prompt itself is left
+ * to resolve — its result is ignored after interruption.
+ */
+export const prompt = <T>(
+  fn: () => Promise<T | symbol>,
+): Effect.Effect<T, PromptCancelled> =>
+  Effect.callback<T, PromptCancelled>((resume, signal) => {
+    let settled = false;
+    fn().then(
+      (result) => {
+        if (settled || signal.aborted) return;
+        settled = true;
+        if (p.isCancel(result)) {
+          resume(Effect.fail(new PromptCancelled()));
+        } else {
+          resume(Effect.succeed(result as T));
+        }
+      },
+      (err) => {
+        if (settled || signal.aborted) return;
+        settled = true;
+        resume(Effect.die(err));
+      },
+    );
+  });
+
+export const success = (str: string) => Effect.sync(() => p.log.success(str));
+export const warn = (str: string) => Effect.sync(() => p.log.warn(str));
+export const error = (str: string) => Effect.sync(() => p.log.error(str));
+export const info = (str: string) => Effect.sync(() => p.log.info(str));
+export const text = (opts: p.TextOptions) => prompt(() => p.text(opts));
+export const password = (opts: p.PasswordOptions) =>
+  prompt(() => p.password(opts));
+export const select = <Value>(opts: p.SelectOptions<Value>) =>
+  prompt(() => p.select<Value>(opts));
+export const confirm = (opts: p.ConfirmOptions) =>
+  prompt(() => p.confirm(opts));
+export const multiselect = <Value>(opts: p.MultiSelectOptions<Value>) =>
+  prompt(() => p.multiselect<Value>(opts));
+
+/**
+ * Open a URL in the user's default browser.
+ *
+ * On Windows, uses rundll32's FileProtocolHandler — a built-in shim that
+ * opens URLs in the default browser. It accepts the URL as a direct
+ * argument (no shell, no quoting of `&`). cmd.exe `start` would treat
+ * `&` in OAuth URLs as a command separator, and `explorer.exe` treats
+ * its arg as a path.
+ */
+export const openUrl = (url: string) =>
+  Effect.gen(function* () {
+    const [cmd, args] =
+      process.platform === "win32"
+        ? (["rundll32.exe", ["url.dll,FileProtocolHandler", url]] as const)
+        : process.platform === "darwin"
+          ? (["open", [url]] as const)
+          : (["xdg-open", [url]] as const);
+    const handle = yield* ChildProcess.make(cmd, [...args], { shell: false });
+    yield* handle.exitCode;
+  }).pipe(Effect.scoped);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/ConfigProvider.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/ConfigProvider.ts
new file mode 100644
index 00000000000..c8fa609d747
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/ConfigProvider.ts
@@ -0,0 +1,25 @@
+import * as ConfigProvider from "effect/ConfigProvider";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+
+export const loadConfigProvider = (envFile: Option.Option<string>) => {
+  if (Option.isSome(envFile)) {
+    return ConfigProvider.fromDotEnv({ path: envFile.value }).pipe(
+      Effect.map((dotEnv) =>
+        ConfigProvider.orElse(dotEnv, ConfigProvider.fromEnv()),
+      ),
+    );
+  }
+  return Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const exists = yield* fs.exists(".env");
+    if (!exists) {
+      return ConfigProvider.fromEnv();
+    }
+    return ConfigProvider.orElse(
+      yield* ConfigProvider.fromDotEnv({ path: ".env" }),
+      ConfigProvider.fromEnv(),
+    );
+  });
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/Duration.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/Duration.ts
new file mode 100644
index 00000000000..ab604a3757c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/Duration.ts
@@ -0,0 +1,21 @@
+import * as Duration from "effect/Duration";
+
+/**
+ * Convert a {@link Duration.Input} to whole, non-negative
+ * milliseconds. Returns `undefined` when `input` is `undefined`,
+ * so call sites can map through optional duration fields without
+ * a branch.
+ */
+export const toMillis = (input: Duration.Input | undefined) =>
+  input === undefined
+    ? undefined
+    : Math.max(0, Math.ceil(Duration.toMillis(input)));
+
+/**
+ * Convert a {@link Duration.Input} to whole, non-negative seconds.
+ * Returns `undefined` when `input` is `undefined`.
+ */
+export const toSeconds = (input: Duration.Input | undefined) =>
+  input === undefined
+    ? undefined
+    : Math.max(0, Math.ceil(Duration.toSeconds(input)));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/FileLogger.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/FileLogger.ts
new file mode 100644
index 00000000000..9fc07186f3d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/FileLogger.ts
@@ -0,0 +1,22 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Logger from "effect/Logger";
+import { Path } from "effect/Path";
+import { AlchemyContext } from "../AlchemyContext.ts";
+
+export const fileLogger = Effect.fnUntraced(function* (
+  ...segments: ReadonlyArray<string>
+) {
+  const { dotAlchemy } = yield* AlchemyContext;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path;
+  const logFile = path.join(dotAlchemy, "log", ...segments);
+
+  yield* fs.makeDirectory(path.dirname(logFile), { recursive: true });
+
+  return yield* Logger.formatLogFmt.pipe(
+    Logger.toFile(logFile, {
+      flag: "a",
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/PlatformServices.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/PlatformServices.ts
new file mode 100644
index 00000000000..af4e8bd7371
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/PlatformServices.ts
@@ -0,0 +1,95 @@
+import * as Effect from "effect/Effect";
+import type { FileSystem } from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import type { Path } from "effect/Path";
+import type { Teardown } from "effect/Runtime";
+import type { Stdio } from "effect/Stdio";
+import type { Terminal } from "effect/Terminal";
+import type { HttpServer } from "effect/unstable/http/HttpServer";
+import type { ServeError } from "effect/unstable/http/HttpServerError";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import type { WebSocketConstructor } from "effect/unstable/socket/Socket";
+
+const isBun = typeof Bun !== "undefined";
+
+/**
+ * Constructs a layer with different implementations for Bun and Node.
+ */
+export const platformLayer = <A, E, R>(constructors: {
+  bun: () => Promise<Layer.Layer<A, E, R>>;
+  node: () => Promise<Layer.Layer<A, E, R>>;
+}) =>
+  Layer.unwrap(
+    Effect.promise(async () => {
+      if (isBun) {
+        return await constructors.bun();
+      } else {
+        return await constructors.node();
+      }
+    }),
+  );
+
+export type PlatformServices =
+  | ChildProcessSpawner
+  | FileSystem
+  | Path
+  | Stdio
+  | Terminal
+  // WebSocketConstructor is not included in NodeServices/BunServices, but required for Workers tail
+  | WebSocketConstructor;
+
+export const PlatformServices: Layer.Layer<PlatformServices> = platformLayer({
+  bun: async () => {
+    const [BunServices, BunSocket] = await Promise.all([
+      import("@effect/platform-bun/BunServices"),
+      import("@effect/platform-bun/BunSocket"),
+    ]);
+    return Layer.merge(BunServices.layer, BunSocket.layerWebSocketConstructor);
+  },
+  node: async () => {
+    const [NodeServices, NodeSocket] = await Promise.all([
+      import("@effect/platform-node/NodeServices"),
+      import("@effect/platform-node/NodeSocket"),
+    ]);
+    return Layer.merge(
+      NodeServices.layer,
+      NodeSocket.layerWebSocketConstructor,
+    );
+  },
+});
+
+export const runMain = <E, A>(
+  effect: Effect.Effect<A, E>,
+  options?: {
+    readonly disableErrorReporting?: boolean | undefined;
+    readonly teardown?: Teardown | undefined;
+  },
+): void => {
+  if (isBun) {
+    void import("@effect/platform-bun/BunRuntime").then((BunRuntime) =>
+      BunRuntime.runMain(effect, options),
+    );
+  } else {
+    void import("@effect/platform-node/NodeRuntime").then((NodeRuntime) =>
+      NodeRuntime.runMain(effect, options),
+    );
+  }
+};
+
+export const httpServer = (
+  port: number = 0,
+  host: string = "127.0.0.1",
+): Layer.Layer<HttpServer, ServeError> =>
+  platformLayer({
+    bun: async () => {
+      const BunHttpServer = await import("@effect/platform-bun/BunHttpServer");
+      return BunHttpServer.layer({ hostname: host, port });
+    },
+    node: async () => {
+      const [NodeHttpServer, Http] = await Promise.all([
+        import("@effect/platform-node/NodeHttpServer"),
+        import("node:http"),
+      ]);
+      return NodeHttpServer.layerServer(Http.createServer, { host, port });
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/Stream.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/Stream.ts
new file mode 100644
index 00000000000..e6ccd1b3289
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/Stream.ts
@@ -0,0 +1,12 @@
+import type * as Stream from "effect/Stream";
+
+export const getRawStream = (
+  stream: Stream.Stream<any, any, any>,
+): ReadableStream | undefined =>
+  streamHasRaw(stream) ? stream.raw : undefined;
+
+export const streamHasRaw = (
+  stream: Stream.Stream<any, any, any>,
+): stream is Stream.Stream<any, any, any> & {
+  raw: ReadableStream;
+} => "raw" in stream && stream.raw != null;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/base32.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/base32.ts
new file mode 100644
index 00000000000..5ed733a6903
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/base32.ts
@@ -0,0 +1,44 @@
+// Base32 is ideal for physical names because it's denser than hex (5 bits per char vs 4)
+// and compatible with DNS/S3 (as opposed to base64 which contains uppercase letters and symbols).
+
+// base32.ts
+// Concise, fast RFC 4648 Base32 encoder (no padding), lowercase output.
+// Charset: a-z2-7 (DNS/S3 friendly)
+const ALPH = "abcdefghijklmnopqrstuvwxyz234567";
+
+/**
+ * Encode bytes into RFC4648 Base32 (no padding), lowercase.
+ *
+ * Performance notes:
+ * - O(n) single pass, no big-int
+ * - Avoids per-byte string concatenation by using a char array
+ */
+export function base32(bytes: Uint8Array): string {
+  const n = bytes.length;
+  if (n === 0) return "";
+
+  // Base32 length without padding: ceil(n*8/5)
+  const outLen = ((n * 8 + 4) / 5) | 0;
+  const out = Array.from<string>({ length: outLen });
+
+  let buffer = 0;
+  let bits = 0;
+  let o = 0;
+
+  for (let i = 0; i < n; i++) {
+    buffer = (buffer << 8) | bytes[i];
+    bits += 8;
+
+    while (bits >= 5) {
+      out[o++] = ALPH[(buffer >>> (bits - 5)) & 31];
+      bits -= 5;
+    }
+  }
+
+  if (bits > 0) {
+    out[o++] = ALPH[(buffer << (5 - bits)) & 31];
+  }
+
+  // outLen computed as exact ceiling; o should match, but slice defensively.
+  return o === outLen ? out.join("") : out.slice(0, o).join("");
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/cached-function.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/cached-function.ts
new file mode 100644
index 00000000000..a27e4360fab
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/cached-function.ts
@@ -0,0 +1,75 @@
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+
+/**
+ * Options for creating a cached function.
+ */
+export interface CachedFunctionOptions<A> {
+  /**
+   * Function to convert arguments to a cache key string.
+   * Defaults to `JSON.stringify`.
+   */
+  readonly key?: (args: A) => string;
+}
+
+/**
+ * Creates a memoized version of a function that returns an Effect.
+ *
+ * The key feature is deduplication of concurrent calls with the same inputs -
+ * only one execution happens while other callers wait for and receive the same result.
+ *
+ * @example
+ * ```ts
+ * import * as Effect from "effect/Effect";
+ * import { cachedFunction } from "~/lib/cached-function";
+ *
+ * const fetchUser = (id: string) =>
+ *   Effect.promise(() => fetch(`/users/${id}`).then(r => r.json()));
+ *
+ * const program = Effect.gen(function* () {
+ *   const cachedFetchUser = yield* cachedFunction(fetchUser);
+ *
+ *   // These concurrent calls will only trigger one fetch
+ *   const [user1, user2] = yield* Effect.all([
+ *     cachedFetchUser("123"),
+ *     cachedFetchUser("123"),
+ *   ]);
+ * });
+ * ```
+ */
+export const cachedFunction = <A, B, E, R>(
+  fn: (args: A) => Effect.Effect<B, E, R>,
+  options?: CachedFunctionOptions<A>,
+): Effect.Effect<(args: A) => Effect.Effect<B, E, R>> =>
+  Effect.sync(() => {
+    const keyFn = options?.key ?? JSON.stringify;
+    const cache = new Map<string, Deferred.Deferred<B, E>>();
+
+    return (args: A): Effect.Effect<B, E, R> =>
+      Effect.suspend(() => {
+        const cacheKey = keyFn(args);
+        const existing = cache.get(cacheKey);
+
+        // If there's already a deferred for this key, wait on it
+        if (existing) {
+          return Deferred.await(existing);
+        }
+
+        // Create a new deferred and store it
+        return Effect.gen(function* () {
+          const deferred = yield* Deferred.make<B, E>();
+          cache.set(cacheKey, deferred);
+
+          // Execute the effect and complete the deferred
+          const exit = yield* Effect.exit(fn(args));
+          yield* Deferred.done(deferred, exit);
+
+          if (exit._tag === "Failure") {
+            cache.delete(cacheKey);
+          }
+
+          // Return the result
+          return yield* exit;
+        });
+      });
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/camel.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/camel.ts
new file mode 100644
index 00000000000..7590caaec5b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/camel.ts
@@ -0,0 +1,21 @@
+import { isPlainObject } from "./data.ts";
+
+export const camelCaseKey = (key: string) =>
+  key
+    .replace(/^_+/, "")
+    .replace(/_([a-z])/g, (_, letter: string) => letter.toUpperCase());
+
+export const toCamelCase = <T>(value: unknown): T => {
+  if (Array.isArray(value)) {
+    return value.map((item) => toCamelCase(item)) as T;
+  }
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, nested]) => [
+        camelCaseKey(key),
+        toCamelCase(nested),
+      ]),
+    ) as T;
+  }
+  return value as T;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/data.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/data.ts
new file mode 100644
index 00000000000..2094e3d27d2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/data.ts
@@ -0,0 +1,56 @@
+import * as Predicate from "effect/Predicate";
+import * as EffectRecord from "effect/Record";
+import * as Redacted from "effect/Redacted";
+
+export type Primitive =
+  | never
+  | undefined
+  | null
+  | boolean
+  | number
+  | string
+  | bigint
+  | symbol;
+
+export const isPrimitive = (value: any): value is Primitive =>
+  value === undefined ||
+  value === null ||
+  typeof value === "boolean" ||
+  typeof value === "number" ||
+  typeof value === "string" ||
+  typeof value === "symbol" ||
+  typeof value === "bigint";
+
+export const isPlainObject = (
+  value: unknown,
+): value is Record<string, unknown> => {
+  if (!Predicate.isObject(value)) return false;
+  return Object.getPrototypeOf(value) === Object.prototype;
+};
+
+export const stripFields = <T>(value: T, empty: null | undefined): T => {
+  if (Array.isArray(value)) {
+    return value.map((item) => stripFields(item, empty)) as T;
+  }
+  if (!isPlainObject(value)) return value;
+  return EffectRecord.map(
+    EffectRecord.filter(value, (entry) => entry !== empty),
+    (entry) => stripFields(entry, empty),
+  ) as T;
+};
+
+export const stripNullFields = <T>(value: T): T => stripFields(value, null);
+
+export const stripUndefinedFields = <T>(value: T): T =>
+  stripFields(value, undefined);
+
+export const unwrapRedacted = <T>(value: T): T => {
+  if (Redacted.isRedacted(value)) {
+    return Redacted.value(value) as T;
+  }
+  if (Array.isArray(value)) {
+    return value.map(unwrapRedacted) as T;
+  }
+  if (!isPlainObject(value)) return value;
+  return EffectRecord.map(value, unwrapRedacted) as T;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/dedent.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/dedent.ts
new file mode 100644
index 00000000000..8b6ba055857
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/dedent.ts
@@ -0,0 +1,59 @@
+/**
+ * Tagged template literal for removing indentation from a block of text.
+ *
+ * If the first line is empty, it will be ignored.
+ */
+export function dedent(
+  strings: TemplateStringsArray,
+  ...values: unknown[]
+): string;
+export function dedent(text: string): string;
+export function dedent(
+  stringsOrText: TemplateStringsArray | string,
+  ...values: unknown[]
+): string {
+  const raw =
+    typeof stringsOrText === "string"
+      ? stringsOrText
+      : String.raw({ raw: stringsOrText }, ...values);
+
+  let lines = raw.split("\n");
+
+  while (lines.length > 0 && lines[0].trim() === "") {
+    lines = lines.slice(1);
+  }
+
+  while (lines.length > 0 && lines[lines.length - 1].trim() === "") {
+    lines = lines.slice(0, lines.length - 1);
+  }
+
+  if (lines.length === 0) {
+    return "";
+  }
+
+  let minIndentLength = Number.POSITIVE_INFINITY;
+  for (const line of lines) {
+    if (line.trim() !== "") {
+      const indent = line.match(/^[ \t]*/)?.[0];
+      if (indent != null && indent.length < minIndentLength) {
+        minIndentLength = indent.length;
+      }
+    }
+  }
+
+  if (minIndentLength === Number.POSITIVE_INFINITY) {
+    return lines.join("\n");
+  }
+
+  lines = lines.map((line) => {
+    if (line.trim() === "") {
+      return line;
+    }
+    return line.startsWith(" ".repeat(minIndentLength)) ||
+      line.startsWith("\t".repeat(minIndentLength))
+      ? line.substring(minIndentLength)
+      : line;
+  });
+
+  return lines.join("\n");
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/effect.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/effect.ts
new file mode 100644
index 00000000000..401121bd15d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/effect.ts
@@ -0,0 +1,114 @@
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { pipeArguments } from "effect/Pipeable";
+import { SingleShotGen } from "effect/Utils";
+
+export type EffectClass<Shape, A, Err = never, Req = never> = Effect.Effect<
+  A,
+  Err,
+  Req
+> & {
+  new (_: never): Shape;
+};
+
+export const effectClass: {
+  <A, Err = never, Req = never>(
+    impl: Effect.Effect<A, Err, Req>,
+  ): EffectClass<A, A, Err, Req>;
+  <Shape>(): <A, Err = never, Req = never>(
+    impl: Effect.Effect<A, Err, Req>,
+  ) => EffectClass<Shape, A, Err, Req>;
+} = ((impl?: any) =>
+  impl === undefined
+    ? (innerImpl: any) => effectClass(innerImpl)
+    : (Object.assign(
+        class {
+          static asEffect() {
+            return impl;
+          }
+          static [Symbol.iterator]() {
+            return new SingleShotGen(this.asEffect());
+          }
+          static pipe(...fns: any) {
+            return pipeArguments(this, fns);
+          }
+        },
+        impl,
+      ) as unknown as EffectClass<any, any, any, any>)) as any;
+
+export const taggedFunction = <
+  Tag extends Context.ServiceClass<any, any, any>,
+  Fn extends (...args: any[]) => any,
+>(
+  tag: Tag,
+  fn: Fn,
+): Tag & Fn => {
+  const overrides = {
+    asEffect: () => tag,
+    [Symbol.iterator]: () => tag[Symbol.iterator](),
+    pipe: (...fns: any[]) => pipeArguments(tag, fns as any),
+    toString: () => `${tag.toString()}.${fn.name}`,
+  };
+
+  return new Proxy(fn, {
+    get: (target, prop, receiver) =>
+      Reflect.has(overrides, prop)
+        ? Reflect.get(overrides, prop, receiver)
+        : Reflect.has(target, prop)
+          ? Reflect.get(target, prop, receiver)
+          : Reflect.get(tag as object, prop, tag),
+    has: (target, prop) =>
+      Reflect.has(overrides, prop) ||
+      Reflect.has(target, prop) ||
+      Reflect.has(tag as object, prop),
+  }) as Tag & Fn;
+};
+
+export const isYieldableEffect = (
+  value: unknown,
+): value is Effect.Effect<unknown, unknown, unknown> =>
+  Effect.isEffect(value) &&
+  typeof (value as { [Symbol.iterator]?: unknown })[Symbol.iterator] ===
+    "function";
+
+export type YieldableEffectLike<A = unknown, E = unknown, R = unknown> =
+  | Effect.Effect<A, E, R>
+  | {
+      asEffect: () => Effect.Effect<A, E, R>;
+      [Symbol.iterator]: () => Iterator<unknown>;
+    };
+
+export const isEffectClassLike = (
+  value: unknown,
+): value is YieldableEffectLike =>
+  typeof value === "function" &&
+  typeof (value as { asEffect?: unknown }).asEffect === "function";
+
+export const isYieldableEffectLike = (
+  value: unknown,
+): value is YieldableEffectLike =>
+  isYieldableEffect(value) || isEffectClassLike(value);
+
+export type UnwrapEffect<T> =
+  T extends Effect.Effect<infer A, any, any> ? A : T;
+
+export type ToEffectInterface<T> = {
+  raw: T;
+} & {
+  [K in keyof T]: T[K] extends (...args: any[]) => any
+    ? (...args: Parameters<T[K]>) => Effect.Effect<Awaited<ReturnType<T[K]>>>
+    : T[K];
+};
+
+export const toEffectInterface = <T extends object>(raw: T) =>
+  ({
+    raw,
+    ...Object.fromEntries(
+      Object.entries(raw).map(([key, value]) => [
+        key,
+        typeof value === "function"
+          ? (...args: any[]) => Effect.tryPromise(async () => value(...args))
+          : value,
+      ]),
+    ),
+  }) as ToEffectInterface<T>;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/exec.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/exec.ts
new file mode 100644
index 00000000000..f0d238980e9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/exec.ts
@@ -0,0 +1,18 @@
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import type { ChildProcess } from "effect/unstable/process";
+
+export const exec = Effect.fn("exec")(function* (
+  command: ChildProcess.Command,
+) {
+  const handle = yield* command;
+  const [exitCode, stdout, stderr] = yield* Effect.all(
+    [
+      handle.exitCode,
+      Stream.mkString(Stream.decodeText(handle.stdout)),
+      Stream.mkString(Stream.decodeText(handle.stderr)),
+    ],
+    { concurrency: 3 },
+  );
+  return { exitCode, stdout, stderr };
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/gitignore-rules-to-globs.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/gitignore-rules-to-globs.ts
new file mode 100644
index 00000000000..6db321aa397
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/gitignore-rules-to-globs.ts
@@ -0,0 +1,80 @@
+/**
+ * Converts gitignore-style rules into glob patterns for tools like fast-glob's {@link https://github.com/mrmlnc/fast-glob#ignore `ignore`} option.
+ *
+ * Gitignore and glob differ (ordering, negation, escapes). This maps the common cases:
+ *
+ * - Rules with no `/` match at any depth → \`**\/name\`, \`**\/name\/\*\/`
+ * - A leading `/` anchors to the ignore file's directory (use the same `cwd` in fast-glob) → `name`, `name/**`
+ * - A `/` in the pattern (not only leading) uses path-aware matching → `a/b`, `a/b/**`
+ * - A trailing `/` restricts to directories → adds `/**` as needed
+ * - Lines starting with `!` (negation) are returned with a `!` prefix for use in **positive** glob
+ *   lists; they are not valid in fast-glob's `ignore` array (filter them out if you only pass `ignore`)
+ *
+ * Does not implement full gitignore escaping (e.g. `\\ ` for trailing space) or `**` edge cases
+ * identical to git; escape handling can be added later if needed.
+ */
+export function gitignoreRulesToGlobs(rules: ReadonlyArray<string>): string[] {
+  const out: string[] = [];
+  for (const raw of rules) {
+    const line = raw.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+      continue;
+    }
+    let negated = false;
+    let rest = line;
+    if (rest.startsWith("!")) {
+      negated = true;
+      rest = rest.slice(1).trim();
+      if (rest.length === 0 || rest.startsWith("#")) {
+        continue;
+      }
+    }
+    let dirOnly = rest.endsWith("/");
+    if (dirOnly) {
+      rest = rest.slice(0, -1);
+    }
+    rest = rest.replace(/\\/g, "/");
+    if (rest.length === 0) {
+      continue;
+    }
+    const anchored = rest.startsWith("/");
+    if (anchored) {
+      rest = rest.slice(1);
+    }
+    if (rest.length === 0) {
+      continue;
+    }
+    const hasSlash = rest.includes("/");
+    const globs = ruleBodyToGlobs(rest, { anchored, hasSlash, dirOnly });
+    for (const g of globs) {
+      out.push(negated ? `!${g}` : g);
+    }
+  }
+  return out;
+}
+
+function ruleBodyToGlobs(
+  body: string,
+  opts: { anchored: boolean; hasSlash: boolean; dirOnly: boolean },
+): string[] {
+  const { anchored, hasSlash, dirOnly } = opts;
+  if (dirOnly) {
+    if (anchored) {
+      return [`${body}/**`];
+    }
+    if (hasSlash) {
+      return [`${body}/**`];
+    }
+    return [`**/${body}/**`];
+  }
+  if (anchored) {
+    if (hasSlash) {
+      return [body, `${body}/**`];
+    }
+    return [body, `${body}/**`];
+  }
+  if (hasSlash) {
+    return [body, `${body}/**`];
+  }
+  return [`**/${body}`, `**/${body}/**`];
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/hash.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/hash.ts
new file mode 100644
index 00000000000..f97813b1df8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/hash.ts
@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+import * as Effect from "effect/Effect";
+
+/**
+ * Stable hash of a resolved Task input. Wrapped in `Effect.sync` so the
+ * call participates in the Effect runtime (tracing/interruption) per the
+ * Effect-platform conventions.
+ */
+export const hashInput = (input: unknown): Effect.Effect<string> =>
+  Effect.sync(() =>
+    createHash("sha256")
+      .update(JSON.stringify(input ?? null))
+      .digest("hex"),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/index.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/index.ts
new file mode 100644
index 00000000000..0830cb7dca7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/index.ts
@@ -0,0 +1,10 @@
+export * from "./base32.ts";
+export * from "./camel.ts";
+export * from "./data.ts";
+export * from "./dedent.ts";
+export * from "./service.ts";
+export * from "./sha256.ts";
+export * from "./stable.ts";
+export * from "./type.ts";
+export * from "./types.ts";
+export * from "./unknown.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/layer-scoped.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/layer-scoped.ts
new file mode 100644
index 00000000000..44ba28d6f0a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/layer-scoped.ts
@@ -0,0 +1,25 @@
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import type * as Scope from "effect/Scope";
+
+/**
+ * Builds a layer with the current scope.
+ * @param layer - The layer to build.
+ * @returns A scoped effect returning a Context with the provided layer.
+ */
+export const buildLayerScoped = <ROut, E, RIn>(
+  layer: Layer.Layer<ROut, E, RIn>,
+): Effect.Effect<Context.Context<ROut>, E, RIn | Scope.Scope> =>
+  Effect.flatMap(Effect.scope, (scope) => Layer.buildWithScope(layer, scope));
+
+/**
+ * Builds a layer with the current scope and provides it to the given effect.
+ * @param layer - The layer to build.
+ */
+export const provideLayerScoped =
+  <ROut, E1, RIn>(layer: Layer.Layer<ROut, E1, RIn>) =>
+  <A, E2, R>(effect: Effect.Effect<A, E2, R>) =>
+    Effect.flatMap(buildLayerScoped(layer), (context) =>
+      Effect.provideContext(effect, context),
+    );
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/poll.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/poll.ts
new file mode 100644
index 00000000000..5fb9fa70009
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/poll.ts
@@ -0,0 +1,47 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Predicate from "effect/Predicate";
+import * as Schedule from "effect/Schedule";
+
+export class PredicateFailed extends Data.TaggedError("PredicateFailed")<{
+  message: string;
+  actual: unknown;
+}> {}
+
+export const isPredicateFailed = (e: unknown): e is PredicateFailed =>
+  Predicate.isTagged(e, "PredicateFailed");
+
+/**
+ * Retries an effect until a predicate is met.
+ * @param input - The input to the poll function.
+ * @param input.description - The description of what is being polled; used in the error message if the predicate fails.
+ * @param input.effect - The effect to execute until the predicate is met.
+ * @param input.predicate - The predicate to check if the effect has met the desired state.
+ * @param input.schedule - The schedule to use for retries; defaults to every 3 seconds.
+ * @param input.times - The maximum number of times to poll; defaults to 50.
+ * @returns The value that satisfies the predicate.
+ */
+export const poll = Effect.fn("poll")(
+  <A, E, R>(input: {
+    description?: string;
+    effect: Effect.Effect<A, E, R>;
+    predicate: (value: A) => boolean;
+    schedule?: Schedule.Schedule<unknown, unknown, never>;
+    times?: number;
+  }) =>
+    input.effect.pipe(
+      Effect.filterOrFail(
+        input.predicate,
+        (actual) =>
+          new PredicateFailed({
+            message: `Predicate failed: ${input.description ?? "<no description>"}`,
+            actual,
+          }),
+      ),
+      Effect.retry({
+        while: isPredicateFailed,
+        schedule: input.schedule ?? Schedule.spaced("3 seconds"),
+        times: input.times ?? 50,
+      }),
+    ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/proxy-chain.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/proxy-chain.ts
new file mode 100644
index 00000000000..0727590ebe4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/proxy-chain.ts
@@ -0,0 +1,80 @@
+import * as Effect from "effect/Effect";
+
+type Op =
+  | { kind: "get"; prop: PropertyKey }
+  | { kind: "call"; args: unknown[] };
+
+/**
+ * Replay an op chain against a real value. `get` reads a property,
+ * `call` invokes — bound to the previous receiver so `this` resolves
+ * to the object the method was read from (drizzle's `select()` etc.
+ * read `this._.session`, so dropping `this` would throw).
+ */
+const replay = (root: unknown, ops: ReadonlyArray<Op>): unknown => {
+  let cur: any = root;
+  let receiver: any = root;
+  for (const op of ops) {
+    if (op.kind === "get") {
+      receiver = cur;
+      cur = cur[op.prop];
+    } else {
+      cur = cur.apply(receiver, op.args);
+      receiver = cur;
+    }
+  }
+  return cur;
+};
+
+/**
+ * Wrap a cached `Effect<T>` in a chainable Proxy so callers can use the
+ * returned value as if it were `T` itself — every property read and call
+ * records a step, and the chain is replayed against the resolved value
+ * when it's finally yielded as an Effect.
+ *
+ * Compare:
+ *
+ * ```typescript
+ * // Without proxyChain — caller has to yield the cached Effect first:
+ * const conn = yield* makeConnection();      // Effect<Db>
+ * fetch: Effect.gen(function* () {
+ *   const db = yield* conn;
+ *   const rows = yield* db.select().from(users);
+ * });
+ *
+ * // With proxyChain — caller treats the return as the value directly:
+ * const db = proxyChain(yield* Effect.cached(makeDb));   // T
+ * fetch: Effect.gen(function* () {
+ *   const rows = yield* db.select().from(users);
+ * });
+ * ```
+ *
+ * The chain ends when the proxy is yielded as an Effect — the resolved
+ * value at that point must be a `Yieldable` (an Effect, drizzle query
+ * builder, etc). Anything before that is recorded as ops.
+ */
+export const proxyChain = <T>(cached: Effect.Effect<T, any, any>): T =>
+  chain(cached) as T;
+
+const chain = (
+  cached: Effect.Effect<unknown, any, any>,
+  ops: ReadonlyArray<Op> = [],
+): unknown =>
+  new Proxy(function () {} as any, {
+    get(_, prop) {
+      if (prop === Symbol.iterator) {
+        // `yield* proxy` — produce the resolved Effect's iterator.
+        return function () {
+          const eff = Effect.flatMap(
+            cached,
+            (root) =>
+              replay(root, ops) as Effect.Effect<unknown, unknown, unknown>,
+          );
+          return (eff as any)[Symbol.iterator]();
+        };
+      }
+      return chain(cached, [...ops, { kind: "get", prop }]);
+    },
+    apply(_, __, args) {
+      return chain(cached, [...ops, { kind: "call", args }]);
+    },
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/scc.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/scc.ts
new file mode 100644
index 00000000000..7810c92241f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/scc.ts
@@ -0,0 +1,89 @@
+/**
+ * Compute the set of graph nodes that participate in a dependency cycle.
+ *
+ * A node is considered "in a cycle" iff it sits in a strongly-connected
+ * component (SCC) of size > 1, or has a self-edge (size-1 SCC that loops
+ * back to itself).
+ *
+ * Implementation is iterative Tarjan's algorithm to avoid blowing the JS
+ * call stack on very wide graphs.
+ */
+export const findCycleMembers = (
+  edges: Record<string, readonly string[]>,
+): Set<string> => {
+  const cycleMembers = new Set<string>();
+
+  let index = 0;
+  const indexOf = new Map<string, number>();
+  const lowlink = new Map<string, number>();
+  const onStack = new Set<string>();
+  const stack: string[] = [];
+
+  type Frame = { node: string; childIdx: number };
+  const callStack: Frame[] = [];
+
+  const startNode = (node: string) => {
+    indexOf.set(node, index);
+    lowlink.set(node, index);
+    index += 1;
+    stack.push(node);
+    onStack.add(node);
+    callStack.push({ node, childIdx: 0 });
+  };
+
+  for (const root of Object.keys(edges)) {
+    if (indexOf.has(root)) continue;
+    startNode(root);
+
+    while (callStack.length > 0) {
+      const frame = callStack[callStack.length - 1];
+      const children = edges[frame.node] ?? [];
+      if (frame.childIdx < children.length) {
+        const child = children[frame.childIdx];
+        frame.childIdx += 1;
+        if (!indexOf.has(child)) {
+          startNode(child);
+          continue;
+        }
+        if (onStack.has(child)) {
+          lowlink.set(
+            frame.node,
+            Math.min(lowlink.get(frame.node)!, indexOf.get(child)!),
+          );
+        }
+        continue;
+      }
+
+      // All children processed: maybe close an SCC.
+      if (lowlink.get(frame.node) === indexOf.get(frame.node)) {
+        const scc: string[] = [];
+        for (;;) {
+          const w = stack.pop()!;
+          onStack.delete(w);
+          scc.push(w);
+          if (w === frame.node) break;
+        }
+        if (scc.length > 1) {
+          for (const fqn of scc) cycleMembers.add(fqn);
+        } else {
+          // Size-1 SCC: only counts as a cycle if it has a self-edge.
+          const only = scc[0];
+          if ((edges[only] ?? []).includes(only)) {
+            cycleMembers.add(only);
+          }
+        }
+      }
+
+      // Pop frame and propagate lowlink up to the parent.
+      callStack.pop();
+      const parent = callStack[callStack.length - 1];
+      if (parent) {
+        const cur = lowlink.get(parent.node)!;
+        const childLow = lowlink.get(frame.node)!;
+        if (childLow < cur) lowlink.set(parent.node, childLow);
+      }
+    }
+  }
+
+  return cycleMembers;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/service.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/service.ts
new file mode 100644
index 00000000000..5c2254e31cf
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/service.ts
@@ -0,0 +1,16 @@
+import * as Context from "effect/Context";
+
+export const GenericService =
+  <
+    Fn extends (T: { Type: string }) => Context.Service<any, any> = (
+      ...args: any[]
+    ) => Context.Service<any, any>,
+  >() =>
+  <Kind extends string>(Kind: Kind): ReturnType<Fn> & Fn => {
+    const service = Context.Service<any, any>(Kind);
+    const make = (Type: string) => Context.Service(`${Kind}<${Type}>`);
+    return Object.assign(
+      Object.setPrototypeOf(make, service),
+      service,
+    ) as ReturnType<Fn> & Fn;
+  };
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/sha256.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/sha256.ts
new file mode 100644
index 00000000000..213a2dc9a3b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/sha256.ts
@@ -0,0 +1,27 @@
+import * as Effect from "effect/Effect";
+import { stableValue } from "./stable.ts";
+
+type Input = ArrayBuffer | Uint8Array | string;
+
+export const sha256 = (input: Input) =>
+  Effect.promise(async () => {
+    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(input));
+    const hashArray = Array.from(new Uint8Array(digest));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  });
+
+export const sha256Object = (input: object) =>
+  sha256(JSON.stringify(stableValue(input)));
+
+const toArrayBuffer = (input: Input) => {
+  if (input instanceof ArrayBuffer) {
+    return input;
+  }
+  if (typeof input === "string") {
+    return new TextEncoder().encode(input);
+  }
+  return input.buffer.slice(
+    input.byteOffset,
+    input.byteOffset + input.byteLength,
+  ) as ArrayBuffer;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/stable.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/stable.ts
new file mode 100644
index 00000000000..458f59143c0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/stable.ts
@@ -0,0 +1,35 @@
+import { isPlainObject } from "./data.ts";
+
+export const normalizeNulls = <T>(value: T): T => {
+  if (value === null) {
+    return undefined as T;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => normalizeNulls(item)) as T;
+  }
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value)
+        .map(([key, nested]) => [key, normalizeNulls(nested)])
+        .filter(([, nested]) => nested !== undefined),
+    ) as T;
+  }
+  return value;
+};
+
+export const stableValue = (value: unknown): unknown => {
+  if (Array.isArray(value)) {
+    return value.map(stableValue);
+  }
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, nested]) => [key, stableValue(nested)]),
+    );
+  }
+  return value;
+};
+
+export const stableStringify = (value: unknown) =>
+  JSON.stringify(stableValue(normalizeNulls(value) ?? null));
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/type.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/type.ts
new file mode 100644
index 00000000000..7c1f312da40
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/type.ts
@@ -0,0 +1,6 @@
+export type type<T> = new () => T;
+export const type = class {} as new <T>() => T;
+
+export declare namespace type {
+  export type of<T extends type<any>> = InstanceType<T>;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/types.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/types.ts
new file mode 100644
index 00000000000..1f9c698b308
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/types.ts
@@ -0,0 +1,32 @@
+import * as Effect from "effect/Effect";
+
+export type IsAny<T> = 0 extends 1 & T ? true : false;
+
+export type ExcludeAny<T> = IsAny<T> extends true ? never : T;
+
+export type UnionToIntersection<U> = (
+  U extends any ? (k: U) => void : never
+) extends (k: infer I) => void
+  ? I
+  : never;
+
+export const assertDefined = <T>(value: T | undefined, message: string): T => {
+  if (!value) {
+    throw new Error(message);
+  }
+  return value;
+};
+
+export const asEffect = <T, Err = never, Req = never>(
+  effect:
+    | T
+    | Effect.Effect<T, Err, Req>
+    | { asEffect: () => Effect.Effect<T, Err, Req> },
+): Effect.Effect<T, Err, Req> =>
+  typeof (effect as any)?.asEffect === "function"
+    ? (effect as any).asEffect()
+    : Effect.isEffect(effect)
+      ? effect
+      : Effect.succeed(effect as T);
+
+export type IsNever<T> = [T] extends [never] ? true : false;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/unknown.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/unknown.ts
new file mode 100644
index 00000000000..e06e7ee12d5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/unknown.ts
@@ -0,0 +1,19 @@
+import type { Input } from "../Input.ts";
+import { type Output, isOutput } from "../Output.ts";
+import type { IsAny } from "./types.ts";
+
+// @ts-expect-error - we want to allow any value to be checked for unknown
+export const isUnknown = <V>(value: V): value is Output<Input.Resolve<V>> =>
+  isOutput(value);
+
+export type IsUnknown<T> = unknown extends T
+  ? IsAny<T> extends true
+    ? false
+    : true
+  : false;
+
+export type UnknownKeys<T> = {
+  [K in keyof T]: IsUnknown<T[K]> extends true ? K : never;
+}[keyof T];
+
+export type ExcludeUnknown<T> = IsUnknown<T> extends true ? never : T;
diff --git a/.repos/alchemy-effect/packages/alchemy/src/Util/zip.ts b/.repos/alchemy-effect/packages/alchemy/src/Util/zip.ts
new file mode 100644
index 00000000000..822cfabb3a2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/Util/zip.ts
@@ -0,0 +1,27 @@
+import * as Effect from "effect/Effect";
+
+export interface ZipFile {
+  path: string;
+  content: string | Uint8Array<ArrayBufferLike>;
+}
+
+export const zipCode = Effect.fn(function* (
+  content: string | Uint8Array<ArrayBufferLike>,
+  files?: ReadonlyArray<ZipFile>,
+) {
+  // Create a zip buffer in memory
+  const zip = new (yield* Effect.promise(() => import("jszip"))).default();
+  const date = new Date("1980-01-01T00:00:00.000Z");
+  zip.file("index.mjs", content, { date });
+  for (const file of files ?? []) {
+    zip.file(file.path, file.content, { date });
+  }
+
+  return yield* Effect.promise(() =>
+    zip.generateAsync({
+      type: "nodebuffer",
+      compression: "DEFLATE",
+      platform: "UNIX",
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/src/index.ts b/.repos/alchemy-effect/packages/alchemy/src/index.ts
new file mode 100644
index 00000000000..abd522298ba
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/src/index.ts
@@ -0,0 +1,56 @@
+export {
+  Action,
+  isAction,
+  type Action as ActionInstance,
+  type ActionLike,
+} from "./Action.ts";
+export * as AdoptPolicy from "./AdoptPolicy.ts";
+export * from "./AlchemyContext.ts";
+export * from "./Apply.ts";
+export {
+  Service as BindingService,
+  Policy,
+  type ServiceLike as BindingServiceLike,
+  type ServiceShape as BindingServiceShape,
+  type PolicyLike,
+  type PolicyShape,
+} from "./Binding.ts";
+export * from "./Destroy.ts";
+export * from "./Diff.ts";
+export * from "./Input.ts";
+export * from "./InstanceId.ts";
+export * from "./KeyPair.ts";
+export * from "./Namespace.ts";
+export { stackRef } from "./Output.ts";
+export type { Output } from "./Output.ts";
+export * from "./PhysicalName.ts";
+export * as Plan from "./Plan.ts";
+export { Provider, ProviderCollection } from "./Provider.ts";
+export * from "./Random.ts";
+export * from "./Ref.ts";
+export * as RemovalPolicy from "./RemovalPolicy.ts";
+export * from "./Resource.ts";
+export * as Schema from "./Schema.ts";
+export * as Server from "./Server/index.ts";
+export * as Serverless from "./Serverless/index.ts";
+export { Stack } from "./Stack.ts";
+export * from "./Stage.ts";
+export { inMemoryState, localState } from "./State/index.ts";
+
+export * as Construct from "./Construct.ts";
+
+// Re-export internal types so they can be portably named in
+// downstream `.d.ts` emissions (fixes TS2883 in user files).
+export { AuthProviders } from "./Auth/AuthProvider.ts";
+export { Cli } from "./Cli/Cli.ts";
+export type { Dependencies } from "./Dependencies.ts";
+export type * from "./Platform.ts";
+export { Platform } from "./Platform.ts";
+export type { ProviderCollectionLike } from "./Provider.ts";
+export type * from "./Rpc.ts";
+export {
+  RuntimeContext,
+  type BaseRuntimeContext,
+  type RuntimeContext as RuntimeContextInterface,
+} from "./RuntimeContext.ts";
+export type * from "./Stack.ts";
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Account.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Account.test.ts
new file mode 100644
index 00000000000..ec10d14807d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Account.test.ts
@@ -0,0 +1,30 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("patch API Gateway account settings", (stack) =>
+  Effect.gen(function* () {
+    const before = yield* ag.getAccount({});
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        yield* AWS.ApiGateway.Account("AgAccount", {});
+        return undefined;
+      }),
+    );
+
+    const account = yield* ag.getAccount({});
+    expect(account).toBeDefined();
+
+    yield* stack.destroy();
+
+    const after = yield* ag.getAccount({});
+    expect(after.cloudwatchRoleArn).toEqual(before.cloudwatchRoleArn);
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/ApiKey.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/ApiKey.test.ts
new file mode 100644
index 00000000000..8c4af161aad
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/ApiKey.test.ts
@@ -0,0 +1,47 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete API key", (stack) =>
+  Effect.gen(function* () {
+    const key = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* AWS.ApiGateway.ApiKey("AgApiKey", {
+          generateDistinctId: true,
+          enabled: true,
+        });
+      }),
+    );
+
+    expect(key.id).toBeDefined();
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)(
+  "custom API key value is not returned in outputs",
+  (stack) =>
+    Effect.gen(function* () {
+      const key = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.ApiKey("AgApiKeySecret", {
+            value: Redacted.make("alchemy-test-secret-value-abc123"),
+          });
+        }),
+      );
+
+      expect(key.id).toBeDefined();
+      expect(Object.keys(key as Record<string, unknown>)).not.toContain(
+        "value",
+      );
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Authorizer.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Authorizer.test.ts
new file mode 100644
index 00000000000..d6acf2a7c6d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Authorizer.test.ts
@@ -0,0 +1,60 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+const authorizerUri = process.env.ALCHEMY_TEST_AUTHORIZER_URI;
+
+/**
+ * Requires a Lambda authorizer invocation URI accepted by API Gateway.
+ */
+test.provider.skipIf(!runLive || !authorizerUri)(
+  "create and update Lambda TOKEN authorizer",
+  (stack) =>
+    Effect.gen(function* () {
+      const uri = authorizerUri!;
+
+      const { api, authorizer } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgAuthorizerApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          const authorizer = yield* AWS.ApiGateway.Authorizer("AgAuthorizer", {
+            restApiId: api.restApiId,
+            type: "TOKEN",
+            authorizerUri: uri,
+            identitySource: "method.request.header.Authorization",
+            authorizerResultTtlInSeconds: 60,
+          });
+          return { api, authorizer };
+        }),
+      );
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          const apiAgain = yield* AWS.ApiGateway.RestApi("AgAuthorizerApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.Authorizer("AgAuthorizer", {
+            restApiId: apiAgain.restApiId,
+            type: "TOKEN",
+            authorizerUri: uri,
+            identitySource: "method.request.header.Authorization",
+            authorizerResultTtlInSeconds: 120,
+          });
+        }),
+      );
+
+      const remote = yield* ag.getAuthorizer({
+        restApiId: api.restApiId,
+        authorizerId: authorizer.authorizerId,
+      });
+      expect(remote.authorizerResultTtlInSeconds).toEqual(120);
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/BasePathMapping.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/BasePathMapping.test.ts
new file mode 100644
index 00000000000..80fd480daf5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/BasePathMapping.test.ts
@@ -0,0 +1,7 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import { describe } from "@effect/vitest";
+
+Test.make({ providers: AWS.providers() });
+
+describe.skip("ApiGateway.BasePathMapping", () => {});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Bindings.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Bindings.test.ts
new file mode 100644
index 00000000000..65d2c5162c9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Bindings.test.ts
@@ -0,0 +1,9 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import { describe, it } from "vitest";
+
+Test.make({ providers: AWS.providers() });
+
+describe("ApiGateway bindings", () => {
+  it.skip("placeholder — no runtime bindings for REST v1 in this slice", () => {});
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Deployment.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Deployment.test.ts
new file mode 100644
index 00000000000..b4b514a9cb7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Deployment.test.ts
@@ -0,0 +1,85 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete deployment", (stack) =>
+  Effect.gen(function* () {
+    const { api, deployment } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const api = yield* AWS.ApiGateway.RestApi("AgDepApi", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+        yield* AWS.ApiGateway.Method("AgDepMock", {
+          restApi: api,
+          httpMethod: "GET",
+          authorizationType: "NONE",
+          integration: { type: "MOCK" },
+        });
+        const deployment = yield* AWS.ApiGateway.Deployment("AgDep", {
+          restApi: api,
+          description: "alchemy-test-deployment",
+        });
+        return { api, deployment };
+      }),
+    );
+
+    expect(deployment.deploymentId).toBeDefined();
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)(
+  "deployment trigger change creates new deployment",
+  (stack) =>
+    Effect.gen(function* () {
+      const { api, d1 } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgTrigApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.Method("AgTrigMock", {
+            restApi: api,
+            httpMethod: "GET",
+            authorizationType: "NONE",
+            integration: { type: "MOCK" },
+          });
+          const deployment = yield* AWS.ApiGateway.Deployment("AgTrigDep", {
+            restApi: api,
+            description: "v1",
+            triggers: { t: "a" },
+          });
+          return { api, d1: deployment };
+        }),
+      );
+
+      const { d2 } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgTrigApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.Method("AgTrigMock", {
+            restApi: api,
+            httpMethod: "GET",
+            authorizationType: "NONE",
+            integration: { type: "MOCK" },
+          });
+          const deployment = yield* AWS.ApiGateway.Deployment("AgTrigDep", {
+            restApi: api,
+            description: "v1",
+            triggers: { t: "b" },
+          });
+          return { d2: deployment };
+        }),
+      );
+
+      expect(d2.deploymentId).not.toEqual(d1.deploymentId);
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/DomainName.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/DomainName.test.ts
new file mode 100644
index 00000000000..63b071f6da1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/DomainName.test.ts
@@ -0,0 +1,7 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import { describe } from "@effect/vitest";
+
+Test.make({ providers: AWS.providers() });
+
+describe.skip("ApiGateway.DomainName", () => {});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/GatewayResponse.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/GatewayResponse.test.ts
new file mode 100644
index 00000000000..f8e9ca9cb74
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/GatewayResponse.test.ts
@@ -0,0 +1,87 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete gateway response", (stack) =>
+  Effect.gen(function* () {
+    const { api } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const api = yield* AWS.ApiGateway.RestApi("AgGwRespApi", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+        yield* AWS.ApiGateway.GatewayResponse("AgDefault4xx", {
+          restApiId: api.restApiId,
+          responseType: "DEFAULT_4XX",
+          responseTemplates: {
+            "application/json": '{"message":"test"}',
+          },
+        });
+        return { api };
+      }),
+    );
+
+    const g = yield* ag.getGatewayResponse({
+      restApiId: api.restApiId,
+      responseType: "DEFAULT_4XX",
+    });
+    expect(g.responseType).toEqual("DEFAULT_4XX");
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)(
+  "update gateway response status and templates",
+  (stack) =>
+    Effect.gen(function* () {
+      const { api } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgGwRespUpdateApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.GatewayResponse("AgDefault5xx", {
+            restApiId: api.restApiId,
+            responseType: "DEFAULT_5XX",
+            statusCode: "500",
+            responseTemplates: {
+              "application/json": '{"message":"v1"}',
+            },
+          });
+          return { api };
+        }),
+      );
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          const apiAgain = yield* AWS.ApiGateway.RestApi("AgGwRespUpdateApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.GatewayResponse("AgDefault5xx", {
+            restApiId: apiAgain.restApiId,
+            responseType: "DEFAULT_5XX",
+            statusCode: "502",
+            responseTemplates: {
+              "application/json": '{"message":"v2"}',
+            },
+          });
+        }),
+      );
+
+      const g = yield* ag.getGatewayResponse({
+        restApiId: api.restApiId,
+        responseType: "DEFAULT_5XX",
+      });
+      expect(g.statusCode).toEqual("502");
+      expect(g.responseTemplates?.["application/json"]).toEqual(
+        '{"message":"v2"}',
+      );
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Method.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Method.test.ts
new file mode 100644
index 00000000000..6774968e481
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Method.test.ts
@@ -0,0 +1,40 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete MOCK method", (stack) =>
+  Effect.gen(function* () {
+    const { api } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const api = yield* AWS.ApiGateway.RestApi("AgMethodApi", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+        yield* AWS.ApiGateway.Method("AgMockGet", {
+          restApi: api,
+          httpMethod: "GET",
+          authorizationType: "NONE",
+          integration: {
+            type: "MOCK",
+            requestTemplates: { "application/json": '{"statusCode": 200}' },
+          },
+        });
+        return { api };
+      }),
+    );
+
+    const method = yield* ag.getMethod({
+      restApiId: api.restApiId,
+      resourceId: api.rootResourceId,
+      httpMethod: "GET",
+    });
+    expect(method.httpMethod).toEqual("GET");
+
+    yield* stack.destroy();
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Resource.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Resource.test.ts
new file mode 100644
index 00000000000..ed328a8ee52
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Resource.test.ts
@@ -0,0 +1,37 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)(
+  "create and delete API Gateway resource",
+  (stack) =>
+    Effect.gen(function* () {
+      const { api, res } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgResApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          const res = yield* AWS.ApiGateway.Resource("AgSubPath", {
+            restApi: api,
+            parentId: api.rootResourceId,
+            pathPart: "items",
+          });
+          return { api, res };
+        }),
+      );
+
+      const remote = yield* ag.getResource({
+        restApiId: api.restApiId,
+        resourceId: res.resourceId,
+      });
+      expect(remote.pathPart).toEqual("items");
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/RestApi.smoke.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/RestApi.smoke.test.ts
new file mode 100644
index 00000000000..66eeabf06e2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/RestApi.smoke.test.ts
@@ -0,0 +1,126 @@
+import * as AWS from "@/AWS";
+import { AWSEnvironment } from "@/AWS/Environment";
+import * as Output from "@/Output";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { TestFunction, TestFunctionLive } from "../Lambda/handler.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)(
+  "REST API proxies to Lambda (primitives)",
+  (stack) =>
+    Effect.gen(function* () {
+      const { region, accountId } = yield* AWSEnvironment;
+
+      const out = yield* stack.deploy(
+        Effect.gen(function* () {
+          const fn = yield* TestFunction.pipe(Effect.provide(TestFunctionLive));
+
+          const api = yield* AWS.ApiGateway.RestApi("AgSmokeApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+
+          const proxyResource = yield* AWS.ApiGateway.Resource("AgSmokeProxy", {
+            restApi: api,
+            parentId: api.rootResourceId,
+            pathPart: "{proxy+}",
+          });
+
+          const invokeUri = Output.map(
+            fn.functionArn,
+            (arn: string) =>
+              `arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/${arn}/invocations`,
+          );
+
+          yield* AWS.ApiGateway.Method("AgSmokeRootAny", {
+            restApi: api,
+            httpMethod: "ANY",
+            authorizationType: "NONE",
+            integration: {
+              type: "AWS_PROXY",
+              integrationHttpMethod: "POST",
+              uri: invokeUri,
+            },
+          });
+
+          yield* AWS.ApiGateway.Method("AgSmokeProxyAny", {
+            restApi: api,
+            resourceId: proxyResource.resourceId,
+            httpMethod: "ANY",
+            authorizationType: "NONE",
+            integration: {
+              type: "AWS_PROXY",
+              integrationHttpMethod: "POST",
+              uri: invokeUri,
+            },
+          });
+
+          const deployment = yield* AWS.ApiGateway.Deployment("AgSmokeDep", {
+            restApi: api,
+            description: "smoke",
+          });
+
+          const stage = yield* AWS.ApiGateway.Stage("AgSmokeStage", {
+            restApi: api,
+            stageName: "test",
+            deploymentId: deployment.deploymentId,
+          });
+
+          yield* AWS.Lambda.Permission("AgSmokePerm", {
+            action: "lambda:InvokeFunction",
+            functionName: fn.functionName,
+            principal: "apigateway.amazonaws.com",
+            sourceArn: Output.map(
+              api.restApiId,
+              (id: string) =>
+                `arn:aws:execute-api:${region}:${accountId}:${id}/*/*/*`,
+            ),
+          });
+
+          const invokeUrl = Output.map(
+            Output.all(api.restApiId, stage.stageName),
+            ([id, sn]: [string, string]) =>
+              `https://${id}.execute-api.${region}.amazonaws.com/${sn}/`,
+          );
+
+          return { invokeUrl };
+        }),
+      );
+
+      const response = yield* HttpClient.get(out.invokeUrl).pipe(
+        Effect.flatMap((response) =>
+          response.status === 200
+            ? Effect.succeed(response)
+            : Effect.fail(new Error(`invoke URL returned ${response.status}`)),
+        ),
+        Effect.retry({
+          // Stage propagation + Lambda permission can take 30–90s after the
+          // last create. Cap exponential at 10s so we keep polling at a
+          // steady cadence instead of doubling out to multi-minute waits.
+          schedule: Schedule.exponential(500).pipe(
+            Schedule.modifyDelay((d: Duration.Duration) =>
+              Effect.succeed(
+                Duration.isGreaterThan(d, Duration.seconds(10))
+                  ? Duration.seconds(10)
+                  : d,
+              ),
+            ),
+            Schedule.both(Schedule.recurs(20)),
+          ),
+        }),
+      );
+
+      expect(response.status).toBe(200);
+      expect(yield* response.text).toBe("Hello, world!");
+
+      yield* stack.destroy();
+    }),
+  { timeout: 600_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/RestApi.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/RestApi.test.ts
new file mode 100644
index 00000000000..ff3df2c42da
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/RestApi.test.ts
@@ -0,0 +1,94 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete REST API", (stack) =>
+  Effect.gen(function* () {
+    const api = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* AWS.ApiGateway.RestApi("AgRestApiLifecycle", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+      }),
+    );
+
+    expect(api.restApiId).toBeDefined();
+    expect(api.rootResourceId).toBeDefined();
+
+    const remote = yield* ag.getRestApi({ restApiId: api.restApiId });
+    expect(remote.id).toEqual(api.restApiId);
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)(
+  "binary media types update applies via patch",
+  (stack) =>
+    Effect.gen(function* () {
+      const api = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.RestApi("AgRestApiBinary", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+            binaryMediaTypes: ["application/octet-stream"],
+          });
+        }),
+      );
+
+      expect(api.binaryMediaTypes?.includes("application/octet-stream")).toBe(
+        true,
+      );
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.RestApi("AgRestApiBinary", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+            binaryMediaTypes: ["application/octet-stream", "image/png"],
+          });
+        }),
+      );
+
+      const remote = yield* ag.getRestApi({ restApiId: api.restApiId });
+      expect(remote.binaryMediaTypes?.includes("image/png")).toBe(true);
+
+      yield* stack.destroy();
+    }),
+);
+
+test.provider.skipIf(!runLive)(
+  "binary media types removal applies via patch",
+  (stack) =>
+    Effect.gen(function* () {
+      const api = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.RestApi("AgRestApiBinaryRemoval", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+            binaryMediaTypes: ["application/octet-stream", "image/png"],
+          });
+        }),
+      );
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.RestApi("AgRestApiBinaryRemoval", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+            binaryMediaTypes: ["image/png"],
+          });
+        }),
+      );
+
+      const remote = yield* ag.getRestApi({ restApiId: api.restApiId });
+      expect(remote.binaryMediaTypes?.includes("image/png")).toBe(true);
+      expect(
+        remote.binaryMediaTypes?.includes("application/octet-stream"),
+      ).toBe(false);
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Stage.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Stage.test.ts
new file mode 100644
index 00000000000..0e229e6e533
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/Stage.test.ts
@@ -0,0 +1,173 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete stage", (stack) =>
+  Effect.gen(function* () {
+    const { stage } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const api = yield* AWS.ApiGateway.RestApi("AgStageApi", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+        yield* AWS.ApiGateway.Method("AgStageMock", {
+          restApi: api,
+          httpMethod: "GET",
+          authorizationType: "NONE",
+          integration: { type: "MOCK" },
+        });
+        const deployment = yield* AWS.ApiGateway.Deployment("AgStageDep", {
+          restApi: api,
+        });
+        const stage = yield* AWS.ApiGateway.Stage("AgStageDev", {
+          restApi: api,
+          stageName: "dev",
+          deploymentId: deployment.deploymentId,
+        });
+        return { stage };
+      }),
+    );
+
+    expect(stage.stageName).toEqual("dev");
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)("stage variables update in place", (stack) =>
+  Effect.gen(function* () {
+    const { api, deployment } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const api = yield* AWS.ApiGateway.RestApi("AgStageVarApi", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+        yield* AWS.ApiGateway.Method("AgStageVarMock", {
+          restApi: api,
+          httpMethod: "GET",
+          authorizationType: "NONE",
+          integration: { type: "MOCK" },
+        });
+        const deployment = yield* AWS.ApiGateway.Deployment("AgStageVarDep", {
+          restApi: api,
+        });
+        const stage = yield* AWS.ApiGateway.Stage("AgStageVar", {
+          restApi: api,
+          stageName: "dev",
+          deploymentId: deployment.deploymentId,
+          variables: { K: "1" },
+        });
+        return { api, stage, deployment };
+      }),
+    );
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        const api = yield* AWS.ApiGateway.RestApi("AgStageVarApi", {
+          endpointConfiguration: { types: ["REGIONAL"] },
+        });
+        yield* AWS.ApiGateway.Method("AgStageVarMock", {
+          restApi: api,
+          httpMethod: "GET",
+          authorizationType: "NONE",
+          integration: { type: "MOCK" },
+        });
+        const deployment = yield* AWS.ApiGateway.Deployment("AgStageVarDep", {
+          restApi: api,
+        });
+        yield* AWS.ApiGateway.Stage("AgStageVar", {
+          restApi: api,
+          stageName: "dev",
+          deploymentId: deployment.deploymentId,
+          variables: { K: "2" },
+        });
+        return undefined;
+      }),
+    );
+
+    const remote = yield* ag.getStage({
+      restApiId: api.restApiId,
+      stageName: "dev",
+    });
+    expect(remote.variables?.K).toEqual("2");
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)(
+  "stage method settings update in place",
+  (stack) =>
+    Effect.gen(function* () {
+      const { api } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgStageMethodApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.Method("AgStageMethodMock", {
+            restApi: api,
+            httpMethod: "GET",
+            authorizationType: "NONE",
+            integration: { type: "MOCK" },
+          });
+          const deployment = yield* AWS.ApiGateway.Deployment(
+            "AgStageMethodDep",
+            {
+              restApi: api,
+            },
+          );
+          yield* AWS.ApiGateway.Stage("AgStageMethod", {
+            restApi: api,
+            stageName: "dev",
+            deploymentId: deployment.deploymentId,
+            methodSettings: {
+              "*/*": { throttlingBurstLimit: 10, throttlingRateLimit: 100 },
+            },
+          });
+          return { api };
+        }),
+      );
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          const api = yield* AWS.ApiGateway.RestApi("AgStageMethodApi", {
+            endpointConfiguration: { types: ["REGIONAL"] },
+          });
+          yield* AWS.ApiGateway.Method("AgStageMethodMock", {
+            restApi: api,
+            httpMethod: "GET",
+            authorizationType: "NONE",
+            integration: { type: "MOCK" },
+          });
+          const deployment = yield* AWS.ApiGateway.Deployment(
+            "AgStageMethodDep",
+            {
+              restApi: api,
+            },
+          );
+          yield* AWS.ApiGateway.Stage("AgStageMethod", {
+            restApi: api,
+            stageName: "dev",
+            deploymentId: deployment.deploymentId,
+            methodSettings: {
+              "*/*": { throttlingBurstLimit: 20, throttlingRateLimit: 200 },
+            },
+          });
+          return undefined;
+        }),
+      );
+
+      const remote = yield* ag.getStage({
+        restApiId: api.restApiId,
+        stageName: "dev",
+      });
+      expect(remote.methodSettings?.["*/*"]?.throttlingBurstLimit).toEqual(20);
+      expect(remote.methodSettings?.["*/*"]?.throttlingRateLimit).toEqual(200);
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/UsagePlan.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/UsagePlan.test.ts
new file mode 100644
index 00000000000..ef54e1db33c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/UsagePlan.test.ts
@@ -0,0 +1,53 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)("create and delete usage plan", (stack) =>
+  Effect.gen(function* () {
+    const plan = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* AWS.ApiGateway.UsagePlan("AgUsagePlan", {
+          description: "test plan",
+        });
+      }),
+    );
+
+    expect(plan.id).toBeDefined();
+
+    yield* stack.destroy();
+  }),
+);
+
+test.provider.skipIf(!runLive)(
+  "usage plan throttle updates in place",
+  (stack) =>
+    Effect.gen(function* () {
+      const plan = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.UsagePlan("AgUsagePlanThrottle", {
+            throttle: { burstLimit: 10, rateLimit: 100 },
+          });
+        }),
+      );
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.UsagePlan("AgUsagePlanThrottle", {
+            throttle: { burstLimit: 20, rateLimit: 200 },
+          });
+        }),
+      );
+
+      const remote = yield* ag.getUsagePlan({ usagePlanId: plan.id });
+      expect(remote.throttle?.burstLimit).toEqual(20);
+      expect(remote.throttle?.rateLimit).toEqual(200);
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/UsagePlanKey.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/UsagePlanKey.test.ts
new file mode 100644
index 00000000000..249284e8ef4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/UsagePlanKey.test.ts
@@ -0,0 +1,33 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+
+test.provider.skipIf(!runLive)(
+  "create and delete usage plan key association",
+  (stack) =>
+    Effect.gen(function* () {
+      const { key, plan } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const key = yield* AWS.ApiGateway.ApiKey("AgUpkKey", {
+            generateDistinctId: true,
+          });
+          const plan = yield* AWS.ApiGateway.UsagePlan("AgUpkPlan", {});
+          yield* AWS.ApiGateway.UsagePlanKey("AgUpkLink", {
+            usagePlanId: plan.id,
+            keyId: key.id,
+          });
+          return { key, plan };
+        }),
+      );
+
+      expect(key.id).toBeDefined();
+      expect(plan.id).toBeDefined();
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/VpcLink.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/VpcLink.test.ts
new file mode 100644
index 00000000000..55f15511bad
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ApiGateway/VpcLink.test.ts
@@ -0,0 +1,46 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as ag from "@distilled.cloud/aws/api-gateway";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_APIGATEWAY_TESTS === "true";
+const targetArn = process.env.ALCHEMY_TEST_VPC_LINK_TARGET_ARN;
+
+/**
+ * Requires a load balancer ARN accepted by API Gateway VPC links (set env when running live).
+ */
+test.provider.skipIf(!runLive || !targetArn)(
+  "create, update description, delete VPC link",
+  (stack) =>
+    Effect.gen(function* () {
+      const arn = targetArn!;
+
+      const link = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.VpcLink("AgVpcLinkTest", {
+            description: "v1",
+            targetArns: [arn],
+          });
+        }),
+      );
+
+      expect(link.vpcLinkId).toBeDefined();
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* AWS.ApiGateway.VpcLink("AgVpcLinkTest", {
+            description: "v2",
+            targetArns: [arn],
+          });
+        }),
+      );
+
+      const remote = yield* ag.getVpcLink({ vpcLinkId: link.vpcLinkId });
+      expect(remote.description).toEqual("v2");
+
+      yield* stack.destroy();
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/CachePolicy.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/CachePolicy.test.ts
new file mode 100644
index 00000000000..2288c6b3de5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/CachePolicy.test.ts
@@ -0,0 +1,97 @@
+import * as AWS from "@/AWS";
+import { CachePolicy } from "@/AWS/CloudFront";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+describe("AWS.CloudFront.CachePolicy", () => {
+  test.provider.skipIf(!runLive)(
+    "create, update, and delete a cache policy",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* CachePolicy("ApiCachePolicy", {
+              comment: "initial",
+              minTTL: 0,
+              defaultTTL: 60,
+              maxTTL: 3600,
+              parametersInCacheKeyAndForwardedToOrigin: {
+                EnableAcceptEncodingGzip: true,
+                EnableAcceptEncodingBrotli: true,
+                HeadersConfig: {
+                  HeaderBehavior: "whitelist",
+                  Headers: { Quantity: 1, Items: ["Authorization"] },
+                },
+                CookiesConfig: { CookieBehavior: "none" },
+                QueryStringsConfig: { QueryStringBehavior: "all" },
+              },
+            });
+          }),
+        );
+
+        const initial = yield* cloudfront.getCachePolicy({
+          Id: created.cachePolicyId,
+        });
+        expect(initial.CachePolicy?.Id).toEqual(created.cachePolicyId);
+        expect(initial.CachePolicy?.CachePolicyConfig?.Comment).toEqual(
+          "initial",
+        );
+        expect(initial.CachePolicy?.CachePolicyConfig?.DefaultTTL).toEqual(60);
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* CachePolicy("ApiCachePolicy", {
+              comment: "updated",
+              minTTL: 0,
+              defaultTTL: 120,
+              maxTTL: 86400,
+              parametersInCacheKeyAndForwardedToOrigin: {
+                EnableAcceptEncodingGzip: true,
+                EnableAcceptEncodingBrotli: true,
+                HeadersConfig: { HeaderBehavior: "none" },
+                CookiesConfig: { CookieBehavior: "none" },
+                QueryStringsConfig: { QueryStringBehavior: "none" },
+              },
+            });
+          }),
+        );
+
+        expect(updated.cachePolicyId).toEqual(created.cachePolicyId);
+
+        const after = yield* cloudfront.getCachePolicy({
+          Id: updated.cachePolicyId,
+        });
+        expect(after.CachePolicy?.CachePolicyConfig?.Comment).toEqual(
+          "updated",
+        );
+        expect(after.CachePolicy?.CachePolicyConfig?.DefaultTTL).toEqual(120);
+        expect(after.CachePolicy?.CachePolicyConfig?.MaxTTL).toEqual(86400);
+
+        yield* stack.destroy();
+        yield* assertCachePolicyDeleted(updated.cachePolicyId);
+      }),
+    { timeout: 300_000 },
+  );
+});
+
+const assertCachePolicyDeleted = (id: string) =>
+  cloudfront.getCachePolicy({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("CachePolicyStillExists"))),
+    Effect.catchTag("NoSuchCachePolicy", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error && error.message === "CachePolicyStillExists",
+      schedule: Schedule.fixed("5 seconds").pipe(
+        Schedule.both(Schedule.recurs(24)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Distribution.smoke.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Distribution.smoke.test.ts
new file mode 100644
index 00000000000..16921d6f281
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Distribution.smoke.test.ts
@@ -0,0 +1,268 @@
+import * as AWS from "@/AWS";
+import {
+  CachePolicy,
+  Distribution,
+  KeyGroup,
+  OriginAccessControl,
+  OriginRequestPolicy,
+  PublicKey,
+  ResponseHeadersPolicy,
+} from "@/AWS/CloudFront";
+import type { PolicyStatement } from "@/AWS/IAM/Policy";
+import { Bucket } from "@/AWS/S3";
+import * as Output from "@/Output";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+const SIGNING_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvTkfqkMHU8HMmIRKJaMl
+IoD691g60aS15QlaP/DVkpuoeEp8JA8YDs5vQFu6HSIYCTQ7WwFx9oRvN08i7yXB
+EHt3x7uZVpdkp6JBbjR9BGNsAVri6DZ0TJQ11zWeN3keqhnUdFhQjPwT+u4r6oKk
+kNvkl7eU2nFK+UIaPlD+rA+AlYT0m7gSVcd9KaLf/UzBrtSy1dbXYDT4dHChMUVy
+4gDsQ6D4u6lRAHY9jcKxlgEIM+O8ODKyzlbergv2EwhANG4P27DBeDhA/off3upM
+TTVTGKZeoABtqM0ZiYq0cDgf8KUn9NPxSdnJ4+cbigLjJBPS93VYWzWX0HXlZpQ3
+HQIDAQAB
+-----END PUBLIC KEY-----
+`;
+
+describe("AWS.CloudFront smoke", () => {
+  test.provider.skipIf(!runLive)(
+    "deploy distribution wired to cache, origin request, and response headers policies alongside a key group",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const bucket = yield* Bucket("SmokeBucket", { forceDestroy: true });
+            const oac = yield* OriginAccessControl("SmokeOac", {
+              originType: "s3",
+            });
+
+            const cachePolicy = yield* CachePolicy("SmokeCachePolicy", {
+              comment: "smoke",
+              minTTL: 0,
+              defaultTTL: 60,
+              maxTTL: 86400,
+              parametersInCacheKeyAndForwardedToOrigin: {
+                EnableAcceptEncodingGzip: true,
+                EnableAcceptEncodingBrotli: true,
+                HeadersConfig: { HeaderBehavior: "none" },
+                CookiesConfig: { CookieBehavior: "none" },
+                QueryStringsConfig: { QueryStringBehavior: "none" },
+              },
+            });
+
+            const originRequestPolicy = yield* OriginRequestPolicy(
+              "SmokeOriginRequestPolicy",
+              {
+                comment: "smoke",
+                headersConfig: { HeaderBehavior: "none" },
+                cookiesConfig: { CookieBehavior: "none" },
+                queryStringsConfig: { QueryStringBehavior: "all" },
+              },
+            );
+
+            const responseHeadersPolicy = yield* ResponseHeadersPolicy(
+              "SmokeResponseHeadersPolicy",
+              {
+                comment: "smoke",
+                securityHeadersConfig: {
+                  StrictTransportSecurity: {
+                    AccessControlMaxAgeSec: 31536000,
+                    IncludeSubdomains: true,
+                    Preload: true,
+                    Override: true,
+                  },
+                  ContentTypeOptions: { Override: true },
+                  FrameOptions: { FrameOption: "DENY", Override: true },
+                },
+              },
+            );
+
+            const publicKey = yield* PublicKey("SmokeSigningKey", {
+              encodedKey: SIGNING_PUBLIC_KEY,
+              comment: "smoke signed-url key",
+            });
+
+            const keyGroup = yield* KeyGroup("SmokeSigningKeys", {
+              comment: "smoke signed-url group",
+              items: [publicKey.publicKeyId],
+            });
+
+            const distribution = yield* Distribution("SmokeDistribution", {
+              origins: [
+                {
+                  id: "site",
+                  domainName: bucket.bucketRegionalDomainName,
+                  s3Origin: true,
+                  originAccessControlId: oac.originAccessControlId,
+                },
+              ],
+              defaultRootObject: "index.html",
+              defaultCacheBehavior: {
+                targetOriginId: "site",
+                viewerProtocolPolicy: "redirect-to-https",
+                compress: true,
+                allowedMethods: ["GET", "HEAD"],
+                cachedMethods: ["GET", "HEAD"],
+                cachePolicyId: cachePolicy.cachePolicyId,
+                originRequestPolicyId:
+                  originRequestPolicy.originRequestPolicyId,
+                responseHeadersPolicyId:
+                  responseHeadersPolicy.responseHeadersPolicyId,
+              },
+            });
+
+            const statement: PolicyStatement = {
+              Effect: "Allow",
+              Principal: { Service: "cloudfront.amazonaws.com" },
+              Action: ["s3:GetObject"],
+              Resource: [Output.interpolate`${bucket.bucketArn}/*` as any],
+              Condition: {
+                StringEquals: {
+                  "AWS:SourceArn": distribution.distributionArn as any,
+                },
+              },
+            };
+
+            yield* bucket.bind`Allow(${distribution}, CloudFront.Read(${bucket}))`(
+              { policyStatements: [statement] },
+            );
+
+            return {
+              bucket,
+              oac,
+              cachePolicy,
+              originRequestPolicy,
+              responseHeadersPolicy,
+              publicKey,
+              keyGroup,
+              distribution,
+            };
+          }),
+        );
+
+        const dist = yield* cloudfront.getDistribution({
+          Id: deployed.distribution.distributionId,
+        });
+        expect(dist.Distribution?.Status).toEqual("Deployed");
+
+        const defaultBehavior =
+          dist.Distribution?.DistributionConfig?.DefaultCacheBehavior;
+        expect(defaultBehavior?.CachePolicyId).toEqual(
+          deployed.cachePolicy.cachePolicyId,
+        );
+        expect(defaultBehavior?.OriginRequestPolicyId).toEqual(
+          deployed.originRequestPolicy.originRequestPolicyId,
+        );
+        expect(defaultBehavior?.ResponseHeadersPolicyId).toEqual(
+          deployed.responseHeadersPolicy.responseHeadersPolicyId,
+        );
+
+        const cachePolicy = yield* cloudfront.getCachePolicy({
+          Id: deployed.cachePolicy.cachePolicyId,
+        });
+        expect(cachePolicy.CachePolicy?.Id).toEqual(
+          deployed.cachePolicy.cachePolicyId,
+        );
+
+        const originRequestPolicy = yield* cloudfront.getOriginRequestPolicy({
+          Id: deployed.originRequestPolicy.originRequestPolicyId,
+        });
+        expect(originRequestPolicy.OriginRequestPolicy?.Id).toEqual(
+          deployed.originRequestPolicy.originRequestPolicyId,
+        );
+
+        const responseHeadersPolicy =
+          yield* cloudfront.getResponseHeadersPolicy({
+            Id: deployed.responseHeadersPolicy.responseHeadersPolicyId,
+          });
+        expect(responseHeadersPolicy.ResponseHeadersPolicy?.Id).toEqual(
+          deployed.responseHeadersPolicy.responseHeadersPolicyId,
+        );
+
+        const keyGroup = yield* cloudfront.getKeyGroup({
+          Id: deployed.keyGroup.keyGroupId,
+        });
+        expect(keyGroup.KeyGroup?.KeyGroupConfig?.Items).toEqual([
+          deployed.publicKey.publicKeyId,
+        ]);
+
+        yield* stack.destroy();
+        yield* assertDistributionDeleted(deployed.distribution.distributionId);
+        yield* assertCachePolicyDeleted(deployed.cachePolicy.cachePolicyId);
+        yield* assertOriginRequestPolicyDeleted(
+          deployed.originRequestPolicy.originRequestPolicyId,
+        );
+        yield* assertResponseHeadersPolicyDeleted(
+          deployed.responseHeadersPolicy.responseHeadersPolicyId,
+        );
+        yield* assertKeyGroupDeleted(deployed.keyGroup.keyGroupId);
+        yield* assertPublicKeyDeleted(deployed.publicKey.publicKeyId);
+      }),
+    900_000,
+  );
+});
+
+const retrying = (label: string) =>
+  Effect.retry({
+    while: (error: unknown) =>
+      error instanceof Error && error.message === label,
+    schedule: Schedule.fixed("10 seconds").pipe(
+      Schedule.both(Schedule.recurs(60)),
+    ),
+  });
+
+const assertDistributionDeleted = (id: string) =>
+  cloudfront.getDistribution({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("DistributionStillExists"))),
+    Effect.catchTag("NoSuchDistribution", () => Effect.void),
+    retrying("DistributionStillExists"),
+  );
+
+const assertCachePolicyDeleted = (id: string) =>
+  cloudfront.getCachePolicy({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("CachePolicyStillExists"))),
+    Effect.catchTag("NoSuchCachePolicy", () => Effect.void),
+    retrying("CachePolicyStillExists"),
+  );
+
+const assertOriginRequestPolicyDeleted = (id: string) =>
+  cloudfront.getOriginRequestPolicy({ Id: id }).pipe(
+    Effect.flatMap(() =>
+      Effect.fail(new Error("OriginRequestPolicyStillExists")),
+    ),
+    Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.void),
+    retrying("OriginRequestPolicyStillExists"),
+  );
+
+const assertResponseHeadersPolicyDeleted = (id: string) =>
+  cloudfront.getResponseHeadersPolicy({ Id: id }).pipe(
+    Effect.flatMap(() =>
+      Effect.fail(new Error("ResponseHeadersPolicyStillExists")),
+    ),
+    Effect.catchTag("NoSuchResponseHeadersPolicy", () => Effect.void),
+    retrying("ResponseHeadersPolicyStillExists"),
+  );
+
+const assertKeyGroupDeleted = (id: string) =>
+  cloudfront.getKeyGroup({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("KeyGroupStillExists"))),
+    Effect.catchTag("NoSuchResource", () => Effect.void),
+    retrying("KeyGroupStillExists"),
+  );
+
+const assertPublicKeyDeleted = (id: string) =>
+  cloudfront.getPublicKey({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("PublicKeyStillExists"))),
+    Effect.catchTag("NoSuchPublicKey", () => Effect.void),
+    retrying("PublicKeyStillExists"),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Distribution.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Distribution.test.ts
new file mode 100644
index 00000000000..faab0fe8548
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Distribution.test.ts
@@ -0,0 +1,125 @@
+import * as AWS from "@/AWS";
+import { Distribution, OriginAccessControl } from "@/AWS/CloudFront";
+import type { PolicyStatement } from "@/AWS/IAM/Policy";
+import { Bucket } from "@/AWS/S3";
+import * as Output from "@/Output";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as S3 from "@distilled.cloud/aws/s3";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+describe("AWS.CloudFront.Distribution", () => {
+  test.provider.skipIf(!runLive)(
+    "create and delete distribution for a private S3 origin",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const bucket = yield* Bucket("WebsiteBucket", {
+              forceDestroy: true,
+            });
+            const oac = yield* OriginAccessControl("WebsiteOac", {
+              originType: "s3",
+            });
+            const distribution = yield* Distribution("WebsiteDistribution", {
+              origins: [
+                {
+                  id: "site",
+                  domainName: bucket.bucketRegionalDomainName,
+                  s3Origin: true,
+                  originAccessControlId: oac.originAccessControlId,
+                },
+              ],
+              defaultRootObject: "index.html",
+              defaultCacheBehavior: {
+                targetOriginId: "site",
+                viewerProtocolPolicy: "redirect-to-https",
+                compress: true,
+                allowedMethods: ["GET", "HEAD"],
+                cachedMethods: ["GET", "HEAD"],
+                forwardedValues: {
+                  QueryString: false,
+                  Cookies: {
+                    Forward: "none",
+                  },
+                },
+              },
+            });
+
+            const statement: PolicyStatement = {
+              Effect: "Allow",
+              Principal: {
+                Service: "cloudfront.amazonaws.com",
+              },
+              Action: ["s3:GetObject"],
+              Resource: [Output.interpolate`${bucket.bucketArn}/*` as any],
+              Condition: {
+                StringEquals: {
+                  "AWS:SourceArn": distribution.distributionArn as any,
+                },
+              },
+            };
+
+            yield* bucket.bind`Allow(${distribution}, CloudFront.Read(${bucket}))`(
+              {
+                policyStatements: [statement],
+              },
+            );
+
+            return {
+              bucket,
+              oac,
+              distribution,
+            };
+          }),
+        );
+
+        const current = yield* cloudfront.getDistribution({
+          Id: deployed.distribution.distributionId,
+        });
+        expect(current.Distribution?.Status).toEqual("Deployed");
+        expect(current.Distribution?.DomainName).toEqual(
+          deployed.distribution.domainName,
+        );
+
+        const control = yield* cloudfront.getOriginAccessControl({
+          Id: deployed.oac.originAccessControlId,
+        });
+        expect(control.OriginAccessControl?.Id).toEqual(
+          deployed.oac.originAccessControlId,
+        );
+
+        yield* S3.putObject({
+          Bucket: deployed.bucket.bucketName,
+          Key: "index.html",
+          Body: "<html>ok</html>",
+          ContentType: "text/html; charset=utf-8",
+        });
+
+        yield* stack.destroy();
+        yield* assertDistributionDeleted(deployed.distribution.distributionId);
+      }),
+    { timeout: 600_000 },
+  );
+});
+
+const assertDistributionDeleted = (distributionId: string) =>
+  cloudfront.getDistribution({ Id: distributionId }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("DistributionStillExists"))),
+    Effect.catchTag("NoSuchDistribution", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error && error.message === "DistributionStillExists",
+      schedule: Schedule.fixed("10 seconds").pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Function.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Function.test.ts
new file mode 100644
index 00000000000..f56d59f83a6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Function.test.ts
@@ -0,0 +1,64 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider.skipIf(process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS !== "true")(
+  "create and delete a CloudFront Function with key value store associations",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const deployed = yield* stack.deploy(
+        Effect.gen(function* () {
+          const store = yield* AWS.CloudFront.KeyValueStore("RequestStore", {
+            comment: "request metadata",
+          });
+          const fn = yield* AWS.CloudFront.Function("RequestFn", {
+            comment: "request handler",
+            keyValueStoreArns: [store.keyValueStoreArn],
+            code: `async function handler(event) {
+  return event.request;
+}`,
+          });
+          return { store, fn };
+        }),
+      );
+
+      const current = yield* cloudfront.describeFunction({
+        Name: deployed.fn.functionName,
+        Stage: "LIVE",
+      });
+      expect(current.FunctionSummary?.Name).toEqual(deployed.fn.functionName);
+      expect(
+        current.FunctionSummary?.FunctionConfig.KeyValueStoreAssociations
+          ?.Items?.[0]?.KeyValueStoreARN,
+      ).toEqual(deployed.store.keyValueStoreArn);
+
+      yield* stack.destroy();
+      yield* assertFunctionDeleted(deployed.fn.functionName);
+    }),
+  { timeout: 300_000 },
+);
+
+const assertFunctionDeleted = (name: string) =>
+  cloudfront
+    .describeFunction({
+      Name: name,
+      Stage: "LIVE",
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new Error("FunctionStillExists"))),
+      Effect.catchTag("NoSuchFunctionExists", () => Effect.void),
+      Effect.retry({
+        while: (error) =>
+          error instanceof Error && error.message === "FunctionStillExists",
+        schedule: Schedule.fixed("5 seconds").pipe(
+          Schedule.both(Schedule.recurs(24)),
+        ),
+      }),
+    );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Invalidation.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Invalidation.test.ts
new file mode 100644
index 00000000000..a5f8fd0bd8f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/Invalidation.test.ts
@@ -0,0 +1,126 @@
+import * as AWS from "@/AWS";
+import { Distribution, OriginAccessControl } from "@/AWS/CloudFront";
+import type { PolicyStatement } from "@/AWS/IAM/Policy";
+import { Bucket } from "@/AWS/S3";
+import * as Output from "@/Output";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as S3 from "@distilled.cloud/aws/s3";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider.skipIf(process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS !== "true")(
+  "create invalidation with explicit paths and wait for completion",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const deployed = yield* stack.deploy(
+        Effect.gen(function* () {
+          const bucket = yield* Bucket("WebsiteBucket", {
+            forceDestroy: true,
+          });
+          const oac = yield* OriginAccessControl("WebsiteOac", {
+            originType: "s3",
+          });
+          const distribution = yield* Distribution("WebsiteDistribution", {
+            origins: [
+              {
+                id: "site",
+                domainName: bucket.bucketRegionalDomainName,
+                s3Origin: true,
+                originAccessControlId: oac.originAccessControlId,
+              },
+            ],
+            defaultRootObject: "index.html",
+            defaultCacheBehavior: {
+              targetOriginId: "site",
+              viewerProtocolPolicy: "redirect-to-https",
+              compress: true,
+              allowedMethods: ["GET", "HEAD"],
+              cachedMethods: ["GET", "HEAD"],
+              forwardedValues: {
+                QueryString: false,
+                Cookies: {
+                  Forward: "none",
+                },
+              },
+            },
+          });
+
+          const statement: PolicyStatement = {
+            Effect: "Allow",
+            Principal: {
+              Service: "cloudfront.amazonaws.com",
+            },
+            Action: ["s3:GetObject"],
+            Resource: [Output.interpolate`${bucket.bucketArn}/*` as any],
+            Condition: {
+              StringEquals: {
+                "AWS:SourceArn": distribution.distributionArn as any,
+              },
+            },
+          };
+
+          yield* bucket.bind`Allow(${distribution}, CloudFront.Read(${bucket}))`(
+            {
+              policyStatements: [statement],
+            },
+          );
+
+          const invalidation = yield* AWS.CloudFront.Invalidation(
+            "InvalidateDocs",
+            {
+              distributionId: distribution.distributionId,
+              version: "v2",
+              wait: true,
+              paths: ["/index.html", "/docs/*"],
+            },
+          );
+
+          return {
+            bucket,
+            distribution,
+            invalidation,
+          };
+        }),
+      );
+
+      yield* S3.putObject({
+        Bucket: deployed.bucket.bucketName,
+        Key: "index.html",
+        Body: "<html>ok</html>",
+        ContentType: "text/html; charset=utf-8",
+      });
+
+      const current = yield* cloudfront.getInvalidation({
+        DistributionId: deployed.distribution.distributionId,
+        Id: deployed.invalidation.invalidationId,
+      });
+      expect(current.Invalidation?.Status).toEqual("Completed");
+      expect(current.Invalidation?.InvalidationBatch?.Paths?.Items).toEqual([
+        "/index.html",
+        "/docs/*",
+      ]);
+
+      yield* stack.destroy();
+      yield* assertDistributionDeleted(deployed.distribution.distributionId);
+    }),
+  { timeout: 600_000 },
+);
+
+const assertDistributionDeleted = (distributionId: string) =>
+  cloudfront.getDistribution({ Id: distributionId }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("DistributionStillExists"))),
+    Effect.catchTag("NoSuchDistribution", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error && error.message === "DistributionStillExists",
+      schedule: Schedule.fixed("10 seconds").pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/KeyGroup.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/KeyGroup.test.ts
new file mode 100644
index 00000000000..c5dd0e43cb0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/KeyGroup.test.ts
@@ -0,0 +1,116 @@
+import * as AWS from "@/AWS";
+import { KeyGroup, PublicKey } from "@/AWS/CloudFront";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+const PRIMARY_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvTkfqkMHU8HMmIRKJaMl
+IoD691g60aS15QlaP/DVkpuoeEp8JA8YDs5vQFu6HSIYCTQ7WwFx9oRvN08i7yXB
+EHt3x7uZVpdkp6JBbjR9BGNsAVri6DZ0TJQ11zWeN3keqhnUdFhQjPwT+u4r6oKk
+kNvkl7eU2nFK+UIaPlD+rA+AlYT0m7gSVcd9KaLf/UzBrtSy1dbXYDT4dHChMUVy
+4gDsQ6D4u6lRAHY9jcKxlgEIM+O8ODKyzlbergv2EwhANG4P27DBeDhA/off3upM
+TTVTGKZeoABtqM0ZiYq0cDgf8KUn9NPxSdnJ4+cbigLjJBPS93VYWzWX0HXlZpQ3
+HQIDAQAB
+-----END PUBLIC KEY-----
+`;
+
+const SECONDARY_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu6QT6PtJ4O4Xcy6C8BkI
+NHDRF8TnPbWZlVFYXr4R9miLMlORiH34sUtyYAwYlvHyYlrL76Z4A8HaLTMDfCf5
+eswQr0r7qVOstRJrEW8ycTXJw/8Mj+1KKSrs8QopVZBMEnOfiUsentnWhQgKSpbI
+mA4sLTg45jBoaZi9c8M40psgAp/1vPn5zeloAjoku5ax18FM32yRi9C21J84BWCd
+vp6E7NtzJh9XlH22xOPGmbCh1r3uAtiujpXj1UNw/QEMooiEsJAeoROpvHZkh6/m
+VZUU1njrXaTMl4OUd+I+Y96eWWo539vU0dD5XnUUNuYybwI6FeVmrouHR9wG4RJL
+JQIDAQAB
+-----END PUBLIC KEY-----
+`;
+
+describe("AWS.CloudFront.KeyGroup", () => {
+  test.provider.skipIf(!runLive)(
+    "create, update items, and delete a key group",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            const primary = yield* PublicKey("PrimarySigningKey", {
+              encodedKey: PRIMARY_PUBLIC_KEY,
+              comment: "primary",
+            });
+            const secondary = yield* PublicKey("SecondarySigningKey", {
+              encodedKey: SECONDARY_PUBLIC_KEY,
+              comment: "secondary",
+            });
+            const group = yield* KeyGroup("SignedUrlKeys", {
+              comment: "initial",
+              items: [primary.publicKeyId],
+            });
+            return { primary, secondary, group };
+          }),
+        );
+
+        const initial = yield* cloudfront.getKeyGroup({
+          Id: created.group.keyGroupId,
+        });
+        expect(initial.KeyGroup?.Id).toEqual(created.group.keyGroupId);
+        expect(initial.KeyGroup?.KeyGroupConfig?.Comment).toEqual("initial");
+        expect(initial.KeyGroup?.KeyGroupConfig?.Items).toEqual([
+          created.primary.publicKeyId,
+        ]);
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            const primary = yield* PublicKey("PrimarySigningKey", {
+              encodedKey: PRIMARY_PUBLIC_KEY,
+              comment: "primary",
+            });
+            const secondary = yield* PublicKey("SecondarySigningKey", {
+              encodedKey: SECONDARY_PUBLIC_KEY,
+              comment: "secondary",
+            });
+            const group = yield* KeyGroup("SignedUrlKeys", {
+              comment: "updated",
+              items: [primary.publicKeyId, secondary.publicKeyId],
+            });
+            return { primary, secondary, group };
+          }),
+        );
+
+        expect(updated.group.keyGroupId).toEqual(created.group.keyGroupId);
+
+        const after = yield* cloudfront.getKeyGroup({
+          Id: updated.group.keyGroupId,
+        });
+        expect(after.KeyGroup?.KeyGroupConfig?.Comment).toEqual("updated");
+        expect(after.KeyGroup?.KeyGroupConfig?.Items).toEqual([
+          updated.primary.publicKeyId,
+          updated.secondary.publicKeyId,
+        ]);
+
+        yield* stack.destroy();
+        yield* assertKeyGroupDeleted(updated.group.keyGroupId);
+      }),
+    { timeout: 300_000 },
+  );
+});
+
+const assertKeyGroupDeleted = (id: string) =>
+  cloudfront.getKeyGroup({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("KeyGroupStillExists"))),
+    Effect.catchTag("NoSuchResource", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error && error.message === "KeyGroupStillExists",
+      schedule: Schedule.fixed("5 seconds").pipe(
+        Schedule.both(Schedule.recurs(24)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/OriginRequestPolicy.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/OriginRequestPolicy.test.ts
new file mode 100644
index 00000000000..ab311e984ec
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/OriginRequestPolicy.test.ts
@@ -0,0 +1,105 @@
+import * as AWS from "@/AWS";
+import { OriginRequestPolicy } from "@/AWS/CloudFront";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+describe("AWS.CloudFront.OriginRequestPolicy", () => {
+  test.provider.skipIf(!runLive)(
+    "create, update, and delete an origin request policy",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* OriginRequestPolicy("AppOriginRequest", {
+              comment: "initial",
+              headersConfig: {
+                HeaderBehavior: "whitelist",
+                Headers: { Quantity: 1, Items: ["Authorization"] },
+              },
+              cookiesConfig: { CookieBehavior: "none" },
+              queryStringsConfig: { QueryStringBehavior: "all" },
+            });
+          }),
+        );
+
+        const initial = yield* cloudfront.getOriginRequestPolicy({
+          Id: created.originRequestPolicyId,
+        });
+        expect(initial.OriginRequestPolicy?.Id).toEqual(
+          created.originRequestPolicyId,
+        );
+        expect(
+          initial.OriginRequestPolicy?.OriginRequestPolicyConfig?.Comment,
+        ).toEqual("initial");
+        expect(
+          initial.OriginRequestPolicy?.OriginRequestPolicyConfig?.HeadersConfig
+            ?.Headers?.Items,
+        ).toEqual(["Authorization"]);
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* OriginRequestPolicy("AppOriginRequest", {
+              comment: "updated",
+              headersConfig: {
+                HeaderBehavior: "whitelist",
+                Headers: {
+                  Quantity: 2,
+                  Items: ["Authorization", "Accept-Language"],
+                },
+              },
+              cookiesConfig: { CookieBehavior: "all" },
+              queryStringsConfig: { QueryStringBehavior: "all" },
+            });
+          }),
+        );
+
+        expect(updated.originRequestPolicyId).toEqual(
+          created.originRequestPolicyId,
+        );
+
+        const after = yield* cloudfront.getOriginRequestPolicy({
+          Id: updated.originRequestPolicyId,
+        });
+        expect(
+          after.OriginRequestPolicy?.OriginRequestPolicyConfig?.Comment,
+        ).toEqual("updated");
+        expect(
+          after.OriginRequestPolicy?.OriginRequestPolicyConfig?.HeadersConfig
+            ?.Headers?.Items,
+        ).toEqual(["Authorization", "Accept-Language"]);
+        expect(
+          after.OriginRequestPolicy?.OriginRequestPolicyConfig?.CookiesConfig
+            ?.CookieBehavior,
+        ).toEqual("all");
+
+        yield* stack.destroy();
+        yield* assertOriginRequestPolicyDeleted(updated.originRequestPolicyId);
+      }),
+    300_000,
+  );
+});
+
+const assertOriginRequestPolicyDeleted = (id: string) =>
+  cloudfront.getOriginRequestPolicy({ Id: id }).pipe(
+    Effect.flatMap(() =>
+      Effect.fail(new Error("OriginRequestPolicyStillExists")),
+    ),
+    Effect.catchTag("NoSuchOriginRequestPolicy", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error &&
+        error.message === "OriginRequestPolicyStillExists",
+      schedule: Schedule.fixed("5 seconds").pipe(
+        Schedule.both(Schedule.recurs(24)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/PublicKey.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/PublicKey.test.ts
new file mode 100644
index 00000000000..3423a9a8432
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/PublicKey.test.ts
@@ -0,0 +1,84 @@
+import * as AWS from "@/AWS";
+import { PublicKey } from "@/AWS/CloudFront";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+const TEST_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvTkfqkMHU8HMmIRKJaMl
+IoD691g60aS15QlaP/DVkpuoeEp8JA8YDs5vQFu6HSIYCTQ7WwFx9oRvN08i7yXB
+EHt3x7uZVpdkp6JBbjR9BGNsAVri6DZ0TJQ11zWeN3keqhnUdFhQjPwT+u4r6oKk
+kNvkl7eU2nFK+UIaPlD+rA+AlYT0m7gSVcd9KaLf/UzBrtSy1dbXYDT4dHChMUVy
+4gDsQ6D4u6lRAHY9jcKxlgEIM+O8ODKyzlbergv2EwhANG4P27DBeDhA/off3upM
+TTVTGKZeoABtqM0ZiYq0cDgf8KUn9NPxSdnJ4+cbigLjJBPS93VYWzWX0HXlZpQ3
+HQIDAQAB
+-----END PUBLIC KEY-----
+`;
+
+describe("AWS.CloudFront.PublicKey", () => {
+  test.provider.skipIf(!runLive)(
+    "create, update comment, and delete a public key",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* PublicKey("SignedUrlKey", {
+              encodedKey: TEST_PUBLIC_KEY,
+              comment: "initial",
+            });
+          }),
+        );
+
+        const initial = yield* cloudfront.getPublicKey({
+          Id: created.publicKeyId,
+        });
+        expect(initial.PublicKey?.Id).toEqual(created.publicKeyId);
+        expect(initial.PublicKey?.PublicKeyConfig?.Comment).toEqual("initial");
+        expect(initial.PublicKey?.PublicKeyConfig?.EncodedKey).toEqual(
+          TEST_PUBLIC_KEY,
+        );
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* PublicKey("SignedUrlKey", {
+              encodedKey: TEST_PUBLIC_KEY,
+              comment: "updated",
+            });
+          }),
+        );
+
+        expect(updated.publicKeyId).toEqual(created.publicKeyId);
+        expect(updated.callerReference).toEqual(created.callerReference);
+
+        const after = yield* cloudfront.getPublicKey({
+          Id: updated.publicKeyId,
+        });
+        expect(after.PublicKey?.PublicKeyConfig?.Comment).toEqual("updated");
+
+        yield* stack.destroy();
+        yield* assertPublicKeyDeleted(updated.publicKeyId);
+      }),
+    { timeout: 300_000 },
+  );
+});
+
+const assertPublicKeyDeleted = (id: string) =>
+  cloudfront.getPublicKey({ Id: id }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("PublicKeyStillExists"))),
+    Effect.catchTag("NoSuchPublicKey", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error && error.message === "PublicKeyStillExists",
+      schedule: Schedule.fixed("5 seconds").pipe(
+        Schedule.both(Schedule.recurs(24)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/ResponseHeadersPolicy.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/ResponseHeadersPolicy.test.ts
new file mode 100644
index 00000000000..46dd22c33c9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/CloudFront/ResponseHeadersPolicy.test.ts
@@ -0,0 +1,125 @@
+import * as AWS from "@/AWS";
+import { ResponseHeadersPolicy } from "@/AWS/CloudFront";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const runLive = process.env.ALCHEMY_RUN_LIVE_AWS_WEBSITE_TESTS === "true";
+
+describe("AWS.CloudFront.ResponseHeadersPolicy", () => {
+  test.provider.skipIf(!runLive)(
+    "create, update, and delete a response headers policy",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* ResponseHeadersPolicy("AppResponseHeaders", {
+              comment: "initial",
+              securityHeadersConfig: {
+                StrictTransportSecurity: {
+                  AccessControlMaxAgeSec: 31536000,
+                  IncludeSubdomains: true,
+                  Preload: true,
+                  Override: true,
+                },
+                ContentTypeOptions: { Override: true },
+                FrameOptions: { FrameOption: "DENY", Override: true },
+                ReferrerPolicy: {
+                  ReferrerPolicy: "no-referrer",
+                  Override: true,
+                },
+              },
+            });
+          }),
+        );
+
+        const initial = yield* cloudfront.getResponseHeadersPolicy({
+          Id: created.responseHeadersPolicyId,
+        });
+        expect(initial.ResponseHeadersPolicy?.Id).toEqual(
+          created.responseHeadersPolicyId,
+        );
+        expect(
+          initial.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.Comment,
+        ).toEqual("initial");
+        expect(
+          initial.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig
+            ?.SecurityHeadersConfig?.FrameOptions?.FrameOption,
+        ).toEqual("DENY");
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* ResponseHeadersPolicy("AppResponseHeaders", {
+              comment: "updated",
+              corsConfig: {
+                AccessControlAllowOrigins: {
+                  Quantity: 1,
+                  Items: ["https://app.example.com"],
+                },
+                AccessControlAllowMethods: {
+                  Quantity: 2,
+                  Items: ["GET", "OPTIONS"],
+                },
+                AccessControlAllowHeaders: {
+                  Quantity: 1,
+                  Items: ["Authorization"],
+                },
+                AccessControlAllowCredentials: false,
+                OriginOverride: true,
+              },
+              securityHeadersConfig: {
+                FrameOptions: { FrameOption: "SAMEORIGIN", Override: true },
+              },
+            });
+          }),
+        );
+
+        expect(updated.responseHeadersPolicyId).toEqual(
+          created.responseHeadersPolicyId,
+        );
+
+        const after = yield* cloudfront.getResponseHeadersPolicy({
+          Id: updated.responseHeadersPolicyId,
+        });
+        expect(
+          after.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.Comment,
+        ).toEqual("updated");
+        expect(
+          after.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig
+            ?.SecurityHeadersConfig?.FrameOptions?.FrameOption,
+        ).toEqual("SAMEORIGIN");
+        expect(
+          after.ResponseHeadersPolicy?.ResponseHeadersPolicyConfig?.CorsConfig
+            ?.AccessControlAllowOrigins?.Items,
+        ).toEqual(["https://app.example.com"]);
+
+        yield* stack.destroy();
+        yield* assertResponseHeadersPolicyDeleted(
+          updated.responseHeadersPolicyId,
+        );
+      }),
+    { timeout: 300_000 },
+  );
+});
+
+const assertResponseHeadersPolicyDeleted = (id: string) =>
+  cloudfront.getResponseHeadersPolicy({ Id: id }).pipe(
+    Effect.flatMap(() =>
+      Effect.fail(new Error("ResponseHeadersPolicyStillExists")),
+    ),
+    Effect.catchTag("NoSuchResponseHeadersPolicy", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error &&
+        error.message === "ResponseHeadersPolicyStillExists",
+      schedule: Schedule.fixed("5 seconds").pipe(
+        Schedule.both(Schedule.recurs(24)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/AttributeValue.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/AttributeValue.test.ts
new file mode 100644
index 00000000000..76ce8dc55fe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/AttributeValue.test.ts
@@ -0,0 +1,478 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  fromAttributeValue,
+  isMapSchemaType,
+  isNumberSetSchema,
+  isStringSetSchema,
+  toAttributeType,
+  toAttributeValue,
+} from "@/AWS/DynamoDB/AttributeValue";
+import type { AttributeValue } from "@distilled.cloud/aws/dynamodb";
+import * as Effect from "effect/Effect";
+import * as S from "effect/Schema";
+
+describe("toAttributeValue", () => {
+  test("undefined -> NULL false", async () => {
+    const result = await Effect.runPromise(toAttributeValue(undefined));
+    expect(result).toEqual({ NULL: false });
+  });
+
+  test("null -> NULL true", async () => {
+    const result = await Effect.runPromise(toAttributeValue(null));
+    expect(result).toEqual({ NULL: true });
+  });
+
+  test("boolean true -> BOOL", async () => {
+    const result = await Effect.runPromise(toAttributeValue(true));
+    expect(result).toEqual({ BOOL: true });
+  });
+
+  test("boolean false -> BOOL", async () => {
+    const result = await Effect.runPromise(toAttributeValue(false));
+    expect(result).toEqual({ BOOL: false });
+  });
+
+  test("string -> S", async () => {
+    const result = await Effect.runPromise(toAttributeValue("hello"));
+    expect(result).toEqual({ S: "hello" });
+  });
+
+  test("number -> N", async () => {
+    const result = await Effect.runPromise(toAttributeValue(42));
+    expect(result).toEqual({ N: "42" });
+  });
+
+  test("float number -> N", async () => {
+    const result = await Effect.runPromise(toAttributeValue(3.14));
+    expect(result).toEqual({ N: "3.14" });
+  });
+
+  test("array -> L", async () => {
+    const result = await Effect.runPromise(toAttributeValue([1, 2, 3]));
+    expect(result).toEqual({
+      L: [{ N: "1" }, { N: "2" }, { N: "3" }],
+    });
+  });
+
+  test("mixed array -> L", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue(["hello", 42, true]),
+    );
+    expect(result).toEqual({
+      L: [{ S: "hello" }, { N: "42" }, { BOOL: true }],
+    });
+  });
+
+  test("empty array -> L", async () => {
+    const result = await Effect.runPromise(toAttributeValue([]));
+    expect(result).toEqual({ L: [] });
+  });
+
+  test("object -> M", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue({ name: "Alice", age: 30 }),
+    );
+    expect(result).toEqual({
+      M: {
+        name: { S: "Alice" },
+        age: { N: "30" },
+      },
+    });
+  });
+
+  test("nested object -> M", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue({
+        user: {
+          name: "Alice",
+          details: {
+            age: 30,
+          },
+        },
+      }),
+    );
+    expect(result).toEqual({
+      M: {
+        user: {
+          M: {
+            name: { S: "Alice" },
+            details: {
+              M: {
+                age: { N: "30" },
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  test("empty object -> M", async () => {
+    const result = await Effect.runPromise(toAttributeValue({}));
+    expect(result).toEqual({ M: {} });
+  });
+
+  test("Set of strings -> SS", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue(new Set(["a", "b", "c"])),
+    );
+    expect(result).toEqual({ SS: ["a", "b", "c"] });
+  });
+
+  test("Set of numbers -> NS", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue(new Set([1, 2, 3])),
+    );
+    // NS values are returned as-is (numbers in this case)
+    expect(result.NS).toEqual(["1", "2", "3"]);
+  });
+
+  test("empty Set -> SS (empty)", async () => {
+    const result = await Effect.runPromise(toAttributeValue(new Set()));
+    expect(result).toEqual({ SS: [] });
+  });
+
+  test("Set of mixed types -> L", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue(new Set([1, "two", true])),
+    );
+    expect(result).toEqual({
+      L: [{ N: "1" }, { S: "two" }, { BOOL: true }],
+    });
+  });
+
+  test("Uint8Array -> B", async () => {
+    const uint8 = new Uint8Array([1, 2, 3, 4]);
+    const result = await Effect.runPromise(toAttributeValue(uint8));
+    expect(result).toEqual({ B: uint8 });
+  });
+
+  test("Buffer -> B", async () => {
+    const buffer = Buffer.from([1, 2, 3, 4]);
+    const result = await Effect.runPromise(toAttributeValue(buffer));
+    expect(result.B).toBeInstanceOf(Uint8Array);
+  });
+
+  test("File -> B", async () => {
+    const file = new File(["hello"], "test.txt");
+    const result = await Effect.runPromise(toAttributeValue(file));
+    expect(result.B).toBeInstanceOf(Uint8Array);
+  });
+
+  test("ArrayBuffer -> B", async () => {
+    const arrayBuffer = new ArrayBuffer(4);
+    const result = await Effect.runPromise(toAttributeValue(arrayBuffer));
+    expect(result.B).toBeInstanceOf(Uint8Array);
+  });
+
+  test("complex nested structure", async () => {
+    const result = await Effect.runPromise(
+      toAttributeValue({
+        id: "123",
+        name: "Alice",
+        age: 30,
+        active: true,
+        tags: ["developer", "typescript"],
+        metadata: {
+          created: "2023-01-01",
+          count: 42,
+        },
+        scores: new Set([100, 95, 88]),
+      }),
+    );
+    expect(result).toEqual({
+      M: {
+        id: { S: "123" },
+        name: { S: "Alice" },
+        age: { N: "30" },
+        active: { BOOL: true },
+        tags: {
+          L: [{ S: "developer" }, { S: "typescript" }],
+        },
+        metadata: {
+          M: {
+            created: { S: "2023-01-01" },
+            count: { N: "42" },
+          },
+        },
+        scores: { NS: expect.any(Array) },
+      },
+    });
+  });
+
+  test("invalid type throws error", async () => {
+    const symbol = Symbol("test");
+    const result = Effect.runPromise(
+      toAttributeValue(symbol).pipe(
+        Effect.map(() => false),
+        Effect.catchTag("InvalidAttributeValue", (error) =>
+          Effect.succeed(true),
+        ),
+      ),
+    );
+    await expect(result).resolves.toBe(true);
+  });
+});
+
+describe("fromAttributeValue", () => {
+  test("NULL true -> null", () => {
+    expect(fromAttributeValue({ NULL: true })).toBe(null);
+  });
+
+  test("BOOL -> boolean", () => {
+    expect(fromAttributeValue({ BOOL: true })).toBe(true);
+    expect(fromAttributeValue({ BOOL: false })).toBe(false);
+  });
+
+  test("S -> string", () => {
+    expect(fromAttributeValue({ S: "hello" })).toBe("hello");
+  });
+
+  test("N -> number", () => {
+    expect(fromAttributeValue({ N: "42" })).toBe(42);
+    expect(fromAttributeValue({ N: "3.14" })).toBe(3.14);
+  });
+
+  test("L -> array", () => {
+    const result = fromAttributeValue({
+      L: [{ N: "1" }, { N: "2" }, { N: "3" }],
+    });
+    expect(result).toEqual([1, 2, 3]);
+  });
+
+  test("M -> object", () => {
+    const result = fromAttributeValue({
+      M: {
+        name: { S: "Alice" },
+        age: { N: "30" },
+      },
+    });
+    expect(result).toEqual({ name: "Alice", age: 30 });
+  });
+
+  test("SS -> Set of strings", () => {
+    const result = fromAttributeValue({ SS: ["a", "b", "c"] });
+    expect(result).toEqual(new Set(["a", "b", "c"]));
+  });
+
+  test("NS -> Set of numbers", () => {
+    const result = fromAttributeValue({ NS: ["1", "2", "3"] });
+    expect(result).toEqual(new Set(["1", "2", "3"]));
+  });
+
+  test("BS -> Set of binary", () => {
+    const binary = [new Uint8Array([1, 2]), new Uint8Array([3, 4])];
+    const result = fromAttributeValue({ BS: binary });
+    expect(result).toEqual(new Set(binary));
+  });
+
+  test("nested structure", () => {
+    const result = fromAttributeValue({
+      M: {
+        id: { S: "123" },
+        name: { S: "Alice" },
+        tags: {
+          L: [{ S: "developer" }, { S: "typescript" }],
+        },
+        metadata: {
+          M: {
+            count: { N: "42" },
+          },
+        },
+      },
+    });
+    expect(result).toEqual({
+      id: "123",
+      name: "Alice",
+      tags: ["developer", "typescript"],
+      metadata: {
+        count: 42,
+      },
+    });
+  });
+
+  test("unknown attribute value throws error", () => {
+    expect(() => fromAttributeValue({} as AttributeValue)).toThrow();
+  });
+});
+
+describe("toAttributeType", () => {
+  test("String schema -> S", () => {
+    expect(toAttributeType(S.String)).toBe("S");
+  });
+
+  test("Number schema -> N", () => {
+    expect(toAttributeType(S.Number)).toBe("N");
+  });
+
+  test("Struct schema -> M", () => {
+    expect(
+      toAttributeType(
+        S.Struct({
+          name: S.String,
+          age: S.Number,
+        }),
+      ),
+    ).toBe("M");
+  });
+
+  test("Record schema -> M", () => {
+    expect(toAttributeType(S.Record(S.String, S.String))).toBe("M");
+  });
+
+  test("Map schema -> M", () => {
+    expect(toAttributeType(S.ReadonlyMap(S.String, S.String))).toBe("M");
+  });
+
+  test("Array/List schema -> L", () => {
+    expect(toAttributeType(S.Array(S.String))).toBe("L");
+  });
+
+  test("Set of strings -> SS", () => {
+    expect(toAttributeType(S.ReadonlySet(S.String))).toBe("SS");
+  });
+
+  test("Set of numbers -> NS", () => {
+    expect(toAttributeType(S.ReadonlySet(S.Number))).toBe("NS");
+  });
+
+  test("Class schema -> M", () => {
+    class User extends S.Class<User>("User")({
+      name: S.String,
+      age: S.Number,
+    }) {}
+    expect(toAttributeType(User)).toBe("M");
+  });
+
+  test("default fallback -> S", () => {
+    expect(toAttributeType(S.Boolean)).toBe("S");
+  });
+});
+
+describe("isMapSchemaType", () => {
+  test("Map schema", () => {
+    expect(isMapSchemaType(S.ReadonlyMap(S.String, S.String))).toBe(true);
+  });
+
+  test("Record schema", () => {
+    expect(isMapSchemaType(S.Record(S.String, S.String))).toBe(true);
+  });
+
+  test("Struct schema", () => {
+    expect(
+      isMapSchemaType(
+        S.Struct({
+          name: S.String,
+          age: S.Number,
+        }),
+      ),
+    ).toBe(true);
+  });
+
+  test("Class schema", () => {
+    class User extends S.Class<User>("User")({
+      name: S.String,
+      age: S.Number,
+    }) {}
+    expect(isMapSchemaType(User)).toBe(true);
+  });
+
+  test("not a map schema", () => {
+    expect(isMapSchemaType(S.String)).toBe(false);
+    expect(isMapSchemaType(S.Number)).toBe(false);
+    expect(isMapSchemaType(S.Array(S.String))).toBe(false);
+  });
+});
+
+describe("isStringSetSchema", () => {
+  test("Set of strings", () => {
+    expect(isStringSetSchema(S.ReadonlySet(S.String))).toBe(true);
+  });
+
+  test("not a string set", () => {
+    expect(isStringSetSchema(S.ReadonlySet(S.Number))).toBe(false);
+    expect(isStringSetSchema(S.String)).toBe(false);
+    expect(isStringSetSchema(S.Array(S.String))).toBe(false);
+  });
+});
+
+describe("isNumberSetSchema", () => {
+  test("Set of numbers", () => {
+    expect(isNumberSetSchema(S.ReadonlySet(S.Number))).toBe(true);
+  });
+
+  test("not a number set", () => {
+    expect(isNumberSetSchema(S.ReadonlySet(S.String))).toBe(false);
+    expect(isNumberSetSchema(S.Number)).toBe(false);
+    expect(isNumberSetSchema(S.Array(S.Number))).toBe(false);
+  });
+});
+
+describe("round-trip conversions", () => {
+  test("string", async () => {
+    const original = "hello";
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toBe(original);
+  });
+
+  test("number", async () => {
+    const original = 42;
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toBe(original);
+  });
+
+  test("boolean", async () => {
+    const original = true;
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toBe(original);
+  });
+
+  test("null", async () => {
+    const original = null;
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toBe(original);
+  });
+
+  test("array", async () => {
+    const original = [1, "two", true];
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toEqual(original);
+  });
+
+  test("object", async () => {
+    const original = { name: "Alice", age: 30, active: true };
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toEqual(original);
+  });
+
+  test("Set of strings", async () => {
+    const original = new Set(["a", "b", "c"]);
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toEqual(original);
+  });
+
+  test("complex nested structure", async () => {
+    const original = {
+      id: "123",
+      name: "Alice",
+      age: 30,
+      active: true,
+      tags: ["developer", "typescript"],
+      metadata: {
+        created: "2023-01-01",
+        count: 42,
+      },
+    };
+    const attr = await Effect.runPromise(toAttributeValue(original));
+    const result = fromAttributeValue(attr);
+    expect(result).toEqual(original);
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Bindings.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Bindings.test.ts
new file mode 100644
index 00000000000..ba21b5e6800
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Bindings.test.ts
@@ -0,0 +1,648 @@
+import * as AWS from "@/AWS";
+import * as Core from "@/Test/Core";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { describe } from "vitest";
+
+import DynamoDBTestFunctionLive, { DynamoDBTestFunction } from "./handler";
+
+const testOptions = { providers: AWS.providers() };
+const { test, beforeAll, afterAll } = Test.make(testOptions);
+const sharedStack = Core.scratchStack(testOptions, "DynamoDBBindings");
+
+// Lambda function URL cold-start (DNS, IAM propagation, init) can take
+// well over 60s on a fresh deploy under parallel-suite load — observed
+// up to ~90s when S3 throttling delays the Lambda code upload too.
+// Budget ~150s of readiness polling so we don't fail the whole suite on
+// a slow init.
+const readinessPolicy = Schedule.fixed("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(75)),
+);
+
+let baseUrl: string;
+const sourceTableId = "TestTable";
+
+describe("DynamoDB Bindings", () => {
+  beforeAll(
+    Effect.gen(function* () {
+      yield* Effect.logInfo(
+        "DynamoDB test setup: destroying previous resources",
+      );
+      yield* sharedStack.destroy();
+
+      yield* Effect.logInfo("DynamoDB test setup: deploying fixture");
+      const { functionUrl } = yield* sharedStack.deploy(
+        Effect.gen(function* () {
+          return yield* DynamoDBTestFunction;
+        }).pipe(Effect.provide(DynamoDBTestFunctionLive)),
+      );
+
+      expect(functionUrl).toBeTruthy();
+      baseUrl = functionUrl!.replace(/\/+$/, "");
+      const readinessUrl = `${baseUrl}/scan`;
+
+      yield* Effect.logInfo(
+        `DynamoDB test setup: function URL ready (${functionUrl})`,
+      );
+      yield* Effect.logInfo(
+        `DynamoDB test setup: probing readiness at ${readinessUrl} (20s budget)`,
+      );
+
+      yield* HttpClient.get(readinessUrl).pipe(
+        Effect.flatMap((response) =>
+          response.status === 200
+            ? Effect.succeed(response)
+            : Effect.fail(new Error(`Function not ready: ${response.status}`)),
+        ),
+        Effect.tap(() =>
+          Effect.logInfo("DynamoDB test setup: fixture responded successfully"),
+        ),
+        Effect.tapError((error) =>
+          Effect.logWarning(
+            `DynamoDB test setup: fixture not ready yet (${String(error)})`,
+          ),
+        ),
+        Effect.retry({ schedule: readinessPolicy }),
+      );
+    }),
+    { timeout: 240_000 },
+  );
+
+  afterAll(sharedStack.destroy(), { timeout: 60_000 });
+
+  describe("PutItem", () => {
+    test.provider("puts an item into the table", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "put-test#1", sk: "item", data: "test data" },
+          ),
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect(response).toHaveProperty("success", true);
+      }),
+    );
+  });
+
+  describe("GetItem", () => {
+    test.provider("gets an existing item from the table", (_stack) =>
+      Effect.gen(function* () {
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "get-test#1", sk: "item", data: "get test data" },
+          ),
+        );
+
+        const response = yield* HttpClient.get(
+          `${baseUrl}/get?pk=${encodeURIComponent("get-test#1")}&sk=item`,
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect(response).toHaveProperty("item");
+        expect((response as any).item.pk.S).toBe("get-test#1");
+        expect((response as any).item.sk.S).toBe("item");
+        expect((response as any).item.data.S).toBe("get test data");
+      }),
+    );
+
+    test.provider("returns undefined for non-existent item", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.get(
+          `${baseUrl}/get?pk=${encodeURIComponent("non-existent")}&sk=item`,
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect((response as any).item).toBeUndefined();
+      }),
+    );
+  });
+
+  describe("DescribeTable", () => {
+    test.provider("describes the bound table", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.get(
+          `${baseUrl}/describe-table`,
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect((response as any).table.TableName).toBeTruthy();
+        expect((response as any).table.KeySchema).toEqual([
+          { AttributeName: "pk", KeyType: "HASH" },
+          { AttributeName: "sk", KeyType: "RANGE" },
+        ]);
+      }),
+    );
+  });
+
+  describe("DescribeTimeToLive", () => {
+    test.provider("describes table ttl configuration", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.get(`${baseUrl}/describe-ttl`).pipe(
+          Effect.flatMap((r) => r.json),
+        );
+
+        expect(response).toHaveProperty("timeToLiveDescription");
+      }),
+    );
+  });
+
+  describe("BatchWriteItem", () => {
+    test.provider("writes multiple items through the bound table", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/batch-write`),
+            {
+              RequestItems: {
+                [sourceTableId]: [
+                  {
+                    PutRequest: {
+                      Item: {
+                        pk: { S: "batch-write#1" },
+                        sk: { S: "item" },
+                        data: { S: "first item" },
+                      },
+                    },
+                  },
+                  {
+                    PutRequest: {
+                      Item: {
+                        pk: { S: "batch-write#2" },
+                        sk: { S: "item" },
+                        data: { S: "second item" },
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          ),
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect(Object.keys((response as any).unprocessedItems)).toHaveLength(0);
+      }),
+    );
+  });
+
+  describe("BatchGetItem", () => {
+    test.provider("reads multiple items through the bound table", (_stack) =>
+      Effect.gen(function* () {
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/batch-write`),
+            {
+              RequestItems: {
+                [sourceTableId]: [
+                  {
+                    PutRequest: {
+                      Item: {
+                        pk: { S: "batch-get#1" },
+                        sk: { S: "item" },
+                        data: { S: "first item" },
+                      },
+                    },
+                  },
+                  {
+                    PutRequest: {
+                      Item: {
+                        pk: { S: "batch-get#2" },
+                        sk: { S: "item" },
+                        data: { S: "second item" },
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          ),
+        );
+
+        const response = yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/batch-get`),
+            {
+              RequestItems: {
+                [sourceTableId]: {
+                  Keys: [
+                    { pk: { S: "batch-get#1" }, sk: { S: "item" } },
+                    { pk: { S: "batch-get#2" }, sk: { S: "item" } },
+                  ],
+                },
+              },
+            },
+          ),
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        const items = Object.values((response as any).responses).flat();
+        expect(items).toHaveLength(2);
+      }),
+    );
+  });
+
+  describe("UpdateTimeToLive", () => {
+    test.provider("updates table ttl configuration", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/update-ttl`),
+            { attributeName: "expiresAt", enabled: true },
+          ),
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect((response as any).timeToLiveSpecification).toEqual({
+          AttributeName: "expiresAt",
+          Enabled: true,
+        });
+      }),
+    );
+  });
+
+  describe("ExecuteStatement", () => {
+    test.provider(
+      "executes a PartiQL statement against the bound table",
+      (_stack) =>
+        Effect.gen(function* () {
+          yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/put`),
+              { pk: "statement#1", sk: "item", data: "statement data" },
+            ),
+          );
+
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/execute-statement`),
+              { pk: "statement#1", sk: "item" },
+            ),
+          ).pipe(Effect.flatMap((r) => r.json));
+
+          expect((response as any).items).toHaveLength(1);
+          expect((response as any).items[0].data.S).toBe("statement data");
+        }),
+    );
+  });
+
+  describe("BatchExecuteStatement", () => {
+    test.provider(
+      "executes PartiQL statements against the bound table",
+      (_stack) =>
+        Effect.gen(function* () {
+          yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/batch-write`),
+              {
+                RequestItems: {
+                  [sourceTableId]: [
+                    {
+                      PutRequest: {
+                        Item: {
+                          pk: { S: "batch-statement#1" },
+                          sk: { S: "item" },
+                          data: { S: "first item" },
+                        },
+                      },
+                    },
+                    {
+                      PutRequest: {
+                        Item: {
+                          pk: { S: "batch-statement#2" },
+                          sk: { S: "item" },
+                          data: { S: "second item" },
+                        },
+                      },
+                    },
+                  ],
+                },
+              },
+            ),
+          );
+
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/batch-execute-statement`),
+              {
+                first: { pk: "batch-statement#1", sk: "item" },
+                second: { pk: "batch-statement#2", sk: "item" },
+              },
+            ),
+          ).pipe(Effect.flatMap((r) => r.json));
+
+          expect((response as any).responses).toHaveLength(2);
+        }),
+    );
+  });
+
+  describe("ExecuteTransaction", () => {
+    test.provider(
+      "executes a PartiQL transaction against the table",
+      (_stack) =>
+        Effect.gen(function* () {
+          yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/put`),
+              { pk: "tx#1", sk: "item1", data: "first" },
+            ),
+          );
+          yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/put`),
+              { pk: "tx#1", sk: "item2", data: "second" },
+            ),
+          );
+
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.post(`${baseUrl}/execute-transaction`),
+          ).pipe(Effect.flatMap((r) => r.json));
+
+          expect((response as any).responses).toHaveLength(2);
+        }),
+    );
+  });
+
+  describe("TransactWriteItems", () => {
+    test.provider(
+      "writes items transactionally through the bound table",
+      (_stack) =>
+        Effect.gen(function* () {
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/transact-write`),
+              {
+                TransactItems: [
+                  {
+                    Put: {
+                      Table: sourceTableId,
+                      Item: {
+                        pk: { S: "transact-write#1" },
+                        sk: { S: "item" },
+                        data: { S: "first item" },
+                      },
+                    },
+                  },
+                  {
+                    Put: {
+                      Table: sourceTableId,
+                      Item: {
+                        pk: { S: "transact-write#2" },
+                        sk: { S: "item" },
+                        data: { S: "second item" },
+                      },
+                    },
+                  },
+                ],
+              },
+            ),
+          ).pipe(Effect.flatMap((r) => r.json));
+
+          expect((response as any).success).toBe(true);
+        }),
+    );
+  });
+
+  describe("TransactGetItems", () => {
+    test.provider(
+      "reads items transactionally through the bound table",
+      (_stack) =>
+        Effect.gen(function* () {
+          yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/transact-write`),
+              {
+                TransactItems: [
+                  {
+                    Put: {
+                      Table: sourceTableId,
+                      Item: {
+                        pk: { S: "transact-get#1" },
+                        sk: { S: "item" },
+                        data: { S: "first item" },
+                      },
+                    },
+                  },
+                  {
+                    Put: {
+                      Table: sourceTableId,
+                      Item: {
+                        pk: { S: "transact-get#2" },
+                        sk: { S: "item" },
+                        data: { S: "second item" },
+                      },
+                    },
+                  },
+                ],
+              },
+            ),
+          );
+
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/transact-get`),
+              {
+                TransactItems: [
+                  {
+                    Get: {
+                      Table: sourceTableId,
+                      Key: {
+                        pk: { S: "transact-get#1" },
+                        sk: { S: "item" },
+                      },
+                    },
+                  },
+                  {
+                    Get: {
+                      Table: sourceTableId,
+                      Key: {
+                        pk: { S: "transact-get#2" },
+                        sk: { S: "item" },
+                      },
+                    },
+                  },
+                ],
+              },
+            ),
+          ).pipe(Effect.flatMap((r) => r.json));
+
+          expect((response as any).responses).toHaveLength(2);
+        }),
+    );
+  });
+
+  describe("UpdateItem", () => {
+    test.provider("updates an existing item", (_stack) =>
+      Effect.gen(function* () {
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "update-test#1", sk: "item", data: "original" },
+          ),
+        );
+
+        const response = yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/update`),
+            { pk: "update-test#1", sk: "item", data: "updated" },
+          ),
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect(response).toHaveProperty("success", true);
+        expect((response as any).attributes.data.S).toBe("updated");
+
+        const getResponse = yield* HttpClient.get(
+          `${baseUrl}/get?pk=${encodeURIComponent("update-test#1")}&sk=item`,
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect((getResponse as any).item.data.S).toBe("updated");
+      }),
+    );
+  });
+
+  describe("DeleteItem", () => {
+    test.provider("deletes an existing item", (_stack) =>
+      Effect.gen(function* () {
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "delete-test#1", sk: "item", data: "to delete" },
+          ),
+        );
+
+        const response = yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.delete(`${baseUrl}/delete`),
+            { pk: "delete-test#1", sk: "item" },
+          ),
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect(response).toHaveProperty("success", true);
+
+        const getResponse = yield* HttpClient.get(
+          `${baseUrl}/get?pk=${encodeURIComponent("delete-test#1")}&sk=item`,
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        expect((getResponse as any).item).toBeUndefined();
+      }),
+    );
+  });
+
+  describe("Query", () => {
+    test.provider("queries items by partition key", (_stack) =>
+      Effect.gen(function* () {
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "query-test#1", sk: "item1", data: "first" },
+          ),
+        );
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "query-test#1", sk: "item2", data: "second" },
+          ),
+        );
+
+        // DynamoDB Query is eventually consistent by default, so a
+        // brand-new PutItem may not appear in the immediately-following
+        // Query. Poll briefly until both items are visible.
+        const response = yield* Effect.gen(function* () {
+          const r = yield* HttpClient.get(
+            `${baseUrl}/query?pk=${encodeURIComponent("query-test#1")}`,
+          ).pipe(Effect.flatMap((r) => r.json));
+          if ((r as any).count !== 2) {
+            return yield* Effect.fail(new QueryNotConsistent());
+          }
+          return r;
+        }).pipe(
+          Effect.retry({
+            while: (e) => e._tag === "QueryNotConsistent",
+            schedule: Schedule.fixed("500 millis").pipe(
+              Schedule.both(Schedule.recurs(20)),
+            ),
+          }),
+        );
+
+        expect((response as any).count).toBe(2);
+        expect((response as any).items.length).toBe(2);
+      }),
+    );
+  });
+
+  describe("ListTables", () => {
+    test.provider("lists the deployed table", (_stack) =>
+      Effect.gen(function* () {
+        const described = yield* HttpClient.get(
+          `${baseUrl}/describe-table`,
+        ).pipe(Effect.flatMap((r) => r.json));
+
+        const response = yield* HttpClient.get(`${baseUrl}/list-tables`).pipe(
+          Effect.flatMap((r) => r.json),
+        );
+
+        expect((response as any).tableNames).toContain(
+          (described as any).table.TableName,
+        );
+      }),
+    );
+  });
+
+  describe("ListTagsOfResource", () => {
+    test.provider("lists alchemy ownership tags for the table", (_stack) =>
+      Effect.gen(function* () {
+        const response = yield* HttpClient.get(`${baseUrl}/list-tags`).pipe(
+          Effect.flatMap((r) => r.json),
+        );
+
+        const keys = ((response as any).tags ?? []).map((tag: any) => tag.Key);
+        expect(keys).toContain("alchemy::stack");
+        expect(keys).toContain("alchemy::stage");
+        expect(keys).toContain("alchemy::id");
+      }),
+    );
+  });
+
+  describe("RestoreTableToPointInTime", () => {
+    test.provider(
+      "returns a structured error when point-in-time recovery is unavailable",
+      (_stack) =>
+        Effect.gen(function* () {
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}/restore-table`),
+              {},
+            ),
+          ).pipe(Effect.flatMap((r) => r.json));
+
+          expect((response as any).ok).toBe(false);
+          expect([
+            "PointInTimeRecoveryUnavailableException",
+            "TableAlreadyExistsException",
+          ]).toContain((response as any).error);
+        }),
+    );
+  });
+
+  describe("Scan", () => {
+    test.provider("scans all items in the table", (_stack) =>
+      Effect.gen(function* () {
+        yield* HttpClient.execute(
+          HttpClientRequest.bodyJsonUnsafe(
+            HttpClientRequest.post(`${baseUrl}/put`),
+            { pk: "scan-test#1", sk: "item", data: "scan data" },
+          ),
+        );
+
+        const response = yield* HttpClient.get(`${baseUrl}/scan`).pipe(
+          Effect.flatMap((r) => r.json),
+        );
+
+        expect((response as any).count).toBeGreaterThanOrEqual(1);
+        expect((response as any).items.length).toBeGreaterThanOrEqual(1);
+      }),
+    );
+  });
+});
+
+class QueryNotConsistent extends Data.TaggedError("QueryNotConsistent") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Stream.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Stream.test.ts
new file mode 100644
index 00000000000..9fd72dcf716
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Stream.test.ts
@@ -0,0 +1,192 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import * as SQS from "@distilled.cloud/aws/sqs";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import DynamoDBStreamFunctionLive, {
+  DynamoDBStreamFunction,
+  TableAndQueue,
+} from "./stream-handler.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe.sequential("AWS.DynamoDB.Stream", () => {
+  test.provider(
+    "processes real DynamoDB stream records through Lambda",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.logInfo(
+          "DynamoDB Stream test: destroying previous resources",
+        );
+        yield* stack.destroy();
+
+        yield* Effect.logInfo("DynamoDB Stream test: deploying stream fixture");
+        const { table, queue, streamFunction } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const { table, queue } = yield* TableAndQueue;
+
+            const func = yield* DynamoDBStreamFunction;
+
+            return { table, queue, streamFunction: func };
+          }).pipe(Effect.provide(DynamoDBStreamFunctionLive)),
+        );
+
+        const streamState = yield* waitForTableStreamSpecification(
+          table.tableName,
+          {
+            StreamEnabled: true,
+            StreamViewType: "NEW_AND_OLD_IMAGES",
+          },
+        );
+        expect(streamState.Table?.StreamSpecification).toEqual({
+          StreamEnabled: true,
+          StreamViewType: "NEW_AND_OLD_IMAGES",
+        });
+        expect(streamState.Table?.LatestStreamArn).toBeDefined();
+
+        yield* waitForEventSourceMappingEnabled(
+          streamFunction.functionName,
+          streamState.Table?.LatestStreamArn!,
+        );
+
+        yield* Effect.logInfo(
+          `DynamoDB Stream test: writing item into ${table.tableName}`,
+        );
+        yield* DynamoDB.putItem({
+          TableName: table.tableName,
+          Item: {
+            pk: { S: "stream#1" },
+            sk: { S: "item#1" },
+            data: { S: "payload" },
+          },
+        });
+
+        const message = yield* waitForQueueMessage(queue.queueUrl);
+        const body = JSON.parse(message.Body!);
+
+        expect(body.eventName).toEqual("INSERT");
+        expect(body.keys.pk.S).toEqual("stream#1");
+        expect(body.keys.sk.S).toEqual("item#1");
+        expect(body.newImage.data.S).toEqual("payload");
+        expect(body.oldImage).toBeUndefined();
+
+        yield* Effect.logInfo("DynamoDB Stream test: destroying fixture");
+        yield* stack.destroy();
+      }),
+    { timeout: 600_000 },
+  );
+});
+
+const waitForEventSourceMappingEnabled = Effect.fn(function* (
+  functionName: string,
+  eventSourceArn: string,
+) {
+  yield* Effect.logInfo(
+    `DynamoDB Stream test: waiting for Lambda event source mapping on ${functionName}`,
+  );
+
+  return yield* Lambda.listEventSourceMappings({
+    FunctionName: functionName,
+    EventSourceArn: eventSourceArn,
+  }).pipe(
+    Effect.flatMap((result) => {
+      const mapping = result.EventSourceMappings?.[0];
+      if (!mapping || mapping.State !== "Enabled") {
+        return Effect.logInfo(
+          `DynamoDB Stream test: event source mapping not ready yet. state=${mapping?.State ?? "missing"}`,
+        ).pipe(Effect.andThen(Effect.fail(new EventSourceMappingNotReady())));
+      }
+      return Effect.logInfo(
+        `DynamoDB Stream test: event source mapping ready (${mapping.UUID})`,
+      ).pipe(Effect.andThen(Effect.succeed(mapping)));
+    }),
+    Effect.retry({
+      while: (error) => error._tag === "EventSourceMappingNotReady",
+      schedule: Schedule.fixed("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+});
+
+const waitForTableStreamSpecification = Effect.fn(function* (
+  tableName: string,
+  expected: DynamoDB.StreamSpecification,
+) {
+  yield* Effect.logInfo(
+    `DynamoDB Stream test: waiting for stream configuration on ${tableName}`,
+  );
+
+  return yield* DynamoDB.describeTable({
+    TableName: tableName,
+  }).pipe(
+    Effect.flatMap((result) => {
+      const actual = result.Table?.StreamSpecification;
+      if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        return Effect.logInfo(
+          `DynamoDB Stream test: stream configuration not ready yet. actual=${JSON.stringify(actual)} expected=${JSON.stringify(expected)}`,
+        ).pipe(
+          Effect.andThen(Effect.fail(new TableStreamConfigurationNotReady())),
+        );
+      }
+      return Effect.logInfo(
+        `DynamoDB Stream test: stream configuration ready on ${tableName}`,
+      ).pipe(Effect.andThen(Effect.succeed(result)));
+    }),
+    Effect.retry({
+      while: (error) => error._tag === "TableStreamConfigurationNotReady",
+      schedule: Schedule.fixed("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+});
+
+const waitForQueueMessage = Effect.fn(function* (queueUrl: string) {
+  yield* Effect.logInfo(
+    `DynamoDB Stream test: waiting for stream output message on ${queueUrl}`,
+  );
+
+  // Even after the EventSourceMapping reports `Enabled`, AWS needs a cold-
+  // start window (typically 30–90s for the first record) before the Lambda
+  // is reliably invoked from a freshly-provisioned DynamoDB Stream shard.
+  // Use SQS long-polling (WaitTimeSeconds=20) and budget ~3 minutes so this
+  // is robust on first-deploy runs without slowing down the happy path.
+  return yield* SQS.receiveMessage({
+    QueueUrl: queueUrl,
+    MaxNumberOfMessages: 1,
+    WaitTimeSeconds: 20,
+  }).pipe(
+    Effect.flatMap((result) => {
+      const message = result.Messages?.[0];
+      if (!message?.Body) {
+        return Effect.logInfo(
+          "DynamoDB Stream test: stream output queue is still empty",
+        ).pipe(Effect.andThen(Effect.fail(new StreamMessageNotReady())));
+      }
+      return Effect.logInfo(
+        `DynamoDB Stream test: received stream output message ${message.MessageId}`,
+      ).pipe(Effect.andThen(Effect.succeed(message)));
+    }),
+    Effect.retry({
+      while: (error) => error._tag === "StreamMessageNotReady",
+      schedule: Schedule.fixed("5 seconds").pipe(
+        Schedule.both(Schedule.recurs(72)), // 72 * (5s sleep + up to 20s poll) ~= 6min budget
+      ),
+    }),
+  );
+});
+
+class EventSourceMappingNotReady extends Data.TaggedError(
+  "EventSourceMappingNotReady",
+) {}
+
+class TableStreamConfigurationNotReady extends Data.TaggedError(
+  "TableStreamConfigurationNotReady",
+) {}
+
+class StreamMessageNotReady extends Data.TaggedError("StreamMessageNotReady") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Table.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Table.test.ts
new file mode 100644
index 00000000000..f7926565b5a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/Table.test.ts
@@ -0,0 +1,881 @@
+import { adopt } from "@/AdoptPolicy";
+import * as AWS from "@/AWS";
+import { Table } from "@/AWS/DynamoDB";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as DynamoDB from "@distilled.cloud/aws/dynamodb";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.DynamoDB.Table", () => {
+  const longGlobalSecondaryIndexStabilization = Schedule.fixed(
+    "10 seconds",
+  ).pipe(Schedule.both(Schedule.recurs(180)));
+
+  test.provider("create, update, delete table", (stack) =>
+    Effect.gen(function* () {
+      yield* logTestStep("starting create/update/delete table");
+      yield* stack.destroy();
+
+      yield* logTestStep("deploying base table");
+      const table = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Table("TestTable", {
+            partitionKey: "id",
+            attributes: { id: "S" },
+          });
+        }),
+      );
+
+      const actualTable = yield* DynamoDB.describeTable({
+        TableName: table.tableName,
+      });
+      expect(actualTable.Table?.TableArn).toEqual(table.tableArn);
+
+      yield* logTestStep("destroying base table");
+      yield* stack.destroy();
+
+      yield* assertTableIsDeleted(table.tableName);
+    }),
+  );
+
+  test.provider(
+    "create, update, and disable table stream configuration through bindings",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* logTestStep("starting stream configuration test");
+        yield* stack.destroy();
+
+        yield* logTestStep("deploying table with binding-owned stream");
+        const table = yield* stack.deploy(
+          Effect.gen(function* () {
+            const table = yield* Table("StreamTable", {
+              partitionKey: "id",
+              attributes: { id: "S" },
+            });
+            yield* table.bind("TestTableStreamBinding", {
+              streamSpecification: {
+                StreamEnabled: true,
+                StreamViewType: "NEW_AND_OLD_IMAGES",
+              },
+            });
+            return table;
+          }),
+        );
+
+        const created = yield* waitForTableStreamSpecification(
+          table.tableName,
+          {
+            StreamEnabled: true,
+            StreamViewType: "NEW_AND_OLD_IMAGES",
+          },
+        );
+        expect(created.Table?.StreamSpecification).toEqual({
+          StreamEnabled: true,
+          StreamViewType: "NEW_AND_OLD_IMAGES",
+        });
+        expect(created.Table?.LatestStreamArn).toBeDefined();
+
+        yield* logTestStep("updating stream view type to KEYS_ONLY");
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const table = yield* Table("StreamTable", {
+              partitionKey: "id",
+              attributes: { id: "S" },
+            });
+            yield* table.bind("TestTableStreamBinding", {
+              streamSpecification: {
+                StreamEnabled: true,
+                StreamViewType: "KEYS_ONLY",
+              },
+            });
+            return table;
+          }),
+        );
+
+        const updated = yield* waitForTableStreamSpecification(
+          table.tableName,
+          {
+            StreamEnabled: true,
+            StreamViewType: "KEYS_ONLY",
+          },
+        );
+        expect(updated.Table?.StreamSpecification).toEqual({
+          StreamEnabled: true,
+          StreamViewType: "KEYS_ONLY",
+        });
+
+        yield* logTestStep("removing stream binding");
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("StreamTable", {
+              partitionKey: "id",
+              attributes: { id: "S" },
+            });
+          }),
+        );
+
+        const disabled = yield* waitForTableStreamSpecification(
+          table.tableName,
+          undefined,
+        );
+        expect(disabled.Table?.StreamSpecification).toBeUndefined();
+
+        yield* logTestStep("destroying stream table");
+        yield* stack.destroy();
+
+        yield* assertTableIsDeleted(table.tableName);
+      }),
+  );
+
+  test.provider(
+    "create and update table tags and point-in-time recovery",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* logTestStep("starting tags and point-in-time recovery test");
+        yield* stack.destroy();
+
+        yield* logTestStep("deploying tagged table with PITR enabled");
+        const table = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("TaggedTable", {
+              partitionKey: "id",
+              attributes: { id: "S" },
+              tags: { Environment: "test" },
+              pointInTimeRecoverySpecification: {
+                PointInTimeRecoveryEnabled: true,
+                RecoveryPeriodInDays: 7,
+              },
+            });
+          }),
+        );
+
+        const createdTags = yield* waitForTableTags(table.tableArn, {
+          Environment: "test",
+        });
+        expect(createdTags["Environment"]).toEqual("test");
+        expect(table.tags?.["Environment"]).toEqual("test");
+
+        const createdBackups = yield* waitForPointInTimeRecovery(
+          table.tableName,
+          true,
+        );
+        expect(
+          createdBackups.PointInTimeRecoveryDescription
+            ?.PointInTimeRecoveryStatus,
+        ).toEqual("ENABLED");
+        expect(
+          createdBackups.PointInTimeRecoveryDescription?.RecoveryPeriodInDays,
+        ).toEqual(7);
+
+        yield* logTestStep("updating tags and disabling PITR");
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("TaggedTable", {
+              partitionKey: "id",
+              attributes: { id: "S" },
+              tags: { Environment: "prod", Team: "platform" },
+              pointInTimeRecoverySpecification: {
+                PointInTimeRecoveryEnabled: false,
+              },
+            });
+          }),
+        );
+
+        const updatedTags = yield* waitForTableTags(updated.tableArn, {
+          Environment: "prod",
+          Team: "platform",
+        });
+        expect(updatedTags["Environment"]).toEqual("prod");
+        expect(updatedTags["Team"]).toEqual("platform");
+        expect(updated.tags?.["Environment"]).toEqual("prod");
+        expect(updated.tags?.["Team"]).toEqual("platform");
+
+        const updatedBackups = yield* waitForPointInTimeRecovery(
+          updated.tableName,
+          false,
+        );
+        expect(
+          updatedBackups.PointInTimeRecoveryDescription
+            ?.PointInTimeRecoveryStatus,
+        ).toEqual("DISABLED");
+
+        yield* logTestStep("destroying tagged table");
+        yield* stack.destroy();
+
+        yield* assertTableIsDeleted(table.tableName);
+      }),
+    { timeout: 240_000 },
+  );
+
+  test.provider(
+    "create table with folded local and global secondary indexes",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* logTestStep("starting folded index create test");
+        yield* stack.destroy();
+
+        yield* logTestStep("deploying table with LSI and GSI");
+        const table = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("IndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+                gsi1pk: "S",
+              },
+              localSecondaryIndexes: [
+                {
+                  IndexName: "lsi-by-sk",
+                  KeySchema: [
+                    { AttributeName: "pk", KeyType: "HASH" },
+                    { AttributeName: "sk", KeyType: "RANGE" },
+                  ],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+              ],
+              globalSecondaryIndexes: [
+                {
+                  IndexName: "gsi-by-lookup",
+                  KeySchema: [{ AttributeName: "gsi1pk", KeyType: "HASH" }],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+              ],
+            });
+          }),
+        );
+
+        const actualTable = yield* Effect.gen(function* () {
+          const current = yield* DynamoDB.describeTable({
+            TableName: table.tableName,
+          });
+          if (
+            current.Table?.GlobalSecondaryIndexes?.some(
+              (index) => index.IndexStatus !== "ACTIVE",
+            )
+          ) {
+            return yield* Effect.fail(new GlobalSecondaryIndexNotActive());
+          }
+          return current.Table;
+        }).pipe(
+          Effect.retry({
+            while: (error) => error._tag === "GlobalSecondaryIndexNotActive",
+            schedule: Schedule.fixed("2 seconds").pipe(
+              Schedule.both(Schedule.recurs(30)),
+            ),
+          }),
+        );
+
+        expect(
+          actualTable?.LocalSecondaryIndexes?.map((index) => index.IndexName),
+        ).toContain("lsi-by-sk");
+        expect(
+          actualTable?.GlobalSecondaryIndexes?.map((index) => index.IndexName),
+        ).toContain("gsi-by-lookup");
+        expect(
+          table.localSecondaryIndexes?.map((index) => index.IndexName),
+        ).toContain("lsi-by-sk");
+        expect(
+          table.globalSecondaryIndexes?.map((index) => index.IndexName),
+        ).toContain("gsi-by-lookup");
+
+        yield* logTestStep("destroying indexed table");
+        yield* stack.destroy();
+
+        yield* assertTableIsDeleted(table.tableName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  // it's super slow because GSIs are awfully slow to create
+  test.provider.skip(
+    "update global secondary indexes across multiple deploys",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* logTestStep(
+          "starting multi-stage global secondary index update test",
+        );
+        yield* stack.destroy();
+
+        yield* logTestStep("deploying table without GSIs");
+        const table = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("UpdatingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+              },
+            });
+          }),
+        );
+
+        yield* expectTableIndexes(table.tableName, {
+          local: [],
+          global: [],
+        });
+
+        yield* logTestStep("adding first GSI");
+        const oneAdded = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("UpdatingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+                gsi1pk: "S",
+              },
+              globalSecondaryIndexes: [
+                {
+                  IndexName: "gsi-by-lookup-1",
+                  KeySchema: [{ AttributeName: "gsi1pk", KeyType: "HASH" }],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+              ],
+            });
+          }),
+        );
+        expect(oneAdded.tableName).toEqual(table.tableName);
+        yield* expectTableIndexes(oneAdded.tableName, {
+          local: [],
+          global: ["gsi-by-lookup-1"],
+        });
+
+        yield* logTestStep("removing first GSI");
+        const oneRemoved = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("UpdatingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+                gsi1pk: "S",
+                gsi2pk: "S",
+              },
+            });
+          }),
+        );
+        expect(oneRemoved.tableName).toEqual(table.tableName);
+        yield* expectTableIndexes(oneRemoved.tableName, {
+          local: [],
+          global: [],
+        });
+
+        yield* logTestStep("adding two GSIs sequentially through one deploy");
+        const twoAdded = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("UpdatingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+                gsi1pk: "S",
+                gsi2pk: "S",
+              },
+              globalSecondaryIndexes: [
+                {
+                  IndexName: "gsi-by-lookup-1",
+                  KeySchema: [{ AttributeName: "gsi1pk", KeyType: "HASH" }],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+                {
+                  IndexName: "gsi-by-lookup-2",
+                  KeySchema: [{ AttributeName: "gsi2pk", KeyType: "HASH" }],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+              ],
+            });
+          }),
+        );
+        expect(twoAdded.tableName).toEqual(table.tableName);
+        yield* expectTableIndexes(twoAdded.tableName, {
+          local: [],
+          global: ["gsi-by-lookup-1", "gsi-by-lookup-2"],
+        });
+
+        yield* logTestStep("removing one of two GSIs");
+        const oneOfTwoRemoved = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("UpdatingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+                gsi1pk: "S",
+                gsi2pk: "S",
+              },
+              globalSecondaryIndexes: [
+                {
+                  IndexName: "gsi-by-lookup-2",
+                  KeySchema: [{ AttributeName: "gsi2pk", KeyType: "HASH" }],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+              ],
+            });
+          }),
+        );
+        expect(oneOfTwoRemoved.tableName).toEqual(table.tableName);
+        yield* expectTableIndexes(oneOfTwoRemoved.tableName, {
+          local: [],
+          global: ["gsi-by-lookup-2"],
+        });
+
+        yield* logTestStep("removing remaining GSI");
+        const twoRemoved = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("UpdatingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+                gsi1pk: "S",
+                gsi2pk: "S",
+              },
+            });
+          }),
+        );
+        expect(twoRemoved.tableName).toEqual(table.tableName);
+        yield* expectTableIndexes(twoRemoved.tableName, {
+          local: [],
+          global: [],
+        });
+
+        yield* logTestStep("destroying GSI update test table");
+        yield* stack.destroy();
+
+        yield* assertTableIsDeleted(table.tableName);
+      }),
+    { timeout: 2_400_000 },
+  );
+
+  test.provider(
+    "changing local secondary indexes replaces the table",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* logTestStep("starting local secondary index replacement test");
+        yield* stack.destroy();
+
+        yield* logTestStep("deploying baseline table without LSIs");
+        const original = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("ReplacingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+              },
+            });
+          }),
+        );
+
+        yield* expectTableIndexes(original.tableName, {
+          local: [],
+          global: [],
+        });
+
+        yield* logTestStep("deploying replacement with LSI");
+        const withLsi = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("ReplacingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+              },
+              localSecondaryIndexes: [
+                {
+                  IndexName: "lsi-by-sk",
+                  KeySchema: [
+                    { AttributeName: "pk", KeyType: "HASH" },
+                    { AttributeName: "sk", KeyType: "RANGE" },
+                  ],
+                  Projection: {
+                    ProjectionType: "ALL",
+                  },
+                },
+              ],
+            });
+          }),
+        );
+
+        expect(withLsi.tableName).not.toEqual(original.tableName);
+        yield* assertTableIsDeleted(original.tableName);
+        yield* expectTableIndexes(withLsi.tableName, {
+          local: ["lsi-by-sk"],
+          global: [],
+        });
+
+        yield* logTestStep("deploying replacement without LSI again");
+        const withoutLsiAgain = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("ReplacingIndexedTable", {
+              partitionKey: "pk",
+              sortKey: "sk",
+              attributes: {
+                pk: "S",
+                sk: "S",
+              },
+            });
+          }),
+        );
+
+        expect(withoutLsiAgain.tableName).not.toEqual(withLsi.tableName);
+        yield* assertTableIsDeleted(withLsi.tableName);
+        yield* expectTableIndexes(withoutLsiAgain.tableName, {
+          local: [],
+          global: [],
+        });
+
+        yield* logTestStep("destroying replacement test table");
+        yield* stack.destroy();
+
+        yield* assertTableIsDeleted(withoutLsiAgain.tableName);
+      }),
+    { timeout: 240_000 },
+  );
+
+  // Engine-level adoption: a table tagged with this stack/stage/id is
+  // silently adopted on a fresh state store; a table tagged with a
+  // different logical id is rejected unless `adopt(true)` is supplied.
+  // Longer timeouts because DynamoDB table create/delete each take ~30s.
+  test.provider(
+    "owned table (matching alchemy tags) is silently adopted without --adopt",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const tableName = `alchemy-test-ddb-adopt-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        // Phase 1: deploy normally; alchemy stamps internal tags.
+        const initial = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("AdoptableTable", {
+              tableName,
+              partitionKey: "id",
+              attributes: { id: "S" },
+            });
+          }),
+        );
+        expect(initial.tableName).toEqual(tableName);
+
+        // Phase 2: wipe local state — the table stays in DynamoDB.
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "AdoptableTable",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        // Phase 3: redeploy without `adopt(true)`. Read sees alchemy tags
+        // matching this stack/stage/id and returns plain attrs — silent
+        // adoption.
+        const adopted = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("AdoptableTable", {
+              tableName,
+              partitionKey: "id",
+              attributes: { id: "S" },
+            });
+          }),
+        );
+
+        expect(adopted.tableArn).toEqual(initial.tableArn);
+
+        yield* stack.destroy();
+        yield* assertTableIsDeleted(tableName);
+      }),
+    { timeout: 360_000 },
+  );
+
+  test.provider(
+    "foreign-tagged table requires adopt(true) to take over",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const tableName = `alchemy-test-ddb-takeover-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        // Phase 1: deploy under "Original" — table tagged
+        // alchemy::id=Original.
+        const original = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Table("Original", {
+              tableName,
+              partitionKey: "id",
+              attributes: { id: "S" },
+            });
+          }),
+        );
+        expect(original.tableName).toEqual(tableName);
+
+        // Wipe state for "Original"; table stays in DynamoDB.
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "Original",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        // Phase 2: redeploy under "Different" with `adopt(true)`. Read
+        // returns Unowned(attrs) because the table's tags identify a
+        // different logical id; with adopt enabled the engine takes over
+        // and the update rewrites tags.
+        const takenOver = yield* stack
+          .deploy(
+            Effect.gen(function* () {
+              return yield* Table("Different", {
+                tableName,
+                partitionKey: "id",
+                attributes: { id: "S" },
+              });
+            }),
+          )
+          .pipe(adopt(true));
+
+        expect(takenOver.tableName).toEqual(tableName);
+
+        // After the update the tags should now identify this stack/stage/id.
+        // The takeover update reads tags back from the cloud after writing,
+        // so `takenOver.tags` already reflects the rewritten tag set.
+        expect(takenOver.tags?.["alchemy::id"]).toEqual("Different");
+
+        yield* stack.destroy();
+        yield* assertTableIsDeleted(tableName);
+      }),
+    { timeout: 360_000 },
+  );
+
+  const assertTableIsDeleted = Effect.fn(function* (tableName: string) {
+    yield* Effect.logInfo(
+      `DynamoDB Table test: waiting for deletion of ${tableName}`,
+    );
+    yield* DynamoDB.describeTable({
+      TableName: tableName,
+    }).pipe(
+      Effect.flatMap(() => Effect.fail(new TableStillExists())),
+      Effect.retry({
+        while: (e) => e._tag === "TableStillExists",
+        schedule: Schedule.fixed("1 second").pipe(
+          Schedule.both(Schedule.recurs(30)),
+        ),
+      }),
+      Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+    );
+    yield* Effect.logInfo(
+      `DynamoDB Table test: confirmed deleted ${tableName}`,
+    );
+  });
+
+  const waitForTableTags = Effect.fn(function* (
+    tableArn: string,
+    expected: Record<string, string>,
+  ) {
+    yield* Effect.logInfo(
+      `DynamoDB Table test: waiting for tags on ${tableArn} -> ${JSON.stringify(expected)}`,
+    );
+    return yield* DynamoDB.listTagsOfResource({
+      ResourceArn: tableArn,
+    }).pipe(
+      Effect.flatMap((result) => {
+        const tags = Object.fromEntries(
+          (result.Tags ?? []).map((tag) => [tag.Key!, tag.Value!]),
+        ) as Record<string, string>;
+        const matches = Object.entries(expected).every(
+          ([key, value]) => tags[key] === value,
+        );
+        if (!matches) {
+          return Effect.logInfo(
+            `DynamoDB Table test: tags not ready on ${tableArn}. expected=${JSON.stringify(expected)} actual=${JSON.stringify(tags)}`,
+          ).pipe(Effect.andThen(Effect.fail(new TableTagsNotUpdated())));
+        }
+        return Effect.logInfo(
+          `DynamoDB Table test: tags ready on ${tableArn} -> ${JSON.stringify(tags)}`,
+        ).pipe(Effect.andThen(Effect.succeed(tags)));
+      }),
+      Effect.retry({
+        while: (error) => error._tag === "TableTagsNotUpdated",
+        schedule: Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(15)),
+        ),
+      }),
+    );
+  });
+
+  const waitForPointInTimeRecovery = Effect.fn(function* (
+    tableName: string,
+    enabled: boolean,
+  ) {
+    yield* Effect.logInfo(
+      `DynamoDB Table test: waiting for PITR on ${tableName} -> ${enabled ? "ENABLED" : "DISABLED"}`,
+    );
+    return yield* DynamoDB.describeContinuousBackups({
+      TableName: tableName,
+    }).pipe(
+      Effect.flatMap((result) => {
+        const status =
+          result.ContinuousBackupsDescription?.PointInTimeRecoveryDescription
+            ?.PointInTimeRecoveryStatus;
+        if (
+          (enabled && status !== "ENABLED") ||
+          (!enabled && status !== "DISABLED")
+        ) {
+          return Effect.logInfo(
+            `DynamoDB Table test: PITR not ready on ${tableName}. current=${status ?? "undefined"}`,
+          ).pipe(
+            Effect.andThen(Effect.fail(new PointInTimeRecoveryNotUpdated())),
+          );
+        }
+        if (!result.ContinuousBackupsDescription) {
+          return Effect.fail(new PointInTimeRecoveryNotUpdated());
+        }
+        return Effect.logInfo(
+          `DynamoDB Table test: PITR ready on ${tableName} -> ${status}`,
+        ).pipe(
+          Effect.andThen(Effect.succeed(result.ContinuousBackupsDescription)),
+        );
+      }),
+      Effect.retry({
+        while: (error) => error._tag === "PointInTimeRecoveryNotUpdated",
+        schedule: Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(15)),
+        ),
+      }),
+    );
+  });
+
+  const waitForTableStreamSpecification = Effect.fn(function* (
+    tableName: string,
+    expected: DynamoDB.StreamSpecification | undefined,
+  ) {
+    yield* Effect.logInfo(
+      `DynamoDB Table test: waiting for stream configuration on ${tableName} -> ${JSON.stringify(expected)}`,
+    );
+    return yield* DynamoDB.describeTable({
+      TableName: tableName,
+    }).pipe(
+      Effect.flatMap((result) => {
+        const actual = result.Table?.StreamSpecification;
+        const matches =
+          JSON.stringify(actual ?? undefined) === JSON.stringify(expected);
+        if (!matches) {
+          return Effect.logInfo(
+            `DynamoDB Table test: stream configuration not ready on ${tableName}. actual=${JSON.stringify(actual)} expected=${JSON.stringify(expected)}`,
+          ).pipe(Effect.andThen(Effect.fail(new StreamSpecNotUpdated())));
+        }
+        return Effect.logInfo(
+          `DynamoDB Table test: stream configuration ready on ${tableName} -> ${JSON.stringify(actual)}`,
+        ).pipe(Effect.andThen(Effect.succeed(result)));
+      }),
+      Effect.retry({
+        while: (error) => error._tag === "StreamSpecNotUpdated",
+        schedule: Schedule.fixed("2 seconds").pipe(
+          Schedule.both(Schedule.recurs(20)),
+        ),
+      }),
+    );
+  });
+
+  const expectTableIndexes = Effect.fn(function* (
+    tableName: string,
+    expected: {
+      local: string[];
+      global: string[];
+    },
+  ) {
+    const expectedLocal = [...expected.local].sort();
+    const expectedGlobal = [...expected.global].sort();
+    yield* Effect.logInfo(
+      `DynamoDB Table test: waiting for indexes on ${tableName}. expectedLocal=${JSON.stringify(expectedLocal)} expectedGlobal=${JSON.stringify(expectedGlobal)}`,
+    );
+
+    return yield* DynamoDB.describeTable({
+      TableName: tableName,
+    }).pipe(
+      Effect.flatMap((result) => {
+        const table = result.Table;
+        const actualLocal = [...(table?.LocalSecondaryIndexes ?? [])]
+          .map((index) => index.IndexName!)
+          .sort();
+        const actualGlobal = [...(table?.GlobalSecondaryIndexes ?? [])]
+          .map((index) => index.IndexName!)
+          .sort();
+        const allGlobalActive = (table?.GlobalSecondaryIndexes ?? []).every(
+          (index) => index.IndexStatus === "ACTIVE",
+        );
+
+        if (
+          JSON.stringify(actualLocal) !== JSON.stringify(expectedLocal) ||
+          JSON.stringify(actualGlobal) !== JSON.stringify(expectedGlobal) ||
+          !allGlobalActive
+        ) {
+          return Effect.logInfo(
+            `DynamoDB Table test: indexes not ready on ${tableName}. tableStatus=${table?.TableStatus ?? "undefined"} actualLocal=${JSON.stringify(actualLocal)} actualGlobal=${JSON.stringify(actualGlobal)} globalStatuses=${JSON.stringify((table?.GlobalSecondaryIndexes ?? []).map((index) => ({ name: index.IndexName, status: index.IndexStatus })))}`,
+          ).pipe(Effect.andThen(Effect.fail(new TableIndexesNotUpdated())));
+        }
+
+        return Effect.logInfo(
+          `DynamoDB Table test: indexes ready on ${tableName}. actualLocal=${JSON.stringify(actualLocal)} actualGlobal=${JSON.stringify(actualGlobal)}`,
+        ).pipe(Effect.andThen(Effect.succeed(table)));
+      }),
+      Effect.retry({
+        while: (error) => error._tag === "TableIndexesNotUpdated",
+        schedule: longGlobalSecondaryIndexStabilization,
+      }),
+    );
+  });
+
+  const logTestStep = (message: string) =>
+    Effect.logInfo(`DynamoDB Table test: ${message}`);
+
+  class TableStillExists extends Data.TaggedError("TableStillExists") {}
+
+  class StreamSpecNotUpdated extends Data.TaggedError("StreamSpecNotUpdated") {}
+
+  class TableTagsNotUpdated extends Data.TaggedError("TableTagsNotUpdated") {}
+
+  class PointInTimeRecoveryNotUpdated extends Data.TaggedError(
+    "PointInTimeRecoveryNotUpdated",
+  ) {}
+
+  class GlobalSecondaryIndexNotActive extends Data.TaggedError(
+    "GlobalSecondaryIndexNotActive",
+  ) {}
+
+  class TableIndexesNotUpdated extends Data.TaggedError(
+    "TableIndexesNotUpdated",
+  ) {}
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/handler.ts
new file mode 100644
index 00000000000..29e96cde4da
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/handler.ts
@@ -0,0 +1,361 @@
+import * as DynamoDB from "@/AWS/DynamoDB";
+import * as Lambda from "@/AWS/Lambda";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import path from "pathe";
+
+const main = path.resolve(import.meta.dirname, "handler.ts");
+
+export class DynamoDBTestFunction extends Lambda.Function<Lambda.Function>()(
+  "DynamoDBTestFunction",
+  {
+    main,
+    url: true,
+  },
+) {}
+
+export default DynamoDBTestFunction.make(
+  Effect.gen(function* () {
+    const sourceTable = yield* DynamoDB.Table("TestTable", {
+      partitionKey: "pk",
+      sortKey: "sk",
+      attributes: { pk: "S", sk: "S" },
+    });
+    const restoreTargetTable = yield* DynamoDB.Table("RestoreTargetTable", {
+      partitionKey: "pk",
+      sortKey: "sk",
+      attributes: { pk: "S", sk: "S" },
+    });
+
+    const getItem = yield* DynamoDB.GetItem.bind(sourceTable);
+    const batchGetItem = yield* DynamoDB.BatchGetItem.bind(sourceTable);
+    const batchWriteItem = yield* DynamoDB.BatchWriteItem.bind(sourceTable);
+    const batchExecuteStatement =
+      yield* DynamoDB.BatchExecuteStatement.bind(sourceTable);
+    const describeTable = yield* DynamoDB.DescribeTable.bind(sourceTable);
+    const describeTimeToLive =
+      yield* DynamoDB.DescribeTimeToLive.bind(sourceTable);
+    const executeStatement = yield* DynamoDB.ExecuteStatement.bind(sourceTable);
+    const executeTransaction =
+      yield* DynamoDB.ExecuteTransaction.bind(sourceTable);
+    const putItem = yield* DynamoDB.PutItem.bind(sourceTable);
+    const deleteItem = yield* DynamoDB.DeleteItem.bind(sourceTable);
+    const listTables = yield* DynamoDB.ListTables.bind();
+    const listTagsOfResource =
+      yield* DynamoDB.ListTagsOfResource.bind(sourceTable);
+    const updateItem = yield* DynamoDB.UpdateItem.bind(sourceTable);
+    const updateTimeToLive = yield* DynamoDB.UpdateTimeToLive.bind(sourceTable);
+    const query = yield* DynamoDB.Query.bind(sourceTable);
+    const scan = yield* DynamoDB.Scan.bind(sourceTable);
+    const TableName = yield* sourceTable.tableName;
+    const restoreTableToPointInTime =
+      yield* DynamoDB.RestoreTableToPointInTime.bind(
+        sourceTable,
+        restoreTargetTable,
+      );
+    const transactGetItems = yield* DynamoDB.TransactGetItems.bind(sourceTable);
+    const transactWriteItems =
+      yield* DynamoDB.TransactWriteItems.bind(sourceTable);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+        const pathname = url.pathname;
+
+        yield* Effect.logInfo(
+          `Request: ${request.method} ${pathname} (originalUrl: ${request.originalUrl}, url: ${request.url})`,
+        );
+
+        if (request.method === "POST" && pathname === "/put") {
+          const body = (yield* request.json) as unknown as {
+            pk: string;
+            sk: string;
+            data?: string;
+          };
+          const result = yield* putItem({
+            Item: {
+              pk: { S: body.pk },
+              sk: { S: body.sk },
+              ...(body.data ? { data: { S: body.data } } : {}),
+            },
+          });
+          return yield* HttpServerResponse.json({ success: true, result });
+        }
+
+        if (request.method === "GET" && pathname === "/get") {
+          const pk = url.searchParams.get("pk");
+          const sk = url.searchParams.get("sk");
+          if (!pk || !sk) {
+            return HttpServerResponse.text("Missing pk or sk", { status: 400 });
+          }
+          const result = yield* getItem({
+            Key: {
+              pk: { S: pk },
+              sk: { S: sk },
+            },
+          });
+          return yield* HttpServerResponse.json({ item: result.Item });
+        }
+
+        if (request.method === "GET" && pathname === "/describe-table") {
+          const result = yield* describeTable();
+          return yield* HttpServerResponse.json({
+            table: result.Table,
+          });
+        }
+
+        if (request.method === "GET" && pathname === "/describe-ttl") {
+          const result = yield* describeTimeToLive();
+          return yield* HttpServerResponse.json({
+            timeToLiveDescription: result.TimeToLiveDescription,
+          });
+        }
+
+        if (request.method === "DELETE" && pathname === "/delete") {
+          const body = (yield* request.json) as unknown as {
+            pk: string;
+            sk: string;
+          };
+          const result = yield* deleteItem({
+            Key: {
+              pk: { S: body.pk },
+              sk: { S: body.sk },
+            },
+          });
+          return yield* HttpServerResponse.json({ success: true, result });
+        }
+
+        if (request.method === "POST" && pathname === "/update") {
+          const body = (yield* request.json) as unknown as {
+            pk: string;
+            sk: string;
+            data: string;
+          };
+          const result = yield* updateItem({
+            Key: {
+              pk: { S: body.pk },
+              sk: { S: body.sk },
+            },
+            UpdateExpression: "SET #data = :data",
+            ExpressionAttributeNames: { "#data": "data" },
+            ExpressionAttributeValues: { ":data": { S: body.data } },
+            ReturnValues: "ALL_NEW",
+          });
+          return yield* HttpServerResponse.json({
+            success: true,
+            attributes: result.Attributes,
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/update-ttl") {
+          const body = (yield* request.json) as unknown as {
+            attributeName: string;
+            enabled: boolean;
+          };
+          const result = yield* updateTimeToLive({
+            TimeToLiveSpecification: {
+              AttributeName: body.attributeName,
+              Enabled: body.enabled,
+            },
+          });
+          return yield* HttpServerResponse.json({
+            timeToLiveSpecification: result.TimeToLiveSpecification,
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/batch-write") {
+          const body =
+            (yield* request.json) as unknown as DynamoDB.BatchWriteItemRequest;
+          const result = yield* batchWriteItem(body);
+          return yield* HttpServerResponse.json({
+            unprocessedItems: result.UnprocessedItems ?? {},
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/batch-get") {
+          const body =
+            (yield* request.json) as unknown as DynamoDB.BatchGetItemRequest;
+          const result = yield* batchGetItem(body);
+          return yield* HttpServerResponse.json({
+            responses: result.Responses ?? {},
+            unprocessedKeys: result.UnprocessedKeys ?? {},
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/transact-write") {
+          const body =
+            (yield* request.json) as unknown as DynamoDB.TransactWriteItemsRequest;
+          const result = yield* transactWriteItems(body);
+          return yield* HttpServerResponse.json({
+            success: true,
+            result,
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/transact-get") {
+          const body =
+            (yield* request.json) as unknown as DynamoDB.TransactGetItemsRequest;
+          const result = yield* transactGetItems(body);
+          return yield* HttpServerResponse.json({
+            responses: result.Responses ?? [],
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/execute-transaction") {
+          const tableName = yield* TableName;
+          const result = yield* executeTransaction({
+            TransactStatements: [
+              {
+                Statement: `SELECT * FROM "${tableName}" WHERE pk=? AND sk=?`,
+                Parameters: [{ S: "tx#1" }, { S: "item1" }],
+              },
+              {
+                Statement: `SELECT * FROM "${tableName}" WHERE pk=? AND sk=?`,
+                Parameters: [{ S: "tx#1" }, { S: "item2" }],
+              },
+            ],
+          });
+          return yield* HttpServerResponse.json({
+            responses: result.Responses,
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/execute-statement") {
+          const body = (yield* request.json) as unknown as {
+            pk: string;
+            sk: string;
+          };
+          const tableName = yield* TableName;
+          const result = yield* executeStatement({
+            Statement: `SELECT * FROM "${tableName}" WHERE pk=? AND sk=?`,
+            Parameters: [{ S: body.pk }, { S: body.sk }],
+          });
+          return yield* HttpServerResponse.json({
+            items: result.Items ?? [],
+          });
+        }
+
+        if (
+          request.method === "POST" &&
+          pathname === "/batch-execute-statement"
+        ) {
+          const body = (yield* request.json) as unknown as {
+            first: { pk: string; sk: string };
+            second: { pk: string; sk: string };
+          };
+          const sourceTableName = yield* TableName;
+          const result = yield* batchExecuteStatement({
+            Statements: [
+              {
+                Statement: `SELECT * FROM "${sourceTableName}" WHERE pk=? AND sk=?`,
+                Parameters: [{ S: body.first.pk }, { S: body.first.sk }],
+              },
+              {
+                Statement: `SELECT * FROM "${sourceTableName}" WHERE pk=? AND sk=?`,
+                Parameters: [{ S: body.second.pk }, { S: body.second.sk }],
+              },
+            ],
+          });
+          return yield* HttpServerResponse.json({
+            responses: result.Responses ?? [],
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/restore-table") {
+          const result = yield* restoreTableToPointInTime({
+            UseLatestRestorableTime: true,
+          }).pipe(
+            Effect.map((result) => ({
+              ok: true as const,
+              result,
+            })),
+            Effect.catch((error) =>
+              Effect.succeed({
+                ok: false as const,
+                error:
+                  typeof error === "object" && error !== null && "_tag" in error
+                    ? (error as { _tag: string })._tag
+                    : `${error}`,
+              }),
+            ),
+          );
+          return yield* HttpServerResponse.json(result);
+        }
+
+        if (request.method === "GET" && pathname === "/query") {
+          const pk = url.searchParams.get("pk");
+          if (!pk) {
+            return HttpServerResponse.text("Missing pk", { status: 400 });
+          }
+          const result = yield* query({
+            KeyConditionExpression: "pk = :pk",
+            ExpressionAttributeValues: { ":pk": { S: pk } },
+          });
+          return yield* HttpServerResponse.json({
+            items: result.Items,
+            count: result.Count,
+          });
+        }
+
+        if (request.method === "GET" && pathname === "/list-tables") {
+          const result = yield* listTables();
+          return yield* HttpServerResponse.json({
+            tableNames: result.TableNames,
+          });
+        }
+
+        if (request.method === "GET" && pathname === "/list-tags") {
+          const result = yield* listTagsOfResource();
+          return yield* HttpServerResponse.json({
+            tags: result.Tags,
+          });
+        }
+
+        if (request.method === "GET" && pathname === "/scan") {
+          const result = yield* scan({});
+          return yield* HttpServerResponse.json({
+            items: result.Items,
+            count: result.Count,
+          });
+        }
+
+        return yield* HttpServerResponse.json(
+          {
+            error: "Not found",
+            method: request.method,
+            pathname,
+            url: request.url,
+          },
+          { status: 404 },
+        );
+      }).pipe(Effect.orDie),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        DynamoDB.BatchExecuteStatementLive,
+        DynamoDB.BatchGetItemLive,
+        DynamoDB.BatchWriteItemLive,
+        DynamoDB.DescribeTableLive,
+        DynamoDB.DescribeTimeToLiveLive,
+        DynamoDB.ExecuteStatementLive,
+        DynamoDB.ExecuteTransactionLive,
+        DynamoDB.GetItemLive,
+        DynamoDB.ListTablesLive,
+        DynamoDB.ListTagsOfResourceLive,
+        DynamoDB.PutItemLive,
+        DynamoDB.DeleteItemLive,
+        DynamoDB.UpdateItemLive,
+        DynamoDB.UpdateTimeToLiveLive,
+        DynamoDB.QueryLive,
+        DynamoDB.RestoreTableToPointInTimeLive,
+        DynamoDB.ScanLive,
+        DynamoDB.TransactGetItemsLive,
+        DynamoDB.TransactWriteItemsLive,
+      ),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/stream-handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/stream-handler.ts
new file mode 100644
index 00000000000..46032d5ab44
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/DynamoDB/stream-handler.ts
@@ -0,0 +1,74 @@
+import * as AWS from "@/AWS";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+export class DynamoDBStreamFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "DynamoDBStreamFunction",
+  {
+    main: import.meta.filename,
+  },
+) {}
+
+export class TableAndQueue extends Context.Service<
+  TableAndQueue,
+  {
+    table: AWS.DynamoDB.Table;
+    queue: AWS.SQS.Queue;
+  }
+>()("TableAndQueue") {}
+
+const TableAndQueueLive = Layer.effect(
+  TableAndQueue,
+  Effect.gen(function* () {
+    const table = yield* AWS.DynamoDB.Table("StreamSourceTable", {
+      partitionKey: "pk",
+      sortKey: "sk",
+      attributes: {
+        pk: "S",
+        sk: "S",
+      },
+    });
+    const queue = yield* AWS.SQS.Queue("StreamSinkQueue");
+    return {
+      table,
+      queue,
+    };
+  }),
+);
+
+const eff = Effect.gen(function* () {
+  const { table, queue } = yield* TableAndQueue;
+  const sink = yield* AWS.SQS.QueueSink.bind(queue);
+
+  yield* AWS.DynamoDB.stream(table, {
+    streamViewType: "NEW_AND_OLD_IMAGES",
+    startingPosition: "TRIM_HORIZON",
+    batchSize: 10,
+  }).process((stream) =>
+    stream.pipe(
+      Stream.map((record) =>
+        JSON.stringify({
+          eventName: record.eventName,
+          keys: record.dynamodb.Keys,
+          newImage: record.dynamodb.NewImage,
+          oldImage: record.dynamodb.OldImage,
+        }),
+      ),
+      Stream.run(sink),
+    ),
+  );
+}).pipe(
+  Effect.provide(
+    Layer.provideMerge(
+      Layer.mergeAll(AWS.Lambda.TableEventSource, AWS.SQS.QueueSinkLive),
+      Layer.mergeAll(AWS.SQS.SendMessageBatchLive),
+    ),
+  ),
+);
+
+// @ts-expect-error
+export default DynamoDBStreamFunction.make(eff).pipe(
+  Layer.provideMerge(TableAndQueueLive),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Subnet.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Subnet.test.ts
new file mode 100644
index 00000000000..b3b538824dc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Subnet.test.ts
@@ -0,0 +1,115 @@
+import * as AWS from "@/AWS";
+import { Subnet, Vpc } from "@/AWS/EC2";
+import * as Test from "@/Test/Vitest";
+import * as EC2 from "@distilled.cloud/aws/ec2";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create, update, delete subnet", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const { vpc, subnet } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const vpc = yield* Vpc("TestVpc", {
+          cidrBlock: "10.0.0.0/16",
+        });
+        const subnet = yield* Subnet("TestSubnet", {
+          vpcId: vpc.vpcId,
+          cidrBlock: "10.0.1.0/24",
+        });
+        return { vpc, subnet };
+      }),
+    );
+
+    const actualSubnet = yield* EC2.describeSubnets({
+      SubnetIds: [subnet.subnetId],
+    });
+
+    expect(actualSubnet.Subnets?.[0]?.SubnetId).toEqual(subnet.subnetId);
+    expect(actualSubnet.Subnets?.[0]?.CidrBlock).toEqual("10.0.1.0/24");
+    expect(actualSubnet.Subnets?.[0]?.VpcId).toEqual(vpc.vpcId);
+    expect(actualSubnet.Subnets?.[0]?.State).toEqual("available");
+    expect(actualSubnet.Subnets?.[0]?.MapPublicIpOnLaunch).toEqual(false);
+
+    // Update subnet attributes
+    const { subnet: updatedSubnet } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const vpc = yield* Vpc("TestVpc", {
+          cidrBlock: "10.0.0.0/16",
+        });
+        const subnet = yield* Subnet("TestSubnet", {
+          vpcId: vpc.vpcId,
+          cidrBlock: "10.0.1.0/24",
+          mapPublicIpOnLaunch: true,
+        });
+        return { vpc, subnet };
+      }),
+    );
+
+    yield* expectSubnetAttribute({
+      SubnetId: updatedSubnet.subnetId,
+      Attribute: "mapPublicIpOnLaunch",
+      Value: true,
+    });
+
+    // Delete subnet and VPC
+    yield* stack.destroy();
+
+    yield* assertSubnetDeleted(subnet.subnetId);
+  }).pipe(logLevel),
+);
+
+const expectSubnetAttribute = Effect.fn(function* (props: {
+  SubnetId: string;
+  Attribute: "mapPublicIpOnLaunch" | "assignIpv6AddressOnCreation";
+  Value: boolean;
+}) {
+  yield* EC2.describeSubnets({
+    SubnetIds: [props.SubnetId],
+  }).pipe(
+    Effect.tap(Effect.logDebug),
+    Effect.flatMap((result) => {
+      const subnet = result.Subnets?.[0];
+      const actualValue =
+        props.Attribute === "mapPublicIpOnLaunch"
+          ? subnet?.MapPublicIpOnLaunch
+          : subnet?.AssignIpv6AddressOnCreation;
+
+      return actualValue === props.Value
+        ? Effect.succeed(result)
+        : Effect.fail(new SubnetAttributeStale());
+    }),
+    Effect.retry({
+      while: (e) => e instanceof SubnetAttributeStale,
+      schedule: Schedule.exponential(100),
+    }),
+  );
+});
+
+const assertSubnetDeleted = Effect.fn(function* (subnetId: string) {
+  yield* EC2.describeSubnets({
+    SubnetIds: [subnetId],
+  }).pipe(
+    Effect.flatMap(() => Effect.fail(new SubnetStillExists())),
+    Effect.retry({
+      while: (e) => e instanceof SubnetStillExists,
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catchTag("InvalidSubnetID.NotFound", () => Effect.void),
+  );
+});
+
+class SubnetStillExists extends Data.TaggedError("SubnetStillExists") {}
+
+class SubnetAttributeStale extends Data.TaggedError("SubnetAttributeStale") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Vpc.smoke.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Vpc.smoke.test.ts
new file mode 100644
index 00000000000..539404e5783
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Vpc.smoke.test.ts
@@ -0,0 +1,2272 @@
+import * as AWS from "@/AWS";
+import {
+  EgressOnlyInternetGateway,
+  EIP,
+  InternetGateway,
+  NatGateway,
+  NetworkAcl,
+  NetworkAclAssociation,
+  NetworkAclEntry,
+  Route,
+  RouteTable,
+  RouteTableAssociation,
+  SecurityGroup,
+  Subnet,
+  Vpc,
+  VpcEndpoint,
+} from "@/AWS/EC2";
+import * as Test from "@/Test/Vitest";
+import * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { expect } from "@effect/vitest";
+import { Data, Schedule } from "effect";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider.skip(
+  "VPC evolution: from simple to complex",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      // Get available AZs for multi-AZ stages
+      const azResult = yield* EC2.describeAvailabilityZones({});
+      const availableAzs =
+        azResult.AvailabilityZones?.filter((az) => az.State === "available") ??
+        [];
+      const az1 = availableAzs[0]?.ZoneName!;
+      const az2 = availableAzs[1]?.ZoneName!;
+
+      // =========================================================================
+      // STAGE 1: Bare Minimum VPC
+      // User starts with just a VPC - the most basic setup
+      // =========================================================================
+      yield* Effect.log("=== Stage 1: Bare Minimum VPC ===");
+      {
+        const myVpc = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+            });
+          }),
+        );
+
+        // Verify VPC was created
+        expect(myVpc.vpcId).toMatch(/^vpc-/);
+        expect(myVpc.cidrBlock).toEqual("10.0.0.0/16");
+        expect(myVpc.state).toEqual("available");
+
+        const vpcResult = yield* EC2.describeVpcs({
+          VpcIds: [myVpc.vpcId],
+        });
+        expect(vpcResult.Vpcs?.[0]?.CidrBlock).toEqual("10.0.0.0/16");
+      }
+
+      // =========================================================================
+      // STAGE 2: Add Internet Connectivity
+      // User needs public internet access - add IGW, public subnet, route table
+      // Tests: VPC update (DNS settings), IGW create, Subnet create, Route create
+      // =========================================================================
+      yield* Effect.log("=== Stage 2: Add Internet Connectivity ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              publicRouteTable,
+              internetRoute,
+              publicSubnet1Association,
+            };
+          }),
+        );
+
+        // Verify IGW
+        expect(_stack.internetGateway.internetGatewayId).toMatch(/^igw-/);
+        expect(_stack.internetGateway.vpcId).toEqual(_stack.myVpc.vpcId);
+
+        // Verify public subnet
+        expect(_stack.publicSubnet1.subnetId).toMatch(/^subnet-/);
+        expect(_stack.publicSubnet1.mapPublicIpOnLaunch).toEqual(true);
+        expect(_stack.publicSubnet1.availabilityZone).toEqual(az1);
+
+        // Verify route to IGW
+        expect(_stack.internetRoute.state).toEqual("active");
+        expect(_stack.internetRoute.gatewayId).toEqual(
+          _stack.internetGateway.internetGatewayId,
+        );
+
+        // Verify association
+        expect(_stack.publicSubnet1Association.associationId).toMatch(
+          /^rtbassoc-/,
+        );
+      }
+
+      // =========================================================================
+      // STAGE 3: Add Private Subnet
+      // User needs private resources (databases, internal services)
+      // Tests: Adding private subnet with separate route table (no internet)
+      // =========================================================================
+      yield* Effect.log("=== Stage 3: Add Private Subnet ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              publicSubnet1Association,
+              privateSubnet1Association,
+            };
+          }),
+        );
+
+        // Verify private subnet
+        expect(_stack.privateSubnet1.subnetId).toMatch(/^subnet-/);
+        expect(_stack.privateSubnet1.mapPublicIpOnLaunch).toBeFalsy();
+
+        // Verify private route table has NO internet route
+        const privateRtResult = yield* EC2.describeRouteTables({
+          RouteTableIds: [_stack.privateRouteTable.routeTableId],
+        });
+        const privateRoutes = privateRtResult.RouteTables?.[0]?.Routes ?? [];
+        const privateInternetRoute = privateRoutes.find(
+          (r) => r.DestinationCidrBlock === "0.0.0.0/0",
+        );
+        expect(privateInternetRoute).toBeUndefined();
+      }
+
+      // =========================================================================
+      // STAGE 4: Multi-AZ Expansion
+      // User needs high availability - add subnets in second AZ
+      // Tests: Adding subnets in second AZ, sharing route tables
+      // =========================================================================
+      yield* Effect.log("=== Stage 4: Multi-AZ Expansion ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+            });
+
+            // AZ1 subnets
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+            });
+
+            // AZ2 subnets
+            const publicSubnet2 = yield* Subnet("PublicSubnet2", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.2.0/24",
+              availabilityZone: az2,
+              mapPublicIpOnLaunch: true,
+            });
+
+            const privateSubnet2 = yield* Subnet("PrivateSubnet2", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.11.0/24",
+              availabilityZone: az2,
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            // AZ1 associations
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            // AZ2 associations (share route tables)
+            const publicSubnet2Association = yield* RouteTableAssociation(
+              "PublicSubnet2Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet2.subnetId,
+              },
+            );
+
+            const privateSubnet2Association = yield* RouteTableAssociation(
+              "PrivateSubnet2Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet2.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicSubnet2,
+              privateSubnet2,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              publicSubnet1Association,
+              privateSubnet1Association,
+              publicSubnet2Association,
+              privateSubnet2Association,
+            };
+          }),
+        );
+
+        // Verify subnets are in different AZs
+        expect(_stack.publicSubnet1.availabilityZone).toEqual(az1);
+        expect(_stack.publicSubnet2.availabilityZone).toEqual(az2);
+        expect(_stack.privateSubnet1.availabilityZone).toEqual(az1);
+        expect(_stack.privateSubnet2.availabilityZone).toEqual(az2);
+
+        // Verify all 4 associations exist
+        expect(_stack.publicSubnet1Association.associationId).toMatch(
+          /^rtbassoc-/,
+        );
+        expect(_stack.publicSubnet2Association.associationId).toMatch(
+          /^rtbassoc-/,
+        );
+        expect(_stack.privateSubnet1Association.associationId).toMatch(
+          /^rtbassoc-/,
+        );
+        expect(_stack.privateSubnet2Association.associationId).toMatch(
+          /^rtbassoc-/,
+        );
+
+        // Verify both public subnets share the same route table
+        expect(_stack.publicSubnet1Association.routeTableId).toEqual(
+          _stack.publicSubnet2Association.routeTableId,
+        );
+      }
+
+      // =========================================================================
+      // STAGE 5: Update Tags and Properties
+      // User needs better organization - add tags for production
+      // Tests: Tag updates on existing resources
+      // =========================================================================
+      yield* Effect.log("=== Stage 5: Update Tags and Properties ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+              tags: {
+                Name: "production-vpc",
+                Environment: "production",
+              },
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+              tags: {
+                Name: "production-igw",
+              },
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1a", Tier: "public" },
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+              tags: { Name: "private-1a", Tier: "private" },
+            });
+
+            const publicSubnet2 = yield* Subnet("PublicSubnet2", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.2.0/24",
+              availabilityZone: az2,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1b", Tier: "public" },
+            });
+
+            const privateSubnet2 = yield* Subnet("PrivateSubnet2", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.11.0/24",
+              availabilityZone: az2,
+              tags: { Name: "private-1b", Tier: "private" },
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt" },
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "private-rt" },
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            const publicSubnet2Association = yield* RouteTableAssociation(
+              "PublicSubnet2Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet2.subnetId,
+              },
+            );
+
+            const privateSubnet2Association = yield* RouteTableAssociation(
+              "PrivateSubnet2Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet2.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicSubnet2,
+              privateSubnet2,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              publicSubnet1Association,
+              privateSubnet1Association,
+              publicSubnet2Association,
+              privateSubnet2Association,
+            };
+          }),
+        );
+
+        // Verify tags were applied by checking AWS (with retry for eventual consistency)
+        yield* assertVpcTags(_stack.myVpc.vpcId, {
+          Name: "production-vpc",
+          Environment: "production",
+        });
+      }
+
+      // =========================================================================
+      // STAGE 6: Re-associate Subnet to Different Route Table
+      // User wants to move PublicSubnet2 to a dedicated route table
+      // Tests: Route table association update (replaceRouteTableAssociation)
+      // =========================================================================
+      yield* Effect.log("=== Stage 6: Re-associate Subnet ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+              tags: {
+                Name: "production-vpc",
+                Environment: "production",
+              },
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "production-igw" },
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1a", Tier: "public" },
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+              tags: { Name: "private-1a", Tier: "private" },
+            });
+
+            const publicSubnet2 = yield* Subnet("PublicSubnet2", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.2.0/24",
+              availabilityZone: az2,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1b", Tier: "public" },
+            });
+
+            const privateSubnet2 = yield* Subnet("PrivateSubnet2", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.11.0/24",
+              availabilityZone: az2,
+              tags: { Name: "private-1b", Tier: "private" },
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt" },
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "private-rt" },
+            });
+
+            // NEW: Dedicated route table for AZ2 public subnet
+            const publicRouteTable2 = yield* RouteTable("PublicRouteTable2", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt-az2" },
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            // NEW: Internet route for AZ2 public route table
+            const internetRoute2 = yield* Route("InternetRoute2", {
+              routeTableId: publicRouteTable2.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            // CHANGED: PublicSubnet2 now uses PublicRouteTable2
+            const publicSubnet2Association = yield* RouteTableAssociation(
+              "PublicSubnet2Association",
+              {
+                routeTableId: publicRouteTable2.routeTableId,
+                subnetId: publicSubnet2.subnetId,
+              },
+            );
+
+            const privateSubnet2Association = yield* RouteTableAssociation(
+              "PrivateSubnet2Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet2.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicSubnet2,
+              privateSubnet2,
+              publicRouteTable,
+              privateRouteTable,
+              publicRouteTable2,
+              internetRoute,
+              internetRoute2,
+              publicSubnet1Association,
+              privateSubnet1Association,
+              publicSubnet2Association,
+              privateSubnet2Association,
+            };
+          }),
+        );
+
+        // Verify PublicSubnet2 is now associated with a different route table
+        expect(_stack.publicSubnet2Association.routeTableId).toEqual(
+          _stack.publicRouteTable2.routeTableId,
+        );
+        expect(_stack.publicSubnet2Association.routeTableId).not.toEqual(
+          _stack.publicSubnet1Association.routeTableId,
+        );
+
+        // Verify the new route table has an internet route
+        expect(_stack.internetRoute2.state).toEqual("active");
+      }
+
+      // =========================================================================
+      // STAGE 7: Scale Down
+      // User removes AZ2 resources (cost savings)
+      // Tests: Resource deletion, dependency ordering during delete
+      // =========================================================================
+      yield* Effect.log("=== Stage 7: Scale Down ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+              tags: {
+                Name: "production-vpc",
+                Environment: "production",
+              },
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "production-igw" },
+            });
+
+            // Only AZ1 subnets remain
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1a", Tier: "public" },
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+              tags: { Name: "private-1a", Tier: "private" },
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt" },
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "private-rt" },
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            // Note: PublicSubnet2, PrivateSubnet2, PublicRouteTable2, InternetRoute2,
+            // and their associations are NOT included - they will be deleted
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              publicSubnet1Association,
+              privateSubnet1Association,
+            };
+          }),
+        );
+
+        // Verify only 2 subnets exist now
+        const subnetsResult = yield* EC2.describeSubnets({
+          Filters: [{ Name: "vpc-id", Values: [_stack.myVpc.vpcId] }],
+        });
+        expect(subnetsResult.Subnets).toHaveLength(2);
+
+        // Verify remaining subnets are in AZ1
+        for (const subnet of subnetsResult.Subnets ?? []) {
+          expect(subnet.AvailabilityZone).toEqual(az1);
+        }
+      }
+
+      // =========================================================================
+      // STAGE 8: Add NAT Gateway for Private Subnet Internet Access
+      // User needs private instances to access internet for updates
+      // Tests: EIP create, NAT Gateway create with state waiting
+      // =========================================================================
+      yield* Effect.log("=== Stage 8: Add NAT Gateway ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+              tags: {
+                Name: "production-vpc",
+                Environment: "production",
+              },
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "production-igw" },
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1a", Tier: "public" },
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+              tags: { Name: "private-1a", Tier: "private" },
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt" },
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "private-rt" },
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            // NEW: Elastic IP for NAT Gateway
+            const natEip = yield* EIP("NatEip", {
+              tags: { Name: "nat-eip" },
+            });
+
+            // NEW: NAT Gateway in public subnet
+            const natGateway = yield* NatGateway("NatGateway", {
+              subnetId: publicSubnet1.subnetId,
+              allocationId: natEip.allocationId,
+              tags: { Name: "production-nat" },
+            });
+
+            // NEW: Route from private subnet to NAT Gateway
+            const natRoute = yield* Route("NatRoute", {
+              routeTableId: privateRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              natGatewayId: natGateway.natGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              natEip,
+              natGateway,
+              natRoute,
+              publicSubnet1Association,
+              privateSubnet1Association,
+            };
+          }),
+        );
+
+        // Verify EIP
+        expect(_stack.natEip.allocationId).toMatch(/^eipalloc-/);
+        expect(_stack.natEip.publicIp).toBeDefined();
+
+        // Verify NAT Gateway
+        expect(_stack.natGateway.natGatewayId).toMatch(/^nat-/);
+        expect(_stack.natGateway.state).toEqual("available");
+        expect(_stack.natGateway.publicIp).toEqual(_stack.natEip.publicIp);
+
+        // Verify NAT route is active
+        expect(_stack.natRoute.state).toEqual("active");
+        expect(_stack.natRoute.natGatewayId).toEqual(
+          _stack.natGateway.natGatewayId,
+        );
+
+        // Verify private route table now has internet route via NAT
+        const privateRtResult = yield* EC2.describeRouteTables({
+          RouteTableIds: [_stack.privateRouteTable.routeTableId],
+        });
+        const privateRoutes = privateRtResult.RouteTables?.[0]?.Routes ?? [];
+        const privateInternetRoute = privateRoutes.find(
+          (r) => r.DestinationCidrBlock === "0.0.0.0/0",
+        );
+        expect(privateInternetRoute?.NatGatewayId).toEqual(
+          _stack.natGateway.natGatewayId,
+        );
+      }
+
+      // =========================================================================
+      // STAGE 9: Add Security Groups
+      // User needs to control instance access
+      // Tests: Security Group with inline ingress/egress rules
+      // =========================================================================
+      yield* Effect.log("=== Stage 9: Add Security Groups ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+              tags: {
+                Name: "production-vpc",
+                Environment: "production",
+              },
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "production-igw" },
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1a", Tier: "public" },
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+              tags: { Name: "private-1a", Tier: "private" },
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt" },
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "private-rt" },
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const natEip = yield* EIP("NatEip", {
+              tags: { Name: "nat-eip" },
+            });
+
+            const natGateway = yield* NatGateway("NatGateway", {
+              subnetId: publicSubnet1.subnetId,
+              allocationId: natEip.allocationId,
+              tags: { Name: "production-nat" },
+            });
+
+            const natRoute = yield* Route("NatRoute", {
+              routeTableId: privateRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              natGatewayId: natGateway.natGatewayId,
+            });
+
+            // NEW: Web security group allowing HTTP/HTTPS
+            const webSecurityGroup = yield* SecurityGroup("WebSecurityGroup", {
+              vpcId: myVpc.vpcId,
+              description: "Web tier security group",
+              ingress: [
+                {
+                  ipProtocol: "tcp",
+                  fromPort: 80,
+                  toPort: 80,
+                  cidrIpv4: "0.0.0.0/0",
+                  description: "Allow HTTP",
+                },
+                {
+                  ipProtocol: "tcp",
+                  fromPort: 443,
+                  toPort: 443,
+                  cidrIpv4: "0.0.0.0/0",
+                  description: "Allow HTTPS",
+                },
+              ],
+              egress: [
+                {
+                  ipProtocol: "-1",
+                  cidrIpv4: "0.0.0.0/0",
+                  description: "Allow all outbound",
+                },
+              ],
+              tags: { Name: "web-sg" },
+            });
+
+            // NEW: Database security group allowing access from web tier
+            const dbSecurityGroup = yield* SecurityGroup("DbSecurityGroup", {
+              vpcId: myVpc.vpcId,
+              description: "Database tier security group",
+              ingress: [
+                {
+                  ipProtocol: "tcp",
+                  fromPort: 5432,
+                  toPort: 5432,
+                  referencedGroupId: webSecurityGroup.groupId,
+                  description: "Allow PostgreSQL from web tier",
+                },
+              ],
+              egress: [
+                {
+                  ipProtocol: "-1",
+                  cidrIpv4: "0.0.0.0/0",
+                  description: "Allow all outbound",
+                },
+              ],
+              tags: { Name: "db-sg" },
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              natEip,
+              natGateway,
+              natRoute,
+              webSecurityGroup,
+              dbSecurityGroup,
+              publicSubnet1Association,
+              privateSubnet1Association,
+            };
+          }),
+        );
+
+        // Verify Web Security Group
+        expect(_stack.webSecurityGroup.groupId).toMatch(/^sg-/);
+        expect(_stack.webSecurityGroup.vpcId).toEqual(_stack.myVpc.vpcId);
+        expect(_stack.webSecurityGroup.ingressRules).toHaveLength(2);
+        expect(_stack.webSecurityGroup.egressRules).toHaveLength(1);
+
+        // Verify DB Security Group references Web Security Group
+        expect(_stack.dbSecurityGroup.groupId).toMatch(/^sg-/);
+        expect(_stack.dbSecurityGroup.ingressRules).toHaveLength(1);
+        expect(
+          _stack.dbSecurityGroup.ingressRules?.[0]?.referencedGroupId,
+        ).toEqual(_stack.webSecurityGroup.groupId);
+      }
+
+      // =========================================================================
+      // STAGE 10: Scale Down - Remove NAT Gateway and Security Groups
+      // User scales down to basic VPC for cost savings
+      // Tests: NAT Gateway delete with state waiting, Security Group delete
+      // =========================================================================
+      yield* Effect.log("=== Stage 10: Scale Down to Basic VPC ===");
+      {
+        const _stack = yield* stack.deploy(
+          Effect.gen(function* () {
+            const myVpc = yield* Vpc("MyVpc", {
+              cidrBlock: "10.0.0.0/16",
+              enableDnsSupport: true,
+              enableDnsHostnames: true,
+              tags: {
+                Name: "production-vpc",
+                Environment: "production",
+              },
+            });
+
+            const internetGateway = yield* InternetGateway("InternetGateway", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "production-igw" },
+            });
+
+            const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.1.0/24",
+              availabilityZone: az1,
+              mapPublicIpOnLaunch: true,
+              tags: { Name: "public-1a", Tier: "public" },
+            });
+
+            const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+              vpcId: myVpc.vpcId,
+              cidrBlock: "10.0.10.0/24",
+              availabilityZone: az1,
+              tags: { Name: "private-1a", Tier: "private" },
+            });
+
+            const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "public-rt" },
+            });
+
+            const privateRouteTable = yield* RouteTable("PrivateRouteTable", {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "private-rt" },
+            });
+
+            const internetRoute = yield* Route("InternetRoute", {
+              routeTableId: publicRouteTable.routeTableId,
+              destinationCidrBlock: "0.0.0.0/0",
+              gatewayId: internetGateway.internetGatewayId,
+            });
+
+            const publicSubnet1Association = yield* RouteTableAssociation(
+              "PublicSubnet1Association",
+              {
+                routeTableId: publicRouteTable.routeTableId,
+                subnetId: publicSubnet1.subnetId,
+              },
+            );
+
+            const privateSubnet1Association = yield* RouteTableAssociation(
+              "PrivateSubnet1Association",
+              {
+                routeTableId: privateRouteTable.routeTableId,
+                subnetId: privateSubnet1.subnetId,
+              },
+            );
+
+            // Note: NAT Gateway, EIP, NatRoute, and Security Groups are NOT included
+            // They will be deleted
+
+            return {
+              myVpc,
+              internetGateway,
+              publicSubnet1,
+              privateSubnet1,
+              publicRouteTable,
+              privateRouteTable,
+              internetRoute,
+              publicSubnet1Association,
+              privateSubnet1Association,
+            };
+          }),
+        );
+
+        // Verify NAT Gateway is deleted
+        const natGwResult = yield* ec2
+          .describeNatGateways({
+            Filter: [{ Name: "vpc-id", Values: [_stack.myVpc.vpcId] }],
+          })
+          .pipe(
+            Effect.map((r) =>
+              r.NatGateways?.filter((gw) => gw.State !== "deleted"),
+            ),
+          );
+        expect(natGwResult).toHaveLength(0);
+
+        // Verify Security Groups are deleted (only default should remain)
+        const sgResult = yield* EC2.describeSecurityGroups({
+          Filters: [{ Name: "vpc-id", Values: [_stack.myVpc.vpcId] }],
+        });
+        expect(sgResult.SecurityGroups).toHaveLength(1); // Only default SG
+        expect(sgResult.SecurityGroups?.[0]?.GroupName).toEqual("default");
+      }
+
+      // =========================================================================
+      // STAGE 11: Final Cleanup
+      // Destroy everything and verify
+      // =========================================================================
+      yield* Effect.log("=== Stage 11: Final Cleanup ===");
+      const vpcResult = yield* EC2.describeVpcs({
+        Filters: [{ Name: "tag:Name", Values: ["production-vpc"] }],
+      });
+      const capturedVpcId = vpcResult.Vpcs?.[0]?.VpcId;
+
+      yield* stack.destroy();
+
+      // Verify VPC is deleted
+      if (capturedVpcId) {
+        yield* EC2.describeVpcs({ VpcIds: [capturedVpcId] }).pipe(
+          Effect.flatMap(() => Effect.fail(new Error("VPC still exists"))),
+          Effect.catchTag("InvalidVpcID.NotFound", () => Effect.void),
+        );
+      }
+
+      yield* Effect.log("=== All stages completed successfully! ===");
+    }).pipe(logLevel),
+  { timeout: 1_000_000 },
+);
+
+test.provider.skip(
+  "Comprehensive VPC with all components",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      // Get available AZs
+      const azResult = yield* EC2.describeAvailabilityZones({});
+      const availableAzs =
+        azResult.AvailabilityZones?.filter((az) => az.State === "available") ??
+        [];
+      const az1 = availableAzs[0]?.ZoneName!;
+      const az2 = availableAzs[1]?.ZoneName!;
+
+      // =========================================================================
+      // Define all resources for a production-ready VPC
+      // =========================================================================
+      const _stack = yield* stack.deploy(
+        Effect.gen(function* () {
+          // VPC with DNS enabled and IPv6 for egress-only IGW
+          const myVpc = yield* Vpc("MyVpc", {
+            cidrBlock: "10.0.0.0/16",
+            enableDnsSupport: true,
+            enableDnsHostnames: true,
+            amazonProvidedIpv6CidrBlock: true,
+            tags: {
+              Name: "comprehensive-vpc",
+              Environment: "test",
+            },
+          });
+
+          // Internet Gateway for public internet access
+          const internetGateway = yield* InternetGateway("InternetGateway", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "comprehensive-igw" },
+          });
+
+          // Egress-Only Internet Gateway for IPv6 outbound traffic from private subnets
+          const egressOnlyIgw = yield* EgressOnlyInternetGateway(
+            "EgressOnlyIgw",
+            {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "comprehensive-eigw" },
+            },
+          );
+
+          // Public Subnets in two AZs
+          const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.1.0/24",
+            availabilityZone: az1,
+            mapPublicIpOnLaunch: true,
+            tags: { Name: "public-1a", Tier: "public" },
+          });
+
+          const publicSubnet2 = yield* Subnet("PublicSubnet2", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.2.0/24",
+            availabilityZone: az2,
+            mapPublicIpOnLaunch: true,
+            tags: { Name: "public-1b", Tier: "public" },
+          });
+
+          // Private Subnets in two AZs
+          const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.10.0/24",
+            availabilityZone: az1,
+            tags: { Name: "private-1a", Tier: "private" },
+          });
+
+          const privateSubnet2 = yield* Subnet("PrivateSubnet2", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.11.0/24",
+            availabilityZone: az2,
+            tags: { Name: "private-1b", Tier: "private" },
+          });
+
+          // Route Tables
+          const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "public-rt" },
+          });
+
+          const privateRouteTable1 = yield* RouteTable("PrivateRouteTable1", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "private-rt-1" },
+          });
+
+          const privateRouteTable2 = yield* RouteTable("PrivateRouteTable2", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "private-rt-2" },
+          });
+
+          // Internet route for public subnets
+          const internetRoute = yield* Route("InternetRoute", {
+            routeTableId: publicRouteTable.routeTableId,
+            destinationCidrBlock: "0.0.0.0/0",
+            gatewayId: internetGateway.internetGatewayId,
+          });
+
+          // NAT Gateway with EIP for AZ1
+          const natEip1 = yield* EIP("NatEip1", {
+            tags: { Name: "nat-eip-1" },
+          });
+
+          const natGateway1 = yield* NatGateway("NatGateway1", {
+            subnetId: publicSubnet1.subnetId,
+            allocationId: natEip1.allocationId,
+            tags: { Name: "nat-gateway-1" },
+          });
+
+          // NAT Gateway with EIP for AZ2
+          const natEip2 = yield* EIP("NatEip2", {
+            tags: { Name: "nat-eip-2" },
+          });
+
+          const natGateway2 = yield* NatGateway("NatGateway2", {
+            subnetId: publicSubnet2.subnetId,
+            allocationId: natEip2.allocationId,
+            tags: { Name: "nat-gateway-2" },
+          });
+
+          // NAT routes for private subnets (each AZ routes to its own NAT)
+          const natRoute1 = yield* Route("NatRoute1", {
+            routeTableId: privateRouteTable1.routeTableId,
+            destinationCidrBlock: "0.0.0.0/0",
+            natGatewayId: natGateway1.natGatewayId,
+          });
+
+          const natRoute2 = yield* Route("NatRoute2", {
+            routeTableId: privateRouteTable2.routeTableId,
+            destinationCidrBlock: "0.0.0.0/0",
+            natGatewayId: natGateway2.natGatewayId,
+          });
+
+          // Route Table Associations
+          const publicSubnet1Association = yield* RouteTableAssociation(
+            "PublicSubnet1Association",
+            {
+              routeTableId: publicRouteTable.routeTableId,
+              subnetId: publicSubnet1.subnetId,
+            },
+          );
+
+          const publicSubnet2Association = yield* RouteTableAssociation(
+            "PublicSubnet2Association",
+            {
+              routeTableId: publicRouteTable.routeTableId,
+              subnetId: publicSubnet2.subnetId,
+            },
+          );
+
+          const privateSubnet1Association = yield* RouteTableAssociation(
+            "PrivateSubnet1Association",
+            {
+              routeTableId: privateRouteTable1.routeTableId,
+              subnetId: privateSubnet1.subnetId,
+            },
+          );
+
+          const privateSubnet2Association = yield* RouteTableAssociation(
+            "PrivateSubnet2Association",
+            {
+              routeTableId: privateRouteTable2.routeTableId,
+              subnetId: privateSubnet2.subnetId,
+            },
+          );
+
+          // Security Groups
+          const webSecurityGroup = yield* SecurityGroup("WebSecurityGroup", {
+            vpcId: myVpc.vpcId,
+            description: "Web tier security group",
+            ingress: [
+              {
+                ipProtocol: "tcp",
+                fromPort: 80,
+                toPort: 80,
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow HTTP",
+              },
+              {
+                ipProtocol: "tcp",
+                fromPort: 443,
+                toPort: 443,
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow HTTPS",
+              },
+            ],
+            egress: [
+              {
+                ipProtocol: "-1",
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow all outbound",
+              },
+            ],
+            tags: { Name: "web-sg" },
+          });
+
+          const appSecurityGroup = yield* SecurityGroup("AppSecurityGroup", {
+            vpcId: myVpc.vpcId,
+            description: "Application tier security group",
+            ingress: [
+              {
+                ipProtocol: "tcp",
+                fromPort: 8080,
+                toPort: 8080,
+                referencedGroupId: webSecurityGroup.groupId,
+                description: "Allow from web tier",
+              },
+            ],
+            egress: [
+              {
+                ipProtocol: "-1",
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow all outbound",
+              },
+            ],
+            tags: { Name: "app-sg" },
+          });
+
+          const dbSecurityGroup = yield* SecurityGroup("DbSecurityGroup", {
+            vpcId: myVpc.vpcId,
+            description: "Database tier security group",
+            ingress: [
+              {
+                ipProtocol: "tcp",
+                fromPort: 5432,
+                toPort: 5432,
+                referencedGroupId: appSecurityGroup.groupId,
+                description: "Allow PostgreSQL from app tier",
+              },
+            ],
+            egress: [
+              {
+                ipProtocol: "-1",
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow all outbound",
+              },
+            ],
+            tags: { Name: "db-sg" },
+          });
+
+          // Network ACL for private subnets with custom rules
+          const privateNetworkAcl = yield* NetworkAcl("PrivateNetworkAcl", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "private-nacl" },
+          });
+
+          // Network ACL Entries (rules)
+          // Allow inbound traffic from VPC CIDR
+          const privateNaclIngressVpc = yield* NetworkAclEntry(
+            "PrivateNaclIngressVpc",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              ruleNumber: 100,
+              protocol: "-1", // All protocols
+              ruleAction: "allow",
+              egress: false,
+              cidrBlock: "10.0.0.0/16",
+            },
+          );
+
+          // Allow inbound ephemeral ports (for NAT return traffic)
+          const privateNaclIngressEphemeral = yield* NetworkAclEntry(
+            "PrivateNaclIngressEphemeral",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              ruleNumber: 200,
+              protocol: "6", // TCP
+              ruleAction: "allow",
+              egress: false,
+              cidrBlock: "0.0.0.0/0",
+              portRange: { from: 1024, to: 65535 },
+            },
+          );
+
+          // Allow all outbound traffic
+          const privateNaclEgressAll = yield* NetworkAclEntry(
+            "PrivateNaclEgressAll",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              ruleNumber: 100,
+              protocol: "-1", // All protocols
+              ruleAction: "allow",
+              egress: true,
+              cidrBlock: "0.0.0.0/0",
+            },
+          );
+
+          // Network ACL Associations - associate private subnets with the custom NACL
+          const privateSubnet1NaclAssoc = yield* NetworkAclAssociation(
+            "PrivateSubnet1NaclAssoc",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              subnetId: privateSubnet1.subnetId,
+            },
+          );
+
+          const privateSubnet2NaclAssoc = yield* NetworkAclAssociation(
+            "PrivateSubnet2NaclAssoc",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              subnetId: privateSubnet2.subnetId,
+            },
+          );
+
+          // VPC Gateway Endpoint for S3 (reduces NAT costs and improves latency)
+          const s3Endpoint = yield* VpcEndpoint("S3Endpoint", {
+            vpcId: myVpc.vpcId,
+            serviceName: `com.amazonaws.${
+              (yield* EC2.describeAvailabilityZones({})).AvailabilityZones?.[0]
+                ?.RegionName
+            }.s3`,
+            vpcEndpointType: "Gateway",
+            routeTableIds: [
+              privateRouteTable1.routeTableId,
+              privateRouteTable2.routeTableId,
+            ],
+            tags: { Name: "s3-endpoint" },
+          });
+
+          return {
+            myVpc,
+            internetGateway,
+            egressOnlyIgw,
+            publicSubnet1,
+            publicSubnet2,
+            privateSubnet1,
+            privateSubnet2,
+            publicRouteTable,
+            privateRouteTable1,
+            privateRouteTable2,
+            internetRoute,
+            natEip1,
+            natEip2,
+            natGateway1,
+            natGateway2,
+            natRoute1,
+            natRoute2,
+            publicSubnet1Association,
+            publicSubnet2Association,
+            privateSubnet1Association,
+            privateSubnet2Association,
+            webSecurityGroup,
+            appSecurityGroup,
+            dbSecurityGroup,
+            privateNetworkAcl,
+            privateNaclIngressVpc,
+            privateNaclIngressEphemeral,
+            privateNaclEgressAll,
+            privateSubnet1NaclAssoc,
+            privateSubnet2NaclAssoc,
+            s3Endpoint,
+          };
+        }),
+      );
+
+      // =========================================================================
+      // Verify VPC
+      // =========================================================================
+      expect(_stack.myVpc.vpcId).toMatch(/^vpc-/);
+      expect(_stack.myVpc.cidrBlock).toEqual("10.0.0.0/16");
+      expect(_stack.myVpc.state).toEqual("available");
+
+      const vpcResult = yield* EC2.describeVpcs({
+        VpcIds: [_stack.myVpc.vpcId],
+      });
+      expect(vpcResult.Vpcs?.[0]?.CidrBlock).toEqual("10.0.0.0/16");
+      // EnableDnsSupport and EnableDnsHostnames are not present in the describeVpcs output.
+      // Instead, use describeVpcAttribute for these:
+      const dnsSupport = yield* EC2.describeVpcAttribute({
+        VpcId: _stack.myVpc.vpcId,
+        Attribute: "enableDnsSupport",
+      });
+      expect(dnsSupport.EnableDnsSupport?.Value).toBeTruthy();
+
+      const dnsHostnames = yield* EC2.describeVpcAttribute({
+        VpcId: _stack.myVpc.vpcId,
+        Attribute: "enableDnsHostnames",
+      });
+      expect(dnsHostnames.EnableDnsHostnames?.Value).toBeTruthy();
+
+      // Verify VPC has IPv6 CIDR block
+      expect(_stack.myVpc.ipv6CidrBlockAssociationSet).toBeDefined();
+      expect(_stack.myVpc.ipv6CidrBlockAssociationSet?.length).toBeGreaterThan(
+        0,
+      );
+
+      // =========================================================================
+      // Verify Internet Gateway
+      // =========================================================================
+      expect(_stack.internetGateway.internetGatewayId).toMatch(/^igw-/);
+      expect(_stack.internetGateway.vpcId).toEqual(_stack.myVpc.vpcId);
+
+      // =========================================================================
+      // Verify Egress-Only Internet Gateway
+      // =========================================================================
+      expect(_stack.egressOnlyIgw.egressOnlyInternetGatewayId).toMatch(
+        /^eigw-/,
+      );
+      expect(_stack.egressOnlyIgw.attachments).toBeDefined();
+      expect(_stack.egressOnlyIgw.attachments?.[0]?.vpcId).toEqual(
+        _stack.myVpc.vpcId,
+      );
+
+      // =========================================================================
+      // Verify Subnets
+      // =========================================================================
+      expect(_stack.publicSubnet1.subnetId).toMatch(/^subnet-/);
+      expect(_stack.publicSubnet1.availabilityZone).toEqual(az1);
+      expect(_stack.publicSubnet1.mapPublicIpOnLaunch).toEqual(true);
+
+      expect(_stack.publicSubnet2.subnetId).toMatch(/^subnet-/);
+      expect(_stack.publicSubnet2.availabilityZone).toEqual(az2);
+      expect(_stack.publicSubnet2.mapPublicIpOnLaunch).toEqual(true);
+
+      expect(_stack.privateSubnet1.subnetId).toMatch(/^subnet-/);
+      expect(_stack.privateSubnet1.availabilityZone).toEqual(az1);
+      expect(_stack.privateSubnet1.mapPublicIpOnLaunch).toBeFalsy();
+
+      expect(_stack.privateSubnet2.subnetId).toMatch(/^subnet-/);
+      expect(_stack.privateSubnet2.availabilityZone).toEqual(az2);
+      expect(_stack.privateSubnet2.mapPublicIpOnLaunch).toBeFalsy();
+
+      // Verify 4 subnets total
+      const subnetsResult = yield* EC2.describeSubnets({
+        Filters: [{ Name: "vpc-id", Values: [_stack.myVpc.vpcId] }],
+      });
+      expect(subnetsResult.Subnets).toHaveLength(4);
+
+      // =========================================================================
+      // Verify NAT Gateways and EIPs
+      // =========================================================================
+      expect(_stack.natEip1.allocationId).toMatch(/^eipalloc-/);
+      expect(_stack.natEip1.publicIp).toBeDefined();
+
+      expect(_stack.natEip2.allocationId).toMatch(/^eipalloc-/);
+      expect(_stack.natEip2.publicIp).toBeDefined();
+
+      expect(_stack.natGateway1.natGatewayId).toMatch(/^nat-/);
+      expect(_stack.natGateway1.state).toEqual("available");
+      expect(_stack.natGateway1.publicIp).toEqual(_stack.natEip1.publicIp);
+      expect(_stack.natGateway1.subnetId).toEqual(
+        _stack.publicSubnet1.subnetId,
+      );
+
+      expect(_stack.natGateway2.natGatewayId).toMatch(/^nat-/);
+      expect(_stack.natGateway2.state).toEqual("available");
+      expect(_stack.natGateway2.publicIp).toEqual(_stack.natEip2.publicIp);
+      expect(_stack.natGateway2.subnetId).toEqual(
+        _stack.publicSubnet2.subnetId,
+      );
+
+      // =========================================================================
+      // Verify Routes
+      // =========================================================================
+      // Internet route to IGW
+      expect(_stack.internetRoute.state).toEqual("active");
+      expect(_stack.internetRoute.gatewayId).toEqual(
+        _stack.internetGateway.internetGatewayId,
+      );
+
+      // NAT routes
+      expect(_stack.natRoute1.state).toEqual("active");
+      expect(_stack.natRoute1.natGatewayId).toEqual(
+        _stack.natGateway1.natGatewayId,
+      );
+
+      expect(_stack.natRoute2.state).toEqual("active");
+      expect(_stack.natRoute2.natGatewayId).toEqual(
+        _stack.natGateway2.natGatewayId,
+      );
+
+      // Verify public route table has internet route
+      const publicRtResult = yield* EC2.describeRouteTables({
+        RouteTableIds: [_stack.publicRouteTable.routeTableId],
+      });
+      const publicRoutes = publicRtResult.RouteTables?.[0]?.Routes ?? [];
+      const publicInternetRoute = publicRoutes.find(
+        (r) => r.DestinationCidrBlock === "0.0.0.0/0",
+      );
+      expect(publicInternetRoute?.GatewayId).toEqual(
+        _stack.internetGateway.internetGatewayId,
+      );
+
+      // Verify private route tables have NAT routes
+      const private1RtResult = yield* EC2.describeRouteTables({
+        RouteTableIds: [_stack.privateRouteTable1.routeTableId],
+      });
+      const private1Routes = private1RtResult.RouteTables?.[0]?.Routes ?? [];
+      const private1NatRoute = private1Routes.find(
+        (r) => r.DestinationCidrBlock === "0.0.0.0/0",
+      );
+      expect(private1NatRoute?.NatGatewayId).toEqual(
+        _stack.natGateway1.natGatewayId,
+      );
+
+      const private2RtResult = yield* EC2.describeRouteTables({
+        RouteTableIds: [_stack.privateRouteTable2.routeTableId],
+      });
+      const private2Routes = private2RtResult.RouteTables?.[0]?.Routes ?? [];
+      const private2NatRoute = private2Routes.find(
+        (r) => r.DestinationCidrBlock === "0.0.0.0/0",
+      );
+      expect(private2NatRoute?.NatGatewayId).toEqual(
+        _stack.natGateway2.natGatewayId,
+      );
+
+      // =========================================================================
+      // Verify Route Table Associations
+      // =========================================================================
+      expect(_stack.publicSubnet1Association.associationId).toMatch(
+        /^rtbassoc-/,
+      );
+      expect(_stack.publicSubnet2Association.associationId).toMatch(
+        /^rtbassoc-/,
+      );
+      expect(_stack.privateSubnet1Association.associationId).toMatch(
+        /^rtbassoc-/,
+      );
+      expect(_stack.privateSubnet2Association.associationId).toMatch(
+        /^rtbassoc-/,
+      );
+
+      // Both public subnets share the same route table
+      expect(_stack.publicSubnet1Association.routeTableId).toEqual(
+        _stack.publicSubnet2Association.routeTableId,
+      );
+
+      // Private subnets have their own route tables (for HA NAT)
+      expect(_stack.privateSubnet1Association.routeTableId).not.toEqual(
+        _stack.privateSubnet2Association.routeTableId,
+      );
+
+      // =========================================================================
+      // Verify Security Groups
+      // =========================================================================
+      expect(_stack.webSecurityGroup.groupId).toMatch(/^sg-/);
+      expect(_stack.webSecurityGroup.vpcId).toEqual(_stack.myVpc.vpcId);
+      expect(_stack.webSecurityGroup.ingressRules).toHaveLength(2);
+      // TODO(sam): why is it 2 when we only have 1? is it a default or egress only ingress?
+      expect(_stack.webSecurityGroup.egressRules).toHaveLength(2);
+
+      expect(_stack.appSecurityGroup.groupId).toMatch(/^sg-/);
+      expect(_stack.appSecurityGroup.vpcId).toEqual(_stack.myVpc.vpcId);
+      expect(_stack.appSecurityGroup.ingressRules).toHaveLength(1);
+      expect(
+        _stack.appSecurityGroup.ingressRules?.[0]?.referencedGroupId,
+      ).toEqual(_stack.webSecurityGroup.groupId);
+
+      expect(_stack.dbSecurityGroup.groupId).toMatch(/^sg-/);
+      expect(_stack.dbSecurityGroup.vpcId).toEqual(_stack.myVpc.vpcId);
+      expect(_stack.dbSecurityGroup.ingressRules).toHaveLength(1);
+      expect(
+        _stack.dbSecurityGroup.ingressRules?.[0]?.referencedGroupId,
+      ).toEqual(_stack.appSecurityGroup.groupId);
+
+      // Verify security groups in AWS
+      const sgResult = yield* EC2.describeSecurityGroups({
+        Filters: [{ Name: "vpc-id", Values: [_stack.myVpc.vpcId] }],
+      });
+      // 4 security groups: default + web + app + db
+      expect(sgResult.SecurityGroups).toHaveLength(4);
+
+      // =========================================================================
+      // Verify Network ACL
+      // =========================================================================
+      expect(_stack.privateNetworkAcl.networkAclId).toMatch(/^acl-/);
+      expect(_stack.privateNetworkAcl.vpcId).toEqual(_stack.myVpc.vpcId);
+      expect(_stack.privateNetworkAcl.isDefault).toEqual(false);
+
+      // Verify Network ACL in AWS
+      const naclResult = yield* EC2.describeNetworkAcls({
+        NetworkAclIds: [_stack.privateNetworkAcl.networkAclId],
+      });
+      expect(naclResult.NetworkAcls).toHaveLength(1);
+      expect(naclResult.NetworkAcls?.[0]?.VpcId).toEqual(_stack.myVpc.vpcId);
+
+      // =========================================================================
+      // Verify Network ACL Entries
+      // =========================================================================
+      expect(_stack.privateNaclIngressVpc.networkAclId).toEqual(
+        _stack.privateNetworkAcl.networkAclId,
+      );
+      expect(_stack.privateNaclIngressVpc.ruleNumber).toEqual(100);
+      expect(_stack.privateNaclIngressVpc.egress).toEqual(false);
+      expect(_stack.privateNaclIngressVpc.ruleAction).toEqual("allow");
+
+      expect(_stack.privateNaclIngressEphemeral.ruleNumber).toEqual(200);
+      expect(_stack.privateNaclIngressEphemeral.portRange).toEqual({
+        from: 1024,
+        to: 65535,
+      });
+
+      expect(_stack.privateNaclEgressAll.egress).toEqual(true);
+      expect(_stack.privateNaclEgressAll.ruleNumber).toEqual(100);
+
+      // =========================================================================
+      // Verify Network ACL Associations
+      // =========================================================================
+      expect(_stack.privateSubnet1NaclAssoc.associationId).toMatch(
+        /^aclassoc-/,
+      );
+      expect(_stack.privateSubnet1NaclAssoc.networkAclId).toEqual(
+        _stack.privateNetworkAcl.networkAclId,
+      );
+      expect(_stack.privateSubnet1NaclAssoc.subnetId).toEqual(
+        _stack.privateSubnet1.subnetId,
+      );
+
+      expect(_stack.privateSubnet2NaclAssoc.associationId).toMatch(
+        /^aclassoc-/,
+      );
+      expect(_stack.privateSubnet2NaclAssoc.subnetId).toEqual(
+        _stack.privateSubnet2.subnetId,
+      );
+
+      // =========================================================================
+      // Verify VPC Endpoint for S3
+      // =========================================================================
+      expect(_stack.s3Endpoint.vpcEndpointId).toMatch(/^vpce-/);
+      expect(_stack.s3Endpoint.vpcEndpointType).toEqual("Gateway");
+      expect(_stack.s3Endpoint.vpcId).toEqual(_stack.myVpc.vpcId);
+      expect(_stack.s3Endpoint.state).toEqual("available");
+      expect(_stack.s3Endpoint.routeTableIds).toContain(
+        _stack.privateRouteTable1.routeTableId,
+      );
+      expect(_stack.s3Endpoint.routeTableIds).toContain(
+        _stack.privateRouteTable2.routeTableId,
+      );
+
+      // Verify VPC Endpoint in AWS
+      const vpceResult = yield* EC2.describeVpcEndpoints({
+        VpcEndpointIds: [_stack.s3Endpoint.vpcEndpointId],
+      });
+      expect(vpceResult.VpcEndpoints).toHaveLength(1);
+      expect(vpceResult.VpcEndpoints?.[0]?.VpcEndpointType).toEqual("Gateway");
+
+      // =========================================================================
+      // Verify Tags
+      // =========================================================================
+      yield* assertVpcTags(_stack.myVpc.vpcId, {
+        Name: "comprehensive-vpc",
+        Environment: "test",
+      });
+
+      // =========================================================================
+      // Idempotency check - apply again and verify no changes
+      // =========================================================================
+      yield* Effect.log("=== Idempotency Check: Re-applying stack ===");
+      const stack2 = yield* stack.deploy(
+        Effect.gen(function* () {
+          // VPC with DNS enabled and IPv6 for egress-only IGW
+          const myVpc = yield* Vpc("MyVpc", {
+            cidrBlock: "10.0.0.0/16",
+            enableDnsSupport: true,
+            enableDnsHostnames: true,
+            amazonProvidedIpv6CidrBlock: true,
+            tags: {
+              Name: "comprehensive-vpc",
+              Environment: "test",
+            },
+          });
+
+          // Internet Gateway for public internet access
+          const internetGateway = yield* InternetGateway("InternetGateway", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "comprehensive-igw" },
+          });
+
+          // Egress-Only Internet Gateway for IPv6 outbound traffic from private subnets
+          const egressOnlyIgw = yield* EgressOnlyInternetGateway(
+            "EgressOnlyIgw",
+            {
+              vpcId: myVpc.vpcId,
+              tags: { Name: "comprehensive-eigw" },
+            },
+          );
+
+          // Public Subnets in two AZs
+          const publicSubnet1 = yield* Subnet("PublicSubnet1", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.1.0/24",
+            availabilityZone: az1,
+            mapPublicIpOnLaunch: true,
+            tags: { Name: "public-1a", Tier: "public" },
+          });
+
+          const publicSubnet2 = yield* Subnet("PublicSubnet2", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.2.0/24",
+            availabilityZone: az2,
+            mapPublicIpOnLaunch: true,
+            tags: { Name: "public-1b", Tier: "public" },
+          });
+
+          // Private Subnets in two AZs
+          const privateSubnet1 = yield* Subnet("PrivateSubnet1", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.10.0/24",
+            availabilityZone: az1,
+            tags: { Name: "private-1a", Tier: "private" },
+          });
+
+          const privateSubnet2 = yield* Subnet("PrivateSubnet2", {
+            vpcId: myVpc.vpcId,
+            cidrBlock: "10.0.11.0/24",
+            availabilityZone: az2,
+            tags: { Name: "private-1b", Tier: "private" },
+          });
+
+          // Route Tables
+          const publicRouteTable = yield* RouteTable("PublicRouteTable", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "public-rt" },
+          });
+
+          const privateRouteTable1 = yield* RouteTable("PrivateRouteTable1", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "private-rt-1" },
+          });
+
+          const privateRouteTable2 = yield* RouteTable("PrivateRouteTable2", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "private-rt-2" },
+          });
+
+          // Internet route for public subnets
+          const internetRoute = yield* Route("InternetRoute", {
+            routeTableId: publicRouteTable.routeTableId,
+            destinationCidrBlock: "0.0.0.0/0",
+            gatewayId: internetGateway.internetGatewayId,
+          });
+
+          // NAT Gateway with EIP for AZ1
+          const natEip1 = yield* EIP("NatEip1", {
+            tags: { Name: "nat-eip-1" },
+          });
+
+          const natGateway1 = yield* NatGateway("NatGateway1", {
+            subnetId: publicSubnet1.subnetId,
+            allocationId: natEip1.allocationId,
+            tags: { Name: "nat-gateway-1" },
+          });
+
+          // NAT Gateway with EIP for AZ2
+          const natEip2 = yield* EIP("NatEip2", {
+            tags: { Name: "nat-eip-2" },
+          });
+
+          const natGateway2 = yield* NatGateway("NatGateway2", {
+            subnetId: publicSubnet2.subnetId,
+            allocationId: natEip2.allocationId,
+            tags: { Name: "nat-gateway-2" },
+          });
+
+          // NAT routes for private subnets (each AZ routes to its own NAT)
+          const natRoute1 = yield* Route("NatRoute1", {
+            routeTableId: privateRouteTable1.routeTableId,
+            destinationCidrBlock: "0.0.0.0/0",
+            natGatewayId: natGateway1.natGatewayId,
+          });
+
+          const natRoute2 = yield* Route("NatRoute2", {
+            routeTableId: privateRouteTable2.routeTableId,
+            destinationCidrBlock: "0.0.0.0/0",
+            natGatewayId: natGateway2.natGatewayId,
+          });
+
+          // Route Table Associations
+          const publicSubnet1Association = yield* RouteTableAssociation(
+            "PublicSubnet1Association",
+            {
+              routeTableId: publicRouteTable.routeTableId,
+              subnetId: publicSubnet1.subnetId,
+            },
+          );
+
+          const publicSubnet2Association = yield* RouteTableAssociation(
+            "PublicSubnet2Association",
+            {
+              routeTableId: publicRouteTable.routeTableId,
+              subnetId: publicSubnet2.subnetId,
+            },
+          );
+
+          const privateSubnet1Association = yield* RouteTableAssociation(
+            "PrivateSubnet1Association",
+            {
+              routeTableId: privateRouteTable1.routeTableId,
+              subnetId: privateSubnet1.subnetId,
+            },
+          );
+
+          const privateSubnet2Association = yield* RouteTableAssociation(
+            "PrivateSubnet2Association",
+            {
+              routeTableId: privateRouteTable2.routeTableId,
+              subnetId: privateSubnet2.subnetId,
+            },
+          );
+
+          // Security Groups
+          const webSecurityGroup = yield* SecurityGroup("WebSecurityGroup", {
+            vpcId: myVpc.vpcId,
+            description: "Web tier security group",
+            ingress: [
+              {
+                ipProtocol: "tcp",
+                fromPort: 80,
+                toPort: 80,
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow HTTP",
+              },
+              {
+                ipProtocol: "tcp",
+                fromPort: 443,
+                toPort: 443,
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow HTTPS",
+              },
+            ],
+            egress: [
+              {
+                ipProtocol: "-1",
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow all outbound",
+              },
+            ],
+            tags: { Name: "web-sg" },
+          });
+
+          const appSecurityGroup = yield* SecurityGroup("AppSecurityGroup", {
+            vpcId: myVpc.vpcId,
+            description: "Application tier security group",
+            ingress: [
+              {
+                ipProtocol: "tcp",
+                fromPort: 8080,
+                toPort: 8080,
+                referencedGroupId: webSecurityGroup.groupId,
+                description: "Allow from web tier",
+              },
+            ],
+            egress: [
+              {
+                ipProtocol: "-1",
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow all outbound",
+              },
+            ],
+            tags: { Name: "app-sg" },
+          });
+
+          const dbSecurityGroup = yield* SecurityGroup("DbSecurityGroup", {
+            vpcId: myVpc.vpcId,
+            description: "Database tier security group",
+            ingress: [
+              {
+                ipProtocol: "tcp",
+                fromPort: 5432,
+                toPort: 5432,
+                referencedGroupId: appSecurityGroup.groupId,
+                description: "Allow PostgreSQL from app tier",
+              },
+            ],
+            egress: [
+              {
+                ipProtocol: "-1",
+                cidrIpv4: "0.0.0.0/0",
+                description: "Allow all outbound",
+              },
+            ],
+            tags: { Name: "db-sg" },
+          });
+
+          // Network ACL for private subnets with custom rules
+          const privateNetworkAcl = yield* NetworkAcl("PrivateNetworkAcl", {
+            vpcId: myVpc.vpcId,
+            tags: { Name: "private-nacl" },
+          });
+
+          // Network ACL Entries (rules)
+          // Allow inbound traffic from VPC CIDR
+          const privateNaclIngressVpc = yield* NetworkAclEntry(
+            "PrivateNaclIngressVpc",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              ruleNumber: 100,
+              protocol: "-1", // All protocols
+              ruleAction: "allow",
+              egress: false,
+              cidrBlock: "10.0.0.0/16",
+            },
+          );
+
+          // Allow inbound ephemeral ports (for NAT return traffic)
+          const privateNaclIngressEphemeral = yield* NetworkAclEntry(
+            "PrivateNaclIngressEphemeral",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              ruleNumber: 200,
+              protocol: "6", // TCP
+              ruleAction: "allow",
+              egress: false,
+              cidrBlock: "0.0.0.0/0",
+              portRange: { from: 1024, to: 65535 },
+            },
+          );
+
+          // Allow all outbound traffic
+          const privateNaclEgressAll = yield* NetworkAclEntry(
+            "PrivateNaclEgressAll",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              ruleNumber: 100,
+              protocol: "-1", // All protocols
+              ruleAction: "allow",
+              egress: true,
+              cidrBlock: "0.0.0.0/0",
+            },
+          );
+
+          // Network ACL Associations - associate private subnets with the custom NACL
+          const privateSubnet1NaclAssoc = yield* NetworkAclAssociation(
+            "PrivateSubnet1NaclAssoc",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              subnetId: privateSubnet1.subnetId,
+            },
+          );
+
+          const privateSubnet2NaclAssoc = yield* NetworkAclAssociation(
+            "PrivateSubnet2NaclAssoc",
+            {
+              networkAclId: privateNetworkAcl.networkAclId,
+              subnetId: privateSubnet2.subnetId,
+            },
+          );
+
+          // VPC Gateway Endpoint for S3 (reduces NAT costs and improves latency)
+          const s3Endpoint = yield* VpcEndpoint("S3Endpoint", {
+            vpcId: myVpc.vpcId,
+            serviceName: `com.amazonaws.${
+              (yield* EC2.describeAvailabilityZones({})).AvailabilityZones?.[0]
+                ?.RegionName
+            }.s3`,
+            vpcEndpointType: "Gateway",
+            routeTableIds: [
+              privateRouteTable1.routeTableId,
+              privateRouteTable2.routeTableId,
+            ],
+            tags: { Name: "s3-endpoint" },
+          });
+
+          return {
+            myVpc,
+            internetGateway,
+            egressOnlyIgw,
+            publicSubnet1,
+            publicSubnet2,
+            privateSubnet1,
+            privateSubnet2,
+            publicRouteTable,
+            privateRouteTable1,
+            privateRouteTable2,
+            internetRoute,
+            natEip1,
+            natEip2,
+            natGateway1,
+            natGateway2,
+            natRoute1,
+            natRoute2,
+            publicSubnet1Association,
+            publicSubnet2Association,
+            privateSubnet1Association,
+            privateSubnet2Association,
+            webSecurityGroup,
+            appSecurityGroup,
+            dbSecurityGroup,
+            privateNetworkAcl,
+            privateNaclIngressVpc,
+            privateNaclIngressEphemeral,
+            privateNaclEgressAll,
+            privateSubnet1NaclAssoc,
+            privateSubnet2NaclAssoc,
+            s3Endpoint,
+          };
+        }),
+      );
+
+      // All IDs should remain the same
+      expect(stack2.myVpc.vpcId).toEqual(_stack.myVpc.vpcId);
+      expect(stack2.internetGateway.internetGatewayId).toEqual(
+        _stack.internetGateway.internetGatewayId,
+      );
+      expect(stack2.egressOnlyIgw.egressOnlyInternetGatewayId).toEqual(
+        _stack.egressOnlyIgw.egressOnlyInternetGatewayId,
+      );
+      expect(stack2.natGateway1.natGatewayId).toEqual(
+        _stack.natGateway1.natGatewayId,
+      );
+      expect(stack2.natGateway2.natGatewayId).toEqual(
+        _stack.natGateway2.natGatewayId,
+      );
+      expect(stack2.privateNetworkAcl.networkAclId).toEqual(
+        _stack.privateNetworkAcl.networkAclId,
+      );
+      expect(stack2.s3Endpoint.vpcEndpointId).toEqual(
+        _stack.s3Endpoint.vpcEndpointId,
+      );
+
+      // =========================================================================
+      // Cleanup
+      // =========================================================================
+      yield* Effect.log("=== Cleanup: Destroying all resources ===");
+      const capturedVpcId = _stack.myVpc.vpcId;
+
+      yield* stack.destroy();
+
+      // Verify VPC is deleted
+      yield* EC2.describeVpcs({ VpcIds: [capturedVpcId] }).pipe(
+        Effect.flatMap(() => Effect.fail(new Error("VPC still exists"))),
+        Effect.catchTag("InvalidVpcID.NotFound", () => Effect.void),
+      );
+
+      yield* Effect.log(
+        "=== Comprehensive VPC test completed successfully! ===",
+      );
+    }).pipe(logLevel),
+  { timeout: 1_000_000 },
+);
+
+// ============================================================================
+// Eventually Consistent Check Utilities
+// ============================================================================
+
+class TagsNotPropagated extends Data.TaggedError("TagsNotPropagated")<{
+  readonly expected: Record<string, string>;
+  readonly actual: Record<string, string | undefined>;
+}> {}
+
+/**
+ * Asserts that a VPC has the expected tags, retrying until eventually consistent.
+ */
+const assertVpcTags = Effect.fn(function* (
+  vpcId: string,
+  expectedTags: Record<string, string>,
+) {
+  yield* EC2.describeVpcs({ VpcIds: [vpcId] }).pipe(
+    Effect.flatMap((result) => {
+      const tags = result.Vpcs?.[0]?.Tags ?? [];
+      const actual: Record<string, string | undefined> = {};
+
+      for (const key of Object.keys(expectedTags)) {
+        actual[key] = tags.find((t) => t.Key === key)?.Value;
+      }
+
+      const allMatch = Object.entries(expectedTags).every(
+        ([key, value]) => actual[key] === value,
+      );
+
+      return allMatch
+        ? Effect.succeed(result)
+        : Effect.fail(
+            new TagsNotPropagated({ expected: expectedTags, actual }),
+          );
+    }),
+    Effect.tapError(Effect.log),
+    Effect.retry({
+      while: (e) => e._tag === "TagsNotPropagated",
+      schedule: Schedule.fixed(1000).pipe(Schedule.both(Schedule.recurs(10))),
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Vpc.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Vpc.test.ts
new file mode 100644
index 00000000000..25f7b46d4ce
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/EC2/Vpc.test.ts
@@ -0,0 +1,116 @@
+import * as AWS from "@/AWS";
+import { Vpc } from "@/AWS/EC2";
+import * as Test from "@/Test/Vitest";
+import * as EC2 from "@distilled.cloud/aws/ec2";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider.skip("create, update, delete vpc", (stack) =>
+  Effect.gen(function* () {
+    const vpc = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Vpc("TestVpc", {
+          cidrBlock: "10.0.0.0/16",
+          enableDnsSupport: true,
+          enableDnsHostnames: true,
+        });
+      }),
+    );
+
+    const actualVpc = yield* EC2.describeVpcs({
+      VpcIds: [vpc.vpcId],
+    });
+    expect(actualVpc.Vpcs?.[0]?.VpcId).toEqual(vpc.vpcId);
+    expect(actualVpc.Vpcs?.[0]?.CidrBlock).toEqual("10.0.0.0/16");
+    expect(actualVpc.Vpcs?.[0]?.State).toEqual("available");
+
+    yield* expectVpcAttribute({
+      VpcId: vpc.vpcId,
+      Attribute: "enableDnsSupport",
+      Value: true,
+    });
+
+    yield* expectVpcAttribute({
+      VpcId: vpc.vpcId,
+      Attribute: "enableDnsHostnames",
+      Value: true,
+    });
+
+    // Update VPC attributes
+    const updatedVpc = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Vpc("TestVpc", {
+          cidrBlock: "10.0.0.0/16",
+          enableDnsSupport: false,
+          enableDnsHostnames: false,
+        });
+      }),
+    );
+
+    yield* expectVpcAttribute({
+      VpcId: updatedVpc.vpcId,
+      Attribute: "enableDnsSupport",
+      Value: false,
+    });
+
+    yield* expectVpcAttribute({
+      VpcId: updatedVpc.vpcId,
+      Attribute: "enableDnsHostnames",
+      Value: false,
+    });
+
+    yield* stack.destroy();
+
+    yield* assertVpcDeleted(vpc.vpcId);
+  }).pipe(logLevel),
+);
+
+const expectVpcAttribute = Effect.fn(function* (props: {
+  VpcId: string;
+  Attribute: EC2.VpcAttributeName;
+  Value: boolean;
+}) {
+  yield* EC2.describeVpcAttribute({
+    VpcId: props.VpcId,
+    Attribute: props.Attribute,
+  }).pipe(
+    Effect.tap(Effect.logDebug),
+    Effect.flatMap((result: any) =>
+      result[`${props.Attribute[0].toUpperCase()}${props.Attribute.slice(1)}`]
+        ?.Value === props.Value
+        ? Effect.succeed(result)
+        : Effect.fail(new VpcAttributeStale()),
+    ),
+    Effect.retry({
+      while: (e) => e._tag === "VpcAttributeStale",
+      schedule: Schedule.exponential(100),
+    }),
+  );
+});
+
+class VpcAttributeStale extends Data.TaggedError("VpcAttributeStale") {}
+
+class VpcStillExists extends Data.TaggedError("VpcStillExists") {}
+
+export const assertVpcDeleted = Effect.fn(function* (vpcId: string) {
+  yield* EC2.describeVpcs({
+    VpcIds: [vpcId],
+  }).pipe(
+    Effect.flatMap(() => Effect.fail(new VpcStillExists())),
+    Effect.retry({
+      while: (e) => e._tag === "VpcStillExists",
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catchTag("InvalidVpcID.NotFound", () => Effect.void),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/ECS/CapacityProvider.smoke.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/ECS/CapacityProvider.smoke.test.ts
new file mode 100644
index 00000000000..029d40b187f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/ECS/CapacityProvider.smoke.test.ts
@@ -0,0 +1,83 @@
+import * as AWS from "@/AWS";
+import { CapacityProvider } from "@/AWS/ECS";
+import * as Test from "@/Test/Vitest";
+import * as ecs from "@distilled.cloud/aws/ecs";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+// Skipped by default: requires a pre-provisioned EC2 Auto Scaling Group ARN
+// (set via TEST_ASG_ARN) because AutoScalingGroup/LaunchTemplate currently
+// have no test infrastructure in this repo. Run locally with:
+//   TEST_ASG_ARN=arn:aws:autoscaling:... bun vitest CapacityProvider
+test.provider.skipIf(!process.env.TEST_ASG_ARN)(
+  "create, update, delete ECS capacity provider",
+  (stack) =>
+    Effect.gen(function* () {
+      const autoScalingGroupArn = process.env.TEST_ASG_ARN!;
+      yield* stack.destroy();
+
+      const provider = yield* stack.deploy(
+        CapacityProvider("TestCapacityProvider", {
+          autoScalingGroupArn,
+          managedScaling: {
+            status: "ENABLED",
+            targetCapacity: 80,
+            minimumScalingStepSize: 1,
+            maximumScalingStepSize: 10,
+          },
+          managedTerminationProtection: "DISABLED",
+          tags: { env: "test" },
+        }),
+      );
+
+      expect(provider.capacityProviderArn).toMatch(
+        /^arn:aws:ecs:[^:]+:\d+:capacity-provider\//,
+      );
+      expect(provider.status).toEqual("ACTIVE");
+      expect(provider.managedScaling?.targetCapacity).toEqual(80);
+      expect(provider.tags.env).toEqual("test");
+
+      const described = yield* ecs.describeCapacityProviders({
+        capacityProviders: [provider.name],
+        include: ["TAGS"],
+      });
+      const found = described.capacityProviders?.[0];
+      expect(found?.name).toEqual(provider.name);
+      expect(
+        found?.autoScalingGroupProvider?.managedScaling?.targetCapacity,
+      ).toEqual(80);
+
+      const updated = yield* stack.deploy(
+        CapacityProvider("TestCapacityProvider", {
+          autoScalingGroupArn,
+          managedScaling: {
+            status: "ENABLED",
+            targetCapacity: 60,
+            minimumScalingStepSize: 1,
+            maximumScalingStepSize: 5,
+          },
+          managedTerminationProtection: "DISABLED",
+          tags: { env: "test", owner: "alchemy" },
+        }),
+      );
+
+      expect(updated.managedScaling?.targetCapacity).toEqual(60);
+      expect(updated.tags.owner).toEqual("alchemy");
+
+      yield* stack.destroy();
+
+      const afterDestroy = yield* ecs.describeCapacityProviders({
+        capacityProviders: [provider.name],
+      });
+      expect(afterDestroy.capacityProviders ?? []).toHaveLength(0);
+    }).pipe(logLevel),
+  { timeout: 600_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Credentials.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Credentials.test.ts
new file mode 100644
index 00000000000..8b69adc7e6b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Credentials.test.ts
@@ -0,0 +1,188 @@
+import * as AWS from "@/AWS";
+import {
+  ServiceSpecificCredential,
+  SigningCertificate,
+  SSHPublicKey,
+  User,
+} from "@/AWS/IAM";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { testCertificateBody, testSshPublicKey } from "./fixtures.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.IAM credential resources", () => {
+  test.provider(
+    "create, update, and delete a service-specific credential",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const user = yield* User("CredentialOwner", {});
+            const credential = yield* ServiceSpecificCredential(
+              "ServiceCredential",
+              {
+                userName: user.userName,
+                serviceName: "codecommit.amazonaws.com",
+                status: "Active",
+              },
+            );
+            return { user, credential };
+          }),
+        );
+
+        expect(deployed.credential.servicePassword).toBeDefined();
+
+        const created = yield* IAM.listServiceSpecificCredentials({
+          UserName: deployed.user.userName,
+          ServiceName: deployed.credential.serviceName,
+        });
+        expect(
+          created.ServiceSpecificCredentials?.some(
+            (entry) =>
+              entry.ServiceSpecificCredentialId ===
+              deployed.credential.serviceSpecificCredentialId,
+          ),
+        ).toBe(true);
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const user = yield* User("CredentialOwner", {});
+            yield* ServiceSpecificCredential("ServiceCredential", {
+              userName: user.userName,
+              serviceName: "codecommit.amazonaws.com",
+              status: "Inactive",
+            });
+          }),
+        );
+
+        const updated = yield* IAM.listServiceSpecificCredentials({
+          UserName: deployed.user.userName,
+          ServiceName: deployed.credential.serviceName,
+        });
+        const metadata = updated.ServiceSpecificCredentials?.find(
+          (entry) =>
+            entry.ServiceSpecificCredentialId ===
+            deployed.credential.serviceSpecificCredentialId,
+        );
+        expect(metadata?.Status).toBe("Inactive");
+
+        yield* stack.destroy();
+
+        const deleted = yield* IAM.listServiceSpecificCredentials({
+          UserName: deployed.user.userName,
+          ServiceName: deployed.credential.serviceName,
+        }).pipe(Effect.option);
+        expect(
+          deleted._tag === "None" ||
+            !deleted.value.ServiceSpecificCredentials?.some(
+              (entry) =>
+                entry.ServiceSpecificCredentialId ===
+                deployed.credential.serviceSpecificCredentialId,
+            ),
+        ).toBe(true);
+      }),
+  );
+
+  test.provider(
+    "create, update, and delete SSH and signing credentials for a user",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const user = yield* User("CredentialUser", {});
+            const sshKey = yield* SSHPublicKey("UserSshKey", {
+              userName: user.userName,
+              sshPublicKeyBody: testSshPublicKey,
+              status: "Active",
+            });
+            const signingCertificate = yield* SigningCertificate(
+              "UserSigningCertificate",
+              {
+                userName: user.userName,
+                certificateBody: testCertificateBody,
+                status: "Active",
+              },
+            );
+            return { user, sshKey, signingCertificate };
+          }),
+        );
+
+        const createdKey = yield* IAM.getSSHPublicKey({
+          UserName: deployed.user.userName,
+          SSHPublicKeyId: deployed.sshKey.sshPublicKeyId,
+          Encoding: "SSH",
+        });
+        expect(createdKey.SSHPublicKey?.Status).toBe("Active");
+
+        const createdCerts = yield* IAM.listSigningCertificates({
+          UserName: deployed.user.userName,
+        });
+        expect(
+          createdCerts.Certificates.some(
+            (entry) =>
+              entry.CertificateId === deployed.signingCertificate.certificateId,
+          ),
+        ).toBe(true);
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const user = yield* User("CredentialUser", {});
+            yield* SSHPublicKey("UserSshKey", {
+              userName: user.userName,
+              sshPublicKeyBody: testSshPublicKey,
+              status: "Inactive",
+            });
+            yield* SigningCertificate("UserSigningCertificate", {
+              userName: user.userName,
+              certificateBody: testCertificateBody,
+              status: "Inactive",
+            });
+          }),
+        );
+
+        const updatedKey = yield* IAM.getSSHPublicKey({
+          UserName: deployed.user.userName,
+          SSHPublicKeyId: deployed.sshKey.sshPublicKeyId,
+          Encoding: "SSH",
+        });
+        expect(updatedKey.SSHPublicKey?.Status).toBe("Inactive");
+
+        const updatedCerts = yield* IAM.listSigningCertificates({
+          UserName: deployed.user.userName,
+        });
+        const updatedCert = updatedCerts.Certificates.find(
+          (entry) =>
+            entry.CertificateId === deployed.signingCertificate.certificateId,
+        );
+        expect(updatedCert?.Status).toBe("Inactive");
+
+        yield* stack.destroy();
+
+        const deletedKey = yield* IAM.getSSHPublicKey({
+          UserName: deployed.user.userName,
+          SSHPublicKeyId: deployed.sshKey.sshPublicKeyId,
+          Encoding: "SSH",
+        }).pipe(Effect.option);
+        expect(deletedKey._tag).toBe("None");
+
+        const deletedCerts = yield* IAM.listSigningCertificates({
+          UserName: deployed.user.userName,
+        }).pipe(Effect.option);
+        expect(
+          deletedCerts._tag === "None" ||
+            !deletedCerts.value.Certificates.some(
+              (entry) =>
+                entry.CertificateId ===
+                deployed.signingCertificate.certificateId,
+            ),
+        ).toBe(true);
+      }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/DeviceAndServerCertificate.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/DeviceAndServerCertificate.test.ts
new file mode 100644
index 00000000000..7dffa81b3e9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/DeviceAndServerCertificate.test.ts
@@ -0,0 +1,130 @@
+import * as AWS from "@/AWS";
+import { ServerCertificate, VirtualMFADevice } from "@/AWS/IAM";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { testCertificateBody, testPrivateKey } from "./fixtures.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.IAM device and server certificate resources", () => {
+  test.provider("create, update, and delete a server certificate", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const certificate = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* ServerCertificate("ServerCertificate", {
+            certificateBody: testCertificateBody,
+            privateKey: testPrivateKey,
+            tags: {
+              env: "test",
+            },
+          });
+        }),
+      );
+
+      const created = yield* IAM.getServerCertificate({
+        ServerCertificateName: certificate.serverCertificateName,
+      });
+      expect(
+        created.ServerCertificate.ServerCertificateMetadata
+          .ServerCertificateName,
+      ).toBe(certificate.serverCertificateName);
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* ServerCertificate("ServerCertificate", {
+            certificateBody: testCertificateBody,
+            privateKey: testPrivateKey,
+            tags: {
+              env: "prod",
+            },
+          });
+        }),
+      );
+
+      const updatedTags = yield* IAM.listServerCertificateTags({
+        ServerCertificateName: certificate.serverCertificateName,
+      });
+      expect(
+        Object.fromEntries(
+          (updatedTags.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+        ),
+      ).toMatchObject({
+        env: "prod",
+      });
+
+      yield* stack.destroy();
+
+      const deleted = yield* IAM.getServerCertificate({
+        ServerCertificateName: certificate.serverCertificateName,
+      }).pipe(Effect.option);
+      expect(deleted._tag).toBe("None");
+    }),
+  );
+
+  test.provider(
+    "create, update, and delete an unassigned virtual MFA device",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const device = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* VirtualMFADevice("VirtualMfaDevice", {
+              tags: {
+                env: "test",
+              },
+            });
+          }),
+        );
+
+        expect(device.base32StringSeed).toBeDefined();
+        expect(device.qrCodePNG).toBeDefined();
+
+        const created = yield* IAM.listVirtualMFADevices({
+          AssignmentStatus: "Unassigned",
+        });
+        expect(
+          created.VirtualMFADevices.some(
+            (entry) => entry.SerialNumber === device.serialNumber,
+          ),
+        ).toBe(true);
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* VirtualMFADevice("VirtualMfaDevice", {
+              tags: {
+                env: "prod",
+              },
+            });
+          }),
+        );
+
+        const updatedTags = yield* IAM.listMFADeviceTags({
+          SerialNumber: device.serialNumber,
+        });
+        expect(
+          Object.fromEntries(
+            (updatedTags.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+          ),
+        ).toMatchObject({
+          env: "prod",
+        });
+
+        yield* stack.destroy();
+
+        const deleted = yield* IAM.listVirtualMFADevices({
+          AssignmentStatus: "Unassigned",
+        }).pipe(Effect.option);
+        expect(
+          deleted._tag === "None" ||
+            !deleted.value.VirtualMFADevices.some(
+              (entry) => entry.SerialNumber === device.serialNumber,
+            ),
+        ).toBe(true);
+      }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Federation.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Federation.test.ts
new file mode 100644
index 00000000000..a79d5ec5c14
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Federation.test.ts
@@ -0,0 +1,142 @@
+import * as AWS from "@/AWS";
+import { OpenIDConnectProvider, SAMLProvider } from "@/AWS/IAM";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import {
+  testOidcThumbprintA,
+  testOidcThumbprintB,
+  testOidcUrl,
+  testSamlMetadataDocument,
+  testSamlMetadataDocumentUpdated,
+  testSamlProviderName,
+} from "./fixtures.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.IAM federation resources", () => {
+  test.provider(
+    "create, update, and delete an OpenID Connect provider",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const provider = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* OpenIDConnectProvider("OidcProvider", {
+              url: testOidcUrl,
+              clientIDList: ["sts.amazonaws.com"],
+              thumbprintList: [testOidcThumbprintA],
+              tags: {
+                env: "test",
+              },
+            });
+          }),
+        );
+
+        const created = yield* IAM.getOpenIDConnectProvider({
+          OpenIDConnectProviderArn: provider.openIDConnectProviderArn,
+        });
+        expect(created.Url).toBe(testOidcUrl.replace(/^https?:\/\//, ""));
+        expect(created.ClientIDList ?? []).toContain("sts.amazonaws.com");
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* OpenIDConnectProvider("OidcProvider", {
+              url: testOidcUrl,
+              clientIDList: ["sts.amazonaws.com", "alchemy-client"],
+              thumbprintList: [testOidcThumbprintB],
+              tags: {
+                env: "prod",
+              },
+            });
+          }),
+        );
+
+        const updated = yield* IAM.getOpenIDConnectProvider({
+          OpenIDConnectProviderArn: provider.openIDConnectProviderArn,
+        });
+        expect(updated.ClientIDList ?? []).toContain("alchemy-client");
+        expect(updated.ThumbprintList).toEqual([testOidcThumbprintB]);
+
+        const tags = yield* IAM.listOpenIDConnectProviderTags({
+          OpenIDConnectProviderArn: provider.openIDConnectProviderArn,
+        });
+        expect(
+          Object.fromEntries(
+            (tags.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+          ),
+        ).toMatchObject({
+          env: "prod",
+        });
+
+        yield* stack.destroy();
+
+        const deleted = yield* IAM.getOpenIDConnectProvider({
+          OpenIDConnectProviderArn: provider.openIDConnectProviderArn,
+        }).pipe(Effect.option);
+        expect(deleted._tag).toBe("None");
+      }),
+  );
+
+  test.provider("create, update, and delete a SAML provider", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const provider = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* SAMLProvider("SamlProvider", {
+            name: testSamlProviderName,
+            samlMetadataDocument: testSamlMetadataDocument,
+            tags: {
+              env: "test",
+            },
+          });
+        }),
+      );
+
+      const created = yield* IAM.getSAMLProvider({
+        SAMLProviderArn: provider.samlProviderArn,
+      });
+      expect(created.SAMLMetadataDocument).toContain("urn:alchemy:test:idp");
+
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* SAMLProvider("SamlProvider", {
+            name: testSamlProviderName,
+            samlMetadataDocument: testSamlMetadataDocumentUpdated,
+            tags: {
+              env: "prod",
+            },
+          });
+        }),
+      );
+
+      const updated = yield* IAM.getSAMLProvider({
+        SAMLProviderArn: provider.samlProviderArn,
+      });
+      expect(updated.SAMLMetadataDocument).toContain(
+        "urn:alchemy:test:idp:updated",
+      );
+
+      const tags = yield* IAM.listSAMLProviderTags({
+        SAMLProviderArn: provider.samlProviderArn,
+      });
+      expect(
+        Object.fromEntries(
+          (tags.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+        ),
+      ).toMatchObject({
+        env: "prod",
+      });
+
+      yield* stack.destroy();
+
+      const deleted = yield* IAM.getSAMLProvider({
+        SAMLProviderArn: provider.samlProviderArn,
+      }).pipe(Effect.option);
+      expect(deleted._tag).toBe("None");
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Identity.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Identity.test.ts
new file mode 100644
index 00000000000..a618acbf95e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Identity.test.ts
@@ -0,0 +1,65 @@
+import * as AWS from "@/AWS";
+import { Group, GroupMembership, InstanceProfile, Role, User } from "@/AWS/IAM";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider("create user, group membership, and instance profile", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const resources = yield* stack.deploy(
+      Effect.gen(function* () {
+        const role = yield* Role("ProfileRole", {
+          assumeRolePolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Principal: { Service: "ec2.amazonaws.com" },
+                Action: ["sts:AssumeRole"],
+              },
+            ],
+          },
+        });
+        const user = yield* User("IamUser", {
+          tags: {
+            env: "test",
+          },
+        });
+        const group = yield* Group("IamGroup", {});
+        const membership = yield* GroupMembership("IamMembership", {
+          groupName: group.groupName,
+          userNames: [user.userName],
+        });
+        const profile = yield* InstanceProfile("IamInstanceProfile", {
+          roleName: role.roleName,
+          tags: {
+            env: "test",
+          },
+        });
+
+        return { user, group, membership, profile, role };
+      }),
+    );
+
+    const group = yield* IAM.getGroup({
+      GroupName: resources.group.groupName,
+    });
+    expect(
+      group.Users.some((user) => user.UserName === resources.user.userName),
+    ).toBe(true);
+
+    const profile = yield* IAM.getInstanceProfile({
+      InstanceProfileName: resources.profile.instanceProfileName,
+    });
+    expect(profile.InstanceProfile.Roles[0]?.RoleName).toBe(
+      resources.role.roleName,
+    );
+
+    yield* stack.destroy();
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Policy.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Policy.test.ts
new file mode 100644
index 00000000000..42f2438fa64
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Policy.test.ts
@@ -0,0 +1,77 @@
+import * as AWS from "@/AWS";
+import { Policy } from "@/AWS/IAM";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider("create, update, and delete managed policy", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const policy = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Policy("IamPolicy", {
+          policyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Action: ["s3:ListBucket"],
+                Resource: ["*"],
+              },
+            ],
+          },
+          tags: {
+            env: "test",
+          },
+        });
+      }),
+    );
+
+    const created = yield* IAM.getPolicy({
+      PolicyArn: policy.policyArn,
+    });
+    expect(created.Policy?.PolicyName).toBe(policy.policyName);
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Policy("IamPolicy", {
+          policyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Effect: "Allow",
+                Action: ["s3:GetObject"],
+                Resource: ["*"],
+              },
+            ],
+          },
+          tags: {
+            env: "prod",
+          },
+        });
+      }),
+    );
+
+    const updatedTags = yield* IAM.listPolicyTags({
+      PolicyArn: policy.policyArn,
+    });
+    expect(
+      Object.fromEntries(
+        (updatedTags.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+      ),
+    ).toMatchObject({
+      env: "prod",
+    });
+
+    yield* stack.destroy();
+
+    const deleted = yield* IAM.getPolicy({
+      PolicyArn: policy.policyArn,
+    }).pipe(Effect.option);
+    expect(deleted._tag).toBe("None");
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Role.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Role.test.ts
new file mode 100644
index 00000000000..7eb487964b0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Role.test.ts
@@ -0,0 +1,215 @@
+import { adopt } from "@/AdoptPolicy";
+import * as AWS from "@/AWS";
+import { Role } from "@/AWS/IAM";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const assumeRolePolicy = {
+  Version: "2012-10-17" as const,
+  Statement: [
+    {
+      Effect: "Allow" as const,
+      Principal: {
+        Service: "lambda.amazonaws.com",
+      },
+      Action: ["sts:AssumeRole"],
+    },
+  ],
+};
+
+test.provider("create, update, and delete role", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const role = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Role("IamRole", {
+          assumeRolePolicyDocument: assumeRolePolicy,
+          managedPolicyArns: [
+            "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+          ],
+          inlinePolicies: {
+            AllowLogs: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Action: ["logs:CreateLogGroup"],
+                  Resource: "*",
+                },
+              ],
+            },
+          },
+          tags: {
+            env: "test",
+          },
+        });
+      }),
+    );
+
+    const created = yield* IAM.getRole({
+      RoleName: role.roleName,
+    });
+    expect(created.Role.RoleName).toBe(role.roleName);
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Role("IamRole", {
+          assumeRolePolicyDocument: assumeRolePolicy,
+          managedPolicyArns: [],
+          inlinePolicies: {
+            AllowLogs: {
+              Version: "2012-10-17",
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Action: ["logs:CreateLogStream"],
+                  Resource: "*",
+                },
+              ],
+            },
+          },
+          tags: {
+            env: "prod",
+          },
+        });
+      }),
+    );
+
+    const updatedTags = yield* IAM.listRoleTags({
+      RoleName: role.roleName,
+    });
+    expect(
+      Object.fromEntries(
+        (updatedTags.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+      ),
+    ).toMatchObject({
+      env: "prod",
+    });
+
+    yield* stack.destroy();
+
+    const deleted = yield* IAM.getRole({
+      RoleName: role.roleName,
+    }).pipe(Effect.option);
+    expect(deleted._tag).toBe("None");
+  }),
+);
+
+// Engine-level adoption tests for IAM Role. Note: the user must supply an
+// explicit `roleName` for adoption to work across a state-store wipe —
+// without one, `createPhysicalName` derives a fresh name from a per-deploy
+// random `instanceId`, so the cold-start `read` lookup would never find
+// the original role.
+test.provider(
+  "owned role (matching alchemy tags) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const roleName = `alchemy-test-role-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Role("AdoptableRole", {
+            roleName,
+            assumeRolePolicyDocument: assumeRolePolicy,
+          });
+        }),
+      );
+
+      // Wipe state — the role stays in IAM.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableRole",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Role("AdoptableRole", {
+            roleName,
+            assumeRolePolicyDocument: assumeRolePolicy,
+          });
+        }),
+      );
+
+      expect(adopted.roleArn).toEqual(initial.roleArn);
+      expect(adopted.roleName).toEqual(roleName);
+
+      yield* stack.destroy();
+
+      const deleted = yield* IAM.getRole({ RoleName: roleName }).pipe(
+        Effect.option,
+      );
+      expect(deleted._tag).toBe("None");
+    }),
+);
+
+test.provider(
+  "foreign-tagged role requires adopt(true) to take over",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      // Use a deterministic shared physical name for both deploys.
+      const sharedRoleName = `alchemy-test-role-takeover-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      const original = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Role("Original", {
+            roleName: sharedRoleName,
+            assumeRolePolicyDocument: assumeRolePolicy,
+          });
+        }),
+      );
+
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "Original",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      const takenOver = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* Role("Different", {
+              roleName: sharedRoleName,
+              assumeRolePolicyDocument: assumeRolePolicy,
+            });
+          }),
+        )
+        .pipe(adopt(true));
+
+      expect(takenOver.roleArn).toEqual(original.roleArn);
+
+      // After adoption, tags should now identify this stack/stage/id.
+      const tagsResp = yield* IAM.listRoleTags({ RoleName: sharedRoleName });
+      const tagMap = Object.fromEntries(
+        (tagsResp.Tags ?? []).map((t) => [t.Key, t.Value]),
+      );
+      expect(tagMap["alchemy::id"]).toEqual("Different");
+
+      yield* stack.destroy();
+
+      const deleted = yield* IAM.getRole({ RoleName: sharedRoleName }).pipe(
+        Effect.option,
+      );
+      expect(deleted._tag).toBe("None");
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Sensitive.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Sensitive.test.ts
new file mode 100644
index 00000000000..c09887864e7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/Sensitive.test.ts
@@ -0,0 +1,63 @@
+import * as AWS from "@/AWS";
+import { AccessKey, LoginProfile, User } from "@/AWS/IAM";
+import * as Test from "@/Test/Vitest";
+import * as IAM from "@distilled.cloud/aws/iam";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.IAM sensitive resources", () => {
+  test.provider(
+    "create, update, and delete access key plus login profile",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const resources = yield* stack.deploy(
+          Effect.gen(function* () {
+            const user = yield* User("CredentialUser", {});
+            const accessKey = yield* AccessKey("AccessKey", {
+              userName: user.userName,
+              status: "Active",
+            });
+            const loginProfile = yield* LoginProfile("LoginProfile", {
+              userName: user.userName,
+              password: "TempPassword123!",
+              passwordResetRequired: true,
+            });
+            return { user, accessKey, loginProfile };
+          }),
+        );
+
+        expect(resources.accessKey.secretAccessKey).toBeDefined();
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const user = yield* User("CredentialUser", {});
+            yield* AccessKey("AccessKey", {
+              userName: user.userName,
+              status: "Inactive",
+            });
+            yield* LoginProfile("LoginProfile", {
+              userName: user.userName,
+              password: "UpdatedPassword123!",
+              passwordResetRequired: false,
+            });
+          }),
+        );
+
+        const accessKeys = yield* IAM.listAccessKeys({
+          UserName: resources.user.userName,
+        });
+        expect(accessKeys.AccessKeyMetadata[0]?.Status).toBe("Inactive");
+
+        const loginProfile = yield* IAM.getLoginProfile({
+          UserName: resources.user.userName,
+        });
+        expect(loginProfile.LoginProfile.PasswordResetRequired).toBe(false);
+
+        yield* stack.destroy();
+      }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/fixtures.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/fixtures.ts
new file mode 100644
index 00000000000..7c8474cfbf0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/fixtures.ts
@@ -0,0 +1,87 @@
+export const testCertificateBody = `-----BEGIN CERTIFICATE-----
+MIICuDCCAaACCQDB190ctLeLgjANBgkqhkiG9w0BAQsFADAeMRwwGgYDVQQDDBNh
+bGNoZW15LWVmZmVjdC10ZXN0MB4XDTI2MDMxMjE4NTczOVoXDTI3MDMxMjE4NTcz
+OVowHjEcMBoGA1UEAwwTYWxjaGVteS1lZmZlY3QtdGVzdDCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJwiwtc5eAckD66lQaHRj+1qHqIO2yaKsXV6DJFg
+q1HhE//fup0fcJIPlKUDDfZlx1cIuvUVO0qlpg8mG9RwKm533j5ysiciBkxmIpvQ
+6xFLbfD/n3w2EcTPbJaqf7guO7hGlfP3wur/SNeKG5U/GuE2Ta6uqCEhj2XQHHdJ
+5Xgz1873txyYcG2+wDhpSbSMMaOvTCWu3BSek5zx0Y2tvb8gVSJQ6cXLf9EIPPUw
+FaiY+oJ24f4BRssF8C++o2te9nFApmyL9cCoM352bj/h4s3LPS/Ogx+HsxUdTjFh
+Lbrg25IosnUuX8ecQcO9R2Ftl4T5kLvb4KaA+knAo55oP9MCAwEAATANBgkqhkiG
+9w0BAQsFAAOCAQEAWKwbO5WCu6+kdEwXq59ZAdBHK/8DLL9frm/i+BaBD+Qjk/gF
+uRBfUXMYvrayWxGnrGgbD5ltHkxkjfpcIoGXcoGiGkpssJ1PrmNhXU+GApvTlx/M
+UIlY96wMzI+k3Vx8nGAuPfWr8+P7JmX0fPojw3XwlD8LICgZcik/q+Y8gf2JEza2
+dcFQa4gdhPj/lZuo9PJrogSnc7opgOkwWcpXHUiixqb/KLCPDFqnEXVjCP24NBGY
+0q4+AE4SoS1uYnh9DRx8lBM9TqahQGsk66OEp9/dUF23CBtRNuU7SS/5oH1Kgq8m
+EI2bc6hl1tMiULo9WrvuVFknk1hx4/Yli2AMmQ==
+-----END CERTIFICATE-----`;
+
+export const testPrivateKey = `-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCcIsLXOXgHJA+u
+pUGh0Y/tah6iDtsmirF1egyRYKtR4RP/37qdH3CSD5SlAw32ZcdXCLr1FTtKpaYP
+JhvUcCpud94+crInIgZMZiKb0OsRS23w/598NhHEz2yWqn+4Lju4RpXz98Lq/0jX
+ihuVPxrhNk2urqghIY9l0Bx3SeV4M9fO97ccmHBtvsA4aUm0jDGjr0wlrtwUnpOc
+8dGNrb2/IFUiUOnFy3/RCDz1MBWomPqCduH+AUbLBfAvvqNrXvZxQKZsi/XAqDN+
+dm4/4eLNyz0vzoMfh7MVHU4xYS264NuSKLJ1Ll/HnEHDvUdhbZeE+ZC72+CmgPpJ
+wKOeaD/TAgMBAAECggEAfl1/1dLUOutLqexjxwSleN/HNR/S7EmZwFtsKojTfyws
+FI3NKfdVE1F622YyebX79IvDTDHHz+1rDZ2pLnEtVkS7YU1QtG1MLa8H2ZXnehLT
+QxaPzGayUNgTqYkKX1VDziuKl25xmeHM4W0MT+lH5vgdPQBsYIwZ06vwLfdnubTw
+GPjXBYHexWrL/Bpm9lPPFcB3kGtQ5T51U34DrBKCKLuckZcdV//91dy8IvrYQsLU
+SbEisoOlztn3IgweKbsMXdHoiKfH1IGiVPKAOReNnDpZWIQoorNHF9A90xuhfZHD
+9PZ4UDu0ywzPfCnY5wi8ZK9+MKgA1mNLDgbiKjY3IQKBgQDInGMnKBHL3lqKA93F
+WFM2jukTWSToPn8jTGtdg6cJ6eXNu1y54Xf2Ws/Y2Opf26iWopmWGExJ6gsyPng6
+pUBZ3MyFdRF7/hX9tN2d9XmLB1ULjMQinljfEemmb/NEk8PmRvZiBEaQcWZqJd1H
+3J2aNf4IA+QsMCgvLjfiLWPfkQKBgQDHPsbuZcd8IeGbHgSfQ6NB4LG2dgtn+QL0
+fzW5ppS+cfRSZGlugAftL8yvE4lY0OL6KHn2GV4hHkbK4Jf1+3NtLNLP/ZUWG1n+
+CgQ0zbUiGe48Fjiw3t/eTVRmU5O342CeIlQx0ZCYgmh4HGYewtHWATHz87uPYjId
+6xdkE/w/IwKBgBwTZv0P6o2xrNIsAFmiJuM31P7UNwoZ1QlHpK8Nwc7tYTANzMhm
++bcMtpIOqZ6Iy2tpjj0nYWXmz3JUs9bhUcRB1o3G+I912/YJ3gpBVKVUfV6EcN63
+cpClnSGiAVXTqFMOE2VcW9PTSxYH/pQUGCqA6/CLOt/ETZtsyH1rBNNBAoGAE2GY
+6kG+SOXm0zb1TiS/Mb5QqyYKb/+5+NyS9k8s8uWU1Zrs4pHTs4/Nwk4NMzWGjrz3
+OCg5jtEqI7v7LDNchAczLoZFRVQ9ycdhp11HPFz3XqLuus3DSxWMmzOQD/gvQtKm
+C/6NqTguP1jL2jwrOzz8hfV0jjsIEv72VIbZJ68CgYBVGQlMbxn0FgAKmkQjS3H8
+NxJgkyRs59+YrN9v3ZkHs7I2krxrFIWkOyNKgvaTt3/rpx0IK8URYoR+pAWA8I9r
+hmxwC/rv7MHPe/R/EDnfLRgdpCV4MEP2nbHcVIN23z/VaxS07h3UXkc7iPibN5hY
+6GSLFl3fVUvo8nWbAm8/Bg==
+-----END PRIVATE KEY-----`;
+
+export const testSshPublicKey =
+  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDf2JQ857siVWa30QTOix63EDnH3t6SzjmNp5ps1XDPrVCLbWMvvN2I17uRIydtWm3mM8BLz5JvDLbJMWgAo+imslqC+GW1UcDTzx8Hcrg5hUUSwHrYgpq6JBdIwVjshO/dgzGjnVIM9aYbKIOSYdahRrY9ORyyuEK+u46M+04GE6f5KYk0hQMXXdJTBsukXJMSz82kkTyRkyuLaw06+TCNLv+Ui8y9d2VtrG2cIeo6XWfGw+NTYG5O9BaBqxpuuDeslLfLtiTXy7E6dgTk9Qo6/5s30As2dcPLD8nwP1IKeKXCB1IvMWgiSV+lC8HlRgm2udGs92jW6pX4XZmMR2Wd alchemy-test-rsa";
+
+const testCertificateBase64 = testCertificateBody.replace(
+  /-----BEGIN CERTIFICATE-----|-----END CERTIFICATE-----|\n/g,
+  "",
+);
+
+export const testSamlMetadataDocument = `<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:alchemy:test:idp">
+  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>${testCertificateBase64}</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/sso" />
+  </IDPSSODescriptor>
+</EntityDescriptor>`;
+
+export const testSamlMetadataDocumentUpdated = `<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:alchemy:test:idp:updated">
+  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>${testCertificateBase64}</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/sso/updated" />
+  </IDPSSODescriptor>
+</EntityDescriptor>`;
+
+export const testOidcUrl = "https://example.com/alchemy-oidc";
+export const testOidcThumbprintA = "1111111111111111111111111111111111111111";
+export const testOidcThumbprintB = "2222222222222222222222222222222222222222";
+export const testSamlProviderName = "alchemy-saml-provider";
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/Bindings.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/Bindings.test.ts
new file mode 100644
index 00000000000..93412c878db
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/Bindings.test.ts
@@ -0,0 +1,327 @@
+import * as AWS from "@/AWS";
+import * as Alchemy from "@/index.ts";
+import * as State from "@/State";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import KinesisApiFunctionLive, {
+  KinesisApiFunction,
+  StreamAndConsumer,
+} from "./handler.ts";
+
+const providers = AWS.providers();
+const state = State.localState();
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers,
+  state,
+});
+
+const Stack = Alchemy.Stack(
+  "kinesis-bindings",
+  { providers, state },
+  Effect.gen(function* () {
+    // Share one stream/consumer between the deployed function and the stack
+    // outputs so the test can assert the live API responses against the known
+    // names without round-tripping them through the fixture's runtime.
+    const { stream, consumer } = yield* StreamAndConsumer;
+    const fn = yield* KinesisApiFunction;
+    return {
+      url: fn.functionUrl.as<string>(),
+      streamName: stream.streamName.as<string>(),
+      consumerName: consumer.consumerName.as<string>(),
+    };
+  }).pipe(Effect.provide(KinesisApiFunctionLive)),
+);
+
+const stack = beforeAll(deploy(Stack), { timeout: 240_000 });
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack), { timeout: 60_000 });
+
+// Lambda Function URLs cold-start (DNS, init) and a fresh role's IAM grants
+// (eventual consistency) can both take a while on the first hit. Retrying on
+// any non-200 lets the first request wait through that window; warm calls
+// return on the first try and never retry.
+const readinessSchedule = Schedule.fixed("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(75)),
+);
+
+// Lambda Function URLs come back with a trailing slash (`https://…on.aws/`).
+// Naively concatenating `${baseUrl}${path}` would yield a double slash
+// (`…on.aws//stream`), whose pathname (`//stream`) never matches the fixture's
+// `/stream` route, so every request 404s and the readiness retry spins until
+// the test times out. Strip the trailing slash before joining.
+const urlOf = (baseUrl: string, path: string) =>
+  `${baseUrl.replace(/\/+$/, "")}${path}`;
+
+const getJson = (baseUrl: string, path: string) =>
+  HttpClient.get(urlOf(baseUrl, path)).pipe(
+    Effect.flatMap((response) =>
+      response.status === 200
+        ? response.json
+        : Effect.fail(new Error(`Request failed: ${response.status}`)),
+    ),
+    Effect.retry({ schedule: readinessSchedule }),
+  );
+
+const postJson = (baseUrl: string, path: string, body: unknown) =>
+  HttpClient.execute(
+    HttpClientRequest.bodyJsonUnsafe(
+      HttpClientRequest.post(urlOf(baseUrl, path)),
+      body,
+    ),
+  ).pipe(
+    Effect.flatMap((response) =>
+      response.status === 200
+        ? response.json
+        : Effect.fail(new Error(`Request failed: ${response.status}`)),
+    ),
+    Effect.retry({ schedule: readinessSchedule }),
+  );
+
+const getFirstShardId = (baseUrl: string) =>
+  getJson(baseUrl, "/shards").pipe(
+    Effect.map((response) => (response as any).Shards?.[0]?.ShardId as string),
+  );
+
+describe.sequential("Kinesis Bindings", () => {
+  describe("DescribeAccountSettings", () => {
+    test(
+      "returns the account settings payload",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* getJson(url, "/account-settings");
+        if ((response as any).ok === false) {
+          expect((response as any).error).toBeTruthy();
+        } else {
+          expect((response as any).value).toBeDefined();
+        }
+      }),
+    );
+  });
+
+  describe("DescribeLimits", () => {
+    test(
+      "returns shard and stream limits",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* getJson(url, "/limits");
+        if ((response as any).ok === false) {
+          expect((response as any).error).toBeTruthy();
+        } else {
+          expect((response as any).value.ShardLimit).toBeGreaterThan(0);
+        }
+      }),
+    );
+  });
+
+  describe("ListStreams", () => {
+    test(
+      "lists the deployed stream",
+      Effect.gen(function* () {
+        // Kinesis ListStreams is paginated and the alchemy binding wraps
+        // the single-page operation. On an account with > 100 streams our
+        // brand-new stream may simply not be on page 1. Just verify the
+        // binding returns an Array; the specific stream is verified via
+        // DescribeStream below.
+        const { url } = yield* stack;
+        const response = yield* getJson(url, "/streams");
+        const names = (response as any).StreamNames ?? [];
+        expect(Array.isArray(names)).toBe(true);
+      }),
+    );
+  });
+
+  describe("DescribeStream", () => {
+    test(
+      "describes the bound stream",
+      Effect.gen(function* () {
+        const { url, streamName } = yield* stack;
+        const response = yield* getJson(url, "/stream");
+        expect((response as any).StreamDescription.StreamName).toBe(streamName);
+      }),
+    );
+  });
+
+  describe("DescribeStreamSummary", () => {
+    test(
+      "describes the bound stream summary",
+      Effect.gen(function* () {
+        const { url, streamName } = yield* stack;
+        const response = yield* getJson(url, "/stream-summary");
+        expect((response as any).StreamDescriptionSummary.StreamName).toBe(
+          streamName,
+        );
+      }),
+    );
+  });
+
+  describe("GetResourcePolicy", () => {
+    test(
+      "returns the stream policy or a structured error",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* getJson(url, "/resource-policy");
+        if ((response as any).ok === false) {
+          expect((response as any).error).toBeTruthy();
+        } else {
+          expect((response as any).value).toBeDefined();
+        }
+      }),
+    );
+  });
+
+  describe("ListShards", () => {
+    test(
+      "lists shards for the stream",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* getJson(url, "/shards");
+        expect(((response as any).Shards ?? []).length).toBeGreaterThan(0);
+      }),
+    );
+  });
+
+  describe("GetShardIterator", () => {
+    test(
+      "returns a shard iterator for the first shard",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const shardId = yield* getFirstShardId(url);
+        const response = yield* postJson(url, "/iterator", { shardId });
+        expect((response as any).ShardIterator).toBeTruthy();
+      }),
+    );
+  });
+
+  describe("GetRecords", () => {
+    test(
+      "reads a just-written record through the shard iterator",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const shardId = yield* getFirstShardId(url);
+        const marker = `records-${crypto.randomUUID()}`;
+        const response = yield* postJson(url, "/records", {
+          shardId,
+          partitionKey: "records-test",
+          data: marker,
+        });
+        const records = (response as any).records ?? [];
+        expect(records.some((record: any) => record.data === marker)).toBe(
+          true,
+        );
+      }),
+    );
+  });
+
+  describe("ListStreamConsumers", () => {
+    test(
+      "lists the registered consumer",
+      Effect.gen(function* () {
+        const { url, consumerName } = yield* stack;
+        const response = yield* getJson(url, "/stream-consumers");
+        const consumers = (response as any).Consumers ?? [];
+        expect(
+          consumers.some(
+            (consumer: any) => consumer.ConsumerName === consumerName,
+          ),
+        ).toBe(true);
+      }),
+    );
+  });
+
+  describe("DescribeStreamConsumer", () => {
+    test(
+      "describes the registered consumer",
+      Effect.gen(function* () {
+        const { url, consumerName } = yield* stack;
+        const response = yield* getJson(url, "/consumer");
+        expect((response as any).ConsumerDescription.ConsumerName).toBe(
+          consumerName,
+        );
+      }),
+    );
+  });
+
+  describe("SubscribeToShard", () => {
+    test(
+      "opens a subscribe-to-shard stream",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const shardId = yield* getFirstShardId(url);
+        const response = yield* postJson(url, "/subscribe", { shardId });
+        expect((response as any).ok).toBe(true);
+      }),
+    );
+  });
+
+  describe("ListTagsForResource", () => {
+    test(
+      "lists the stream ownership tags",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* getJson(url, "/tags");
+        const keys = ((response as any).Tags ?? []).map((tag: any) => tag.Key);
+        expect(keys).toContain("alchemy::stack");
+        expect(keys).toContain("alchemy::stage");
+        expect(keys).toContain("alchemy::id");
+        expect(keys).toContain("fixture");
+      }),
+    );
+  });
+
+  describe("PutRecord", () => {
+    test(
+      "writes a single record",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* postJson(url, "/put-record", {
+          partitionKey: "put-record",
+          data: `put-record-${crypto.randomUUID()}`,
+        });
+        expect((response as any).ShardId).toBeTruthy();
+        expect((response as any).SequenceNumber).toBeTruthy();
+      }),
+    );
+  });
+
+  describe("PutRecords", () => {
+    test(
+      "writes a batch of records",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* postJson(url, "/put-records", {
+          records: [
+            {
+              partitionKey: "put-records",
+              data: `batch-1-${crypto.randomUUID()}`,
+            },
+            {
+              partitionKey: "put-records",
+              data: `batch-2-${crypto.randomUUID()}`,
+            },
+          ],
+        });
+        expect((response as any).FailedRecordCount ?? 0).toBe(0);
+        expect(((response as any).Records ?? []).length).toBe(2);
+      }),
+    );
+  });
+
+  describe("StreamSink", () => {
+    test(
+      "writes records through the sink helper",
+      Effect.gen(function* () {
+        const { url } = yield* stack;
+        const response = yield* postJson(url, "/sink", {
+          records: [
+            { partitionKey: "sink", data: `sink-1-${crypto.randomUUID()}` },
+            { partitionKey: "sink", data: `sink-2-${crypto.randomUUID()}` },
+          ],
+        });
+        expect((response as any).ok).toBe(true);
+      }),
+    );
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/Stream.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/Stream.test.ts
new file mode 100644
index 00000000000..c71b2943ba7
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/Stream.test.ts
@@ -0,0 +1,668 @@
+import { adopt } from "@/AdoptPolicy";
+import * as AWS from "@/AWS";
+import { Stream } from "@/AWS/Kinesis";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.Kinesis.Stream", () => {
+  test.provider(
+    "create and delete stream with default props",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("DefaultStream");
+          }),
+        );
+
+        expect(stream.streamName).toBeDefined();
+        expect(stream.streamArn).toBeDefined();
+        expect(stream.streamStatus).toEqual("ACTIVE");
+
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(streamDescription.StreamDescriptionSummary.StreamStatus).toEqual(
+          "ACTIVE",
+        );
+        expect(
+          streamDescription.StreamDescriptionSummary.StreamModeDetails
+            ?.StreamMode,
+        ).toEqual("ON_DEMAND");
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "create, update, delete on-demand stream with tags",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("TestStream", {
+              streamMode: "ON_DEMAND",
+              tags: { Environment: "test" },
+            });
+          }),
+        );
+
+        // Verify the stream was created
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(streamDescription.StreamDescriptionSummary.StreamStatus).toEqual(
+          "ACTIVE",
+        );
+        expect(
+          streamDescription.StreamDescriptionSummary.StreamModeDetails
+            ?.StreamMode,
+        ).toEqual("ON_DEMAND");
+        expect(
+          streamDescription.StreamDescriptionSummary.RetentionPeriodHours,
+        ).toEqual(24);
+
+        // Verify tags
+        const tagging = yield* Kinesis.listTagsForStream({
+          StreamName: stream.streamName,
+        });
+        expect(tagging.Tags).toContainEqual({
+          Key: "Environment",
+          Value: "test",
+        });
+
+        // Update the stream - increase retention period and update tags
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("TestStream", {
+              streamMode: "ON_DEMAND",
+              retentionPeriodHours: 48,
+              tags: { Environment: "production", Team: "platform" },
+            });
+          }),
+        );
+
+        // Verify the retention period was updated
+        const updatedDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          updatedDescription.StreamDescriptionSummary.RetentionPeriodHours,
+        ).toEqual(48);
+
+        // Verify tags were updated
+        const updatedTagging = yield* Kinesis.listTagsForStream({
+          StreamName: stream.streamName,
+        });
+        expect(updatedTagging.Tags).toContainEqual({
+          Key: "Environment",
+          Value: "production",
+        });
+        expect(updatedTagging.Tags).toContainEqual({
+          Key: "Team",
+          Value: "platform",
+        });
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "create provisioned stream with shards",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("ProvisionedStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 2,
+            });
+          }),
+        );
+
+        // Verify the stream was created with shards
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(streamDescription.StreamDescriptionSummary.StreamStatus).toEqual(
+          "ACTIVE",
+        );
+        expect(
+          streamDescription.StreamDescriptionSummary.StreamModeDetails
+            ?.StreamMode,
+        ).toEqual("PROVISIONED");
+        expect(
+          streamDescription.StreamDescriptionSummary.OpenShardCount,
+        ).toEqual(2);
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "update provisioned stream shard count",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("ShardStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 1,
+            });
+          }),
+        );
+
+        // Verify initial shard count
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          streamDescription.StreamDescriptionSummary.OpenShardCount,
+        ).toEqual(1);
+
+        // Update shard count
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("ShardStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 2,
+            });
+          }),
+        );
+
+        // Verify shard count was updated
+        const updatedDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          updatedDescription.StreamDescriptionSummary.OpenShardCount,
+        ).toEqual(2);
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 300_000 },
+  );
+
+  test.provider(
+    "create stream with custom name",
+    (stack) =>
+      Effect.gen(function* () {
+        const customName = `test-custom-kinesis-stream-custom-name-stream`;
+
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("CustomNameStream", {
+              streamName: customName,
+            });
+          }),
+        );
+
+        expect(stream.streamName).toEqual(customName);
+        expect(stream.streamArn).toContain(customName);
+
+        // Verify the stream exists
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: customName,
+        });
+        expect(streamDescription.StreamDescriptionSummary.StreamName).toEqual(
+          customName,
+        );
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(customName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "create stream with encryption",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("EncryptedStream", {
+              encryption: true,
+            });
+          }),
+        );
+
+        // Verify the stream has encryption enabled
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          streamDescription.StreamDescriptionSummary.EncryptionType,
+        ).toEqual("KMS");
+
+        // Update to disable encryption
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("EncryptedStream", {
+              encryption: false,
+            });
+          }),
+        );
+
+        // Verify encryption is disabled
+        const updatedDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          updatedDescription.StreamDescriptionSummary.EncryptionType,
+        ).toEqual("NONE");
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "create stream with enhanced monitoring and update metrics",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("MonitoredStream", {
+              shardLevelMetrics: ["IncomingBytes", "OutgoingRecords"],
+            });
+          }),
+        );
+
+        // Verify enhanced monitoring is enabled
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        const metrics =
+          streamDescription.StreamDescriptionSummary.EnhancedMonitoring?.[0]
+            ?.ShardLevelMetrics ?? [];
+        expect(metrics).toContain("IncomingBytes");
+        expect(metrics).toContain("OutgoingRecords");
+
+        // Update metrics - add some, remove some
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("MonitoredStream", {
+              shardLevelMetrics: [
+                "IncomingBytes",
+                "IncomingRecords",
+                "IteratorAgeMilliseconds",
+              ],
+            });
+          }),
+        );
+
+        // Verify metrics were updated
+        const updatedDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        const updatedMetrics =
+          updatedDescription.StreamDescriptionSummary.EnhancedMonitoring?.[0]
+            ?.ShardLevelMetrics ?? [];
+        expect(updatedMetrics).toContain("IncomingBytes");
+        expect(updatedMetrics).toContain("IncomingRecords");
+        expect(updatedMetrics).toContain("IteratorAgeMilliseconds");
+        expect(updatedMetrics).not.toContain("OutgoingRecords");
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "idempotent create - stream already exists",
+    (stack) =>
+      Effect.gen(function* () {
+        // First create
+        const stream1 = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("IdempotentStream", {});
+          }),
+        );
+        const streamName = stream1.streamName;
+
+        // Second create (should be idempotent)
+        const stream2 = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("IdempotentStream", {});
+          }),
+        );
+        expect(stream2.streamName).toEqual(streamName);
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "switch stream mode from provisioned to on-demand",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("ModeChangeStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 1,
+            });
+          }),
+        );
+
+        // Verify provisioned mode
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          streamDescription.StreamDescriptionSummary.StreamModeDetails
+            ?.StreamMode,
+        ).toEqual("PROVISIONED");
+
+        // Update to on-demand mode
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("ModeChangeStream", {
+              streamMode: "ON_DEMAND",
+            });
+          }),
+        );
+
+        // Verify on-demand mode
+        const updatedDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          updatedDescription.StreamDescriptionSummary.StreamModeDetails
+            ?.StreamMode,
+        ).toEqual("ON_DEMAND");
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 300_000 },
+  );
+
+  test.provider(
+    "decrease retention period",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("RetentionStream", {
+              retentionPeriodHours: 48,
+            });
+          }),
+        );
+
+        // Verify initial retention period
+        const streamDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          streamDescription.StreamDescriptionSummary.RetentionPeriodHours,
+        ).toEqual(48);
+
+        // Decrease retention period back to default
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("RetentionStream", {
+              retentionPeriodHours: 24,
+            });
+          }),
+        );
+
+        // Verify retention period was decreased
+        const updatedDescription = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          updatedDescription.StreamDescriptionSummary.RetentionPeriodHours,
+        ).toEqual(24);
+
+        yield* stack.destroy();
+
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 180_000 },
+  );
+
+  test.provider(
+    "update stream resource policy and max record size",
+    (stack) =>
+      Effect.gen(function* () {
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("PolicyStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 1,
+            });
+          }),
+        );
+
+        const policy = JSON.stringify({
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Sid: "AllowSameAccountDescribe",
+              Effect: "Allow",
+              Principal: {
+                AWS: `arn:aws:iam::${stream.streamArn.split(":")[4]}:root`,
+              },
+              Action: ["kinesis:DescribeStreamSummary"],
+              Resource: stream.streamArn,
+            },
+          ],
+        });
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("PolicyStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 1,
+              resourcePolicy: policy,
+              maxRecordSizeInKiB: 2048,
+            });
+          }),
+        );
+
+        expect(updated.resourcePolicy).toContain("AllowSameAccountDescribe");
+        expect(updated.maxRecordSizeInKiB).toEqual(2048);
+
+        const policyResponse = yield* Kinesis.getResourcePolicy({
+          ResourceARN: stream.streamArn,
+        });
+        expect(policyResponse.Policy).toContain("AllowSameAccountDescribe");
+
+        const summary = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(summary.StreamDescriptionSummary.MaxRecordSizeInKiB).toEqual(
+          2048,
+        );
+
+        yield* stack.destroy();
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 240_000 },
+  );
+
+  test.provider(
+    "update warm throughput when account supports it",
+    (stack) =>
+      Effect.gen(function* () {
+        const accountSettings = yield* Kinesis.describeAccountSettings({});
+        const status =
+          accountSettings.MinimumThroughputBillingCommitment?.Status ??
+          "DISABLED";
+
+        if (status === "DISABLED") {
+          return;
+        }
+
+        const stream = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("WarmThroughputStream");
+          }),
+        );
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("WarmThroughputStream", {
+              warmThroughputMiBps: 10,
+            });
+          }),
+        );
+
+        expect(updated.warmThroughput?.targetMiBps).toEqual(10);
+
+        const summary = yield* Kinesis.describeStreamSummary({
+          StreamName: stream.streamName,
+        });
+        expect(
+          summary.StreamDescriptionSummary.WarmThroughput?.TargetMiBps,
+        ).toEqual(10);
+
+        yield* stack.destroy();
+        yield* assertStreamDeleted(stream.streamName);
+      }),
+    { timeout: 240_000 },
+  );
+
+  test.provider(
+    "owned stream (matching alchemy tags) is silently adopted without --adopt",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const streamName = `alchemy-test-kinesis-adopt-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        const initial = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("AdoptableStream", { streamName });
+          }),
+        );
+        expect(initial.streamName).toEqual(streamName);
+
+        // Wipe state — the stream stays in Kinesis.
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "AdoptableStream",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        const adopted = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("AdoptableStream", { streamName });
+          }),
+        );
+
+        expect(adopted.streamArn).toEqual(initial.streamArn);
+
+        yield* stack.destroy();
+        yield* assertStreamDeleted(streamName);
+      }),
+    { timeout: 240_000 },
+  );
+
+  test.provider(
+    "foreign-tagged stream requires adopt(true) to take over",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const streamName = `alchemy-test-kinesis-takeover-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Stream("Original", { streamName });
+          }),
+        );
+
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "Original",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        const takenOver = yield* stack
+          .deploy(
+            Effect.gen(function* () {
+              return yield* Stream("Different", { streamName });
+            }),
+          )
+          .pipe(adopt(true));
+
+        expect(takenOver.streamName).toEqual(streamName);
+
+        const tagsResp = yield* Kinesis.listTagsForResource({
+          ResourceARN: takenOver.streamArn,
+        });
+        const tagMap = Object.fromEntries(
+          (tagsResp.Tags ?? [])
+            .filter(
+              (t): t is { Key: string; Value: string } =>
+                typeof t.Value === "string",
+            )
+            .map((t) => [t.Key, t.Value]),
+        );
+        expect(tagMap["alchemy::id"]).toEqual("Different");
+
+        yield* stack.destroy();
+        yield* assertStreamDeleted(streamName);
+      }),
+    { timeout: 240_000 },
+  );
+
+  class StreamStillExists extends Data.TaggedError("StreamStillExists") {}
+
+  const assertStreamDeleted = Effect.fn(function* (streamName: string) {
+    yield* Kinesis.describeStreamSummary({
+      StreamName: streamName,
+    }).pipe(
+      Effect.flatMap(() => Effect.fail(new StreamStillExists())),
+      Effect.retry({
+        while: (e: { _tag: string }) =>
+          e._tag === "StreamStillExists" ||
+          // During stream deletion, AWS may return incomplete responses that fail parsing
+          e._tag === "ParseError",
+        schedule: Schedule.exponential(500).pipe(
+          Schedule.both(Schedule.recurs(30)),
+        ),
+      }),
+      Effect.catchTag("ResourceNotFoundException", () => Effect.void),
+    );
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/StreamConsumer.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/StreamConsumer.test.ts
new file mode 100644
index 00000000000..d7d62ffe80d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/StreamConsumer.test.ts
@@ -0,0 +1,98 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.Kinesis.StreamConsumer", () => {
+  test.provider(
+    "create, update tags, and delete a stream consumer",
+    (stack) =>
+      Effect.gen(function* () {
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const stream = yield* AWS.Kinesis.Stream("ConsumerSourceStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 1,
+            });
+
+            const consumer = yield* AWS.Kinesis.StreamConsumer(
+              "AnalyticsConsumer",
+              {
+                streamArn: stream.streamArn,
+                tags: {
+                  fixture: "consumer-test",
+                },
+              },
+            );
+
+            return { stream, consumer };
+          }),
+        );
+
+        const description = yield* Kinesis.describeStreamConsumer({
+          ConsumerARN: deployed.consumer.consumerArn,
+        });
+        expect(description.ConsumerDescription.ConsumerStatus).toEqual(
+          "ACTIVE",
+        );
+
+        const initialTags = yield* Kinesis.listTagsForResource({
+          ResourceARN: deployed.consumer.consumerArn,
+        });
+        expect(initialTags.Tags).toContainEqual({
+          Key: "fixture",
+          Value: "consumer-test",
+        });
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            const stream = yield* AWS.Kinesis.Stream("ConsumerSourceStream", {
+              streamMode: "PROVISIONED",
+              shardCount: 1,
+            });
+
+            const consumer = yield* AWS.Kinesis.StreamConsumer(
+              "AnalyticsConsumer",
+              {
+                streamArn: stream.streamArn,
+                tags: {
+                  fixture: "consumer-test-updated",
+                  team: "platform",
+                },
+              },
+            );
+
+            return { stream, consumer };
+          }),
+        );
+
+        const updatedTags = yield* Kinesis.listTagsForResource({
+          ResourceARN: updated.consumer.consumerArn,
+        });
+        expect(updatedTags.Tags).toContainEqual({
+          Key: "fixture",
+          Value: "consumer-test-updated",
+        });
+        expect(updatedTags.Tags).toContainEqual({
+          Key: "team",
+          Value: "platform",
+        });
+
+        yield* stack.destroy();
+
+        const deleted = yield* Kinesis.describeStreamConsumer({
+          ConsumerARN: updated.consumer.consumerArn,
+        }).pipe(
+          Effect.map(() => false),
+          Effect.catchTag("ResourceNotFoundException", () =>
+            Effect.succeed(true),
+          ),
+        );
+        expect(deleted).toBe(true);
+      }),
+    { timeout: 180_000 },
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/StreamEventSource.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/StreamEventSource.test.ts
new file mode 100644
index 00000000000..35c06698f0e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/StreamEventSource.test.ts
@@ -0,0 +1,119 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import KinesisStreamFunctionLive, {
+  KinesisStreamFunction,
+} from "./stream-handler.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe.sequential("AWS.Kinesis.StreamEventSource", () => {
+  test.provider(
+    "processes real Kinesis records through Lambda",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const streamFunction = yield* stack.deploy(
+          KinesisStreamFunction.pipe(Effect.provide(KinesisStreamFunctionLive)),
+        );
+
+        const functionUrl = streamFunction.functionUrl!;
+
+        const { streamName, streamArn } = yield* HttpClient.get(
+          functionUrl,
+        ).pipe(
+          Effect.flatMap((response) =>
+            response.status === 200
+              ? (response.json as Effect.Effect<{
+                  streamName: string;
+                  streamArn: string;
+                }>)
+              : Effect.fail(
+                  new FunctionNotReady(
+                    `Function not ready: ${response.status}`,
+                  ),
+                ),
+          ),
+          Effect.flatMap((body) =>
+            body.streamName && body.streamArn
+              ? Effect.succeed(body)
+              : Effect.fail(
+                  new FunctionNotReady(
+                    "Function returned empty stream identifiers",
+                  ),
+                ),
+          ),
+          Effect.retry({
+            schedule: Schedule.fixed("1 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+
+        yield* waitForEventSourceMappingEnabled(
+          streamFunction.functionName,
+          streamArn,
+        );
+        yield* Effect.sleep("10 seconds");
+
+        yield* Kinesis.putRecord({
+          StreamName: streamName,
+          PartitionKey: "stream-event-source",
+          Data: new TextEncoder().encode("payload"),
+        });
+        yield* Effect.sleep("5 seconds");
+
+        const mapping = yield* waitForEventSourceMappingEnabled(
+          streamFunction.functionName,
+          streamArn,
+        );
+        expect(mapping.State).toEqual("Enabled");
+
+        yield* stack.destroy();
+      }),
+    { timeout: 240_000 },
+  );
+});
+
+const waitForEventSourceMappingEnabled = Effect.fn(function* (
+  functionName: string,
+  eventSourceArn: string,
+) {
+  return yield* Lambda.listEventSourceMappings({
+    FunctionName: functionName,
+    EventSourceArn: eventSourceArn,
+  }).pipe(
+    Effect.flatMap((result) => {
+      const mapping = result.EventSourceMappings?.[0];
+      if (!mapping || mapping.State !== "Enabled") {
+        return Effect.fail(new EventSourceMappingNotReady());
+      }
+      return Effect.succeed(mapping);
+    }),
+    Effect.retry({
+      while: (error) => error._tag === "EventSourceMappingNotReady",
+      schedule: Schedule.fixed("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+});
+
+class EventSourceMappingNotReady extends Data.TaggedError(
+  "EventSourceMappingNotReady",
+) {}
+
+class FunctionNotReady extends Data.TaggedError("FunctionNotReady")<{
+  message: string;
+}> {
+  constructor(message: string) {
+    super({ message });
+  }
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/handler.ts
new file mode 100644
index 00000000000..a3a3809387f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/handler.ts
@@ -0,0 +1,340 @@
+import * as AWS from "@/AWS";
+import * as Kinesis from "@distilled.cloud/aws/kinesis";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import path from "pathe";
+
+const main = path.resolve(import.meta.dirname, "handler.ts");
+
+export class KinesisApiFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "KinesisApiFunction",
+  {
+    main: import.meta.filename,
+    url: true,
+  },
+) {}
+
+export class StreamAndConsumer extends Context.Service<
+  StreamAndConsumer,
+  {
+    stream: AWS.Kinesis.Stream;
+    consumer: AWS.Kinesis.StreamConsumer;
+  }
+>()("StreamAndConsumer") {}
+
+export const StreamAndConsumerLive = Layer.effect(
+  StreamAndConsumer,
+  Effect.gen(function* () {
+    const stream = yield* AWS.Kinesis.Stream("FixtureStream", {
+      streamMode: "PROVISIONED",
+      shardCount: 1,
+      tags: {
+        fixture: "kinesis-bindings",
+      },
+    });
+
+    const consumer = yield* AWS.Kinesis.StreamConsumer("FixtureConsumer", {
+      streamArn: stream.streamArn,
+      tags: {
+        fixture: "kinesis-bindings",
+      },
+    });
+
+    return {
+      stream,
+      consumer,
+    };
+  }),
+);
+
+export const KinesisApiFunctionLive = KinesisApiFunction.make(
+  Effect.gen(function* () {
+    const { stream, consumer } = yield* StreamAndConsumer;
+
+    const describeAccountSettings =
+      yield* AWS.Kinesis.DescribeAccountSettings.bind();
+    const describeLimits = yield* AWS.Kinesis.DescribeLimits.bind();
+    const listStreams = yield* AWS.Kinesis.ListStreams.bind();
+    const describeStream = yield* AWS.Kinesis.DescribeStream.bind(stream);
+    const describeStreamSummary =
+      yield* AWS.Kinesis.DescribeStreamSummary.bind(stream);
+    const listShards = yield* AWS.Kinesis.ListShards.bind(stream);
+    const getShardIterator = yield* AWS.Kinesis.GetShardIterator.bind(stream);
+    const getRecords = yield* AWS.Kinesis.GetRecords.bind(stream);
+    const getResourcePolicy = yield* AWS.Kinesis.GetResourcePolicy.bind(stream);
+    const listStreamConsumers =
+      yield* AWS.Kinesis.ListStreamConsumers.bind(stream);
+    const describeStreamConsumer =
+      yield* AWS.Kinesis.DescribeStreamConsumer.bind(consumer);
+    const subscribeToShard = yield* AWS.Kinesis.SubscribeToShard.bind(consumer);
+    const listTagsForResource =
+      yield* AWS.Kinesis.ListTagsForResource.bind(stream);
+    const putRecord = yield* AWS.Kinesis.PutRecord.bind(stream);
+    const putRecords = yield* AWS.Kinesis.PutRecords.bind(stream);
+    const sink = yield* AWS.Kinesis.StreamSink.bind(stream);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+        const pathname = url.pathname;
+
+        if (request.method === "GET" && pathname === "/ready") {
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "GET" && pathname === "/account-settings") {
+          const response = yield* describeAccountSettings().pipe(
+            Effect.match({
+              onFailure: (error) => ({
+                ok: false as const,
+                error:
+                  typeof error === "object" && error !== null && "_tag" in error
+                    ? (error as { _tag: string })._tag
+                    : `${error}`,
+              }),
+              onSuccess: (value) => ({
+                ok: true as const,
+                value,
+              }),
+            }),
+          );
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (request.method === "GET" && pathname === "/limits") {
+          const response = yield* describeLimits().pipe(
+            Effect.match({
+              onFailure: (error) => ({
+                ok: false as const,
+                error:
+                  typeof error === "object" && error !== null && "_tag" in error
+                    ? (error as { _tag: string })._tag
+                    : `${error}`,
+              }),
+              onSuccess: (value) => ({
+                ok: true as const,
+                value,
+              }),
+            }),
+          );
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (request.method === "GET" && pathname === "/streams") {
+          return yield* HttpServerResponse.json(yield* listStreams());
+        }
+
+        if (request.method === "GET" && pathname === "/stream") {
+          return yield* HttpServerResponse.json(yield* describeStream());
+        }
+
+        if (request.method === "GET" && pathname === "/stream-summary") {
+          return yield* HttpServerResponse.json(yield* describeStreamSummary());
+        }
+
+        if (request.method === "GET" && pathname === "/resource-policy") {
+          const response = yield* getResourcePolicy().pipe(
+            Effect.match({
+              onFailure: (error) => ({
+                ok: false as const,
+                error:
+                  typeof error === "object" && error !== null && "_tag" in error
+                    ? (error as { _tag: string })._tag
+                    : `${error}`,
+              }),
+              onSuccess: (value) => ({
+                ok: true as const,
+                value,
+              }),
+            }),
+          );
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (request.method === "GET" && pathname === "/shards") {
+          return yield* HttpServerResponse.json(yield* listShards());
+        }
+
+        if (request.method === "GET" && pathname === "/stream-consumers") {
+          return yield* HttpServerResponse.json(yield* listStreamConsumers());
+        }
+
+        if (request.method === "GET" && pathname === "/consumer") {
+          return yield* HttpServerResponse.json(
+            yield* describeStreamConsumer(),
+          );
+        }
+
+        if (request.method === "GET" && pathname === "/tags") {
+          return yield* HttpServerResponse.json(yield* listTagsForResource());
+        }
+
+        if (request.method === "POST" && pathname === "/put-record") {
+          const body = (yield* request.json) as {
+            partitionKey: string;
+            data: string;
+          };
+          return yield* HttpServerResponse.json(
+            yield* putRecord({
+              PartitionKey: body.partitionKey,
+              Data: new TextEncoder().encode(body.data),
+            }),
+          );
+        }
+
+        if (request.method === "POST" && pathname === "/put-records") {
+          const body = (yield* request.json) as {
+            records: Array<{ partitionKey: string; data: string }>;
+          };
+          return yield* HttpServerResponse.json(
+            yield* putRecords({
+              Records: body.records.map((record) => ({
+                PartitionKey: record.partitionKey,
+                Data: new TextEncoder().encode(record.data),
+              })),
+            }),
+          );
+        }
+
+        if (request.method === "POST" && pathname === "/sink") {
+          const body = (yield* request.json) as {
+            records: Array<{ partitionKey: string; data: string }>;
+          };
+          yield* Stream.fromIterable(
+            body.records.map((record) => ({
+              PartitionKey: record.partitionKey,
+              Data: new TextEncoder().encode(record.data),
+            })),
+          ).pipe(Stream.run(sink));
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && pathname === "/iterator") {
+          const body = (yield* request.json) as { shardId: string };
+          return yield* HttpServerResponse.json(
+            yield* getShardIterator({
+              ShardId: body.shardId,
+              ShardIteratorType: "LATEST",
+            }),
+          );
+        }
+
+        if (request.method === "POST" && pathname === "/records") {
+          const body = (yield* request.json) as {
+            shardId: string;
+            partitionKey: string;
+            data: string;
+          };
+
+          const iterator = yield* getShardIterator({
+            ShardId: body.shardId,
+            ShardIteratorType: "LATEST",
+          });
+          const shardIterator = iterator.ShardIterator;
+
+          if (!shardIterator) {
+            return yield* HttpServerResponse.json(
+              { error: "No shard iterator returned" },
+              { status: 500 },
+            );
+          }
+
+          yield* putRecord({
+            PartitionKey: body.partitionKey,
+            Data: new TextEncoder().encode(body.data),
+          });
+
+          const result = yield* waitForRecords(getRecords, shardIterator);
+          return yield* HttpServerResponse.json({
+            records: (result.Records ?? []).map((record) => ({
+              partitionKey: record.PartitionKey,
+              data: decodeText(record.Data),
+            })),
+            millisBehindLatest: result.MillisBehindLatest,
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/subscribe") {
+          const body = (yield* request.json) as { shardId: string };
+          const result = yield* subscribeToShard({
+            ShardId: body.shardId,
+            StartingPosition: {
+              Type: "LATEST",
+            },
+          });
+          return yield* HttpServerResponse.json({
+            ok: result.EventStream !== undefined,
+          });
+        }
+
+        return yield* HttpServerResponse.json(
+          { error: "Not found", method: request.method, pathname },
+          { status: 404 },
+        );
+      }).pipe(Effect.orDie),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(AWS.Kinesis.StreamSinkLive, AWS.Kinesis.PutRecordsLive),
+        Layer.mergeAll(
+          AWS.Kinesis.DescribeAccountSettingsLive,
+          AWS.Kinesis.DescribeLimitsLive,
+          AWS.Kinesis.DescribeStreamLive,
+          AWS.Kinesis.DescribeStreamConsumerLive,
+          AWS.Kinesis.DescribeStreamSummaryLive,
+          AWS.Kinesis.GetRecordsLive,
+          AWS.Kinesis.GetResourcePolicyLive,
+          AWS.Kinesis.GetShardIteratorLive,
+          AWS.Kinesis.ListShardsLive,
+          AWS.Kinesis.ListStreamConsumersLive,
+          AWS.Kinesis.ListStreamsLive,
+          AWS.Kinesis.ListTagsForResourceLive,
+          AWS.Kinesis.PutRecordLive,
+          AWS.Kinesis.PutRecordsLive,
+          AWS.Kinesis.SubscribeToShardLive,
+          StreamAndConsumerLive,
+        ),
+      ),
+    ),
+  ),
+  // Re-merge so the deploying Stack can `yield* StreamAndConsumer` and expose
+  // the stream/consumer names as deploy-time outputs. Reusing the same
+  // `StreamAndConsumerLive` reference keeps it a single shared stream/consumer.
+).pipe(Layer.provideMerge(StreamAndConsumerLive));
+
+export default KinesisApiFunctionLive;
+
+const decodeText = (value: Uint8Array<ArrayBufferLike>) =>
+  new TextDecoder().decode(value);
+
+class RecordsNotReady extends Data.TaggedError("RecordsNotReady") {}
+
+const waitForRecords = (
+  getRecords: (
+    request: Kinesis.GetRecordsInput,
+  ) => Effect.Effect<Kinesis.GetRecordsOutput, Kinesis.GetRecordsError>,
+  shardIterator: string,
+) =>
+  getRecords({
+    ShardIterator: shardIterator,
+  }).pipe(
+    Effect.flatMap((result) =>
+      (result.Records?.length ?? 0) > 0
+        ? Effect.succeed(result)
+        : Effect.fail(new RecordsNotReady()),
+    ),
+    Effect.retry({
+      while: (error) => error._tag === "RecordsNotReady",
+      schedule: Schedule.fixed("1 second").pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/stream-handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/stream-handler.ts
new file mode 100644
index 00000000000..83aab9018b4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Kinesis/stream-handler.ts
@@ -0,0 +1,82 @@
+import * as AWS from "@/AWS";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export class KinesisStreamFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "KinesisStreamFunction",
+  {
+    main: import.meta.filename,
+    url: true,
+  },
+) {}
+
+export class StreamAndQueue extends Context.Service<
+  StreamAndQueue,
+  {
+    stream: AWS.Kinesis.Stream;
+    queue: AWS.SQS.Queue;
+  }
+>()("StreamAndQueue") {}
+
+export const StreamAndQueueLive = Layer.effect(
+  StreamAndQueue,
+  Effect.gen(function* () {
+    const stream = yield* AWS.Kinesis.Stream("EventSourceStream", {
+      streamMode: "PROVISIONED",
+      shardCount: 1,
+    });
+    const queue = yield* AWS.SQS.Queue("KinesisEventSinkQueue");
+
+    return {
+      stream,
+      queue,
+    };
+  }),
+);
+export default KinesisStreamFunction.make(
+  Effect.gen(function* () {
+    const { stream, queue } = yield* StreamAndQueue;
+    const sink = yield* AWS.SQS.QueueSink.bind(queue);
+
+    yield* AWS.Kinesis.records(stream, {
+      startingPosition: "LATEST",
+      batchSize: 10,
+    }).process((records) =>
+      records.pipe(
+        Stream.map((record) =>
+          JSON.stringify({
+            partitionKey: record.kinesis.partitionKey,
+            data: Buffer.from(record.kinesis.data, "base64").toString("utf8"),
+            eventID: record.eventID,
+          }),
+        ),
+        Stream.run(sink),
+      ),
+    );
+
+    const streamName = yield* stream.streamName;
+    const streamArn = yield* stream.streamArn;
+    const queueUrl = yield* queue.queueUrl;
+
+    return {
+      fetch: Effect.gen(function* () {
+        return yield* HttpServerResponse.json({
+          ok: true,
+          streamArn: yield* streamArn,
+          streamName: yield* streamName,
+          queueUrl: yield* queueUrl,
+        });
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(AWS.Lambda.StreamEventSource, AWS.SQS.QueueSinkLive),
+        Layer.mergeAll(AWS.SQS.SendMessageBatchLive, StreamAndQueueLive),
+      ),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/Function.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/Function.test.ts
new file mode 100644
index 00000000000..f442993f950
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/Function.test.ts
@@ -0,0 +1,143 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import { expect } from "@effect/vitest";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { TestFunction, TestFunctionLive } from "./handler.ts";
+
+const timeoutHandlerPath = new URL("./timeout-handler.ts", import.meta.url)
+  .pathname;
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider(
+  "create, update, delete function",
+  (stack) =>
+    Effect.gen(function* () {
+      const { functionName, functionUrl } = yield* stack.deploy(
+        TestFunction.pipe(Effect.provide(TestFunctionLive)),
+      );
+
+      expect(functionUrl).toBeTruthy();
+
+      const response = yield* HttpClient.get(functionUrl!).pipe(
+        Effect.flatMap((response) =>
+          response.status === 200
+            ? Effect.succeed(response)
+            : Effect.fail(
+                new Error(`Function URL returned ${response.status}`),
+              ),
+        ),
+        Effect.tapError((error) => Effect.logError(error)),
+        Effect.retry({
+          schedule: Schedule.exponential(500).pipe(
+            Schedule.both(Schedule.recurs(10)),
+          ),
+        }),
+      );
+
+      expect(response.status).toBe(200);
+      expect(yield* response.text).toBe("Hello, world!");
+
+      const invokePolicy = yield* getPolicyStatement(
+        functionName,
+        "FunctionURLAllowPublicInvoke",
+      );
+      expect(invokePolicy.Condition).toEqual({
+        Bool: {
+          "lambda:InvokedViaFunctionUrl": "true",
+        },
+      });
+    }).pipe(
+      Effect.tap(() => stack.destroy()),
+      Effect.onError(() => stack.destroy().pipe(Effect.ignore)),
+    ),
+  { timeout: 180_000 },
+);
+
+test.provider(
+  "applies and updates the Lambda timeout",
+  (stack) =>
+    Effect.gen(function* () {
+      const initial = yield* stack.deploy(
+        AWS.Lambda.Function<{}>()("TimeoutFn", {
+          main: timeoutHandlerPath,
+          handler: "handler",
+          isExternal: true,
+          url: false,
+          timeout: Duration.seconds(15),
+        }),
+      );
+
+      const initialConfig = yield* Lambda.getFunction({
+        FunctionName: initial.functionName,
+      });
+      expect(initialConfig.Configuration?.Timeout).toBe(15);
+
+      yield* stack.deploy(
+        AWS.Lambda.Function<{}>()("TimeoutFn", {
+          main: timeoutHandlerPath,
+          handler: "handler",
+          isExternal: true,
+          url: false,
+          timeout: Duration.seconds(45),
+        }),
+      );
+
+      const updatedConfig = yield* Lambda.getFunction({
+        FunctionName: initial.functionName,
+      }).pipe(
+        Effect.filterOrFail(
+          (c) => c.Configuration?.Timeout === 45,
+          () => new Error("Timeout update has not propagated yet"),
+        ),
+        Effect.retry({
+          schedule: Schedule.exponential(500).pipe(
+            Schedule.both(Schedule.recurs(10)),
+          ),
+        }),
+      );
+      expect(updatedConfig.Configuration?.Timeout).toBe(45);
+    }).pipe(
+      Effect.tap(() => stack.destroy()),
+      Effect.onError(() => stack.destroy().pipe(Effect.ignore)),
+    ),
+  { timeout: 360_000 },
+);
+
+const getPolicyStatement = Effect.fn(function* (
+  functionName: string,
+  statementId: string,
+) {
+  return yield* Lambda.getPolicy({ FunctionName: functionName }).pipe(
+    Effect.flatMap(({ Policy }) =>
+      Effect.try({
+        try: () => {
+          const policy = JSON.parse(Policy ?? "{}") as {
+            Statement?: Array<{
+              Sid?: string;
+              Condition?: unknown;
+            }>;
+          };
+          const statement = policy.Statement?.find(
+            (statement) => statement.Sid === statementId,
+          );
+          if (!statement) {
+            throw new Error(`Policy statement ${statementId} not found`);
+          }
+          return statement;
+        },
+        catch: (cause) =>
+          cause instanceof Error ? cause : new Error(String(cause)),
+      }),
+    ),
+    Effect.retry({
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/HttpServer.fixture.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/HttpServer.fixture.ts
new file mode 100644
index 00000000000..cbd3cb26df5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/HttpServer.fixture.ts
@@ -0,0 +1,61 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export const TestHttpEffect = Effect.gen(function* () {
+  const request = yield* HttpServerRequest;
+  const url = new URL(request.originalUrl);
+  const pathname = url.pathname;
+
+  if (request.method === "GET" && pathname === "/inspect") {
+    return yield* HttpServerResponse.json({
+      method: request.method,
+      url: request.url,
+      originalUrl: request.originalUrl,
+      host: request.headers.host,
+      protocol: request.headers["x-forwarded-proto"],
+      requestId: request.headers["x-request-id"],
+      remoteAddress: Option.getOrUndefined(request.remoteAddress),
+      query: Object.fromEntries(url.searchParams.entries()),
+      cookies: request.cookies,
+    });
+  }
+
+  if (request.method === "POST" && pathname === "/jobs") {
+    const payload = (yield* request.json) as { content: string };
+    const response = yield* HttpServerResponse.json(
+      {
+        method: request.method,
+        url: request.url,
+        payload,
+      },
+      {
+        status: 201,
+        headers: {
+          "x-handler": "lambda-http",
+        },
+      },
+    );
+
+    return HttpServerResponse.setCookieUnsafe(
+      response,
+      "job-session",
+      "created",
+      {
+        httpOnly: true,
+        path: "/",
+      },
+    );
+  }
+
+  if (request.method === "GET" && pathname === "/binary") {
+    return HttpServerResponse.uint8Array(new TextEncoder().encode("alchemy"), {
+      headers: {
+        "content-type": "application/octet-stream",
+      },
+    });
+  }
+
+  return HttpServerResponse.text("Not found", { status: 404 });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/HttpServer.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/HttpServer.test.ts
new file mode 100644
index 00000000000..01d1ddf3a31
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/HttpServer.test.ts
@@ -0,0 +1,220 @@
+import { makeFunctionHttpHandler } from "@/AWS/Lambda/HttpServer";
+import type {
+  LambdaFunctionURLEvent,
+  LambdaFunctionURLResult,
+} from "aws-lambda";
+import * as Effect from "effect/Effect";
+import type { Scope } from "effect/Scope";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { describe, expect, it } from "vitest";
+import { TestHttpEffect } from "./HttpServer.fixture";
+
+describe("AWS.Lambda.HttpServer", () => {
+  it("maps a Function URL event into HttpServerRequest", async () => {
+    const result = asStructuredResult(
+      await invoke(
+        makeEvent({
+          rawPath: "/inspect",
+          rawQueryString: "jobId=job-123&trace=1",
+          headers: {
+            "x-forwarded-proto": "https",
+            "x-request-id": "req-123",
+          },
+          cookies: ["session=abc", "theme=dark"],
+          requestContext: {
+            http: {
+              method: "GET",
+              path: "/inspect",
+              sourceIp: "203.0.113.42",
+            },
+          } as LambdaFunctionURLEvent["requestContext"],
+        }),
+      ),
+    );
+
+    expect(result.statusCode).toBe(200);
+    expect(result.headers?.["content-type"]).toContain("application/json");
+    expect(JSON.parse(result.body ?? "")).toEqual({
+      method: "GET",
+      url: "https://example.lambda-url.us-east-1.on.aws/inspect?jobId=job-123&trace=1",
+      originalUrl:
+        "https://example.lambda-url.us-east-1.on.aws/inspect?jobId=job-123&trace=1",
+      host: "example.lambda-url.us-east-1.on.aws",
+      protocol: "https",
+      requestId: "req-123",
+      remoteAddress: "203.0.113.42",
+      query: {
+        jobId: "job-123",
+        trace: "1",
+      },
+      cookies: {
+        session: "abc",
+        theme: "dark",
+      },
+    });
+  });
+
+  it("maps HttpServerResponse into a Function URL result", async () => {
+    const result = asStructuredResult(
+      await invoke(
+        makeEvent({
+          rawPath: "/jobs",
+          headers: {
+            "content-type": "application/json",
+          },
+          body: JSON.stringify({
+            content: "ship it",
+          }),
+          requestContext: {
+            http: {
+              method: "POST",
+              path: "/jobs",
+            },
+          } as LambdaFunctionURLEvent["requestContext"],
+        }),
+      ),
+    );
+
+    expect(result.statusCode).toBe(201);
+    expect(result.headers).toMatchObject({
+      "content-type": "application/json",
+      "x-handler": "lambda-http",
+    });
+    expect(result.cookies).toHaveLength(1);
+    expect(result.cookies?.[0]).toContain("job-session=created");
+    expect(JSON.parse(result.body ?? "")).toEqual({
+      method: "POST",
+      url: "https://example.lambda-url.us-east-1.on.aws/jobs",
+      payload: {
+        content: "ship it",
+      },
+    });
+    expect(result.body).not.toContain("HttpServerResponse");
+  });
+
+  it("base64 encodes binary responses", async () => {
+    const result = asStructuredResult(
+      await invoke(
+        makeEvent({
+          rawPath: "/binary",
+          requestContext: {
+            http: {
+              method: "GET",
+              path: "/binary",
+            },
+          } as LambdaFunctionURLEvent["requestContext"],
+        }),
+      ),
+    );
+
+    expect(result.statusCode).toBe(200);
+    expect(result.headers?.["content-type"]).toBe("application/octet-stream");
+    expect(result.isBase64Encoded).toBe(true);
+    expect(Buffer.from(result.body ?? "", "base64").toString("utf8")).toBe(
+      "alchemy",
+    );
+  });
+
+  it("uses shared Http error handling for defects", async () => {
+    const result = asStructuredResult(
+      await invoke(
+        makeEvent({
+          rawPath: "/boom",
+          requestContext: {
+            http: {
+              method: "GET",
+              path: "/boom",
+            },
+          } as LambdaFunctionURLEvent["requestContext"],
+        }),
+        Effect.fail({ message: "Boom" } as any).pipe(Effect.orDie),
+      ),
+    );
+
+    expect(result.statusCode).toBe(500);
+    expect(result.headers?.["content-type"]).toContain("text/plain");
+    expect(result.body).toBe("Internal Server Error");
+  });
+});
+
+const invoke = async (
+  event: LambdaFunctionURLEvent,
+  handler: Effect.Effect<
+    HttpServerResponse.HttpServerResponse,
+    any,
+    HttpServerRequest.HttpServerRequest | Scope
+  > = TestHttpEffect,
+): Promise<LambdaFunctionURLResult> => {
+  const out = makeFunctionHttpHandler(handler)(event);
+  if (!Effect.isEffect(out)) {
+    throw new Error("Expected Effect from Function URL handler");
+  }
+  return Effect.runPromise(out);
+};
+
+const makeEvent = (
+  overrides: Partial<LambdaFunctionURLEvent> = {},
+): LambdaFunctionURLEvent => {
+  const event: LambdaFunctionURLEvent = {
+    version: "2.0",
+    routeKey: "$default",
+    rawPath: "/",
+    rawQueryString: "",
+    cookies: undefined,
+    headers: {
+      host: "example.lambda-url.us-east-1.on.aws",
+      "x-forwarded-proto": "https",
+    },
+    queryStringParameters: undefined,
+    requestContext: {
+      accountId: "123456789012",
+      apiId: "api-id",
+      domainName: "example.lambda-url.us-east-1.on.aws",
+      domainPrefix: "example",
+      http: {
+        method: "GET",
+        path: "/",
+        protocol: "HTTP/1.1",
+        sourceIp: "203.0.113.10",
+        userAgent: "vitest",
+      },
+      requestId: "request-id",
+      routeKey: "$default",
+      stage: "$default",
+      time: "09/Mar/2026:00:00:00 +0000",
+      timeEpoch: 1741478400000,
+    },
+    body: undefined,
+    pathParameters: undefined,
+    isBase64Encoded: false,
+    stageVariables: undefined,
+  };
+
+  return {
+    ...event,
+    ...overrides,
+    headers: {
+      ...event.headers,
+      ...overrides.headers,
+    },
+    requestContext: {
+      ...event.requestContext,
+      ...overrides.requestContext,
+      http: {
+        ...event.requestContext.http,
+        ...overrides.requestContext?.http,
+      },
+    },
+  };
+};
+
+const asStructuredResult = (
+  result: LambdaFunctionURLResult,
+): Exclude<LambdaFunctionURLResult, string> => {
+  if (typeof result === "string") {
+    throw new Error(`Expected a structured Lambda response, got: ${result}`);
+  }
+
+  return result;
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/Permission.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/Permission.test.ts
new file mode 100644
index 00000000000..64677eadd18
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/Permission.test.ts
@@ -0,0 +1,78 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as Lambda from "@distilled.cloud/aws/lambda";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { TestFunction, TestFunctionLive } from "./handler.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider(
+  "creates permission scoped to function URL invocation",
+  (stack) =>
+    Effect.gen(function* () {
+      const deployed = yield* stack.deploy(
+        Effect.gen(function* () {
+          const fn = yield* TestFunction;
+          const permission = yield* AWS.Lambda.Permission("UrlInvokeOnly", {
+            action: "lambda:InvokeFunction",
+            functionName: fn.functionName,
+            principal: "*",
+            invokedViaFunctionUrl: true,
+          });
+
+          return { fn, permission };
+        }).pipe(Effect.provide(TestFunctionLive)),
+      );
+
+      const policy = yield* getPolicyStatement(
+        deployed.fn.functionName,
+        deployed.permission.statementId,
+      );
+
+      expect(policy.Condition).toEqual({
+        Bool: {
+          "lambda:InvokedViaFunctionUrl": "true",
+        },
+      });
+    }).pipe(
+      Effect.tap(() => stack.destroy()),
+      Effect.onError(() => stack.destroy().pipe(Effect.ignore)),
+    ),
+  { timeout: 180_000 },
+);
+
+const getPolicyStatement = Effect.fn(function* (
+  functionName: string,
+  statementId: string,
+) {
+  return yield* Lambda.getPolicy({ FunctionName: functionName }).pipe(
+    Effect.flatMap(({ Policy }) =>
+      Effect.try({
+        try: () => {
+          const policy = JSON.parse(Policy ?? "{}") as {
+            Statement?: Array<{
+              Sid?: string;
+              Condition?: unknown;
+            }>;
+          };
+          const statement = policy.Statement?.find(
+            (statement) => statement.Sid === statementId,
+          );
+          if (!statement) {
+            throw new Error(`Policy statement ${statementId} not found`);
+          }
+          return statement;
+        },
+        catch: (cause) =>
+          cause instanceof Error ? cause : new Error(String(cause)),
+      }),
+    ),
+    Effect.retry({
+      schedule: Schedule.exponential(500).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/handler.ts
new file mode 100644
index 00000000000..724cf930300
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/handler.ts
@@ -0,0 +1,25 @@
+import * as Lambda from "@/AWS/Lambda";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+const main = import.meta.filename;
+
+export class TestFunction extends Lambda.Function<Lambda.Function>()(
+  "TestFunction",
+  {
+    main,
+    url: true,
+  },
+) {}
+
+export const TestFunctionLive = TestFunction.make(
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello, world!");
+      }),
+    };
+  }),
+);
+
+export default TestFunctionLive;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/timeout-handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/timeout-handler.ts
new file mode 100644
index 00000000000..96c2aa6129d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/timeout-handler.ts
@@ -0,0 +1,7 @@
+const handler = async () => ({
+  statusCode: 200,
+  body: "ok",
+});
+
+export { handler };
+export default handler;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/toTimeoutSeconds.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/toTimeoutSeconds.test.ts
new file mode 100644
index 00000000000..c2e33773240
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Lambda/toTimeoutSeconds.test.ts
@@ -0,0 +1,48 @@
+import { toTimeoutSeconds } from "@/AWS/Lambda/Function.ts";
+import * as Duration from "effect/Duration";
+import { describe, expect, it } from "vitest";
+
+describe("toTimeoutSeconds", () => {
+  it("returns undefined for undefined", () => {
+    expect(toTimeoutSeconds(undefined)).toBeUndefined();
+  });
+
+  it("converts a Duration to whole seconds", () => {
+    expect(toTimeoutSeconds(Duration.seconds(30))).toBe(30);
+    expect(toTimeoutSeconds(Duration.minutes(2))).toBe(120);
+  });
+
+  it("rounds sub-second and partial durations up", () => {
+    expect(toTimeoutSeconds(Duration.millis(1))).toBe(1);
+    expect(toTimeoutSeconds(Duration.millis(1500))).toBe(2);
+    expect(toTimeoutSeconds(Duration.millis(2001))).toBe(3);
+  });
+
+  it("returns undefined for an infinite Duration", () => {
+    expect(toTimeoutSeconds(Duration.infinity)).toBeUndefined();
+  });
+
+  describe("after state JSON round-trip", () => {
+    const roundTrip = (d: Duration.Duration) =>
+      JSON.parse(JSON.stringify(d)) as Duration.Duration;
+
+    it("converts a rehydrated Millis Duration", () => {
+      const json = roundTrip(Duration.seconds(42));
+      expect(json).toEqual({
+        _id: "Duration",
+        _tag: "Millis",
+        millis: 42_000,
+      });
+      expect(toTimeoutSeconds(json)).toBe(42);
+    });
+
+    it("converts a rehydrated Nanos Duration", () => {
+      const json = roundTrip(Duration.nanos(5_000_000_000n));
+      expect(toTimeoutSeconds(json)).toBe(5);
+    });
+
+    it("returns undefined for a rehydrated Infinity Duration", () => {
+      expect(toTimeoutSeconds(roundTrip(Duration.infinity))).toBeUndefined();
+    });
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/S3/Bucket.data-plane.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/S3/Bucket.data-plane.test.ts
new file mode 100644
index 00000000000..f5e2e2bff70
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/S3/Bucket.data-plane.test.ts
@@ -0,0 +1,357 @@
+import * as AWS from "@/AWS";
+import { Bucket } from "@/AWS/S3";
+import * as Test from "@/Test/Vitest";
+import * as S3 from "@distilled.cloud/aws/s3";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const deployTestBucket = (stack: Test.ScratchStack) =>
+  stack.deploy(
+    Effect.gen(function* () {
+      return yield* Bucket("DataPlaneTestBucket", {
+        forceDestroy: true,
+      });
+    }),
+  );
+
+test.provider("listObjectsV2 - list objects in bucket", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "file1.txt",
+      Body: "content 1",
+    });
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "file2.txt",
+      Body: "content 2",
+    });
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "folder/file3.txt",
+      Body: "content 3",
+    });
+
+    const result = yield* S3.listObjectsV2({
+      Bucket: bucketName,
+    });
+
+    expect(result.Contents).toBeDefined();
+    expect(result.Contents!.length).toBe(3);
+    expect(result.Contents!.map((c) => c.Key)).toContain("file1.txt");
+    expect(result.Contents!.map((c) => c.Key)).toContain("file2.txt");
+    expect(result.Contents!.map((c) => c.Key)).toContain("folder/file3.txt");
+
+    const prefixResult = yield* S3.listObjectsV2({
+      Bucket: bucketName,
+      Prefix: "folder/",
+    });
+    expect(prefixResult.Contents!.length).toBe(1);
+    expect(prefixResult.Contents![0].Key).toBe("folder/file3.txt");
+
+    const limitResult = yield* S3.listObjectsV2({
+      Bucket: bucketName,
+      MaxKeys: 1,
+    });
+    expect(limitResult.Contents!.length).toBe(1);
+    expect(limitResult.IsTruncated).toBe(true);
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("headObject - get object metadata", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "test-file.txt",
+      Body: "Hello, World!",
+      ContentType: "text/plain",
+    });
+
+    const result = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "test-file.txt",
+    });
+
+    expect(result.ContentType).toBe("text/plain");
+    expect(result.ContentLength).toBe(13);
+    expect(result.ETag).toBeDefined();
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("headObject - returns error for non-existent object", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    const result = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "non-existent.txt",
+    }).pipe(
+      Effect.map(() => "found" as const),
+      Effect.catchTag("NotFound", () => Effect.succeed("not-found" as const)),
+    );
+
+    expect(result).toBe("not-found");
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("copyObject - copy object within bucket", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "source.txt",
+      Body: "Original content",
+      ContentType: "text/plain",
+    });
+
+    yield* S3.copyObject({
+      Bucket: bucketName,
+      Key: "destination.txt",
+      CopySource: `${bucketName}/source.txt`,
+    });
+
+    const destHead = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "destination.txt",
+    });
+    expect(destHead.ContentType).toBe("text/plain");
+    expect(destHead.ContentLength).toBe(16);
+
+    const sourceHead = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "source.txt",
+    });
+    expect(sourceHead.ContentLength).toBe(16);
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("copyObject - copy with metadata replacement", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "source.txt",
+      Body: "Content",
+      ContentType: "text/plain",
+    });
+
+    yield* S3.copyObject({
+      Bucket: bucketName,
+      Key: "destination.txt",
+      CopySource: `${bucketName}/source.txt`,
+      ContentType: "application/octet-stream",
+      MetadataDirective: "REPLACE",
+    });
+
+    const destHead = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "destination.txt",
+    });
+    // AWS may normalize content-type to binary/octet-stream
+    expect(destHead.ContentType).toBe("binary/octet-stream");
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("multipart upload - complete workflow", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    const createResult = yield* S3.createMultipartUpload({
+      Bucket: bucketName,
+      Key: "multipart-file.txt",
+      ContentType: "text/plain",
+    });
+
+    expect(createResult.UploadId).toBeDefined();
+    const uploadId = createResult.UploadId!;
+
+    // AWS S3 requires parts to be at least 5MB except for the last (or only)
+    // part, so a single-part upload works with any size
+    const partContent = "Complete multipart upload content";
+
+    const partResult = yield* S3.uploadPart({
+      Bucket: bucketName,
+      Key: "multipart-file.txt",
+      UploadId: uploadId,
+      PartNumber: 1,
+      Body: partContent,
+    });
+    expect(partResult.ETag).toBeDefined();
+
+    yield* S3.completeMultipartUpload({
+      Bucket: bucketName,
+      Key: "multipart-file.txt",
+      UploadId: uploadId,
+      MultipartUpload: {
+        Parts: [{ ETag: partResult.ETag!, PartNumber: 1 }],
+      },
+    });
+
+    const headResult = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "multipart-file.txt",
+    });
+    // AWS S3 may use binary/octet-stream for multipart uploads even when
+    // ContentType is set on createMultipartUpload
+    expect(headResult.ContentLength).toBe(partContent.length);
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("multipart upload - abort", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    const createResult = yield* S3.createMultipartUpload({
+      Bucket: bucketName,
+      Key: "aborted-file.txt",
+      ContentType: "text/plain",
+    });
+
+    const uploadId = createResult.UploadId!;
+
+    yield* S3.uploadPart({
+      Bucket: bucketName,
+      Key: "aborted-file.txt",
+      UploadId: uploadId,
+      PartNumber: 1,
+      Body: "Some content",
+    });
+
+    yield* S3.abortMultipartUpload({
+      Bucket: bucketName,
+      Key: "aborted-file.txt",
+      UploadId: uploadId,
+    });
+
+    const headResult = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "aborted-file.txt",
+    }).pipe(
+      Effect.map(() => "found" as const),
+      Effect.catchTag("NotFound", () => Effect.succeed("not-found" as const)),
+    );
+
+    expect(headResult).toBe("not-found");
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("putObject and getObject - basic operations", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "test-put.txt",
+      Body: "Test content for put operation",
+      ContentType: "text/plain",
+    });
+
+    const headResult = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "test-put.txt",
+    });
+    expect(headResult.ContentType).toBe("text/plain");
+    expect(headResult.ContentLength).toBe(30);
+
+    const getResult = yield* S3.getObject({
+      Bucket: bucketName,
+      Key: "test-put.txt",
+    });
+    expect(getResult.ContentType).toBe("text/plain");
+    expect(getResult.ContentLength).toBe(30);
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("deleteObject - remove object", (stack) =>
+  Effect.gen(function* () {
+    const bucket = yield* deployTestBucket(stack);
+    const bucketName = bucket.bucketName;
+
+    yield* S3.putObject({
+      Bucket: bucketName,
+      Key: "to-delete.txt",
+      Body: "Delete me",
+    });
+
+    yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "to-delete.txt",
+    });
+
+    yield* S3.deleteObject({
+      Bucket: bucketName,
+      Key: "to-delete.txt",
+    });
+
+    const headResult = yield* S3.headObject({
+      Bucket: bucketName,
+      Key: "to-delete.txt",
+    }).pipe(
+      Effect.map(() => "found" as const),
+      Effect.catchTag("NotFound", () => Effect.succeed("not-found" as const)),
+    );
+
+    expect(headResult).toBe("not-found");
+
+    yield* stack.destroy();
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+class BucketStillExists extends Data.TaggedError("BucketStillExists") {}
+
+const assertBucketDeleted = Effect.fn(function* (bucketName: string) {
+  yield* S3.headBucket({ Bucket: bucketName }).pipe(
+    Effect.flatMap(() => Effect.fail(new BucketStillExists())),
+    Effect.retry({
+      while: (e) => e._tag === "BucketStillExists",
+      schedule: Schedule.exponential(100).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+    Effect.catchTag("NotFound", () => Effect.void),
+    Effect.catch(() => Effect.void),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/S3/Bucket.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/S3/Bucket.test.ts
new file mode 100644
index 00000000000..61a181f4b5c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/S3/Bucket.test.ts
@@ -0,0 +1,389 @@
+import * as AWS from "@/AWS";
+import { Bucket } from "@/AWS/S3";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as S3 from "@distilled.cloud/aws/s3";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider("create and delete bucket with default props", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("DefaultBucket");
+      }),
+    );
+
+    expect(bucket.bucketName).toBeDefined();
+    expect(bucket.bucketArn).toBeDefined();
+    expect(bucket.region).toBeDefined();
+
+    yield* S3.headBucket({ Bucket: bucket.bucketName });
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucket.bucketName);
+  }),
+);
+
+test.provider("create, update, delete bucket", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("TestBucket", {
+          bucketName: "alchemy-test-bucket-crud",
+          tags: { Environment: "test" },
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    yield* S3.headBucket({ Bucket: bucket.bucketName });
+
+    const tagging = yield* S3.getBucketTagging({
+      Bucket: bucket.bucketName,
+    });
+    expect(tagging.TagSet).toContainEqual({
+      Key: "Environment",
+      Value: "test",
+    });
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("TestBucket", {
+          bucketName: "alchemy-test-bucket-crud",
+          tags: { Environment: "production", Team: "platform" },
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    const updatedTagging = yield* S3.getBucketTagging({
+      Bucket: bucket.bucketName,
+    });
+    expect(updatedTagging.TagSet).toContainEqual({
+      Key: "Environment",
+      Value: "production",
+    });
+    expect(updatedTagging.TagSet).toContainEqual({
+      Key: "Team",
+      Value: "platform",
+    });
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucket.bucketName);
+  }),
+);
+
+test.provider("create bucket with custom name", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("CustomNameBucket", {
+          bucketName: "alchemy-test-bucket-custom-name",
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    expect(bucket.bucketName).toEqual("alchemy-test-bucket-custom-name");
+    expect(bucket.bucketArn).toEqual(
+      "arn:aws:s3:::alchemy-test-bucket-custom-name",
+    );
+
+    yield* S3.headBucket({ Bucket: bucket.bucketName });
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucket.bucketName);
+  }),
+);
+
+test.provider("create bucket with forceDestroy", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("ForceDestroyBucket", {
+          bucketName: "alchemy-test-bucket-force-destroy",
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    yield* S3.putObject({
+      Bucket: bucket.bucketName,
+      Key: "test-object.txt",
+      Body: "Hello, World!",
+    });
+
+    yield* S3.headObject({
+      Bucket: bucket.bucketName,
+      Key: "test-object.txt",
+    });
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucket.bucketName);
+  }),
+);
+
+test.provider("idempotent create - bucket already exists", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket1 = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("IdempotentBucket", {
+          bucketName: "alchemy-test-bucket-idempotent",
+          forceDestroy: true,
+        });
+      }),
+    );
+    const bucketName = bucket1.bucketName;
+
+    const bucket2 = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("IdempotentBucket", {
+          bucketName: "alchemy-test-bucket-idempotent",
+          forceDestroy: true,
+        });
+      }),
+    );
+    expect(bucket2.bucketName).toEqual(bucketName);
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("create bucket with objectLockEnabled", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("ObjectLockBucket", {
+          bucketName: "alchemy-test-bucket-object-lock",
+          objectLockEnabled: true,
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    const objectLockConfig = yield* S3.getObjectLockConfiguration({
+      Bucket: bucket.bucketName,
+    });
+    expect(objectLockConfig.ObjectLockConfiguration?.ObjectLockEnabled).toEqual(
+      "Enabled",
+    );
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucket.bucketName);
+  }),
+);
+
+test.provider("remove all tags from bucket", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("TagRemovalBucket", {
+          bucketName: "alchemy-test-bucket-tag-removal",
+          tags: { Environment: "test", Team: "platform" },
+          forceDestroy: true,
+        });
+      }),
+    );
+    const bucketName = bucket.bucketName;
+
+    const tagging = yield* S3.getBucketTagging({
+      Bucket: bucketName,
+    });
+    expect(tagging.TagSet).toHaveLength(2);
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("TagRemovalBucket", {
+          bucketName: "alchemy-test-bucket-tag-removal",
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    const result = yield* S3.getBucketTagging({
+      Bucket: bucketName,
+    }).pipe(
+      Effect.map(() => "has-tags" as const),
+      Effect.catchTag("NoSuchTagSet", () => Effect.succeed("no-tags" as const)),
+    );
+    expect(result).toEqual("no-tags");
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucketName);
+  }),
+);
+
+test.provider("create and remove bucket policy from bindings", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const distributionArn =
+      "arn:aws:cloudfront::123456789012:distribution/TESTDIST";
+    const bucketArn = "arn:aws:s3:::alchemy-test-bucket-policy-bindings";
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        const bucket = yield* Bucket("PolicyBucket", {
+          bucketName: "alchemy-test-bucket-policy-bindings",
+          forceDestroy: true,
+        });
+
+        yield* bucket.bind("AWS.S3.Policy(TestDistribution, PolicyBucket)", {
+          policyStatements: [
+            {
+              Effect: "Allow",
+              Principal: {
+                Service: "cloudfront.amazonaws.com",
+              },
+              Action: ["s3:GetObject"],
+              Resource: [`${bucketArn}/*`],
+              Condition: {
+                StringEquals: {
+                  "AWS:SourceArn": distributionArn,
+                },
+              },
+            },
+          ],
+        });
+
+        return bucket;
+      }),
+    );
+
+    const bucketPolicy = yield* S3.getBucketPolicy({
+      Bucket: bucket.bucketName,
+    }).pipe(Effect.map((response) => JSON.parse(response.Policy!)));
+    const statement = bucketPolicy.Statement[0];
+
+    expect(bucketPolicy.Version).toEqual("2012-10-17");
+    expect(statement.Effect).toEqual("Allow");
+    expect(statement.Principal).toEqual({
+      Service: "cloudfront.amazonaws.com",
+    });
+    expect(statement.Action).toEqual("s3:GetObject");
+    expect(statement.Resource).toEqual(`${bucketArn}/*`);
+    expect(statement.Condition).toEqual({
+      StringEquals: {
+        "AWS:SourceArn": distributionArn,
+      },
+    });
+
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Bucket("PolicyBucket", {
+          bucketName: "alchemy-test-bucket-policy-bindings",
+          forceDestroy: true,
+        });
+      }),
+    );
+
+    const policyAfterRemoval = yield* S3.getBucketPolicy({
+      Bucket: bucket.bucketName,
+    }).pipe(
+      Effect.map(() => "has-policy" as const),
+      Effect.catchTag("NoSuchBucketPolicy", () =>
+        Effect.succeed("no-policy" as const),
+      ),
+    );
+
+    expect(policyAfterRemoval).toEqual("no-policy");
+
+    yield* stack.destroy();
+
+    yield* assertBucketDeleted(bucket.bucketName);
+  }),
+);
+
+// Engine-level adoption: S3 has no per-stack ownership signal (we don't
+// stamp alchemy tags on buckets — the canonical existence check is
+// `headBucket`, which only succeeds when the bucket is owned by *this AWS
+// account*). So a name match means we own it at the account level — silent
+// adoption is correct for the cold-start case.
+test.provider(
+  "owned bucket (account-level) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const bucketName = `alchemy-test-s3-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Bucket("AdoptableBucket", {
+            bucketName,
+            forceDestroy: true,
+          });
+        }),
+      );
+      expect(initial.bucketName).toEqual(bucketName);
+
+      // Wipe state — bucket stays in S3.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableBucket",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Bucket("AdoptableBucket", {
+            bucketName,
+            forceDestroy: true,
+          });
+        }),
+      );
+
+      expect(adopted.bucketArn).toEqual(initial.bucketArn);
+
+      yield* stack.destroy();
+      yield* assertBucketDeleted(bucketName);
+    }),
+);
+
+class BucketStillExists extends Data.TaggedError("BucketStillExists") {}
+
+const assertBucketDeleted = Effect.fn(function* (bucketName: string) {
+  yield* S3.headBucket({ Bucket: bucketName }).pipe(
+    Effect.flatMap(() => Effect.fail(new BucketStillExists())),
+    Effect.retry({
+      while: (e) => e._tag === "BucketStillExists",
+      schedule: Schedule.exponential(100).pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+    Effect.catchTag("NotFound", () => Effect.void),
+    Effect.catch(() => Effect.void),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Bindings.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Bindings.test.ts
new file mode 100644
index 00000000000..e1c5a7e497b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Bindings.test.ts
@@ -0,0 +1,425 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as SQS from "@distilled.cloud/aws/sqs";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import {
+  SNSApiFunction,
+  SNSApiFunctionLive,
+  TopicAndQueue,
+} from "./handler.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const readinessPolicy = Schedule.fixed("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(75)),
+);
+
+describe.sequential("SNS Bindings", () => {
+  test.provider(
+    "exercises the SNS bindings surface against a live fixture",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.logInfo("SNS test setup: destroying previous resources");
+        if (!process.env.NO_DESTROY) {
+          yield* stack.destroy();
+        }
+
+        yield* Effect.logInfo("SNS test setup: deploying fixture");
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const { topic, queue, subscription } = yield* TopicAndQueue;
+
+            const apiFunction = yield* SNSApiFunction;
+
+            return {
+              apiFunction,
+              topic,
+              queue,
+              subscription,
+            };
+          }).pipe(Effect.provide(SNSApiFunctionLive)),
+        );
+
+        const baseUrl = deployed.apiFunction.functionUrl!.replace(/\/+$/, "");
+        const queueUrl = deployed.queue.queueUrl;
+        const topicArn = deployed.topic.topicArn;
+        const subscriptionArn = deployed.subscription.subscriptionArn;
+
+        // Gate on an IAM-backed binding call (read-only GetTopicAttributes),
+        // not the no-op `/ready` route. A fresh role's inline policy is
+        // eventually consistent: the function code can be live (200 on
+        // `/ready`) seconds before STS has propagated the `sns:*` grants, so a
+        // `/ready` gate lets the first `/publish` race the propagation window
+        // and 500 with AuthorizationErrorException. Hitting `/topic-attributes`
+        // here waits until the policy is actually live before any assertions.
+        const readinessUrl = `${baseUrl}/topic-attributes`;
+        yield* Effect.logInfo(
+          `SNS test setup: probing IAM readiness at ${readinessUrl} (150s budget)`,
+        );
+
+        yield* HttpClient.get(readinessUrl).pipe(
+          Effect.flatMap((response) =>
+            response.status === 200
+              ? Effect.succeed(response)
+              : Effect.fail(
+                  new Error(`Function not ready: ${response.status}`),
+                ),
+          ),
+          Effect.tap(() =>
+            Effect.logInfo("SNS test setup: fixture responded successfully"),
+          ),
+          Effect.tapError((error) =>
+            Effect.logWarning(
+              `SNS test setup: fixture not ready yet (${String(error)})`,
+            ),
+          ),
+          Effect.retry({ schedule: readinessPolicy }),
+        );
+
+        const getJson = (path: string) =>
+          HttpClient.get(`${baseUrl}${path}`).pipe(
+            Effect.flatMap((response) => response.json),
+          );
+
+        const postJson = (path: string, body: unknown) =>
+          HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.post(`${baseUrl}${path}`),
+              body,
+            ),
+          ).pipe(
+            Effect.tap((response) =>
+              Effect.flatMap(response.text, Effect.logInfo),
+            ),
+            Effect.flatMap((response) => response.json),
+          );
+
+        const deleteJson = (path: string, body: unknown) =>
+          HttpClient.execute(
+            HttpClientRequest.bodyJsonUnsafe(
+              HttpClientRequest.delete(`${baseUrl}${path}`),
+              body,
+            ),
+          ).pipe(Effect.flatMap((response) => response.json));
+
+        const waitForQueueMessage = Effect.fn(function* (
+          predicate: (body: {
+            message: string;
+            topicArn: string;
+            subject?: string;
+          }) => boolean,
+        ) {
+          return yield* SQS.receiveMessage({
+            QueueUrl: queueUrl,
+            MaxNumberOfMessages: 1,
+            WaitTimeSeconds: 20,
+            VisibilityTimeout: 30,
+          }).pipe(
+            Effect.flatMap((result) => {
+              const message = result.Messages?.[0];
+              if (!message?.Body || !message.ReceiptHandle) {
+                return Effect.fail(new QueueMessageNotReady());
+              }
+
+              const body = JSON.parse(message.Body) as {
+                message: string;
+                topicArn: string;
+                subject?: string;
+              };
+
+              return SQS.deleteMessage({
+                QueueUrl: queueUrl,
+                ReceiptHandle: message.ReceiptHandle,
+              }).pipe(
+                Effect.flatMap(() =>
+                  predicate(body)
+                    ? Effect.succeed(body)
+                    : Effect.fail(new QueueMessageNotReady()),
+                ),
+              );
+            }),
+            // Each attempt already long-polls up to 20s, so a handful of
+            // retries spans a generous (~3min) delivery window without the
+            // short-poll spin that made this flaky — and stays under the
+            // test's 360s budget even across the multiple waits per run.
+            Effect.retry({
+              while: (error) => error._tag === "QueueMessageNotReady",
+              schedule: Schedule.recurs(9),
+            }),
+          );
+        });
+
+        const waitForQueueMessages = Effect.fn(function* (count: number) {
+          const bodies: Array<{
+            message: string;
+            topicArn: string;
+            subject?: string;
+          }> = [];
+
+          while (bodies.length < count) {
+            bodies.push(yield* waitForQueueMessage(() => true));
+          }
+
+          return bodies;
+        });
+
+        // Publish
+        yield* Effect.gen(function* () {
+          const marker = `publish-${crypto.randomUUID()}`;
+          const response = yield* postJson("/publish", {
+            message: marker,
+            subject: "PublishTest",
+          });
+
+          expect((response as any).MessageId).toBeTruthy();
+
+          const queued = yield* waitForQueueMessage(
+            (body) => body.message === marker,
+          );
+          expect((queued as any).topicArn).toBe(topicArn);
+          expect((queued as any).subject).toBe("PublishTest");
+        });
+
+        // PublishBatch
+        yield* Effect.gen(function* () {
+          const first = `batch-1-${crypto.randomUUID()}`;
+          const second = `batch-2-${crypto.randomUUID()}`;
+
+          const response = yield* postJson("/publish-batch", {
+            messages: [first, second],
+          });
+
+          expect(((response as any).Successful ?? []).length).toBe(2);
+
+          const bodies = yield* waitForQueueMessages(2);
+          const messages = bodies.map((body) => body.message);
+          expect(messages).toContain(first);
+          expect(messages).toContain(second);
+        });
+
+        // GetTopicAttributes
+        yield* Effect.gen(function* () {
+          const response = yield* getJson("/topic-attributes");
+          expect((response as any).Attributes.TopicArn).toBe(topicArn);
+        });
+
+        // SetTopicAttributes — eventual consistency. SNS can take a few
+        // seconds to propagate a SetTopicAttributes change, and during
+        // that window GetTopicAttributes may return a payload without
+        // the updated key. Poll briefly.
+        yield* Effect.gen(function* () {
+          yield* postJson("/topic-attributes", {
+            name: "DisplayName",
+            value: "updated-display-name",
+          });
+
+          yield* Effect.gen(function* () {
+            const response = yield* getJson("/topic-attributes");
+            const displayName = (response as any).Attributes?.DisplayName;
+            if (displayName !== "updated-display-name") {
+              return yield* Effect.fail(new TopicAttributeNotPropagated());
+            }
+          }).pipe(
+            Effect.retry({
+              while: (e) => e._tag === "TopicAttributeNotPropagated",
+              schedule: Schedule.fixed("1 second").pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
+          );
+        });
+
+        // AddPermission
+        yield* Effect.gen(function* () {
+          yield* postJson("/add-permission", {});
+          const response = yield* getJson("/topic-attributes");
+          expect((response as any).Attributes.Policy).toContain(
+            "FixturePublishPermission",
+          );
+        });
+
+        // RemovePermission
+        yield* Effect.gen(function* () {
+          yield* postJson("/add-permission", {});
+          yield* postJson("/remove-permission", {});
+          const response = yield* getJson("/topic-attributes");
+          expect((response as any).Attributes.Policy ?? "").not.toContain(
+            "FixturePublishPermission",
+          );
+        });
+
+        // GetDataProtectionPolicy
+        yield* Effect.gen(function* () {
+          const response = yield* getJson("/data-protection-policy");
+          if ((response as any).ok === false) {
+            expect((response as any).error).toBeTruthy();
+          } else {
+            expect(response).toBeDefined();
+          }
+        });
+
+        // PutDataProtectionPolicy
+        yield* Effect.gen(function* () {
+          const response = yield* postJson("/data-protection-policy", {
+            policy: "{}",
+          });
+          expect(response).toBeDefined();
+        });
+
+        // ListTopics (account-wide) — the alchemy binding wraps SNS's
+        // single-page `ListTopics` operation, which returns up to 100 topics.
+        // On a busy account our brand-new topic may simply be on a later page,
+        // so just assert the binding works (returns an Array of topics). Our
+        // specific ARN is verified via the topic-scoped `topic-attributes`
+        // call above.
+        yield* Effect.gen(function* () {
+          const response = yield* getJson("/topics");
+          const topics = (response as any).Topics ?? [];
+          expect(Array.isArray(topics)).toBe(true);
+        });
+
+        // ListSubscriptions (account-wide) — the alchemy binding wraps
+        // SNS's single-page `ListSubscriptions` operation, which returns
+        // up to 100 subscriptions. On a busy account our brand-new
+        // subscription may simply be on a later page. Just assert the
+        // binding works (returns an Array of subscriptions). Our specific
+        // ARN is verified via the topic-scoped call below.
+        yield* Effect.gen(function* () {
+          const response = yield* getJson("/subscriptions");
+          const subscriptions = (response as any).Subscriptions ?? [];
+          expect(Array.isArray(subscriptions)).toBe(true);
+        });
+
+        // ListSubscriptionsByTopic — scoped to the topic we just created,
+        // so propagation is tight. SNS still has eventual consistency on
+        // brand-new subscriptions; poll for ~30s.
+        yield* Effect.gen(function* () {
+          const arns = yield* Effect.gen(function* () {
+            const response = yield* getJson("/subscriptions-by-topic");
+            const arns = ((response as any).Subscriptions ?? []).map(
+              (subscription: any) => subscription.SubscriptionArn,
+            );
+            if (!arns.includes(subscriptionArn)) {
+              return yield* Effect.fail(new SubscriptionNotListed());
+            }
+            return arns;
+          }).pipe(
+            Effect.retry({
+              while: (e) => e._tag === "SubscriptionNotListed",
+              schedule: Schedule.fixed("2 seconds").pipe(
+                Schedule.both(Schedule.recurs(15)),
+              ),
+            }),
+          );
+          expect(arns).toContain(subscriptionArn);
+        });
+
+        // ListTagsForResource
+        yield* Effect.gen(function* () {
+          const response = yield* getJson("/tags");
+          const keys = ((response as any).Tags ?? []).map(
+            (tag: any) => tag.Key,
+          );
+          expect(keys).toContain("alchemy::stack");
+          expect(keys).toContain("alchemy::stage");
+          expect(keys).toContain("alchemy::id");
+        });
+
+        // TagResource
+        yield* Effect.gen(function* () {
+          yield* postJson("/tags", {
+            key: "sns-binding-test",
+            value: "true",
+          });
+          const response = yield* getJson("/tags");
+          const tags = Object.fromEntries(
+            ((response as any).Tags ?? []).map((tag: any) => [
+              tag.Key,
+              tag.Value,
+            ]),
+          );
+          expect(tags["sns-binding-test"]).toBe("true");
+        });
+
+        // UntagResource
+        yield* Effect.gen(function* () {
+          yield* postJson("/tags", {
+            key: "sns-remove-test",
+            value: "true",
+          });
+          yield* deleteJson("/tags", {
+            keys: ["sns-remove-test"],
+          });
+          const response = yield* getJson("/tags");
+          const keys = ((response as any).Tags ?? []).map(
+            (tag: any) => tag.Key,
+          );
+          expect(keys).not.toContain("sns-remove-test");
+        });
+
+        // GetSubscriptionAttributes
+        yield* Effect.gen(function* () {
+          const response = yield* getJson("/subscription-attributes");
+          expect((response as any).Attributes.Protocol).toBe("sqs");
+        });
+
+        // SetSubscriptionAttributes
+        yield* Effect.gen(function* () {
+          const response = yield* postJson("/subscription-attributes", {
+            name: "RawMessageDelivery",
+            value: "true",
+          }).pipe(
+            Effect.flatMap(() => getJson("/subscription-attributes")),
+            Effect.ensuring(
+              postJson("/subscription-attributes", {
+                name: "RawMessageDelivery",
+                value: "false",
+              }).pipe(Effect.ignore),
+            ),
+          );
+          expect((response as any).Attributes.RawMessageDelivery).toBe("true");
+        });
+
+        // ConfirmSubscription
+        yield* Effect.gen(function* () {
+          const response = yield* postJson("/confirm-subscription", {
+            token: "invalid-token",
+          });
+          expect((response as any).ok).toBe(false);
+          expect((response as any).error).toBeTruthy();
+        });
+
+        // TopicSink
+        yield* Effect.gen(function* () {
+          const first = `sink-1-${crypto.randomUUID()}`;
+          const second = `sink-2-${crypto.randomUUID()}`;
+
+          const response = yield* postJson("/sink", {
+            messages: [first, second],
+          });
+          expect((response as any).ok).toBe(true);
+
+          const bodies = yield* waitForQueueMessages(2);
+          const messages = bodies.map((body) => body.message);
+          expect(messages).toContain(first);
+          expect(messages).toContain(second);
+        });
+
+        if (!process.env.NO_DESTROY) {
+          yield* stack.destroy();
+        }
+      }),
+    { timeout: 360_000 },
+  );
+});
+
+class QueueMessageNotReady extends Data.TaggedError("QueueMessageNotReady") {}
+class SubscriptionNotListed extends Data.TaggedError("SubscriptionNotListed") {}
+class TopicAttributeNotPropagated extends Data.TaggedError(
+  "TopicAttributeNotPropagated",
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Subscription.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Subscription.test.ts
new file mode 100644
index 00000000000..16755ad7f43
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Subscription.test.ts
@@ -0,0 +1,78 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as SNS from "@distilled.cloud/aws/sns";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import {
+  SNSApiFunction,
+  SNSApiFunctionLive,
+  TopicAndQueue,
+} from "./handler.ts";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider(
+  "create and delete lambda subscription",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const deployed = yield* stack.deploy(
+        Effect.gen(function* () {
+          const { topic, queue, subscription } = yield* TopicAndQueue;
+
+          const apiFunction = yield* SNSApiFunction;
+
+          return {
+            apiFunction,
+            topic,
+            queue,
+            subscription,
+          };
+        }).pipe(Effect.provide(SNSApiFunctionLive)),
+      );
+
+      expect(deployed.subscription.subscriptionArn).toBeDefined();
+
+      const attributes = yield* SNS.getSubscriptionAttributes({
+        SubscriptionArn: deployed.subscription.subscriptionArn,
+      }).pipe(
+        Effect.tapError((err) =>
+          Effect.logError(deployed.subscription.subscriptionArn, err),
+        ),
+        Effect.retry({
+          while: (error) => error._tag === "NotFoundException",
+          schedule: Schedule.fixed(300),
+        }),
+      );
+      expect(attributes.Attributes?.Protocol).toBe("lambda");
+      expect(attributes.Attributes?.TopicArn).toBe(deployed.topic.topicArn);
+
+      yield* stack.destroy();
+      yield* assertSubscriptionDeleted(deployed.subscription.subscriptionArn);
+    }),
+  { timeout: 180_000 },
+);
+
+class SubscriptionStillExists extends Data.TaggedError(
+  "SubscriptionStillExists",
+) {}
+
+const assertSubscriptionDeleted = Effect.fn(function* (
+  subscriptionArn: string,
+) {
+  yield* SNS.getSubscriptionAttributes({
+    SubscriptionArn: subscriptionArn,
+  }).pipe(
+    Effect.flatMap(() => Effect.fail(new SubscriptionStillExists())),
+    Effect.retry({
+      while: (error) => error._tag === "SubscriptionStillExists",
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catchTag("NotFoundException", () => Effect.void),
+    Effect.catchTag("InvalidParameterException", () => Effect.void),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Topic.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Topic.test.ts
new file mode 100644
index 00000000000..381130dbd27
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/Topic.test.ts
@@ -0,0 +1,227 @@
+import { adopt } from "@/AdoptPolicy";
+import * as AWS from "@/AWS";
+import { Topic } from "@/AWS/SNS";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as SNS from "@distilled.cloud/aws/sns";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+describe("AWS.SNS.Topic", () => {
+  test.provider("create and delete topic with default props", (stack) =>
+    Effect.gen(function* () {
+      const topic = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Topic("DefaultTopic");
+        }),
+      );
+
+      expect(topic.topicName).toBeDefined();
+      expect(topic.topicArn).toBeDefined();
+
+      const attributes = yield* SNS.getTopicAttributes({
+        TopicArn: topic.topicArn,
+      });
+      expect(attributes.Attributes?.TopicArn).toBe(topic.topicArn);
+
+      yield* stack.destroy();
+      yield* assertTopicDeleted(topic.topicArn);
+    }),
+  );
+
+  test.provider("create, update, delete topic attributes and tags", (stack) =>
+    Effect.gen(function* () {
+      const topic = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Topic("ManagedTopic", {
+            attributes: {
+              DisplayName: "managed-topic-v1",
+            },
+            tags: {
+              env: "test",
+            },
+          });
+        }),
+      );
+
+      const initialAttributes = yield* SNS.getTopicAttributes({
+        TopicArn: topic.topicArn,
+      });
+      expect(initialAttributes.Attributes?.DisplayName).toBe(
+        "managed-topic-v1",
+      );
+
+      const updatedTopic = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Topic("ManagedTopic", {
+            attributes: {
+              DisplayName: "managed-topic-v2",
+            },
+            tags: {
+              updated: "true",
+            },
+          });
+        }),
+      );
+
+      const updatedAttributes = yield* SNS.getTopicAttributes({
+        TopicArn: updatedTopic.topicArn,
+      });
+      expect(updatedAttributes.Attributes?.DisplayName).toBe(
+        "managed-topic-v2",
+      );
+
+      const tagResponse = yield* SNS.listTagsForResource({
+        ResourceArn: updatedTopic.topicArn,
+      });
+      const tags = Object.fromEntries(
+        (tagResponse.Tags ?? []).map((tag) => [tag.Key, tag.Value]),
+      );
+      expect(tags.updated).toBe("true");
+      expect(tags.env).toBeUndefined();
+
+      yield* stack.destroy();
+      yield* assertTopicDeleted(updatedTopic.topicArn);
+    }),
+  );
+
+  test.provider("create and delete fifo topic", (stack) =>
+    Effect.gen(function* () {
+      const topic = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Topic("FifoTopic", {
+            fifo: true,
+            attributes: {
+              ContentBasedDeduplication: "true",
+            },
+          });
+        }),
+      );
+
+      expect(topic.topicName).toContain(".fifo");
+
+      const attributes = yield* SNS.getTopicAttributes({
+        TopicArn: topic.topicArn,
+      });
+      expect(attributes.Attributes?.FifoTopic).toBe("true");
+      expect(attributes.Attributes?.ContentBasedDeduplication).toBe("true");
+
+      yield* stack.destroy();
+      yield* assertTopicDeleted(topic.topicArn);
+    }),
+  );
+
+  // Engine-level adoption tests for SNS Topic.
+  test.provider(
+    "owned topic (matching alchemy tags) is silently adopted without --adopt",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const topicName = `alchemy-test-sns-adopt-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        const initial = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Topic("AdoptableTopic", { topicName });
+          }),
+        );
+        expect(initial.topicName).toEqual(topicName);
+
+        // Wipe state — the topic stays in SNS.
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "AdoptableTopic",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        const adopted = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Topic("AdoptableTopic", { topicName });
+          }),
+        );
+
+        expect(adopted.topicArn).toEqual(initial.topicArn);
+
+        yield* stack.destroy();
+        yield* assertTopicDeleted(initial.topicArn);
+      }),
+  );
+
+  test.provider(
+    "foreign-tagged topic requires adopt(true) to take over",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const topicName = `alchemy-test-sns-takeover-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        const original = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Topic("Original", { topicName });
+          }),
+        );
+
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "Original",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        const takenOver = yield* stack
+          .deploy(
+            Effect.gen(function* () {
+              return yield* Topic("Different", { topicName });
+            }),
+          )
+          .pipe(adopt(true));
+
+        expect(takenOver.topicArn).toEqual(original.topicArn);
+
+        const tagsResp = yield* SNS.listTagsForResource({
+          ResourceArn: takenOver.topicArn,
+        });
+        const tagMap = Object.fromEntries(
+          (tagsResp.Tags ?? [])
+            .filter(
+              (t): t is { Key: string; Value: string } =>
+                typeof t.Value === "string",
+            )
+            .map((t) => [t.Key, t.Value]),
+        );
+        expect(tagMap["alchemy::id"]).toEqual("Different");
+
+        yield* stack.destroy();
+        yield* assertTopicDeleted(takenOver.topicArn);
+      }),
+  );
+
+  class TopicStillExists extends Data.TaggedError("TopicStillExists") {}
+
+  const assertTopicDeleted = Effect.fn(function* (topicArn: string) {
+    yield* SNS.getTopicAttributes({
+      TopicArn: topicArn,
+    }).pipe(
+      Effect.flatMap(() => Effect.fail(new TopicStillExists())),
+      Effect.retry({
+        while: (error) => error._tag === "TopicStillExists",
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NotFoundException", () => Effect.void),
+      Effect.catchTag("InvalidParameterException", () => Effect.void),
+    );
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/handler.ts
new file mode 100644
index 00000000000..bb19bac00a5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/SNS/handler.ts
@@ -0,0 +1,352 @@
+import * as AWS from "@/AWS";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import path from "pathe";
+
+const main = path.resolve(import.meta.dirname, "handler.ts");
+
+export class SNSEventFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "SNSEventFunction",
+  {
+    main,
+    handler: "SNSEventFunctionLive",
+    url: true,
+  },
+) {}
+
+export const SNSEventFunctionLive = SNSEventFunction.make(
+  Effect.gen(function* () {
+    // no-op, we're just gonna be targeted manualy by the Subscription
+  }),
+);
+
+const formatError = (error: unknown) =>
+  typeof error === "object" && error !== null && "_tag" in error
+    ? { ok: false as const, error: (error as { _tag: string })._tag }
+    : { ok: false as const, error: `${error}` };
+
+export class TopicAndQueue extends Context.Service<
+  TopicAndQueue,
+  {
+    topic: AWS.SNS.Topic;
+    queue: AWS.SQS.Queue;
+    subscription: AWS.SNS.Subscription;
+    subscriptionAttrsQueue: AWS.SQS.Queue;
+    queueSubscription: AWS.SNS.Subscription;
+  }
+>()("TopicAndQueue") {}
+
+export const TopicAndQueueLive = Layer.effect(
+  TopicAndQueue,
+  Effect.gen(function* () {
+    const topic = yield* AWS.SNS.Topic("TestTopic", {
+      attributes: {
+        DisplayName: "sns-test-topic",
+      },
+    });
+    const queue = yield* AWS.SQS.Queue("NotificationsQueue");
+    const subscriptionAttrsQueue = yield* AWS.SQS.Queue(
+      "SubscriptionAttrsQueue",
+    );
+    const eventFunction = yield* SNSEventFunction;
+    const subscription = yield* AWS.SNS.Subscription("FixtureSubscription", {
+      topicArn: topic.topicArn,
+      protocol: "lambda",
+      endpoint: eventFunction.functionArn,
+      returnSubscriptionArn: true,
+    });
+    const queueSubscription = yield* AWS.SNS.Subscription(
+      "QueueFixtureSubscription",
+      {
+        topicArn: topic.topicArn,
+        protocol: "sqs",
+        endpoint: subscriptionAttrsQueue.queueArn,
+        returnSubscriptionArn: true,
+      },
+    );
+    return {
+      topic,
+      queue,
+      subscription,
+      subscriptionAttrsQueue,
+      queueSubscription,
+    };
+  }),
+).pipe(Layer.provide(SNSEventFunctionLive));
+
+export class SNSApiFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "SNSApiFunction",
+  {
+    main,
+    url: true,
+    env: {
+      DEBUG: "true",
+    },
+  },
+) {}
+
+export const SNSApiFunctionLive = SNSApiFunction.make(
+  Effect.gen(function* () {
+    const { topic, queue, subscription, queueSubscription } =
+      yield* TopicAndQueue;
+
+    const publish = yield* AWS.SNS.Publish.bind(topic);
+    const publishBatch = yield* AWS.SNS.PublishBatch.bind(topic);
+    const getTopicAttributes = yield* AWS.SNS.GetTopicAttributes.bind(topic);
+    const setTopicAttributes = yield* AWS.SNS.SetTopicAttributes.bind(topic);
+    const addPermission = yield* AWS.SNS.AddPermission.bind(topic);
+    const removePermission = yield* AWS.SNS.RemovePermission.bind(topic);
+    const getDataProtectionPolicy =
+      yield* AWS.SNS.GetDataProtectionPolicy.bind(topic);
+    const putDataProtectionPolicy =
+      yield* AWS.SNS.PutDataProtectionPolicy.bind(topic);
+    const listTopics = yield* AWS.SNS.ListTopics.bind();
+    const listSubscriptions = yield* AWS.SNS.ListSubscriptions.bind();
+    const listSubscriptionsByTopic =
+      yield* AWS.SNS.ListSubscriptionsByTopic.bind(topic);
+    const listTagsForResource = yield* AWS.SNS.ListTagsForResource.bind(topic);
+    const tagResource = yield* AWS.SNS.TagResource.bind(topic);
+    const untagResource = yield* AWS.SNS.UntagResource.bind(topic);
+    const getSubscriptionAttributes =
+      yield* AWS.SNS.GetSubscriptionAttributes.bind(queueSubscription);
+    const setSubscriptionAttributes =
+      yield* AWS.SNS.SetSubscriptionAttributes.bind(queueSubscription);
+    const confirmSubscription =
+      yield* AWS.SNS.ConfirmSubscription.bind(subscription);
+    const sink = yield* AWS.SNS.TopicSink.bind(topic);
+    const TopicArn = yield* topic.topicArn;
+    const accountId = TopicArn.pipe(
+      Effect.map((topicArn) => topicArn.split(":")[4] ?? ""),
+    );
+
+    const queueSink = yield* AWS.SQS.QueueSink.bind(queue);
+
+    yield* AWS.SNS.notifications(topic).subscribe((stream) =>
+      stream.pipe(
+        Stream.map((notification) =>
+          JSON.stringify({
+            topicArn: notification.TopicArn,
+            message: notification.Message,
+            subject: notification.Subject,
+            messageId: notification.MessageId,
+          }),
+        ),
+        Stream.run(queueSink),
+      ),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+        const pathname = url.pathname;
+
+        if (request.method === "GET" && pathname === "/ready") {
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && pathname === "/publish") {
+          const body = (yield* request.json) as {
+            message: string;
+            subject?: string;
+          };
+          const response = yield* publish({
+            Message: body.message,
+            Subject: body.subject,
+          });
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (request.method === "POST" && pathname === "/publish-batch") {
+          const body = (yield* request.json) as { messages: string[] };
+          const response = yield* publishBatch({
+            PublishBatchRequestEntries: body.messages.map((message, index) => ({
+              Id: `${index}`,
+              Message: message,
+            })),
+          });
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (request.method === "POST" && pathname === "/sink") {
+          const body = (yield* request.json) as { messages: string[] };
+          yield* Stream.fromIterable(body.messages).pipe(Stream.run(sink));
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "GET" && pathname === "/topic-attributes") {
+          return yield* HttpServerResponse.json(yield* getTopicAttributes());
+        }
+
+        if (request.method === "POST" && pathname === "/topic-attributes") {
+          const body = (yield* request.json) as {
+            name: string;
+            value?: string;
+          };
+          return yield* HttpServerResponse.json(
+            yield* setTopicAttributes({
+              AttributeName: body.name,
+              AttributeValue: body.value,
+            }),
+          );
+        }
+
+        if (request.method === "POST" && pathname === "/add-permission") {
+          const label = "FixturePublishPermission";
+          const response = yield* addPermission({
+            Label: label,
+            AWSAccountId: [yield* accountId],
+            ActionName: ["Publish"],
+          });
+          return yield* HttpServerResponse.json({ label, response });
+        }
+
+        if (request.method === "POST" && pathname === "/remove-permission") {
+          const response = yield* removePermission({
+            Label: "FixturePublishPermission",
+          });
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (
+          request.method === "GET" &&
+          pathname === "/data-protection-policy"
+        ) {
+          return yield* HttpServerResponse.json(
+            yield* getDataProtectionPolicy().pipe(
+              Effect.catch((error) => Effect.succeed(formatError(error))),
+            ),
+          );
+        }
+
+        if (
+          request.method === "POST" &&
+          pathname === "/data-protection-policy"
+        ) {
+          const body = (yield* request.json) as { policy: string };
+          const response = yield* putDataProtectionPolicy({
+            DataProtectionPolicy: body.policy,
+          }).pipe(Effect.catch((error) => Effect.succeed(formatError(error))));
+          return yield* HttpServerResponse.json(response);
+        }
+
+        if (request.method === "GET" && pathname === "/topics") {
+          return yield* HttpServerResponse.json(yield* listTopics());
+        }
+
+        if (request.method === "GET" && pathname === "/subscriptions") {
+          return yield* HttpServerResponse.json(yield* listSubscriptions());
+        }
+
+        if (
+          request.method === "GET" &&
+          pathname === "/subscriptions-by-topic"
+        ) {
+          return yield* HttpServerResponse.json(
+            yield* listSubscriptionsByTopic(),
+          );
+        }
+
+        if (request.method === "GET" && pathname === "/tags") {
+          return yield* HttpServerResponse.json(yield* listTagsForResource());
+        }
+
+        if (request.method === "POST" && pathname === "/tags") {
+          const body = (yield* request.json) as {
+            key: string;
+            value: string;
+          };
+          return yield* HttpServerResponse.json(
+            yield* tagResource({
+              Tags: [{ Key: body.key, Value: body.value }],
+            }),
+          );
+        }
+
+        if (request.method === "DELETE" && pathname === "/tags") {
+          const body = (yield* request.json) as { keys: string[] };
+          return yield* HttpServerResponse.json(
+            yield* untagResource({
+              TagKeys: body.keys,
+            }),
+          );
+        }
+
+        if (
+          request.method === "GET" &&
+          pathname === "/subscription-attributes"
+        ) {
+          return yield* HttpServerResponse.json(
+            yield* getSubscriptionAttributes(),
+          );
+        }
+
+        if (
+          request.method === "POST" &&
+          pathname === "/subscription-attributes"
+        ) {
+          const body = (yield* request.json) as {
+            name: string;
+            value?: string;
+          };
+          return yield* HttpServerResponse.json(
+            yield* setSubscriptionAttributes({
+              AttributeName: body.name,
+              AttributeValue: body.value,
+            }),
+          );
+        }
+
+        if (request.method === "POST" && pathname === "/confirm-subscription") {
+          const body = (yield* request.json) as { token: string };
+          const response = yield* confirmSubscription({
+            Token: body.token,
+          }).pipe(Effect.catch((error) => Effect.succeed(formatError(error))));
+          return yield* HttpServerResponse.json(response);
+        }
+
+        return yield* HttpServerResponse.json(
+          { error: "Not found", method: request.method, pathname },
+          { status: 404 },
+        );
+      }).pipe(Effect.orDie),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(
+          TopicAndQueueLive,
+          AWS.Lambda.TopicEventSource,
+          AWS.SNS.TopicSinkLive,
+          AWS.SQS.QueueSinkLive,
+        ),
+        Layer.mergeAll(
+          AWS.SNS.AddPermissionLive,
+          AWS.SNS.ConfirmSubscriptionLive,
+          AWS.SNS.GetDataProtectionPolicyLive,
+          AWS.SNS.GetSubscriptionAttributesLive,
+          AWS.SNS.GetTopicAttributesLive,
+          AWS.SNS.ListSubscriptionsByTopicLive,
+          AWS.SNS.ListSubscriptionsLive,
+          AWS.SNS.ListTagsForResourceLive,
+          AWS.SNS.ListTopicsLive,
+          AWS.SNS.PublishBatchLive,
+          AWS.SNS.PublishLive,
+          AWS.SNS.PutDataProtectionPolicyLive,
+          AWS.SNS.RemovePermissionLive,
+          AWS.SNS.SetSubscriptionAttributesLive,
+          AWS.SNS.SetTopicAttributesLive,
+          AWS.SNS.TagResourceLive,
+          AWS.SNS.UntagResourceLive,
+          AWS.SQS.SendMessageBatchLive,
+        ),
+      ),
+    ),
+  ),
+).pipe(Layer.provideMerge(TopicAndQueueLive));
+
+export default SNSApiFunctionLive;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/SQS/Queue.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/SQS/Queue.test.ts
new file mode 100644
index 00000000000..a514a33df66
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/SQS/Queue.test.ts
@@ -0,0 +1,405 @@
+import { adopt } from "@/AdoptPolicy";
+import * as AWS from "@/AWS";
+import { Queue } from "@/AWS/SQS";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as SQS from "@distilled.cloud/aws/sqs";
+import { expect } from "@effect/vitest";
+import * as Console from "effect/Console";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { QueueSinkFunction, QueueSinkFunctionLive } from "./sink-handler";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+test.provider("create and delete queue with default props", (stack) =>
+  Effect.gen(function* () {
+    const queue = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Queue("DefaultQueue");
+      }),
+    );
+
+    expect(queue.queueName).toBeDefined();
+    expect(queue.queueUrl).toBeDefined();
+    expect(queue.queueArn).toBeDefined();
+
+    const queueAttributes = yield* SQS.getQueueAttributes({
+      QueueUrl: queue.queueUrl,
+      AttributeNames: ["All"],
+    });
+    expect(queueAttributes.Attributes).toBeDefined();
+
+    yield* stack.destroy();
+
+    yield* assertQueueDeleted(queue.queueUrl);
+  }),
+);
+
+test.provider("create, update, delete standard queue", (stack) =>
+  Effect.gen(function* () {
+    const queue = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Queue("TestQueue", {
+          visibilityTimeout: 30,
+          delaySeconds: 0,
+        });
+      }),
+    );
+
+    // Verify the queue was created
+    const queueAttributes = yield* SQS.getQueueAttributes({
+      QueueUrl: queue.queueUrl,
+      AttributeNames: ["All"],
+    });
+    expect(queueAttributes.Attributes?.VisibilityTimeout).toEqual("30");
+    expect(queueAttributes.Attributes?.DelaySeconds).toEqual("0");
+
+    // Update the queue
+    const updatedQueue = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Queue("TestQueue", {
+          visibilityTimeout: 60,
+          delaySeconds: 5,
+        });
+      }),
+    );
+
+    // Verify the queue was updated (reads can lag briefly after SetQueueAttributes)
+    yield* waitForQueueAttributeMatch(updatedQueue.queueUrl, {
+      VisibilityTimeout: "60",
+      DelaySeconds: "5",
+    });
+
+    yield* stack.destroy();
+
+    yield* assertQueueDeleted(queue.queueUrl);
+  }),
+);
+
+test.provider("create, update, delete fifo queue", (stack) =>
+  Effect.gen(function* () {
+    const queue = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Queue("TestFifoQueue", {
+          fifo: true,
+          contentBasedDeduplication: false,
+          visibilityTimeout: 30,
+        });
+      }),
+    );
+
+    // Verify the FIFO queue was created
+    expect(queue.queueUrl).toContain(".fifo");
+    expect(queue.queueName).toContain(".fifo");
+
+    const queueAttributes = yield* SQS.getQueueAttributes({
+      QueueUrl: queue.queueUrl,
+      AttributeNames: ["All"],
+    });
+    expect(queueAttributes.Attributes?.FifoQueue).toEqual("true");
+    expect(queueAttributes.Attributes?.ContentBasedDeduplication).toEqual(
+      "false",
+    );
+
+    // Update the FIFO queue to enable content-based deduplication
+    const updatedQueue = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Queue("TestFifoQueue", {
+          fifo: true,
+          contentBasedDeduplication: true,
+          visibilityTimeout: 60,
+        });
+      }),
+    );
+
+    // Verify the queue was updated (reads can lag briefly after SetQueueAttributes)
+    yield* waitForQueueAttributeMatch(updatedQueue.queueUrl, {
+      ContentBasedDeduplication: "true",
+      VisibilityTimeout: "60",
+    });
+
+    yield* stack.destroy();
+
+    yield* assertQueueDeleted(queue.queueUrl);
+  }),
+);
+
+test.provider("create queue with custom name", (stack) =>
+  Effect.gen(function* () {
+    const queue = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Queue("CustomNameQueue", {
+          queueName: "my-custom-test-queue",
+        });
+      }),
+    );
+
+    expect(queue.queueName).toEqual("my-custom-test-queue");
+    expect(queue.queueUrl).toContain("my-custom-test-queue");
+
+    // Verify the queue exists
+    const queueAttributes = yield* SQS.getQueueAttributes({
+      QueueUrl: queue.queueUrl,
+      AttributeNames: ["All"],
+    });
+    expect(queueAttributes.Attributes).toBeDefined();
+
+    yield* stack.destroy();
+
+    yield* assertQueueDeleted(queue.queueUrl);
+  }),
+);
+
+test.provider(
+  "QueueSink writes arbitrary messages through a deployed Lambda",
+  (stack) =>
+    Effect.gen(function* () {
+      // yield* stack.destroy();
+
+      const apiFunction = yield* stack.deploy(
+        QueueSinkFunction.pipe(Effect.provide(QueueSinkFunctionLive)),
+      );
+      const baseUrl = apiFunction.functionUrl!.replace(/\/+$/, "");
+
+      const { queueUrl } = yield* waitForFunctionReady(`${baseUrl}/ready`);
+
+      const messages = [
+        `sink-${crypto.randomUUID()}`,
+        `sink-${crypto.randomUUID()}`,
+        `sink-${crypto.randomUUID()}`,
+      ];
+      const response = yield* HttpClient.post(`${baseUrl}/sink`, {
+        body: yield* HttpBody.json({ messages }),
+      }).pipe(
+        Effect.flatMap((result) =>
+          result.status === 200
+            ? Effect.succeed(result)
+            : Effect.fail("not ready"),
+        ),
+        Effect.tapError(Console.log),
+        Effect.retry({
+          while: (error) => error === "not ready",
+          schedule: Schedule.fixed("2 seconds").pipe(
+            Schedule.both(Schedule.recurs(75)),
+          ),
+        }),
+        Effect.flatMap((result) => result.json),
+      );
+
+      expect((response as any).ok).toBe(true);
+      expect((response as any).count).toBe(messages.length);
+
+      const received = yield* waitForQueueMessages(queueUrl, messages.length);
+
+      expect(received.sort()).toEqual([...messages].sort());
+
+      yield* stack.destroy();
+
+      yield* assertQueueDeleted(queueUrl);
+    }),
+  { timeout: 180_000 },
+);
+
+// Engine-level adoption tests for SQS Queue.
+test.provider(
+  "owned queue (matching alchemy tags) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const queueName = `alchemy-test-sqs-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Queue("AdoptableQueue", { queueName });
+        }),
+      );
+      expect(initial.queueName).toEqual(queueName);
+
+      // Wipe state — queue stays in SQS.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableQueue",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Queue("AdoptableQueue", { queueName });
+        }),
+      );
+
+      expect(adopted.queueArn).toEqual(initial.queueArn);
+      expect(adopted.queueUrl).toEqual(initial.queueUrl);
+
+      yield* stack.destroy();
+      yield* assertQueueDeleted(initial.queueUrl);
+    }),
+);
+
+test.provider(
+  "foreign-tagged queue requires adopt(true) to take over",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const queueName = `alchemy-test-sqs-takeover-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      const original = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Queue("Original", { queueName });
+        }),
+      );
+
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "Original",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      const takenOver = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* Queue("Different", { queueName });
+          }),
+        )
+        .pipe(adopt(true));
+
+      expect(takenOver.queueName).toEqual(queueName);
+      expect(takenOver.queueUrl).toEqual(original.queueUrl);
+
+      yield* stack.destroy();
+      yield* assertQueueDeleted(takenOver.queueUrl);
+    }),
+);
+
+class QueueStillExists extends Data.TaggedError("QueueStillExists") {}
+
+class FunctionNotReady extends Data.TaggedError("FunctionNotReady") {}
+
+class QueueMessageNotReady extends Data.TaggedError("QueueMessageNotReady") {}
+
+class QueueAttributesNotReady extends Data.TaggedError(
+  "QueueAttributesNotReady",
+) {}
+
+const waitForFunctionReady = (url: string) =>
+  HttpClient.get(url).pipe(
+    Effect.flatMap((response) =>
+      response.status === 200
+        ? (response.json as Effect.Effect<{ queueUrl: string }>)
+        : Effect.fail(new FunctionNotReady()),
+    ),
+    // A freshly-deployed function can briefly serve a 200 before its captured
+    // env vars (the queue URL) have finished propagating, so treat a missing
+    // queueUrl as "not ready yet" and keep polling.
+    Effect.flatMap((json: any) =>
+      typeof json?.queueUrl === "string"
+        ? Effect.succeed({ queueUrl: json.queueUrl as string })
+        : Effect.fail(new FunctionNotReady()),
+    ),
+    Effect.retry({
+      while: (error) => error._tag === "FunctionNotReady",
+      schedule: Schedule.fixed("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(75)),
+      ),
+    }),
+  );
+
+/** Poll until GetQueueAttributes reflects SetQueueAttributes (SQS is eventually consistent). */
+const waitForQueueAttributeMatch = Effect.fn(function* (
+  queueUrl: string,
+  expected: Record<string, string>,
+) {
+  yield* Effect.gen(function* () {
+    const result = yield* SQS.getQueueAttributes({
+      QueueUrl: queueUrl,
+      AttributeNames: ["All"],
+    });
+    const attrs = result.Attributes ?? {};
+    for (const [name, value] of Object.entries(expected)) {
+      if (attrs[name] !== value) {
+        return yield* Effect.fail(new QueueAttributesNotReady());
+      }
+    }
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "QueueAttributesNotReady",
+      schedule: Schedule.fixed("500 millis").pipe(
+        Schedule.both(Schedule.recurs(40)),
+      ),
+    }),
+  );
+});
+
+const waitForQueueMessages = Effect.fn(function* (
+  queueUrl: string,
+  count: number,
+) {
+  const messages: string[] = [];
+
+  while (messages.length < count) {
+    messages.push(yield* waitForQueueMessage(queueUrl));
+  }
+
+  return messages;
+});
+
+const waitForQueueMessage = (queueUrl: string) =>
+  Effect.gen(function* () {
+    const result = yield* SQS.receiveMessage({
+      QueueUrl: queueUrl,
+      MaxNumberOfMessages: 1,
+      WaitTimeSeconds: 2,
+      VisibilityTimeout: 5,
+    });
+
+    const message = result.Messages?.[0];
+    if (!message?.Body || !message.ReceiptHandle) {
+      return yield* Effect.fail(new QueueMessageNotReady());
+    }
+
+    const body = message.Body;
+
+    yield* SQS.deleteMessage({
+      QueueUrl: queueUrl,
+      ReceiptHandle: message.ReceiptHandle,
+    });
+
+    return body;
+  }).pipe(
+    Effect.retry({
+      while: (error) => error._tag === "QueueMessageNotReady",
+      schedule: Schedule.fixed("2 seconds").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+
+const assertQueueDeleted = Effect.fn(function* (queueUrl: string) {
+  yield* SQS.getQueueAttributes({
+    QueueUrl: queueUrl,
+    AttributeNames: ["All"],
+  }).pipe(
+    Effect.flatMap(() => Effect.fail(new QueueStillExists())),
+    Effect.retry({
+      while: (e) => e._tag === "QueueStillExists",
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catchTag("QueueDoesNotExist", () => Effect.void),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/SQS/sink-handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/SQS/sink-handler.ts
new file mode 100644
index 00000000000..53c48fc9093
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/SQS/sink-handler.ts
@@ -0,0 +1,87 @@
+import * as AWS from "@/AWS";
+import * as Console from "effect/Console";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import path from "pathe";
+
+const main = path.resolve(import.meta.dirname, "sink-handler.ts");
+
+export class TestQueue extends Context.Service<
+  TestQueue,
+  { queue: AWS.SQS.Queue }
+>()("TestQueue") {}
+
+export const TestQueueLive = Layer.effect(
+  TestQueue,
+  Effect.gen(function* () {
+    const queue = yield* AWS.SQS.Queue("QueueSinkQueue");
+    return { queue };
+  }),
+);
+
+export class QueueSinkFunction extends AWS.Lambda.Function<AWS.Lambda.Function>()(
+  "QueueSinkFunction",
+  {
+    main,
+    url: true,
+  },
+) {}
+
+export const QueueSinkFunctionLive = QueueSinkFunction.make(
+  Effect.gen(function* () {
+    const { queue } = yield* TestQueue;
+    const sink = yield* AWS.SQS.QueueSink.bind(queue);
+    const queueUrl = yield* queue.queueUrl;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        yield* Console.log(request);
+        const pathname = new URL(request.originalUrl).pathname;
+
+        if (request.method === "GET" && pathname === "/ready") {
+          return yield* HttpServerResponse.json({
+            ok: true,
+            queueUrl: yield* queueUrl,
+          });
+        }
+
+        if (request.method === "POST" && pathname === "/sink") {
+          const body = (yield* request.json) as { messages: string[] };
+
+          yield* Stream.fromIterable(body.messages).pipe(Stream.run(sink));
+
+          return yield* HttpServerResponse.json({
+            ok: true,
+            count: body.messages.length,
+          });
+        }
+
+        return yield* HttpServerResponse.json(
+          { error: "Not found", method: request.method, pathname },
+          { status: 404 },
+        );
+      }).pipe(
+        Effect.tapError(Console.log),
+        Effect.tap(Console.log),
+        Effect.catch(() =>
+          Effect.succeed(
+            HttpServerResponse.text("Internal server error", { status: 500 }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.provideMerge(
+        Layer.mergeAll(TestQueueLive, AWS.SQS.QueueSinkLive),
+        Layer.mergeAll(AWS.SQS.SendMessageBatchLive),
+      ),
+    ),
+  ),
+);
+export default QueueSinkFunctionLive;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Secret/Secret.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Secret/Secret.test.ts
new file mode 100644
index 00000000000..522a657de09
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Secret/Secret.test.ts
@@ -0,0 +1,152 @@
+import * as AWS from "@/AWS";
+import * as Alchemy from "@/index.ts";
+import * as State from "@/State";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import SecretsTestFunctionLive, {
+  CONFIG_SECRET_ENV_KEY,
+  LITERAL_SECRET_VALUE,
+  NUMBER_VAR_VALUE,
+  OBJECT_VAR_VALUE,
+  STRING_VAR_VALUE,
+  SecretsTestFunction,
+} from "./fixtures/handler.ts";
+
+/**
+ * `Config.redacted("CONFIG_SECRET")` resolves against the active
+ * `ConfigProvider` at deploy time. The default provider reads from
+ * `process.env`, so populate it before `beforeAll(deploy(Stack))`
+ * compiles the stack.
+ */
+const CONFIG_SECRET_VALUE = "sk-from-aws-config-source-xyz";
+process.env[CONFIG_SECRET_ENV_KEY] = CONFIG_SECRET_VALUE;
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: AWS.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const Stack = Alchemy.Stack(
+  "AlchemySecretLambdaStack",
+  {
+    providers: AWS.providers(),
+    state: State.localState(),
+  },
+  Effect.gen(function* () {
+    const fn = yield* SecretsTestFunction;
+    return {
+      url: fn.functionUrl.as<string>(),
+    };
+  }).pipe(Effect.provide(SecretsTestFunctionLive)),
+);
+
+const stack = beforeAll(deploy(Stack), { timeout: 90_000 });
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack), { timeout: 60_000 });
+
+// Lambda Function URLs cold-start (DNS, IAM propagation, init) can take
+// well over a minute on a fresh deploy under parallel load. Budget a
+// generous retry window for the very first request, then reuse the
+// warm URL for subsequent calls.
+const readinessSchedule = Schedule.fixed("2 seconds").pipe(
+  Schedule.both(Schedule.recurs(20)),
+);
+
+const getJson = (url: string) =>
+  HttpClient.get(url).pipe(
+    Effect.flatMap((res) =>
+      res.status === 200
+        ? Effect.flatMap(res.json, (body) => Effect.succeed(body))
+        : Effect.fail(new Error(`Request failed: ${res.status}`)),
+    ),
+    Effect.retry({ schedule: readinessSchedule }),
+  );
+
+test(
+  "Config.redacted with literal default round-trips to Lambda runtime as Redacted<string>",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    expect(url).toBeTypeOf("string");
+
+    const baseUrl = url.replace(/\/+$/, "");
+    const body = (yield* getJson(`${baseUrl}/secret/literal`)) as {
+      isRedacted: boolean;
+      value: string;
+    };
+    expect(body).toEqual({
+      isRedacted: true,
+      value: LITERAL_SECRET_VALUE,
+    });
+  }).pipe(logLevel),
+  { timeout: 45_000 },
+);
+
+test(
+  "Config.redacted resolved from env round-trips through Lambda env",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const body = (yield* getJson(`${baseUrl}/secret/config`)) as {
+      isRedacted: boolean;
+      value: string;
+    };
+    expect(body).toEqual({
+      isRedacted: true,
+      value: CONFIG_SECRET_VALUE,
+    });
+  }).pipe(logLevel),
+  { timeout: 45_000 },
+);
+
+test(
+  "Config.string round-trips to Lambda runtime as a string",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const body = (yield* getJson(`${baseUrl}/var/string`)) as {
+      type: string;
+      value: unknown;
+    };
+    expect(body).toEqual({ type: "string", value: STRING_VAR_VALUE });
+  }).pipe(logLevel),
+  { timeout: 45_000 },
+);
+
+test(
+  "Config.number round-trips to Lambda runtime preserving the number type",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const body = (yield* getJson(`${baseUrl}/var/number`)) as {
+      type: string;
+      value: unknown;
+    };
+    expect(body).toEqual({ type: "number", value: NUMBER_VAR_VALUE });
+  }).pipe(logLevel),
+  { timeout: 45_000 },
+);
+
+test(
+  "Config.string with object default round-trips to Lambda runtime preserving nested shape",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const baseUrl = url.replace(/\/+$/, "");
+
+    const body = (yield* getJson(`${baseUrl}/var/object`)) as {
+      type: string;
+      value: unknown;
+    };
+    expect(body).toEqual({ type: "object", value: OBJECT_VAR_VALUE });
+  }).pipe(logLevel),
+  { timeout: 45_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Secret/fixtures/handler.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Secret/fixtures/handler.ts
new file mode 100644
index 00000000000..c143c443419
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Secret/fixtures/handler.ts
@@ -0,0 +1,120 @@
+import * as Lambda from "@/AWS/Lambda";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import path from "pathe";
+
+const main = path.resolve(import.meta.dirname, "handler.ts");
+
+/**
+ * Hard-coded values the integ test asserts against to prove the
+ * deploy-time bindings flow all the way through to the runtime.
+ */
+export const LITERAL_SECRET_VALUE = "sk-aws-literal-secret-abc";
+export const STRING_VAR_VALUE = "plain-aws-string-value";
+export const NUMBER_VAR_VALUE = 9090;
+export const OBJECT_VAR_VALUE = {
+  region: "us-east-1",
+  flags: { canary: true },
+};
+
+/**
+ * Name of the deploy-time `process.env` variable the test populates
+ * before deploying — sourced via `Config.string(...)` inside the
+ * Lambda's init phase.
+ */
+export const CONFIG_SECRET_ENV_KEY = "ALCHEMY_AWS_SECRET_TEST_SOURCE";
+
+export class SecretsTestFunction extends Lambda.Function<SecretsTestFunction>()(
+  "SecretsTestFunction",
+  {
+    main,
+    url: true,
+  },
+) {}
+
+export const SecretsTestFunctionLive = SecretsTestFunction.make(
+  Effect.gen(function* () {
+    // Secret from a literal — `Alchemy.Secret` coerces the literal to
+    // `Redacted` and the Lambda runtime accessor rebuilds the wrapper
+    // from the JSON marker stored in env.
+    const literalSecret = yield* Config.redacted("LITERAL_SECRET").pipe(
+      Config.withDefault(Redacted.make(LITERAL_SECRET_VALUE)),
+    );
+
+    // Secret from a `Config` — resolved against the active
+    // `ConfigProvider` (process.env) at deploy time. The test populates
+    // `process.env[CONFIG_SECRET_ENV_KEY]` before deploying, so source
+    // from that same key (not a hard-coded literal).
+    const configSecret = yield* Config.redacted(CONFIG_SECRET_ENV_KEY);
+
+    // Plain string variable — string round-trip.
+    const stringVar = yield* Config.string("STRING_VAR").pipe(
+      Config.withDefault(STRING_VAR_VALUE),
+    );
+
+    // Number variable — non-string values JSON.stringify on `set` and
+    // JSON.parse on the runtime accessor, so the accessor returns the
+    // original number.
+    const numberVar = yield* Config.number("NUMBER_VAR").pipe(
+      Config.withDefault(NUMBER_VAR_VALUE),
+    );
+
+    // Object variable — same JSON round-trip as above for nested data.
+    const objectVar = yield* Config.string("OBJECT_VAR").pipe(
+      Config.withDefault(OBJECT_VAR_VALUE),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+        const pathname = url.pathname;
+
+        switch (pathname) {
+          case "/ready":
+            return HttpServerResponse.text("ok");
+          case "/secret/literal": {
+            return yield* HttpServerResponse.json({
+              isRedacted: Redacted.isRedacted(literalSecret),
+              value: Redacted.value(literalSecret),
+            });
+          }
+          case "/secret/config": {
+            return yield* HttpServerResponse.json({
+              isRedacted: Redacted.isRedacted(configSecret),
+              value: Redacted.value(configSecret),
+            });
+          }
+          case "/var/string": {
+            return yield* HttpServerResponse.json({
+              type: typeof stringVar,
+              value: stringVar,
+            });
+          }
+          case "/var/number": {
+            return yield* HttpServerResponse.json({
+              type: typeof numberVar,
+              value: numberVar,
+            });
+          }
+          case "/var/object": {
+            return yield* HttpServerResponse.json({
+              type: typeof objectVar,
+              value: objectVar,
+            });
+          }
+          default:
+            return HttpServerResponse.json(
+              { error: "Not found", pathname },
+              { status: 404 },
+            );
+        }
+      }).pipe(Effect.orDie),
+    };
+  }),
+);
+
+export default SecretsTestFunctionLive;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/AWS/Website/Router.test.ts b/.repos/alchemy-effect/packages/alchemy/test/AWS/Website/Router.test.ts
new file mode 100644
index 00000000000..d9107a8f0d1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/AWS/Website/Router.test.ts
@@ -0,0 +1,78 @@
+import * as AWS from "@/AWS";
+import * as Test from "@/Test/Vitest";
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+// slow AF
+describe.skip("AWS.Website.Router", () => {
+  test.provider(
+    "create router with static-site attached via KV routing",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const deployed = yield* stack.deploy(
+          Effect.gen(function* () {
+            const router = yield* AWS.Website.Router("Router", {
+              invalidation: {
+                paths: "all",
+                wait: true,
+              },
+            });
+
+            const site = yield* AWS.Website.StaticSite("DocsSite", {
+              path: "examples/aws-static-site/site",
+              forceDestroy: true,
+              router: {
+                instance: {
+                  kvStoreArn: router.kvStoreArn,
+                  kvNamespace: router.kvNamespace,
+                  distributionId: router.distributionId,
+                  url: router.url,
+                },
+              },
+            });
+
+            return {
+              site,
+              router,
+            };
+          }),
+        );
+
+        expect(deployed.router.distribution.distributionId).toBeDefined();
+        expect(deployed.router.kvStoreArn).toBeDefined();
+
+        const config = yield* cloudfront.getDistributionConfig({
+          Id: deployed.router.distribution.distributionId,
+        });
+        expect(
+          config.DistributionConfig?.DefaultCacheBehavior?.FunctionAssociations
+            ?.Quantity,
+        ).toBeGreaterThanOrEqual(1);
+
+        yield* stack.destroy();
+        yield* assertDistributionDeleted(
+          deployed.router.distribution.distributionId,
+        );
+      }),
+    { timeout: 600_000 },
+  );
+});
+
+const assertDistributionDeleted = (distributionId: string) =>
+  cloudfront.getDistribution({ Id: distributionId }).pipe(
+    Effect.flatMap(() => Effect.fail(new Error("DistributionStillExists"))),
+    Effect.catchTag("NoSuchDistribution", () => Effect.void),
+    Effect.retry({
+      while: (error) =>
+        error instanceof Error && error.message === "DistributionStillExists",
+      schedule: Schedule.fixed("10 seconds").pipe(
+        Schedule.both(Schedule.recurs(60)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Build/Build.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Build/Build.test.ts
new file mode 100644
index 00000000000..a3ae9ed8328
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Build/Build.test.ts
@@ -0,0 +1,105 @@
+import * as AWS from "@/AWS";
+import * as Build from "@/Build";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as pathe from "pathe";
+
+const { test } = Test.make({ providers: AWS.providers() });
+
+const fixtureDir = pathe.resolve(import.meta.dirname, "fixture");
+
+test.provider(
+  "create, skip, update, delete build",
+  (stack) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      yield* stack.destroy();
+
+      const distDir = pathe.join(fixtureDir, "dist");
+      yield* fs
+        .remove(distDir, { recursive: true })
+        .pipe(Effect.catch(() => Effect.void));
+
+      const build1 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Build.Command("test-build", {
+            command: "bash build.sh",
+            cwd: fixtureDir,
+            outdir: "dist",
+          });
+        }),
+      );
+
+      expect(build1.outdir).toBe(distDir);
+      expect(build1.hash).toBeDefined();
+      expect(typeof build1.hash).toBe("string");
+      expect(build1.hash.length).toBeGreaterThan(0);
+
+      const distExists = yield* fs.exists(distDir);
+      expect(distExists).toBe(true);
+
+      const outputExists = yield* fs.exists(pathe.join(distDir, "output.txt"));
+      expect(outputExists).toBe(true);
+
+      const firstBuildOutput = yield* fs.readFileString(
+        pathe.join(distDir, "output.txt"),
+      );
+
+      yield* Effect.sleep(1100);
+
+      const build2 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Build.Command("test-build", {
+            command: "bash build.sh",
+            cwd: fixtureDir,
+            outdir: "dist",
+          });
+        }),
+      );
+
+      expect(build2.hash).toBe(build1.hash);
+
+      const secondBuildOutput = yield* fs.readFileString(
+        pathe.join(distDir, "output.txt"),
+      );
+      expect(secondBuildOutput).toBe(firstBuildOutput);
+
+      yield* fs.writeFileString(
+        pathe.join(fixtureDir, "src", "main.ts"),
+        'export const message = "Updated!";\n',
+      );
+
+      const build3 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Build.Command("test-build", {
+            command: "bash build.sh",
+            cwd: fixtureDir,
+            outdir: "dist",
+          });
+        }),
+      );
+
+      expect(build3.hash).not.toBe(build1.hash);
+
+      const thirdBuildOutput = yield* fs.readFileString(
+        pathe.join(distDir, "output.txt"),
+      );
+      expect(thirdBuildOutput).not.toBe(firstBuildOutput);
+
+      yield* fs.writeFileString(
+        pathe.join(fixtureDir, "src", "main.ts"),
+        'export const message = "Hello, World!";\n',
+      );
+
+      yield* stack.destroy();
+
+      const distExistsAfterDestroy = yield* fs.exists(distDir);
+      expect(distExistsAfterDestroy).toBe(false);
+    }),
+  { timeout: 60000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Build/fixture/build.sh b/.repos/alchemy-effect/packages/alchemy/test/Build/fixture/build.sh
new file mode 100755
index 00000000000..f0825e26f12
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Build/fixture/build.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+mkdir -p dist
+echo "Built at $(date)" > dist/output.txt
+cp src/main.ts dist/main.ts
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Build/fixture/src/main.ts b/.repos/alchemy-effect/packages/alchemy/test/Build/fixture/src/main.ts
new file mode 100644
index 00000000000..12c37a0bd1a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Build/fixture/src/main.ts
@@ -0,0 +1 @@
+export const message = "Hello, World!";
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Bundle/Docker.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Bundle/Docker.test.ts
new file mode 100644
index 00000000000..876a79c9869
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Bundle/Docker.test.ts
@@ -0,0 +1,220 @@
+import {
+  DockerCommandError,
+  dockerBuild,
+  materializeDockerfile,
+  runDockerCommand,
+  writeContextFiles,
+} from "@/Bundle/Docker";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Result from "effect/Result";
+import { spawnSync } from "node:child_process";
+
+const dockerDaemonOk =
+  spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0;
+
+describe("docker context helpers", () => {
+  it.effect("materializes a Dockerfile in the target directory", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({
+        prefix: "alchemy-docker-ctx-",
+      });
+      try {
+        const ctx = path.join(root, "ctx");
+        const dockerfile = yield* materializeDockerfile("FROM scratch\n", ctx);
+        expect(dockerfile).toBe(path.join(ctx, "Dockerfile"));
+        expect(yield* fs.exists(dockerfile)).toBe(true);
+        expect(yield* fs.readFileString(dockerfile)).toBe("FROM scratch\n");
+      } finally {
+        yield* fs
+          .remove(root, { recursive: true })
+          .pipe(Effect.catch(() => Effect.void));
+      }
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("writes nested context files", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({
+        prefix: "alchemy-docker-path-",
+      });
+      try {
+        const ctx = path.join(root, "ctx");
+        yield* writeContextFiles(ctx, [
+          { path: "nested/hello.txt", content: "hi" },
+        ]);
+        expect(
+          yield* fs.readFileString(path.join(ctx, "nested", "hello.txt")),
+        ).toBe("hi");
+      } finally {
+        yield* fs
+          .remove(root, { recursive: true })
+          .pipe(Effect.catch(() => Effect.void));
+      }
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
+
+describe("runDockerCommand", () => {
+  it.effect("fails with DockerCommandError for invalid docker invocation", () =>
+    Effect.gen(function* () {
+      const result = yield* Effect.result(
+        runDockerCommand([
+          "inspect",
+          "--type=image",
+          "this-image-should-not-exist-alchemy-test:xyz",
+        ]),
+      );
+      expect(Result.isFailure(result)).toBe(true);
+      if (Result.isFailure(result)) {
+        expect(result.failure).toBeInstanceOf(DockerCommandError);
+      }
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
+
+describe("dockerBuild", () => {
+  if (dockerDaemonOk) {
+    it.effect("builds a minimal image with content Dockerfile", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-docker-build-",
+        });
+        try {
+          const ctx = path.join(root, "ctx");
+          const tag = "alchemy-docker-test:minimal";
+          yield* materializeDockerfile(
+            [
+              "FROM alpine:3.19",
+              "RUN echo ok > /tmp/ok.txt",
+              'CMD ["cat", "/tmp/ok.txt"]',
+              "",
+            ].join("\n"),
+            ctx,
+          );
+          yield* dockerBuild({
+            tag,
+            context: ctx,
+          });
+          const inspect = yield* runDockerCommand([
+            "image",
+            "inspect",
+            tag,
+            "--format",
+            "{{.Id}}",
+          ]);
+          expect(inspect.stdout.trim().length).toBeGreaterThan(0);
+          yield* runDockerCommand(["rmi", "-f", tag]).pipe(
+            Effect.catch(() => Effect.void),
+          );
+        } finally {
+          yield* fs
+            .remove(root, { recursive: true })
+            .pipe(Effect.catch(() => Effect.void));
+        }
+      }).pipe(Effect.provide(NodeServices.layer)),
+    );
+
+    it.effect("passes --platform and --build-arg", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-docker-build-",
+        });
+        try {
+          const ctx = path.join(root, "ctx");
+          const tag = "alchemy-docker-test:args";
+          yield* materializeDockerfile(
+            [
+              "FROM alpine:3.19",
+              "ARG FOO=default",
+              'RUN echo "$FOO" > /out.txt',
+              "",
+            ].join("\n"),
+            ctx,
+          );
+          yield* dockerBuild({
+            tag,
+            context: ctx,
+            platform: "linux/amd64",
+            buildArgs: { FOO: "from-arg" },
+          });
+          const out = yield* runDockerCommand([
+            "run",
+            "--rm",
+            tag,
+            "cat",
+            "/out.txt",
+          ]);
+          expect(out.stdout.trim()).toBe("from-arg");
+          yield* runDockerCommand(["rmi", "-f", tag]).pipe(
+            Effect.catch(() => Effect.void),
+          );
+        } finally {
+          yield* fs
+            .remove(root, { recursive: true })
+            .pipe(Effect.catch(() => Effect.void));
+        }
+      }).pipe(Effect.provide(NodeServices.layer)),
+    );
+
+    it.effect("respects multi-stage --target", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-docker-build-",
+        });
+        try {
+          const ctx = path.join(root, "ctx");
+          const tag = "alchemy-docker-test:target";
+          yield* materializeDockerfile(
+            [
+              "FROM alpine:3.19 AS base",
+              "RUN echo base > /stage.txt",
+              "",
+              "FROM alpine:3.19 AS secondary",
+              "RUN echo secondary > /stage.txt",
+              "",
+            ].join("\n"),
+            ctx,
+          );
+          yield* dockerBuild({
+            tag,
+            context: ctx,
+            target: "secondary",
+          });
+          const out = yield* runDockerCommand([
+            "run",
+            "--rm",
+            tag,
+            "cat",
+            "/stage.txt",
+          ]);
+          expect(out.stdout.trim()).toBe("secondary");
+          yield* runDockerCommand(["rmi", "-f", tag]).pipe(
+            Effect.catch(() => Effect.void),
+          );
+        } finally {
+          yield* fs
+            .remove(root, { recursive: true })
+            .pipe(Effect.catch(() => Effect.void));
+        }
+      }).pipe(Effect.provide(NodeServices.layer)),
+    );
+  } else {
+    it.skip("builds a minimal image with content Dockerfile", () => {});
+    it.skip("passes --platform and --build-arg", () => {});
+    it.skip("respects multi-stage --target", () => {});
+  }
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Bundle/PurePlugin.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Bundle/PurePlugin.test.ts
new file mode 100644
index 00000000000..f03a22d7b33
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Bundle/PurePlugin.test.ts
@@ -0,0 +1,596 @@
+import * as Bundle from "@/Bundle/Bundle";
+import {
+  annotateModule,
+  packageNameFromId,
+  purePlugin,
+  resolvePackageName,
+} from "@/Bundle/PurePlugin";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as nodeFs from "node:fs";
+import * as nodePath from "node:path";
+import * as os from "node:os";
+import { rolldown } from "rolldown";
+
+describe("packageNameFromId", () => {
+  it("extracts a top-level package name", () => {
+    expect(packageNameFromId("/proj/node_modules/effect/dist/Effect.js")).toBe(
+      "effect",
+    );
+  });
+
+  it("extracts a scoped package name", () => {
+    expect(
+      packageNameFromId("/proj/node_modules/@effect/cluster/dist/index.js"),
+    ).toBe("@effect/cluster");
+  });
+
+  it("uses the LAST node_modules segment for nested deps", () => {
+    expect(
+      packageNameFromId(
+        "/proj/node_modules/foo/node_modules/effect/dist/Effect.js",
+      ),
+    ).toBe("effect");
+  });
+
+  it("returns null for ids outside node_modules", () => {
+    expect(packageNameFromId("/proj/src/Bundle.ts")).toBeNull();
+  });
+
+  it("normalizes Windows-style separators", () => {
+    expect(
+      packageNameFromId(
+        "C:\\proj\\node_modules\\@effect\\cluster\\dist\\index.js",
+      ),
+    ).toBe("@effect/cluster");
+  });
+});
+
+describe("resolvePackageName (filesystem walk)", () => {
+  it("falls back to walking up to the nearest package.json for non-node_modules ids", async () => {
+    const root = nodeFs.mkdtempSync(
+      nodePath.join(os.tmpdir(), "alchemy-resolve-pkg-"),
+    );
+    try {
+      const pkgDir = nodePath.join(root, "packages", "fancy-pkg");
+      nodeFs.mkdirSync(nodePath.join(pkgDir, "src", "deep"), {
+        recursive: true,
+      });
+      nodeFs.writeFileSync(
+        nodePath.join(pkgDir, "package.json"),
+        JSON.stringify({ name: "@scope/fancy-pkg" }),
+      );
+      const id = nodePath.join(pkgDir, "src", "deep", "Mod.ts");
+      const cache = new Map<string, string | null>();
+
+      expect(await resolvePackageName(id, cache)).toBe("@scope/fancy-pkg");
+      // Repeat hits the cache; result is identical and the visited dirs
+      // are populated.
+      expect(await resolvePackageName(id, cache)).toBe("@scope/fancy-pkg");
+      expect(cache.size).toBeGreaterThan(0);
+    } finally {
+      nodeFs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("strips ?query and #hash suffixes before walking", async () => {
+    const root = nodeFs.mkdtempSync(
+      nodePath.join(os.tmpdir(), "alchemy-resolve-pkg-"),
+    );
+    try {
+      const pkgDir = nodePath.join(root, "pkg");
+      nodeFs.mkdirSync(pkgDir, { recursive: true });
+      nodeFs.writeFileSync(
+        nodePath.join(pkgDir, "package.json"),
+        JSON.stringify({ name: "with-query" }),
+      );
+      const id = `${nodePath.join(pkgDir, "Mod.ts")}?v=123`;
+      expect(await resolvePackageName(id, new Map())).toBe("with-query");
+    } finally {
+      nodeFs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("returns null when no package.json is found upward", async () => {
+    const root = nodeFs.mkdtempSync(
+      nodePath.join(os.tmpdir(), "alchemy-resolve-pkg-"),
+    );
+    try {
+      const id = nodePath.join(root, "lonely.ts");
+      nodeFs.writeFileSync(id, "");
+      expect(await resolvePackageName(id, new Map())).toBeNull();
+    } finally {
+      nodeFs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("annotateModule", () => {
+  const annotate = (code: string) =>
+    annotateModule(code, "/n/effect/dist/x.js");
+
+  it("annotates calls in TypeScript source (worker/bun condition path)", () => {
+    const result = annotateModule(
+      `import { make } from "./util";\nexport const x: number = make();\n`,
+      "/proj/packages/alchemy/src/Util.ts",
+    );
+    expect(result).not.toBeNull();
+    expect(result!.code).toContain("/*#__PURE__*/ make()");
+  });
+
+  it("annotates top-level call expressions", () => {
+    const result = annotate(`const x = create();`);
+    expect(result).not.toBeNull();
+    expect(result!.code).toBe(`const x = /*#__PURE__*/ create();`);
+  });
+
+  it("annotates top-level new expressions", () => {
+    const result = annotate(`const x = new Klass();`);
+    expect(result!.code).toBe(`const x = /*#__PURE__*/ new Klass();`);
+  });
+
+  it("annotates calls inside named exports", () => {
+    const result = annotate(`export const x = make();`);
+    expect(result!.code).toBe(`export const x = /*#__PURE__*/ make();`);
+  });
+
+  it("annotates calls inside default exports", () => {
+    const result = annotate(`export default make();`);
+    expect(result!.code).toBe(`export default /*#__PURE__*/ make();`);
+  });
+
+  it("does NOT annotate calls inside function bodies", () => {
+    const result = annotate(`function f() { return inner(); }`);
+    expect(result).toBeNull();
+  });
+
+  it("does NOT annotate IIFEs", () => {
+    const result = annotate(`(function () { sideEffect(); })();`);
+    expect(result).toBeNull();
+  });
+
+  it("does NOT annotate arrow IIFEs", () => {
+    const result = annotate(`(() => sideEffect())();`);
+    expect(result).toBeNull();
+  });
+
+  it("skips already-annotated calls", () => {
+    const result = annotate(`const x = /*#__PURE__*/ create();`);
+    expect(result).toBeNull();
+  });
+
+  it("annotates calls through ts-as expressions", () => {
+    const result = annotate(`const x = make() as Foo;`);
+    expect(result!.code).toContain("/*#__PURE__*/ make()");
+  });
+
+  it("annotates both branches of ternary initializers", () => {
+    const result = annotate(`const x = cond ? a() : b();`);
+    expect(result!.code).toContain("/*#__PURE__*/ a()");
+    expect(result!.code).toContain("/*#__PURE__*/ b()");
+  });
+
+  it("returns a high-resolution source map", () => {
+    const result = annotate(`const x = create();`);
+    expect(result!.map.mappings.length).toBeGreaterThan(0);
+  });
+
+  it("preserves line numbers", () => {
+    const input = `const a = first();\nconst b = second();\n`;
+    const result = annotate(input);
+    expect(result!.code.split("\n").length).toBe(input.split("\n").length);
+  });
+});
+
+/**
+ * Invokes a plugin's `transform` hook directly, regardless of whether it
+ * was defined as a plain function or a `{ filter, handler }` object. The
+ * rolldown transform hook expects four positional arguments `(this, code,
+ * id, meta)` plus a `TransformPluginContext` — we stub both with `any`
+ * since the plugin under test only reads `code` and `id`.
+ */
+async function callTransform(
+  plugin: ReturnType<typeof purePlugin>,
+  code: string,
+  id: string,
+): Promise<unknown> {
+  const transform = plugin.transform;
+  if (transform === undefined) throw new Error("plugin has no transform hook");
+  const handler =
+    typeof transform === "function" ? transform : transform.handler;
+  return await (handler as (...args: any[]) => unknown).call(
+    {} as any,
+    code,
+    id,
+    { moduleType: "js" },
+  );
+}
+
+/**
+ * Invokes a plugin's `options` hook with stubbed plugin context. Awaits
+ * any returned promise so async hooks complete before we proceed.
+ */
+async function callOptions(
+  plugin: ReturnType<typeof purePlugin>,
+  opts: { input: string; cwd?: string },
+): Promise<void> {
+  const optsHook = plugin.options;
+  if (typeof optsHook !== "function") return;
+  await (optsHook as (...args: any[]) => unknown).call({} as any, opts);
+}
+
+const runTransform = callTransform;
+
+describe("purePlugin", () => {
+  it("transforms only modules from matched packages", async () => {
+    const plugin = purePlugin();
+    const userCode = `const x = doThing();`;
+
+    const matched = await runTransform(
+      plugin,
+      userCode,
+      "/proj/node_modules/effect/dist/Effect.js",
+    );
+    expect(matched).not.toBeNull();
+    expect((matched as { code: string }).code).toContain("/*#__PURE__*/");
+
+    const unmatched = await runTransform(
+      plugin,
+      userCode,
+      "/proj/node_modules/lodash/index.js",
+    );
+    expect(unmatched).toBeNull();
+
+    const userland = await runTransform(
+      plugin,
+      userCode,
+      "/proj/src/MyModule.ts",
+    );
+    expect(userland).toBeNull();
+  });
+
+  it("respects user-extended package list", async () => {
+    const plugin = purePlugin({ packages: ["my-lib"] });
+
+    const result = await runTransform(
+      plugin,
+      `const x = doThing();`,
+      "/proj/node_modules/my-lib/index.js",
+    );
+    expect(result).not.toBeNull();
+    expect((result as { code: string }).code).toContain("/*#__PURE__*/");
+
+    const effectResult = await runTransform(
+      plugin,
+      `const x = doThing();`,
+      "/proj/node_modules/effect/dist/Effect.js",
+    );
+    expect(effectResult).not.toBeNull();
+  });
+
+  it("replaceDefaults overrides the default package list", async () => {
+    const plugin = purePlugin({
+      packages: ["my-lib"],
+      replaceDefaults: true,
+    });
+
+    const effectResult = await runTransform(
+      plugin,
+      `const x = doThing();`,
+      "/proj/node_modules/effect/dist/Effect.js",
+    );
+    expect(effectResult).toBeNull();
+  });
+
+  it("does NOT override moduleSideEffects when the package's sideEffects field is unknown", async () => {
+    // Virtual id — there is no real `package.json` to read, so the
+    // plugin must conservatively leave `moduleSideEffects` alone.
+    const plugin = purePlugin();
+    const result = await runTransform(
+      plugin,
+      `function f() { return 1; }`,
+      "/proj/node_modules/effect/dist/Effect.js",
+    );
+    // No annotatable top-level calls AND no disk-backed sideEffects:false
+    // declaration → plugin returns null (no rewrite, no hint).
+    expect(result).toBeNull();
+  });
+});
+
+describe("auto-detect entry package", () => {
+  it.effect(
+    "auto-detects the entry's owning package even WITHOUT a sideEffects field (default-on for user code)",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-pure-autodetect-",
+        });
+        // Plain user package.json — no `sideEffects` field.
+        yield* fs.writeFileString(
+          path.join(root, "package.json"),
+          JSON.stringify({ name: "my-app", type: "module" }),
+        );
+        yield* fs.writeFileString(
+          path.join(root, "entry.ts"),
+          `export const x = makeX();\nfunction makeX() { return 1; }`,
+        );
+
+        const plugin = purePlugin();
+        yield* Effect.promise(() =>
+          callOptions(plugin, {
+            input: path.join(root, "entry.ts"),
+            cwd: root,
+          }),
+        );
+
+        // Annotation must happen even though `sideEffects` is absent.
+        const sourcePath = path.join(root, "lib.ts");
+        const result = yield* Effect.promise(() =>
+          callTransform(
+            plugin,
+            `export const v = make();\nfunction make() { return 1; }`,
+            sourcePath,
+          ),
+        );
+        expect(result).not.toBeNull();
+        expect((result as { code: string }).code).toContain(
+          "/*#__PURE__*/ make()",
+        );
+        // …but moduleSideEffects must NOT be forced false on a package
+        // that did not declare `sideEffects: false`.
+        expect(
+          (result as { moduleSideEffects?: boolean | null }).moduleSideEffects,
+        ).not.toBe(false);
+
+        yield* fs.remove(root, { recursive: true });
+      }).pipe(Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect(
+    "still overrides moduleSideEffects when the package DOES declare sideEffects: false",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-pure-autodetect-sef-",
+        });
+        yield* fs.writeFileString(
+          path.join(root, "package.json"),
+          JSON.stringify({
+            name: "my-pure-app",
+            type: "module",
+            sideEffects: false,
+          }),
+        );
+
+        const plugin = purePlugin();
+        yield* Effect.promise(() =>
+          callOptions(plugin, {
+            input: path.join(root, "entry.ts"),
+            cwd: root,
+          }),
+        );
+
+        const result = yield* Effect.promise(() =>
+          callTransform(
+            plugin,
+            `export const v = make();\nfunction make() { return 1; }`,
+            path.join(root, "lib.ts"),
+          ),
+        );
+        expect(result).not.toBeNull();
+        expect(
+          (result as { moduleSideEffects?: boolean | null }).moduleSideEffects,
+        ).toBe(false);
+
+        yield* fs.remove(root, { recursive: true });
+      }).pipe(Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect(
+    "does NOT mark entries as moduleSideEffects: false, even in matched packages",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-pure-entry-preserve-",
+        });
+        yield* fs.writeFileString(
+          path.join(root, "package.json"),
+          JSON.stringify({
+            name: "my-app",
+            type: "module",
+            sideEffects: false,
+          }),
+        );
+        const entryPath = path.join(root, "entry.ts");
+
+        const plugin = purePlugin();
+        yield* Effect.promise(() =>
+          callOptions(plugin, { input: entryPath, cwd: root }),
+        );
+
+        const entryResult = yield* Effect.promise(() =>
+          callTransform(plugin, `console.log("hello");`, entryPath),
+        );
+        // Entry has no top-level annotatable calls (console.log() is a
+        // top-level call, but it is not a const initializer — wait, it
+        // IS, our walker visits ExpressionStatement.expression too).
+        // Either way the moduleSideEffects flag must NOT be false.
+        if (entryResult !== null) {
+          expect(
+            (entryResult as { moduleSideEffects?: boolean | null })
+              .moduleSideEffects,
+          ).not.toBe(false);
+        }
+
+        yield* fs.remove(root, { recursive: true });
+      }).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
+
+describe("Bundle.build with purePlugin", () => {
+  it.effect(
+    "drops unused exports from a workspace-linked TS package (no node_modules)",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectory({
+          prefix: "alchemy-pure-plugin-ts-",
+        });
+
+        // Mimic a monorepo workspace symlink: the package lives at
+        // packages/fake-ws/, with `src/index.ts` directly importable.
+        const pkgDir = path.join(root, "packages", "fake-ws");
+        yield* fs.makeDirectory(path.join(pkgDir, "src"), { recursive: true });
+        yield* fs.writeFileString(
+          path.join(pkgDir, "package.json"),
+          JSON.stringify({
+            name: "fake-ws",
+            version: "0.0.0",
+            type: "module",
+            sideEffects: false,
+            exports: { ".": "./src/index.ts" },
+          }),
+        );
+        yield* fs.writeFileString(
+          path.join(pkgDir, "src", "index.ts"),
+          [
+            `export const used: string = makeUsed();`,
+            `export const unused: string = makeUnused();`,
+            `function makeUsed(): string { return "USED_TS_MARKER"; }`,
+            `function makeUnused(): string { return "UNUSED_TS_MARKER"; }`,
+          ].join("\n"),
+        );
+
+        // Symlink the package under node_modules so rolldown can find it.
+        const nm = path.join(root, "node_modules");
+        yield* fs.makeDirectory(nm, { recursive: true });
+        nodeFs.symlinkSync(pkgDir, path.join(nm, "fake-ws"), "dir");
+
+        const entry = path.join(root, "entry.ts");
+        yield* fs.writeFileString(
+          entry,
+          `import { used } from "fake-ws";\nconsole.log(used);`,
+        );
+
+        const result = yield* Effect.tryPromise({
+          try: () =>
+            rolldown({
+              input: entry,
+              cwd: root,
+              plugins: [
+                purePlugin({
+                  packages: ["fake-ws"],
+                  replaceDefaults: true,
+                }),
+              ],
+              treeshake: true,
+            }),
+          catch: (cause) => cause,
+        });
+        const { output } = yield* Effect.tryPromise({
+          try: () => result.generate({ format: "esm" }),
+          catch: (cause) => cause,
+        });
+        yield* Effect.tryPromise({
+          try: () => result.close(),
+          catch: (cause) => cause,
+        });
+
+        const code = output
+          .filter((c) => c.type === "chunk")
+          .map((c) => c.code)
+          .join("\n");
+        expect(code).toContain("USED_TS_MARKER");
+        expect(code).not.toContain("UNUSED_TS_MARKER");
+
+        yield* fs.remove(root, { recursive: true });
+      }).pipe(Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("drops unused exports from a side-effect-free fake package", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({
+        prefix: "alchemy-pure-plugin-",
+      });
+
+      const fakePkgDir = path.join(root, "node_modules", "fake-effect");
+      yield* fs.makeDirectory(fakePkgDir, { recursive: true });
+      yield* fs.writeFileString(
+        path.join(fakePkgDir, "package.json"),
+        JSON.stringify({
+          name: "fake-effect",
+          version: "0.0.0",
+          type: "module",
+          main: "./index.js",
+          exports: { ".": "./index.js" },
+        }),
+      );
+      // Module-top-level call without annotation: bundlers normally
+      // assume this could have side-effects and keep it. With pure
+      // annotations + sideEffects:false we expect it dropped.
+      yield* fs.writeFileString(
+        path.join(fakePkgDir, "index.js"),
+        [
+          `export const used = makeUsed();`,
+          `export const unused = makeUnused();`,
+          `function makeUsed() { return "USED_MARKER"; }`,
+          `function makeUnused() { return "UNUSED_MARKER"; }`,
+        ].join("\n"),
+      );
+
+      const entry = path.join(root, "entry.js");
+      yield* fs.writeFileString(
+        entry,
+        `import { used } from "fake-effect"; console.log(used);`,
+      );
+
+      const result = yield* Effect.tryPromise({
+        try: () =>
+          rolldown({
+            input: entry,
+            cwd: root,
+            plugins: [
+              purePlugin({
+                packages: ["fake-effect"],
+                replaceDefaults: true,
+              }),
+            ],
+            treeshake: true,
+          }),
+        catch: (cause) => cause,
+      });
+      const { output } = yield* Effect.tryPromise({
+        try: () => result.generate({ format: "esm" }),
+        catch: (cause) => cause,
+      });
+      yield* Effect.tryPromise({
+        try: () => result.close(),
+        catch: (cause) => cause,
+      });
+
+      const code = output
+        .filter((c) => c.type === "chunk")
+        .map((c) => c.code)
+        .join("\n");
+      expect(code).toContain("USED_MARKER");
+      expect(code).not.toContain("UNUSED_MARKER");
+
+      yield* fs.remove(root, { recursive: true });
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
+
+// Touch Bundle to ensure tree-shaking re-export ordering during type-check.
+void Bundle;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Bundle/RawPlugin.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Bundle/RawPlugin.test.ts
new file mode 100644
index 00000000000..0aab5f535fe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Bundle/RawPlugin.test.ts
@@ -0,0 +1,196 @@
+import * as Bundle from "@/Bundle/Bundle";
+import { RAW_RE, rawPlugin, splitFileAndPostfix } from "@/Bundle/RawPlugin";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { assert, describe, expect, it, layer } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Predicate from "effect/Predicate";
+import * as NodeFs from "node:fs/promises";
+
+layer(NodeServices.layer)("Bundle.build with rawPlugin", (it) => {
+  it.effect("inlines a sibling file imported with ?raw", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({
+        prefix: "alchemy-raw-bundle-",
+      });
+      yield* fs.writeFileString(
+        path.join(root, "hello.txt"),
+        "HELLO_RAW_MARKER",
+      );
+      const entry = path.join(root, "entry.ts");
+      yield* fs.writeFileString(
+        entry,
+        `import txt from "./hello.txt?raw";\nconsole.log(txt);\n`,
+      );
+
+      const result = yield* Bundle.build({
+        input: entry,
+        cwd: root,
+      });
+
+      const code = result.files
+        .filter((f) => typeof f.content === "string")
+        .map((f) => f.content as string)
+        .join("\n");
+      expect(code).toContain(`"HELLO_RAW_MARKER"`);
+      // The bundle should not emit hello.txt as a separate asset.
+      expect(result.files.every((f) => !f.path.endsWith("hello.txt"))).toBe(
+        true,
+      );
+
+      yield* fs.remove(root, { recursive: true });
+    }),
+  );
+
+  it.effect("resolves ?raw imports through subdirectories", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({
+        prefix: "alchemy-raw-subdir-",
+      });
+      yield* fs.makeDirectory(path.join(root, "sub"), { recursive: true });
+      yield* fs.writeFileString(
+        path.join(root, "sub", "foo.json"),
+        `{"marker":"SUBDIR_RAW_MARKER"}`,
+      );
+      const entry = path.join(root, "entry.ts");
+      yield* fs.writeFileString(
+        entry,
+        `import foo from "./sub/foo.json?raw";\nconsole.log(foo);\n`,
+      );
+
+      const result = yield* Bundle.build({
+        input: entry,
+        cwd: root,
+      });
+
+      const code = result.files
+        .filter((f) => typeof f.content === "string")
+        .map((f) => f.content as string)
+        .join("\n");
+      expect(code).toContain("SUBDIR_RAW_MARKER");
+
+      yield* fs.remove(root, { recursive: true });
+    }),
+  );
+});
+
+layer(NodeServices.layer)("rawPlugin load hook", (it) => {
+  /**
+   * Invokes a plugin's `load` hook directly with a stubbed plugin
+   * context. The handler reads through `this.fs` (rolldown's
+   * plugin-context filesystem); we stub it with `node:fs/promises` so the
+   * disk read works without booting a full rolldown build.
+   */
+  const load = (id: string) =>
+    Effect.promise(async () => {
+      const plugin = rawPlugin();
+      assert(
+        Predicate.hasProperty(plugin, "load") &&
+          Predicate.hasProperty(plugin.load, "handler") &&
+          typeof plugin.load.handler === "function",
+        "plugin has no load hook",
+      );
+      const result = await plugin.load.handler.call({ fs: NodeFs } as any, id);
+      assert(Predicate.isObject(result), "load hook returned non-object");
+      return result;
+    });
+
+  it.effect("inlines a .txt file as a JSON-encoded default export", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({ prefix: "alchemy-raw-load-" });
+      const file = path.join(root, "hello.txt");
+      yield* fs.writeFileString(file, "Hello, World!\n");
+
+      const result = yield* load(file);
+
+      expect(result.code).toBe(`export default "Hello, World!\\n";`);
+      expect(result.moduleType).toBe("js");
+
+      yield* fs.remove(root, { recursive: true });
+    }),
+  );
+
+  it.effect("inlines a .json file verbatim (no parsing)", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({ prefix: "alchemy-raw-json-" });
+      const file = path.join(root, "data.json");
+      const raw = `{"a": 1, "b": "two"}`;
+      yield* fs.writeFileString(file, raw);
+
+      const result = yield* load(`${file}?raw`);
+
+      expect(result.code).toBe(`export default ${JSON.stringify(raw)};`);
+
+      yield* fs.remove(root, { recursive: true });
+    }),
+  );
+
+  it.effect("strips additional query params before reading the file", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectory({ prefix: "alchemy-raw-q-" });
+      const file = path.join(root, "page.html");
+      yield* fs.writeFileString(file, "<h1>hi</h1>");
+
+      const result = yield* load(`${file}?raw&t=12345`);
+
+      expect(result.code).toBe(`export default "<h1>hi</h1>";`);
+
+      yield* fs.remove(root, { recursive: true });
+    }),
+  );
+});
+
+describe("RAW_RE", () => {
+  it("matches `?raw`", () => {
+    expect(RAW_RE.test("/foo/bar.txt?raw")).toBe(true);
+  });
+
+  it("matches `?raw&foo`", () => {
+    expect(RAW_RE.test("/foo/bar.txt?raw&foo")).toBe(true);
+  });
+
+  it("matches `?other&raw`", () => {
+    expect(RAW_RE.test("/foo/bar.txt?other&raw")).toBe(true);
+  });
+
+  it("does NOT match ids without ?raw", () => {
+    expect(RAW_RE.test("/foo/bar.txt")).toBe(false);
+    expect(RAW_RE.test("/foo/bar.txt?url")).toBe(false);
+    expect(RAW_RE.test("/foo/bar.txt?rawish")).toBe(false);
+  });
+});
+
+describe("splitFileAndPostfix", () => {
+  it("splits at the first `?`", () => {
+    expect(splitFileAndPostfix("./foo.txt?raw")).toEqual(["./foo.txt", "?raw"]);
+  });
+
+  it("splits at the first `#`", () => {
+    expect(splitFileAndPostfix("./foo.txt#frag")).toEqual([
+      "./foo.txt",
+      "#frag",
+    ]);
+  });
+
+  it("returns empty postfix when no query/hash", () => {
+    expect(splitFileAndPostfix("./foo.txt")).toEqual(["./foo.txt", ""]);
+  });
+
+  it("splits at whichever of `?` / `#` comes first", () => {
+    expect(splitFileAndPostfix("./foo.txt#frag?raw")).toEqual([
+      "./foo.txt",
+      "#frag?raw",
+    ]);
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cli/checkVersion.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cli/checkVersion.test.ts
new file mode 100644
index 00000000000..52cdaba53b6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cli/checkVersion.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, test } from "vitest";
+
+import { _internal } from "../../src/Cli/checkVersion";
+
+const { pickDistTag } = _internal;
+
+describe("pickDistTag", () => {
+  // Real shape returned by https://registry.npmjs.org/-/package/alchemy/dist-tags
+  const realDistTags = { latest: "0.93.7", next: "2.0.0-beta.33" };
+
+  test("beta version picks the matching prerelease tag (next) over latest", () => {
+    expect(pickDistTag("2.0.0-beta.30", realDistTags)).toBe("2.0.0-beta.33");
+  });
+
+  test("stable version picks latest", () => {
+    expect(pickDistTag("0.93.6", realDistTags)).toBe("0.93.7");
+  });
+
+  test("prefers identifier-named tag when present", () => {
+    expect(
+      pickDistTag("2.0.0-beta.30", {
+        latest: "0.93.7",
+        next: "2.0.0-rc.1",
+        beta: "2.0.0-beta.40",
+      }),
+    ).toBe("2.0.0-beta.40");
+  });
+
+  test("falls back to next when no identifier-named tag exists", () => {
+    expect(
+      pickDistTag("2.0.0-rc.1", { latest: "0.93.7", next: "2.0.0-rc.2" }),
+    ).toBe("2.0.0-rc.2");
+  });
+
+  test("falls back to latest when no prerelease channel exists", () => {
+    expect(pickDistTag("2.0.0-beta.30", { latest: "0.93.7" })).toBe("0.93.7");
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cli/fixtures/import-stack-fixture.ts b/.repos/alchemy-effect/packages/alchemy/test/Cli/fixtures/import-stack-fixture.ts
new file mode 100644
index 00000000000..5337822bbf3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cli/fixtures/import-stack-fixture.ts
@@ -0,0 +1,13 @@
+import * as Effect from "effect/Effect";
+import { Stack } from "@/Stack.ts";
+import * as State from "@/State/index.ts";
+import { TestLayers } from "../../test.resources.ts";
+
+export default Stack(
+  "import-stack-fixture",
+  {
+    providers: TestLayers(),
+    state: State.inMemoryState(),
+  },
+  Effect.succeed("import-stack-fixture"),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cli/importStack.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cli/importStack.test.ts
new file mode 100644
index 00000000000..674504fd148
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cli/importStack.test.ts
@@ -0,0 +1,39 @@
+import * as Effect from "effect/Effect";
+import { fileURLToPath } from "node:url";
+import path from "pathe";
+import { describe, expect, test } from "vitest";
+import { importStack } from "../../src/Cli/commands/_shared";
+import { evalStack } from "../../src/Stack";
+import * as TestCore from "../../src/Test/Core";
+import { TestLayers } from "../test.resources";
+
+const fixtureAbsolutePath = fileURLToPath(
+  import.meta.resolve("./fixtures/import-stack-fixture.ts"),
+);
+const fixtureRelativePath = path.relative(process.cwd(), fixtureAbsolutePath);
+
+const runFixture = (path: string) =>
+  TestCore.run(
+    importStack(path).pipe(
+      Effect.flatMap((stackEffect) =>
+        evalStack(stackEffect, (stack) => Effect.succeed(stack.output), {
+          stage: "test",
+        }),
+      ),
+    ),
+    {
+      providers: TestLayers(),
+    },
+  );
+
+describe("importStack", () => {
+  test("loads stack entrypoint via relative path", () =>
+    expect(runFixture(fixtureRelativePath)).resolves.toBe(
+      "import-stack-fixture",
+    ));
+
+  test("loads stack entrypoint via absolute path", () =>
+    expect(runFixture(fixtureAbsolutePath)).resolves.toBe(
+      "import-stack-fixture",
+    ));
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/AiGateway.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/AiGateway.test.ts
new file mode 100644
index 00000000000..c2da106f3f9
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/AiGateway.test.ts
@@ -0,0 +1,247 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Alchemy from "@/index.ts";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as aiGateway from "@distilled.cloud/cloudflare/ai-gateway";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { Gateway } from "./fixtures/Gateway.ts";
+import TestWorker from "./fixtures/TestWorker.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete ai gateway with default props", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const gateway = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.AiGateway("DefaultGateway", {
+          id: "alchemy-test-ai-gateway-default",
+        });
+      }),
+    );
+
+    expect(gateway.gatewayId).toEqual("alchemy-test-ai-gateway-default");
+    expect(gateway.cacheInvalidateOnUpdate).toEqual(false);
+    expect(gateway.cacheTtl).toEqual(null);
+    expect(gateway.collectLogs).toEqual(true);
+    expect(gateway.rateLimitingInterval).toEqual(null);
+    expect(gateway.rateLimitingLimit).toEqual(null);
+    expect(gateway.rateLimitingTechnique).toEqual("fixed");
+
+    const actualGateway = yield* aiGateway.getAiGateway({
+      accountId,
+      id: gateway.gatewayId,
+    });
+    expect(actualGateway.id).toEqual(gateway.gatewayId);
+
+    yield* stack.destroy();
+
+    yield* waitForGatewayToBeDeleted(gateway.gatewayId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("create, update, delete ai gateway", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const gateway = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.AiGateway("TestGateway", {
+          id: "alchemy-test-ai-gateway",
+          cacheTtl: 60,
+          collectLogs: true,
+          rateLimitingInterval: 60,
+          rateLimitingLimit: 100,
+          rateLimitingTechnique: "fixed",
+        });
+      }),
+    );
+
+    const actualGateway = yield* aiGateway.getAiGateway({
+      accountId,
+      id: gateway.gatewayId,
+    });
+    expect(actualGateway.id).toEqual(gateway.gatewayId);
+    expect(actualGateway.cacheTtl).toEqual(60);
+    expect(actualGateway.rateLimitingLimit).toEqual(100);
+
+    const updatedGateway = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.AiGateway("TestGateway", {
+          id: "alchemy-test-ai-gateway",
+          cacheTtl: 120,
+          collectLogs: true,
+          rateLimitingInterval: 120,
+          rateLimitingLimit: 200,
+          rateLimitingTechnique: "sliding",
+        });
+      }),
+    );
+
+    const actualUpdatedGateway = yield* aiGateway.getAiGateway({
+      accountId,
+      id: updatedGateway.gatewayId,
+    });
+    expect(actualUpdatedGateway.cacheTtl).toEqual(120);
+    expect(actualUpdatedGateway.rateLimitingInterval).toEqual(120);
+    expect(actualUpdatedGateway.rateLimitingLimit).toEqual(200);
+    expect(actualUpdatedGateway.rateLimitingTechnique).toEqual("sliding");
+
+    yield* stack.destroy();
+
+    yield* waitForGatewayToBeDeleted(gateway.gatewayId, accountId);
+  }).pipe(logLevel),
+);
+
+// Engine-level adoption: AI Gateways have no ownership signal (Cloudflare
+// doesn't expose tags on AI Gateways), so a name match in `read` is treated
+// as silent adoption.
+test.provider(
+  "existing ai gateway (matching id) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const gatewayId = `alchemy-test-aigw-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      // Phase 1: deploy normally so a real AI Gateway exists.
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AiGateway("AdoptableGateway", {
+            id: gatewayId,
+          });
+        }),
+      );
+      expect(initial.gatewayId).toEqual(gatewayId);
+
+      // Phase 2: wipe local state — the gateway stays on Cloudflare.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableGateway",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      // Phase 3: redeploy without `adopt(true)`. The engine calls
+      // `provider.read`, which fetches the gateway by id and returns plain
+      // attrs — silent adoption.
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AiGateway("AdoptableGateway", {
+            id: gatewayId,
+          });
+        }),
+      );
+
+      expect(adopted.gatewayId).toEqual(gatewayId);
+
+      const persisted = yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        return yield* state.get({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableGateway",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      expect((persisted as any)?.attr).toMatchObject({ gatewayId });
+
+      yield* stack.destroy();
+      yield* waitForGatewayToBeDeleted(gatewayId, accountId);
+    }).pipe(logLevel),
+);
+
+const waitForGatewayToBeDeleted = Effect.fn(function* (
+  gatewayId: string,
+  accountId: string,
+) {
+  yield* aiGateway
+    .getAiGateway({
+      accountId,
+      id: gatewayId,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new GatewayStillExists())),
+      Effect.retry({
+        while: (e): e is GatewayStillExists => e instanceof GatewayStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("GatewayNotFound", () => Effect.void),
+    );
+});
+
+class GatewayStillExists extends Data.TaggedError("GatewayStillExists") {}
+
+const Stack = Alchemy.Stack(
+  "AiGatewayBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const gateway = yield* Gateway;
+    const worker = yield* TestWorker;
+    return {
+      gatewayId: gateway.gatewayId,
+      url: worker.url.as<string>(),
+    };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deployed worker can call AiGateway binding (effect-native getUrl)",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const workerUrl = out.url;
+    expect(workerUrl).toBeTypeOf("string");
+    expect(out.gatewayId).toBeTypeOf("string");
+    expect(out.gatewayId.length).toBeGreaterThan(0);
+
+    const client = yield* HttpClient.HttpClient;
+    const res = yield* client.get(`${workerUrl}/url`).pipe(
+      Effect.flatMap((res) =>
+        res.status === 200
+          ? Effect.succeed(res)
+          : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+      ),
+      Effect.retry({
+        schedule: Schedule.exponential("500 millis"),
+        times: 15,
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (yield* res.json) as { url: string };
+    // The runtime gateway exposes a stable account-scoped URL like
+    // https://gateway.ai.cloudflare.com/v1/<accountId>/<gatewayId>
+    expect(body.url).toContain(out.gatewayId);
+    expect(body.url).toContain("gateway.ai.cloudflare.com");
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/LanguageModel.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/LanguageModel.test.ts
new file mode 100644
index 00000000000..9d05ea6cdbf
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/LanguageModel.test.ts
@@ -0,0 +1,538 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Alchemy from "@/index.ts";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as Sse from "effect/unstable/encoding/Sse";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { Gateway } from "./fixtures/Gateway.ts";
+import LanguageModelTestWorker from "./fixtures/LanguageModelWorker.ts";
+
+// Fresh `workers.dev` URLs return non-200 (404 / 500 "Script not
+// found") for a few seconds while the edge propagates. Each test uses
+// `HttpClient.filterStatusOk(yield* HttpClient.HttpClient)` so the
+// existing `Effect.retry` rides through these by converting the
+// bad-status response into a retryable Effect failure.
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const Stack = Alchemy.Stack(
+  "AiGatewayLanguageModelStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* LanguageModelTestWorker;
+    const gateway = yield* Gateway;
+    return {
+      gatewayId: gateway.gatewayId,
+      url: worker.url.as<string>(),
+    };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+type StreamPart = {
+  type: string;
+  id?: string;
+  name?: string;
+  delta?: string;
+  reason?: string;
+  usage?: {
+    inputTokens?: { total?: number };
+    outputTokens?: { total?: number };
+  };
+};
+
+const parseSse = (sse: string): ReadonlyArray<StreamPart> =>
+  sse
+    .split("\n\n")
+    .map((frame) => frame.replace(/^data:\s*/, "").trim())
+    .filter((line) => line.length > 0)
+    .map((line) => JSON.parse(line) as StreamPart);
+
+test(
+  "deployed worker generates text via AiGateway-backed LanguageModel",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(`${out.url}/generate?prompt=${encodeURIComponent("Say pong.")}`)
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as {
+      text: string;
+      finishReason: string;
+      usage: {
+        inputTokens: number | undefined;
+        outputTokens: number | undefined;
+      };
+    };
+
+    expect(typeof body.text).toBe("string");
+    expect(body.text.length).toBeGreaterThan(0);
+    // Refactor invariant: `mapUsage` must populate both input and output
+    // tokens from Workers AI's `prompt_tokens` / `completion_tokens` fields.
+    expect(body.usage.inputTokens).toBeGreaterThan(0);
+    expect(body.usage.outputTokens).toBeGreaterThan(0);
+    // Refactor invariant: a normal completion maps to `stop`, not `unknown` /
+    // `other` / `error`.
+    expect(body.finishReason).toBe("stop");
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "deployed worker streams text via AiGateway-backed LanguageModel",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(`${out.url}/stream?prompt=${encodeURIComponent("Say pong.")}`)
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const parts = parseSse(yield* res.text);
+    const text = parts
+      .filter((p) => p.type === "text-delta")
+      .map((p) => p.delta ?? "")
+      .join("");
+    const finish = parts.find((p) => p.type === "finish");
+
+    expect(parts.length).toBeGreaterThan(0);
+    expect(text.length).toBeGreaterThan(0);
+    expect(finish).toBeDefined();
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "streamed parts respect ordering: text-start → text-delta+ → text-end → finish",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(`${out.url}/stream?prompt=${encodeURIComponent("Say pong.")}`)
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const parts = parseSse(yield* res.text);
+    const indexOfType = (type: string) =>
+      parts.findIndex((p) => p.type === type);
+    const lastIndexOfType = (type: string) => {
+      for (let i = parts.length - 1; i >= 0; i--) {
+        if (parts[i]!.type === type) return i;
+      }
+      return -1;
+    };
+
+    // Refactor invariant: `emitTextDelta` opens a text-start before the first
+    // text-delta, `finalizeStream` emits text-end before the final finish.
+    const startIdx = indexOfType("text-start");
+    const firstDeltaIdx = indexOfType("text-delta");
+    const lastDeltaIdx = lastIndexOfType("text-delta");
+    const endIdx = indexOfType("text-end");
+    const finishIdx = indexOfType("finish");
+
+    expect(startIdx).toBeGreaterThanOrEqual(0);
+    expect(firstDeltaIdx).toBeGreaterThan(startIdx);
+    expect(endIdx).toBeGreaterThan(lastDeltaIdx);
+    expect(finishIdx).toBe(parts.length - 1);
+    expect(finishIdx).toBeGreaterThan(endIdx);
+
+    // Exactly one text segment was opened and closed.
+    expect(parts.filter((p) => p.type === "text-start")).toHaveLength(1);
+    expect(parts.filter((p) => p.type === "text-end")).toHaveLength(1);
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test.skipIf(!process.env.DEBUG_RAW_STREAM)(
+  "DEBUG: dump raw Workers AI SSE stream",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+    const fs = yield* Effect.promise(() => import("node:fs"));
+    const print = (s: string) => fs.writeSync(2, s);
+
+    for (const includeUsage of ["0", "1"] as const) {
+      const res = yield* client
+        .get(
+          `${out.url}/raw-stream?include_usage=${includeUsage}&prompt=${encodeURIComponent("Say pong.")}`,
+        )
+        .pipe(
+          Effect.retry({
+            schedule: Schedule.exponential("500 millis"),
+            times: 10,
+          }),
+        );
+      print(`\n=== include_usage=${includeUsage} ===\n`);
+      print(yield* res.text);
+      print("\n=== end ===\n");
+    }
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "stream finish part reports the real token counts and a `stop` reason",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(
+        `${out.url}/stream?prompt=${encodeURIComponent("Say the word 'pong' and nothing else.")}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const parts = parseSse(yield* res.text);
+    const finish = parts.find((p) => p.type === "finish");
+    expect(finish).toBeDefined();
+    // Workers AI emits the real usage chunk and then a zero-valued
+    // "terminator" usage chunk; the refactor must keep the real one (see
+    // `hasNonZeroUsage` in updateChunkMeta).
+    expect(finish?.usage?.inputTokens?.total).toBeGreaterThan(0);
+    expect(finish?.usage?.outputTokens?.total).toBeGreaterThan(0);
+    // Workers AI's native stream shape never emits `finish_reason`; a clean
+    // `[DONE]` must still surface as "stop" rather than "unknown".
+    expect(finish?.reason).toBe("stop");
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "stream emits multiple text-delta chunks for a long-form response",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(
+        `${out.url}/stream?prompt=${encodeURIComponent(
+          "Write a short paragraph (around 80 words) about why TypeScript developers might enjoy Effect TS.",
+        )}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const parts = parseSse(yield* res.text);
+    const deltas = parts.filter((p) => p.type === "text-delta");
+    // Refactor invariant: each model SSE chunk produces a text-delta — so a
+    // long response should produce many. A single fused delta would mean we
+    // accidentally buffered the stream.
+    expect(deltas.length).toBeGreaterThan(3);
+    const total = deltas.map((p) => p.delta ?? "").join("").length;
+    expect(total).toBeGreaterThan(20);
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+// `persisted chat survives across DO invocations` exercises the
+// /chat?id=... route which is wired by `ChatAgent` from the Agent
+// slice. The fixture in this slice (`LanguageModelWorker`) does not
+// include that route — the test re-activates in the Agent PR.
+test.skip(
+  "persisted chat survives across DO invocations",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+    const id = `test-${Date.now()}`;
+
+    const r1 = yield* client
+      .get(
+        `${out.url}/chat?id=${id}&prompt=${encodeURIComponent("My name is Sam. Remember it.")}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    if (r1.status !== 200) {
+      console.error("turn1 error body:", yield* r1.text);
+    }
+    expect(r1.status).toBe(200);
+    const b1 = (yield* r1.json) as { text: string; turns: number };
+    expect(b1.turns).toBeGreaterThanOrEqual(2);
+
+    const r2 = yield* client
+      .get(
+        `${out.url}/chat?id=${id}&prompt=${encodeURIComponent("What is my name? Answer with just the name.")}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(r2.status).toBe(200);
+    const b2 = (yield* r2.json) as { text: string; turns: number };
+
+    expect(b2.text.toLowerCase()).toContain("sam");
+    expect(b2.turns).toBeGreaterThanOrEqual(4);
+  }).pipe(logLevel),
+  { timeout: 240_000 },
+);
+
+test(
+  "deployed worker invokes a tool via AiGateway-backed LanguageModel",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(
+        `${out.url}/tool?prompt=${encodeURIComponent(
+          "What's the weather in San Francisco?",
+        )}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    if (res.status !== 200) {
+      console.error("tool error body:", yield* res.text);
+    }
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as {
+      text: string;
+      finishReason: string;
+      toolCalls: Array<{
+        id: string;
+        name: string;
+        params: { city: string };
+      }>;
+      toolResults: Array<{
+        id: string;
+        name: string;
+        result: { city: string; temperatureF: number; condition: string };
+        isFailure: boolean;
+      }>;
+    };
+
+    expect(body.toolCalls.length).toBeGreaterThan(0);
+    const call = body.toolCalls[0]!;
+    expect(call.name).toBe("get_weather");
+    expect(typeof call.params.city).toBe("string");
+    expect(call.params.city.toLowerCase()).toContain("san francisco");
+
+    expect(body.toolResults.length).toBeGreaterThan(0);
+    const result = body.toolResults[0]!;
+    expect(result.name).toBe("get_weather");
+    expect(result.isFailure).toBe(false);
+    expect(result.result.temperatureF).toBe(72);
+    expect(result.result.condition).toBe("sunny");
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "streams tool-call parts via AiGateway-backed LanguageModel",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(
+        `${out.url}/tool-stream?prompt=${encodeURIComponent(
+          "What's the weather in Seattle?",
+        )}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const parts = parseSse(yield* res.text);
+    const toolParamsStart = parts.filter((p) => p.type === "tool-params-start");
+    const toolParamsDeltas = parts.filter(
+      (p) => p.type === "tool-params-delta",
+    );
+    const toolParamsEnd = parts.filter((p) => p.type === "tool-params-end");
+
+    expect(toolParamsStart.length).toBeGreaterThan(0);
+    expect(toolParamsStart[0]?.name).toBe("get_weather");
+    expect(toolParamsDeltas.length).toBeGreaterThan(0);
+
+    // Refactor invariant: `finalizeStream` closes any tool calls still open
+    // when the stream ends, emitting one `tool-params-end` per opened call.
+    expect(toolParamsEnd.length).toBe(toolParamsStart.length);
+    // Each start is matched to an end by id.
+    const startIds = new Set(toolParamsStart.map((p) => p.id));
+    const endIds = new Set(toolParamsEnd.map((p) => p.id));
+    expect(endIds).toEqual(startIds);
+
+    // Ordering: every tool-params-end comes after its corresponding start,
+    // every delta with the same id falls between start and end, and finish
+    // is last.
+    const indexOf = (type: string, id: string | undefined) =>
+      parts.findIndex((p) => p.type === type && p.id === id);
+    for (const start of toolParamsStart) {
+      const startIdx = indexOf("tool-params-start", start.id);
+      const endIdx = indexOf("tool-params-end", start.id);
+      expect(endIdx).toBeGreaterThan(startIdx);
+      for (const delta of toolParamsDeltas.filter((p) => p.id === start.id)) {
+        const dIdx = parts.indexOf(delta);
+        expect(dIdx).toBeGreaterThan(startIdx);
+        expect(dIdx).toBeLessThan(endIdx);
+      }
+    }
+    expect(parts[parts.length - 1]?.type).toBe("finish");
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "concatenated tool-params-delta payloads parse back into the requested arguments",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(
+        `${out.url}/tool-stream?prompt=${encodeURIComponent(
+          "What's the weather in Portland?",
+        )}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    const parts = parseSse(yield* res.text);
+    const toolParamsStart = parts.filter((p) => p.type === "tool-params-start");
+    expect(toolParamsStart.length).toBeGreaterThan(0);
+    const firstId = toolParamsStart[0]!.id!;
+
+    // Refactor invariant: `handleToolDeltas` emits each `arguments` fragment
+    // as a `tool-params-delta` in order; concatenating them yields a valid
+    // JSON document with the originally-requested fields.
+    const joined = parts
+      .filter((p) => p.type === "tool-params-delta" && p.id === firstId)
+      .map((p) => p.delta ?? "")
+      .join("");
+    const args = JSON.parse(joined) as { city?: string };
+    expect(typeof args.city).toBe("string");
+    expect(args.city!.toLowerCase()).toContain("portland");
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "streams Effect-native parts and prints them live",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(
+        `${out.url}/stream?prompt=${encodeURIComponent("Write a short haiku about Effect TS.")}`,
+      )
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 10,
+        }),
+      );
+    expect(res.status).toBe(200);
+
+    // Write to fd 2 (stderr) with fs.writeSync to bypass vitest's stdout
+    // capture and Node's stream buffering — chunks land in the terminal as
+    // soon as they arrive from the network.
+    const fs = yield* Effect.promise(() => import("node:fs"));
+    const print = (s: string) => fs.writeSync(2, s);
+
+    print("\n--- live stream begin ---\n");
+    let collected = "";
+
+    yield* res.stream.pipe(
+      Stream.orDie,
+      Stream.decodeText(),
+      Stream.pipeThroughChannel(Sse.decode<never, unknown>()),
+      Stream.runForEach((event) =>
+        Effect.sync(() => {
+          const part = JSON.parse(event.data) as {
+            type: string;
+            delta?: string;
+            id?: string;
+            reason?: string;
+          };
+          switch (part.type) {
+            case "text-start":
+              print(`[text-start id=${part.id}]\n`);
+              break;
+            case "text-delta":
+              print(part.delta ?? "");
+              collected += part.delta ?? "";
+              break;
+            case "text-end":
+              print(`\n[text-end id=${part.id}]\n`);
+              break;
+            case "finish":
+              print(`[finish reason=${part.reason}]\n`);
+              break;
+            default:
+              print(`[${part.type}]\n`);
+          }
+        }),
+      ),
+    );
+
+    print("--- live stream end ---\n");
+    expect(collected.length).toBeGreaterThan(0);
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/Gateway.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/Gateway.ts
new file mode 100644
index 00000000000..1aa36c3142c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/Gateway.ts
@@ -0,0 +1,6 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+
+export const Gateway = Cloudflare.AiGateway("Gateway", {
+  cacheTtl: 60,
+  collectLogs: true,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/LanguageModelWorker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/LanguageModelWorker.ts
new file mode 100644
index 00000000000..17da8e675b4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/LanguageModelWorker.ts
@@ -0,0 +1,211 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import type { RuntimeContext } from "@/RuntimeContext.ts";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import {
+  LanguageModel as AiLanguageModel,
+  Tool,
+  Toolkit,
+} from "effect/unstable/ai";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Gateway } from "./Gateway.ts";
+
+const MODEL = "@cf/meta/llama-3.1-8b-instruct";
+const TOOL_MODEL = "@cf/moonshotai/kimi-k2.6";
+
+const GetWeather = Tool.make("get_weather", {
+  description:
+    "Get the current weather for a city. Always call this tool when the user asks about the weather.",
+  parameters: Schema.Struct({
+    city: Schema.String,
+  }),
+  success: Schema.Struct({
+    city: Schema.String,
+    temperatureF: Schema.Number,
+    condition: Schema.String,
+  }),
+});
+
+const WeatherToolkit = Toolkit.make(GetWeather);
+
+const WeatherToolkitLayer = WeatherToolkit.toLayer({
+  get_weather: ({ city }) =>
+    Effect.succeed({
+      city,
+      temperatureF: 72,
+      condition: "sunny",
+    }),
+});
+
+export default class LanguageModelTestWorker extends Cloudflare.Worker<LanguageModelTestWorker>()(
+  "LanguageModelTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+    const languageModel = aiGateway.model({
+      client: aiGateway,
+      model: MODEL,
+      parameters: { temperature: 0.7, maxTokens: 1024 },
+    });
+    const toolLanguageModel = aiGateway.model({
+      client: aiGateway,
+      model: TOOL_MODEL,
+      parameters: { temperature: 0.2, maxTokens: 1024 },
+    });
+    const dumpRawStream = (
+      model: string,
+      messages: ReadonlyArray<{ role: string; content: string }>,
+      streamOptions: Record<string, unknown> | undefined,
+    ) =>
+      Effect.gen(function* () {
+        const ai = yield* aiGateway.raw;
+        const gatewayId = yield* aiGateway.id;
+        const response = yield* Effect.tryPromise({
+          try: () =>
+            ai.run(
+              model as keyof AiModels,
+              {
+                messages,
+                stream: true,
+                ...streamOptions,
+              } as unknown as AiModels[keyof AiModels]["inputs"],
+              { gateway: { id: gatewayId }, returnRawResponse: true },
+            ),
+          catch: (e) => e,
+        });
+        if (response.body == null)
+          return HttpServerResponse.text("no body", { status: 500 });
+        const body = Stream.fromReadableStream<Uint8Array, never>({
+          evaluate: () => response.body!,
+          onError: () => undefined as never,
+        });
+        return HttpServerResponse.stream(body, {
+          headers: { "content-type": "text/event-stream" },
+        });
+      }).pipe(Effect.orDie);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const ctx = yield* Effect.context<RuntimeContext>();
+        const url = new URL(request.url, "http://worker");
+        const prompt =
+          url.searchParams.get("prompt") ??
+          "Say the single word 'pong' and nothing else.";
+
+        if (url.pathname === "/generate") {
+          const response = yield* AiLanguageModel.generateText({ prompt }).pipe(
+            Effect.orDie,
+          );
+          return yield* HttpServerResponse.json({
+            text: response.text,
+            finishReason: response.finishReason,
+            usage: {
+              inputTokens: response.usage.inputTokens.total,
+              outputTokens: response.usage.outputTokens.total,
+            },
+          });
+        }
+
+        if (url.pathname === "/raw-stream") {
+          const model = url.searchParams.get("model") ?? MODEL;
+          const includeUsage = url.searchParams.get("include_usage") === "1";
+          return yield* dumpRawStream(
+            model,
+            [{ role: "user", content: prompt }],
+            includeUsage
+              ? { stream_options: { include_usage: true } }
+              : undefined,
+          );
+        }
+
+        if (url.pathname === "/test-stream") {
+          // Synthetic stream: 5 chunks with 200ms gaps. If the client sees
+          // them at staggered timestamps, worker→edge streaming works.
+          // If they all land at once, output is buffered downstream.
+          const encoder = new TextEncoder();
+          const body = Stream.range(0, 5).pipe(
+            Stream.mapEffect((i) =>
+              Effect.sleep(Duration.millis(200)).pipe(
+                Effect.as(encoder.encode(`data: chunk-${i}\n\n`)),
+              ),
+            ),
+          );
+          return HttpServerResponse.stream(body, {
+            headers: { "content-type": "text/event-stream" },
+          });
+        }
+
+        if (url.pathname === "/tool") {
+          const response = yield* AiLanguageModel.generateText({
+            prompt,
+            toolkit: WeatherToolkit,
+            toolChoice: "required",
+          }).pipe(
+            Effect.provide(WeatherToolkitLayer),
+            Effect.provide(toolLanguageModel),
+            Effect.orDie,
+          );
+          return yield* HttpServerResponse.json({
+            text: response.text,
+            finishReason: response.finishReason,
+            toolCalls: response.toolCalls.map((call) => ({
+              id: call.id,
+              name: call.name,
+              params: call.params,
+            })),
+            toolResults: response.toolResults.map((result) => ({
+              id: result.id,
+              name: result.name,
+              result: result.result,
+              isFailure: result.isFailure,
+            })),
+          });
+        }
+
+        if (url.pathname === "/tool-stream") {
+          const encoder = new TextEncoder();
+          const body = AiLanguageModel.streamText({
+            prompt,
+            toolkit: WeatherToolkit,
+            toolChoice: "required",
+          }).pipe(
+            Stream.map((part) =>
+              encoder.encode(`data: ${JSON.stringify(part)}\n\n`),
+            ),
+            Stream.provide(WeatherToolkitLayer),
+            Stream.provide(toolLanguageModel),
+            Stream.provideContext(ctx),
+          );
+          return HttpServerResponse.stream(body, {
+            headers: { "content-type": "text/event-stream" },
+          });
+        }
+
+        if (url.pathname === "/stream") {
+          const encoder = new TextEncoder();
+          const body = AiLanguageModel.streamText({ prompt }).pipe(
+            Stream.map((part) =>
+              encoder.encode(`data: ${JSON.stringify(part)}\n\n`),
+            ),
+            Stream.provide(languageModel),
+            Stream.provideContext(ctx),
+          );
+          return HttpServerResponse.stream(body, {
+            headers: { "content-type": "text/event-stream" },
+          });
+        }
+
+        return HttpServerResponse.text("ok");
+      }).pipe(Effect.provide(languageModel)),
+    };
+  }).pipe(Effect.provide(Cloudflare.AiGatewayBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/TestWorker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/TestWorker.ts
new file mode 100644
index 00000000000..e75e4722418
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AiGateway/fixtures/TestWorker.ts
@@ -0,0 +1,30 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Gateway } from "./Gateway.ts";
+
+export default class TestWorker extends Cloudflare.Worker<TestWorker>()(
+  "AiGatewayTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        if (request.url.startsWith("/url")) {
+          const url = yield* aiGateway.getUrl().pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ url });
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.AiGatewayBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.test.ts
new file mode 100644
index 00000000000..101635db481
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/AnalyticsEngineDataset.test.ts
@@ -0,0 +1,61 @@
+import * as Alchemy from "@/index.ts";
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { Dataset } from "./fixtures/dataset.ts";
+import AnalyticsEngineTestWorker from "./fixtures/worker.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const Stack = Alchemy.Stack(
+  "AnalyticsEngineBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const dataset = yield* Dataset;
+    const worker = yield* AnalyticsEngineTestWorker;
+    return {
+      dataset: dataset.dataset,
+      url: worker.url.as<string>(),
+    };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deployed worker can write data points through the Analytics Engine binding",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    expect(url).toBeTypeOf("string");
+
+    const client = yield* HttpClient.HttpClient;
+    const res = yield* client.get(`${url}/write`).pipe(
+      Effect.flatMap((res) =>
+        res.status === 200 ? Effect.succeed(res) : Effect.fail(res),
+      ),
+      Effect.retry({
+        schedule: Schedule.exponential("500 millis"),
+        times: 10,
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (yield* res.json) as { ok: boolean };
+    expect(body.ok).toBe(true);
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/fixtures/dataset.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/fixtures/dataset.ts
new file mode 100644
index 00000000000..4e5cec424bd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/fixtures/dataset.ts
@@ -0,0 +1,5 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+
+export const Dataset = Cloudflare.AnalyticsEngineDataset("Events", {
+  dataset: "alchemy_test_analytics_events",
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/fixtures/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/fixtures/worker.ts
new file mode 100644
index 00000000000..452d2df0c3e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/AnalyticsEngine/fixtures/worker.ts
@@ -0,0 +1,37 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Dataset } from "./dataset.ts";
+
+export default class AnalyticsEngineTestWorker extends Cloudflare.Worker<AnalyticsEngineTestWorker>()(
+  "AnalyticsEngineTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const analytics = yield* Cloudflare.AnalyticsEngineDataset.bind(Dataset);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (url.pathname === "/write") {
+          yield* analytics
+            .writeDataPoint({
+              indexes: ["account-1"],
+              blobs: ["signup"],
+              doubles: [1],
+            })
+            .pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.AnalyticsEngineDatasetBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/ApiToken/AccountApiToken.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/ApiToken/AccountApiToken.test.ts
new file mode 100644
index 00000000000..925a39884f8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/ApiToken/AccountApiToken.test.ts
@@ -0,0 +1,184 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import * as accounts from "@distilled.cloud/cloudflare/accounts";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import { describe } from "node:test";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+describe.skip("AccountApiToken", () => {
+  test.provider("create and delete account token with default props", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const token = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AccountApiToken("DefaultToken", {
+            policies: [
+              {
+                effect: "allow",
+                permissionGroups: ["Workers Scripts Read"],
+                resources: {
+                  [`com.cloudflare.api.account.${accountId}`]: "*",
+                },
+              },
+            ],
+          });
+        }),
+      );
+
+      expect(token.tokenId).toBeDefined();
+      expect(token.name).toBeDefined();
+      expect(token.status).toEqual("active");
+      expect(Redacted.value(token.value)).toMatch(/.+/);
+
+      const actualToken = yield* accounts.getToken({
+        accountId,
+        tokenId: token.tokenId,
+      });
+      expect(actualToken.id).toEqual(token.tokenId);
+      expect(actualToken.name).toEqual(token.name);
+
+      yield* stack.destroy();
+
+      yield* waitForTokenToBeDeleted(token.tokenId, accountId);
+    }).pipe(logLevel),
+  );
+
+  test.provider("create, update, delete account token", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const token = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AccountApiToken("UpdateToken", {
+            name: "alchemy-test-acct-update-initial",
+            policies: [
+              {
+                effect: "allow",
+                permissionGroups: ["Workers Scripts Read"],
+                resources: {
+                  [`com.cloudflare.api.account.${accountId}`]: "*",
+                },
+              },
+            ],
+          });
+        }),
+      );
+
+      expect(token.name).toEqual("alchemy-test-acct-update-initial");
+      const initialValue = Redacted.value(token.value);
+
+      const updated = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AccountApiToken("UpdateToken", {
+            name: "alchemy-test-acct-update-renamed",
+            policies: [
+              {
+                effect: "allow",
+                permissionGroups: [
+                  "Workers Scripts Read",
+                  "Workers KV Storage Read",
+                ],
+                resources: {
+                  [`com.cloudflare.api.account.${accountId}`]: "*",
+                },
+              },
+            ],
+          });
+        }),
+      );
+
+      expect(updated.tokenId).toEqual(token.tokenId);
+      expect(updated.name).toEqual("alchemy-test-acct-update-renamed");
+      expect(Redacted.value(updated.value)).toEqual(initialValue);
+
+      const actual = yield* accounts.getToken({
+        accountId,
+        tokenId: updated.tokenId,
+      });
+      expect(actual.name).toEqual("alchemy-test-acct-update-renamed");
+      expect(actual.policies?.[0]?.permissionGroups.length).toEqual(2);
+
+      yield* stack.destroy();
+
+      yield* waitForTokenToBeDeleted(token.tokenId, accountId);
+    }).pipe(logLevel),
+  );
+
+  test.provider("noop when account token props unchanged", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const props = {
+        name: "alchemy-test-acct-noop",
+        policies: [
+          {
+            effect: "allow" as const,
+            permissionGroups: ["Workers Scripts Read" as const],
+            resources: {
+              [`com.cloudflare.api.account.${accountId}`]: "*",
+            },
+          },
+        ],
+      };
+
+      const first = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AccountApiToken("NoopToken", props);
+        }),
+      );
+
+      const second = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.AccountApiToken("NoopToken", props);
+        }),
+      );
+
+      expect(second.tokenId).toEqual(first.tokenId);
+      expect(Redacted.value(second.value)).toEqual(Redacted.value(first.value));
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+  );
+
+  const waitForTokenToBeDeleted = Effect.fn(function* (
+    tokenId: string,
+    accountId: string,
+  ) {
+    yield* accounts.getToken({ accountId, tokenId }).pipe(
+      Effect.flatMap(() => Effect.fail(new TokenStillExists())),
+      Effect.retry({
+        while: (e): e is TokenStillExists => e instanceof TokenStillExists,
+        schedule: Schedule.exponential(200).pipe(
+          Schedule.both(Schedule.recurs(8)),
+        ),
+      }),
+      Effect.catchTag("TokenStillExists", () =>
+        Effect.die(
+          `Cloudflare API token ${tokenId} was not deleted after retries`,
+        ),
+      ),
+      Effect.catchTag("TokenNotFound", () => Effect.void),
+      Effect.catchTag("InvalidRoute", () => Effect.void),
+    );
+  });
+});
+class TokenStillExists extends Data.TaggedError("TokenStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/ApiToken/UserApiToken.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/ApiToken/UserApiToken.test.ts
new file mode 100644
index 00000000000..0ff013ecbf2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/ApiToken/UserApiToken.test.ts
@@ -0,0 +1,135 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import * as user from "@distilled.cloud/cloudflare/user";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+describe.skip("UserApiToken", () => {
+  test.provider("create and delete user token with default props", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const token = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.UserApiToken("DefaultUserToken", {
+            policies: [
+              {
+                effect: "allow",
+                permissionGroups: ["Workers Scripts Read"],
+                resources: {
+                  [`com.cloudflare.api.account.${accountId}`]: "*",
+                },
+              },
+            ],
+          });
+        }),
+      );
+
+      expect(token.tokenId).toBeDefined();
+      expect(token.name).toBeDefined();
+      expect(token.status).toEqual("active");
+      expect(Redacted.value(token.value)).toMatch(/.+/);
+
+      const actualToken = yield* user.getToken({ tokenId: token.tokenId });
+      expect(actualToken.id).toEqual(token.tokenId);
+      expect(actualToken.name).toEqual(token.name);
+
+      yield* stack.destroy();
+
+      yield* waitForTokenToBeDeleted(token.tokenId);
+    }).pipe(logLevel),
+  );
+
+  test.provider("create, update, delete user token", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const token = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.UserApiToken("UpdateUserToken", {
+            name: "alchemy-test-user-update-initial",
+            policies: [
+              {
+                effect: "allow",
+                permissionGroups: ["Workers Scripts Read"],
+                resources: {
+                  [`com.cloudflare.api.account.${accountId}`]: "*",
+                },
+              },
+            ],
+          });
+        }),
+      );
+
+      expect(token.name).toEqual("alchemy-test-user-update-initial");
+      const initialValue = Redacted.value(token.value);
+
+      const updated = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.UserApiToken("UpdateUserToken", {
+            name: "alchemy-test-user-update-renamed",
+            policies: [
+              {
+                effect: "allow",
+                permissionGroups: [
+                  "Workers Scripts Read",
+                  "Workers KV Storage Read",
+                ],
+                resources: {
+                  [`com.cloudflare.api.account.${accountId}`]: "*",
+                },
+              },
+            ],
+          });
+        }),
+      );
+
+      expect(updated.tokenId).toEqual(token.tokenId);
+      expect(updated.name).toEqual("alchemy-test-user-update-renamed");
+      expect(Redacted.value(updated.value)).toEqual(initialValue);
+
+      const actual = yield* user.getToken({ tokenId: updated.tokenId });
+      expect(actual.name).toEqual("alchemy-test-user-update-renamed");
+      expect(actual.policies?.[0]?.permissionGroups.length).toEqual(2);
+
+      yield* stack.destroy();
+
+      yield* waitForTokenToBeDeleted(token.tokenId);
+    }).pipe(logLevel),
+  );
+
+  const waitForTokenToBeDeleted = Effect.fn(function* (tokenId: string) {
+    yield* user.getToken({ tokenId }).pipe(
+      Effect.flatMap(() => Effect.fail(new TokenStillExists())),
+      Effect.retry({
+        while: (e): e is TokenStillExists => e instanceof TokenStillExists,
+        schedule: Schedule.exponential(200).pipe(
+          Schedule.both(Schedule.recurs(8)),
+        ),
+      }),
+      Effect.catchTag("TokenStillExists", () =>
+        Effect.die(
+          `Cloudflare API token ${tokenId} was not deleted after retries`,
+        ),
+      ),
+      Effect.catchTag("TokenNotFound", () => Effect.void),
+      Effect.catchTag("InvalidRoute", () => Effect.void),
+    );
+  });
+});
+class TokenStillExists extends Data.TaggedError("TokenStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/Browser.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/Browser.test.ts
new file mode 100644
index 00000000000..5ad4ea1288d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/Browser.test.ts
@@ -0,0 +1,71 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
+  status: number;
+  body: string;
+}> {}
+
+const readJson = (url: string) =>
+  HttpClient.HttpClient.pipe(
+    Effect.flatMap((client) => client.get(url)),
+    Effect.flatMap((res) =>
+      res.status === 200
+        ? res.json
+        : res.text.pipe(
+            Effect.flatMap((body) =>
+              Effect.fail(new WorkerNotReady({ status: res.status, body })),
+            ),
+          ),
+    ),
+  ).pipe(
+    Effect.retry({
+      while: (e): e is WorkerNotReady => e instanceof WorkerNotReady,
+      schedule: Schedule.exponential("500 millis").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "async worker renders a page title through Browser Rendering",
+  Effect.gen(function* () {
+    const { asyncWorkerUrl } = yield* stack;
+    const body = (yield* readJson(`${asyncWorkerUrl}/title`)) as {
+      mode: string;
+      title: string;
+    };
+
+    expect(body.mode).toBe("async");
+    expect(body.title).toBe("Example Domain");
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "effect worker renders a page title through Browser Rendering",
+  Effect.gen(function* () {
+    const { effectWorkerUrl } = yield* stack;
+    const body = (yield* readJson(`${effectWorkerUrl}/title`)) as {
+      mode: string;
+      title: string;
+    };
+
+    expect(body.mode).toBe("effect");
+    expect(body.title).toBe("Example Domain");
+  }),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/async-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/async-worker.ts
new file mode 100644
index 00000000000..5847889c455
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/async-worker.ts
@@ -0,0 +1,23 @@
+import puppeteer from "@cloudflare/puppeteer";
+import type { AsyncWorkerEnv } from "./stack.ts";
+
+const TARGET_URL = "https://example.com";
+
+export default {
+  async fetch(request: Request, env: AsyncWorkerEnv): Promise<Response> {
+    const url = new URL(request.url);
+    if (url.pathname !== "/title") {
+      return new Response("ok");
+    }
+
+    const browser = await puppeteer.launch(env.BROWSER as any);
+    try {
+      const page = await browser.newPage();
+      await page.goto(TARGET_URL, { waitUntil: "networkidle0" });
+      const title = await page.title();
+      return Response.json({ mode: "async", title });
+    } finally {
+      await browser.close();
+    }
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/effect-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/effect-worker.ts
new file mode 100644
index 00000000000..374e39cd4d5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/effect-worker.ts
@@ -0,0 +1,52 @@
+import puppeteer from "@cloudflare/puppeteer";
+import * as Cloudflare from "alchemy/Cloudflare";
+import type { BrowserPuppeteer } from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+const TARGET_URL = "https://example.com";
+
+type PuppeteerBrowser = Awaited<ReturnType<(typeof puppeteer)["launch"]>>;
+
+const cloudflarePuppeteer =
+  puppeteer as unknown as BrowserPuppeteer<PuppeteerBrowser>;
+
+export default class BrowserEffectWorker extends Cloudflare.Worker<BrowserEffectWorker>()(
+  "BrowserEffectWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const browser = yield* Cloudflare.Browser({
+      name: "BROWSER",
+    });
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        if (!request.url.startsWith("/title")) {
+          return HttpServerResponse.text("ok");
+        }
+
+        return yield* browser
+          .withBrowser(cloudflarePuppeteer, (browser) =>
+            Effect.gen(function* () {
+              const page = yield* Effect.tryPromise(() => browser.newPage());
+              yield* Effect.tryPromise(() =>
+                page.goto(TARGET_URL, { waitUntil: "networkidle0" }),
+              );
+              const title = yield* Effect.tryPromise(() => page.title());
+              return { title };
+            }),
+          )
+          .pipe(
+            Effect.orDie,
+            Effect.flatMap(({ title }) =>
+              HttpServerResponse.json({ mode: "effect", title }),
+            ),
+          );
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.BrowserBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/stack.ts
new file mode 100644
index 00000000000..aab79e3544f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Browser/fixtures/stack.ts
@@ -0,0 +1,36 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as pathe from "pathe";
+import BrowserEffectWorker from "./effect-worker.ts";
+
+const asyncWorkerMain = pathe.resolve(import.meta.dirname, "async-worker.ts");
+
+export const AsyncWorker = Cloudflare.Worker("BrowserAsyncWorker", {
+  main: asyncWorkerMain,
+  compatibility: {
+    flags: ["nodejs_compat"],
+  },
+  env: {
+    BROWSER: Cloudflare.Browser({ name: "BROWSER" }),
+  },
+});
+
+export type AsyncWorkerEnv = Cloudflare.InferEnv<typeof AsyncWorker>;
+
+export default Alchemy.Stack(
+  "BrowserBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const asyncWorker = yield* AsyncWorker;
+    const effectWorker = yield* BrowserEffectWorker;
+
+    return {
+      asyncWorkerUrl: asyncWorker.url.as<string>(),
+      effectWorkerUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/D1Binding.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/D1Binding.test.ts
new file mode 100644
index 00000000000..02a5c15ee39
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/D1Binding.test.ts
@@ -0,0 +1,192 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import D1Worker from "./d1-worker.ts";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
+  status: number;
+  body: string;
+}> {}
+
+/**
+ * Wrap an HTTP call so a non-2xx response (workers.dev cold-start
+ * "There is nothing here yet" / "Script not found" pages) becomes a
+ * retryable Effect failure rather than a successful response with a
+ * 404/500 status.
+ */
+const retryUntilOk = <E, R>(
+  eff: Effect.Effect<HttpClientResponse.HttpClientResponse, E, R>,
+) =>
+  eff.pipe(
+    Effect.flatMap((res) =>
+      res.status === 200
+        ? Effect.succeed(res)
+        : res.text.pipe(
+            Effect.flatMap((body) =>
+              Effect.fail(new WorkerNotReady({ status: res.status, body })),
+            ),
+          ),
+    ),
+    Effect.retry({
+      while: (e): e is WorkerNotReady =>
+        e instanceof WorkerNotReady && e.status >= 400 && e.status < 600,
+      schedule: Schedule.exponential("500 millis").pipe(
+        Schedule.both(Schedule.recurs(15)),
+      ),
+    }),
+  );
+
+/**
+ * End-to-end test of `Cloudflare.D1Connection.bind(...)` against a real
+ * Cloudflare Worker + D1 database.
+ *
+ * Stack:
+ *
+ * - `D1WorkerDatabase` (Cloudflare.D1Database).
+ * - `D1EffectWorker` — uses `Cloudflare.D1Connection.bind(database)` in
+ *   the init phase, with `Cloudflare.D1ConnectionLive` provided to the
+ *   worker effect.
+ *
+ * The worker exposes routes that exercise every method on the
+ * `D1ConnectionClient`: `exec`, `prepare` + `.run/.all/.first`,
+ * `batch`, and the `raw` Effect that resolves to the underlying
+ * Cloudflare D1Database. The test hits those routes over HTTP and
+ * asserts the round-trip succeeds — proving the binding name agreed
+ * upon by the deploy-time policy and the runtime lookup match, and
+ * the Cloudflare runtime actually injected the binding into `env`.
+ */
+test.provider(
+  "D1Connection.bind exercises the full client surface",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const worker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* D1Worker;
+        }),
+      );
+
+      expect(worker.url).toBeTypeOf("string");
+      const baseUrl = worker.url as string;
+
+      // Cloudflare's edge takes a few seconds to start serving a fresh
+      // workers.dev URL — initial requests can return Cloudflare's
+      // "There is nothing here yet" 404 page. Retry until /init returns
+      // 200, then use the same retry once for the warm-up before
+      // running the rest of the surface area assertions in a
+      // straight line.
+      const initRes = yield* HttpClient.execute(
+        HttpClientRequest.post(`${baseUrl}/init`),
+      ).pipe(
+        Effect.flatMap((res) =>
+          res.status === 200
+            ? res.text.pipe(Effect.as(res))
+            : res.text.pipe(
+                Effect.flatMap((body) =>
+                  Effect.fail(new WorkerNotReady({ status: res.status, body })),
+                ),
+              ),
+        ),
+        Effect.retry({
+          while: (e): e is WorkerNotReady =>
+            e instanceof WorkerNotReady && e.status >= 400 && e.status < 600,
+          schedule: Schedule.exponential("500 millis").pipe(
+            Schedule.both(Schedule.recurs(20)),
+          ),
+        }),
+      );
+      expect(initRes.status).toBe(200);
+      // db.exec returns a count + duration. We don't assert exact
+      // values (CREATE TABLE IF NOT EXISTS may report 0 statements
+      // executed on a re-run), only that the response shape parses.
+      const initBody = (yield* initRes.json) as {
+        count: number;
+        duration: number;
+      };
+      expect(typeof initBody.count).toBe("number");
+      expect(typeof initBody.duration).toBe("number");
+
+      // batch-insert via prepare.bind. Edge propagation can still serve a
+      // transient 404 between routes on a fresh URL, so retry until the
+      // route handler responds 200.
+      const seedRes = yield* HttpClient.execute(
+        HttpClientRequest.post(`${baseUrl}/seed`),
+      ).pipe(
+        Effect.flatMap((res) =>
+          res.status === 200
+            ? Effect.succeed(res)
+            : res.text.pipe(
+                Effect.flatMap((body) =>
+                  Effect.fail(new WorkerNotReady({ status: res.status, body })),
+                ),
+              ),
+        ),
+        Effect.retry({
+          while: (e): e is WorkerNotReady =>
+            e instanceof WorkerNotReady && e.status >= 400 && e.status < 600,
+          schedule: Schedule.exponential("500 millis").pipe(
+            Schedule.both(Schedule.recurs(15)),
+          ),
+        }),
+      );
+      expect(seedRes.status).toBe(200);
+      expect(yield* seedRes.json).toMatchObject({ batches: 3, success: true });
+
+      // single insert via prepare.bind.run
+      const insertRes = yield* retryUntilOk(
+        HttpClient.execute(
+          HttpClientRequest.post(`${baseUrl}/users`).pipe(
+            HttpClientRequest.bodyJsonUnsafe({ id: 4, name: "dave" }),
+          ),
+        ),
+      );
+      expect(insertRes.status).toBe(200);
+      expect(yield* insertRes.json).toMatchObject({
+        success: true,
+        meta: { changes: 1 },
+      });
+
+      // SELECT all via prepare.all
+      const allRes = yield* retryUntilOk(HttpClient.get(`${baseUrl}/users`));
+      expect(allRes.status).toBe(200);
+      const allBody = (yield* allRes.json) as {
+        success: boolean;
+        results: Array<{ id: number; name: string }>;
+      };
+      expect(allBody.success).toBe(true);
+      expect(allBody.results).toEqual([
+        { id: 1, name: "alice" },
+        { id: 2, name: "bob" },
+        { id: 3, name: "carol" },
+        { id: 4, name: "dave" },
+      ]);
+
+      // SELECT one via prepare.bind.first
+      const oneRes = yield* retryUntilOk(HttpClient.get(`${baseUrl}/users/2`));
+      expect(oneRes.status).toBe(200);
+      expect(yield* oneRes.json).toEqual({ row: { id: 2, name: "bob" } });
+
+      // raw escape hatch (used by Better Auth / Drizzle integrations)
+      const rawRes = yield* retryUntilOk(HttpClient.get(`${baseUrl}/raw`));
+      expect(rawRes.status).toBe(200);
+      expect(yield* rawRes.json).toEqual({ count: 4 });
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+  { timeout: 240_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/Database.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/Database.test.ts
new file mode 100644
index 00000000000..aa4a4e1d4e5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/Database.test.ts
@@ -0,0 +1,647 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete database with default props", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const database = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("DefaultDatabase");
+      }),
+    );
+
+    expect(database.databaseName).toBeDefined();
+    expect(database.databaseId).toBeDefined();
+
+    const actualDatabase = yield* d1.getDatabase({
+      accountId,
+      databaseId: database.databaseId,
+    });
+    expect(actualDatabase.uuid).toEqual(database.databaseId);
+
+    yield* stack.destroy();
+
+    yield* waitForDatabaseToBeDeleted(database.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("create, update, delete database", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const database = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("TestDatabase", {
+          readReplication: { mode: "disabled" },
+        });
+      }),
+    );
+
+    const actualDatabase = yield* d1.getDatabase({
+      accountId,
+      databaseId: database.databaseId,
+    });
+    expect(actualDatabase.uuid).toEqual(database.databaseId);
+
+    const updatedDatabase = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("TestDatabase", {
+          readReplication: { mode: "auto" },
+        });
+      }),
+    );
+
+    expect(updatedDatabase.databaseId).toEqual(database.databaseId);
+
+    const actualUpdatedDatabase = yield* d1.getDatabase({
+      accountId,
+      databaseId: updatedDatabase.databaseId,
+    });
+    expect(actualUpdatedDatabase.readReplication?.mode).toEqual("auto");
+
+    yield* stack.destroy();
+
+    yield* waitForDatabaseToBeDeleted(database.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("applies migrations from migrationsDir", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const migrationsDir = yield* fs.makeTempDirectory({
+      prefix: "alchemy-d1-migrations-",
+    });
+
+    yield* fs.writeFileString(
+      path.join(migrationsDir, "0001_users.sql"),
+      "CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT NOT NULL);",
+    );
+    yield* fs.writeFileString(
+      path.join(migrationsDir, "0002_posts.sql"),
+      "CREATE TABLE posts (id INTEGER PRIMARY KEY, title TEXT NOT NULL);",
+    );
+
+    yield* stack.destroy();
+
+    const database = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("MigrationDatabase", {
+          migrationsDir,
+        });
+      }),
+    );
+
+    expect(database.migrationsDir).toEqual(migrationsDir);
+    expect(database.migrationsTable).toEqual("d1_migrations");
+    expect(Object.keys(database.migrationsHashes).sort()).toEqual([
+      "0001_users.sql",
+      "0002_posts.sql",
+    ]);
+
+    const tables = yield* listTables(accountId, database.databaseId);
+    expect(tables).toContain("users");
+    expect(tables).toContain("posts");
+    expect(tables).toContain("d1_migrations");
+
+    const applied = yield* queryAll<{ id: string; name: string }>(
+      accountId,
+      database.databaseId,
+      "SELECT id, name FROM d1_migrations ORDER BY id;",
+    );
+    expect(applied).toEqual([
+      { id: "00001", name: "0001_users.sql" },
+      { id: "00002", name: "0002_posts.sql" },
+    ]);
+    for (const row of applied) {
+      expect(row.id).toMatch(/^\d{5}$/);
+    }
+
+    // Adding a new migration on update should apply only the new one and the
+    // sequential id should continue from where it left off.
+    yield* fs.writeFileString(
+      path.join(migrationsDir, "0003_comments.sql"),
+      "CREATE TABLE comments (id INTEGER PRIMARY KEY, body TEXT NOT NULL);",
+    );
+
+    const updated = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("MigrationDatabase", {
+          migrationsDir,
+        });
+      }),
+    );
+    expect(updated.databaseId).toEqual(database.databaseId);
+
+    const tablesAfter = yield* listTables(accountId, database.databaseId);
+    expect(tablesAfter).toContain("comments");
+
+    const appliedAfter = yield* queryAll<{ id: string; name: string }>(
+      accountId,
+      database.databaseId,
+      "SELECT id, name FROM d1_migrations ORDER BY id;",
+    );
+    expect(appliedAfter).toEqual([
+      { id: "00001", name: "0001_users.sql" },
+      { id: "00002", name: "0002_posts.sql" },
+      { id: "00003", name: "0003_comments.sql" },
+    ]);
+
+    yield* stack.destroy();
+    yield* waitForDatabaseToBeDeleted(database.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("applies migrations using a custom migrationsTable", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const migrationsDir = yield* fs.makeTempDirectory({
+      prefix: "alchemy-d1-custom-migrations-",
+    });
+    yield* fs.writeFileString(
+      path.join(migrationsDir, "0001_create.sql"),
+      "CREATE TABLE test_migrations_table (id INTEGER PRIMARY KEY, name TEXT);",
+    );
+
+    yield* stack.destroy();
+
+    const database = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("CustomMigrationsTableDb", {
+          migrationsDir,
+          migrationsTable: "custom_migration_tracking",
+        });
+      }),
+    );
+
+    expect(database.migrationsTable).toEqual("custom_migration_tracking");
+
+    const tables = yield* listTables(accountId, database.databaseId);
+    expect(tables).toContain("custom_migration_tracking");
+    expect(tables).toContain("test_migrations_table");
+    // The default table must NOT be created when a custom one is configured.
+    expect(tables).not.toContain("d1_migrations");
+
+    yield* stack.destroy();
+    yield* waitForDatabaseToBeDeleted(database.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider(
+  "migrates legacy 2-column migration table to wrangler schema",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const migrationsDir = yield* fs.makeTempDirectory({
+        prefix: "alchemy-d1-legacy-",
+      });
+      yield* fs.writeFileString(
+        path.join(migrationsDir, "0002_create_users.sql"),
+        "CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT NOT NULL);",
+      );
+      yield* fs.writeFileString(
+        path.join(migrationsDir, "0003_create_posts.sql"),
+        "CREATE TABLE posts (id INTEGER PRIMARY KEY, title TEXT NOT NULL);",
+      );
+
+      yield* stack.destroy();
+
+      // Step 1: deploy the database without migrations so we can seed a legacy
+      // 2-column d1_migrations table on it before re-deploying with a
+      // migrationsDir.
+      const seeded = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.D1Database("LegacyMigrationDb");
+        }),
+      );
+
+      yield* execSql(
+        accountId,
+        seeded.databaseId,
+        `CREATE TABLE d1_migrations (
+         id TEXT PRIMARY KEY,
+         applied_at TEXT NOT NULL
+       );`,
+      );
+      yield* execSql(
+        accountId,
+        seeded.databaseId,
+        `INSERT INTO d1_migrations (id, applied_at) VALUES
+         ('0000_initial_setup.sql', datetime('now', '-1 day')),
+         ('0001_add_indexes.sql', datetime('now', '-1 hour'));`,
+      );
+
+      // Step 2: deploy again with a migrationsDir; the resource should detect
+      // the legacy 2-column schema, migrate to (id, name, applied_at), and apply
+      // the new migrations on top.
+      const upgraded = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.D1Database("LegacyMigrationDb", {
+            migrationsDir,
+          });
+        }),
+      );
+      expect(upgraded.databaseId).toEqual(seeded.databaseId);
+
+      const columns = yield* queryAll<{ name: string }>(
+        accountId,
+        seeded.databaseId,
+        "PRAGMA table_info(d1_migrations);",
+      );
+      const colNames = columns.map((c) => c.name).sort();
+      expect(colNames).toEqual(["applied_at", "id", "name"]);
+
+      const records = yield* queryAll<{ id: string; name: string }>(
+        accountId,
+        seeded.databaseId,
+        "SELECT id, name FROM d1_migrations ORDER BY id;",
+      );
+      const names = records.map((r) => r.name);
+      expect(names).toContain("0000_initial_setup.sql");
+      expect(names).toContain("0001_add_indexes.sql");
+      expect(names).toContain("0002_create_users.sql");
+      expect(names).toContain("0003_create_posts.sql");
+
+      // All ids should be 5-digit zero-padded sequential numbers.
+      for (const r of records) {
+        expect(r.id).toMatch(/^\d{5}$/);
+      }
+      expect(records[0].id).toBe("00001");
+      expect(records[records.length - 1].id).toBe(
+        records.length.toString().padStart(5, "0"),
+      );
+
+      yield* stack.destroy();
+      yield* waitForDatabaseToBeDeleted(seeded.databaseId, accountId);
+    }).pipe(logLevel),
+);
+
+test.provider("imports SQL files via importFiles", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = yield* fs.makeTempDirectory({
+      prefix: "alchemy-d1-imports-",
+    });
+    const importPath = path.join(dir, "seed.sql");
+
+    yield* fs.writeFileString(
+      importPath,
+      [
+        "CREATE TABLE widgets (id INTEGER PRIMARY KEY, label TEXT NOT NULL);",
+        "INSERT INTO widgets (id, label) VALUES (1, 'one');",
+        "INSERT INTO widgets (id, label) VALUES (2, 'two');",
+      ].join("\n"),
+    );
+
+    yield* stack.destroy();
+
+    const database = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.D1Database("ImportDatabase", {
+          importFiles: [importPath],
+        });
+      }),
+    );
+
+    expect(database.importHashes[importPath]).toBeDefined();
+
+    const widgets = yield* getResults<{ id: number; label: string }>(
+      accountId,
+      database.databaseId,
+      "SELECT id, label FROM widgets ORDER BY id;",
+    );
+    expect(widgets).toEqual([
+      { id: 1, label: "one" },
+      { id: 2, label: "two" },
+    ]);
+
+    yield* stack.destroy();
+    yield* waitForDatabaseToBeDeleted(database.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("clones a database by databaseId", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = yield* fs.makeTempDirectory({
+      prefix: "alchemy-d1-clone-id-",
+    });
+    const seedPath = path.join(dir, "seed.sql");
+
+    yield* fs.writeFileString(
+      seedPath,
+      [
+        "CREATE TABLE colors (id INTEGER PRIMARY KEY, name TEXT NOT NULL);",
+        "INSERT INTO colors (id, name) VALUES (1, 'red'), (2, 'green'), (3, 'blue');",
+      ].join("\n"),
+    );
+
+    yield* stack.destroy();
+
+    const { source, target } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const source = yield* Cloudflare.D1Database("CloneByIdSource", {
+          importFiles: [seedPath],
+        });
+        const target = yield* Cloudflare.D1Database("CloneByIdTarget", {
+          clone: { databaseId: source.databaseId },
+        });
+        return { source, target };
+      }),
+    );
+
+    expect(target.databaseId).not.toEqual(source.databaseId);
+
+    const targetColors = yield* getResults<{ id: number; name: string }>(
+      accountId,
+      target.databaseId,
+      "SELECT id, name FROM colors ORDER BY id;",
+    );
+    expect(targetColors).toEqual([
+      { id: 1, name: "red" },
+      { id: 2, name: "green" },
+      { id: 3, name: "blue" },
+    ]);
+
+    yield* stack.destroy();
+    yield* waitForDatabaseToBeDeleted(source.databaseId, accountId);
+    yield* waitForDatabaseToBeDeleted(target.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("clones a database by name lookup", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = yield* fs.makeTempDirectory({
+      prefix: "alchemy-d1-clone-name-",
+    });
+    const seedPath = path.join(dir, "seed.sql");
+
+    yield* fs.writeFileString(
+      seedPath,
+      [
+        "CREATE TABLE animals (id INTEGER PRIMARY KEY, kind TEXT NOT NULL);",
+        "INSERT INTO animals (id, kind) VALUES (1, 'cat'), (2, 'dog');",
+      ].join("\n"),
+    );
+
+    yield* stack.destroy();
+
+    const { source, target } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const source = yield* Cloudflare.D1Database("CloneByNameSource", {
+          importFiles: [seedPath],
+        });
+        const target = yield* Cloudflare.D1Database("CloneByNameTarget", {
+          clone: { name: source.databaseName },
+        });
+        return { source, target };
+      }),
+    );
+
+    expect(target.databaseId).not.toEqual(source.databaseId);
+
+    const animals = yield* getResults<{ id: number; kind: string }>(
+      accountId,
+      target.databaseId,
+      "SELECT id, kind FROM animals ORDER BY id;",
+    );
+    expect(animals).toEqual([
+      { id: 1, kind: "cat" },
+      { id: 2, kind: "dog" },
+    ]);
+
+    yield* stack.destroy();
+    yield* waitForDatabaseToBeDeleted(source.databaseId, accountId);
+    yield* waitForDatabaseToBeDeleted(target.databaseId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider(
+  "clones a database by passing the source resource directly",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const dir = yield* fs.makeTempDirectory({
+        prefix: "alchemy-d1-clone-direct-",
+      });
+      const seedPath = path.join(dir, "seed.sql");
+
+      yield* fs.writeFileString(
+        seedPath,
+        [
+          "CREATE TABLE shapes (id INTEGER PRIMARY KEY, name TEXT NOT NULL);",
+          "INSERT INTO shapes (id, name) VALUES (1, 'square'), (2, 'circle');",
+        ].join("\n"),
+      );
+
+      yield* stack.destroy();
+
+      const { source, target } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const source = yield* Cloudflare.D1Database("CloneDirectSource", {
+            importFiles: [seedPath],
+          });
+          const target = yield* Cloudflare.D1Database("CloneDirectTarget", {
+            clone: source,
+          });
+          return { source, target };
+        }),
+      );
+
+      expect(target.databaseId).not.toEqual(source.databaseId);
+
+      const shapes = yield* getResults<{ id: number; name: string }>(
+        accountId,
+        target.databaseId,
+        "SELECT id, name FROM shapes ORDER BY id;",
+      );
+      expect(shapes).toEqual([
+        { id: 1, name: "square" },
+        { id: 2, name: "circle" },
+      ]);
+
+      yield* stack.destroy();
+      yield* waitForDatabaseToBeDeleted(source.databaseId, accountId);
+      yield* waitForDatabaseToBeDeleted(target.databaseId, accountId);
+    }).pipe(logLevel),
+);
+
+const queryAll = Effect.fn(function* <T>(
+  accountId: string,
+  databaseId: string,
+  sql: string,
+) {
+  const queryDb = yield* d1.queryDatabase;
+  const result = yield* queryDb({ accountId, databaseId, sql });
+  return (result.result[0]?.results ?? []) as T[];
+});
+
+const execSql = (accountId: string, databaseId: string, sql: string) =>
+  queryAll<unknown>(accountId, databaseId, sql);
+
+const listTables = Effect.fn(function* (accountId: string, databaseId: string) {
+  const rows = yield* queryAll<{ name: string }>(
+    accountId,
+    databaseId,
+    "SELECT name FROM sqlite_master WHERE type='table';",
+  );
+  return rows.map((r) => r.name);
+});
+
+/**
+ * D1 query results are eventually consistent following an import/clone, so
+ * retry until we see at least one row (matches v1's `getResults` helper).
+ */
+const getResults = Effect.fn(function* <T>(
+  accountId: string,
+  databaseId: string,
+  sql: string,
+) {
+  return yield* queryAll<T>(accountId, databaseId, sql).pipe(
+    Effect.flatMap((rows) =>
+      rows.length > 0
+        ? Effect.succeed(rows)
+        : Effect.fail(new EmptyResults({ sql })),
+    ),
+    Effect.retry({
+      while: (e) => e instanceof EmptyResults,
+      schedule: Schedule.both(
+        Schedule.spaced(Duration.seconds(1)),
+        Schedule.recurs(10),
+      ),
+    }),
+    Effect.orDie,
+  );
+});
+
+// Engine-level adoption: D1 databases have no ownership signal (Cloudflare
+// doesn't expose tags on D1), so a name match in `read` is treated as silent
+// adoption.
+test.provider(
+  "existing database (matching name) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const databaseName = `alchemy-test-d1-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      // Phase 1: deploy normally so a real D1 database exists.
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.D1Database("AdoptableDatabase", {
+            name: databaseName,
+          });
+        }),
+      );
+      expect(initial.databaseName).toEqual(databaseName);
+      const initialId = initial.databaseId;
+
+      // Phase 2: wipe local state — the database stays on Cloudflare.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableDatabase",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      // Phase 3: redeploy without `adopt(true)`. The engine calls
+      // `provider.read`, which lists databases by name and returns plain
+      // attrs — silent adoption.
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.D1Database("AdoptableDatabase", {
+            name: databaseName,
+          });
+        }),
+      );
+
+      // Same physical database — adoption, not re-creation.
+      expect(adopted.databaseId).toEqual(initialId);
+      expect(adopted.databaseName).toEqual(databaseName);
+
+      const persisted = yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        return yield* state.get({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableDatabase",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      expect((persisted as any)?.attr).toMatchObject({
+        databaseId: initialId,
+        databaseName,
+      });
+
+      yield* stack.destroy();
+      yield* waitForDatabaseToBeDeleted(initialId, accountId);
+    }).pipe(logLevel),
+);
+
+const waitForDatabaseToBeDeleted = Effect.fn(function* (
+  databaseId: string,
+  accountId: string,
+) {
+  yield* d1
+    .getDatabase({
+      accountId,
+      databaseId,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new DatabaseStillExists())),
+      Effect.retry({
+        while: (e): e is DatabaseStillExists =>
+          e instanceof DatabaseStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("DatabaseNotFound", () => Effect.void),
+    );
+});
+
+class DatabaseStillExists extends Data.TaggedError("DatabaseStillExists") {}
+class EmptyResults extends Data.TaggedError("EmptyResults")<{
+  sql: string;
+}> {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/d1-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/d1-worker.ts
new file mode 100644
index 00000000000..1cb611f48e4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/D1/d1-worker.ts
@@ -0,0 +1,111 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * D1 database created at deploy time and bound to the worker via
+ * `Cloudflare.D1Connection.bind(...)`. The handlers below exercise
+ * the full surface area of the Effect-native D1 client:
+ *
+ *   POST /init       — `db.exec("CREATE TABLE ...")`
+ *   POST /seed       — `db.batch([prepare(...).bind(...), ...])`
+ *   POST /users      — `db.prepare(...).bind(...).run()`
+ *   GET  /users      — `db.prepare(...).all()`
+ *   GET  /users/:id  — `db.prepare(...).bind(id).first()`
+ *   GET  /raw        — `db.raw` -> direct runtime D1Database access
+ */
+export const TestDatabase = Cloudflare.D1Database("D1WorkerDatabase");
+
+export default class D1Worker extends Cloudflare.Worker<D1Worker>()(
+  "D1EffectWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const database = yield* TestDatabase;
+    const db = yield* Cloudflare.D1Connection.bind(database);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/init") {
+          const result = yield* db.exec(
+            "CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, name TEXT NOT NULL)",
+          );
+          return yield* HttpServerResponse.json({
+            count: result.count,
+            duration: result.duration,
+          });
+        }
+
+        if (request.method === "POST" && url.pathname === "/seed") {
+          const insert = db.prepare(
+            "INSERT INTO users (id, name) VALUES (?, ?)",
+          );
+          const results = yield* db.batch([
+            insert.bind(1, "alice"),
+            insert.bind(2, "bob"),
+            insert.bind(3, "carol"),
+          ]);
+          return yield* HttpServerResponse.json({
+            batches: results.length,
+            success: results.every((r) => r.success),
+          });
+        }
+
+        if (request.method === "POST" && url.pathname === "/users") {
+          const body = (yield* request.json) as { id: number; name: string };
+          const result = yield* db
+            .prepare("INSERT INTO users (id, name) VALUES (?, ?)")
+            .bind(body.id, body.name)
+            .run();
+          return yield* HttpServerResponse.json({
+            success: result.success,
+            meta: { changes: result.meta.changes },
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/users") {
+          const result = yield* db
+            .prepare("SELECT id, name FROM users ORDER BY id")
+            .all<{ id: number; name: string }>();
+          return yield* HttpServerResponse.json({
+            success: result.success,
+            results: result.results,
+          });
+        }
+
+        const userMatch = url.pathname.match(/^\/users\/(\d+)$/);
+        if (request.method === "GET" && userMatch) {
+          const id = Number(userMatch[1]);
+          const row = yield* db
+            .prepare("SELECT id, name FROM users WHERE id = ?")
+            .bind(id)
+            .first<{ id: number; name: string }>();
+          return yield* HttpServerResponse.json({ row });
+        }
+
+        if (request.method === "GET" && url.pathname === "/raw") {
+          // `db.raw` returns the underlying Cloudflare D1Database.
+          // Run a prepared statement directly on it to prove `raw`
+          // resolves to a working binding (this is the escape hatch
+          // libraries like Better Auth/Drizzle rely on).
+          const raw = yield* db.raw;
+          const result = yield* Effect.promise(() =>
+            raw.prepare("SELECT COUNT(*) as count FROM users").first<{
+              count: number;
+            }>(),
+          );
+          return yield* HttpServerResponse.json({ count: result?.count ?? 0 });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.D1ConnectionLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/Dns.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/Dns.test.ts
new file mode 100644
index 00000000000..f5c3f4ea00b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/Dns.test.ts
@@ -0,0 +1,92 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import { findZoneByName } from "@/Cloudflare/Zone/lookup";
+import * as Core from "@/Test/Core.ts";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const zoneName =
+  process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// Resolve the test zone id via the SDK. `withProviders` supplies the Cloudflare
+// credentials + account id the lookup needs inside a plain test body.
+const resolveZoneId = Core.withProviders(
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+    const zone = yield* findZoneByName({ accountId, name: zoneName });
+    return zone?.id;
+  }),
+  { providers: Cloudflare.providers() },
+  "DnsTestStack",
+);
+
+test(
+  "deployed worker drives the full DNS record CRUD surface via DnsReadWrite",
+  Effect.gen(function* () {
+    const { effectUrl } = yield* stack;
+    expect(effectUrl).toBeTypeOf("string");
+
+    const zoneId = yield* resolveZoneId;
+    expect(zoneId, `zone "${zoneName}" not found in account`).toBeTypeOf(
+      "string",
+    );
+
+    // Unique per run so repeated runs never collide on record name.
+    const name = `alchemy-dns-test-${Math.random()
+      .toString(36)
+      .slice(2, 10)}.${zoneName}`;
+
+    const client = yield* HttpClient.HttpClient;
+    const res = yield* client
+      .get(`${effectUrl}/dns?name=${encodeURIComponent(name)}`)
+      .pipe(
+        // Retry only while the worker is still cold-starting (not yet live).
+        // Once it responds 200 or 500 the handler ran, so stop and inspect.
+        Effect.flatMap((res) =>
+          res.status === 200 || res.status === 500
+            ? Effect.succeed(res)
+            : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+        ),
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 15,
+        }),
+      );
+
+    if (res.status !== 200) {
+      const err = yield* res.json;
+      throw new Error(`DNS worker failed: ${JSON.stringify(err)}`);
+    }
+
+    const body = (yield* res.json) as {
+      id: string;
+      getName: string;
+      count: number;
+      updatedId: string;
+      deleted: boolean;
+    };
+    expect(body.id.length).toBeGreaterThan(0);
+    expect(body.getName).toBe(name);
+    expect(body.count).toBeGreaterThan(0);
+    expect(body.updatedId).toBe(body.id);
+    expect(body.deleted).toBe(true);
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/effect.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/effect.ts
new file mode 100644
index 00000000000..b2730009831
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/effect.ts
@@ -0,0 +1,74 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Zone } from "./zone.ts";
+/**
+ * Effect-native Worker fixture that exercises the {@link Cloudflare.DnsReadWrite}
+ * binding (full DNS record CRUD).
+ *
+ * Binding `DnsReadWrite` in the Init phase provisions a scoped
+ * {@link Cloudflare.AccountApiToken} (with `DNS Read` + `DNS Write`, limited to
+ * the bound zone) and binds its value plus the zone id into the Worker. The
+ * `/dns` route then drives a self-contained create → get → list → update →
+ * delete scenario against that zone.
+ */
+export default class DnsEffectWorker extends Cloudflare.Worker<DnsEffectWorker>()(
+  "DnsEffectWorker",
+  {
+    main: import.meta.filename,
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const dns = yield* Cloudflare.DnsReadWrite.bind(Zone);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+
+        if (url.pathname === "/dns") {
+          const name = url.searchParams.get("name")!;
+
+          return yield* Effect.gen(function* () {
+            const created = yield* dns.createDnsRecord({
+              type: "A",
+              name,
+              content: "192.0.2.1",
+              ttl: 1,
+            });
+            const id = created.id;
+
+            const got = yield* dns.getDnsRecord(id);
+            const list = yield* dns.listDnsRecords({ type: "A" });
+            const updated = yield* dns.updateDnsRecord(id, {
+              type: "A",
+              name,
+              content: "192.0.2.2",
+              ttl: 1,
+            });
+            yield* dns.deleteDnsRecord(id);
+
+            return yield* HttpServerResponse.json({
+              id,
+              getName: got.name,
+              count: list.result?.length,
+              updatedId: updated.id,
+              deleted: true,
+            });
+          }).pipe(
+            Effect.catchCause((cause) =>
+              HttpServerResponse.json(
+                { error: Cause.pretty(cause) },
+                { status: 500 },
+              ),
+            ),
+          );
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.DnsReadWriteLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/stack.ts
new file mode 100644
index 00000000000..7811e3ef3f6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import DnsEffectWorker from "./effect.ts";
+
+export default Alchemy.Stack(
+  "DnsTestStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const effectWorker = yield* DnsEffectWorker;
+    return {
+      effectUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/zone.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/zone.ts
new file mode 100644
index 00000000000..56c2a7c241c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Dns/fixtures/zone.ts
@@ -0,0 +1,6 @@
+import * as AdoptPolicy from "alchemy/AdoptPolicy";
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Zone = Cloudflare.Zone("alchemy-test-2.us", {
+  name: "alchemy-test-2.us",
+}).pipe(AdoptPolicy.adopt());
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/SendEmail.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/SendEmail.test.ts
new file mode 100644
index 00000000000..d5b2c68a853
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/SendEmail.test.ts
@@ -0,0 +1,62 @@
+import * as Alchemy from "@/index.ts";
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import SendEmailWorker from "./fixtures/worker.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const FROM = process.env.CLOUDFLARE_TEST_EMAIL_FROM;
+const TO = process.env.CLOUDFLARE_TEST_EMAIL_TO;
+const skip = !FROM || !TO;
+
+const Stack = Alchemy.Stack(
+  "SendEmailBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* SendEmailWorker;
+    return { url: worker.url.as<string>() };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY || skip)(destroy(Stack));
+
+test.skipIf(skip)(
+  "sends an email through the Worker send_email binding",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const sendUrl = `${url}/send?from=${encodeURIComponent(FROM!)}&to=${encodeURIComponent(TO!)}`;
+    const res = yield* client.get(sendUrl).pipe(
+      Effect.flatMap((res) =>
+        res.status === 200 ? Effect.succeed(res) : Effect.fail(res),
+      ),
+      Effect.retry({
+        schedule: Schedule.exponential("500 millis"),
+        times: 10,
+      }),
+    );
+    const body = (yield* res.json) as { ok: boolean; message?: string };
+    if (!body.ok) {
+      throw new Error(`send_email failed: ${body.message}`);
+    }
+    expect(body.ok).toBe(true);
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/fixtures/sender.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/fixtures/sender.ts
new file mode 100644
index 00000000000..9e6a035320c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/fixtures/sender.ts
@@ -0,0 +1,14 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+
+const senderAddress = process.env.CLOUDFLARE_TEST_EMAIL_FROM;
+const destinationAddress = process.env.CLOUDFLARE_TEST_EMAIL_TO;
+
+/**
+ * `send_email` binding for the deployed test Worker. Restricted to the
+ * sender/destination pair supplied via env so the e2e test exercises a
+ * real `.send()` round-trip against Cloudflare.
+ */
+export const Email = Cloudflare.SendEmail("Email", {
+  allowedSenderAddresses: senderAddress ? [senderAddress] : undefined,
+  destinationAddress,
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/fixtures/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/fixtures/worker.ts
new file mode 100644
index 00000000000..6f7a237506a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Email/fixtures/worker.ts
@@ -0,0 +1,49 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Email } from "./sender.ts";
+
+export default class SendEmailWorker extends Cloudflare.Worker<SendEmailWorker>()(
+  "SendEmailTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const email = yield* Cloudflare.SendEmail.bind(Email);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (url.pathname === "/send") {
+          const from = url.searchParams.get("from")!;
+          const to = url.searchParams.get("to")!;
+          const subject = url.searchParams.get("subject") ?? "alchemy test";
+          const result = yield* email
+            .send({
+              from,
+              to,
+              subject,
+              text: `sent at ${new Date().toISOString()}`,
+            })
+            .pipe(
+              Effect.match({
+                onSuccess: () => ({ ok: true as const }),
+                onFailure: (err) => ({
+                  ok: false as const,
+                  message: err.message,
+                }),
+              }),
+            );
+          return yield* HttpServerResponse.json(result);
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.SendEmailBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Hyperdrive/Hyperdrive.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Hyperdrive/Hyperdrive.test.ts
new file mode 100644
index 00000000000..52c8825926a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Hyperdrive/Hyperdrive.test.ts
@@ -0,0 +1,112 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import * as hyperdrive from "@distilled.cloud/cloudflare/hyperdrive";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const baseOrigin = {
+  scheme: "postgres" as const,
+  host: "ep-cool-darkness-123456.us-east-2.aws.neon.tech",
+  port: 5432,
+  database: "app",
+  user: "app",
+  password: Redacted.make("p4ssword!"),
+};
+
+test.provider.skip("create and delete hyperdrive with default props", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const hd = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.Hyperdrive("DefaultHyperdrive", {
+          origin: baseOrigin,
+        });
+      }),
+    );
+
+    expect(hd.hyperdriveId).toBeDefined();
+    expect(hd.name).toBeDefined();
+
+    const actual = yield* hyperdrive.getConfig({
+      accountId,
+      hyperdriveId: hd.hyperdriveId,
+    });
+    expect(actual.id).toEqual(hd.hyperdriveId);
+    // @ts-expect-error
+    expect(actual.origin.host).toEqual(baseOrigin.host);
+
+    yield* stack.destroy();
+
+    yield* waitForConfigToBeDeleted(hd.hyperdriveId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider.skip("create, update, delete hyperdrive", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const hd = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.Hyperdrive("UpdateHyperdrive", {
+          origin: baseOrigin,
+          caching: { disabled: false, maxAge: 60 },
+        });
+      }),
+    );
+
+    const updated = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.Hyperdrive("UpdateHyperdrive", {
+          origin: baseOrigin,
+          caching: { disabled: true },
+        });
+      }),
+    );
+
+    expect(updated.hyperdriveId).toEqual(hd.hyperdriveId);
+
+    const actual = yield* hyperdrive.getConfig({
+      accountId,
+      hyperdriveId: updated.hyperdriveId,
+    });
+    // After PUT with `disabled: true`, caching should reflect the change.
+    expect(actual.caching).toBeDefined();
+
+    yield* stack.destroy();
+
+    yield* waitForConfigToBeDeleted(hd.hyperdriveId, accountId);
+  }).pipe(logLevel),
+);
+
+const waitForConfigToBeDeleted = Effect.fn(function* (
+  hyperdriveId: string,
+  accountId: string,
+) {
+  yield* hyperdrive.getConfig({ accountId, hyperdriveId }).pipe(
+    Effect.flatMap(() => Effect.fail(new ConfigStillExists())),
+    Effect.retry({
+      while: (e): e is ConfigStillExists => e instanceof ConfigStillExists,
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catchTag("HyperdriveConfigNotFound", () => Effect.void),
+  );
+});
+
+class ConfigStillExists extends Data.TaggedError("ConfigStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/Images.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/Images.test.ts
new file mode 100644
index 00000000000..0fdba89be89
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/Images.test.ts
@@ -0,0 +1,91 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "./fixtures/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
+  status: number;
+  body: string;
+}> {}
+
+/**
+ * 1x1 red PNG — a known-good minimal image that Cloudflare Images accepts and
+ * reports as `image/png`, 1x1. The test uploads this to each worker, which
+ * forwards the request stream straight into `images.info()`.
+ */
+const TINY_PNG = new Uint8Array(
+  Buffer.from(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==",
+    "base64",
+  ),
+);
+
+// Cloudflare's edge takes a few seconds to start serving a fresh workers.dev
+// URL — initial requests can return Cloudflare's "There is nothing here yet"
+// 404 page. Retry until the worker answers 200 (and surface its body if it
+// doesn't, so a real failure isn't hidden by the retry loop).
+const postImage = (url: string) =>
+  HttpClient.execute(
+    HttpClientRequest.post(url).pipe(
+      HttpClientRequest.bodyUint8Array(TINY_PNG),
+    ),
+  ).pipe(
+    Effect.flatMap((res) =>
+      res.status === 200
+        ? res.json
+        : res.text.pipe(
+            Effect.flatMap((body) =>
+              Effect.fail(new WorkerNotReady({ status: res.status, body })),
+            ),
+          ),
+    ),
+    Effect.retry({
+      while: (e): e is WorkerNotReady =>
+        e instanceof WorkerNotReady && e.status >= 400 && e.status < 500,
+      schedule: Schedule.exponential("500 millis").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "async worker reads image info via env Images binding",
+  Effect.gen(function* () {
+    const { asyncWorkerUrl } = yield* stack;
+    const info = yield* postImage(asyncWorkerUrl);
+    expect(info).toMatchObject({
+      mode: "async",
+      format: "image/png",
+      width: 1,
+      height: 1,
+    });
+  }),
+  { timeout: 240_000 },
+);
+
+test(
+  "effect worker reads image info via yield* Images",
+  Effect.gen(function* () {
+    const { effectWorkerUrl } = yield* stack;
+    const info = yield* postImage(effectWorkerUrl);
+    expect(info).toMatchObject({
+      mode: "effect",
+      format: "image/png",
+      width: 1,
+      height: 1,
+    });
+  }),
+  { timeout: 240_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/async-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/async-worker.ts
new file mode 100644
index 00000000000..9058b30052b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/async-worker.ts
@@ -0,0 +1,14 @@
+import type { AsyncWorkerEnv } from "./stack.ts";
+
+/**
+ * Async (non-Effect) Worker fixture for the Cloudflare Images binding declared
+ * via `env: { MEDIA: Cloudflare.Images(...) }`. `InferEnv` maps the marker to
+ * the native `cf.ImagesBinding`, so the handler calls `env.MEDIA.info(...)`
+ * directly with the request body's `ReadableStream`.
+ */
+export default {
+  async fetch(request: Request, env: AsyncWorkerEnv): Promise<Response> {
+    const info = await env.MEDIA.info(request.body!);
+    return Response.json({ mode: "async", ...info });
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/effect-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/effect-worker.ts
new file mode 100644
index 00000000000..841f7d5e0d0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/effect-worker.ts
@@ -0,0 +1,30 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Effect-native Worker fixture for the Cloudflare Images binding. Yielding
+ * `Cloudflare.Images(...)` during Init attaches the binding to this Worker and
+ * returns the runtime client in one step — no separate `.bind(...)`. The
+ * worker forwards the request body (typed as `Stream.Stream<Uint8Array>`)
+ * straight into `images.info(...)`, proving the Effect-native client converts
+ * an Effect Stream into the runtime ReadableStream the binding expects.
+ */
+export default class ImagesEffectWorker extends Cloudflare.Worker<ImagesEffectWorker>()(
+  "ImagesEffectWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const images = yield* Cloudflare.Images({ name: "PIPELINE" });
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const info = yield* images.info(request.stream).pipe(Effect.orDie);
+        return yield* HttpServerResponse.json({ mode: "effect", ...info });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.ImagesBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/stack.ts
new file mode 100644
index 00000000000..1fc16f083f1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Images/fixtures/stack.ts
@@ -0,0 +1,31 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as pathe from "pathe";
+import ImagesEffectWorker from "./effect-worker.ts";
+
+export const AsyncWorker = Cloudflare.Worker("ImagesAsyncWorker", {
+  main: pathe.resolve(import.meta.dirname, "async-worker.ts"),
+  env: {
+    MEDIA: Cloudflare.Images({ name: "MEDIA" }),
+  },
+});
+
+export type AsyncWorkerEnv = Cloudflare.InferEnv<typeof AsyncWorker>;
+
+export default Alchemy.Stack(
+  "ImagesBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const asyncWorker = yield* AsyncWorker;
+    const effectWorker = yield* ImagesEffectWorker;
+
+    return {
+      asyncWorkerUrl: asyncWorker.url.as<string>(),
+      effectWorkerUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/KV/Namespace.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/KV/Namespace.test.ts
new file mode 100644
index 00000000000..802ce5c8d4a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/KV/Namespace.test.ts
@@ -0,0 +1,178 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as KV from "@/Cloudflare/KV/index";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as kv from "@distilled.cloud/cloudflare/kv";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete namespace with default props", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const namespace = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* KV.KVNamespace("DefaultNamespace");
+      }),
+    );
+
+    expect(namespace.title).toBeDefined();
+    expect(namespace.namespaceId).toBeDefined();
+
+    const actualNamespace = yield* kv.getNamespace({
+      accountId,
+      namespaceId: namespace.namespaceId,
+    });
+    expect(actualNamespace.id).toEqual(namespace.namespaceId);
+
+    yield* stack.destroy();
+
+    yield* waitForNamespaceToBeDeleted(namespace.namespaceId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("create, update, delete namespace", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const namespace = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* KV.KVNamespace("TestNamespace");
+      }),
+    );
+
+    const actualNamespace = yield* kv.getNamespace({
+      accountId,
+      namespaceId: namespace.namespaceId,
+    });
+    expect(actualNamespace.id).toEqual(namespace.namespaceId);
+    expect(actualNamespace.title).toEqual(namespace.title);
+
+    const updatedNamespace = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* KV.KVNamespace("TestNamespace", {
+          title: namespace.title + "-updated",
+        });
+      }),
+    );
+
+    const actualUpdatedNamespace = yield* kv.getNamespace({
+      accountId,
+      namespaceId: updatedNamespace.namespaceId,
+    });
+    expect(actualUpdatedNamespace.title).toEqual(namespace.title + "-updated");
+    expect(actualUpdatedNamespace.id).toEqual(updatedNamespace.namespaceId);
+
+    yield* stack.destroy();
+
+    yield* waitForNamespaceToBeDeleted(namespace.namespaceId, accountId);
+  }).pipe(logLevel),
+);
+
+// Engine-level adoption: KV namespaces have no ownership signal (Cloudflare
+// doesn't expose tags on KV), so a name match in `read` is treated as silent
+// adoption. The test wipes local state mid-run while leaving the namespace
+// on Cloudflare — this simulates a fresh state store seeing an existing
+// resource with the same physical name.
+test.provider(
+  "existing namespace (matching title) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      // Use a fixed title so the namespace's identity persists across a
+      // state-store wipe.
+      const title = `alchemy-test-kv-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      // Phase 1: deploy normally so a real KV namespace exists on Cloudflare.
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* KV.KVNamespace("AdoptableNamespace", { title });
+        }),
+      );
+      expect(initial.title).toEqual(title);
+      const initialId = initial.namespaceId;
+      expect(initialId).toBeDefined();
+
+      // Phase 2: wipe local state — the namespace stays on Cloudflare.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableNamespace",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      // Phase 3: redeploy without `adopt(true)`. The engine calls
+      // `provider.read`, which lists namespaces, matches by title, and
+      // returns plain attrs — silent adoption.
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* KV.KVNamespace("AdoptableNamespace", { title });
+        }),
+      );
+
+      // Same physical namespace — adoption, not re-creation.
+      expect(adopted.namespaceId).toEqual(initialId);
+      expect(adopted.title).toEqual(title);
+
+      const persisted = yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        return yield* state.get({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableNamespace",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      expect((persisted as any)?.attr).toMatchObject({
+        namespaceId: initialId,
+        title,
+      });
+
+      yield* stack.destroy();
+      yield* waitForNamespaceToBeDeleted(initialId, accountId);
+    }).pipe(logLevel),
+);
+
+const waitForNamespaceToBeDeleted = Effect.fn(function* (
+  namespaceId: string,
+  accountId: string,
+) {
+  yield* kv
+    .getNamespace({
+      accountId,
+      namespaceId,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new NamespaceStillExists())),
+      Effect.retry({
+        while: (e): e is NamespaceStillExists =>
+          e instanceof NamespaceStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NamespaceNotFound", () => Effect.void),
+    );
+});
+
+class NamespaceStillExists extends Data.TaggedError("NamespaceStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/QueueConsumer.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/QueueConsumer.test.ts
new file mode 100644
index 00000000000..d2102f6fdda
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/QueueConsumer.test.ts
@@ -0,0 +1,392 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as queues from "@distilled.cloud/cloudflare/queues";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { MinimumLogLevel } from "effect/References";
+import * as pathe from "pathe";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const main = pathe.resolve(import.meta.dirname, "consumer-worker.ts");
+
+/**
+ * Lifecycle: create the consumer, change settings (in-place update),
+ * change script (replace), then destroy.
+ *
+ * Verifies the diff matrix end-to-end and that updateConsumer is
+ * issued every reconcile (so settings drift gets corrected even when
+ * `olds.settings` matches `news.settings`).
+ */
+test.provider("create, update settings, replace script, delete", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const initial = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        const workerA = yield* Cloudflare.Worker("WorkerA", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: workerA.workerName,
+          settings: { batchSize: 5, maxRetries: 3 },
+        });
+        return { queue, workerA, consumer };
+      }),
+    );
+
+    expect(initial.consumer.consumerId).toBeTypeOf("string");
+    expect(initial.consumer.scriptName).toEqual(initial.workerA.workerName);
+
+    const live = yield* queues.getConsumer({
+      accountId,
+      queueId: initial.queue.queueId,
+      consumerId: initial.consumer.consumerId,
+    });
+    expect("scriptName" in live ? live.scriptName : undefined).toEqual(
+      initial.workerA.workerName,
+    );
+
+    // Settings-only change is an update, not a replace — consumerId
+    // must remain stable.
+    const updated = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        const workerA = yield* Cloudflare.Worker("WorkerA", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: workerA.workerName,
+          settings: { batchSize: 25, maxRetries: 7 },
+        });
+        return { queue, workerA, consumer };
+      }),
+    );
+
+    expect(updated.consumer.consumerId).toEqual(initial.consumer.consumerId);
+
+    const liveUpdated = yield* queues.getConsumer({
+      accountId,
+      queueId: updated.queue.queueId,
+      consumerId: updated.consumer.consumerId,
+    });
+    expect(liveUpdated.settings?.batchSize).toEqual(25);
+    expect(liveUpdated.settings?.maxRetries).toEqual(7);
+
+    // Script change is a delete-first replace: Cloudflare's
+    // updateConsumer silently ignores script_name on an existing
+    // consumer, and the platform allows only one Worker consumer
+    // per queue, so the engine must tear the old consumer down
+    // before creating the new one. WorkerA stays yielded across
+    // the deploy so it isn't garbage-collected mid-replace and
+    // race the Worker.delete with Cloudflare's queue↔script sync.
+    const replaced = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        yield* Cloudflare.Worker("WorkerA", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const workerB = yield* Cloudflare.Worker("WorkerB", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: workerB.workerName,
+          settings: { batchSize: 25, maxRetries: 7 },
+        });
+        return { queue, workerB, consumer };
+      }),
+    );
+
+    expect(replaced.consumer.consumerId).not.toEqual(
+      initial.consumer.consumerId,
+    );
+    expect(replaced.consumer.scriptName).toEqual(replaced.workerB.workerName);
+
+    const liveReplaced = yield* queues.getConsumer({
+      accountId,
+      queueId: replaced.queue.queueId,
+      consumerId: replaced.consumer.consumerId,
+    });
+    expect(
+      "scriptName" in liveReplaced ? liveReplaced.scriptName : undefined,
+    ).toEqual(replaced.workerB.workerName);
+
+    // The original consumer must be gone after the replace.
+    const oldExit = yield* Effect.exit(
+      queues.getConsumer({
+        accountId,
+        queueId: replaced.queue.queueId,
+        consumerId: initial.consumer.consumerId,
+      }),
+    );
+    expect(Exit.isFailure(oldExit)).toBe(true);
+
+    yield* stack.destroy();
+
+    // Post-destroy: the new consumer must be gone on Cloudflare too.
+    const exit = yield* Effect.exit(
+      queues.getConsumer({
+        accountId,
+        queueId: replaced.queue.queueId,
+        consumerId: replaced.consumer.consumerId,
+      }),
+    );
+    expect(Exit.isFailure(exit)).toBe(true);
+  }).pipe(logLevel),
+);
+
+/**
+ * Recovery from out-of-band consumer deletion. After a manual
+ * `deleteConsumer` via the API, the reconciler must observe that
+ * the consumer is missing and recreate it instead of failing on a
+ * stale `output.consumerId` from local state.
+ *
+ * The redeploy bumps `settings` so the diff returns `update` and
+ * the engine actually invokes reconcile (a no-prop redeploy is a
+ * `noop` and skips drift detection by design — drift correction
+ * only happens when something the user-controlled changes).
+ */
+test.provider("recreates consumer after out-of-band delete", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const initial = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        const worker = yield* Cloudflare.Worker("Worker", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: worker.workerName,
+          settings: { batchSize: 5 },
+        });
+        return { queue, worker, consumer };
+      }),
+    );
+
+    // Out-of-band delete via the SDK directly.
+    yield* queues.deleteConsumer({
+      accountId,
+      queueId: initial.queue.queueId,
+      consumerId: initial.consumer.consumerId,
+    });
+
+    const recovered = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        const worker = yield* Cloudflare.Worker("Worker", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: worker.workerName,
+          settings: { batchSize: 11 },
+        });
+        return { queue, worker, consumer };
+      }),
+    );
+
+    expect(recovered.consumer.consumerId).toBeTypeOf("string");
+    // The new consumer must be reachable on Cloudflare — the previous
+    // implementation died with "already exists but could not be found"
+    // because listConsumers was single-page and ConsumerAlreadyExists
+    // was caught by a generic `Effect.catch`.
+    const live = yield* queues.getConsumer({
+      accountId,
+      queueId: recovered.queue.queueId,
+      consumerId: recovered.consumer.consumerId,
+    });
+    expect("scriptName" in live ? live.scriptName : undefined).toEqual(
+      recovered.worker.workerName,
+    );
+
+    yield* stack.destroy();
+  }).pipe(logLevel),
+);
+
+/**
+ * State-loss adoption. Wipe the local state for the QueueConsumer,
+ * leaving the Cloudflare consumer in place. On redeploy the engine
+ * calls `provider.read`, which now falls back to listConsumers when
+ * `output.consumerId` is missing — so the consumer is adopted instead
+ * of producing a duplicate-create attempt.
+ */
+test.provider("adopts existing consumer after local state loss", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const initial = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        const worker = yield* Cloudflare.Worker("Worker", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: worker.workerName,
+        });
+        return { queue, worker, consumer };
+      }),
+    );
+
+    // Wipe just the QueueConsumer entry — Queue and Worker stay so the
+    // redeploy reuses the same queueId / scriptName.
+    yield* Effect.gen(function* () {
+      const state = yield* yield* State;
+      yield* state.delete({
+        stack: stack.name,
+        stage: "test",
+        fqn: "Consumer",
+      });
+    }).pipe(Effect.provide(stack.state));
+
+    const adopted = yield* stack.deploy(
+      Effect.gen(function* () {
+        const queue = yield* Cloudflare.Queue("Q");
+        const worker = yield* Cloudflare.Worker("Worker", {
+          main,
+          compatibility: { date: "2024-01-01" },
+        });
+        const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+          queueId: queue.queueId,
+          scriptName: worker.workerName,
+        });
+        return { queue, worker, consumer };
+      }),
+    );
+
+    // Adoption: the consumerId from Cloudflare equals the one we
+    // created originally — we did not duplicate-create.
+    expect(adopted.consumer.consumerId).toEqual(initial.consumer.consumerId);
+
+    const live = yield* queues.getConsumer({
+      accountId,
+      queueId: adopted.queue.queueId,
+      consumerId: adopted.consumer.consumerId,
+    });
+    expect("scriptName" in live ? live.scriptName : undefined).toEqual(
+      adopted.worker.workerName,
+    );
+
+    yield* stack.destroy();
+  }).pipe(logLevel),
+);
+
+/**
+ * Conflict: queue already has a worker consumer pointing at a
+ * *different* script. This is the regression for the user-reported
+ * "already exists but could not be found" error — the previous
+ * implementation filtered listConsumers by `news.scriptName`, so a
+ * collision with a different script left the find empty and the
+ * reconciler died with a misleading message.
+ *
+ * The new behaviour: detect the foreign worker consumer and fail with
+ * a clear, actionable error naming both the existing script and the
+ * desired one.
+ */
+test.provider(
+  "fails clearly when queue has consumer for different script",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      // Phase 1: deploy worker A as the queue's consumer, then wipe just
+      // the QueueConsumer state so the next deploy thinks it's a
+      // greenfield create.
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          const queue = yield* Cloudflare.Queue("Q");
+          const workerA = yield* Cloudflare.Worker("WorkerA", {
+            main,
+            compatibility: { date: "2024-01-01" },
+          });
+          const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+            queueId: queue.queueId,
+            scriptName: workerA.workerName,
+          });
+          return { queue, workerA, consumer };
+        }),
+      );
+
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "Consumer",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      // Phase 2: redeploy with a different scriptName under the same
+      // logical id. Cloudflare's queue still has worker A as consumer.
+      const exit = yield* Effect.exit(
+        stack.deploy(
+          Effect.gen(function* () {
+            const queue = yield* Cloudflare.Queue("Q");
+            const workerB = yield* Cloudflare.Worker("WorkerB", {
+              main,
+              compatibility: { date: "2024-01-01" },
+            });
+            const consumer = yield* Cloudflare.QueueConsumer("Consumer", {
+              queueId: queue.queueId,
+              scriptName: workerB.workerName,
+            });
+            return { queue, workerB, consumer };
+          }),
+        ),
+      );
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      const message = JSON.stringify(exit);
+      // The error must name both the colliding existing script and the
+      // requested one — that is the difference between "user can fix
+      // this" and "what does this mean".
+      expect(message).toContain(initial.workerA.workerName);
+      expect(message).toContain("only one worker consumer");
+
+      // Cleanup: re-introduce the Consumer entry pointing at workerA so
+      // destroy can remove the cloud consumer.
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          const queue = yield* Cloudflare.Queue("Q");
+          const workerA = yield* Cloudflare.Worker("WorkerA", {
+            main,
+            compatibility: { date: "2024-01-01" },
+          });
+          yield* Cloudflare.QueueConsumer("Consumer", {
+            queueId: queue.queueId,
+            scriptName: workerA.workerName,
+          });
+          return queue;
+        }),
+      );
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/RoundTrip.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/RoundTrip.test.ts
new file mode 100644
index 00000000000..2be41dc3bcf
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/RoundTrip.test.ts
@@ -0,0 +1,139 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import QueueWorker, { Counter, RoundTripQueue } from "./round-trip-worker.ts";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+class CountMismatch extends Data.TaggedError("CountMismatch")<{
+  expected: number;
+  actual: number;
+}> {}
+
+/**
+ * End-to-end Cloudflare Queue round-trip via
+ * `Cloudflare.messages(queue).subscribe(...)`.
+ *
+ * Stack:
+ *
+ * - `Counter` Durable Object (per-key count + last-bodies tail).
+ * - `RoundTripQueue` (Cloudflare.Queue).
+ * - `QueueRoundTripWorker` — exposes:
+ *     - `POST /send?name=K`  →  enqueues a message via the
+ *       `Cloudflare.QueueBinding` producer.
+ *     - subscribe handler    →  increments the named Counter DO
+ *       and stores the body, via
+ *       `Cloudflare.messages(RoundTripQueue).subscribe(...)`.
+ *     - `GET /count?name=K`  →  reads the DO snapshot.
+ * - `Cloudflare.QueueConsumer` is auto-created by the policy
+ *   side of `messages().subscribe(...)` — there is no explicit
+ *   `QueueConsumer(...)` yield in the stack.
+ *
+ * The test sends N messages, then polls `/count?name=K` with
+ * exponential backoff until the DO reports `count >= N`. The
+ * round-trip proves: producer binding writes, Cloudflare dispatches
+ * to the registered consumer, the subscribe handler runs, the DO
+ * RPC stub from inside the queue handler works, and the test
+ * client can read the resulting DO state.
+ */
+test.provider(
+  "send → subscribe handler → DO state → polled by test client",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const out = yield* stack.deploy(
+        Effect.gen(function* () {
+          // The Worker's init body yields Counter and
+          // RoundTripQueue internally — yielding QueueWorker is
+          // enough to bring the whole stack (Queue +
+          // QueueConsumer + Counter DO + Worker) into the plan.
+          const worker = yield* QueueWorker;
+          return { url: worker.url };
+        }),
+      );
+      const url = out.url;
+      expect(url).toBeTypeOf("string");
+      const baseUrl = url as string;
+
+      // Use a unique counter key per test run so we don't
+      // accumulate state from prior runs (the DO survives across
+      // deploys when the namespace logical id is stable).
+      const name = `roundtrip-${Math.random().toString(36).slice(2, 8)}`;
+      const messages = ["alpha", "beta", "gamma", "delta"];
+
+      for (const text of messages) {
+        // Cloudflare's edge takes a few seconds to start serving a fresh
+        // workers.dev URL — retry until the worker returns 202.
+        const sendResponse = yield* HttpClient.execute(
+          HttpClientRequest.post(
+            `${baseUrl}/send?name=${encodeURIComponent(name)}`,
+          ).pipe(HttpClientRequest.bodyText(text)),
+        ).pipe(
+          Effect.flatMap((res) =>
+            res.status === 202
+              ? Effect.succeed(res)
+              : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+          ),
+          Effect.retry({
+            schedule: Schedule.exponential("500 millis").pipe(
+              Schedule.both(Schedule.recurs(15)),
+            ),
+          }),
+        );
+        expect(sendResponse.status).toBe(202);
+        const sent = (yield* sendResponse.json) as {
+          sent: { name: string; text: string };
+        };
+        expect(sent.sent.name).toBe(name);
+        expect(sent.sent.text).toBe(text);
+      }
+
+      // Poll the DO snapshot until the consumer has caught up. The
+      // exponential schedule + recurs cap gives Cloudflare ~60s to
+      // dispatch and ack — comfortably above the typical 1–5s
+      // dispatch latency we saw in practice without flaking.
+      const snapshot = yield* HttpClient.get(
+        `${baseUrl}/count?name=${encodeURIComponent(name)}`,
+      ).pipe(
+        Effect.flatMap((res) => res.json),
+        Effect.flatMap((body) => {
+          const snap = body as { count: number; lastBodies: string[] };
+          return snap.count >= messages.length
+            ? Effect.succeed(snap)
+            : Effect.fail(
+                new CountMismatch({
+                  expected: messages.length,
+                  actual: snap.count,
+                }),
+              );
+        }),
+        Effect.retry({
+          while: (e): e is CountMismatch => e instanceof CountMismatch,
+          schedule: Schedule.exponential("500 millis").pipe(
+            Schedule.both(Schedule.recurs(40)),
+          ),
+        }),
+      );
+
+      // The DO observed every message. The order is best-effort
+      // (Cloudflare may dispatch batches in parallel) so we
+      // compare as a multiset.
+      expect(snapshot.count).toBeGreaterThanOrEqual(messages.length);
+      expect([...snapshot.lastBodies].sort()).toEqual([...messages].sort());
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+  { timeout: 240_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/consumer-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/consumer-worker.ts
new file mode 100644
index 00000000000..b20fa0919a1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/consumer-worker.ts
@@ -0,0 +1,9 @@
+/// <reference types="@cloudflare/workers-types" />
+
+// Minimal worker fixture used by QueueConsumer.test.ts. The handler
+// bodies are no-ops — the tests assert against the consumer
+// registration, not against message delivery.
+export default {
+  fetch: async () => new Response("ok"),
+  queue: async () => {},
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/round-trip-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/round-trip-worker.ts
new file mode 100644
index 00000000000..e369ba9e84b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/round-trip-worker.ts
@@ -0,0 +1,118 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Per-key counter that the queue handler increments on every
+ * message it processes, and that the test polls back via the
+ * worker's `GET /count?name=...` route. Persists in DO storage so
+ * the count survives DO hibernation.
+ */
+export class Counter extends Cloudflare.DurableObjectNamespace<Counter>()(
+  "Counter",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      let count = (yield* state.storage.get<number>("count")) ?? 0;
+      const lastBodies =
+        (yield* state.storage.get<string[]>("lastBodies")) ?? [];
+      return {
+        record: Effect.fn(function* (body: string) {
+          count += 1;
+          lastBodies.push(body);
+          yield* state.storage.put("count", count);
+          yield* state.storage.put("lastBodies", lastBodies);
+        }),
+        snapshot: () =>
+          Effect.succeed({
+            count,
+            lastBodies,
+          }),
+      };
+    });
+  }),
+) {}
+
+/**
+ * The queue resource the worker produces to and consumes from. The
+ * test deploys this stack, sends N messages via `POST /send?name=K`,
+ * waits for the consumer to push them through to the Counter DO,
+ * and polls `GET /count?name=K` until the count matches.
+ *
+ * `Cloudflare.messages(...).subscribe(...)` (in QueueWorker below)
+ * auto-creates the matching `Cloudflare.QueueConsumer` resource at
+ * deploy time, so this fixture has no separate consumer wiring.
+ */
+export const RoundTripQueue = Cloudflare.Queue("RoundTripQueue");
+
+interface QueueMessageBody {
+  name: string;
+  text: string;
+}
+
+export default class QueueWorker extends Cloudflare.Worker<QueueWorker>()(
+  "QueueRoundTripWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const counters = yield* Counter;
+    const queueResource = yield* RoundTripQueue;
+    const queue = yield* Cloudflare.QueueBinding.bind(queueResource);
+
+    // Effect-style queue consumer. The handler delegates to the
+    // Counter DO so the test can verify the message landed by
+    // polling the DO's snapshot.
+    //
+    // Mixed `Duration.Input` forms are intentional: the e2e test
+    // exercises that a `Duration` value (`maxWaitTime`) and a
+    // string (`retryDelay: "1 second"`) both type-check at the
+    // `Cloudflare.messages(...)` call site and survive the convert-
+    // and-forward path into Cloudflare's QueueConsumer settings.
+    // Values are kept small so the round-trip latency stays well
+    // under the test's 240s timeout.
+    yield* Cloudflare.messages<QueueMessageBody>(queueResource, {
+      batchSize: 10,
+      maxRetries: 3,
+      maxWaitTime: Duration.millis(500),
+      retryDelay: "1 second",
+    }).subscribe((stream) =>
+      Stream.runForEach(stream, (msg) =>
+        counters.getByName(msg.body.name).record(msg.body.text),
+      ),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/send") {
+          const name = url.searchParams.get("name") ?? "default";
+          const text = yield* request.text;
+          yield* queue.send({ name, text }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json(
+            { sent: { name, text } },
+            { status: 202 },
+          );
+        }
+
+        if (request.method === "GET" && url.pathname === "/count") {
+          const name = url.searchParams.get("name") ?? "default";
+          const snapshot = yield* counters.getByName(name).snapshot();
+          return yield* HttpServerResponse.json(snapshot);
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }).pipe(
+    Effect.provide(Cloudflare.QueueBindingLive),
+    Effect.provide(Cloudflare.QueueEventSourceLive),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/toConsumerSettings.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/toConsumerSettings.test.ts
new file mode 100644
index 00000000000..98dae436cdf
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Queue/toConsumerSettings.test.ts
@@ -0,0 +1,58 @@
+import { toConsumerSettings } from "@/Cloudflare/Queue/QueueEventSource.ts";
+import * as Duration from "effect/Duration";
+import { describe, expect, it } from "vitest";
+
+describe("toConsumerSettings", () => {
+  it("passes scalar fields through unchanged", () => {
+    expect(
+      toConsumerSettings({
+        batchSize: 25,
+        maxConcurrency: 4,
+        maxRetries: 3,
+      }),
+    ).toEqual({
+      batchSize: 25,
+      maxConcurrency: 4,
+      maxRetries: 3,
+      maxWaitTimeMs: undefined,
+      retryDelay: undefined,
+    });
+  });
+
+  it("converts maxWaitTime to whole milliseconds", () => {
+    expect(
+      toConsumerSettings({ maxWaitTime: Duration.seconds(5) }).maxWaitTimeMs,
+    ).toBe(5_000);
+    expect(
+      toConsumerSettings({ maxWaitTime: "250 millis" }).maxWaitTimeMs,
+    ).toBe(250);
+    expect(toConsumerSettings({ maxWaitTime: 1500 }).maxWaitTimeMs).toBe(1500);
+  });
+
+  it("rounds sub-millisecond maxWaitTime up", () => {
+    expect(
+      toConsumerSettings({ maxWaitTime: Duration.nanos(1n) }).maxWaitTimeMs,
+    ).toBe(1);
+  });
+
+  it("converts retryDelay to whole seconds", () => {
+    expect(
+      toConsumerSettings({ retryDelay: Duration.minutes(2) }).retryDelay,
+    ).toBe(120);
+    expect(toConsumerSettings({ retryDelay: "30 seconds" }).retryDelay).toBe(
+      30,
+    );
+  });
+
+  it("rounds partial-second retryDelay up", () => {
+    expect(
+      toConsumerSettings({ retryDelay: Duration.millis(1500) }).retryDelay,
+    ).toBe(2);
+  });
+
+  it("leaves missing time fields undefined", () => {
+    const result = toConsumerSettings({ batchSize: 10 });
+    expect(result.maxWaitTimeMs).toBeUndefined();
+    expect(result.retryDelay).toBeUndefined();
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/R2/Bucket.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/R2/Bucket.test.ts
new file mode 100644
index 00000000000..3cb523d71ad
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/R2/Bucket.test.ts
@@ -0,0 +1,334 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as r2 from "@distilled.cloud/cloudflare/r2";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete bucket with default props", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("DefaultBucket");
+      }),
+    );
+
+    expect(bucket.bucketName).toBeDefined();
+    expect(bucket.storageClass).toEqual("Standard");
+    expect(bucket.jurisdiction).toEqual("default");
+
+    const actualBucket = yield* getBucketWhenReady(
+      bucket.bucketName,
+      accountId,
+    );
+    expect(actualBucket.name).toEqual(bucket.bucketName);
+
+    yield* stack.destroy();
+
+    yield* waitForBucketToBeDeleted(bucket.bucketName, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("create, update, delete bucket", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("TestBucket", {
+          name: "test-bucket-initial",
+          storageClass: "Standard",
+        });
+      }),
+    );
+
+    const actualBucket = yield* getBucketWhenReady(
+      bucket.bucketName,
+      accountId,
+    );
+    expect(actualBucket.name).toEqual(bucket.bucketName);
+    expect(actualBucket.storageClass).toEqual("Standard");
+
+    const updatedBucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("TestBucket", {
+          name: "test-bucket-initial",
+          storageClass: "InfrequentAccess",
+        });
+      }),
+    );
+
+    const actualUpdatedBucket = yield* getBucketWhenReady(
+      updatedBucket.bucketName,
+      accountId,
+    );
+    expect(actualUpdatedBucket.name).toEqual(updatedBucket.bucketName);
+    expect(actualUpdatedBucket.storageClass).toEqual("InfrequentAccess");
+
+    yield* stack.destroy();
+
+    yield* waitForBucketToBeDeleted(bucket.bucketName, accountId);
+  }).pipe(logLevel),
+);
+
+// Engine-level adoption: R2 buckets have no ownership signal (Cloudflare
+// doesn't expose tags on R2 buckets), so a name match in `read` is treated
+// as silent adoption.
+test.provider(
+  "existing bucket (matching name) is silently adopted without --adopt",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const bucketName = `alchemy-test-r2-adopt-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+
+      // Phase 1: deploy normally so a real R2 bucket exists.
+      const initial = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.R2Bucket("AdoptableBucket", {
+            name: bucketName,
+          });
+        }),
+      );
+      expect(initial.bucketName).toEqual(bucketName);
+
+      // Phase 2: wipe local state — the bucket stays on Cloudflare.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableBucket",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      // Phase 3: redeploy without `adopt(true)`. The engine calls
+      // `provider.read`, which fetches the bucket by name and returns
+      // plain attrs — silent adoption.
+      const adopted = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.R2Bucket("AdoptableBucket", {
+            name: bucketName,
+          });
+        }),
+      );
+
+      expect(adopted.bucketName).toEqual(bucketName);
+
+      const persisted = yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        return yield* state.get({
+          stack: stack.name,
+          stage: "test",
+          fqn: "AdoptableBucket",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      expect((persisted as any)?.attr).toMatchObject({ bucketName });
+
+      yield* stack.destroy();
+      yield* waitForBucketToBeDeleted(bucketName, accountId);
+    }).pipe(logLevel),
+);
+
+test.provider("destroying a bucket empties its objects first", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("BucketWithObjects");
+      }),
+    );
+
+    const putObject = (key: string, body: string) =>
+      r2.putObject({
+        accountId,
+        bucketName: bucket.bucketName,
+        objectName: key,
+        contentType: "text/plain",
+        body: new Blob([body], { type: "text/plain" }),
+      });
+    yield* putObject("hello.txt", "hello");
+    yield* putObject("nested/world.txt", "world");
+
+    const before = yield* r2
+      .listObjects({
+        accountId,
+        bucketName: bucket.bucketName,
+        perPage: 1000,
+      })
+      .pipe(
+        Effect.flatMap((page) => {
+          const keys = (page.result ?? [])
+            .map((o) => o.key)
+            .filter((k): k is string => typeof k === "string");
+          return keys.length === 2
+            ? Effect.succeed(keys)
+            : Effect.fail(new ListLagError());
+        }),
+        Effect.retry({
+          while: (e): e is ListLagError => e instanceof ListLagError,
+          schedule: Schedule.exponential(200).pipe(
+            Schedule.both(Schedule.recurs(8)),
+          ),
+        }),
+      );
+    expect(before.sort()).toEqual(["hello.txt", "nested/world.txt"]);
+
+    yield* stack.destroy();
+
+    yield* waitForBucketToBeDeleted(bucket.bucketName, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("lifecycle rules are added, updated, and removed", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    // Create with one rule.
+    const initial = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("LifecycleBucket", {
+          lifecycleRules: [
+            {
+              id: "expire-after-30d",
+              deleteObjectsTransition: {
+                condition: { type: "Age", maxAge: 60 * 60 * 24 * 30 },
+              },
+            },
+          ],
+        });
+      }),
+    );
+
+    const initialRules = yield* r2.getBucketLifecycle({
+      accountId,
+      bucketName: initial.bucketName,
+    });
+    expect(initialRules.rules).toHaveLength(1);
+    expect(initialRules.rules?.[0]?.id).toEqual("expire-after-30d");
+    expect(initialRules.rules?.[0]?.enabled).toEqual(true);
+    expect(initialRules.rules?.[0]?.deleteObjectsTransition?.condition).toEqual(
+      { type: "Age", maxAge: 60 * 60 * 24 * 30 },
+    );
+
+    // Update: change the prefix and add a storage class transition.
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("LifecycleBucket", {
+          lifecycleRules: [
+            {
+              id: "expire-after-30d",
+              prefix: "logs/",
+              storageClassTransitions: [
+                {
+                  condition: { type: "Age", maxAge: 60 * 60 * 24 * 7 },
+                  storageClass: "InfrequentAccess",
+                },
+              ],
+              deleteObjectsTransition: {
+                condition: { type: "Age", maxAge: 60 * 60 * 24 * 30 },
+              },
+            },
+          ],
+        });
+      }),
+    );
+
+    const updatedRules = yield* r2.getBucketLifecycle({
+      accountId,
+      bucketName: initial.bucketName,
+    });
+    expect(updatedRules.rules).toHaveLength(1);
+    expect(updatedRules.rules?.[0]?.conditions.prefix).toEqual("logs/");
+    expect(updatedRules.rules?.[0]?.storageClassTransitions).toEqual([
+      {
+        condition: { type: "Age", maxAge: 60 * 60 * 24 * 7 },
+        storageClass: "InfrequentAccess",
+      },
+    ]);
+
+    // Clear all rules.
+    yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("LifecycleBucket", {
+          lifecycleRules: [],
+        });
+      }),
+    );
+
+    const clearedRules = yield* r2.getBucketLifecycle({
+      accountId,
+      bucketName: initial.bucketName,
+    });
+    expect(clearedRules.rules ?? []).toEqual([]);
+
+    yield* stack.destroy();
+    yield* waitForBucketToBeDeleted(initial.bucketName, accountId);
+  }).pipe(logLevel),
+);
+
+// R2 bucket creates are eventually consistent — a read immediately after
+// deploy can briefly return NoSuchBucket until the bucket propagates.
+const getBucketWhenReady = Effect.fn(function* (
+  bucketName: string,
+  accountId: string,
+) {
+  return yield* r2.getBucket({ accountId, bucketName }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "NoSuchBucket",
+      schedule: Schedule.exponential("200 millis").pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
+});
+
+const waitForBucketToBeDeleted = Effect.fn(function* (
+  bucketName: string,
+  accountId: string,
+) {
+  yield* r2
+    .getBucket({
+      accountId,
+      bucketName,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new BucketStillExists())),
+      Effect.retry({
+        while: (e): e is BucketStillExists => e instanceof BucketStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NoSuchBucket", () => Effect.void),
+    );
+});
+
+class BucketStillExists extends Data.TaggedError("BucketStillExists") {}
+
+class ListLagError extends Data.TaggedError("ListLagError") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/R2/CustomDomain.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/R2/CustomDomain.test.ts
new file mode 100644
index 00000000000..6f4c96dfd98
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/R2/CustomDomain.test.ts
@@ -0,0 +1,205 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import * as r2 from "@distilled.cloud/cloudflare/r2";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const zoneName =
+  process.env.CLOUDFLARE_TEST_R2_DOMAIN_ZONE_NAME ?? "alchemy-test-2.us";
+const suffix = process.env.PULL_REQUEST ?? process.env.USER;
+// A custom-domain hostname maps one-to-one to a bucket at the Cloudflare zone
+// level, so it is a *global* resource. These suites run concurrently
+// (`sequence.concurrent`), so every test must claim a hostname no other test
+// uses — otherwise the tests race to attach the same hostname to different
+// buckets and lose with `Conflict: Domain already in use`.
+const domain = zoneName
+  ? `alchemy-r2-test-single-${suffix}.${zoneName}`
+  : undefined;
+const domain2 = zoneName
+  ? `alchemy-r2-test-multi-a-${suffix}.${zoneName}`
+  : undefined;
+const domain3 = zoneName
+  ? `alchemy-r2-test-multi-b-${suffix}.${zoneName}`
+  : undefined;
+
+test.provider("creates, updates, and deletes a bucket custom domain", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const bucket = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("DomainBucket", {
+          domains: [{ name: domain! }],
+        });
+      }),
+    );
+
+    expect(bucket.domains).toHaveLength(1);
+    expect(bucket.domains[0]?.domain).toEqual(domain);
+    expect(bucket.domains[0]?.enabled).toEqual(true);
+
+    const actual = yield* r2.getBucketDomainCustom({
+      accountId,
+      bucketName: bucket.bucketName,
+      domain: domain!,
+      jurisdiction: bucket.jurisdiction,
+    });
+    expect(actual.domain).toEqual(domain);
+
+    const updated = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Cloudflare.R2Bucket("DomainBucket", {
+          domains: [{ name: domain!, enabled: false }],
+        });
+      }),
+    );
+
+    expect(updated.domains[0]?.enabled).toEqual(false);
+
+    yield* stack.destroy();
+
+    const deleted = yield* r2
+      .getBucketDomainCustom({
+        accountId,
+        bucketName: bucket.bucketName,
+        domain: domain!,
+        jurisdiction: bucket.jurisdiction,
+      })
+      .pipe(
+        Effect.map(() => false),
+        Effect.catchTag("DomainNotFound", () => Effect.succeed(true)),
+        Effect.catchTag("NoSuchBucket", () => Effect.succeed(true)),
+      );
+    expect(deleted).toEqual(true);
+
+    yield* waitForBucketToBeDeleted(bucket.bucketName, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider(
+  "creates, updates, and deletes a bucket with multiple custom domains",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const bucket = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.R2Bucket("MultiDomainBucket", {
+            domains: [{ name: domain2! }, { name: domain3! }],
+          });
+        }),
+      );
+
+      expect(bucket.domains).toHaveLength(2);
+      const domainNames = bucket.domains.map((d) => d.domain).sort();
+      expect(domainNames).toEqual([domain2, domain3].sort());
+      expect(bucket.domains.every((d) => d.enabled)).toEqual(true);
+
+      for (const name of [domain2!, domain3!]) {
+        const actual = yield* r2.getBucketDomainCustom({
+          accountId,
+          bucketName: bucket.bucketName,
+          domain: name,
+          jurisdiction: bucket.jurisdiction,
+        });
+        expect(actual.domain).toEqual(name);
+      }
+
+      const updated = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.R2Bucket("MultiDomainBucket", {
+            domains: [{ name: domain3!, enabled: false }, { name: domain2! }],
+          });
+        }),
+      );
+
+      const updatedByName = Object.fromEntries(
+        updated.domains.map((d) => [d.domain, d]),
+      );
+      expect(updatedByName[domain3!]?.enabled).toEqual(false);
+      expect(updatedByName[domain2!]?.enabled).toEqual(true);
+
+      const removed = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.R2Bucket("MultiDomainBucket", {
+            domains: [{ name: domain2! }],
+          });
+        }),
+      );
+
+      expect(removed.domains).toHaveLength(1);
+      expect(removed.domains[0]?.domain).toEqual(domain2);
+
+      const firstRemoved = yield* r2
+        .getBucketDomainCustom({
+          accountId,
+          bucketName: bucket.bucketName,
+          domain: domain3!,
+          jurisdiction: bucket.jurisdiction,
+        })
+        .pipe(
+          Effect.map(() => false),
+          Effect.catchTag("DomainNotFound", () => Effect.succeed(true)),
+        );
+      expect(firstRemoved).toEqual(true);
+
+      yield* stack.destroy();
+
+      for (const name of [domain2!, domain3!]) {
+        const deleted = yield* r2
+          .getBucketDomainCustom({
+            accountId,
+            bucketName: bucket.bucketName,
+            domain: name,
+            jurisdiction: bucket.jurisdiction,
+          })
+          .pipe(
+            Effect.map(() => false),
+            Effect.catchTag("DomainNotFound", () => Effect.succeed(true)),
+            Effect.catchTag("NoSuchBucket", () => Effect.succeed(true)),
+          );
+        expect(deleted).toEqual(true);
+      }
+
+      yield* waitForBucketToBeDeleted(bucket.bucketName, accountId);
+    }).pipe(logLevel),
+);
+
+const waitForBucketToBeDeleted = Effect.fn(function* (
+  bucketName: string,
+  accountId: string,
+) {
+  yield* r2
+    .getBucket({
+      accountId,
+      bucketName,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new BucketStillExists())),
+      Effect.retry({
+        while: (e): e is BucketStillExists => e instanceof BucketStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NoSuchBucket", () => Effect.void),
+    );
+});
+
+class BucketStillExists extends Data.TaggedError("BucketStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/RateLimit.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/RateLimit.test.ts
new file mode 100644
index 00000000000..dc8f0f8db76
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/RateLimit.test.ts
@@ -0,0 +1,93 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// The worker calls `rateLimit.limit({ key })` `n` times inside a single
+// request and returns the per-call `success` flags. Hitting the binding from
+// one isolate makes the throttling deterministic and avoids relying on edge
+// propagation between separate HTTP requests.
+const burst = Effect.fn(function* (url: string, key: string, n: number) {
+  const client = yield* HttpClient.HttpClient;
+  const res = yield* client
+    .get(`${url}/burst?key=${encodeURIComponent(key)}&n=${n}`)
+    .pipe(
+      Effect.flatMap((res) =>
+        res.status === 200
+          ? Effect.succeed(res)
+          : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+      ),
+      Effect.retry({ schedule: Schedule.exponential("500 millis"), times: 15 }),
+    );
+  return (yield* res.json) as { key: string; results: boolean[] };
+});
+
+const freshKey = () => `fresh-${Math.random().toString(36).slice(2)}`;
+
+// Both worker styles bind the same RateLimit shape (`limit: 2`, `period: 10`)
+// and expose the identical `/burst` contract, so they share one behavioral
+// suite parameterized by which deployed URL to hit.
+const behaviorSuite = (label: string, getUrl: () => Effect.Effect<string>) =>
+  describe(label, () => {
+    test(
+      "throttles requests past the configured limit",
+      Effect.gen(function* () {
+        const url = yield* getUrl();
+        expect(url).toBeTypeOf("string");
+
+        // Limit is 2 over a 10s window. Cloudflare's limiter is best-effort
+        // (per-colo, approximate counting), so we don't assert an exact
+        // allowed count — only the observable contract: the first call is
+        // allowed, the burst is eventually throttled, and once the budget is
+        // exhausted later calls stay denied.
+        const n = 10;
+        const { results } = yield* burst(url, freshKey(), n);
+
+        expect(results).toHaveLength(n);
+        expect(results[0]).toBe(true);
+        expect(results.at(-1)).toBe(false);
+        // Some calls were allowed, some denied.
+        const allowed = results.filter(Boolean).length;
+        expect(allowed).toBeGreaterThan(0);
+        expect(allowed).toBeLessThan(n);
+      }).pipe(logLevel),
+      { timeout: 180_000 },
+    );
+
+    test(
+      "tracks each key independently",
+      Effect.gen(function* () {
+        const url = yield* getUrl();
+
+        // A distinct key gets its own fresh budget regardless of how much a
+        // previous key was throttled.
+        const fresh = yield* burst(url, freshKey(), 1);
+        expect(fresh.results).toEqual([true]);
+      }).pipe(logLevel),
+      { timeout: 180_000 },
+    );
+  });
+
+behaviorSuite("async worker (env binding)", () =>
+  stack.pipe(Effect.map((s) => s.asyncUrl)),
+);
+
+behaviorSuite("effect worker (yield* RateLimit)", () =>
+  stack.pipe(Effect.map((s) => s.effectUrl)),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/async.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/async.ts
new file mode 100644
index 00000000000..3bdb765327b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/async.ts
@@ -0,0 +1,34 @@
+import type { AsyncWorkerEnv } from "./stack.ts";
+
+/**
+ * Async (non-Effect) Worker handler that exercises the RateLimit binding
+ * declared via `env: { THROTTLE: Cloudflare.RateLimit(...) }`. `InferEnv` maps
+ * the binding to the native `cf.RateLimit`, so the handler calls
+ * `env.THROTTLE.limit({ key })` directly.
+ *
+ * `/burst` calls the limiter `n` times within a single isolate so the
+ * throttling is deterministic: with `limit: 2` the first two calls for a key
+ * succeed and the rest are denied.
+ */
+export default {
+  fetch: async (request: Request, env: AsyncWorkerEnv) => {
+    const url = new URL(request.url);
+
+    if (url.pathname === "/burst") {
+      const key = url.searchParams.get("key") ?? "default";
+      const n = Number(url.searchParams.get("n") ?? "5");
+
+      const results: boolean[] = [];
+      for (let i = 0; i < n; i++) {
+        const { success } = await env.THROTTLE.limit({ key });
+        results.push(success);
+      }
+
+      return new Response(JSON.stringify({ key, results }), {
+        headers: { "content-type": "application/json" },
+      });
+    }
+
+    return new Response("ok");
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/effect.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/effect.ts
new file mode 100644
index 00000000000..4758760bf96
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/effect.ts
@@ -0,0 +1,54 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Effect-native Worker fixture that exercises the real Cloudflare RateLimit
+ * binding via `RateLimitBindingLive`. Yielding `Cloudflare.RateLimit(...)`
+ * during the Init phase attaches the binding to this Worker and returns the
+ * runtime client in one step — no separate `.bind(...)` call. `/burst` then
+ * calls `throttle.limit({ key })` `n` times against a single isolate.
+ *
+ * Driving the limit inside one request makes throttling deterministic (no
+ * reliance on edge propagation between requests): with `limit: 2` the first
+ * two calls for a key succeed and the rest are denied, while a different key
+ * gets its own independent budget.
+ */
+export default class RateLimitEffectWorker extends Cloudflare.Worker<RateLimitEffectWorker>()(
+  "RateLimitEffectWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const throttle = yield* Cloudflare.RateLimit({
+      name: "THROTTLE",
+      namespaceId: 11_001,
+      simple: { limit: 2, period: 10 },
+    });
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+
+        if (url.pathname === "/burst") {
+          const key = url.searchParams.get("key") ?? "default";
+          const n = Number(url.searchParams.get("n") ?? "5");
+
+          const results: boolean[] = [];
+          for (let i = 0; i < n; i++) {
+            const { success } = yield* throttle
+              .limit({ key })
+              .pipe(Effect.orDie);
+            results.push(success);
+          }
+
+          return yield* HttpServerResponse.json({ key, results });
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.RateLimitBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/stack.ts
new file mode 100644
index 00000000000..54dcab19c5a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/RateLimit/fixtures/stack.ts
@@ -0,0 +1,35 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as path from "pathe";
+import RateLimitEffectWorker from "./effect.ts";
+
+export const AsyncWorker = Cloudflare.Worker("RateLimitAsyncWorker", {
+  main: path.resolve(import.meta.dirname, "async.ts"),
+  url: true,
+  env: {
+    THROTTLE: Cloudflare.RateLimit({
+      name: "THROTTLE",
+      namespaceId: 11_002,
+      simple: { limit: 2, period: 10 },
+    }),
+  },
+});
+
+export type AsyncWorkerEnv = Cloudflare.InferEnv<typeof AsyncWorker>;
+
+export default Alchemy.Stack(
+  "RateLimitTestStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const asyncWorker = yield* AsyncWorker;
+    const effectWorker = yield* RateLimitEffectWorker;
+    return {
+      asyncUrl: asyncWorker.url.as<string>(),
+      effectUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/Secret.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/Secret.test.ts
new file mode 100644
index 00000000000..1a1e01756a5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/Secret.test.ts
@@ -0,0 +1,143 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import type { HttpClientResponse } from "effect/unstable/http/HttpClientResponse";
+import Stack from "./fixtures/stack.ts";
+import {
+  LITERAL_SECRET_VALUE,
+  NUMBER_VAR_VALUE,
+  OBJECT_VAR_VALUE,
+  STRING_VAR_VALUE,
+} from "./fixtures/worker.ts";
+/**
+ * `Config.redacted("CONFIG_SECRET")` resolves against the active
+ * `ConfigProvider` at deploy time. The default provider reads from
+ * `process.env`, so populate it before `beforeAll(deploy(Stack))`
+ * compiles the stack.
+ */
+const CONFIG_SECRET_VALUE = (process.env.CONFIG_SECRET =
+  "sk-from-config-source-xyz");
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+/**
+ * Cloudflare's edge takes a few seconds to start serving a fresh
+ * workers.dev URL — initial requests can return Cloudflare's "There is
+ * nothing here yet" 404 page or a 5xx while the script propagates.
+ * Retry until we get a 2xx (or a 4xx that isn't 404 — those are real
+ * client errors and should fail loud).
+ */
+class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
+  status: number;
+}> {}
+
+const fetchWhenReady = (url: string) =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    return yield* client.get(url).pipe(
+      Effect.flatMap((res: HttpClientResponse) =>
+        res.status === 200
+          ? Effect.succeed(res)
+          : Effect.fail(new WorkerNotReady({ status: res.status })),
+      ),
+      Effect.retry({
+        while: (e): e is WorkerNotReady =>
+          e instanceof WorkerNotReady && (e.status === 404 || e.status >= 500),
+        schedule: Schedule.exponential("500 millis").pipe(
+          Schedule.both(Schedule.recurs(20)),
+        ),
+      }),
+    );
+  });
+
+test(
+  "Config.redacted with literal default round-trips to runtime as Redacted<string>",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    expect(url).toBeTypeOf("string");
+
+    const res = yield* fetchWhenReady(`${url}/secret/literal`);
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as { isRedacted: boolean; value: string };
+    expect(body).toEqual({
+      isRedacted: true,
+      value: LITERAL_SECRET_VALUE,
+    });
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "Config.redacted resolved from env deploys as a secret_text and round-trips",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    const res = yield* fetchWhenReady(`${url}/secret/config`);
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as { isRedacted: boolean; value: string };
+    expect(body).toEqual({
+      isRedacted: true,
+      value: CONFIG_SECRET_VALUE,
+    });
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "Config.string round-trips to runtime as a string",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    const res = yield* fetchWhenReady(`${url}/var/string`);
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as { type: string; value: unknown };
+    expect(body).toEqual({ type: "string", value: STRING_VAR_VALUE });
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "Config.number round-trips to runtime preserving the number type",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    const res = yield* fetchWhenReady(`${url}/var/number`);
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as { type: string; value: unknown };
+    expect(body).toEqual({ type: "number", value: NUMBER_VAR_VALUE });
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
+
+test(
+  "Config.string with object default round-trips to runtime preserving nested shape",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    const res = yield* fetchWhenReady(`${url}/var/object`);
+    expect(res.status).toBe(200);
+
+    const body = (yield* res.json) as { type: string; value: unknown };
+    expect(body).toEqual({ type: "object", value: OBJECT_VAR_VALUE });
+  }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/fixtures/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/fixtures/stack.ts
new file mode 100644
index 00000000000..a1d6f43cd05
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/fixtures/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import SecretsTestWorker from "./worker.ts";
+
+export default Alchemy.Stack(
+  "AlchemySecretWorkerStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* SecretsTestWorker;
+    return {
+      url: worker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/fixtures/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/fixtures/worker.ts
new file mode 100644
index 00000000000..83de5167931
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Secret/fixtures/worker.ts
@@ -0,0 +1,101 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Hard-coded values the integ test asserts against to prove the
+ * deploy-time bindings flow all the way through to the runtime.
+ */
+export const LITERAL_SECRET_VALUE = "sk-literal-secret-abc";
+export const STRING_VAR_VALUE = "plain-string-value";
+export const NUMBER_VAR_VALUE = 4242;
+export const OBJECT_VAR_VALUE = { host: "localhost", flags: { beta: true } };
+
+/**
+ * Name of the deploy-time `process.env` variable the test populates
+ * before deploying — sourced via `Config.string(...)` inside the
+ * worker's init phase.
+ */
+
+export default class SecretsTestWorker extends Cloudflare.Worker<SecretsTestWorker>()(
+  "SecretsTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+  },
+  Effect.gen(function* () {
+    // Secret from a literal — `Alchemy.Secret` coerces the literal to
+    // `Redacted` and the Worker provider deploys it as `secret_text`.
+    const literalSecret = yield* Config.redacted("LITERAL_SECRET").pipe(
+      Config.withDefault(Redacted.make(LITERAL_SECRET_VALUE)),
+    );
+
+    // Secret from a `Config` — resolved against the active
+    // `ConfigProvider` (process.env) at deploy time.
+    const configSecret = yield* Config.redacted("CONFIG_SECRET");
+
+    // Plain string variable — `plain_text` binding round-trip.
+    const stringVar = yield* Config.string("STRING_VAR").pipe(
+      Config.withDefault(STRING_VAR_VALUE),
+    );
+
+    // Number variable — non-string values JSON.stringify on `set` and
+    // JSON.parse on the runtime accessor, so the accessor returns the
+    // original number.
+    const numberVar = yield* Config.number("NUMBER_VAR").pipe(
+      Config.withDefault(NUMBER_VAR_VALUE),
+    );
+
+    // Object variable — same JSON round-trip as above for nested data.
+    const objectVar = yield* Config.string("OBJECT_VAR").pipe(
+      Config.withDefault(OBJECT_VAR_VALUE),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        // `request.url` on Cloudflare workers is the pathname+query
+        // (relative). Use `originalUrl` to get the absolute URL so
+        // `new URL(...)` doesn't throw.
+        const pathname = new URL(request.originalUrl).pathname;
+        switch (pathname) {
+          case "/secret/literal": {
+            return yield* HttpServerResponse.json({
+              isRedacted: Redacted.isRedacted(literalSecret),
+              value: Redacted.value(literalSecret),
+            });
+          }
+          case "/secret/config": {
+            return yield* HttpServerResponse.json({
+              isRedacted: Redacted.isRedacted(configSecret),
+              value: Redacted.value(configSecret),
+            });
+          }
+          case "/var/string": {
+            return yield* HttpServerResponse.json({
+              type: typeof stringVar,
+              value: stringVar,
+            });
+          }
+          case "/var/number": {
+            return yield* HttpServerResponse.json({
+              type: typeof numberVar,
+              value: numberVar,
+            });
+          }
+          case "/var/object": {
+            return yield* HttpServerResponse.json({
+              type: typeof objectVar,
+              value: objectVar,
+            });
+          }
+          default:
+            return HttpServerResponse.text("ok");
+        }
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/SecretsStore/SecretsStore.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/SecretsStore/SecretsStore.test.ts
new file mode 100644
index 00000000000..99f914feccd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/SecretsStore/SecretsStore.test.ts
@@ -0,0 +1,139 @@
+import {
+  Credentials,
+  apiTokenCredentials,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as secretsStore from "@distilled.cloud/cloudflare/secrets-store";
+import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+
+/**
+ * Test harness that captures the outbound `HttpClientRequest` and lets
+ * the caller plug in a canned `Response`. The motivating regression
+ * (Cloudflare's `secrets_store/stores` POST receiving an array body
+ * and rejecting it with `invalid_json_body`) was invisible to the type
+ * system because the upstream SDK schema modeled the body as
+ * `{ name }[]`. The fix is to upgrade `@distilled.cloud/cloudflare` to
+ * a release with the corrected single-object schema; these tests pin
+ * the wire format so a future SDK regression is caught immediately.
+ */
+interface Captured {
+  url: string;
+  method: string;
+  contentType: string | undefined;
+  bodyJson: unknown;
+  authorization: string | undefined;
+}
+
+const harness = (response: Response) => {
+  let captured: Captured | undefined;
+  const client = HttpClient.make((request) =>
+    Effect.sync(() => {
+      const body = request.body as HttpBody.HttpBody;
+      const bodyText =
+        body._tag === "Uint8Array" ? new TextDecoder().decode(body.body) : "";
+      captured = {
+        url: request.url,
+        method: request.method,
+        contentType: body._tag === "Uint8Array" ? body.contentType : undefined,
+        bodyJson: bodyText ? JSON.parse(bodyText) : undefined,
+        authorization: request.headers.authorization,
+      };
+      return HttpClientResponse.fromWeb(request, response);
+    }),
+  );
+  const layer = Layer.mergeAll(
+    Layer.succeed(HttpClient.HttpClient, client),
+    Layer.succeed(
+      Credentials,
+      Effect.succeed(apiTokenCredentials({ apiToken: "test-token" })),
+    ),
+  );
+  return { layer, get: () => captured! };
+};
+
+const successResponse = () =>
+  new Response(
+    JSON.stringify({
+      success: true,
+      errors: [],
+      messages: [],
+      result: {
+        id: "store-id-123",
+        name: "default_secrets_store",
+        created: "2026-01-01T00:00:00Z",
+        modified: "2026-01-01T00:00:00Z",
+      },
+    }),
+    { status: 200, headers: { "content-type": "application/json" } },
+  );
+
+const errorResponse = (
+  status: number,
+  errors: Array<{ code: number; message: string }>,
+) =>
+  new Response(
+    JSON.stringify({ success: false, errors, messages: [], result: null }),
+    { status, headers: { "content-type": "application/json" } },
+  );
+
+it.live(
+  "createStore POSTs a single JSON object body (regression: invalid_json_body)",
+  () =>
+    Effect.gen(function* () {
+      const { layer, get } = harness(successResponse());
+
+      const result = yield* Effect.gen(function* () {
+        const create = yield* secretsStore.createStore;
+        return yield* create({
+          accountId: "acct-abc",
+          name: "default_secrets_store",
+        });
+      }).pipe(Effect.provide(layer));
+
+      expect(result.id).toBe("store-id-123");
+      expect(result.name).toBe("default_secrets_store");
+
+      const sent = get();
+      expect(sent.method).toBe("POST");
+      expect(sent.url).toBe(
+        "https://api.cloudflare.com/client/v4/accounts/acct-abc/secrets_store/stores",
+      );
+      expect(sent.contentType).toMatch(/application\/json/);
+      expect(sent.authorization).toBe("Bearer test-token");
+
+      // Cloudflare's REST API expects `{"name": "..."}` and rejects
+      // `[{"name": "..."}]` with code 1001 `invalid_json_body`.
+      // Earlier `@distilled.cloud/cloudflare` releases sent the array
+      // shape; this test pins the corrected single-object body.
+      expect(sent.bodyJson).toEqual({ name: "default_secrets_store" });
+      expect(Array.isArray(sent.bodyJson)).toBe(false);
+    }),
+);
+
+it.live(
+  "createStore surfaces MaximumStoresExceeded as a tagged error so callers can catchTag it",
+  () =>
+    Effect.gen(function* () {
+      const { layer } = harness(
+        errorResponse(409, [
+          { code: 1003, message: "maximum_stores_exceeded" },
+        ]),
+      );
+
+      const result = yield* Effect.gen(function* () {
+        const create = yield* secretsStore.createStore;
+        return yield* create({ accountId: "acct-abc", name: "x" }).pipe(
+          Effect.catchTag("MaximumStoresExceeded", (e) => Effect.succeed(e)),
+        );
+      }).pipe(Effect.provide(layer));
+
+      expect(result).toBeInstanceOf(secretsStore.MaximumStoresExceeded);
+      const err = result as secretsStore.MaximumStoresExceeded;
+      expect(err._tag).toBe("MaximumStoresExceeded");
+      expect(err.message).toBe("maximum_stores_exceeded");
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/StateStore/State.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/StateStore/State.test.ts
new file mode 100644
index 00000000000..d28b35f2a7c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/StateStore/State.test.ts
@@ -0,0 +1,409 @@
+import * as Cloudflare from "@/Cloudflare";
+import { STATE_STORE_VERSION } from "@/Cloudflare/StateStore/Api.ts";
+import { State } from "@/State/State.ts";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+/**
+ * Live-API tests for the deployed Cloudflare State Store at
+ * `alchemy-state-store`. The State service is wired up via
+ * `Cloudflare.state()` so each test body just `yield* State` and
+ * exercises the typed interface — same code path users hit in
+ * production.
+ *
+ * Tests share a single (stack, stage) pair so they can be reasoned
+ * about as a sequence: the first test wipes the namespace, the
+ * remainder build state up and tear it down.
+ */
+
+const STACK = "alchemy_tests";
+const STAGE = "alchemy_tests";
+
+const { test } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const sampleState = (fqn: string, instanceId: string) => ({
+  kind: "resource" as const,
+  resourceType: "Test.Resource",
+  namespace: undefined,
+  fqn,
+  logicalId: fqn.split("/").pop()!,
+  instanceId,
+  providerVersion: 1,
+  status: "created" as const,
+  downstream: [],
+  bindings: [],
+  props: { hello: "world" },
+  attr: { id: instanceId },
+});
+
+const replacedState = (fqn: string) => ({
+  kind: "resource" as const,
+  resourceType: "Test.Resource",
+  namespace: undefined,
+  fqn,
+  logicalId: fqn.split("/").pop()!,
+  instanceId: "replaced-new",
+  providerVersion: 1,
+  status: "replaced" as const,
+  downstream: [],
+  bindings: [],
+  deleteFirst: false,
+  props: { hello: "world-new" },
+  attr: { id: "replaced-new" },
+  old: {
+    kind: "resource",
+    resourceType: "Test.Resource",
+    namespace: undefined,
+    fqn,
+    logicalId: fqn.split("/").pop()!,
+    instanceId: "replaced-old",
+    providerVersion: 1,
+    status: "created",
+    downstream: [],
+    bindings: [],
+    props: { hello: "world-old" },
+    attr: { id: "replaced-old" },
+  },
+});
+
+test(
+  "getVersion returns the current STATE_STORE_VERSION",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const version = yield* store.getVersion();
+    expect(version).toBe(STATE_STORE_VERSION);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "DELETE /state/stacks/:stack wipes the test namespace (cleanup)",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    yield* store.deleteStack({ stack: STACK });
+    const fqns = yield* store.list({ stack: STACK, stage: STAGE });
+    expect(fqns).toEqual([]);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "PUT /resources/:fqn (setState) persists a resource",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const fqn = "stack/scope/resource-a";
+    const value = sampleState(fqn, "inst-a");
+    const echoed = yield* store.set({
+      stack: STACK,
+      stage: STAGE,
+      fqn,
+      value,
+    });
+    expect(echoed.fqn).toBe(fqn);
+    expect(echoed.instanceId).toBe("inst-a");
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /resources/:fqn (getState) reads back the persisted value",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const fqn = "stack/scope/resource-a";
+    const got = yield* store.get({ stack: STACK, stage: STAGE, fqn });
+    expect(got).toBeDefined();
+    expect(got!.fqn).toBe(fqn);
+    expect((got as any).props).toEqual({ hello: "world" });
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /resources/:fqn returns undefined for a missing fqn",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const got = yield* store.get({
+      stack: STACK,
+      stage: STAGE,
+      fqn: "stack/scope/does-not-exist",
+    });
+    expect(got).toBeUndefined();
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /resources (listResources) returns the FQNs in the stage",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const fqnB = "stack/scope/resource-b";
+    yield* store.set({
+      stack: STACK,
+      stage: STAGE,
+      fqn: fqnB,
+      value: sampleState(fqnB, "inst-b"),
+    });
+    const fqns = yield* store.list({ stack: STACK, stage: STAGE });
+    expect([...fqns].sort()).toEqual([
+      "stack/scope/resource-a",
+      "stack/scope/resource-b",
+    ]);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /stacks (listStacks) includes the registered test stack",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const stacks = yield* store.listStacks();
+    expect(stacks).toContain(STACK);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /stacks/:stack/stages (listStages) includes the test stage",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const stages = yield* store.listStages(STACK);
+    expect([...stages]).toContain(STAGE);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "PUT /output (setStackOutput) persists a stack output",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const out = yield* store.setOutput({
+      stack: STACK,
+      stage: STAGE,
+      value: { url: "https://example.com", count: 42 },
+    });
+    expect(out).toEqual({ url: "https://example.com", count: 42 });
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /output (getStackOutput) reads back the persisted output",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const out = yield* store.getOutput({ stack: STACK, stage: STAGE });
+    expect(out).toEqual({ url: "https://example.com", count: 42 });
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /output returns undefined for an un-deployed stage",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const out = yield* store.getOutput({
+      stack: STACK,
+      stage: "never-deployed",
+    });
+    expect(out).toBeUndefined();
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "GET /replaced-resources (getReplacedResources) returns status===replaced rows",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const fqn = "stack/scope/resource-replaced";
+    yield* store.set({
+      stack: STACK,
+      stage: STAGE,
+      fqn,
+      value: replacedState(fqn) as any,
+    });
+    const replaced = yield* store.getReplacedResources({
+      stack: STACK,
+      stage: STAGE,
+    });
+    const fqns = replaced.map((r) => (r as any).fqn);
+    expect(fqns).toContain(fqn);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "DELETE /resources/:fqn (deleteState) removes a single resource",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const fqn = "stack/scope/resource-a";
+    yield* store.delete({ stack: STACK, stage: STAGE, fqn });
+    const got = yield* store.get({ stack: STACK, stage: STAGE, fqn });
+    expect(got).toBeUndefined();
+    const fqns = yield* store.list({ stack: STACK, stage: STAGE });
+    expect([...fqns]).not.toContain(fqn);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "DELETE /stacks/:stack?stage=... clears one stage but leaves the stack registered",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    yield* store.deleteStack({ stack: STACK, stage: STAGE });
+    const fqns = yield* store.list({ stack: STACK, stage: STAGE });
+    expect(fqns).toEqual([]);
+    const out = yield* store.getOutput({ stack: STACK, stage: STAGE });
+    expect(out).toBeUndefined();
+    // Per Api.ts: stage-scoped deletes do NOT unregister the stack.
+    const stacks = yield* store.listStacks();
+    expect(stacks).toContain(STACK);
+  }),
+  { timeout: 60_000 },
+);
+
+test(
+  "DELETE /stacks/:stack (no stage) removes the stack from listStacks",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    yield* store.deleteStack({ stack: STACK });
+    const stacks = yield* store.listStacks();
+    expect(stacks).not.toContain(STACK);
+  }),
+  { timeout: 60_000 },
+);
+
+/**
+ * Stress test for transient `setState` failures (the reported 415 / etc.
+ * symptoms). 100 sequential PUTs against the same `(stack, stage, fqn)`
+ * — if the worker is racy under repeated writes (cold-start layer
+ * memoization, edge propagation, intermediary content-type munging)
+ * one of these calls should surface it.
+ */
+test(
+  "setState 100x sequential — surfaces transient failures",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const stack = STACK;
+    const stage = `${STAGE}-stress-seq`;
+    const fqn = "stack/scope/stress-seq";
+
+    yield* store.deleteStack({ stack, stage });
+
+    yield* Effect.forEach(
+      Array.from({ length: 100 }, (_, i) => i),
+      (i) =>
+        store
+          .set({
+            stack,
+            stage,
+            fqn,
+            value: sampleState(fqn, `inst-${i}`),
+          })
+          .pipe(Effect.asVoid),
+      { discard: true },
+    );
+
+    const got = yield* store.get({ stack, stage, fqn });
+    expect(got).toBeDefined();
+    expect((got as any).instanceId).toBe("inst-99");
+
+    yield* store.deleteStack({ stack, stage });
+  }),
+  { timeout: 300_000 },
+);
+
+/**
+ * Same shape as the sequential stress test, but fires all 100 PUTs
+ * concurrently. Designed to catch races inside the Durable Object
+ * (`Store.getByName(stack)`) and the HttpApiBuilder layer
+ * initialization that wouldn't show up serially.
+ */
+test(
+  "setState 100x concurrent — surfaces racy transient failures",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const stack = STACK;
+    const stage = `${STAGE}-stress-par`;
+
+    yield* store.deleteStack({ stack, stage });
+
+    yield* Effect.forEach(
+      Array.from({ length: 100 }, (_, i) => i),
+      (i) => {
+        const fqn = `stack/scope/stress-par-${i}`;
+        return store
+          .set({
+            stack,
+            stage,
+            fqn,
+            value: sampleState(fqn, `inst-${i}`),
+          })
+          .pipe(Effect.asVoid);
+      },
+      { concurrency: "unbounded", discard: true },
+    );
+
+    const fqns = yield* store.list({ stack, stage });
+    expect(fqns.length).toBe(100);
+
+    yield* store.deleteStack({ stack, stage });
+  }),
+  { timeout: 300_000 },
+);
+
+/**
+ * Engine-shape traffic pattern: for each resource, the apply loop reads
+ * the previous state (`GET /resources/:fqn`) and then writes the new
+ * state (`PUT /resources/:fqn`). When the engine deploys many
+ * resources in parallel, the worker sees interleaved GET+PUT pairs
+ * sharing the same connection / isolate.
+ *
+ * The 30×5 shape (30 sequential batches, 5 GET+PUT pairs in flight per
+ * batch) reproduces a transient 415 the engine surfaces under that
+ * pattern. The test fails on the first non-2xx so any regression of
+ * the underlying issue is caught immediately.
+ */
+test(
+  "GET+PUT interleaved 30x5 — engine traffic pattern",
+  Effect.gen(function* () {
+    const store = yield* yield* State;
+    const stack = STACK;
+    const stage = `${STAGE}-interleaved`;
+
+    yield* store.deleteStack({ stack, stage });
+
+    yield* Effect.forEach(
+      Array.from({ length: 30 }, (_, b) => b),
+      (b) =>
+        Effect.forEach(
+          Array.from({ length: 5 }, (_, i) => `M${b}_${i}`),
+          (fqn) =>
+            Effect.all(
+              [
+                store.get({ stack, stage, fqn }).pipe(Effect.asVoid),
+                store
+                  .set({
+                    stack,
+                    stage,
+                    fqn,
+                    value: sampleState(fqn, `inst-${fqn}`),
+                  })
+                  .pipe(Effect.asVoid),
+              ],
+              { concurrency: "unbounded", discard: true },
+            ),
+          { concurrency: "unbounded", discard: true },
+        ),
+      { discard: true },
+    );
+
+    const fqns = yield* store.list({ stack, stage });
+    expect(fqns.length).toBe(30 * 5);
+
+    yield* store.deleteStack({ stack, stage });
+  }),
+  { timeout: 300_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/Tunnel.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/Tunnel.test.ts
new file mode 100644
index 00000000000..1c3b044f86e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/Tunnel.test.ts
@@ -0,0 +1,89 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// Hit a worker route, retrying through fresh-worker edge propagation, and
+// decode the JSON body.
+const hit = Effect.fn(function* (path: string) {
+  const client = yield* HttpClient.HttpClient;
+  const res = yield* client.get(path).pipe(
+    Effect.flatMap((res) =>
+      res.status === 200
+        ? Effect.succeed(res)
+        : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+    ),
+    Effect.retry({ schedule: Schedule.exponential("500 millis"), times: 15 }),
+  );
+  return yield* res.json;
+});
+
+const freshName = () =>
+  `alchemy-tunnel-test-${Math.random().toString(36).slice(2, 10)}`;
+
+describe("Tunnel runtime bindings", () => {
+  test(
+    "TunnelRead lists tunnels with a read-scoped token",
+    Effect.gen(function* () {
+      const { effectUrl } = yield* stack;
+      const body = (yield* hit(`${effectUrl}/read`)) as { count: number };
+      expect(body.count).toBeTypeOf("number");
+    }).pipe(logLevel),
+    { timeout: 180_000 },
+  );
+
+  test(
+    "TunnelWrite creates and deletes a tunnel with a write-scoped token",
+    Effect.gen(function* () {
+      const { effectUrl } = yield* stack;
+      const body = (yield* hit(
+        `${effectUrl}/write?name=${encodeURIComponent(freshName())}`,
+      )) as { id: string; deleted: boolean };
+      expect(body.id).toBeTypeOf("string");
+      expect(body.id.length).toBeGreaterThan(0);
+      expect(body.deleted).toBe(true);
+    }).pipe(logLevel),
+    { timeout: 180_000 },
+  );
+
+  test(
+    "TunnelReadWrite drives the full CRUD surface",
+    Effect.gen(function* () {
+      const { effectUrl } = yield* stack;
+      const name = freshName();
+      const body = (yield* hit(
+        `${effectUrl}/readwrite?name=${encodeURIComponent(name)}`,
+      )) as {
+        id: string;
+        getName: string;
+        count: number;
+        updatedName: string;
+        hasToken: boolean;
+        deleted: boolean;
+      };
+      expect(body.id.length).toBeGreaterThan(0);
+      expect(body.getName).toBe(name);
+      expect(body.count).toBeGreaterThan(0);
+      expect(body.updatedName).toBe(`${name}-renamed`);
+      expect(body.hasToken).toBe(true);
+      expect(body.deleted).toBe(true);
+    }).pipe(logLevel),
+    { timeout: 180_000 },
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/fixtures/effect.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/fixtures/effect.ts
new file mode 100644
index 00000000000..09e40ba26dd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/fixtures/effect.ts
@@ -0,0 +1,91 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Effect-native Worker fixture that exercises all three Cloudflare tunnel
+ * runtime bindings from a single Worker:
+ *
+ * - {@link Cloudflare.TunnelRead} — read-only (`/read`)
+ * - {@link Cloudflare.TunnelWrite} — mutating (`/write`)
+ * - {@link Cloudflare.TunnelReadWrite} — full CRUD (`/readwrite`)
+ *
+ * Each binding provisions its own least-privilege {@link Cloudflare.AccountApiToken}
+ * (binding the token's outputs into the Worker) and the routes below run a
+ * self-contained scenario per binding so the test can assert one behavior each.
+ */
+export default class TunnelEffectWorker extends Cloudflare.Worker<TunnelEffectWorker>()(
+  "TunnelEffectWorker",
+  {
+    main: import.meta.filename,
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const read = yield* Cloudflare.TunnelRead.bind();
+    const write = yield* Cloudflare.TunnelWrite.bind();
+    const tunnels = yield* Cloudflare.TunnelReadWrite.bind();
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.originalUrl);
+        const name = url.searchParams.get("name") ?? "alchemy-tunnel";
+
+        // Read-only: prove the read token works by listing tunnels.
+        if (url.pathname === "/read") {
+          const list = yield* read
+            .list({ isDeleted: false })
+            .pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ count: list.result?.length });
+        }
+
+        // Write: create then delete with the write-scoped token.
+        if (url.pathname === "/write") {
+          const tunnel = yield* write
+            .create({ name, configSrc: "cloudflare" })
+            .pipe(Effect.orDie);
+          yield* write.delete(tunnel.id!).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({
+            id: tunnel.id,
+            deleted: true,
+          });
+        }
+
+        // Read + write: drive the full CRUD surface end to end.
+        if (url.pathname === "/readwrite") {
+          const created = yield* tunnels
+            .create({ name, configSrc: "cloudflare" })
+            .pipe(Effect.orDie);
+          const id = created.id!;
+          const got = yield* tunnels.get(id).pipe(Effect.orDie);
+          const list = yield* tunnels.list().pipe(Effect.orDie);
+          const updated = yield* tunnels
+            .update(id, { name: `${name}-renamed` })
+            .pipe(Effect.orDie);
+          const token = yield* tunnels.getToken(id).pipe(Effect.orDie);
+          yield* tunnels.delete(id).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({
+            id,
+            getName: got.name,
+            count: list.result?.length,
+            updatedName: updated.name,
+            hasToken: token.length > 0,
+            deleted: true,
+          });
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        Cloudflare.TunnelReadLive,
+        Cloudflare.TunnelWriteLive,
+        Cloudflare.TunnelReadWriteLive,
+      ),
+    ),
+  ),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/fixtures/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/fixtures/stack.ts
new file mode 100644
index 00000000000..159395ed0a3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Tunnel/fixtures/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import TunnelEffectWorker from "./effect.ts";
+
+export default Alchemy.Stack(
+  "TunnelsTestStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const effectWorker = yield* TunnelEffectWorker;
+    return {
+      effectUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Fixture.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Fixture.ts
new file mode 100644
index 00000000000..972f0fa1280
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Fixture.ts
@@ -0,0 +1,71 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+/**
+ * Recursively copy `sourceDir` into a fresh `fs.makeTempDirectory`
+ * (with `prefix`), preserving file modes. Returns the absolute path of
+ * the new temp directory.
+ *
+ * Used by tests that want to mutate a fixture's `src/` files without
+ * polluting the source-controlled fixture or racing with other tests
+ * sharing the same fixture path.
+ *
+ * - `tempRoot`, when provided, places the temp dir under a specific
+ *   parent directory instead of the OS temp root. This matters for
+ *   Vite tests because Vite's `vite:build-html` plugin can't express
+ *   project roots that sit outside the current working directory; an
+ *   under-workspace temp dir keeps the relative path representable.
+ * - `entries`, when provided, restricts the copy to a specific subset
+ *   of top-level entries. Defaults to copying everything in
+ *   `sourceDir`.
+ */
+export const cloneFixture = Effect.fnUntraced(function* (
+  sourceDir: string,
+  options: {
+    prefix: string;
+    tempRoot?: string;
+    entries?: string[];
+  },
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+
+  if (options.tempRoot) {
+    yield* fs.makeDirectory(options.tempRoot, { recursive: true });
+  }
+  const dir = yield* fs.makeTempDirectory({
+    prefix: options.prefix,
+    directory: options.tempRoot,
+  });
+
+  const entries = options.entries ?? (yield* fs.readDirectory(sourceDir));
+
+  const copyTree = (relativePath: string): Effect.Effect<void, any, any> =>
+    Effect.gen(function* () {
+      const from = path.join(sourceDir, relativePath);
+      const to = path.join(dir, relativePath);
+      const stat = yield* fs.stat(from);
+      if (stat.type === "Directory") {
+        yield* fs.makeDirectory(to, { recursive: true });
+        const children = yield* fs.readDirectory(from);
+        for (const child of children) {
+          yield* copyTree(path.join(relativePath, child));
+        }
+      } else {
+        const contents = yield* fs.readFile(from);
+        yield* fs.writeFile(to, contents);
+        // Preserve executable bit so copied build scripts still run.
+        const mode = Number(stat.mode);
+        if (mode & 0o111) {
+          yield* fs.chmod(to, mode);
+        }
+      }
+    });
+
+  for (const entry of entries) {
+    yield* copyTree(entry);
+  }
+
+  return dir;
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Http.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Http.ts
new file mode 100644
index 00000000000..a347b734415
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Http.ts
@@ -0,0 +1,141 @@
+import * as Data from "effect/Data";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * HTTP assertion helpers tuned for Cloudflare's "deploy → propagate →
+ * serve" pipeline.
+ *
+ * Newly-deployed workers.dev URLs commonly:
+ *  - Return Cloudflare's "There is nothing here yet" placeholder page
+ *    while the workers.dev subdomain is enabling for the first time.
+ *  - Serve a stale cached body for a few seconds after the version flip.
+ *  - Briefly 522 / 530 while the edge fetches the new version.
+ *
+ * The helpers here retry through all of those failure modes with an
+ * exponential backoff capped by an explicit total `timeout`, while
+ * still surfacing a precise, actionable error if the budget is
+ * exhausted.
+ */
+
+export class HttpAssertionFailed extends Data.TaggedError(
+  "HttpAssertionFailed",
+)<{
+  url: string;
+  marker: string;
+  status: number;
+  bodyExcerpt: string;
+}> {}
+
+export class HttpFetchFailed extends Data.TaggedError("HttpFetchFailed")<{
+  url: string;
+  message: string;
+}> {}
+
+export interface ExpectUrlContainsOptions {
+  /** Maximum total time to retry before failing. Default 90s. */
+  timeout?: Duration.Input;
+  /** Initial backoff between attempts. Default 750ms. */
+  initialBackoff?: Duration.Input;
+  /** Description used in error messages. */
+  label?: string;
+}
+
+const looksLikeCloudflarePlaceholder = (body: string) =>
+  // Cloudflare's "no worker / not propagated" landing page.
+  body.includes("There is nothing here yet") ||
+  // The blue 522 / 1xxx error page family.
+  /Error\s+\d{3,4}/i.test(body);
+
+const fetchOnce = (url: string, marker: string) =>
+  Effect.tryPromise({
+    try: async (signal) => {
+      // Cache-busting query string defeats both edge caches and any
+      // intermediate proxy that ignores `cache-control: no-cache`.
+      const u = new URL(url);
+      u.searchParams.set("__alchemy_cb", String(Date.now()));
+      const res = await fetch(u, {
+        signal,
+        cache: "no-store",
+        headers: {
+          "cache-control": "no-cache",
+          pragma: "no-cache",
+          accept: "*/*",
+        },
+      });
+      const body = await res.text();
+      if (
+        !res.ok ||
+        looksLikeCloudflarePlaceholder(body) ||
+        !body.includes(marker)
+      ) {
+        throw new HttpAssertionFailed({
+          url,
+          marker,
+          status: res.status,
+          bodyExcerpt: body.slice(0, 240),
+        });
+      }
+      return body;
+    },
+    catch: (e) =>
+      e instanceof HttpAssertionFailed
+        ? e
+        : new HttpFetchFailed({
+            url,
+            message: e instanceof Error ? e.message : String(e),
+          }),
+  });
+
+/**
+ * Fetch `url` and assert the response body contains `marker`. Retries
+ * the fetch on transient failures (network errors, 5xx, Cloudflare
+ * placeholders, missing marker) until the marker appears or the
+ * `timeout` elapses. Each attempt uses a fresh cache-busting query
+ * param and `cache: "no-store"` so we don't sit on a CDN-cached body.
+ *
+ * The hash assertions in the deploy tests prove the *intent* to
+ * publish; this helper proves the assets actually serve over HTTP.
+ */
+export const expectUrlContains = (
+  url: string,
+  marker: string,
+  options: ExpectUrlContainsOptions = {},
+) => {
+  const totalTimeout = Duration.fromInputUnsafe(
+    options.timeout ?? "90 seconds",
+  );
+  const initial = options.initialBackoff ?? "750 millis";
+  const label = options.label ?? "url";
+
+  return fetchOnce(url, marker).pipe(
+    Effect.retry({
+      // Cap individual sleeps at 8s so very long timeouts still
+      // sample at a reasonable rate near the end of the budget.
+      schedule: Schedule.exponential(initial, 1.5).pipe(
+        Schedule.either(Schedule.spaced("8 seconds")),
+      ),
+    }),
+    // Bound the *total* retry budget. `Effect.retry` on its own would
+    // back off forever; the timeout guarantees the test fails loudly
+    // instead of stalling out the suite. We swap the default
+    // `TimeoutException` for a typed assertion error so the failure
+    // message says *what* we were waiting for, not just "timed out".
+    Effect.timeoutOrElse({
+      duration: totalTimeout,
+      orElse: () =>
+        Effect.fail(
+          new HttpAssertionFailed({
+            url,
+            marker,
+            status: 0,
+            bodyExcerpt: `[timed out after ${Duration.toMillis(totalTimeout)}ms waiting for marker "${marker}"]`,
+          }),
+        ),
+    }),
+    Effect.tapError((error) =>
+      Effect.logError(`expectUrlContains(${label}) failed`, error),
+    ),
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Worker.ts
new file mode 100644
index 00000000000..52eb641532f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Utils/Worker.ts
@@ -0,0 +1,142 @@
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * Test helpers for asserting against Cloudflare Worker state via the
+ * official workers SDK. These wrap the common "exists / get tags / wait
+ * for delete" patterns used across `Worker.test.ts` and the website
+ * tests so callers don't reimplement the retry plumbing each time.
+ */
+
+class WorkerStillExists extends Data.TaggedError("WorkerStillExists") {}
+
+/**
+ * Poll Cloudflare's `getScriptSubdomain` until it reports `expected`,
+ * then assert. Cloudflare's subdomain toggle is eventually consistent
+ * with respect to a freshly-completed `putScript` /
+ * `createScriptSubdomain` call, so a same-tick read may still return
+ * the previous value for a second or two. Retries indefinitely with a
+ * fixed cadence; the surrounding test's own timeout bounds the wait.
+ */
+export const expectWorkersDevSubdomain = Effect.fn(function* (
+  workerName: string,
+  accountId: string,
+  expected: boolean,
+) {
+  const final = yield* workers
+    .getScriptSubdomain({ accountId, scriptName: workerName })
+    .pipe(
+      Effect.flatMap((s) =>
+        s.enabled === expected
+          ? Effect.succeed(s)
+          : Effect.fail(
+              `subdomain not yet ${expected ? "enabled" : "disabled"}`,
+            ),
+      ),
+      Effect.tapError(Effect.logInfo),
+      Effect.retry({ schedule: Schedule.spaced("500 millis") }),
+    );
+  expect(final.enabled).toBe(expected);
+});
+
+/**
+ * Poll Cloudflare's `getScriptSubdomain` until both `enabled` and
+ * `previewsEnabled` match the expected values, then assert. Like
+ * `expectWorkersDevSubdomain`, the subdomain toggle is eventually
+ * consistent with respect to a freshly-completed `putScript` /
+ * `createScriptSubdomain` call, so a same-tick read may still return the
+ * previous value for a second or two. Retries indefinitely with a fixed
+ * cadence; the surrounding test's own timeout bounds the wait.
+ */
+export const expectWorkersDevPreviews = Effect.fn(function* (
+  workerName: string,
+  accountId: string,
+  expected: { enabled: boolean; previewsEnabled: boolean },
+) {
+  const final = yield* workers
+    .getScriptSubdomain({ accountId, scriptName: workerName })
+    .pipe(
+      Effect.flatMap((s) =>
+        s.enabled === expected.enabled &&
+        s.previewsEnabled === expected.previewsEnabled
+          ? Effect.succeed(s)
+          : Effect.fail(
+              `subdomain not yet { enabled: ${expected.enabled}, previewsEnabled: ${expected.previewsEnabled} }`,
+            ),
+      ),
+      Effect.tapError(Effect.logInfo),
+      Effect.retry({ schedule: Schedule.spaced("500 millis") }),
+    );
+  expect(final).toEqual(expected);
+});
+
+/**
+ * Look up a worker by name. Returns `undefined` if no script with that
+ * name exists in the account.
+ */
+export const findWorker = Effect.fn(function* (
+  workerName: string,
+  accountId: string,
+) {
+  const matches = yield* workers.searchScript({
+    accountId,
+    name: workerName,
+  });
+  return matches.find((worker) => worker.scriptName === workerName);
+});
+
+/**
+ * Read the tags currently attached to a worker's live script settings.
+ * Useful for asserting `alchemy:stack:*` / `alchemy:stage:*` ownership
+ * tags without round-tripping through `searchScript`.
+ */
+export const getWorkerTags = Effect.fn(function* (
+  workerName: string,
+  accountId: string,
+) {
+  const settings = yield* workers.getScriptScriptAndVersionSetting({
+    accountId,
+    scriptName: workerName,
+  });
+  return settings.tags ?? [];
+});
+
+/**
+ * Asserts that a worker exists on Cloudflare. Use as a deploy
+ * checkpoint that doesn't take a propagation dependency on the
+ * workers.dev subdomain.
+ */
+export const expectWorkerExists = Effect.fn(function* (
+  workerName: string,
+  accountId: string,
+) {
+  const settings = yield* workers.getScriptScriptAndVersionSetting({
+    accountId,
+    scriptName: workerName,
+  });
+  expect(settings).toBeDefined();
+});
+
+/**
+ * Block until Cloudflare reports the worker is gone. Uses exponential
+ * backoff; safe to call after `stack.destroy()` to ensure subsequent
+ * tests in the same file don't observe the about-to-be-deleted worker.
+ */
+export const waitForWorkerToBeDeleted = Effect.fn(function* (
+  workerName: string,
+  accountId: string,
+) {
+  yield* workers.getScript({ accountId, scriptName: workerName }).pipe(
+    Effect.flatMap(() => Effect.fail(new WorkerStillExists())),
+    Effect.retry({
+      while: (e): e is WorkerStillExists => e instanceof WorkerStillExists,
+      schedule: Schedule.exponential(100).pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+    Effect.catchTag("WorkerNotFound", () => Effect.void),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeIndex.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeIndex.test.ts
new file mode 100644
index 00000000000..b377b012b81
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeIndex.test.ts
@@ -0,0 +1,123 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import * as vectorize from "@distilled.cloud/cloudflare/vectorize";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete index with explicit dimensions", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const index = yield* stack.deploy(
+      Cloudflare.VectorizeIndex("DefaultIndex", {
+        dimensions: 768,
+        metric: "cosine",
+      }),
+    );
+
+    expect(index.indexName).toBeDefined();
+    expect(index.dimensions).toEqual(768);
+    expect(index.metric).toEqual("cosine");
+
+    const actual = yield* vectorize.getIndex({
+      accountId,
+      indexName: index.indexName,
+    });
+    expect(actual.name).toEqual(index.indexName);
+    expect(actual.config?.dimensions).toEqual(768);
+
+    yield* stack.destroy();
+
+    yield* waitForDelete(accountId, index.indexName);
+  }).pipe(logLevel),
+);
+
+test.provider("create index from a preset", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const index = yield* stack.deploy(
+      Cloudflare.VectorizeIndex("PresetIndex", {
+        preset: "@cf/baai/bge-base-en-v1.5",
+        description: "preset index",
+      }),
+    );
+
+    const actual = yield* vectorize.getIndex({
+      accountId,
+      indexName: index.indexName,
+    });
+    // bge-base resolves to 768 dimensions.
+    expect(actual.config?.dimensions).toEqual(768);
+    expect(index.description).toEqual("preset index");
+
+    yield* stack.destroy();
+
+    yield* waitForDelete(accountId, index.indexName);
+  }).pipe(logLevel),
+);
+
+test.provider("replaces index when dimensions change", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const index = yield* stack.deploy(
+      Cloudflare.VectorizeIndex("ReplaceIndex", {
+        dimensions: 32,
+        metric: "cosine",
+      }),
+    );
+    expect(index.dimensions).toEqual(32);
+    expect(index.metric).toEqual("cosine");
+
+    const replaced = yield* stack.deploy(
+      Cloudflare.VectorizeIndex("ReplaceIndex", {
+        dimensions: 64,
+        metric: "euclidean",
+      }),
+    );
+
+    const actual = yield* vectorize.getIndex({
+      accountId,
+      indexName: replaced.indexName,
+    });
+    expect(actual.config?.dimensions).toEqual(64);
+    expect(actual.config?.metric).toEqual("euclidean");
+
+    yield* stack.destroy();
+
+    yield* waitForDelete(accountId, replaced.indexName);
+  }).pipe(logLevel),
+);
+
+const waitForDelete = (accountId: string, indexName: string) =>
+  vectorize.getIndex({ accountId, indexName }).pipe(
+    Effect.flatMap((index) =>
+      index.name === indexName
+        ? Effect.fail({ _tag: "IndexNotDeleted" } as const)
+        : Effect.void,
+    ),
+    Effect.catchTag(["NotFound", "Gone"], () => Effect.void),
+    Effect.retry({
+      while: (e) => e._tag === "IndexNotDeleted",
+      schedule: Schedule.exponential("500 millis").pipe(
+        Schedule.both(Schedule.recurs(10)),
+      ),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeIndexBinding.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeIndexBinding.test.ts
new file mode 100644
index 00000000000..61fbce52c19
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeIndexBinding.test.ts
@@ -0,0 +1,115 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { poll } from "@/Util/poll.ts";
+import { assert, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import { HttpClientResponse } from "effect/unstable/http";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import VectorizeWorker from "./fixtures/vectorize-worker.ts";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+/**
+ * End-to-end test of `Cloudflare.VectorizeIndex.bind(...)` against a
+ * real Cloudflare Worker + Vectorize index.
+ *
+ * The worker exercises the client surface (`upsert`, `describe`, `query`,
+ * `getByIds`). Vectorize mutations are eventually consistent, so after
+ * upserting we retry the query/get routes until the vectors are visible.
+ */
+test.provider(
+  "VectorizeIndex.bind exercises the client surface",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const workerUrl = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* VectorizeWorker;
+          }),
+        )
+        .pipe(
+          Effect.flatMap((worker) => {
+            assert.typeOf(worker.url, "string");
+            return HttpClient.get(`${worker.url}/health`).pipe(
+              Effect.flatMap(HttpClientResponse.filterStatusOk),
+              Effect.retry({
+                schedule: Schedule.exponential("500 millis").pipe(
+                  Schedule.both(Schedule.recurs(20)),
+                ),
+              }),
+              Effect.as(worker.url),
+            );
+          }),
+        );
+
+      // Fresh workers.dev URLs take a few seconds to start serving 200s.
+      // Retry the upsert until the route handler responds.
+      const upsertRes = yield* HttpClient.post(`${workerUrl}/upsert`).pipe(
+        Effect.flatMap(HttpClientResponse.filterStatusOk),
+        Effect.flatMap((res) => res.json),
+      );
+      expect(upsertRes).toMatchObject({ mutationId: expect.any(String) });
+
+      const describeRes = yield* HttpClient.get(`${workerUrl}/describe`).pipe(
+        Effect.flatMap(HttpClientResponse.filterStatusOk),
+        Effect.flatMap((res) => res.json),
+      );
+      expect(describeRes).toMatchObject({ dimensions: 32 });
+
+      // Mutations are async/eventually consistent — poll the query route
+      // until all three upserted vectors are visible.
+      const queryBody = yield* poll({
+        description: "GET /query returns the three upserted vectors",
+        effect: HttpClient.get(`${workerUrl}/query`).pipe(
+          Effect.flatMap(HttpClientResponse.filterStatusOk),
+          Effect.flatMap((res) => res.json),
+          Effect.map((body) => body as { count: number; ids: string[] }),
+        ),
+        predicate: (body) => body.count >= 3,
+      });
+      expect(queryBody.count).toBeGreaterThanOrEqual(3);
+      // The query vector equals "a" exactly, so it should be the top match.
+      expect(queryBody.ids[0]).toBe("a");
+
+      const getRes = yield* poll({
+        description: "GET /get returns the two upserted vectors",
+        effect: HttpClient.get(`${workerUrl}/get`).pipe(
+          Effect.flatMap(HttpClientResponse.filterStatusOk),
+          Effect.flatMap((res) => res.json),
+          Effect.map((body) => body as { ids: string[] }),
+        ),
+        predicate: (body) => body.ids.length === 2,
+      });
+      expect(getRes).toEqual({ ids: ["a", "b"] });
+
+      // Metadata-filtered query: only the vector tagged `kind: "second"`
+      // should come back. The metadata index lives on the parent and was
+      // created at deploy time before the upsert, so the filter is valid;
+      // poll until Cloudflare indexes the upserted vectors with it.
+      const filteredBody = yield* poll({
+        description: "GET /query-filtered returns the second vector",
+        effect: HttpClient.get(`${workerUrl}/query-filtered`).pipe(
+          Effect.flatMap(HttpClientResponse.filterStatusOk),
+          Effect.flatMap((res) => res.json),
+          Effect.map(
+            (body) => body as { count: number; ids: string[]; kinds: string[] },
+          ),
+        ),
+        predicate: (body) => body.ids.length === 1 && body.kinds.length === 1,
+      });
+      expect(filteredBody.ids).toEqual(["b"]);
+      expect(filteredBody.kinds).toEqual(["second"]);
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+  { timeout: 240_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeMetadataIndex.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeMetadataIndex.test.ts
new file mode 100644
index 00000000000..63192057177
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/VectorizeMetadataIndex.test.ts
@@ -0,0 +1,228 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import { poll } from "@/Util/poll.ts";
+import * as vectorize from "@distilled.cloud/cloudflare/vectorize";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete a metadata index", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const { index, meta } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const index = yield* Cloudflare.VectorizeIndex("ParentIdx", {
+          dimensions: 32,
+          metric: "cosine",
+        });
+        const meta = yield* Cloudflare.VectorizeMetadataIndex("MetaIdx", {
+          indexName: index.indexName,
+          propertyName: "category",
+          indexType: "string",
+        });
+        return { index, meta };
+      }),
+    );
+
+    expect(meta.propertyName).toBe("category");
+    expect(meta.indexType).toBe("string");
+    expect(meta.indexName).toBe(index.indexName);
+
+    // The metadata index appears in the parent's list once Cloudflare
+    // processes the async mutation.
+    const entries = yield* poll({
+      description: "metadata index exists with propertyName=category",
+      effect: listMetadataIndexes(accountId, index.indexName),
+      predicate: (entries) =>
+        entries.some((e) => e.propertyName === "category"),
+    });
+    expect(entries.find((e) => e.propertyName === "category")?.indexType).toBe(
+      "String",
+    );
+
+    yield* stack.destroy();
+
+    // Both parent and metadata index are gone.
+    const after = yield* listMetadataIndexes(accountId, index.indexName);
+    expect(after.length).toBe(0);
+  }).pipe(logLevel),
+);
+
+test.provider("multiple metadata indexes on the same parent coexist", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const { index } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const index = yield* Cloudflare.VectorizeIndex("MultiParent", {
+          dimensions: 32,
+          metric: "cosine",
+        });
+        yield* Cloudflare.VectorizeMetadataIndex("CategoryMeta", {
+          indexName: index.indexName,
+          propertyName: "category",
+          indexType: "string",
+        });
+        yield* Cloudflare.VectorizeMetadataIndex("PriceMeta", {
+          indexName: index.indexName,
+          propertyName: "price",
+          indexType: "number",
+        });
+        return { index };
+      }),
+    );
+    const entries = yield* poll({
+      description: "metadata index includes category and price",
+      effect: listMetadataIndexes(accountId, index.indexName),
+      predicate: (entries) =>
+        entries.some((e) => e.propertyName === "category") &&
+        entries.some((e) => e.propertyName === "price"),
+    });
+    expect(entries.find((e) => e.propertyName === "category")?.indexType).toBe(
+      "String",
+    );
+    expect(entries.find((e) => e.propertyName === "price")?.indexType).toBe(
+      "Number",
+    );
+
+    yield* stack.destroy();
+  }).pipe(logLevel),
+);
+
+test.provider(
+  "replacing the parent index also replaces the metadata index",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      // Initial deploy with dimensions=32.
+      const { index: oldIndex } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const index = yield* Cloudflare.VectorizeIndex("ReplaceParent", {
+            dimensions: 32,
+            metric: "cosine",
+          });
+          yield* Cloudflare.VectorizeMetadataIndex("ReplaceMeta", {
+            indexName: index.indexName,
+            propertyName: "tag",
+            indexType: "string",
+          });
+          return { index };
+        }),
+      );
+      yield* poll({
+        description: "metadata index exists with propertyName=tag",
+        effect: listMetadataIndexes(accountId, oldIndex.indexName),
+        predicate: (entries) => entries.some((e) => e.propertyName === "tag"),
+      });
+
+      // Re-deploy with different dimensions — the parent replaces, which
+      // also replaces the metadata index on the new parent.
+      const { index: newIndex, meta: newMeta } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const index = yield* Cloudflare.VectorizeIndex("ReplaceParent", {
+            dimensions: 64,
+            metric: "cosine",
+          });
+          const meta = yield* Cloudflare.VectorizeMetadataIndex("ReplaceMeta", {
+            indexName: index.indexName,
+            propertyName: "tag",
+            indexType: "string",
+          });
+          return { index, meta };
+        }),
+      );
+
+      expect(newIndex.indexName).not.toBe(oldIndex.indexName);
+      expect(newMeta.indexName).toBe(newIndex.indexName);
+
+      // Old parent is gone.
+      const oldGone = yield* vectorize
+        .getIndex({ accountId, indexName: oldIndex.indexName })
+        .pipe(
+          Effect.map(() => false),
+          Effect.catchTag(["NotFound", "Gone"], () => Effect.succeed(true)),
+        );
+      expect(oldGone).toBe(true);
+
+      // The new parent has the metadata index.
+      yield* poll({
+        description: "metadata index exists with propertyName=tag",
+        effect: listMetadataIndexes(accountId, newIndex.indexName),
+        predicate: (entries) => entries.some((e) => e.propertyName === "tag"),
+      });
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+);
+
+test.provider(
+  "destroy is idempotent when the parent index was deleted out-of-band",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const { index } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const index = yield* Cloudflare.VectorizeIndex("OobParent", {
+            dimensions: 32,
+            metric: "cosine",
+          });
+          yield* Cloudflare.VectorizeMetadataIndex("OobMeta", {
+            indexName: index.indexName,
+            propertyName: "ns",
+            indexType: "string",
+          });
+          return { index };
+        }),
+      );
+      yield* poll({
+        description: "metadata index exists with propertyName=ns",
+        effect: listMetadataIndexes(accountId, index.indexName),
+        predicate: (entries) => entries.some((e) => e.propertyName === "ns"),
+      });
+
+      // Simulate Cloudflare's cascading delete: drop the parent directly.
+      // On Cloudflare's side this also removes the metadata index.
+      yield* vectorize.deleteIndex({
+        accountId,
+        indexName: index.indexName,
+      });
+
+      // The metadata index provider's delete tolerates 404/410 from the
+      // missing parent, so `destroy` succeeds without erroring.
+      yield* stack.destroy();
+    }).pipe(logLevel),
+);
+
+const listMetadataIndexes = Effect.fn(function* (
+  accountId: string,
+  indexName: string,
+) {
+  return yield* vectorize
+    .listIndexMetadataIndexes({ accountId, indexName })
+    .pipe(
+      Effect.map((res) => res.metadataIndexes ?? []),
+      Effect.catchTag(["NotFound", "Gone"], () =>
+        // Parent index gone — treat as "no metadata indexes".
+        Effect.succeed([]),
+      ),
+    );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/fixtures/vectorize-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/fixtures/vectorize-worker.ts
new file mode 100644
index 00000000000..31b7f837225
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Vectorize/fixtures/vectorize-worker.ts
@@ -0,0 +1,125 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Vectorize index created at deploy time and bound to the worker via
+ * `Cloudflare.VectorizeConnection.bind(...)`. A metadata index on the
+ * `kind` property is also provisioned so that filtered queries can use
+ * it. The handlers exercise the Effect-native Vectorize client surface:
+ *
+ *   POST /upsert         — `index.upsert([...])`
+ *   GET  /describe       — `index.describe()`
+ *   GET  /query          — `index.query(vector, { topK })`
+ *   GET  /query-filtered — `index.query(vector, { filter: { kind: ... } })`
+ *   GET  /get            — `index.getByIds([...])`
+ */
+const DIMENSIONS = 32;
+
+/** Builds a deterministic `DIMENSIONS`-length vector seeded by the first values. */
+const vector = (...seed: number[]): number[] =>
+  Array.from({ length: DIMENSIONS }, (_, i) => seed[i] ?? (i % 10) / 10);
+
+export const TestIndex = Cloudflare.VectorizeIndex("VectorizeWorkerIndex", {
+  dimensions: DIMENSIONS,
+  metric: "cosine",
+});
+
+export default class VectorizeWorker extends Cloudflare.Worker<VectorizeWorker>()(
+  "VectorizeEffectWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const index = yield* TestIndex;
+    // Metadata indexes must exist before vectors are inserted for them to
+    // be queryable — declaring it here puts it in the stack so the deploy
+    // creates it before the test hits /upsert.
+    yield* Cloudflare.VectorizeMetadataIndex("VectorizeWorkerKindMetaIndex", {
+      indexName: index.indexName,
+      propertyName: "kind",
+      indexType: "string",
+    });
+    const vec = yield* Cloudflare.VectorizeIndex.bind(index);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "GET" && url.pathname === "/health") {
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && url.pathname === "/upsert") {
+          const mutation = yield* vec.upsert([
+            {
+              id: "a",
+              values: vector(0.1, 0.2, 0.3),
+              metadata: { kind: "first" },
+            },
+            {
+              id: "b",
+              values: vector(0.9, 0.8, 0.7),
+              metadata: { kind: "second" },
+            },
+            {
+              id: "c",
+              values: vector(0.4, 0.5, 0.6),
+              metadata: { kind: "third" },
+            },
+          ]);
+          return yield* HttpServerResponse.json({
+            mutationId: mutation.mutationId,
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/describe") {
+          const info = yield* vec.describe();
+          return yield* HttpServerResponse.json({
+            dimensions: info.dimensions,
+            vectorCount: info.vectorCount,
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/query") {
+          const matches = yield* vec.query(vector(0.1, 0.2, 0.3), {
+            topK: 3,
+            returnMetadata: "all",
+          });
+          return yield* HttpServerResponse.json({
+            count: matches.count,
+            ids: matches.matches.map((m) => m.id),
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/query-filtered") {
+          const matches = yield* vec.query(vector(0.1, 0.2, 0.3), {
+            topK: 3,
+            returnMetadata: "all",
+            filter: { kind: { $eq: "second" } },
+          });
+          return yield* HttpServerResponse.json({
+            count: matches.count,
+            ids: matches.matches.map((m) => m.id),
+            kinds: matches.matches.map(
+              (m) => (m.metadata as { kind?: string } | undefined)?.kind,
+            ),
+          });
+        }
+
+        if (request.method === "GET" && url.pathname === "/get") {
+          const vectors = yield* vec.getByIds(["a", "b"]);
+          return yield* HttpServerResponse.json({
+            ids: vectors.map((v) => v.id).sort(),
+          });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.VectorizeIndexBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VpcService/VpcService.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VpcService/VpcService.test.ts
new file mode 100644
index 00000000000..a9d5ff884ed
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VpcService/VpcService.test.ts
@@ -0,0 +1,187 @@
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Test from "@/Test/Vitest";
+import * as connectivity from "@distilled.cloud/cloudflare/connectivity";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create, update, delete vpc service", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const { tunnel, service } = yield* stack.deploy(
+      Effect.gen(function* () {
+        const tunnel = yield* Cloudflare.Tunnel("VpcTunnel", {
+          ingress: [{ service: "http://localhost:8080" }],
+          adopt: true,
+        });
+        const service = yield* Cloudflare.VpcService("VpcSvc", {
+          httpPort: 8080,
+          host: {
+            hostname: "localhost",
+            resolverNetwork: { tunnelId: tunnel.tunnelId },
+          },
+          adopt: true,
+        });
+        return { tunnel, service };
+      }),
+    );
+
+    expect(service.serviceId).toBeDefined();
+    expect(service.serviceType).toEqual("http");
+    expect(service.httpPort).toEqual(8080);
+    expect(service.host).toMatchObject({
+      hostname: "localhost",
+      resolverNetwork: { tunnelId: tunnel.tunnelId },
+    });
+
+    const fetched = yield* connectivity.getDirectoryService({
+      accountId,
+      serviceId: service.serviceId,
+    });
+    expect(fetched.serviceId).toEqual(service.serviceId);
+    // @ts-expect-error
+    expect(fetched.httpPort).toEqual(8080);
+
+    const updated = yield* stack.deploy(
+      Effect.gen(function* () {
+        const tunnel = yield* Cloudflare.Tunnel("VpcTunnel", {
+          ingress: [{ service: "http://localhost:8080" }],
+          adopt: true,
+        });
+        return yield* Cloudflare.VpcService("VpcSvc", {
+          httpPort: 3000,
+          httpsPort: 3001,
+          host: {
+            hostname: "localhost",
+            resolverNetwork: { tunnelId: tunnel.tunnelId },
+          },
+          adopt: true,
+        });
+      }),
+    );
+
+    expect(updated.serviceId).toEqual(service.serviceId);
+    expect(updated.httpPort).toEqual(3000);
+    expect(updated.httpsPort).toEqual(3001);
+
+    const fetchedUpdated = yield* connectivity.getDirectoryService({
+      accountId,
+      serviceId: service.serviceId,
+    });
+    // @ts-expect-error
+    expect(fetchedUpdated.httpPort).toEqual(3000);
+    // @ts-expect-error
+    expect(fetchedUpdated.httpsPort).toEqual(3001);
+
+    yield* stack.destroy();
+
+    yield* waitForServiceToBeDeleted(service.serviceId, accountId);
+  }).pipe(logLevel),
+);
+
+test.provider("create vpc service with ipv4 host", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const service = yield* stack.deploy(
+      Effect.gen(function* () {
+        const tunnel = yield* Cloudflare.Tunnel("Ipv4Tunnel", {
+          ingress: [{ service: "http://localhost:8080" }],
+          adopt: true,
+        });
+        return yield* Cloudflare.VpcService("Ipv4Svc", {
+          httpPort: 8080,
+          host: {
+            ipv4: "192.168.1.100",
+            network: { tunnelId: tunnel.tunnelId },
+          },
+          adopt: true,
+        });
+      }),
+    );
+
+    expect(service.host).toMatchObject({
+      ipv4: "192.168.1.100",
+    });
+    expect("ipv6" in service.host).toBe(false);
+
+    const fetched = yield* connectivity.getDirectoryService({
+      accountId,
+      serviceId: service.serviceId,
+    });
+    expect((fetched.host as { ipv4?: string }).ipv4).toEqual("192.168.1.100");
+
+    yield* stack.destroy();
+    yield* waitForServiceToBeDeleted(service.serviceId, accountId);
+  }).pipe(logLevel),
+);
+
+// TODO: re-enable once distilled ships the union-ordering fix
+// (alchemy-run/distilled#232) — on @distilled.cloud/cloudflare@0.16.3 the
+// dual-stack host variant comes after the ipv4-only variant in the request
+// schema's Schema.Union, so `ipv6` is silently stripped on encode.
+test.provider.skip("create vpc service with dual-stack host", (stack) =>
+  Effect.gen(function* () {
+    const { accountId } = yield* CloudflareEnvironment;
+
+    yield* stack.destroy();
+
+    const service = yield* stack.deploy(
+      Effect.gen(function* () {
+        const tunnel = yield* Cloudflare.Tunnel("DualStackTunnel", {
+          ingress: [{ service: "http://localhost:8080" }],
+          adopt: true,
+        });
+        return yield* Cloudflare.VpcService("DualStackSvc", {
+          httpPort: 8080,
+          host: {
+            ipv4: "192.168.1.101",
+            ipv6: "2001:db8::1",
+            network: { tunnelId: tunnel.tunnelId },
+          },
+          adopt: true,
+        });
+      }),
+    );
+
+    expect(service.host).toMatchObject({
+      ipv4: "192.168.1.101",
+      ipv6: "2001:db8::1",
+    });
+
+    yield* stack.destroy();
+    yield* waitForServiceToBeDeleted(service.serviceId, accountId);
+  }).pipe(logLevel),
+);
+
+const waitForServiceToBeDeleted = Effect.fn(function* (
+  serviceId: string,
+  accountId: string,
+) {
+  yield* connectivity.getDirectoryService({ accountId, serviceId }).pipe(
+    Effect.flatMap(() => Effect.fail(new VpcServiceStillExists())),
+    Effect.retry({
+      while: (e): e is VpcServiceStillExists =>
+        e instanceof VpcServiceStillExists,
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catch(() => Effect.void),
+  );
+});
+
+class VpcServiceStillExists extends Data.TaggedError("VpcServiceStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VpcService/VpcServiceRef.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VpcService/VpcServiceRef.test.ts
new file mode 100644
index 00000000000..097d313ed06
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/VpcService/VpcServiceRef.test.ts
@@ -0,0 +1,50 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("reference vpc service by name and by id", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const service = yield* stack.deploy(
+      Effect.gen(function* () {
+        const tunnel = yield* Cloudflare.Tunnel("RefTunnel", {
+          ingress: [{ service: "http://localhost:8080" }],
+          adopt: true,
+        });
+        return yield* Cloudflare.VpcService("RefSvc", {
+          httpPort: 8080,
+          host: {
+            hostname: "localhost",
+            resolverNetwork: { tunnelId: tunnel.tunnelId },
+          },
+          adopt: true,
+        });
+      }),
+    );
+
+    const refByName = yield* Cloudflare.VpcServiceRef({
+      name: service.serviceName,
+    });
+    expect(refByName.serviceId).toEqual(service.serviceId);
+    expect(refByName.serviceName).toEqual(service.serviceName);
+    expect(refByName.httpPort).toEqual(service.httpPort);
+
+    const refById = yield* Cloudflare.VpcServiceRef({
+      serviceId: service.serviceId,
+    });
+    expect(refById.serviceId).toEqual(service.serviceId);
+    expect(refById.serviceName).toEqual(service.serviceName);
+
+    yield* stack.destroy();
+  }).pipe(logLevel),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/StaticSite.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/StaticSite.test.ts
new file mode 100644
index 00000000000..ccc49cf83a4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/StaticSite.test.ts
@@ -0,0 +1,312 @@
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { MinimumLogLevel } from "effect/References";
+import * as pathe from "pathe";
+import { cloneFixture } from "../Utils/Fixture.ts";
+import { expectUrlContains } from "../Utils/Http.ts";
+import {
+  expectWorkerExists,
+  waitForWorkerToBeDeleted,
+} from "../Utils/Worker.ts";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const fixtureDir = pathe.resolve(import.meta.dirname, "staticsite-fixture");
+const workerEntry = pathe.resolve(import.meta.dirname, "fixtures/worker.ts");
+
+test.provider(
+  "StaticSite: editing a source file republishes the assets in a single deploy",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      yield* stack.destroy();
+
+      const cwd = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-staticsite-fix-",
+        entries: ["src", "build.sh"],
+      });
+      const indexPath = path.join(cwd, "src", "index.html");
+
+      // ── deploy 1: initial publish ──────────────────────────────────────
+      const v1Marker = `staticsite-v1-${Date.now()}`;
+      yield* fs.writeFileString(indexPath, htmlPage(v1Marker));
+
+      const site1 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.StaticSite("FixSite", staticSiteProps(cwd));
+        }),
+      );
+
+      expect(site1.url).toBeDefined();
+      expect(site1.hash?.assets).toBeDefined();
+      yield* expectWorkerExists(site1.workerName, accountId);
+      // End-to-end: the worker URL actually serves the v1 marker.
+      // Use a long timeout because workers.dev subdomains can take 60s+
+      // to propagate the very first time they're enabled.
+      yield* expectUrlContains(`${site1.url!}/index.html`, v1Marker, {
+        timeout: "120 seconds",
+        label: "deploy1 v1 marker",
+      });
+
+      // ── deploy 2: edit fixture, redeploy once ──────────────────────────
+      const v2Marker = `staticsite-v2-${Date.now()}`;
+      yield* fs.writeFileString(indexPath, htmlPage(v2Marker));
+
+      const site2 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.StaticSite("FixSite", staticSiteProps(cwd));
+        }),
+      );
+
+      expect(site2.hash?.assets).toBeDefined();
+      expect(site2.hash?.assets).not.toEqual(site1.hash?.assets);
+
+      // The single-deploy guarantee: after one redeploy, the new
+      // marker is reachable over HTTP. Before the fix, this failure
+      // mode is what users were hitting — the worker version finalized
+      // pointing at the previous asset manifest because the initial
+      // Worker.update read dist mid-write.
+      yield* expectUrlContains(`${site2.url!}/index.html`, v2Marker, {
+        timeout: "60 seconds",
+        label: "deploy2 v2 marker",
+      });
+      // And the v1 marker should be gone — i.e. the new deploy fully
+      // replaced the previous content rather than coexisting with it.
+      yield* expectUrlAbsent(`${site2.url!}/index.html`, v1Marker, {
+        timeout: "30 seconds",
+      });
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(site1.workerName, accountId);
+    }).pipe(logLevel),
+  { timeout: 360_000 },
+);
+
+// ─────────────────────────────────────────────────────────────────────
+// Path-relocation / cross-machine state behavior
+//
+// `StaticSite` builds via `Build.Command` and hands its `outdir` +
+// content hash to `Worker` as `AssetsWithHash`. The hash is the only
+// thing the diff/keepAssets logic should care about — the recorded
+// `path` is *not* an input. These tests pin that down so that:
+//
+//   1. State produced on machine A (e.g. a CI runner) can be
+//      re-applied on machine B without `NotFound` failures from a
+//      stale `path` lurking in state.
+//   2. A worker-only edit, with `src/` byte-identical, keeps the
+//      asset manifest in place instead of re-uploading.
+//   3. A genuine source edit (already covered above) bumps the
+//      hash and ships new bytes — repeated here for symmetry.
+// ─────────────────────────────────────────────────────────────────────
+
+test.provider(
+  "StaticSite: relocating the project (and deleting the old one) preserves hash.assets",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      yield* stack.destroy();
+
+      // Include `.gitignore` so `Build.Command`'s default memo skips
+      // `dist/` between deploys; without it, the build output from
+      // deploy 1 would shift the input hash on deploy 2 and force an
+      // unnecessary rebuild that defeats the test.
+      const cwdA = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-staticsite-relocate-a-",
+        entries: ["src", "build.sh", ".gitignore"],
+      });
+
+      // Pin a deterministic marker so both deploys hash to the same
+      // bytes regardless of timestamps.
+      const marker = `staticsite-relocate-${Date.now()}`;
+      yield* fs.writeFileString(
+        path.join(cwdA, "src", "index.html"),
+        htmlPage(marker),
+      );
+
+      const site1 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.StaticSite(
+            "RelocSite",
+            staticSiteProps(cwdA),
+          );
+        }),
+      );
+      expect(site1.hash?.assets).toBeDefined();
+      yield* expectUrlContains(`${site1.url!}/index.html`, marker, {
+        timeout: "120 seconds",
+        label: "deploy1 marker",
+      });
+
+      // Simulate the CI→local handoff: throw away the directory the
+      // first deploy ran in. Anything that still tries to readDir the
+      // recorded `outdir` will blow up here — the keepAssets path
+      // must not require it.
+      yield* fs.remove(cwdA, { recursive: true });
+
+      const cwdB = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-staticsite-relocate-b-",
+        entries: ["src", "build.sh", ".gitignore"],
+      });
+      yield* fs.writeFileString(
+        path.join(cwdB, "src", "index.html"),
+        htmlPage(marker),
+      );
+
+      const site2 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.StaticSite(
+            "RelocSite",
+            staticSiteProps(cwdB),
+          );
+        }),
+      );
+
+      // The build still runs (Build.Command always re-runs its
+      // command), but the resulting content hash is identical, so
+      // Worker takes the keepAssets path and the recorded
+      // `hash.assets` is stable.
+      expect(site2.hash?.assets).toEqual(site1.hash?.assets);
+      // And the URL keeps serving — i.e. we didn't lose the asset
+      // binding in the process.
+      yield* expectUrlContains(`${site2.url!}/index.html`, marker, {
+        timeout: "60 seconds",
+        label: "deploy2 marker",
+      });
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(site1.workerName, accountId);
+    }).pipe(logLevel),
+  { timeout: 360_000 },
+);
+
+test.provider(
+  "StaticSite: a bundle-only change keeps the asset manifest (hash.assets stable)",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      yield* stack.destroy();
+
+      // Include `.gitignore` so the memo (which falls back to gitignore
+      // when not explicitly configured) skips `dist/` between deploys —
+      // otherwise the second `hashDirectory` would observe the build
+      // output from deploy 1 and produce a different input hash.
+      const cwd = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-staticsite-bundle-only-",
+        entries: ["src", "build.sh", ".gitignore"],
+      });
+      const marker = `staticsite-bundle-only-${Date.now()}`;
+      yield* fs.writeFileString(
+        path.join(cwd, "src", "index.html"),
+        htmlPage(marker),
+      );
+      // Use a temp worker entry so we can edit it between deploys to
+      // shift `hash.bundle` without touching `src/`.
+      const workerDir = yield* fs.makeTempDirectory({
+        prefix: "alchemy-staticsite-bundle-only-entry-",
+      });
+      const workerPath = path.join(workerDir, "worker.ts");
+      const writeWorker = (variant: string) =>
+        fs.writeFileString(
+          workerPath,
+          `export default {
+  fetch: async () => new Response(${JSON.stringify(`bundle-only ${variant}`)}),
+};
+`,
+        );
+
+      const deploy = () =>
+        stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.StaticSite("BundleOnlyStaticSite", {
+              ...staticSiteProps(cwd),
+              main: workerPath,
+            });
+          }),
+        );
+
+      yield* writeWorker("v1");
+      const v1 = yield* deploy();
+      expect(v1.hash?.assets).toBeDefined();
+      expect(v1.hash?.bundle).toBeDefined();
+      yield* expectUrlContains(`${v1.url!}/index.html`, marker, {
+        timeout: "120 seconds",
+        label: "v1 marker",
+      });
+
+      yield* writeWorker("v2");
+      const v2 = yield* deploy();
+      expect(v2.hash?.bundle).not.toEqual(v1.hash?.bundle);
+      expect(v2.hash?.assets).toEqual(v1.hash?.assets);
+      yield* expectUrlContains(`${v2.url!}/index.html`, marker, {
+        timeout: "60 seconds",
+        label: "v2 marker (assets unchanged)",
+      });
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(v1.workerName, accountId);
+    }).pipe(logLevel),
+  { timeout: 360_000 },
+);
+
+const staticSiteProps = (cwd: string) => ({
+  command: "bash build.sh",
+  cwd,
+  outdir: "dist",
+  main: workerEntry,
+  url: true as const,
+  subdomain: { enabled: true, previewsEnabled: true },
+  compatibility: { date: "2024-01-01" },
+});
+
+const htmlPage = (marker: string) => `<!doctype html>
+<html>
+  <head><title>${marker}</title></head>
+  <body><h1>${marker}</h1></body>
+</html>
+`;
+
+/**
+ * Inverse of `expectUrlContains`: succeeds if the marker is *absent*
+ * from the response within the timeout. We drive this off the same
+ * primitive by inverting the check at the call site.
+ */
+const expectUrlAbsent = (
+  url: string,
+  marker: string,
+  options: { timeout?: Duration.Input },
+) =>
+  Effect.gen(function* () {
+    yield* expectUrlContains(url, "<", { ...options, label: "page exists" });
+    const u = new URL(url);
+    u.searchParams.set("__alchemy_cb", String(Date.now()));
+    const body = yield* Effect.promise(() =>
+      fetch(u, {
+        cache: "no-store",
+        headers: { "cache-control": "no-cache" },
+      }).then((r) => r.text()),
+    );
+    expect(
+      body.includes(marker),
+      `expected URL ${url} to NOT contain "${marker}", but it did`,
+    ).toBe(false);
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/Vite.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/Vite.test.ts
new file mode 100644
index 00000000000..75a81b9d4b3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/Vite.test.ts
@@ -0,0 +1,280 @@
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as pathe from "pathe";
+import { cloneFixture } from "../Utils/Fixture.ts";
+import { expectUrlContains } from "../Utils/Http.ts";
+import {
+  expectWorkerExists,
+  waitForWorkerToBeDeleted,
+} from "../Utils/Worker.ts";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const fixtureDir = pathe.resolve(import.meta.dirname, "vite-fixture");
+
+// Vite/Rollup's `vite:build-html` plugin chokes when the project root
+// is outside the current working directory because it tries to express
+// the emitted asset path relative to `cwd`. To keep the temp clone
+// reachable via a sane relative path, allocate the temp dir *inside*
+// the alchemy package's `.tmp/` so it sits under the same workspace
+// root as `cwd`.
+const tempRoot = pathe.resolve(import.meta.dirname, "../../../.tmp");
+
+test.provider(
+  "Vite: editing a source file republishes the assets in a single deploy",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      yield* stack.destroy();
+
+      const rootDir = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-vite-fix-",
+        tempRoot,
+        entries: ["index.html", "package.json", "vite.config.ts", "src"],
+      });
+      const indexPath = path.join(rootDir, "index.html");
+
+      // Restrict the input memo to fixture sources so the test isn't
+      // re-hashing the whole monorepo on every deploy.
+      const memoInclude = ["index.html", "src/**", "package.json"];
+
+      const v1Marker = `vite-v1-${Date.now()}`;
+      yield* fs.writeFileString(indexPath, htmlPage(v1Marker));
+
+      const site1 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Vite(
+            "FixVite",
+            viteProps(rootDir, memoInclude),
+          );
+        }),
+      );
+
+      expect(site1.url).toBeDefined();
+      expect(site1.hash?.input).toBeDefined();
+      yield* expectWorkerExists(site1.workerName, accountId);
+      yield* expectUrlContains(`${site1.url!}/`, v1Marker, {
+        timeout: "120 seconds",
+        label: "deploy1 v1 marker",
+      });
+
+      // ── deploy 2: edit fixture, redeploy once ──────────────────────────
+      const v2Marker = `vite-v2-${Date.now()}`;
+      yield* fs.writeFileString(indexPath, htmlPage(v2Marker));
+
+      const site2 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Vite(
+            "FixVite",
+            viteProps(rootDir, memoInclude),
+          );
+        }),
+      );
+
+      expect(site2.hash?.input).toBeDefined();
+      expect(site2.hash?.input).not.toEqual(site1.hash?.input);
+      yield* expectUrlContains(`${site2.url!}/`, v2Marker, {
+        timeout: "60 seconds",
+        label: "deploy2 v2 marker",
+      });
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(site1.workerName, accountId);
+    }).pipe(logLevel),
+  { timeout: 360_000 },
+);
+
+// ─────────────────────────────────────────────────────────────────────
+// Path-relocation behavior for the vite path
+//
+// `Cloudflare.Vite` hashes its memo'd input tree (`hash.input`)
+// instead of carrying an `AssetsWithHash`. The diff is:
+//
+//   `input !== output.hash?.input`
+//
+// — a pure content comparison that must be stable across rootDir
+// moves. We delete the original rootDir between deploys to make the
+// test fail loudly if anything still depends on the recorded path.
+// ─────────────────────────────────────────────────────────────────────
+
+test.provider(
+  "Vite: relocating rootDir (and deleting the old one) is a no-op when sources are identical",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      yield* stack.destroy();
+
+      const memoInclude = ["index.html", "src/**", "package.json"];
+      const marker = `vite-relocate-${Date.now()}`;
+
+      const rootA = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-vite-relocate-a-",
+        tempRoot,
+        entries: ["index.html", "package.json", "vite.config.ts", "src"],
+      });
+      yield* fs.writeFileString(
+        path.join(rootA, "index.html"),
+        htmlPage(marker),
+      );
+
+      const site1 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Vite(
+            "ViteReloc",
+            viteProps(rootA, memoInclude),
+          );
+        }),
+      );
+      expect(site1.hash?.input).toBeDefined();
+      yield* expectUrlContains(`${site1.url!}/`, marker, {
+        timeout: "120 seconds",
+        label: "deploy1 marker",
+      });
+
+      // Drop rootA so a stale path comparison can't quietly succeed.
+      yield* fs.remove(rootA, { recursive: true });
+
+      const rootB = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-vite-relocate-b-",
+        tempRoot,
+        entries: ["index.html", "package.json", "vite.config.ts", "src"],
+      });
+      yield* fs.writeFileString(
+        path.join(rootB, "index.html"),
+        htmlPage(marker),
+      );
+
+      const site2 = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Vite(
+            "ViteReloc",
+            viteProps(rootB, memoInclude),
+          );
+        }),
+      );
+
+      // Identical sources ⇒ identical input hash ⇒ diff says
+      // unchanged ⇒ no rebuild required for the apply to succeed.
+      expect(site2.hash?.input).toEqual(site1.hash?.input);
+      yield* expectUrlContains(`${site2.url!}/`, marker, {
+        timeout: "60 seconds",
+        label: "deploy2 marker",
+      });
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(site1.workerName, accountId);
+    }).pipe(logLevel),
+  { timeout: 360_000 },
+);
+
+test.provider(
+  "Vite: `env` props are inlined as `import.meta.env.*` into the bundle",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      const rootDir = yield* cloneFixture(fixtureDir, {
+        prefix: "alchemy-vite-env-",
+        tempRoot,
+        entries: ["index.html", "package.json", "vite.config.ts", "src"],
+      });
+      const memoInclude = ["index.html", "src/**", "package.json"];
+      const marker = `vite-env-${Date.now()}`;
+
+      const site = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Vite("FixViteEnv", {
+            ...viteProps(rootDir, memoInclude),
+            env: { VITE_TEST_MARKER: marker },
+          });
+        }),
+      );
+
+      expect(site.url).toBeDefined();
+      // Resolve the hashed bundle URL by reading the deployed HTML, then
+      // assert the marker that `main.ts` references via
+      // `import.meta.env.VITE_TEST_MARKER` was actually inlined into the
+      // served JS asset by `Cloudflare.Vite`'s `env`-→-`define` plumbing.
+      const bundleUrl = yield* discoverBundleUrl(site.url!);
+      yield* expectUrlContains(bundleUrl, marker, {
+        timeout: "60 seconds",
+        label: "VITE_TEST_MARKER inlined into client bundle",
+      });
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(site.workerName, accountId);
+    }).pipe(logLevel),
+  { timeout: 360_000 },
+);
+
+const discoverBundleUrl = (siteUrl: string) =>
+  Effect.gen(function* () {
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+    return yield* Effect.gen(function* () {
+      const res = yield* client.get(`${siteUrl}/`);
+      const html = yield* res.text;
+      const match = html.match(
+        /<script[^>]+src="(\/assets\/[^"]+\.js)"[^>]*>/i,
+      );
+      if (!match) {
+        // Fresh deploys can briefly return Cloudflare's "There is
+        // nothing here yet" HTML page instead of the SPA index — retry.
+        return yield* Effect.fail(
+          new Error(
+            `Could not find /assets/*.js script tag in HTML: ${html.slice(0, 200)}`,
+          ),
+        );
+      }
+      return `${siteUrl}${match[1]}`;
+    }).pipe(
+      Effect.retry({
+        schedule: Schedule.exponential("500 millis"),
+        times: 10,
+      }),
+    );
+  });
+
+const viteProps = (rootDir: string, memoInclude: string[]) => ({
+  rootDir,
+  url: true as const,
+  subdomain: { enabled: true, previewsEnabled: true },
+  compatibility: {
+    date: "2024-09-23",
+    flags: ["nodejs_compat"],
+  },
+  memo: { include: memoInclude },
+});
+
+const htmlPage = (marker: string) => `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>${marker}</title>
+  </head>
+  <body>
+    <div id="app">${marker}</div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
+`;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/fixtures/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/fixtures/worker.ts
new file mode 100644
index 00000000000..d4875496dc2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/fixtures/worker.ts
@@ -0,0 +1,3 @@
+export default {
+  fetch: async () => new Response("ok"),
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/.gitignore b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/.gitignore
new file mode 100644
index 00000000000..1521c8b7652
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/.gitignore
@@ -0,0 +1 @@
+dist
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/build.sh b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/build.sh
new file mode 100755
index 00000000000..d2ab3a84f97
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/build.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# Minimal deterministic build for the StaticSite fixture: copy src/ -> dist/.
+#
+# We sleep briefly before *and* during the copy so that any Worker.update
+# that races against this build (e.g. reading dist/ mid-write) has a wide
+# enough window to actually trip. The user-visible bug this test guards
+# against — "two deploys needed to publish assets" — only manifests when
+# the build takes meaningful wall time, which a real astro/vite build
+# does but a one-line `cp` does not.
+set -euo pipefail
+sleep 0.5
+rm -rf dist
+mkdir -p dist
+sleep 0.5
+cp -R src/. dist/
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/src/index.html b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/src/index.html
new file mode 100644
index 00000000000..ca66e96e30d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/staticsite-fixture/src/index.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<html>
+  <head>
+    <title>StaticSite fixture v1</title>
+  </head>
+  <body>
+    <h1>StaticSite fixture v1</h1>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/.gitignore b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/.gitignore
new file mode 100644
index 00000000000..de4d1f007dd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/.gitignore
@@ -0,0 +1,2 @@
+dist
+node_modules
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/index.html b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/index.html
new file mode 100644
index 00000000000..e8d5df1fb0e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/index.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>Vite fixture v1</title>
+  </head>
+  <body>
+    <div id="app">Vite fixture v1</div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/package.json b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/package.json
new file mode 100644
index 00000000000..a5e07d0453b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "alchemy-vite-fixture",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module"
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/src/main.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/src/main.ts
new file mode 100644
index 00000000000..ad5b9c89299
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/src/main.ts
@@ -0,0 +1,15 @@
+// Minimal client entry. The cloudflare-vite-plugin handles the worker
+// runtime separately; this file just satisfies the `index.html` script tag
+// reference so Vite emits a real client bundle.
+//
+// `import.meta.env.VITE_TEST_MARKER` is referenced here so the
+// "Vite: env props" test can verify `Cloudflare.Vite({ env })` actually
+// reaches the client bundle. Vite inlines the value via the `define`
+// hook at build time; the integration test fetches the deployed JS
+// asset and asserts the value is present.
+const marker = (import.meta.env as { VITE_TEST_MARKER?: string })
+  .VITE_TEST_MARKER;
+const el = document.getElementById("app");
+if (el) {
+  el.textContent = `${el.textContent} (hydrated, marker=${marker ?? ""})`;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/src/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/src/worker.ts
new file mode 100644
index 00000000000..10859e02ad8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/src/worker.ts
@@ -0,0 +1,12 @@
+// Minimal worker entry. The cloudflare-vite-plugin wraps this in a
+// virtual module and emits it as the SSR bundle. We delegate to the
+// asset binding (`ASSETS.fetch`) so the actual fixture content (the
+// built `index.html`) is what's served — that's what the test is
+// checking on subsequent deploys.
+type Env = { ASSETS: { fetch: (req: Request) => Promise<Response> } };
+
+export default {
+  fetch(request: Request, env: Env): Promise<Response> {
+    return env.ASSETS.fetch(request);
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/vite.config.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/vite.config.ts
new file mode 100644
index 00000000000..0225f8ea146
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Website/vite-fixture/vite.config.ts
@@ -0,0 +1,19 @@
+import { defineConfig } from "vite";
+
+// `Cloudflare.Vite` declares an `ssr` environment but doesn't set a
+// worker entry by default. For non-framework projects (no React/Vue
+// plugin to inject one), Vite 8 errors out with "rollupOptions.input
+// should not be an html file when building for SSR". We point the SSR
+// build at our minimal worker entry so the cloudflare-vite-plugin can
+// wrap it into the worker bundle.
+export default defineConfig({
+  environments: {
+    ssr: {
+      build: {
+        rollupOptions: {
+          input: "./src/worker.ts",
+        },
+      },
+    },
+  },
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/CronEventSource.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/CronEventSource.test.ts
new file mode 100644
index 00000000000..c5e56b1196f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/CronEventSource.test.ts
@@ -0,0 +1,85 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Alchemy from "@/index.ts";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import CronTestWorker from "./fixtures/cron-worker.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const Stack = Alchemy.Stack(
+  "CronEventSourceStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* CronTestWorker;
+    return {
+      url: worker.url.as<string>(),
+      crons: worker.crons,
+    };
+  }),
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test.skipIf(!!process.env.NO_SLOW_TESTS)(
+  "deployed worker fires the scheduled handler on its cron trigger",
+  Effect.gen(function* () {
+    const { url, crons } = yield* stack;
+    expect(crons).toContain("* * * * *");
+
+    const client = yield* HttpClient.HttpClient;
+
+    // Reset any leftover state from prior runs. Doubles as a readiness probe —
+    // a fresh workers.dev URL can take a few seconds to start serving 200s.
+    yield* Effect.gen(function* () {
+      const res = yield* client.post(`${url}/reset`);
+      if (res.status !== 200) {
+        return yield* Effect.fail(new Error(`Worker not ready: ${res.status}`));
+      }
+    }).pipe(
+      Effect.retry({
+        schedule: Schedule.exponential("500 millis"),
+        times: 10,
+      }),
+    );
+    const resetAt = Date.now();
+
+    // Cloudflare cron granularity is one minute and there's some propagation
+    // delay after deploy, so we poll up to ~3 minutes for the first fire.
+    const times = yield* Effect.gen(function* () {
+      const res = yield* client.get(`${url}/times`);
+      if (res.status !== 200) return [];
+      const body = (yield* res.json) as { times?: unknown };
+      if (!Array.isArray(body.times)) return [];
+      return body.times.filter((t) => t >= resetAt);
+    }).pipe(
+      Effect.catch(() => Effect.succeed([])),
+      Effect.repeat({
+        schedule: Schedule.spaced("5 seconds"),
+        until: (recent) => recent.length > 0,
+        times: 36,
+      }),
+    );
+
+    expect(times.length).toBeGreaterThan(0);
+    for (const t of times) {
+      expect(t).toBeGreaterThanOrEqual(resetAt);
+    }
+  }).pipe(logLevel),
+  { timeout: 300_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/DurableObjectNamespace.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/DurableObjectNamespace.test.ts
new file mode 100644
index 00000000000..7b62a44e86c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/DurableObjectNamespace.test.ts
@@ -0,0 +1,350 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import Stack from "./fixtures/do-rpc/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// Cap exponential backoff at 3s — keeps the fast-path snappy but stops
+// the geometric blow-up (0.5 + 1 + 2 + 4 + 8 + 16 + 32 + 64s ...) that
+// makes retries dominate test wall time when CF edge is slow.
+const readinessSchedule = Schedule.exponential("500 millis").pipe(
+  Schedule.either(Schedule.spaced("3 seconds")),
+);
+
+const readinessRetries = 15;
+
+// The test runtime's HttpClient (FetchHttpClient/undici) keeps HTTP/1.1
+// connections alive and pooled. A pooled connection stays pinned to a single
+// Cloudflare edge metal, so when that metal lags the freshly-deployed version
+// every retry rides the same stale socket and keeps reading the old body for
+// the life of the keep-alive — even though the new version is already live.
+// Forcing `Connection: close` makes each readiness attempt open a fresh
+// connection, letting it land on an edge that has the new version (this is
+// why a brand-new `curl` sees the update immediately while a kept-alive
+// client does not). See do-rpc DurableObjectNamespace test investigation.
+const freshConn = HttpClient.mapRequest(
+  HttpClientRequest.setHeader("connection", "close"),
+);
+
+test(
+  "durable object methods can use binding clients",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* client.post(`${url}/roundtrip`).pipe(
+      Effect.flatMap((res) =>
+        res.status === 200
+          ? Effect.succeed(res)
+          : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+      ),
+      Effect.retry({ schedule: readinessSchedule, times: 15 }),
+    );
+
+    expect(res.status).toBe(200);
+    const body = (yield* res.json) as { value: string };
+    expect(body.value).toBe("ok");
+  }).pipe(logLevel),
+  { timeout: 60_000 },
+);
+
+// Reproduces the `tick` streaming example from the Durable Objects tutorial:
+// https://v2.alchemy.run/tutorial/cloudflare/durable-objects/
+//
+// The DO exposes `tick(n): Stream<number>` and the Worker forwards it to the
+// HTTP response with `HttpServerResponse.stream`. The client reads the body as
+// newline-delimited integers. With `/tick/5` we expect ["0","1","2","3","4"].
+test(
+  "tick streams sequential values from a durable object (tutorial repro)",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = freshConn(yield* HttpClient.HttpClient);
+
+    const lines = yield* client.get(`${url}/tick/5`).pipe(
+      Effect.flatMap((res) =>
+        res.status === 200
+          ? res.stream.pipe(
+              Stream.decodeText,
+              Stream.splitLines,
+              Stream.filter((line) => line.length > 0),
+              Stream.runCollect,
+              Effect.map((chunk) => [...chunk]),
+            )
+          : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+      ),
+      Effect.retry({ schedule: readinessSchedule, times: readinessRetries }),
+    );
+
+    expect(lines).toEqual(["0", "1", "2", "3", "4"]);
+  }).pipe(logLevel),
+  { timeout: 60_000 },
+);
+
+// While a freshly pre-created worker is propagating, Cloudflare's edge
+// serves Alchemy's pre-create stub, which responds 200 with this plain-text
+// body. It is not the real script, so any poll that sees it must retry.
+const DEPLOY_PLACEHOLDER = "Alchemy worker is being deployed...";
+
+// Cloudflare's edge keeps serving the previous worker version (or the
+// pre-create stub) for a while after a (re)deploy, so retrying on 200-only
+// is not enough — the stale version still returns 200 with the old body.
+// Retry until the body matches the expected version string.
+const fetchReady = (url: string, expected: string) =>
+  Effect.gen(function* () {
+    const client = freshConn(yield* HttpClient.HttpClient);
+    return yield* client.get(url).pipe(
+      Effect.flatMap((r) =>
+        r.status === 200
+          ? Effect.flatMap(r.text, (body) =>
+              body === expected
+                ? Effect.succeed(body)
+                : Effect.fail(
+                    new Error(`stale: got ${body}, want ${expected}`),
+                  ),
+            )
+          : Effect.fail(new Error(`Worker not ready: ${r.status}`)),
+      ),
+      Effect.retry({ schedule: readinessSchedule, times: readinessRetries }),
+    );
+  });
+
+const fetchJsonReady = <T>(url: string) =>
+  Effect.gen(function* () {
+    const client = freshConn(yield* HttpClient.HttpClient);
+    return yield* client.get(url).pipe(
+      // Parse the body INSIDE the retry: the pre-create stub answers 200 with
+      // a non-JSON placeholder, so JSON decoding must be part of the readiness
+      // check (a 200 status alone does not mean the real script is live yet).
+      Effect.flatMap((r) =>
+        r.status !== 200
+          ? Effect.fail(new Error(`Worker not ready: ${r.status}`))
+          : Effect.flatMap(r.text, (body) =>
+              body.includes(DEPLOY_PLACEHOLDER)
+                ? Effect.fail(new Error("stale: still deploying"))
+                : Effect.try({
+                    try: () => JSON.parse(body) as T,
+                    catch: () => new Error(`non-json body: ${body}`),
+                  }),
+            ),
+      ),
+      Effect.retry({ schedule: readinessSchedule, times: readinessRetries }),
+    );
+  });
+
+const hostWorkerScript = `import { DurableObject } from "cloudflare:workers";
+export class Counter extends DurableObject {
+  async increment() {
+    const value = (await this.ctx.storage.get("count")) ?? 0;
+    const next = value + 1;
+    await this.ctx.storage.put("count", next);
+    return next;
+  }
+  async reset() {
+    await this.ctx.storage.delete("count");
+  }
+  async get() {
+    return (await this.ctx.storage.get("count")) ?? 0;
+  }
+}
+export default {
+  async fetch(request, env) {
+    const stub = env.Counter.getByName("shared");
+    const url = new URL(request.url);
+    if (url.pathname === "/increment") {
+      return Response.json({ value: await stub.increment() });
+    }
+    if (url.pathname === "/get") {
+      return Response.json({ value: await stub.get() });
+    }
+    if (url.pathname === "/reset") {
+      await stub.reset();
+      return Response.json({ ok: true });
+    }
+    return new Response("Not Found", { status: 404 });
+  },
+};
+`;
+
+const consumerWorkerScript = `export default {
+  async fetch(request, env) {
+    const stub = env.Counter.getByName("shared");
+    const url = new URL(request.url);
+    if (url.pathname === "/increment") {
+      return Response.json({ value: await stub.increment() });
+    }
+    if (url.pathname === "/get") {
+      return Response.json({ value: await stub.get() });
+    }
+    if (url.pathname === "/reset") {
+      await stub.reset();
+      return Response.json({ ok: true });
+    }
+    return new Response("Not Found", { status: 404 });
+  },
+};
+`;
+
+test.provider(
+  "async worker durable object binding accepts scriptName",
+  (scratch) =>
+    Effect.gen(function* () {
+      yield* scratch.deploy(
+        Effect.gen(function* () {
+          return {
+            host: yield* Cloudflare.Worker("host-worker", {
+              script: hostWorkerScript,
+              env: {
+                Counter: Cloudflare.DurableObjectNamespace("Counter"),
+              },
+            }),
+          };
+        }),
+      );
+
+      const deployed = yield* scratch.deploy(
+        Effect.gen(function* () {
+          const host = yield* Cloudflare.Worker("host-worker", {
+            script: hostWorkerScript,
+            env: {
+              Counter: Cloudflare.DurableObjectNamespace("Counter"),
+            },
+          });
+          const consumer = yield* Cloudflare.Worker("consumer-worker", {
+            script: consumerWorkerScript,
+            env: {
+              Counter: Cloudflare.DurableObjectNamespace("Counter", {
+                scriptName: host.workerName,
+              }),
+            },
+          });
+
+          return { consumer, host };
+        }),
+      );
+
+      const reset = yield* fetchJsonReady<{ ok: boolean }>(
+        `${deployed.host.url}/reset`,
+      );
+      expect(reset.ok).toBe(true);
+
+      const first = yield* fetchJsonReady<{ value: number }>(
+        `${deployed.consumer.url}/increment`,
+      );
+      expect(first.value).toBe(1);
+
+      const second = yield* fetchJsonReady<{ value: number }>(
+        `${deployed.host.url}/get`,
+      );
+      expect(second.value).toBe(1);
+
+      yield* scratch.destroy();
+    }).pipe(logLevel),
+  { timeout: 60_000 },
+);
+
+// Walk an async worker through four redeploys against the same scratch state,
+// each one swapping in a new script + bindings shape so we exercise the
+// migration paths `putWorker` relies on:
+//   v1 — create with a single DO class `DO_A`
+//   v2 — rename `DO_A` → `DO_A_v2` (className change, same binding id)
+//   v3 — add a brand-new DO class `DO_B` alongside `DO_A_v2`
+//   v4 — delete `DO_A`, keep only `DO_B`
+test.provider(
+  "durable object class migrations across redeploys",
+  (scratch) =>
+    Effect.gen(function* () {
+      const v1 = yield* scratch.deploy(
+        Effect.gen(function* () {
+          return {
+            worker: yield* Cloudflare.Worker("worker", {
+              script: `import { DurableObject } from "cloudflare:workers";
+export class DO_A extends DurableObject {}
+export default { async fetch() { return new Response("v1"); } };
+`,
+              env: {
+                DO_A: Cloudflare.DurableObjectNamespace("DO_A"),
+              },
+            }),
+          };
+        }),
+      );
+      expect(yield* fetchReady(v1.worker.url!, "v1")).toBe("v1");
+
+      const v2 = yield* scratch.deploy(
+        Effect.gen(function* () {
+          return {
+            worker: yield* Cloudflare.Worker("worker", {
+              script: `import { DurableObject } from "cloudflare:workers";
+export class DO_A_v2 extends DurableObject {}
+export default { async fetch() { return new Response("v2"); } };
+`,
+              env: {
+                DO_A: Cloudflare.DurableObjectNamespace("DO_A", {
+                  className: "DO_A_v2",
+                }),
+              },
+            }),
+          };
+        }),
+      );
+      expect(yield* fetchReady(v2.worker.url!, "v2")).toBe("v2");
+
+      const v3 = yield* scratch.deploy(
+        Effect.gen(function* () {
+          return {
+            worker: yield* Cloudflare.Worker("worker", {
+              script: `import { DurableObject } from "cloudflare:workers";
+export class DO_A_v2 extends DurableObject {}
+export class DO_B extends DurableObject {}
+export default { async fetch() { return new Response("v3"); } };
+`,
+              env: {
+                DO_A: Cloudflare.DurableObjectNamespace("DO_A", {
+                  className: "DO_A_v2",
+                }),
+                DO_B: Cloudflare.DurableObjectNamespace("DO_B"),
+              },
+            }),
+          };
+        }),
+      );
+      expect(yield* fetchReady(v3.worker.url!, "v3")).toBe("v3");
+
+      const v4 = yield* scratch.deploy(
+        Effect.gen(function* () {
+          return {
+            worker: yield* Cloudflare.Worker("worker", {
+              script: `import { DurableObject } from "cloudflare:workers";
+export class DO_B extends DurableObject {}
+export default { async fetch() { return new Response("v4"); } };
+`,
+              env: {
+                DO_B: Cloudflare.DurableObjectNamespace("DO_B"),
+              },
+            }),
+          };
+        }),
+      );
+      expect(yield* fetchReady(v4.worker.url!, "v4")).toBe("v4");
+
+      yield* scratch.destroy();
+    }).pipe(logLevel),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/DynamicWorkerLoader.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/DynamicWorkerLoader.test.ts
new file mode 100644
index 00000000000..fa1b4deaf91
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/DynamicWorkerLoader.test.ts
@@ -0,0 +1,63 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/dynamic-worker-loader/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
+  status: number;
+  body: string;
+}> {}
+
+// Fresh workers.dev URLs serve Cloudflare's placeholder page for a few seconds
+// after deploy. Retry until the worker (and its dynamically-loaded child)
+// answer 200, surfacing the body if not so a real failure isn't masked.
+const readJson = (url: string) =>
+  HttpClient.HttpClient.pipe(
+    Effect.flatMap((client) => client.get(url)),
+    Effect.flatMap((res) =>
+      res.status === 200
+        ? res.json
+        : res.text.pipe(
+            Effect.flatMap((body) =>
+              Effect.fail(new WorkerNotReady({ status: res.status, body })),
+            ),
+          ),
+    ),
+    Effect.retry({
+      while: (e): e is WorkerNotReady => e instanceof WorkerNotReady,
+      schedule: Schedule.exponential("500 millis").pipe(
+        Schedule.both(Schedule.recurs(20)),
+      ),
+    }),
+  );
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "async worker loads and proxies to a dynamic worker via env binding",
+  Effect.gen(function* () {
+    const { asyncWorkerUrl } = yield* stack;
+    const body = yield* readJson(asyncWorkerUrl);
+    expect(body).toMatchObject({ mode: "async", ok: true });
+  }),
+  { timeout: 180_000 },
+);
+
+test(
+  "effect worker loads and proxies to a dynamic worker via yield* loader",
+  Effect.gen(function* () {
+    const { effectWorkerUrl } = yield* stack;
+    const body = yield* readJson(effectWorkerUrl);
+    expect(body).toMatchObject({ mode: "effect", ok: true });
+  }),
+  { timeout: 180_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/HttpApi.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/HttpApi.test.ts
new file mode 100644
index 00000000000..055ca3cf51d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/HttpApi.test.ts
@@ -0,0 +1,225 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type { HttpClientResponse } from "effect/unstable/http/HttpClientResponse";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { TaskApi } from "./fixtures/http-api/api.ts";
+import Stack from "./fixtures/http-api/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const testTimeout = 60_000;
+const burstTimeout = 90_000;
+const requestTimeout = "5 seconds";
+// A fresh Cloudflare deploy is eventually consistent and NOT atomic across
+// edge PoPs: the script, the workers.dev route, and each binding (R2 / D1 /
+// DO namespace + migration) propagate independently. Until they converge,
+// requests landing on a cold PoP return a `404` (route not resolvable) or a
+// `500` (script up, binding not ready). New DO namespaces / D1 databases are
+// the slowest, so the readiness window comfortably exceeds 15s in the tail.
+// Retry on a steady 1.5s cadence for ~30s so every first-touch request rides
+// out the convergence window regardless of which PoP it hits.
+const readinessRetry = {
+  schedule: Schedule.spaced("1500 millis"),
+  times: 20,
+} as const;
+
+const makeClient = (url: string) =>
+  HttpApiClient.make(TaskApi, { baseUrl: url });
+
+// The raw `HttpClient` (used for transport-level CORS checks) does not fail on
+// a non-2xx status, so `Effect.retry` won't fire on the freshly-deployed edge
+// 404/500 window. Explicitly `Effect.fail` non-2xx responses to force the
+// retry (unlike the typed `HttpApiClient`, which already fails on them).
+const requestUntilReady = (
+  effect: Effect.Effect<HttpClientResponse, unknown, never>,
+) =>
+  effect.pipe(
+    Effect.timeout(requestTimeout),
+    Effect.flatMap(
+      Effect.fnUntraced(function* (res) {
+        return res.status >= 200 && res.status < 300
+          ? res
+          : yield* Effect.fail(
+              new Error(`Worker not ready: ${res.status} ${yield* res.text}`),
+            );
+      }),
+    ),
+    Effect.retry(readinessRetry),
+  );
+
+// Gate the deploy on the worker having propagated to the edge: hit both the
+// R2-backed (`createTask`) and DO-backed (`createTaskDO`) paths once, retrying
+// through the freshly-deployed 404 window, then give it extra time to settle
+// across edge PoPs. Individual tests can then call the API directly without
+// each re-implementing a per-request readiness retry.
+const stack = beforeAll(
+  deploy(Stack).pipe(
+    Effect.tap(({ url }) =>
+      Effect.gen(function* () {
+        const client = yield* makeClient(url);
+        yield* client.Tasks.createTask({ payload: { title: "warmup" } }).pipe(
+          Effect.timeout(requestTimeout),
+          Effect.retry(readinessRetry),
+        );
+        yield* client.Tasks.createTaskDO({ payload: { title: "warmup" } }).pipe(
+          Effect.timeout(requestTimeout),
+          Effect.retry(readinessRetry),
+        );
+      }),
+    ),
+    // just give it some extra time to propagate
+    Effect.tap(Effect.sleep("5 seconds")),
+  ),
+);
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "deployed http-api worker handles createTask + getTask via typed HttpApiClient",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    expect(url).toBeTypeOf("string");
+    const client = yield* makeClient(url);
+
+    const created = yield* client.Tasks.createTask({
+      payload: { title: "Write docs" },
+    }).pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+    expect(created.title).toBe("Write docs");
+    expect(created.completed).toBe(false);
+    expect(created.id).toBeTypeOf("string");
+
+    const fetched = yield* client.Tasks.getTask({
+      params: { id: created.id },
+    }).pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+    expect(fetched.id).toBe(created.id);
+    expect(fetched.title).toBe("Write docs");
+
+    // No retry here: `TaskNotFound` is the expected domain result, not a
+    // transient readiness failure — retrying would just re-run the 404.
+    const missing = yield* client.Tasks.getTask({
+      params: { id: "does-not-exist" },
+    }).pipe(Effect.flip);
+    expect(missing._tag).toBe("TaskNotFound");
+    if (missing._tag === "TaskNotFound") {
+      expect(missing.id).toBe("does-not-exist");
+    }
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "cors middleware adds Access-Control-Allow-Origin header on preflight",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    // CORS preflight (OPTIONS) is transport-level and not part of the typed
+    // HttpApi surface, so this single check uses the raw HttpClient.
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* requestUntilReady(
+      client.execute(
+        HttpClientRequest.make("OPTIONS")(url).pipe(
+          HttpClientRequest.setHeaders({
+            Origin: "https://example.com",
+            "Access-Control-Request-Method": "POST",
+            "Access-Control-Request-Headers": "content-type",
+          }),
+        ),
+      ),
+    );
+    expect(res.headers["access-control-allow-origin"]).toBeDefined();
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "cors middleware adds Access-Control-Allow-Origin header on actual requests",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    const res = yield* requestUntilReady(
+      client.execute(
+        HttpClientRequest.post(`${url}/`).pipe(
+          HttpClientRequest.setHeaders({ Origin: "https://example.com" }),
+          HttpClientRequest.bodyJsonUnsafe({ title: "cors-check" }),
+        ),
+      ),
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers["access-control-allow-origin"]).toBeDefined();
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "concurrent createTask survives scope-lifecycle pressure",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* makeClient(url);
+
+    const N = 200;
+    const results = yield* Effect.forEach(
+      Array.from({ length: N }, (_, i) => i),
+      (i) =>
+        Effect.gen(function* () {
+          const created = yield* client.Tasks.createTask({
+            payload: { title: `task-${i}` },
+          }).pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+          if (created.title !== `task-${i}`) {
+            return yield* Effect.fail(
+              new Error(`create ${i} title mismatch: ${created.title}`),
+            );
+          }
+          return created.id;
+        }),
+      { concurrency: 64 },
+    );
+
+    expect(results).toHaveLength(N);
+    expect(new Set(results).size).toBe(N);
+  }).pipe(logLevel),
+  { timeout: burstTimeout },
+);
+
+test(
+  "createTaskDO + getTaskDO round-trip 100x in parallel through the DO HttpApi",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* makeClient(url);
+
+    const N = 100;
+    yield* Effect.forEach(
+      Array.from({ length: N }, (_, i) => i),
+      (i) =>
+        Effect.gen(function* () {
+          const title = `do-task-${i}`;
+          const created = yield* client.Tasks.createTaskDO({
+            payload: { title },
+          }).pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+          expect(created.title).toBe(title);
+          expect(created.completed).toBe(false);
+          expect(created.id).toBeTypeOf("string");
+
+          const fetched = yield* client.Tasks.getTaskDO({
+            params: { id: created.id },
+          }).pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+          expect(fetched.id).toBe(created.id);
+          expect(fetched.title).toBe(title);
+        }),
+      { concurrency: 32 },
+    );
+  }).pipe(logLevel),
+  { timeout: burstTimeout },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Rpc.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Rpc.test.ts
new file mode 100644
index 00000000000..65eff0c6d4e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Rpc.test.ts
@@ -0,0 +1,667 @@
+import {
+  RpcDecodeError,
+  RpcCallError,
+  RpcRemoteStreamError,
+  encodeRpcError,
+  decodeRpcResult,
+  decodeRpcValue,
+  ErrorTag,
+  StreamTag,
+  StreamErrorTag,
+  isRpcErrorEnvelope,
+  isRpcStreamEnvelope,
+  fromRpcReadableStream,
+  fromRpcStreamEnvelope,
+  toRpcStream,
+  makeRpcStub,
+  type RpcErrorEnvelope,
+  type RpcStreamEnvelope,
+} from "@/Cloudflare/Workers/Rpc";
+import { describe, expect, it } from "@effect/vitest";
+import * as Cause from "effect/Cause";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Stream from "effect/Stream";
+
+class MyError extends Data.TaggedError("MyError")<{
+  readonly message: string;
+}> {}
+
+// ---------------------------------------------------------------------------
+// RpcDecodeError
+// ---------------------------------------------------------------------------
+
+describe("RpcDecodeError", () => {
+  it.effect("message delegates to Error.message when cause is an Error", () =>
+    Effect.gen(function* () {
+      const err = new RpcDecodeError({ cause: new Error("inner") });
+      expect(err._tag).toBe("RpcDecodeError");
+      expect(err.message).toBe("inner");
+    }),
+  );
+
+  it.effect("message stringifies non-Error cause", () =>
+    Effect.gen(function* () {
+      const err = new RpcDecodeError({ cause: 42 });
+      expect(err.message).toBe("42");
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// RpcCallError
+// ---------------------------------------------------------------------------
+
+describe("RpcCallError", () => {
+  it.effect("message includes method name and Error.message", () =>
+    Effect.gen(function* () {
+      const err = new RpcCallError({
+        method: "doStuff",
+        cause: new Error("boom"),
+      });
+      expect(err._tag).toBe("RpcCallError");
+      expect(err.message).toBe('RPC call to "doStuff" failed: boom');
+    }),
+  );
+
+  it.effect("message stringifies non-Error cause", () =>
+    Effect.gen(function* () {
+      const err = new RpcCallError({ method: "doStuff", cause: "oops" });
+      expect(err.message).toBe('RPC call to "doStuff" failed: oops');
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// isRpcErrorEnvelope
+// ---------------------------------------------------------------------------
+
+describe("isRpcErrorEnvelope", () => {
+  it.effect("detects valid envelope", () =>
+    Effect.gen(function* () {
+      const envelope: RpcErrorEnvelope = {
+        _tag: ErrorTag,
+        error: { message: "boom" },
+      };
+      expect(isRpcErrorEnvelope(envelope)).toBe(true);
+    }),
+  );
+
+  it.effect("rejects non-envelope values", () =>
+    Effect.gen(function* () {
+      expect(isRpcErrorEnvelope(null)).toBe(false);
+      expect(isRpcErrorEnvelope(undefined)).toBe(false);
+      expect(isRpcErrorEnvelope(42)).toBe(false);
+      expect(isRpcErrorEnvelope("hello")).toBe(false);
+      expect(isRpcErrorEnvelope({ _tag: "Other" })).toBe(false);
+      expect(isRpcErrorEnvelope({ _tag: ErrorTag })).toBe(false);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// isRpcStreamEnvelope
+// ---------------------------------------------------------------------------
+
+describe("isRpcStreamEnvelope", () => {
+  it.effect("detects valid bytes envelope", () =>
+    Effect.gen(function* () {
+      const envelope: RpcStreamEnvelope = {
+        _tag: StreamTag,
+        encoding: "bytes",
+        body: new ReadableStream(),
+      };
+      expect(isRpcStreamEnvelope(envelope)).toBe(true);
+    }),
+  );
+
+  it.effect("detects valid jsonl envelope", () =>
+    Effect.gen(function* () {
+      const envelope: RpcStreamEnvelope = {
+        _tag: StreamTag,
+        encoding: "jsonl",
+        body: new ReadableStream(),
+      };
+      expect(isRpcStreamEnvelope(envelope)).toBe(true);
+    }),
+  );
+
+  it.effect("rejects missing or wrong fields", () =>
+    Effect.gen(function* () {
+      expect(isRpcStreamEnvelope(null)).toBe(false);
+      expect(isRpcStreamEnvelope(42)).toBe(false);
+      expect(isRpcStreamEnvelope({ _tag: StreamTag })).toBe(false);
+      expect(
+        isRpcStreamEnvelope({
+          _tag: StreamTag,
+          encoding: "xml",
+          body: new ReadableStream(),
+        }),
+      ).toBe(false);
+      expect(
+        isRpcStreamEnvelope({
+          _tag: StreamTag,
+          encoding: "jsonl",
+          body: "not a stream",
+        }),
+      ).toBe(false);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// encodeRpcError
+// ---------------------------------------------------------------------------
+
+describe("encodeRpcError", () => {
+  it.effect("preserves tagged error fields", () =>
+    Effect.gen(function* () {
+      const error = new MyError({ message: "BOOF" });
+      const encoded = encodeRpcError(error) as Record<string, unknown>;
+      expect(encoded._tag).toBe("MyError");
+      expect(encoded.message).toBe("BOOF");
+    }),
+  );
+
+  it.effect("normalizes plain Error to name/message/stack", () =>
+    Effect.gen(function* () {
+      const error = new Error("plain failure");
+      const encoded = encodeRpcError(error) as Record<string, unknown>;
+      expect(encoded.name).toBe("Error");
+      expect(encoded.message).toBe("plain failure");
+      expect(encoded.stack).toBeDefined();
+    }),
+  );
+
+  it.effect("passes through primitives", () =>
+    Effect.gen(function* () {
+      expect(encodeRpcError("string error")).toBe("string error");
+      expect(encodeRpcError(42)).toBe(42);
+      expect(encodeRpcError(null)).toBe(null);
+      expect(encodeRpcError(undefined)).toBe(undefined);
+    }),
+  );
+
+  it.effect("passes through plain objects", () =>
+    Effect.gen(function* () {
+      const obj = { code: 404, detail: "not found" };
+      expect(encodeRpcError(obj)).toBe(obj);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// Helper: create a ReadableStream from a string
+// ---------------------------------------------------------------------------
+
+const textToReadableStream = (text: string): ReadableStream<Uint8Array> => {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(text));
+      controller.close();
+    },
+  });
+};
+
+const bytesToReadableStream = (
+  chunks: Uint8Array[],
+): ReadableStream<Uint8Array> =>
+  new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(chunk);
+      }
+      controller.close();
+    },
+  });
+
+// ---------------------------------------------------------------------------
+// fromRpcReadableStream
+// ---------------------------------------------------------------------------
+
+describe("fromRpcReadableStream", () => {
+  it.effect("bytes encoding passes raw Uint8Array chunks through", () =>
+    Effect.gen(function* () {
+      const data = new TextEncoder().encode("hello");
+      const body = bytesToReadableStream([data]);
+      const stream = fromRpcReadableStream(body, "bytes");
+      const chunks = yield* Stream.runCollect(stream);
+      expect(chunks).toEqual([data]);
+    }),
+  );
+
+  it.effect("jsonl encoding parses JSON lines", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream('{"a":1}\n{"b":2}\n');
+      const stream = fromRpcReadableStream(body, "jsonl");
+      const chunks = yield* Stream.runCollect(stream);
+      expect(chunks).toEqual([{ a: 1 }, { b: 2 }]);
+    }),
+  );
+
+  it.effect("jsonl encoding produces RpcDecodeError on malformed JSON", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream("not json\n");
+      const stream = fromRpcReadableStream(body, "jsonl");
+      const exit = yield* Effect.exit(Stream.runCollect(stream));
+      expect(Exit.isFailure(exit)).toBe(true);
+    }),
+  );
+
+  it.effect("jsonl encoding skips empty lines", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream('{"x":1}\n\n\n{"y":2}\n');
+      const stream = fromRpcReadableStream(body, "jsonl");
+      const chunks = yield* Stream.runCollect(stream);
+      expect(chunks).toEqual([{ x: 1 }, { y: 2 }]);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// fromRpcStreamEnvelope
+// ---------------------------------------------------------------------------
+
+describe("fromRpcStreamEnvelope", () => {
+  it.effect("delegates to fromRpcReadableStream", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream('{"v":99}\n');
+      const envelope: RpcStreamEnvelope = {
+        _tag: StreamTag,
+        encoding: "jsonl",
+        body,
+      };
+      const chunks = yield* Stream.runCollect(fromRpcStreamEnvelope(envelope));
+      expect(chunks).toEqual([{ v: 99 }]);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// decodeRpcValue
+// ---------------------------------------------------------------------------
+
+describe("decodeRpcValue", () => {
+  it.effect("passes through plain values", () =>
+    Effect.gen(function* () {
+      expect(decodeRpcValue("hello")).toBe("hello");
+      expect(decodeRpcValue(42)).toBe(42);
+      expect(decodeRpcValue(null)).toBe(null);
+    }),
+  );
+
+  it.effect("converts stream envelope to Effect Stream", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream('{"k":1}\n');
+      const envelope: RpcStreamEnvelope = {
+        _tag: StreamTag,
+        encoding: "jsonl",
+        body,
+      };
+      const result = decodeRpcValue(envelope);
+      expect(Stream.isStream(result)).toBe(true);
+      const chunks = yield* Stream.runCollect(result as Stream.Stream<any>);
+      expect(chunks).toEqual([{ k: 1 }]);
+    }),
+  );
+
+  it.effect("converts bare ReadableStream to bytes Effect Stream", () =>
+    Effect.gen(function* () {
+      const data = new TextEncoder().encode("raw");
+      const body = bytesToReadableStream([data]);
+      const result = decodeRpcValue(body);
+      expect(Stream.isStream(result)).toBe(true);
+      const chunks = yield* Stream.runCollect(result as Stream.Stream<any>);
+      expect(chunks).toEqual([data]);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// decodeRpcResult
+// ---------------------------------------------------------------------------
+
+describe("decodeRpcResult", () => {
+  it.effect("succeeds for plain values", () =>
+    Effect.gen(function* () {
+      const result = yield* decodeRpcResult("hello");
+      expect(result).toBe("hello");
+    }),
+  );
+
+  it.effect("succeeds for numeric values", () =>
+    Effect.gen(function* () {
+      const result = yield* decodeRpcResult(42);
+      expect(result).toBe(42);
+    }),
+  );
+
+  it.effect("fails for error envelopes with tagged error", () =>
+    Effect.gen(function* () {
+      const envelope: RpcErrorEnvelope = {
+        _tag: ErrorTag,
+        error: { _tag: "MyError", message: "BOOF" },
+      };
+      const exit = yield* Effect.exit(decodeRpcResult(envelope));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failReason = exit.cause.reasons.find((r) => r._tag === "Fail");
+        expect(failReason).toBeDefined();
+        const error = (failReason as any).error as Record<string, unknown>;
+        expect(error._tag).toBe("MyError");
+        expect(error.message).toBe("BOOF");
+      }
+    }),
+  );
+
+  it.effect("fails with plain Error shape for error envelopes", () =>
+    Effect.gen(function* () {
+      const envelope: RpcErrorEnvelope = {
+        _tag: ErrorTag,
+        error: { name: "Error", message: "plain failure" },
+      };
+      const exit = yield* Effect.exit(decodeRpcResult(envelope));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failReason = exit.cause.reasons.find((r) => r._tag === "Fail");
+        const error = (failReason as any).error as Record<string, unknown>;
+        expect(error.message).toBe("plain failure");
+      }
+    }),
+  );
+
+  it.effect("wraps stream envelopes in succeed (stream passthrough)", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream('{"s":1}\n');
+      const envelope: RpcStreamEnvelope = {
+        _tag: StreamTag,
+        encoding: "jsonl",
+        body,
+      };
+      const result = yield* decodeRpcResult(envelope);
+      expect(Stream.isStream(result)).toBe(true);
+      const chunks = yield* Stream.runCollect(result as Stream.Stream<any>);
+      expect(chunks).toEqual([{ s: 1 }]);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// toRpcStream
+// ---------------------------------------------------------------------------
+
+describe("toRpcStream", () => {
+  it.effect("selects jsonl encoding for non-byte data", () =>
+    Effect.gen(function* () {
+      const stream = Stream.fromIterable([{ a: 1 }]);
+      const envelope = yield* toRpcStream(stream);
+      expect(envelope._tag).toBe(StreamTag);
+      expect(envelope.encoding).toBe("jsonl");
+      expect(envelope.body).toBeInstanceOf(ReadableStream);
+    }),
+  );
+
+  it.effect("roundtrips a single-element jsonl stream", () =>
+    Effect.gen(function* () {
+      const stream = Stream.fromIterable([{ a: 1 }]);
+      const envelope = yield* toRpcStream(stream);
+      const decoded = fromRpcReadableStream(envelope.body, "jsonl");
+      const chunks = yield* Stream.runCollect(decoded);
+      expect(chunks).toEqual([{ a: 1 }]);
+    }),
+  );
+
+  it.effect("selects bytes encoding for Uint8Array data", () =>
+    Effect.gen(function* () {
+      const data = new Uint8Array([1, 2, 3]);
+      const stream = Stream.fromIterable([data]);
+      const envelope = yield* toRpcStream(stream);
+      expect(envelope._tag).toBe(StreamTag);
+      expect(envelope.encoding).toBe("bytes");
+      expect(envelope.body).toBeInstanceOf(ReadableStream);
+    }),
+  );
+
+  it.effect("roundtrips a single-element bytes stream", () =>
+    Effect.gen(function* () {
+      const data = new Uint8Array([1, 2, 3]);
+      const stream = Stream.fromIterable([data]);
+      const envelope = yield* toRpcStream(stream);
+      const decoded = fromRpcReadableStream(envelope.body, "bytes");
+      const chunks = yield* Stream.runCollect(decoded);
+      expect(chunks).toEqual([data]);
+    }),
+  );
+
+  it.effect("handles empty stream as jsonl", () =>
+    Effect.gen(function* () {
+      const stream = Stream.empty;
+      const envelope = yield* toRpcStream(stream);
+      expect(envelope._tag).toBe(StreamTag);
+      expect(envelope.encoding).toBe("jsonl");
+
+      const decoded = fromRpcReadableStream(envelope.body, envelope.encoding);
+      const chunks = yield* Stream.runCollect(decoded);
+      expect(chunks).toEqual([]);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// makeRpcStub
+// ---------------------------------------------------------------------------
+
+describe("makeRpcStub", () => {
+  it.effect("proxies successful calls", () =>
+    Effect.gen(function* () {
+      const mockStub = {
+        greet: async (name: string) => `hello ${name}`,
+      };
+      const stub = makeRpcStub<{
+        greet: (name: string) => Effect.Effect<string>;
+      }>(mockStub);
+
+      const result = yield* stub.greet("world");
+      expect(result).toBe("hello world");
+    }),
+  );
+
+  it.effect("wraps rejected promises as RpcCallError", () =>
+    Effect.gen(function* () {
+      const mockStub = {
+        boom: async () => {
+          throw new Error("kaboom");
+        },
+      };
+      const stub = makeRpcStub<{
+        boom: () => Effect.Effect<never, RpcCallError>;
+      }>(mockStub);
+
+      const exit = yield* Effect.exit(stub.boom());
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failReason = exit.cause.reasons.find((r) => r._tag === "Fail");
+        expect(failReason).toBeDefined();
+        const error = (failReason as any).error;
+        expect(error._tag).toBe("RpcCallError");
+        expect(error.method).toBe("boom");
+      }
+    }),
+  );
+
+  it.effect("decodes error envelopes into Effect.fail", () =>
+    Effect.gen(function* () {
+      const mockStub = {
+        failMe: async () => ({
+          _tag: ErrorTag,
+          error: { _tag: "MyError", message: "remote fail" },
+        }),
+      };
+      const stub = makeRpcStub<{
+        failMe: () => Effect.Effect<never, { _tag: string; message: string }>;
+      }>(mockStub);
+
+      const exit = yield* Effect.exit(stub.failMe());
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const failReason = exit.cause.reasons.find((r) => r._tag === "Fail");
+        const error = (failReason as any).error as Record<string, unknown>;
+        expect(error._tag).toBe("MyError");
+        expect(error.message).toBe("remote fail");
+      }
+    }),
+  );
+
+  it.effect("decodes stream envelopes from successful calls", () =>
+    Effect.gen(function* () {
+      const body = textToReadableStream('{"n":42}\n');
+      const mockStub = {
+        streamMe: async () => ({
+          _tag: StreamTag,
+          encoding: "jsonl" as const,
+          body,
+        }),
+      };
+      const stub = makeRpcStub<{
+        streamMe: () => Effect.Effect<Stream.Stream<{ n: number }>>;
+      }>(mockStub);
+
+      const stream = yield* stub.streamMe();
+      expect(Stream.isStream(stream)).toBe(true);
+      const chunks = yield* Stream.runCollect(stream);
+      expect(chunks).toEqual([{ n: 42 }]);
+    }),
+  );
+});
+
+// ---------------------------------------------------------------------------
+// Stream error transport
+// ---------------------------------------------------------------------------
+
+describe("stream errors", () => {
+  it.effect("toRpcStream encodes a stream that fails immediately", () =>
+    Effect.gen(function* () {
+      const stream = Stream.fail(new MyError({ message: "immediate" }));
+      const envelope = yield* toRpcStream(stream);
+      expect(envelope._tag).toBe(StreamTag);
+      expect(envelope.encoding).toBe("jsonl");
+
+      const decoded = fromRpcReadableStream(envelope.body, "jsonl");
+      const exit = yield* Effect.exit(Stream.runCollect(decoded));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const reason = exit.cause.reasons.find(Cause.isFailReason);
+        expect(reason).toBeDefined();
+        const err = reason!.error;
+        expect(err).toBeInstanceOf(RpcRemoteStreamError);
+        expect((err as RpcRemoteStreamError).error).toEqual({
+          _tag: "MyError",
+          message: "immediate",
+        });
+      }
+    }),
+  );
+
+  it.effect("toRpcStream encodes a stream that fails after elements", () =>
+    Effect.gen(function* () {
+      const stream = Stream.make(1, 2).pipe(
+        Stream.concat(Stream.fail(new MyError({ message: "mid" }))),
+      );
+      const envelope = yield* toRpcStream(stream);
+      expect(envelope._tag).toBe(StreamTag);
+      expect(envelope.encoding).toBe("jsonl");
+
+      const decoded = fromRpcReadableStream(envelope.body, "jsonl");
+      const exit = yield* Effect.exit(Stream.runCollect(decoded));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const reason = exit.cause.reasons.find(Cause.isFailReason);
+        expect(reason).toBeDefined();
+        const err = reason!.error;
+        expect(err).toBeInstanceOf(RpcRemoteStreamError);
+        expect((err as RpcRemoteStreamError).error).toEqual({
+          _tag: "MyError",
+          message: "mid",
+        });
+      }
+    }),
+  );
+
+  it.effect("fromRpcReadableStream decodes error marker in JSONL", () =>
+    Effect.gen(function* () {
+      const errorLine = JSON.stringify({
+        _tag: StreamErrorTag,
+        error: { _tag: "MyError", message: "wire" },
+      });
+      const body = textToReadableStream(`${errorLine}\n`);
+      const stream = fromRpcReadableStream(body, "jsonl");
+      const exit = yield* Effect.exit(Stream.runCollect(stream));
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const reason = exit.cause.reasons.find(Cause.isFailReason);
+        const err = reason!.error;
+        expect(err).toBeInstanceOf(RpcRemoteStreamError);
+        expect((err as RpcRemoteStreamError).error).toEqual({
+          _tag: "MyError",
+          message: "wire",
+        });
+      }
+    }),
+  );
+
+  it.effect("fromRpcReadableStream yields elements before error marker", () =>
+    Effect.gen(function* () {
+      const errorLine = JSON.stringify({
+        _tag: StreamErrorTag,
+        error: { message: "after elements" },
+      });
+      const body = textToReadableStream(`{"v":1}\n{"v":2}\n${errorLine}\n`);
+      const stream = fromRpcReadableStream(body, "jsonl");
+      const collected: unknown[] = [];
+      const exit = yield* Effect.exit(
+        Stream.runForEach(stream, (item) =>
+          Effect.sync(() => {
+            collected.push(item);
+          }),
+        ),
+      );
+      expect(collected).toEqual([{ v: 1 }, { v: 2 }]);
+      expect(Exit.isFailure(exit)).toBe(true);
+    }),
+  );
+
+  it.effect(
+    "makeRpcStub preserves stream errors (not collapsed to RpcCallError)",
+    () =>
+      Effect.gen(function* () {
+        const errorLine = JSON.stringify({
+          _tag: StreamErrorTag,
+          error: { _tag: "MyError", message: "remote stream err" },
+        });
+        const body = textToReadableStream(`{"n":1}\n${errorLine}\n`);
+        const mockStub = {
+          streamFail: async () => ({
+            _tag: StreamTag,
+            encoding: "jsonl" as const,
+            body,
+          }),
+        };
+        const stub = makeRpcStub<{
+          streamFail: () => Effect.Effect<
+            Stream.Stream<unknown, RpcRemoteStreamError>
+          >;
+        }>(mockStub);
+
+        const stream = yield* stub.streamFail();
+        const exit = yield* Effect.exit(Stream.runCollect(stream));
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const reason = exit.cause.reasons.find(Cause.isFailReason);
+          expect(reason).toBeDefined();
+          expect(reason!.error).toBeInstanceOf(RpcRemoteStreamError);
+        }
+      }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcDurableObjectNamespace.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcDurableObjectNamespace.test.ts
new file mode 100644
index 00000000000..49a465d0129
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcDurableObjectNamespace.test.ts
@@ -0,0 +1,303 @@
+import { expect } from "@effect/vitest";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as RpcClient from "effect/unstable/rpc/RpcClient";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import Stack from "./fixtures/rpc-do-namespace-do-rpc/stack.ts";
+import { WorkerRpcs as RpcWorkerWorkerRpcs } from "./fixtures/rpc-worker-rpc-http/group.ts";
+import RpcWorkerStack from "./fixtures/rpc-worker-rpc-http/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+// Cap exponential backoff at 3s so retries stay bounded when CF edge is
+// slow (otherwise the geometric blow-up dominates wall time).
+const readinessSchedule = Schedule.exponential("500 millis").pipe(
+  Schedule.either(Schedule.spaced("3 seconds")),
+);
+
+// Suffix DO instance ids with a per-process random tag so reruns under
+// `NO_DESTROY=1` don't collide with persisted state from earlier runs
+// (the DO's `count` lives in `state.storage`).
+const runId = Math.random().toString(36).slice(2, 10);
+const k = (name: string) => `${name}-${runId}`;
+
+const resetCounter = (url: string, id: string) =>
+  Effect.gen(function* () {
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+    yield* client
+      .post(`${url}/counter/${id}/reset`)
+      .pipe(Effect.retry({ schedule: readinessSchedule, times: 10 }));
+  });
+
+const rpcClientLayer = (url: string) =>
+  RpcClient.layerProtocolHttp({ url }).pipe(
+    Layer.provide(FetchHttpClient.layer),
+    Layer.provide(
+      Layer.succeed(RpcSerialization.RpcSerialization, RpcSerialization.ndjson),
+    ),
+  );
+
+const readinessRetries = 15;
+
+// The `*DO` RPC handlers forward to the Durable Object via `getByName(...)`.
+// On a freshly-deployed worker the DO-namespace binding hasn't propagated to
+// every Cloudflare edge yet, so the first calls fail with `Worker not found.`.
+// The worker fixture wraps the DO call in `Effect.orDie` / `Stream.orDie`, so
+// that error arrives at the client as a DEFECT — and `Effect.retry` does not
+// retry defects. Promote defects to failures so the readiness retry can absorb
+// the transient binding-propagation error (a genuine bug would simply keep
+// failing until the retry budget is exhausted).
+const retryReadyN =
+  (times: number) =>
+  <A, E, R>(eff: Effect.Effect<A, E, R>) =>
+    eff.pipe(
+      Effect.catchDefect((defect) => Effect.fail(defect)),
+      Effect.retry({ schedule: readinessSchedule, times }),
+    );
+
+const retryReady = retryReadyN(readinessRetries);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// Gate the deploy on the worker→DO binding having propagated to the edge:
+// hit both the unary and streaming `*DO` paths once, retrying through the
+// transient `Worker not found.` window, so individual tests can call the
+// `*DO` RPCs directly without each having to re-implement the readiness retry.
+const rpcWorkerStack = beforeAll(
+  deploy(RpcWorkerStack).pipe(
+    Effect.tap((outputs) =>
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(RpcWorkerWorkerRpcs);
+        yield* c.PingDO({ message: "warmup" }).pipe(retryReady);
+        yield* c.CountDO({ upto: 1 }).pipe(Stream.runCollect, retryReady);
+      }).pipe(Effect.scoped, Effect.provide(rpcClientLayer(outputs.url))),
+    ),
+    // just give it some extra time to propagate
+    Effect.tap(Effect.sleep("5 seconds")),
+  ),
+);
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(RpcWorkerStack));
+
+test(
+  "RpcDurableObjectNamespace: Increment / Get round-trip via Worker",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const alpha = k("alpha");
+    yield* resetCounter(url, alpha);
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const incRes = yield* client.post(`${url}/counter/${alpha}/increment`);
+    expect(incRes.status).toBe(200);
+    const inc = (yield* incRes.json) as { count: number };
+    expect(inc.count).toBe(1);
+
+    yield* client.post(`${url}/counter/${alpha}/increment`);
+    yield* client.post(`${url}/counter/${alpha}/increment`);
+
+    const getRes = yield* client.get(`${url}/counter/${alpha}`);
+    expect(getRes.status).toBe(200);
+    const got = (yield* getRes.json) as { count: number };
+    expect(got.count).toBe(3);
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcDurableObjectNamespace: separate getByName(id) instances are isolated",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const betaId = k("beta");
+    const gammaId = k("gamma");
+    yield* resetCounter(url, betaId);
+    yield* resetCounter(url, gammaId);
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    yield* client.post(`${url}/counter/${betaId}/increment`);
+
+    const beta = (yield* (yield* client.get(`${url}/counter/${betaId}`))
+      .json) as {
+      count: number;
+    };
+    const gamma = (yield* (yield* client.get(`${url}/counter/${gammaId}`))
+      .json) as {
+      count: number;
+    };
+    expect(beta.count).toBe(1);
+    expect(gamma.count).toBe(0);
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcDurableObjectNamespace: streaming RPC via getByName(id).CountUpTo",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const delta = k("delta");
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(`${url}/counter/${delta}/stream?upto=4`)
+      .pipe(Effect.retry({ times: 5 }));
+    expect(res.status).toBe(200);
+    const body = yield* res.text;
+    const lines = body.split("\n").filter((l) => l.length > 0);
+    expect(lines).toEqual(["1", "2", "3", "4"]);
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcWorker + RpcDurableObjectNamespace: Worker proxies *DO RPCs through the typed namespace",
+  Effect.gen(function* () {
+    const { url } = yield* rpcWorkerStack;
+
+    yield* Effect.gen(function* () {
+      const c = yield* RpcClient.make(RpcWorkerWorkerRpcs);
+      const ping = yield* c.Ping({ message: "hi" }).pipe(retryReady);
+      expect(ping.echo).toBe("hi");
+
+      const pingDO = yield* c.PingDO({ message: "via DO" }).pipe(retryReady);
+      expect(pingDO.echo).toBe("via DO");
+    }).pipe(Effect.scoped, Effect.provide(rpcClientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcDurableObjectNamespace: 100 concurrent Increment calls do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const concurrent = k("concurrent");
+    yield* resetCounter(url, concurrent);
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    yield* client.post(`${url}/counter/${concurrent}/increment`);
+
+    const N = 100;
+    const results = yield* Effect.forEach(
+      Array.from({ length: N }, (_, i) => i),
+      () =>
+        client.post(`${url}/counter/${concurrent}/increment`).pipe(
+          Effect.flatMap((res) => res.json),
+          Effect.timeout("10 seconds"),
+          Effect.retry({
+            schedule: readinessSchedule,
+            times: 3,
+          }),
+        ),
+      { concurrency: 32 },
+    );
+
+    expect(results).toHaveLength(N);
+    const finalRes = yield* client.get(`${url}/counter/${concurrent}`);
+    const final = (yield* finalRes.json) as { count: number };
+    expect(final.count).toBe(N + 1);
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcWorker + RpcDurableObjectNamespace: 100 concurrent unary RPCs do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* rpcWorkerStack;
+
+    yield* Effect.gen(function* () {
+      const c = yield* RpcClient.make(RpcWorkerWorkerRpcs);
+
+      const N = 100;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          c.Ping({ message: `m-${i}` }).pipe(
+            Effect.timeout("10 seconds"),
+            Effect.retry({
+              schedule: readinessSchedule,
+              times: 3,
+            }),
+          ),
+        { concurrency: 32 },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i].echo).toBe(`m-${i}`);
+      }
+    }).pipe(Effect.scoped, Effect.provide(rpcClientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcWorker + RpcDurableObjectNamespace: 100 concurrent *DO unary RPCs do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* rpcWorkerStack;
+
+    yield* Effect.gen(function* () {
+      const c = yield* RpcClient.make(RpcWorkerWorkerRpcs);
+
+      const N = 100;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          c
+            .PingDO({ message: `m-${i}` })
+            .pipe(Effect.timeout("10 seconds"), retryReadyN(5)),
+        { concurrency: 16 },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i].echo).toBe(`m-${i}`);
+      }
+    }).pipe(Effect.scoped, Effect.provide(rpcClientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcWorker + RpcDurableObjectNamespace: 100 concurrent streaming *DO RPCs do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* rpcWorkerStack;
+
+    yield* Effect.gen(function* () {
+      const c = yield* RpcClient.make(RpcWorkerWorkerRpcs);
+
+      const N = 100;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          c
+            .CountDO({ upto: 3 + (i % 3) })
+            .pipe(
+              Stream.runCollect,
+              Effect.timeout("10 seconds"),
+              retryReadyN(5),
+            ),
+        { concurrency: 16 },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i]).toEqual(
+          Array.from({ length: 3 + (i % 3) }, (_, n) => n + 1),
+        );
+      }
+    }).pipe(Effect.scoped, Effect.provide(rpcClientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcHttp.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcHttp.test.ts
new file mode 100644
index 00000000000..149926152ce
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcHttp.test.ts
@@ -0,0 +1,297 @@
+import { expect } from "@effect/vitest";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Vitest";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as RpcClient from "effect/unstable/rpc/RpcClient";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import { WorkerRpcs } from "./fixtures/rpc-http/group.ts";
+import Stack from "./fixtures/rpc-http/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(
+  deploy(Stack).pipe(
+    // Ping the Worker to ensure it's ready.
+    // Subsequent calls should succeed without retries.
+    Effect.tap(({ url }) =>
+      Effect.gen(function* () {
+        const client = yield* RpcClient.make(WorkerRpcs);
+        const result = yield* client.Ping({ message: "warmup" }).pipe(
+          Effect.tapError(Console.log),
+          Effect.retry({
+            schedule: Schedule.exponential("500 millis"),
+            times: 5,
+          }),
+        );
+        expect(result.echo).toBe("warmup");
+        expect(result.n).toBeGreaterThan(0);
+      }).pipe(Effect.scoped, Effect.provide(clientLayer(url))),
+    ),
+  ),
+);
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// The Cloudflare Worker fetch adapter (`workersHttpHandler`) currently
+// short-circuits Effect's standard HTTP lifecycle (it manually
+// provides `HttpServerRequest` and converts the response to a web
+// `Response` outside of `HttpEffect.toHandled`). PR #328 reported that
+// this can deadlock `RpcServer.toHttpEffect` under workerd. This test
+// hammers a real deployed Worker exposing an Effect RPC group to
+// surface lifecycle / per-request scope regressions.
+//
+// The `*DO` variants exercise the DO fetch pathway
+// (`DurableObjectBridge.fetch` -> `makeRequestEffect`) via an
+// `RpcClient` constructed inside the Worker handler whose transport
+// is `Cloudflare.toHttpClient(rpcDO.getByName(...))`. This mirrors the
+// HttpApi fixture's `getTaskDO` pattern.
+const clientLayer = (url: string) =>
+  RpcClient.layerProtocolHttp({ url }).pipe(
+    Layer.provide(FetchHttpClient.layer),
+    Layer.provide(
+      Layer.succeed(RpcSerialization.RpcSerialization, RpcSerialization.ndjson),
+    ),
+  );
+
+test(
+  "RpcServer.toHttpEffect: unary RPC response",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    console.log("url:", url);
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+      const result = yield* client
+        .Ping({ message: "hello" })
+        .pipe(Effect.tapError(Console.log));
+      expect(result.echo).toBe("hello");
+      expect(result.n).toBeGreaterThan(0);
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect: streaming RPC response",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+      const values = yield* client.Count({ upto: 5 }).pipe(Stream.runCollect);
+      expect(values).toEqual([1, 2, 3, 4, 5]);
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect: array payload streams response items in order",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+      const messages = ["a", "b", "c", "d"];
+      const values = yield* client.Echo({ messages }).pipe(Stream.runCollect);
+      expect(values).toEqual(
+        messages.map((message, index) => ({ index, message })),
+      );
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect: 200 concurrent unary calls do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+
+      const N = 200;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          client.Ping({ message: `m-${i}` }).pipe(
+            Effect.timeout("5 seconds"),
+            Effect.retry({
+              schedule: Schedule.exponential("500 millis"),
+              times: 3,
+            }),
+          ),
+        { concurrency: 64 },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i].echo).toBe(`m-${i}`);
+      }
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect: concurrent streaming calls do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+
+      const N = 64;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          client.Count({ upto: 3 + (i % 3) }).pipe(
+            Stream.runCollect,
+            Effect.timeout("5 seconds"),
+            Effect.retry({
+              schedule: Schedule.exponential("500 millis"),
+              times: 3,
+            }),
+          ),
+        { concurrency: N },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i]).toEqual(
+          Array.from({ length: 3 + (i % 3) }, (_, n) => n + 1),
+        );
+      }
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+// === Durable Object pathway ===
+// These exercise the Worker's `*DO` handlers, which proxy through an
+// `RpcClient` whose transport is `Cloudflare.toHttpClient(rpcDO.getByName(...))`.
+
+test(
+  "RpcServer.toHttpEffect Durable Object unary RPC response",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+      const result = yield* client
+        .PingDO({ message: "hello-do" })
+        .pipe(Effect.tapError(Console.log));
+      expect(result.echo).toBe("hello-do");
+      expect(result.n).toBeGreaterThan(0);
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect Durable Object streaming RPC response",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+      const values = yield* client.CountDO({ upto: 5 }).pipe(Stream.runCollect);
+      expect(values).toEqual([1, 2, 3, 4, 5]);
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect Durable Object array payload streams response items in order",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+      const messages = ["a", "b", "c", "d"];
+      const values = yield* client.EchoDO({ messages }).pipe(Stream.runCollect);
+      expect(values).toEqual(
+        messages.map((message, index) => ({ index, message })),
+      );
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect Durable Object concurrent unary calls do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+
+      const N = 64;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          client.PingDO({ message: `m-${i}` }).pipe(
+            Effect.timeout("10 seconds"),
+            Effect.retry({
+              schedule: Schedule.exponential("500 millis"),
+              times: 3,
+            }),
+          ),
+        { concurrency: 16 },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i].echo).toBe(`m-${i}`);
+      }
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 60_000 },
+);
+
+test(
+  "RpcServer.toHttpEffect Durable Object concurrent streaming calls do not hang",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(WorkerRpcs);
+
+      const N = 32;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          client.CountDO({ upto: 3 + (i % 3) }).pipe(
+            Stream.runCollect,
+            Effect.timeout("10 seconds"),
+            Effect.retry({
+              schedule: Schedule.exponential("500 millis"),
+              times: 3,
+            }),
+          ),
+        { concurrency: N },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i]).toEqual(
+          Array.from({ length: 3 + (i % 3) }, (_, n) => n + 1),
+        );
+      }
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcWorker.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcWorker.test.ts
new file mode 100644
index 00000000000..a0aff0f3e9b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/RpcWorker.test.ts
@@ -0,0 +1,121 @@
+import { expect } from "@effect/vitest";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Vitest";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as RpcClient from "effect/unstable/rpc/RpcClient";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import { CallerRpcs, TargetRpcs } from "./fixtures/rpc-worker-binding/group.ts";
+import Stack from "./fixtures/rpc-worker-binding/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+// Cap exponential backoff at 3s so retries stay bounded when the CF edge is
+// slow (otherwise the geometric blow-up dominates wall time).
+const readinessSchedule = Schedule.exponential("500 millis").pipe(
+  Schedule.either(Schedule.spaced("3 seconds")),
+);
+
+// The caller worker forwards to the target via the service binding and wraps
+// the call in `Effect.orDie` (see fixtures/caller-worker.ts). On a freshly
+// deployed worker the service binding hasn't propagated to every Cloudflare
+// edge yet, so the first calls fail with `Worker not found.` — which arrives
+// at the client as a DEFECT, and `Effect.retry` does not retry defects.
+// Promote defects to failures so the readiness retry can absorb the transient
+// binding-propagation error (a genuine bug would simply keep failing until the
+// retry budget is exhausted).
+const retryReadyN =
+  (times: number) =>
+  <A, E, R>(eff: Effect.Effect<A, E, R>) =>
+    eff.pipe(
+      Effect.catchDefect((defect) => Effect.fail(defect)),
+      Effect.retry({ schedule: readinessSchedule, times }),
+    );
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+const clientLayer = (url: string) =>
+  RpcClient.layerProtocolHttp({ url }).pipe(
+    Layer.provide(FetchHttpClient.layer),
+    Layer.provide(
+      Layer.succeed(RpcSerialization.RpcSerialization, RpcSerialization.ndjson),
+    ),
+  );
+
+test(
+  "RpcWorker: target worker exposes Greet",
+  Effect.gen(function* () {
+    const { targetUrl } = yield* stack;
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(TargetRpcs);
+      const result = yield* client.Greet({ name: "world" }).pipe(
+        Effect.tapError(Console.log),
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 5,
+        }),
+      );
+      expect(result.greeting).toBe("hello world");
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(targetUrl)));
+  }).pipe(logLevel),
+  { timeout: 60_000 },
+);
+
+test(
+  "RpcWorker.bind: caller proxies through service binding to target",
+  Effect.gen(function* () {
+    const { callerUrl } = yield* stack;
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(CallerRpcs);
+      const result = yield* client
+        .ProxyGreet({ name: "alchemy" })
+        .pipe(Effect.tapError(Console.log), retryReadyN(10));
+      expect(result.greeting).toBe("hello alchemy");
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(callerUrl)));
+  }).pipe(logLevel),
+  { timeout: 60_000 },
+);
+
+test(
+  "RpcWorker.bind: 100 concurrent ProxyGreet calls do not hang",
+  Effect.gen(function* () {
+    const { callerUrl } = yield* stack;
+    yield* Effect.gen(function* () {
+      const client = yield* RpcClient.make(CallerRpcs);
+
+      // Warm the service binding by serially exercising it before the
+      // burst — workerd surfaces "Worker not found" defects until the
+      // target script is fully propagated to the same edge that the
+      // caller worker hits.
+      yield* client.ProxyGreet({ name: "warmup" }).pipe(retryReadyN(10));
+
+      const N = 100;
+      const results = yield* Effect.forEach(
+        Array.from({ length: N }, (_, i) => i),
+        (i) =>
+          client
+            .ProxyGreet({ name: `peer-${i}` })
+            .pipe(Effect.timeout("10 seconds"), retryReadyN(10)),
+        { concurrency: 32 },
+      );
+
+      expect(results).toHaveLength(N);
+      for (let i = 0; i < N; i++) {
+        expect(results[i].greeting).toBe(`hello peer-${i}`);
+      }
+    }).pipe(Effect.scoped, Effect.provide(clientLayer(callerUrl)));
+  }).pipe(logLevel),
+  { timeout: 60_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/TaggedDO.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/TaggedDO.test.ts
new file mode 100644
index 00000000000..6c639a3125f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/TaggedDO.test.ts
@@ -0,0 +1,197 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type { HttpClientResponse } from "effect/unstable/http/HttpClientResponse";
+import Stack from "./fixtures/tagged-do/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+const testTimeout = 20_000;
+const requestTimeout = "5 seconds";
+// Fresh `*.workers.dev` URLs propagate through the edge over a few seconds —
+// the first requests routinely return 404 / 500 before the script is
+// resolvable. `Effect.retry` only fires on Effect failures, not on HTTP
+// status codes, so we explicitly `Effect.fail` non-2xx responses to force a
+// retry through `readinessRetry`.
+const readinessRetry = {
+  schedule: Schedule.exponential("500 millis"),
+  times: 15,
+} as const;
+
+const requestUntilReady = (
+  effect: Effect.Effect<HttpClientResponse, unknown, never>,
+) =>
+  effect.pipe(
+    Effect.timeout(requestTimeout),
+    Effect.flatMap(
+      Effect.fnUntraced(function* (res) {
+        return res.status >= 200 && res.status < 300
+          ? res
+          : yield* Effect.fail(
+              new Error(`Worker not ready: ${res.status} ${yield* res.text}`),
+            );
+      }),
+    ),
+    Effect.retry(readinessRetry),
+  );
+
+// Each test addresses its own DO instance via a unique counter key so the
+// tests are safe to run in parallel. The fixture Workers read this header
+// and forward it as the argument to `counter.getByName(key)`.
+const withCounterKey = (key: string) =>
+  HttpClient.mapRequest(HttpClientRequest.setHeader("x-counter-key", key));
+
+const reset = (url: string) =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    yield* requestUntilReady(client.post(`${url}/reset`));
+  });
+
+test(
+  "D1 counter writes from WorkerA are visible from WorkerB (cross-script DO)",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const client = (yield* HttpClient.HttpClient).pipe(
+      withCounterKey("d1-cross"),
+    );
+
+    yield* reset(urlA).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+    yield* reset(urlB).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+
+    const first = yield* requestUntilReady(client.post(`${urlA}/d1/increment`));
+    expect(first.status).toBe(200);
+    expect((yield* first.json) as { value: number }).toEqual({ value: 1 });
+
+    const second = yield* requestUntilReady(
+      client.post(`${urlA}/d1/increment`),
+    );
+    expect((yield* second.json) as { value: number }).toEqual({ value: 2 });
+
+    const fromB = yield* requestUntilReady(client.get(`${urlB}/d1`));
+    expect(fromB.status).toBe(200);
+    expect((yield* fromB.json) as { value: number }).toEqual({ value: 2 });
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "DO storage counter writes from WorkerA are visible from WorkerB (cross-script DO)",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const client = (yield* HttpClient.HttpClient).pipe(
+      withCounterKey("do-cross"),
+    );
+
+    yield* reset(urlA).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+    yield* reset(urlB).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+
+    const first = yield* requestUntilReady(client.post(`${urlA}/do/increment`));
+    expect(first.status).toBe(200);
+    expect((yield* first.json) as { value: number }).toEqual({ value: 1 });
+
+    const second = yield* requestUntilReady(
+      client.post(`${urlA}/do/increment`),
+    );
+    expect((yield* second.json) as { value: number }).toEqual({ value: 2 });
+
+    const fromB = yield* requestUntilReady(client.get(`${urlB}/do`));
+    expect(fromB.status).toBe(200);
+    expect((yield* fromB.json) as { value: number }).toEqual({ value: 2 });
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "WorkerC hosts its own isolated Counter (writes from A/B are not visible from C)",
+  Effect.gen(function* () {
+    const { urlA, urlB, urlC } = yield* stack;
+    const client = (yield* HttpClient.HttpClient).pipe(
+      withCounterKey("isolation"),
+    );
+
+    yield* reset(urlA).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+    yield* reset(urlB).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+    yield* reset(urlC).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+
+    // Increment via WorkerA and WorkerB (both route to WorkerA's hosted Counter).
+    yield* requestUntilReady(client.post(`${urlA}/do/increment`));
+    yield* requestUntilReady(client.post(`${urlB}/do/increment`));
+
+    const fromA = yield* requestUntilReady(client.get(`${urlA}/do`));
+    expect((yield* fromA.json) as { value: number }).toEqual({ value: 2 });
+
+    // WorkerC hosts its own Counter namespace via `Counter.from(WorkerC)`,
+    // so its DO instance has never been written to.
+    const fromC = yield* requestUntilReady(client.get(`${urlC}/do`));
+    expect((yield* fromC.json) as { value: number }).toEqual({ value: 0 });
+
+    // Writes through WorkerC do not leak back to WorkerA/B either.
+    yield* requestUntilReady(client.post(`${urlC}/do/increment`));
+    yield* requestUntilReady(client.post(`${urlC}/do/increment`));
+    yield* requestUntilReady(client.post(`${urlC}/do/increment`));
+
+    const cAfter = yield* requestUntilReady(client.get(`${urlC}/do`));
+    expect((yield* cAfter.json) as { value: number }).toEqual({ value: 3 });
+
+    const aAfter = yield* requestUntilReady(client.get(`${urlA}/do`));
+    expect((yield* aAfter.json) as { value: number }).toEqual({ value: 2 });
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "Writes from WorkerB are visible from WorkerA (bidirectional cross-script DO)",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const client = (yield* HttpClient.HttpClient).pipe(
+      withCounterKey("bidirectional"),
+    );
+
+    yield* reset(urlA).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+    yield* reset(urlB).pipe(
+      Effect.provideService(HttpClient.HttpClient, client),
+    );
+
+    yield* requestUntilReady(client.post(`${urlB}/d1/increment`));
+    yield* requestUntilReady(client.post(`${urlB}/d1/increment`));
+    yield* requestUntilReady(client.post(`${urlB}/do/increment`));
+
+    const d1FromA = yield* requestUntilReady(client.get(`${urlA}/d1`));
+    const doFromA = yield* requestUntilReady(client.get(`${urlA}/do`));
+
+    expect((yield* d1FromA.json) as { value: number }).toEqual({ value: 2 });
+    expect((yield* doFromA.json) as { value: number }).toEqual({ value: 1 });
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/TaggedRpcDO.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/TaggedRpcDO.test.ts
new file mode 100644
index 00000000000..4ad21a65037
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/TaggedRpcDO.test.ts
@@ -0,0 +1,330 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import type * as Scope from "effect/Scope";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import type { HttpClientResponse } from "effect/unstable/http/HttpClientResponse";
+import * as RpcClient from "effect/unstable/rpc/RpcClient";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import { CounterRpcs } from "./fixtures/tagged-rpc-do/group.ts";
+import Stack from "./fixtures/tagged-rpc-do/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const testTimeout = 30_000;
+const requestTimeout = "5 seconds";
+// Fresh `*.workers.dev` URLs propagate through the edge over a few seconds —
+// the first requests routinely return 404 / 500 before the script is
+// resolvable. `Effect.retry` only fires on Effect failures, not on HTTP
+// status codes, so we explicitly `Effect.fail` non-2xx responses to force a
+// retry through `readinessRetry`.
+// Cap exponential backoff at 3s so cold-start retries stay bounded when
+// CF edge propagation is slow.
+const readinessRetry = {
+  schedule: Schedule.exponential("500 millis").pipe(
+    Schedule.either(Schedule.spaced("3 seconds")),
+  ),
+  times: 15,
+} as const;
+
+const requestUntilReady = (
+  effect: Effect.Effect<HttpClientResponse, unknown, never>,
+) =>
+  effect.pipe(
+    Effect.timeout(requestTimeout),
+    Effect.flatMap(
+      Effect.fnUntraced(function* (res) {
+        return res.status >= 200 && res.status < 300
+          ? res
+          : yield* Effect.fail(
+              new Error(`Worker not ready: ${res.status} ${yield* res.text}`),
+            );
+      }),
+    ),
+    Effect.tapError(Effect.logError),
+    Effect.retry(readinessRetry),
+  );
+
+// Each test addresses its own DO instance via a unique counter key so the
+// tests are safe to run in parallel. WorkerB / WorkerC fixtures read
+// the `x-counter-key` header; WorkerA's RPC takes `key` directly in
+// every payload.
+const withCounterKey = (key: string) =>
+  HttpClient.mapRequest(HttpClientRequest.setHeader("x-counter-key", key));
+
+// Build a typed `RpcClient<CounterRpcs>` against WorkerA's URL.
+// Every call rides through the same JSON edge as the worker.dev URL,
+// so we share the readiness retry below at the test layer.
+const rpcClientLayer = (url: string) =>
+  RpcClient.layerProtocolHttp({ url }).pipe(
+    Layer.provide(FetchHttpClient.layer),
+    Layer.provide(
+      Layer.succeed(RpcSerialization.RpcSerialization, RpcSerialization.ndjson),
+    ),
+  );
+
+// Drive a typed `RpcClient<CounterRpcs>` body against WorkerA's URL.
+// Each call gets its own scope (so the client is freed promptly).
+//
+// NOTE: `withRpcA` deliberately does NOT retry the body. The bodies below
+// perform non-idempotent D1/DO increments, and a body-level retry would
+// re-apply a mutation whose server-side write already committed but whose
+// response failed transiently (the classic "expected 2 to be 1" flake).
+// Readiness is instead handled idempotently: each test runs a retried
+// `resetA`/`resetHttp` first (which also warms the edge), and the `beforeAll`
+// gate below settles propagation before any test runs.
+type RpcRequirements =
+  | RpcClient.Protocol
+  | RpcSerialization.RpcSerialization
+  | Scope.Scope;
+const withRpcA = <A, E, R>(url: string, body: Effect.Effect<A, E, R>) =>
+  body.pipe(
+    Effect.tapError((e) => Effect.logError("withRpcA error", e)),
+    Effect.scoped,
+    Effect.provide(rpcClientLayer(url)),
+  ) as Effect.Effect<A, E, Exclude<R, RpcRequirements>>;
+
+const resetHttp = (url: string, key: string) =>
+  Effect.gen(function* () {
+    const client = (yield* HttpClient.HttpClient).pipe(withCounterKey(key));
+    yield* requestUntilReady(client.post(`${url}/reset`));
+  });
+
+// `reset` is idempotent, so it's safe to retry — this doubles as the
+// per-test readiness gate for WorkerA's RPC edge.
+const resetA = (url: string, key: string) =>
+  withRpcA(
+    url,
+    Effect.gen(function* () {
+      const c = yield* RpcClient.make(CounterRpcs);
+      yield* c.reset({ key });
+    }),
+  ).pipe(Effect.retry(readinessRetry));
+
+// Gate the deploy on all three workers' edges being resolvable (via the
+// idempotent reset path), then let propagation settle, so the non-retried
+// increment bodies below don't race cold-start.
+const stack = beforeAll(
+  deploy(Stack).pipe(
+    Effect.tap(({ urlA, urlB, urlC }) =>
+      Effect.all(
+        [
+          resetA(urlA, "warmup"),
+          resetHttp(urlB, "warmup"),
+          resetHttp(urlC, "warmup"),
+        ],
+        { concurrency: "unbounded" },
+      ),
+    ),
+    // just give it some extra time to propagate
+    Effect.tap(Effect.sleep("5 seconds")),
+  ),
+);
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "RpcWorker WorkerA exposes the same RPC surface as the underlying DO",
+  Effect.gen(function* () {
+    const { urlA, urlB, urlC } = yield* stack;
+    console.log("URLS:", { urlA, urlB, urlC });
+    const key = "rpc-worker-a";
+
+    yield* resetA(urlA, key);
+
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        const first = yield* c.incrementD1({ key });
+        console.log("withRpcA", first);
+        const second = yield* c.incrementD1({ key });
+        const get = yield* c.getD1({ key });
+        expect(first.value).toBe(1);
+        expect(second.value).toBe(2);
+        expect(get.value).toBe(2);
+      }),
+    );
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "D1 counter writes via WorkerA's RPC are visible from WorkerB (cross-script DO)",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const key = "d1-cross";
+
+    yield* resetA(urlA, key);
+    yield* resetHttp(urlB, key);
+
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        const inc1 = yield* c.incrementD1({ key });
+        expect(inc1.value).toBe(1);
+        const inc2 = yield* c.incrementD1({ key });
+        expect(inc2.value).toBe(2);
+      }),
+    );
+
+    const httpClient = (yield* HttpClient.HttpClient).pipe(withCounterKey(key));
+    const fromB = yield* httpClient
+      .get(`${urlB}/d1`)
+      .pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+    expect(fromB.status).toBe(200);
+    expect((yield* fromB.json) as { value: number }).toEqual({ value: 2 });
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "DO storage counter writes via WorkerA's RPC are visible from WorkerB (cross-script DO)",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const key = "do-cross";
+
+    yield* resetA(urlA, key);
+    yield* resetHttp(urlB, key);
+
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        const inc1 = yield* c.incrementDO({ key });
+        expect(inc1.value).toBe(1);
+        const inc2 = yield* c.incrementDO({ key });
+        expect(inc2.value).toBe(2);
+      }),
+    );
+
+    const httpClient = (yield* HttpClient.HttpClient).pipe(withCounterKey(key));
+    const fromB = yield* httpClient
+      .get(`${urlB}/do`)
+      .pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+    expect(fromB.status).toBe(200);
+    expect((yield* fromB.json) as { value: number }).toEqual({ value: 2 });
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "Writes from WorkerB are visible from WorkerA's RPC (bidirectional cross-script DO)",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const key = "bidirectional";
+
+    yield* resetA(urlA, key);
+    yield* resetHttp(urlB, key);
+
+    const httpClient = (yield* HttpClient.HttpClient).pipe(withCounterKey(key));
+    // These increments are non-idempotent: retrying a request whose write
+    // committed but whose response failed would over-count. The `resetHttp`
+    // above (retried) has already warmed WorkerB's edge, so run them once.
+    yield* httpClient
+      .post(`${urlB}/d1/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+    yield* httpClient
+      .post(`${urlB}/d1/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+    yield* httpClient
+      .post(`${urlB}/do/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        const d1 = yield* c.getD1({ key });
+        const dox = yield* c.getDO({ key });
+        expect(d1.value).toBe(2);
+        expect(dox.value).toBe(1);
+      }),
+    );
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
+
+test(
+  "WorkerC hosts its own isolated Counter (writes from A/B are not visible from C)",
+  Effect.gen(function* () {
+    const { urlA, urlB, urlC } = yield* stack;
+    const key = "isolation";
+
+    yield* resetA(urlA, key);
+    yield* resetHttp(urlB, key);
+    yield* resetHttp(urlC, key);
+
+    // Increment via WorkerA (RPC) and WorkerB (HTTP → cross-script DO);
+    // both route to WorkerA's hosted Counter.
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        yield* c.incrementDO({ key });
+      }),
+    );
+
+    const httpClient = (yield* HttpClient.HttpClient).pipe(withCounterKey(key));
+    // Non-idempotent increment — run once (resetHttp above warmed the edge).
+    yield* httpClient
+      .post(`${urlB}/do/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+
+    // WorkerA sees value 2 (its own + WorkerB's cross-script).
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        const fromA = yield* c.getDO({ key });
+        expect(fromA.value).toBe(2);
+      }),
+    );
+
+    // WorkerC hosts its own Counter namespace via `Counter.from(WorkerC)`,
+    // so its DO instance has never been written to.
+    const fromC = yield* httpClient
+      .get(`${urlC}/do`)
+      .pipe(Effect.timeout(requestTimeout), Effect.retry(readinessRetry));
+    expect((yield* fromC.json) as { value: number }).toEqual({ value: 0 });
+
+    // Writes through WorkerC do not leak back to WorkerA either.
+    yield* httpClient
+      .post(`${urlC}/do/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+    yield* httpClient
+      .post(`${urlC}/do/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+    yield* httpClient
+      .post(`${urlC}/do/increment`)
+      .pipe(Effect.timeout(requestTimeout));
+
+    const cAfter = yield* httpClient
+      .get(`${urlC}/do`)
+      .pipe(Effect.timeout(requestTimeout));
+    expect((yield* cAfter.json) as { value: number }).toEqual({ value: 3 });
+
+    yield* withRpcA(
+      urlA,
+      Effect.gen(function* () {
+        const c = yield* RpcClient.make(CounterRpcs);
+        const aAfter = yield* c.getDO({ key });
+        expect(aAfter.value).toBe(2);
+      }),
+    );
+  }).pipe(logLevel),
+  { timeout: testTimeout },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Worker.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Worker.test.ts
new file mode 100644
index 00000000000..0d73d49ac00
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Worker.test.ts
@@ -0,0 +1,863 @@
+import { adopt } from "@/AdoptPolicy";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as R2 from "@/Cloudflare/R2";
+import { Stack } from "@/Stack";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { MinimumLogLevel } from "effect/References";
+import * as pathe from "pathe";
+import { cloneFixture } from "../Utils/Fixture.ts";
+import { expectUrlContains } from "../Utils/Http.ts";
+import {
+  expectWorkerExists,
+  expectWorkersDevPreviews,
+  expectWorkersDevSubdomain,
+  findWorker,
+  getWorkerTags,
+  waitForWorkerToBeDeleted,
+} from "../Utils/Worker.ts";
+import InternalWorker from "./fixtures/internal-worker.ts";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const main = pathe.resolve(import.meta.dirname, "fixtures/worker.ts");
+
+describe.concurrent("Cloudflare.Worker", () => {
+  test.provider("create, update, delete worker", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const s = yield* Stack;
+
+      yield* stack.destroy();
+
+      const worker = yield* stack.deploy(
+        Effect.gen(function* () {
+          yield* R2.R2Bucket("Bucket", {
+            storageClass: "Standard",
+          });
+
+          const worker = yield* Cloudflare.Worker("TestWorker", {
+            main,
+            subdomain: { enabled: true, previewsEnabled: true },
+            compatibility: {
+              date: "2024-01-01",
+            },
+          });
+
+          return worker;
+        }),
+      );
+
+      const actualWorker = yield* findWorker(worker.workerName, accountId);
+      expect(actualWorker?.scriptName).toEqual(worker.workerName);
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        `alchemy:stack:${s.name}`,
+      );
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        `alchemy:stage:${s.stage}`,
+      );
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        "alchemy:id:TestWorker",
+      );
+
+      // Verify the workers.dev subdomain is enabled on Cloudflare
+      // (rather than just trusting the resource's output attributes).
+      expect(worker.url).toBeDefined();
+      const initialSubdomain = yield* workers.getScriptSubdomain({
+        accountId,
+        scriptName: worker.workerName,
+      });
+      expect(initialSubdomain).toEqual({
+        enabled: true,
+        previewsEnabled: true,
+      });
+
+      // Update the worker
+      const updatedWorker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Worker("TestWorker", {
+            main,
+            subdomain: { enabled: true, previewsEnabled: true },
+            compatibility: {
+              date: "2024-01-01",
+            },
+          });
+        }),
+      );
+
+      const actualUpdatedWorker = yield* findWorker(
+        updatedWorker.workerName,
+        accountId,
+      );
+      expect(actualUpdatedWorker?.scriptName).toEqual(updatedWorker.workerName);
+      const actualUpdatedSubdomain = yield* workers.getScriptSubdomain({
+        accountId,
+        scriptName: updatedWorker.workerName,
+      });
+      expect(actualUpdatedSubdomain).toEqual({
+        enabled: true,
+        previewsEnabled: true,
+      });
+
+      yield* stack.destroy();
+
+      yield* waitForWorkerToBeDeleted(worker.workerName, accountId);
+    }).pipe(logLevel),
+  );
+
+  test.provider("create, update, delete worker with assets", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const s = yield* Stack;
+
+      yield* stack.destroy();
+
+      const worker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Worker("TestWorkerWithAssets", {
+            main,
+            assets: pathe.resolve(import.meta.dirname, "assets"),
+            subdomain: { enabled: true, previewsEnabled: true },
+            compatibility: {
+              date: "2024-01-01",
+            },
+          });
+        }),
+      );
+
+      const actualWorker = yield* findWorker(worker.workerName, accountId);
+      expect(actualWorker?.scriptName).toEqual(worker.workerName);
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        `alchemy:stack:${s.name}`,
+      );
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        `alchemy:stage:${s.stage}`,
+      );
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        "alchemy:id:TestWorkerWithAssets",
+      );
+
+      // Verify the worker has assets
+      expect(worker.hash?.assets).toBeDefined();
+
+      // Verify the workers.dev subdomain is enabled on Cloudflare
+      // (rather than just trusting the resource's output attributes).
+      expect(worker.url).toBeDefined();
+      const assetsWorkerSubdomain = yield* workers.getScriptSubdomain({
+        accountId,
+        scriptName: worker.workerName,
+      });
+      expect(assetsWorkerSubdomain).toEqual({
+        enabled: true,
+        previewsEnabled: true,
+      });
+
+      // Update the worker
+      const updatedWorker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Worker("TestWorkerWithAssets", {
+            main,
+            assets: pathe.resolve(import.meta.dirname, "assets"),
+            subdomain: { enabled: true, previewsEnabled: true },
+            compatibility: {
+              date: "2024-01-01",
+            },
+          });
+        }),
+      );
+
+      const actualUpdatedWorker = yield* findWorker(
+        updatedWorker.workerName,
+        accountId,
+      );
+      expect(actualUpdatedWorker?.scriptName).toEqual(updatedWorker.workerName);
+      expect(updatedWorker.hash?.assets).toBeDefined();
+
+      // Final update
+      const finalWorker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Worker("TestWorkerWithAssets", {
+            main,
+            url: true,
+            assets: pathe.resolve(import.meta.dirname, "assets"),
+            subdomain: { enabled: true, previewsEnabled: true },
+            compatibility: {
+              date: "2024-01-01",
+            },
+          });
+        }),
+      );
+
+      yield* stack.destroy();
+
+      yield* waitForWorkerToBeDeleted(finalWorker.workerName, accountId);
+    }).pipe(logLevel),
+  );
+
+  // ─────────────────────────────────────────────────────────────────────
+  // Asset hashing & keepAssets behavior
+  //
+  // `hash.assets` is content-addressed: it must depend only on the bytes
+  // in the directory, not on where the directory lives. The provider
+  // uses that hash to decide whether to upload a fresh manifest or tell
+  // Cloudflare to keep the existing one (`keepAssets: true`). These
+  // tests pin down the user-visible contract:
+  //
+  //   1. Same bytes at a different path → same hash, no re-upload.
+  //   2. Different bytes (any change) → new hash, re-upload.
+  //   3. A worker-only change leaves the asset hash alone, so the
+  //      script update goes out without re-walking the asset tree.
+  //
+  // The "moved path" cases also guard against the regression where state
+  // written by one machine (e.g. a CI runner) recorded an absolute path
+  // that the next machine couldn't open — the deploy used to crash with
+  // `NotFound: FileSystem.readDirectory`.
+  // ─────────────────────────────────────────────────────────────────────
+
+  const assetsFixtureDir = pathe.resolve(import.meta.dirname, "assets");
+
+  test.provider(
+    "Worker assets: relocating to a fresh path with identical bytes preserves hash and keeps assets",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+        const fs = yield* FileSystem.FileSystem;
+
+        yield* stack.destroy();
+
+        const dirA = yield* cloneFixture(assetsFixtureDir, {
+          prefix: "alchemy-worker-assets-a-",
+        });
+        const dirB = yield* cloneFixture(assetsFixtureDir, {
+          prefix: "alchemy-worker-assets-b-",
+        });
+
+        const deploy = (assetsDir: string) =>
+          stack.deploy(
+            Effect.gen(function* () {
+              return yield* Cloudflare.Worker("RelocatedAssets", {
+                main,
+                assets: assetsDir,
+                url: true,
+                subdomain: { enabled: true, previewsEnabled: true },
+                compatibility: { date: "2024-01-01" },
+              });
+            }),
+          );
+
+        const v1 = yield* deploy(dirA);
+        expect(v1.hash?.assets).toBeDefined();
+        yield* expectWorkerExists(v1.workerName, accountId);
+        yield* expectUrlContains(`${v1.url!}/index.html`, "Hello from Worker", {
+          timeout: "120 seconds",
+          label: "v1 served",
+        });
+
+        // Wipe dirA before the second deploy. If anything in the apply
+        // path still tries to read the previously-recorded directory,
+        // this is where we'd fail with NotFound.
+        yield* fs.remove(dirA, { recursive: true });
+
+        const v2 = yield* deploy(dirB);
+
+        // Identical bytes ⇒ identical asset hash ⇒ keepAssets path.
+        expect(v2.hash?.assets).toEqual(v1.hash?.assets);
+        // The script binding stayed live; the URL keeps serving.
+        yield* expectUrlContains(`${v2.url!}/index.html`, "Hello from Worker", {
+          timeout: "60 seconds",
+          label: "v2 served",
+        });
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(v1.workerName, accountId);
+      }).pipe(logLevel),
+    { timeout: 360_000 },
+  );
+
+  test.provider(
+    "Worker assets: editing a file changes the hash and republishes the manifest",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+
+        yield* stack.destroy();
+
+        const dir = yield* cloneFixture(assetsFixtureDir, {
+          prefix: "alchemy-worker-assets-edit-",
+        });
+        const indexPath = path.join(dir, "index.html");
+
+        const v1Marker = `worker-assets-v1-${Date.now()}`;
+        yield* fs.writeFileString(
+          indexPath,
+          `<!doctype html><title>${v1Marker}</title><body>${v1Marker}</body>`,
+        );
+
+        const deploy = () =>
+          stack.deploy(
+            Effect.gen(function* () {
+              return yield* Cloudflare.Worker("EditedAssets", {
+                main,
+                assets: dir,
+                url: true,
+                subdomain: { enabled: true, previewsEnabled: true },
+                compatibility: { date: "2024-01-01" },
+              });
+            }),
+          );
+
+        const v1 = yield* deploy();
+        expect(v1.hash?.assets).toBeDefined();
+        yield* expectUrlContains(`${v1.url!}/index.html`, v1Marker, {
+          timeout: "120 seconds",
+          label: "v1 marker",
+        });
+
+        const v2Marker = `worker-assets-v2-${Date.now()}`;
+        yield* fs.writeFileString(
+          indexPath,
+          `<!doctype html><title>${v2Marker}</title><body>${v2Marker}</body>`,
+        );
+
+        const v2 = yield* deploy();
+        expect(v2.hash?.assets).toBeDefined();
+        expect(v2.hash?.assets).not.toEqual(v1.hash?.assets);
+        yield* expectUrlContains(`${v2.url!}/index.html`, v2Marker, {
+          timeout: "60 seconds",
+          label: "v2 marker",
+        });
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(v1.workerName, accountId);
+      }).pipe(logLevel),
+    { timeout: 360_000 },
+  );
+
+  test.provider(
+    "Worker assets: a bundle-only change keeps the asset manifest (hash.assets stable)",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+
+        yield* stack.destroy();
+
+        const dir = yield* cloneFixture(assetsFixtureDir, {
+          prefix: "alchemy-worker-assets-bundle-only-",
+        });
+        // Write the worker entry into a fresh temp dir so we can edit
+        // it between deploys to force a bundle hash change without
+        // touching the assets directory.
+        const workerDir = yield* fs.makeTempDirectory({
+          prefix: "alchemy-worker-assets-bundle-only-entry-",
+        });
+        const workerPath = path.join(workerDir, "worker.ts");
+        const writeWorker = (marker: string) =>
+          fs.writeFileString(
+            workerPath,
+            `export default {
+    fetch: async () => new Response(${JSON.stringify(`Hello from BundleOnly: ${marker}`)}),
+  };
+  `,
+          );
+
+        const deploy = () =>
+          stack.deploy(
+            Effect.gen(function* () {
+              return yield* Cloudflare.Worker("BundleOnlyChange", {
+                main: workerPath,
+                assets: dir,
+                url: true,
+                subdomain: { enabled: true, previewsEnabled: true },
+                compatibility: { date: "2024-01-01" },
+              });
+            }),
+          );
+
+        yield* writeWorker("v1");
+        const v1 = yield* deploy();
+        expect(v1.hash?.assets).toBeDefined();
+        expect(v1.hash?.bundle).toBeDefined();
+
+        yield* writeWorker("v2");
+        const v2 = yield* deploy();
+        // Bundle changed (worker source edited) → hash.bundle moves.
+        // Assets are byte-identical → hash.assets must not move, and
+        // the keepAssets branch must keep the manifest live.
+        expect(v2.hash?.bundle).not.toEqual(v1.hash?.bundle);
+        expect(v2.hash?.assets).toEqual(v1.hash?.assets);
+        yield* expectUrlContains(`${v2.url!}/index.html`, "Hello from Worker", {
+          timeout: "60 seconds",
+          label: "assets still served after bundle-only change",
+        });
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(v1.workerName, accountId);
+      }).pipe(logLevel),
+    { timeout: 360_000 },
+  );
+
+  test.provider("create, update, delete internal worker", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const s = yield* Stack;
+
+      yield* stack.destroy();
+
+      const worker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* InternalWorker;
+        }),
+      );
+
+      const actualWorker = yield* findWorker(worker.workerName, accountId);
+      expect(actualWorker?.scriptName).toEqual(worker.workerName);
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        `alchemy:stack:${s.name}`,
+      );
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        `alchemy:stage:${s.stage}`,
+      );
+      expect(yield* getWorkerTags(worker.workerName, accountId)).toContain(
+        "alchemy:id:InternalWorker",
+      );
+
+      const updatedWorker = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* InternalWorker;
+        }),
+      );
+
+      expect(updatedWorker.workerName).toEqual(worker.workerName);
+
+      yield* stack.destroy();
+
+      yield* waitForWorkerToBeDeleted(worker.workerName, accountId);
+    }).pipe(logLevel),
+  );
+
+  // ── Engine-level adoption ─────────────────────────────────────────────────
+  //
+  // The engine always calls `provider.read` when there is no prior state, and
+  // routes on the returned shape:
+  //
+  //   - undefined         → resource doesn't exist, drive a normal create
+  //   - plain attrs       → resource exists and is owned by us (Worker
+  //                         determines this from `alchemy:*` tags); silent
+  //                         adoption regardless of `--adopt`
+  //   - `Unowned(attrs)`  → resource exists but the tags don't identify us;
+  //                         the engine fails with `OwnedBySomeoneElse` unless
+  //                         the user opted in via `adopt(true)` / `--adopt`,
+  //                         in which case it's a silent takeover.
+  //
+  // The tests below use `test.provider`'s scratch state so we can wipe state
+  // mid-test while leaving the actual Cloudflare Worker in place — simulating
+  // "the user created/deployed this worker before, but this state store has
+  // never seen it" (e.g. CLI-driven first deploy on a fresh machine, or a
+  // state-store reset).
+
+  test.provider(
+    "owned worker (matching alchemy tags) is silently adopted without --adopt",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+
+        yield* stack.destroy();
+
+        // Use a fixed physical name so the worker's identity persists
+        // across a state-store wipe (otherwise `createWorkerName` would
+        // pick a fresh random suffix on the second deploy and we'd just
+        // be creating a new worker, not adopting).
+        const physicalName = `alchemy-test-owned-adopt-${Math.random()
+          .toString(36)
+          .slice(2, 8)}`;
+
+        // Phase 1: deploy normally so a real Worker exists on Cloudflare,
+        // tagged with this stack/stage/id.
+        const initial = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("AdoptableWorker", {
+              main,
+              name: physicalName,
+              subdomain: { enabled: true, previewsEnabled: true },
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        );
+        expect(initial.workerName).toEqual(physicalName);
+        expect(yield* findWorker(physicalName, accountId)).toBeDefined();
+
+        // Phase 2: wipe local state for this resource — the worker stays on
+        // Cloudflare. From the next deploy's perspective this looks like a
+        // fresh state store that has never seen this resource.
+        yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          yield* state.delete({
+            stack: stack.name,
+            stage: "test",
+            fqn: "AdoptableWorker",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        // Phase 3: redeploy *without* `adopt(true)`. The engine calls
+        // `provider.read`, the Worker's read sees its own alchemy tags and
+        // returns plain (owned) attrs, and the engine silently adopts.
+        // No `--adopt` flag is required.
+        const adopted = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("AdoptableWorker", {
+              main,
+              name: physicalName,
+              subdomain: { enabled: true, previewsEnabled: true },
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        );
+
+        expect(adopted.workerName).toEqual(physicalName);
+
+        const persisted = yield* Effect.gen(function* () {
+          const state = yield* yield* State;
+          return yield* state.get({
+            stack: stack.name,
+            stage: "test",
+            fqn: "AdoptableWorker",
+          });
+        }).pipe(Effect.provide(stack.state));
+
+        expect(persisted?.status).toBeDefined();
+        expect((persisted as any)?.attr).toMatchObject({
+          workerName: physicalName,
+        });
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(physicalName, accountId);
+      }).pipe(logLevel),
+  );
+
+  test.provider("adopt(true) takes over a foreign-tagged worker", (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+
+      yield* stack.destroy();
+
+      // Phase 1: deploy under logical id "Original" with an explicit
+      // physical name. The Cloudflare Worker is now tagged
+      // `alchemy:id:Original` — i.e. owned by *that* logical resource.
+      const physicalName = `alchemy-test-adopt-takeover-${Math.random()
+        .toString(36)
+        .slice(2, 8)}`;
+      const original = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Worker("Original", {
+            main,
+            name: physicalName,
+            subdomain: { enabled: true, previewsEnabled: true },
+            compatibility: { date: "2024-01-01" },
+          });
+        }),
+      );
+      expect(yield* findWorker(original.workerName, accountId)).toBeDefined();
+      expect(yield* getWorkerTags(physicalName, accountId)).toContain(
+        "alchemy:id:Original",
+      );
+
+      // Wipe state for the "Original" entry; the worker stays on Cloudflare.
+      yield* Effect.gen(function* () {
+        const state = yield* yield* State;
+        yield* state.delete({
+          stack: stack.name,
+          stage: "test",
+          fqn: "Original",
+        });
+      }).pipe(Effect.provide(stack.state));
+
+      // Phase 2: redeploy under a *different* logical id with the same
+      // physical name and `adopt(true)`. `Worker.read` returns
+      // `Unowned(attrs)` because the existing tags identify a different
+      // logical id; with adopt enabled the engine takes over and the
+      // follow-up create/update rewrites the tags. (The rejection path
+      // — same scenario without `adopt(true)` — is covered by the unit
+      // tests in `plan.test.ts`.)
+      const takenOver = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("Different", {
+              main,
+              name: physicalName,
+              subdomain: { enabled: true, previewsEnabled: true },
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        )
+        .pipe(adopt(true));
+
+      expect(takenOver.workerName).toEqual(physicalName);
+
+      const newTags = yield* getWorkerTags(physicalName, accountId);
+      expect(newTags).toContain("alchemy:id:Different");
+      expect(newTags).not.toContain("alchemy:id:Original");
+
+      yield* stack.destroy();
+      yield* waitForWorkerToBeDeleted(physicalName, accountId);
+    }).pipe(logLevel),
+  );
+
+  // First-deploy behaviour: the default (omitting `url`) must enable
+  // the workers.dev subdomain, and `url: false` must disable it. Both
+  // are asserted against live Cloudflare state via `getScriptSubdomain`,
+  // not just the resource's output attributes.
+  test.provider(
+    "url defaults to enabling the workers.dev subdomain on first deploy",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+
+        yield* stack.destroy();
+
+        const worker = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("SubdomainDefaultWorker", {
+              main,
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        );
+
+        expect(worker.url).toBeDefined();
+        yield* expectWorkersDevSubdomain(worker.workerName, accountId, true);
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(worker.workerName, accountId);
+      }).pipe(logLevel),
+  );
+
+  test.provider(
+    "url: false disables the workers.dev subdomain on first deploy",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+
+        yield* stack.destroy();
+
+        const worker = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("SubdomainDisabledWorker", {
+              main,
+              url: false,
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        );
+
+        expect(worker.url).toBeUndefined();
+        yield* expectWorkersDevSubdomain(worker.workerName, accountId, false);
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(worker.workerName, accountId);
+      }).pipe(logLevel),
+  );
+
+  // Update regression: toggling `url` between deploys must propagate
+  // to the live Cloudflare subdomain state. Before this regression
+  // was fixed, the reconciler diffed `news.url !== olds.url` and
+  // drove the API call symmetrically — but the new observed-vs-
+  // desired check inside reconcile must still flip the toggle when
+  // props really do change.
+  test.provider(
+    "toggling url between deploys flips the workers.dev subdomain",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+
+        yield* stack.destroy();
+
+        const deploy = (url: boolean) =>
+          stack.deploy(
+            Effect.gen(function* () {
+              return yield* Cloudflare.Worker("SubdomainToggleWorker", {
+                main,
+                url,
+                compatibility: { date: "2024-01-01" },
+              });
+            }),
+          );
+
+        const v1 = yield* deploy(true);
+        expect(v1.url).toBeDefined();
+        yield* expectWorkersDevSubdomain(v1.workerName, accountId, true);
+
+        const v2 = yield* deploy(false);
+        expect(v2.workerName).toEqual(v1.workerName);
+        expect(v2.url).toBeUndefined();
+        yield* expectWorkersDevSubdomain(v2.workerName, accountId, false);
+
+        const v3 = yield* deploy(true);
+        expect(v3.workerName).toEqual(v1.workerName);
+        expect(v3.url).toBeDefined();
+        yield* expectWorkersDevSubdomain(v3.workerName, accountId, true);
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(v1.workerName, accountId);
+      }).pipe(logLevel),
+  );
+
+  // Drift regression: if something external (a previous failed deploy,
+  // a Cloudflare dashboard toggle, the bootstrap path in `loginWithCloudflare`)
+  // leaves the workers.dev subdomain in `enabled: true, previewsEnabled: false`,
+  // a redeploy must observe `previewsEnabled` and flip it back on. The
+  // pre-fix reconciler diffed only `enabled` against desired, so it
+  // skipped the API call and let the drift persist.
+  test.provider(
+    "redeploy re-enables previewsEnabled when externally disabled",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+
+        yield* stack.destroy();
+
+        // Deploy with different compatibility dates to force the update.
+        const deploy = (date: string) =>
+          stack.deploy(
+            Cloudflare.Worker("SubdomainPreviewsDriftWorker", {
+              main,
+              compatibility: { date },
+            }),
+          );
+
+        const v1 = yield* deploy("2026-01-01");
+        yield* expectWorkersDevPreviews(v1.workerName, accountId, {
+          enabled: true,
+          previewsEnabled: true,
+        });
+
+        // Simulate external drift: leave `enabled: true` but turn
+        // `previewsEnabled` off out-of-band.
+        yield* workers.createScriptSubdomain({
+          accountId,
+          scriptName: v1.workerName,
+          enabled: true,
+          previewsEnabled: false,
+        });
+        const drifted = yield* workers.getScriptSubdomain({
+          accountId,
+          scriptName: v1.workerName,
+        });
+        expect(drifted).toEqual({ enabled: true, previewsEnabled: false });
+
+        const v2 = yield* deploy("2026-01-02");
+        expect(v2.workerName).toEqual(v1.workerName);
+        yield* expectWorkersDevPreviews(v2.workerName, accountId, {
+          enabled: true,
+          previewsEnabled: true,
+        });
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(v1.workerName, accountId);
+      }).pipe(logLevel),
+  );
+
+  // `domains` should reflect the workers.dev URL when the subdomain is
+  // enabled and be empty when it isn't. `worker.url` is just `domains[0]`,
+  // so the two must stay in lockstep across deploys.
+  test.provider(
+    "domains reflects the workers.dev subdomain and tracks url",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+
+        yield* stack.destroy();
+
+        const deploy = (url: boolean) =>
+          stack.deploy(
+            Effect.gen(function* () {
+              return yield* Cloudflare.Worker("DomainsWorker", {
+                main,
+                url,
+                compatibility: { date: "2024-01-01" },
+              });
+            }),
+          );
+
+        const enabled = yield* deploy(true);
+        expect(enabled.domains).toHaveLength(1);
+        expect(enabled.domains[0]).toMatch(/\.workers\.dev$/);
+        expect(enabled.url).toEqual(enabled.domains[0]);
+
+        const disabled = yield* deploy(false);
+        expect(disabled.domains).toEqual([]);
+        expect(disabled.url).toBeUndefined();
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(enabled.workerName, accountId);
+      }).pipe(logLevel),
+  );
+
+  // When custom domains are attached, they come first in `domains` (in
+  // the order the user provided them), followed by the workers.dev URL
+  // when the subdomain is enabled. `worker.url` is `domains[0]`, so the
+  // custom domain wins.
+  const customDomainZone = process.env.CLOUDFLARE_TEST_WORKER_DOMAIN_ZONE_NAME;
+  test.provider.skipIf(!customDomainZone)(
+    "domains puts custom domains before workers.dev and url is the first",
+    (stack) =>
+      Effect.gen(function* () {
+        const { accountId } = yield* CloudflareEnvironment;
+        const suffix = process.env.PULL_REQUEST ?? process.env.USER ?? "local";
+        const domainA = `alchemy-worker-a-${suffix}.${customDomainZone}`;
+        const domainB = `alchemy-worker-b-${suffix}.${customDomainZone}`;
+
+        yield* stack.destroy();
+
+        const worker = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("CustomDomainWorker", {
+              main,
+              domain: [domainA, domainB],
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        );
+
+        expect(worker.domains.slice(0, 2)).toEqual([
+          `https://${domainA}`,
+          `https://${domainB}`,
+        ]);
+        expect(worker.domains[2]).toMatch(/\.workers\.dev$/);
+        expect(worker.url).toEqual(`https://${domainA}`);
+
+        // Reorder — `domains[0]` should follow.
+        const swapped = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Worker("CustomDomainWorker", {
+              main,
+              domain: [domainB, domainA],
+              compatibility: { date: "2024-01-01" },
+            });
+          }),
+        );
+        expect(swapped.domains.slice(0, 2)).toEqual([
+          `https://${domainB}`,
+          `https://${domainA}`,
+        ]);
+        expect(swapped.url).toEqual(`https://${domainB}`);
+
+        yield* stack.destroy();
+        yield* waitForWorkerToBeDeleted(worker.workerName, accountId);
+      }).pipe(logLevel),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/WorkerBinding.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/WorkerBinding.test.ts
new file mode 100644
index 00000000000..6ac528137e1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/WorkerBinding.test.ts
@@ -0,0 +1,71 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/worker-worker-binding/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+// Cold-start retry — fresh `workers.dev` URLs take a few seconds to start
+// answering 200, so the very first request rides this schedule.
+const coldStartRetry = Effect.retry({
+  schedule: Schedule.exponential("500 millis").pipe(
+    Schedule.both(Schedule.recurs(20)),
+  ),
+});
+
+test(
+  "target worker's own fetch handler responds",
+  Effect.gen(function* () {
+    const { targetUrl } = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client.get(targetUrl).pipe(coldStartRetry);
+    expect(res.status).toBe(200);
+    expect(yield* res.text).toBe("hello from BindingTargetWorker");
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "async caller can call target's RPC method via service binding",
+  Effect.gen(function* () {
+    const { asyncCallerUrl } = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(`${asyncCallerUrl}/?name=alice`)
+      .pipe(coldStartRetry);
+    expect(res.status).toBe(200);
+    expect(yield* res.text).toBe("hello alice");
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
+
+test(
+  "effect caller can call target's RPC method via bindWorker",
+  Effect.gen(function* () {
+    const { effectCallerUrl } = yield* stack;
+    const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+
+    const res = yield* client
+      .get(`${effectCallerUrl}/?name=bob`)
+      .pipe(coldStartRetry);
+    expect(res.status).toBe(200);
+    expect(yield* res.text).toBe("hello bob");
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/WorkerEnv.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/WorkerEnv.test.ts
new file mode 100644
index 00000000000..453fa5c57b0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/WorkerEnv.test.ts
@@ -0,0 +1,100 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import { expectUrlContains } from "../Utils/Http.ts";
+import Stack from "./fixtures/env/stack.ts";
+
+// Populate process.env before deploy so the worker fixture's
+// `Config.xxx(...)` reads resolve at deploy time (default provider).
+const CONFIG_STR_VALUE = (process.env.CONFIG_STR = "config-string-value");
+const CONFIG_NUM_VALUE = (process.env.CONFIG_NUM = "1234");
+const CONFIG_REDACTED_VALUE = (process.env.CONFIG_REDACTED =
+  "config-redacted-value");
+const CONFIG_REDACTED_INIT_VALUE = (process.env.CONFIG_REDACTED_INIT =
+  "config-redacted-init-value");
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+describe.concurrent("Cloudflare.Worker env bindings", () => {
+  test(
+    "async worker round-trips every supported binding shape",
+    Effect.gen(function* () {
+      const { asyncUrl } = yield* stack;
+      expect(asyncUrl).toBeTypeOf("string");
+      console.log(asyncUrl);
+
+      const body = yield* expectUrlContains(asyncUrl, '"STR":"hello"', {
+        timeout: "60 seconds",
+        label: "async env-worker response",
+      });
+      expect(JSON.parse(body)).toEqual({
+        STR: "hello",
+        NUM: 42,
+        BOOL: true,
+        NULL: null,
+        OBJ: { nested: { value: "ok" }, count: 7 },
+        ARR: [1, 2, 3],
+        SECRET_STR: "shh",
+        SECRET_JSON: { token: "abc", scopes: ["read", "write"] },
+        CONFIG_STR: CONFIG_STR_VALUE,
+        CONFIG_NUM: Number(CONFIG_NUM_VALUE),
+        CONFIG_REDACTED: CONFIG_REDACTED_VALUE,
+      });
+    }).pipe(logLevel),
+  );
+
+  test(
+    "effect worker round-trips env: literals and Redacted via WorkerEnvironment",
+    Effect.gen(function* () {
+      const { effectUrl } = yield* stack;
+
+      const body = yield* expectUrlContains(
+        `${effectUrl}/env`,
+        '"STR":"hello"',
+        { timeout: "60 seconds", label: "effect env-worker /env" },
+      );
+      expect(JSON.parse(body)).toEqual({
+        STR: "hello",
+        NUM: 42,
+        BOOL: true,
+        NULL: null,
+        OBJ: { nested: { value: "ok" }, count: 7 },
+        ARR: [1, 2, 3],
+        SECRET_STR: "shh",
+        SECRET_JSON: { token: "abc", scopes: ["read", "write"] },
+      });
+    }).pipe(logLevel),
+  );
+
+  test(
+    "effect worker round-trips Config.xxx bindings captured in Init",
+    Effect.gen(function* () {
+      const { effectUrl } = yield* stack;
+
+      const body = yield* expectUrlContains(
+        `${effectUrl}/config`,
+        '"CONFIG_STR"',
+        { timeout: "60 seconds", label: "effect env-worker /config" },
+      );
+      expect(JSON.parse(body)).toEqual({
+        CONFIG_STR: CONFIG_STR_VALUE,
+        CONFIG_NUM: Number(CONFIG_NUM_VALUE),
+        CONFIG_REDACTED: CONFIG_REDACTED_VALUE,
+        CONFIG_REDACTED_INIT: CONFIG_REDACTED_INIT_VALUE,
+        CONFIG_REDACTED_INIT_IS_REDACTED: true,
+      });
+    }).pipe(logLevel),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Workflow.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Workflow.test.ts
new file mode 100644
index 00000000000..2d354d7a231
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/Workflow.test.ts
@@ -0,0 +1,103 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "./fixtures/workflow/stack.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const stack = beforeAll(
+  deploy(Stack).pipe(
+    // Let the freshly-deployed worker (and its Workflow binding) settle before
+    // the first run so a step doesn't error mid-propagation.
+    Effect.tap(Effect.sleep("5 seconds")),
+  ),
+);
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+interface WorkflowStatus {
+  status: string;
+  output?: { greeting: string; envBindingCount: number };
+  error?: { message?: string } | null;
+}
+
+// Start a fresh workflow instance and poll until it reaches a terminal state.
+// A transient `errored` during edge/binding propagation fails this effect so
+// the caller can retry with a brand-new instance.
+const runWorkflowToCompletion = (url: string) =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+
+    // Cloudflare's edge takes a few seconds to start serving a fresh
+    // workers.dev URL, so retry until it returns 200 (a fresh URL also
+    // returns 404 transiently, which is not an HTTP error so Effect.retry
+    // does not catch it unless we explicitly fail on non-200).
+    const startRes = yield* client.post(`${url}/workflow/start/world`).pipe(
+      Effect.flatMap((res) =>
+        res.status === 200
+          ? Effect.succeed(res)
+          : Effect.fail(new Error(`Worker not ready: ${res.status}`)),
+      ),
+      Effect.retry({
+        schedule: Schedule.exponential("500 millis"),
+        times: 15,
+      }),
+    );
+    const { instanceId } = (yield* startRes.json) as { instanceId: string };
+    expect(instanceId).toBeTypeOf("string");
+
+    const lastStatus = yield* client
+      .get(`${url}/workflow/status/${instanceId}`)
+      .pipe(
+        Effect.flatMap((res) => res.json),
+        Effect.map((json) => json as unknown as WorkflowStatus),
+        Effect.repeat({
+          schedule: Schedule.spaced("2 seconds"),
+          until: (s) => s.status === "complete" || s.status === "errored",
+          times: 12,
+        }),
+      );
+
+    // Surface a non-complete terminal state as a failure so the outer retry
+    // can take another swing (a fresh worker occasionally errors a step while
+    // its bindings are still propagating).
+    if (lastStatus.status !== "complete") {
+      return yield* Effect.fail(
+        new Error(
+          `workflow ${lastStatus.status}: ${JSON.stringify(lastStatus.error)}`,
+        ),
+      );
+    }
+    return lastStatus;
+  });
+
+test(
+  "deployed worker can run a workflow to completion",
+  Effect.gen(function* () {
+    const out = yield* stack;
+    const url = out.url;
+    expect(url).toBeTypeOf("string");
+
+    const lastStatus = yield* runWorkflowToCompletion(url).pipe(
+      Effect.retry({ schedule: Schedule.spaced("3 seconds"), times: 2 }),
+    );
+
+    expect(lastStatus.status).toBe("complete");
+    expect(lastStatus.error).toBeFalsy();
+    expect(lastStatus.output?.greeting).toBe("Hello, world!");
+    // The body yields `WorkerEnvironment` — if the regression from PR #71 ever
+    // returns, the body dies on the first yield and `output` is undefined.
+    expect(lastStatus.output?.envBindingCount).toBeGreaterThan(0);
+  }).pipe(logLevel),
+  { timeout: 30_000 },
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/assets/index.html b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/assets/index.html
new file mode 100644
index 00000000000..8f35316fe87
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/assets/index.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Test Worker with Assets</title>
+  </head>
+  <body>
+    <h1>Hello from Worker Assets!</h1>
+    <p>This is a test asset file.</p>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/assets/test.txt b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/assets/test.txt
new file mode 100644
index 00000000000..79edbf80d59
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/assets/test.txt
@@ -0,0 +1,3 @@
+This is a test file from assets.
+Version: 1
+
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/cron-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/cron-worker.ts
new file mode 100644
index 00000000000..ddc7c38f488
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/cron-worker.ts
@@ -0,0 +1,73 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Durable Object that records each `scheduledTime` the cron handler sees.
+ * The test polls `snapshot()` via the worker's `GET /times` route to verify
+ * the cron actually fired.
+ */
+export class CronCounter extends Cloudflare.DurableObjectNamespace<CronCounter>()(
+  "CronCounter",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      let times = (yield* state.storage.get<number[]>("times")) ?? [];
+      return {
+        record: Effect.fn(function* (time: number) {
+          times = [...times, time];
+          yield* state.storage.put("times", times);
+        }),
+        snapshot: () => Effect.succeed({ times }),
+        reset: Effect.fn(function* () {
+          times = [];
+          yield* state.storage.put("times", times);
+        }),
+      };
+    });
+  }),
+) {}
+
+/**
+ * Fixture worker for `CronEventSource.test.ts`.
+ *
+ * Cloudflare's minimum cron granularity is one minute, so the trigger is set
+ * to `* * * * *`. Each fire records `controller.scheduledTime` on the
+ * `CronCounter` DO. The test polls `GET /times` until at least one entry
+ * appears (or the timeout expires).
+ */
+export default class CronTestWorker extends Cloudflare.Worker<CronTestWorker>()(
+  "CronTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const counters = yield* CronCounter;
+
+    yield* Cloudflare.cron("* * * * *").subscribe((controller) =>
+      counters.getByName("default").record(controller.scheduledTime),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "GET" && url.pathname === "/times") {
+          const snapshot = yield* counters.getByName("default").snapshot();
+          return yield* HttpServerResponse.json(snapshot);
+        }
+
+        if (request.method === "POST" && url.pathname === "/reset") {
+          yield* counters.getByName("default").reset();
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.CronEventSourceLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/object.ts
new file mode 100644
index 00000000000..7a85b328723
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/object.ts
@@ -0,0 +1,30 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as Stream from "effect/Stream";
+
+const KV = Cloudflare.KVNamespace("DurableObjectWorkerEnvironmentKV", {
+  title: "durable-object-worker-environment-kv",
+});
+
+export class WorkerEnvironmentKVObject extends Cloudflare.DurableObjectNamespace<WorkerEnvironmentKVObject>()(
+  "WorkerEnvironmentKVObject",
+  Effect.gen(function* () {
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.gen(function* () {
+      return {
+        put: (key: string, value: string) => kv.put(key, value),
+        get: (key: string) => kv.get(key),
+        // Mirrors the `tick` example from the tutorial:
+        // https://v2.alchemy.run/tutorial/cloudflare/durable-objects/
+        // An RPC method that returns a Stream of sequential numbers.
+        tick: (n: number) =>
+          Stream.iterate(0, (i) => i + 1).pipe(
+            Stream.take(n),
+            Stream.schedule(Schedule.spaced("100 millis")),
+          ),
+      };
+    });
+  }).pipe(Effect.provide(Cloudflare.KVNamespaceBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/stack.ts
new file mode 100644
index 00000000000..39a98c6ce0a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import DurableObjectWorkerEnvironmentWorker from "./worker.ts";
+
+export default Alchemy.Stack(
+  "DurableObjectWorkerEnvironmentStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* DurableObjectWorkerEnvironmentWorker;
+    return {
+      url: worker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/worker.ts
new file mode 100644
index 00000000000..6885a269dff
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/do-rpc/worker.ts
@@ -0,0 +1,53 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { WorkerEnvironmentKVObject } from "./object.ts";
+
+export default class DurableObjectWorkerEnvironmentWorker extends Cloudflare.Worker<DurableObjectWorkerEnvironmentWorker>()(
+  "DurableObjectWorkerEnvironmentWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const objects = yield* WorkerEnvironmentKVObject;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/roundtrip") {
+          const object = objects.getByName("default");
+          const key = "durable-object-worker-environment";
+          yield* object.put(key, "ok").pipe(Effect.orDie);
+          const value = yield* object.get(key).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        // Mirrors the tutorial's `/tick/:n` route verbatim — forwards the
+        // Stream returned by the DO's `tick` RPC method straight onto the
+        // HTTP response.
+        // https://v2.alchemy.run/tutorial/cloudflare/durable-objects/
+        if (request.method === "GET" && url.pathname.startsWith("/tick/")) {
+          const n = Number(url.pathname.split("/").pop()!);
+          const stream = objects
+            .getByName("tick")
+            .tick(n)
+            .pipe(
+              Stream.map((i) => `${i}\n`),
+              Stream.encodeText,
+            );
+          return HttpServerResponse.stream(stream, {
+            headers: { "content-type": "text/plain" },
+          });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/async-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/async-worker.ts
new file mode 100644
index 00000000000..7aa9f1125d5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/async-worker.ts
@@ -0,0 +1,25 @@
+import type { AsyncWorkerEnv } from "./stack.ts";
+
+/**
+ * Async (non-Effect) Worker fixture for the Worker Loader binding declared via
+ * `env: { LOADER: Cloudflare.DynamicWorkerLoader() }`. `InferEnv` maps the
+ * marker to the native `worker_loader` binding, so the handler calls
+ * `env.LOADER.load(...).getEntrypoint().fetch(...)` directly.
+ */
+export default {
+  async fetch(request: Request, env: AsyncWorkerEnv): Promise<Response> {
+    const worker = env.LOADER.load({
+      compatibilityDate: "2026-01-28",
+      mainModule: "worker.js",
+      modules: {
+        "worker.js": `export default {
+          async fetch() {
+            return Response.json({ mode: "async", ok: true });
+          }
+        }`,
+      },
+    });
+
+    return worker.getEntrypoint().fetch(request);
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/effect-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/effect-worker.ts
new file mode 100644
index 00000000000..e8fb83d5c42
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/effect-worker.ts
@@ -0,0 +1,41 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+
+/**
+ * Effect-native Worker fixture for the Worker Loader binding. Yielding
+ * `Cloudflare.DynamicWorkerLoader(name)` during Init registers the
+ * `worker_loader` binding on this Worker and returns the runtime handle in one
+ * step — no separate `.bind(...)`. The fetch handler loads an isolated dynamic
+ * Worker from inline source and proxies the request to it over Effect-native
+ * HTTP.
+ */
+export default class DynamicLoaderEffectWorker extends Cloudflare.Worker<DynamicLoaderEffectWorker>()(
+  "DynamicLoaderEffectWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const loader = yield* Cloudflare.DynamicWorkerLoader("LOADER");
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        const worker = loader.load({
+          compatibilityDate: "2026-01-28",
+          mainModule: "worker.js",
+          modules: {
+            "worker.js": `export default {
+              async fetch() {
+                return Response.json({ mode: "effect", ok: true });
+              }
+            }`,
+          },
+        });
+
+        return yield* worker.fetch(request).pipe(Effect.orDie);
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/stack.ts
new file mode 100644
index 00000000000..c462387e84b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/dynamic-worker-loader/stack.ts
@@ -0,0 +1,31 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as pathe from "pathe";
+import DynamicLoaderEffectWorker from "./effect-worker.ts";
+
+export const AsyncWorker = Cloudflare.Worker("DynamicLoaderAsyncWorker", {
+  main: pathe.resolve(import.meta.dirname, "async-worker.ts"),
+  env: {
+    LOADER: Cloudflare.DynamicWorkerLoader(),
+  },
+});
+
+export type AsyncWorkerEnv = Cloudflare.InferEnv<typeof AsyncWorker>;
+
+export default Alchemy.Stack(
+  "DynamicWorkerLoaderStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const asyncWorker = yield* AsyncWorker;
+    const effectWorker = yield* DynamicLoaderEffectWorker;
+
+    return {
+      asyncWorkerUrl: asyncWorker.url.as<string>(),
+      effectWorkerUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/async.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/async.ts
new file mode 100644
index 00000000000..16a6ccbc8cc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/async.ts
@@ -0,0 +1,32 @@
+import type { AsyncWorkerEnv } from "./stack.ts";
+
+// Async (non-Effect) Worker handler that echoes its env bindings back as
+// JSON so the test can assert that every supported `WorkerBindingResource`
+// shape (string, number, boolean, null, array, object, Redacted<string>,
+// Redacted<Json>, Config<string>, Config<number>) round-trips end-to-end.
+export default {
+  fetch: async (_request: Request, env: AsyncWorkerEnv) => {
+    return new Response(
+      JSON.stringify({
+        STR: env.STR,
+        NUM: env.NUM,
+        BOOL: env.BOOL,
+        NULL: env.NULL,
+        OBJ: env.OBJ,
+        ARR: env.ARR,
+        SECRET_STR: env.SECRET_STR,
+        // Redacted<Json> is JSON-stringified into secret_text on the way in,
+        // so the async runtime sees a string here. Parse it back so the
+        // test can compare the structured value.
+        SECRET_JSON:
+          typeof env.SECRET_JSON === "string"
+            ? JSON.parse(env.SECRET_JSON)
+            : env.SECRET_JSON,
+        CONFIG_STR: env.CONFIG_STR,
+        CONFIG_NUM: env.CONFIG_NUM,
+        CONFIG_REDACTED: env.CONFIG_REDACTED,
+      }),
+      { headers: { "content-type": "application/json" } },
+    );
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/effect.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/effect.ts
new file mode 100644
index 00000000000..3a546e5066e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/effect.ts
@@ -0,0 +1,82 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Effect-native Worker fixture that exercises every supported
+ * `WorkerBindingResource` shape and echoes the resolved values back as
+ * JSON so the test can assert the deploy → runtime round-trip.
+ *
+ * Mixes the two declaration styles:
+ *   - `env: { ... }` literal/Redacted/Config values declared on the
+ *     resource (resolved via `WorkerEnvironment` at runtime).
+ *   - `yield* Config.xxx(...)` resolved during Init — Alchemy captures
+ *     the binding automatically and the same `Config` re-resolves from
+ *     the binding at runtime.
+ */
+export default class EnvEffectWorker extends Cloudflare.Worker<EnvEffectWorker>()(
+  "EnvEffectWorker",
+  {
+    main: import.meta.filename,
+    env: {
+      STR: "hello",
+      NUM: 42,
+      BOOL: true,
+      NULL: null,
+      OBJ: { nested: { value: "ok" }, count: 7 },
+      ARR: [1, 2, 3],
+      SECRET_STR: Redacted.make("shh"),
+      SECRET_JSON: Redacted.make({ token: "abc", scopes: ["read", "write"] }),
+      // Config declared statically on `env` — Alchemy resolves at deploy
+      // time and binds it as `secret_text` on the Worker.
+      CONFIG_REDACTED: Config.redacted("CONFIG_REDACTED"),
+    },
+  },
+  Effect.gen(function* () {
+    // Captured during Init — Alchemy binds these onto the Worker and the
+    // runtime ConfigProvider (backed by `env`) re-resolves them here.
+    const configStr = yield* Config.string("CONFIG_STR");
+    const configNum = yield* Config.number("CONFIG_NUM");
+    const configRedactedInit = yield* Config.redacted("CONFIG_REDACTED_INIT");
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const env = yield* Cloudflare.WorkerEnvironment;
+        const pathname = new URL(request.originalUrl).pathname;
+
+        if (pathname === "/env") {
+          return yield* HttpServerResponse.json({
+            STR: env.STR,
+            NUM: env.NUM,
+            BOOL: env.BOOL,
+            NULL: env.NULL,
+            OBJ: env.OBJ,
+            ARR: env.ARR,
+            SECRET_STR: env.SECRET_STR,
+            SECRET_JSON:
+              typeof env.SECRET_JSON === "string"
+                ? JSON.parse(env.SECRET_JSON)
+                : env.SECRET_JSON,
+          });
+        }
+
+        if (pathname === "/config") {
+          return yield* HttpServerResponse.json({
+            CONFIG_STR: configStr,
+            CONFIG_NUM: configNum,
+            CONFIG_REDACTED: env.CONFIG_REDACTED,
+            CONFIG_REDACTED_INIT: Redacted.value(configRedactedInit),
+            CONFIG_REDACTED_INIT_IS_REDACTED:
+              Redacted.isRedacted(configRedactedInit),
+          });
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/stack.ts
new file mode 100644
index 00000000000..ce9978a8837
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/env/stack.ts
@@ -0,0 +1,47 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as path from "pathe";
+import EnvEffectWorker from "./effect.ts";
+
+export type AsyncWorkerEnv = Cloudflare.InferEnv<typeof AsyncWorker>;
+
+export const AsyncWorker = Cloudflare.Worker("EnvAsyncWorker", {
+  main: path.resolve(import.meta.dirname, "async.ts"),
+  url: true,
+  env: {
+    STR: "hello",
+    NUM: 42,
+    BOOL: true,
+    NULL: null,
+    OBJ: { nested: { value: "ok" }, count: 7 },
+    ARR: [1, 2, 3],
+    SECRET_STR: Redacted.make("shh"),
+    SECRET_JSON: Redacted.make({
+      token: "abc",
+      scopes: ["read", "write"],
+    }),
+    CONFIG_STR: Config.string("CONFIG_STR"),
+    CONFIG_NUM: Config.number("CONFIG_NUM"),
+    CONFIG_REDACTED: Config.redacted("CONFIG_REDACTED"),
+  },
+});
+
+export default Alchemy.Stack(
+  "WorkerEnvTestStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const asyncWorker = yield* AsyncWorker;
+    const effectWorker = yield* EnvEffectWorker;
+
+    return {
+      asyncUrl: asyncWorker.url.as<string>(),
+      effectUrl: effectWorker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/api.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/api.ts
new file mode 100644
index 00000000000..6424328b919
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/api.ts
@@ -0,0 +1,58 @@
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
+export class Task extends Schema.Class<Task>("Task")({
+  id: Schema.String,
+  title: Schema.String,
+  completed: Schema.Boolean,
+}) {}
+
+export const decodeTask = Schema.decodeUnknownEffect(Task);
+
+export const encodeTask = Schema.encodeUnknownSync(Task);
+
+export class TaskNotFound extends Schema.TaggedErrorClass<TaskNotFound>()(
+  "TaskNotFound",
+  { id: Schema.String },
+  { httpApiStatus: 404 },
+) {}
+
+const TaskParams = Schema.Struct({
+  id: Schema.String,
+});
+
+export const getTask = HttpApiEndpoint.get("getTask", "/:id", {
+  params: TaskParams,
+  success: Task,
+  error: TaskNotFound,
+});
+
+export const createTask = HttpApiEndpoint.post("createTask", "/", {
+  success: Task,
+  payload: Schema.Struct({
+    title: Schema.String,
+  }),
+});
+
+const getTaskDO = HttpApiEndpoint.get("getTaskDO", "/do/:id", {
+  params: TaskParams,
+  success: Task,
+  error: TaskNotFound,
+});
+
+const createTaskDO = HttpApiEndpoint.post("createTaskDO", "/do", {
+  success: Task,
+  payload: Schema.Struct({
+    title: Schema.String,
+  }),
+});
+
+export class TasksGroup extends HttpApiGroup.make("Tasks")
+  .add(getTask)
+  .add(createTask)
+  .add(getTaskDO)
+  .add(createTaskDO) {}
+
+export class TaskApi extends HttpApi.make("TaskApi").add(TasksGroup) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/object.ts
new file mode 100644
index 00000000000..402ebf7cf27
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/object.ts
@@ -0,0 +1,59 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Layer } from "effect";
+import * as Effect from "effect/Effect";
+import { HttpRouter } from "effect/unstable/http";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
+import { createTask, decodeTask, encodeTask, getTask, Task } from "./api.ts";
+
+export class TasksDOGroup extends HttpApiGroup.make("TasksDO")
+  .add(getTask)
+  .add(createTask) {}
+
+export class TaskDOApi extends HttpApi.make("TaskDOApi").add(TasksDOGroup) {}
+
+/**
+ * Durable Object backing the `createTaskDO` / `getTaskDO` endpoints.
+ * Persists tasks in the DO's transactional storage and exposes simple
+ * RPC methods that the Worker calls from its HttpApi handlers.
+ */
+export default class TasksObject extends Cloudflare.DurableObjectNamespace<TasksObject>()(
+  "TasksObject",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      const tasksGroup = HttpApiBuilder.group(
+        TaskDOApi,
+        "TasksDO",
+        (handlers) =>
+          handlers
+            .handle("getTask", ({ params }) =>
+              state.storage
+                .get<Task>(params.id)
+                .pipe(Effect.flatMap(decodeTask), Effect.orDie),
+            )
+            .handle("createTask", ({ payload }) => {
+              const id = crypto.randomUUID();
+              const task = new Task({
+                id,
+                title: payload.title,
+                completed: false,
+              });
+              return state.storage
+                .put(id, encodeTask(task))
+                .pipe(Effect.as(task));
+            }),
+      );
+
+      return {
+        fetch: HttpApiBuilder.layer(TaskDOApi).pipe(
+          Layer.provide(tasksGroup),
+          HttpRouter.toHttpEffect,
+        ),
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/stack.ts
new file mode 100644
index 00000000000..6011385a02b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import HttpApiTestWorker from "./worker.ts";
+
+export default Alchemy.Stack(
+  "HttpApiTestStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* HttpApiTestWorker;
+    return {
+      url: worker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/worker.ts
new file mode 100644
index 00000000000..7040384078f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/http-api/worker.ts
@@ -0,0 +1,100 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { decodeTask, Task, TaskApi, TaskNotFound } from "./api.ts";
+import TasksObject, { TaskDOApi } from "./object.ts";
+
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+  fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+  fileWebResponse: () =>
+    Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+
+const corsLayer = HttpRouter.cors({
+  allowedOrigins: ["*"],
+  allowedMethods: ["GET", "POST", "OPTIONS"],
+  allowedHeaders: ["Content-Type"],
+});
+
+const Bucket = Cloudflare.R2Bucket("Tasks");
+
+export default class HttpApiTestWorker extends Cloudflare.Worker<HttpApiTestWorker>()(
+  "HttpApiTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Bucket);
+    const tasksDO = yield* TasksObject;
+
+    const getTaskDO = (id: string = "default") =>
+      HttpApiClient.makeWith(TaskDOApi, {
+        baseUrl: `http://localhost`,
+        httpClient: Cloudflare.toHttpClient(tasksDO.getByName(id)),
+      });
+
+    const tasksGroup = HttpApiBuilder.group(TaskApi, "Tasks", (handlers) =>
+      handlers
+        .handle("getTask", ({ params }) =>
+          tasks.get(params.id).pipe(
+            Effect.orDie,
+            Effect.flatMap((data) =>
+              data
+                ? data.text().pipe(
+                    Effect.map((data) => JSON.parse(data)),
+                    Effect.orDie,
+                  )
+                : Effect.succeed(undefined),
+            ),
+            Effect.flatMap((data) =>
+              data
+                ? decodeTask(data).pipe(Effect.orDie)
+                : Effect.fail(new TaskNotFound({ id: params.id })),
+            ),
+            Effect.tapError((err) => Effect.logError("err", err)),
+          ),
+        )
+        .handle("createTask", ({ payload }) => {
+          const task = new Task({
+            id: crypto.randomUUID(),
+            title: payload.title,
+            completed: false,
+          });
+          return tasks
+            .put(task.id, JSON.stringify(task))
+            .pipe(Effect.orDie, Effect.as(task));
+        })
+        .handle("getTaskDO", ({ params }) =>
+          getTaskDO().pipe(
+            Effect.flatMap((client) =>
+              client.TasksDO.getTask({ params }).pipe(Effect.orDie),
+            ),
+          ),
+        )
+        .handle("createTaskDO", ({ payload }) =>
+          getTaskDO().pipe(
+            Effect.flatMap((client) =>
+              client.TasksDO.createTask({ payload }).pipe(Effect.orDie),
+            ),
+          ),
+        ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(TaskApi).pipe(
+        Layer.provide(tasksGroup),
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]),
+        Layer.provide(corsLayer),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/internal-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/internal-worker.ts
new file mode 100644
index 00000000000..3b73658f0ca
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/internal-worker.ts
@@ -0,0 +1,19 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default class InternalWorker extends Cloudflare.Worker<InternalWorker>()(
+  "InternalWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello from InternalWorker", {
+          status: 200,
+        });
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/group.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/group.ts
new file mode 100644
index 00000000000..c3c70efd4cb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/group.ts
@@ -0,0 +1,28 @@
+import * as Schema from "effect/Schema";
+import * as Rpc from "effect/unstable/rpc/Rpc";
+import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+import * as RpcSchema from "effect/unstable/rpc/RpcSchema";
+
+/**
+ * Procedures served on each {@link RpcDurableObjectNamespace} instance.
+ * The DO instance *is* the session, so payloads don't include a per-
+ * session id — the keying happens at `getByName(...)`.
+ */
+export class CounterRpcs extends RpcGroup.make(
+  Rpc.make("Increment", {
+    payload: {},
+    success: Schema.Struct({ count: Schema.Number }),
+  }),
+  Rpc.make("Get", {
+    payload: {},
+    success: Schema.Struct({ count: Schema.Number }),
+  }),
+  Rpc.make("CountUpTo", {
+    payload: { upto: Schema.Number },
+    success: RpcSchema.Stream(Schema.Number, Schema.Never),
+  }),
+  Rpc.make("Reset", {
+    payload: {},
+    success: Schema.Void,
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/object.ts
new file mode 100644
index 00000000000..b5851936c14
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/object.ts
@@ -0,0 +1,47 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { CounterRpcs } from "./group.ts";
+
+/**
+ * Typed counter Durable Object built on
+ * {@link Cloudflare.RpcDurableObjectNamespace}. Persists `count` in
+ * `state.storage` and serves `Increment` / `Get` / `CountUpTo` over
+ * an `RpcServer.toHttpEffect(group)` on the DO's `fetch`.
+ */
+export default class RpcCounterObject extends Cloudflare.RpcDurableObjectNamespace<RpcCounterObject>()(
+  "RpcCounterObject",
+  { schema: CounterRpcs },
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      let count = (yield* state.storage.get<number>("count")) ?? 0;
+
+      const handlers = CounterRpcs.toLayer({
+        Increment: () =>
+          Effect.gen(function* () {
+            count += 1;
+            yield* state.storage.put("count", count);
+            return { count };
+          }),
+        Get: () => Effect.succeed({ count }),
+        CountUpTo: ({ upto }) =>
+          Stream.fromIterable(
+            Array.from({ length: Math.max(0, upto) }, (_, i) => i + 1),
+          ),
+        Reset: () =>
+          Effect.gen(function* () {
+            count = 0;
+            yield* state.storage.put("count", 0);
+          }),
+      });
+
+      return RpcServer.toHttpEffect(CounterRpcs).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+      );
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/stack.ts
new file mode 100644
index 00000000000..b477186647a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/stack.ts
@@ -0,0 +1,21 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import RpcCounterWorker from "./worker.ts";
+
+/**
+ * Stack with one Worker driving an
+ * {@link Cloudflare.RpcDurableObjectNamespace} counter via the typed
+ * `getByName(id)` client.
+ */
+export default Alchemy.Stack(
+  "RpcDurableObjectNamespaceStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* RpcCounterWorker;
+    return { url: worker.url.as<string>() };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/worker.ts
new file mode 100644
index 00000000000..b26e29a825a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-do-namespace-do-rpc/worker.ts
@@ -0,0 +1,70 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import RpcCounterObject from "./object.ts";
+
+/**
+ * Plain {@link Cloudflare.Worker} that drives the
+ * {@link RpcCounterObject} via the typed `getByName(id)` client returned
+ * from {@link Cloudflare.RpcDurableObjectNamespace}. Each route maps to
+ * one RPC, so the integ test can assert the round-trip end to end:
+ *
+ * - `POST /counter/:id/increment` → `Increment`
+ * - `GET  /counter/:id`           → `Get`
+ * - `GET  /counter/:id/stream?upto=N` → `CountUpTo` (newline-delimited)
+ */
+export default class RpcCounterWorker extends Cloudflare.Worker<RpcCounterWorker>()(
+  "RpcCounterWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const counters = yield* RpcCounterObject;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+        const match = url.pathname.match(/^\/counter\/([^/]+)(?:\/(\w+))?$/);
+        if (!match)
+          return HttpServerResponse.text("Not Found", { status: 404 });
+        const [, id, action] = match;
+
+        if (request.method === "POST" && action === "increment") {
+          const client = yield* counters.getByName(id);
+          const result = yield* client.Increment({}).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json(result);
+        }
+        if (request.method === "POST" && action === "reset") {
+          const client = yield* counters.getByName(id);
+          yield* client.Reset({}).pipe(Effect.orDie);
+          return HttpServerResponse.text("ok");
+        }
+        if (request.method === "GET" && action === "stream") {
+          const upto = Number(url.searchParams.get("upto") ?? "5");
+          const body = Stream.unwrap(
+            Effect.map(counters.getByName(id), (client) =>
+              client.CountUpTo({ upto }).pipe(
+                Stream.map((n) => new TextEncoder().encode(`${n}\n`)),
+                Stream.orDie,
+              ),
+            ),
+          );
+          return HttpServerResponse.stream(body, {
+            headers: { "content-type": "text/plain" },
+          });
+        }
+        if (request.method === "GET" && action === undefined) {
+          const client = yield* counters.getByName(id);
+          const result = yield* client.Get({}).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json(result);
+        }
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/group.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/group.ts
new file mode 100644
index 00000000000..7d6e4d2be4f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/group.ts
@@ -0,0 +1,58 @@
+import * as Schema from "effect/Schema";
+import * as Rpc from "effect/unstable/rpc/Rpc";
+import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+import * as RpcSchema from "effect/unstable/rpc/RpcSchema";
+
+/**
+ * RPCs implemented locally in both the Worker and the Durable Object.
+ *
+ * - `Ping` — unary
+ * - `Count` — streaming response
+ * - `Echo` — array payload (a "stream" of inputs in one HTTP body) that
+ *   replays each item back as a streaming response
+ */
+export const InnerRpcs = RpcGroup.make(
+  Rpc.make("Ping", {
+    payload: { message: Schema.String },
+    success: Schema.Struct({ echo: Schema.String, n: Schema.Number }),
+  }),
+  Rpc.make("Count", {
+    payload: { upto: Schema.Number },
+    success: RpcSchema.Stream(Schema.Number, Schema.Never),
+  }),
+  Rpc.make("Echo", {
+    payload: { messages: Schema.Array(Schema.String) },
+    success: RpcSchema.Stream(
+      Schema.Struct({ index: Schema.Number, message: Schema.String }),
+      Schema.Never,
+    ),
+  }),
+);
+
+/**
+ * RPCs exposed only by the Worker. Each handler proxies the corresponding
+ * `InnerRpcs` method through an `RpcClient` whose transport is backed by
+ * `Cloudflare.toHttpClient(rpcDO.getByName(...))`. This exercises the DO
+ * fetch pathway (`DurableObjectBridge.fetch` -> `makeRequestEffect`) via
+ * the typed RPC client, mirroring the `*DO` variants in the HttpApi
+ * fixture.
+ */
+export const DoRpcs = RpcGroup.make(
+  Rpc.make("PingDO", {
+    payload: { message: Schema.String },
+    success: Schema.Struct({ echo: Schema.String, n: Schema.Number }),
+  }),
+  Rpc.make("CountDO", {
+    payload: { upto: Schema.Number },
+    success: RpcSchema.Stream(Schema.Number, Schema.Never),
+  }),
+  Rpc.make("EchoDO", {
+    payload: { messages: Schema.Array(Schema.String) },
+    success: RpcSchema.Stream(
+      Schema.Struct({ index: Schema.Number, message: Schema.String }),
+      Schema.Never,
+    ),
+  }),
+);
+
+export const WorkerRpcs = InnerRpcs.merge(DoRpcs);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/object.ts
new file mode 100644
index 00000000000..65b0c400e7e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/object.ts
@@ -0,0 +1,63 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { DoRpcs } from "./group.ts";
+
+/**
+ * Durable Object backing the `*DO` RPCs on the Worker. It exposes the
+ * `InnerRpcs` group via `RpcServer.toHttpEffect`. The Worker constructs
+ * an `RpcClient` whose transport calls into this DO's `fetch`, so the
+ * Worker's `*DO` handlers transparently delegate here.
+ */
+export default class RpcHttpTestObject extends Cloudflare.DurableObjectNamespace<RpcHttpTestObject>()(
+  "RpcHttpTestObject",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      let counter = 0;
+
+      const handlersLayer = DoRpcs.toLayer({
+        PingDO: ({ message }) => {
+          console.log("Ping");
+          return Effect.sync(() => {
+            console.log("Ping inside");
+            return {
+              echo: message,
+              n: ++counter,
+            };
+          });
+        },
+        CountDO: ({ upto }) =>
+          Stream.fromReadableStream<number, never>({
+            evaluate: () => {
+              let next = 1;
+              return new ReadableStream<number>({
+                pull(controller) {
+                  if (next > upto) {
+                    controller.close();
+                    return;
+                  }
+                  controller.enqueue(next++);
+                },
+              });
+            },
+            onError: (cause) => cause as never,
+          }),
+        EchoDO: ({ messages }) =>
+          Stream.fromIterable(
+            messages.map((message, index) => ({ index, message })),
+          ),
+      });
+
+      return {
+        fetch: RpcServer.toHttpEffect(DoRpcs).pipe(
+          Effect.provide(
+            Layer.mergeAll(handlersLayer, RpcSerialization.layerNdjson),
+          ),
+        ),
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/stack.ts
new file mode 100644
index 00000000000..6554a2db0f0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import RpcHttpTestWorker from "./worker.ts";
+
+export default Alchemy.Stack(
+  "RpcHttpTestStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* RpcHttpTestWorker;
+    return {
+      url: worker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/worker.ts
new file mode 100644
index 00000000000..c646a4ee82b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-http/worker.ts
@@ -0,0 +1,97 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import type { HttpEffect } from "alchemy/Http";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as RpcClient from "effect/unstable/rpc/RpcClient";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { DoRpcs, WorkerRpcs } from "./group.ts";
+import RpcHttpTestObject from "./object.ts";
+
+let counter = 0;
+
+export default class RpcHttpTestWorker extends Cloudflare.Worker<RpcHttpTestWorker>()(
+  "RpcHttpTestWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const rpcDO = yield* RpcHttpTestObject;
+
+    // Per-request RpcClient transport: dispatches HTTP requests to the
+    // DO's fetch handler (which serves `InnerRpcs` via
+    // `RpcServer.toHttpEffect`). Mirrors the `Cloudflare.toHttpClient`
+    // pattern used by the HttpApi fixture's `getTaskDO` factory.
+    const makeDOClient = (id: string = "default") =>
+      RpcClient.make(DoRpcs).pipe(
+        Effect.provide(
+          RpcClient.layerProtocolHttp({ url: "http://localhost" }).pipe(
+            Layer.provide(
+              Layer.succeed(
+                HttpClient.HttpClient,
+                Cloudflare.toHttpClient(rpcDO.getByName(id)),
+              ),
+            ),
+            Layer.provide(RpcSerialization.layerNdjson),
+          ),
+        ),
+      );
+
+    const handlersLayer = WorkerRpcs.toLayer({
+      Ping: ({ message }) =>
+        Effect.sync(() => ({
+          echo: message,
+          n: ++counter,
+        })),
+      Count: ({ upto }) =>
+        Stream.fromReadableStream<number, never>({
+          evaluate: () => {
+            let next = 1;
+            return new ReadableStream<number>({
+              pull(controller) {
+                if (next > upto) {
+                  controller.close();
+                  return;
+                }
+                controller.enqueue(next++);
+              },
+            });
+          },
+          onError: (cause) => cause as never,
+        }),
+      Echo: ({ messages }) =>
+        Stream.fromIterable(
+          messages.map((message, index) => ({ index, message })),
+        ),
+      PingDO: (payload) =>
+        Effect.gen(function* () {
+          const client = yield* makeDOClient();
+          const result = yield* client.PingDO(payload);
+          return result;
+        }).pipe(Effect.orDie),
+      CountDO: (payload) =>
+        Stream.unwrap(
+          Effect.gen(function* () {
+            const client = yield* makeDOClient();
+            return client.CountDO(payload).pipe(Stream.orDie);
+          }),
+        ),
+      EchoDO: (payload) =>
+        Stream.unwrap(
+          Effect.gen(function* () {
+            return (yield* makeDOClient()).EchoDO(payload).pipe(Stream.orDie);
+          }),
+        ),
+    });
+
+    return {
+      fetch: RpcServer.toHttpEffect(WorkerRpcs).pipe(
+        Effect.provide(
+          Layer.mergeAll(handlersLayer, RpcSerialization.layerNdjson),
+        ),
+      ) as unknown as HttpEffect,
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/caller-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/caller-worker.ts
new file mode 100644
index 00000000000..a1521f77efe
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/caller-worker.ts
@@ -0,0 +1,31 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { CallerRpcs } from "./group.ts";
+import BindingTargetRpcWorker from "./target-worker.ts";
+
+/**
+ * Caller {@link RpcWorker} that uses `Cloudflare.RpcWorker.bind` to
+ * obtain a typed client for {@link BindingTargetRpcWorker}. The bind
+ * yields the client directly — the per-request handler just calls
+ * `target.Greet({ name })` like any other Effect RpcClient. Internally
+ * each method invocation builds a fresh underlying RPC client (via a
+ * Proxy) because Cloudflare rejects cross-request reuse of the
+ * service-binding stub I/O; that detail is hidden from the consumer.
+ */
+export default class BindingCallerRpcWorker extends Cloudflare.RpcWorker<BindingCallerRpcWorker>()(
+  "BindingCallerRpcWorker",
+  { main: import.meta.filename, schema: CallerRpcs },
+  Effect.gen(function* () {
+    const target = yield* Cloudflare.RpcWorker.bind(BindingTargetRpcWorker);
+
+    const handlers = CallerRpcs.toLayer({
+      ProxyGreet: ({ name }) => target.Greet({ name }).pipe(Effect.orDie),
+    });
+    return RpcServer.toHttpEffect(CallerRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+    );
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/group.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/group.ts
new file mode 100644
index 00000000000..7df85096be5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/group.ts
@@ -0,0 +1,25 @@
+import * as Schema from "effect/Schema";
+import * as Rpc from "effect/unstable/rpc/Rpc";
+import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+
+/**
+ * RPCs exposed by the target {@link RpcWorker} — the canonical
+ * `greet(name)` so the call site has an obvious round-trip to assert.
+ */
+export class TargetRpcs extends RpcGroup.make(
+  Rpc.make("Greet", {
+    payload: { name: Schema.String },
+    success: Schema.Struct({ greeting: Schema.String }),
+  }),
+) {}
+
+/**
+ * RPCs exposed by the caller worker. `ProxyGreet` forwards through the
+ * service-binding RPC client returned by `Cloudflare.RpcWorker.bind`.
+ */
+export class CallerRpcs extends RpcGroup.make(
+  Rpc.make("ProxyGreet", {
+    payload: { name: Schema.String },
+    success: Schema.Struct({ greeting: Schema.String }),
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/stack.ts
new file mode 100644
index 00000000000..77514d714f3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/stack.ts
@@ -0,0 +1,30 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import BindingCallerRpcWorker from "./caller-worker.ts";
+import BindingTargetRpcWorker from "./target-worker.ts";
+
+/**
+ * Stack with two `RpcWorker`s wired through `RpcWorker.bind`:
+ *
+ * - `BindingTargetRpcWorker` — exposes `Greet`.
+ * - `BindingCallerRpcWorker` — exposes `ProxyGreet`, which yields
+ *   `Cloudflare.RpcWorker.bind(BindingTargetRpcWorker)` and forwards
+ *   the call through the typed RPC client over the in-account service
+ *   binding.
+ */
+export default Alchemy.Stack(
+  "RpcWorkerBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const target = yield* BindingTargetRpcWorker;
+    const caller = yield* BindingCallerRpcWorker;
+    return {
+      targetUrl: target.url.as<string>(),
+      callerUrl: caller.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/target-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/target-worker.ts
new file mode 100644
index 00000000000..eff61afc205
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-binding/target-worker.ts
@@ -0,0 +1,25 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { TargetRpcs } from "./group.ts";
+
+/**
+ * Effect-native `RpcWorker` that exposes `greet(name)`. Used as the
+ * *callee* in the RpcWorker-binding fixture — the caller worker
+ * yields `Cloudflare.RpcWorker.bind(BindingTargetRpcWorker)` to obtain
+ * a typed `RpcClient<TargetRpcs>`.
+ */
+export default class BindingTargetRpcWorker extends Cloudflare.RpcWorker<BindingTargetRpcWorker>()(
+  "BindingTargetRpcWorker",
+  { main: import.meta.filename, schema: TargetRpcs },
+  Effect.gen(function* () {
+    const handlers = TargetRpcs.toLayer({
+      Greet: ({ name }) => Effect.succeed({ greeting: `hello ${name}` }),
+    });
+    return RpcServer.toHttpEffect(TargetRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+    );
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/group.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/group.ts
new file mode 100644
index 00000000000..b50ef90d205
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/group.ts
@@ -0,0 +1,42 @@
+import * as Schema from "effect/Schema";
+import * as Rpc from "effect/unstable/rpc/Rpc";
+import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+import * as RpcSchema from "effect/unstable/rpc/RpcSchema";
+
+/**
+ * RPCs implemented locally on the {@link RpcWorker} itself.
+ *
+ * - `Ping` — unary
+ * - `Count` — streaming response
+ */
+export class InnerRpcs extends RpcGroup.make(
+  Rpc.make("Ping", {
+    payload: { message: Schema.String },
+    success: Schema.Struct({ echo: Schema.String, n: Schema.Number }),
+  }),
+  Rpc.make("Count", {
+    payload: { upto: Schema.Number },
+    success: RpcSchema.Stream(Schema.Number, Schema.Never),
+  }),
+) {}
+
+/**
+ * RPCs served by the {@link RpcDurableObjectNamespace} backing the
+ * `*DO` variants below — same shapes as `InnerRpcs`, sharing the wire
+ * codec end-to-end.
+ */
+export class DoRpcs extends RpcGroup.make(
+  Rpc.make("PingDO", {
+    payload: { message: Schema.String },
+    success: Schema.Struct({ echo: Schema.String, n: Schema.Number }),
+  }),
+  Rpc.make("CountDO", {
+    payload: { upto: Schema.Number },
+    success: RpcSchema.Stream(Schema.Number, Schema.Never),
+  }),
+) {}
+
+/**
+ * Surface served by the {@link RpcWorker} — local + DO-proxied.
+ */
+export const WorkerRpcs = InnerRpcs.merge(DoRpcs);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/object.ts
new file mode 100644
index 00000000000..7a1653d4b37
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/object.ts
@@ -0,0 +1,37 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { DoRpcs } from "./group.ts";
+
+/**
+ * Typed Durable Object backing the `*DO` variants on the
+ * {@link RpcWorkerRpcHttpWorker}. Built with
+ * {@link Cloudflare.RpcDurableObjectNamespace} so the worker can call
+ * `objects.getByName(id).PingDO(...)` directly — no `RpcClient.make`,
+ * no `Cloudflare.toHttpClient`, no manual transport plumbing.
+ */
+export default class RpcWorkerRpcHttpObject extends Cloudflare.RpcDurableObjectNamespace<RpcWorkerRpcHttpObject>()(
+  "RpcWorkerRpcHttpObject",
+  { schema: DoRpcs },
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      let counter = 0;
+
+      const handlers = DoRpcs.toLayer({
+        PingDO: ({ message }) =>
+          Effect.sync(() => ({ echo: message, n: ++counter })),
+        CountDO: ({ upto }) =>
+          Stream.fromIterable(
+            Array.from({ length: Math.max(0, upto) }, (_, i) => i + 1),
+          ),
+      });
+
+      return RpcServer.toHttpEffect(DoRpcs).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+      );
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/stack.ts
new file mode 100644
index 00000000000..c098fa6be3b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/stack.ts
@@ -0,0 +1,20 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import RpcWorkerRpcHttpWorker from "./worker.ts";
+
+/**
+ * Stack for the {@link Cloudflare.RpcWorker} +
+ * {@link Cloudflare.RpcDurableObjectNamespace} combined fixture.
+ */
+export default Alchemy.Stack(
+  "RpcWorkerRpcHttpStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* RpcWorkerRpcHttpWorker;
+    return { url: worker.url.as<string>() };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/worker.ts
new file mode 100644
index 00000000000..7e16de90650
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/rpc-worker-rpc-http/worker.ts
@@ -0,0 +1,51 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { WorkerRpcs } from "./group.ts";
+import RpcWorkerRpcHttpObject from "./object.ts";
+
+let counter = 0;
+
+/**
+ * {@link Cloudflare.RpcWorker} variant of the manual `rpc-http`
+ * fixture. Local handlers (`Ping`, `Count`) live on the worker; `*DO`
+ * handlers forward through the typed
+ * {@link RpcWorkerRpcHttpObject} client returned by yielding the
+ * {@link Cloudflare.RpcDurableObjectNamespace} class. The piped
+ * `RpcServer.toHttpEffect(WorkerRpcs)` is returned directly — no
+ * `{ fetch }` wrapper.
+ */
+export default class RpcWorkerRpcHttpWorker extends Cloudflare.RpcWorker<RpcWorkerRpcHttpWorker>()(
+  "RpcWorkerRpcHttpWorker",
+  { main: import.meta.filename, schema: WorkerRpcs },
+  Effect.gen(function* () {
+    const objects = yield* RpcWorkerRpcHttpObject;
+
+    const handlers = WorkerRpcs.toLayer({
+      Ping: ({ message }) =>
+        Effect.sync(() => ({ echo: message, n: ++counter })),
+      Count: ({ upto }) =>
+        Stream.fromIterable(
+          Array.from({ length: Math.max(0, upto) }, (_, i) => i + 1),
+        ),
+      PingDO: ({ message }) =>
+        Effect.gen(function* () {
+          const client = yield* objects.getByName("default");
+          return yield* client.PingDO({ message });
+        }).pipe(Effect.orDie),
+      CountDO: ({ upto }) =>
+        Stream.unwrap(
+          Effect.map(objects.getByName("default"), (client) =>
+            client.CountDO({ upto }).pipe(Stream.orDie),
+          ),
+        ),
+    });
+
+    return RpcServer.toHttpEffect(WorkerRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+    );
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/object.ts
new file mode 100644
index 00000000000..db1c2c527f4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/object.ts
@@ -0,0 +1,84 @@
+import type { RuntimeContext } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export const MyDB = Cloudflare.D1Database("MyDB");
+
+const DO_COUNT_KEY = "do_count";
+
+// Tag — D1 RPC methods take an explicit row `key` so the shared D1 table
+// can be partitioned per-caller. The DO storage methods don't need one
+// because per-instance storage is already isolated by `getByName(name)`.
+export class Counter extends Cloudflare.DurableObjectNamespace<
+  Counter,
+  {
+    incrementD1: (key: string) => Effect.Effect<number, never, RuntimeContext>;
+    getD1: (key: string) => Effect.Effect<number, never, RuntimeContext>;
+    incrementDO: () => Effect.Effect<number, never, RuntimeContext>;
+    getDO: () => Effect.Effect<number, never, RuntimeContext>;
+    reset: (key: string) => Effect.Effect<void, never, RuntimeContext>;
+  }
+>()("Counter") {}
+
+// Layer
+export const CounterLive = Counter.make(
+  Effect.gen(function* () {
+    const db = yield* Cloudflare.D1Connection.bind(MyDB);
+
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      // D1's `exec()` splits on newlines and rejects multi-line statements
+      // ("incomplete input: SQLITE_ERROR"). Keep the DDL on a single line.
+      yield* db.exec(
+        "CREATE TABLE IF NOT EXISTS d1_counters (id TEXT PRIMARY KEY, value INTEGER NOT NULL DEFAULT 0)",
+      );
+
+      const readD1 = (key: string) =>
+        db
+          .prepare("SELECT value FROM d1_counters WHERE id = ?")
+          .bind(key)
+          .first<{ value: number }>()
+          .pipe(Effect.map((row) => row?.value ?? 0));
+
+      const writeD1 = (key: string, value: number) =>
+        db
+          .prepare(
+            "INSERT INTO d1_counters (id, value) VALUES (?, ?) ON CONFLICT(id) DO UPDATE SET value = excluded.value",
+          )
+          .bind(key, value)
+          .run()
+          .pipe(Effect.asVoid);
+
+      const readDO = () =>
+        state.storage
+          .get<number>(DO_COUNT_KEY)
+          .pipe(Effect.map((value) => value ?? 0));
+
+      const writeDO = (value: number) =>
+        state.storage.put(DO_COUNT_KEY, value).pipe(Effect.asVoid);
+
+      return {
+        incrementD1: (key: string) =>
+          Effect.gen(function* () {
+            const next = (yield* readD1(key)) + 1;
+            yield* writeD1(key, next);
+            return next;
+          }),
+        getD1: (key: string) => readD1(key),
+        incrementDO: () =>
+          Effect.gen(function* () {
+            const next = (yield* readDO()) + 1;
+            yield* writeDO(next);
+            return next;
+          }),
+        getDO: () => readDO(),
+        reset: (key: string) =>
+          Effect.gen(function* () {
+            yield* writeD1(key, 0);
+            yield* writeDO(0);
+          }),
+      };
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/stack.ts
new file mode 100644
index 00000000000..004936cbaa8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/stack.ts
@@ -0,0 +1,25 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import WorkerALayer, { WorkerA } from "./workerA.ts";
+import WorkerB from "./workerB.ts";
+import WorkerCLayer, { WorkerC } from "./workerC.ts";
+
+export default Alchemy.Stack(
+  "TaggedDOExample",
+  {
+    state: Cloudflare.state(),
+    providers: Cloudflare.providers(),
+  },
+  Effect.gen(function* () {
+    const workerA = yield* WorkerA;
+    const workerB = yield* WorkerB;
+    const workerC = yield* WorkerC;
+
+    return {
+      urlA: workerA.url.as<string>(),
+      urlB: workerB.url.as<string>(),
+      urlC: workerC.url.as<string>(),
+    };
+  }).pipe(Effect.provide(WorkerALayer), Effect.provide(WorkerCLayer)),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerA.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerA.ts
new file mode 100644
index 00000000000..a0a24cbe18e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerA.ts
@@ -0,0 +1,62 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Counter, CounterLive } from "./object.ts";
+
+// Tag
+export class WorkerA extends Cloudflare.Worker<WorkerA, {}, Counter>()(
+  "WorkerA",
+  {
+    main: import.meta.filename,
+  },
+) {}
+
+// Layer
+export default WorkerA.make(
+  Effect.gen(function* () {
+    const counter = yield* Counter;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.headers["x-counter-key"] ?? "default";
+        const stub = counter.getByName(key);
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/reset") {
+          yield* stub.reset(key);
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && url.pathname === "/d1/increment") {
+          const value = yield* stub.incrementD1(key);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/d1") {
+          const value = yield* stub.getD1(key);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "POST" && url.pathname === "/do/increment") {
+          const value = yield* stub.incrementDO();
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/do") {
+          const value = yield* stub.getDO();
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      // WorkerA needs to provide it
+      CounterLive.pipe(Layer.provide(Cloudflare.D1ConnectionLive)),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerB.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerB.ts
new file mode 100644
index 00000000000..a96bed0f565
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerB.ts
@@ -0,0 +1,53 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+import { Counter } from "./object.ts";
+import { WorkerA } from "./workerA.ts";
+
+export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+  "WorkerB",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const counter = yield* Counter.from(WorkerA);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.headers["x-counter-key"] ?? "default";
+        const stub = counter.getByName(key);
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/reset") {
+          yield* stub.reset(key);
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && url.pathname === "/d1/increment") {
+          const value = yield* stub.incrementD1(key);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/d1") {
+          const value = yield* stub.getD1(key);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "POST" && url.pathname === "/do/increment") {
+          const value = yield* stub.incrementDO();
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/do") {
+          const value = yield* stub.getDO();
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerC.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerC.ts
new file mode 100644
index 00000000000..db0af8d2c46
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-do/workerC.ts
@@ -0,0 +1,56 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Counter, CounterLive } from "./object.ts";
+
+// Tag — WorkerC also hosts its OWN Counter (declared in its public contract).
+// Because each Worker hosts its own DO namespace, the instances under
+// WorkerC are isolated from the instances under WorkerA/B.
+export class WorkerC extends Cloudflare.Worker<WorkerC, {}, Counter>()(
+  "WorkerC",
+  {
+    main: import.meta.filename,
+  },
+) {}
+
+// Layer — uses `Counter.from(WorkerC)` (self-reference) instead of
+// `yield* Counter`. The two forms are equivalent inside the host; the
+// `.from(Self)` form is the recommended style for code that may be
+// extracted into a reusable Layer.
+export default WorkerC.make(
+  Effect.gen(function* () {
+    const counter = yield* Counter.from(WorkerC);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.headers["x-counter-key"] ?? "default";
+        const stub = counter.getByName(key);
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/reset") {
+          yield* stub.reset(key);
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && url.pathname === "/do/increment") {
+          const value = yield* stub.incrementDO();
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/do") {
+          const value = yield* stub.getDO();
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      CounterLive.pipe(Layer.provide(Cloudflare.D1ConnectionLive)),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/group.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/group.ts
new file mode 100644
index 00000000000..9cde3e6560c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/group.ts
@@ -0,0 +1,41 @@
+import * as Schema from "effect/Schema";
+import * as Rpc from "effect/unstable/rpc/Rpc";
+import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
+
+/**
+ * Shared RPC group for the cross-script `tagged-rpc-do` fixture.
+ *
+ * Served on **two** ends:
+ * - Each {@link Cloudflare.RpcDurableObjectNamespace} instance
+ *   (`Counter`) — the per-instance counter surface.
+ * - WorkerA, an {@link Cloudflare.RpcWorker} that forwards each call
+ *   to `counter.getByName(key)` so consumers can hit the counter over
+ *   a service binding without knowing about DO routing.
+ *
+ * Every payload carries `key`. WorkerA uses it to pick the DO instance
+ * via `getByName(key)`; the DO uses it for D1 row partitioning and
+ * ignores it for the per-instance storage methods (already isolated
+ * by `getByName(name)`).
+ */
+export class CounterRpcs extends RpcGroup.make(
+  Rpc.make("incrementD1", {
+    payload: { key: Schema.String },
+    success: Schema.Struct({ value: Schema.Number }),
+  }),
+  Rpc.make("getD1", {
+    payload: { key: Schema.String },
+    success: Schema.Struct({ value: Schema.Number }),
+  }),
+  Rpc.make("incrementDO", {
+    payload: { key: Schema.String },
+    success: Schema.Struct({ value: Schema.Number }),
+  }),
+  Rpc.make("getDO", {
+    payload: { key: Schema.String },
+    success: Schema.Struct({ value: Schema.Number }),
+  }),
+  Rpc.make("reset", {
+    payload: { key: Schema.String },
+    success: Schema.Void,
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/object.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/object.ts
new file mode 100644
index 00000000000..d4efafd93bb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/object.ts
@@ -0,0 +1,88 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { CounterRpcs } from "./group.ts";
+
+export const MyDB = Cloudflare.D1Database("MyDB");
+
+const DO_COUNT_KEY = "do_count";
+
+// Tag — modular `RpcDurableObjectNamespace` declaration. The runtime
+// (D1 setup, handler bodies) lives in `CounterLive` below; consumers
+// only need this class identifier to bind via `Counter.from(WorkerA)`.
+export class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+  "Counter",
+  { schema: CounterRpcs },
+) {}
+
+// Layer — outer Effect resolves shared deps (D1), inner Effect runs
+// once per instance and returns the piped `RpcServer.toHttpEffect`
+// the DO's `fetch` handler will serve.
+export const CounterLive = Counter.make(
+  Effect.gen(function* () {
+    const db = yield* Cloudflare.D1Connection.bind(MyDB);
+
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      // D1's `exec()` splits on newlines and rejects multi-line statements;
+      // keep the DDL on a single line.
+      yield* db.exec(
+        "CREATE TABLE IF NOT EXISTS d1_counters (id TEXT PRIMARY KEY, value INTEGER NOT NULL DEFAULT 0)",
+      );
+
+      const readD1 = (key: string) =>
+        db
+          .prepare("SELECT value FROM d1_counters WHERE id = ?")
+          .bind(key)
+          .first<{ value: number }>()
+          .pipe(Effect.map((row) => row?.value ?? 0));
+
+      const writeD1 = (key: string, value: number) =>
+        db
+          .prepare(
+            "INSERT INTO d1_counters (id, value) VALUES (?, ?) ON CONFLICT(id) DO UPDATE SET value = excluded.value",
+          )
+          .bind(key, value)
+          .run()
+          .pipe(Effect.asVoid);
+
+      const readDO = () =>
+        state.storage.get<number>(DO_COUNT_KEY).pipe(Effect.map((v) => v ?? 0));
+
+      const writeDO = (value: number) =>
+        state.storage.put(DO_COUNT_KEY, value).pipe(Effect.asVoid);
+
+      const handlers = CounterRpcs.toLayer({
+        incrementD1: ({ key }) =>
+          Effect.gen(function* () {
+            const next = (yield* readD1(key)) + 1;
+            yield* writeD1(key, next);
+            return { value: next };
+          }),
+        getD1: ({ key }) => Effect.map(readD1(key), (value) => ({ value })),
+        // `key` is ignored — the DO instance is already partitioned by
+        // `getByName(key)` at the namespace boundary.
+        incrementDO: () =>
+          Effect.gen(function* () {
+            const next = (yield* readDO()) + 1;
+            yield* writeDO(next);
+            return { value: next };
+          }),
+        getDO: () => Effect.map(readDO(), (value) => ({ value })),
+        reset: ({ key }) =>
+          Effect.gen(function* () {
+            console.log("reset DO", key);
+            yield* writeD1(key, 0);
+            yield* writeDO(0);
+          }),
+      });
+
+      return RpcServer.toHttpEffect(CounterRpcs).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+      );
+    });
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/stack.ts
new file mode 100644
index 00000000000..129183e25cc
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/stack.ts
@@ -0,0 +1,25 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import WorkerALayer, { WorkerA } from "./workerA.ts";
+import WorkerB from "./workerB.ts";
+import WorkerCLayer, { WorkerC } from "./workerC.ts";
+
+export default Alchemy.Stack(
+  "TaggedRpcDOExample",
+  {
+    state: Cloudflare.state(),
+    providers: Cloudflare.providers(),
+  },
+  Effect.gen(function* () {
+    const workerA = yield* WorkerA;
+    const workerB = yield* WorkerB;
+    const workerC = yield* WorkerC;
+
+    return {
+      urlA: workerA.url.as<string>(),
+      urlB: workerB.url.as<string>(),
+      urlC: workerC.url.as<string>(),
+    };
+  }).pipe(Effect.provide(WorkerALayer), Effect.provide(WorkerCLayer)),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerA.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerA.ts
new file mode 100644
index 00000000000..425fd8adc79
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerA.ts
@@ -0,0 +1,72 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { CounterRpcs } from "./group.ts";
+import { Counter, CounterLive } from "./object.ts";
+
+// Tag — host worker for the typed `Counter` rpc DO. The third type
+// argument declares `Counter` as part of WorkerA's public contract so
+// that `Counter.from(WorkerA)` type-checks from any consumer.
+//
+// WorkerA's own `fetch` surface is the same `CounterRpcs` group as
+// the DO — every call is proxied to `counter.getByName(key).method({...})`.
+// Consumers can therefore hit the counter over a service binding via
+// `Cloudflare.RpcWorker.bind(WorkerA)` without knowing about DO routing.
+export class WorkerA extends Cloudflare.RpcWorker<WorkerA, Counter>()(
+  "WorkerA",
+  {
+    main: import.meta.filename,
+    schema: CounterRpcs,
+  },
+) {}
+
+// Layer — yielding `Counter` resolves to WorkerA's local hosted
+// namespace (the `CounterLive` Layer below populates the tag).
+export default WorkerA.make(
+  Effect.gen(function* () {
+    const counter = yield* Counter;
+
+    // `counter.getByName(key)` returns a chainable Proxy (built via
+    // `proxyChain`) so each method call yields directly. `Effect.orDie`
+    // drops the transport-level `RpcClientError`, which isn't part of
+    // the declared `CounterRpcs` error channel.
+    const handlers = CounterRpcs.toLayer({
+      incrementD1: ({ key }) =>
+        counter
+          .getByName(key)
+          .pipe(Effect.flatMap((c) => c.incrementD1({ key })))
+          .pipe(Effect.orDie),
+      getD1: ({ key }) =>
+        counter
+          .getByName(key)
+          .pipe(Effect.flatMap((c) => c.getD1({ key })))
+          .pipe(Effect.orDie),
+      incrementDO: ({ key }) =>
+        counter
+          .getByName(key)
+          .pipe(Effect.flatMap((c) => c.incrementDO({ key })))
+          .pipe(Effect.orDie),
+      getDO: ({ key }) =>
+        counter
+          .getByName(key)
+          .pipe(Effect.flatMap((c) => c.getDO({ key })))
+          .pipe(Effect.orDie),
+      reset: ({ key }) =>
+        counter
+          .getByName(key)
+          .pipe(Effect.flatMap((c) => c.reset({ key })))
+          .pipe(Effect.orDie),
+    });
+
+    return RpcServer.toHttpEffect(CounterRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+    );
+  }).pipe(
+    Effect.provide(
+      // WorkerA hosts `Counter`, so it must provide `CounterLive`.
+      CounterLive.pipe(Layer.provide(Cloudflare.D1ConnectionLive)),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerB.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerB.ts
new file mode 100644
index 00000000000..996cb70dc3d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerB.ts
@@ -0,0 +1,57 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+import { Counter } from "./object.ts";
+import { WorkerA } from "./workerA.ts";
+
+// Consumer worker — binds to WorkerA's hosted `Counter` rpc DO via
+// `Counter.from(WorkerA)` (cross-script DO binding). Plain
+// `Cloudflare.Worker` so we can drive the test through HTTP routes
+// without needing an RpcClient setup for this end.
+export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+  "WorkerB",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const counter = yield* Counter.from(WorkerA);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.headers["x-counter-key"] ?? "default";
+        const stub = yield* counter.getByName(key);
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/reset") {
+          yield* stub.reset({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && url.pathname === "/d1/increment") {
+          const { value } = yield* stub.incrementD1({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/d1") {
+          const { value } = yield* stub.getD1({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "POST" && url.pathname === "/do/increment") {
+          const { value } = yield* stub.incrementDO({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/do") {
+          const { value } = yield* stub.getDO({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }).pipe(Effect.scoped),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerC.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerC.ts
new file mode 100644
index 00000000000..dc8f4343c85
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/tagged-rpc-do/workerC.ts
@@ -0,0 +1,57 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Counter, CounterLive } from "./object.ts";
+
+// Tag — WorkerC also hosts its OWN `Counter` rpc DO (declared in its
+// public contract). Each Worker host gets an isolated DO namespace,
+// so writes via WorkerC's instances are NOT visible from WorkerA/B's
+// instances of the same `Counter` class.
+export class WorkerC extends Cloudflare.Worker<WorkerC, {}, Counter>()(
+  "WorkerC",
+  {
+    main: import.meta.filename,
+  },
+) {}
+
+// Layer — uses `Counter.from(WorkerC)` (self-reference) instead of
+// the bare `yield* Counter`. Inside the host they're equivalent; the
+// `.from(Self)` form is the recommended style for code that may be
+// extracted into a reusable Layer.
+export default WorkerC.make(
+  Effect.gen(function* () {
+    const counter = yield* Counter.from(WorkerC);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.headers["x-counter-key"] ?? "default";
+        const stub = yield* counter.getByName(key);
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "POST" && url.pathname === "/reset") {
+          yield* stub.reset({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ ok: true });
+        }
+
+        if (request.method === "POST" && url.pathname === "/do/increment") {
+          const { value } = yield* stub.incrementDO({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        if (request.method === "GET" && url.pathname === "/do") {
+          const { value } = yield* stub.getDO({ key }).pipe(Effect.orDie);
+          return yield* HttpServerResponse.json({ value });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }).pipe(Effect.scoped),
+    };
+  }).pipe(
+    Effect.provide(
+      CounterLive.pipe(Layer.provide(Cloudflare.D1ConnectionLive)),
+    ),
+  ),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-async-caller.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-async-caller.ts
new file mode 100644
index 00000000000..cbe894ef79c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-async-caller.ts
@@ -0,0 +1,33 @@
+/// <reference types="@cloudflare/workers-types" />
+
+/**
+ * Plain (non-Effect) Cloudflare Worker that calls a service-binding RPC
+ * method (`env.TARGET.greet(name)`) the same way any normal Cloudflare
+ * Worker would.
+ *
+ * GET /?name=foo  →  responds with whatever the target returns ("hello foo"),
+ * surfacing any error as a 500 with the message in the body so the test can
+ * assert against it directly instead of spelunking worker logs.
+ */
+export default {
+  async fetch(
+    request: Request,
+    env: {
+      TARGET: Service & {
+        greet: (name: string) => Promise<string>;
+      };
+    },
+  ): Promise<Response> {
+    const name = new URL(request.url).searchParams.get("name") ?? "world";
+    try {
+      console.log("async caller calling target");
+      const greeting = await env.TARGET.greet(name);
+      console.log("async caller got greeting", greeting);
+      return new Response(String(greeting));
+    } catch (err) {
+      console.log("async caller failed", err);
+      const message = err instanceof Error ? err.message : String(err);
+      return new Response(`async caller failed: ${message}`, { status: 500 });
+    }
+  },
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-effect-caller.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-effect-caller.ts
new file mode 100644
index 00000000000..1ef869831ec
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-effect-caller.ts
@@ -0,0 +1,41 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import BindingTargetWorker from "./binding-target-worker.ts";
+
+/**
+ * Effect-native worker that calls another Effect-native worker's RPC method
+ * via `Cloudflare.bindWorker`. This is the canonical Effect → Effect cross-
+ * worker pattern: the bound stub returns Effects, errors and streams flow
+ * back through the typed channel.
+ *
+ * GET /?name=foo  →  pipes the bound `greet(name)` Effect through.
+ */
+export default class BindingEffectCaller extends Cloudflare.Worker<BindingEffectCaller>()(
+  "BindingEffectCaller",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    const target = yield* Cloudflare.bindWorker(BindingTargetWorker);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const name =
+          new URL(request.url, "http://x").searchParams.get("name") ?? "world";
+        const greeting = yield* target.greet(name);
+        return HttpServerResponse.text(String(greeting));
+      }).pipe(
+        Effect.catchCause((cause) =>
+          Effect.succeed(
+            HttpServerResponse.text(`effect caller failed: ${String(cause)}`, {
+              status: 500,
+            }),
+          ),
+        ),
+      ),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-target-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-target-worker.ts
new file mode 100644
index 00000000000..4a840be7201
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/binding-target-worker.ts
@@ -0,0 +1,22 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+/**
+ * Effect-native worker that exposes a single RPC method (`greet`) plus a
+ * `fetch` handler. Used as the *callee* in the binding fixtures below.
+ */
+export default class BindingTargetWorker extends Cloudflare.Worker<BindingTargetWorker>()(
+  "BindingTargetWorker",
+  {
+    main: import.meta.filename,
+  },
+  Effect.gen(function* () {
+    return {
+      greet: (name: string) => Effect.succeed(`hello ${name}`),
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("hello from BindingTargetWorker");
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/stack.ts
new file mode 100644
index 00000000000..f3a528e5426
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker-worker-binding/stack.ts
@@ -0,0 +1,48 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as pathe from "pathe";
+import BindingEffectCaller from "./binding-effect-caller.ts";
+import BindingTargetWorker from "./binding-target-worker.ts";
+
+const asyncCallerMain = pathe.resolve(
+  import.meta.dirname,
+  "binding-async-caller.ts",
+);
+
+/**
+ * Stack with three workers:
+ *
+ * - `BindingTargetWorker` — Effect-native target exposing `greet` (RPC) +
+ *   `fetch`.
+ * - `BindingAsyncCaller` — plain `{ fetch }` Cloudflare worker that calls
+ *   `env.TARGET.greet(name)` over a service binding.
+ * - `BindingEffectCaller` — Effect-native worker that uses
+ *   `Cloudflare.bindWorker(BindingTargetWorker)` to call `greet` from
+ *   inside an Effect.
+ */
+export default Alchemy.Stack(
+  "WorkerBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const target = yield* BindingTargetWorker;
+
+    const asyncCaller = yield* Cloudflare.Worker("BindingAsyncCaller", {
+      main: asyncCallerMain,
+      env: {
+        TARGET: target,
+      },
+    });
+
+    const effectCaller = yield* BindingEffectCaller;
+
+    return {
+      targetUrl: target.url.as<string>(),
+      asyncCallerUrl: asyncCaller.url.as<string>(),
+      effectCallerUrl: effectCaller.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker.ts
new file mode 100644
index 00000000000..ea6c1f5a243
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/worker.ts
@@ -0,0 +1,6 @@
+export default {
+  fetch: async () => {
+    return new Response("Hello from TestWorker");
+  },
+  queue: async () => {},
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/stack.ts
new file mode 100644
index 00000000000..c4c208f62c0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/stack.ts
@@ -0,0 +1,18 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import WorkflowTestWorker from "./workflow-worker.ts";
+
+export default Alchemy.Stack(
+  "WorkflowBindingStack",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* WorkflowTestWorker;
+    return {
+      url: worker.url.as<string>(),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/test-workflow.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/test-workflow.ts
new file mode 100644
index 00000000000..7b419623a1b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/test-workflow.ts
@@ -0,0 +1,38 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+/**
+ * Fixture workflow used by `Workflow.test.ts`.
+ *
+ * Exercises:
+ *  - `Cloudflare.task` durable steps (greet + finalize)
+ *  - `Cloudflare.sleep` between steps
+ *  - `Cloudflare.WorkerEnvironment` access from inside the body — regression
+ *    guard for https://github.com/alchemy-run/alchemy-effect/pull/71
+ */
+export default class TestWorkflow extends Cloudflare.Workflow<TestWorkflow>()(
+  "TestWorkflow",
+  Effect.gen(function* () {
+    return Effect.fn(function* (input: { value: string }) {
+      console.log("greeted");
+      const env = yield* Cloudflare.WorkerEnvironment;
+
+      const greeted = yield* Cloudflare.task(
+        "greet",
+        Effect.succeed(`Hello, ${input.value}!`),
+      );
+
+      yield* Cloudflare.sleep("cooldown", "1 second");
+
+      const finalized = yield* Cloudflare.task(
+        "finalize",
+        Effect.succeed({
+          greeting: greeted,
+          envBindingCount: Object.keys(env).length,
+        }),
+      );
+
+      return finalized;
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/workflow-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/workflow-worker.ts
new file mode 100644
index 00000000000..e5dbfc204f4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Workers/fixtures/workflow/workflow-worker.ts
@@ -0,0 +1,38 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import TestWorkflow from "./test-workflow.ts";
+
+export default class WorkflowTestWorker extends Cloudflare.Worker<WorkflowTestWorker>()(
+  "WorkflowTestWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true, previewsEnabled: false },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const workflow = yield* TestWorkflow;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        if (request.url.startsWith("/workflow/start/")) {
+          const value = request.url.split("/workflow/start/")[1] ?? "world";
+          const instance = yield* workflow.create({ value });
+          return yield* HttpServerResponse.json({ instanceId: instance.id });
+        }
+
+        if (request.url.startsWith("/workflow/status/")) {
+          const instanceId = request.url.split("/workflow/status/")[1] ?? "";
+          const instance = yield* workflow.get(instanceId);
+          const status = yield* instance.status();
+          return yield* HttpServerResponse.json(status);
+        }
+
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zaraz/ZarazConfig.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zaraz/ZarazConfig.test.ts
new file mode 100644
index 00000000000..c5399df0063
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zaraz/ZarazConfig.test.ts
@@ -0,0 +1,175 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Test from "@/Test/Vitest";
+import { stripNullFields, stripUndefinedFields } from "@/Util/data";
+import * as zaraz from "@distilled.cloud/cloudflare/zaraz";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const zoneId = process.env.CLOUDFLARE_TEST_ZARAZ_ZONE_ID;
+const zoneName =
+  process.env.CLOUDFLARE_TEST_ZARAZ_ZONE_NAME ?? "alchemy-test-2.us";
+
+test.provider.skipIf(!zoneId)(
+  "updates and retains a zone-level Zaraz config",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const original = yield* zaraz.getConfig({ zoneId: zoneId! });
+      const toggledDataLayer = !original.dataLayer;
+
+      yield* Effect.gen(function* () {
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.ZarazConfig("Config", {
+              zone: { zoneId: zoneId!, name: zoneName },
+              dataLayer: toggledDataLayer,
+            });
+          }),
+        );
+
+        expect(updated.zoneId).toEqual(zoneId);
+        expect(updated.dataLayer).toEqual(toggledDataLayer);
+
+        const liveUpdated = yield* zaraz.getConfig({ zoneId: zoneId! });
+        expect(liveUpdated.dataLayer).toEqual(toggledDataLayer);
+
+        const restored = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.ZarazConfig("Config", {
+              zone: { zoneId: zoneId!, name: zoneName },
+              dataLayer: original.dataLayer,
+            });
+          }),
+        );
+
+        expect(restored.dataLayer).toEqual(original.dataLayer);
+
+        yield* stack.destroy();
+
+        const liveRetained = yield* zaraz.getConfig({ zoneId: zoneId! });
+        expect(liveRetained.dataLayer).toEqual(original.dataLayer);
+      }).pipe(
+        Effect.ensuring(
+          zaraz.putConfig(toPutConfig(zoneId!, original)).pipe(Effect.ignore),
+        ),
+      );
+    }).pipe(logLevel),
+  { timeout: 120_000 },
+);
+
+test.provider.skipIf(!zoneId)(
+  "delete true resets Zaraz config to defaults",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const original = yield* zaraz.getConfig({ zoneId: zoneId! });
+      const originalWorkflow = yield* zaraz.getWorkflow({ zoneId: zoneId! });
+      const defaults = yield* zaraz.getDefault({ zoneId: zoneId! });
+
+      yield* Effect.gen(function* () {
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.ZarazConfig("Config", {
+              zone: { zoneId: zoneId!, name: zoneName },
+              dataLayer: !defaults.dataLayer,
+              workflow: "preview",
+              delete: true,
+            });
+          }),
+        );
+
+        const liveUpdated = yield* zaraz.getConfig({ zoneId: zoneId! });
+        expect(liveUpdated.dataLayer).toEqual(!defaults.dataLayer);
+
+        yield* stack.destroy();
+
+        const liveDeleted = yield* zaraz.getConfig({ zoneId: zoneId! });
+        expect(liveDeleted.dataLayer).toEqual(defaults.dataLayer);
+        const liveDeletedWorkflow = yield* zaraz.getWorkflow({
+          zoneId: zoneId!,
+        });
+        expect(liveDeletedWorkflow).toEqual("realtime");
+      }).pipe(
+        Effect.ensuring(
+          Effect.gen(function* () {
+            yield* zaraz
+              .putConfig(toPutConfig(zoneId!, original))
+              .pipe(Effect.ignore);
+            yield* zaraz
+              .putZaraz({ zoneId: zoneId!, workflow: originalWorkflow })
+              .pipe(Effect.ignore);
+          }),
+        ),
+      );
+    }).pipe(logLevel),
+  { timeout: 120_000 },
+);
+
+test.provider.skipIf(!zoneId)(
+  "updates and retains Zaraz workflow mode",
+  (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const original = yield* zaraz.getWorkflow({ zoneId: zoneId! });
+      const workflow = original === "realtime" ? "preview" : "realtime";
+
+      yield* Effect.gen(function* () {
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.ZarazConfig("Config", {
+              zone: { zoneId: zoneId!, name: zoneName },
+              workflow,
+            });
+          }),
+        );
+
+        expect(updated.workflow).toEqual(workflow);
+
+        const liveUpdated = yield* zaraz.getWorkflow({ zoneId: zoneId! });
+        expect(liveUpdated).toEqual(workflow);
+
+        yield* stack.destroy();
+
+        const liveRetained = yield* zaraz.getWorkflow({ zoneId: zoneId! });
+        expect(liveRetained).toEqual(workflow);
+      }).pipe(
+        Effect.ensuring(
+          zaraz
+            .putZaraz({ zoneId: zoneId!, workflow: original })
+            .pipe(Effect.ignore),
+        ),
+      );
+    }).pipe(logLevel),
+  { timeout: 120_000 },
+);
+
+type ConfigResponse = zaraz.GetConfigResponse | zaraz.PutConfigResponse;
+
+const toPutConfig = (
+  zoneId: string,
+  config: ConfigResponse,
+): zaraz.PutConfigRequest =>
+  stripUndefinedFields({
+    zoneId,
+    dataLayer: config.dataLayer,
+    debugKey: config.debugKey,
+    settings: stripNullFields(config.settings),
+    tools: config.tools,
+    triggers: config.triggers,
+    variables: config.variables,
+    zarazVersion: config.zarazVersion,
+    analytics: config.analytics ? stripNullFields(config.analytics) : undefined,
+    consent: config.consent ? stripNullFields(config.consent) : undefined,
+    historyChange: config.historyChange ?? undefined,
+  }) as zaraz.PutConfigRequest;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zaraz/ZarazEventTypes.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zaraz/ZarazEventTypes.test.ts
new file mode 100644
index 00000000000..b6de8a54078
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zaraz/ZarazEventTypes.test.ts
@@ -0,0 +1,153 @@
+import {
+  ZarazConfig,
+  type InferZarazEcommerceEvents,
+  type InferZarazEvents,
+  type ZarazHttpEventsPayload,
+  type ZarazTrack,
+  type ZarazWebApi,
+} from "@/Cloudflare/Zaraz";
+import { expect, test } from "vitest";
+
+const checkZarazEventTypes = () => {
+  const zaraz = ZarazConfig.events<{
+    Login: { method: "google" | "email" | "email-link" };
+    "Button Clicked": { button_label: string; context?: string };
+    __zarazSPA: undefined;
+  }>();
+
+  const zarazWithEcommerce = ZarazConfig.events<{
+    Login: { method: "google" | "email" | "email-link" };
+    "Button Clicked": { button_label: string; context?: string };
+    __zarazSPA: undefined;
+  }>({ ecommerce: true });
+
+  type Events = InferZarazEvents<typeof zaraz>;
+  type DisabledEcommerceEvents = InferZarazEcommerceEvents<typeof zaraz>;
+  type EcommerceEvents = InferZarazEcommerceEvents<typeof zarazWithEcommerce>;
+
+  const standardEcommerceEvents = {
+    "Product List Viewed": true,
+    "Products Searched": true,
+    "Product Clicked": true,
+    "Product Added": true,
+    "Product Added to Wishlist": true,
+    "Product Removed": true,
+    "Product Viewed": true,
+    "Cart Viewed": true,
+    "Checkout Started": true,
+    "Checkout Step Viewed": true,
+    "Checkout Step Completed": true,
+    "Payment Info Entered": true,
+    "Order Completed": true,
+    "Order Updated": true,
+    "Order Refunded": true,
+    "Order Cancelled": true,
+    "Clicked Promotion": true,
+    "Viewed Promotion": true,
+    "Shipping Info Entered": true,
+  } satisfies Record<keyof EcommerceEvents, true>;
+
+  void standardEcommerceEvents;
+
+  const track = undefined as unknown as ZarazTrack<Events>;
+
+  track("Login", { method: "google" });
+  track("__zarazSPA");
+  track("__zarazSPA", undefined);
+  track("Button Clicked", { button_label: "Save" });
+  track("Button Clicked", { button_label: "Save", context: "toolbar" });
+
+  // @ts-expect-error event name must exist in the contract
+  track("Missing", {});
+
+  // @ts-expect-error event properties are checked per event name
+  track("Login", { method: "github" });
+
+  // @ts-expect-error events with undefined properties do not accept an object
+  track("__zarazSPA", {});
+
+  // @ts-expect-error required event properties must be present
+  track("Button Clicked", {});
+
+  const browser = undefined as unknown as ZarazWebApi<Events, EcommerceEvents>;
+  const browserWithoutEcommerce = undefined as unknown as ZarazWebApi<
+    Events,
+    DisabledEcommerceEvents
+  >;
+
+  browser.track("Login", { method: "email-link" });
+  browser.ecommerce("Product Viewed", { product_id: "product-1", price: 12 });
+  browser.ecommerce("Products Searched", { query: "shirts" });
+  browser.ecommerce("Checkout Step Viewed", { step: 1 });
+  browser.ecommerce("Order Completed", {
+    order_id: "order-1",
+    total: 24,
+    currency: "USD",
+    products: [{ product_id: "product-1", quantity: 2 }],
+  });
+
+  // @ts-expect-error ecommerce events are disabled unless the contract opts in
+  browserWithoutEcommerce.ecommerce("Product Viewed", {
+    product_id: "product-1",
+  });
+
+  // @ts-expect-error ecommerce events use the ecommerce contract
+  browser.ecommerce("Login", { method: "google" });
+
+  // @ts-expect-error ecommerce payloads are checked
+  browser.ecommerce("Product Viewed", { invalid: "product-1" });
+
+  // @ts-expect-error ecommerce events require at least one supported property
+  browser.ecommerce("Product Viewed", {});
+
+  const payload = {
+    events: [
+      {
+        client: {
+          __zarazTrack: "Login",
+          method: "email",
+        },
+        system: {
+          page: {
+            title: "Login",
+            url: "https://example.com/login",
+          },
+        },
+      },
+    ],
+  } satisfies ZarazHttpEventsPayload<Events>;
+
+  void payload;
+
+  const emptyPayload = {
+    events: [
+      {
+        client: {
+          __zarazTrack: "__zarazSPA",
+        },
+      },
+    ],
+  } satisfies ZarazHttpEventsPayload<Events>;
+
+  void emptyPayload;
+
+  const invalidPayload = {
+    events: [
+      {
+        client: {
+          __zarazTrack: "Login",
+          // @ts-expect-error HTTP event payloads validate discriminated event properties
+          method: "github",
+        },
+      },
+    ],
+  } satisfies ZarazHttpEventsPayload<Events>;
+
+  void invalidPayload;
+};
+
+void checkZarazEventTypes;
+
+test("Zaraz event contracts are type-only", () => {
+  expect(ZarazConfig.events<{}>()).toEqual({});
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zone/Zone.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zone/Zone.test.ts
new file mode 100644
index 00000000000..9e5dc929f95
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Cloudflare/Zone/Zone.test.ts
@@ -0,0 +1,208 @@
+import { adopt, OwnedBySomeoneElse } from "@/AdoptPolicy";
+import * as Cloudflare from "@/Cloudflare";
+import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import { findZoneByName } from "@/Cloudflare/Zone/lookup";
+import { destroy } from "@/RemovalPolicy";
+import * as Test from "@/Test/Vitest";
+import * as zones from "@distilled.cloud/cloudflare/zones";
+import { expect } from "@effect/vitest";
+import * as Cause from "effect/Cause";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Cloudflare.providers() });
+
+// Cloudflare's POST /zones rejects reserved pseudo-TLDs (`.test`, `.local`,
+// `.example`) with "unable to identify ... as a registered domain". A
+// syntactically-valid, registerable name is accepted into a `pending` zone
+// even when the domain isn't actually registered to us — which is all these
+// create/delete lifecycle tests need. Derive the name from the test account id
+// so it's deterministic and never collides with a real zone.
+const zoneNameFor = (accountId: string, label: string) =>
+  process.env.TEST_ZONE_NAME ?? `alchemy-${label}-${accountId}.com`;
+
+test.provider(
+  "create zone retains by default — destroy() opts in to deletion",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const TEST_ZONE = zoneNameFor(accountId, "destroy");
+
+      const zone = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Zone("CreatedZone", {
+            name: TEST_ZONE,
+          }).pipe(destroy());
+        }),
+      );
+
+      expect(zone.name).toBe(TEST_ZONE);
+      expect(zone.accountId).toBe(accountId);
+
+      // The mapped attributes should match what the Cloudflare API reports,
+      // with the API's `null`s normalized to `undefined`.
+      const live = yield* zones.getZone({ zoneId: zone.zoneId });
+      expect(zone.zoneId).toBe(live.id);
+      expect(zone.name).toBe(live.name);
+      expect(zone.accountName).toBe(live.account.name ?? undefined);
+      expect(zone.type).toBe(live.type ?? "full");
+      expect(zone.status).toBe(live.status ?? undefined);
+      expect(zone.paused).toBe(live.paused ?? false);
+      expect(zone.nameServers).toEqual(live.nameServers);
+      expect(zone.originalNameServers).toEqual(
+        live.originalNameServers ?? undefined,
+      );
+      expect(zone.vanityNameServers).toEqual(
+        live.vanityNameServers ?? undefined,
+      );
+      expect(zone.activatedOn).toBe(live.activatedOn ?? undefined);
+      expect(zone.createdOn).toBe(live.createdOn);
+      expect(zone.modifiedOn).toBe(live.modifiedOn);
+      expect(zone.developmentMode).toBe(live.developmentMode);
+      expect(zone.originalDnshost).toBe(live.originalDnshost ?? undefined);
+      expect(zone.originalRegistrar).toBe(live.originalRegistrar ?? undefined);
+      expect(zone.cnameSuffix).toBe(live.cnameSuffix ?? undefined);
+      expect(zone.verificationKey).toBe(live.verificationKey ?? undefined);
+      expect(zone.owner.id).toBe(live.owner.id ?? undefined);
+      expect(zone.meta.foundationDns).toBe(
+        live.meta.foundationDns ?? undefined,
+      );
+
+      yield* stack.destroy();
+
+      yield* waitForZoneToBeDeleted(zone.zoneId);
+    }),
+);
+
+test.provider(
+  "create zone retains by default — survives stack.destroy()",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const TEST_ZONE = zoneNameFor(accountId, "retain");
+
+      const zone = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Cloudflare.Zone("RetainedZone", {
+            name: TEST_ZONE,
+          });
+        }),
+      );
+
+      expect(zone.name).toBe(TEST_ZONE);
+      expect(zone.accountId).toBe(accountId);
+
+      yield* stack.destroy();
+
+      const live = yield* zones.getZone({ zoneId: zone.zoneId });
+      expect(live.id).toBe(zone.zoneId);
+
+      // clean up the retained zone so the test is repeatable
+      yield* zones.deleteZone({ zoneId: zone.zoneId });
+      yield* waitForZoneToBeDeleted(zone.zoneId);
+    }),
+);
+
+test.provider(
+  "adoption — existing zone errors without adopt, takes over with adopt(true)",
+  (stack) =>
+    Effect.gen(function* () {
+      const { accountId } = yield* CloudflareEnvironment;
+      const TEST_ZONE = zoneNameFor(accountId, "adopt");
+
+      // Create the zone out-of-band so the stack has no state of its own for
+      // it — exactly the "the zone already exists" scenario. Tolerate a zone
+      // left behind by an interrupted run so the test stays repeatable.
+      const existing = yield* zones
+        .createZone({
+          account: { id: accountId },
+          name: TEST_ZONE,
+          type: "full",
+        })
+        .pipe(
+          Effect.catchTag("ZoneAlreadyExists", () =>
+            findZoneByName({ accountId, name: TEST_ZONE }).pipe(
+              Effect.flatMap((match) =>
+                match
+                  ? Effect.succeed(match)
+                  : Effect.die(new Error(`zone ${TEST_ZONE} not found`)),
+              ),
+            ),
+          ),
+        );
+
+      // Without `adopt`: a Cloudflare zone carries no ownership markers, so the
+      // engine cannot prove we created it and refuses to take it over. The
+      // engine surfaces this as a defect, so catch the whole cause and pull the
+      // typed error back out rather than string-matching the message.
+      const error = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Zone("AdoptedZone", { name: TEST_ZONE });
+          }),
+        )
+        .pipe(
+          Effect.as(undefined),
+          Effect.catchCause((cause) => Effect.succeed(findOwnedError(cause))),
+        );
+      expect(error).toBeInstanceOf(OwnedBySomeoneElse);
+
+      // With `adopt(true)`: the engine takes over the pre-existing zone instead
+      // of creating a new one. `destroy()` opts the adopted zone into deletion
+      // on teardown so the test stays repeatable.
+      const adopted = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Zone("AdoptedZone", {
+              name: TEST_ZONE,
+            }).pipe(destroy());
+          }),
+        )
+        .pipe(adopt(true));
+      expect(adopted.zoneId).toBe(existing.id);
+      expect(adopted.name).toBe(TEST_ZONE);
+
+      yield* stack.destroy();
+      yield* waitForZoneToBeDeleted(existing.id);
+    }),
+);
+
+const waitForZoneToBeDeleted = Effect.fn(function* (zoneId: string) {
+  yield* zones.getZone({ zoneId }).pipe(
+    // A successful read means the zone is still around — force a retry.
+    Effect.flatMap(() => new ZoneStillExists()),
+    // Any other failure (e.g. `Invalid zone identifier` / 404) means the zone
+    // is gone, which is exactly what we're waiting for.
+    Effect.catch((e) =>
+      e instanceof ZoneStillExists ? Effect.fail(e) : Effect.void,
+    ),
+    Effect.retry({
+      while: (e): e is ZoneStillExists => e instanceof ZoneStillExists,
+      schedule: Schedule.exponential(100),
+      times: 20,
+    }),
+  );
+});
+
+class ZoneStillExists extends Data.TaggedError("ZoneStillExists") {}
+
+/**
+ * Pull the {@link OwnedBySomeoneElse} value out of a Cause regardless of
+ * whether the engine raised it as a typed failure or a defect.
+ */
+const findOwnedError = (
+  cause: Cause.Cause<unknown>,
+): OwnedBySomeoneElse | undefined =>
+  cause.reasons
+    .map((reason) =>
+      Cause.isFailReason(reason)
+        ? reason.error
+        : Cause.isDieReason(reason)
+          ? reason.defect
+          : undefined,
+    )
+    .find(
+      (value): value is OwnedBySomeoneElse =>
+        value instanceof OwnedBySomeoneElse,
+    );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Drizzle/Schema.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Drizzle/Schema.test.ts
new file mode 100644
index 00000000000..c18cdd6fb64
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Drizzle/Schema.test.ts
@@ -0,0 +1,106 @@
+import * as Drizzle from "@/Drizzle";
+import * as Stack from "@/Stack";
+import { State } from "@/State";
+import * as Test from "@/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+const { test } = Test.make({ providers: Drizzle.providers() });
+
+// Minimal drizzle-orm schema source — enough for `generateDrizzleJson`
+// to produce a non-empty snapshot.
+const SCHEMA_SOURCE = `
+import { pgTable, serial, text } from "drizzle-orm/pg-core";
+
+export const users = pgTable("users", {
+  id: serial("id").primaryKey(),
+  name: text("name").notNull(),
+});
+`;
+
+const DRIFTED_SCHEMA_SOURCE =
+  SCHEMA_SOURCE +
+  `\nexport const posts = pgTable("posts", {\n  id: serial("id").primaryKey(),\n  title: text("title").notNull(),\n});\n`;
+
+const stageWorkspace = (initialSource: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const root = yield* fs.makeTempDirectory({
+      prefix: "alchemy-drizzle-schema-test-",
+    });
+    const schemaPath = path.join(root, "schema.ts");
+    yield* fs.writeFileString(schemaPath, initialSource);
+    const out = path.join(root, "migrations");
+    return { root, out, schemaPath };
+  });
+
+const getStatus = Effect.fn(function* (fqn: string) {
+  const state = yield* yield* State;
+  const stk = yield* Stack.Stack;
+  const s = yield* state.get({ stack: stk.name, stage: stk.stage, fqn });
+  return s?.status;
+});
+
+test.provider(
+  "repeated deploys with no schema drift produce noop, not update (regression: forced update cascaded into Neon.Branch)",
+  (stack) =>
+    Effect.gen(function* () {
+      const ws = yield* stageWorkspace(SCHEMA_SOURCE);
+
+      yield* stack.deploy(
+        Drizzle.Schema("app-schema", {
+          schema: ws.schemaPath,
+          out: ws.out,
+        }),
+      );
+      expect(yield* getStatus("app-schema")).toEqual("created");
+
+      // Second deploy with the same schema. Before the fix, Schema.diff
+      // returned `{ action: "update" }` unconditionally, so status would
+      // flip to "updated" and downstream resources (e.g. Neon.Branch)
+      // would see `schema.out` as an unresolved Output during plan and
+      // cascade into their own spurious updates.
+      yield* stack.deploy(
+        Drizzle.Schema("app-schema", {
+          schema: ws.schemaPath,
+          out: ws.out,
+        }),
+      );
+      expect(yield* getStatus("app-schema")).toEqual("created");
+    }),
+);
+
+test.provider(
+  "deploy after a real schema change updates the resource",
+  (stack) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const ws = yield* stageWorkspace(SCHEMA_SOURCE);
+
+      const initial = yield* stack.deploy(
+        Drizzle.Schema("app-schema", {
+          schema: ws.schemaPath,
+          out: ws.out,
+        }),
+      );
+
+      // Write the drifted schema as a *new* file so the dynamic import
+      // cache doesn't hand us the original module.
+      const driftedSchemaPath = path.join(ws.root, "schema-drifted.ts");
+      yield* fs.writeFileString(driftedSchemaPath, DRIFTED_SCHEMA_SOURCE);
+
+      const drifted = yield* stack.deploy(
+        Drizzle.Schema("app-schema", {
+          schema: driftedSchemaPath,
+          out: ws.out,
+        }),
+      );
+
+      expect(yield* getStatus("app-schema")).toEqual("updated");
+      expect(drifted.snapshotHash).not.toEqual(initial.snapshotHash);
+    }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/FQN.test.ts b/.repos/alchemy-effect/packages/alchemy/test/FQN.test.ts
new file mode 100644
index 00000000000..2bdb8cda228
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/FQN.test.ts
@@ -0,0 +1,108 @@
+import { describe, expect, test } from "@effect/vitest";
+import { fromPath, FQN_SEPARATOR, parseFqn, toFqn, toPath } from "../src/FQN";
+import type { NamespaceNode } from "../src/Namespace";
+
+describe("FQN", () => {
+  describe("toPath", () => {
+    test("returns empty array for undefined namespace", () => {
+      expect(toPath(undefined)).toEqual([]);
+    });
+
+    test("returns single element for root namespace", () => {
+      const ns: NamespaceNode = { Id: "Root" };
+      expect(toPath(ns)).toEqual(["Root"]);
+    });
+
+    test("returns path from root to leaf", () => {
+      const ns: NamespaceNode = {
+        Id: "Child",
+        Parent: {
+          Id: "Parent",
+          Parent: { Id: "Root" },
+        },
+      };
+      expect(toPath(ns)).toEqual(["Root", "Parent", "Child"]);
+    });
+  });
+
+  describe("toFqn", () => {
+    test("returns logicalId for undefined namespace", () => {
+      expect(toFqn(undefined, "MyResource")).toBe("MyResource");
+    });
+
+    test("returns namespace-qualified name", () => {
+      const ns: NamespaceNode = { Id: "Parent" };
+      expect(toFqn(ns, "MyResource")).toBe(`Parent${FQN_SEPARATOR}MyResource`);
+    });
+
+    test("handles deep namespace", () => {
+      const ns: NamespaceNode = {
+        Id: "Child",
+        Parent: { Id: "Parent" },
+      };
+      expect(toFqn(ns, "MyResource")).toBe(
+        `Parent${FQN_SEPARATOR}Child${FQN_SEPARATOR}MyResource`,
+      );
+    });
+  });
+
+  describe("parseFqn", () => {
+    test("parses simple logicalId", () => {
+      expect(parseFqn("MyResource")).toEqual({
+        path: [],
+        logicalId: "MyResource",
+      });
+    });
+
+    test("parses namespaced FQN", () => {
+      expect(parseFqn("Parent/Child/MyResource")).toEqual({
+        path: ["Parent", "Child"],
+        logicalId: "MyResource",
+      });
+    });
+
+    test("parses single namespace FQN", () => {
+      expect(parseFqn("Parent/MyResource")).toEqual({
+        path: ["Parent"],
+        logicalId: "MyResource",
+      });
+    });
+  });
+
+  describe("fromPath", () => {
+    test("returns undefined for empty path", () => {
+      expect(fromPath([])).toBeUndefined();
+    });
+
+    test("returns single node for single element", () => {
+      const result = fromPath(["Root"]);
+      expect(result).toEqual({ Id: "Root", Parent: undefined });
+    });
+
+    test("returns nested nodes", () => {
+      const result = fromPath(["Root", "Parent", "Child"]);
+      expect(result).toEqual({
+        Id: "Child",
+        Parent: {
+          Id: "Parent",
+          Parent: { Id: "Root", Parent: undefined },
+        },
+      });
+    });
+  });
+
+  describe("roundtrip", () => {
+    test("toFqn -> parseFqn -> fromPath -> toFqn", () => {
+      const ns: NamespaceNode = {
+        Id: "Child",
+        Parent: { Id: "Parent" },
+      };
+      const logicalId = "MyResource";
+      const fqn = toFqn(ns, logicalId);
+      const parsed = parseFqn(fqn);
+      const reconstructedNs = fromPath(parsed.path);
+      const roundtripFqn = toFqn(reconstructedNs, parsed.logicalId);
+      expect(roundtripFqn).toBe(fqn);
+    });
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/KeyPair.test.ts b/.repos/alchemy-effect/packages/alchemy/test/KeyPair.test.ts
new file mode 100644
index 00000000000..caaf2c27270
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/KeyPair.test.ts
@@ -0,0 +1,86 @@
+import * as NodeCrypto from "node:crypto";
+import { KeyPair, KeyPairProvider } from "@/KeyPair";
+import { inMemoryState } from "@/State";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+const { test } = Test.make({
+  providers: KeyPairProvider(),
+  state: inMemoryState(),
+});
+
+const assertPemKeyPair = (attrs: {
+  privateKey: Redacted.Redacted<string>;
+  publicKey: string;
+}) => {
+  const priv = Redacted.value(attrs.privateKey);
+  expect(priv).toMatch(/^-----BEGIN PRIVATE KEY-----/);
+  expect(priv).toMatch(/-----END PRIVATE KEY-----/);
+  expect(attrs.publicKey).toMatch(/^-----BEGIN PUBLIC KEY-----/);
+  expect(attrs.publicKey).toMatch(/-----END PUBLIC KEY-----/);
+  // Node throws if the PEM is malformed.
+  NodeCrypto.createPrivateKey(priv);
+  NodeCrypto.createPublicKey(attrs.publicKey);
+};
+
+describe("Alchemy.KeyPair", () => {
+  test.provider("mints an ed25519 keypair by default", (stack) =>
+    Effect.gen(function* () {
+      const attrs = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* KeyPair("ed25519-default");
+        }),
+      );
+      expect(attrs.algorithm).toBe("ed25519");
+      assertPemKeyPair(attrs);
+    }),
+  );
+
+  test.provider("mints an rsa keypair when requested", (stack) =>
+    Effect.gen(function* () {
+      const attrs = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* KeyPair("rsa-key", {
+            algorithm: "rsa",
+            modulusLength: 2048,
+          });
+        }),
+      );
+      expect(attrs.algorithm).toBe("rsa");
+      assertPemKeyPair(attrs);
+    }),
+  );
+
+  test.provider("mints an ec keypair when requested", (stack) =>
+    Effect.gen(function* () {
+      const attrs = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* KeyPair("ec-key", {
+            algorithm: "ec",
+            namedCurve: "P-256",
+          });
+        }),
+      );
+      expect(attrs.algorithm).toBe("ec");
+      assertPemKeyPair(attrs);
+    }),
+  );
+
+  test.provider("preserves the keypair across deploys", (stack) =>
+    Effect.gen(function* () {
+      const program = Effect.gen(function* () {
+        return yield* KeyPair("stable-key");
+      });
+
+      const first = yield* stack.deploy(program);
+      const second = yield* stack.deploy(program);
+
+      expect(Redacted.value(second.privateKey)).toBe(
+        Redacted.value(first.privateKey),
+      );
+      expect(second.publicKey).toBe(first.publicKey);
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcProvider.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcProvider.test.ts
new file mode 100644
index 00000000000..49e9ecd61b1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcProvider.test.ts
@@ -0,0 +1,179 @@
+import { AlchemyContext } from "@/AlchemyContext.ts";
+import { InstanceId } from "@/InstanceId.ts";
+import * as RpcProvider from "@/Local/RpcProvider.ts";
+import type { ProviderService } from "@/Provider.ts";
+import { Resource } from "@/Resource.ts";
+import { Stack, type StackSpec } from "@/Stack.ts";
+import { Stage } from "@/Stage.ts";
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+
+interface TestResource extends Resource<
+  "Local.RpcProvider.Test",
+  {},
+  { ok: boolean }
+> {}
+const TestResource = Resource<TestResource>("Local.RpcProvider.Test");
+
+type StackShape = Omit<StackSpec, "output">;
+
+interface Capture {
+  stack?: StackShape;
+  stage?: string;
+  instanceId?: string;
+}
+
+const defaultStack: StackShape = {
+  name: "default-stack",
+  stage: "default-stage",
+  resources: {},
+  bindings: {},
+  actions: {},
+};
+
+describe("Local.RpcProvider.effect", () => {
+  it.effect(
+    "provides default Stack, Stage, and InstanceId to lifecycle effects",
+    () =>
+      Effect.gen(function* () {
+        const [capture, result] = yield* useProvider((provider) =>
+          provider.reconcile({
+            id: "r",
+            instanceId: "inst-from-arg",
+            news: {},
+            olds: undefined,
+            output: undefined,
+            session: undefined as any,
+            bindings: [],
+          }),
+        );
+        expect(result).toEqual({ ok: true });
+        expect(capture.stack).toBe(defaultStack);
+        expect(capture.stage).toBe(defaultStack.stage);
+        expect(capture.instanceId).toBe("inst-from-arg");
+      }),
+  );
+
+  it.effect(
+    "does not override Stack, Stage, or InstanceId when already provided",
+    () =>
+      Effect.gen(function* () {
+        const overrideStack: StackShape = {
+          name: "override-stack",
+          stage: "ignored-stage-on-stack",
+          resources: {},
+          bindings: {},
+          actions: {},
+        };
+        const [capture] = yield* useProvider((provider) =>
+          provider
+            .reconcile({
+              id: "r",
+              instanceId: "inst-from-arg",
+              news: {},
+              olds: undefined,
+              output: undefined,
+              session: undefined as any,
+              bindings: [],
+            })
+            .pipe(
+              Effect.provideService(Stack, overrideStack),
+              Effect.provideService(Stage, "override-stage"),
+              Effect.provideService(InstanceId, "override-instance-id"),
+            ),
+        );
+        expect(capture.stack).toBe(overrideStack);
+        expect(capture.stage).toBe("override-stage");
+        expect(capture.instanceId).toBe("override-instance-id");
+      }),
+  );
+
+  it.effect("provides defaults to Stream-returning lifecycle methods", () =>
+    Effect.gen(function* () {
+      const [capture, items] = yield* useProvider((provider) =>
+        provider.tail!({
+          id: "r",
+          instanceId: "inst-from-arg",
+          props: {},
+          output: { ok: true },
+        }).pipe(Stream.runCollect),
+      );
+      expect(items.length).toBe(1);
+      expect(capture.stack).toBe(defaultStack);
+      expect(capture.stage).toBe(defaultStack.stage);
+      expect(capture.instanceId).toBe("inst-from-arg");
+    }),
+  );
+
+  it.effect("omits InstanceId fallback when input has no instanceId", () =>
+    Effect.gen(function* () {
+      const [capture, exit] = yield* useProvider((provider) =>
+        provider
+          .reconcile({
+            id: "r",
+            news: {},
+            olds: undefined,
+            output: undefined,
+            session: undefined!,
+            instanceId: undefined!,
+            bindings: [],
+          })
+          .pipe(Effect.exit),
+      );
+      expect(exit._tag).toBe("Failure");
+      expect(capture.stack).toBe(defaultStack);
+      expect(capture.stage).toBe(defaultStack.stage);
+      expect(capture.instanceId).toBeUndefined();
+    }),
+  );
+});
+
+const TestResourceProvider = (capture: Capture) =>
+  RpcProvider.effect(
+    TestResource,
+    "ignored://entry",
+    Effect.succeed({
+      reconcile: Effect.fn(function* (_input: any) {
+        capture.stack = yield* Stack;
+        capture.stage = yield* Stage;
+        capture.instanceId = yield* InstanceId;
+        return { ok: true };
+      }),
+      tail: (_input: any) =>
+        Stream.fromEffect(
+          Effect.gen(function* () {
+            capture.stack = yield* Stack;
+            capture.stage = yield* Stage;
+            capture.instanceId = yield* InstanceId;
+            return { timestamp: new Date(0), message: "ok" };
+          }),
+        ),
+      delete: Effect.fn(function* () {}),
+    }),
+  );
+
+const useProvider = <A, E, R>(
+  callback: (provider: ProviderService<TestResource>) => Effect.Effect<A, E, R>,
+) => {
+  const capture: Capture = {};
+  return TestResource.Provider.pipe(
+    Effect.flatMap(callback),
+    Effect.map((result) => [capture, result] as const),
+    Effect.provide(
+      Layer.provide(
+        TestResourceProvider(capture),
+        Layer.mergeAll(
+          Layer.succeed(Stack, defaultStack),
+          Layer.succeed(Stage, defaultStack.stage),
+          Layer.succeed(AlchemyContext, {
+            dotAlchemy: "/tmp/.alchemy",
+            dev: false,
+            adopt: false,
+          }),
+        ),
+      ),
+    ),
+  );
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSerialization.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSerialization.test.ts
new file mode 100644
index 00000000000..5c746b354d8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSerialization.test.ts
@@ -0,0 +1,228 @@
+import {
+  unwrapRpcHandlers,
+  wrapRpcHandlers,
+  type RpcWrapped,
+} from "@/Local/RpcSerialization.ts";
+import * as Output from "@/Output.ts";
+import { describe, expect, it } from "@effect/vitest";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+
+/**
+ * Builds a client whose wrap→unwrap path mirrors the production wire:
+ * `unwrapRpcEffectHandler` serializes its args; capnweb JSON-encodes them
+ * over the websocket; `wrapRpcEffectHandler` deserializes them on the other
+ * end. We thread `JSON.parse(JSON.stringify(...))` between the wrap and
+ * unwrap layers to model that hop. Streams skip the JSON hop because they
+ * are bridged via a real `ReadableStream`.
+ */
+const roundTrip = <T extends Record<string, any>>(
+  handlers: T,
+  streamKeys?: Array<keyof T>,
+): T => {
+  const wrapped = wrapRpcHandlers(handlers, streamKeys);
+  const piped = Object.fromEntries(
+    Object.entries(wrapped).map(([key, value]) => {
+      if (typeof value !== "function") {
+        return [key, value];
+      }
+      if (streamKeys?.includes(key as keyof T)) {
+        // Streams bypass JSON; the underlying ReadableStream is shipped.
+        return [key, value];
+      }
+      const fn = value as (args: Array<unknown>) => Promise<unknown>;
+      const piped = async (args: Array<unknown>) => {
+        const wireArgs = JSON.parse(JSON.stringify(args));
+        const result = await fn(wireArgs);
+        return JSON.parse(JSON.stringify(result));
+      };
+      return [key, piped];
+    }),
+  ) as RpcWrapped<T>;
+  return unwrapRpcHandlers<T>(piped, streamKeys) as T;
+};
+
+describe("Local.RpcSerialization", () => {
+  describe("argument serialization", () => {
+    it.effect("round-trips a top-level Redacted argument", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          echo: (s: Redacted.Redacted<string>) =>
+            Effect.succeed(Redacted.value(s)),
+        };
+        const client = roundTrip(handlers);
+        expect(yield* client.echo(Redacted.make("hush"))).toBe("hush");
+      }),
+    );
+
+    it.effect("round-trips a Redacted nested inside an object", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          password: (env: { password: Redacted.Redacted<string> }) =>
+            Effect.succeed(Redacted.value(env.password)),
+        };
+        const client = roundTrip(handlers);
+        expect(
+          yield* client.password({ password: Redacted.make("hush") }),
+        ).toBe("hush");
+      }),
+    );
+
+    it.effect("preserves objects with their own toJSON (Date)", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          withDate: (env: { when: Date | string }) =>
+            Effect.succeed(String(env.when)),
+        };
+        const client = roundTrip(handlers);
+        const d = new Date("2026-05-16T12:00:00.000Z");
+        expect(yield* client.withDate({ when: d })).toBe(d.toISOString());
+      }),
+    );
+
+    it.effect("drops function-valued args (replaced with null)", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          take: (arg: { cb: (() => void) | null }) =>
+            Effect.succeed(arg.cb === null ? "null" : typeof arg.cb),
+        };
+        const client = roundTrip(handlers);
+        expect(yield* client.take({ cb: () => {} })).toBe("null");
+      }),
+    );
+
+    it.effect("serializes arrays element-wise", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          sum: (xs: ReadonlyArray<Redacted.Redacted<number>>) =>
+            Effect.succeed(xs.reduce((a, x) => a + Redacted.value(x), 0)),
+        };
+        const client = roundTrip(handlers);
+        const result = yield* client.sum([
+          Redacted.make(1),
+          Redacted.make(2),
+          Redacted.make(3),
+        ]);
+        expect(result).toBe(6);
+      }),
+    );
+
+    it.effect("converts Output sentinel into a NamedExpr", () =>
+      Effect.gen(function* () {
+        let received: unknown;
+        const handlers = {
+          take: (arg: { val: Output.Output<string> }) =>
+            Effect.sync(() => {
+              received = arg.val;
+              return "ok";
+            }),
+        };
+        const client = roundTrip(handlers);
+        const fakeOutput = new Output.NamedExpr(
+          new Output.EffectExpr(Output.VoidExpr, () => Effect.succeed("x")),
+          "myBinding",
+        );
+        const result = yield* client.take({
+          val: fakeOutput as unknown as Output.Output<string>,
+        });
+        expect(result).toBe("ok");
+        expect(Output.isOutput(received)).toBe(true);
+        expect((received as Output.NamedExpr<unknown>).kind).toBe("NamedExpr");
+      }),
+    );
+  });
+
+  describe("effect exit serialization", () => {
+    it.effect("propagates success", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          ok: () => Effect.succeed(42),
+        };
+        expect(yield* roundTrip(handlers).ok()).toBe(42);
+      }),
+    );
+
+    it.effect("propagates Fail (typed error)", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          boom: (): Effect.Effect<never, { _tag: "Boom"; msg: string }> =>
+            Effect.fail({ _tag: "Boom" as const, msg: "kaboom" }),
+        };
+        const exit = yield* Effect.exit(roundTrip(handlers).boom());
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(Cause.hasFails(exit.cause)).toBe(true);
+          const found = Cause.findErrorOption(exit.cause);
+          expect(found._tag).toBe("Some");
+          if (found._tag === "Some") {
+            expect(found.value).toEqual({ _tag: "Boom", msg: "kaboom" });
+          }
+        }
+      }),
+    );
+
+    it.effect("propagates Die (defect)", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          boom: () => Effect.die(new Error("defect")),
+        };
+        const exit = yield* Effect.exit(roundTrip(handlers).boom());
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(Cause.hasDies(exit.cause)).toBe(true);
+        }
+      }),
+    );
+
+    it.effect("propagates Interrupt", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          boom: () => Effect.interrupt,
+        };
+        const exit = yield* Effect.exit(roundTrip(handlers).boom());
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          expect(Cause.hasInterrupts(exit.cause)).toBe(true);
+        }
+      }),
+    );
+  });
+
+  describe("streams", () => {
+    it.effect("round-trips a stream when streamKeys is honored", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          tail: (_n: number) => Stream.fromIterable([1, 2, 3, 4]),
+        };
+        const client = roundTrip(handlers, ["tail"] as const);
+        const out: Array<number> = [];
+        yield* Stream.runForEach(client.tail(0), (x) =>
+          Effect.sync(() => {
+            out.push(x);
+          }),
+        );
+        expect(out).toEqual([1, 2, 3, 4]);
+      }),
+    );
+  });
+
+  describe("nested handlers", () => {
+    it.effect("recurses into nested handler objects", () =>
+      Effect.gen(function* () {
+        const handlers = {
+          group: {
+            echo: (s: Redacted.Redacted<string>) =>
+              Effect.succeed(Redacted.value(s)),
+          },
+        };
+        const client = roundTrip(handlers);
+        expect(yield* client.group.echo(Redacted.make("nested"))).toBe(
+          "nested",
+        );
+      }),
+    );
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServer.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServer.test.ts
new file mode 100644
index 00000000000..45b46f5f40f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServer.test.ts
@@ -0,0 +1,115 @@
+import { unwrapRpcHandlers } from "@/Local/RpcSerialization.ts";
+import type { RpcProxyApi } from "@/Local/RpcServer.ts";
+import { PlatformServices } from "@/Util/PlatformServices.ts";
+import { assert, describe, expect, it } from "@effect/vitest";
+import { newWebSocketRpcSession, type RpcStub } from "capnweb";
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as Sink from "effect/Sink";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { openWebSocket, waitForExit } from "./fixtures/process-effect.ts";
+import { runtimes } from "./fixtures/runtimes.ts";
+
+const FIXTURE_TS = new URL("./fixtures/rpc-server-entry.ts", import.meta.url)
+  .pathname;
+
+const ADDRESS_RE = /<ALCHEMY_RPC_ADDRESS>(.+?)<\/ALCHEMY_RPC_ADDRESS>/;
+
+const sampleEnv = () =>
+  JSON.stringify({
+    profile: null,
+    envFile: null,
+    alchemyContext: {
+      dotAlchemy: "/tmp/.alchemy",
+      updateStateStore: false,
+      dev: true,
+      adopt: false,
+    },
+    stack: { name: "test", stage: "dev" },
+  });
+
+for (const runtime of runtimes()) {
+  describe.skipIf(!runtime.available)(
+    `Local.RpcServer (${runtime.name})`,
+    () => {
+      const [bin, ...args] = runtime.argv(FIXTURE_TS);
+      const launch = ChildProcess.make(bin, args, {
+        env: {
+          ALCHEMY_RPC_SERVER_ENVIRONMENT: sampleEnv(),
+        },
+        extendEnv: true,
+        // We never write to the child's stdin, so close it. stdout/stderr
+        // default to "pipe" which is what we want for the buffering forks
+        // below.
+        stdin: "ignore",
+        // SIGTERM first, escalate to SIGKILL after 1s if the child hasn't
+        // exited. Matches the behavior of the old hand-rolled finalizer.
+        killSignal: "SIGTERM",
+        forceKillAfter: "1 second",
+      });
+
+      it.live(
+        "prints the RPC address marker on stdout and accepts /parent + session connections",
+        () =>
+          Effect.gen(function* () {
+            const proc = yield* launch;
+            const url = yield* proc.stdout.pipe(
+              Stream.decodeText,
+              Stream.run(
+                Sink.fold(
+                  () => "",
+                  (acc) => !acc.includes("</ALCHEMY_RPC_ADDRESS>"),
+                  (acc, chunk) => Effect.succeed(acc + chunk),
+                ),
+              ),
+              Effect.timeout("5 seconds"),
+              Effect.map((output) => output.match(ADDRESS_RE)?.[1]),
+            );
+            assert(url, `url not found in output: "${url}"`);
+            expect(url).toMatch(/^ws:\/\//);
+
+            // Open the parent websocket inside the scope so it stays alive
+            // for the duration of the RPC exchange below; closing it later
+            // is exactly what triggers the child to exit.
+            const parent = yield* openWebSocket(new URL("/parent", url));
+
+            // Drive a real RPC call through a session websocket. capnweb's
+            // surface is Promise-based, so we wrap exactly at the boundary
+            // and let everything above and below stay in Effect.
+            const stub = newWebSocketRpcSession(url) as RpcStub<RpcProxyApi>;
+            const result = yield* Effect.promise(async () => {
+              const provider = await stub.getProvider("Test.Echo");
+              const handlers = unwrapRpcHandlers(provider as any) as {
+                echo: (msg: string) => Effect.Effect<string>;
+              };
+              return await Effect.runPromise(handlers.echo("hello"));
+            });
+            expect(result).toBe("echo:hello");
+
+            // Closing the parent ws should cause the child to exit promptly.
+            yield* Effect.sync(() => parent.close());
+            // waitForExit fails if the child is still running after the
+            // timeout, so reaching this point means the child exited.
+            yield* waitForExit(proc, "5 seconds");
+          }).pipe(Effect.scoped, Effect.provide(PlatformServices)),
+        { timeout: 30_000 },
+      );
+
+      it.live(
+        "exits if the parent never connects within ~10s",
+        () =>
+          Effect.gen(function* () {
+            const start = yield* Clock.currentTimeMillis;
+            const proc = yield* launch;
+            // Never open /parent — the server should self-terminate via the
+            // connect timeout.
+            yield* waitForExit(proc, "20 seconds");
+            const elapsed = (yield* Clock.currentTimeMillis) - start;
+            expect(elapsed).toBeLessThan(18_000);
+          }).pipe(Effect.scoped, Effect.provide(PlatformServices)),
+        { timeout: 30_000 },
+      );
+    },
+  );
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServerEnvironment.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServerEnvironment.test.ts
new file mode 100644
index 00000000000..136be22cb75
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServerEnvironment.test.ts
@@ -0,0 +1,71 @@
+import { AlchemyContext } from "@/AlchemyContext.ts";
+import {
+  fromEnv,
+  layer,
+  RPC_SERVER_ENVIRONMENT_KEY,
+  type RpcServerEnvironment,
+} from "@/Local/RpcServerEnvironment.ts";
+import { Stack } from "@/Stack.ts";
+import { Stage } from "@/Stage.ts";
+import { PlatformServices } from "@/Util/PlatformServices.ts";
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+const sampleEnv: RpcServerEnvironment = {
+  profile: undefined,
+  envFile: undefined,
+  alchemyContext: {
+    dotAlchemy: "/tmp/.alchemy",
+    dev: true,
+    adopt: false,
+  },
+  stack: {
+    name: "my-stack",
+    stage: "dev",
+  },
+};
+
+describe("Local.RpcServerEnvironment", () => {
+  it.effect("layer() provides Stack, Stage, and AlchemyContext", () =>
+    Effect.gen(function* () {
+      const observed = yield* Effect.gen(function* () {
+        const stack = yield* Stack;
+        const stage = yield* Stage;
+        const ctx = yield* AlchemyContext;
+        return { stack, stage, ctx };
+      }).pipe(
+        Effect.provide(Layer.provide(layer(sampleEnv), PlatformServices)),
+      );
+
+      expect(observed.stack.name).toBe("my-stack");
+      expect(observed.stack.stage).toBe("dev");
+      expect(observed.stage).toBe("dev");
+      expect(observed.ctx.dotAlchemy).toBe("/tmp/.alchemy");
+      expect(observed.ctx.dev).toBe(true);
+    }),
+  );
+
+  it.effect("fromEnv() roundtrips a serialized RpcServerEnvironment", () =>
+    Effect.gen(function* () {
+      // We can't safely mutate `process.env[RPC_SERVER_ENVIRONMENT_KEY]`
+      // from inside a concurrent test, so we install a private layer in
+      // front of `fromEnv()` instead and verify it produces the same
+      // Stack service that `layer()` does.
+      process.env[RPC_SERVER_ENVIRONMENT_KEY] = JSON.stringify(sampleEnv);
+      try {
+        const stack = yield* Stack.pipe(
+          Effect.provide(Layer.provide(fromEnv(), PlatformServices)),
+        );
+        expect(stack.name).toBe(sampleEnv.stack.name);
+        expect(stack.stage).toBe(sampleEnv.stack.stage);
+      } finally {
+        delete process.env[RPC_SERVER_ENVIRONMENT_KEY];
+      }
+    }),
+  );
+
+  it("exports the canonical environment variable key", () => {
+    expect(RPC_SERVER_ENVIRONMENT_KEY).toBe("ALCHEMY_RPC_SERVER_ENVIRONMENT");
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServerSession.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServerSession.test.ts
new file mode 100644
index 00000000000..eac3b49c4c5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcServerSession.test.ts
@@ -0,0 +1,124 @@
+import {
+  makeServerRpcSession,
+  type ServerWebSocketLike,
+} from "@/Local/RpcServerSession.ts";
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+
+describe("Local.RpcServerSession", () => {
+  it.effect("happy path: paired sessions round-trip a method call", () =>
+    Effect.gen(function* () {
+      const mainA = { ping: async (x: number) => x + 1 };
+      const mainB = { pong: async (x: string) => `${x}!` };
+      const { a } = pairSessions(mainA, mainB);
+      const remote = a.session.getRemoteMain() as unknown as {
+        pong: (x: string) => Promise<string>;
+      };
+      const result = yield* Effect.promise(() => remote.pong("hi"));
+      expect(result).toBe("hi!");
+    }),
+  );
+
+  it.effect("string and Buffer payloads both decode", () =>
+    Effect.gen(function* () {
+      const received: Array<string> = [];
+      const ws: ServerWebSocketLike = {
+        send: () => {},
+        close: () => {},
+      };
+      // Build a session purely to observe `dispatch.message` decoding.
+      // Use a noop main; we won't call anything on it.
+      const { dispatch } = makeServerRpcSession(ws, {});
+      const origMessage = dispatch.message;
+      dispatch.message = (data: any) => {
+        if (typeof data === "string") {
+          received.push(`str:${data}`);
+        } else {
+          received.push(`buf:${data.toString("utf-8")}`);
+        }
+        return origMessage(data);
+      };
+      dispatch.message("hello");
+      dispatch.message(Buffer.from("world", "utf-8") as Buffer<ArrayBuffer>);
+      expect(received).toEqual(["str:hello", "buf:world"]);
+    }),
+  );
+
+  it.effect("dispatch.message after dispatch.close is dropped silently", () =>
+    Effect.gen(function* () {
+      const ws: ServerWebSocketLike = {
+        send: () => {},
+        close: () => {},
+      };
+      const { dispatch } = makeServerRpcSession(ws, {});
+      dispatch.close(1000, "bye");
+      // Should not throw, should be a no-op.
+      expect(() => dispatch.message("anything")).not.toThrow();
+    }),
+  );
+
+  it.effect("dispatch.close rejects a pending getRemoteMain call", () =>
+    Effect.gen(function* () {
+      // mainB never resolves on the wire because we never deliver anything
+      // back; the close event should reject the in-flight call.
+      const closes: Array<{ code?: number; reason?: string }> = [];
+      const ws: ServerWebSocketLike = {
+        send: () => {
+          // intentionally drop outbound traffic
+        },
+        close: (code, reason) => {
+          closes.push({ code, reason });
+        },
+      };
+      const { session, dispatch } = makeServerRpcSession(ws, {});
+      const remote = session.getRemoteMain() as unknown as {
+        ping: (n: number) => Promise<number>;
+      };
+      const inFlight = remote.ping(1);
+      dispatch.close(1006, "abnormal");
+      // The dropped outbound traffic means the only way `inFlight` can
+      // resolve is by rejection after `dispatch.close`. Wrap it as an
+      // Effect that fails on rejection so we can assert with `Exit`.
+      const exit = yield* Effect.exit(Effect.tryPromise(() => inFlight));
+      expect(Exit.isFailure(exit)).toBe(true);
+    }),
+  );
+});
+
+/**
+ * Wire two `ServerRpcSession`s together over in-memory fake websockets so we
+ * can drive `RpcSession.getRemoteMain()` end-to-end without touching the
+ * platform WS server.
+ */
+const pairSessions = <
+  A extends Record<string, any>,
+  B extends Record<string, any>,
+>(
+  mainA: A,
+  mainB: B,
+) => {
+  const closes: Array<{ side: "a" | "b"; code?: number; reason?: string }> = [];
+  let a!: ReturnType<typeof makeServerRpcSession<A>>;
+  let b!: ReturnType<typeof makeServerRpcSession<B>>;
+
+  const wsA: ServerWebSocketLike = {
+    send: (msg) => {
+      queueMicrotask(() => b.dispatch.message(msg));
+    },
+    close: (code, reason) => {
+      closes.push({ side: "a", code, reason });
+    },
+  };
+  const wsB: ServerWebSocketLike = {
+    send: (msg) => {
+      queueMicrotask(() => a.dispatch.message(msg));
+    },
+    close: (code, reason) => {
+      closes.push({ side: "b", code, reason });
+    },
+  };
+  a = makeServerRpcSession<A>(wsA, mainA);
+  b = makeServerRpcSession<B>(wsB, mainB);
+  return { a, b, wsA, wsB, closes };
+};
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSpawner.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSpawner.test.ts
new file mode 100644
index 00000000000..bedbd800fdb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSpawner.test.ts
@@ -0,0 +1,209 @@
+import { unwrapRpcHandlers } from "@/Local/RpcSerialization.ts";
+import type { RpcProxyApi } from "@/Local/RpcServer.ts";
+import {
+  layerServer,
+  RpcSpawner,
+  type RpcSpawnPayload,
+} from "@/Local/RpcSpawner.ts";
+import { PlatformServices } from "@/Util/PlatformServices.ts";
+import { describe, expect, it } from "@effect/vitest";
+import { newWebSocketRpcSession, type RpcStub } from "capnweb";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import {
+  assertPidExited,
+  canOpenWebSocket,
+  isAlive,
+  openWebSocket,
+  pidListeningOn,
+} from "./fixtures/process-effect.ts";
+
+const FIXTURE_TS_URL = new URL(
+  "./fixtures/rpc-server-entry.ts",
+  import.meta.url,
+).toString();
+const CRASH_FIXTURE_TS_URL = new URL(
+  "./fixtures/rpc-server-crash.ts",
+  import.meta.url,
+).toString();
+
+const samplePayload = (
+  serverEntryUrl: string,
+  stackName = "test",
+): RpcSpawnPayload => ({
+  serverEntryUrl,
+  alchemyContext: {
+    dotAlchemy: "/tmp/.alchemy",
+    dev: true,
+    adopt: false,
+  },
+  stack: { name: stackName, stage: "dev" },
+});
+
+// The spawner inherits the runtime that vitest itself is running under
+// (it shells out to `bun` or `node` based on `typeof Bun`). These tests
+// only verify behavior for the active runtime; run vitest under both to
+// get full coverage.
+describe(`Local.RpcSpawner (runtime=${typeof globalThis.Bun !== "undefined" ? "bun" : "node"})`, () => {
+  /**
+   * The Spawner layer (and any child processes it spawns) is torn down
+   * when the surrounding test scope closes, so we provide it at the test
+   * boundary rather than wrapping a sub-effect — that would tear the
+   * server down the moment the sub-effect returned.
+   */
+  const services = Layer.provideMerge(
+    layerServer({ profile: undefined, envFile: undefined }),
+    Layer.merge(PlatformServices, FetchHttpClient.layer),
+  );
+
+  it.live(
+    "POST returns a ws url whose RPC end-to-end call hits the fixture",
+    () =>
+      Effect.gen(function* () {
+        const url = yield* RpcSpawner.useSync((spawner) => spawner.url);
+        const wsUrl = yield* post(url, samplePayload(FIXTURE_TS_URL));
+        expect(wsUrl).toMatch(/^ws:\/\//);
+        const result = yield* echoWebSocket(wsUrl, "hello");
+        expect(result).toBe("echo:hello");
+      }).pipe(Effect.provide(services)),
+    { timeout: 60_000 },
+  );
+
+  it.live(
+    "caches the child by payload: a second POST returns the same url",
+    () =>
+      Effect.gen(function* () {
+        const url = yield* RpcSpawner.useSync((spawner) => spawner.url);
+        const payload = samplePayload(FIXTURE_TS_URL);
+        const first = yield* post(url, payload);
+        const second = yield* post(url, payload);
+        expect(second).toBe(first);
+        const pid = yield* pidListeningOn(first);
+        if (pid !== undefined) {
+          expect(yield* isAlive(pid)).toBe(true);
+        }
+      }).pipe(Effect.provide(services)),
+    { timeout: 60_000 },
+  );
+
+  it.live(
+    "distinct payloads spawn distinct children with distinct urls",
+    () =>
+      Effect.gen(function* () {
+        const url = yield* RpcSpawner.useSync((spawner) => spawner.url);
+        const a = yield* post(url, samplePayload(FIXTURE_TS_URL, "stack-a"));
+        const b = yield* post(url, samplePayload(FIXTURE_TS_URL, "stack-b"));
+        expect(a).not.toBe(b);
+      }).pipe(Effect.provide(services)),
+    { timeout: 60_000 },
+  );
+
+  it.live(
+    "closing the spawner's scope kills all spawned children",
+    () =>
+      Effect.gen(function* () {
+        // Boot the spawner in an inner scope so we can close it while
+        // the outer test scope is still alive, then assert against the
+        // pid we recorded.
+        const pid = yield* Effect.gen(function* () {
+          const url = yield* RpcSpawner.useSync((spawner) => spawner.url);
+          const wsUrl = yield* post(url, samplePayload(FIXTURE_TS_URL));
+          return yield* pidListeningOn(wsUrl);
+        }).pipe(Effect.provide(services), Effect.scoped);
+
+        if (pid === undefined) return;
+        yield* assertPidExited(pid);
+      }),
+    { timeout: 60_000 },
+  );
+
+  it.live(
+    "url returned for a crash-on-boot fixture is not a usable RPC endpoint",
+    () =>
+      Effect.gen(function* () {
+        // The crash fixture prints the address marker then exits. The
+        // spawner's health check is best-effort: depending on race
+        // timing the POST may return a bogus url, or surface a 500
+        // once the retry budget drains. The invariant we *can*
+        // assert is that callers cannot open a parent websocket to
+        // the returned url.
+        const url = yield* RpcSpawner.useSync((spawner) => spawner.url);
+        yield* Effect.gen(function* () {
+          const r = yield* postRaw(url, samplePayload(CRASH_FIXTURE_TS_URL));
+          if (r.status !== 200) {
+            return { unusable: true } as const;
+          }
+          const usable = yield* canOpenWebSocket(new URL("/parent", r.body));
+          return { unusable: !usable } as const;
+        }).pipe(
+          Effect.flatMap((r) =>
+            r.unusable
+              ? Effect.void
+              : Effect.fail(new Error("endpoint was still usable")),
+          ),
+          // Mirrors the original `for (let i = 0; i < 4 && !failed; i++)`
+          // loop: up to 4 retries spaced 250ms apart.
+          Effect.retry({
+            schedule: Schedule.spaced(Duration.millis(250)),
+            times: 4,
+          }),
+        );
+      }).pipe(Effect.provide(services)),
+    { timeout: 60_000 },
+  );
+});
+
+interface PostResult {
+  readonly status: number;
+  readonly body: string;
+}
+
+const postRaw = (
+  url: string,
+  body: unknown,
+): Effect.Effect<PostResult, never, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const req = HttpClientRequest.post(url).pipe(
+      HttpClientRequest.setBody(
+        HttpBody.text(JSON.stringify(body), "application/json"),
+      ),
+    );
+    const res = yield* client.execute(req);
+    const text = yield* res.text;
+    return { status: res.status, body: text };
+  }).pipe(Effect.orDie);
+
+const post = (
+  url: string,
+  body: unknown,
+): Effect.Effect<string, Error, HttpClient.HttpClient> =>
+  postRaw(url, body).pipe(
+    Effect.flatMap((r) =>
+      r.status === 200
+        ? Effect.succeed(r.body)
+        : Effect.fail(new Error(`spawn POST failed: ${r.status} ${r.body}`)),
+    ),
+  );
+
+const echoWebSocket = (
+  rpcUrl: string,
+  msg: string,
+): Effect.Effect<string, Error> =>
+  Effect.gen(function* () {
+    yield* openWebSocket(new URL("/parent", rpcUrl));
+    return yield* Effect.promise(async () => {
+      const stub = newWebSocketRpcSession(rpcUrl) as RpcStub<RpcProxyApi>;
+      const provider = await stub.getProvider("Test.Echo");
+      const handlers = unwrapRpcHandlers(provider as any) as {
+        echo: (m: string) => Effect.Effect<string>;
+      };
+      return await Effect.runPromise(handlers.echo(msg));
+    });
+  }).pipe(Effect.scoped);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSpawnerCleanup.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSpawnerCleanup.test.ts
new file mode 100644
index 00000000000..3e087a447b1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/RpcSpawnerCleanup.test.ts
@@ -0,0 +1,104 @@
+import { PlatformServices } from "@/Util/PlatformServices.ts";
+import { assert, describe, expect, it } from "@effect/vitest";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Sink from "effect/Sink";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { fileURLToPath } from "node:url";
+import {
+  assertPidExited,
+  isAlive,
+  killPid,
+  pidListeningOn,
+  waitForExit,
+} from "./fixtures/process-effect.ts";
+import { runtimes } from "./fixtures/runtimes.ts";
+
+const PARENT_TS = fileURLToPath(
+  new URL("./fixtures/rpc-spawner-parent.ts", import.meta.url),
+);
+const CHILD_TS_URL = new URL(
+  "./fixtures/rpc-server-entry.ts",
+  import.meta.url,
+).toString();
+
+for (const runtime of runtimes()) {
+  describe(`Local.RpcSpawner cleanup (${runtime.name})`, () => {
+    /**
+     * Boots the parent fixture and waits until it has reported both its own
+     * pid and the child's RPC url (from which we resolve the child's pid via
+     * `lsof`). Retries the stdout parse on a schedule until both fields are
+     * populated.
+     */
+    const launch = Effect.gen(function* () {
+      const [bin, ...args] = runtime.argv(PARENT_TS);
+      const child = yield* ChildProcess.make(bin, [...args, CHILD_TS_URL], {
+        stdout: "pipe",
+        forceKillAfter: "1 second",
+      });
+      const output = yield* child.stdout.pipe(
+        Stream.decodeText,
+        Stream.run(
+          Sink.fold(
+            () => "",
+            (acc) =>
+              !acc.includes("CHILD_URL=") || !acc.includes("PARENT_PID="),
+            (acc, chunk) => Effect.succeed(acc + chunk),
+          ),
+        ),
+        Effect.timeout("5 seconds"),
+      );
+
+      const childUrl = output.match(/CHILD_URL=(\S+)/)?.[1];
+      const parentPid = Number.parseInt(
+        output.match(/PARENT_PID=(\d+)/)?.[1]!,
+        10,
+      );
+
+      assert(childUrl, `child url not found in output: ${output}`);
+      assert(
+        !Number.isNaN(parentPid),
+        `parent pid not found in output: ${output}`,
+      );
+
+      const childPid = yield* pidListeningOn(childUrl);
+
+      yield* Effect.addFinalizer(() => killPid(childPid, "SIGKILL"));
+
+      return {
+        child,
+        parentPid,
+        childPid,
+      };
+    });
+
+    it.live(
+      "child dies after parent receives SIGTERM",
+      () =>
+        Effect.gen(function* () {
+          const { child, parentPid, childPid } = yield* launch;
+          expect(yield* isAlive(childPid)).toBe(true);
+          yield* killPid(parentPid, "SIGTERM");
+          // waitForExit wraps `handle.exitCode`, which resolves once
+          // the OS reports the parent's exit.
+          yield* waitForExit(child, Duration.seconds(10));
+          yield* assertPidExited(childPid);
+        }).pipe(Effect.provide(PlatformServices)),
+      { timeout: 45_000 },
+    );
+
+    it.live(
+      "child dies after parent receives SIGKILL",
+      () =>
+        Effect.gen(function* () {
+          const { child, parentPid, childPid } = yield* launch;
+          expect(yield* isAlive(childPid)).toBe(true);
+          yield* killPid(parentPid, "SIGKILL");
+          yield* waitForExit(child, Duration.seconds(10));
+          yield* assertPidExited(childPid);
+        }).pipe(Effect.provide(PlatformServices)),
+      { timeout: 45_000 },
+    );
+  });
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/process-effect.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/process-effect.ts
new file mode 100644
index 00000000000..99527669705
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/process-effect.ts
@@ -0,0 +1,149 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import type { ChildProcessHandle } from "effect/unstable/process/ChildProcessSpawner";
+
+/**
+ * Wait for the child to exit (with timeout). Uses `handle.isRunning`
+ * rather than `handle.exitCode` because the latter raises a
+ * `PlatformError` for processes killed by signal (no exit code), which
+ * is a perfectly normal outcome for the SIGKILL test cases.
+ */
+export const waitForExit = (
+  handle: ChildProcessHandle,
+  timeout: Duration.Input,
+): Effect.Effect<void, Error> =>
+  handle.isRunning.pipe(
+    Effect.orElseSucceed(() => false),
+    Effect.repeat({
+      schedule: Schedule.spaced(Duration.millis(50)),
+      until: (running) => !running,
+    }),
+    Effect.timeout(timeout),
+    Effect.catchTag("TimeoutError", () =>
+      Effect.fail(new Error("child did not exit in time")),
+    ),
+  );
+
+export const assertPidExited = (pid: number): Effect.Effect<void, Error> =>
+  isAlive(pid).pipe(
+    Effect.orElseSucceed(() => false),
+    Effect.repeat({
+      schedule: Schedule.spaced(Duration.millis(50)),
+      until: (alive) => !alive,
+    }),
+    Effect.timeout("5 seconds"),
+    Effect.catchTag("TimeoutError", () =>
+      Effect.fail(new Error("child did not exit in time")),
+    ),
+  );
+
+/**
+ * `process.kill(pid, 0)` is a sync syscall that probes a pid we don't
+ * own a handle to (e.g. a grandchild spawned by the parent fixture).
+ * Wrapped in `Effect.sync` so it participates in the runtime.
+ */
+export const isAlive = (pid: number): Effect.Effect<boolean> =>
+  Effect.sync(() => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+
+/**
+ * Resolves the pid currently LISTENing on the port of `wsUrl`. Uses an
+ * `lsof` invocation; we don't own a handle to whatever process is
+ * listening so there's no ChildProcessHandle equivalent.
+ */
+export const pidListeningOn = (wsUrl: string) =>
+  ChildProcess.make(
+    "lsof",
+    ["-iTCP:" + new URL(wsUrl).port, "-sTCP:LISTEN", "-t"],
+    {
+      stdout: "pipe",
+    },
+  ).pipe(
+    Effect.flatMap((handle) =>
+      handle.stdout.pipe(Stream.decodeText, Stream.mkString),
+    ),
+    Effect.map((stdout) => Number.parseInt(stdout.trim().split("\n")[0]!, 10)),
+  );
+
+/** Send a signal to a pid we don't own a handle to. */
+export const killPid = (
+  pid: number,
+  signal: NodeJS.Signals,
+): Effect.Effect<void> =>
+  Effect.sync(() => {
+    try {
+      process.kill(pid, signal);
+    } catch {}
+  });
+
+/**
+ * Open a WebSocket inside a scope so it's reliably closed at scope
+ * end. Resolves once `open` fires or fails on error / close.
+ */
+export const openWebSocket = (
+  url: string | URL,
+): Effect.Effect<WebSocket, Error, Scope.Scope> =>
+  Effect.acquireRelease(
+    Effect.callback<WebSocket, Error>((resume) => {
+      const ws = new WebSocket(url);
+      const cleanup = () => {
+        ws.removeEventListener("open", onOpen);
+        ws.removeEventListener("error", onError);
+      };
+      const onOpen = () => {
+        cleanup();
+        resume(Effect.succeed(ws));
+      };
+      const onError = () => {
+        cleanup();
+        try {
+          ws.close();
+        } catch {}
+        resume(Effect.fail(new Error(`websocket connect failed: ${url}`)));
+      };
+      ws.addEventListener("open", onOpen, { once: true });
+      ws.addEventListener("error", onError, { once: true });
+    }),
+    (ws) =>
+      Effect.sync(() => {
+        try {
+          ws.close();
+        } catch {}
+      }),
+  );
+
+/** Probe whether a websocket can be opened. Never fails. */
+export const canOpenWebSocket = (
+  url: string | URL,
+  timeout: Duration.Input = Duration.millis(1_500),
+): Effect.Effect<boolean> =>
+  Effect.callback<boolean>((resume) => {
+    const ws = new WebSocket(url);
+    let settled = false;
+    const settle = (v: boolean) => {
+      if (settled) return;
+      settled = true;
+      try {
+        ws.close();
+      } catch {}
+      resume(Effect.succeed(v));
+    };
+    ws.addEventListener("open", () => settle(true), { once: true });
+    ws.addEventListener("error", () => settle(false), { once: true });
+    ws.addEventListener("close", () => settle(false), { once: true });
+  }).pipe(
+    Effect.timeoutOrElse({
+      duration: timeout,
+      orElse: () => Effect.succeed(false),
+    }),
+  );
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-server-crash.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-server-crash.ts
new file mode 100644
index 00000000000..ddece86d32f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-server-crash.ts
@@ -0,0 +1,5 @@
+// Fixture that prints the marker and then immediately exits, simulating an
+// RPC server that boots but crashes before the parent can use it. Used to
+// exercise the spawner's retry-budget logic.
+console.log("<ALCHEMY_RPC_ADDRESS>ws://127.0.0.1:1/</ALCHEMY_RPC_ADDRESS>");
+process.exit(1);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-server-entry.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-server-entry.ts
new file mode 100644
index 00000000000..e4e8094fe11
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-server-entry.ts
@@ -0,0 +1,28 @@
+// Relative import (not `@/` alias) so this file runs under both Bun and Node
+// without a paths-aware loader. This fixture is excluded from the test
+// project's typecheck (see tsconfig.test.json) because the relative path
+// crosses composite-project boundaries.
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { launch } from "../../../src/Local/RpcServer.ts";
+
+/**
+ * Minimal test fixture for `RpcServer.launch`. Registers a single service
+ * keyed by `"Test.Echo"` which is what the parent looks up via
+ * `getProvider("Test.Echo")`.
+ */
+export class TestEcho extends Context.Service<
+  TestEcho,
+  {
+    echo: (msg: string) => Effect.Effect<string>;
+    boom: () => Effect.Effect<never, { _tag: "Boom"; msg: string }>;
+  }
+>()("Test.Echo") {}
+
+const TestEchoLive = Layer.succeed(TestEcho, {
+  echo: (msg) => Effect.succeed(`echo:${msg}`),
+  boom: () => Effect.fail({ _tag: "Boom" as const, msg: "kaboom" }),
+});
+
+launch(TestEchoLive);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-spawner-parent.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-spawner-parent.ts
new file mode 100644
index 00000000000..ec02d58bac0
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/rpc-spawner-parent.ts
@@ -0,0 +1,65 @@
+// Test fixture: boots an RpcSpawner, POSTs once with the child entry given by
+// the first CLI arg, and prints `PARENT_PID=<n>` and `CHILD_PID=<n>` lines to
+// stdout so the test harness can observe them. Then idles until killed.
+// Relative imports (not `@/` alias) so this file runs under both Bun and
+// Node without a paths-aware loader. This fixture is excluded from the test
+// project's typecheck (see tsconfig.test.json) because the relative path
+// crosses composite-project boundaries.
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { layerServer, RpcSpawner } from "../../../src/Local/RpcSpawner.ts";
+import { PlatformServices } from "../../../src/Util/PlatformServices.ts";
+
+const childEntry = process.argv[2];
+if (!childEntry) {
+  console.error("usage: rpc-spawner-parent.ts <child-entry-url>");
+  process.exit(2);
+}
+
+const program = Effect.gen(function* () {
+  const sp = yield* RpcSpawner;
+  const http = yield* HttpClient.HttpClient;
+  const res = yield* http
+    .post(sp.url, {
+      body: yield* HttpBody.json({
+        serverEntryUrl: childEntry,
+        alchemyContext: {
+          dotAlchemy: "/tmp/.alchemy",
+          updateStateStore: false,
+          dev: true,
+          adopt: false,
+        },
+        stack: { name: "test", stage: "dev" },
+      }),
+    })
+    .pipe(Effect.flatMap((res) => res.text));
+
+  // The child's pid is whatever owns the listening port returned in res.
+  // We surface it for the test harness via stdout.
+  console.log(`PARENT_PID=${process.pid}\n`);
+  console.log(`CHILD_URL=${res}\n`);
+
+  const stop = yield* Deferred.make<void>();
+  yield* Deferred.await(stop);
+});
+
+program
+  .pipe(
+    Effect.provide([
+      Layer.provide(
+        layerServer({ profile: undefined, envFile: undefined }),
+        PlatformServices,
+      ),
+      FetchHttpClient.layer,
+    ]),
+    Effect.scoped,
+    Effect.runPromise,
+  )
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  });
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/runtimes.ts b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/runtimes.ts
new file mode 100644
index 00000000000..f289054e1b1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Local/fixtures/runtimes.ts
@@ -0,0 +1,34 @@
+import { spawnSync } from "node:child_process";
+
+export interface Runtime {
+  readonly name: "bun" | "node";
+  readonly argv: (entry: string) => Array<string>;
+  readonly available: boolean;
+}
+
+const hasBin = (bin: string): boolean => {
+  try {
+    const r = spawnSync("which", [bin], { encoding: "utf-8" });
+    return r.status === 0 && Boolean(r.stdout?.trim());
+  } catch {
+    return false;
+  }
+};
+
+export const runtimes = (): Array<Runtime> => [
+  {
+    name: "bun",
+    argv: (entry) => ["bun", "run", entry],
+    available: hasBin("bun"),
+  },
+  {
+    name: "node",
+    argv: (entry) => [
+      "node",
+      "--experimental-transform-types",
+      "--no-warnings=ExperimentalWarning",
+      entry,
+    ],
+    available: hasBin("node"),
+  },
+];
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Neon/Project.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Neon/Project.test.ts
new file mode 100644
index 00000000000..12464dc60b6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Neon/Project.test.ts
@@ -0,0 +1,122 @@
+import * as Neon from "@/Neon";
+import * as Test from "@/Test/Vitest";
+import { getProject } from "@distilled.cloud/neon";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Neon.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+test.provider("create and delete project with default props", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const project = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Neon.Project("DefaultProject");
+      }),
+    );
+
+    expect(project.projectId).toBeDefined();
+    expect(project.projectName).toBeDefined();
+    expect(project.defaultBranchId).toBeDefined();
+    expect(project.connectionUri).toContain("postgres");
+
+    const fetched = yield* getProject({ project_id: project.projectId });
+    expect(fetched.project.id).toEqual(project.projectId);
+
+    yield* stack.destroy();
+  }).pipe(logLevel),
+);
+
+test.provider("enable logical replication on update", (stack) =>
+  Effect.gen(function* () {
+    yield* stack.destroy();
+
+    const initial = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Neon.Project("LogicalReplicationProject", {
+          name: "alchemy-test-logical-replication",
+          region: "aws-us-east-1",
+        });
+      }),
+    );
+    expect(initial.enableLogicalReplication).toEqual(false);
+
+    const enabled = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* Neon.Project("LogicalReplicationProject", {
+          name: "alchemy-test-logical-replication",
+          region: "aws-us-east-1",
+          enableLogicalReplication: true,
+        });
+      }),
+    );
+    expect(enabled.projectId).toEqual(initial.projectId);
+    expect(enabled.enableLogicalReplication).toEqual(true);
+
+    const fetched = yield* getProject({ project_id: enabled.projectId });
+    expect(fetched.project.settings).toMatchObject({
+      enable_logical_replication: true,
+    });
+
+    yield* stack.destroy();
+  }).pipe(logLevel),
+);
+
+test.provider(
+  "create project, apply migrations and seed data, then create a branch",
+  (stack) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const migrationsDir = yield* fs.makeTempDirectory({
+        prefix: "alchemy-neon-migrations-",
+      });
+      yield* fs.writeFileString(
+        path.join(migrationsDir, "0001_users.sql"),
+        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL);",
+      );
+      const seedDir = yield* fs.makeTempDirectory({
+        prefix: "alchemy-neon-seed-",
+      });
+      const seedPath = path.join(seedDir, "seed.sql");
+      yield* fs.writeFileString(
+        seedPath,
+        "INSERT INTO users (name) VALUES ('alice'), ('bob');",
+      );
+
+      yield* stack.destroy();
+
+      const { project, branch } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const project = yield* Neon.Project("MigrationProject", {
+            migrationsDir,
+            importFiles: [seedPath],
+          });
+          const branch = yield* Neon.Branch("FeatureBranch", {
+            project,
+          });
+          return { project, branch };
+        }),
+      );
+
+      expect(project.migrationsTable).toEqual("neon_migrations");
+      expect(Object.keys(project.migrationsHashes).sort()).toEqual([
+        "0001_users.sql",
+      ]);
+      expect(project.importHashes[seedPath]).toBeDefined();
+
+      expect(branch.projectId).toEqual(project.projectId);
+      expect(branch.parentBranchId).toEqual(project.defaultBranchId);
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Output.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Output.test.ts
new file mode 100644
index 00000000000..7b87c06cd35
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Output.test.ts
@@ -0,0 +1,911 @@
+import * as Output from "@/Output";
+import { ref as makeRef } from "@/Ref";
+import type { ResourceLike } from "@/Resource";
+import { Stack } from "@/Stack";
+import { Stage } from "@/Stage";
+import { inMemoryState } from "@/State/InMemoryState";
+import type { ResourceState } from "@/State/ResourceState";
+import { describe, expect, it } from "@effect/vitest";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+
+const provideState = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  effect.pipe(Effect.provide(inMemoryState()));
+
+const fakeResource = <T extends string, A extends object>(
+  type: T,
+  fqn: string,
+  logicalId: string = fqn,
+): ResourceLike<T, any, A> =>
+  ({
+    Type: type,
+    FQN: fqn,
+    LogicalId: logicalId,
+    Namespace: undefined,
+  }) as any;
+
+describe("Output.evaluate", () => {
+  describe("primitives and plain values", () => {
+    it.effect("returns primitive values as-is", () =>
+      provideState(
+        Effect.gen(function* () {
+          expect(yield* Output.evaluate(42, {})).toBe(42);
+          expect(yield* Output.evaluate("hello", {})).toBe("hello");
+          expect(yield* Output.evaluate(true, {})).toBe(true);
+          expect(yield* Output.evaluate(null, {})).toBe(null);
+          expect(yield* Output.evaluate(undefined, {})).toBe(undefined);
+        }),
+      ),
+    );
+
+    it.effect("recursively evaluates plain objects", () =>
+      provideState(
+        Effect.gen(function* () {
+          const result = yield* Output.evaluate({ a: 1, b: { c: "x" } }, {});
+          expect(result).toEqual({ a: 1, b: { c: "x" } });
+        }),
+      ),
+    );
+
+    it.effect("recursively evaluates arrays", () =>
+      provideState(
+        Effect.gen(function* () {
+          const result = yield* Output.evaluate([1, "two", { k: 3 }], {});
+          expect(result).toEqual([1, "two", { k: 3 }]);
+        }),
+      ),
+    );
+  });
+
+  describe("Redacted", () => {
+    it.effect("preserves Redacted values at the top level", () =>
+      provideState(
+        Effect.gen(function* () {
+          const secret = Redacted.make("hunter2");
+          const result = yield* Output.evaluate(secret, {});
+          expect(Redacted.isRedacted(result)).toBe(true);
+          expect(Redacted.value(result as Redacted.Redacted<string>)).toBe(
+            "hunter2",
+          );
+        }),
+      ),
+    );
+
+    it.effect("preserves Redacted values nested inside an object", () =>
+      provideState(
+        Effect.gen(function* () {
+          const secret = Redacted.make("hunter2");
+          const result = yield* Output.evaluate(
+            { value: secret, name: "x" },
+            {},
+          );
+          expect(result.name).toBe("x");
+          expect(Redacted.isRedacted(result.value)).toBe(true);
+          expect(Redacted.value(result.value)).toBe("hunter2");
+        }),
+      ),
+    );
+
+    it.effect("preserves Redacted values nested inside an array", () =>
+      provideState(
+        Effect.gen(function* () {
+          const secret = Redacted.make("hunter2");
+          const [result] = yield* Output.evaluate([secret], {});
+          expect(Redacted.isRedacted(result)).toBe(true);
+          expect(Redacted.value(result)).toBe("hunter2");
+        }),
+      ),
+    );
+  });
+
+  describe("LiteralExpr", () => {
+    it.effect("evaluates Output.literal(value)", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal("foo");
+          expect(yield* Output.evaluate(expr, {})).toBe("foo");
+        }),
+      ),
+    );
+
+    it.effect("evaluates a literal nested within an object", () =>
+      provideState(
+        Effect.gen(function* () {
+          const result = yield* Output.evaluate(
+            { greeting: Output.literal("hi") },
+            {},
+          );
+          expect(result).toEqual({ greeting: "hi" });
+        }),
+      ),
+    );
+  });
+
+  describe("ResourceExpr", () => {
+    it.effect("resolves to the upstream value keyed by FQN", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "MyBucket");
+          const expr = Output.of(src);
+          const result = yield* Output.evaluate(expr, {
+            MyBucket: { name: "my-bucket" },
+          });
+          expect(result).toEqual({ name: "my-bucket" });
+        }),
+      ),
+    );
+
+    it.effect("fails with MissingSourceError when upstream is absent", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "Missing");
+          const expr = Output.of(src);
+          const exit = yield* Effect.exit(Output.evaluate(expr, {}));
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const failure = exit.cause.toJSON() as any;
+            expect(JSON.stringify(failure)).toContain("MissingSourceError");
+          }
+        }),
+      ),
+    );
+
+    it.effect("evaluates a raw resource (isResource branch)", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "RawBucket");
+          const result = yield* Output.evaluate(src as any, {
+            RawBucket: { ok: true },
+          });
+          expect(result).toEqual({ ok: true });
+        }),
+      ),
+    );
+
+    it.effect("raw resource with missing upstream fails", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "Gone");
+          const exit = yield* Effect.exit(Output.evaluate(src as any, {}));
+          expect(Exit.isFailure(exit)).toBe(true);
+        }),
+      ),
+    );
+  });
+
+  describe("PropExpr", () => {
+    it.effect("accesses a property on a resource expression", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource<"Test.Bucket", { name: string }>(
+            "Test.Bucket",
+            "B",
+          );
+          const expr = Output.of(src) as any;
+          const result = yield* Output.evaluate(expr.name, {
+            B: { name: "the-name" },
+          });
+          expect(result).toBe("the-name");
+        }),
+      ),
+    );
+
+    it.effect("returns undefined when accessing missing property", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "B2");
+          const expr = Output.of(src) as any;
+          const result = yield* Output.evaluate(expr.missing, {
+            B2: { other: 1 },
+          });
+          expect(result).toBeUndefined();
+        }),
+      ),
+    );
+
+    it.effect("supports nested property access", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "B3");
+          const expr = Output.of(src) as any;
+          const result = yield* Output.evaluate(expr.nested.deep, {
+            B3: { nested: { deep: "value" } },
+          });
+          expect(result).toBe("value");
+        }),
+      ),
+    );
+  });
+
+  describe("ApplyExpr (map)", () => {
+    it.effect("applies a synchronous function over a literal", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.map(Output.literal(2), (n) => n * 3);
+          expect(yield* Output.evaluate(expr, {})).toBe(6);
+        }),
+      ),
+    );
+
+    it.effect("composes multiple maps", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal(2).pipe(
+            Output.map((n: number) => n + 1),
+            Output.map((n: number) => n * 10),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe(30);
+        }),
+      ),
+    );
+
+    it.effect("maps over a resource attribute", () =>
+      provideState(
+        Effect.gen(function* () {
+          const src = fakeResource("Test.Bucket", "B4");
+          const expr = (Output.of(src) as any).name.pipe(
+            Output.map((s: string) => s.toUpperCase()),
+          );
+          const result = yield* Output.evaluate(expr, {
+            B4: { name: "abc" },
+          });
+          expect(result).toBe("ABC");
+        }),
+      ),
+    );
+  });
+
+  describe("EffectExpr (mapEffect)", () => {
+    it.effect("evaluates an effectful transformation", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal(5).pipe(
+            Output.mapEffect((n: number) => Effect.succeed(n * 2)),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe(10);
+        }),
+      ),
+    );
+
+    it.effect("chains multiple effectful transformations", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal("a").pipe(
+            Output.mapEffect((s: string) => Effect.succeed(s + "b")),
+            Output.mapEffect((s) => Effect.succeed(s + "c")),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe("abc");
+        }),
+      ),
+    );
+  });
+
+  describe("FlatMapExpr (flatMap)", () => {
+    it.effect("flattens an Output returned from the function", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal(5).pipe(
+            Output.flatMap((n: number) => Output.literal(n * 2)),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe(10);
+        }),
+      ),
+    );
+
+    it.effect("supports the data-first form", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.flatMap(Output.literal("a"), (s: string) =>
+            Output.literal(s + "b"),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe("ab");
+        }),
+      ),
+    );
+
+    it.effect("chains multiple flatMaps", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal(1).pipe(
+            Output.flatMap((n: number) => Output.literal(n + 1)),
+            Output.flatMap((n: number) => Output.literal(n * 10)),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe(20);
+        }),
+      ),
+    );
+
+    it.effect("flatMaps into another resource's output", () =>
+      provideState(
+        Effect.gen(function* () {
+          const a = fakeResource("Test.A", "FA");
+          const b = fakeResource("Test.B", "FB");
+          const expr = (Output.of(a) as any).name.pipe(
+            Output.flatMap(() => (Output.of(b) as any).name),
+          );
+          const result = yield* Output.evaluate(expr, {
+            FA: { name: "a-name" },
+            FB: { name: "b-name" },
+          });
+          expect(result).toBe("b-name");
+        }),
+      ),
+    );
+
+    it.effect("can flatMap into a non-Output literal value", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.literal(3).pipe(
+            Output.flatMap((n: number) => Output.asOutput(n + 1)),
+          );
+          expect(yield* Output.evaluate(expr, {})).toBe(4);
+        }),
+      ),
+    );
+
+    it("tracks only the source expression as upstream", () => {
+      const a = fakeResource("Test.A", "UA");
+      const expr = (Output.of(a) as any).name.pipe(
+        Output.flatMap((s: string) => Output.literal(s)),
+      );
+      expect(Object.keys(Output.upstream(expr))).toEqual(["UA"]);
+    });
+  });
+
+  describe("method-style combinators on a proxied Output", () => {
+    // Resource outputs are Proxies, so `.map(fn)` / `.mapEffect(fn)` /
+    // `.flatMap(fn)` / `.apply(fn)` / `.effect(fn)` must be callable as
+    // methods (not just via `Output.map(output, fn)` / `.pipe(...)`).
+    const resourceOutput = () => {
+      const src = fakeResource<"Test.Bucket", { name: string }>(
+        "Test.Bucket",
+        "M",
+      );
+      return (Output.of(src) as any).name as Output.Output<string>;
+    };
+
+    it.effect(".map(fn) builds an ApplyExpr", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = (resourceOutput() as any).map((s: string) =>
+            s.toUpperCase(),
+          );
+          expect(Output.isApplyExpr(expr)).toBe(true);
+          expect(yield* Output.evaluate(expr, { M: { name: "abc" } })).toBe(
+            "ABC",
+          );
+        }),
+      ),
+    );
+
+    it.effect(".apply(fn) builds an ApplyExpr", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = (resourceOutput() as any).apply((s: string) =>
+            s.toUpperCase(),
+          );
+          expect(Output.isApplyExpr(expr)).toBe(true);
+          expect(yield* Output.evaluate(expr, { M: { name: "abc" } })).toBe(
+            "ABC",
+          );
+        }),
+      ),
+    );
+
+    it.effect(".mapEffect(fn) builds an EffectExpr", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = (resourceOutput() as any).mapEffect((s: string) =>
+            Effect.succeed(s + "!"),
+          );
+          expect(Output.isEffectExpr(expr)).toBe(true);
+          expect(yield* Output.evaluate(expr, { M: { name: "abc" } })).toBe(
+            "abc!",
+          );
+        }),
+      ),
+    );
+
+    it.effect(".effect(fn) builds an EffectExpr", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = (resourceOutput() as any).effect((s: string) =>
+            Effect.succeed(s + "!"),
+          );
+          expect(Output.isEffectExpr(expr)).toBe(true);
+          expect(yield* Output.evaluate(expr, { M: { name: "abc" } })).toBe(
+            "abc!",
+          );
+        }),
+      ),
+    );
+
+    it.effect(".flatMap(fn) builds a FlatMapExpr", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = (resourceOutput() as any).flatMap((s: string) =>
+            Output.literal(s + "?"),
+          );
+          expect(Output.isFlatMapExpr(expr)).toBe(true);
+          expect(yield* Output.evaluate(expr, { M: { name: "abc" } })).toBe(
+            "abc?",
+          );
+        }),
+      ),
+    );
+  });
+
+  describe("AllExpr", () => {
+    it.effect("evaluates all wrapped outputs in parallel", () =>
+      provideState(
+        Effect.gen(function* () {
+          const expr = Output.all(
+            Output.literal(1),
+            Output.literal("two"),
+            Output.literal(true),
+          );
+          const result = yield* Output.evaluate(expr, {});
+          expect(result).toEqual([1, "two", true]);
+        }),
+      ),
+    );
+
+    it.effect("evaluates all with resource expressions", () =>
+      provideState(
+        Effect.gen(function* () {
+          const a = fakeResource("Test.A", "A");
+          const b = fakeResource("Test.B", "B");
+          const expr = Output.all(Output.of(a), Output.of(b));
+          const result = yield* Output.evaluate(expr, {
+            A: { x: 1 },
+            B: { y: 2 },
+          });
+          expect(result).toEqual([{ x: 1 }, { y: 2 }]);
+        }),
+      ),
+    );
+  });
+
+  describe("RefExpr", () => {
+    const provideStackStage = <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+      stack = "myStack",
+      stage = "myStage",
+    ) =>
+      effect.pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            Layer.succeed(Stack, { name: stack } as any),
+            Layer.succeed(Stage, stage),
+          ),
+        ),
+      );
+
+    it.effect("resolves a Ref against in-memory state", () =>
+      Effect.gen(function* () {
+        const initial = {
+          myStack: {
+            myStage: {
+              myResource: {
+                fqn: "myResource",
+                attr: { hello: "world" },
+              } as unknown as ResourceState,
+            },
+          },
+        };
+        const r = makeRef<ResourceLike>("myResource");
+        const expr = Output.of(r);
+        const result = yield* provideStackStage(
+          Output.evaluate(expr, {}).pipe(
+            Effect.provide(inMemoryState(initial)),
+          ),
+        );
+        expect(result).toEqual({ hello: "world" });
+      }),
+    );
+
+    it.effect("uses explicit stack/stage when provided on the ref", () =>
+      Effect.gen(function* () {
+        const initial = {
+          otherStack: {
+            otherStage: {
+              someResource: {
+                fqn: "someResource",
+                attr: { v: 1 },
+              } as unknown as ResourceState,
+            },
+          },
+        };
+        const r = makeRef<ResourceLike>("someResource", {
+          stack: "otherStack",
+          stage: "otherStage",
+        });
+        const expr = Output.of(r);
+        // No Stack/Stage layers needed since the ref carries them.
+        const result = yield* Output.evaluate(expr, {}).pipe(
+          Effect.provide(inMemoryState(initial)),
+        );
+        expect(result).toEqual({ v: 1 });
+      }),
+    );
+
+    it.effect(
+      "fails with InvalidReferenceError when ref target is missing",
+      () =>
+        Effect.gen(function* () {
+          const r = makeRef<ResourceLike>("ghost", {
+            stack: "s",
+            stage: "t",
+          });
+          const expr = Output.of(r);
+          const exit = yield* Effect.exit(
+            Output.evaluate(expr, {}).pipe(Effect.provide(inMemoryState())),
+          );
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            expect(JSON.stringify(exit.cause.toJSON())).toContain(
+              "InvalidReferenceError",
+            );
+          }
+        }),
+    );
+
+    it.effect(
+      "PropExpr on a Ref reads the attribute from persisted state",
+      () =>
+        Effect.gen(function* () {
+          const initial = {
+            myStack: {
+              myStage: {
+                shared: {
+                  fqn: "shared",
+                  attr: { url: "https://example.com", name: "shared" },
+                } as unknown as ResourceState,
+              },
+            },
+          };
+          const r = makeRef<ResourceLike>("shared");
+          const expr = (Output.of(r) as any).url as Output.Output<string>;
+          const result = yield* provideStackStage(
+            Output.evaluate(expr, {}).pipe(
+              Effect.provide(inMemoryState(initial)),
+            ),
+          );
+          expect(result).toBe("https://example.com");
+        }),
+    );
+  });
+
+  describe("StackRefExpr", () => {
+    const provideStage = <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+      stage = "myStage",
+    ) => effect.pipe(Effect.provide(Layer.succeed(Stage, stage)));
+
+    it.effect("Output.stackRef resolves to the persisted stack output", () =>
+      Effect.gen(function* () {
+        const expr = yield* Output.stackRef<{ url: string }>("Backend");
+        const result = yield* provideStage(
+          Output.evaluate(expr, {}).pipe(
+            Effect.provide(
+              inMemoryState(
+                {},
+                { Backend: { myStage: { url: "https://api.example.com" } } },
+              ),
+            ),
+          ),
+        );
+        expect(result).toEqual({ url: "https://api.example.com" });
+      }),
+    );
+
+    it.effect("explicit stage overrides the ambient Stage", () =>
+      Effect.gen(function* () {
+        const expr = yield* Output.stackRef<{ url: string }>("Backend", {
+          stage: "prod",
+        });
+        // No Stage layer is provided — the ref carries it explicitly.
+        const result = yield* Output.evaluate(expr, {}).pipe(
+          Effect.provide(
+            inMemoryState(
+              {},
+              { Backend: { prod: { url: "https://prod.example.com" } } },
+            ),
+          ),
+        );
+        expect(result).toEqual({ url: "https://prod.example.com" });
+      }),
+    );
+
+    it.effect("PropExpr off a stackRef reads a single attribute", () =>
+      Effect.gen(function* () {
+        const backend = yield* Output.stackRef<{ url: string }>("Backend");
+        const expr = (backend as any).url as Output.Output<string>;
+        const result = yield* provideStage(
+          Output.evaluate(expr, {}).pipe(
+            Effect.provide(
+              inMemoryState(
+                {},
+                { Backend: { myStage: { url: "https://api.example.com" } } },
+              ),
+            ),
+          ),
+        );
+        expect(result).toBe("https://api.example.com");
+      }),
+    );
+
+    it.effect(
+      "fails with InvalidReferenceError when the target stack/stage has no persisted output",
+      () =>
+        Effect.gen(function* () {
+          const expr = yield* Output.stackRef<{ url: string }>("Backend", {
+            stage: "ghost",
+          });
+          const exit = yield* Effect.exit(
+            Output.evaluate(expr, {}).pipe(Effect.provide(inMemoryState())),
+          );
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (Exit.isFailure(exit)) {
+            const err = Cause.squash(
+              exit.cause,
+            ) as Output.InvalidReferenceError;
+            expect(err._tag).toBe("InvalidReferenceError");
+            expect(err.stack).toBe("Backend");
+            expect(err.stage).toBe("ghost");
+          }
+        }),
+    );
+  });
+
+  describe("composition", () => {
+    it.effect("evaluates outputs nested inside arrays and objects", () =>
+      provideState(
+        Effect.gen(function* () {
+          const a = fakeResource("Test.A", "RA");
+          const b = fakeResource("Test.B", "RB");
+          const value = {
+            list: [Output.of(a), Output.literal("lit")],
+            nested: {
+              prop: (Output.of(b) as any).name.pipe(
+                Output.map((s: string) => `name=${s}`),
+              ),
+            },
+            scalar: 42,
+          };
+          const result = yield* Output.evaluate(value, {
+            RA: { foo: "f" },
+            RB: { name: "bee" },
+          });
+          expect(result).toEqual({
+            list: [{ foo: "f" }, "lit"],
+            nested: { prop: "name=bee" },
+            scalar: 42,
+          });
+        }),
+      ),
+    );
+  });
+});
+
+describe("Output.interpolate", () => {
+  it.effect("interpolates literal values into a template", () =>
+    provideState(
+      Effect.gen(function* () {
+        const expr = Output.interpolate`hello ${Output.literal("world")}!`;
+        expect(yield* Output.evaluate(expr, {})).toBe("hello world!");
+      }),
+    ),
+  );
+
+  it.effect("interpolates resource attributes", () =>
+    provideState(
+      Effect.gen(function* () {
+        const src = fakeResource("Test.Bucket", "Buck");
+        // @ts-expect-error
+        const name = Output.of(src).name;
+        const expr = Output.interpolate`s3://${name}/key`;
+        const result = yield* Output.evaluate(expr, {
+          Buck: { name: "my-bucket" },
+        });
+        expect(result).toBe("s3://my-bucket/key");
+      }),
+    ),
+  );
+
+  it.effect("renders nullish args as empty strings", () =>
+    provideState(
+      Effect.gen(function* () {
+        const expr = Output.interpolate`a${Output.literal(null)}b${Output.literal(
+          undefined,
+        )}c`;
+        expect(yield* Output.evaluate(expr, {})).toBe("abc");
+      }),
+    ),
+  );
+});
+
+describe("Output coercion guard", () => {
+  // These guard against the long-standing footgun where coercing an
+  // unresolved Output silently produced a placeholder — the inspect
+  // string for string-hints, or NaN for number-hints. Both let bogus
+  // values flow into resource props and ultimately into the cloud.
+
+  it("throws on template-literal interpolation of a raw Output", () => {
+    const src = fakeResource("Test.Bucket", "Buck");
+    // @ts-expect-error — synthetic prop access
+    const name = Output.of(src).name;
+    expect(() => `${name}`).toThrow(/Output\.interpolate/);
+  });
+
+  it("throws on string concatenation with a raw Output", () => {
+    const src = fakeResource("Test.Bucket", "Buck");
+    // @ts-expect-error — synthetic prop access
+    const name = Output.of(src).name;
+    expect(() => "s3://" + name).toThrow(/Output\.interpolate/);
+  });
+
+  it("throws on number coercion of a raw Output", () => {
+    const src = fakeResource("Test.Bucket", "Buck");
+    // @ts-expect-error — synthetic prop access
+    const name = Output.of(src).name;
+    expect(() => +name).toThrow(/Output\.(interpolate|map)/);
+  });
+
+  it("throws on arithmetic with a raw Output", () => {
+    const src = fakeResource("Test.Bucket", "Buck");
+    // @ts-expect-error — synthetic prop access
+    const name = Output.of(src).name;
+    expect(() => (name as unknown as number) * 2).toThrow(
+      /Output\.(interpolate|map)/,
+    );
+  });
+});
+
+describe("Output.isOutput / isExpr", () => {
+  it("identifies Output expressions", () => {
+    expect(Output.isOutput(Output.literal(1))).toBe(true);
+    expect(Output.isOutput(Output.all(Output.literal(1)))).toBe(true);
+    expect(Output.isExpr(Output.literal(1))).toBe(true);
+  });
+
+  it("rejects non-Output values", () => {
+    expect(Output.isOutput(1)).toBeFalsy();
+    expect(Output.isOutput("x")).toBeFalsy();
+    expect(Output.isOutput(null)).toBeFalsy();
+    expect(Output.isOutput(undefined)).toBeFalsy();
+    expect(Output.isOutput({})).toBeFalsy();
+    expect(Output.isOutput([])).toBeFalsy();
+  });
+});
+
+describe("Output.asOutput", () => {
+  it.effect("wraps a plain value as a literal Output", () =>
+    provideState(
+      Effect.gen(function* () {
+        const o = Output.asOutput("foo");
+        expect(Output.isOutput(o)).toBe(true);
+        expect(yield* Output.evaluate(o, {})).toBe("foo");
+      }),
+    ),
+  );
+
+  it.effect("wraps an Effect as an EffectExpr", () =>
+    provideState(
+      Effect.gen(function* () {
+        const o = Output.asOutput(Effect.succeed(123));
+        expect(Output.isOutput(o)).toBe(true);
+        expect(yield* Output.evaluate(o, {})).toBe(123);
+      }),
+    ),
+  );
+
+  it("returns the same Output if already an Output", () => {
+    const o = Output.literal("x");
+    expect(Output.asOutput(o)).toBe(o);
+  });
+});
+
+describe("Output.upstream / hasOutputs / resolveUpstream", () => {
+  it("returns upstream resources from a ResourceExpr", () => {
+    const src = fakeResource("Test.A", "FQN-A");
+    const expr = Output.of(src);
+    const up = Output.upstream(expr);
+    expect(Object.keys(up)).toEqual(["FQN-A"]);
+  });
+
+  it("returns upstream resources from a PropExpr", () => {
+    const src = fakeResource("Test.A", "FQN-A");
+    const expr = (Output.of(src) as any).foo;
+    expect(Object.keys(Output.upstream(expr))).toEqual(["FQN-A"]);
+  });
+
+  it("merges upstream resources from AllExpr", () => {
+    const a = fakeResource("Test.A", "A");
+    const b = fakeResource("Test.B", "B");
+    const expr = Output.all(Output.of(a), Output.of(b));
+    expect(Object.keys(Output.upstream(expr)).sort()).toEqual(["A", "B"]);
+  });
+
+  it("returns empty upstream for literals", () => {
+    expect(Output.upstream(Output.literal(1))).toEqual({});
+  });
+
+  it("treats a raw Resource passed directly as an upstream dependency", () => {
+    const src = fakeResource("Test.A", "RawA");
+    expect(Object.keys(Output.upstream(src as any))).toEqual(["RawA"]);
+  });
+
+  it("upstreamAny detects a raw Resource passed directly as a prop value", () => {
+    const a = fakeResource("Test.A", "FQN-A");
+    const b = fakeResource("Test.B", "FQN-B");
+    const props = { image: a, network: b };
+    expect(Object.keys(Output.upstreamAny(props)).sort()).toEqual([
+      "FQN-A",
+      "FQN-B",
+    ]);
+  });
+
+  it("upstreamAny detects raw Resources nested in arrays/objects", () => {
+    const a = fakeResource("Test.A", "FQN-A");
+    const b = fakeResource("Test.B", "FQN-B");
+    const props = {
+      volumes: [{ source: a }],
+      env: { ref: b },
+    };
+    expect(Object.keys(Output.upstreamAny(props)).sort()).toEqual([
+      "FQN-A",
+      "FQN-B",
+    ]);
+  });
+
+  it("upstreamAny detects raw Resource at the top level", () => {
+    const a = fakeResource("Test.A", "Top");
+    expect(Object.keys(Output.upstreamAny(a))).toEqual(["Top"]);
+  });
+
+  it("resolveUpstream picks up raw Resources alongside Output expressions", () => {
+    const a = fakeResource("Test.A", "A1");
+    const b = fakeResource("Test.B", "B1");
+    const result = Output.resolveUpstream({
+      raw: a,
+      via: Output.of(b),
+    });
+    expect(Object.keys(result).sort()).toEqual(["A1", "B1"]);
+  });
+
+  it("hasOutputs is true when an object contains an Output referencing a resource", () => {
+    const src = fakeResource("Test.A", "X");
+    expect(Output.hasOutputs({ k: Output.of(src) })).toBe(true);
+  });
+
+  it("hasOutputs is false for plain values", () => {
+    expect(Output.hasOutputs({ k: 1, b: "x" })).toBe(false);
+    expect(Output.hasOutputs([1, 2, 3])).toBe(false);
+  });
+
+  it("resolveUpstream walks arrays and objects to gather resources", () => {
+    const a = fakeResource("Test.A", "RA");
+    const b = fakeResource("Test.B", "RB");
+    const result = Output.resolveUpstream({
+      arr: [Output.of(a)],
+      nested: { prop: Output.of(b) },
+      scalar: 1,
+    });
+    expect(Object.keys(result).sort()).toEqual(["RA", "RB"]);
+  });
+});
+
+describe("Output.toEnvKey / toUpper", () => {
+  it("uppercases strings", () => {
+    expect(Output.toUpper("hello")).toBe("HELLO");
+  });
+
+  it("joins id + suffix and replaces dashes with underscores", () => {
+    expect(Output.toEnvKey("my-bucket", "name")).toBe("MY_BUCKET_NAME");
+    expect(Output.toEnvKey("svc", "api-key")).toBe("SVC_API_KEY");
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLBranch.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLBranch.test.ts
new file mode 100644
index 00000000000..676c429a530
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLBranch.test.ts
@@ -0,0 +1,630 @@
+import { adopt } from "@/AdoptPolicy";
+import * as Planetscale from "@/Planetscale";
+import * as RemovalPolicy from "@/RemovalPolicy.ts";
+import * as Test from "@/Test/Vitest";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import { describe, expect } from "@effect/vitest";
+import { Data, Schedule } from "effect";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Planetscale.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+describe.skipIf(!process.env.PLANETSCALE_TEST)(() => {
+  test.provider(
+    "adopts existing branch when adopt is true",
+    (stack) =>
+      Effect.gen(function* () {
+        const dbName = "alchemy-branch-adopt-true";
+        const branchName = "adopted";
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            });
+
+            return { database };
+          }),
+        );
+
+        yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          "main",
+        );
+        yield* deleteBranchIfExists(database.organization, dbName, branchName);
+
+        yield* ops.createBranch({
+          organization: database.organization,
+          database: dbName,
+          name: branchName,
+          parent_branch: "main",
+        });
+        yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          branchName,
+        );
+
+        const { branch } = yield* stack
+          .deploy(
+            Effect.gen(function* () {
+              const database = yield* Planetscale.MySQLDatabase("Database", {
+                name: dbName,
+                region: { slug: "us-east" },
+                clusterSize: "PS_10",
+              });
+              const branch = yield* Planetscale.MySQLBranch("AdoptedBranch", {
+                name: branchName,
+                database,
+                parentBranch: "main",
+                isProduction: false,
+              });
+
+              return { database, branch };
+            }),
+          )
+          .pipe(adopt(true));
+
+        expect(branch).toMatchObject({
+          name: branchName,
+          organization: database.organization,
+          database: dbName,
+          parentBranch: "main",
+          production: false,
+          createdAt: expect.any(String),
+          updatedAt: expect.any(String),
+          htmlUrl: expect.any(String),
+          region: { slug: expect.any(String) },
+        });
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(dbName, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "errors on existing branch when adopt is false",
+    (stack) =>
+      Effect.gen(function* () {
+        const dbName = "alchemy-branch-adopt-false";
+        const branchName = "existing";
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            });
+
+            return { database };
+          }),
+        );
+
+        yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          "main",
+        );
+        yield* deleteBranchIfExists(database.organization, dbName, branchName);
+
+        yield* ops.createBranch({
+          organization: database.organization,
+          database: dbName,
+          name: branchName,
+          parent_branch: "main",
+        });
+        yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          branchName,
+        );
+
+        const exit = yield* stack
+          .deploy(
+            Effect.gen(function* () {
+              const database = yield* Planetscale.MySQLDatabase("Database", {
+                name: dbName,
+                region: { slug: "us-east" },
+                clusterSize: "PS_10",
+              });
+              const branch = yield* Planetscale.MySQLBranch("ExistingBranch", {
+                name: branchName,
+                database,
+                parentBranch: "main",
+                isProduction: false,
+              });
+
+              return { database, branch };
+            }),
+          )
+          .pipe(Effect.exit);
+
+        yield* deleteBranchIfExists(database.organization, dbName, branchName);
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(dbName, database.organization);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (Exit.isFailure(exit)) {
+          const pretty = Cause.pretty(exit.cause);
+          expect(pretty).toContain("Cannot adopt resource");
+          expect(pretty).toContain("Planetscale.MySQLBranch");
+        }
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "can create branch with backup",
+    (stack) =>
+      Effect.gen(function* () {
+        const dbName = "alchemy-branch-backup";
+        const branchName = "restored";
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            });
+
+            return { database };
+          }),
+        );
+
+        yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          "main",
+        );
+        yield* deleteBranchIfExists(database.organization, dbName, branchName);
+
+        const backup = yield* ops.createBackup({
+          organization: database.organization,
+          database: dbName,
+          branch: "main",
+          name: "alchemy-branch-backup-source",
+          retention_unit: "hour",
+          retention_value: 1,
+        });
+        yield* waitForBackupSuccess(
+          database.organization,
+          dbName,
+          "main",
+          backup.id,
+        );
+
+        const { branch } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            });
+            const branch = yield* Planetscale.MySQLBranch("RestoredBranch", {
+              name: branchName,
+              database,
+              parentBranch: "main",
+              isProduction: true,
+              backupId: backup.id,
+              clusterSize: "PS_10",
+            });
+
+            return { database, branch };
+          }),
+        );
+
+        expect(branch).toMatchObject({
+          name: branchName,
+          database: dbName,
+          parentBranch: "main",
+          production: true,
+        });
+
+        const live = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          branchName,
+        );
+        expect(live.name).toEqual(branchName);
+        expect(live.production).toBe(true);
+        expect(live.cluster_name).toEqual("PS_10");
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            });
+            const branch = yield* Planetscale.MySQLBranch("RestoredBranch", {
+              name: branchName,
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            return { database, branch };
+          }),
+        );
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(dbName, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "can enable and disable safe migrations",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, branch } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: true,
+              clusterSize: "PS_10",
+              safeMigrations: true,
+            });
+
+            return { database, branch };
+          }),
+        );
+
+        const enabled = yield* ops.getBranch({
+          organization: database.organization,
+          database: database.name,
+          branch: branch.name,
+        });
+        expect(enabled.production).toBe(true);
+        expect(enabled.safe_migrations).toBe(true);
+
+        const { updatedBranch } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const updatedBranch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: true,
+              clusterSize: "PS_10",
+              safeMigrations: false,
+            });
+
+            return { database, updatedBranch };
+          }),
+        );
+
+        expect(updatedBranch.name).toEqual(branch.name);
+
+        const disabled = yield* ops.getBranch({
+          organization: database.organization,
+          database: database.name,
+          branch: branch.name,
+        });
+        expect(disabled.safe_migrations).toBe(false);
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            return { database, branch };
+          }),
+        );
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "can update cluster size",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, branch } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: true,
+              clusterSize: "PS_10",
+            });
+
+            return { database, branch };
+          }),
+        );
+
+        const initial = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          branch.name,
+        );
+        expect(initial.cluster_name).toEqual("PS_10");
+
+        const { resizedBranch } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const resizedBranch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: true,
+              clusterSize: "PS_20",
+            });
+
+            return { database, resizedBranch };
+          }),
+        );
+
+        expect(resizedBranch.name).toEqual(branch.name);
+
+        const resized = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          branch.name,
+        );
+        expect(resized.cluster_name).toEqual("PS_20");
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            return { database, branch };
+          }),
+        );
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "can create branch with Branch object as parent",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, parent, child } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+            const parent = yield* Planetscale.MySQLBranch("ParentBranch", {
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+            const child = yield* Planetscale.MySQLBranch("ChildBranch", {
+              database,
+              parentBranch: parent,
+              isProduction: false,
+            });
+
+            return { database, parent, child };
+          }),
+        );
+
+        expect(child).toMatchObject({
+          database: database.name,
+          parentBranch: parent.name,
+          production: false,
+        });
+
+        const live = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          child.name,
+        );
+        expect(live.parent_branch).toEqual(parent.name);
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "branch with RemovalPolicy.retain(true) should not be deleted via API",
+    (stack) =>
+      Effect.gen(function* () {
+        const dbName = "alchemy-branch-retain";
+        const branchName = "retained";
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            }).pipe(RemovalPolicy.retain(true));
+
+            return { database };
+          }),
+        );
+
+        yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          "main",
+        );
+        yield* deleteBranchIfExists(database.organization, dbName, branchName);
+
+        const { branch } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              region: { slug: "us-east" },
+              clusterSize: "PS_10",
+            }).pipe(RemovalPolicy.retain(true));
+            const branch = yield* Planetscale.MySQLBranch("RetainedBranch", {
+              name: branchName,
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            }).pipe(RemovalPolicy.retain(true));
+
+            return { database, branch };
+          }),
+        );
+
+        expect(branch.name).toEqual(branchName);
+
+        yield* stack.destroy();
+
+        const live = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          dbName,
+          branchName,
+        );
+        expect(live.name).toEqual(branchName);
+
+        yield* deleteBranchIfExists(database.organization, dbName, branchName);
+        yield* ops
+          .deleteDatabase({
+            organization: database.organization,
+            database: dbName,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+        yield* waitForDatabaseToBeDeleted(dbName, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+});
+
+const deleteBranchIfExists = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+) {
+  yield* ops
+    .deleteBranch({ organization, database, branch })
+    .pipe(Effect.catchTag("NotFound", () => Effect.void));
+  yield* waitForBranchToBeDeleted(organization, database, branch);
+});
+
+const waitForBranchToBeDeleted = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+) {
+  yield* ops.getBranch({ organization, database, branch }).pipe(
+    Effect.flatMap(() => Effect.fail(new BranchStillExists())),
+    Effect.retry({
+      while: (e): e is BranchStillExists => e instanceof BranchStillExists,
+      schedule: Schedule.exponential(100),
+    }),
+    Effect.catchTag("NotFound", () => Effect.void),
+  );
+});
+
+const waitForDatabaseToBeDeleted = Effect.fn(function* (
+  database: string,
+  organization: string,
+) {
+  yield* ops
+    .getDatabase({
+      organization,
+      database,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new DatabaseStillExists())),
+      Effect.retry({
+        while: (e): e is DatabaseStillExists =>
+          e instanceof DatabaseStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NotFound", () => Effect.void),
+    );
+});
+
+const waitForBackupSuccess = Effect.fn(function* (
+  organization: string,
+  database: string,
+  branch: string,
+  id: string,
+) {
+  return yield* ops.getBackup({ organization, database, branch, id }).pipe(
+    Effect.flatMap((backup) => {
+      switch (backup.state) {
+        case "success":
+          return Effect.succeed(backup);
+        case "failed":
+        case "canceled":
+        case "ignored":
+          return Effect.fail(
+            new BackupNotReady({ retryable: false, state: backup.state }),
+          );
+        default:
+          return Effect.fail(
+            new BackupNotReady({ retryable: true, state: backup.state }),
+          );
+      }
+    }),
+    Effect.retry({
+      while: (e): e is BackupNotReady =>
+        e instanceof BackupNotReady && e.retryable,
+      schedule: Schedule.exponential(1_000).pipe(
+        Schedule.both(Schedule.recurs(120)),
+      ),
+    }),
+  );
+});
+
+class BranchStillExists extends Data.TaggedError("BranchStillExists") {}
+
+class DatabaseStillExists extends Data.TaggedError("DatabaseStillExists") {}
+
+class BackupNotReady extends Data.TaggedError("BackupNotReady")<{
+  retryable: boolean;
+  state: string;
+}> {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLDatabase.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLDatabase.test.ts
new file mode 100644
index 00000000000..40c82777510
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLDatabase.test.ts
@@ -0,0 +1,390 @@
+import { adopt } from "@/AdoptPolicy";
+import * as Planetscale from "@/Planetscale";
+import * as RemovalPolicy from "@/RemovalPolicy.ts";
+import * as Test from "@/Test/Vitest";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import { describe, expect } from "@effect/vitest";
+import { Data, Schedule } from "effect";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Planetscale.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const fixturesDir = `${import.meta.dirname}/fixtures`;
+
+describe.skipIf(!process.env.PLANETSCALE_TEST)(() => {
+  test.provider("create database with minimal settings", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const { database } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const database = yield* Planetscale.MySQLDatabase(
+            "MySQLDatabaseBasic",
+            {
+              clusterSize: "PS_10",
+            },
+          );
+
+          return {
+            database,
+          };
+        }),
+      );
+
+      expect(database).toMatchObject({
+        kind: "mysql",
+        id: expect.any(String),
+        name: expect.any(String),
+        organization: expect.any(String),
+        state: expect.any(String),
+        defaultBranch: "main",
+        plan: expect.any(String),
+        createdAt: expect.any(String),
+        updatedAt: expect.any(String),
+        htmlUrl: expect.any(String),
+        region: {
+          slug: expect.any(String),
+        },
+        clusterSize: "PS_10",
+      });
+
+      const branch = yield* Planetscale.waitForBranchReady(
+        database.organization,
+        database.name,
+        "main",
+      );
+
+      expect(branch.cluster_name).toEqual("PS_10");
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+  );
+
+  test.provider("create, update, and delete database", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.destroy();
+
+      const { database } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const database = yield* Planetscale.MySQLDatabase(
+            "MySQLDatabaseCRUD",
+            {
+              region: {
+                slug: "us-east",
+              },
+              clusterSize: "PS_10",
+              defaultBranch: "main",
+              allowDataBranching: true,
+              automaticMigrations: true,
+              requireApprovalForDeploy: false,
+              restrictBranchRegion: true,
+              insightsRawQueries: true,
+              productionBranchWebConsole: true,
+              migrationFramework: "rails",
+              migrationTableName: "schema_migrations",
+            },
+          );
+
+          return {
+            database,
+          };
+        }),
+      );
+
+      expect(database).toMatchObject({
+        kind: "mysql",
+        id: expect.any(String),
+        name: expect.any(String),
+        organization: expect.any(String),
+        state: expect.any(String),
+        plan: expect.any(String),
+        createdAt: expect.any(String),
+        updatedAt: expect.any(String),
+        htmlUrl: expect.any(String),
+        region: {
+          slug: expect.any(String),
+        },
+        clusterSize: "PS_10",
+        defaultBranch: "main",
+        allowDataBranching: true,
+        automaticMigrations: true,
+        requireApprovalForDeploy: false,
+        restrictBranchRegion: true,
+        insightsRawQueries: true,
+        productionBranchWebConsole: true,
+        migrationFramework: "rails",
+        migrationTableName: "schema_migrations",
+      });
+
+      const { updatedDatabase } = yield* stack.deploy(
+        Effect.gen(function* () {
+          const updatedDatabase = yield* Planetscale.MySQLDatabase(
+            "MySQLDatabaseCRUD",
+            {
+              clusterSize: "PS_20",
+              allowDataBranching: false,
+              automaticMigrations: true,
+              requireApprovalForDeploy: true,
+              restrictBranchRegion: false,
+              insightsRawQueries: false,
+              productionBranchWebConsole: false,
+              defaultBranch: "main",
+              migrationFramework: "django",
+              migrationTableName: "django_migrations",
+            },
+          );
+
+          return {
+            updatedDatabase,
+          };
+        }),
+      );
+
+      expect(updatedDatabase).toMatchObject({
+        allowDataBranching: false,
+        automaticMigrations: true,
+        requireApprovalForDeploy: true,
+        restrictBranchRegion: false,
+        insightsRawQueries: false,
+        productionBranchWebConsole: false,
+        defaultBranch: "main",
+        migrationFramework: "django",
+        migrationTableName: "django_migrations",
+      });
+
+      const branch = yield* Planetscale.waitForBranchReady(
+        database.organization,
+        database.name,
+        "main",
+      );
+
+      expect(branch.cluster_name).toEqual("PS_20");
+
+      yield* stack.destroy();
+
+      yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+    }).pipe(logLevel),
+  );
+
+  test.provider(
+    "creates non-main default branch if specified",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase(
+              "MySQLDatabaseCustomBranch",
+              {
+                clusterSize: "PS_10",
+                defaultBranch: "custom",
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database).toMatchObject({
+          kind: "mysql",
+          defaultBranch: "custom",
+        });
+
+        const branch = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          "custom",
+        );
+
+        expect(branch.name).toEqual("custom");
+        expect(branch.parent_branch).toEqual("main");
+        expect(branch.cluster_name).toEqual("PS_10");
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000, // must wait on multiple resizes and branch creation
+  );
+
+  test.provider(
+    "applies migrations and import files",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const importFile = `${fixturesDir}/seed.sql`;
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase(
+              "MySQLDatabaseMigrations",
+              {
+                clusterSize: "PS_10",
+                migrationsDir: `${fixturesDir}/migrations`,
+                importFiles: [importFile],
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database.migrationsTable).toEqual("planetscale_migrations");
+        expect(database.migrationsHashes["0001_create_widgets.sql"]).toEqual(
+          expect.any(String),
+        );
+        expect(database.importHashes[importFile]).toEqual(expect.any(String));
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "adopt with wrong kind should throw",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PgBaselineWrongKind",
+              {
+                region: { slug: "us-east" },
+                clusterSize: "PS_10",
+                arch: "arm", // arm is slightly faster
+              },
+            );
+
+            return { database };
+          }),
+        );
+
+        yield* Planetscale.waitForDatabaseReady(
+          database.organization,
+          database.name,
+        );
+        const exit = yield* Effect.exit(
+          stack
+            .deploy(
+              Effect.gen(function* () {
+                return yield* Planetscale.MySQLDatabase("MysqlWrongKind", {
+                  name: database.name,
+                  clusterSize: "PS_10",
+                });
+              }),
+            )
+            .pipe(adopt(true)),
+        );
+
+        expect(Exit.isFailure(exit)).toBe(true);
+
+        if (Exit.isFailure(exit)) {
+          const pretty = Cause.pretty(exit.cause);
+
+          expect(pretty).toContain("postgresql");
+          expect(pretty).toContain("PostgresDatabase");
+        }
+        yield* stack.destroy();
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "database with RemovalPolicy.retain(true) should not be deleted via API",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase(
+              "MySQLDatabaseRetainRemoval",
+              {
+                region: { slug: "us-east" },
+                clusterSize: "PS_10",
+              },
+            ).pipe(RemovalPolicy.retain(true));
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        // Verify database exists
+        const readyDatabase = yield* Planetscale.waitForDatabaseReady(
+          database.organization,
+          database.name,
+        );
+
+        expect(readyDatabase.name).toEqual(database.name);
+
+        // When we call destroy, the database should NOT be deleted via API
+        yield* stack.destroy();
+
+        yield* Planetscale.waitForDatabaseReady(
+          database.organization,
+          database.name,
+        );
+
+        // Verify database still exists (was not deleted via API)
+        const live = yield* ops.getDatabase({
+          organization: database.organization,
+          database: database.name,
+        });
+
+        // Database should still exist
+        expect(live.name).toEqual(database.name);
+        expect(live.state).toEqual("ready");
+        expect(live.kind).toEqual("mysql");
+
+        // Clean up manually for the test
+        yield* ops
+          .deleteDatabase({
+            organization: database.organization,
+            database: database.name,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+      }).pipe(logLevel),
+    5_000_000,
+  );
+});
+
+const waitForDatabaseToBeDeleted = Effect.fn(function* (
+  database: string,
+  organization: string,
+) {
+  yield* ops
+    .getDatabase({
+      organization,
+      database,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new DatabaseStillExists())),
+      Effect.retry({
+        while: (e): e is DatabaseStillExists =>
+          e instanceof DatabaseStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NotFound", () => Effect.void),
+    );
+});
+
+class DatabaseStillExists extends Data.TaggedError("DatabaseStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLPassword.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLPassword.test.ts
new file mode 100644
index 00000000000..f4e50df05d8
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/MySQLPassword.test.ts
@@ -0,0 +1,315 @@
+import * as Planetscale from "@/Planetscale";
+import * as RemovalPolicy from "@/RemovalPolicy.ts";
+import * as Test from "@/Test/Vitest";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import { describe, expect } from "@effect/vitest";
+import { Data, Schedule } from "effect";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({
+  providers: Planetscale.providers(),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+describe.skipIf(!process.env.PLANETSCALE_TEST)(() => {
+  test.provider(
+    "create, update, and delete password",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, branch, password } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            const password = yield* Planetscale.MySQLPassword("Password", {
+              database,
+              branch,
+              role: "reader",
+            });
+
+            return { database, branch, password };
+          }),
+        );
+
+        expect(password).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          role: "reader",
+          host: expect.any(String),
+          username: expect.any(String),
+          organization: expect.any(String),
+          database: database.name,
+          branch: branch.name,
+        });
+
+        // Verify password was created by querying the API directly
+        const fetched = yield* ops.getPassword({
+          organization: database.organization,
+          database: database.name,
+          branch: branch.name,
+          id: password.id,
+        });
+
+        expect(fetched.id).toEqual(password.id);
+        expect(fetched.name).toEqual(password.name);
+        expect(fetched.role).toEqual("reader");
+
+        // Update the password (only name and cidrs should trigger update, not replace)
+        const { updatedPassword } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const sameDatabase = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+
+            const sameBranch = yield* Planetscale.MySQLBranch("Branch", {
+              database: sameDatabase,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            const updatedPassword = yield* Planetscale.MySQLPassword(
+              "Password",
+              {
+                name: "test-updated-password-name",
+                database: sameDatabase.name,
+                branch: sameBranch.name,
+                role: "reader",
+              },
+            );
+
+            return { updatedPassword };
+          }),
+        );
+
+        expect(updatedPassword.id).toEqual(password.id);
+        expect(updatedPassword.name).not.toEqual(password.name);
+
+        // Verify password was updated
+        const fetchedUpdated = yield* ops.getPassword({
+          organization: database.organization,
+          database: database.name,
+          branch: branch.name,
+          id: updatedPassword.id,
+        });
+
+        expect(fetchedUpdated.id).toEqual(password.id);
+        expect(fetchedUpdated.name).toEqual(updatedPassword.name);
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "password gets replaced when properties other than name and cidrs change",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, branch, password } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            const password = yield* Planetscale.MySQLPassword("Password", {
+              database,
+              branch,
+              role: "reader",
+              ttl: 3600,
+              cidrs: ["0.0.0.0/0"],
+            });
+            return { database, branch, password };
+          }),
+        );
+
+        const originalId = password.id;
+        expect(password.role).toEqual("reader");
+        expect(password.ttl).toEqual(3600);
+
+        // Change role from reader -> writer (should trigger replace).
+        const { replacedPassword } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              clusterSize: "PS_10",
+            });
+
+            const branch = yield* Planetscale.MySQLBranch("Branch", {
+              database,
+              parentBranch: "main",
+              isProduction: false,
+            });
+
+            const replacedPassword = yield* Planetscale.MySQLPassword(
+              "Password",
+              {
+                database,
+                branch,
+                role: "writer",
+                ttl: 3600,
+                cidrs: ["0.0.0.0/0"],
+              },
+            );
+            return { replacedPassword };
+          }),
+        );
+
+        // New ID due to replacement.
+        expect(replacedPassword.id).not.toEqual(originalId);
+        expect(replacedPassword.role).toEqual("writer");
+
+        // Old password should have been deleted as part of the replace.
+        const oldExit = yield* ops
+          .getPassword({
+            organization: database.organization,
+            database: database.name,
+            branch: branch.name,
+            id: originalId,
+          })
+          .pipe(Effect.exit);
+        expect(Exit.isFailure(oldExit)).toBe(true);
+        if (Exit.isFailure(oldExit)) {
+          expect(Cause.pretty(oldExit.cause)).toContain("NotFound");
+        }
+
+        // New password exists with the new role.
+        const newFetched = yield* ops.getPassword({
+          organization: database.organization,
+          database: database.name,
+          branch: branch.name,
+          id: replacedPassword.id,
+        });
+        expect(newFetched.id).toEqual(replacedPassword.id);
+        expect(newFetched.role).toEqual("writer");
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "password with RemovalPolicy.retain(true) should not be deleted via API",
+    (stack) =>
+      Effect.gen(function* () {
+        const dbName = `alchemy-test-pwd-retain`;
+        const passwordName = `retain-password`;
+
+        yield* stack.destroy();
+
+        const { database, password } = yield* stack.deploy(
+          Effect.gen(function* () {
+            // Retain the database too — otherwise deleting it would cascade
+            // to the password and we couldn't observe the retain behavior.
+            const database = yield* Planetscale.MySQLDatabase("Database", {
+              name: dbName,
+              clusterSize: "PS_10",
+            }).pipe(RemovalPolicy.retain(true));
+            const password = yield* Planetscale.MySQLPassword("Password", {
+              name: passwordName,
+              database,
+              role: "reader",
+            }).pipe(RemovalPolicy.retain(true));
+            return { database, password };
+          }),
+        );
+
+        // Password exists post-deploy.
+        const fetched = yield* ops.getPassword({
+          organization: database.organization,
+          database: database.name,
+          branch: "main",
+          id: password.id,
+        });
+        expect(fetched.id).toEqual(password.id);
+
+        // Destroy the stack — both retained, so neither should be removed.
+        yield* stack.destroy();
+
+        const { organization } = yield* Planetscale.Credentials;
+
+        // Database should still exist and be ready.
+        const liveDb = yield* Planetscale.waitForDatabaseReady(
+          organization,
+          dbName,
+        );
+        expect(liveDb.name).toEqual(dbName);
+
+        // Password should still exist (was not deleted via API).
+        const stillExists = yield* ops.getPassword({
+          organization,
+          database: dbName,
+          branch: "main",
+          id: password.id,
+        });
+        expect(stillExists.id).toEqual(password.id);
+        expect(stillExists.name).toEqual(password.name);
+
+        // Manual cleanup for the test.
+        yield* ops
+          .deletePassword({
+            organization,
+            database: dbName,
+            branch: "main",
+            id: password.id,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+
+        yield* ops
+          .deleteDatabase({
+            organization,
+            database: dbName,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+
+        yield* waitForDatabaseToBeDeleted(dbName, organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+});
+
+const waitForDatabaseToBeDeleted = Effect.fn(function* (
+  database: string,
+  organization: string,
+) {
+  yield* ops
+    .getDatabase({
+      organization,
+      database,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new DatabaseStillExists())),
+      Effect.retry({
+        while: (e): e is DatabaseStillExists =>
+          e instanceof DatabaseStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NotFound", () => Effect.void),
+    );
+});
+
+class DatabaseStillExists extends Data.TaggedError("DatabaseStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/fixtures/migrations/0001_create_widgets.sql b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/fixtures/migrations/0001_create_widgets.sql
new file mode 100644
index 00000000000..546a61da3d1
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/fixtures/migrations/0001_create_widgets.sql
@@ -0,0 +1,4 @@
+CREATE TABLE IF NOT EXISTS alchemy_mysql_widgets (
+  id bigint NOT NULL PRIMARY KEY,
+  name varchar(255) NOT NULL
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/fixtures/seed.sql b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/fixtures/seed.sql
new file mode 100644
index 00000000000..ff5bbb165df
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/MySQL/fixtures/seed.sql
@@ -0,0 +1,3 @@
+INSERT INTO alchemy_mysql_widgets (id, name)
+VALUES (1, 'seeded')
+ON DUPLICATE KEY UPDATE name = VALUES(name);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/Hyperdrive.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/Hyperdrive.test.ts
new file mode 100644
index 00000000000..7221c37d474
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/Hyperdrive.test.ts
@@ -0,0 +1,113 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Planetscale from "@/Planetscale";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import HyperdriveWorker from "./fixtures/hyperdrive-worker.ts";
+import type { Widget } from "./fixtures/schema.ts";
+import { Hyperdrive, PlanetscaleDb } from "./fixtures/Stack.ts";
+
+const { test } = Test.make({
+  providers: Layer.mergeAll(Cloudflare.providers(), Planetscale.providers()),
+});
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+class WorkerNotReady extends Data.TaggedError("WorkerNotReady")<{
+  status: number;
+  body: string;
+}> {}
+
+describe.skipIf(!process.env.PLANETSCALE_TEST)(() => {
+  /**
+   * End-to-end: deploy a {@link Planetscale.PostgresDatabase} + branch +
+   * role, point a {@link Cloudflare.Hyperdrive} at the role's origin, and
+   * exercise the Drizzle Effect client over real Postgres via a Worker.
+   *
+   * Validates that:
+   *   - migrations applied from the fixtures dir produce the expected table
+   *   - `Cloudflare.Hyperdrive.bind(...) + Drizzle.postgres(...)` produces
+   *     a working Effect-native client at runtime
+   *   - INSERT / SELECT / DELETE round-trip through Hyperdrive to Planetscale
+   */
+  test.provider(
+    "PostgresBranch + Hyperdrive + Drizzle round-trips through a Worker",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { worker } = yield* stack.deploy(
+          Effect.gen(function* () {
+            yield* PlanetscaleDb;
+            yield* Hyperdrive;
+            const worker = yield* HyperdriveWorker;
+            return { worker };
+          }),
+        );
+
+        expect(worker.url).toBeTypeOf("string");
+        const baseUrl = (worker.url as string).replace(/\/+$/, "");
+
+        // workers.dev edge takes a few seconds to start serving; retry the
+        // first request until we get a non-4xx.
+        const initial = yield* HttpClient.get(`${baseUrl}/widgets`).pipe(
+          Effect.flatMap((res) =>
+            res.status === 200
+              ? res.text.pipe(Effect.as(res))
+              : res.text.pipe(
+                  Effect.flatMap((body) =>
+                    Effect.fail(
+                      new WorkerNotReady({ status: res.status, body }),
+                    ),
+                  ),
+                ),
+          ),
+          Effect.retry({
+            while: (e): e is WorkerNotReady =>
+              e instanceof WorkerNotReady && e.status >= 400 && e.status < 600,
+            schedule: Schedule.exponential("500 millis").pipe(
+              Schedule.both(Schedule.recurs(20)),
+            ),
+          }),
+        );
+        expect(initial.status).toBe(200);
+        const initialBody = (yield* initial.json) as { widgets: Widget[] };
+        expect(Array.isArray(initialBody.widgets)).toBe(true);
+
+        const insertRes = yield* HttpClient.execute(
+          HttpClientRequest.post(`${baseUrl}/widgets`).pipe(
+            HttpClientRequest.bodyJsonUnsafe({ id: 1, name: "alpha" }),
+          ),
+        );
+        expect(insertRes.status).toBe(200);
+        const insertBody = (yield* insertRes.json) as { widget: Widget };
+        expect(insertBody.widget).toMatchObject({ id: 1, name: "alpha" });
+
+        const after = yield* HttpClient.get(`${baseUrl}/widgets`);
+        expect(after.status).toBe(200);
+        const afterBody = (yield* after.json) as { widgets: Widget[] };
+        expect(afterBody.widgets.some((w) => w.id === 1)).toBe(true);
+
+        const deleteRes = yield* HttpClient.execute(
+          HttpClientRequest.delete(`${baseUrl}/widgets/1`),
+        );
+        expect(deleteRes.status).toBe(200);
+
+        const final = yield* HttpClient.get(`${baseUrl}/widgets`);
+        const finalBody = (yield* final.json) as { widgets: Widget[] };
+        expect(finalBody.widgets.some((w) => w.id === 1)).toBe(false);
+
+        yield* stack.destroy();
+      }).pipe(logLevel),
+    { timeout: 600_000 },
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/PostgresDatabase.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/PostgresDatabase.test.ts
new file mode 100644
index 00000000000..32cec30ada2
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/PostgresDatabase.test.ts
@@ -0,0 +1,488 @@
+import { adopt } from "@/AdoptPolicy";
+import * as Planetscale from "@/Planetscale";
+import * as RemovalPolicy from "@/RemovalPolicy.ts";
+import * as Test from "@/Test/Vitest";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import { describe, expect } from "@effect/vitest";
+import { Data, Schedule } from "effect";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { MinimumLogLevel } from "effect/References";
+
+const { test } = Test.make({ providers: Planetscale.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+
+const fixturesDir = `${import.meta.dirname}/fixtures`;
+
+describe.skipIf(!process.env.PLANETSCALE_TEST)(() => {
+  test.provider(
+    "create database with minimal settings",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseBasic",
+              {
+                clusterSize: "PS_10",
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database).toMatchObject({
+          kind: "postgresql",
+          id: expect.any(String),
+          name: expect.any(String),
+          organization: expect.any(String),
+          state: expect.any(String),
+          defaultBranch: "main",
+          plan: expect.any(String),
+          createdAt: expect.any(String),
+          updatedAt: expect.any(String),
+          htmlUrl: expect.any(String),
+          region: {
+            slug: expect.any(String),
+          },
+          clusterSize: "PS_10",
+        });
+
+        const branch = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          "main",
+        );
+
+        expect(branch.cluster_name).toEqual("PS_10_AWS_X86");
+
+        yield* stack.destroy();
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "create, update, and delete database",
+    (stack) =>
+      Effect.gen(function* () {
+        const name = `alchemy-test-postgresql-crud`;
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseCRUD",
+              {
+                name,
+                region: {
+                  slug: "us-east",
+                },
+                clusterSize: "PS_10",
+                defaultBranch: "main",
+                requireApprovalForDeploy: false,
+                restrictBranchRegion: true,
+                productionBranchWebConsole: true,
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database).toMatchObject({
+          kind: "postgresql",
+          id: expect.any(String),
+          name,
+          organization: expect.any(String),
+          state: expect.any(String),
+          plan: expect.any(String),
+          createdAt: expect.any(String),
+          updatedAt: expect.any(String),
+          htmlUrl: expect.any(String),
+          region: {
+            slug: expect.any(String),
+          },
+          clusterSize: "PS_10",
+          defaultBranch: "main",
+          requireApprovalForDeploy: false,
+          restrictBranchRegion: true,
+          productionBranchWebConsole: true,
+        });
+
+        const { updatedDatabase } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const updatedDatabase = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseCRUD",
+              {
+                name,
+                clusterSize: "PS_20",
+                requireApprovalForDeploy: true,
+                restrictBranchRegion: false,
+                productionBranchWebConsole: false,
+                defaultBranch: "main",
+              },
+            );
+
+            return {
+              updatedDatabase,
+            };
+          }),
+        );
+
+        expect(updatedDatabase).toMatchObject({
+          name,
+          requireApprovalForDeploy: true,
+          restrictBranchRegion: false,
+          productionBranchWebConsole: false,
+          defaultBranch: "main",
+        });
+
+        const branch = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          "main",
+        );
+
+        expect(branch.cluster_name).toEqual("PS_20_AWS_X86");
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "creates non-main default branch if specified",
+    (stack) =>
+      Effect.gen(function* () {
+        const name = `alchemy-test-postgresql-custom-branch`;
+        const defaultBranch = "custom";
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseCustomBranch",
+              {
+                name,
+                clusterSize: "PS_10",
+                defaultBranch,
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database).toMatchObject({
+          name,
+          kind: "postgresql",
+          defaultBranch,
+        });
+
+        const branch = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          defaultBranch,
+        );
+
+        expect(branch.name).toEqual(defaultBranch);
+        expect(branch.parent_branch).toEqual("main");
+        expect(branch.cluster_name).toEqual("PS_10_AWS_X86");
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000, // must wait on multiple resizes and branch creation
+  );
+
+  test.provider(
+    "create database with arm arch",
+    (stack) =>
+      Effect.gen(function* () {
+        const name = `alchemy-test-postgresql-basic`;
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseBasic",
+              {
+                name,
+                clusterSize: "PS_10",
+                arch: "arm",
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database).toMatchObject({
+          kind: "postgresql",
+          id: expect.any(String),
+          name,
+          arch: "arm",
+          clusterSize: "PS_10",
+        });
+
+        const branch = yield* Planetscale.waitForBranchReady(
+          database.organization,
+          database.name,
+          "main",
+        );
+
+        expect(branch.cluster_name).toEqual("PS_10_AWS_ARM");
+
+        yield* stack.destroy();
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "applies migrations and import files",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const importFile = `${fixturesDir}/seed.sql`;
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseMigrations",
+              {
+                clusterSize: "PS_10",
+                migrationsDir: `${fixturesDir}/migrations`,
+                importFiles: [importFile],
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database.migrationsTable).toEqual("planetscale_migrations");
+        expect(database.migrationsHashes["0001_create_widgets.sql"]).toEqual(
+          expect.any(String),
+        );
+        expect(database.importHashes[importFile]).toEqual(expect.any(String));
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "adopt with wrong kind should throw",
+    (stack) =>
+      Effect.gen(function* () {
+        const name = `alchemy-test-postgresql-kind`;
+
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.MySQLDatabase(
+              "MySQLBaselineWrongKind",
+              {
+                name,
+                region: { slug: "us-east" },
+                clusterSize: "PS_10",
+              },
+            );
+
+            return { database };
+          }),
+        );
+
+        yield* Planetscale.waitForDatabaseReady(database.organization, name);
+
+        const exit = yield* Effect.exit(
+          stack
+            .deploy(
+              Effect.gen(function* () {
+                const database = yield* Planetscale.PostgresDatabase(
+                  "PostgresWrongKind",
+                  {
+                    name,
+                    clusterSize: "PS_10",
+                  },
+                );
+
+                return { database };
+              }),
+            )
+            .pipe(adopt(true)),
+        );
+
+        expect(Exit.isFailure(exit)).toBe(true);
+
+        if (Exit.isFailure(exit)) {
+          const pretty = Cause.pretty(exit.cause);
+          expect(pretty).toContain("mysql");
+          expect(pretty).toContain("MySQLDatabase");
+        }
+
+        yield* stack.destroy();
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "adopt with wrong arch should trigger replace",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        // Create a database with arm
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseWrongArch",
+              {
+                arch: "arm",
+                clusterSize: "PS_10",
+              },
+            );
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        expect(database.arch).toEqual("arm");
+
+        // Now try to adopt it with a different arch — should replace
+        const { newDatabase } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const newDatabase = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseWrongArch",
+              {
+                arch: "x86",
+                clusterSize: "PS_10",
+              },
+            );
+            return {
+              newDatabase,
+            };
+          }),
+        );
+
+        expect(newDatabase.id).not.toBe(database.id);
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+        yield* waitForDatabaseToBeDeleted(
+          newDatabase.name,
+          newDatabase.organization,
+        );
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "database with RemovalPolicy.retain(true) should not be deleted via API",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase(
+              "PostgresDatabaseRetainRemoval",
+              {
+                region: { slug: "us-east" },
+                clusterSize: "PS_10",
+              },
+            ).pipe(RemovalPolicy.retain(true));
+
+            return {
+              database,
+            };
+          }),
+        );
+
+        // Verify database exists
+        yield* Planetscale.waitForDatabaseReady(
+          database.organization,
+          database.name,
+        );
+
+        // When we call destroy, the database should NOT be deleted via API
+        yield* stack.destroy();
+
+        yield* Planetscale.waitForDatabaseReady(
+          database.organization,
+          database.name,
+        );
+
+        // Verify database still exists (was not deleted via API)
+        const live = yield* ops.getDatabase({
+          organization: database.organization,
+          database: database.name,
+        });
+
+        // Database should still exist
+        expect(live.name).toEqual(database.name);
+        expect(live.state).toEqual("ready");
+        expect(live.kind).toEqual("postgresql");
+
+        // Clean up manually for the test
+        yield* ops
+          .deleteDatabase({
+            organization: database.organization,
+            database: database.name,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+      }).pipe(logLevel),
+    5_000_000,
+  );
+});
+
+const waitForDatabaseToBeDeleted = Effect.fn(function* (
+  database: string,
+  organization: string,
+) {
+  yield* ops
+    .getDatabase({
+      organization,
+      database,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new DatabaseStillExists())),
+      Effect.retry({
+        while: (e): e is DatabaseStillExists =>
+          e instanceof DatabaseStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NotFound", () => Effect.void),
+    );
+});
+
+class DatabaseStillExists extends Data.TaggedError("DatabaseStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/PostgresRole.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/PostgresRole.test.ts
new file mode 100644
index 00000000000..15ff2b79904
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/PostgresRole.test.ts
@@ -0,0 +1,439 @@
+import * as Planetscale from "@/Planetscale";
+import * as RemovalPolicy from "@/RemovalPolicy.ts";
+import * as Test from "@/Test/Vitest";
+import * as ops from "@distilled.cloud/planetscale/Operations";
+import { describe, expect } from "@effect/vitest";
+import { Redacted } from "effect";
+import * as Cause from "effect/Cause";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { MinimumLogLevel } from "effect/References";
+import * as Schedule from "effect/Schedule";
+
+const { test } = Test.make({ providers: Planetscale.providers() });
+
+const logLevel = Effect.provideService(
+  MinimumLogLevel,
+  process.env.DEBUG ? "Debug" : "Info",
+);
+describe.skipIf(!process.env.PLANETSCALE_TEST)(() => {
+  test.provider(
+    "default role - create, duplicate fails, forceReset returns new id",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        // First: create default role, expect success
+        const { database, role1 } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role1 = yield* Planetscale.PostgresDefaultRole("Role1", {
+              database,
+            });
+
+            return { role1, database };
+          }),
+        );
+
+        expect(role1).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          host: expect.any(String),
+          username: expect.any(String),
+          password: expect.any(Object),
+          databaseName: "postgres",
+          branch: "main",
+          organization: database.organization,
+        });
+
+        // Second: create again without forceReset — should fail (default already exists)
+        const exit = yield* stack
+          .deploy(
+            Effect.gen(function* () {
+              const database = yield* Planetscale.PostgresDatabase("Database", {
+                clusterSize: "PS_10",
+                arch: "arm",
+              });
+              const role2 = yield* Planetscale.PostgresDefaultRole("Role2", {
+                database,
+              });
+
+              return { role2 };
+            }),
+          )
+          .pipe(Effect.exit);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+
+        if (Exit.isFailure(exit)) {
+          expect(Cause.pretty(exit.cause)).toMatch(
+            /Default role already exists.*Use forceReset/,
+          );
+        }
+
+        // Third: create with forceReset — should succeed and return a different role id
+        const { role3 } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role3 = yield* Planetscale.PostgresDefaultRole("Role3", {
+              database,
+              forceReset: true,
+            });
+
+            return { role3, database };
+          }),
+        );
+
+        expect(role3).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          host: expect.any(String),
+          username: expect.any(String),
+          password: expect.any(Object),
+          databaseName: "postgres",
+          branch: "main",
+          organization: database.organization,
+        });
+
+        // the default role ID is the same, but the password is different
+        expect(Redacted.value(role3.password)).not.toEqual(
+          Redacted.value(role1.password),
+        );
+
+        yield* stack.destroy();
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "create and delete role",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        // Create a role
+        const { database, role } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role = yield* Planetscale.PostgresRole("Role", {
+              database,
+              // Empty array means no permissions, which is fine for testing.
+              inheritedRoles: [],
+            });
+
+            return { database, role };
+          }),
+        );
+
+        expect(role).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          host: expect.any(String),
+          username: expect.any(String),
+          password: expect.any(Object),
+        });
+
+        // Update role with different ttl (should trigger replacement)
+        const { updatedRole } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const updatedRole = yield* Planetscale.PostgresRole("Role", {
+              database,
+              ttl: 3600,
+              inheritedRoles: [],
+            });
+
+            return { database, updatedRole };
+          }),
+        );
+
+        expect(role.id).not.toEqual(updatedRole.id);
+        expect(updatedRole.ttl).toEqual(3600);
+
+        const found = yield* ops
+          .getRole({
+            id: role.id,
+            database: database.name,
+            organization: database.organization,
+            branch: "main",
+          })
+          .pipe(
+            Effect.map(() => true),
+            Effect.catchTag("NotFound", () => Effect.succeed(false)),
+          );
+
+        expect(found).toBe(false);
+
+        const updatedRoleFromApi = yield* ops.getRole({
+          id: updatedRole.id,
+          database: database.name,
+          organization: database.organization,
+          branch: "main",
+        });
+
+        expect(updatedRoleFromApi.ttl).toEqual(3600);
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "role gets replaced when properties change",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, role1 } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role1 = yield* Planetscale.PostgresRole("RoleReplace", {
+              database: database,
+              inheritedRoles: ["pg_read_all_data"],
+              ttl: 3600,
+            });
+
+            return { database, role1 };
+          }),
+        );
+
+        expect(role1).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          inheritedRoles: ["pg_read_all_data"],
+        });
+
+        const originalId = role1.id;
+        const originalName = role1.name;
+
+        const { role2 } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role2 = yield* Planetscale.PostgresRole("RoleReplace", {
+              database: database,
+              inheritedRoles: ["postgres"],
+              ttl: 7200,
+            });
+
+            return { role2 };
+          }),
+        );
+
+        expect(role2).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          inheritedRoles: ["postgres"],
+        });
+
+        expect(role2.id).not.toEqual(originalId);
+        expect(role2.name).not.toEqual(originalName);
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "role with RemovalPolicy.retain(true) should not be deleted via API",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { organization } = yield* Planetscale.Credentials;
+
+        const { database, role } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            }).pipe(RemovalPolicy.retain(true));
+            const role = yield* Planetscale.PostgresRole("RoleRetainRemoval", {
+              database,
+              inheritedRoles: ["postgres"],
+            }).pipe(RemovalPolicy.retain(true));
+
+            return { database, role };
+          }),
+        );
+
+        expect(role).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          database: database.name,
+          inheritedRoles: ["postgres"],
+        });
+
+        yield* stack.destroy();
+
+        const liveRole = yield* ops
+          .getRole({
+            organization,
+            database: database.name,
+            branch: "main",
+            id: role.id,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+
+        expect(liveRole).toBeDefined();
+        expect(liveRole?.id).toEqual(role.id);
+
+        // deleting the db takes care of deleting the role
+        yield* ops
+          .deleteDatabase({
+            organization,
+            database: database.name,
+          })
+          .pipe(Effect.catchTag("NotFound", () => Effect.void));
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "role update: successor is updatable without replacement",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, role1 } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role1 = yield* Planetscale.PostgresRole("RoleSuccessor", {
+              database,
+              inheritedRoles: ["postgres"],
+              successor: "postgres",
+            });
+
+            return { database, role1 };
+          }),
+        );
+
+        expect(role1).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          successor: "postgres",
+        });
+
+        const originalId = role1.id;
+
+        const { role2 } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+            const role2 = yield* Planetscale.PostgresRole("RoleSuccessor", {
+              database,
+              inheritedRoles: ["postgres"],
+              successor: "pg_read_all_data",
+            });
+
+            return { role2 };
+          }),
+        );
+
+        expect(role2).toMatchObject({
+          id: originalId,
+          successor: "pg_read_all_data",
+        });
+
+        expect(role2.id).toEqual(originalId);
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+
+  test.provider(
+    "role with custom branch",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.destroy();
+
+        const { database, branch, role } = yield* stack.deploy(
+          Effect.gen(function* () {
+            const database = yield* Planetscale.PostgresDatabase("Database", {
+              clusterSize: "PS_10",
+              arch: "arm",
+            });
+
+            const branch = yield* Planetscale.PostgresBranch("CustomBranch", {
+              database,
+            });
+
+            const role = yield* Planetscale.PostgresRole("RoleCustomBranch", {
+              database,
+              branch,
+              inheritedRoles: ["postgres"],
+            });
+
+            return { database, branch, role };
+          }),
+        );
+
+        expect(role).toMatchObject({
+          id: expect.any(String),
+          name: expect.any(String),
+          database: database.name,
+          branch: branch.name,
+          inheritedRoles: ["postgres"],
+        });
+
+        yield* stack.destroy();
+
+        yield* waitForDatabaseToBeDeleted(database.name, database.organization);
+      }).pipe(logLevel),
+    5_000_000,
+  );
+});
+const waitForDatabaseToBeDeleted = Effect.fn(function* (
+  database: string,
+  organization: string,
+) {
+  yield* ops
+    .getDatabase({
+      organization,
+      database,
+    })
+    .pipe(
+      Effect.flatMap(() => Effect.fail(new DatabaseStillExists())),
+      Effect.retry({
+        while: (e): e is DatabaseStillExists =>
+          e instanceof DatabaseStillExists,
+        schedule: Schedule.exponential(100),
+      }),
+      Effect.catchTag("NotFound", () => Effect.void),
+    );
+});
+
+class DatabaseStillExists extends Data.TaggedError("DatabaseStillExists") {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/Stack.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/Stack.ts
new file mode 100644
index 00000000000..1b340daeb2e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/Stack.ts
@@ -0,0 +1,39 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Planetscale from "@/Planetscale/index.ts";
+import * as Effect from "effect/Effect";
+
+/**
+ * Shared Planetscale + Cloudflare wiring used by the Hyperdrive
+ * fixture worker. A long-lived staging Postgres database (named
+ * deterministically so reruns adopt the same resource) owns a feature
+ * branch + role; Hyperdrive points at `role.origin` so the worker can
+ * connect over Postgres-on-PSBouncer.
+ */
+export const PlanetscaleDb = Effect.gen(function* () {
+  const database = yield* Planetscale.PostgresDatabase("HyperdriveTestDb", {
+    name: "alchemy-postgres-hyperdrive",
+    region: { slug: "us-east" },
+    clusterSize: "PS_10",
+  });
+
+  const branch = yield* Planetscale.PostgresBranch("HyperdriveTestBranch", {
+    database,
+    migrationsDir:
+      "./packages/alchemy/test/Planetscale/Postgres/fixtures/migrations",
+  });
+
+  const role = yield* Planetscale.PostgresRole("HyperdriveTestRole", {
+    database,
+    branch,
+    inheritedRoles: ["postgres"],
+  });
+
+  return { database, branch, role };
+});
+
+export const Hyperdrive = Effect.gen(function* () {
+  const { role } = yield* PlanetscaleDb;
+  return yield* Cloudflare.Hyperdrive("HyperdriveTestEdge", {
+    origin: role.origin,
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/hyperdrive-worker.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/hyperdrive-worker.ts
new file mode 100644
index 00000000000..e3cd48e2d6c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/hyperdrive-worker.ts
@@ -0,0 +1,73 @@
+import * as Cloudflare from "@/Cloudflare/index.ts";
+import * as Drizzle from "@/Drizzle/index.ts";
+import { eq } from "drizzle-orm";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Hyperdrive } from "./Stack.ts";
+import { relations, Widgets } from "./schema.ts";
+
+/**
+ * Worker fixture that binds a Cloudflare Hyperdrive (pointed at a
+ * Planetscale Postgres role) and exercises Drizzle's Effect-native
+ * client. Mirrors the cloudflare-planetscale-drizzle example but lives
+ * inside the package so the runtime path is covered by an integration
+ * test next to the resource it exercises.
+ */
+export default class HyperdriveWorker extends Cloudflare.Worker<HyperdriveWorker>()(
+  "PlanetscaleHyperdriveWorker",
+  {
+    main: import.meta.filename,
+    subdomain: { enabled: true },
+    compatibility: { date: "2024-09-23", flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const conn = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+    const db = yield* Drizzle.postgres(conn.connectionString, { relations });
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+
+        if (request.method === "GET" && url.pathname === "/widgets") {
+          const widgets = yield* db.select().from(Widgets);
+          return yield* HttpServerResponse.json({ widgets });
+        }
+
+        if (request.method === "POST" && url.pathname === "/widgets") {
+          const body = (yield* request.json) as { id: number; name: string };
+          const [inserted] = yield* db
+            .insert(Widgets)
+            .values({ id: body.id, name: body.name })
+            .onConflictDoUpdate({
+              target: Widgets.id,
+              set: { name: body.name },
+            })
+            .returning();
+          return yield* HttpServerResponse.json({ widget: inserted });
+        }
+
+        const idMatch = url.pathname.match(/^\/widgets\/(\d+)$/);
+        if (request.method === "DELETE" && idMatch) {
+          const id = Number(idMatch[1]);
+          const [deleted] = yield* db
+            .delete(Widgets)
+            .where(eq(Widgets.id, id))
+            .returning();
+          return yield* HttpServerResponse.json({ widget: deleted ?? null });
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }).pipe(
+        Effect.catch((cause: any) =>
+          HttpServerResponse.json(
+            { ok: false, error: String(cause) },
+            { status: 500 },
+          ),
+        ),
+      ),
+    };
+  }).pipe(Effect.provide(Layer.mergeAll(Cloudflare.HyperdriveBindingLive))),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/migrations/0001_create_widgets.sql b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/migrations/0001_create_widgets.sql
new file mode 100644
index 00000000000..173c6be07b4
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/migrations/0001_create_widgets.sql
@@ -0,0 +1,4 @@
+CREATE TABLE IF NOT EXISTS alchemy_postgres_widgets (
+  id integer PRIMARY KEY,
+  name text NOT NULL
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/schema.ts b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/schema.ts
new file mode 100644
index 00000000000..230c14296ae
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/schema.ts
@@ -0,0 +1,10 @@
+import { defineRelations } from "drizzle-orm";
+import { integer, pgTable, text } from "drizzle-orm/pg-core";
+
+export const Widgets = pgTable("alchemy_postgres_widgets", {
+  id: integer("id").primaryKey(),
+  name: text("name").notNull(),
+});
+export type Widget = typeof Widgets.$inferSelect;
+
+export const relations = defineRelations({ Widgets }, () => ({}));
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/seed.sql b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/seed.sql
new file mode 100644
index 00000000000..8fa089555f3
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Planetscale/Postgres/fixtures/seed.sql
@@ -0,0 +1,3 @@
+INSERT INTO alchemy_postgres_widgets (id, name)
+VALUES (1, 'seeded')
+ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/State/Sync.test.ts b/.repos/alchemy-effect/packages/alchemy/test/State/Sync.test.ts
new file mode 100644
index 00000000000..4b4b26d8330
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/State/Sync.test.ts
@@ -0,0 +1,123 @@
+import {
+  InMemoryService,
+  syncState,
+  type ResourceState,
+  type StateService,
+} from "@/State";
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+
+describe("syncState", () => {
+  it.effect(
+    "copies source resources and overwrites matching destination resources",
+    () =>
+      Effect.gen(function* () {
+        const sourceA = resource("resource-a", { value: "source-a" });
+        const sourceB = resource("resource-b", { value: "source-b" });
+        const destinationA = resource("resource-a", { value: "destination-a" });
+
+        const source = yield* InMemoryService({
+          app: {
+            dev: {
+              "resource-a": sourceA,
+              "resource-b": sourceB,
+            },
+          },
+        });
+        const destination = yield* InMemoryService({
+          app: {
+            dev: {
+              "resource-a": destinationA,
+            },
+          },
+        });
+
+        yield* syncState(source, destination);
+
+        yield* expectStage(destination, "app", "dev", {
+          "resource-a": sourceA,
+          "resource-b": sourceB,
+        });
+      }),
+  );
+
+  it.effect(
+    "deletes resources from destination when they are absent from source",
+    () =>
+      Effect.gen(function* () {
+        const source = yield* InMemoryService({
+          app: {
+            dev: {
+              "resource-a": resource("resource-a", { value: "source-a" }),
+            },
+          },
+        });
+        const destination = yield* InMemoryService({
+          app: {
+            dev: {
+              "resource-a": resource("resource-a", { value: "destination-a" }),
+              "resource-b": resource("resource-b", { value: "destination-b" }),
+            },
+            prod: {
+              "resource-c": resource("resource-c", { value: "destination-c" }),
+            },
+          },
+          oldApp: {
+            dev: {
+              "resource-d": resource("resource-d", { value: "destination-d" }),
+            },
+          },
+        });
+
+        yield* syncState(source, destination);
+
+        yield* expectStage(destination, "app", "dev", {
+          "resource-a": resource("resource-a", { value: "source-a" }),
+        });
+        yield* expectStage(destination, "app", "prod", {});
+        yield* expectStage(destination, "oldApp", "dev", {});
+        expect(yield* destination.listStacks()).toEqual(["app"]);
+      }),
+  );
+});
+
+const resource = (
+  fqn: string,
+  attr: Record<string, unknown>,
+): ResourceState => ({
+  resourceType: "test:resource",
+  namespace: undefined,
+  fqn,
+  logicalId: fqn,
+  instanceId: `instance-${fqn}`,
+  providerVersion: 1,
+  status: "created",
+  downstream: [],
+  bindings: [],
+  props: {},
+  attr,
+});
+
+const listStage = Effect.fnUntraced(function* (
+  state: StateService,
+  stack: string,
+  stage: string,
+) {
+  const fqns = yield* state.list({ stack, stage });
+  const entries = yield* Effect.forEach(
+    fqns,
+    Effect.fnUntraced(function* (fqn) {
+      return [fqn, yield* state.get({ stack, stage, fqn })] as const;
+    }),
+  );
+  return Object.fromEntries(entries);
+});
+
+const expectStage = Effect.fnUntraced(function* (
+  state: StateService,
+  stack: string,
+  stage: string,
+  expected: Record<string, ResourceState>,
+) {
+  expect(yield* listStage(state, stack, stage)).toEqual(expected);
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/Util/data.test.ts b/.repos/alchemy-effect/packages/alchemy/test/Util/data.test.ts
new file mode 100644
index 00000000000..200db17b9ee
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/Util/data.test.ts
@@ -0,0 +1,63 @@
+import {
+  isPlainObject,
+  stripNullFields,
+  stripUndefinedFields,
+  unwrapRedacted,
+} from "@/Util/data";
+import * as Redacted from "effect/Redacted";
+import { describe, expect, test } from "vitest";
+
+describe("data utilities", () => {
+  test("isPlainObject accepts object literals", () => {
+    expect(isPlainObject({})).toBe(true);
+  });
+
+  test("isPlainObject rejects arrays and object instances", () => {
+    expect(isPlainObject([])).toBe(false);
+    expect(isPlainObject(Object.create(null))).toBe(false);
+    expect(isPlainObject(new Date())).toBe(false);
+    expect(isPlainObject(Redacted.make("secret"))).toBe(false);
+  });
+
+  test("stripNullFields removes nulls recursively from arrays and records", () => {
+    expect(
+      stripNullFields({
+        a: null,
+        b: undefined,
+        c: [{ d: null, e: 1 }],
+      }),
+    ).toEqual({
+      b: undefined,
+      c: [{ e: 1 }],
+    });
+  });
+
+  test("stripUndefinedFields removes undefined recursively from arrays and records", () => {
+    expect(
+      stripUndefinedFields({
+        a: null,
+        b: undefined,
+        c: [{ d: undefined, e: 1 }],
+      }),
+    ).toEqual({
+      a: null,
+      c: [{ e: 1 }],
+    });
+  });
+
+  test("unwrapRedacted unwraps only arrays and plain records recursively", () => {
+    const date = new Date("2026-05-20T00:00:00.000Z");
+
+    expect(
+      unwrapRedacted({
+        value: Redacted.make("secret"),
+        nested: [Redacted.make("nested")],
+        date,
+      }),
+    ).toEqual({
+      value: "secret",
+      nested: ["nested"],
+      date,
+    });
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/action.test.ts b/.repos/alchemy-effect/packages/alchemy/test/action.test.ts
new file mode 100644
index 00000000000..2d930418471
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/action.test.ts
@@ -0,0 +1,459 @@
+import { Action } from "@/Action";
+import * as Plan from "@/Plan";
+import * as Stack from "@/Stack";
+import { Stage } from "@/Stage";
+import {
+  InMemoryService,
+  inMemoryState,
+  State,
+  type ActionState,
+  type RanActionState,
+} from "@/State";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Ref from "effect/Ref";
+import { Bucket, TestLayers } from "./test.resources";
+
+const TEST_STACK = "task-test";
+const TEST_STAGE = "test";
+
+// Fresh in-memory state per test so persisted task rows don't leak between
+// runs in the same file.
+const freshState = () =>
+  Layer.effect(
+    State,
+    Effect.sync(() => InMemoryService({})),
+  );
+
+const { test } = Test.make({
+  providers: TestLayers(),
+  state: freshState(),
+});
+
+const resolveStackId = Effect.gen(function* () {
+  const ambient = yield* Effect.serviceOption(Stack.Stack);
+  return Option.match(ambient, {
+    onNone: () => ({ name: TEST_STACK, stage: TEST_STAGE }),
+    onSome: (s) => ({ name: s.name, stage: s.stage }),
+  });
+});
+
+const seed = (rows: Record<string, ActionState>) =>
+  Effect.gen(function* () {
+    const { name, stage } = yield* resolveStackId;
+    const state = yield* yield* State;
+    for (const [fqn, value] of Object.entries(rows)) {
+      yield* state.set({ stack: name, stage, fqn, value });
+    }
+  });
+
+const makePlan = <A, Err = never, Req = never>(
+  effect: Effect.Effect<A, Err, Req>,
+  options?: Plan.MakePlanOptions,
+): Effect.Effect<Plan.Plan<A>, Err, State> =>
+  // @ts-expect-error - Stack.make's typing erases R unsoundly here
+  Effect.gen(function* () {
+    const { name, stage } = yield* resolveStackId;
+    // @ts-expect-error
+    return yield* effect.pipe(
+      // @ts-expect-error
+      Stack.make({
+        name,
+        providers: Layer.empty,
+        state: inMemoryState(),
+      }),
+      Effect.provideService(Stage, stage),
+      Effect.flatMap((stackSpec: any) => Plan.make(stackSpec, options)),
+      Effect.provide(TestLayers()),
+    );
+  });
+
+// ── Plan tests ────────────────────────────────────────────────────────────
+
+describe("Plan", () => {
+  test(
+    "first-time task -> run",
+    Effect.gen(function* () {
+      const Sync = Action("Sync", (input: { table: string }) =>
+        Effect.succeed({ rows: 1, table: input.table }),
+      );
+
+      const plan = yield* Effect.gen(function* () {
+        return yield* Sync({ table: "users" });
+      }).pipe(makePlan);
+
+      expect(plan.actions.Sync).toMatchObject({
+        kind: "action",
+        action: "run",
+        state: undefined,
+        forced: false,
+      });
+      expect(plan.actions.Sync.def.LogicalId).toBe("Sync");
+    }),
+  );
+
+  test(
+    "same input hash -> noop (skip)",
+    Effect.gen(function* () {
+      const Sync = Action("Sync", (_: { table: string }) =>
+        Effect.succeed({ rows: 1 }),
+      );
+
+      // Pre-seed a `ran` row with a hash that matches { table: "users" }.
+      const { hashInput } = yield* Effect.promise(() => import("@/Util/hash"));
+      const inputHash = yield* hashInput({ table: "users" });
+      yield* seed({
+        Sync: {
+          kind: "action",
+          status: "ran",
+          fqn: "Sync",
+          logicalId: "Sync",
+          namespace: undefined,
+          actionType: "Sync",
+          inputHash,
+          input: { table: "users" },
+          output: { rows: 1 },
+          downstream: [],
+        } satisfies RanActionState,
+      });
+
+      const plan = yield* Effect.gen(function* () {
+        return yield* Sync({ table: "users" });
+      }).pipe(makePlan);
+
+      expect(plan.actions.Sync.action).toBe("noop");
+    }),
+  );
+
+  test(
+    "changed input hash -> run",
+    Effect.gen(function* () {
+      const Sync = Action("Sync", (_: { table: string }) =>
+        Effect.succeed({ rows: 1 }),
+      );
+
+      const { hashInput } = yield* Effect.promise(() => import("@/Util/hash"));
+      const oldHash = yield* hashInput({ table: "users" });
+      yield* seed({
+        Sync: {
+          kind: "action",
+          status: "ran",
+          fqn: "Sync",
+          logicalId: "Sync",
+          namespace: undefined,
+          actionType: "Sync",
+          inputHash: oldHash,
+          input: { table: "users" },
+          output: { rows: 1 },
+          downstream: [],
+        } satisfies RanActionState,
+      });
+
+      const plan = yield* Effect.gen(function* () {
+        return yield* Sync({ table: "orders" });
+      }).pipe(makePlan);
+
+      expect(plan.actions.Sync.action).toBe("run");
+    }),
+  );
+
+  test(
+    "force flips noop -> run",
+    Effect.gen(function* () {
+      const Sync = Action("Sync", (_: { table: string }) =>
+        Effect.succeed({ rows: 1 }),
+      );
+
+      const { hashInput } = yield* Effect.promise(() => import("@/Util/hash"));
+      const inputHash = yield* hashInput({ table: "users" });
+      yield* seed({
+        Sync: {
+          kind: "action",
+          status: "ran",
+          fqn: "Sync",
+          logicalId: "Sync",
+          namespace: undefined,
+          actionType: "Sync",
+          inputHash,
+          input: { table: "users" },
+          output: { rows: 1 },
+          downstream: [],
+        } satisfies RanActionState,
+      });
+
+      const plan = yield* Effect.gen(function* () {
+        return yield* Sync({ table: "users" });
+      }).pipe((eff) => makePlan(eff, { force: true }));
+
+      expect(plan.actions.Sync.action).toBe("run");
+      expect((plan.actions.Sync as Plan.ActionRun).forced).toBe(true);
+    }),
+  );
+
+  test(
+    "task removed from stack -> taskDeletions",
+    Effect.gen(function* () {
+      const { hashInput } = yield* Effect.promise(() => import("@/Util/hash"));
+      const inputHash = yield* hashInput({ table: "users" });
+      yield* seed({
+        Sync: {
+          kind: "action",
+          status: "ran",
+          fqn: "Sync",
+          logicalId: "Sync",
+          namespace: undefined,
+          actionType: "Sync",
+          inputHash,
+          input: { table: "users" },
+          output: { rows: 1 },
+          downstream: [],
+        } satisfies RanActionState,
+      });
+
+      // The new stack has no tasks at all.
+      const plan = yield* Effect.gen(function* () {
+        return undefined;
+      }).pipe(makePlan);
+
+      expect(plan.actionDeletions.Sync).toMatchObject({
+        kind: "action",
+        action: "delete",
+      });
+      expect(plan.actions.Sync).toBeUndefined();
+    }),
+  );
+
+  test(
+    "resource depends on task: task is upstream of resource",
+    Effect.gen(function* () {
+      const Compute = Action("Compute", (_: {}) =>
+        Effect.succeed({ value: "computed" }),
+      );
+
+      const plan = yield* Effect.gen(function* () {
+        const computed = yield* Compute({});
+        const bucket = yield* Bucket("MyBucket", { name: computed.value });
+        return bucket;
+      }).pipe(makePlan);
+
+      // Action is run (first time), bucket is created and lists Compute as upstream.
+      expect(plan.actions.Compute.action).toBe("run");
+      expect(plan.actions.Compute.downstream).toContain("MyBucket");
+    }),
+  );
+
+  test(
+    "task depends on resource: resource is upstream of task",
+    Effect.gen(function* () {
+      const Sync = Action("Sync", (_: { name: string }) =>
+        Effect.succeed({ ok: true }),
+      );
+
+      const plan = yield* Effect.gen(function* () {
+        const bucket = yield* Bucket("MyBucket", { name: "b" });
+        return yield* Sync({ name: bucket.name });
+      }).pipe(makePlan);
+
+      expect(plan.resources.MyBucket.action).toBe("create");
+      expect(plan.actions.Sync.action).toBe("run");
+      // MyBucket's downstream includes the task FQN.
+      expect(plan.resources.MyBucket.downstream).toContain("Sync");
+    }),
+  );
+
+  test(
+    "explicit logical id allows multiple instances",
+    Effect.gen(function* () {
+      const Sync = Action("Sync", (_: { which: string }) =>
+        Effect.succeed({ ok: true }),
+      );
+
+      const plan = yield* Effect.gen(function* () {
+        yield* Sync("nightly", { which: "n" });
+        yield* Sync("hourly", { which: "h" });
+      }).pipe(makePlan);
+
+      expect(plan.actions.nightly.action).toBe("run");
+      expect(plan.actions.hourly.action).toBe("run");
+      expect(plan.actions.Sync).toBeUndefined();
+    }),
+  );
+});
+
+// ── Apply tests ───────────────────────────────────────────────────────────
+
+describe("Apply", () => {
+  test.provider("first run invokes body and persists ran state", (stack) =>
+    Effect.gen(function* () {
+      const counter = yield* Ref.make(0);
+      const Sync = Action("Sync", (input: { n: number }) =>
+        Effect.gen(function* () {
+          yield* Ref.update(counter, (c) => c + 1);
+          return { doubled: input.n * 2 };
+        }),
+      );
+
+      const out = yield* stack.deploy(
+        Effect.gen(function* () {
+          return yield* Sync({ n: 21 });
+        }),
+      );
+
+      expect(out).toEqual({ doubled: 42 });
+      expect(yield* Ref.get(counter)).toBe(1);
+
+      // Persisted state is `ran` with the materialized output.
+      const state = yield* yield* State;
+      const persisted = yield* state.get({
+        stack: stack.name,
+        stage: "test",
+        fqn: "Sync",
+      });
+      expect(persisted).toMatchObject({
+        kind: "action",
+        status: "ran",
+        output: { doubled: 42 },
+      });
+    }),
+  );
+
+  test.provider("same input across deploys -> body not re-invoked", (stack) =>
+    Effect.gen(function* () {
+      const counter = yield* Ref.make(0);
+      const program = Effect.gen(function* () {
+        const Sync = Action("Sync", (input: { n: number }) =>
+          Effect.gen(function* () {
+            yield* Ref.update(counter, (c) => c + 1);
+            return { doubled: input.n * 2 };
+          }),
+        );
+        return yield* Sync({ n: 21 });
+      });
+
+      const first = yield* stack.deploy(program);
+      const second = yield* stack.deploy(program);
+
+      expect(first).toEqual({ doubled: 42 });
+      expect(second).toEqual({ doubled: 42 });
+      expect(yield* Ref.get(counter)).toBe(1);
+    }),
+  );
+
+  test.provider("changed input -> body re-invoked", (stack) =>
+    Effect.gen(function* () {
+      const counter = yield* Ref.make(0);
+      const programFor = (n: number) =>
+        Effect.gen(function* () {
+          const Sync = Action("Sync", (input: { n: number }) =>
+            Effect.gen(function* () {
+              yield* Ref.update(counter, (c) => c + 1);
+              return { doubled: input.n * 2 };
+            }),
+          );
+          return yield* Sync({ n });
+        });
+
+      yield* stack.deploy(programFor(21));
+      const second = yield* stack.deploy(programFor(50));
+
+      expect(second).toEqual({ doubled: 100 });
+      expect(yield* Ref.get(counter)).toBe(2);
+    }),
+  );
+
+  test.provider("task output flows to downstream resource input", (stack) =>
+    Effect.gen(function* () {
+      const Name = Action("Name", (_: {}) =>
+        Effect.succeed({ name: "computed-bucket-name" }),
+      );
+
+      const out = yield* stack.deploy(
+        Effect.gen(function* () {
+          const computed = yield* Name({});
+          return yield* Bucket("MyBucket", { name: computed.name });
+        }),
+      );
+
+      expect(out.name).toBe("computed-bucket-name");
+    }),
+  );
+
+  test.provider("resource attr flows to task input", (stack) =>
+    Effect.gen(function* () {
+      const Echo = Action("Echo", (input: { name: string }) =>
+        Effect.succeed({ echoed: input.name }),
+      );
+
+      const out = yield* stack.deploy(
+        Effect.gen(function* () {
+          const bucket = yield* Bucket("MyBucket", { name: "from-resource" });
+          return yield* Echo({ name: bucket.name });
+        }),
+      );
+
+      expect(out).toEqual({ echoed: "from-resource" });
+    }),
+  );
+
+  test.provider(
+    "removing task from stack drops state without invoking body",
+    (stack) =>
+      Effect.gen(function* () {
+        const deleteSpy = yield* Ref.make(0);
+        const Sync = Action("Sync", (_: { n: number }) =>
+          Effect.succeed({ ok: true }),
+        );
+
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Sync({ n: 1 });
+          }),
+        );
+
+        const state = yield* yield* State;
+        expect(
+          yield* state.get({ stack: stack.name, stage: "test", fqn: "Sync" }),
+        ).toMatchObject({ kind: "action", status: "ran" });
+
+        // Re-deploy WITHOUT the task — state should be dropped.
+        // (Use a tracker hook to confirm body wasn't called.)
+        yield* stack.deploy(Effect.succeed(undefined));
+        void deleteSpy;
+
+        expect(
+          yield* state.get({ stack: stack.name, stage: "test", fqn: "Sync" }),
+        ).toBeUndefined();
+      }),
+  );
+
+  test.provider("init-effect form: deps satisfied at apply", (stack) =>
+    Effect.gen(function* () {
+      class Multiplier extends Context.Service<Multiplier, number>()(
+        "test/Multiplier",
+      ) {}
+
+      const Sync = Action(
+        "Sync",
+        Effect.gen(function* () {
+          const m = yield* Multiplier;
+          return (input: { n: number }) =>
+            Effect.succeed({ result: input.n * m });
+        }),
+      );
+
+      const out = yield* stack
+        .deploy(
+          Effect.gen(function* () {
+            return yield* Sync({ n: 21 });
+          }),
+        )
+        .pipe(Effect.provideService(Multiplier, 3));
+
+      expect(out).toEqual({ result: 63 });
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/apply.test.ts b/.repos/alchemy-effect/packages/alchemy/test/apply.test.ts
new file mode 100644
index 00000000000..7a07a38dc0a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/apply.test.ts
@@ -0,0 +1,4430 @@
+import { Cli } from "@/Cli/Cli";
+import * as Construct from "@/Construct";
+import * as Output from "@/Output";
+import { Stack } from "@/Stack";
+import {
+  type ReplacedResourceState,
+  type ReplacingResourceState,
+  type ResourceState,
+  State,
+} from "@/State";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import { Data, Layer } from "effect";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import {
+  ArtifactProbe,
+  BindingTarget,
+  DeletedBindingRegressionTarget,
+  DurationResource,
+  Function,
+  PhasedTarget,
+  StaticStablesResource,
+  TestLayers,
+  TestResource,
+  TestResourceHooks,
+  type TestResourceProps,
+} from "./test.resources.ts";
+
+const { test } = Test.make({ providers: TestLayers() });
+
+const getState = Effect.fn(function* <S = ResourceState>(resourceId: string) {
+  const state = yield* yield* State;
+  const stk = yield* Stack;
+  return (yield* state.get({
+    stack: stk.name,
+    stage: stk.stage,
+    fqn: resourceId,
+  })) as S;
+});
+const listState = Effect.fn(function* () {
+  const state = yield* yield* State;
+  const stk = yield* Stack;
+  return yield* state.list({ stack: stk.name, stage: stk.stage });
+});
+
+const expectConvergedStatus = (status: ResourceState["status"] | undefined) => {
+  expect(["created", "updated"]).toContain(status);
+};
+
+// Graceful failure handling means downstream resources of a failed upstream
+// may have committed an intermediate "creating"/"replacing" status before
+// their `waitForDeps` discovered the upstream failure - or may have fully
+// converged using a stable previous output of the failed upstream (e.g. a
+// replacement whose old generation is still live). This helper tolerates any
+// of those outcomes; the corresponding recovery deploy validates terminal
+// state.
+const expectNotStarted = (state: ResourceState | undefined) => {
+  expect([undefined, "creating", "replacing", "created", "updated"]).toContain(
+    state?.status,
+  );
+};
+
+export class ResourceFailure extends Data.TaggedError("ResourceFailure")<{
+  message: string;
+}> {
+  constructor() {
+    super({ message: `Failed to create` });
+  }
+}
+
+const hook =
+  (hooks?: {
+    create?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+    update?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+    delete?: (id: string) => Effect.Effect<void, any>;
+    read?: (id: string) => Effect.Effect<any, any>;
+  }) =>
+  <A, Err, Req>(test: Effect.Effect<A, Err, Req>) =>
+    test.pipe(
+      Effect.provide(
+        Layer.succeed(
+          TestResourceHooks,
+          hooks ?? {
+            create: () => Effect.fail(new ResourceFailure()),
+            update: () => Effect.fail(new ResourceFailure()),
+            delete: () => Effect.fail(new ResourceFailure()),
+            read: () => Effect.succeed(undefined),
+          },
+        ),
+      ),
+      // @ts-expect-error - catchTag changes the return type
+      Effect.catchTag("ResourceFailure", () => Effect.succeed(true)),
+    ) as Effect.Effect<A, Err, Req | State>;
+
+// Helper to fail on specific resource IDs
+const failOn = (
+  resourceId: string,
+  hook: "create" | "update" | "delete",
+): {
+  create?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+  update?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+  delete?: (id: string) => Effect.Effect<void, any>;
+} => ({
+  [hook]: (id: string) =>
+    id === resourceId
+      ? Effect.fail(new ResourceFailure())
+      : Effect.succeed(undefined),
+});
+
+// Helper to fail on multiple resource IDs for different hooks
+const failOnMultiple = (
+  failures: Array<{ id: string; hook: "create" | "update" | "delete" }>,
+): {
+  create?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+  update?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+  delete?: (id: string) => Effect.Effect<void, any>;
+} => {
+  const createFailures = failures
+    .filter((f) => f.hook === "create")
+    .map((f) => f.id);
+  const updateFailures = failures
+    .filter((f) => f.hook === "update")
+    .map((f) => f.id);
+  const deleteFailures = failures
+    .filter((f) => f.hook === "delete")
+    .map((f) => f.id);
+
+  return {
+    create: (id: string) =>
+      createFailures.includes(id)
+        ? Effect.fail(new ResourceFailure())
+        : Effect.succeed(undefined),
+    update: (id: string) =>
+      updateFailures.includes(id)
+        ? Effect.fail(new ResourceFailure())
+        : Effect.succeed(undefined),
+    delete: (id: string) =>
+      deleteFailures.includes(id)
+        ? Effect.fail(new ResourceFailure())
+        : Effect.succeed(undefined),
+  };
+};
+
+describe("basic operations", () => {
+  test.provider("should create, update, and delete resources", (stack) =>
+    Effect.gen(function* () {
+      expect(
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string",
+          });
+          return A.string;
+        }).pipe(stack.deploy),
+      ).toEqual("test-string");
+
+      expect(
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string-new",
+          });
+          return A.string;
+        }).pipe(stack.deploy),
+      ).toEqual("test-string-new");
+
+      yield* stack.destroy();
+
+      expect(yield* getState("A")).toBeUndefined();
+      expect(yield* listState()).toEqual([]);
+    }),
+  );
+
+  test.provider("should resolve output properties", (stack) =>
+    Effect.gen(function* () {
+      expect(
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string",
+            stringArray: ["test-string-array"],
+          });
+          const B = yield* TestResource("B", {
+            string: A.string,
+          });
+          return B.string;
+        }).pipe(stack.deploy),
+      ).toEqual("test-string");
+
+      expect(
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string",
+            stringArray: ["test-string-array"],
+          });
+          const B = yield* TestResource("B", {
+            string: A.string.pipe(Output.map((string) => string.toUpperCase())),
+          });
+          return B.string;
+        }).pipe(stack.deploy),
+      ).toEqual("TEST-STRING");
+
+      expect(
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string",
+            stringArray: ["test-string-array"],
+          });
+          const B = yield* TestResource("B", {
+            string: A.string.pipe(
+              Output.map((string) => string.toUpperCase() + "-NEW"),
+            ),
+          });
+          return B.string;
+        }).pipe(stack.deploy),
+      ).toEqual("TEST-STRING-NEW");
+
+      expect(
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string",
+            stringArray: ["test-string-array"],
+          });
+          const B = yield* TestResource("B", {
+            string: A.string.pipe(
+              Output.flatMap((string) =>
+                Output.literal(string.toUpperCase() + "-FLAT"),
+              ),
+            ),
+          });
+          return B.string;
+        }).pipe(stack.deploy),
+      ).toEqual("TEST-STRING-FLAT");
+    }),
+  );
+
+  test.provider(
+    "should resolve bindings inside constructs using namespaced resources",
+    (stack) =>
+      Effect.gen(function* () {
+        const Site = Construct.fn(function* (_id: string, _props: {}) {
+          const bucket = yield* BindingTarget("Bucket", {
+            string: "bucket-value",
+          });
+          const distribution = yield* BindingTarget("Distribution", {
+            string: "distribution-value",
+          });
+
+          yield* bucket.bind("Policy", {
+            env: {
+              BUCKET: bucket.string,
+              DISTRIBUTION: distribution.string,
+            },
+          });
+
+          return {
+            bucket,
+            distribution,
+          };
+        });
+
+        const output = yield* Site("MarketingSite", {}).pipe(stack.deploy);
+
+        expect(output.bucket.env).toEqual({
+          BUCKET: "bucket-value",
+          DISTRIBUTION: "distribution-value",
+        });
+        expectConvergedStatus(
+          (yield* getState("MarketingSite/Bucket"))?.status,
+        );
+        expect((yield* getState("MarketingSite/Distribution"))?.status).toEqual(
+          "created",
+        );
+      }),
+  );
+
+  test.provider(
+    "should exclude deleted bindings before provider updates",
+    (stack) =>
+      Effect.gen(function* () {
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            const target = yield* DeletedBindingRegressionTarget("A", {
+              name: "target",
+            });
+            yield* target.bind("TestBinding", {
+              env: {
+                FEATURE_FLAG: "on",
+              },
+            });
+            return target;
+          }),
+        );
+
+        expect(created.env).toEqual({
+          FEATURE_FLAG: "on",
+        });
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* DeletedBindingRegressionTarget("A", {
+              name: "target",
+            });
+          }),
+        );
+
+        expect(updated.env).toEqual({});
+        expect(yield* getState("A")).toMatchObject({
+          bindings: [],
+          attr: {
+            env: {},
+          },
+        });
+      }),
+  );
+
+  test.provider(
+    "should update a surviving consumer before deleting a removed dependency",
+    (stack) =>
+      Effect.gen(function* () {
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            const secret = yield* TestResource("Secret", {
+              string: "secret-value",
+            });
+            const worker = yield* Function("Worker", {
+              name: "worker",
+              env: {
+                SECRET: secret.string,
+              },
+            });
+            return { secret, worker };
+          }),
+        );
+
+        expect(created.worker.env).toEqual({
+          SECRET: "secret-value",
+        });
+        expect((yield* getState("Secret"))?.status).toEqual("created");
+        expect((yield* getState("Worker"))?.status).toEqual("created");
+
+        const updated = yield* stack.deploy(
+          Effect.gen(function* () {
+            return yield* Function("Worker", {
+              name: "worker",
+            });
+          }),
+        );
+
+        expect(updated.env).toEqual({});
+        expect(yield* getState("Secret")).toBeUndefined();
+        expect((yield* getState("Worker"))?.status).toEqual("updated");
+      }),
+  );
+
+  test.provider(
+    "should create a resource with a binding that references its own output",
+    (stack) =>
+      Effect.gen(function* () {
+        const created = yield* stack.deploy(
+          Effect.gen(function* () {
+            const target = yield* DeletedBindingRegressionTarget("A", {
+              name: "target",
+            });
+            yield* target.bind("SelfBinding", {
+              env: {
+                SELF_NAME: target.name,
+              },
+            });
+            return target;
+          }),
+        );
+
+        expect(created.env).toEqual({
+          SELF_NAME: "target",
+        });
+      }),
+    { timeout: 10_000 },
+  );
+});
+
+describe("linear update propagation", () => {
+  // Regression: in a linear chain (A -> B with no cycle), an update to A
+  // followed by an update to B must let B see A's *post-update* attr, never
+  // the stale prior attr. Before the cycle-gating change, A would publish
+  // its prior attr early and B's update would race against the live value,
+  // sometimes deploying with stale data (e.g. a Worker reading a Build's
+  // outdir/hash before the build finished).
+  test.provider(
+    "downstream update receives upstream's post-update attr",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* stack.deploy(
+          Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "v1" });
+            const B = yield* TestResource("B", { string: A.string });
+            return { A, B };
+          }),
+        );
+
+        const sawByB: string[] = [];
+        const captureBHooks = {
+          create: () => Effect.succeed(undefined),
+          update: (id: string, props: TestResourceProps) =>
+            Effect.sync(() => {
+              if (id === "B" && typeof props.string === "string") {
+                sawByB.push(props.string);
+              }
+            }),
+          delete: () => Effect.succeed(undefined),
+          read: () => Effect.succeed(undefined),
+        };
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "v2" });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        }).pipe(stack.deploy, hook(captureBHooks));
+
+        expect(output.A.string).toEqual("v2");
+        expect(output.B.string).toEqual("v2");
+        // B.update must have observed the fresh upstream value, never the
+        // stale "v1". A single fresh-only call is the ideal; we accept any
+        // sequence as long as no stale value leaked through.
+        expect(sawByB.length).toBeGreaterThan(0);
+        expect(sawByB.every((v) => v === "v2")).toBe(true);
+      }),
+  );
+});
+
+describe("circularity via bindings", () => {
+  const selfBoundStack = (props: {
+    string: string;
+    replaceString?: string;
+    includeD?: boolean;
+  }) =>
+    Effect.gen(function* () {
+      const A = yield* BindingTarget("A", {
+        name: "a",
+        string: props.string,
+        replaceString: props.replaceString,
+      });
+      yield* A.bind("SelfBinding", {
+        env: {
+          SELF: A.string,
+        },
+      });
+      const B = yield* TestResource("B", { string: A.string });
+      if (props.includeD) {
+        const D = yield* TestResource("D", { string: B.string });
+        return { A, B, D };
+      }
+      return { A, B };
+    });
+
+  const mutualBindingStack = (props: {
+    aString: string;
+    aReplaceString?: string;
+    bString?: string;
+    includeD?: boolean;
+  }) =>
+    Effect.gen(function* () {
+      const A = yield* BindingTarget("A", {
+        name: "a",
+        string: props.aString,
+        replaceString: props.aReplaceString,
+      });
+      const B = yield* BindingTarget("B", {
+        name: "b",
+        string: props.bString ?? "b-value",
+      });
+      yield* A.bind("FromB", {
+        env: {
+          PEER: B.string,
+        },
+      });
+      yield* B.bind("FromA", {
+        env: {
+          PEER: A.string,
+        },
+      });
+      if (props.includeD) {
+        const D = yield* TestResource("D", {
+          string: Output.interpolate`${A.string}-${B.string}`,
+        });
+        return { A, B, D };
+      }
+      return { A, B };
+    });
+
+  const propAndBindingCycleStack = () =>
+    Effect.gen(function* () {
+      const A = yield* BindingTarget("A", {
+        name: "a",
+        string: "a-value",
+      });
+      const B = yield* TestResource("B", {
+        string: A.string,
+      });
+      yield* A.bind("FromB", {
+        env: {
+          PEER: B.string,
+        },
+      });
+      return { A, B };
+    });
+
+  test.provider(
+    "create succeeds when props use precreate output and bindings use downstream output",
+    (stack) =>
+      Effect.gen(function* () {
+        const output = yield* stack.deploy(propAndBindingCycleStack());
+
+        expect(output.A.env).toEqual({ PEER: "a-value" });
+        expect(output.B.string).toEqual("a-value");
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expectConvergedStatus((yield* getState("B"))?.status);
+      }),
+    { timeout: 10_000 },
+  );
+
+  describe("self-referential bindings", () => {
+    test.provider("create succeeds with self binding", (stack) =>
+      Effect.gen(function* () {
+        const output = yield* stack.deploy(
+          selfBoundStack({
+            string: "a-value",
+            replaceString: "original",
+          }),
+        );
+
+        expect(output.A.env).toEqual({ SELF: "a-value" });
+        expect(output.B.string).toEqual("a-value");
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expectConvergedStatus((yield* getState("B"))?.status);
+      }),
+    );
+
+    test.provider(
+      "replacing state noop replay recovers and creates downstream resources",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* selfBoundStack({
+            string: "a-value",
+            replaceString: "original",
+          }).pipe(stack.deploy);
+
+          const program = selfBoundStack({
+            string: "a-value-replaced",
+            replaceString: "changed",
+            includeD: true,
+          });
+
+          yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+          expect(
+            (yield* getState<ReplacingResourceState>("A"))?.status,
+          ).toEqual("replacing");
+          expectConvergedStatus((yield* getState("B"))?.status);
+          expectNotStarted(yield* getState("D"));
+
+          const output = yield* program.pipe(stack.deploy);
+          expectConvergedStatus((yield* getState("A"))?.status);
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expectConvergedStatus((yield* getState("D"))?.status);
+          expect(output.A.env).toEqual({ SELF: "a-value-replaced" });
+          expect(output.D!.string).toEqual("a-value-replaced");
+        }),
+    );
+
+    test.provider(
+      "replacing state update replay updates replacement and creates downstream resources",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* selfBoundStack({
+            string: "a-value",
+            replaceString: "original",
+          }).pipe(stack.deploy);
+
+          yield* selfBoundStack({
+            string: "a-value-replaced",
+            replaceString: "changed",
+            includeD: true,
+          }).pipe(stack.deploy, hook(failOn("A", "create")));
+
+          expect(
+            (yield* getState<ReplacingResourceState>("A"))?.status,
+          ).toEqual("replacing");
+          expectConvergedStatus((yield* getState("B"))?.status);
+          expectNotStarted(yield* getState("D"));
+
+          const output = yield* selfBoundStack({
+            string: "a-value-updated-during-recovery",
+            replaceString: "changed",
+            includeD: true,
+          }).pipe(stack.deploy);
+
+          expectConvergedStatus((yield* getState("A"))?.status);
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expectConvergedStatus((yield* getState("D"))?.status);
+          expect(output.A.env).toEqual({
+            SELF: "a-value-updated-during-recovery",
+          });
+          expect(output.D!.string).toEqual("a-value-updated-during-recovery");
+        }),
+    );
+
+    test.provider(
+      "replaced state noop replay finishes cleanup and creates downstream resources",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* selfBoundStack({
+            string: "a-value",
+            replaceString: "original",
+          }).pipe(stack.deploy);
+
+          const program = selfBoundStack({
+            string: "a-value-replaced",
+            replaceString: "changed",
+            includeD: true,
+          });
+
+          yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+          expect((yield* getState<ReplacedResourceState>("A"))?.status).toEqual(
+            "replaced",
+          );
+          expect((yield* getState("B"))?.status).toEqual("updating");
+          expectNotStarted(yield* getState("D"));
+
+          const output = yield* program.pipe(stack.deploy);
+          expectConvergedStatus((yield* getState("A"))?.status);
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expectConvergedStatus((yield* getState("D"))?.status);
+          expect(output.A.env).toEqual({ SELF: "a-value-replaced" });
+          expect(output.D!.string).toEqual("a-value-replaced");
+        }),
+    );
+
+    test.provider(
+      "replaced state update replay updates replacement and downstream resources",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* selfBoundStack({
+            string: "a-value",
+            replaceString: "original",
+          }).pipe(stack.deploy);
+
+          yield* selfBoundStack({
+            string: "a-value-replaced",
+            replaceString: "changed",
+            includeD: true,
+          }).pipe(stack.deploy, hook(failOn("B", "update")));
+
+          expect((yield* getState<ReplacedResourceState>("A"))?.status).toEqual(
+            "replaced",
+          );
+          expect((yield* getState("B"))?.status).toEqual("updating");
+          expectNotStarted(yield* getState("D"));
+
+          const output = yield* selfBoundStack({
+            string: "a-value-updated-after-replace",
+            replaceString: "changed",
+            includeD: true,
+          }).pipe(stack.deploy);
+
+          expectConvergedStatus((yield* getState("A"))?.status);
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expectConvergedStatus((yield* getState("D"))?.status);
+          expect(output.A.env).toEqual({
+            SELF: "a-value-updated-after-replace",
+          });
+          expect(output.D!.string).toEqual("a-value-updated-after-replace");
+        }),
+    );
+  });
+
+  describe("mutual A <-> B bindings", () => {
+    test.provider("create succeeds with mutual bindings", (stack) =>
+      Effect.gen(function* () {
+        const output = yield* stack.deploy(
+          mutualBindingStack({
+            aString: "a-value",
+          }),
+        );
+
+        expect(output.A.env).toEqual({ PEER: "b-value" });
+        expect(output.B.env).toEqual({ PEER: "a-value" });
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expectConvergedStatus((yield* getState("B"))?.status);
+      }),
+    );
+
+    test.provider("destroy succeeds with mutual bindings", (stack) =>
+      Effect.gen(function* () {
+        yield* mutualBindingStack({
+          aString: "a-value",
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy();
+
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+      }),
+    );
+
+    describe("from replacing state", () => {
+      test.provider(
+        "replacing noop recovery creates downstream resources",
+        (stack) =>
+          Effect.gen(function* () {
+            yield* mutualBindingStack({
+              aString: "a-value",
+              aReplaceString: "original",
+            }).pipe(stack.deploy);
+
+            const program = mutualBindingStack({
+              aString: "a-value-replaced",
+              aReplaceString: "changed",
+              includeD: true,
+            });
+
+            yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+            expect(
+              (yield* getState<ReplacingResourceState>("A"))?.status,
+            ).toEqual("replacing");
+            expectConvergedStatus((yield* getState("B"))?.status);
+            expectNotStarted(yield* getState("D"));
+
+            const output = yield* program.pipe(stack.deploy);
+            expectConvergedStatus((yield* getState("A"))?.status);
+            expect((yield* getState("B"))?.status).toEqual("updated");
+            expectConvergedStatus((yield* getState("D"))?.status);
+            expect(output.A.env).toEqual({ PEER: "b-value" });
+            expect(output.B.env).toEqual({ PEER: "a-value-replaced" });
+            expect(output.D!.string).toEqual("a-value-replaced-b-value");
+          }),
+      );
+
+      test.provider(
+        "replacing update recovery creates downstream resources",
+        (stack) =>
+          Effect.gen(function* () {
+            yield* mutualBindingStack({
+              aString: "a-value",
+              aReplaceString: "original",
+            }).pipe(stack.deploy);
+
+            yield* mutualBindingStack({
+              aString: "a-value-replaced",
+              aReplaceString: "changed",
+              includeD: true,
+            }).pipe(stack.deploy, hook(failOn("A", "create")));
+
+            expect(
+              (yield* getState<ReplacingResourceState>("A"))?.status,
+            ).toEqual("replacing");
+            expectConvergedStatus((yield* getState("B"))?.status);
+            expectNotStarted(yield* getState("D"));
+
+            const output = yield* mutualBindingStack({
+              aString: "a-value-updated-during-recovery",
+              aReplaceString: "changed",
+              includeD: true,
+            }).pipe(stack.deploy);
+
+            expectConvergedStatus((yield* getState("A"))?.status);
+            expect((yield* getState("B"))?.status).toEqual("updated");
+            expectConvergedStatus((yield* getState("D"))?.status);
+            expect(output.A.env).toEqual({ PEER: "b-value" });
+            expect(output.B.env).toEqual({
+              PEER: "a-value-updated-during-recovery",
+            });
+            expect(output.D!.string).toEqual(
+              "a-value-updated-during-recovery-b-value",
+            );
+          }),
+      );
+
+      test.provider(
+        "replacing replace recovery nests another replacement",
+        (stack) =>
+          Effect.gen(function* () {
+            yield* mutualBindingStack({
+              aString: "a-value",
+              aReplaceString: "original",
+            }).pipe(stack.deploy);
+
+            yield* mutualBindingStack({
+              aString: "a-value-replaced",
+              aReplaceString: "changed",
+              includeD: true,
+            }).pipe(stack.deploy, hook(failOn("A", "create")));
+
+            const output = yield* mutualBindingStack({
+              aString: "a-value-another-replacement",
+              aReplaceString: "another-change",
+              includeD: true,
+            }).pipe(stack.deploy);
+
+            expectConvergedStatus((yield* getState("A"))?.status);
+            expect((yield* getState("B"))?.status).toEqual("updated");
+            expectConvergedStatus((yield* getState("D"))?.status);
+            expect(output.B.env).toEqual({
+              PEER: "a-value-another-replacement",
+            });
+          }),
+      );
+    });
+
+    describe("from replaced state", () => {
+      test.provider(
+        "replaced noop recovery updates downstream then creates downstream resources",
+        (stack) =>
+          Effect.gen(function* () {
+            yield* mutualBindingStack({
+              aString: "a-value",
+              aReplaceString: "original",
+            }).pipe(stack.deploy);
+
+            const program = mutualBindingStack({
+              aString: "a-value-replaced",
+              aReplaceString: "changed",
+              includeD: true,
+            });
+
+            yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+            expect(
+              (yield* getState<ReplacedResourceState>("A"))?.status,
+            ).toEqual("replaced");
+            expect((yield* getState("B"))?.status).toEqual("updating");
+            expectNotStarted(yield* getState("D"));
+
+            const output = yield* program.pipe(stack.deploy);
+            expect((yield* getState("A"))?.status).toEqual("created");
+            expect((yield* getState("B"))?.status).toEqual("updated");
+            expectConvergedStatus((yield* getState("D"))?.status);
+            expect(output.A.env).toEqual({ PEER: "b-value" });
+            expect(output.B.env).toEqual({ PEER: "a-value-replaced" });
+            expect(output.D!.string).toEqual("a-value-replaced-b-value");
+          }),
+      );
+
+      test.provider(
+        "replaced with update recovery updates replacement and downstream resources",
+        (stack) =>
+          Effect.gen(function* () {
+            yield* mutualBindingStack({
+              aString: "a-value",
+              aReplaceString: "original",
+            }).pipe(stack.deploy);
+
+            yield* mutualBindingStack({
+              aString: "a-value-replaced",
+              aReplaceString: "changed",
+              includeD: true,
+            }).pipe(stack.deploy, hook(failOn("B", "update")));
+
+            expect(
+              (yield* getState<ReplacedResourceState>("A"))?.status,
+            ).toEqual("replaced");
+            expect((yield* getState("B"))?.status).toEqual("updating");
+            expectNotStarted(yield* getState("D"));
+
+            const output = yield* mutualBindingStack({
+              aString: "a-value-updated-after-replace",
+              aReplaceString: "changed",
+              includeD: true,
+            }).pipe(stack.deploy);
+
+            expect((yield* getState("A"))?.status).toEqual("created");
+            expect((yield* getState("B"))?.status).toEqual("updated");
+            expectConvergedStatus((yield* getState("D"))?.status);
+            expect(output.A.env).toEqual({ PEER: "b-value" });
+            expect(output.B.env).toEqual({
+              PEER: "a-value-updated-after-replace",
+            });
+            expect(output.D!.string).toEqual(
+              "a-value-updated-after-replace-b-value",
+            );
+          }),
+      );
+
+      test.provider(
+        "replaced replace recovery nests another replacement",
+        (stack) =>
+          Effect.gen(function* () {
+            yield* mutualBindingStack({
+              aString: "a-value",
+              aReplaceString: "original",
+            }).pipe(stack.deploy);
+
+            yield* mutualBindingStack({
+              aString: "a-value-replaced",
+              aReplaceString: "changed",
+              includeD: true,
+            }).pipe(stack.deploy, hook(failOn("B", "update")));
+
+            const output = yield* mutualBindingStack({
+              aString: "a-value-another-replacement",
+              aReplaceString: "another-change",
+              includeD: true,
+            }).pipe(stack.deploy);
+
+            expectConvergedStatus((yield* getState("A"))?.status);
+            expect((yield* getState("B"))?.status).toEqual("updated");
+            expectConvergedStatus((yield* getState("D"))?.status);
+            expect(output.B.env).toEqual({
+              PEER: "a-value-another-replacement",
+            });
+          }),
+      );
+    });
+  });
+});
+
+describe("prop-flow convergence", () => {
+  const phasedCycleStack = (props: {
+    desired: string;
+    replaceKey?: string;
+    use: "stableId" | "value";
+    includeC?: boolean;
+  }) =>
+    Effect.gen(function* () {
+      const A = yield* PhasedTarget("A", {
+        desired: props.desired,
+        replaceKey: props.replaceKey,
+      });
+      const selected = props.use === "stableId" ? A.stableId : A.value;
+      const B = yield* TestResource("B", {
+        string: selected,
+      });
+      yield* A.bind("FromB", {
+        env: {
+          B: B.string,
+        },
+      });
+
+      if (props.includeC) {
+        const C = yield* TestResource("C", {
+          string: B.string,
+        });
+        return { A, B, C };
+      }
+
+      return { A, B };
+    });
+
+  test.provider(
+    "fresh circular create may use a stable precreate identifier",
+    (stack) =>
+      Effect.gen(function* () {
+        const output = yield* phasedCycleStack({
+          desired: "final-a",
+          replaceKey: "v1",
+          use: "stableId",
+        }).pipe(stack.deploy);
+
+        expect(output.A.value).toEqual("final-a");
+        expect(output.B.string).toEqual("stable:v1");
+      }),
+  );
+
+  test.provider(
+    "fresh circular create should converge downstream props to final values",
+    (stack) =>
+      Effect.gen(function* () {
+        const output = yield* phasedCycleStack({
+          desired: "final-a",
+          replaceKey: "v1",
+          use: "value",
+        }).pipe(stack.deploy);
+
+        expect(output.A.value).toEqual("final-a");
+        expect(output.B.string).toEqual("final-a");
+      }),
+  );
+
+  test.provider(
+    "fresh replacement should converge newly created downstream props to replacement values",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* phasedCycleStack({
+          desired: "old-a",
+          replaceKey: "v1",
+          use: "value",
+        }).pipe(stack.deploy);
+
+        const output = yield* phasedCycleStack({
+          desired: "new-a",
+          replaceKey: "v2",
+          use: "value",
+        }).pipe(stack.deploy);
+
+        expect(output.A.value).toEqual("new-a");
+        expect(output.B.string).toEqual("new-a");
+      }),
+  );
+
+  test.provider(
+    "stale precreate values should not propagate transitively",
+    (stack) =>
+      Effect.gen(function* () {
+        const output = yield* phasedCycleStack({
+          desired: "final-a",
+          replaceKey: "v1",
+          use: "value",
+          includeC: true,
+        }).pipe(stack.deploy);
+
+        expect(output.A.value).toEqual("final-a");
+        expect(output.B.string).toEqual("final-a");
+        expect(output.C!.string).toEqual("final-a");
+      }),
+  );
+
+  test.provider(
+    "binding feedback converges across an A -> B -> A fixed point",
+    (stack) =>
+      Effect.gen(function* () {
+        const output = yield* Effect.gen(function* () {
+          const A = yield* PhasedTarget("A", {
+            desired: "final-a",
+            replaceKey: "v1",
+          });
+          const B = yield* TestResource("B", {
+            string: A.value,
+          });
+          yield* A.bind("FromB", {
+            env: {
+              B: B.string,
+            },
+          });
+          return { A, B };
+        }).pipe(stack.deploy);
+
+        expect(output.A.value).toEqual("final-a");
+        expect(output.B.string).toEqual("final-a");
+        expect(output.A.env).toEqual({
+          B: "final-a",
+        });
+      }),
+  );
+
+  test.provider(
+    "terminal created or updated status is delayed until fixed-point convergence finishes",
+    (stack) =>
+      Effect.gen(function* () {
+        const events: Array<{ id: string; status: string }> = [];
+        const cli = Cli.of({
+          approvePlan: () => Effect.succeed(true),
+          displayPlan: () => Effect.void,
+          startApplySession: () =>
+            Effect.succeed({
+              done: () => Effect.void,
+              emit: (event) =>
+                Effect.sync(() => {
+                  if (event.kind === "status-change") {
+                    events.push({
+                      id: event.id,
+                      status: event.status,
+                    });
+                  }
+                }),
+            }),
+        });
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* PhasedTarget("A", {
+            desired: "final-a",
+            replaceKey: "v1",
+          });
+          const B = yield* TestResource("B", {
+            string: A.value,
+          });
+          yield* A.bind("FromB", {
+            env: {
+              B: B.string,
+            },
+          });
+          return { A, B };
+        }).pipe(stack.deploy, Effect.provide(Layer.succeed(Cli, cli)));
+
+        expect(output.A.env).toEqual({
+          B: "final-a",
+        });
+
+        const statusesById = events.reduce(
+          (acc, event: { id: string; status: string }) => {
+            (acc[event.id] ??= []).push(event);
+            return acc;
+          },
+          {} as Record<string, Array<{ id: string; status: string }>>,
+        );
+        const terminal = (id: string) =>
+          (statusesById[id] ?? [])
+            .map((event: { id: string; status: string }) => event.status)
+            .filter(
+              (status: string) => status === "created" || status === "updated",
+            );
+
+        expect(terminal("A")).toEqual(["updated"]);
+        expect(terminal("B")).toEqual(["updated"]);
+      }),
+  );
+
+  // Regression: a resource with `precreate` (e.g. Cloudflare Worker) resolves
+  // its early `ready` signal before its real `reconcile` runs. A non-cyclic
+  // downstream must still wait for the upstream's TERMINAL output, so that an
+  // upstream `reconcile` failure interrupts the downstream instead of letting
+  // it proceed off the precreate stub. Before the fix the downstream raced
+  // ahead on the precreate identifier and fully created itself even though the
+  // upstream failed.
+  test.provider(
+    "precreate upstream reconcile failure interrupts non-cyclic downstream (stable id dep)",
+    (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* PhasedTarget("A", {
+            desired: "a-value",
+            replaceKey: "v1",
+          });
+          // B depends on A.stableId — a value already available from A's
+          // precreate stub — yet must still be gated on A's reconcile.
+          const B = yield* TestResource("B", {
+            string: A.stableId,
+          });
+          return { A, B };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        // A's reconcile failed after committing "creating".
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        // B must NOT have reached its own reconcile. It may have committed an
+        // intermediate "creating" while waiting on deps, but it must never be
+        // "created" — that would mean the upstream failure was ignored.
+        expect((yield* getState("B"))?.status).not.toEqual("created");
+
+        // Recovery deploy converges both.
+        const output = yield* program.pipe(stack.deploy);
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expectConvergedStatus((yield* getState("B"))?.status);
+        expect(output.B.string).toEqual("stable:v1");
+      }),
+  );
+
+  test.provider(
+    "precreate upstream reconcile failure interrupts non-cyclic downstream (value dep)",
+    (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* PhasedTarget("A", {
+            desired: "a-value",
+            replaceKey: "v1",
+          });
+          const B = yield* TestResource("B", {
+            string: A.value,
+          });
+          const C = yield* TestResource("C", {
+            string: B.string,
+          });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        expect((yield* getState("B"))?.status).not.toEqual("created");
+        // Transitive downstream never starts either.
+        expectNotStarted(yield* getState("C"));
+
+        const output = yield* program.pipe(stack.deploy);
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expectConvergedStatus((yield* getState("B"))?.status);
+        expectConvergedStatus((yield* getState("C"))?.status);
+        expect(output.C.string).toEqual("a-value");
+      }),
+  );
+});
+
+describe("from created state", () => {
+  test.provider("noop when props unchanged", (stack) =>
+    Effect.gen(function* () {
+      const program = Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "test-string",
+        });
+        return A.string;
+      });
+
+      let output = yield* stack.deploy(program);
+      expect(output).toEqual("test-string");
+
+      expect((yield* getState("A"))?.status).toEqual("created");
+      output = yield* stack.deploy(program);
+
+      // Re-apply with same props - should be noop
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("test-string");
+    }),
+  );
+
+  test.provider("replace when props trigger replacement", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            replaceString: "original",
+          });
+          return A.replaceString;
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      // Change props that trigger replacement
+
+      const output = yield* stack.deploy(
+        Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            replaceString: "new",
+          });
+          return A.replaceString;
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("new");
+    }),
+  );
+});
+
+describe("from updated state", () => {
+  test.provider("noop when props unchanged", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+          });
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      // Update to get to updated state
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string-changed",
+          });
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("updated");
+
+      // Re-apply with same props - should be noop
+      const output = yield* stack.deploy(
+        Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string-changed",
+          });
+          return A.string;
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("updated");
+      expect(output).toEqual("test-string-changed");
+    }),
+  );
+
+  test.provider("replace when props trigger replacement", (stack) =>
+    Effect.gen(function* () {
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+            replaceString: "original",
+          });
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      // Update to get to updated state
+      yield* stack.deploy(
+        Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string-changed",
+            replaceString: "original",
+          });
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("updated");
+
+      // Change props that trigger replacement
+      const output = yield* stack.deploy(
+        Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string-changed",
+            replaceString: "new",
+          });
+          return A.replaceString;
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("new");
+    }),
+  );
+});
+
+describe("from creating state", () => {
+  test.provider("continue creating when props unchanged", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "test-string",
+        });
+      }).pipe(stack.deploy, hook());
+      expect((yield* getState("A"))?.status).toEqual("creating");
+
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "test-string",
+        });
+        return A.string;
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("test-string");
+    }),
+  );
+
+  test.provider(
+    "continue creating when props have updatable changes",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+          });
+        }).pipe(stack.deploy, hook());
+        expect((yield* getState("A"))?.status).toEqual("creating");
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string-changed",
+          });
+          return A.string;
+        }).pipe(stack.deploy);
+        expect(output).toEqual("test-string-changed");
+        expect((yield* getState("A"))?.status).toEqual("created");
+      }),
+  );
+
+  test.provider("replace when props trigger replacement", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "test-string",
+        });
+      }).pipe(stack.deploy, hook());
+      expect((yield* getState("A"))?.status).toEqual("creating");
+
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          replaceString: "test-string-changed",
+        });
+        return A.replaceString;
+      }).pipe(stack.deploy);
+      expect(output).toEqual("test-string-changed");
+      expect((yield* getState("A"))?.status).toEqual("created");
+    }),
+  );
+
+  test.provider(
+    "destroy should handle creating state with no attributes",
+    (stack) =>
+      Effect.gen(function* () {
+        // 1. Create a resource but fail - this leaves state in "creating" with no attr
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+          });
+        }).pipe(stack.deploy, hook());
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        expect((yield* getState("A"))?.attr).toBeUndefined();
+
+        // 2. Call destroy - this triggers collectGarbage which tries to delete
+        // the orphaned resource. The bug is that output is undefined in the
+        // delete call when the resource never completed creation.
+        yield* stack.destroy();
+
+        // Resource should be cleaned up
+        expect(yield* getState("A")).toBeUndefined();
+      }),
+  );
+
+  test.provider(
+    "destroy should handle creating state when attributes can be recovered",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+          });
+        }).pipe(stack.deploy, hook());
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        expect((yield* getState("A"))?.attr).toBeUndefined();
+
+        yield* stack.destroy().pipe(
+          hook({
+            delete: () => Effect.fail(new ResourceFailure()),
+            read: () =>
+              Effect.succeed({
+                string: "test-string",
+              }),
+          }),
+        );
+
+        // Resource should be cleaned up
+        expect((yield* getState("A"))?.status).toEqual("deleting");
+
+        // actually delete this time
+        yield* stack.destroy().pipe(
+          hook({
+            read: () =>
+              Effect.succeed({
+                string: "test-string",
+              }),
+          }),
+        );
+
+        expect(yield* getState("A")).toBeUndefined();
+      }),
+  );
+
+  test.provider(
+    "destroy should handle replacing state when old resource has no attributes",
+    (stack) =>
+      Effect.gen(function* () {
+        // 1. Create a resource but fail - this leaves state in "creating" with no attr
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "original",
+          });
+        }).pipe(stack.deploy, hook());
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        expect((yield* getState("A"))?.attr).toBeUndefined();
+
+        // 2. Trigger replacement but also fail during create - this leaves state in "replacing"
+        // with old.attr being undefined
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "new",
+          });
+        }).pipe(stack.deploy, hook());
+        const state = yield* getState<ReplacingResourceState>("A");
+        expect(state?.status).toEqual("replacing");
+        expect(state?.old?.attr).toBeUndefined();
+
+        // 3. Call destroy - this triggers collectGarbage which tries to delete
+        // the resource. The bug is that old.attr is undefined.
+        yield* stack.destroy().pipe(
+          hook({
+            read: () =>
+              Effect.succeed({
+                replaceString: "original",
+              }),
+          }),
+        );
+
+        // Resource should be cleaned up
+        expect(yield* getState("A")).toBeUndefined();
+      }),
+  );
+});
+
+describe("from updating state", () => {
+  test.provider("continue updating when props unchanged", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "test-string",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "test-string-changed",
+        });
+      }).pipe(
+        stack.deploy,
+        hook({
+          update: () => Effect.fail(new ResourceFailure()),
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("updating");
+
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "test-string-changed",
+        });
+        return A.string;
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("updated");
+      expect(output).toEqual("test-string-changed");
+    }),
+  );
+
+  test.provider(
+    "continue updating when props have updatable changes",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+          });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string-changed",
+          });
+        }).pipe(
+          stack.deploy,
+          hook({
+            update: () => Effect.fail(new ResourceFailure()),
+          }),
+        );
+        expect((yield* getState("A"))?.status).toEqual("updating");
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string-changed-again",
+          });
+          return A.string;
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect(output).toEqual("test-string-changed-again");
+      }),
+  );
+
+  test.provider("replace when props trigger replacement", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "test-string",
+          replaceString: "original",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "test-string-changed",
+          replaceString: "original",
+        });
+      }).pipe(
+        stack.deploy,
+        hook({
+          update: () => Effect.fail(new ResourceFailure()),
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("updating");
+
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "test-string-changed",
+          replaceString: "changed",
+        });
+        return A.replaceString;
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("changed");
+    }),
+  );
+});
+
+describe("from replacing state", () => {
+  test.provider("continue replacement when props unchanged", (stack) =>
+    Effect.gen(function* () {
+      // 1. Create initial resource
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "original",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      // 2. Trigger replacement but fail during create of replacement
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "new",
+        });
+      }).pipe(
+        stack.deploy,
+        hook({
+          create: () => Effect.fail(new ResourceFailure()),
+        }),
+      );
+      const state = yield* getState<ReplacingResourceState>("A");
+      expect(state?.status).toEqual("replacing");
+      expect(state?.old?.status).toEqual("created");
+
+      // 3. Re-apply with same props - should continue replacement
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          replaceString: "new",
+        });
+        return A.replaceString;
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("new");
+    }),
+  );
+
+  test.provider(
+    "continue replacement when props have updatable changes",
+    (stack) =>
+      Effect.gen(function* () {
+        // 1. Create initial resource
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "original",
+            string: "initial",
+          });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // 2. Trigger replacement but fail during create
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "new",
+            string: "initial",
+          });
+        }).pipe(
+          stack.deploy,
+          hook({
+            create: () => Effect.fail(new ResourceFailure()),
+          }),
+        );
+        expect((yield* getState("A"))?.status).toEqual("replacing");
+
+        // 3. Re-apply with changed props (updatable) - should continue replacement with new props
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            replaceString: "new",
+            string: "changed",
+          });
+          return { replaceString: A.replaceString, string: A.string };
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect(output.replaceString).toEqual("new");
+        expect(output.string).toEqual("changed");
+      }),
+  );
+
+  test.provider(
+    "continue replacement when props trigger another replacement",
+    (stack) =>
+      Effect.gen(function* () {
+        // 1. Create initial resource
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "original",
+          });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // 2. Trigger replacement but fail during create
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "new",
+          });
+        }).pipe(
+          stack.deploy,
+          hook({
+            create: () => Effect.fail(new ResourceFailure()),
+          }),
+        );
+        expect((yield* getState("A"))?.status).toEqual("replacing");
+
+        // 3. Replace again with another replacement - should converge
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            replaceString: "another-replacement",
+          });
+          return A.replaceString;
+        }).pipe(stack.deploy);
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expect(output).toEqual("another-replacement");
+      }),
+  );
+});
+
+describe("from replaced state", () => {
+  test.provider("continue cleanup when props unchanged", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "test-string",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "test-string-changed",
+        });
+      }).pipe(
+        stack.deploy,
+        hook({
+          delete: () => Effect.fail(new ResourceFailure()),
+        }),
+      );
+      const AState = yield* getState<ReplacedResourceState>("A");
+      expect(AState?.status).toEqual("replaced");
+      expect(AState?.old).toMatchObject({
+        status: "created",
+        props: {
+          replaceString: "test-string",
+        },
+      });
+
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "test-string-changed",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+    }),
+  );
+
+  test.provider(
+    "update replacement then cleanup when props have updatable changes",
+    (stack) =>
+      Effect.gen(function* () {
+        // 1. Create initial resource
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "original",
+            string: "initial",
+          });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // 2. Trigger replacement and fail during delete of old resource
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "new",
+            string: "initial",
+          });
+        }).pipe(
+          stack.deploy,
+          hook({
+            delete: () => Effect.fail(new ResourceFailure()),
+          }),
+        );
+        const state = yield* getState<ReplacedResourceState>("A");
+        expect(state?.status).toEqual("replaced");
+        expect(state?.old?.status).toEqual("created");
+
+        // 3. Change props again (updatable change) - should update the replacement then cleanup
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            replaceString: "new",
+            string: "changed",
+          });
+          return { replaceString: A.replaceString, string: A.string };
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect(output.replaceString).toEqual("new");
+        expect(output.string).toEqual("changed");
+      }),
+  );
+
+  test.provider(
+    "continue cleanup when props trigger another replacement",
+    (stack) =>
+      Effect.gen(function* () {
+        // 1. Create initial resource
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "original",
+          });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // 2. Trigger replacement and fail during delete of old resource
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "new",
+          });
+        }).pipe(
+          stack.deploy,
+          hook({
+            delete: () => Effect.fail(new ResourceFailure()),
+          }),
+        );
+        expect((yield* getState("A"))?.status).toEqual("replaced");
+
+        // 3. Replace again and continue cleanup of the older generations
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            replaceString: "another-replacement",
+          });
+          return A.replaceString;
+        }).pipe(stack.deploy);
+        expectConvergedStatus((yield* getState("A"))?.status);
+        expect(output).toEqual("another-replacement");
+      }),
+  );
+});
+
+describe("from deleting state", () => {
+  test.provider(
+    "create when props unchanged or have updatable changes",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            string: "test-string",
+          });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        yield* stack.destroy().pipe(
+          hook({
+            delete: () => Effect.fail(new ResourceFailure()),
+          }),
+        );
+        expect((yield* getState("A"))?.status).toEqual("deleting");
+
+        // Now re-apply with the same props - should create the resource again
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "test-string",
+          });
+          return A.string;
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect(output).toEqual("test-string");
+      }),
+  );
+
+  test.provider("create when props trigger replacement", (stack) =>
+    Effect.gen(function* () {
+      // 1. Create initial resource
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          replaceString: "original",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      // 2. Try to delete but fail
+      yield* stack.destroy().pipe(
+        hook({
+          delete: () => Effect.fail(new ResourceFailure()),
+        }),
+      );
+      expect((yield* getState("A"))?.status).toEqual("deleting");
+
+      // 3. Re-apply with props that trigger replacement - should recreate
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          replaceString: "new",
+        });
+        return A.replaceString;
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect(output).toEqual("new");
+    }),
+  );
+});
+
+// =============================================================================
+// DEPENDENT RESOURCES (A -> B where B depends on A.string)
+// =============================================================================
+
+describe("dependent resources (A -> B)", () => {
+  describe("happy path", () => {
+    test.provider("create A then B where B uses A.string", (stack) =>
+      Effect.gen(function* () {
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.A.string).toEqual("a-value");
+        expect(output.B.string).toEqual("a-value");
+      }),
+    );
+
+    test.provider("update A propagates to B", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", { string: A.string });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+
+        // Update A's string - B should update with the new value
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect(output.A.string).toEqual("a-value-updated");
+        expect(output.B.string).toEqual("a-value-updated");
+      }),
+    );
+
+    test.provider("replace A, B updates to new A's output", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value",
+            replaceString: "original",
+          });
+          yield* TestResource("B", { string: A.string });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+
+        // Replace A - B should update to point to new A's output
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value-new",
+            replaceString: "changed",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect(output.A.string).toEqual("a-value-new");
+        expect(output.B.string).toEqual("a-value-new");
+      }),
+    );
+
+    test.provider("delete both resources (B deleted first, then A)", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", { string: A.string });
+        }).pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+
+        yield* stack.destroy();
+
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+        expect(yield* listState()).toEqual([]);
+      }),
+    );
+  });
+
+  describe("failures during expandAndPivot", () => {
+    test.provider(
+      "A create fails, B never starts - recovery creates both",
+      (stack) =>
+        Effect.gen(function* () {
+          // A fails to create - B should never start
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            yield* TestResource("B", { string: A.string });
+          }).pipe(stack.deploy, hook(failOn("A", "create")));
+
+          expect((yield* getState("A"))?.status).toEqual("creating");
+          expectNotStarted(yield* getState("B"));
+
+          // Recovery: re-apply should create both
+          const output = yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            const B = yield* TestResource("B", { string: A.string });
+            return { A, B };
+          }).pipe(stack.deploy);
+
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("created");
+          expect(output.A.string).toEqual("a-value");
+          expect(output.B.string).toEqual("a-value");
+        }),
+    );
+
+    test.provider("A creates, B create fails - recovery creates B", (stack) =>
+      Effect.gen(function* () {
+        // A succeeds, B fails to create
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", { string: A.string });
+        }).pipe(stack.deploy, hook(failOn("B", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("creating");
+
+        // Recovery: re-apply should noop A and create B
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.B.string).toEqual("a-value");
+      }),
+    );
+
+    test.provider("A update fails - recovery updates both", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", { string: A.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        });
+
+        // A fails to update - B should not start updating
+        yield* program.pipe(stack.deploy, hook(failOn("A", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updating");
+        expect((yield* getState("B"))?.status).toEqual("created");
+
+        // Recovery: re-apply should update both
+        const output = yield* program.pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect(output.A.string).toEqual("a-value-updated");
+        expect(output.B.string).toEqual("a-value-updated");
+      }),
+    );
+
+    test.provider("A updates, B update fails - recovery updates B", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", { string: A.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          return { A, B };
+        });
+
+        // A succeeds, B fails to update
+        yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updating");
+
+        // Recovery: re-apply should noop A and update B
+        const output = yield* program.pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect(output.B.string).toEqual("a-value-updated");
+      }),
+    );
+
+    test.provider(
+      "A replacement fails - recovery replaces A and updates B",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value",
+              replaceString: "original",
+            });
+            yield* TestResource("B", { string: A.string });
+          }).pipe(stack.deploy);
+
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value-new",
+              replaceString: "changed",
+            });
+            const B = yield* TestResource("B", { string: A.string });
+            return { A, B };
+          });
+
+          // A replacement fails (during create of new A) - B should not start
+          yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+          expect(
+            (yield* getState<ReplacingResourceState>("A"))?.status,
+          ).toEqual("replacing");
+          expect((yield* getState("B"))?.status).toEqual("created");
+
+          // Recovery: re-apply should complete A replacement and update B
+          const output = yield* program.pipe(stack.deploy);
+
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect(output.A.string).toEqual("a-value-new");
+          expect(output.B.string).toEqual("a-value-new");
+        }),
+    );
+
+    test.provider(
+      "A replaced, B update fails - recovery updates B then cleans up",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value",
+              replaceString: "original",
+            });
+            yield* TestResource("B", { string: A.string });
+          }).pipe(stack.deploy);
+
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value-new",
+              replaceString: "changed",
+            });
+            const B = yield* TestResource("B", { string: A.string });
+            return { A, B };
+          });
+
+          // A replacement succeeds, B fails to update
+          yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+          // A should be in replaced state (new A created, old A pending cleanup)
+          // B should be in updating state
+          const aState = yield* getState<ReplacedResourceState>("A");
+          expect(aState?.status).toEqual("replaced");
+          expect((yield* getState("B"))?.status).toEqual("updating");
+
+          // Recovery: re-apply should update B and clean up old A
+          const output = yield* program.pipe(stack.deploy);
+
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect(output.B.string).toEqual("a-value-new");
+        }),
+    );
+  });
+
+  describe("failures during collectGarbage", () => {
+    test.provider(
+      "A replaced, B updated, old A delete fails - recovery cleans up",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value",
+              replaceString: "original",
+            });
+            yield* TestResource("B", { string: A.string });
+          }).pipe(stack.deploy);
+
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value-new",
+              replaceString: "changed",
+            });
+            const B = yield* TestResource("B", { string: A.string });
+            return { A, B };
+          });
+
+          // A replacement and B update succeed, but old A delete fails
+          yield* program.pipe(stack.deploy, hook(failOn("A", "delete")));
+
+          // A should be in replaced state (delete of old A failed)
+          // B should have been updated successfully
+          expect((yield* getState<ReplacedResourceState>("A"))?.status).toEqual(
+            "replaced",
+          );
+          expect((yield* getState("B"))?.status).toEqual("updated");
+
+          // Recovery: re-apply should clean up old A
+          const output = yield* program.pipe(stack.deploy);
+
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect(output.A.string).toEqual("a-value-new");
+        }),
+    );
+
+    test.provider(
+      "orphan B delete fails - recovery deletes B then A",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            yield* TestResource("B", { string: A.string });
+          }).pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("created");
+
+          // Orphan deletion: B delete fails
+          yield* stack.destroy().pipe(hook(failOn("B", "delete")));
+
+          // B should be in deleting state, A should still be created (waiting for B)
+          expect((yield* getState("B"))?.status).toEqual("deleting");
+          expect((yield* getState("A"))?.status).toEqual("created");
+
+          // Recovery: re-apply destroy should delete B then A
+          yield* stack.destroy();
+
+          expect(yield* getState("A")).toBeUndefined();
+          expectNotStarted(yield* getState("B"));
+        }),
+    );
+
+    test.provider(
+      "orphan A delete fails after B deleted - recovery deletes A",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            yield* TestResource("B", { string: A.string });
+          }).pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("created");
+
+          // Orphan deletion: B succeeds, A fails
+          yield* stack.destroy().pipe(hook(failOn("A", "delete")));
+
+          // B should be deleted, A should be in deleting state
+          expectNotStarted(yield* getState("B"));
+          expect((yield* getState("A"))?.status).toEqual("deleting");
+
+          // Recovery: re-apply destroy should delete A
+          yield* stack.destroy();
+
+          expect(yield* getState("A")).toBeUndefined();
+        }),
+    );
+  });
+});
+
+// =============================================================================
+// THREE-LEVEL DEPENDENCY CHAIN (A -> B -> C where C depends on B, B depends on A)
+// =============================================================================
+
+describe("three-level dependency chain (A -> B -> C)", () => {
+  describe("happy path", () => {
+    test.provider("create A then B then C", (stack) =>
+      Effect.gen(function* () {
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect(output.A.string).toEqual("a-value");
+        expect(output.B.string).toEqual("a-value");
+        expect(output.C.string).toEqual("a-value");
+      }),
+    );
+
+    test.provider("update A propagates through B to C", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-updated");
+      }),
+    );
+
+    test.provider("replace A propagates through B to C", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value",
+            replaceString: "original",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value-new",
+            replaceString: "changed",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-new");
+      }),
+    );
+
+    test.provider("delete all three (C first, then B, then A)", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy();
+
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+        expect(yield* listState()).toEqual([]);
+      }),
+    );
+  });
+
+  describe("creation failures", () => {
+    test.provider("A create fails - B and C never start", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect(output.C.string).toEqual("a-value");
+      }),
+    );
+
+    test.provider("A creates, B create fails - C never starts", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("B", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("creating");
+        expectNotStarted(yield* getState("C"));
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect(output.C.string).toEqual("a-value");
+      }),
+    );
+
+    test.provider("A and B create, C create fails", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("C", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("creating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect(output.C.string).toEqual("a-value");
+      }),
+    );
+  });
+
+  describe("update failures", () => {
+    test.provider("A update fails - B and C remain stable", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updating");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-updated");
+      }),
+    );
+
+    test.provider("A updates, B update fails - C remains stable", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updating");
+        expect((yield* getState("C"))?.status).toEqual("created");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-updated");
+      }),
+    );
+
+    test.provider("A and B update, C update fails", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value-updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("C", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-updated");
+      }),
+    );
+  });
+
+  describe("replace cascade failures", () => {
+    test.provider("A replace fails - B and C remain stable", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value",
+            replaceString: "original",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value-new",
+            replaceString: "changed",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        expect((yield* getState<ReplacingResourceState>("A"))?.status).toEqual(
+          "replacing",
+        );
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-new");
+      }),
+    );
+
+    test.provider("A replaced, B update fails - C remains stable", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value",
+            replaceString: "original",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value-new",
+            replaceString: "changed",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+        expect((yield* getState<ReplacedResourceState>("A"))?.status).toEqual(
+          "replaced",
+        );
+        expect((yield* getState("B"))?.status).toEqual("updating");
+        expect((yield* getState("C"))?.status).toEqual("created");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-new");
+      }),
+    );
+
+    test.provider("A replaced, B updated, C update fails", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value",
+            replaceString: "original",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value-new",
+            replaceString: "changed",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("C", "update")));
+
+        expect((yield* getState<ReplacedResourceState>("A"))?.status).toEqual(
+          "replaced",
+        );
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-value-new");
+      }),
+    );
+
+    test.provider(
+      "A replaced, B and C updated, old A delete fails - recovery cleans up",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value",
+              replaceString: "original",
+            });
+            const B = yield* TestResource("B", { string: A.string });
+            yield* TestResource("C", { string: B.string });
+          }).pipe(stack.deploy);
+
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "a-value-new",
+              replaceString: "changed",
+            });
+            const B = yield* TestResource("B", { string: A.string });
+            const C = yield* TestResource("C", { string: B.string });
+            return { A, B, C };
+          });
+
+          yield* program.pipe(stack.deploy, hook(failOn("A", "delete")));
+
+          expect((yield* getState<ReplacedResourceState>("A"))?.status).toEqual(
+            "replaced",
+          );
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect((yield* getState("C"))?.status).toEqual("updated");
+
+          // Recovery
+          const output = yield* program.pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect((yield* getState("C"))?.status).toEqual("updated");
+          expect(output.C.string).toEqual("a-value-new");
+        }),
+    );
+  });
+
+  describe("delete order failures", () => {
+    test.provider("C delete fails - A and B waiting", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy().pipe(hook(failOn("C", "delete")));
+
+        expect((yield* getState("C"))?.status).toEqual("deleting");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // Recovery
+        yield* stack.destroy();
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+      }),
+    );
+
+    test.provider("C deleted, B delete fails - A waiting", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy().pipe(hook(failOn("B", "delete")));
+
+        expectNotStarted(yield* getState("C"));
+        expect((yield* getState("B"))?.status).toEqual("deleting");
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // Recovery
+        yield* stack.destroy();
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+      }),
+    );
+
+    test.provider("C and B deleted, A delete fails", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy().pipe(hook(failOn("A", "delete")));
+
+        expectNotStarted(yield* getState("C"));
+        expectNotStarted(yield* getState("B"));
+        expect((yield* getState("A"))?.status).toEqual("deleting");
+
+        // Recovery
+        yield* stack.destroy();
+        expect(yield* getState("A")).toBeUndefined();
+      }),
+    );
+  });
+});
+
+// =============================================================================
+// DIAMOND DEPENDENCIES (D depends on B and C, both depend on A)
+//     A
+//    / \
+//   B   C
+//    \ /
+//     D
+// =============================================================================
+
+describe("diamond dependencies (A -> B,C -> D)", () => {
+  describe("happy path", () => {
+    test.provider("create all four resources", (stack) =>
+      Effect.gen(function* () {
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.D.string).toEqual("a-value-a-value");
+      }),
+    );
+
+    test.provider("update A propagates to B, C, and D", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+        }).pipe(stack.deploy);
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect((yield* getState("D"))?.status).toEqual("updated");
+        expect(output.D.string).toEqual("updated-updated");
+      }),
+    );
+
+    test.provider("add D while B replaces and C noops", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", {
+            string: Output.interpolate`${A.string}-b`,
+            replaceString: "b-original",
+          });
+          yield* TestResource("C", {
+            string: Output.interpolate`${A.string}-c`,
+            replaceString: "c-original",
+          });
+        }).pipe(stack.deploy);
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", {
+            string: Output.interpolate`${A.string}-b-replaced`,
+            replaceString: "b-changed",
+          });
+          const C = yield* TestResource("C", {
+            string: Output.interpolate`${A.string}-c`,
+            replaceString: "c-original",
+          });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.B.replaceString).toEqual("b-changed");
+        expect(output.C.replaceString).toEqual("c-original");
+        expect(output.D.string).toEqual("a-value-b-replaced-a-value-c");
+      }),
+    );
+
+    test.provider("add D while C replaces and B noops", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", {
+            string: Output.interpolate`${A.string}-b`,
+            replaceString: "b-original",
+          });
+          yield* TestResource("C", {
+            string: Output.interpolate`${A.string}-c`,
+            replaceString: "c-original",
+          });
+        }).pipe(stack.deploy);
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", {
+            string: Output.interpolate`${A.string}-b`,
+            replaceString: "b-original",
+          });
+          const C = yield* TestResource("C", {
+            string: Output.interpolate`${A.string}-c-replaced`,
+            replaceString: "c-changed",
+          });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.B.replaceString).toEqual("b-original");
+        expect(output.C.replaceString).toEqual("c-changed");
+        expect(output.D.string).toEqual("a-value-b-a-value-c-replaced");
+      }),
+    );
+
+    test.provider("add D while both B and C replace", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", {
+            string: Output.interpolate`${A.string}-b`,
+            replaceString: "b-original",
+          });
+          yield* TestResource("C", {
+            string: Output.interpolate`${A.string}-c`,
+            replaceString: "c-original",
+          });
+        }).pipe(stack.deploy);
+
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", {
+            string: Output.interpolate`${A.string}-b-replaced`,
+            replaceString: "b-changed",
+          });
+          const C = yield* TestResource("C", {
+            string: Output.interpolate`${A.string}-c-replaced`,
+            replaceString: "c-changed",
+          });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.B.replaceString).toEqual("b-changed");
+        expect(output.C.replaceString).toEqual("c-changed");
+        expect(output.D.string).toEqual(
+          "a-value-b-replaced-a-value-c-replaced",
+        );
+      }),
+    );
+
+    test.provider("delete all (D first, then B and C, then A)", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy();
+
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+        expectNotStarted(yield* getState("D"));
+      }),
+    );
+  });
+
+  describe("creation failures", () => {
+    test.provider("A create fails - B, C, D never start", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("creating");
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+        expectNotStarted(yield* getState("D"));
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.D.string).toEqual("a-value-a-value");
+      }),
+    );
+
+    test.provider(
+      "A creates, B create fails - C may create, D stuck",
+      (stack) =>
+        Effect.gen(function* () {
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            const B = yield* TestResource("B", { string: A.string });
+            const C = yield* TestResource("C", { string: A.string });
+            const D = yield* TestResource("D", {
+              string: Output.interpolate`${B.string}-${C.string}`,
+            });
+            return { A, B, C, D };
+          });
+
+          yield* program.pipe(stack.deploy, hook(failOn("B", "create")));
+
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("creating");
+          // C might have been created since it doesn't depend on B
+          const cState = yield* getState("C");
+          expect(cState === undefined || cState?.status === "created").toBe(
+            true,
+          );
+          expectNotStarted(yield* getState("D"));
+
+          // Recovery
+          const output = yield* program.pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("created");
+          expect((yield* getState("C"))?.status).toEqual("created");
+          expect((yield* getState("D"))?.status).toEqual("created");
+          expect(output.D.string).toEqual("a-value-a-value");
+        }),
+    );
+
+    test.provider(
+      "A creates, C create fails - B may create, D stuck",
+      (stack) =>
+        Effect.gen(function* () {
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            const B = yield* TestResource("B", { string: A.string });
+            const C = yield* TestResource("C", { string: A.string });
+            const D = yield* TestResource("D", {
+              string: Output.interpolate`${B.string}-${C.string}`,
+            });
+            return { A, B, C, D };
+          });
+
+          yield* program.pipe(stack.deploy, hook(failOn("C", "create")));
+
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("C"))?.status).toEqual("creating");
+          // B might have been created since it doesn't depend on C
+          const bState = yield* getState("B");
+          expect(bState === undefined || bState?.status === "created").toBe(
+            true,
+          );
+          expectNotStarted(yield* getState("D"));
+
+          // Recovery
+          const output = yield* program.pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("created");
+          expect((yield* getState("C"))?.status).toEqual("created");
+          expect((yield* getState("D"))?.status).toEqual("created");
+          expect(output.D.string).toEqual("a-value-a-value");
+        }),
+    );
+
+    test.provider("A, B, C create - D create fails", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("D", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("creating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.D.string).toEqual("a-value-a-value");
+      }),
+    );
+
+    test.provider("both B and C fail to create - D stuck", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        });
+
+        yield* program.pipe(
+          stack.deploy,
+          hook(
+            failOnMultiple([
+              { id: "B", hook: "create" },
+              { id: "C", hook: "create" },
+            ]),
+          ),
+        );
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        // effect terminates eagerly, so it's possible that B or C to run first and block C from running
+        const BState = yield* getState("B");
+        const CState = yield* getState("C");
+        expect(BState?.status).toBeOneOf(["creating", undefined]);
+        expect(CState?.status).toBeOneOf(["creating", undefined]);
+        // at leasst one of B or C should have been created
+        expect(BState?.status ?? CState?.status).toEqual("creating");
+
+        expectNotStarted(yield* getState("D"));
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+        expect(output.D.string).toEqual("a-value-a-value");
+      }),
+    );
+  });
+
+  describe("update failures", () => {
+    test.provider("A update fails - B, C, D remain stable", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updating");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("D"))?.status).toEqual("created");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect((yield* getState("D"))?.status).toEqual("updated");
+        expect(output.D.string).toEqual("updated-updated");
+      }),
+    );
+
+    test.provider(
+      "A updates, B update fails - C may update, D stuck",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            const B = yield* TestResource("B", { string: A.string });
+            const C = yield* TestResource("C", { string: A.string });
+            yield* TestResource("D", {
+              string: Output.interpolate`${B.string}-${C.string}`,
+            });
+          }).pipe(stack.deploy);
+
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "updated" });
+            const B = yield* TestResource("B", { string: A.string });
+            const C = yield* TestResource("C", { string: A.string });
+            const D = yield* TestResource("D", {
+              string: Output.interpolate`${B.string}-${C.string}`,
+            });
+            return { A, B, C, D };
+          });
+
+          yield* program.pipe(stack.deploy, hook(failOn("B", "update")));
+
+          expect((yield* getState("A"))?.status).toEqual("updated");
+          expect((yield* getState("B"))?.status).toEqual("updating");
+          // C might have been updated since it doesn't depend on B
+          const cState = yield* getState("C");
+          expect(
+            cState?.status === "created" || cState?.status === "updated",
+          ).toBe(true);
+          expect((yield* getState("D"))?.status).toEqual("created");
+
+          // Recovery
+          const output = yield* program.pipe(stack.deploy);
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect((yield* getState("C"))?.status).toEqual("updated");
+          expect((yield* getState("D"))?.status).toEqual("updated");
+          expect(output.D.string).toEqual("updated-updated");
+        }),
+    );
+
+    test.provider("A, B, C update - D update fails", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "updated" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          const D = yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+          return { A, B, C, D };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("D", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect((yield* getState("D"))?.status).toEqual("updating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("D"))?.status).toEqual("updated");
+        expect(output.D.string).toEqual("updated-updated");
+      }),
+    );
+  });
+
+  describe("delete failures", () => {
+    test.provider("D delete fails - B, C, A waiting", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: A.string });
+          yield* TestResource("D", {
+            string: Output.interpolate`${B.string}-${C.string}`,
+          });
+        }).pipe(stack.deploy);
+
+        yield* stack.destroy().pipe(hook(failOn("D", "delete")));
+
+        expect((yield* getState("D"))?.status).toEqual("deleting");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("C"))?.status).toEqual("created");
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // Recovery
+        yield* stack.destroy();
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+        expectNotStarted(yield* getState("D"));
+      }),
+    );
+
+    test.provider(
+      "D deleted, B delete fails - C may delete, A waiting",
+      (stack) =>
+        Effect.gen(function* () {
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            const B = yield* TestResource("B", { string: A.string });
+            const C = yield* TestResource("C", { string: A.string });
+            yield* TestResource("D", {
+              string: Output.interpolate`${B.string}-${C.string}`,
+            });
+          }).pipe(stack.deploy);
+
+          yield* stack.destroy().pipe(hook(failOn("B", "delete")));
+
+          expectNotStarted(yield* getState("D"));
+          expect((yield* getState("B"))?.status).toEqual("deleting");
+          // C may or may not be deleted depending on execution order
+          const cState = yield* getState("C");
+          expect(cState === undefined || cState?.status === "created").toBe(
+            true,
+          );
+          expect((yield* getState("A"))?.status).toEqual("created");
+
+          // Recovery
+          yield* stack.destroy();
+          expect(yield* getState("A")).toBeUndefined();
+          expectNotStarted(yield* getState("B"));
+          expectNotStarted(yield* getState("C"));
+        }),
+    );
+  });
+});
+
+// =============================================================================
+// INDEPENDENT RESOURCES (no dependencies between them)
+// =============================================================================
+
+describe("independent resources (A, B with no dependencies)", () => {
+  describe("parallel failures", () => {
+    test.provider("both A and B fail to create", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: "b-value" });
+          return { A, B };
+        });
+
+        yield* program.pipe(
+          stack.deploy,
+          hook(
+            failOnMultiple([
+              { id: "A", hook: "create" },
+              { id: "B", hook: "create" },
+            ]),
+          ),
+        );
+
+        // effect terminates eagerly, so it's possible that A or B runs first and blocks the other from running
+        const AState = yield* getState("A");
+        const BState = yield* getState("B");
+        expect(AState?.status).toBeOneOf(["creating", undefined]);
+        expect(BState?.status).toBeOneOf(["creating", undefined]);
+        // at least one of A or B should have been creating
+        expect(AState?.status ?? BState?.status).toEqual("creating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.A.string).toEqual("a-value");
+        expect(output.B.string).toEqual("b-value");
+      }),
+    );
+
+    test.provider("A creates, B fails - recovery creates B", (stack) =>
+      Effect.gen(function* () {
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: "b-value" });
+          return { A, B };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("B", "create")));
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("creating");
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.B.string).toEqual("b-value");
+      }),
+    );
+
+    test.provider("A update fails, B update succeeds", (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", { string: "a-value" });
+          yield* TestResource("B", { string: "b-value" });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-updated" });
+          const B = yield* TestResource("B", { string: "b-updated" });
+          return { A, B };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "update")));
+
+        expect((yield* getState("A"))?.status).toEqual("updating");
+        // B might have been updated
+        const bState = yield* getState("B");
+        expect(
+          bState?.status === "created" || bState?.status === "updated",
+        ).toBe(true);
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("updated");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect(output.A.string).toEqual("a-updated");
+        expect(output.B.string).toEqual("b-updated");
+      }),
+    );
+  });
+
+  describe("mixed state recovery", () => {
+    test.provider(
+      "A in creating, B in updating state - recovery completes both",
+      (stack) =>
+        Effect.gen(function* () {
+          // First create B successfully
+          yield* Effect.gen(function* () {
+            yield* TestResource("B", { string: "b-value" });
+          }).pipe(stack.deploy);
+          expect((yield* getState("B"))?.status).toEqual("created");
+
+          // Now try to create A and update B - A fails
+          const program = Effect.gen(function* () {
+            const A = yield* TestResource("A", { string: "a-value" });
+            const B = yield* TestResource("B", { string: "b-updated" });
+            return { A, B };
+          });
+
+          yield* program.pipe(
+            stack.deploy,
+            hook(
+              failOnMultiple([
+                { id: "A", hook: "create" },
+                { id: "B", hook: "update" },
+              ]),
+            ),
+          );
+
+          // effect terminates eagerly, so it's possible that A or B runs first and blocks the other from running
+          const AState = yield* getState("A");
+          const BState = yield* getState("B");
+          expect(AState?.status).toBeOneOf(["creating", undefined]);
+          expect(BState?.status).toBeOneOf(["created", "updating"]);
+          // at least one of A or B should have started their failing operation
+          expect(
+            AState?.status === "creating" || BState?.status === "updating",
+          ).toBe(true);
+
+          // Recovery
+          const output = yield* program.pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("updated");
+          expect(output.A.string).toEqual("a-value");
+          expect(output.B.string).toEqual("b-updated");
+        }),
+    );
+
+    test.provider(
+      "A in replacing, B in deleting state - complex recovery",
+      (stack) =>
+        Effect.gen(function* () {
+          // Create both
+          yield* Effect.gen(function* () {
+            yield* TestResource("A", { replaceString: "original" });
+            yield* TestResource("B", { string: "b-value" });
+          }).pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expect((yield* getState("B"))?.status).toEqual("created");
+
+          // Try to replace A and delete B (by not including B) - both fail
+          const program = Effect.gen(function* () {
+            yield* TestResource("A", { replaceString: "changed" });
+          });
+
+          yield* program.pipe(
+            stack.deploy,
+            hook(
+              failOnMultiple([
+                { id: "A", hook: "create" },
+                { id: "B", hook: "delete" },
+              ]),
+            ),
+          );
+
+          // effect terminates eagerly, so it's possible that A or B runs first and blocks the other from running
+          const AState = yield* getState<ReplacingResourceState>("A");
+          const BState = yield* getState("B");
+          expect(AState?.status).toBeOneOf(["created", "replacing"]);
+          expect(BState?.status).toBeOneOf(["created", "deleting"]);
+          // at least one of A or B should have started their failing operation
+          expect(
+            AState?.status === "replacing" || BState?.status === "deleting",
+          ).toBe(true);
+
+          // Recovery - complete the replace and delete
+          yield* program.pipe(stack.deploy);
+          expect((yield* getState("A"))?.status).toEqual("created");
+          expectNotStarted(yield* getState("B"));
+        }),
+    );
+  });
+});
+
+// =============================================================================
+// MULTIPLE RESOURCES REPLACING SIMULTANEOUSLY
+// =============================================================================
+
+describe("multiple resources replacing", () => {
+  test.provider("two independent resources replace successfully", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", { replaceString: "a-original" });
+        yield* TestResource("B", { replaceString: "b-original" });
+      }).pipe(stack.deploy);
+
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { replaceString: "a-new" });
+        const B = yield* TestResource("B", { replaceString: "b-new" });
+        return { A, B };
+      }).pipe(stack.deploy);
+
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect((yield* getState("B"))?.status).toEqual("created");
+      expect(output.A.replaceString).toEqual("a-new");
+      expect(output.B.replaceString).toEqual("b-new");
+    }),
+  );
+
+  test.provider(
+    "A replace fails, B replace succeeds - recovery completes A",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-original" });
+          yield* TestResource("B", { replaceString: "b-original" });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { replaceString: "a-new" });
+          const B = yield* TestResource("B", { replaceString: "b-new" });
+          return { A, B };
+        });
+
+        yield* program.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        expect((yield* getState<ReplacingResourceState>("A"))?.status).toEqual(
+          "replacing",
+        );
+        // B might have been replaced
+        const bState = yield* getState("B");
+        expect(
+          bState?.status === "created" ||
+            bState?.status === "replacing" ||
+            bState?.status === "replaced",
+        ).toBe(true);
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.A.replaceString).toEqual("a-new");
+        expect(output.B.replaceString).toEqual("b-new");
+      }),
+  );
+
+  test.provider(
+    "both A and B replace fail - recovery completes both",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-original" });
+          yield* TestResource("B", { replaceString: "b-original" });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { replaceString: "a-new" });
+          const B = yield* TestResource("B", { replaceString: "b-new" });
+          return { A, B };
+        });
+
+        yield* program.pipe(
+          stack.deploy,
+          hook(
+            failOnMultiple([
+              { id: "A", hook: "create" },
+              { id: "B", hook: "create" },
+            ]),
+          ),
+        );
+
+        // effect terminates eagerly, so it's possible that A or B runs first and blocks the other from running
+        const AState = yield* getState<ReplacingResourceState>("A");
+        const BState = yield* getState<ReplacingResourceState>("B");
+        expect(AState?.status).toBeOneOf(["created", "replacing"]);
+        expect(BState?.status).toBeOneOf(["created", "replacing"]);
+        // at least one of A or B should have started replacing
+        expect(
+          AState?.status === "replacing" || BState?.status === "replacing",
+        ).toBe(true);
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.A.replaceString).toEqual("a-new");
+        expect(output.B.replaceString).toEqual("b-new");
+      }),
+  );
+
+  test.provider(
+    "A replaced, B replacing - old A delete fails, B create fails - recovery completes both",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-original" });
+          yield* TestResource("B", { replaceString: "b-original" });
+        }).pipe(stack.deploy);
+
+        const program = Effect.gen(function* () {
+          const A = yield* TestResource("A", { replaceString: "a-new" });
+          const B = yield* TestResource("B", { replaceString: "b-new" });
+          return { A, B };
+        });
+
+        yield* program.pipe(
+          stack.deploy,
+          hook(
+            failOnMultiple([
+              { id: "A", hook: "delete" },
+              { id: "B", hook: "create" },
+            ]),
+          ),
+        );
+
+        // effect terminates eagerly, so it's possible that A or B runs first and blocks the other from running
+        // A should be replaced (new created, old pending delete) or still replacing/created if B failed first
+        // B should be replacing (new not yet created) or already created if A failed first
+        const AState = yield* getState<ReplacedResourceState>("A");
+        const BState = yield* getState<ReplacingResourceState>("B");
+        expect(AState?.status).toBeOneOf(["created", "replacing", "replaced"]);
+        expect(BState?.status).toBeOneOf(["created", "replacing"]);
+        // at least one of A or B should have started their failing operation
+        expect(
+          AState?.status === "replaced" || BState?.status === "replacing",
+        ).toBe(true);
+
+        // Recovery
+        const output = yield* program.pipe(stack.deploy);
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect(output.A.replaceString).toEqual("a-new");
+        expect(output.B.replaceString).toEqual("b-new");
+      }),
+  );
+});
+
+describe("repeated replacements", () => {
+  test.provider(
+    "resource can be replaced again while still in replacing state",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-original" });
+        }).pipe(stack.deploy);
+
+        const firstReplacement = Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-first" });
+        });
+
+        yield* firstReplacement.pipe(stack.deploy, hook(failOn("A", "create")));
+
+        const replacingState = yield* getState<ReplacingResourceState>("A");
+        expect(replacingState?.status).toEqual("replacing");
+
+        const secondReplacement = Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-second" });
+        });
+
+        yield* secondReplacement.pipe(stack.deploy);
+
+        const finalState = yield* getState("A");
+        expectConvergedStatus(finalState?.status);
+        expect(finalState?.props?.replaceString).toEqual("a-second");
+      }),
+  );
+
+  test.provider(
+    "resource can be replaced again while still in replaced state",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-original" });
+        }).pipe(stack.deploy);
+
+        const firstReplacement = Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-first" });
+        });
+
+        yield* firstReplacement.pipe(stack.deploy, hook(failOn("A", "delete")));
+
+        const replacedState = yield* getState<ReplacedResourceState>("A");
+        expect(replacedState?.status).toEqual("replaced");
+
+        const secondReplacement = Effect.gen(function* () {
+          yield* TestResource("A", { replaceString: "a-second" });
+        });
+
+        yield* secondReplacement.pipe(stack.deploy);
+
+        const finalState = yield* getState("A");
+        expectConvergedStatus(finalState?.status);
+        expect(finalState?.props?.replaceString).toEqual("a-second");
+      }),
+  );
+});
+
+// =============================================================================
+// ORPHAN CHAIN DELETION
+// =============================================================================
+
+describe("orphan chain deletion", () => {
+  test.provider("three-level orphan chain deleted in correct order", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-value" });
+        const B = yield* TestResource("B", { string: A.string });
+        yield* TestResource("C", { string: B.string });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect((yield* getState("B"))?.status).toEqual("created");
+      expect((yield* getState("C"))?.status).toEqual("created");
+
+      // Remove C from graph - should delete C only
+      yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-value" });
+        yield* TestResource("B", { string: A.string });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect((yield* getState("B"))?.status).toEqual("created");
+      expectNotStarted(yield* getState("C"));
+    }),
+  );
+
+  test.provider(
+    "orphan with intermediate failure recovers correctly",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "a-value" });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        // Remove all three - C fails to delete
+        yield* stack.destroy().pipe(hook(failOn("C", "delete")));
+
+        expect((yield* getState("C"))?.status).toEqual("deleting");
+        expect((yield* getState("B"))?.status).toEqual("created");
+        expect((yield* getState("A"))?.status).toEqual("created");
+
+        // Recovery
+        yield* stack.destroy();
+        expect(yield* getState("A")).toBeUndefined();
+        expectNotStarted(yield* getState("B"));
+        expectNotStarted(yield* getState("C"));
+      }),
+  );
+
+  test.provider("partial orphan - remove leaf, add new dependent", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-value" });
+        yield* TestResource("B", { string: A.string });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect((yield* getState("B"))?.status).toEqual("created");
+
+      // Remove B, add C dependent on A
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-value" });
+        const C = yield* TestResource("C", { string: A.string });
+        return { A, C };
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expectNotStarted(yield* getState("B"));
+      expect((yield* getState("C"))?.status).toEqual("created");
+      expect(output.C.string).toEqual("a-value");
+    }),
+  );
+});
+
+// =============================================================================
+// COMPLEX MIXED STATE SCENARIOS
+// =============================================================================
+
+describe("complex mixed state scenarios", () => {
+  test.provider("replace upstream while creating downstream", (stack) =>
+    Effect.gen(function* () {
+      // Create A
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "a-value",
+          replaceString: "original",
+        });
+      }).pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+
+      // Now add B dependent on A, and also replace A
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "a-value-new",
+          replaceString: "changed",
+        });
+        const B = yield* TestResource("B", { string: A.string });
+        return { A, B };
+      }).pipe(stack.deploy);
+
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect((yield* getState("B"))?.status).toEqual("created");
+      expect(output.A.string).toEqual("a-value-new");
+      expect(output.B.string).toEqual("a-value-new");
+    }),
+  );
+
+  test.provider("update upstream, create and delete in same apply", (stack) =>
+    Effect.gen(function* () {
+      // Create A and B
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", { string: "a-value" });
+        yield* TestResource("B", { string: "b-value" });
+      }).pipe(stack.deploy);
+
+      // Update A, delete B (by not including), create C
+      const output = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-updated" });
+        const C = yield* TestResource("C", { string: A.string });
+        return { A, C };
+      }).pipe(stack.deploy);
+
+      expect((yield* getState("A"))?.status).toEqual("updated");
+      expectNotStarted(yield* getState("B"));
+      expect((yield* getState("C"))?.status).toEqual("created");
+      expect(output.C.string).toEqual("a-updated");
+    }),
+  );
+
+  test.provider(
+    "chain reaction: A replace triggers B update triggers C update",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-value",
+            replaceString: "original",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          yield* TestResource("C", { string: B.string });
+        }).pipe(stack.deploy);
+
+        // Replace A - should cascade updates to B and C
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "a-replaced",
+            replaceString: "changed",
+          });
+          const B = yield* TestResource("B", { string: A.string });
+          const C = yield* TestResource("C", { string: B.string });
+          return { A, B, C };
+        }).pipe(stack.deploy);
+
+        expect((yield* getState("A"))?.status).toEqual("created");
+        expect((yield* getState("B"))?.status).toEqual("updated");
+        expect((yield* getState("C"))?.status).toEqual("updated");
+        expect(output.C.string).toEqual("a-replaced");
+      }),
+  );
+
+  test.provider("multiple failures across all operation types", (stack) =>
+    Effect.gen(function* () {
+      // Setup: A, B created; C, D will be added
+      yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "a-value",
+          replaceString: "original",
+        });
+        yield* TestResource("B", { string: "b-value" });
+      }).pipe(stack.deploy);
+
+      // Complex operation: A replace, B update, C create, D not included (nothing to delete)
+      const program = Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "a-replaced",
+          replaceString: "changed",
+        });
+        const B = yield* TestResource("B", { string: "b-updated" });
+        const C = yield* TestResource("C", { string: "c-value" });
+        return { A, B, C };
+      });
+
+      // Fail on A replace (create phase) and C create
+      yield* program.pipe(
+        stack.deploy,
+        hook(
+          failOnMultiple([
+            { id: "A", hook: "create" },
+            { id: "C", hook: "create" },
+          ]),
+        ),
+      );
+
+      // effect terminates eagerly, so it's possible that A or C runs first and blocks the other from running
+      const AState = yield* getState<ReplacingResourceState>("A");
+      // B might have been updated
+      const bState = yield* getState("B");
+      expect(bState?.status === "created" || bState?.status === "updated").toBe(
+        true,
+      );
+      const CState = yield* getState("C");
+      expect(AState?.status).toBeOneOf(["created", "replacing"]);
+      expect(CState?.status).toBeOneOf(["creating", undefined]);
+      // at least one of A or C should have started their failing operation
+      expect(
+        AState?.status === "replacing" || CState?.status === "creating",
+      ).toBe(true);
+
+      // Recovery
+      const output = yield* program.pipe(stack.deploy);
+      expect((yield* getState("A"))?.status).toEqual("created");
+      expect((yield* getState("B"))?.status).toEqual("updated");
+      expect((yield* getState("C"))?.status).toEqual("created");
+      expect(output.A.replaceString).toEqual("changed");
+      expect(output.B.string).toEqual("b-updated");
+      expect(output.C.string).toEqual("c-value");
+    }),
+  );
+});
+
+describe("artifacts", () => {
+  test.provider("shares artifacts from plan diff into apply update", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        yield* ArtifactProbe("A", { value: "v1" });
+      }).pipe(stack.deploy);
+
+      const updated = yield* Effect.gen(function* () {
+        const A = yield* ArtifactProbe("A", { value: "v2" });
+        return { A };
+      }).pipe(stack.deploy);
+
+      expect(updated.A.value).toEqual("v2");
+      expect(updated.A.artifactValue).toEqual("v2");
+      expect((yield* getState("A"))?.status).toEqual("updated");
+    }),
+  );
+
+  test.provider(
+    "isolates artifact bags by FQN for namespaced resources with the same leaf logical ID",
+    (stack) =>
+      Effect.gen(function* () {
+        const Site = Construct.fn(function* (
+          _id: string,
+          props: { value: string },
+        ) {
+          return yield* ArtifactProbe("Shared", { value: props.value });
+        });
+
+        yield* Effect.gen(function* () {
+          yield* Site("Left", { value: "left-v1" });
+          yield* Site("Right", { value: "right-v1" });
+        }).pipe(stack.deploy);
+
+        const updated = yield* Effect.gen(function* () {
+          const left = yield* Site("Left", { value: "left-v2" });
+          const right = yield* Site("Right", { value: "right-v2" });
+          return { left, right };
+        }).pipe(stack.deploy);
+
+        expect(updated.left.artifactValue).toEqual("left-v2");
+        expect(updated.right.artifactValue).toEqual("right-v2");
+        expect((yield* getState("Left/Shared"))?.status).toEqual("updated");
+        expect((yield* getState("Right/Shared"))?.status).toEqual("updated");
+      }),
+  );
+});
+
+// =============================================================================
+// STATIC STABLE PROPERTIES (provider.stables defined on provider, not in diff)
+// This tests the bug where diff returns undefined but downstream resources
+// depend on stable properties that should be preserved
+// =============================================================================
+
+describe("static stable properties (provider.stables)", () => {
+  describe("diff returns undefined with tag-only changes", () => {
+    test.provider(
+      "upstream has static stables, diff returns undefined, downstream depends on stableId",
+      (stack) =>
+        Effect.gen(function* () {
+          // Stage 1: Create A with no tags, B depends on A.stableId
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", { string: "value" });
+              const B = yield* TestResource("B", { string: A.stableId });
+              return { A, B };
+            }).pipe(stack.deploy);
+            expect(output.A.stableId).toEqual("stable-A");
+            expect(output.B.string).toEqual("stable-A");
+            expect((yield* getState("A"))?.status).toEqual("created");
+            expect((yield* getState("B"))?.status).toEqual("created");
+          }
+
+          // Stage 2: Add tags to A - diff returns undefined, but arePropsChanged is true
+          // B depends on A.stableId which should remain stable
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value",
+                tags: { Name: "tagged-resource" },
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              return { A, B };
+            }).pipe(stack.deploy);
+            // A should be updated (tags changed)
+            expect(output.A.tags).toEqual({ Name: "tagged-resource" });
+            // B should NOT be updated because stableId didn't change
+            expect(output.B.string).toEqual("stable-A");
+            expect((yield* getState("A"))?.status).toEqual("updated");
+            // B should remain "created" (noop) since its input (stableId) didn't change
+            expect((yield* getState("B"))?.status).toEqual("created");
+          }
+        }),
+    );
+
+    test.provider(
+      "chain: A -> B -> C where B depends on A.stableId and C depends on B.stableString",
+      (stack) =>
+        Effect.gen(function* () {
+          // Stage 1: Create chain
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "initial",
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              const C = yield* TestResource("C", { string: B.stableString });
+              return { A, B, C };
+            }).pipe(stack.deploy);
+            expect(output.A.stableId).toEqual("stable-A");
+            expect(output.B.string).toEqual("stable-A");
+            expect(output.C.string).toEqual("B");
+          }
+
+          // Stage 2: Change A's tags only - diff returns undefined
+          // Neither B nor C should update since their inputs are stable
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "initial",
+                tags: { Env: "production" },
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              const C = yield* TestResource("C", { string: B.stableString });
+              return { A, B, C };
+            }).pipe(stack.deploy);
+            expect(output.A.tags).toEqual({ Env: "production" });
+            expect((yield* getState("A"))?.status).toEqual("updated");
+            // B and C should not change
+            expect((yield* getState("B"))?.status).toEqual("created");
+            expect((yield* getState("C"))?.status).toEqual("created");
+          }
+        }),
+    );
+
+    test.provider(
+      "diamond: A -> B,C -> D where all depend on stable properties",
+      (stack) =>
+        Effect.gen(function* () {
+          // Stage 1: Create diamond
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "initial",
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              const C = yield* TestResource("C", { string: A.stableArn });
+              const D = yield* TestResource("D", {
+                string: Output.interpolate`${B.stableString}-${C.stableString}`,
+              });
+              return { A, B, C, D };
+            }).pipe(stack.deploy);
+            expect(output.A.stableId).toEqual("stable-A");
+            expect(output.A.stableArn).toEqual(
+              "arn:test:resource:us-east-1:123456789:A",
+            );
+            expect(output.B.string).toEqual("stable-A");
+            expect(output.C.string).toEqual(
+              "arn:test:resource:us-east-1:123456789:A",
+            );
+            expect(output.D.string).toEqual("B-C");
+          }
+
+          // Stage 2: Change A's tags - should not affect B, C, or D
+          {
+            yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "initial",
+                tags: { Team: "platform" },
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              const C = yield* TestResource("C", { string: A.stableArn });
+              yield* TestResource("D", {
+                string: Output.interpolate`${B.stableString}-${C.stableString}`,
+              });
+            }).pipe(stack.deploy);
+            expect((yield* getState("A"))?.status).toEqual("updated");
+            expect((yield* getState("B"))?.status).toEqual("created");
+            expect((yield* getState("C"))?.status).toEqual("created");
+            expect((yield* getState("D"))?.status).toEqual("created");
+          }
+        }),
+    );
+  });
+
+  describe("diff returns update action with static stables", () => {
+    test.provider(
+      "upstream has static stables and diff returns update, downstream depends on stableId",
+      (stack) =>
+        Effect.gen(function* () {
+          // Stage 1: Create A and B
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value-1",
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              return { A, B };
+            }).pipe(stack.deploy);
+            expect(output.A.stableId).toEqual("stable-A");
+            expect(output.B.string).toEqual("stable-A");
+          }
+
+          // Stage 2: Change A's string - diff returns "update", stableId still stable
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value-2",
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              return { A, B };
+            }).pipe(stack.deploy);
+            expect(output.A.string).toEqual("value-2");
+            expect(output.A.stableId).toEqual("stable-A");
+            expect((yield* getState("A"))?.status).toEqual("updated");
+            // B should not change since stableId is stable
+            expect((yield* getState("B"))?.status).toEqual("created");
+          }
+        }),
+    );
+
+    test.provider(
+      "downstream depends on non-stable property, should update",
+      (stack) =>
+        Effect.gen(function* () {
+          // Stage 1: Create A and B where B depends on A.string (non-stable)
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value-1",
+              });
+              const B = yield* TestResource("B", { string: A.string });
+              return { A, B };
+            }).pipe(stack.deploy);
+            expect(output.A.string).toEqual("value-1");
+            expect(output.B.string).toEqual("value-1");
+          }
+
+          // Stage 2: Change A's string - B should update
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value-2",
+              });
+              const B = yield* TestResource("B", { string: A.string });
+              return { A, B };
+            }).pipe(stack.deploy);
+            expect(output.A.string).toEqual("value-2");
+            expect(output.B.string).toEqual("value-2");
+            expect((yield* getState("A"))?.status).toEqual("updated");
+            expect((yield* getState("B"))?.status).toEqual("updated");
+          }
+        }),
+    );
+  });
+
+  describe("replace action with static stables", () => {
+    test.provider(
+      "upstream replaces, downstream depends on stableId - should update with new value",
+      (stack) =>
+        Effect.gen(function* () {
+          // Stage 1: Create A and B
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value",
+                replaceString: "original",
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              return { A, B };
+            }).pipe(stack.deploy);
+            expect(output.A.stableId).toEqual("stable-A");
+            expect(output.B.string).toEqual("stable-A");
+          }
+
+          // Stage 2: Replace A - stableId will change (new resource)
+          {
+            const output = yield* Effect.gen(function* () {
+              const A = yield* StaticStablesResource("A", {
+                string: "value",
+                replaceString: "changed",
+              });
+              const B = yield* TestResource("B", { string: A.stableId });
+              return { A, B };
+            }).pipe(stack.deploy);
+            // A was replaced, stableId is regenerated
+            expect(output.A.stableId).toEqual("stable-A");
+            expect(output.B.string).toEqual("stable-A");
+            expect((yield* getState("A"))?.status).toEqual("created");
+            expect((yield* getState("B"))?.status).toEqual("updated");
+          }
+        }),
+    );
+  });
+});
+
+describe("Redacted props/outputs survive deploy", () => {
+  test.provider(
+    "preserves a Redacted prop end-to-end through create",
+    (stack) =>
+      Effect.gen(function* () {
+        const secret = Redacted.make("hunter2");
+        const created = yield* Effect.gen(function* () {
+          return yield* TestResource("A", {
+            string: "x",
+            redacted: secret,
+          });
+        }).pipe(stack.deploy);
+
+        expect(Redacted.isRedacted(created.redacted)).toBe(true);
+        expect(Redacted.value(created.redacted!)).toBe("hunter2");
+
+        const state = yield* getState("A");
+        expect(state).toBeDefined();
+        expect(Redacted.isRedacted((state!.props as any).redacted)).toBe(true);
+        expect(Redacted.value((state!.props as any).redacted)).toBe("hunter2");
+        expect(Redacted.isRedacted((state!.attr as any).redacted)).toBe(true);
+        expect(Redacted.value((state!.attr as any).redacted)).toBe("hunter2");
+      }),
+  );
+
+  test.provider(
+    "preserves Redacted values nested inside an array end-to-end",
+    (stack) =>
+      Effect.gen(function* () {
+        const created = yield* Effect.gen(function* () {
+          return yield* TestResource("A", {
+            string: "x",
+            redactedArray: [Redacted.make("a"), Redacted.make("b")],
+          });
+        }).pipe(stack.deploy);
+
+        expect(created.redactedArray).toBeDefined();
+        expect(created.redactedArray!.length).toBe(2);
+        expect(Redacted.isRedacted(created.redactedArray![0]!)).toBe(true);
+        expect(Redacted.value(created.redactedArray![0]!)).toBe("a");
+        expect(Redacted.isRedacted(created.redactedArray![1]!)).toBe(true);
+        expect(Redacted.value(created.redactedArray![1]!)).toBe("b");
+      }),
+  );
+
+  test.provider(
+    "preserves a Redacted output flowing into a downstream resource prop",
+    (stack) =>
+      Effect.gen(function* () {
+        const output = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", {
+            string: "x",
+            redacted: Redacted.make("hunter2"),
+          });
+          const B = yield* TestResource("B", {
+            string: "y",
+            redacted: A.redacted as any,
+          });
+          return { A, B };
+        }).pipe(stack.deploy);
+
+        expect(Redacted.isRedacted(output.B.redacted)).toBe(true);
+        expect(Redacted.value(output.B.redacted!)).toBe("hunter2");
+
+        const bState = yield* getState("B");
+        expect(Redacted.isRedacted((bState!.props as any).redacted)).toBe(true);
+        expect(Redacted.value((bState!.props as any).redacted)).toBe("hunter2");
+        expect(Redacted.isRedacted((bState!.attr as any).redacted)).toBe(true);
+        expect(Redacted.value((bState!.attr as any).redacted)).toBe("hunter2");
+      }),
+  );
+
+  test.provider(
+    "no-op redeploy when only Redacted prop is present and value unchanged",
+    (stack) =>
+      Effect.gen(function* () {
+        const first = yield* Effect.gen(function* () {
+          return yield* TestResource("A", {
+            string: "x",
+            redacted: Redacted.make("hunter2"),
+          });
+        }).pipe(stack.deploy);
+        expect(Redacted.value(first.redacted!)).toBe("hunter2");
+
+        const before = yield* getState("A");
+
+        yield* Effect.gen(function* () {
+          return yield* TestResource("A", {
+            string: "x",
+            redacted: Redacted.make("hunter2"),
+          });
+        }).pipe(stack.deploy);
+
+        const after = yield* getState("A");
+        expect(after?.status).toBe("created");
+        expect((before as any).updatedAt ?? null).toEqual(
+          (after as any).updatedAt ?? null,
+        );
+        expect(Redacted.value((after!.attr as any).redacted)).toBe("hunter2");
+      }),
+  );
+
+  test.provider("update redeploy when Redacted prop value changes", (stack) =>
+    Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        return yield* TestResource("A", {
+          string: "x",
+          redacted: Redacted.make("old"),
+        });
+      }).pipe(stack.deploy);
+
+      const updated = yield* Effect.gen(function* () {
+        return yield* TestResource("A", {
+          string: "x",
+          redacted: Redacted.make("new"),
+        });
+      }).pipe(stack.deploy);
+
+      expect(Redacted.isRedacted(updated.redacted)).toBe(true);
+      expect(Redacted.value(updated.redacted!)).toBe("new");
+      const state = yield* getState("A");
+      expect(state?.status).toBe("updated");
+      expect(Redacted.value((state!.attr as any).redacted)).toBe("new");
+    }),
+  );
+});
+
+describe("stack output persistence", () => {
+  const getStackOutput = (stack: string, stage: string) =>
+    Effect.gen(function* () {
+      const state = yield* yield* State;
+      return yield* state.getOutput({ stack, stage });
+    });
+
+  test.provider(
+    "apply persists the resolved stack output via state.setOutput",
+    (stack) =>
+      Effect.gen(function* () {
+        const result = yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "hello" });
+          return { url: A.string };
+        }).pipe(stack.deploy);
+        expect(result).toEqual({ url: "hello" });
+
+        const persisted = yield* getStackOutput(stack.name, "test").pipe(
+          Effect.provide(stack.state),
+        );
+        expect(persisted).toEqual({ url: "hello" });
+      }),
+  );
+
+  test.provider(
+    "redeploys overwrite the persisted stack output with the new value",
+    (stack) =>
+      Effect.gen(function* () {
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "v1" });
+          return { url: A.string };
+        }).pipe(stack.deploy);
+
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "v2" });
+          return { url: A.string };
+        }).pipe(stack.deploy);
+
+        const persisted = yield* getStackOutput(stack.name, "test").pipe(
+          Effect.provide(stack.state),
+        );
+        expect(persisted).toEqual({ url: "v2" });
+      }),
+  );
+
+  test.provider(
+    "another stack can read the persisted output via Output.stackRef",
+    (stack) =>
+      Effect.gen(function* () {
+        // First deploy: write the stack output we'll later reference.
+        yield* Effect.gen(function* () {
+          const A = yield* TestResource("A", { string: "shared" });
+          return { url: A.string };
+        }).pipe(stack.deploy);
+
+        // Second deploy: a downstream resource consumes the previously
+        // persisted stack output via Output.stackRef. The deploy
+        // succeeds because state.getOutput finds it.
+        const result = yield* Effect.gen(function* () {
+          const upstream = yield* Output.stackRef<{ url: string }>(stack.name);
+          const B = yield* TestResource("B", {
+            string: (upstream as any).url,
+          });
+          return { downstream: B.string };
+        }).pipe(stack.deploy);
+
+        expect(result).toEqual({ downstream: "shared" });
+      }),
+  );
+});
+
+describe("Duration round-trip through state", () => {
+  test.provider(
+    "input Duration reaches reconcile as a real Duration and output Duration re-hydrates as a real Duration on the next deploy",
+    (stack) =>
+      Effect.gen(function* () {
+        const first = yield* stack.deploy(
+          DurationResource("Timer", { timeout: Duration.seconds(15) }),
+        );
+
+        // Reconcile saw a real Duration: arithmetic worked.
+        expect(Duration.isDuration(first.observedTimeout)).toBe(true);
+        expect(Duration.toMillis(first.observedTimeout)).toBe(15_000);
+        expect(Duration.isDuration(first.computedTimeout)).toBe(true);
+        expect(Duration.toMillis(first.computedTimeout)).toBe(16_000);
+
+        // Second deploy: identical props. The engine reads the previous
+        // output from state. If the Duration weren't revived, `output`
+        // (a plain `{_id,_tag,millis}` shape) would fail `isDuration` and
+        // `Duration.toMillis` would throw.
+        const second = yield* stack.deploy(
+          DurationResource("Timer", { timeout: Duration.seconds(15) }),
+        );
+        expect(Duration.isDuration(second.observedTimeout)).toBe(true);
+        expect(Duration.toMillis(second.observedTimeout)).toBe(15_000);
+        expect(Duration.isDuration(second.computedTimeout)).toBe(true);
+        expect(Duration.toMillis(second.computedTimeout)).toBe(16_000);
+
+        // The persisted state itself should round-trip to a real Duration.
+        const persisted = yield* getState<{
+          attr: DurationResource["Attributes"];
+        }>("Timer");
+        expect(Duration.isDuration(persisted.attr.computedTimeout)).toBe(true);
+        expect(Duration.toMillis(persisted.attr.computedTimeout)).toBe(16_000);
+      }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/plan.test.ts b/.repos/alchemy-effect/packages/alchemy/test/plan.test.ts
new file mode 100644
index 00000000000..67d434dde15
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/plan.test.ts
@@ -0,0 +1,2881 @@
+import { AdoptPolicy, Unowned } from "@/AdoptPolicy";
+import * as Construct from "@/Construct";
+import { dedupeBindings } from "@/Diff";
+import type { Input, InputProps } from "@/Input";
+import * as Output from "@/Output";
+import * as Plan from "@/Plan";
+import { UnsatisfiedResourceCycle } from "@/Plan";
+import type { ResourceBinding } from "@/Resource";
+import * as Stack from "@/Stack";
+import { Stage } from "@/Stage";
+import {
+  InMemoryService,
+  inMemoryState,
+  State,
+  type ResourceState,
+  type ResourceStatus,
+} from "@/State";
+import * as Test from "@/Test/Vitest";
+import { describe, expect } from "@effect/vitest";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+import {
+  ArtifactProbe,
+  BindingTarget,
+  Bucket,
+  Function,
+  NoPrecreateBindingTarget,
+  Queue,
+  TestLayers,
+  TestResource,
+  TestResourceHooks,
+  type TestResourceProps,
+} from "./test.resources";
+
+const TEST_STACK = "test";
+const TEST_STAGE = "test";
+
+// Fresh in-memory state per test run so seeded resources from one test
+// don't leak into another in the same file.
+const freshState = Layer.effect(
+  State,
+  Effect.sync(() => InMemoryService({})),
+);
+
+const { test } = Test.make({
+  providers: TestLayers(),
+  state: freshState,
+});
+
+// Resolve stack name/stage from ambient Stack if present (for test.provider)
+// otherwise fall back to the file-level defaults (for plain test()).
+const resolveStackId = Effect.gen(function* () {
+  const ambient = yield* Effect.serviceOption(Stack.Stack);
+  return Option.match(ambient, {
+    onNone: () => ({ name: TEST_STACK, stage: TEST_STAGE }),
+    onSome: (s) => ({ name: s.name, stage: s.stage }),
+  });
+});
+
+const seed = (resources: Record<string, ResourceState>) =>
+  Effect.gen(function* () {
+    const { name, stage } = yield* resolveStackId;
+    const state = yield* yield* State;
+    for (const [fqn, value] of Object.entries(resources)) {
+      yield* state.set({ stack: name, stage, fqn, value });
+    }
+  });
+
+const instanceId = "852f6ec2e19b66589825efe14dca2971";
+
+const makePlan = <A, Err = never, Req = never>(
+  effect: Effect.Effect<A, Err, Req>,
+  options?: Plan.MakePlanOptions,
+): Effect.Effect<Plan.Plan<A>, Err, State> =>
+  // @ts-expect-error - Stack.make's typing erases R unsoundly here
+  Effect.gen(function* () {
+    const { name, stage } = yield* resolveStackId;
+    // @ts-expect-error
+    return yield* effect.pipe(
+      // @ts-expect-error
+      Stack.make({
+        name,
+        providers: Layer.empty,
+        state: inMemoryState(),
+      }),
+      Effect.provideService(Stage, stage),
+      Effect.flatMap((stackSpec: any) => Plan.make(stackSpec, options)),
+      Effect.provide(TestLayers()),
+    );
+  });
+
+const makePlanWithCustomStack =
+  (stackSpec: any) =>
+  <A, Err = never, Req = never>(
+    effect: Effect.Effect<A, Err, Req>,
+  ): Effect.Effect<Plan.Plan<A>, Err, State> =>
+    // @ts-expect-error
+    Effect.gen(function* () {
+      const { name, stage } = yield* resolveStackId;
+      // @ts-expect-error
+      return yield* effect.pipe(
+        // @ts-expect-error
+        Stack.make({
+          name,
+          providers: Layer.empty,
+          state: inMemoryState(),
+          stack: stackSpec,
+        }),
+        Effect.provideService(Stage, stage),
+        Effect.flatMap(Plan.make),
+        Effect.provide(TestLayers()),
+      );
+    });
+
+test(
+  "artifacts are isolated by FQN during plan diff for namespaced resources",
+  Effect.gen(function* () {
+    yield* seed({
+      "Left/Shared": {
+        instanceId: "left-instance",
+        providerVersion: 0,
+        logicalId: "Shared",
+        fqn: "Left/Shared",
+        namespace: { Id: "Left" },
+        resourceType: "Test.ArtifactProbe",
+        status: "created",
+        props: {
+          value: "left-v1",
+        },
+        attr: {
+          value: "left-v1",
+          artifactValue: undefined,
+        },
+        bindings: [],
+        downstream: [],
+      },
+      "Right/Shared": {
+        instanceId: "right-instance",
+        providerVersion: 0,
+        logicalId: "Shared",
+        fqn: "Right/Shared",
+        namespace: { Id: "Right" },
+        resourceType: "Test.ArtifactProbe",
+        status: "created",
+        props: {
+          value: "right-v1",
+        },
+        attr: {
+          value: "right-v1",
+          artifactValue: undefined,
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    const Site = Construct.fn(function* (
+      _id: string,
+      props: { value: string },
+    ) {
+      return yield* ArtifactProbe("Shared", { value: props.value });
+    });
+
+    const plan = yield* Effect.gen(function* () {
+      const left = yield* Site("Left", { value: "left-v2" });
+      const right = yield* Site("Right", { value: "right-v2" });
+      return { left, right };
+    }).pipe(makePlan);
+
+    expect(plan.resources["Left/Shared"]?.action).toEqual("update");
+    expect(plan.resources["Right/Shared"]?.action).toEqual("update");
+  }),
+);
+
+test(
+  "create all resources when plan is empty",
+  Effect.gen(function* () {
+    expect(
+      yield* Effect.gen(function* () {
+        const bucket = yield* Bucket("MyBucket", {
+          name: "test-bucket",
+        });
+        const queue = yield* Queue("MyQueue", {
+          name: "test-queue",
+        });
+
+        return {
+          queueUrl: queue.queueUrl,
+          bucketArn: bucket.bucketArn,
+        };
+      }).pipe(makePlan),
+    ).toMatchObject({
+      resources: {
+        MyBucket: {
+          action: "create",
+          bindings: [],
+          props: {
+            name: "test-bucket",
+          },
+          state: undefined,
+        },
+        MyQueue: {
+          action: "create",
+          bindings: [],
+          props: {
+            name: "test-queue",
+          },
+          state: undefined,
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "update the changed resources and no-op un-changed resources",
+  Effect.gen(function* () {
+    yield* seed({
+      MyBucket: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyBucket",
+        fqn: "MyBucket",
+        namespace: undefined,
+        resourceType: "Test.Bucket",
+        status: "created",
+        props: {
+          name: "test-bucket",
+        },
+        attr: {
+          name: "test-bucket",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* makePlan(
+        Effect.gen(function* () {
+          yield* Bucket("MyBucket", {
+            name: "test-bucket",
+          });
+          yield* Queue("MyQueue", {
+            name: "test-queue",
+          });
+        }),
+      ),
+    ).toMatchObject({
+      resources: {
+        MyBucket: {
+          action: "noop",
+          bindings: [],
+          state: {
+            status: "created",
+          },
+        },
+        MyQueue: {
+          action: "create",
+          bindings: [],
+          props: {
+            name: "test-queue",
+          },
+          state: undefined,
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "force changes noop resources into updates",
+  Effect.gen(function* () {
+    yield* seed({
+      MyBucket: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyBucket",
+        fqn: "MyBucket",
+        namespace: undefined,
+        resourceType: "Test.Bucket",
+        status: "created",
+        props: {
+          name: "test-bucket",
+        },
+        attr: {
+          name: "test-bucket",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* makePlan(
+        Effect.gen(function* () {
+          yield* Bucket("MyBucket", {
+            name: "test-bucket",
+          });
+        }),
+        { force: true },
+      ),
+    ).toMatchObject({
+      resources: {
+        MyBucket: {
+          action: "update",
+          bindings: [],
+          props: {
+            name: "test-bucket",
+          },
+          state: {
+            status: "created",
+          },
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "no-op resources with undefined props",
+  Effect.gen(function* () {
+    yield* seed({
+      MyQueue: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyQueue",
+        fqn: "MyQueue",
+        namespace: undefined,
+        resourceType: "Test.Queue",
+        status: "created",
+        props: undefined as any,
+        attr: {
+          name: "MyQueue",
+          queueUrl: "https://test.queue.com/MyQueue",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* makePlan(
+        Effect.gen(function* () {
+          yield* Queue("MyQueue");
+        }),
+      ),
+    ).toMatchObject({
+      resources: {
+        MyQueue: {
+          action: "noop",
+          bindings: [],
+          state: {
+            status: "created",
+          },
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "no-op resources when object prop key order changes",
+  Effect.gen(function* () {
+    yield* seed({
+      MyFunction: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyFunction",
+        fqn: "MyFunction",
+        namespace: undefined,
+        resourceType: "Test.Function",
+        status: "created",
+        props: {
+          name: "test-function",
+          env: {
+            A: "1",
+            B: "2",
+          },
+        },
+        attr: {
+          name: "test-function",
+          env: {
+            A: "1",
+            B: "2",
+          },
+          functionArn: "arn:test:function:MyFunction",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* makePlan(
+        Effect.gen(function* () {
+          yield* Function("MyFunction", {
+            name: "test-function",
+            env: {
+              B: "2",
+              A: "1",
+            },
+          });
+        }),
+      ),
+    ).toMatchObject({
+      resources: {
+        MyFunction: {
+          action: "noop",
+          bindings: [],
+          state: {
+            status: "created",
+          },
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "delete orphaned resources",
+  Effect.gen(function* () {
+    yield* seed({
+      MyBucket: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyBucket",
+        fqn: "MyBucket",
+        namespace: undefined,
+        resourceType: "Test.Bucket",
+        status: "created",
+        props: {
+          name: "test-bucket",
+        },
+        attr: {
+          name: "test-bucket",
+        },
+        bindings: [],
+        downstream: [],
+      },
+      MyQueue: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyQueue",
+        fqn: "MyQueue",
+        namespace: undefined,
+        resourceType: "Test.Queue",
+        status: "created",
+        props: {
+          name: "test-queue",
+        },
+        attr: {
+          name: "test-queue",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* makePlan(
+        Effect.gen(function* () {
+          yield* Queue("MyQueue", {
+            name: "test-queue",
+          });
+        }),
+      ),
+    ).toMatchObject({
+      resources: {
+        MyQueue: {
+          action: "noop",
+          bindings: [],
+          state: {
+            status: "created",
+          },
+        },
+      },
+      deletions: {
+        MyBucket: {
+          action: "delete",
+          bindings: [],
+          state: {
+            status: "created",
+            attr: {
+              name: "test-bucket",
+            },
+          },
+          resource: {
+            LogicalId: "MyBucket",
+            Type: "Test.Bucket",
+            Props: {
+              name: "test-bucket",
+            },
+          },
+        },
+      },
+    });
+  }),
+);
+
+test(
+  "allow deleting a resource after a surviving consumer removes the dependency",
+  Effect.gen(function* () {
+    yield* seed({
+      Secret: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "Secret",
+        fqn: "Secret",
+        namespace: undefined,
+        resourceType: "Test.TestResource",
+        status: "created",
+        props: {
+          string: "secret-value",
+        },
+        attr: {
+          string: "secret-value",
+          stringArray: [],
+          stableString: "Secret",
+          stableArray: ["Secret"],
+          replaceString: undefined,
+        },
+        bindings: [],
+        downstream: ["Worker"],
+      },
+      Worker: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "Worker",
+        fqn: "Worker",
+        namespace: undefined,
+        resourceType: "Test.Function",
+        status: "created",
+        props: {
+          name: "worker",
+          env: {
+            SECRET: "secret-value",
+          },
+        },
+        attr: {
+          name: "worker",
+          env: {
+            SECRET: "secret-value",
+          },
+          functionArn: "arn:aws:lambda:us-west-2:084828582823:function:Worker",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* makePlan(
+        Effect.gen(function* () {
+          yield* Function("Worker", {
+            name: "worker",
+          });
+        }),
+      ),
+    ).toMatchObject({
+      resources: {
+        Worker: {
+          action: "update",
+          props: {
+            name: "worker",
+          },
+          bindings: [],
+        },
+      },
+      deletions: {
+        Secret: {
+          action: "delete",
+          state: {
+            status: "created",
+            downstream: ["Worker"],
+          },
+        },
+      },
+    });
+  }),
+);
+
+test(
+  "reject deleting a resource when a surviving consumer still references it",
+  Effect.gen(function* () {
+    yield* seed({
+      Secret: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "Secret",
+        fqn: "Secret",
+        namespace: undefined,
+        resourceType: "Test.TestResource",
+        status: "created",
+        props: {
+          string: "secret-value",
+        },
+        attr: {
+          string: "secret-value",
+          stringArray: [],
+          stableString: "Secret",
+          stableArray: ["Secret"],
+          replaceString: undefined,
+        },
+        bindings: [],
+        downstream: ["Worker"],
+      },
+      Worker: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "Worker",
+        fqn: "Worker",
+        namespace: undefined,
+        resourceType: "Test.Function",
+        status: "created",
+        props: {
+          name: "worker",
+          env: {
+            SECRET: "secret-value",
+          },
+        },
+        attr: {
+          name: "worker",
+          env: {
+            SECRET: "secret-value",
+          },
+          functionArn: "arn:aws:lambda:us-west-2:084828582823:function:Worker",
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    const malformedStack = {
+      name: TEST_STACK,
+      stage: TEST_STAGE,
+      resources: {},
+      bindings: {},
+      output: undefined,
+    };
+
+    const exit = yield* Effect.exit(
+      Effect.gen(function* () {
+        const secret = yield* TestResource("Secret", {
+          string: "secret-value",
+        });
+        yield* Function("Worker", {
+          name: "worker",
+          env: {
+            SECRET: secret.string,
+          },
+        });
+        const stack = yield* Stack.Stack;
+        delete stack.resources.Secret;
+      }).pipe(makePlanWithCustomStack(malformedStack)),
+    );
+
+    expect(Exit.isFailure(exit)).toBe(true);
+    if (Exit.isFailure(exit)) {
+      const reason = exit.cause.reasons.find(Cause.isFailReason);
+      expect(reason).toBeDefined();
+      expect(reason!.error).toEqual(
+        new Plan.DeleteResourceHasDownstreamDependencies({
+          message: "Resource Secret has downstream dependencies",
+          resourceId: "Secret",
+          dependencies: ["Worker"],
+        }),
+      );
+    }
+  }),
+);
+
+describe("replace resource when replaceString changes", () => {
+  const stateResources: Record<string, ResourceState> = {
+    A: {
+      instanceId,
+      providerVersion: 0,
+      logicalId: "A",
+      fqn: "A",
+      namespace: undefined,
+      resourceType: "Test.TestResource",
+      status: "created",
+      props: {
+        replaceString: "A",
+      },
+      attr: {},
+      downstream: [],
+      bindings: [],
+    },
+  };
+
+  test(
+    "noop and replace when replaceString is fully resolved at plan time",
+    Effect.gen(function* () {
+      yield* seed(stateResources);
+      expect(
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "A",
+          });
+        }).pipe(makePlan),
+      ).toMatchObject({
+        resources: {
+          A: {
+            action: "noop",
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+
+      expect(
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "B",
+          });
+        }).pipe(makePlan),
+      ).toMatchObject({
+        resources: {
+          A: {
+            action: "replace",
+            props: {
+              replaceString: "B",
+            },
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+    }),
+  );
+
+  test(
+    "force preserves replaces",
+    Effect.gen(function* () {
+      yield* seed(stateResources);
+      expect(
+        yield* Effect.gen(function* () {
+          yield* TestResource("A", {
+            replaceString: "B",
+          });
+        }).pipe((effect) => makePlan(effect, { force: true })),
+      ).toMatchObject({
+        resources: {
+          A: {
+            action: "replace",
+            props: {
+              replaceString: "B",
+            },
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+    }),
+  );
+
+  test(
+    "update when replaceString depends on unresolved output (diff short-circuits)",
+    Effect.gen(function* () {
+      yield* seed(stateResources);
+      let B: TestResource;
+      expect(
+        yield* Effect.gen(function* () {
+          B = yield* TestResource("B", {
+            string: "A",
+          });
+          yield* TestResource("A", {
+            replaceString: B.string,
+          });
+        }).pipe(makePlan),
+      ).toMatchObject({
+        resources: {
+          A: {
+            action: "update",
+            props: {
+              replaceString: expect.objectContaining({
+                kind: "PropExpr",
+                identifier: "string",
+                expr: expect.objectContaining({
+                  kind: "ResourceExpr",
+                  src: B!,
+                }),
+              }),
+            },
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+    }),
+  );
+});
+
+test(
+  "update resource when a binding is added without prop changes",
+  Effect.gen(function* () {
+    yield* seed({
+      A: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "A",
+        fqn: "A",
+        namespace: undefined,
+        resourceType: "Test.BindingTarget",
+        status: "created",
+        props: {
+          name: "target",
+        },
+        attr: {
+          name: "target",
+          env: {},
+        },
+        bindings: [],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* Effect.gen(function* () {
+        const target = yield* BindingTarget("A", {
+          name: "target",
+        });
+        yield* target.bind("TestBinding", {
+          env: {
+            FEATURE_FLAG: "on",
+          },
+        });
+      }).pipe(makePlan),
+    ).toMatchObject({
+      resources: {
+        A: {
+          action: "update",
+          bindings: [
+            {
+              action: "create",
+              sid: "TestBinding",
+              data: {
+                env: {
+                  FEATURE_FLAG: "on",
+                },
+              },
+            },
+          ],
+          state: {
+            status: "created",
+          },
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "update resource when a binding is removed without prop changes",
+  Effect.gen(function* () {
+    yield* seed({
+      A: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "A",
+        fqn: "A",
+        namespace: undefined,
+        resourceType: "Test.BindingTarget",
+        status: "created",
+        props: {
+          name: "target",
+        },
+        attr: {
+          name: "target",
+          env: {
+            FEATURE_FLAG: "on",
+          },
+        },
+        bindings: [
+          {
+            sid: "TestBinding",
+            data: {
+              env: {
+                FEATURE_FLAG: "on",
+              },
+            },
+          },
+        ],
+        downstream: [],
+      },
+    });
+    expect(
+      yield* Effect.gen(function* () {
+        yield* BindingTarget("A", {
+          name: "target",
+        });
+      }).pipe(makePlan),
+    ).toMatchObject({
+      resources: {
+        A: {
+          action: "update",
+          bindings: [
+            {
+              action: "delete",
+              sid: "TestBinding",
+              data: {
+                env: {
+                  FEATURE_FLAG: "on",
+                },
+              },
+            },
+          ],
+          state: {
+            status: "created",
+          },
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test.provider(
+  "binding removals do not keep reappearing after apply",
+  (scratch) =>
+    Effect.gen(function* () {
+      const state = yield* yield* State;
+      yield* state.set({
+        stack: scratch.name,
+        stage: TEST_STAGE,
+        fqn: "A",
+        value: {
+          instanceId,
+          providerVersion: 0,
+          logicalId: "A",
+          fqn: "A",
+          namespace: undefined,
+          resourceType: "Test.BindingTarget",
+          status: "created",
+          props: {
+            name: "target",
+          },
+          attr: {
+            name: "target",
+            env: {
+              FEATURE_FLAG: "on",
+            },
+          },
+          bindings: [
+            {
+              sid: "TestBinding",
+              data: {
+                env: {
+                  FEATURE_FLAG: "on",
+                },
+              },
+            },
+          ],
+          downstream: [],
+        },
+      });
+
+      yield* scratch.deploy(
+        Effect.gen(function* () {
+          yield* BindingTarget("A", {
+            name: "target",
+          });
+        }),
+      );
+
+      expect(
+        yield* state.get({
+          stack: scratch.name,
+          stage: TEST_STAGE,
+          fqn: "A",
+        }),
+      ).toMatchObject({
+        bindings: [],
+      });
+
+      expect(
+        yield* Effect.gen(function* () {
+          yield* BindingTarget("A", {
+            name: "target",
+          });
+        }).pipe(makePlan),
+      ).toMatchObject({
+        resources: {
+          A: {
+            action: "noop",
+            bindings: [],
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+    }),
+);
+
+describe("duplicate bindings are collapsed by sid before diff", () => {
+  test(
+    "dedupeBindings keeps the last occurrence of each sid",
+    Effect.sync(() => {
+      const deduped = dedupeBindings([
+        { sid: "Shared", data: { env: { K: "first" } } },
+        { sid: "Other", data: { env: { K: "x" } } },
+        { sid: "Shared", data: { env: { K: "last" } } },
+      ]);
+
+      // The duplicated sid retains its first-seen position but takes the
+      // last value (matching `diffBindings`' `Map`-based collapse).
+      expect(deduped).toEqual([
+        { sid: "Shared", data: { env: { K: "last" } } },
+        { sid: "Other", data: { env: { K: "x" } } },
+      ]);
+    }),
+  );
+
+  test(
+    "diff observes a single binding when the same sid is bound twice",
+    Effect.gen(function* () {
+      yield* seed({
+        A: {
+          instanceId,
+          providerVersion: 0,
+          logicalId: "A",
+          fqn: "A",
+          namespace: undefined,
+          resourceType: "Test.BindingTarget",
+          status: "created",
+          props: {
+            name: "target",
+          },
+          attr: {
+            name: "target",
+            env: {},
+          },
+          bindings: [],
+          downstream: [],
+        },
+      });
+
+      // Capture the exact binding list the provider's `diff` receives.
+      const observed: ResourceBinding[][] = [];
+
+      const plan = yield* Effect.gen(function* () {
+        const target = yield* BindingTarget("A", {
+          name: "target",
+        });
+        // The same sid is recorded twice — mirrors a single KV namespace
+        // bound to two consumers that both attach it to the same target,
+        // which pushes a duplicate into `stack.bindings[fqn]`.
+        yield* target.bind("Shared", { env: { FEATURE_FLAG: "on" } });
+        yield* target.bind("Shared", { env: { FEATURE_FLAG: "on" } });
+      }).pipe(
+        makePlan,
+        Effect.provideService(TestResourceHooks, {
+          diff: (_id, newBindings) =>
+            Effect.sync(() => {
+              observed.push(newBindings);
+            }),
+        }),
+      );
+
+      // Before the fix, `diff` saw the raw duplicate pair (length 2) while
+      // `reconcile` saw a deduped list — an inconsistency that made hashing
+      // unstable. Every diff invocation must now see the collapsed list.
+      expect(observed.length).toBeGreaterThan(0);
+      for (const seen of observed) {
+        expect(seen).toHaveLength(1);
+        expect(seen[0]).toMatchObject({
+          sid: "Shared",
+          data: { env: { FEATURE_FLAG: "on" } },
+        });
+      }
+
+      // The plan node likewise collapses to a single create binding.
+      expect(plan.resources.A).toMatchObject({
+        action: "update",
+        bindings: [
+          {
+            action: "create",
+            sid: "Shared",
+            data: { env: { FEATURE_FLAG: "on" } },
+          },
+        ],
+      });
+    }),
+  );
+});
+
+describe("construct namespaces", () => {
+  test(
+    "namespaced construct bindings resolve into the plan graph",
+    Effect.gen(function* () {
+      const Site = Construct.fn(function* (_id: string, _props: {}) {
+        const bucket = yield* BindingTarget("Bucket", {
+          name: "bucket",
+        });
+        const distribution = yield* BindingTarget("Distribution", {
+          name: "distribution",
+        });
+        yield* bucket.bind("Policy", {
+          env: {
+            BUCKET: bucket.string,
+            DISTRIBUTION: distribution.string,
+          },
+        });
+        return { bucket, distribution };
+      });
+
+      const plan = yield* Effect.gen(function* () {
+        yield* Site("MarketingSite", {});
+      }).pipe(makePlan);
+
+      expect(plan).toMatchObject({
+        resources: {
+          "MarketingSite/Bucket": {
+            action: "create",
+            bindings: [
+              {
+                action: "create",
+                sid: "Policy",
+                data: {
+                  env: {
+                    BUCKET: expect.objectContaining({
+                      kind: "PropExpr",
+                      identifier: "string",
+                      expr: expect.objectContaining({
+                        kind: "ResourceExpr",
+                        src: plan.resources["MarketingSite/Bucket"]!.resource,
+                      }),
+                    }),
+                    DISTRIBUTION: expect.objectContaining({
+                      kind: "PropExpr",
+                      identifier: "string",
+                      expr: expect.objectContaining({
+                        kind: "ResourceExpr",
+                        src: plan.resources["MarketingSite/Distribution"]!
+                          .resource,
+                      }),
+                    }),
+                  },
+                },
+              },
+            ],
+          },
+          "MarketingSite/Distribution": {
+            action: "create",
+            bindings: [],
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+    }),
+  );
+
+  test(
+    "same child logical ids in different constructs do not collide",
+    Effect.gen(function* () {
+      const Site = Construct.fn(function* (
+        _id: string,
+        props: { name: string },
+      ) {
+        return yield* Bucket("Bucket", {
+          name: props.name,
+        });
+      });
+
+      const plan = yield* Effect.gen(function* () {
+        yield* Site("MarketingSite", {
+          name: "marketing-bucket",
+        });
+        yield* Site("DocsSite", {
+          name: "docs-bucket",
+        });
+      }).pipe(makePlan);
+
+      expect(plan).toMatchObject({
+        resources: {
+          "MarketingSite/Bucket": {
+            action: "create",
+            props: {
+              name: "marketing-bucket",
+            },
+          },
+          "DocsSite/Bucket": {
+            action: "create",
+            props: {
+              name: "docs-bucket",
+            },
+          },
+        },
+        deletions: expect.toSatisfy(
+          (d: any) => Object.keys(d).length === 0,
+          "empty object",
+        ),
+      });
+    }),
+  );
+
+  test(
+    "binding-only cycles inside a construct do not become downstream edges",
+    Effect.gen(function* () {
+      const Site = Construct.fn(function* (_id: string, _props: {}) {
+        const A = yield* BindingTarget("A", {
+          string: "a-value",
+        });
+        const B = yield* BindingTarget("B", {
+          string: "b-value",
+        });
+
+        yield* A.bind("FromB", {
+          env: {
+            PEER: B.string,
+          },
+        });
+        yield* B.bind("FromA", {
+          env: {
+            PEER: A.string,
+          },
+        });
+
+        return { A, B };
+      });
+
+      const plan = yield* Effect.gen(function* () {
+        yield* Site("MarketingSite", {});
+      }).pipe(makePlan);
+
+      expect(plan.resources["MarketingSite/A"]?.downstream).toEqual([]);
+      expect(plan.resources["MarketingSite/B"]?.downstream).toEqual([]);
+      expect(plan.deletions).toEqual({});
+    }),
+  );
+});
+
+const createTestResourceState = (options: {
+  logicalId: string;
+  status: ResourceStatus;
+  props: TestResourceProps;
+  attr?: {};
+}) =>
+  ({
+    instanceId,
+    providerVersion: 0,
+    ...options,
+    resourceType: "Test.TestResource",
+    attr: options.attr ?? {},
+    downstream: [],
+    bindings: [],
+    fqn: options.logicalId,
+    namespace: undefined,
+  }) as ResourceState;
+
+const createReplacingState = (options: {
+  logicalId: string;
+  props: TestResourceProps;
+  old: ResourceState;
+  attr?: {};
+}) =>
+  ({
+    ...createTestResourceState({
+      logicalId: options.logicalId,
+      status: "replacing",
+      props: options.props,
+      attr: options.attr,
+    }),
+    old: options.old,
+    deleteFirst: false,
+  }) as Extract<ResourceState, { status: "replacing" }>;
+
+const createReplacedState = (options: {
+  logicalId: string;
+  props: TestResourceProps;
+  old: ResourceState;
+  attr?: {};
+}) =>
+  ({
+    ...createTestResourceState({
+      logicalId: options.logicalId,
+      status: "replaced",
+      props: options.props,
+      attr: options.attr,
+    }),
+    old: options.old,
+    deleteFirst: false,
+  }) as Extract<ResourceState, { status: "replaced" }>;
+
+const testSimple = (
+  title: string,
+  testCase: {
+    state: {
+      status: ResourceStatus;
+      props: TestResourceProps;
+      attr?: {};
+      old?: Partial<ResourceState>;
+    };
+    props: TestResourceProps;
+    plan?: any;
+    fail?: string;
+  },
+) =>
+  test(
+    title,
+    Effect.gen(function* () {
+      yield* seed({
+        A: createTestResourceState({
+          ...testCase.state,
+          logicalId: "A",
+        }),
+      });
+      {
+        const plan = Effect.gen(function* () {
+          yield* TestResource("A", testCase.props);
+        }).pipe(makePlan);
+
+        if (testCase.fail) {
+          const result = plan.pipe(
+            Effect.map(() => false),
+            // @ts-expect-error
+            Effect.catchTag(testCase.fail, () => Effect.succeed(true)),
+            Effect.catch(() => Effect.succeed(false)),
+          ) as Effect.Effect<boolean>;
+          if (!result) {
+            expect.fail(`Expected error '${testCase.fail}`);
+          }
+        } else {
+          expect(yield* plan).toMatchObject({
+            resources: {
+              A: testCase.plan,
+            },
+            deletions: expect.toSatisfy(
+              (d: any) => Object.keys(d).length === 0,
+              "empty object",
+            ),
+          });
+        }
+      }
+    }),
+  );
+
+describe("prior crash in 'creating' state", () => {
+  testSimple("create if props unchanged", {
+    state: {
+      status: "creating",
+      props: {
+        string: "A",
+      },
+    },
+    props: {
+      string: "A",
+    },
+    plan: {
+      action: "create",
+      props: {
+        string: "A",
+      },
+    },
+  });
+
+  testSimple("create if changed props can be updated", {
+    state: {
+      status: "creating",
+      props: {
+        string: "A",
+      },
+    },
+    props: {
+      string: "B",
+    },
+    plan: {
+      action: "create",
+      props: {
+        string: "B",
+      },
+    },
+  });
+
+  testSimple("replace if changed props cannot be updated", {
+    state: {
+      status: "creating",
+      props: {
+        replaceString: "A",
+      },
+    },
+    props: {
+      replaceString: "B",
+    },
+    plan: {
+      action: "replace",
+      props: {
+        replaceString: "B",
+      },
+      state: {
+        status: "creating",
+        props: {
+          replaceString: "A",
+        },
+      },
+    },
+  });
+});
+
+describe("prior crash in 'updating' state", () => {
+  testSimple("update if props unchanged", {
+    state: {
+      status: "updating",
+      props: {
+        string: "A",
+      },
+    },
+    props: {
+      string: "A",
+    },
+    plan: {
+      action: "update",
+      props: {
+        string: "A",
+      },
+      state: {
+        status: "updating",
+        props: {
+          string: "A",
+        },
+      },
+    },
+  });
+
+  testSimple("update if changed props can be updated", {
+    state: {
+      status: "updating",
+      props: {
+        string: "A",
+      },
+    },
+    props: {
+      string: "B",
+    },
+    plan: {
+      action: "update",
+      props: {
+        string: "B",
+      },
+      state: {
+        status: "updating",
+        props: {
+          string: "A",
+        },
+      },
+    },
+  });
+
+  testSimple("replace if changed props can not be updated", {
+    state: {
+      status: "updating",
+      props: {
+        replaceString: "A",
+      },
+    },
+    props: {
+      replaceString: "B",
+    },
+    plan: {
+      action: "replace",
+      props: {
+        replaceString: "B",
+      },
+      state: {
+        status: "updating",
+        props: {
+          replaceString: "A",
+        },
+      },
+    },
+  });
+});
+
+describe("prior crash in 'replacing' state", () => {
+  const priorStates = ["created", "creating", "updated", "updating"] as const;
+
+  const testUnchanged = ({
+    old,
+  }: {
+    old: {
+      status: ResourceStatus;
+    };
+  }) =>
+    testSimple(
+      `"continue 'replace' if props are unchanged and previous state is '${old.status}'"`,
+      {
+        state: {
+          status: "replacing",
+          props: {
+            string: "A",
+          },
+          old,
+        },
+        props: {
+          string: "A",
+        },
+        plan: {
+          action: "replace",
+          props: {
+            string: "A",
+          },
+          state: {
+            status: "replacing",
+            props: {
+              string: "A",
+            },
+            old,
+          },
+        },
+      },
+    );
+
+  priorStates.forEach((status) =>
+    testUnchanged({
+      old: {
+        status,
+      },
+    }),
+  );
+
+  const testMinorChange = ({
+    old,
+  }: {
+    old: {
+      status: ResourceStatus;
+    };
+  }) =>
+    testSimple(
+      `"continue 'replace' if props can be updated and previous state is '${old.status}'"`,
+      {
+        state: {
+          status: "replacing",
+          props: {
+            string: "A",
+          },
+          old,
+        },
+        props: {
+          string: "B",
+        },
+        plan: {
+          action: "replace",
+          props: {
+            string: "B",
+          },
+          state: {
+            status: "replacing",
+            props: {
+              string: "A",
+            },
+            old,
+          },
+        },
+      },
+    );
+
+  priorStates.forEach((status) =>
+    testMinorChange({
+      old: {
+        status,
+      },
+    }),
+  );
+
+  const testReplacement = (
+    title: string,
+    {
+      old,
+      plan,
+    }: {
+      old: ResourceState;
+      plan: any;
+    },
+  ) =>
+    testSimple(title, {
+      state: {
+        status: "replacing",
+        props: {
+          replaceString: "A",
+        },
+        old,
+      },
+      props: {
+        replaceString: "B",
+      },
+      plan,
+    });
+
+  (["replaced", "replacing"] as const).forEach((status) =>
+    testReplacement(
+      `continue 'replace' if trying to replace a partially replaced resource in state '${status}'`,
+      {
+        old:
+          status === "replaced"
+            ? createReplacedState({
+                logicalId: "A_old1",
+                props: {
+                  replaceString: "A1",
+                },
+                old: createTestResourceState({
+                  logicalId: "A_old0",
+                  status: "created",
+                  props: {
+                    replaceString: "A0",
+                  },
+                }),
+              })
+            : createReplacingState({
+                logicalId: "A_old1",
+                props: {
+                  replaceString: "A1",
+                },
+                old: createTestResourceState({
+                  logicalId: "A_old0",
+                  status: "created",
+                  props: {
+                    replaceString: "A0",
+                  },
+                }),
+              }),
+        plan: {
+          action: "replace",
+          props: {
+            replaceString: "B",
+          },
+          state: {
+            status: "replacing",
+            props: {
+              replaceString: "A",
+            },
+            old: expect.objectContaining({
+              status,
+              props: {
+                replaceString: "A1",
+              },
+              old: expect.objectContaining({
+                status: "created",
+                props: {
+                  replaceString: "A0",
+                },
+              }),
+            }),
+          },
+        },
+      },
+    ),
+  );
+});
+
+describe("prior crash in 'replaced' state", () => {
+  (["replaced", "replacing"] as const).forEach((status) =>
+    testSimple(
+      `continue 'replace' if a replaced resource must be replaced again and previous state is '${status}'`,
+      {
+        state: {
+          status: "replaced",
+          props: {
+            replaceString: "A1",
+          },
+          old:
+            status === "replaced"
+              ? createReplacedState({
+                  logicalId: "A_old0",
+                  props: {
+                    replaceString: "A0",
+                  },
+                  old: createTestResourceState({
+                    logicalId: "A_old-1",
+                    status: "created",
+                    props: {
+                      replaceString: "A-1",
+                    },
+                  }),
+                })
+              : createReplacingState({
+                  logicalId: "A_old0",
+                  props: {
+                    replaceString: "A0",
+                  },
+                  old: createTestResourceState({
+                    logicalId: "A_old-1",
+                    status: "created",
+                    props: {
+                      replaceString: "A-1",
+                    },
+                  }),
+                }),
+        },
+        props: {
+          replaceString: "B",
+        },
+        plan: {
+          action: "replace",
+          props: {
+            replaceString: "B",
+          },
+          state: {
+            status: "replaced",
+            props: {
+              replaceString: "A1",
+            },
+            old: expect.objectContaining({
+              status,
+              props: {
+                replaceString: "A0",
+              },
+              old: expect.objectContaining({
+                status: "created",
+                props: {
+                  replaceString: "A-1",
+                },
+              }),
+            }),
+          },
+        },
+      },
+    ),
+  );
+});
+
+describe("prior crash in 'deleting' state", () => {
+  testSimple(
+    "create the resource if props are unchanged and the previous state is 'deleting'",
+    {
+      state: {
+        status: "deleting",
+        props: {
+          string: "A",
+        },
+      },
+      props: {
+        string: "A",
+      },
+      plan: {
+        action: "create",
+        props: {
+          string: "A",
+        },
+      },
+    },
+  );
+});
+
+test(
+  "lazy Output queue.queueUrl to Function.env",
+  Effect.gen(function* () {
+    let MyQueue: Queue;
+    let MyFunction: Function;
+    const plan = yield* Effect.gen(function* () {
+      MyQueue = yield* Queue("MyQueue");
+      MyFunction = yield* Function("MyFunction", {
+        name: "test-function",
+        env: {
+          QUEUE_URL: MyQueue.queueUrl,
+        },
+      });
+    }).pipe(makePlan);
+    expect(plan).toMatchObject({
+      resources: {
+        MyFunction: {
+          action: "create",
+          bindings: [],
+          resource: MyFunction!,
+          props: {
+            name: "test-function",
+            env: {
+              QUEUE_URL: expect.objectContaining({
+                kind: "PropExpr",
+                identifier: "queueUrl",
+                expr: expect.objectContaining({
+                  kind: "ResourceExpr",
+                  src: MyQueue!,
+                }),
+              }),
+            },
+          },
+          state: undefined,
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+test(
+  "detect that queueUrl will change and pass through the PropExpr instead of old output",
+  Effect.gen(function* () {
+    yield* seed({
+      MyQueue: {
+        instanceId,
+        providerVersion: 0,
+        logicalId: "MyQueue",
+        fqn: "MyQueue",
+        namespace: undefined,
+        resourceType: "Test.Queue",
+        status: "created",
+        props: {
+          name: "test-queue-old",
+        },
+        attr: {
+          queueUrl: "https://test.queue.com/test-queue-old",
+        },
+        downstream: [],
+        bindings: [],
+      },
+    });
+    let MyQueue: Queue;
+    let MyFunction: Function;
+    const plan = yield* Effect.gen(function* () {
+      MyQueue = yield* Queue("MyQueue");
+      MyFunction = yield* Function("MyFunction", {
+        name: "test-function",
+        env: {
+          QUEUE_URL: MyQueue.queueUrl,
+        },
+      });
+    }).pipe(makePlan);
+    expect(plan).toMatchObject({
+      resources: {
+        MyFunction: {
+          action: "create",
+          bindings: [],
+          resource: MyFunction!,
+          props: {
+            name: "test-function",
+            env: {
+              QUEUE_URL: expect.objectContaining({
+                kind: "PropExpr",
+                identifier: "queueUrl",
+                expr: expect.objectContaining({
+                  kind: "ResourceExpr",
+                  src: MyQueue!,
+                }),
+              }),
+            },
+          },
+          state: undefined,
+        },
+      },
+      deletions: expect.toSatisfy(
+        (d: any) => Object.keys(d).length === 0,
+        "empty object",
+      ),
+    });
+  }),
+);
+
+describe("Outputs should resolve to old values", () => {
+  const stateResources: Record<string, ResourceState> = {
+    A: {
+      instanceId,
+      providerVersion: 0,
+      logicalId: "A",
+      fqn: "A",
+      namespace: undefined,
+      resourceType: "Test.TestResource",
+      status: "created",
+      props: {
+        string: "test-string",
+        stringArray: ["test-string"],
+      },
+      attr: {
+        string: "test-string",
+        stringArray: ["test-string"],
+      },
+      downstream: [],
+      bindings: [],
+    },
+  };
+
+  const expected = (props: Input.Resolve<InputProps<TestResourceProps>>) => ({
+    resources: {
+      A: {
+        action: "noop",
+        bindings: [],
+      },
+      B: {
+        action: "create",
+        bindings: [],
+        props: props,
+      },
+    },
+    deletions: expect.toSatisfy(
+      (d: any) => Object.keys(d).length === 0,
+      "empty object",
+    ),
+  });
+
+  const subtest = <const I extends InputProps<TestResourceProps>>(
+    description: string,
+    input: (resource: TestResource) => I,
+    attr: Input.Resolve<I>,
+  ) =>
+    test(
+      description,
+      Effect.gen(function* () {
+        yield* seed(stateResources);
+        expect(
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "test-string",
+              stringArray: ["test-string"],
+            });
+            yield* TestResource("B", input(A));
+          }).pipe(makePlan),
+        ).toMatchObject(expected(attr));
+      }),
+    );
+
+  subtest(
+    "string",
+    (A) => ({
+      string: A.string,
+    }),
+    {
+      string: "test-string",
+    },
+  );
+
+  subtest(
+    "string.apply(string => undefined)",
+    (A) => ({
+      string: A.string.pipe(Output.map(() => undefined)),
+    }),
+    {
+      string: undefined,
+    },
+  );
+
+  subtest(
+    "string.effect(string => Effect.succeed(undefined))",
+    (A) => ({
+      string: A.string.pipe(Output.mapEffect(() => Effect.succeed(undefined))),
+    }),
+    {
+      string: undefined,
+    },
+  );
+
+  subtest(
+    "string.flatMap(() => Output.literal(undefined))",
+    (A) => ({
+      string: A.string.pipe(Output.flatMap(() => Output.literal(undefined))),
+    }),
+    {
+      string: undefined,
+    },
+  );
+
+  subtest(
+    "string.flatMap(string => A.stringArray.map(([first]) => first))",
+    (A) => ({
+      string: A.string.pipe(
+        Output.flatMap(() =>
+          A.stringArray.pipe(
+            Output.map((stringArray) => stringArray[0]!.toUpperCase()),
+          ),
+        ),
+      ),
+    }),
+    {
+      string: "TEST-STRING",
+    },
+  );
+
+  subtest(
+    "stringArray[0].toUpperCase()",
+    (A) => ({
+      string: A.stringArray.pipe(
+        Output.map((stringArray) => stringArray[0]!.toUpperCase()),
+      ),
+    }),
+    {
+      string: "TEST-STRING",
+    },
+  );
+
+  subtest(
+    "resource object",
+    (A) => ({
+      object: A as any,
+    }),
+    {
+      object: {
+        string: "test-string",
+      },
+    } as any,
+  );
+});
+
+describe("raw Resource refs in props are tracked as upstream dependencies", () => {
+  test(
+    "raw Resource passed directly as a prop value populates the upstream's downstream",
+    Effect.gen(function* () {
+      const plan = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-value" });
+        yield* TestResource("B", {
+          object: A as any,
+        });
+      }).pipe(makePlan);
+
+      expect(plan.resources.A!.downstream).toEqual(["B"]);
+      expect(plan.resources.B!.downstream).toEqual([]);
+    }),
+  );
+
+  test(
+    "raw Resources nested in arrays/objects are tracked as upstream dependencies",
+    Effect.gen(function* () {
+      const plan = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", { string: "a-value" });
+        const B = yield* TestResource("B", { string: "b-value" });
+        yield* TestResource("C", {
+          stringArray: [A] as any,
+          object: { ref: B } as any,
+        });
+      }).pipe(makePlan);
+
+      expect(plan.resources.A!.downstream).toEqual(["C"]);
+      expect(plan.resources.B!.downstream).toEqual(["C"]);
+      expect(plan.resources.C!.downstream).toEqual([]);
+    }),
+  );
+});
+
+describe("stable properties should not cause downstream changes", () => {
+  const subtest = (
+    description: string,
+    input: (A: TestResource) => InputProps<TestResourceProps>,
+  ) => {
+    // @ts-expect-error - get the keys
+    const props = input(Output.of({}));
+    test(
+      description,
+      Effect.gen(function* () {
+        yield* seed({
+          A: {
+            instanceId,
+            providerVersion: 0,
+            logicalId: "A",
+            fqn: "A",
+            namespace: undefined,
+            resourceType: "Test.TestResource",
+            status: "created",
+            props: {
+              string: "test-string-old",
+            },
+            attr: {
+              string: "test-string-old",
+              stableString: "A",
+              stableArray: ["A"],
+            },
+            downstream: [],
+            bindings: [],
+          },
+          B: {
+            instanceId,
+            providerVersion: 0,
+            logicalId: "B",
+            fqn: "B",
+            namespace: undefined,
+            resourceType: "Test.TestResource",
+            status: "created",
+            props: Object.fromEntries(
+              Object.entries({
+                string: "A",
+                stringArray: ["A"],
+              }).filter(([key]) => key in props),
+            ),
+            attr: {
+              stableString: "A",
+            },
+            downstream: [],
+            bindings: [],
+          },
+        });
+        expect(
+          yield* Effect.gen(function* () {
+            const A = yield* TestResource("A", {
+              string: "test-string",
+            });
+            yield* TestResource("B", input(A));
+          }).pipe(makePlan),
+        ).toMatchObject({
+          resources: {
+            A: {
+              action: "update",
+              props: {
+                string: "test-string",
+              },
+            },
+            B: {
+              action: "noop",
+            },
+          },
+          deletions: expect.toSatisfy(
+            (d: any) => Object.keys(d).length === 0,
+            "empty object",
+          ),
+        });
+      }),
+    );
+  };
+
+  subtest("A.stableString", (A) => ({
+    string: A.stableString,
+  }));
+
+  subtest("A.stableString.apply((string) => string.toUpperCase())", (A) => ({
+    string: A.stableString.pipe(Output.map((string) => string.toUpperCase())),
+  }));
+
+  subtest(
+    "A.stableString.effect((string) => Effect.succeed(string.toUpperCase()))",
+    (A) => ({
+      string: A.stableString.pipe(
+        Output.mapEffect((string) => Effect.succeed(string.toUpperCase())),
+      ),
+    }),
+  );
+
+  subtest(
+    "A.stableString.flatMap((string) => Output.literal(string.toUpperCase()))",
+    (A) => ({
+      string: A.stableString.pipe(
+        Output.flatMap((string) => Output.literal(string.toUpperCase())),
+      ),
+    }),
+  );
+
+  subtest("A.stableArray", (A) => ({
+    stringArray: A.stableArray,
+  }));
+
+  subtest("A.stableArray[0]", (A) => ({
+    string: A.stableArray.pipe(Output.map((stableArray) => stableArray[0]!)),
+  }));
+
+  subtest("A.stableArray[0].apply((string) => string.toUpperCase())", (A) => ({
+    string: A.stableArray.pipe(
+      Output.map((stableArray) => stableArray[0]!.toUpperCase()),
+    ),
+  }));
+
+  subtest(
+    "A.stableArray[0].effect((string) => Effect.succeed(string.toUpperCase()))",
+    (A) => ({
+      string: A.stableArray.pipe(
+        Output.mapEffect((stableArray) =>
+          Effect.succeed(stableArray[0]!.toUpperCase()),
+        ),
+      ),
+    }),
+  );
+});
+
+describe("unsatisfied cycle detection", () => {
+  const extractCycleDefect = <A, E>(
+    exit: Exit.Exit<A, E>,
+  ): UnsatisfiedResourceCycle | undefined => {
+    if (!Exit.isFailure(exit)) return undefined;
+    const die = exit.cause.reasons.find(Cause.isDieReason);
+    return die?.defect as UnsatisfiedResourceCycle | undefined;
+  };
+
+  test(
+    "binding cycle between resources without precreate dies",
+    Effect.gen(function* () {
+      const exit = yield* makePlan(
+        Effect.gen(function* () {
+          const A = yield* NoPrecreateBindingTarget("A", {
+            string: "a-value",
+          });
+          const B = yield* NoPrecreateBindingTarget("B", {
+            string: "b-value",
+          });
+
+          yield* A.bind("FromB", { env: { PEER: B.string } });
+          yield* B.bind("FromA", { env: { PEER: A.string } });
+
+          return { A, B };
+        }),
+      ).pipe(Effect.exit);
+
+      const err = extractCycleDefect(exit);
+      expect(err).toBeDefined();
+      expect(err!._tag).toBe("UnsatisfiedResourceCycle");
+      expect(err!.cycle.sort()).toEqual(["A", "B"]);
+      expect(err!.missingPrecreate.sort()).toEqual(["A", "B"]);
+    }),
+  );
+
+  test(
+    "binding cycle with all precreate resources succeeds",
+    Effect.gen(function* () {
+      const exit = yield* makePlan(
+        Effect.gen(function* () {
+          const A = yield* BindingTarget("A", { string: "a-value" });
+          const B = yield* BindingTarget("B", { string: "b-value" });
+
+          yield* A.bind("FromB", {
+            env: { PEER: B.string },
+          });
+          yield* B.bind("FromA", {
+            env: { PEER: A.string },
+          });
+
+          return { A, B };
+        }),
+      ).pipe(Effect.exit);
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+    }),
+  );
+
+  test(
+    "mixed cycle succeeds when precreate resource breaks it",
+    Effect.gen(function* () {
+      const exit = yield* makePlan(
+        Effect.gen(function* () {
+          const A = yield* BindingTarget("A", { string: "a-value" });
+          const B = yield* NoPrecreateBindingTarget("B", {
+            string: A.string,
+          });
+
+          yield* A.bind("FromB", {
+            env: { PEER: B.string },
+          });
+
+          return { A, B };
+        }),
+      ).pipe(Effect.exit);
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+    }),
+  );
+
+  test(
+    "three-node binding cycle dies when none have precreate",
+    Effect.gen(function* () {
+      const exit = yield* makePlan(
+        Effect.gen(function* () {
+          const A = yield* NoPrecreateBindingTarget("A", { string: "a" });
+          const B = yield* NoPrecreateBindingTarget("B", { string: "b" });
+          const C = yield* NoPrecreateBindingTarget("C", { string: "c" });
+
+          yield* A.bind("FromC", { env: { PEER: C.string } });
+          yield* B.bind("FromA", { env: { PEER: A.string } });
+          yield* C.bind("FromB", { env: { PEER: B.string } });
+
+          return { A, B, C };
+        }),
+      ).pipe(Effect.exit);
+
+      const err = extractCycleDefect(exit);
+      expect(err).toBeDefined();
+      expect(err!._tag).toBe("UnsatisfiedResourceCycle");
+      expect(err!.cycle.sort()).toEqual(["A", "B", "C"]);
+      expect(err!.missingPrecreate.sort()).toEqual(["A", "B", "C"]);
+    }),
+  );
+
+  test(
+    "acyclic binding graph succeeds even without precreate",
+    Effect.gen(function* () {
+      const exit = yield* makePlan(
+        Effect.gen(function* () {
+          const A = yield* NoPrecreateBindingTarget("A", {
+            string: "a-value",
+          });
+          const B = yield* NoPrecreateBindingTarget("B", {
+            string: A.string,
+          });
+
+          yield* B.bind("FromA", { env: { PEER: A.string } });
+
+          return { A, B };
+        }),
+      ).pipe(Effect.exit);
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+    }),
+  );
+});
+
+describe("unresolved plan inputs in diff should conservatively update", () => {
+  test(
+    "update when upstream resource is new and downstream news contains exprs",
+    Effect.gen(function* () {
+      yield* seed({
+        B: {
+          instanceId,
+          providerVersion: 0,
+          logicalId: "B",
+          fqn: "B",
+          namespace: undefined,
+          resourceType: "Test.TestResource",
+          status: "created",
+          props: {
+            string: "old-value",
+          },
+          attr: {
+            string: "old-value",
+            stableString: "B",
+            stableArray: ["B"],
+          },
+          downstream: [],
+          bindings: [],
+        },
+      });
+      const plan = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "hello",
+        });
+        yield* TestResource("B", {
+          string: A.string,
+        });
+      }).pipe(makePlan);
+
+      expect(plan.resources.A.action).toBe("create");
+      expect(plan.resources.B.action).toBe("update");
+    }),
+  );
+});
+
+describe("Redacted props/outputs are preserved through plan", () => {
+  test(
+    "Redacted prop on a new resource is preserved as a Redacted in the plan",
+    Effect.gen(function* () {
+      const plan = yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "x",
+          redacted: Redacted.make("hunter2"),
+        });
+      }).pipe(makePlan);
+
+      const node: any = plan.resources.A!;
+      expect(node.action).toBe("create");
+      const props = node.props as TestResourceProps;
+      expect(Redacted.isRedacted(props.redacted)).toBe(true);
+      expect(Redacted.value(props.redacted!)).toBe("hunter2");
+    }),
+  );
+
+  test(
+    "Redacted prop nested inside an array is preserved through the plan",
+    Effect.gen(function* () {
+      const plan = yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "x",
+          redactedArray: [Redacted.make("a"), Redacted.make("b")],
+        });
+      }).pipe(makePlan);
+
+      const node: any = plan.resources.A!;
+      expect(node.action).toBe("create");
+      const props = node.props as TestResourceProps;
+      expect(props.redactedArray).toBeDefined();
+      expect(props.redactedArray!.length).toBe(2);
+      expect(Redacted.isRedacted(props.redactedArray![0]!)).toBe(true);
+      expect(Redacted.isRedacted(props.redactedArray![1]!)).toBe(true);
+      expect(Redacted.value(props.redactedArray![0]!)).toBe("a");
+      expect(Redacted.value(props.redactedArray![1]!)).toBe("b");
+    }),
+  );
+
+  test(
+    "no-op when prior state has the same Redacted value",
+    Effect.gen(function* () {
+      yield* seed({
+        A: {
+          instanceId,
+          providerVersion: 0,
+          logicalId: "A",
+          fqn: "A",
+          namespace: undefined,
+          resourceType: "Test.TestResource",
+          status: "created",
+          props: {
+            string: "x",
+            redacted: Redacted.make("hunter2"),
+          },
+          attr: {
+            string: "x",
+            stringArray: [],
+            stableString: "A",
+            stableArray: ["A"],
+            replaceString: undefined,
+            redacted: Redacted.make("hunter2"),
+            redactedArray: undefined,
+          },
+          downstream: [],
+          bindings: [],
+        },
+      });
+      const plan = yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "x",
+          redacted: Redacted.make("hunter2"),
+        });
+      }).pipe(makePlan);
+
+      expect(plan.resources.A!.action).toBe("noop");
+    }),
+  );
+
+  test(
+    "update when Redacted prop value changes",
+    Effect.gen(function* () {
+      yield* seed({
+        A: {
+          instanceId,
+          providerVersion: 0,
+          logicalId: "A",
+          fqn: "A",
+          namespace: undefined,
+          resourceType: "Test.TestResource",
+          status: "created",
+          props: {
+            string: "x",
+            redacted: Redacted.make("old"),
+          },
+          attr: {
+            string: "x",
+            stringArray: [],
+            stableString: "A",
+            stableArray: ["A"],
+            replaceString: undefined,
+            redacted: Redacted.make("old"),
+            redactedArray: undefined,
+          },
+          downstream: [],
+          bindings: [],
+        },
+      });
+      const plan = yield* Effect.gen(function* () {
+        yield* TestResource("A", {
+          string: "x",
+          redacted: Redacted.make("new"),
+        });
+      }).pipe(makePlan);
+
+      expect(plan.resources.A!.action).toBe("update");
+      const node: any = plan.resources.A!;
+      const props = node.props as TestResourceProps;
+      expect(Redacted.isRedacted(props.redacted)).toBe(true);
+      expect(Redacted.value(props.redacted!)).toBe("new");
+    }),
+  );
+
+  test(
+    "Redacted output flowing into a downstream resource preserves its redaction",
+    Effect.gen(function* () {
+      yield* seed({
+        A: {
+          instanceId,
+          providerVersion: 0,
+          logicalId: "A",
+          fqn: "A",
+          namespace: undefined,
+          resourceType: "Test.TestResource",
+          status: "created",
+          props: {
+            string: "x",
+            redacted: Redacted.make("hunter2"),
+          },
+          attr: {
+            string: "x",
+            stringArray: [],
+            stableString: "A",
+            stableArray: ["A"],
+            replaceString: undefined,
+            redacted: Redacted.make("hunter2"),
+            redactedArray: undefined,
+          },
+          downstream: [],
+          bindings: [],
+        },
+      });
+      const plan = yield* Effect.gen(function* () {
+        const A = yield* TestResource("A", {
+          string: "x",
+          redacted: Redacted.make("hunter2"),
+        });
+        yield* TestResource("B", {
+          string: "y",
+          redacted: A.redacted as any,
+        });
+      }).pipe(makePlan);
+
+      const bNode: any = plan.resources.B!;
+      const bProps = bNode.props as TestResourceProps;
+      expect(Redacted.isRedacted(bProps.redacted)).toBe(true);
+      expect(Redacted.value(bProps.redacted!)).toBe("hunter2");
+    }),
+  );
+});
+
+describe("engine-level adoption", () => {
+  // Build a plan, optionally with an explicit AdoptPolicy and a read hook
+  // that simulates a pre-existing cloud resource.
+  const ownedAttrs: TestResource["Attributes"] = {
+    string: "hello",
+    stringArray: [],
+    stableString: "Adopted",
+    stableArray: ["Adopted"],
+    replaceString: undefined,
+    redacted: undefined,
+    redactedArray: undefined,
+  };
+
+  const makeAdoptPlan = <A>(
+    effect: Effect.Effect<A, any, any>,
+    opts: {
+      adopt?: boolean;
+      readHook?: (
+        id: string,
+      ) => Effect.Effect<TestResource["Attributes"] | undefined, any>;
+    },
+  ): Effect.Effect<Plan.Plan<A>, any, State> =>
+    Effect.gen(function* () {
+      const { name, stage } = yield* resolveStackId;
+      const hooksLayer = opts.readHook
+        ? Layer.succeed(TestResourceHooks, { read: opts.readHook })
+        : Layer.empty;
+      const adoptLayer =
+        opts.adopt === undefined
+          ? Layer.empty
+          : Layer.succeed(AdoptPolicy, opts.adopt);
+      return yield* (effect as Effect.Effect<A, any, any>).pipe(
+        Stack.make({
+          name,
+          providers: Layer.empty,
+          state: inMemoryState(),
+        } as any) as any,
+        Effect.provideService(Stage, stage),
+        Effect.flatMap((stackSpec: any) => Plan.make(stackSpec)),
+        Effect.provide(TestLayers()),
+        Effect.provide(hooksLayer),
+        Effect.provide(adoptLayer),
+      ) as Effect.Effect<Plan.Plan<A>, any, State>;
+    }) as Effect.Effect<Plan.Plan<A>, any, State>;
+
+  test(
+    "owned read result is silently adopted (no AdoptPolicy needed) and forced to update",
+    Effect.gen(function* () {
+      const plan = yield* makeAdoptPlan(
+        Effect.gen(function* () {
+          yield* TestResource("Adopted", { string: "hello" });
+        }),
+        { readHook: () => Effect.succeed(ownedAttrs) },
+      );
+
+      // Cold-start adoption forces an update so the provider can re-sync
+      // tags / config against `news` — even when read returns plain
+      // (owned) attrs, the cloud resource may carry drift the engine
+      // can't detect from `props` alone.
+      expect(plan.resources.Adopted!.action).toBe("update");
+
+      const state = yield* yield* State;
+      const persisted = yield* state.get({
+        stack: TEST_STACK,
+        stage: TEST_STAGE,
+        fqn: "Adopted",
+      });
+      expect(persisted?.status).toBe("created");
+      expect((persisted as any)?.attr).toMatchObject({ string: "hello" });
+    }),
+  );
+
+  test(
+    "Unowned read result + adopt enabled -> takeover forces an update",
+    Effect.gen(function* () {
+      const plan = yield* makeAdoptPlan(
+        Effect.gen(function* () {
+          yield* TestResource("Adopted", { string: "hello" });
+        }),
+        {
+          adopt: true,
+          readHook: () => Effect.succeed(Unowned(ownedAttrs)),
+        },
+      );
+
+      // Takeover of an Unowned resource forces `update` so the provider's
+      // update path can rewrite ownership tags / config to match this
+      // logical id (a plain noop would leave the resource looking
+      // foreign-owned to subsequent deploys).
+      expect(plan.resources.Adopted!.action).toBe("update");
+
+      const state = yield* yield* State;
+      const persisted = yield* state.get({
+        stack: TEST_STACK,
+        stage: TEST_STAGE,
+        fqn: "Adopted",
+      });
+      expect(persisted?.status).toBe("created");
+
+      // The Unowned brand must be fully scrubbed from anything that
+      // reaches the state store — both via the public `Unowned.is`
+      // check *and* via direct symbol inspection (in case someone
+      // accidentally uses `Symbol.for` rather than `Unowned.is`).
+      const persistedAttr = (persisted as any)?.attr as object;
+      expect(Unowned.is(persistedAttr)).toBe(false);
+      expect(Object.getOwnPropertySymbols(persistedAttr).length).toBe(0);
+      expect(JSON.stringify(persistedAttr)).not.toContain("Unowned");
+    }),
+  );
+
+  test(
+    "Unowned read result + adopt disabled -> OwnedBySomeoneElse",
+    Effect.gen(function* () {
+      const exit = yield* makeAdoptPlan(
+        Effect.gen(function* () {
+          yield* TestResource("Foreign", { string: "hello" });
+        }),
+        {
+          adopt: false,
+          readHook: () => Effect.succeed(Unowned(ownedAttrs)),
+        },
+      ).pipe(Effect.exit);
+
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const reason = exit.cause.reasons.find(Cause.isFailReason);
+        expect((reason?.error as any)?._tag).toBe("OwnedBySomeoneElse");
+        expect((reason?.error as any)?.resourceType).toBe("Test.TestResource");
+      }
+    }),
+  );
+
+  test(
+    "read returns undefined -> ordinary create",
+    Effect.gen(function* () {
+      const plan = yield* makeAdoptPlan(
+        Effect.gen(function* () {
+          yield* TestResource("Fresh", { string: "hello" });
+        }),
+        { readHook: () => Effect.succeed(undefined) },
+      );
+
+      expect(plan.resources.Fresh!.action).toBe("create");
+      expect(plan.resources.Fresh!.state).toBeUndefined();
+    }),
+  );
+
+  test(
+    "providers without a `read` method skip the adoption probe entirely",
+    Effect.gen(function* () {
+      // Bucket has no `read` implementation. The engine should fall back
+      // to a normal `create` action without any side effects.
+      const plan = yield* makeAdoptPlan(
+        Effect.gen(function* () {
+          yield* Bucket("FreshBucket", { name: "fresh" });
+        }),
+        { adopt: true },
+      );
+
+      expect(plan.resources.FreshBucket!.action).toBe("create");
+    }),
+  );
+});
+
+describe("RefExpr resolution", () => {
+  const seedAt = (
+    stack: string,
+    stage: string,
+    resources: Record<string, ResourceState>,
+  ) =>
+    Effect.gen(function* () {
+      const state = yield* yield* State;
+      for (const [fqn, value] of Object.entries(resources)) {
+        yield* state.set({ stack, stage, fqn, value });
+      }
+    });
+
+  const sharedAttr = {
+    string: "shared-string",
+    stringArray: ["shared"],
+    stableString: "shared-stable",
+    stableArray: ["shared-stable"],
+    replaceString: undefined,
+    redacted: undefined,
+    redactedArray: undefined,
+  };
+
+  const sharedResourceState = {
+    instanceId,
+    providerVersion: 0,
+    logicalId: "Shared",
+    fqn: "Shared",
+    namespace: undefined,
+    resourceType: "Test.TestResource",
+    status: "created" as ResourceStatus,
+    props: { string: "shared-string" },
+    attr: sharedAttr,
+    bindings: [],
+    downstream: [],
+  } as ResourceState;
+
+  test(
+    "resolves a cross-stage Ref to the seeded resource's attributes",
+    Effect.gen(function* () {
+      yield* seedAt(TEST_STACK, "other", { Shared: sharedResourceState });
+      const plan = yield* Effect.gen(function* () {
+        const shared = yield* TestResource.ref("Shared", { stage: "other" });
+        yield* TestResource("Consumer", { string: shared.string });
+      }).pipe(makePlan);
+
+      expect(plan.resources.Consumer?.action).toBe("create");
+      expect((plan.resources.Consumer as any)?.props).toMatchObject({
+        string: "shared-string",
+      });
+    }),
+  );
+
+  test(
+    "resolves a cross-stack Ref using the explicit stack option",
+    Effect.gen(function* () {
+      yield* seedAt("other-stack", TEST_STAGE, {
+        Shared: sharedResourceState,
+      });
+      const plan = yield* Effect.gen(function* () {
+        const shared = yield* TestResource.ref("Shared", {
+          stack: "other-stack",
+        });
+        yield* TestResource("Consumer", {
+          string: shared.string,
+        });
+      }).pipe(makePlan);
+
+      expect((plan.resources.Consumer as any)?.props).toMatchObject({
+        string: "shared-string",
+      });
+    }),
+  );
+
+  test(
+    "Ref to a resource in the current stack/stage is resolved",
+    Effect.gen(function* () {
+      yield* seed({ Shared: sharedResourceState });
+      const plan = yield* Effect.gen(function* () {
+        const shared = yield* TestResource.ref("Shared");
+        yield* TestResource("Consumer", { string: shared.string });
+      }).pipe(makePlan);
+
+      expect((plan.resources.Consumer as any)?.props).toMatchObject({
+        string: "shared-string",
+      });
+    }),
+  );
+
+  test(
+    "missing Ref target dies with InvalidReferenceError",
+    Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        Effect.gen(function* () {
+          const shared = yield* TestResource.ref("Ghost", { stage: "other" });
+          yield* TestResource("Consumer", { string: shared.string });
+        }).pipe(makePlan),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const err = Cause.squash(exit.cause) as Output.InvalidReferenceError;
+        expect(err._tag).toBe("InvalidReferenceError");
+        expect(err.resourceId).toBe("Ghost");
+        expect(err.stage).toBe("other");
+      }
+    }),
+  );
+});
+
+describe("StackRefExpr resolution", () => {
+  const setStackOutput = (stack: string, stage: string, value: unknown) =>
+    Effect.gen(function* () {
+      const state = yield* yield* State;
+      yield* state.setOutput({ stack, stage, value });
+    });
+
+  test(
+    "resolves an Output.stackRef to the persisted stack output",
+    Effect.gen(function* () {
+      yield* setStackOutput("Backend", TEST_STAGE, {
+        url: "https://api.example.com",
+      });
+      const plan = yield* Effect.gen(function* () {
+        const backend = yield* Output.stackRef<{ url: string }>("Backend");
+        yield* TestResource("Consumer", {
+          string: (backend as any).url,
+        });
+      }).pipe(makePlan);
+
+      expect(plan.resources.Consumer?.action).toBe("create");
+      expect((plan.resources.Consumer as any)?.props).toMatchObject({
+        string: "https://api.example.com",
+      });
+    }),
+  );
+
+  test(
+    "resolves an explicit stage on the stackRef",
+    Effect.gen(function* () {
+      yield* setStackOutput("Backend", "prod", {
+        url: "https://prod.example.com",
+      });
+      const plan = yield* Effect.gen(function* () {
+        const backend = yield* Output.stackRef<{ url: string }>("Backend", {
+          stage: "prod",
+        });
+        yield* TestResource("Consumer", {
+          string: (backend as any).url,
+        });
+      }).pipe(makePlan);
+
+      expect((plan.resources.Consumer as any)?.props).toMatchObject({
+        string: "https://prod.example.com",
+      });
+    }),
+  );
+
+  test(
+    "missing stack output dies with InvalidReferenceError",
+    Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        Effect.gen(function* () {
+          const backend = yield* Output.stackRef<{ url: string }>("Backend", {
+            stage: "ghost",
+          });
+          yield* TestResource("Consumer", {
+            string: (backend as any).url,
+          });
+        }).pipe(makePlan),
+      );
+      expect(Exit.isFailure(exit)).toBe(true);
+      if (Exit.isFailure(exit)) {
+        const err = Cause.squash(exit.cause) as Output.InvalidReferenceError;
+        expect(err._tag).toBe("InvalidReferenceError");
+        expect(err.stack).toBe("Backend");
+        expect(err.stage).toBe("ghost");
+      }
+    }),
+  );
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/schema.test.ts b/.repos/alchemy-effect/packages/alchemy/test/schema.test.ts
new file mode 100644
index 00000000000..534014e916c
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/schema.test.ts
@@ -0,0 +1,123 @@
+import { describe, expect, test } from "vitest";
+
+import {
+  getSetValueAST,
+  isBooleanSchema,
+  isListSchema,
+  isMapSchema,
+  isNullishSchema,
+  isNullSchema,
+  isNumberSchema,
+  isRecordLikeSchema,
+  isSetSchema,
+  isStringSchema,
+  isUndefinedSchema,
+} from "@/Schema";
+import * as S from "effect/Schema";
+
+describe("isStringSchema", () => {
+  test("string", () => {
+    expect(isStringSchema(S.String)).toBe(true);
+  });
+  test("not string", () => {
+    expect(isStringSchema(S.Number)).toBe(false);
+  });
+});
+
+describe("isNumberSchema", () => {
+  test("number", () => {
+    expect(isNumberSchema(S.Number)).toBe(true);
+  });
+  test("not number", () => {
+    expect(isNumberSchema(S.String)).toBe(false);
+  });
+});
+
+describe("isMapSchema", () => {
+  test("map", () => {
+    expect(isMapSchema(S.ReadonlyMap(S.String, S.String))).toBe(true);
+  });
+  test("not map", () => {
+    expect(isMapSchema(S.Record(S.String, S.String))).toBe(false);
+  });
+});
+
+describe("isRecordLikeSchema", () => {
+  for (const [key, value] of Object.entries({
+    map: S.ReadonlyMap(S.String, S.String),
+    struct: S.Struct({
+      key: S.String,
+      value: S.String,
+    }),
+    class: class Self extends S.Class<Self>("Self")({
+      key: S.String,
+      value: S.String,
+    }) {},
+  })) {
+    test(key, () => {
+      expect(isRecordLikeSchema(value)).toBe(true);
+    });
+  }
+});
+
+describe("isListSchema", () => {
+  test("list", () => {
+    expect(isListSchema(S.Array(S.String))).toBe(true);
+  });
+  test("Map type is not list", () => {
+    expect(isListSchema(S.ReadonlyMap(S.String, S.String))).toBe(false);
+  });
+});
+
+describe("isSetSchema", () => {
+  test("set", () => {
+    expect(isSetSchema(S.ReadonlySet(S.String))).toBe(true);
+  });
+  test("getSetValueAST", () => {
+    const ast = getSetValueAST(S.ReadonlySet(S.String));
+    expect(ast).toBeDefined();
+    expect(isStringSchema(S.make(ast!))).toBe(true);
+  });
+});
+
+describe("isNullSchema", () => {
+  test("null", () => {
+    expect(isNullSchema(S.Null)).toBe(true);
+  });
+  test("undefined", () => {
+    expect(isNullSchema(S.Undefined)).toBe(false);
+  });
+  test("not null", () => {
+    expect(isNullSchema(S.String)).toBe(false);
+  });
+});
+
+describe("isUndefinedSchema", () => {
+  test("undefined", () => {
+    expect(isUndefinedSchema(S.Undefined)).toBe(true);
+  });
+  test("not undefined", () => {
+    expect(isUndefinedSchema(S.String)).toBe(false);
+  });
+});
+
+describe("isNullishSchema", () => {
+  test("null", () => {
+    expect(isNullishSchema(S.Null)).toBe(true);
+  });
+  test("undefined", () => {
+    expect(isNullishSchema(S.Undefined)).toBe(true);
+  });
+  test("not nullish", () => {
+    expect(isNullishSchema(S.String)).toBe(false);
+  });
+});
+
+describe("isBooleanSchema", () => {
+  test("boolean", () => {
+    expect(isBooleanSchema(S.Boolean)).toBe(true);
+  });
+  test("not boolean", () => {
+    expect(isBooleanSchema(S.String)).toBe(false);
+  });
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/test.resources.ts b/.repos/alchemy-effect/packages/alchemy/test/test.resources.ts
new file mode 100644
index 00000000000..3d4f46e2913
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/test.resources.ts
@@ -0,0 +1,832 @@
+import { Artifacts } from "@/Artifacts";
+import { isResolved } from "@/Diff.ts";
+import * as Provider from "@/Provider.ts";
+import { Resource, type ResourceBinding } from "@/Resource";
+import * as State from "@/State/index";
+import { isUnknown } from "@/Util/unknown";
+import * as Context from "effect/Context";
+import { Data } from "effect";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Redacted from "effect/Redacted";
+
+// Bucket
+export type BucketProps = {
+  name?: string;
+};
+
+export interface Bucket extends Resource<
+  "Test.Bucket",
+  BucketProps,
+  {
+    name: string;
+    bucketArn: string;
+  }
+> {}
+
+export const Bucket = Resource<Bucket>("Test.Bucket");
+
+const bucketProvider = () =>
+  Provider.succeed(Bucket, {
+    diff: Effect.fn(function* ({ id, news, output }) {
+      if (!isResolved(news)) return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {}, output }) {
+      if (output !== undefined) return output;
+      return {
+        name: news.name ?? id,
+        bucketArn: `arn:test:bucket:us-east-1:123456789:${id}`,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+      return;
+    }),
+  });
+
+// Queue
+export type QueueProps = {
+  name?: string;
+};
+
+export interface Queue extends Resource<
+  "Test.Queue",
+  QueueProps,
+  {
+    name: string;
+    queueUrl: string;
+  }
+> {}
+
+export const Queue = Resource<Queue>("Test.Queue");
+
+export const queueProvider = () =>
+  Provider.succeed(Queue, {
+    diff: Effect.fn(function* ({ id, news = {}, output }) {
+      if (!isResolved(news)) return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {} }) {
+      const name = news.name ?? id;
+      return {
+        name,
+        queueUrl: `https://test.queue.com/${name}`,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {}),
+  });
+
+export type FunctionProps = {
+  name?: string;
+  env?: Record<string, string>;
+};
+
+export interface Function extends Resource<
+  "Test.Function",
+  FunctionProps,
+  {
+    name: string;
+    env: Record<string, string>;
+    functionArn: string;
+  }
+> {}
+
+export const Function = Resource<Function>("Test.Function");
+
+export const functionProvider = () =>
+  Provider.succeed(Function, {
+    diff: Effect.fn(function* ({ id, news, output }) {
+      if (!isResolved(news)) return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {} }) {
+      return {
+        name: news.name ?? id,
+        env: news.env ?? {},
+        functionArn: `arn:aws:lambda:us-west-2:084828582823:function:${id}`,
+      };
+    }),
+    delete: Effect.fn(function* ({ output }) {}),
+  });
+
+export type BindingTargetProps = {
+  name?: string;
+  string?: string;
+  replaceString?: string;
+};
+
+export interface BindingTarget extends Resource<
+  "Test.BindingTarget",
+  BindingTargetProps,
+  {
+    name: string;
+    string: string;
+    env: Record<string, string>;
+    replaceString: BindingTargetProps["replaceString"];
+  },
+  {
+    env?: Record<string, string>;
+  }
+> {}
+
+export const BindingTarget = Resource<BindingTarget>("Test.BindingTarget");
+
+export const bindingTargetProvider = () =>
+  Provider.effect(
+    BindingTarget,
+    Effect.gen(function* () {
+      return {
+        diff: Effect.fn(function* ({ id, news = {}, olds = {}, newBindings }) {
+          if (!isResolved(news)) return undefined;
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          if (hooks?.diff && isResolved(newBindings)) {
+            yield* hooks.diff(id, newBindings as ResourceBinding[]);
+          }
+          const n = news as BindingTargetProps;
+          const o = olds as BindingTargetProps;
+          if (n.replaceString !== o.replaceString) {
+            return {
+              action: "replace",
+            };
+          }
+          if (n.name !== o.name || n.string !== o.string) {
+            return {
+              action: "update",
+            };
+          }
+          return undefined;
+        }),
+        precreate: Effect.fn(function* ({ id, news = {} }) {
+          return {
+            name: news.name ?? id,
+            string: news.string ?? id,
+            env: {},
+            replaceString: news.replaceString,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, olds, bindings }) {
+          // The hook routing tracks the engine's create-vs-update intent.
+          // `olds === undefined` covers greenfield AND replacement-create
+          // (engine resets olds when minting a new instance), which is
+          // exactly when the test wants `failOn("X", "create")` to fire.
+          // `output === undefined` would miss replacements with `precreate`
+          // because precreate populates `output` before reconcile runs.
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          if (olds === undefined) {
+            if (hooks?.create) {
+              yield* hooks.create(id, news as TestResourceProps);
+            }
+          } else {
+            if (hooks?.update) {
+              yield* hooks.update(id, news as TestResourceProps);
+            }
+          }
+          return {
+            name: news.name ?? id,
+            string: news.string ?? id,
+            env: Object.assign(
+              {},
+              ...bindings.map(
+                (binding: any) => binding.env ?? binding.data?.env ?? {},
+              ),
+            ),
+            replaceString: news.replaceString,
+          };
+        }),
+        delete: Effect.fn(function* ({ id }) {
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          if (hooks?.delete) {
+            yield* hooks.delete(id);
+          }
+          return;
+        }),
+      };
+    }),
+  );
+
+export type DeletedBindingRegressionProps = {
+  name?: string;
+};
+
+export interface DeletedBindingRegressionTarget extends Resource<
+  "Test.DeletedBindingRegressionTarget",
+  DeletedBindingRegressionProps,
+  {
+    name: string;
+    env: Record<string, string>;
+  },
+  {
+    env?: Record<string, string>;
+  }
+> {}
+
+export const DeletedBindingRegressionTarget =
+  Resource<DeletedBindingRegressionTarget>(
+    "Test.DeletedBindingRegressionTarget",
+  );
+
+export const deletedBindingRegressionProvider = () =>
+  Provider.succeed(DeletedBindingRegressionTarget, {
+    diff: Effect.fn(function* () {}),
+    precreate: Effect.fn(function* ({ id, news = {} }) {
+      return {
+        name: news.name ?? id,
+        env: {},
+      };
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {}, bindings }) {
+      return {
+        name: news.name ?? id,
+        env: Object.assign(
+          {},
+          ...bindings.map(
+            (binding: any) => binding.env ?? binding.data?.env ?? {},
+          ),
+        ),
+      };
+    }),
+    delete: Effect.fn(function* () {}),
+  });
+
+export type ArtifactProbeProps = {
+  value: string;
+};
+
+export interface ArtifactProbe extends Resource<
+  "Test.ArtifactProbe",
+  ArtifactProbeProps,
+  {
+    value: string;
+    artifactValue: string | undefined;
+  }
+> {}
+
+export const ArtifactProbe = Resource<ArtifactProbe>("Test.ArtifactProbe");
+
+export const artifactProbeProvider = () =>
+  Provider.succeed(ArtifactProbe, {
+    diff: Effect.fn(function* ({ news, olds }) {
+      const next = news as ArtifactProbeProps;
+      const prev = olds as ArtifactProbeProps | undefined;
+      const artifacts = yield* Artifacts;
+      const previous = yield* artifacts.get<string>("memo");
+      if (
+        previous !== undefined &&
+        previous !== next.value &&
+        previous !== prev?.value
+      ) {
+        return { action: "replace" as const };
+      }
+      yield* artifacts.set("memo", next.value);
+      return next.value !== prev?.value
+        ? { action: "update" as const }
+        : undefined;
+    }),
+    reconcile: Effect.fn(function* ({ news }) {
+      const props = news as ArtifactProbeProps;
+      const artifacts = yield* Artifacts;
+      return {
+        value: props.value,
+        artifactValue: yield* artifacts.get<string>("memo"),
+      };
+    }),
+    delete: Effect.fn(function* () {}),
+  });
+
+// TestResource
+
+export type TestResourceProps = {
+  string?: string;
+  stringArray?: string[];
+  object?: {
+    string: string;
+  };
+  replaceString?: string;
+  redacted?: Redacted.Redacted<string>;
+  redactedArray?: Redacted.Redacted<string>[];
+};
+
+export interface TestResource extends Resource<
+  "Test.TestResource",
+  TestResourceProps,
+  {
+    string: string;
+    stringArray: string[];
+    stableString: string;
+    stableArray: string[];
+    replaceString: TestResourceProps["replaceString"];
+    redacted: Redacted.Redacted<string> | undefined;
+    redactedArray: Redacted.Redacted<string>[] | undefined;
+  }
+> {}
+
+export class TestResourceHooks extends Context.Service<
+  TestResourceHooks,
+  {
+    create?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+    update?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+    delete?: (id: string) => Effect.Effect<void, any>;
+    /**
+     * If provided, invoked from a binding-aware provider's `diff` with the
+     * exact `newBindings` array the engine handed it. Lets a test assert what
+     * the plan stage observes (e.g. that duplicates were collapsed by sid).
+     */
+    diff?: (
+      id: string,
+      newBindings: ResourceBinding[],
+    ) => Effect.Effect<void, any>;
+    /**
+     * If provided, the read hook is invoked for the resource's `read` lifecycle
+     * operation. Return:
+     *   - attrs (any object) to simulate an existing cloud resource that is
+     *     adoptable
+     *   - `undefined` to simulate a resource that does not exist
+     *   - fail with `OwnedBySomeoneElse` to reject adoption
+     */
+    read?: (
+      id: string,
+    ) => Effect.Effect<TestResource["Attributes"] | undefined, any>;
+  }
+>()("TestResourceHooks") {}
+
+export const TestResource = Resource<TestResource>("Test.TestResource");
+
+export const testResourceProvider = () =>
+  Provider.effect(
+    TestResource,
+    Effect.gen(function* () {
+      return {
+        read: Effect.fn(function* ({ id, output }) {
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          if (hooks?.read) {
+            return (yield* hooks.read(id)) as any;
+          }
+          return output;
+        }),
+        diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+          if (!isResolved(news)) return undefined;
+          const n = news as TestResourceProps;
+          const o = olds as TestResourceProps;
+          if (n.replaceString !== o.replaceString) {
+            return {
+              action: "replace",
+            };
+          }
+          const redactedValue = (
+            r: Redacted.Redacted<string> | undefined,
+          ): string | undefined =>
+            r && Redacted.isRedacted(r) ? Redacted.value(r) : undefined;
+          const redactedArrayValues = (
+            arr: Redacted.Redacted<string>[] | undefined,
+          ): string[] | undefined => arr?.map((r) => Redacted.value(r));
+          const oldRedactedArr = redactedArrayValues(o.redactedArray);
+          const newRedactedArr = redactedArrayValues(n.redactedArray);
+          return isUnknown(n.string) ||
+            isUnknown(n.stringArray) ||
+            n.string !== o.string ||
+            n.stringArray?.length !== o.stringArray?.length ||
+            !!n.stringArray !== !!o.stringArray ||
+            n.stringArray?.some(isUnknown) ||
+            n.stringArray?.some((s, i) => s !== o.stringArray?.[i]) ||
+            redactedValue(n.redacted) !== redactedValue(o.redacted) ||
+            oldRedactedArr?.length !== newRedactedArr?.length ||
+            !!oldRedactedArr !== !!newRedactedArr ||
+            newRedactedArr?.some((s, i) => s !== oldRedactedArr?.[i])
+            ? {
+                action: "update",
+                stables: ["stableString", "stableArray"],
+              }
+            : undefined;
+        }),
+        reconcile: Effect.fn(function* ({ id, news = {}, olds }) {
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          // Branch on `olds` (engine's create-vs-update intent), not
+          // `output` — replacements arrive with a precreate stub in
+          // `output` but `olds === undefined`.
+          if (olds === undefined) {
+            if (hooks?.create) {
+              yield* hooks.create(id, news);
+            }
+          } else {
+            if (hooks?.update) {
+              yield* hooks.update(id, news);
+            }
+          }
+          return {
+            string: news.string ?? id,
+            stringArray: news.stringArray ?? [],
+            stableString: id,
+            stableArray: [id],
+            replaceString: news.replaceString,
+            redacted: news.redacted,
+            redactedArray: news.redactedArray,
+          };
+        }),
+        delete: Effect.fn(function* ({ id }) {
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          if (hooks?.delete) {
+            yield* hooks.delete(id);
+          }
+          return;
+        }),
+      };
+    }),
+  );
+
+// StaticStablesResource - A test resource that has static stables on the provider
+// This simulates resources like VPC, Subnet, etc. where certain properties (e.g., vpcId, subnetId)
+// are always stable and defined on the provider itself, not returned dynamically by diff()
+
+export type StaticStablesResourceProps = {
+  string?: string;
+  tags?: Record<string, string>;
+  replaceString?: string;
+};
+
+export interface StaticStablesResource extends Resource<
+  "Test.StaticStablesResource",
+  StaticStablesResourceProps,
+  {
+    string: string;
+    tags: Record<string, string>;
+    stableId: string;
+    stableArn: string;
+    replaceString: StaticStablesResourceProps["replaceString"];
+  }
+> {}
+
+export class StaticStablesResourceHooks extends Context.Service<
+  StaticStablesResourceHooks,
+  {
+    create?: (
+      id: string,
+      props: StaticStablesResourceProps,
+    ) => Effect.Effect<void, any>;
+    update?: (
+      id: string,
+      props: StaticStablesResourceProps,
+    ) => Effect.Effect<void, any>;
+    delete?: (id: string) => Effect.Effect<void, any>;
+  }
+>()("StaticStablesResourceHooks") {}
+
+export const StaticStablesResource = Resource<StaticStablesResource>(
+  "Test.StaticStablesResource",
+);
+
+export const staticStablesResourceProvider = () =>
+  Provider.succeed(StaticStablesResource, {
+    // KEY DIFFERENCE: Static stables defined on the provider itself
+    // These are always stable regardless of what diff() returns
+    stables: ["stableId", "stableArn"],
+    diff: Effect.fn(function* ({ id, news = {}, olds = {} }) {
+      if (!isResolved(news)) return undefined;
+      const n = news as StaticStablesResourceProps;
+      const o = olds as StaticStablesResourceProps;
+      // Replace when replaceString changes
+      if (n.replaceString !== o.replaceString) {
+        return { action: "replace" };
+      }
+      // For string changes, return update action
+      if (n.string !== o.string) {
+        return { action: "update" };
+      }
+      // For tag-only changes, return undefined (no action)
+      // This simulates the VPC bug: tags changed, arePropsChanged returns true,
+      // but diff() returns undefined because provider doesn't explicitly handle tags
+      return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ id, news = {}, olds, output }) {
+      const hooks = Option.getOrUndefined(
+        yield* Effect.serviceOption(StaticStablesResourceHooks),
+      );
+      // Branch on `olds` (engine create vs update intent). Replacements
+      // pass `output` from the previous generation if any, but engine
+      // resets `olds` to `undefined` for the new instance.
+      if (olds === undefined) {
+        if (hooks?.create) {
+          yield* hooks.create(id, news);
+        }
+        return {
+          string: news.string ?? id,
+          tags: news.tags ?? {},
+          stableId: output?.stableId ?? `stable-${id}`,
+          stableArn:
+            output?.stableArn ??
+            (`arn:test:resource:us-east-1:123456789:${id}` as const),
+          replaceString: news.replaceString,
+        };
+      }
+      if (hooks?.update) {
+        yield* hooks.update(id, news);
+      }
+      return {
+        string: news.string ?? id,
+        tags: news.tags ?? {},
+        stableId: output?.stableId ?? `stable-${id}`,
+        stableArn:
+          output?.stableArn ??
+          (`arn:test:resource:us-east-1:123456789:${id}` as const),
+        replaceString: news.replaceString,
+      };
+    }),
+    delete: Effect.fn(function* ({ id, output }) {
+      yield* Effect.logDebug(output.string);
+      const hooks = Option.getOrUndefined(
+        yield* Effect.serviceOption(StaticStablesResourceHooks),
+      );
+      if (hooks?.delete) {
+        yield* hooks.delete(id);
+      }
+      return;
+    }),
+  });
+
+export type PhasedTargetProps = {
+  desired: string;
+  replaceKey?: string;
+};
+
+export interface PhasedTarget extends Resource<
+  "Test.PhasedTarget",
+  PhasedTargetProps,
+  {
+    stableId: string;
+    value: string;
+    env: Record<string, string>;
+    replaceKey: string | undefined;
+  },
+  {
+    env?: Record<string, string>;
+  }
+> {}
+
+export const PhasedTarget = Resource<PhasedTarget>("Test.PhasedTarget");
+
+const phasedStableId = (replaceKey?: string) =>
+  `stable:${replaceKey ?? "default"}`;
+
+const mergeBindingEnv = (bindings: Array<any>) =>
+  Object.assign(
+    {},
+    ...bindings.map((binding) => binding.env ?? binding.data?.env ?? {}),
+  );
+
+export const phasedTargetProvider = () =>
+  Provider.effect(
+    PhasedTarget,
+    Effect.gen(function* () {
+      return {
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return undefined;
+          const n = news as PhasedTargetProps;
+          const o = olds as PhasedTargetProps;
+          if (n.replaceKey !== o.replaceKey) {
+            return { action: "replace" } as const;
+          }
+          if (n.desired !== o.desired) {
+            return { action: "update" } as const;
+          }
+        }),
+        precreate: Effect.fn(function* ({ news }) {
+          return {
+            stableId: phasedStableId(news.replaceKey),
+            value: `pre:${news.desired}`,
+            env: {},
+            replaceKey: news.replaceKey,
+          };
+        }),
+        reconcile: Effect.fn(function* ({ id, news, olds, bindings }) {
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          // Branch on `olds` not `output`: replacement-create has
+          // precreate-populated `output` but engine-cleared `olds`.
+          if (olds === undefined) {
+            if (hooks?.create) {
+              yield* hooks.create(id, {
+                string: news.desired,
+                replaceString: news.replaceKey,
+              });
+            }
+          } else {
+            if (hooks?.update) {
+              yield* hooks.update(id, {
+                string: news.desired,
+                replaceString: news.replaceKey,
+              });
+            }
+          }
+          return {
+            stableId: phasedStableId(news.replaceKey),
+            value: news.desired,
+            env: mergeBindingEnv(bindings),
+            replaceKey: news.replaceKey,
+          };
+        }),
+        delete: Effect.fn(function* ({ id }) {
+          const hooks = Option.getOrUndefined(
+            yield* Effect.serviceOption(TestResourceHooks),
+          );
+          if (hooks?.delete) {
+            yield* hooks.delete(id);
+          }
+        }),
+      };
+    }),
+  );
+
+// NoPrecreateBindingTarget - like BindingTarget but without precreate,
+// used to test cycle detection for resources that cannot break cycles.
+
+export type NoPrecreateBindingTargetProps = {
+  string?: string;
+};
+
+export interface NoPrecreateBindingTarget extends Resource<
+  "Test.NoPrecreateBindingTarget",
+  NoPrecreateBindingTargetProps,
+  {
+    string: string;
+    env: Record<string, string>;
+  },
+  {
+    env?: Record<string, string>;
+  }
+> {}
+
+export const NoPrecreateBindingTarget = Resource<NoPrecreateBindingTarget>(
+  "Test.NoPrecreateBindingTarget",
+);
+
+export const noPrecreateBindingTargetProvider = () =>
+  Provider.succeed(NoPrecreateBindingTarget, {
+    diff: Effect.fn(function* () {}),
+    reconcile: Effect.fn(function* ({ id, news = {}, bindings }) {
+      return {
+        string: news.string ?? id,
+        env: Object.assign(
+          {},
+          ...bindings.map(
+            (binding: any) => binding.env ?? binding.data?.env ?? {},
+          ),
+        ),
+      };
+    }),
+    delete: Effect.fn(function* () {}),
+  });
+
+// DurationResource — exercises Duration round-tripping through state.
+// Input Duration must arrive at reconcile as a real Duration object (so the
+// resolver doesn't shred its prototype); output Duration must re-hydrate from
+// state on a subsequent deploy as a real Duration object too.
+
+export type DurationResourceProps = {
+  timeout: Duration.Duration;
+};
+
+export interface DurationResource extends Resource<
+  "Test.DurationResource",
+  DurationResourceProps,
+  {
+    /** Echoes the input Duration so we can assert what reconcile observed. */
+    observedTimeout: Duration.Duration;
+    /** Authoritative Duration the provider produces; persisted to state. */
+    computedTimeout: Duration.Duration;
+  }
+> {}
+
+export const DurationResource = Resource<DurationResource>(
+  "Test.DurationResource",
+);
+
+export const durationResourceProvider = () =>
+  Provider.succeed(DurationResource, {
+    diff: Effect.fn(function* ({ news }) {
+      if (!isResolved(news)) return undefined;
+      return undefined;
+    }),
+    reconcile: Effect.fn(function* ({ news }) {
+      // If `news.timeout` was shredded by the resolver into a plain object,
+      // these calls would throw or produce nonsense. The test asserts the
+      // numeric output so a regression surfaces as a failed assertion.
+      const observed = news.timeout;
+      const computed = Duration.millis(Duration.toMillis(observed) + 1_000);
+      return {
+        observedTimeout: observed,
+        computedTimeout: computed,
+      };
+    }),
+    delete: Effect.fn(function* () {}),
+  });
+
+// Layers
+export const TestLayers = () =>
+  Layer.mergeAll(
+    bucketProvider(),
+    queueProvider(),
+    functionProvider(),
+    bindingTargetProvider(),
+    deletedBindingRegressionProvider(),
+    artifactProbeProvider(),
+    testResourceProvider(),
+    staticStablesResourceProvider(),
+    phasedTargetProvider(),
+    noPrecreateBindingTargetProvider(),
+    durationResourceProvider(),
+  );
+
+export const InMemoryTestLayers = () =>
+  Layer.mergeAll(TestLayers(), State.inMemoryState());
+
+// ── Failure injection helpers ──────────────────────────────────────────────
+//
+// These helpers produce TestResourceHooks records that can be passed to the
+// `hook(...)` test combinator to inject failures or defects into specific
+// resource lifecycle methods. `failOn` produces typed failures, while
+// `dieOn` and `throwOn` produce defects (uncaught/thrown errors).
+
+export class ResourceFailure extends Data.TaggedError("ResourceFailure")<{
+  message: string;
+}> {
+  constructor(message = "Failed to create") {
+    super({ message });
+  }
+}
+
+type LifecycleHook = "create" | "update" | "delete";
+
+export type LifecycleHooks = {
+  create?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+  update?: (id: string, props: TestResourceProps) => Effect.Effect<void, any>;
+  delete?: (id: string) => Effect.Effect<void, any>;
+};
+
+export const failOn = (
+  resourceId: string,
+  hook: LifecycleHook,
+): LifecycleHooks => ({
+  [hook]: (id: string) =>
+    id === resourceId
+      ? Effect.fail(new ResourceFailure())
+      : Effect.succeed(undefined),
+});
+
+export const failOnMultiple = (
+  failures: Array<{ id: string; hook: LifecycleHook }>,
+): LifecycleHooks => {
+  const idsFor = (hook: LifecycleHook) =>
+    failures.filter((f) => f.hook === hook).map((f) => f.id);
+  const createFailures = idsFor("create");
+  const updateFailures = idsFor("update");
+  const deleteFailures = idsFor("delete");
+  return {
+    create: (id: string) =>
+      createFailures.includes(id)
+        ? Effect.fail(new ResourceFailure())
+        : Effect.succeed(undefined),
+    update: (id: string) =>
+      updateFailures.includes(id)
+        ? Effect.fail(new ResourceFailure())
+        : Effect.succeed(undefined),
+    delete: (id: string) =>
+      deleteFailures.includes(id)
+        ? Effect.fail(new ResourceFailure())
+        : Effect.succeed(undefined),
+  };
+};
+
+export const dieOn = (
+  resourceId: string,
+  hook: LifecycleHook,
+  message = `dieOn:${resourceId}:${hook}`,
+): LifecycleHooks => ({
+  [hook]: (id: string) =>
+    id === resourceId
+      ? Effect.die(new Error(message))
+      : Effect.succeed(undefined),
+});
+
+export const throwOn = (
+  resourceId: string,
+  hook: LifecycleHook,
+  message = `throwOn:${resourceId}:${hook}`,
+): LifecycleHooks => ({
+  [hook]: (id: string) =>
+    Effect.sync(() => {
+      if (id === resourceId) {
+        throw new Error(message);
+      }
+    }),
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/test/types/Agent.ts b/.repos/alchemy-effect/packages/alchemy/test/types/Agent.ts
new file mode 100644
index 00000000000..b9c7e3c235a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/types/Agent.ts
@@ -0,0 +1,165 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { Sandbox } from "./Sandbox.ts";
+
+const _agentEff = Effect.gen(function* () {
+  const agent1 = yield* Agent;
+  const _binding1 = agent1.getByName("");
+  const profile1 = yield* _binding1.getProfile();
+  const agent2 = yield* Agent2;
+  const _binding2 = agent2.getByName("");
+  const profile2 = yield* _binding2.getProfile();
+  const agent3 = yield* Agent3;
+  const _binding3 = agent3.getByName("");
+  const profile3 = yield* _binding3.getProfile();
+});
+
+const _gen = Effect.gen(function* () {
+  // bind the Sandbox Container to the Agent DO
+  const sandbox = yield* Cloudflare.bindContainer(Sandbox);
+
+  return Effect.gen(function* () {
+    const state = yield* Cloudflare.DurableObjectState;
+
+    // get the container instance
+    const container = yield* Cloudflare.start(sandbox, {
+      enableInternet: true,
+    });
+
+    container.getTcpPort(1080);
+    container.getUser();
+
+    return {
+      getProfile: () => state.storage.get<string>("Profile"),
+    };
+  });
+});
+
+export const Agent2 = Cloudflare.DurableObjectNamespace(
+  "Agents",
+  Effect.gen(function* () {
+    // bind the Sandbox Container to the Agent DO
+    const sandbox = yield* Cloudflare.bindContainer(Sandbox);
+
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      // get the container instance
+      const container = yield* Cloudflare.start(sandbox, {
+        enableInternet: true,
+      });
+
+      container.getTcpPort(1080);
+      container.getUser();
+
+      return {
+        getProfile: () => state.storage.get<string>("Profile"),
+      };
+    });
+  }),
+);
+
+export class Agent3 extends Cloudflare.DurableObjectNamespace<Agent3>()(
+  "Agents",
+  Effect.gen(function* () {
+    // bind the Sandbox Container to the Agent DO
+    const sandbox = yield* Cloudflare.bindContainer(Sandbox);
+
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      // get the container instance
+      const container = yield* Cloudflare.start(sandbox, {
+        enableInternet: true,
+      });
+
+      container.getTcpPort(1080);
+      container.getUser();
+
+      return {
+        getProfile: () => state.storage.get<string>("Profile"),
+      };
+    });
+  }),
+) {}
+
+export default class Agent extends Cloudflare.DurableObjectNamespace<Agent>()(
+  "Agents",
+  Effect.gen(function* () {
+    // bind the Sandbox Container to the Agent DO
+    const sandbox = yield* Cloudflare.bindContainer(Sandbox);
+
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      // get the container instance
+      const container = yield* Cloudflare.start(sandbox, {
+        enableInternet: true,
+      });
+
+      const connection = yield* container.getTcpPort(1080);
+
+      const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
+      for (const socket of yield* state.getWebSockets()) {
+        const session = socket.deserializeAttachment<{ id: string }>();
+        if (session) {
+          sessions.set(session.id, socket);
+        }
+      }
+
+      return {
+        getProfile: () => state.storage.get<string>("Profile"),
+        putProfile: Effect.fnUntraced(function* (value: string) {
+          yield* state.storage.put("Profile", value);
+        }),
+        eval: (code: string) =>
+          connection
+            .fetch(
+              HttpClientRequest.post("/eval", {
+                body: HttpBody.text(code),
+              }),
+            )
+            .pipe(
+              Effect.flatMap((response) => response.text),
+              Effect.orDie,
+            ),
+        fetch: Effect.gen(function* () {
+          const [response, socket] = yield* Cloudflare.upgrade();
+          const id = "TODO";
+          socket.serializeAttachment({ id });
+          sessions.set(id, socket);
+          return response;
+        }),
+        webSocketMessage: Effect.fnUntraced(function* (
+          socket: Cloudflare.DurableWebSocket,
+          message: string | Uint8Array,
+        ) {
+          const session = socket.deserializeAttachment<{ id: string }>();
+          if (!session) return;
+          const text =
+            typeof message === "string"
+              ? message
+              : new TextDecoder().decode(message);
+          for (const peer of sessions.values()) {
+            yield* peer.send(`[${session.id}] ${text}`);
+          }
+        }),
+        webSocketClose: Effect.fnUntraced(function* (
+          ws: Cloudflare.DurableWebSocket,
+          code: number,
+          reason: string,
+          _wasClean: boolean,
+        ) {
+          const session = ws.deserializeAttachment<{ id: string }>();
+          if (session) {
+            sessions.delete(session.id);
+          }
+          yield* ws.close(code, reason);
+        }),
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/types/Api.ts b/.repos/alchemy-effect/packages/alchemy/test/types/Api.ts
new file mode 100644
index 00000000000..b59ba23314b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/types/Api.ts
@@ -0,0 +1,137 @@
+import * as Cloudflare from "@/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import Agent from "./Agent.ts";
+
+export const Api2 = Cloudflare.Worker(
+  "Api",
+  {
+    main: import.meta.filename,
+    observability: {
+      enabled: true,
+    },
+    compatibility: {
+      flags: ["nodejs_compat"],
+    },
+  },
+  Effect.gen(function* () {
+    const _agents = yield* Agent;
+
+    return {
+      getUser: () => Effect.succeed({ id: "123", name: "John Doe" } as const),
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello World", { status: 200 });
+      }),
+    };
+  }),
+);
+
+const _____ = Effect.gen(function* () {
+  const worker = yield* Api2;
+  const _url = worker.url;
+  const _eff = Effect.gen(function* () {
+    const rpc = yield* Cloudflare.bindWorker(worker);
+    rpc.getUser();
+  });
+
+  const worker2 = yield* Api;
+  const _eff2 = Effect.gen(function* () {
+    const rpc2 = yield* Cloudflare.bindWorker(worker2);
+    rpc2.getUser();
+  });
+
+  const worker3 = yield* Api3;
+  const _eff3 = Effect.gen(function* () {
+    const rpc3 = yield* Cloudflare.bindWorker(worker3);
+    rpc3.getUser();
+  });
+});
+
+// declare the Api service with a tag + props
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.filename,
+    observability: {
+      enabled: true,
+    },
+    compatibility: {
+      flags: ["nodejs_compat"],
+    },
+  },
+  Effect.gen(function* () {
+    // (Infrastructure dependencies are bound here)
+
+    // bind the Agent DO to the Worker
+    const agents = yield* Agent;
+
+    return {
+      getUser: () => Effect.succeed({ id: "123", name: "John Doe" } as const),
+      fetch: Effect.gen(function* () {
+        // (Business logic is implemented here and can reference bound infrastructure above)
+        const request = yield* HttpServerRequest;
+        if (request.url.startsWith("/connect/")) {
+          // connect to a Durable Object web socket
+          const agentId = request.url.split("/").pop()!;
+          const agent = agents.getByName(agentId);
+          const response = yield* agent.fetch(request);
+          return response;
+        } // else if (request.url.startsWith("/profile/")) {
+        //   // call RPC methods on a Durable Object
+        //   const key = request.url.split("/").pop()!;
+        //   const agent = yield* agents.getByName(key);
+        //   if (request.method == "GET") {
+        //     const item = yield* agent.getProfile();
+        //     if (item) {
+        //       return HttpServerResponse.text(item);
+        //     }
+        //   } else if (request.method == "PUT") {
+        //     yield* agent.putProfile(yield* request.text);
+        //     return HttpServerResponse.text("OK", { status: 200 });
+        //   } else {
+        //     return HttpServerResponse.text("Method not allowed", {
+        //       status: 405,
+        //     });
+        //   }
+        // }
+        return HttpServerResponse.text("Hello World", { status: 200 });
+      }),
+    };
+  }).pipe(
+    // Effect.provide(
+    //   Layer.mergeAll(
+    //     //
+    //     // AgentLive,
+    //   ),
+    // ),
+  ),
+) {}
+
+export class Api3 extends Cloudflare.Worker<
+  Api3,
+  {
+    getUser: () => Effect.Effect<{ id: string; name: string }>;
+  }
+>()("Api3", {
+  main: import.meta.filename,
+  observability: {
+    enabled: true,
+  },
+}) {}
+
+export const Api3Live = Api3.make(
+  Effect.gen(function* () {
+    const agent = yield* Agent;
+    return {
+      getUser: Effect.fnUntraced(function* () {
+        const user = agent.getByName("");
+
+        return {
+          id: "123",
+          name: (yield* user.getProfile())!,
+        };
+      }),
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/packages/alchemy/test/types/Sandbox.ts b/.repos/alchemy-effect/packages/alchemy/test/types/Sandbox.ts
new file mode 100644
index 00000000000..8aac1bba68e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/types/Sandbox.ts
@@ -0,0 +1,59 @@
+import * as Cloudflare from "@/Cloudflare";
+import { Stack } from "@/Stack";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+
+export class Sandbox extends Cloudflare.Container<
+  Sandbox,
+  {
+    getUser: () => Effect.Effect<{ id: string; name: string }>;
+  }
+>()(
+  "Sandbox",
+  Stack.useSync((stack) => ({
+    main: import.meta.filename,
+    // handler: "SandboxLive",
+    instanceType: stack.stage === "prod" ? "standard-1" : "dev",
+    dockerfile: `FROM alpine:latest`,
+  })),
+) {}
+
+export const SandboxLive = Sandbox.make(
+  Effect.gen(function* () {
+    // bind dependencies
+    // yield* Cloudflare.Queue()
+
+    // return http effect
+    return {
+      getUser: () => Effect.succeed({ id: "123", name: "John Doe" } as const),
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        // upgrade to web socket
+        const socket = yield* request.upgrade;
+        const writeMessage = yield* socket.writer;
+        const cmd = yield* ChildProcess.make("ffmpeg", ["-version"]);
+        const [exitCode] = yield* Effect.all(
+          [
+            cmd.exitCode,
+            // pipe stdout to the websocket
+            cmd.stdout.pipe(
+              Stream.tap(writeMessage),
+              Stream.decodeText,
+              Stream.mkString,
+            ),
+          ] as const,
+          { concurrency: "unbounded" },
+        );
+
+        return HttpServerResponse.empty({
+          status: exitCode === 0 ? 200 : 500,
+        });
+      }).pipe(Effect.orDie),
+    };
+  }),
+);
+
+export default SandboxLive;
diff --git a/.repos/alchemy-effect/packages/alchemy/test/vitest.setup.ts b/.repos/alchemy-effect/packages/alchemy/test/vitest.setup.ts
new file mode 100644
index 00000000000..72e947763d6
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/vitest.setup.ts
@@ -0,0 +1,8 @@
+import { config } from "dotenv";
+config({ path: ".env", quiet: true });
+
+// Polyfill File constructor for Node.js if not available
+if (typeof globalThis.File === "undefined") {
+  const { File } = require("node:buffer");
+  globalThis.File = File;
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/test/zip.test.ts b/.repos/alchemy-effect/packages/alchemy/test/zip.test.ts
new file mode 100644
index 00000000000..5b00348b62b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/test/zip.test.ts
@@ -0,0 +1,23 @@
+import { sha256 } from "@/Util/sha256";
+import { zipCode } from "@/Util/zip";
+import * as Effect from "effect/Effect";
+import { expect, test } from "vitest";
+
+test("zipCode is deterministic for identical inputs", async () => {
+  const hash = () =>
+    Effect.runPromise(
+      zipCode("export default 1", [
+        {
+          path: "index.mjs.map",
+          content: JSON.stringify({
+            version: 3,
+            sources: ["index.ts"],
+          }),
+        },
+      ]).pipe(Effect.flatMap(sha256)),
+    );
+
+  const first = await hash();
+  await new Promise((resolve) => setTimeout(resolve, 1100));
+  expect(await hash()).toBe(first);
+});
diff --git a/.repos/alchemy-effect/packages/alchemy/tsconfig.bin.json b/.repos/alchemy-effect/packages/alchemy/tsconfig.bin.json
new file mode 100644
index 00000000000..52f66120ccb
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/tsconfig.bin.json
@@ -0,0 +1,23 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["bin/**/*.ts"],
+  "compilerOptions": {
+    "composite": true,
+    "outDir": "./bin",
+    "rootDir": "./bin",
+    "noEmit": false,
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "lib": ["DOM", "DOM.Iterable", "ES2023"],
+    "rewriteRelativeImportExtensions": true
+  },
+  "references": [
+    {
+      "path": "./tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/tsconfig.bundle.json b/.repos/alchemy-effect/packages/alchemy/tsconfig.bundle.json
new file mode 100644
index 00000000000..20d3b1924bd
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/tsconfig.bundle.json
@@ -0,0 +1,6 @@
+{
+  "include": ["bin"],
+  "compilerOptions": {
+    "noEmit": true
+  }
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/tsconfig.json b/.repos/alchemy-effect/packages/alchemy/tsconfig.json
new file mode 100644
index 00000000000..08e1458f47e
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["package.json", "src/**/*.ts", "src/**/*.tsx", "src/**/*.json"],
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": false,
+    "outDir": "./lib",
+    "rootDir": "./src",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    // Solid is the default JSX runtime in this package; React files opt in per-file.
+    "jsx": "react-jsx",
+    "jsxImportSource": "@opentui/solid",
+    "lib": ["DOM", "DOM.Iterable", "ES2023"]
+  }
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/tsconfig.test.json b/.repos/alchemy-effect/packages/alchemy/tsconfig.test.json
new file mode 100644
index 00000000000..309de96c75b
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/tsconfig.test.json
@@ -0,0 +1,32 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["package.json", "test"],
+  "exclude": [
+    "test/Local/fixtures/rpc-server-entry.ts",
+    "test/Local/fixtures/rpc-spawner-parent.ts"
+  ],
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": true,
+    "outDir": "./lib",
+    "rootDir": ".",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "target": "ESNext",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    // Solid is the default JSX runtime in this package; React files opt in per-file.
+    "jsx": "react-jsx",
+    "jsxImportSource": "@opentui/solid",
+    "lib": ["DOM", "DOM.Iterable", "ES2023"]
+  },
+  "references": [
+    {
+      "path": "./tsconfig.json"
+    },
+    {
+      "path": "./tsconfig.bin.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/packages/alchemy/tsdown.config.ts b/.repos/alchemy-effect/packages/alchemy/tsdown.config.ts
new file mode 100644
index 00000000000..bf9d7d3a575
--- /dev/null
+++ b/.repos/alchemy-effect/packages/alchemy/tsdown.config.ts
@@ -0,0 +1,37 @@
+import { defineConfig } from "tsdown";
+
+export default [
+  // bundle the CLi into a standalone executable
+  // defineConfig({
+  //   entry: ["bin/alchemy.ts"],
+  //   format: ["esm"],
+  //   clean: false,
+  //   shims: true,
+  //   outDir: "bin",
+  //   dts: false,
+  //   sourcemap: true,
+  //   outputOptions: {
+  //     inlineDynamicImports: true,
+  //   },
+  //   noExternal: ["execa", "open", "env-paths"],
+  //   tsconfig: "tsconfig.bundle.json",
+  // }),
+  // bundle the dev-mode worker entrypoint. dev.ts spawns this in a child bun
+  // process; under a published install it loads from node_modules and would
+  // otherwise need react/ink/pathe at runtime to resolve InkCLI.tsx as source.
+  // Bundling inlines those so they stay devDependencies (same rationale as
+  // the cli bundle below).
+  defineConfig({
+    entry: ["bin/exec.ts"],
+    format: ["esm"],
+    clean: false,
+    shims: true,
+    outDir: "bin",
+    dts: false,
+    sourcemap: true,
+    outputOptions: {
+      inlineDynamicImports: true,
+    },
+    tsconfig: "tsconfig.bundle.json",
+  }),
+];
diff --git a/.repos/alchemy-effect/packages/better-auth/package.json b/.repos/alchemy-effect/packages/better-auth/package.json
new file mode 100644
index 00000000000..523c35fa40d
--- /dev/null
+++ b/.repos/alchemy-effect/packages/better-auth/package.json
@@ -0,0 +1,35 @@
+{
+  "name": "@alchemy.run/better-auth",
+  "version": "2.0.0-beta.49",
+  "license": "Apache-2.0",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "packages/better-auth"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "scripts": {
+    "build": "bun pm pack"
+  },
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "default": "./lib/index.js",
+      "types": "./lib/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "peerDependencies": {
+    "better-auth": "catalog:"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}
diff --git a/.repos/alchemy-effect/packages/better-auth/src/BetterAuth.ts b/.repos/alchemy-effect/packages/better-auth/src/BetterAuth.ts
new file mode 100644
index 00000000000..e5c35a51745
--- /dev/null
+++ b/.repos/alchemy-effect/packages/better-auth/src/BetterAuth.ts
@@ -0,0 +1,13 @@
+import type { RuntimeContext } from "alchemy";
+import type { HttpEffect } from "alchemy/Http";
+import { type Auth } from "better-auth";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+
+export class BetterAuth extends Context.Service<
+  BetterAuth,
+  {
+    auth: Effect.Effect<Auth<any>, never, RuntimeContext>;
+    fetch: HttpEffect<RuntimeContext>;
+  }
+>()("BetterAuth") {}
diff --git a/.repos/alchemy-effect/packages/better-auth/src/CloudflareD1.ts b/.repos/alchemy-effect/packages/better-auth/src/CloudflareD1.ts
new file mode 100644
index 00000000000..66f55fb6f92
--- /dev/null
+++ b/.repos/alchemy-effect/packages/better-auth/src/CloudflareD1.ts
@@ -0,0 +1,42 @@
+import { Random } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { betterAuth as makeBetterAuth } from "better-auth";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { BetterAuth } from "./BetterAuth.ts";
+
+export const CloudflareD1 = Layer.effect(
+  BetterAuth,
+  Effect.gen(function* () {
+    const d1 = yield* Cloudflare.D1Database("BetterAuth");
+
+    const connection = yield* Cloudflare.D1Connection.bind(d1);
+
+    const BETTER_AUTH_SECRET = yield* Random("BETTER_AUTH_SECRET");
+
+    const betterAuthSecret = yield* BETTER_AUTH_SECRET.text;
+
+    const betterAuth = yield* Effect.gen(function* () {
+      return makeBetterAuth({
+        database: yield* connection.raw,
+        secret: yield* betterAuthSecret.pipe(Effect.map(Redacted.value)),
+      });
+    }).pipe(Effect.cached);
+
+    return {
+      auth: betterAuth,
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const auth = yield* betterAuth;
+
+        const response = yield* Effect.promise(() =>
+          auth.handler(request.source as Request),
+        );
+        return HttpServerResponse.fromWeb(response);
+      }),
+    };
+  }),
+).pipe(Layer.provide(Cloudflare.D1ConnectionLive));
diff --git a/.repos/alchemy-effect/packages/better-auth/src/index.ts b/.repos/alchemy-effect/packages/better-auth/src/index.ts
new file mode 100644
index 00000000000..292458b3257
--- /dev/null
+++ b/.repos/alchemy-effect/packages/better-auth/src/index.ts
@@ -0,0 +1,2 @@
+export * from "./BetterAuth.ts";
+export * from "./CloudflareD1.ts";
diff --git a/.repos/alchemy-effect/packages/better-auth/tsconfig.json b/.repos/alchemy-effect/packages/better-auth/tsconfig.json
new file mode 100644
index 00000000000..c064d4844a5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/better-auth/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["src/**/*.ts"],
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": false,
+    "outDir": "./lib",
+    "rootDir": "./src"
+  },
+  "references": [
+    {
+      "path": "../alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/packages/pr-package/README.md b/.repos/alchemy-effect/packages/pr-package/README.md
new file mode 100644
index 00000000000..430fdec439f
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/README.md
@@ -0,0 +1,165 @@
+# @alchemy.run/pr-package
+
+A self-hostable PR-package service for Cloudflare. Publish ephemeral, tag-addressable npm tarballs (e.g. one per PR commit) and install them with a pretty URL like `https://pkg.ing/<pkg>/<sha>`.
+
+It packages four Cloudflare resources into a single Effect `handler`:
+
+- **R2** bucket — stores `.tgz` blobs
+- **KV** namespace — tag → resourceId index
+- **Secrets Store** + a `Random`-generated **bearer token** — gates writes
+- **Durable Object** — per-resource download stats and TTL state
+
+## Install
+
+```sh
+bun add @alchemy.run/pr-package
+```
+
+## Usage
+
+The package exposes a `handler(options)` Effect that you wire into a `Cloudflare.Worker` you own. The reason it can't own the worker for you: Cloudflare bundles the worker starting from a single entry file, and `parseAliasUrl` is a JS closure — it has to live in (or be reachable from) your stack file's module graph. So the worker class lives in your project, and the package contributes the routing.
+
+### Minimum viable
+
+Two-file pattern, mirroring how `stacks/otel/Ingester.ts` is split out from `stacks/otel.ts`:
+
+```ts
+// stacks/pr-package/Api.ts — the worker entry (main: import.meta.path)
+import * as PrPackage from "@alchemy.run/pr-package";
+import * as Cloudflare from "alchemy/Cloudflare";
+
+const parseAliasUrl: PrPackage.ParseAliasUrl = (url) => {
+  // Map any alias host's URL to { pkgName, tag }, or return null to fall through.
+  // E.g. https://pkg.example.com/<pkg>/<tag>:
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments.length === 2) {
+    return { pkgName: segments[0]!, tag: segments[1]! };
+  }
+  return null;
+};
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "PrPackageWorker",
+  {
+    main: import.meta.path,
+    url: true,
+    domain: ["pkg.example.com"],
+    compatibility: { flags: ["nodejs_compat"], date: "2026-03-17" },
+  },
+  PrPackage.handler({ parseAliasUrl }),
+) {}
+```
+
+```ts
+// stacks/pr-package.ts — the stack
+import * as PrPackage from "@alchemy.run/pr-package";
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Api from "./pr-package/Api.ts";
+
+export default Alchemy.Stack(
+  "PrPackage",
+  { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    const authToken = yield* PrPackage.AuthTokenValue;
+    const api = yield* Api;
+    return {
+      url: api.url.as<string>(),
+      authToken: authToken.text, // Redacted bearer token for uploads
+    };
+  }),
+);
+```
+
+Deploy:
+
+```sh
+bun alchemy deploy ./stacks/pr-package.ts --stage prod
+```
+
+The stack output gives you the worker URL and the auto-generated bearer token. Save the token — you'll need it to publish.
+
+> **Why two files?** Putting the `Worker` class and `Alchemy.Stack(...)` in the same file pulls the alchemy CLI/state-store surface into the worker bundle and breaks at runtime (`No such module "sisteransi"` and similar). Splitting the worker class into its own file keeps the worker bundle minimal.
+
+### `handler(options)` options
+
+| Option          | Type                                | Default          | Notes                                                                |
+| --------------- | ----------------------------------- | ---------------- | -------------------------------------------------------------------- |
+| `parseAliasUrl` | `(url: URL) => AliasMatch \| null`  | `() => null`     | Maps any non-`/projects/...` GET to `{ pkgName, tag }` for a 301.    |
+| `defaultTtl`    | `string` (Effect Duration)          | `"3 weeks"`      | TTL applied when an upload doesn't pass `X-TTL`.                     |
+
+`AliasMatch` is `{ pkgName: string; tag: string }`. Returning `null` falls through to the regular `/projects/:pkgName/...` matcher.
+
+## API
+
+All routes are scoped by `:pkgName`, which can be scoped (`@scope/name`) or unscoped (`name`) — matches npm package naming.
+
+### `PUT /projects/:pkgName/packages` — upload
+
+Headers:
+- `Authorization: Bearer <token>` (required)
+- `Content-Type: application/gzip`
+- `X-Tags: <json-array>` (required) — e.g. `["main","abc1234","abc1234abc1234..."]`
+- `X-TTL: <duration>` (optional) — e.g. `"7 hours"`, `"3 weeks"`. Effect `Duration` syntax.
+- `Content-Length` (required)
+
+Body: raw `.tgz` stream. Streamed straight to R2.
+
+Returns `{ resourceId, project, tags, ttl, expiresAt }`.
+
+If a tag was already pointing somewhere, the old resource has the tag removed; if it was the resource's last tag, the blob and metadata are deleted.
+
+### `GET /<alias-path>` — pretty install URL → 301
+
+Whenever the path doesn't start with `/projects/`, the request URL is handed to `parseAliasUrl(url)`. If it returns a match, the worker 301s to `/projects/:pkgName/tags/:tag`. Otherwise 404.
+
+### `GET /projects/:pkgName/tags/:tag` — resolve tag → 302 to blob
+
+Looks up `tag → resourceId`, records a download in the per-resource Durable Object, and 302s to `/projects/:pkgName/packages/:resourceId`.
+
+### `GET /projects/:pkgName/packages/:resourceId` — serve blob
+
+Returns the `.tgz` with `cache-control: public, max-age=31536000, immutable`. No auth required (resourceIds are unguessable UUIDs).
+
+### `DELETE /projects/:pkgName/tags/:tag` — remove tag
+
+Auth required. If the tag was the resource's last one, the blob and metadata are also deleted.
+
+### `GET /projects/:pkgName/packages/:resourceId/stats` — download stats
+
+Auth required. Returns `{ downloads: { [tag]: number }, totalDownloads: number }`.
+
+## Publishing from CI
+
+```sh
+bun pm pack --destination .
+tgz=$(ls *.tgz)
+curl -fsSL --show-error -X PUT \
+  "https://pkg.example.com/projects/my-pkg/packages" \
+  -H "Authorization: Bearer ${PR_PACKAGE_TOKEN}" \
+  -H "X-Tags: $(jq -nc --arg sha "$GITHUB_SHA" --arg short "${GITHUB_SHA:0:7}" '[$short, $sha, "main"]')" \
+  -H "Content-Type: application/gzip" \
+  --data-binary "@${tgz}"
+```
+
+Then consumers install with:
+
+```sh
+bun add https://pkg.example.com/projects/my-pkg/tags/abc1234
+# or via parseAliasUrl, e.g.:
+bun add https://pkg.example.com/my-pkg/abc1234
+```
+
+See `.github/workflows/pr-package.yaml` in this repo for the full pipeline (publish on push/PR sync, sticky comment with install URLs, tag cleanup on PR close).
+
+## Cleaning up state
+
+If a deploy errors mid-flight and leaves orphan state:
+
+```sh
+bun alchemy state resources <StackName> <stage> ./your/stack.ts --profile <p>
+bun alchemy state clear     <StackName> <stage> ./your/stack.ts --profile <p> --yes
+```
+
+Then reconcile any actually-created Cloudflare resources via the dashboard before redeploying.
diff --git a/.repos/alchemy-effect/packages/pr-package/package.json b/.repos/alchemy-effect/packages/pr-package/package.json
new file mode 100644
index 00000000000..a6c8837a06a
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/package.json
@@ -0,0 +1,34 @@
+{
+  "name": "@alchemy.run/pr-package",
+  "version": "2.0.0-beta.49",
+  "license": "Apache-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "packages/pr-package"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "scripts": {
+    "build": "bun pm pack"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "import": "./lib/index.js"
+    }
+  },
+  "dependencies": {
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}
diff --git a/.repos/alchemy-effect/packages/pr-package/src/AuthToken.ts b/.repos/alchemy-effect/packages/pr-package/src/AuthToken.ts
new file mode 100644
index 00000000000..c63e497f5ae
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/AuthToken.ts
@@ -0,0 +1,18 @@
+import { Random } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export const SecretsStore = Cloudflare.SecretsStore("PrPackageSecrets");
+
+/** Random-generated bearer token. Yield to read `.text` from your stack. */
+export const AuthTokenValue = Random("PrPackageAuthTokenValue");
+
+/** Cloudflare Secret bound to the worker. Internal — yielded by `handler`. */
+export const AuthToken = Effect.gen(function* () {
+  const store = yield* SecretsStore;
+  const value = yield* AuthTokenValue;
+  return yield* Cloudflare.Secret("PrPackageAuthToken", {
+    store,
+    value: value.text,
+  });
+});
diff --git a/.repos/alchemy-effect/packages/pr-package/src/Bucket.ts b/.repos/alchemy-effect/packages/pr-package/src/Bucket.ts
new file mode 100644
index 00000000000..11e6c6f8169
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/Bucket.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Bucket = Cloudflare.R2Bucket("PrPackageBucket");
diff --git a/.repos/alchemy-effect/packages/pr-package/src/PackageStore.ts b/.repos/alchemy-effect/packages/pr-package/src/PackageStore.ts
new file mode 100644
index 00000000000..2e2a8810345
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/PackageStore.ts
@@ -0,0 +1,78 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+interface PackageState {
+  tags: string[];
+  expiresAt: number;
+  downloads: Record<string, number>;
+  totalDownloads: number;
+}
+
+const emptyState: PackageState = {
+  tags: [],
+  expiresAt: 0,
+  downloads: {},
+  totalDownloads: 0,
+};
+
+export default class PackageStore extends Cloudflare.DurableObjectNamespace<PackageStore>()(
+  "PackageStore",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const doState = yield* Cloudflare.DurableObjectState;
+
+      const getState = Effect.gen(function* () {
+        const stored = yield* doState.storage.get<PackageState>("state");
+        return stored ?? emptyState;
+      });
+
+      const setState = (s: PackageState) => doState.storage.put("state", s);
+
+      return {
+        init: (tags: string[], expiresAt: number) =>
+          Effect.gen(function* () {
+            const current = yield* getState;
+            const merged = new Set([...current.tags, ...tags]);
+            const newState: PackageState = {
+              tags: [...merged],
+              expiresAt,
+              downloads: current.downloads,
+              totalDownloads: current.totalDownloads,
+            };
+            yield* setState(newState);
+          }),
+
+        removeTag: (tag: string) =>
+          Effect.gen(function* () {
+            const current = yield* getState;
+            const tags = current.tags.filter((t) => t !== tag);
+            yield* setState({ ...current, tags });
+            return { orphaned: tags.length === 0 };
+          }),
+
+        recordDownload: (tag: string) =>
+          Effect.gen(function* () {
+            const current = yield* getState;
+            const downloads = { ...current.downloads };
+            downloads[tag] = (downloads[tag] ?? 0) + 1;
+            yield* setState({
+              ...current,
+              downloads,
+              totalDownloads: current.totalDownloads + 1,
+            });
+          }),
+
+        getStats: () =>
+          Effect.gen(function* () {
+            const current = yield* getState;
+            return {
+              downloads: current.downloads,
+              totalDownloads: current.totalDownloads,
+            };
+          }),
+
+        getState: () => getState,
+      };
+    });
+  }),
+) {}
diff --git a/.repos/alchemy-effect/packages/pr-package/src/TagIndex.ts b/.repos/alchemy-effect/packages/pr-package/src/TagIndex.ts
new file mode 100644
index 00000000000..9fc3b11d7ef
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/TagIndex.ts
@@ -0,0 +1,3 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const TagIndex = Cloudflare.KVNamespace("PrPackageTagIndex");
diff --git a/.repos/alchemy-effect/packages/pr-package/src/Worker.ts b/.repos/alchemy-effect/packages/pr-package/src/Worker.ts
new file mode 100644
index 00000000000..fece272eb10
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/Worker.ts
@@ -0,0 +1,352 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import {
+  aliasRedirectPath,
+  type AliasParserOptions,
+  type ParseAliasUrl,
+} from "./aliases.ts";
+import { AuthToken } from "./AuthToken.ts";
+import { Bucket } from "./Bucket.ts";
+import PackageStore from "./PackageStore.ts";
+import { TagIndex } from "./TagIndex.ts";
+
+class Unauthorized {
+  readonly _tag = "Unauthorized";
+}
+
+export interface HandlerOptions extends AliasParserOptions {
+  /** Default TTL when X-TTL is not provided on upload. e.g. "3 weeks". */
+  defaultTtl?: string;
+}
+
+const bindings = Layer.mergeAll(
+  Cloudflare.R2BucketBindingLive,
+  Cloudflare.KVNamespaceBindingLive,
+  Cloudflare.SecretBindingLive,
+);
+
+/**
+ * Init effect for a pr-package worker. Pass as the third argument to
+ * `Cloudflare.Worker<X>()(...)` in your stack file.
+ *
+ * The user's stack file must be the worker entry (`main: import.meta.filename`)
+ * because `parseAliasUrl` is a closure that has to live in the bundle.
+ *
+ * @example
+ * ```ts
+ * import * as PrPackage from "@alchemy.run/pr-package";
+ *
+ * class Api extends Cloudflare.Worker<Api>()(
+ *   "Api",
+ *   { main: import.meta.filename, url: true, ... },
+ *   PrPackage.handler({
+ *     parseAliasUrl: (url) => ({ pkgName: "...", tag: "..." }),
+ *   }),
+ * ) {}
+ * ```
+ */
+export const handler = (options: HandlerOptions = {}) =>
+  Effect.gen(function* () {
+    const r2 = yield* Cloudflare.R2Bucket.bind(yield* Bucket);
+    const kv = yield* Cloudflare.KVNamespace.bind(yield* TagIndex);
+    const authToken = yield* Cloudflare.Secret.bind(yield* AuthToken);
+    const packages = yield* PackageStore;
+
+    const parseAliasUrl: ParseAliasUrl = options.parseAliasUrl ?? (() => null);
+    const defaultTtl = options.defaultTtl ?? "3 weeks";
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const host = request.headers.host ?? "localhost";
+        const url = new URL(request.url, `https://${host}`);
+        const path = url.pathname;
+        const method = request.method;
+
+        const requireAuth = Effect.gen(function* () {
+          const authHeader = request.headers.authorization;
+          const expected = yield* authToken;
+          if (!authHeader || authHeader !== `Bearer ${expected}`) {
+            return yield* Effect.fail(new Unauthorized());
+          }
+        });
+
+        // Pretty alias paths 301 → /projects/:pkgName/tags/:tag (relative).
+        if (method === "GET" && !path.startsWith("/projects/")) {
+          const match = parseAliasUrl(url);
+          if (match) {
+            return HttpServerResponse.fromWeb(
+              new Response(null, {
+                status: 301,
+                headers: { location: aliasRedirectPath(match) },
+              }),
+            );
+          }
+        }
+
+        // Route: /projects/:pkgName/...
+        const projectMatch = path.match(
+          /^\/projects\/((?:@|%40)[^/]+\/[^/]+|[^/]+)(\/.*)?$/i,
+        );
+        if (!projectMatch) {
+          return HttpServerResponse.text("Not Found", { status: 404 });
+        }
+        const project = decodeURIComponent(projectMatch[1]);
+        const subPath = projectMatch[2] || "/";
+
+        // --- PUT /projects/:pkgName/packages ---
+        if (method === "PUT" && subPath === "/packages") {
+          return yield* Effect.gen(function* () {
+            yield* requireAuth;
+
+            const tagsRaw = request.headers["x-tags"];
+            const ttlRaw = request.headers["x-ttl"];
+            const contentLength = Number(
+              request.headers["content-length"] ?? 0,
+            );
+
+            if (!tagsRaw) {
+              return yield* HttpServerResponse.json(
+                { error: "X-Tags header is required" },
+                { status: 400 },
+              );
+            }
+
+            let tags: string[];
+            try {
+              tags = JSON.parse(tagsRaw);
+              if (!Array.isArray(tags) || tags.length === 0) {
+                return yield* HttpServerResponse.json(
+                  { error: "X-Tags must be a non-empty JSON array of strings" },
+                  { status: 400 },
+                );
+              }
+            } catch {
+              return yield* HttpServerResponse.json(
+                { error: "X-Tags must be valid JSON" },
+                { status: 400 },
+              );
+            }
+
+            if (!contentLength) {
+              return yield* HttpServerResponse.json(
+                { error: "Content-Length header is required" },
+                { status: 400 },
+              );
+            }
+
+            const ttlStr = ttlRaw || defaultTtl;
+            const ttlDuration = Duration.fromInput(ttlStr as Duration.Input);
+            if (ttlDuration._tag === "None") {
+              return yield* HttpServerResponse.json(
+                {
+                  error:
+                    "X-TTL must be an Effect Duration string (e.g. '7 hours', '3 weeks', '30 minutes')",
+                },
+                { status: 400 },
+              );
+            }
+            const ttlMillis = Duration.toMillis(ttlDuration.value);
+            if (ttlMillis <= 0) {
+              return yield* HttpServerResponse.json(
+                {
+                  error:
+                    "X-TTL must be a positive duration (e.g. '7 hours', '3 weeks')",
+                },
+                { status: 400 },
+              );
+            }
+            const resourceId = crypto.randomUUID();
+            const expiresAt = Date.now() + ttlMillis;
+
+            for (const tag of tags) {
+              const oldResourceId = yield* kv.get(`tag:${project}:${tag}`);
+              if (oldResourceId && oldResourceId !== resourceId) {
+                const oldStore = packages.getByName(oldResourceId);
+                const { orphaned } = yield* oldStore
+                  .removeTag(tag)
+                  .pipe(Effect.orDie);
+                if (orphaned) {
+                  yield* r2.delete(oldResourceId + ".tgz").pipe(Effect.orDie);
+                  yield* kv.delete(`metadata:${oldResourceId}`);
+                }
+              }
+            }
+
+            yield* r2
+              .put(resourceId + ".tgz", request.stream, {
+                contentLength,
+              })
+              .pipe(Effect.orDie);
+
+            for (const tag of tags) {
+              yield* kv.put(`tag:${project}:${tag}`, resourceId);
+            }
+
+            yield* kv.put(
+              `metadata:${resourceId}`,
+              JSON.stringify({ project, tags, expiresAt }),
+            );
+
+            const store = packages.getByName(resourceId);
+            yield* store.init(tags, expiresAt).pipe(Effect.orDie);
+
+            return yield* HttpServerResponse.json({
+              resourceId,
+              project,
+              tags,
+              ttl: ttlStr,
+              expiresAt,
+            });
+          }).pipe(
+            Effect.catchTag("Unauthorized", () =>
+              HttpServerResponse.json(
+                { error: "unauthorized" },
+                { status: 401 },
+              ),
+            ),
+          );
+        }
+
+        // --- GET /projects/:pkgName/tags/:tag ---
+        if (method === "GET" && subPath.startsWith("/tags/")) {
+          const tag = decodeURIComponent(subPath.slice("/tags/".length));
+          const resourceId = yield* kv.get(`tag:${project}:${tag}`);
+          if (!resourceId) {
+            return yield* HttpServerResponse.json(
+              { error: "tag not found" },
+              { status: 404 },
+            );
+          }
+
+          const store = packages.getByName(resourceId);
+          yield* store.recordDownload(tag).pipe(Effect.orDie);
+
+          const encodedProject = project
+            .split("/")
+            .map(encodeURIComponent)
+            .join("/");
+          return HttpServerResponse.fromWeb(
+            new Response(null, {
+              status: 302,
+              headers: {
+                location: `/projects/${encodedProject}/packages/${resourceId}`,
+              },
+            }),
+          );
+        }
+
+        // --- GET /projects/:pkgName/packages/:resourceId ---
+        if (
+          method === "GET" &&
+          subPath.startsWith("/packages/") &&
+          !subPath.endsWith("/stats")
+        ) {
+          const resourceId = subPath.slice("/packages/".length);
+          const object = yield* r2.get(resourceId + ".tgz").pipe(Effect.orDie);
+          if (!object) {
+            return yield* HttpServerResponse.json(
+              { error: "resource not found" },
+              { status: 404 },
+            );
+          }
+
+          const body = yield* object.arrayBuffer().pipe(Effect.orDie);
+          return HttpServerResponse.fromWeb(
+            new Response(body, {
+              status: 200,
+              headers: {
+                "content-type": "application/gzip",
+                "cache-control": "public, max-age=31536000, immutable",
+              },
+            }),
+          );
+        }
+
+        // --- DELETE /projects/:pkgName/tags/:tag ---
+        if (method === "DELETE" && subPath.startsWith("/tags/")) {
+          return yield* Effect.gen(function* () {
+            yield* requireAuth;
+
+            const tag = decodeURIComponent(subPath.slice("/tags/".length));
+            const resourceId = yield* kv.get(`tag:${project}:${tag}`);
+            if (!resourceId) {
+              return yield* HttpServerResponse.json(
+                { error: "tag not found" },
+                { status: 404 },
+              );
+            }
+
+            const store = packages.getByName(resourceId);
+            const { orphaned } = yield* store.removeTag(tag).pipe(Effect.orDie);
+
+            yield* kv.delete(`tag:${project}:${tag}`);
+
+            if (orphaned) {
+              yield* r2.delete(resourceId + ".tgz").pipe(Effect.orDie);
+              yield* kv.delete(`metadata:${resourceId}`);
+            }
+
+            return yield* HttpServerResponse.json({ ok: true });
+          }).pipe(
+            Effect.catchTag("Unauthorized", () =>
+              HttpServerResponse.json(
+                { error: "unauthorized" },
+                { status: 401 },
+              ),
+            ),
+          );
+        }
+
+        // --- GET /projects/:pkgName/packages/:resourceId/stats ---
+        if (
+          method === "GET" &&
+          subPath.startsWith("/packages/") &&
+          subPath.endsWith("/stats")
+        ) {
+          return yield* Effect.gen(function* () {
+            yield* requireAuth;
+
+            const resourceId = subPath.slice(
+              "/packages/".length,
+              -"/stats".length,
+            );
+            const meta = yield* kv.get(`metadata:${resourceId}`);
+            if (!meta) {
+              return yield* HttpServerResponse.json(
+                { error: "resource not found" },
+                { status: 404 },
+              );
+            }
+
+            const store = packages.getByName(resourceId);
+            const stats = yield* store.getStats().pipe(Effect.orDie);
+
+            return yield* HttpServerResponse.json(stats);
+          }).pipe(
+            Effect.catchTag("Unauthorized", () =>
+              HttpServerResponse.json(
+                { error: "unauthorized" },
+                { status: 401 },
+              ),
+            ),
+          );
+        }
+
+        return HttpServerResponse.text("Not Found", { status: 404 });
+      }).pipe(
+        Effect.catch((error: any) =>
+          Effect.succeed(
+            HttpServerResponse.text(
+              `Internal Server Error: ${error?.message ?? error?._tag ?? String(error)}`,
+              { status: 500 },
+            ),
+          ),
+        ),
+      ),
+    };
+  }).pipe(Effect.provide(bindings));
diff --git a/.repos/alchemy-effect/packages/pr-package/src/aliases.ts b/.repos/alchemy-effect/packages/pr-package/src/aliases.ts
new file mode 100644
index 00000000000..350ca76aaae
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/aliases.ts
@@ -0,0 +1,27 @@
+/**
+ * Pretty install URL parsing.
+ *
+ * Every non-`/projects/...` GET hands its full `URL` to `parseAliasUrl`,
+ * which returns `{ pkgName, tag }` to 301 to the canonical
+ * `/projects/:pkgName/tags/:tag` route, or `null` to fall through.
+ *
+ * Defaults to `() => null` — no aliases recognized.
+ */
+
+export interface AliasMatch {
+  pkgName: string;
+  tag: string;
+}
+
+export type ParseAliasUrl = (url: URL) => AliasMatch | null;
+
+export interface AliasParserOptions {
+  /** Parse a request URL into a package match, or `null` to fall through. */
+  parseAliasUrl?: ParseAliasUrl;
+}
+
+const encodePath = (s: string) =>
+  s.split("/").map(encodeURIComponent).join("/");
+
+export const aliasRedirectPath = (match: AliasMatch): string =>
+  `/projects/${encodePath(match.pkgName)}/tags/${encodeURIComponent(match.tag)}`;
diff --git a/.repos/alchemy-effect/packages/pr-package/src/index.ts b/.repos/alchemy-effect/packages/pr-package/src/index.ts
new file mode 100644
index 00000000000..ac86265ca84
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/src/index.ts
@@ -0,0 +1,6 @@
+export * from "./aliases.ts";
+export { AuthToken, AuthTokenValue, SecretsStore } from "./AuthToken.ts";
+export { Bucket } from "./Bucket.ts";
+export { default as PackageStore } from "./PackageStore.ts";
+export { TagIndex } from "./TagIndex.ts";
+export * from "./Worker.ts";
diff --git a/.repos/alchemy-effect/packages/pr-package/tsconfig.json b/.repos/alchemy-effect/packages/pr-package/tsconfig.json
new file mode 100644
index 00000000000..c064d4844a5
--- /dev/null
+++ b/.repos/alchemy-effect/packages/pr-package/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["src/**/*.ts"],
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": false,
+    "outDir": "./lib",
+    "rootDir": "./src"
+  },
+  "references": [
+    {
+      "path": "../alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/.repos/alchemy-effect/scripts/audit-service.ts b/.repos/alchemy-effect/scripts/audit-service.ts
new file mode 100644
index 00000000000..5686af2d0a3
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/audit-service.ts
@@ -0,0 +1,1413 @@
+#!/usr/bin/env bun
+/**
+ * Spec-Driven Service Audit Script
+ *
+ * This script analyzes a distilled AWS service spec and compares it against
+ * the alchemy implementation to identify gaps in bindings, resources,
+ * event sources, and helpers.
+ *
+ * Usage:
+ *   bun scripts/audit-service.ts dynamodb
+ *   bun scripts/audit-service.ts s3
+ *   bun scripts/audit-service.ts --json dynamodb
+ */
+
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+// ============ Types ============
+
+interface Operation {
+  name: string;
+  camelCase: string;
+  pascalCase: string;
+  category: OperationCategory;
+  resourceArity: ResourceArity;
+  impliesResource: boolean;
+  impliesEventSource: boolean;
+  implemented: boolean;
+  registeredInProviders: boolean;
+  registeredInIndex: boolean;
+}
+
+type OperationCategory =
+  | "binding" // Data-plane operation that becomes a Binding.Service
+  | "resource-lifecycle" // create/update/delete operations that imply a Resource
+  | "event-source" // stream/notification operations
+  | "helper-candidate" // operations that might become ergonomic helpers
+  | "internal"; // operations unlikely to be exposed directly
+
+type ResourceArity =
+  | 0 // account/service scoped (e.g., ListBuckets, DescribeLimits)
+  | 1 // single resource scoped (e.g., GetObject(Bucket), GetItem(Table))
+  | 2 // fixed multi-resource (e.g., CopyObject(SourceBucket, DestBucket))
+  | "n"; // variadic resource set (e.g., ExecuteTransaction(TableA, TableB, ...))
+
+interface AuditReport {
+  service: string;
+  distilledPath: string;
+  alchemyPath: string;
+  bindingTestPath: string;
+  totalOperations: number;
+  implementedBindings: Operation[];
+  missingBindings: Operation[];
+  resourceLifecycleOps: Operation[];
+  eventSourceOps: Operation[];
+  helperCandidates: Operation[];
+  internalOps: Operation[];
+  canonicalResources: CanonicalResource[];
+  suggestedHelpers: SuggestedHelper[];
+  registrationGaps: RegistrationGap[];
+  missingBindingTests: string[];
+  leastPrivilegeWarnings: LeastPrivilegeWarning[];
+}
+
+interface CanonicalResource {
+  name: string;
+  impliedByOperations: string[];
+  hasProvider: boolean;
+  suggestedBindings: string[];
+}
+
+interface SuggestedHelper {
+  name: string;
+  pattern: string;
+  basedOn: string[];
+  existingExample: string | null;
+}
+
+interface RegistrationGap {
+  type: "provider" | "index" | "policy";
+  file: string;
+  missing: string[];
+}
+
+interface LeastPrivilegeWarning {
+  binding: string;
+  file: string;
+  resourceArity: ResourceArity;
+  message: string;
+}
+
+// ============ Operation Classification Rules ============
+
+// Resource lifecycle operations create/update/delete the resource ITSELF (Table, Bucket, Queue)
+// NOT operations on items within a resource (deleteItem is a binding, deleteTable is lifecycle)
+const RESOURCE_LIFECYCLE_PATTERNS = [
+  /^createTable$/,
+  /^deleteTable$/,
+  /^updateTable$/,
+  /^createBucket$/,
+  /^deleteBucket$/,
+  /^createQueue$/,
+  /^deleteQueue$/,
+  /^createFunction$/,
+  /^deleteFunction$/,
+  /^updateFunctionCode$/,
+  /^updateFunctionConfiguration$/,
+  /^createStream$/,
+  /^deleteStream$/,
+  /^createPipe$/,
+  /^deletePipe$/,
+  /^updatePipe$/,
+  /^createTopic$/,
+  /^deleteTopic$/,
+  /^createSchedule$/,
+  /^deleteSchedule$/,
+  /^updateSchedule$/,
+  /^createScheduleGroup$/,
+  /^deleteScheduleGroup$/,
+  /^put[A-Z].*(?:Policy|Configuration|Settings)$/,
+];
+
+const EVENT_SOURCE_PATTERNS = [
+  /stream/i,
+  /kinesis/i,
+  /notification/i,
+  /subscription/i,
+  /^describe.*Stream/,
+  /^enable.*Stream/,
+  /^disable.*Stream/,
+  /StreamingDestination/i,
+];
+
+// Operations that are both bindings AND helper candidates (will be classified as bindings first)
+// These are data-plane operations that might benefit from higher-level wrappers
+const HELPER_CANDIDATE_PATTERNS = [
+  /^batch/i,
+  /^transact/i,
+  /^execute.*Statement/,
+];
+
+// Core data-plane bindings (these should always be classified as bindings)
+const CORE_BINDING_PATTERNS = [
+  /^get(?:Item|Object|Message|Record)$/i,
+  /^put(?:Item|Object|Record)$/i,
+  /^delete(?:Item|Object|Message)$/i,
+  /^update(?:Item)$/i,
+  /^query$/i,
+  /^scan$/i,
+  /^send(?:Message|Record)$/i,
+  /^receive(?:Message)$/i,
+  /^head(?:Object|Bucket)$/i,
+  /^list(?:Objects|ObjectsV2)$/i,
+  /^copy(?:Object)$/i,
+  /^upload(?:Part)$/i,
+  /^complete(?:MultipartUpload)$/i,
+  /^create(?:MultipartUpload)$/i,
+  /^abort(?:MultipartUpload)$/i,
+];
+
+const INTERNAL_PATTERNS = [
+  /^describe(?:Endpoints|Limits)$/,
+  /^list(?:Tags|Backups|Exports|Imports|GlobalTables|ContributorInsights)$/,
+  /^tag/i,
+  /^untag/i,
+  /Backup/i,
+  /Export/i,
+  /Import/i,
+  /GlobalTable(?!s$)/i,
+  /ReplicaAutoScaling/i,
+  /ContributorInsights/i,
+  /ResourcePolicy/i,
+  /ContinuousBackups/i,
+];
+
+const ZERO_ARITY_PATTERNS = [
+  /^list(?:Tables|Buckets|Queues|Functions|Streams)$/i,
+  /^describe(?:Endpoints|Limits|Account)$/i,
+];
+
+const FIXED_MULTI_ARITY_PATTERNS = [/^copy/i, /^replicate/i, /^restore.*From/i];
+
+const N_ARITY_PATTERNS = [
+  /^batch/i,
+  /^transact/i,
+  /^execute.*Statement/i,
+  /^execute.*Transaction/i,
+];
+
+// ============ Utilities ============
+
+function toPascalCase(str: string): string {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+
+function toCamelCase(str: string): string {
+  return str.charAt(0).toLowerCase() + str.slice(1);
+}
+
+function matchesAnyPattern(name: string, patterns: RegExp[]): boolean {
+  return patterns.some((p) => p.test(name));
+}
+
+function classifyOperation(
+  serviceName: string,
+  name: string,
+): {
+  category: OperationCategory;
+  resourceArity: ResourceArity;
+  impliesResource: boolean;
+  impliesEventSource: boolean;
+} {
+  if (serviceName === "iam") {
+    const lifecycleIamOps = new Set([
+      "createAccessKey",
+      "deleteAccessKey",
+      "updateAccessKey",
+      "createAccountAlias",
+      "deleteAccountAlias",
+      "updateAccountPasswordPolicy",
+      "deleteAccountPasswordPolicy",
+      "createGroup",
+      "deleteGroup",
+      "updateGroup",
+      "createInstanceProfile",
+      "deleteInstanceProfile",
+      "createLoginProfile",
+      "deleteLoginProfile",
+      "updateLoginProfile",
+      "createOpenIDConnectProvider",
+      "deleteOpenIDConnectProvider",
+      "createPolicy",
+      "deletePolicy",
+      "createRole",
+      "deleteRole",
+      "updateRole",
+      "createSAMLProvider",
+      "deleteSAMLProvider",
+      "updateSAMLProvider",
+      "deleteServerCertificate",
+      "updateServerCertificate",
+      "createServiceSpecificCredential",
+      "deleteServiceSpecificCredential",
+      "updateServiceSpecificCredential",
+      "deleteSigningCertificate",
+      "updateSigningCertificate",
+      "deleteSSHPublicKey",
+      "updateSSHPublicKey",
+      "createUser",
+      "deleteUser",
+      "updateUser",
+      "createVirtualMFADevice",
+      "deleteVirtualMFADevice",
+    ]);
+
+    if (lifecycleIamOps.has(name)) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity:
+          name === "updateAccountPasswordPolicy" ||
+          name === "deleteAccountPasswordPolicy"
+            ? 0
+            : 1,
+        impliesResource: true,
+        impliesEventSource: false,
+      };
+    }
+
+    return {
+      category: "internal",
+      resourceArity: matchesAnyPattern(name, ZERO_ARITY_PATTERNS) ? 0 : 1,
+      impliesResource: false,
+      impliesEventSource: false,
+    };
+  }
+
+  if (serviceName === "sns") {
+    if (name === "createTopic" || name === "deleteTopic") {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: false,
+      };
+    }
+
+    if (name === "subscribe" || name === "unsubscribe") {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: true,
+      };
+    }
+  }
+
+  if (serviceName === "kinesis") {
+    if (
+      name === "registerStreamConsumer" ||
+      name === "deregisterStreamConsumer"
+    ) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: false,
+      };
+    }
+
+    if (
+      [
+        "addTagsToStream",
+        "decreaseStreamRetentionPeriod",
+        "deleteResourcePolicy",
+        "disableEnhancedMonitoring",
+        "enableEnhancedMonitoring",
+        "increaseStreamRetentionPeriod",
+        "mergeShards",
+        "putResourcePolicy",
+        "removeTagsFromStream",
+        "splitShard",
+        "startStreamEncryption",
+        "stopStreamEncryption",
+        "tagResource",
+        "untagResource",
+        "updateMaxRecordSize",
+        "updateShardCount",
+        "updateStreamMode",
+        "updateStreamWarmThroughput",
+      ].includes(name)
+    ) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: false,
+      };
+    }
+
+    if (
+      [
+        "describeAccountSettings",
+        "describeLimits",
+        "describeStream",
+        "describeStreamConsumer",
+        "describeStreamSummary",
+        "getRecords",
+        "getResourcePolicy",
+        "getShardIterator",
+        "listShards",
+        "listStreamConsumers",
+        "listStreams",
+        "listTagsForResource",
+        "putRecord",
+        "putRecords",
+        "subscribeToShard",
+      ].includes(name)
+    ) {
+      return {
+        category: "binding",
+        resourceArity: matchesAnyPattern(name, ZERO_ARITY_PATTERNS) ? 0 : 1,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+
+    if (name === "listTagsForStream" || name === "updateAccountSettings") {
+      return {
+        category: "internal",
+        resourceArity: 1,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+  }
+
+  if (serviceName === "rds-data") {
+    return {
+      category: "binding",
+      resourceArity: 1,
+      impliesResource: false,
+      impliesEventSource: false,
+    };
+  }
+
+  if (serviceName === "secrets-manager") {
+    if (["createSecret", "deleteSecret", "updateSecret"].includes(name)) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: false,
+      };
+    }
+
+    if (name === "listSecrets" || name === "getRandomPassword") {
+      return {
+        category: "binding",
+        resourceArity: 0,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+
+    if (
+      [
+        "getSecretValue",
+        "putSecretValue",
+        "describeSecret",
+        "listSecretVersionIds",
+        "getResourcePolicy",
+        "putResourcePolicy",
+        "deleteResourcePolicy",
+        "updateSecretVersionStage",
+        "validateResourcePolicy",
+      ].includes(name)
+    ) {
+      return {
+        category: "binding",
+        resourceArity: 1,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+  }
+
+  if (serviceName === "rds") {
+    if (
+      [
+        "createDBCluster",
+        "deleteDBCluster",
+        "modifyDBCluster",
+        "enableHttpEndpoint",
+        "disableHttpEndpoint",
+        "startDBCluster",
+        "stopDBCluster",
+        "rebootDBCluster",
+        "createDBClusterEndpoint",
+        "deleteDBClusterEndpoint",
+        "modifyDBClusterEndpoint",
+        "createDBClusterParameterGroup",
+        "deleteDBClusterParameterGroup",
+        "modifyDBClusterParameterGroup",
+        "createDBInstance",
+        "deleteDBInstance",
+        "modifyDBInstance",
+        "createDBParameterGroup",
+        "deleteDBParameterGroup",
+        "modifyDBParameterGroup",
+        "createDBProxy",
+        "deleteDBProxy",
+        "modifyDBProxy",
+        "createDBProxyEndpoint",
+        "deleteDBProxyEndpoint",
+        "modifyDBProxyEndpoint",
+        "modifyDBProxyTargetGroup",
+        "registerDBProxyTargets",
+        "deregisterDBProxyTargets",
+        "createDBSubnetGroup",
+        "deleteDBSubnetGroup",
+        "modifyDBSubnetGroup",
+        "createGlobalCluster",
+        "deleteGlobalCluster",
+        "modifyGlobalCluster",
+      ].includes(name)
+    ) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: false,
+      };
+    }
+
+    if (
+      [
+        "describeDBClusters",
+        "describeDBInstances",
+        "describeDBSubnetGroups",
+        "describeDBClusterParameterGroups",
+        "describeDBParameterGroups",
+        "describeDBProxies",
+        "describeDBProxyEndpoints",
+        "describeDBProxyTargetGroups",
+        "describeDBProxyTargets",
+        "listTagsForResource",
+      ].includes(name)
+    ) {
+      return {
+        category: "binding",
+        resourceArity: 1,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+  }
+
+  if (serviceName === "eventbridge") {
+    if (
+      [
+        "createEventBus",
+        "deleteEventBus",
+        "updateEventBus",
+        "putRule",
+        "deleteRule",
+        "putPermission",
+        "removePermission",
+      ].includes(name)
+    ) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity:
+          name === "putPermission" || name === "removePermission" ? 1 : 1,
+        impliesResource: true,
+        impliesEventSource: name === "putRule" || name === "deleteRule",
+      };
+    }
+
+    if (
+      [
+        "describeEventBus",
+        "listEventBuses",
+        "describeRule",
+        "listRules",
+        "listTargetsByRule",
+        "listRuleNamesByTarget",
+        "putEvents",
+        "testEventPattern",
+      ].includes(name)
+    ) {
+      return {
+        category: "binding",
+        resourceArity:
+          name === "listEventBuses" || name === "testEventPattern" ? 0 : 1,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+  }
+
+  if (serviceName === "pipes") {
+    if (
+      [
+        "createPipe",
+        "describePipe",
+        "updatePipe",
+        "deletePipe",
+        "startPipe",
+        "stopPipe",
+      ].includes(name)
+    ) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: true,
+      };
+    }
+
+    if (["listPipes", "listTagsForResource"].includes(name)) {
+      return {
+        category: "binding",
+        resourceArity: name === "listPipes" ? 0 : 1,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+  }
+
+  if (serviceName === "scheduler") {
+    if (
+      [
+        "createSchedule",
+        "getSchedule",
+        "updateSchedule",
+        "deleteSchedule",
+        "createScheduleGroup",
+        "getScheduleGroup",
+        "deleteScheduleGroup",
+      ].includes(name)
+    ) {
+      return {
+        category: "resource-lifecycle",
+        resourceArity: 1,
+        impliesResource: true,
+        impliesEventSource: true,
+      };
+    }
+
+    if (
+      ["listSchedules", "listScheduleGroups", "listTagsForResource"].includes(
+        name,
+      )
+    ) {
+      return {
+        category: "binding",
+        resourceArity: name === "listTagsForResource" ? 1 : 0,
+        impliesResource: false,
+        impliesEventSource: false,
+      };
+    }
+  }
+
+  const impliesEventSource = matchesAnyPattern(name, EVENT_SOURCE_PATTERNS);
+  const impliesResource = matchesAnyPattern(name, RESOURCE_LIFECYCLE_PATTERNS);
+  const isCoreBinding = matchesAnyPattern(name, CORE_BINDING_PATTERNS);
+
+  let category: OperationCategory;
+  if (matchesAnyPattern(name, INTERNAL_PATTERNS)) {
+    category = "internal";
+  } else if (isCoreBinding) {
+    // Core bindings take priority - these are the main data-plane operations
+    category = "binding";
+  } else if (impliesResource) {
+    category = "resource-lifecycle";
+  } else if (impliesEventSource) {
+    category = "event-source";
+  } else if (matchesAnyPattern(name, HELPER_CANDIDATE_PATTERNS)) {
+    category = "helper-candidate";
+  } else {
+    category = "binding";
+  }
+
+  let resourceArity: ResourceArity;
+  if (matchesAnyPattern(name, ZERO_ARITY_PATTERNS)) {
+    resourceArity = 0;
+  } else if (matchesAnyPattern(name, N_ARITY_PATTERNS)) {
+    resourceArity = "n";
+  } else if (matchesAnyPattern(name, FIXED_MULTI_ARITY_PATTERNS)) {
+    resourceArity = 2;
+  } else {
+    resourceArity = 1;
+  }
+
+  return { category, resourceArity, impliesResource, impliesEventSource };
+}
+
+async function inferImplementedResourceArity(
+  alchemyPath: string,
+  pascalCase: string,
+  fallback: ResourceArity,
+): Promise<ResourceArity> {
+  const file = path.join(alchemyPath, `${pascalCase}.ts`);
+
+  try {
+    const content = await fs.readFile(file, "utf-8");
+    const serviceSignatureMatch = content.match(
+      /Binding\.Service<[\s\S]*?,\s*(\([\s\S]*?\)\s*=>\s*Effect\.Effect<)/,
+    );
+
+    if (!serviceSignatureMatch) {
+      return fallback;
+    }
+
+    const signature = serviceSignatureMatch[1];
+
+    if (/\(\s*\)\s*=>\s*Effect\.Effect</.test(signature)) {
+      return 0;
+    }
+
+    if (/\(\s*\.\.\.[^)]+\)\s*=>\s*Effect\.Effect</.test(signature)) {
+      return "n";
+    }
+
+    if (/\([^)]*,[^)]*\)\s*=>\s*Effect\.Effect</.test(signature)) {
+      return 2;
+    }
+
+    if (/\([^)]*\)\s*=>\s*Effect\.Effect</.test(signature)) {
+      return 1;
+    }
+  } catch {
+    // Fall back to heuristic classification.
+  }
+
+  return fallback;
+}
+
+function formatArity(arity: ResourceArity): string {
+  return `arity=${arity}`;
+}
+
+// ============ File Parsing ============
+
+async function extractDistilledOperations(
+  distilledPath: string,
+  moduleSpecifier?: string,
+): Promise<string[]> {
+  try {
+    const content = await fs.readFile(distilledPath, "utf-8");
+    const operations: string[] = [];
+    const regex = /^export const ([a-z][a-zA-Z0-9]*): API\.OperationMethod</gm;
+
+    let match;
+    while ((match = regex.exec(content)) !== null) {
+      operations.push(match[1]);
+    }
+
+    return operations;
+  } catch {
+    if (!moduleSpecifier) {
+      throw new Error(`Could not read distilled spec: ${distilledPath}`);
+    }
+
+    const mod = await import(moduleSpecifier);
+    return Object.keys(mod)
+      .filter((key) => /^[a-z]/.test(key))
+      .sort();
+  }
+}
+
+async function getAlchemyFiles(alchemyPath: string): Promise<Set<string>> {
+  const files = new Set<string>();
+  try {
+    const entries = await fs.readdir(alchemyPath);
+    for (const entry of entries) {
+      if (entry.endsWith(".ts") && entry !== "index.ts") {
+        files.add(entry.replace(".ts", ""));
+      }
+    }
+  } catch {
+    // Directory doesn't exist
+  }
+  return files;
+}
+
+async function getIndexExports(indexPath: string): Promise<Set<string>> {
+  const exports = new Set<string>();
+  try {
+    const content = await fs.readFile(indexPath, "utf-8");
+    const regex = /export \* from ["']\.\/([^"']+)["']/g;
+    let match;
+    while ((match = regex.exec(content)) !== null) {
+      const name = match[1].replace(".ts", "").replace(".js", "");
+      exports.add(name);
+    }
+  } catch {
+    // File doesn't exist
+  }
+  return exports;
+}
+
+async function getProvidersRegistrations(
+  providersPath: string,
+  service: string,
+): Promise<{ resources: Set<string>; bindings: Set<string> }> {
+  const resources = new Set<string>();
+  const bindings = new Set<string>();
+
+  try {
+    const content = await fs.readFile(providersPath, "utf-8");
+
+    // Match DynamoDB.TableProvider(), S3.BucketProvider(), etc.
+    const resourceRegex = new RegExp(
+      `${service}\\.([A-Z][a-zA-Z0-9]+)Provider\\(\\)`,
+      "g",
+    );
+    let match;
+    while ((match = resourceRegex.exec(content)) !== null) {
+      resources.add(match[1]);
+    }
+
+    // Match DynamoDB.GetItemPolicyLive, S3.GetObjectPolicyLive, etc.
+    // Note: The binding name is like "GetItem" and the export is "GetItemPolicyLive"
+    const bindingRegex = new RegExp(
+      `${service}\\.([A-Z][a-zA-Z0-9]+)PolicyLive`,
+      "g",
+    );
+    while ((match = bindingRegex.exec(content)) !== null) {
+      bindings.add(match[1]);
+    }
+  } catch {
+    // File doesn't exist
+  }
+
+  return { resources, bindings };
+}
+
+async function getBindingTestDescribes(
+  bindingTestPath: string,
+): Promise<{ exists: boolean; describes: Set<string> }> {
+  const describes = new Set<string>();
+
+  try {
+    const content = await fs.readFile(bindingTestPath, "utf-8");
+    const regex = /describe\(\s*["']([A-Z][A-Za-z0-9]+)["']/g;
+
+    let match;
+    while ((match = regex.exec(content)) !== null) {
+      describes.add(match[1]);
+    }
+
+    return { exists: true, describes };
+  } catch {
+    return { exists: false, describes };
+  }
+}
+
+async function getLeastPrivilegeWarnings(
+  alchemyPath: string,
+  operations: Operation[],
+): Promise<LeastPrivilegeWarning[]> {
+  const warnings: LeastPrivilegeWarning[] = [];
+  const wildcardResourcePattern = /Resource:\s*\[\s*["']\*["']\s*\]/;
+
+  for (const op of operations) {
+    if (!op.implemented || op.resourceArity === 0) {
+      continue;
+    }
+
+    if (
+      op.category !== "binding" &&
+      op.category !== "helper-candidate" &&
+      op.category !== "event-source"
+    ) {
+      continue;
+    }
+
+    const file = path.join(alchemyPath, `${op.pascalCase}.ts`);
+    try {
+      const content = await fs.readFile(file, "utf-8");
+      if (wildcardResourcePattern.test(content)) {
+        warnings.push({
+          binding: op.pascalCase,
+          file,
+          resourceArity: op.resourceArity,
+          message:
+            'Resource-bound binding uses `Resource: ["*"]`; bind the canonical resource(s) explicitly so the policy stays least-privilege.',
+        });
+      }
+    } catch {
+      // Ignore missing or unreadable files; other audit checks will surface those.
+    }
+  }
+
+  return warnings.sort((a, b) => a.binding.localeCompare(b.binding));
+}
+
+// ============ Resource Inference ============
+
+function inferCanonicalResources(
+  operations: Operation[],
+  existingFiles: Set<string>,
+): CanonicalResource[] {
+  const resourceMap = new Map<
+    string,
+    { operations: string[]; bindings: string[] }
+  >();
+
+  for (const op of operations) {
+    if (op.category === "resource-lifecycle") {
+      let resourceName: string | undefined;
+
+      if (
+        ["registerStreamConsumer", "deregisterStreamConsumer"].includes(
+          op.camelCase,
+        )
+      ) {
+        resourceName = "StreamConsumer";
+      } else if (["putRule", "deleteRule"].includes(op.camelCase)) {
+        resourceName = "Rule";
+      } else if (["putPermission", "removePermission"].includes(op.camelCase)) {
+        resourceName = "Permission";
+      } else if (
+        [
+          "addTagsToStream",
+          "createStream",
+          "decreaseStreamRetentionPeriod",
+          "deleteResourcePolicy",
+          "deleteStream",
+          "disableEnhancedMonitoring",
+          "enableEnhancedMonitoring",
+          "increaseStreamRetentionPeriod",
+          "mergeShards",
+          "putResourcePolicy",
+          "removeTagsFromStream",
+          "splitShard",
+          "startStreamEncryption",
+          "stopStreamEncryption",
+          "tagResource",
+          "untagResource",
+          "updateMaxRecordSize",
+          "updateShardCount",
+          "updateStreamMode",
+          "updateStreamWarmThroughput",
+        ].includes(op.camelCase)
+      ) {
+        resourceName = "Stream";
+      }
+
+      // Extract resource name from operation like createTable -> Table
+      const match =
+        resourceName === undefined
+          ? op.camelCase.match(
+              /^(create|delete|update|describe)([A-Z][a-zA-Z]+)/,
+            )
+          : undefined;
+      if (resourceName || match) {
+        const resolvedResourceName = resourceName ?? match![2];
+        if (!resourceMap.has(resolvedResourceName)) {
+          resourceMap.set(resolvedResourceName, {
+            operations: [],
+            bindings: [],
+          });
+        }
+        resourceMap.get(resolvedResourceName)!.operations.push(op.camelCase);
+      }
+    } else if (op.category === "binding" && op.resourceArity === 1) {
+      // Associate binding with likely resource
+      // e.g., getItem, putItem, deleteItem -> Table (DynamoDB convention)
+      // This is heuristic and service-specific
+      const commonResources = [
+        "Table",
+        "Bucket",
+        "Queue",
+        "Stream",
+        "Function",
+      ];
+      for (const res of commonResources) {
+        if (!resourceMap.has(res)) {
+          resourceMap.set(res, { operations: [], bindings: [] });
+        }
+        resourceMap.get(res)!.bindings.push(op.pascalCase);
+      }
+    }
+  }
+
+  const results: CanonicalResource[] = [];
+  for (const [name, data] of resourceMap) {
+    if (data.operations.length > 0) {
+      results.push({
+        name,
+        impliedByOperations: data.operations,
+        hasProvider: existingFiles.has(name),
+        suggestedBindings: data.bindings.slice(0, 10), // Limit for readability
+      });
+    }
+  }
+
+  return results.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// ============ Helper Suggestions ============
+
+function suggestHelpers(
+  operations: Operation[],
+  service: string,
+): SuggestedHelper[] {
+  const suggestions: SuggestedHelper[] = [];
+
+  // Pattern: Stream-based helpers like notifications(bucket), messages(queue), changes(table)
+  const streamOps = operations.filter((op) => op.impliesEventSource);
+  if (streamOps.length > 0) {
+    const helperName =
+      service.toLowerCase() === "dynamodb"
+        ? "changes"
+        : service.toLowerCase() === "sqs"
+          ? "messages"
+          : service.toLowerCase() === "s3"
+            ? "notifications"
+            : "events";
+
+    suggestions.push({
+      name: `${helperName}(resource)`,
+      pattern: "Event stream subscription helper",
+      basedOn: streamOps.map((op) => op.camelCase),
+      existingExample:
+        service.toLowerCase() === "s3"
+          ? "alchemy/src/AWS/S3/BucketNotifications.ts"
+          : service.toLowerCase() === "sqs"
+            ? "alchemy/src/AWS/SQS/QueueEventSource.ts"
+            : null,
+    });
+  }
+
+  // Pattern: Batch operations -> typed batch helpers
+  const batchOps = operations.filter(
+    (op) =>
+      op.camelCase.startsWith("batch") || op.camelCase.startsWith("transact"),
+  );
+  if (batchOps.length > 0) {
+    suggestions.push({
+      name: "batch operations",
+      pattern: "Typed batch/transaction wrappers",
+      basedOn: batchOps.map((op) => op.camelCase),
+      existingExample: null,
+    });
+  }
+
+  return suggestions;
+}
+
+// ============ Main Audit Logic ============
+
+async function auditService(serviceName: string): Promise<AuditReport> {
+  const serviceNameLower = serviceName.toLowerCase();
+  const serviceNameUpper =
+    serviceName.charAt(0).toUpperCase() + serviceName.slice(1);
+
+  // Map common service names to their distilled paths and alchemy paths
+  const serviceConfig: Record<string, { distilled: string; alchemy: string }> =
+    {
+      dynamodb: { distilled: "dynamodb", alchemy: "DynamoDB" },
+      s3: { distilled: "s3", alchemy: "S3" },
+      sqs: { distilled: "sqs", alchemy: "SQS" },
+      lambda: { distilled: "lambda", alchemy: "Lambda" },
+      kinesis: { distilled: "kinesis", alchemy: "Kinesis" },
+      ec2: { distilled: "ec2", alchemy: "EC2" },
+      ecs: { distilled: "ecs", alchemy: "ECS" },
+      cloudfront: { distilled: "cloudfront", alchemy: "CloudFront" },
+      cloudwatch: { distilled: "cloudwatch", alchemy: "CloudWatch" },
+      eventbridge: { distilled: "eventbridge", alchemy: "EventBridge" },
+      iam: { distilled: "iam", alchemy: "IAM" },
+      pipes: { distilled: "pipes", alchemy: "Pipes" },
+      sns: { distilled: "sns", alchemy: "SNS" },
+      scheduler: { distilled: "scheduler", alchemy: "Scheduler" },
+      rds: { distilled: "rds", alchemy: "RDS" },
+      "rds-data": { distilled: "rds-data", alchemy: "RDSData" },
+      "secrets-manager": {
+        distilled: "secrets-manager",
+        alchemy: "SecretsManager",
+      },
+      apigateway: { distilled: "api-gateway", alchemy: "ApiGateway" },
+    };
+
+  const config = serviceConfig[serviceNameLower] || {
+    distilled: serviceNameLower,
+    alchemy: serviceNameUpper,
+  };
+
+  const preferredDistilledPath = path.resolve(
+    `.vendor/distilled/@distilled.cloud/aws/src/services/${config.distilled}.ts`,
+  );
+  const fallbackDistilledPath = path.resolve(
+    `vendor/distilled/packages/aws/src/services/${config.distilled}.ts`,
+  );
+  const resolvedDistilledPath = await fs
+    .access(preferredDistilledPath)
+    .then(() => preferredDistilledPath)
+    .catch(() =>
+      fs
+        .access(fallbackDistilledPath)
+        .then(() => fallbackDistilledPath)
+        .catch(() => undefined),
+    );
+  const distilledPath =
+    resolvedDistilledPath ?? `@distilled.cloud/aws/${config.distilled}`;
+  const alchemyPath = path.resolve(
+    `packages/alchemy/src/AWS/${config.alchemy}`,
+  );
+  const bindingTestPath = path.resolve(
+    `packages/alchemy/test/AWS/${config.alchemy}/Bindings.test.ts`,
+  );
+  const indexPath = path.join(alchemyPath, "index.ts");
+  const providersPath = path.resolve("packages/alchemy/src/AWS/Providers.ts");
+
+  // Extract data
+  const distilledOps = await extractDistilledOperations(
+    resolvedDistilledPath ?? preferredDistilledPath,
+    `@distilled.cloud/aws/${config.distilled}`,
+  );
+  const alchemyFiles = await getAlchemyFiles(alchemyPath);
+  const indexExports = await getIndexExports(indexPath);
+  const providerRegs = await getProvidersRegistrations(
+    providersPath,
+    config.alchemy,
+  );
+  const bindingTestCoverage = await getBindingTestDescribes(bindingTestPath);
+
+  // Classify operations
+  const operations: Operation[] = await Promise.all(
+    distilledOps.map(async (name) => {
+      const pascalCase = toPascalCase(name);
+      const classification = classifyOperation(serviceNameLower, name);
+      const implemented = alchemyFiles.has(pascalCase);
+      const resourceArity = implemented
+        ? await inferImplementedResourceArity(
+            alchemyPath,
+            pascalCase,
+            classification.resourceArity,
+          )
+        : classification.resourceArity;
+
+      return {
+        name,
+        camelCase: name,
+        pascalCase,
+        ...classification,
+        resourceArity,
+        implemented,
+        registeredInProviders: providerRegs.bindings.has(pascalCase),
+        registeredInIndex: indexExports.has(pascalCase),
+      };
+    }),
+  );
+
+  // Group by category
+  const implementedBindings = operations.filter(
+    (op) => op.category === "binding" && op.implemented,
+  );
+  const missingBindings = operations.filter(
+    (op) => op.category === "binding" && !op.implemented,
+  );
+  const resourceLifecycleOps = operations.filter(
+    (op) => op.category === "resource-lifecycle",
+  );
+  const eventSourceOps = operations.filter(
+    (op) => op.category === "event-source",
+  );
+  const helperCandidates = operations.filter(
+    (op) => op.category === "helper-candidate",
+  );
+  const internalOps = operations.filter((op) => op.category === "internal");
+
+  // Infer resources and helpers
+  const canonicalResources = inferCanonicalResources(operations, alchemyFiles);
+  const suggestedHelpers = suggestHelpers(operations, serviceName);
+  const leastPrivilegeWarnings = await getLeastPrivilegeWarnings(
+    alchemyPath,
+    operations,
+  );
+
+  // Find registration gaps
+  const registrationGaps: RegistrationGap[] = [];
+
+  const implementedButNotInIndex = implementedBindings.filter(
+    (op) => !op.registeredInIndex,
+  );
+  if (implementedButNotInIndex.length > 0) {
+    registrationGaps.push({
+      type: "index",
+      file: indexPath,
+      missing: implementedButNotInIndex.map((op) => op.pascalCase),
+    });
+  }
+
+  const implementedButNotInProviders = implementedBindings.filter(
+    (op) => !op.registeredInProviders,
+  );
+  if (implementedButNotInProviders.length > 0) {
+    registrationGaps.push({
+      type: "policy",
+      file: providersPath,
+      missing: implementedButNotInProviders.map(
+        (op) => `${op.pascalCase}PolicyLive`,
+      ),
+    });
+  }
+
+  const missingBindingTests = bindingTestCoverage.exists
+    ? implementedBindings
+        .filter((op) => !bindingTestCoverage.describes.has(op.pascalCase))
+        .map((op) => op.pascalCase)
+    : implementedBindings.map((op) => op.pascalCase);
+
+  return {
+    service: serviceName,
+    distilledPath,
+    alchemyPath,
+    bindingTestPath,
+    totalOperations: operations.length,
+    implementedBindings,
+    missingBindings,
+    resourceLifecycleOps,
+    eventSourceOps,
+    helperCandidates,
+    internalOps,
+    canonicalResources,
+    suggestedHelpers,
+    registrationGaps,
+    missingBindingTests,
+    leastPrivilegeWarnings,
+  };
+}
+
+// ============ Report Formatting ============
+
+function formatReport(report: AuditReport): string {
+  const lines: string[] = [];
+
+  lines.push(`\n${"=".repeat(80)}`);
+  lines.push(`SERVICE AUDIT: ${report.service.toUpperCase()}`);
+  lines.push(`${"=".repeat(80)}\n`);
+
+  lines.push(`Distilled spec: ${report.distilledPath}`);
+  lines.push(`Alchemy path:   ${report.alchemyPath}`);
+  lines.push(`Binding tests:  ${report.bindingTestPath}`);
+  lines.push(`Total operations in distilled: ${report.totalOperations}\n`);
+
+  // Summary
+  lines.push(`${"─".repeat(80)}`);
+  lines.push("SUMMARY");
+  lines.push(`${"─".repeat(80)}`);
+  lines.push(
+    `  Implemented bindings:     ${report.implementedBindings.length}`,
+  );
+  lines.push(`  Missing bindings:         ${report.missingBindings.length}`);
+  lines.push(
+    `  Resource lifecycle ops:   ${report.resourceLifecycleOps.length}`,
+  );
+  lines.push(`  Event source ops:         ${report.eventSourceOps.length}`);
+  lines.push(`  Helper candidates:        ${report.helperCandidates.length}`);
+  lines.push(`  Internal ops (skip):      ${report.internalOps.length}`);
+  lines.push(
+    `  Missing binding tests:    ${report.missingBindingTests.length}`,
+  );
+  lines.push(
+    `  Least-privilege warnings: ${report.leastPrivilegeWarnings.length}`,
+  );
+  lines.push("");
+
+  // Implemented bindings
+  if (report.implementedBindings.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("IMPLEMENTED BINDINGS");
+    lines.push(`${"─".repeat(80)}`);
+    for (const op of report.implementedBindings) {
+      const arity = `[${formatArity(op.resourceArity)}]`;
+      const regStatus = op.registeredInProviders
+        ? "✓ registered"
+        : "⚠ NOT in Providers.ts";
+      lines.push(`  ✓ ${op.pascalCase}.ts ${arity} ${regStatus}`);
+    }
+    lines.push("");
+  }
+
+  // Missing bindings (priority list)
+  if (report.missingBindings.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("MISSING BINDINGS (implement these)");
+    lines.push(`${"─".repeat(80)}`);
+
+    // Group by arity
+    const arity1 = report.missingBindings.filter(
+      (op) => op.resourceArity === 1,
+    );
+    const arity0 = report.missingBindings.filter(
+      (op) => op.resourceArity === 0,
+    );
+    const arity2 = report.missingBindings.filter(
+      (op) => op.resourceArity === 2,
+    );
+    const arityN = report.missingBindings.filter(
+      (op) => op.resourceArity === "n",
+    );
+
+    if (arity1.length > 0) {
+      lines.push("  Single-resource bindings (arity=1):");
+      for (const op of arity1.slice(0, 20)) {
+        lines.push(`    • ${op.pascalCase} (${op.camelCase})`);
+      }
+      if (arity1.length > 20) {
+        lines.push(`    ... and ${arity1.length - 20} more`);
+      }
+    }
+
+    if (arity0.length > 0) {
+      lines.push("  Service-scoped bindings (arity=0):");
+      for (const op of arity0) {
+        lines.push(`    • ${op.pascalCase} (${op.camelCase})`);
+      }
+    }
+
+    if (arity2.length > 0) {
+      lines.push("  Fixed multi-resource bindings (arity=2):");
+      for (const op of arity2) {
+        lines.push(`    • ${op.pascalCase} (${op.camelCase})`);
+      }
+    }
+
+    if (arityN.length > 0) {
+      lines.push("  Variadic resource bindings (arity=n):");
+      for (const op of arityN) {
+        lines.push(`    • ${op.pascalCase} (${op.camelCase})`);
+      }
+    }
+    lines.push("");
+  }
+
+  // Canonical resources
+  if (report.canonicalResources.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("CANONICAL RESOURCES (IaC resources to implement)");
+    lines.push(`${"─".repeat(80)}`);
+    for (const res of report.canonicalResources) {
+      const status = res.hasProvider ? "✓ has provider" : "⚠ MISSING provider";
+      lines.push(`  ${res.name}: ${status}`);
+      lines.push(`    Implied by: ${res.impliedByOperations.join(", ")}`);
+    }
+    lines.push("");
+  }
+
+  // Event source operations
+  if (report.eventSourceOps.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("EVENT SOURCE OPERATIONS");
+    lines.push(`${"─".repeat(80)}`);
+    for (const op of report.eventSourceOps) {
+      const impl = op.implemented ? "✓" : "○";
+      lines.push(`  ${impl} ${op.camelCase}`);
+    }
+    lines.push("");
+  }
+
+  // Helper suggestions
+  if (report.suggestedHelpers.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("SUGGESTED HELPERS");
+    lines.push(`${"─".repeat(80)}`);
+    for (const helper of report.suggestedHelpers) {
+      lines.push(`  ${helper.name}`);
+      lines.push(`    Pattern: ${helper.pattern}`);
+      lines.push(`    Based on: ${helper.basedOn.join(", ")}`);
+      if (helper.existingExample) {
+        lines.push(`    Example: ${helper.existingExample}`);
+      }
+    }
+    lines.push("");
+  }
+
+  // Registration gaps
+  if (report.registrationGaps.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("REGISTRATION GAPS (fix these)");
+    lines.push(`${"─".repeat(80)}`);
+    for (const gap of report.registrationGaps) {
+      lines.push(`  ${gap.type.toUpperCase()} (${gap.file}):`);
+      for (const item of gap.missing) {
+        lines.push(`    • ${item}`);
+      }
+    }
+    lines.push("");
+  }
+
+  if (report.missingBindingTests.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("MISSING BINDING TESTS (add describe blocks)");
+    lines.push(`${"─".repeat(80)}`);
+    lines.push(`  In: ${report.bindingTestPath}`);
+    for (const binding of report.missingBindingTests) {
+      lines.push(`    • describe("${binding}", ...)`);
+    }
+    lines.push("");
+  }
+
+  if (report.leastPrivilegeWarnings.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("LEAST-PRIVILEGE WARNINGS");
+    lines.push(`${"─".repeat(80)}`);
+    for (const warning of report.leastPrivilegeWarnings) {
+      lines.push(
+        `  ⚠ ${warning.binding}.ts [${formatArity(warning.resourceArity)}] (${warning.file})`,
+      );
+      lines.push(`    ${warning.message}`);
+    }
+    lines.push("");
+  }
+
+  // Helper candidate operations
+  if (report.helperCandidates.length > 0) {
+    lines.push(`${"─".repeat(80)}`);
+    lines.push("HELPER CANDIDATE OPERATIONS (consider wrapping)");
+    lines.push(`${"─".repeat(80)}`);
+    for (const op of report.helperCandidates) {
+      const impl = op.implemented ? "✓" : "○";
+      lines.push(
+        `  ${impl} ${op.camelCase} [${formatArity(op.resourceArity)}]`,
+      );
+    }
+    lines.push("");
+  }
+
+  lines.push(`${"=".repeat(80)}`);
+  lines.push("END OF AUDIT");
+  lines.push(`${"=".repeat(80)}\n`);
+
+  return lines.join("\n");
+}
+
+// ============ CLI ============
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0) {
+    console.log("Usage: bun scripts/audit-service.ts [--json] <service>");
+    console.log("Example: bun scripts/audit-service.ts dynamodb");
+    process.exit(1);
+  }
+
+  const jsonOutput = args.includes("--json");
+  const serviceName = args.filter((a) => !a.startsWith("--"))[0];
+
+  if (!serviceName) {
+    console.error("Error: No service name provided");
+    process.exit(1);
+  }
+
+  try {
+    const report = await auditService(serviceName);
+
+    if (jsonOutput) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      console.log(formatReport(report));
+    }
+  } catch (error) {
+    console.error(`Error auditing service ${serviceName}:`, error);
+    process.exit(1);
+  }
+}
+
+main();
diff --git a/.repos/alchemy-effect/scripts/cleanup-apigateway-rest-apis.sh b/.repos/alchemy-effect/scripts/cleanup-apigateway-rest-apis.sh
new file mode 100755
index 00000000000..1f6f8f68abd
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/cleanup-apigateway-rest-apis.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+#
+# Deletes API Gateway REST APIs one-by-one, retrying each delete indefinitely.
+# Intended for severely throttled accounts (TooManyRequests) after test runs.
+#
+# Usage:
+#   ./scripts/cleanup-apigateway-rest-apis.sh
+#                       # deletes every REST API whose name contains "Ag" (adjust FILTER_QUERY)
+#   ./scripts/cleanup-apigateway-rest-apis.sh /path/to/ids.txt
+#                       # one rest-api-id per line
+#
+# Environment:
+#   FILTER_QUERY               Override JMESPath for get-rest-apis (default matches `Ag`)
+#   SLEEP_BETWEEN_APIS_SECONDS Pause after each successful delete (default 2)
+#   AWS_PROFILE / AWS_REGION   Standard aws-cli
+#
+
+set -u
+
+# Let this script own retry/backoff; each nested SDK retry wastes throttle tokens.
+export AWS_MAX_ATTEMPTS=${AWS_MAX_ATTEMPTS:-1}
+export AWS_RETRY_MODE=${AWS_RETRY_MODE:-standard}
+
+FILTER_QUERY="${FILTER_QUERY:-items[?contains(name, \`Ag\`)].id}"
+
+# AWS DeleteRestApi has a hard 30s/account throttle. Match it on the inner
+# retry so we don't burn tokens with sub-30s backoff.
+sleep_between_apis_seconds="${SLEEP_BETWEEN_APIS_SECONDS:-32}"
+initial_retry_seconds="${INITIAL_RETRY_SECONDS:-32}"
+max_retry_seconds="${MAX_RETRY_SECONDS:-120}"
+
+ts() {
+  date -u +"%Y-%m-%dT%H:%M:%SZ"
+}
+
+die() {
+  printf '%s\n' "$*" >&2
+  exit 1
+}
+
+delete_one_until_ok() {
+  local id="$1"
+  local attempt=0
+
+  [[ -z "$id" ]] && return
+
+  local err
+  while true; do
+    attempt=$((attempt + 1))
+
+    if err=$(aws apigateway delete-rest-api --rest-api-id "$id" 2>&1); then
+      printf '%s deleted %s (attempt %d)\n' "$(ts)" "$id" "$attempt"
+      return 0
+    fi
+
+    local wait_sec=$initial_retry_seconds
+    if ((wait_sec > max_retry_seconds)); then
+      wait_sec=$max_retry_seconds
+    fi
+
+    printf '%s delete %s failed; retry in %ds | %s\n' \
+      "$(ts)" "$id" "$wait_sec" \
+      "$(echo "$err" | tr '\n' ' ')" >&2
+
+    sleep "$wait_sec"
+  done
+}
+
+list_ids_from_aws() {
+  aws apigateway get-rest-apis \
+    --query "$FILTER_QUERY" \
+    --output text \
+    || die "get-rest-apis failed"
+}
+
+main() {
+  if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+    sed -n '1,25p' "$0"
+    exit 0
+  fi
+
+  if [[ $# -ge 1 ]]; then
+    local f="$1"
+    [[ -f "$f" ]] || die "file not found: $f"
+
+    printf 'Deleting IDs from %s (one api at a time, infinite retries per api)\n' "$f"
+
+    while IFS= read -r id || [[ -n "${id:-}" ]]; do
+      id="${id//$'\r'/}"
+      id="${id//[$'\t ']/}"
+
+      [[ -z "$id" ]] && continue
+      printf 'next id: %s\n' "$id"
+      delete_one_until_ok "$id"
+      sleep "$sleep_between_apis_seconds"
+    done <"$f"
+
+    return 0
+  fi
+
+  printf '%s querying ids: %s\n' "$(ts)" "$FILTER_QUERY"
+
+  local ids
+  ids="$(list_ids_from_aws | tr '\t' '\n' | grep -v '^[[:space:]]*$' || true)"
+  [[ -n "$ids" ]] || printf '%s No matching REST APIs.\n' "$(ts)"
+
+  while IFS= read -r id || [[ -n "${id:-}" ]]; do
+    id="${id//$'\r'/}"
+    id="${id//[$'\t ']/}"
+
+    [[ -z "$id" ]] && continue
+    printf 'next id: %s\n' "$id"
+    delete_one_until_ok "$id"
+    sleep "$sleep_between_apis_seconds"
+  done <<<"$ids"
+}
+
+main "$@"
diff --git a/.repos/alchemy-effect/scripts/cleanup-apigateway-rest-apis.ts b/.repos/alchemy-effect/scripts/cleanup-apigateway-rest-apis.ts
new file mode 100644
index 00000000000..e9f1779b197
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/cleanup-apigateway-rest-apis.ts
@@ -0,0 +1,128 @@
+#!/usr/bin/env bun
+/**
+ * Round-robin cleanup of leftover API Gateway REST APIs in the current
+ * account/region. Companion to {@link ./cleanup-apigateway-rest-apis.sh},
+ * which iterates one API to completion before moving on; this version
+ * pulls IDs from a shared queue and re-queues anything throttled, so a
+ * single stubborn API never blocks the others.
+ *
+ * Usage:
+ *   bun scripts/cleanup-apigateway-rest-apis.ts          # name CONTAINS "Ag"
+ *   FILTER_QUERY="..." bun scripts/cleanup-apigateway-rest-apis.ts
+ *   SPACING_MS=35000 bun scripts/cleanup-apigateway-rest-apis.ts
+ *
+ * Environment:
+ *   FILTER_QUERY   JMESPath for `aws apigateway get-rest-apis --query`
+ *                  (default: items[?contains(name, `Ag`)].id)
+ *   SPACING_MS     Minimum delay between any two delete attempts.
+ *                  Default 35000 — AWS DeleteRestApi is 1 request per 30s
+ *                  account-wide, so we wait just over the window.
+ *   AWS_PROFILE    Standard AWS CLI variable.
+ *   AWS_REGION     Standard AWS CLI variable.
+ */
+import { execFileSync } from "node:child_process";
+
+type Outcome =
+  | { kind: "deleted" }
+  | { kind: "throttled" }
+  | { kind: "error"; message: string };
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+const ts = () => new Date().toISOString();
+
+const FILTER_QUERY =
+  process.env.FILTER_QUERY ?? "items[?contains(name, `Ag`)].id";
+const SPACING_MS = Number(process.env.SPACING_MS ?? 35_000);
+
+const listApis = (): string[] => {
+  const out = execFileSync(
+    "aws",
+    [
+      "apigateway",
+      "get-rest-apis",
+      "--query",
+      FILTER_QUERY,
+      "--output",
+      "text",
+    ],
+    { encoding: "utf8" },
+  );
+  return out
+    .split(/\s+/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+};
+
+const tryDelete = (id: string): Outcome => {
+  try {
+    execFileSync(
+      "aws",
+      ["apigateway", "delete-rest-api", "--rest-api-id", id],
+      {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: {
+          ...process.env,
+          // Let this script own retry/backoff; SDK retries waste tokens.
+          AWS_MAX_ATTEMPTS: "1",
+          AWS_RETRY_MODE: "standard",
+        },
+      },
+    );
+    return { kind: "deleted" };
+  } catch (e: any) {
+    const msg = String(e.stderr ?? e.message ?? e);
+    if (msg.includes("TooManyRequests") || msg.includes("Throttling")) {
+      return { kind: "throttled" };
+    }
+    if (msg.includes("NotFoundException") || msg.includes("does not exist")) {
+      return { kind: "deleted" };
+    }
+    return { kind: "error", message: msg.split("\n").slice(0, 2).join(" ") };
+  }
+};
+
+const main = async () => {
+  const ids = listApis();
+  console.log(
+    `${ts()} found ${ids.length} REST APIs to delete (filter: ${FILTER_QUERY})`,
+  );
+
+  const queue = [...ids];
+  let deleted = 0;
+  let lastAttemptAt = 0;
+
+  while (queue.length > 0) {
+    const wait = SPACING_MS - (Date.now() - lastAttemptAt);
+    if (wait > 0) {
+      await sleep(wait);
+    }
+    const id = queue.shift()!;
+    lastAttemptAt = Date.now();
+    const res = tryDelete(id);
+    if (res.kind === "deleted") {
+      deleted += 1;
+      console.log(
+        `${ts()} deleted ${id} (${deleted}/${ids.length}, ${queue.length} left)`,
+      );
+    } else if (res.kind === "throttled") {
+      // Push to the back of the queue; the next attempt will go to a
+      // different ID. This drains the throttle bucket evenly across the
+      // remaining APIs instead of stalling on a single one.
+      queue.push(id);
+      console.error(
+        `${ts()} throttled ${id} — requeued (${queue.length} left)`,
+      );
+    } else {
+      console.error(`${ts()} error ${id}: ${res.message}`);
+    }
+  }
+
+  console.log(`${ts()} done — deleted ${deleted}/${ids.length}`);
+};
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});
diff --git a/.repos/alchemy-effect/scripts/cleanup-cloudflare.ts b/.repos/alchemy-effect/scripts/cleanup-cloudflare.ts
new file mode 100644
index 00000000000..3bd0b234c8e
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/cleanup-cloudflare.ts
@@ -0,0 +1,645 @@
+#!/usr/bin/env bun
+
+// @ts-nocheck
+/**
+ * Bulk-delete Cloudflare resources in the active Alchemy profile's account.
+ *
+ * Cleans up: Workers, Hyperdrive configs, D1 databases, Queues, Workflows,
+ * R2 buckets.
+ *
+ * Workers and R2 buckets obey a name filter (alchemy-* are preserved by
+ * default). R2 buckets can't be deleted while they hold objects or custom
+ * domains, so each victim bucket is first detached from its custom domains
+ * and emptied of objects, then deleted.
+ *
+ * Workers
+ * that are queue consumers can't be deleted directly — Cloudflare returns
+ * `QueueConsumerConflict`. The script pre-builds a `scriptName → consumers`
+ * map by fanning `listConsumers` across every queue, and on conflict
+ * deletes each consumer first then retries the script delete.
+ *
+ * Hyperdrive, D1, Queues, and Workflows are deleted unconditionally
+ * (the API enforces unique names within the account; nothing to keep).
+ *
+ * Authentication resolves through the active Alchemy profile
+ * (`ALCHEMY_PROFILE`, default `default`).
+ *
+ * Usage:
+ *   bun scripts/cleanup-cloudflare.ts
+ *   KEEP=alchemy- DELETE_MATCH=pr-,distilled bun scripts/cleanup-cloudflare.ts
+ *   DRY_RUN=1 bun scripts/cleanup-cloudflare.ts
+ *   CONCURRENCY=16 bun scripts/cleanup-cloudflare.ts
+ *   SKIP=hyperdrive,d1 bun scripts/cleanup-cloudflare.ts
+ *   ALCHEMY_PROFILE=staging bun scripts/cleanup-cloudflare.ts
+ */
+import {
+  Credentials as CfCredentials,
+  formatHeaders,
+} from "@distilled.cloud/cloudflare/Credentials";
+import * as d1 from "@distilled.cloud/cloudflare/d1";
+import * as hyperdrive from "@distilled.cloud/cloudflare/hyperdrive";
+import * as queues from "@distilled.cloud/cloudflare/queues";
+import * as r2 from "@distilled.cloud/cloudflare/r2";
+import * as workers from "@distilled.cloud/cloudflare/workers";
+import * as workflows from "@distilled.cloud/cloudflare/workflows";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { AuthProviders } from "../packages/alchemy/src/Auth/AuthProvider.ts";
+import { CredentialsStoreLive } from "../packages/alchemy/src/Auth/Credentials.ts";
+import { ProfileLive } from "../packages/alchemy/src/Auth/Profile.ts";
+import { CloudflareAuth } from "../packages/alchemy/src/Cloudflare/Auth/AuthProvider.ts";
+import {
+  CloudflareEnvironment,
+  fromProfile,
+} from "../packages/alchemy/src/Cloudflare/CloudflareEnvironment.ts";
+import { fromAuthProvider } from "../packages/alchemy/src/Cloudflare/Credentials.ts";
+import {
+  PlatformServices,
+  runMain,
+} from "../packages/alchemy/src/Util/PlatformServices.ts";
+
+const KEEP = (process.env.KEEP ?? "alchemy-").toLowerCase();
+const DELETE_PATTERNS = (process.env.DELETE_MATCH ?? "")
+  .split(",")
+  .map((s) => s.trim().toLowerCase())
+  .filter((s) => s.length > 0);
+const DRY_RUN = process.env.DRY_RUN === "1";
+const CONCURRENCY = Math.max(1, Number(process.env.CONCURRENCY ?? 8));
+const SKIP = new Set(
+  (process.env.SKIP ?? "")
+    .split(",")
+    .map((s) => s.trim().toLowerCase())
+    .filter((s) => s.length > 0),
+);
+
+const shouldDeleteName = (name: string): boolean => {
+  const lower = name.toLowerCase();
+  if (DELETE_PATTERNS.some((p) => lower.includes(p))) return true;
+  if (!lower.includes(KEEP)) return true;
+  return false;
+};
+
+/**
+ * Walk every queue page in the account. The distilled SDK's `listQueues`
+ * only returns the first page (100 results); large accounts overflow.
+ */
+const listAllQueueIds = (accountId: string) =>
+  Effect.gen(function* () {
+    const credentialsEff = yield* CfCredentials;
+    const credentials = yield* credentialsEff;
+    const headers = formatHeaders(credentials);
+    const client = yield* HttpClient.HttpClient;
+
+    const ids: { queueId: string; queueName: string }[] = [];
+    for (let page = 1; ; page++) {
+      const res = yield* client.execute(
+        HttpClientRequest.get(
+          `${credentials.apiBaseUrl}/accounts/${accountId}/queues?page=${page}`,
+        ).pipe(HttpClientRequest.setHeaders(headers)),
+      );
+      const body = (yield* res.json) as {
+        result?: { queue_id?: string; queue_name?: string }[] | null;
+      };
+      const batch = body.result ?? [];
+      if (batch.length === 0) break;
+      for (const q of batch) {
+        if (q.queue_id) {
+          ids.push({
+            queueId: q.queue_id,
+            queueName: q.queue_name ?? q.queue_id,
+          });
+        }
+      }
+    }
+    return ids;
+  });
+
+/**
+ * Map `scriptName → [{queueId, consumerId}, ...]` built by fanning out
+ * `listConsumers` across every queue in the account.
+ *
+ * Used to clear queue-consumer bindings before re-trying a worker delete
+ * that failed with `QueueConsumerConflict`.
+ */
+const buildConsumerMap = (accountId: string, queueIds: ReadonlyArray<string>) =>
+  Effect.gen(function* () {
+    const map = new Map<string, { queueId: string; consumerId: string }[]>();
+    yield* Effect.forEach(
+      queueIds,
+      (queueId) =>
+        queues.listConsumers({ accountId, queueId }).pipe(
+          Effect.tap((res) =>
+            Effect.sync(() => {
+              for (const c of res.result ?? []) {
+                const consumerId = c.consumerId;
+                // The distilled SDK exposes the consumer's worker as
+                // `scriptName` (from `script_name`), not `script`.
+                const script = c.scriptName ?? undefined;
+                if (!consumerId || !script) continue;
+                const entry = map.get(script) ?? [];
+                entry.push({ queueId, consumerId });
+                map.set(script, entry);
+              }
+            }),
+          ),
+          Effect.catch(() => Effect.void),
+        ),
+      { concurrency: 8, discard: true },
+    );
+    return map;
+  });
+
+/**
+ * Last-resort cleanup: PUT a minimal script over the worker with no
+ * bindings, no queue consumer config. Cloudflare drops the queue-consumer
+ * relationship when the script's bindings list no longer contains it, so
+ * a follow-up `deleteScript` then succeeds. Used when `listQueues` has
+ * no matching consumer entry but the API still insists the worker is a
+ * consumer (orphaned reference from a deleted queue).
+ */
+const forceOverwriteAndDelete = (accountId: string, scriptName: string) =>
+  Effect.gen(function* () {
+    const credentialsEff = yield* CfCredentials;
+    const credentials = yield* credentialsEff;
+    const headers = formatHeaders(credentials);
+
+    const form = new FormData();
+    form.append(
+      "metadata",
+      JSON.stringify({ main_module: "worker.js", bindings: [] }),
+    );
+    form.append(
+      "worker.js",
+      new Blob(
+        [
+          "export default { fetch() { return new Response('deleted', { status: 410 }); } };",
+        ],
+        { type: "application/javascript+module" },
+      ),
+      "worker.js",
+    );
+
+    const client = yield* HttpClient.HttpClient;
+    yield* client.execute(
+      HttpClientRequest.put(
+        `${credentials.apiBaseUrl}/accounts/${accountId}/workers/scripts/${encodeURIComponent(scriptName)}`,
+      ).pipe(
+        HttpClientRequest.setHeaders(headers),
+        HttpClientRequest.bodyFormData(form),
+      ),
+    );
+    yield* Console.log(`  ↳ overwrote ${scriptName} with empty script`);
+    return yield* workers.deleteScript({
+      accountId,
+      scriptName,
+      force: true,
+    });
+  });
+
+const deleteWorkerWithConsumerRecovery = (
+  accountId: string,
+  scriptName: string,
+  consumers: Map<string, { queueId: string; consumerId: string }[]>,
+) =>
+  workers.deleteScript({ accountId, scriptName, force: true }).pipe(
+    Effect.catchTag("QueueConsumerConflict", () =>
+      Effect.gen(function* () {
+        const bindings = consumers.get(scriptName) ?? [];
+        if (bindings.length === 0) {
+          return yield* forceOverwriteAndDelete(accountId, scriptName);
+        }
+        for (const { queueId, consumerId } of bindings) {
+          yield* queues.deleteConsumer({ accountId, queueId, consumerId }).pipe(
+            Effect.tap(() =>
+              Console.log(
+                `  ↳ unbound consumer ${consumerId} from queue ${queueId} for ${scriptName}`,
+              ),
+            ),
+            Effect.catchTag("ConsumerNotFound", () => Effect.void),
+          );
+        }
+        return yield* workers
+          .deleteScript({ accountId, scriptName, force: true })
+          .pipe(
+            Effect.catchTag("QueueConsumerConflict", () =>
+              forceOverwriteAndDelete(accountId, scriptName),
+            ),
+          );
+      }),
+    ),
+  );
+
+interface CleanupResult {
+  readonly kind: string;
+  readonly listed: number;
+  readonly ok: number;
+  readonly fail: number;
+}
+
+const driveCleanup = <Item, E, R>(
+  kind: string,
+  items: ReadonlyArray<Item>,
+  label: (item: Item) => string,
+  del: (item: Item) => Effect.Effect<unknown, E, R>,
+): Effect.Effect<CleanupResult, never, R> =>
+  Effect.gen(function* () {
+    yield* Console.log(`\n=== ${kind} ===`);
+    yield* Console.log(`→ found ${items.length}`);
+    for (const item of items) yield* Console.log(`   - ${label(item)}`);
+    if (DRY_RUN || items.length === 0) {
+      return { kind, listed: items.length, ok: 0, fail: 0 };
+    }
+    let ok = 0;
+    let fail = 0;
+    yield* Effect.forEach(
+      items,
+      (item) =>
+        del(item).pipe(
+          Effect.tap(() =>
+            Effect.sync(() => {
+              ok += 1;
+              console.log(
+                `✓ ${kind}: deleted ${label(item)} (${ok}/${items.length})`,
+              );
+            }),
+          ),
+          Effect.catch((e) =>
+            Effect.sync(() => {
+              fail += 1;
+              console.error(`✗ ${kind}: ${label(item)}: ${String(e)}`);
+            }),
+          ),
+        ),
+      { concurrency: CONCURRENCY, discard: true },
+    );
+    return { kind, listed: items.length, ok, fail };
+  });
+
+const cleanupWorkers = (accountId: string, queueIds: ReadonlyArray<string>) =>
+  Effect.gen(function* () {
+    const consumerMap = yield* buildConsumerMap(accountId, queueIds);
+    yield* Console.log(
+      `→ queue-consumer bindings indexed for ${consumerMap.size} scripts`,
+    );
+    const all = yield* workers.listScripts.items({ accountId }).pipe(
+      Stream.runCollect,
+      Effect.map((chunk) =>
+        Array.from(chunk).flatMap((s): string[] =>
+          s.id == null ? [] : [s.id],
+        ),
+      ),
+    );
+    yield* Console.log(`→ total worker scripts: ${all.length}`);
+    const victims = all.filter(shouldDeleteName);
+    yield* Console.log(
+      `→ workers to delete: ${victims.length} (keep=${JSON.stringify(KEEP)} deleteMatch=${JSON.stringify(DELETE_PATTERNS)})`,
+    );
+    return yield* driveCleanup(
+      "workers",
+      victims,
+      (name) => name,
+      (name) => deleteWorkerWithConsumerRecovery(accountId, name, consumerMap),
+    );
+  });
+
+const cleanupHyperdrives = (accountId: string) =>
+  Effect.gen(function* () {
+    const all = yield* hyperdrive.listConfigs.items({ accountId }).pipe(
+      Stream.runCollect,
+      Effect.map((chunk) => Array.from(chunk)),
+    );
+    return yield* driveCleanup(
+      "hyperdrive",
+      all,
+      (c) => `${c.name} (${c.id})`,
+      (c) =>
+        hyperdrive
+          .deleteConfig({ accountId, hyperdriveId: c.id })
+          .pipe(Effect.catchTag("HyperdriveConfigNotFound", () => Effect.void)),
+    );
+  });
+
+const cleanupD1 = (accountId: string) =>
+  Effect.gen(function* () {
+    const all = yield* d1.listDatabases.items({ accountId }).pipe(
+      Stream.runCollect,
+      Effect.map((chunk) =>
+        Array.from(chunk).flatMap((db): { uuid: string; name: string }[] =>
+          db.uuid == null ? [] : [{ uuid: db.uuid, name: db.name ?? db.uuid }],
+        ),
+      ),
+    );
+    return yield* driveCleanup(
+      "d1",
+      all,
+      (db) => `${db.name} (${db.uuid})`,
+      (db) =>
+        d1
+          .deleteDatabase({ accountId, databaseId: db.uuid })
+          .pipe(Effect.catchTag("DatabaseNotFound", () => Effect.void)),
+    );
+  });
+
+const cleanupQueues = (
+  accountId: string,
+  queueIds: ReadonlyArray<{ queueId: string; queueName: string }>,
+) =>
+  driveCleanup(
+    "queues",
+    queueIds,
+    (q) => `${q.queueName} (${q.queueId})`,
+    (q) =>
+      queues
+        .deleteQueue({ accountId, queueId: q.queueId })
+        .pipe(Effect.catchTag("QueueNotFound", () => Effect.void)),
+  );
+
+// The distilled SDK's `listWorkflows` schema requires `className: string`,
+// but Cloudflare returns `class_name: null` for some workflows. Use raw
+// HTTP to side-step the schema decoder.
+const listAllWorkflows = (accountId: string) =>
+  Effect.gen(function* () {
+    const credentialsEff = yield* CfCredentials;
+    const credentials = yield* credentialsEff;
+    const headers = formatHeaders(credentials);
+    const client = yield* HttpClient.HttpClient;
+
+    const items: { id: string; name: string }[] = [];
+    for (let page = 1; ; page++) {
+      const res = yield* client.execute(
+        HttpClientRequest.get(
+          `${credentials.apiBaseUrl}/accounts/${accountId}/workflows?page=${page}&per_page=100`,
+        ).pipe(HttpClientRequest.setHeaders(headers)),
+      );
+      const body = (yield* res.json) as {
+        result?: { id?: string; name?: string }[] | null;
+      };
+      const batch = body.result ?? [];
+      if (batch.length === 0) break;
+      for (const w of batch) {
+        if (w.id && w.name) items.push({ id: w.id, name: w.name });
+      }
+      if (batch.length < 100) break;
+    }
+    return items;
+  });
+
+const cleanupWorkflows = (accountId: string) =>
+  Effect.gen(function* () {
+    const all = yield* listAllWorkflows(accountId);
+    // `DELETE /workflows/{name}` 400s with `no_deployed_versions` for any
+    // workflow that never had a version deployed — the control plane can't
+    // delete a versionless workflow. Issuing that DELETE is the bad request,
+    // so filter those out up front (check the first page of versions) instead
+    // of firing a doomed delete and swallowing the error.
+    const deletable = yield* Effect.forEach(
+      all,
+      (w) =>
+        workflows.listVersions({ accountId, workflowName: w.name }).pipe(
+          Effect.map((res) => ((res.result?.length ?? 0) > 0 ? [w] : [])),
+          Effect.catchTag("WorkflowNotFound", () => Effect.succeed([])),
+        ),
+      { concurrency: 8 },
+    ).pipe(Effect.map((xs) => xs.flat()));
+    const skipped = all.length - deletable.length;
+    if (skipped > 0) {
+      yield* Console.log(
+        `→ skipping ${skipped} workflow(s) with no deployed versions (not deletable)`,
+      );
+    }
+    return yield* driveCleanup(
+      "workflows",
+      deletable,
+      (w) => `${w.name} (${w.id})`,
+      (w) =>
+        workflows
+          .deleteWorkflow({ accountId, workflowName: w.name })
+          .pipe(Effect.catchTag("WorkflowNotFound", () => Effect.void)),
+    );
+  });
+
+type R2Jurisdiction = "default" | "eu" | "fedramp";
+
+interface R2BucketRecord {
+  readonly name: string;
+  readonly jurisdiction: R2Jurisdiction;
+}
+
+/**
+ * Walk every R2 bucket in the account. `listBuckets` is cursor-paginated by
+ * bucket name; the distilled SDK exposes the raw method, so page manually with
+ * `startAfter` (lexicographic) until a short page signals the end.
+ */
+const listAllBuckets = (accountId: string) =>
+  Effect.gen(function* () {
+    const out: R2BucketRecord[] = [];
+    let startAfter: string | undefined;
+    for (;;) {
+      const res = yield* r2.listBuckets({
+        accountId,
+        perPage: 1000,
+        startAfter,
+      });
+      const batch = res.buckets ?? [];
+      for (const b of batch) {
+        if (b?.name) {
+          out.push({
+            name: b.name,
+            jurisdiction: (b.jurisdiction ?? "default") as R2Jurisdiction,
+          });
+        }
+      }
+      if (batch.length < 1000) break;
+      startAfter = batch[batch.length - 1]?.name ?? undefined;
+      if (!startAfter) break;
+    }
+    return out;
+  });
+
+/**
+ * R2 refuses to delete a bucket that still has custom domains, event
+ * notification configurations, or objects. Detach every custom domain, remove
+ * every per-queue notification config, drain all objects in 1000-key batches,
+ * then delete the bucket. Each step tolerates a vanished bucket/config so the
+ * cleanup is idempotent.
+ */
+const emptyAndDeleteBucket = (accountId: string, bucket: R2BucketRecord) =>
+  Effect.gen(function* () {
+    const { name: bucketName, jurisdiction } = bucket;
+
+    const domains = yield* r2
+      .listBucketDomainCustoms({ accountId, bucketName, jurisdiction })
+      .pipe(
+        Effect.map((res) => res.domains ?? []),
+        Effect.catchTag("NoSuchBucket", () => Effect.succeed([])),
+      );
+    yield* Effect.forEach(
+      domains,
+      (d) =>
+        r2
+          .deleteBucketDomainCustom({
+            accountId,
+            bucketName,
+            domain: d.domain,
+            jurisdiction,
+          })
+          .pipe(
+            Effect.tap(() =>
+              Console.log(`  ↳ detached domain ${d.domain} from ${bucketName}`),
+            ),
+            Effect.ignore,
+          ),
+      { concurrency: 4, discard: true },
+    );
+
+    const notifications = yield* r2
+      .listBucketEventNotifications({ accountId, bucketName, jurisdiction })
+      .pipe(
+        Effect.map((res) =>
+          (res.queues ?? []).flatMap((q): string[] =>
+            q.queueId ? [q.queueId] : [],
+          ),
+        ),
+        Effect.catchTag("NoSuchBucket", () => Effect.succeed([])),
+        Effect.catchTag("BucketNotFound", () => Effect.succeed([])),
+        Effect.catchTag("NoEventNotificationConfig", () => Effect.succeed([])),
+      );
+    yield* Effect.forEach(
+      notifications,
+      (queueId) =>
+        r2
+          .deleteBucketEventNotification({
+            accountId,
+            bucketName,
+            queueId,
+            jurisdiction,
+          })
+          .pipe(
+            Effect.tap(() =>
+              Console.log(
+                `  ↳ removed notification config (queue ${queueId}) from ${bucketName}`,
+              ),
+            ),
+            Effect.ignore,
+          ),
+      { concurrency: 4, discard: true },
+    );
+
+    yield* r2.listObjects
+      .items({
+        accountId,
+        bucketName,
+        cfR2Jurisdiction: jurisdiction,
+        perPage: 1000,
+      })
+      .pipe(
+        Stream.filter(
+          (o): o is typeof o & { key: string } =>
+            typeof o.key === "string" && o.key !== "",
+        ),
+        Stream.map((o) => o.key),
+        Stream.runForEachArray((chunk) =>
+          r2.deleteObjects({
+            accountId,
+            bucketName,
+            cfR2Jurisdiction: jurisdiction,
+            body: [...chunk],
+          }),
+        ),
+        Effect.catchTag("NoSuchBucket", () => Effect.void),
+      );
+
+    return yield* r2
+      .deleteBucket({ accountId, bucketName, jurisdiction })
+      .pipe(Effect.catchTag("NoSuchBucket", () => Effect.void));
+  });
+
+const cleanupR2 = (accountId: string) =>
+  Effect.gen(function* () {
+    const all = yield* listAllBuckets(accountId);
+    yield* Console.log(`→ total R2 buckets: ${all.length}`);
+    const victims = all.filter((b) => shouldDeleteName(b.name));
+    yield* Console.log(
+      `→ R2 buckets to delete: ${victims.length} (keep=${JSON.stringify(KEEP)} deleteMatch=${JSON.stringify(DELETE_PATTERNS)})`,
+    );
+    return yield* driveCleanup(
+      "r2",
+      victims,
+      (b) => `${b.name} (${b.jurisdiction})`,
+      (b) => emptyAndDeleteBucket(accountId, b),
+    );
+  });
+
+const program = Effect.gen(function* () {
+  const { accountId } = yield* CloudflareEnvironment;
+  yield* Console.log(
+    `→ account=${accountId} dryRun=${DRY_RUN} concurrency=${CONCURRENCY} skip=${JSON.stringify([...SKIP])}`,
+  );
+
+  const queueRecords =
+    SKIP.has("queues") && SKIP.has("workers")
+      ? []
+      : yield* listAllQueueIds(accountId);
+  const queueIds = queueRecords.map((q) => q.queueId);
+
+  const results: CleanupResult[] = [];
+
+  // Workflows first — they may reference workers.
+  if (!SKIP.has("workflows")) {
+    results.push(yield* cleanupWorkflows(accountId));
+  }
+  // Hyperdrive next — independent.
+  if (!SKIP.has("hyperdrive")) {
+    results.push(yield* cleanupHyperdrives(accountId));
+  }
+  // Workers — clears queue-consumer bindings, may PUT empty scripts.
+  if (!SKIP.has("workers")) {
+    results.push(yield* cleanupWorkers(accountId, queueIds));
+  }
+  // Queues — after workers so producers/consumers are gone.
+  if (!SKIP.has("queues")) {
+    results.push(yield* cleanupQueues(accountId, queueRecords));
+  }
+  // D1 — workers using it should be gone first.
+  if (!SKIP.has("d1")) {
+    results.push(yield* cleanupD1(accountId));
+  }
+  // R2 — independent of the above; detaches domains + empties before delete.
+  if (!SKIP.has("r2")) {
+    results.push(yield* cleanupR2(accountId));
+  }
+
+  yield* Console.log("\n=== summary ===");
+  for (const r of results) {
+    yield* Console.log(
+      `  ${r.kind}: listed=${r.listed} deleted=${r.ok} failed=${r.fail}`,
+    );
+  }
+  const totalFail = results.reduce((acc, r) => acc + r.fail, 0);
+  if (totalFail > 0) {
+    return yield* Effect.fail(new Error(`${totalFail} delete(s) failed`));
+  }
+});
+
+const authProviders: AuthProviders["Service"] = {};
+const authRegistry = Layer.succeed(AuthProviders, authProviders);
+const authLayer = Layer.provideMerge(CloudflareAuth, authRegistry);
+
+const profile = Layer.mergeAll(
+  Layer.provide(ProfileLive, PlatformServices),
+  Layer.provide(CredentialsStoreLive, PlatformServices),
+);
+
+const cloudflare = Layer.mergeAll(fromAuthProvider(), fromProfile()).pipe(
+  Layer.provide(authLayer),
+  Layer.provide(profile),
+);
+
+const services = Layer.mergeAll(cloudflare, FetchHttpClient.layer);
+
+runMain(program.pipe(Effect.provide(services)));
diff --git a/.repos/alchemy-effect/scripts/clone-external b/.repos/alchemy-effect/scripts/clone-external
new file mode 100755
index 00000000000..21c7a1a905d
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/clone-external
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+mkdir -p .external
+cd .external
+if [ ! -d "terraform-provider-aws" ]; then
+  git clone git@github.com:hashicorp/terraform-provider-aws.git --depth=1
+fi
\ No newline at end of file
diff --git a/.repos/alchemy-effect/scripts/generate-api-reference.ts b/.repos/alchemy-effect/scripts/generate-api-reference.ts
new file mode 100644
index 00000000000..09954b84f29
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-api-reference.ts
@@ -0,0 +1,546 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+import {
+  Node,
+  Project,
+  SyntaxKind,
+  type JSDoc,
+  type SourceFile,
+} from "ts-morph";
+
+const websiteRoot = path.join(import.meta.dir, "../website");
+
+const config = {
+  srcRoot: path.join(import.meta.dir, "../packages/alchemy/src"),
+  outRoot: path.join(websiteRoot, "src/content/docs/providers"),
+  tsConfig: path.join(import.meta.dir, "../packages/alchemy/tsconfig.json"),
+  excludeFile(baseName: string): boolean {
+    if (baseName === "index.ts") return true;
+    if (/^[a-z]/.test(baseName)) return true;
+    return false;
+  },
+};
+
+interface FileEntry {
+  relativePath: string;
+  absolutePath: string;
+  outputPath: string;
+}
+
+interface ExampleBlock {
+  title: string;
+  body: string;
+}
+
+interface ExampleSection {
+  title: string;
+  description: string;
+  examples: ExampleBlock[];
+}
+
+interface PageDoc {
+  title: string;
+  relativePath: string;
+  summary: string;
+  sections: ExampleSection[];
+}
+
+const normalizeSlashes = (value: string) => value.split(path.sep).join("/");
+
+async function discoverFiles(): Promise<FileEntry[]> {
+  const entries: FileEntry[] = [];
+
+  const topLevelEntries = await fs.readdir(config.srcRoot, {
+    withFileTypes: true,
+  });
+  const dirs = topLevelEntries
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name);
+
+  for (const dir of dirs) {
+    const dirPath = path.join(config.srcRoot, dir);
+    let files: string[];
+    try {
+      files = (await fs.readdir(dirPath, { recursive: true })) as string[];
+    } catch {
+      continue;
+    }
+
+    for (const file of files) {
+      const baseName = path.basename(file);
+      if (!baseName.endsWith(".ts") && !baseName.endsWith(".tsx")) continue;
+      if (baseName.endsWith(".d.ts")) continue;
+      if (config.excludeFile(baseName)) continue;
+
+      const relativePath = path.join(dir, file);
+      const parts = normalizeSlashes(relativePath).split("/");
+      const cloud = parts[0];
+      const service = parts.length >= 3 ? parts[1] : undefined;
+      const resource = path.basename(file, path.extname(file));
+
+      let outputRelative: string;
+      if (cloud === "Cloudflare") {
+        outputRelative = path.join(cloud, `${resource}.md`);
+      } else if (service) {
+        outputRelative = path.join(cloud, service, `${resource}.md`);
+      } else {
+        outputRelative = path.join(cloud, `${resource}.md`);
+      }
+
+      entries.push({
+        relativePath,
+        absolutePath: path.join(config.srcRoot, relativePath),
+        outputPath: path.join(config.outRoot, outputRelative),
+      });
+    }
+  }
+
+  entries.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+  return entries;
+}
+
+function getJsDocBlocks(node: Node): JSDoc[] {
+  const getter = (node as Node & { getJsDocs?: () => JSDoc[] }).getJsDocs;
+  return getter ? getter.call(node) : [];
+}
+
+function cleanDocComment(raw: string): string {
+  return raw
+    .replace(/^\/\*\*?/, "")
+    .replace(/\*\/$/, "")
+    .split("\n")
+    .map((line) => line.replace(/^\s*\*\s?/, ""))
+    .join("\n");
+}
+
+interface ParsedJSDoc {
+  summary: string;
+  sections: ExampleSection[];
+  hasResourceTag: boolean;
+  hasBindingTag: boolean;
+}
+
+function parseJSDoc(node: Node): ParsedJSDoc {
+  const docs = getJsDocBlocks(node);
+  if (docs.length === 0) {
+    return {
+      summary: "",
+      sections: [],
+      hasResourceTag: false,
+      hasBindingTag: false,
+    };
+  }
+
+  const clean = cleanDocComment(docs.map((doc) => doc.getText()).join("\n"));
+  const lines = clean.split("\n");
+
+  const summaryLines: string[] = [];
+  const sections: ExampleSection[] = [];
+  let hasResourceTag = false;
+  let hasBindingTag = false;
+  let sawTag = false;
+  let currentSection: ExampleSection | undefined;
+  let currentExample: ExampleBlock | undefined;
+
+  let sectionDescLines: string[] = [];
+  let collectingSectionDesc = false;
+
+  const flushExample = () => {
+    if (!currentExample) return;
+    currentExample.body = currentExample.body.trim();
+    if (!currentSection) {
+      currentSection = { title: "Examples", description: "", examples: [] };
+      sections.push(currentSection);
+    }
+    currentSection.examples.push(currentExample);
+    currentExample = undefined;
+  };
+
+  const flushSectionDesc = () => {
+    if (currentSection && sectionDescLines.length > 0) {
+      currentSection.description = sectionDescLines.join("\n").trim();
+    }
+    sectionDescLines = [];
+    collectingSectionDesc = false;
+  };
+
+  for (const line of lines) {
+    const tag = line.trimEnd().match(/^@(\w+)\s*(.*)$/);
+    if (tag) {
+      sawTag = true;
+      const [, name, rest] = tag;
+      const value = (rest ?? "").trim();
+      switch (name) {
+        case "resource":
+          hasResourceTag = true;
+          break;
+        case "binding":
+          hasBindingTag = true;
+          break;
+        case "section":
+          flushExample();
+          flushSectionDesc();
+          currentSection = {
+            title: value || "Examples",
+            description: "",
+            examples: [],
+          };
+          sections.push(currentSection);
+          collectingSectionDesc = true;
+          break;
+        case "example":
+          flushSectionDesc();
+          flushExample();
+          currentExample = { title: value || "Example", body: "" };
+          break;
+      }
+      continue;
+    }
+
+    if (!sawTag) {
+      summaryLines.push(line);
+      continue;
+    }
+
+    if (currentExample) {
+      currentExample.body += `${line}\n`;
+    } else if (collectingSectionDesc) {
+      sectionDescLines.push(line);
+    }
+  }
+
+  flushSectionDesc();
+  flushExample();
+
+  return {
+    summary: summaryLines.join("\n").trim(),
+    sections,
+    hasResourceTag,
+    hasBindingTag,
+  };
+}
+
+function findPrimaryJSDoc(sourceFile: SourceFile): ParsedJSDoc {
+  for (const decl of sourceFile.getVariableDeclarations()) {
+    if (!decl.isExported()) continue;
+    const init = decl.getInitializerIfKind(SyntaxKind.CallExpression);
+    const expr = init?.getExpression().getText();
+    if (expr === "Resource" || expr === "Host" || expr === "Platform") {
+      const stmt = decl.getVariableStatement();
+      if (stmt) {
+        const jsdoc = parseJSDoc(stmt);
+        if (jsdoc.summary || jsdoc.sections.length > 0 || jsdoc.hasResourceTag)
+          return jsdoc;
+      }
+    }
+  }
+
+  for (const cls of sourceFile.getClasses()) {
+    if (!cls.isExported()) continue;
+    const jsdoc = parseJSDoc(cls);
+    if (
+      jsdoc.hasResourceTag ||
+      jsdoc.hasBindingTag ||
+      jsdoc.sections.length > 0
+    )
+      return jsdoc;
+    if (jsdoc.summary) return jsdoc;
+  }
+
+  let firstWithSummary: ParsedJSDoc | undefined;
+  for (const stmt of sourceFile.getStatements()) {
+    if (Node.isExportable(stmt) && stmt.isExported()) {
+      const jsdoc = parseJSDoc(stmt);
+      if (
+        jsdoc.hasResourceTag ||
+        jsdoc.hasBindingTag ||
+        jsdoc.sections.length > 0
+      )
+        return jsdoc;
+      if (!firstWithSummary && jsdoc.summary) firstWithSummary = jsdoc;
+    }
+  }
+
+  if (firstWithSummary) return firstWithSummary;
+
+  const rawJSDocBlocks = sourceFile.getFullText().match(/\/\*\*[\s\S]*?\*\//g);
+  if (rawJSDocBlocks) {
+    for (const block of rawJSDocBlocks) {
+      if (
+        block.includes("@section") ||
+        block.includes("@resource") ||
+        block.includes("@binding")
+      ) {
+        const clean = cleanDocComment(block);
+        const lines = clean.split("\n");
+        const summaryLines: string[] = [];
+        const sections: ExampleSection[] = [];
+        let hasResourceTag = false;
+        let hasBindingTag = false;
+        let sawTag = false;
+        let currentSection: ExampleSection | undefined;
+        let currentExample: ExampleBlock | undefined;
+        let sectionDescLines: string[] = [];
+        let collectingSectionDesc = false;
+
+        const flushExample = () => {
+          if (!currentExample) return;
+          currentExample.body = currentExample.body.trim();
+          if (!currentSection) {
+            currentSection = {
+              title: "Examples",
+              description: "",
+              examples: [],
+            };
+            sections.push(currentSection);
+          }
+          currentSection.examples.push(currentExample);
+          currentExample = undefined;
+        };
+
+        const flushSectionDesc = () => {
+          if (currentSection && sectionDescLines.length > 0) {
+            currentSection.description = sectionDescLines.join("\n").trim();
+          }
+          sectionDescLines = [];
+          collectingSectionDesc = false;
+        };
+
+        for (const line of lines) {
+          const tag = line.trimEnd().match(/^@(\w+)\s*(.*)$/);
+          if (tag) {
+            sawTag = true;
+            const [, name, rest] = tag;
+            const value = (rest ?? "").trim();
+            switch (name) {
+              case "resource":
+                hasResourceTag = true;
+                break;
+              case "binding":
+                hasBindingTag = true;
+                break;
+              case "section":
+                flushExample();
+                flushSectionDesc();
+                currentSection = {
+                  title: value || "Examples",
+                  description: "",
+                  examples: [],
+                };
+                sections.push(currentSection);
+                collectingSectionDesc = true;
+                break;
+              case "example":
+                flushSectionDesc();
+                flushExample();
+                currentExample = { title: value || "Example", body: "" };
+                break;
+            }
+            continue;
+          }
+          if (!sawTag) {
+            summaryLines.push(line);
+            continue;
+          }
+          if (currentExample) {
+            currentExample.body += `${line}\n`;
+          } else if (collectingSectionDesc) {
+            sectionDescLines.push(line);
+          }
+        }
+        flushSectionDesc();
+        flushExample();
+
+        const summary = summaryLines.join("\n").trim();
+        if (summary || sections.length > 0) {
+          return { summary, sections, hasResourceTag, hasBindingTag };
+        }
+      }
+    }
+  }
+
+  return {
+    summary: "",
+    sections: [],
+    hasResourceTag: false,
+    hasBindingTag: false,
+  };
+}
+
+function isResourceFile(sourceFile: SourceFile): boolean {
+  const fullText = sourceFile.getFullText();
+
+  if (/^\s*\*\s*@internal\s*$/m.test(fullText)) {
+    const blocks = fullText.match(/\/\*\*[\s\S]*?\*\//g) || [];
+    for (const block of blocks) {
+      if (!/^\s*\*\s*@internal\s*$/m.test(block)) continue;
+      const end = fullText.indexOf(block) + block.length;
+      const after = fullText.slice(end).trimStart();
+      if (after.startsWith("export ")) return false;
+    }
+  }
+
+  if (fullText.includes("@resource") || fullText.includes("@binding"))
+    return true;
+
+  const text = sourceFile.getFullText();
+  if (text.includes("Binding.Service<") || text.includes("Binding.Policy<")) {
+    if (
+      !text.includes("= Resource<") &&
+      !text.includes("extends Resource<") &&
+      !text.includes("= Host<") &&
+      !text.includes("extends Host<") &&
+      !text.includes("Platform(")
+    ) {
+      return false;
+    }
+  }
+
+  for (const decl of sourceFile.getVariableDeclarations()) {
+    if (!decl.isExported()) continue;
+    const init = decl.getInitializerIfKind(SyntaxKind.CallExpression);
+    if (!init) continue;
+    const expr = init.getExpression().getText();
+    if (expr === "Resource" || expr === "Host" || expr === "Platform")
+      return true;
+    const innerCall = init.getExpression();
+    if (Node.isCallExpression(innerCall)) {
+      const innerExpr = innerCall.getExpression().getText();
+      if (innerExpr === "Resource" || innerExpr === "Host") return true;
+    }
+  }
+  for (const iface of sourceFile.getInterfaces()) {
+    if (!iface.isExported()) continue;
+    const hasResourceHeritage = iface
+      .getHeritageClauses()
+      .flatMap((clause) => clause.getTypeNodes())
+      .some((typeNode) => {
+        const expr = typeNode.getExpression().getText();
+        return expr === "Resource" || expr === "Host";
+      });
+    if (hasResourceHeritage) return true;
+  }
+  for (const typeAlias of sourceFile.getTypeAliases()) {
+    if (!typeAlias.isExported()) continue;
+    const typeText = typeAlias.getTypeNode()?.getText() ?? "";
+    if (typeText.startsWith("Resource<") || typeText.startsWith("Host<")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function parseFile(sourceFile: SourceFile, relativePath: string): PageDoc {
+  const baseName = path.basename(relativePath, path.extname(relativePath));
+  const primary = findPrimaryJSDoc(sourceFile);
+
+  return {
+    title: baseName,
+    relativePath,
+    summary: primary.summary,
+    sections: primary.sections,
+  };
+}
+
+function yamlString(value: string): string {
+  if (/[\n:"{}[\],&*?|>!%@`#]/.test(value) || value.trim() !== value) {
+    return JSON.stringify(value);
+  }
+  return value;
+}
+
+function firstParagraph(value: string): string {
+  const idx = value.indexOf("\n\n");
+  const para = idx === -1 ? value : value.slice(0, idx);
+  return para.replace(/\s+/g, " ").trim();
+}
+
+function renderPageBody(doc: PageDoc): string {
+  const parts: string[] = [];
+
+  if (doc.summary) {
+    parts.push(doc.summary);
+  }
+
+  for (const section of doc.sections) {
+    const secParts = [`## ${section.title}`];
+    if (section.description) {
+      secParts.push(section.description);
+    }
+    for (const example of section.examples) {
+      if (section.examples.length > 1) {
+        secParts.push(`**${example.title}**`);
+      }
+      secParts.push(example.body);
+    }
+    parts.push(secParts.join("\n\n"));
+  }
+
+  return parts.join("\n\n");
+}
+
+function renderPage(doc: PageDoc): string {
+  const sourcePath = `src/${normalizeSlashes(doc.relativePath)}`;
+  const description =
+    firstParagraph(doc.summary) || `API reference for ${doc.title}`;
+  const frontmatter = [
+    "---",
+    `title: ${yamlString(doc.title)}`,
+    `description: ${yamlString(description)}`,
+    "---",
+  ].join("\n");
+
+  const sourceBlock = `> **Source:** \`${sourcePath}\``;
+  const body = renderPageBody(doc).trim();
+
+  if (body) {
+    return `${frontmatter}\n\n${sourceBlock}\n\n${body}\n`;
+  }
+  return `${frontmatter}\n\n${sourceBlock}\n`;
+}
+
+async function main() {
+  const entries = await discoverFiles();
+  console.log(`Discovered ${entries.length} source files.`);
+
+  const project = new Project({
+    tsConfigFilePath: config.tsConfig,
+    skipFileDependencyResolution: true,
+  });
+
+  await fs.rm(config.outRoot, { recursive: true, force: true });
+  await fs.mkdir(config.outRoot, { recursive: true });
+
+  const resourceEntries: FileEntry[] = [];
+  for (const entry of entries) {
+    const sourceFile = project.getSourceFile(entry.absolutePath);
+    if (!sourceFile) {
+      console.warn(`  skipped: ${entry.relativePath}`);
+      continue;
+    }
+    if (!isResourceFile(sourceFile)) continue;
+    resourceEntries.push(entry);
+  }
+
+  console.log(
+    `Filtered to ${resourceEntries.length} documented files (excluded ${entries.length - resourceEntries.length} unannotated files).`,
+  );
+
+  let written = 0;
+  for (const entry of resourceEntries) {
+    const sourceFile = project.getSourceFile(entry.absolutePath)!;
+    const doc = parseFile(sourceFile, entry.relativePath);
+
+    await fs.mkdir(path.dirname(entry.outputPath), { recursive: true });
+    await fs.writeFile(entry.outputPath, renderPage(doc), "utf8");
+
+    written++;
+  }
+
+  console.log(
+    `Done. Wrote ${written} resource pages to ${normalizeSlashes(path.relative(path.join(import.meta.dir, ".."), config.outRoot))}.`,
+  );
+}
+
+await main();
diff --git a/.repos/alchemy-effect/scripts/generate-cfn-docs.ts b/.repos/alchemy-effect/scripts/generate-cfn-docs.ts
new file mode 100644
index 00000000000..9f2a5a61e23
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-cfn-docs.ts
@@ -0,0 +1,869 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+
+const CONCURRENCY = 10;
+const MAX_RETRIES = 3;
+const INITIAL_BACKOFF_MS = 1000;
+
+let failedRequests = 0;
+
+const CFN_SPEC_URL =
+  "https://d1uauaxba7bl26.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json";
+
+interface Property {
+  Documentation?: string;
+  UpdateType?: "Mutable" | "Immutable" | "Conditional";
+  Required?: boolean;
+  Type?: string;
+  PrimitiveType?: string;
+  ItemType?: string;
+  PrimitiveItemType?: string;
+  DuplicatesAllowed?: boolean;
+}
+
+interface Attribute {
+  Type?: string;
+  PrimitiveType?: string;
+  ItemType?: string;
+  PrimitiveItemType?: string;
+}
+
+interface ResourceType {
+  Documentation?: string;
+  Properties?: Record<string, Property>;
+  Attributes?: Record<string, Attribute>;
+}
+
+interface PropertyType {
+  Documentation?: string;
+  Properties?: Record<string, Property>;
+}
+
+interface CFNSpec {
+  ResourceSpecificationVersion: string;
+  ResourceTypes: Record<string, ResourceType>;
+  PropertyTypes: Record<string, PropertyType>;
+}
+
+// Scraped data from HTML
+interface ScrapedResourceData {
+  description: string;
+  propertyDescriptions: Map<string, PropertyDescription>;
+  returnValues: ReturnValueInfo[];
+  examples: Example[];
+}
+
+interface PropertyDescription {
+  description: string;
+  allowedValues?: string[];
+}
+
+interface ReturnValueInfo {
+  name: string;
+  description: string;
+  example?: string;
+}
+
+interface Example {
+  title: string;
+  description: string;
+  json?: string;
+  yaml?: string;
+}
+
+// Parse AWS::Service::Resource into { service, resource }
+function parseResourceType(
+  type: string,
+): { service: string; resource: string } | null {
+  const parts = type.split("::");
+  if (parts.length !== 3 || parts[0] !== "AWS") return null;
+  return { service: parts[1], resource: parts[2] };
+}
+
+// Parse AWS::Service::Resource.PropertyType into { service, resource, propertyType }
+function parsePropertyType(
+  type: string,
+): { service: string; resource: string; propertyType: string } | null {
+  const match = type.match(/^AWS::([^:]+)::([^.]+)\.(.+)$/);
+  if (!match) return null;
+  return { service: match[1], resource: match[2], propertyType: match[3] };
+}
+
+// Convert service name to lowercase kebab-case for directory naming
+function toKebabCase(str: string): string {
+  return str
+    .replace(/([a-z])([A-Z])/g, "$1-$2")
+    .replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2")
+    .toLowerCase();
+}
+
+// Format a property type for display (no links, just type names for LLM consumption)
+function formatType(prop: Property | Attribute): string {
+  if (prop.PrimitiveType) {
+    return prop.PrimitiveType;
+  }
+  if (prop.Type === "List") {
+    if (prop.PrimitiveItemType) {
+      return `List<${prop.PrimitiveItemType}>`;
+    }
+    if (prop.ItemType) {
+      return `List<${prop.ItemType}>`;
+    }
+    return "List";
+  }
+  if (prop.Type === "Map") {
+    if (prop.PrimitiveItemType) {
+      return `Map<String, ${prop.PrimitiveItemType}>`;
+    }
+    if (prop.ItemType) {
+      return `Map<String, ${prop.ItemType}>`;
+    }
+    return "Map";
+  }
+  if (prop.Type) {
+    return prop.Type;
+  }
+  return "Unknown";
+}
+
+// Strip HTML tags and decode entities
+function stripHtml(html: string): string {
+  return html
+    .replace(/<[^>]+>/g, "")
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&amp;/g, "&")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&nbsp;/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+// Convert HTML to simple markdown
+function htmlToMarkdown(html: string): string {
+  return (
+    html
+      .replace(/<code class="code">([^<]+)<\/code>/g, "`$1`")
+      .replace(/<em>([^<]+)<\/em>/g, "*$1*")
+      .replace(/<a href="([^"]+)"[^>]*>([^<]+)<\/a>/g, "[$2]($1)")
+      .replace(/<p>/g, "")
+      .replace(/<\/p>/g, "\n\n")
+      .replace(/<[^>]+>/g, "")
+      .replace(/&lt;/g, "<")
+      .replace(/&gt;/g, ">")
+      .replace(/&amp;/g, "&")
+      .replace(/&quot;/g, '"')
+      .replace(/&#39;/g, "'")
+      .replace(/&nbsp;/g, " ")
+      // Normalize whitespace: collapse multiple spaces/tabs and trim each line
+      .split("\n")
+      .map((line) => line.replace(/\s+/g, " ").trim())
+      .join("\n")
+      // Collapse multiple newlines
+      .replace(/\n{3,}/g, "\n\n")
+      .trim()
+  );
+}
+
+// Concurrency limiter
+function createLimiter(concurrency: number) {
+  let active = 0;
+  const queue: (() => void)[] = [];
+
+  return async function limit<T>(fn: () => Promise<T>): Promise<T> {
+    while (active >= concurrency) {
+      await new Promise<void>((resolve) => queue.push(resolve));
+    }
+    active++;
+    try {
+      return await fn();
+    } finally {
+      active--;
+      const next = queue.shift();
+      if (next) next();
+    }
+  };
+}
+
+// Delay helper
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Fetch with retry and exponential backoff
+async function fetchWithRetry(
+  url: string,
+  retries = MAX_RETRIES,
+): Promise<Response | null> {
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    try {
+      const res = await fetch(url, {
+        headers: {
+          "User-Agent":
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
+        },
+      });
+
+      if (res.ok) {
+        return res;
+      }
+
+      // Don't retry on 404 - page doesn't exist
+      if (res.status === 404) {
+        console.error(`  404 Not Found: ${url}`);
+        failedRequests++;
+        return null;
+      }
+
+      // Retry on rate limiting or server errors
+      if (res.status === 429 || res.status >= 500) {
+        const backoffMs = INITIAL_BACKOFF_MS * Math.pow(2, attempt);
+        console.warn(
+          `  ${res.status} on ${url} - retrying in ${backoffMs}ms (attempt ${attempt + 1}/${retries + 1})`,
+        );
+        await delay(backoffMs);
+        continue;
+      }
+
+      // Other errors - log and don't retry
+      console.error(`  HTTP ${res.status} ${res.statusText}: ${url}`);
+      failedRequests++;
+      return null;
+    } catch (error) {
+      const backoffMs = INITIAL_BACKOFF_MS * Math.pow(2, attempt);
+      console.warn(
+        `  Network error on ${url} - retrying in ${backoffMs}ms (attempt ${attempt + 1}/${retries + 1}): ${error}`,
+      );
+      await delay(backoffMs);
+    }
+  }
+
+  console.error(`  Failed after ${retries + 1} attempts: ${url}`);
+  failedRequests++;
+  return null;
+}
+
+// Scraped data for a property type (struct)
+interface ScrapedPropertyTypeData {
+  description: string;
+  propertyDescriptions: Map<string, PropertyDescription>;
+}
+
+// Scrape property type documentation from AWS HTML
+async function scrapePropertyTypeDocs(
+  docUrl: string,
+): Promise<ScrapedPropertyTypeData | null> {
+  const res = await fetchWithRetry(docUrl);
+  if (!res) return null;
+
+  try {
+    const html = await res.text();
+
+    const result: ScrapedPropertyTypeData = {
+      description: "",
+      propertyDescriptions: new Map(),
+    };
+
+    // Extract description - paragraphs after the h1 until the first h2
+    const descMatch = html.match(
+      /<\/awsdocs-filter-selector><\/div>([\s\S]*?)<h2/,
+    );
+    if (descMatch) {
+      const paragraphs = descMatch[1].match(/<p>[\s\S]*?<\/p>/g) || [];
+      result.description = paragraphs
+        .map((p) => htmlToMarkdown(p))
+        .filter((p) => p.length > 0)
+        .join("\n\n");
+    }
+
+    // Extract property descriptions from the variablelist
+    const propsMatch = html.match(
+      /<h2 id="[^"]*-properties"[^>]*>Properties<\/h2>([\s\S]*?)(?:<h2|$)/,
+    );
+    if (propsMatch) {
+      const propsHtml = propsMatch[1];
+      const propRegex =
+        /<dt id="([^"]+)"[^>]*>[\s\S]*?<code class="code">([^<]+)<\/code>[\s\S]*?<\/dt>\s*<dd>([\s\S]*?)<\/dd>/g;
+      let match;
+      while ((match = propRegex.exec(propsHtml)) !== null) {
+        const propName = match[2];
+        const propContent = match[3];
+
+        const descParts = propContent.split(/<p><em>Required<\/em>/);
+        let description = "";
+        if (descParts[0]) {
+          description = htmlToMarkdown(descParts[0]);
+        }
+
+        let allowedValues: string[] | undefined;
+        const allowedMatch = propContent.match(
+          /<em>Allowed values<\/em>:\s*<code class="code">([^<]+)<\/code>/,
+        );
+        if (allowedMatch) {
+          allowedValues = allowedMatch[1].split(" | ").map((v) => v.trim());
+        }
+
+        if (propName) {
+          result.propertyDescriptions.set(propName, {
+            description,
+            allowedValues,
+          });
+        }
+      }
+    }
+
+    return result;
+  } catch (error) {
+    console.error(`  Error parsing ${docUrl}:`, error);
+    failedRequests++;
+    return null;
+  }
+}
+
+// Scrape resource documentation from AWS HTML
+async function scrapeResourceDocs(
+  docUrl: string,
+): Promise<ScrapedResourceData | null> {
+  const res = await fetchWithRetry(docUrl);
+  if (!res) return null;
+
+  try {
+    const html = await res.text();
+
+    const result: ScrapedResourceData = {
+      description: "",
+      propertyDescriptions: new Map(),
+      returnValues: [],
+      examples: [],
+    };
+
+    // Extract description - paragraphs after the h1 until the first h2
+    const descMatch = html.match(
+      /<\/awsdocs-filter-selector><\/div>([\s\S]*?)<h2/,
+    );
+    if (descMatch) {
+      // Extract just the text content from paragraphs
+      const paragraphs = descMatch[1].match(/<p>[\s\S]*?<\/p>/g) || [];
+      result.description = paragraphs
+        .map((p) => htmlToMarkdown(p))
+        .filter((p) => p.length > 0)
+        .join("\n\n");
+    }
+
+    // Extract property descriptions from the variablelist
+    const propsMatch = html.match(
+      /<h2 id="[^"]*-properties"[^>]*>Properties<\/h2>([\s\S]*?)(?:<h2|$)/,
+    );
+    if (propsMatch) {
+      const propsHtml = propsMatch[1];
+      // Match each property definition
+      const propRegex =
+        /<dt id="([^"]+)"[^>]*>[\s\S]*?<code class="code">([^<]+)<\/code>[\s\S]*?<\/dt>\s*<dd>([\s\S]*?)<\/dd>/g;
+      let match;
+      while ((match = propRegex.exec(propsHtml)) !== null) {
+        const propName = match[2];
+        const propContent = match[3];
+
+        // Extract the description (first paragraph or text before Required)
+        const descParts = propContent.split(/<p><em>Required<\/em>/);
+        let description = "";
+        if (descParts[0]) {
+          description = htmlToMarkdown(descParts[0]);
+        }
+
+        // Extract allowed values if present
+        let allowedValues: string[] | undefined;
+        const allowedMatch = propContent.match(
+          /<em>Allowed values<\/em>:\s*<code class="code">([^<]+)<\/code>/,
+        );
+        if (allowedMatch) {
+          allowedValues = allowedMatch[1].split(" | ").map((v) => v.trim());
+        }
+
+        if (propName && description) {
+          result.propertyDescriptions.set(propName, {
+            description,
+            allowedValues,
+          });
+        }
+      }
+    }
+
+    // Extract return values
+    const returnMatch = html.match(
+      /<h2 id="[^"]*-return-values"[^>]*>Return values<\/h2>([\s\S]*?)(?:<h2 id="[^"]*-examples"|<h2 id="[^"]*-seealso"|<awsdocs-copyright|$)/,
+    );
+    if (returnMatch) {
+      const returnHtml = returnMatch[1];
+
+      // Match Fn::GetAtt values
+      const attrRegex =
+        /<dt id="([^"]+)-fn::getatt"[^>]*>[\s\S]*?<code class="code">([^<]+)<\/code>[\s\S]*?<\/dt>\s*<dd>([\s\S]*?)<\/dd>/g;
+      let match;
+      while ((match = attrRegex.exec(returnHtml)) !== null) {
+        const attrName = match[2];
+        const attrContent = match[3];
+
+        // Extract description
+        const descMatch = attrContent.match(/<p>([\s\S]*?)<\/p>/);
+        let description = descMatch ? htmlToMarkdown(descMatch[1]) : "";
+
+        // Extract example if present
+        let example: string | undefined;
+        const exampleMatch = attrContent.match(
+          /Example:\s*<code class="code">([^<]+)<\/code>/,
+        );
+        if (exampleMatch) {
+          example = exampleMatch[1].trim();
+        }
+
+        result.returnValues.push({ name: attrName, description, example });
+      }
+    }
+
+    // Extract examples
+    const examplesMatch = html.match(
+      /<h2 id="[^"]*-examples"[^>]*>Examples<\/h2>([\s\S]*?)(?:<h2 id="[^"]*-seealso"|<awsdocs-copyright|$)/,
+    );
+    if (examplesMatch) {
+      const examplesHtml = examplesMatch[1];
+
+      // Match each example section (h3)
+      const exampleSections = examplesHtml.split(/<h3 id="[^"]*">/);
+      for (let i = 1; i < exampleSections.length && i <= 3; i++) {
+        // Limit to first 3 examples
+        const section = exampleSections[i];
+
+        // Extract title
+        const titleMatch = section.match(/^([^<]+)</);
+        const title = titleMatch ? stripHtml(titleMatch[1]) : `Example ${i}`;
+
+        // Extract description (paragraph before code)
+        const descMatch = section.match(/<\/h3>[\s\S]*?<p>([\s\S]*?)<\/p>/);
+        const description = descMatch ? htmlToMarkdown(descMatch[1]) : "";
+
+        // Extract JSON code
+        let json: string | undefined;
+        const jsonMatch = section.match(
+          /<div id="JSON"[\s\S]*?<code class="json[^"]*">([\s\S]*?)<\/code>/,
+        );
+        if (jsonMatch) {
+          // Preserve newlines in JSON by just stripping tags
+          json = jsonMatch[1]
+            .replace(/<span>\{<\/span>/g, "{")
+            .replace(/<[^>]+>/g, "")
+            .replace(/&lt;/g, "<")
+            .replace(/&gt;/g, ">")
+            .replace(/&amp;/g, "&")
+            .replace(/&quot;/g, '"')
+            .replace(/&#39;/g, "'")
+            .replace(/&nbsp;/g, " ")
+            .trim();
+        }
+
+        // Extract YAML code
+        let yaml: string | undefined;
+        const yamlMatch = section.match(
+          /<div id="YAML"[\s\S]*?<code class="yaml[^"]*">([\s\S]*?)<\/code>/,
+        );
+        if (yamlMatch) {
+          // Preserve newlines in YAML by just stripping tags
+          yaml = yamlMatch[1]
+            .replace(/<[^>]+>/g, "")
+            .replace(/&lt;/g, "<")
+            .replace(/&gt;/g, ">")
+            .replace(/&amp;/g, "&")
+            .replace(/&quot;/g, '"')
+            .replace(/&#39;/g, "'")
+            .replace(/&nbsp;/g, " ")
+            .trim();
+        }
+
+        if (title && (json || yaml)) {
+          result.examples.push({ title, description, json, yaml });
+        }
+      }
+    }
+
+    return result;
+  } catch (error) {
+    console.error(`  Error parsing ${docUrl}:`, error);
+    failedRequests++;
+    return null;
+  }
+}
+
+// Generate markdown for a resource
+function generateResourceMarkdown(
+  resourceName: string,
+  fullType: string,
+  resource: ResourceType,
+  relatedStructs: Map<string, PropertyType>,
+  scraped: ScrapedResourceData | null,
+  structScraped: Map<string, ScrapedPropertyTypeData>,
+): string {
+  const lines: string[] = [];
+
+  lines.push(`# ${resourceName}`);
+  lines.push("");
+  lines.push(`CloudFormation Type: \`${fullType}\``);
+  lines.push("");
+
+  if (resource.Documentation) {
+    lines.push(`[AWS Documentation](${resource.Documentation})`);
+    lines.push("");
+  }
+
+  // Add scraped description
+  if (scraped?.description) {
+    lines.push(scraped.description);
+    lines.push("");
+  }
+
+  // Properties section
+  if (resource.Properties && Object.keys(resource.Properties).length > 0) {
+    lines.push("# Properties");
+    lines.push("");
+
+    const sortedProps = Object.entries(resource.Properties).sort(([a], [b]) =>
+      a.localeCompare(b),
+    );
+
+    for (const [name, prop] of sortedProps) {
+      const type = formatType(prop);
+      const required = prop.Required ? "Yes" : "No";
+      const updateType = prop.UpdateType ?? "N/A";
+
+      lines.push(`## ${name}`);
+      lines.push("");
+
+      // Get scraped description
+      const scrapedProp = scraped?.propertyDescriptions.get(name);
+      if (scrapedProp?.description) {
+        lines.push(scrapedProp.description);
+        lines.push("");
+      }
+
+      lines.push(`- **Required**: ${required}`);
+      lines.push(`- **Type**: ${type}`);
+      lines.push(`- **Update**: ${updateType}`);
+
+      // Add allowed values if present
+      if (scrapedProp?.allowedValues && scrapedProp.allowedValues.length > 0) {
+        lines.push(
+          `- **Allowed Values**: \`${scrapedProp.allowedValues.join("` | `")}\``,
+        );
+      }
+
+      lines.push("");
+    }
+  }
+
+  // Attributes section
+  if (resource.Attributes && Object.keys(resource.Attributes).length > 0) {
+    lines.push("# Attributes");
+    lines.push("");
+
+    const sortedAttrs = Object.entries(resource.Attributes).sort(([a], [b]) =>
+      a.localeCompare(b),
+    );
+
+    for (const [name, attr] of sortedAttrs) {
+      const type = formatType(attr);
+
+      lines.push(`## ${name}`);
+      lines.push("");
+
+      // Find scraped return value description
+      const returnVal = scraped?.returnValues.find((rv) => rv.name === name);
+      if (returnVal?.description) {
+        lines.push(returnVal.description);
+        lines.push("");
+      }
+
+      lines.push(`- **Type**: ${type}`);
+      if (returnVal?.example) {
+        lines.push(`- **Example**: \`${returnVal.example}\``);
+      }
+      lines.push("");
+    }
+  }
+
+  // Examples section
+  if (scraped?.examples && scraped.examples.length > 0) {
+    lines.push("# Examples");
+    lines.push("");
+
+    for (const example of scraped.examples) {
+      lines.push(`## ${example.title}`);
+      lines.push("");
+      if (example.description) {
+        lines.push(example.description);
+        lines.push("");
+      }
+      if (example.yaml) {
+        lines.push("```yaml");
+        lines.push(example.yaml);
+        lines.push("```");
+        lines.push("");
+      } else if (example.json) {
+        lines.push("```json");
+        lines.push(example.json);
+        lines.push("```");
+        lines.push("");
+      }
+    }
+  }
+
+  // Related structs section
+  if (relatedStructs.size > 0) {
+    lines.push("# Property Types");
+    lines.push("");
+
+    const sortedStructs = Array.from(relatedStructs.entries()).sort(
+      ([a], [b]) => a.localeCompare(b),
+    );
+
+    for (const [structName, struct] of sortedStructs) {
+      lines.push(`## ${structName}`);
+      lines.push("");
+
+      // Get scraped description for this struct
+      const scrapedStruct = structScraped.get(structName);
+      if (scrapedStruct?.description) {
+        lines.push(scrapedStruct.description);
+        lines.push("");
+      }
+
+      if (struct.Properties && Object.keys(struct.Properties).length > 0) {
+        const sortedProps = Object.entries(struct.Properties).sort(([a], [b]) =>
+          a.localeCompare(b),
+        );
+
+        for (const [name, prop] of sortedProps) {
+          const type = formatType(prop);
+          const required = prop.Required ? "Yes" : "No";
+          const updateType = prop.UpdateType ?? "N/A";
+
+          lines.push(`### ${name}`);
+          lines.push("");
+
+          // Get scraped property description
+          const scrapedProp = scrapedStruct?.propertyDescriptions.get(name);
+          if (scrapedProp?.description) {
+            lines.push(scrapedProp.description);
+            lines.push("");
+          }
+
+          lines.push(`- **Required**: ${required}`);
+          lines.push(`- **Type**: ${type}`);
+          lines.push(`- **Update**: ${updateType}`);
+
+          // Add allowed values if present
+          if (
+            scrapedProp?.allowedValues &&
+            scrapedProp.allowedValues.length > 0
+          ) {
+            lines.push(
+              `- **Allowed Values**: \`${scrapedProp.allowedValues.join("` | `")}\``,
+            );
+          }
+
+          lines.push("");
+        }
+      }
+    }
+  }
+
+  return lines.join("\n");
+}
+
+async function main() {
+  console.log("Fetching CloudFormation spec...");
+  const res = await fetch(CFN_SPEC_URL);
+  const json = (await res.json()) as CFNSpec;
+
+  console.log(`Version: ${json.ResourceSpecificationVersion}`);
+  console.log(`Resources: ${Object.keys(json.ResourceTypes).length}`);
+  console.log(`PropertyTypes: ${Object.keys(json.PropertyTypes).length}`);
+
+  const cfnDir = ".external/cfn";
+
+  // Ensure directory exists (don't delete existing files)
+  await fs.mkdir(cfnDir, { recursive: true });
+
+  // Group resources by service
+  const serviceResources = new Map<
+    string,
+    Map<string, ResourceType & { _fullType: string }>
+  >();
+  const servicePropertyTypes = new Map<string, Map<string, PropertyType>>();
+
+  for (const [fullType, resource] of Object.entries(json.ResourceTypes)) {
+    const parsed = parseResourceType(fullType);
+    if (!parsed) continue;
+
+    const { service, resource: resourceName } = parsed;
+    if (!serviceResources.has(service)) {
+      serviceResources.set(service, new Map());
+    }
+    serviceResources.get(service)!.set(resourceName, {
+      ...resource,
+      _fullType: fullType,
+    });
+  }
+
+  // Group property types by service and resource
+  for (const [fullType, propType] of Object.entries(json.PropertyTypes)) {
+    const parsed = parsePropertyType(fullType);
+    if (!parsed) continue;
+
+    const { service, resource } = parsed;
+    const key = `${service}::${resource}`;
+    if (!servicePropertyTypes.has(key)) {
+      servicePropertyTypes.set(key, new Map());
+    }
+    servicePropertyTypes.get(key)!.set(parsed.propertyType, propType);
+  }
+
+  console.log(`\nGenerating markdown for ${serviceResources.size} services...`);
+  console.log(
+    `(Scraping AWS documentation with ${CONCURRENCY} concurrent requests...)\n`,
+  );
+
+  // Create service directories first
+  for (const service of serviceResources.keys()) {
+    const serviceDir = path.join(cfnDir, toKebabCase(service));
+    await fs.mkdir(serviceDir, { recursive: true });
+  }
+
+  // Collect all resources to process
+  const allResources: Array<{
+    service: string;
+    resourceName: string;
+    resource: ResourceType & { _fullType: string };
+    relatedStructs: Map<string, PropertyType>;
+  }> = [];
+
+  for (const [service, resources] of serviceResources) {
+    for (const [resourceName, resource] of resources) {
+      const key = `${service}::${resourceName}`;
+      const relatedStructs = servicePropertyTypes.get(key) ?? new Map();
+      allResources.push({ service, resourceName, resource, relatedStructs });
+    }
+  }
+
+  // Helper to check if file exists
+  async function fileExists(filePath: string): Promise<boolean> {
+    try {
+      await fs.access(filePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  // Filter to only resources that need processing
+  const resourcesToProcess: typeof allResources = [];
+  let skippedCount = 0;
+
+  for (const item of allResources) {
+    const serviceDir = path.join(cfnDir, toKebabCase(item.service));
+    const filePath = path.join(serviceDir, `${item.resourceName}.md`);
+    if (await fileExists(filePath)) {
+      console.log(`Skipping ${filePath} (already exists)`);
+      skippedCount++;
+    } else {
+      resourcesToProcess.push(item);
+    }
+  }
+
+  if (skippedCount > 0) {
+    console.log(`Skipping ${skippedCount} resources (already exist)`);
+  }
+
+  const totalToProcess = resourcesToProcess.length;
+  if (totalToProcess === 0) {
+    console.log("All resources already processed. Nothing to do.");
+    return;
+  }
+
+  console.log(`Processing ${totalToProcess} resources...\n`);
+
+  let processedResources = 0;
+  let scrapedCount = 0;
+
+  // Concurrency limiter for HTTP requests
+  const limit = createLimiter(CONCURRENCY);
+
+  // Process all resources in parallel with limited concurrency
+  await Promise.all(
+    resourcesToProcess.map(
+      async ({ service, resourceName, resource, relatedStructs }) => {
+        const fullType = resource._fullType;
+
+        // Scrape the AWS documentation (with concurrency limit)
+        let scraped: ScrapedResourceData | null = null;
+        if (resource.Documentation) {
+          scraped = await limit(() =>
+            scrapeResourceDocs(resource.Documentation!),
+          );
+          if (scraped) {
+            scrapedCount++;
+          }
+        }
+
+        // Scrape property type documentation in parallel
+        const structEntries = Array.from(relatedStructs.entries()).filter(
+          ([, struct]) => struct.Documentation,
+        );
+        const scrapedStructResults = await Promise.all(
+          structEntries.map(async ([structName, struct]) => {
+            const scrapedStruct = await limit(() =>
+              scrapePropertyTypeDocs(struct.Documentation!),
+            );
+            return [structName, scrapedStruct] as const;
+          }),
+        );
+
+        const structScraped = new Map<string, ScrapedPropertyTypeData>();
+        for (const [structName, scrapedStruct] of scrapedStructResults) {
+          if (scrapedStruct) {
+            structScraped.set(structName, scrapedStruct);
+          }
+        }
+
+        const markdown = generateResourceMarkdown(
+          resourceName,
+          fullType,
+          resource,
+          relatedStructs,
+          scraped,
+          structScraped,
+        );
+
+        const serviceDir = path.join(cfnDir, toKebabCase(service));
+        const filePath = path.join(serviceDir, `${resourceName}.md`);
+        await fs.writeFile(filePath, markdown);
+
+        processedResources++;
+        if (processedResources % 100 === 0) {
+          console.log(
+            `  Progress: ${processedResources}/${totalToProcess} (${Math.round((processedResources / totalToProcess) * 100)}%)`,
+          );
+        }
+      },
+    ),
+  );
+
+  console.log(`\nDone! Generated ${totalToProcess} resource docs.`);
+  console.log(`Successfully scraped ${scrapedCount} AWS documentation pages.`);
+
+  if (failedRequests > 0) {
+    console.warn(
+      `\n⚠️  Warning: ${failedRequests} requests failed - some docs may be incomplete`,
+    );
+    process.exit(1);
+  }
+}
+
+main().catch(console.error);
diff --git a/.repos/alchemy-effect/scripts/generate-docs.ts b/.repos/alchemy-effect/scripts/generate-docs.ts
new file mode 100644
index 00000000000..6e45dab3ac1
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-docs.ts
@@ -0,0 +1,47 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+import {
+  chooseCanonicalEntries,
+  createProject,
+  discoverSourceFiles,
+} from "./generate-docs/discovery.ts";
+import { buildFileDoc } from "./generate-docs/model.ts";
+import { renderFileDoc, syntheticIndexes } from "./generate-docs/render.ts";
+import { docsRoot } from "./generate-docs/utils.ts";
+
+async function writeFile(targetPath: string, content: string) {
+  await fs.mkdir(path.dirname(targetPath), { recursive: true });
+  await fs.writeFile(targetPath, `${content.trimEnd()}\n`, "utf8");
+}
+
+async function main() {
+  const project = createProject();
+  const sourceFiles = discoverSourceFiles(project);
+  const { entries, duplicates } = chooseCanonicalEntries(sourceFiles);
+
+  await fs.rm(docsRoot, { recursive: true, force: true });
+  await fs.mkdir(docsRoot, { recursive: true });
+
+  for (const entry of entries) {
+    const fileDoc = buildFileDoc(project, entry, entries);
+    await writeFile(entry.outputPath, renderFileDoc(fileDoc));
+  }
+
+  for (const synthetic of syntheticIndexes(entries)) {
+    await writeFile(synthetic.outputPath, synthetic.content);
+  }
+
+  console.log(`Generated ${entries.length} file docs.`);
+  if (duplicates.length > 0) {
+    console.log("Ignored case-colliding duplicates:");
+    for (const duplicate of duplicates) {
+      console.log(`- kept ${duplicate.canonical}`);
+      for (const ignored of duplicate.ignored) {
+        console.log(`  - ignored ${ignored}`);
+      }
+    }
+  }
+}
+
+await main();
diff --git a/.repos/alchemy-effect/scripts/generate-docs/discovery.ts b/.repos/alchemy-effect/scripts/generate-docs/discovery.ts
new file mode 100644
index 00000000000..352a9c9ac3a
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-docs/discovery.ts
@@ -0,0 +1,279 @@
+import * as path from "node:path";
+
+import {
+  Node,
+  Project,
+  QuoteKind,
+  SyntaxKind,
+  type ClassDeclaration,
+  type SourceFile,
+  type VariableDeclaration,
+} from "ts-morph";
+
+import type { DuplicateGroup, FileKind, SourceEntry } from "./types.ts";
+import {
+  canonicalScore,
+  docOutputPath,
+  lowerPathKey,
+  srcRoot,
+  titleFromRelativePath,
+  tsConfigPath,
+} from "./utils.ts";
+
+export function createProject() {
+  return new Project({
+    tsConfigFilePath: tsConfigPath,
+    skipFileDependencyResolution: true,
+    manipulationSettings: {
+      quoteKind: QuoteKind.Double,
+    },
+  });
+}
+
+export function discoverSourceFiles(project: Project) {
+  return project
+    .getSourceFiles()
+    .filter(
+      (sourceFile) =>
+        sourceFile.getFilePath().startsWith(srcRoot) &&
+        !sourceFile.isDeclarationFile(),
+    );
+}
+
+export function chooseCanonicalEntries(sourceFiles: SourceFile[]) {
+  const groups = new Map<string, SourceFile[]>();
+  for (const sourceFile of sourceFiles) {
+    const relativePath = path.relative(srcRoot, sourceFile.getFilePath());
+    const key = lowerPathKey(relativePath);
+    const group = groups.get(key);
+    if (group) {
+      group.push(sourceFile);
+    } else {
+      groups.set(key, [sourceFile]);
+    }
+  }
+
+  const entries: SourceEntry[] = [];
+  const duplicates: DuplicateGroup[] = [];
+
+  for (const group of groups.values()) {
+    const sorted = [...group].sort((left, right) => {
+      const leftRelative = path.relative(srcRoot, left.getFilePath());
+      const rightRelative = path.relative(srcRoot, right.getFilePath());
+      return (
+        canonicalScore(rightRelative) - canonicalScore(leftRelative) ||
+        leftRelative.localeCompare(rightRelative)
+      );
+    });
+    const canonical = sorted[0]!;
+    const relativePath = path.relative(srcRoot, canonical.getFilePath());
+    entries.push({
+      relativePath,
+      outputPath: docOutputPath(relativePath),
+      sourcePath: canonical.getFilePath(),
+    });
+
+    if (sorted.length > 1) {
+      duplicates.push({
+        canonical: relativePath,
+        ignored: sorted
+          .slice(1)
+          .map((file) => path.relative(srcRoot, file.getFilePath())),
+      });
+    }
+  }
+
+  entries.sort((left, right) =>
+    left.relativePath.localeCompare(right.relativePath),
+  );
+  duplicates.sort((left, right) =>
+    left.canonical.localeCompare(right.canonical),
+  );
+
+  return { entries, duplicates };
+}
+
+export function sourceFileForEntry(project: Project, entry: SourceEntry) {
+  return project.getSourceFileOrThrow(entry.sourcePath);
+}
+
+export function getResourceFactory(
+  sourceFile: SourceFile,
+  factoryName: "Resource" | "Host",
+) {
+  return sourceFile.getVariableDeclarations().find((declaration) => {
+    if (!declaration.isExported()) {
+      return false;
+    }
+    const initializer = declaration.getInitializerIfKind(
+      SyntaxKind.CallExpression,
+    );
+    return initializer?.getExpression().getText() === factoryName;
+  });
+}
+
+export function getResourceTypeDetails(
+  sourceFile: SourceFile,
+  factoryName: "Resource" | "Host",
+) {
+  const declaration = getResourceFactory(sourceFile, factoryName);
+  if (!declaration) {
+    return undefined;
+  }
+  const call = declaration.getInitializerIfKindOrThrow(
+    SyntaxKind.CallExpression,
+  );
+  const firstArg = call.getArguments()[0];
+  return {
+    declaration,
+    name: declaration.getName(),
+    resourceType:
+      firstArg && Node.isStringLiteral(firstArg)
+        ? firstArg.getLiteralValue()
+        : declaration.getName(),
+  };
+}
+
+function extendsCall(declaration: ClassDeclaration, expressionText: string) {
+  return declaration.getText().includes(`extends ${expressionText}<`);
+}
+
+export function getBindingServiceClasses(sourceFile: SourceFile) {
+  return sourceFile
+    .getClasses()
+    .filter(
+      (declaration) =>
+        declaration.isExported() && extendsCall(declaration, "Binding.Service"),
+    );
+}
+
+export function getBindingPolicyClasses(sourceFile: SourceFile) {
+  return sourceFile
+    .getClasses()
+    .filter(
+      (declaration) =>
+        declaration.isExported() && extendsCall(declaration, "Binding.Policy"),
+    );
+}
+
+export function getExportedNames(sourceFile: SourceFile) {
+  return [
+    ...sourceFile
+      .getClasses()
+      .filter((item) => item.isExported())
+      .map((item) => item.getName() ?? ""),
+    ...sourceFile
+      .getFunctions()
+      .filter((item) => item.isExported())
+      .map((item) => item.getName() ?? ""),
+    ...sourceFile
+      .getInterfaces()
+      .filter((item) => item.isExported())
+      .map((item) => item.getName()),
+    ...sourceFile
+      .getTypeAliases()
+      .filter((item) => item.isExported())
+      .map((item) => item.getName()),
+    ...sourceFile
+      .getVariableDeclarations()
+      .filter((item) => item.isExported())
+      .map((item) => item.getName()),
+  ].filter(Boolean);
+}
+
+export function getFileKind(sourceFile: SourceFile): FileKind {
+  const baseName = sourceFile.getBaseNameWithoutExtension();
+  const exportedNames = getExportedNames(sourceFile).join(" ");
+  const eventish =
+    /EventSource|Sink/.test(baseName) || /EventSource|Sink/.test(exportedNames);
+
+  if (baseName === "index") {
+    return "index";
+  }
+  if (getResourceFactory(sourceFile, "Host")) {
+    return "host";
+  }
+  if (getResourceFactory(sourceFile, "Resource")) {
+    return "resource";
+  }
+  if (
+    eventish &&
+    (getBindingPolicyClasses(sourceFile).length > 0 ||
+      getBindingServiceClasses(sourceFile).length > 0 ||
+      sourceFile.getText().includes("Layer.effect("))
+  ) {
+    return "event-source";
+  }
+  if (
+    getBindingServiceClasses(sourceFile).length > 0 ||
+    getBindingPolicyClasses(sourceFile).length > 0
+  ) {
+    return "operation";
+  }
+  if (
+    baseName === "Providers" ||
+    sourceFile
+      .getVariableDeclarations()
+      .some(
+        (declaration) =>
+          declaration.isExported() &&
+          ["providers", "resources", "bindings"].includes(
+            declaration.getName(),
+          ),
+      )
+  ) {
+    return "provider";
+  }
+  return "helper";
+}
+
+export function getProviderDeclaration(
+  sourceFile: SourceFile,
+  name: string,
+): VariableDeclaration | undefined {
+  return sourceFile.getVariableDeclaration(`${name}Provider`);
+}
+
+export function getPrimaryNode(sourceFile: SourceFile, fileKind: FileKind) {
+  switch (fileKind) {
+    case "resource":
+      return getResourceFactory(sourceFile, "Resource")?.getVariableStatement();
+    case "host":
+      return getResourceFactory(sourceFile, "Host")?.getVariableStatement();
+    case "operation":
+      return (
+        getBindingServiceClasses(sourceFile)[0] ??
+        getBindingPolicyClasses(sourceFile)[0]
+      );
+    case "event-source":
+      return (
+        sourceFile
+          .getVariableDeclarations()
+          .find(
+            (declaration) =>
+              declaration.isExported() &&
+              /EventSource|Sink/.test(declaration.getName()),
+          )
+          ?.getVariableStatement() ?? getBindingPolicyClasses(sourceFile)[0]
+      );
+    case "provider":
+      return sourceFile
+        .getVariableDeclarations()
+        .find((declaration) => declaration.isExported())
+        ?.getVariableStatement();
+    case "index":
+      return sourceFile.getExportDeclarations()[0];
+    default:
+      return sourceFile
+        .getStatements()
+        .find(
+          (statement) => Node.isExportable(statement) && statement.isExported(),
+        );
+  }
+}
+
+export function titleForSourceFile(sourceFile: SourceFile) {
+  return titleFromRelativePath(
+    path.relative(srcRoot, sourceFile.getFilePath()),
+  );
+}
diff --git a/.repos/alchemy-effect/scripts/generate-docs/model.ts b/.repos/alchemy-effect/scripts/generate-docs/model.ts
new file mode 100644
index 00000000000..a8c76e37014
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-docs/model.ts
@@ -0,0 +1,814 @@
+import * as path from "node:path";
+
+import {
+  Node,
+  SyntaxKind,
+  type ClassDeclaration,
+  type InterfaceDeclaration,
+  type ParameterDeclaration,
+  type SourceFile,
+  type Symbol,
+  type TypeAliasDeclaration,
+  type TypeNode,
+} from "ts-morph";
+
+import {
+  getBindingPolicyClasses,
+  getBindingServiceClasses,
+  getFileKind,
+  getPrimaryNode,
+  getProviderDeclaration,
+  getResourceTypeDetails,
+} from "./discovery.ts";
+import {
+  docsRoot,
+  formatTypeText,
+  getDefaultValue,
+  getJSDocInfo,
+  getSummary,
+  guessExampleValue,
+  labelFromDocRelativePath,
+  lowerCamel,
+  relativeDocLink,
+  relativeSourcePath,
+  srcRoot,
+  titleFromRelativePath,
+  truncateInline,
+} from "./utils.ts";
+import type {
+  BindingClassDoc,
+  DirectoryCatalog,
+  ExportDoc,
+  FileDoc,
+  FileKind,
+  LinkDoc,
+  OperationDoc,
+  PropertyDoc,
+  ResourceDoc,
+  ShapeDoc,
+  SourceEntry,
+} from "./types.ts";
+import { lifecycleOperationOrder } from "./types.ts";
+
+function propertySignatureToDoc(
+  property: import("ts-morph").PropertySignature,
+): PropertyDoc {
+  return {
+    name: property.getName(),
+    type: formatTypeText(
+      property.getTypeNode()?.getText() ?? property.getType().getText(property),
+    ),
+    optional: property.hasQuestionToken(),
+    readonly: property.isReadonly(),
+    description: getSummary(property),
+    defaultValue: getDefaultValue(property),
+  };
+}
+
+function getShapeFromMembers(
+  title: string,
+  members: Node[],
+  description?: string,
+): ShapeDoc | undefined {
+  const properties = members
+    .flatMap((member) =>
+      Node.isPropertySignature(member) ? [propertySignatureToDoc(member)] : [],
+    )
+    .sort((left, right) => left.name.localeCompare(right.name));
+
+  if (properties.length === 0) {
+    return undefined;
+  }
+
+  return {
+    title,
+    description,
+    properties,
+  };
+}
+
+function resolveShapeDeclaration(
+  symbol: Symbol | undefined,
+): InterfaceDeclaration | TypeAliasDeclaration | undefined {
+  return symbol
+    ?.getDeclarations()
+    .find(
+      (declaration) =>
+        Node.isInterfaceDeclaration(declaration) ||
+        Node.isTypeAliasDeclaration(declaration),
+    ) as InterfaceDeclaration | TypeAliasDeclaration | undefined;
+}
+
+function getShapeFromTypeNode(
+  title: string,
+  typeNode: TypeNode,
+  description?: string,
+): ShapeDoc | undefined {
+  if (Node.isTypeLiteral(typeNode)) {
+    return getShapeFromMembers(title, typeNode.getMembers(), description);
+  }
+
+  if (Node.isTypeReference(typeNode)) {
+    const declaration = resolveShapeDeclaration(
+      typeNode.getTypeName().getSymbol(),
+    );
+    if (declaration) {
+      return getShapeFromDeclaration(title, declaration);
+    }
+  }
+
+  return {
+    title,
+    description,
+    properties: [],
+    signature: formatTypeText(typeNode.getText()),
+  };
+}
+
+function getShapeFromDeclaration(
+  title: string,
+  declaration: InterfaceDeclaration | TypeAliasDeclaration,
+): ShapeDoc | undefined {
+  if (Node.isInterfaceDeclaration(declaration)) {
+    return getShapeFromMembers(
+      title,
+      declaration.getMembers(),
+      getSummary(declaration),
+    );
+  }
+
+  const typeNode = declaration.getTypeNode();
+  if (!typeNode) {
+    return undefined;
+  }
+  return getShapeFromTypeNode(title, typeNode, getSummary(declaration));
+}
+
+function signatureForDeclaration(declaration: Node) {
+  if (Node.isClassDeclaration(declaration)) {
+    const heritage = declaration
+      .getHeritageClauses()
+      .flatMap((clause) => clause.getTypeNodes())
+      .map((typeNode) => typeNode.getText())
+      .join(", ");
+    return `class ${declaration.getName() ?? "Anonymous"}${heritage ? ` extends ${heritage}` : ""}`;
+  }
+
+  if (Node.isFunctionDeclaration(declaration)) {
+    const params = declaration
+      .getParameters()
+      .map((param) => param.getText())
+      .join(", ");
+    const returnType = declaration.getReturnTypeNode()?.getText();
+    return `function ${declaration.getName() ?? "anonymous"}(${params})${returnType ? `: ${returnType}` : ""}`;
+  }
+
+  if (Node.isInterfaceDeclaration(declaration)) {
+    return `interface ${declaration.getName()}`;
+  }
+
+  if (Node.isTypeAliasDeclaration(declaration)) {
+    return `type ${declaration.getName()} = ${formatTypeText(
+      declaration.getTypeNode()?.getText(),
+    )}`;
+  }
+
+  if (Node.isVariableDeclaration(declaration)) {
+    const kind =
+      declaration.getVariableStatement()?.getDeclarationKind() ?? "const";
+    const initializer = declaration.getInitializer()?.getText();
+    return `${kind} ${declaration.getName()}${initializer ? ` = ${truncateInline(initializer)}` : ""}`;
+  }
+
+  if (Node.isModuleDeclaration(declaration)) {
+    return `namespace ${declaration.getName()}`;
+  }
+
+  if (Node.isEnumDeclaration(declaration)) {
+    return `enum ${declaration.getName()}`;
+  }
+
+  return truncateInline(declaration.getText());
+}
+
+function getLocalExports(sourceFile: SourceFile): ExportDoc[] {
+  const exports: ExportDoc[] = [];
+
+  for (const declaration of sourceFile
+    .getClasses()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName() ?? "Anonymous",
+      kind: "class",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration),
+    });
+  }
+
+  for (const declaration of sourceFile
+    .getFunctions()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName() ?? "anonymous",
+      kind: "function",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration),
+    });
+  }
+
+  for (const declaration of sourceFile
+    .getInterfaces()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName(),
+      kind: "interface",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration),
+      shape: getShapeFromDeclaration(declaration.getName(), declaration),
+    });
+  }
+
+  for (const declaration of sourceFile
+    .getTypeAliases()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName(),
+      kind: "type",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration),
+      shape: getShapeFromDeclaration(declaration.getName(), declaration),
+    });
+  }
+
+  for (const declaration of sourceFile
+    .getVariableDeclarations()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName(),
+      kind: "const",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration.getVariableStatement() ?? declaration),
+    });
+  }
+
+  for (const declaration of sourceFile
+    .getEnums()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName(),
+      kind: "enum",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration),
+    });
+  }
+
+  for (const declaration of sourceFile
+    .getModules()
+    .filter((item) => item.isExported())) {
+    exports.push({
+      name: declaration.getName(),
+      kind: "namespace",
+      signature: signatureForDeclaration(declaration),
+      summary: getSummary(declaration),
+    });
+  }
+
+  const seen = new Set<string>();
+  return exports
+    .filter((entry) => {
+      const key = `${entry.kind}:${entry.name}`;
+      if (seen.has(key)) {
+        return false;
+      }
+      seen.add(key);
+      return true;
+    })
+    .sort((left, right) => left.name.localeCompare(right.name));
+}
+
+function getLifecycleOperations(sourceFile: SourceFile, resourceName: string) {
+  const provider = getProviderDeclaration(sourceFile, resourceName);
+  if (!provider) {
+    return [];
+  }
+  const text = provider.getText();
+  return lifecycleOperationOrder.filter((name) =>
+    new RegExp(`\\b${name}\\s*:`).test(text),
+  );
+}
+
+function getResourceDoc(sourceFile: SourceFile, fileKind: FileKind) {
+  const details = getResourceTypeDetails(
+    sourceFile,
+    fileKind === "host" ? "Host" : "Resource",
+  );
+  if (!details) {
+    return undefined;
+  }
+
+  const resourceInterface = sourceFile.getInterface(details.name);
+  const props =
+    sourceFile.getInterface(`${details.name}Props`) ??
+    sourceFile.getTypeAlias(`${details.name}Props`);
+
+  let attributes: ShapeDoc | undefined;
+  let binding: ShapeDoc | undefined;
+
+  if (resourceInterface) {
+    const resourceHeritage = resourceInterface
+      .getHeritageClauses()
+      .flatMap((clause) => clause.getTypeNodes())
+      .find((typeNode) => typeNode.getExpression().getText() === "Resource");
+
+    if (resourceHeritage) {
+      const typeArguments = resourceHeritage.getTypeArguments();
+      const attrsNode = typeArguments[2];
+      const bindingNode = typeArguments[3];
+      if (attrsNode) {
+        attributes = getShapeFromTypeNode(
+          `${details.name} Attributes`,
+          attrsNode,
+        );
+      }
+      if (bindingNode) {
+        binding = getShapeFromTypeNode(
+          `${details.name} Binding Contract`,
+          bindingNode,
+        );
+      }
+    }
+  }
+
+  const resourceDoc: ResourceDoc = {
+    name: details.name,
+    resourceType: details.resourceType,
+    props: props
+      ? getShapeFromDeclaration(`${details.name} Props`, props)
+      : undefined,
+    attributes,
+    binding,
+    lifecycleOperations: getLifecycleOperations(sourceFile, details.name),
+    providerName: getProviderDeclaration(sourceFile, details.name)?.getName(),
+  };
+
+  return resourceDoc;
+}
+
+function getBindingIdentifier(declaration: ClassDeclaration) {
+  const text = declaration.getText();
+  return text.match(/\)\("([^"]+)"\)/)?.[1];
+}
+
+function bindingDocForClass(declaration: ClassDeclaration): BindingClassDoc {
+  return {
+    name: declaration.getName() ?? "Anonymous",
+    identifier: getBindingIdentifier(declaration),
+    signature: signatureForDeclaration(declaration),
+    summary: getSummary(declaration),
+  };
+}
+
+function getRequestShapes(sourceFile: SourceFile) {
+  return [
+    ...sourceFile
+      .getInterfaces()
+      .filter(
+        (item) =>
+          item.isExported() &&
+          /Request|Props|Options|Input$/.test(item.getName()),
+      ),
+    ...sourceFile
+      .getTypeAliases()
+      .filter(
+        (item) =>
+          item.isExported() &&
+          /Request|Props|Options|Input$/.test(item.getName()),
+      ),
+  ]
+    .map((declaration) =>
+      getShapeFromDeclaration(declaration.getName(), declaration),
+    )
+    .filter((shape): shape is ShapeDoc => shape !== undefined)
+    .sort((left, right) => left.title.localeCompare(right.title));
+}
+
+function getSupportedHosts(sourceFile: SourceFile) {
+  const hosts = new Set<string>();
+  const text = sourceFile.getText();
+  if (text.includes("isFunction(host)")) {
+    hosts.add("AWS.Lambda.Function");
+  }
+  if (text.includes("isWorker(host)")) {
+    hosts.add("Cloudflare.Workers.Worker");
+  }
+  return [...hosts].sort();
+}
+
+function parameterToUsage(parameter: ParameterDeclaration) {
+  return {
+    name: parameter.getName(),
+    type: formatTypeText(
+      parameter.getTypeNode()?.getText() ??
+        parameter.getType().getText(parameter),
+    ),
+    optional: parameter.isOptional(),
+    rest: parameter.isRestParameter(),
+  };
+}
+
+function getOperationUsage(
+  sourceFile: SourceFile,
+  serviceName: string | undefined,
+) {
+  if (!serviceName) {
+    return undefined;
+  }
+
+  const live = sourceFile.getVariableDeclaration(`${serviceName}Live`);
+  const initializer = live?.getInitializer();
+  if (!initializer) {
+    return undefined;
+  }
+
+  const effectFns = initializer
+    .getDescendantsOfKind(SyntaxKind.CallExpression)
+    .filter((call) => call.getExpression().getText() === "Effect.fn");
+
+  const [bindFn, invokeFn] = effectFns.map((call) => {
+    const firstArg = call.getArguments()[0];
+    if (
+      firstArg &&
+      (Node.isFunctionExpression(firstArg) || Node.isArrowFunction(firstArg))
+    ) {
+      return firstArg;
+    }
+    return undefined;
+  });
+
+  if (!bindFn && !invokeFn) {
+    return undefined;
+  }
+
+  return {
+    bindParameters: bindFn?.getParameters().map(parameterToUsage) ?? [],
+    invokeParameters: invokeFn?.getParameters().map(parameterToUsage) ?? [],
+  };
+}
+
+function getOperationDoc(sourceFile: SourceFile): OperationDoc | undefined {
+  const services = getBindingServiceClasses(sourceFile).map(bindingDocForClass);
+  const policies = getBindingPolicyClasses(sourceFile).map(bindingDocForClass);
+  const runtimeLayers = sourceFile
+    .getVariableDeclarations()
+    .filter(
+      (declaration) =>
+        declaration.isExported() &&
+        /Live$/.test(declaration.getName()) &&
+        declaration.getInitializer()?.getText().includes("Layer.") === true,
+    )
+    .map((declaration) => declaration.getName())
+    .sort();
+  const requestShapes = getRequestShapes(sourceFile);
+
+  if (
+    services.length === 0 &&
+    policies.length === 0 &&
+    runtimeLayers.length === 0 &&
+    requestShapes.length === 0
+  ) {
+    return undefined;
+  }
+
+  return {
+    services,
+    policies,
+    runtimeLayers,
+    supportedHosts: getSupportedHosts(sourceFile),
+    requestShapes,
+    usage: getOperationUsage(sourceFile, services[0]?.name),
+  };
+}
+
+function getIndexDoc(sourceFile: SourceFile, outputPath: string) {
+  return {
+    reExports: sourceFile
+      .getExportDeclarations()
+      .flatMap((declaration) => {
+        const moduleSpecifier = declaration.getModuleSpecifierValue();
+        if (!moduleSpecifier) {
+          return [];
+        }
+        const target = declaration.getModuleSpecifierSourceFile();
+        const href = target
+          ? relativeDocLink(
+              outputPath,
+              path.join(
+                docsRoot,
+                path
+                  .relative(srcRoot, target.getFilePath())
+                  .replace(/\.ts$/, ".md"),
+              ),
+            )
+          : undefined;
+        const namespaceExport = declaration.getNamespaceExport();
+        const exportNames =
+          declaration.getNamedExports().length > 0
+            ? declaration.getNamedExports().map((item) => item.getName())
+            : namespaceExport
+              ? [namespaceExport.getName()]
+              : ["*"];
+
+        return exportNames.map((exportName) => ({
+          exportName,
+          sourcePath: moduleSpecifier,
+          href,
+        }));
+      })
+      .sort((left, right) =>
+        `${left.exportName}:${left.sourcePath}`.localeCompare(
+          `${right.exportName}:${right.sourcePath}`,
+        ),
+      ),
+  };
+}
+
+function getProviderDoc(sourceFile: SourceFile) {
+  const exportedFactories = sourceFile
+    .getVariableDeclarations()
+    .filter((declaration) => declaration.isExported())
+    .map((declaration) => declaration.getName())
+    .filter(
+      (name) =>
+        [
+          "providers",
+          "resources",
+          "bindings",
+          "credentials",
+          "stageConfig",
+        ].includes(name) || /Provider/.test(name),
+    )
+    .sort();
+
+  return exportedFactories.length > 0 ? { exportedFactories } : undefined;
+}
+
+function buildRelatedLinks(
+  sourceFile: SourceFile,
+  outputPath: string,
+): LinkDoc[] {
+  const links = new Map<string, LinkDoc>();
+
+  const maybeAdd = (target: SourceFile | undefined, label: string) => {
+    if (!target || !target.getFilePath().startsWith(srcRoot)) {
+      return;
+    }
+    const relativeTargetPath = path.relative(srcRoot, target.getFilePath());
+    const href = relativeDocLink(
+      outputPath,
+      path.join(docsRoot, relativeTargetPath.replace(/\.ts$/, ".md")),
+    );
+    links.set(`${label}:${href}`, {
+      label:
+        path.basename(relativeTargetPath, ".ts") === "index"
+          ? path.basename(path.dirname(relativeTargetPath))
+          : label,
+      href,
+    });
+  };
+
+  for (const declaration of sourceFile.getImportDeclarations()) {
+    maybeAdd(
+      declaration.getModuleSpecifierSourceFile(),
+      path.basename(declaration.getModuleSpecifierValue(), ".ts"),
+    );
+  }
+
+  for (const declaration of sourceFile.getExportDeclarations()) {
+    const moduleSpecifier = declaration.getModuleSpecifierValue() ?? "index.ts";
+    maybeAdd(
+      declaration.getModuleSpecifierSourceFile(),
+      path.basename(moduleSpecifier, ".ts"),
+    );
+  }
+
+  return [...links.values()].sort((left, right) =>
+    left.label.localeCompare(right.label),
+  );
+}
+
+function buildDirectoryCatalog(
+  entry: SourceEntry,
+  entries: SourceEntry[],
+): DirectoryCatalog {
+  const directory = path.dirname(entry.relativePath);
+  const isIndexPage = path.basename(entry.relativePath) === "index.ts";
+  const parent = !isIndexPage
+    ? {
+        label: directory === "." ? "API Reference" : path.basename(directory),
+        href: relativeDocLink(
+          entry.outputPath,
+          path.join(
+            docsRoot,
+            directory === "." ? "index.md" : directory,
+            "index.md",
+          ),
+        ),
+      }
+    : directory === "."
+      ? undefined
+      : {
+          label:
+            path.dirname(directory) === "."
+              ? "API Reference"
+              : path.basename(path.dirname(directory)),
+          href: relativeDocLink(
+            entry.outputPath,
+            path.join(
+              docsRoot,
+              path.dirname(directory) === "."
+                ? "index.md"
+                : path.dirname(directory),
+              "index.md",
+            ),
+          ),
+        };
+
+  const siblings = entries
+    .filter(
+      (candidate) =>
+        path.dirname(candidate.relativePath) === directory &&
+        candidate.relativePath !== entry.relativePath,
+    )
+    .map((candidate) => ({
+      label: labelFromDocRelativePath(candidate.relativePath),
+      href: relativeDocLink(entry.outputPath, candidate.outputPath),
+    }))
+    .sort((left, right) => left.label.localeCompare(right.label));
+
+  return { parent, siblings };
+}
+
+function buildSummary(sourceFile: SourceFile, fileKind: FileKind) {
+  const primaryNode = getPrimaryNode(sourceFile, fileKind);
+  const summary = primaryNode ? getSummary(primaryNode) : undefined;
+  if (summary) {
+    return summary;
+  }
+  return "";
+}
+
+function singularize(name: string) {
+  return name.endsWith("ies")
+    ? `${name.slice(0, -3)}y`
+    : name.endsWith("ses")
+      ? name.slice(0, -2)
+      : name.endsWith("s") && name.length > 1
+        ? name.slice(0, -1)
+        : name;
+}
+
+function guessBindingArgument(name: string, rest: boolean) {
+  const base = rest ? singularize(name) : name;
+  return lowerCamel(base || "resource");
+}
+
+function buildRequestBlock(shape: ShapeDoc | undefined) {
+  if (!shape) {
+    return "{\n  // request fields\n}";
+  }
+
+  const required = shape.properties.filter((property) => !property.optional);
+  const properties = (required.length > 0 ? required : shape.properties).slice(
+    0,
+    4,
+  );
+
+  if (properties.length === 0) {
+    return "{}";
+  }
+
+  return `{\n${properties
+    .map((property) => `  ${property.name}: ${guessExampleValue(property)},`)
+    .join("\n")}\n}`;
+}
+
+function buildAutoExample(
+  fileKind: FileKind,
+  title: string,
+  resource?: ResourceDoc,
+  operation?: OperationDoc,
+) {
+  if (fileKind === "resource" || fileKind === "host") {
+    const required = (resource?.props?.properties ?? []).filter(
+      (property) => !property.optional,
+    );
+    const propsBlock =
+      required.length === 0
+        ? "{}"
+        : `{\n${required
+            .map(
+              (property) =>
+                `  ${property.name}: ${guessExampleValue(property)},`,
+            )
+            .join("\n")}\n}`;
+    return {
+      title: `Create ${title}`,
+      body: [
+        "```typescript",
+        `const ${lowerCamel(title)} = yield* ${title}("${title}", ${propsBlock});`,
+        "```",
+      ].join("\n"),
+    };
+  }
+
+  if (fileKind === "operation") {
+    const service = operation?.services[0]?.name ?? title;
+    const bindArguments =
+      operation?.usage?.bindParameters.map((parameter) =>
+        guessBindingArgument(parameter.name, parameter.rest),
+      ) ?? [];
+    const bindCall =
+      bindArguments.length > 0
+        ? `.bind(${bindArguments.join(", ")})`
+        : ".bind()";
+    const invokeParameter = operation?.usage?.invokeParameters[0];
+    const requestShape = operation?.requestShapes[0];
+    const invocation = invokeParameter
+      ? invokeParameter.optional
+        ? `const response = yield* ${lowerCamel(service)}();`
+        : `const response = yield* ${lowerCamel(service)}(${buildRequestBlock(requestShape)});`
+      : `const response = yield* ${lowerCamel(service)}();`;
+
+    return {
+      title: `Use ${service}`,
+      body: [
+        "```typescript",
+        `const ${lowerCamel(service)} = yield* ${service}${bindCall};`,
+        "",
+        invocation,
+        "```",
+      ].join("\n"),
+    };
+  }
+
+  if (fileKind === "event-source") {
+    return {
+      title: `Attach ${title}`,
+      body: [
+        "```typescript",
+        `yield* ${title}.bind(resource, {}, (events) =>`,
+        "  Effect.log(events),",
+        ");",
+        "```",
+      ].join("\n"),
+    };
+  }
+
+  return undefined;
+}
+
+export function buildFileDoc(
+  project: import("ts-morph").Project,
+  entry: SourceEntry,
+  entries: SourceEntry[],
+): FileDoc {
+  const sourceFile = project.getSourceFileOrThrow(entry.sourcePath);
+  const fileKind = getFileKind(sourceFile);
+  const title = titleFromRelativePath(entry.relativePath);
+  const examples = (() => {
+    const primaryNode = getPrimaryNode(sourceFile, fileKind);
+    return primaryNode ? getJSDocInfo(primaryNode).sections : [];
+  })();
+  const resource =
+    fileKind === "resource" || fileKind === "host"
+      ? getResourceDoc(sourceFile, fileKind)
+      : undefined;
+  const operation =
+    fileKind === "operation" || fileKind === "event-source"
+      ? getOperationDoc(sourceFile)
+      : undefined;
+
+  return {
+    title,
+    fileKind,
+    summary: buildSummary(sourceFile, fileKind),
+    sourcePath: relativeSourcePath(sourceFile.getFilePath()),
+    relativePath: entry.relativePath,
+    outputPath: entry.outputPath,
+    exports: getLocalExports(sourceFile),
+    resource,
+    operation,
+    index:
+      fileKind === "index"
+        ? getIndexDoc(sourceFile, entry.outputPath)
+        : undefined,
+    provider: fileKind === "provider" ? getProviderDoc(sourceFile) : undefined,
+    examples,
+    autoExample:
+      examples.length === 0
+        ? buildAutoExample(fileKind, title, resource, operation)
+        : undefined,
+    relatedLinks: buildRelatedLinks(sourceFile, entry.outputPath),
+    directoryCatalog: buildDirectoryCatalog(entry, entries),
+  };
+}
diff --git a/.repos/alchemy-effect/scripts/generate-docs/render.ts b/.repos/alchemy-effect/scripts/generate-docs/render.ts
new file mode 100644
index 00000000000..768c9e0b1dc
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-docs/render.ts
@@ -0,0 +1,330 @@
+import * as path from "node:path";
+
+import type {
+  BindingClassDoc,
+  DirectoryCatalog,
+  FileDoc,
+  LinkDoc,
+  ShapeDoc,
+  SourceEntry,
+} from "./types.ts";
+import {
+  docsRoot,
+  escapeMarkdown,
+  labelFromDocRelativePath,
+  relativeDocLink,
+} from "./utils.ts";
+
+function renderLinks(links: LinkDoc[]) {
+  return links.map((link) => `- [${link.label}](${link.href})`).join("\n");
+}
+
+function renderShape(
+  shape: ShapeDoc | undefined,
+  heading: string,
+  level: "##" | "###" = "##",
+) {
+  if (!shape) {
+    return "";
+  }
+
+  if (shape.properties.length === 0) {
+    return [
+      `${level} ${heading}`,
+      shape.description ?? "",
+      shape.signature ? ["```ts", shape.signature, "```"].join("\n") : "",
+    ]
+      .filter(Boolean)
+      .join("\n\n");
+  }
+
+  const rows = shape.properties.map(
+    (property) =>
+      `| \`${escapeMarkdown(property.name)}\` | \`${escapeMarkdown(property.type)}\` | ${
+        property.optional ? "optional" : "required"
+      }${property.readonly ? ", readonly" : ""} | ${escapeMarkdown(
+        property.defaultValue ?? "-",
+      )} | ${escapeMarkdown(property.description ?? "-")} |`,
+  );
+
+  const table = [
+    "| Property | Type | Flags | Default | Description |",
+    "| --- | --- | --- | --- | --- |",
+    ...rows,
+  ].join("\n");
+
+  return [`${level} ${heading}`, shape.description ?? "", table]
+    .filter(Boolean)
+    .join("\n\n");
+}
+
+function renderBindingGroup(heading: string, items: BindingClassDoc[]) {
+  if (items.length === 0) {
+    return "";
+  }
+
+  return [
+    `### ${heading}`,
+    ...items.map((item) =>
+      [
+        `#### \`${item.name}\``,
+        item.identifier ? `Identifier: \`${item.identifier}\`` : "",
+        item.summary ?? "",
+      ]
+        .filter(Boolean)
+        .join("\n\n"),
+    ),
+  ].join("\n\n");
+}
+
+function renderExports(fileDoc: FileDoc) {
+  if (fileDoc.exports.length === 0) {
+    return "";
+  }
+
+  const rows = fileDoc.exports.map(
+    (entry) =>
+      `| \`${escapeMarkdown(entry.name)}\` | ${entry.kind} | \`${escapeMarkdown(
+        entry.signature,
+      )}\` | ${escapeMarkdown(entry.summary ?? "-")} |`,
+  );
+
+  const details = fileDoc.exports
+    .map((entry) =>
+      [
+        `### \`${entry.name}\``,
+        entry.summary ?? "",
+        ["```ts", entry.signature, "```"].join("\n"),
+        entry.shape ? renderShape(entry.shape, entry.shape.title, "###") : "",
+      ]
+        .filter(Boolean)
+        .join("\n\n"),
+    )
+    .join("\n\n");
+
+  return [
+    "## Exports",
+    "| Symbol | Kind | Signature | Description |",
+    "| --- | --- | --- | --- |",
+    ...rows,
+    "",
+    details,
+  ].join("\n");
+}
+
+function renderExamples(fileDoc: FileDoc) {
+  if (fileDoc.examples.length === 0 && !fileDoc.autoExample) {
+    return "";
+  }
+
+  const sections = fileDoc.examples.flatMap((section) => [
+    `### ${section.title}`,
+    ...section.examples.flatMap((example) => [
+      `#### ${example.title}`,
+      example.body,
+    ]),
+  ]);
+
+  if (fileDoc.autoExample) {
+    sections.push(
+      "### Quick Start",
+      `#### ${fileDoc.autoExample.title}`,
+      fileDoc.autoExample.body,
+    );
+  }
+
+  return ["## Examples", ...sections].join("\n\n");
+}
+
+function renderCatalog(catalog: DirectoryCatalog) {
+  const parts = ["## Navigation"];
+  if (catalog.parent) {
+    parts.push(`- Parent: [${catalog.parent.label}](${catalog.parent.href})`);
+  }
+  if (catalog.siblings.length > 0) {
+    parts.push("- Siblings");
+    parts.push(renderLinks(catalog.siblings));
+  }
+  return parts.join("\n");
+}
+
+function isPrimaryReferencePage(fileDoc: FileDoc) {
+  return ["resource", "host", "operation", "event-source"].includes(
+    fileDoc.fileKind,
+  );
+}
+
+export function renderFileDoc(fileDoc: FileDoc) {
+  const sourceHref = relativeDocLink(
+    fileDoc.outputPath,
+    path.join(docsRoot, "..", fileDoc.sourcePath),
+  );
+  const primaryReferencePage = isPrimaryReferencePage(fileDoc);
+
+  return [
+    "<!-- AUTO-GENERATED: DO NOT EDIT. Run `bun run generate:docs`. -->",
+    "",
+    `# ${fileDoc.title}`,
+    "",
+    fileDoc.summary,
+    "",
+    `- Source: [\`${fileDoc.sourcePath}\`](${sourceHref})`,
+    renderExamples(fileDoc),
+    fileDoc.resource && !primaryReferencePage
+      ? [
+          "## Resource Model",
+          `- Resource Type: \`${fileDoc.resource.resourceType}\``,
+          fileDoc.resource.providerName
+            ? `- Provider Export: \`${fileDoc.resource.providerName}\``
+            : "",
+          fileDoc.resource.lifecycleOperations.length > 0
+            ? `- Lifecycle Operations: ${fileDoc.resource.lifecycleOperations
+                .map((name) => `\`${name}\``)
+                .join(", ")}`
+            : "",
+        ]
+          .filter(Boolean)
+          .join("\n")
+      : "",
+    renderShape(fileDoc.resource?.props, "Props"),
+    renderShape(fileDoc.resource?.attributes, "Attributes"),
+    renderShape(fileDoc.resource?.binding, "Binding Contract"),
+    fileDoc.operation
+      ? [
+          "## Reference",
+          renderBindingGroup("Runtime Bindings", fileDoc.operation.services),
+          renderBindingGroup(
+            "Deploy-Time Policies",
+            fileDoc.operation.policies,
+          ),
+          fileDoc.operation.runtimeLayers.length > 0
+            ? [
+                "### Live Layers",
+                fileDoc.operation.runtimeLayers
+                  .map((name) => `- \`${name}\``)
+                  .join("\n"),
+              ].join("\n\n")
+            : "",
+          fileDoc.operation.supportedHosts.length > 0
+            ? [
+                "### Supported Hosts",
+                fileDoc.operation.supportedHosts
+                  .map((name) => `- \`${name}\``)
+                  .join("\n"),
+              ].join("\n\n")
+            : "",
+          ...fileDoc.operation.requestShapes.map((shape) =>
+            renderShape(shape, shape.title),
+          ),
+        ]
+          .filter(Boolean)
+          .join("\n\n")
+      : "",
+    fileDoc.provider
+      ? [
+          "## Provider Exports",
+          fileDoc.provider.exportedFactories
+            .map((name) => `- \`${name}\``)
+            .join("\n"),
+        ].join("\n\n")
+      : "",
+    fileDoc.index && fileDoc.index.reExports.length > 0
+      ? [
+          "## Re-Exports",
+          "| Export | Source |",
+          "| --- | --- |",
+          ...fileDoc.index.reExports.map((entry) => {
+            const source = entry.href
+              ? `[\`${entry.sourcePath}\`](${entry.href})`
+              : `\`${entry.sourcePath}\``;
+            return `| \`${escapeMarkdown(entry.exportName)}\` | ${source} |`;
+          }),
+        ].join("\n")
+      : "",
+    !primaryReferencePage ? renderExports(fileDoc) : "",
+    !primaryReferencePage && fileDoc.relatedLinks.length > 0
+      ? ["## Related Files", renderLinks(fileDoc.relatedLinks)].join("\n\n")
+      : "",
+    !primaryReferencePage ? renderCatalog(fileDoc.directoryCatalog) : "",
+  ]
+    .filter((part) => part && part.trim().length > 0)
+    .join("\n\n");
+}
+
+function allDirectories(entries: SourceEntry[]) {
+  const directories = new Set<string>();
+  for (const entry of entries) {
+    let current = path.dirname(entry.relativePath);
+    while (true) {
+      directories.add(current);
+      if (current === ".") {
+        break;
+      }
+      current = path.dirname(current);
+    }
+  }
+  return [...directories].sort();
+}
+
+function hasSourceIndex(directory: string, entries: SourceEntry[]) {
+  return entries.some(
+    (entry) => entry.relativePath === path.join(directory, "index.ts"),
+  );
+}
+
+export function syntheticIndexes(entries: SourceEntry[]) {
+  return allDirectories(entries)
+    .filter((directory) => !hasSourceIndex(directory, entries))
+    .map((directory) => {
+      const outputPath = path.join(
+        docsRoot,
+        directory === "." ? "index.md" : directory,
+        "index.md",
+      );
+      const files = entries
+        .filter(
+          (entry) =>
+            path.dirname(entry.relativePath) === directory &&
+            path.basename(entry.relativePath) !== "index.ts",
+        )
+        .map((entry) => ({
+          label: labelFromDocRelativePath(entry.relativePath),
+          href: relativeDocLink(outputPath, entry.outputPath),
+        }))
+        .sort((left, right) => left.label.localeCompare(right.label));
+      const childDirectories = allDirectories(entries)
+        .filter(
+          (candidate) =>
+            candidate !== "." && path.dirname(candidate) === directory,
+        )
+        .map((candidate) => ({
+          label: path.basename(candidate),
+          href: relativeDocLink(
+            outputPath,
+            path.join(docsRoot, candidate, "index.md"),
+          ),
+        }))
+        .sort((left, right) => left.label.localeCompare(right.label));
+
+      const title =
+        directory === "." ? "API Reference" : path.basename(directory);
+      const content = [
+        "<!-- AUTO-GENERATED: DO NOT EDIT. Run `bun run generate:docs`. -->",
+        "",
+        `# ${title}`,
+        "",
+        directory === "."
+          ? "Static API reference generated from `alchemy/src`."
+          : `Directory index for \`src/${directory}\`.`,
+        "",
+        childDirectories.length > 0
+          ? ["## Directories", renderLinks(childDirectories)].join("\n\n")
+          : "",
+        files.length > 0 ? ["## Files", renderLinks(files)].join("\n\n") : "",
+      ]
+        .filter((part) => part && part.trim().length > 0)
+        .join("\n\n");
+
+      return { outputPath, content };
+    });
+}
diff --git a/.repos/alchemy-effect/scripts/generate-docs/types.ts b/.repos/alchemy-effect/scripts/generate-docs/types.ts
new file mode 100644
index 00000000000..d2c7810a7c2
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-docs/types.ts
@@ -0,0 +1,159 @@
+export type FileKind =
+  | "resource"
+  | "host"
+  | "operation"
+  | "event-source"
+  | "provider"
+  | "index"
+  | "helper";
+
+export type ExportKind =
+  | "class"
+  | "const"
+  | "enum"
+  | "function"
+  | "interface"
+  | "namespace"
+  | "type";
+
+export interface SourceEntry {
+  relativePath: string;
+  outputPath: string;
+  sourcePath: string;
+}
+
+export interface DuplicateGroup {
+  canonical: string;
+  ignored: string[];
+}
+
+export interface ExampleDoc {
+  title: string;
+  body: string;
+}
+
+export interface ExampleSection {
+  title: string;
+  examples: ExampleDoc[];
+}
+
+export interface JSDocInfo {
+  summary?: string;
+  defaultValue?: string;
+  sections: ExampleSection[];
+}
+
+export interface PropertyDoc {
+  name: string;
+  type: string;
+  optional: boolean;
+  readonly: boolean;
+  description?: string;
+  defaultValue?: string;
+}
+
+export interface ShapeDoc {
+  title: string;
+  description?: string;
+  properties: PropertyDoc[];
+  signature?: string;
+}
+
+export interface ExportDoc {
+  name: string;
+  kind: ExportKind;
+  signature: string;
+  summary?: string;
+  shape?: ShapeDoc;
+}
+
+export interface ResourceDoc {
+  name: string;
+  resourceType: string;
+  props?: ShapeDoc;
+  attributes?: ShapeDoc;
+  binding?: ShapeDoc;
+  lifecycleOperations: string[];
+  providerName?: string;
+}
+
+export interface BindingClassDoc {
+  name: string;
+  identifier?: string;
+  signature: string;
+  summary?: string;
+}
+
+export interface OperationDoc {
+  services: BindingClassDoc[];
+  policies: BindingClassDoc[];
+  runtimeLayers: string[];
+  supportedHosts: string[];
+  requestShapes: ShapeDoc[];
+  usage?: {
+    bindParameters: Array<{
+      name: string;
+      type: string;
+      optional: boolean;
+      rest: boolean;
+    }>;
+    invokeParameters: Array<{
+      name: string;
+      type: string;
+      optional: boolean;
+      rest: boolean;
+    }>;
+  };
+}
+
+export interface ReExportDoc {
+  exportName: string;
+  sourcePath: string;
+  href?: string;
+}
+
+export interface IndexDoc {
+  reExports: ReExportDoc[];
+}
+
+export interface ProviderDoc {
+  exportedFactories: string[];
+}
+
+export interface LinkDoc {
+  label: string;
+  href: string;
+}
+
+export interface DirectoryCatalog {
+  parent?: LinkDoc;
+  siblings: LinkDoc[];
+}
+
+export interface FileDoc {
+  title: string;
+  fileKind: FileKind;
+  summary: string;
+  sourcePath: string;
+  relativePath: string;
+  outputPath: string;
+  exports: ExportDoc[];
+  resource?: ResourceDoc;
+  operation?: OperationDoc;
+  index?: IndexDoc;
+  provider?: ProviderDoc;
+  examples: ExampleSection[];
+  autoExample?: ExampleDoc;
+  relatedLinks: LinkDoc[];
+  directoryCatalog: DirectoryCatalog;
+}
+
+export const lifecycleOperationOrder = [
+  "read",
+  "diff",
+  "preCreate",
+  "create",
+  "update",
+  "delete",
+  "stables",
+] as const;
diff --git a/.repos/alchemy-effect/scripts/generate-docs/utils.ts b/.repos/alchemy-effect/scripts/generate-docs/utils.ts
new file mode 100644
index 00000000000..84be053f706
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/generate-docs/utils.ts
@@ -0,0 +1,238 @@
+import * as path from "node:path";
+
+import { Node, type JSDoc } from "ts-morph";
+
+import type {
+  ExampleDoc,
+  ExampleSection,
+  JSDocInfo,
+  PropertyDoc,
+} from "./types.ts";
+
+export const repoRoot = path.resolve(import.meta.dir, "../..");
+export const packageRoot = path.join(repoRoot, "alchemy");
+export const srcRoot = path.join(packageRoot, "src");
+export const docsRoot = path.join(packageRoot, "docs");
+export const tsConfigPath = path.join(packageRoot, "tsconfig.json");
+
+export function toPosix(filePath: string) {
+  return filePath.split(path.sep).join("/");
+}
+
+export function relativeSourcePath(filePath: string) {
+  return toPosix(path.relative(packageRoot, filePath));
+}
+
+export function titleFromRelativePath(relativePath: string) {
+  const baseName = path.basename(relativePath, ".ts");
+  if (baseName !== "index") {
+    return baseName;
+  }
+  const directory = path.dirname(relativePath);
+  return directory === "." ? "API Reference" : path.basename(directory);
+}
+
+export function labelFromDocRelativePath(relativePath: string) {
+  return titleFromRelativePath(relativePath);
+}
+
+export function lowerPathKey(relativePath: string) {
+  return toPosix(relativePath).toLowerCase();
+}
+
+export function canonicalScore(relativePath: string) {
+  const baseName = path.basename(relativePath);
+  const uppercaseCount = [...relativePath].filter(
+    (char) => char >= "A" && char <= "Z",
+  ).length;
+  return (
+    (baseName === "index.ts" ? 1000 : 0) +
+    (/^[A-Z]/.test(baseName) ? 100 : 0) +
+    uppercaseCount * 5 +
+    (relativePath === relativePath.toLowerCase() ? -20 : 0)
+  );
+}
+
+export function escapeMarkdown(value: string) {
+  return value.replace(/\|/g, "\\|");
+}
+
+export function normalizeWhitespace(value: string) {
+  return value.replace(/\s+/g, " ").trim();
+}
+
+export function formatTypeText(value: string | undefined) {
+  return value
+    ? value
+        .replace(/\/\*\*[\s\S]*?\*\//g, " ")
+        .replace(/\/\*[\s\S]*?\*\//g, " ")
+        .replace(/\/\/.*$/gm, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+    : "unknown";
+}
+
+export function truncateInline(value: string, maxLength = 120) {
+  const normalized = formatTypeText(value);
+  return normalized.length <= maxLength
+    ? normalized
+    : `${normalized.slice(0, maxLength - 3)}...`;
+}
+
+export function lowerCamel(name: string) {
+  return name.charAt(0).toLowerCase() + name.slice(1);
+}
+
+export function docOutputPath(relativePath: string) {
+  return path.join(docsRoot, relativePath.replace(/\.ts$/, ".md"));
+}
+
+export function relativeDocLink(fromDocPath: string, toDocPath: string) {
+  return toPosix(path.relative(path.dirname(fromDocPath), toDocPath));
+}
+
+/**
+ * Convert JSDoc `{@link url | label}` into standard markdown links.
+ * Absolute `https://alchemy.run/...` URLs are rewritten to relative
+ * paths so the links work in any deployment (localhost, preview, prod).
+ */
+function resolveJSDocLinks(text: string): string {
+  return text.replace(
+    /\{@link\s+(https?:\/\/alchemy\.run(\/[^\s|}]*))\s*\|\s*([^}]+)\}/g,
+    (_match, _url, pathname, label) => `[${label.trim()}](${pathname})`,
+  );
+}
+
+export function cleanDocComment(raw: string) {
+  const cleaned = raw
+    .replace(/^\/\*\*?/, "")
+    .replace(/\*\/$/, "")
+    .split("\n")
+    .map((line) => line.replace(/^\s*\*\s?/, ""))
+    .join("\n");
+  return resolveJSDocLinks(cleaned);
+}
+
+function getJsDocBlocks(node: Node) {
+  const getter = (node as Node & { getJsDocs?: () => JSDoc[] }).getJsDocs;
+  return getter ? getter.call(node) : [];
+}
+
+export function getJSDocInfo(node: Node): JSDocInfo {
+  const docs = getJsDocBlocks(node);
+  if (docs.length === 0) {
+    return { sections: [] };
+  }
+
+  const clean = cleanDocComment(docs.map((doc) => doc.getText()).join("\n"));
+  const lines = clean.split("\n");
+  const summaryLines: string[] = [];
+  const sections: ExampleSection[] = [];
+
+  let defaultValue: string | undefined;
+  let sawTag = false;
+  let currentSection: ExampleSection | undefined;
+  let currentExample: ExampleDoc | undefined;
+
+  const ensureSection = (title: string) => {
+    const section = { title, examples: [] };
+    sections.push(section);
+    currentSection = section;
+    return section;
+  };
+
+  const flushExample = () => {
+    if (!currentExample) {
+      return;
+    }
+    currentExample.body = currentExample.body.trim();
+    if (!currentSection) {
+      currentSection = ensureSection("Examples");
+    }
+    currentSection.examples.push(currentExample);
+    currentExample = undefined;
+  };
+
+  for (const line of lines) {
+    const tag = line.trimEnd().match(/^@(\w+)\s*(.*)$/);
+    if (tag) {
+      sawTag = true;
+      const [, name, rest] = tag;
+      const value = rest.trim();
+      switch (name) {
+        case "default":
+          defaultValue = value || undefined;
+          break;
+        case "section":
+          flushExample();
+          ensureSection(value || "Examples");
+          break;
+        case "example":
+          flushExample();
+          currentExample = {
+            title: value || "Example",
+            body: "",
+          };
+          break;
+      }
+      continue;
+    }
+
+    if (!sawTag) {
+      summaryLines.push(line);
+      continue;
+    }
+
+    if (currentExample) {
+      currentExample.body += `${line}\n`;
+    }
+  }
+
+  flushExample();
+
+  const summary = normalizeWhitespace(
+    summaryLines.join("\n").replace(/```[\s\S]*?```/g, ""),
+  );
+
+  return {
+    summary: summary || undefined,
+    defaultValue,
+    sections,
+  };
+}
+
+export function getSummary(node: Node) {
+  return getJSDocInfo(node).summary;
+}
+
+export function getDefaultValue(node: Node) {
+  return getJSDocInfo(node).defaultValue;
+}
+
+export function guessExampleValue(property: PropertyDoc) {
+  const type = property.type;
+
+  const literal = type.match(/"([^"]+)"|'([^']+)'/);
+  if (literal) {
+    return JSON.stringify(literal[1] ?? literal[2]);
+  }
+  if (/ScalarAttributeType/.test(type)) {
+    return `{ pk: "S" }`;
+  }
+  if (/Record</.test(type)) {
+    return "{}";
+  }
+  if (/\[\]$/.test(type) || /Array</.test(type)) {
+    return "[]";
+  }
+  if (/boolean/i.test(type)) {
+    return "true";
+  }
+  if (/number/i.test(type)) {
+    return "1";
+  }
+  if (/string/i.test(type) || /Name|Arn|Id|Url|Key|Path/.test(type)) {
+    return JSON.stringify(property.name);
+  }
+  return "undefined as any";
+}
diff --git a/.repos/alchemy-effect/scripts/install b/.repos/alchemy-effect/scripts/install
new file mode 100755
index 00000000000..d664a42e65a
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/install
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Load secrets from ./.env if the file exists
+if [[ -f .env ]]; then
+  set -o allexport
+  source .env
+  set +o allexport
+fi
+
+# Installs system dependencies required for this project
+
+UPDATE=0
+for arg in "$@"; do
+  if [[ "$arg" == "--update" ]]; then
+    UPDATE=1
+  fi
+done
+
+# Install or update OpenCode (AI-powered development)
+if ! command -v opencode >/dev/null 2>&1 || [[ "$UPDATE" -eq 1 ]]; then
+  curl -fsSL https://opencode.ai/install | bash
+fi
+
+install_brew() {
+  # $1: executable name
+  # $2: brew install argument
+  local exe="$1"
+  local formula="$2"
+  if ! command -v "$exe" >/dev/null 2>&1; then
+    brew install "$formula"
+  elif [[ "$UPDATE" -eq 1 ]]; then
+    brew upgrade "$formula"
+  fi
+}
+
+install_brew rg ripgrep
+install_brew localstack localstack/tap/localstack-cli
+localstack auth set-token $LOCALSTACK_TOKEN 2>&1 > /dev/null
\ No newline at end of file
diff --git a/.repos/alchemy-effect/scripts/nuke-aws.sh b/.repos/alchemy-effect/scripts/nuke-aws.sh
new file mode 100755
index 00000000000..1937d0a2f13
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/nuke-aws.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if ! command -v aws-nuke &>/dev/null; then
+  echo "aws-nuke is not installed."
+  echo "Install with: brew install ekristen/tap/aws-nuke"
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CONFIG="$SCRIPT_DIR/../aws-nuke-config.yml"
+
+if grep -q '123456789012' "$CONFIG"; then
+  echo "ERROR: You must replace the placeholder account ID in aws-nuke-config.yml"
+  echo "Find your account ID with: aws sts get-caller-identity --query Account --output text"
+  exit 1
+fi
+
+EXTRA_ARGS=("$@")
+
+aws-nuke run \
+  --config "$CONFIG" \
+  --no-alias-check \
+  "${EXTRA_ARGS[@]}"
diff --git a/.repos/alchemy-effect/scripts/pnpm-workspace.ts b/.repos/alchemy-effect/scripts/pnpm-workspace.ts
new file mode 100644
index 00000000000..f11c2f55f97
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/pnpm-workspace.ts
@@ -0,0 +1,108 @@
+#!/usr/bin/env bun
+/**
+ * Generate `pnpm-workspace.yaml` mirroring bun's `package.json#workspaces.*`
+ * fields so pnpm can resolve `catalog:` and `workspace:*` refs in this repo.
+ *
+ * `bun deploy:smoke` (and the GitHub Actions matrix `runtime: pnpm` job)
+ * call this script before `pnpm install` so pnpm has a coherent view of the
+ * workspace. The file is `.gitignore`d — never check it in.
+ *
+ * Usage:
+ *   bun ./scripts/pnpm-workspace.ts          # write
+ *   bun ./scripts/pnpm-workspace.ts --remove # delete
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
+const ROOT = path.resolve(import.meta.dir, "..");
+const PNPM_WORKSPACE_PATH = path.join(ROOT, "pnpm-workspace.yaml");
+
+if (process.argv.includes("--remove")) {
+  await fs.rm(PNPM_WORKSPACE_PATH, { force: true });
+  console.log(`removed ${path.relative(ROOT, PNPM_WORKSPACE_PATH)}`);
+  process.exit(0);
+}
+
+const pkg = JSON.parse(
+  await fs.readFile(path.join(ROOT, "package.json"), "utf8"),
+) as {
+  workspaces?: {
+    packages?: string[];
+    catalog?: Record<string, string>;
+  };
+};
+const packages = pkg.workspaces?.packages ?? [];
+const catalog = pkg.workspaces?.catalog ?? {};
+
+// Bun's `catalog:` ranges are loose (`>=4.0.0-beta.60 || >=4.0.0`) and
+// rely on `bun.lock` to pin the resolved version. pnpm without a lockfile
+// re-resolves each `catalog:` ref to the freshest matching version, which
+// lets sibling packages drift onto different `effect@4.0.0-beta.6{2,4}`
+// builds and produces "Effect<...beta.62> not assignable to Effect<...beta.64>"
+// type errors in CI. Mirror bun's resolved versions into the pnpm catalog
+// so both runtimes see identical trees.
+const bunLockText = await fs
+  .readFile(path.join(ROOT, "bun.lock"), "utf8")
+  .catch(() => "");
+const resolveFromBunLock = (name: string): string | undefined => {
+  // Each top-level package entry in bun.lock looks like:
+  //   "<name>": ["<name>@<version>", ...]
+  // (bun.lock is JSONC with trailing commas, so we regex it.)
+  const escaped = name.replace(/[/@.+*?(){}[\]^$|\\-]/g, "\\$&");
+  const re = new RegExp(`"${escaped}":\\s*\\["${escaped}@([^"]+)"`);
+  return bunLockText.match(re)?.[1];
+};
+const pinnedCatalog: Record<string, string> = {};
+for (const [name, range] of Object.entries(catalog)) {
+  // Non-semver catalog values (URLs, file: paths, workspace:* entries from
+  // bun.lock for monorepo packages) must pass through unchanged — pnpm
+  // rejects e.g. `alchemy: workspace:packages/alchemy` in a catalog
+  // (ERR_PNPM_CATALOG_ENTRY_INVALID_WORKSPACE_SPEC).
+  if (/^(https?:|file:|git\+|workspace:|npm:)/.test(range)) {
+    pinnedCatalog[name] = range;
+    continue;
+  }
+  const pinned = resolveFromBunLock(name);
+  pinnedCatalog[name] =
+    pinned && !/^(workspace:|file:|link:)/.test(pinned) ? pinned : range;
+}
+
+const lines: string[] = [
+  "# Auto-generated by scripts/pnpm-workspace.ts — DO NOT COMMIT.",
+  "# Mirrors `package.json#workspaces.{packages,catalog}` so pnpm can",
+  "# resolve `catalog:` deps in our examples (bun keeps catalogs in",
+  "# `package.json#workspaces.catalog`; pnpm only reads them from this",
+  "# file).",
+  "",
+  // pnpm 11 fails the install with `ERR_PNPM_IGNORED_BUILDS` whenever
+  // a transitive dep has a postinstall script that hasn't been
+  // explicitly approved. Whitelist only the ones our examples actually
+  // need to build (workerd binary download, esbuild's optional native
+  // binaries, sharp's libvips, etc.).
+  //
+  // pnpm 11 renamed `onlyBuiltDependencies` (list) → `allowBuilds`
+  // (dict). Emit both so the file works on pnpm 10 and pnpm 11; pnpm
+  // silently ignores unknown keys.
+  "onlyBuiltDependencies:",
+  ...["@parcel/watcher", "esbuild", "msgpackr-extract", "sharp", "workerd"].map(
+    (name) => `  - ${JSON.stringify(name)}`,
+  ),
+  "",
+  "allowBuilds:",
+  ...["@parcel/watcher", "esbuild", "msgpackr-extract", "sharp", "workerd"].map(
+    (name) => `  ${JSON.stringify(name)}: true`,
+  ),
+  "",
+  "packages:",
+  ...packages.map((p) => `  - ${JSON.stringify(p)}`),
+];
+if (Object.keys(pinnedCatalog).length > 0) {
+  lines.push("", "catalog:");
+  for (const [name, range] of Object.entries(pinnedCatalog)) {
+    lines.push(`  ${JSON.stringify(name)}: ${JSON.stringify(range)}`);
+  }
+}
+lines.push("");
+
+await fs.writeFile(PNPM_WORKSPACE_PATH, lines.join("\n"));
+console.log(`wrote ${path.relative(ROOT, PNPM_WORKSPACE_PATH)}`);
diff --git a/.repos/alchemy-effect/scripts/release/bump.ts b/.repos/alchemy-effect/scripts/release/bump.ts
new file mode 100644
index 00000000000..3a31e49efac
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/bump.ts
@@ -0,0 +1,290 @@
+#!/usr/bin/env bun
+/**
+ * Compute and apply a version bump across all publishable workspace packages.
+ *
+ * Writes: packages/{alchemy,better-auth,pr-package}/package.json
+ * and (via `bun install`) bun.lock.
+ *
+ * Prints the chosen version to stdout. All progress messages go to stderr,
+ * so callers can capture the version with
+ *     VERSION=$(bun scripts/release/bump.ts ...)
+ *
+ * Does NOT commit or push. The release workflow commits only after every
+ * package has been published to npm, so an interrupted publish leaves no
+ * orphan commit behind.
+ *
+ * Channels:
+ *   release <patch|minor|major|x.y.z>
+ *     Stable release. Bumps the named semver part relative to the current
+ *     max stable version on npm, or uses the explicit version as-is.
+ *
+ *   beta [N] / alpha [N]
+ *     Auto-incrementing pre-release. With no spec, queries npm for the
+ *     max 2.0.0-{channel}.N across every publishable package and increments.
+ *     Pass N explicitly to force 2.0.0-{channel}.<N>.
+ *
+ *     Resume behavior: if a prior release published some packages but not
+ *     others, or published everything but the git tag is missing on the
+ *     remote, we resume at that N instead of incrementing past it.
+ *
+ *   tag <version>
+ *     Use <version> verbatim. Intended for ad-hoc channels like
+ *     `tag 2.0.0-experimental.1` — publish-package.ts derives a custom
+ *     npm dist-tag from the prerelease suffix.
+ *
+ * Examples:
+ *   bun scripts/release/bump.ts release patch
+ *   bun scripts/release/bump.ts release 2.1.0
+ *   bun scripts/release/bump.ts beta
+ *   bun scripts/release/bump.ts beta 15
+ *   bun scripts/release/bump.ts alpha
+ *   bun scripts/release/bump.ts tag 2.0.0-experimental.1
+ */
+import { $ } from "bun";
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+const PUBLISHABLE_DIRS = ["alchemy", "better-auth", "pr-package"] as const;
+
+const PUBLISHABLE_NAMES = [
+  "alchemy",
+  "@alchemy.run/better-auth",
+  "@alchemy.run/pr-package",
+] as const;
+
+// Pre-release versions the beta/alpha auto-increment considers when deciding
+// whether to resume. Keeps the line `2.0.0-...` since that is the series
+// currently being released; change here when the stable line advances.
+const CURRENT_MAJOR_MINOR_PATCH = "2.0.0";
+
+type Channel = "release" | "beta" | "alpha" | "tag";
+
+const CHANNELS: readonly Channel[] = ["release", "beta", "alpha", "tag"];
+
+function usage(): never {
+  console.error(
+    "Usage:\n" +
+      "  bun scripts/release/bump.ts release <patch|minor|major|x.y.z>\n" +
+      "  bun scripts/release/bump.ts beta [N]\n" +
+      "  bun scripts/release/bump.ts alpha [N]\n" +
+      "  bun scripts/release/bump.ts tag <version>",
+  );
+  process.exit(1);
+}
+
+async function fetchNpmVersions(pkg: string): Promise<string[]> {
+  try {
+    const r = await fetch(`https://registry.npmjs.org/${pkg}`);
+    if (!r.ok) return [];
+    const data = (await r.json()) as { versions?: Record<string, unknown> };
+    return Object.keys(data.versions ?? {});
+  } catch {
+    return [];
+  }
+}
+
+function maxPrereleaseN(
+  versions: readonly string[],
+  channel: "beta" | "alpha",
+): number {
+  const re = new RegExp(`^${CURRENT_MAJOR_MINOR_PATCH}-${channel}\\.(\\d+)$`);
+  const ns = versions
+    .map((v) => {
+      const m = v.match(re);
+      return m ? parseInt(m[1]!, 10) : 0;
+    })
+    .filter((n) => n > 0);
+  return ns.length > 0 ? Math.max(...ns) : 0;
+}
+
+function maxStable(versions: readonly string[]): string | null {
+  const stables = versions.filter((v) => /^\d+\.\d+\.\d+$/.test(v));
+  if (stables.length === 0) return null;
+  return stables.sort(compareSemver)[stables.length - 1]!;
+}
+
+function compareSemver(a: string, b: string): number {
+  const pa = a.split(".").map((n) => parseInt(n, 10));
+  const pb = b.split(".").map((n) => parseInt(n, 10));
+  for (let i = 0; i < 3; i++) {
+    if (pa[i]! !== pb[i]!) return pa[i]! - pb[i]!;
+  }
+  return 0;
+}
+
+async function getHeadTagVersion(): Promise<string | null> {
+  const r = await $`git describe --exact-match --tags HEAD`.nothrow().quiet();
+  if (r.exitCode !== 0) return null;
+  const tag = r.stdout.toString().trim();
+  if (!/^v\d+\.\d+\.\d+(-[\w.-]+)?$/.test(tag)) return null;
+  return tag.slice(1);
+}
+
+async function remoteTagExists(tag: string): Promise<boolean> {
+  const r =
+    await $`git ls-remote --exit-code --tags origin ${`refs/tags/${tag}`}`
+      .nothrow()
+      .quiet();
+  return r.exitCode === 0;
+}
+
+async function resolveRelease(spec: string | undefined): Promise<string> {
+  if (!spec) {
+    console.error("release channel requires a spec: patch|minor|major|<x.y.z>");
+    process.exit(1);
+  }
+  if (/^\d+\.\d+\.\d+$/.test(spec)) {
+    console.error(`Explicit release version: ${spec}`);
+    return spec;
+  }
+  if (spec !== "patch" && spec !== "minor" && spec !== "major") {
+    console.error(
+      `Invalid release spec: ${spec}. Use patch|minor|major|<x.y.z>.`,
+    );
+    process.exit(1);
+  }
+  const versions = await fetchNpmVersions("alchemy");
+  const current = maxStable(versions);
+  if (!current) {
+    console.error(
+      "No stable `alchemy` versions on npm; cannot bump relative to current.",
+    );
+    process.exit(1);
+  }
+  const [maj, min, pat] = current.split(".").map((n) => parseInt(n, 10)) as [
+    number,
+    number,
+    number,
+  ];
+  const bumped =
+    spec === "major"
+      ? `${maj + 1}.0.0`
+      : spec === "minor"
+        ? `${maj}.${min + 1}.0`
+        : `${maj}.${min}.${pat + 1}`;
+  console.error(`Bumping ${spec}: ${current} → ${bumped}`);
+  return bumped;
+}
+
+async function resolvePrerelease(
+  channel: "beta" | "alpha",
+  spec: string | undefined,
+): Promise<string> {
+  if (spec !== undefined) {
+    if (!/^\d+$/.test(spec)) {
+      console.error(
+        `${channel} channel spec must be an integer N (got: ${spec})`,
+      );
+      process.exit(1);
+    }
+    const explicit = `${CURRENT_MAJOR_MINOR_PATCH}-${channel}.${spec}`;
+    console.error(`Explicit ${channel} version: ${explicit}`);
+    return explicit;
+  }
+
+  console.error(`Resolving next ${channel} version from npm state...`);
+  const perPkgMax = await Promise.all(
+    PUBLISHABLE_NAMES.map(async (name) => {
+      const versions = await fetchNpmVersions(name);
+      return maxPrereleaseN(versions, channel);
+    }),
+  );
+  const maxN = Math.max(0, ...perPkgMax);
+  const allAtMax = maxN > 0 && perPkgMax.every((n) => n === maxN);
+
+  let nextN: number;
+  if (maxN === 0) {
+    nextN = 1;
+    console.error(
+      `No ${channel} versions on npm yet; starting at ${channel}.${nextN}`,
+    );
+  } else if (!allAtMax) {
+    nextN = maxN;
+    console.error(
+      `Partial publish at ${channel}.${maxN} (per-package: ${JSON.stringify(
+        Object.fromEntries(PUBLISHABLE_NAMES.map((n, i) => [n, perPkgMax[i]])),
+      )}). Resuming at ${channel}.${nextN}.`,
+    );
+  } else if (
+    !(await remoteTagExists(`v${CURRENT_MAJOR_MINOR_PATCH}-${channel}.${maxN}`))
+  ) {
+    nextN = maxN;
+    console.error(
+      `All packages at ${channel}.${maxN} on npm but tag v${CURRENT_MAJOR_MINOR_PATCH}-${channel}.${maxN} missing on remote. Resuming at ${channel}.${nextN}.`,
+    );
+  } else {
+    nextN = maxN + 1;
+    console.error(
+      `Bumping to next ${channel}: ${CURRENT_MAJOR_MINOR_PATCH}-${channel}.${nextN}`,
+    );
+  }
+  return `${CURRENT_MAJOR_MINOR_PATCH}-${channel}.${nextN}`;
+}
+
+function resolveTag(spec: string | undefined): string {
+  // The tag channel is the explicit-version escape hatch. Whatever the
+  // caller passes is used verbatim — this is the equivalent of the old
+  // `version-override` input. We enforce an x.y.z-<suffix> shape (no plain
+  // stable versions) because `tag` releases are always pre-releases; use
+  // the `release` channel for stable x.y.z versions.
+  if (!spec) {
+    console.error(
+      "tag channel requires an explicit version (e.g. 2.0.0-experimental.1)",
+    );
+    process.exit(1);
+  }
+  if (!/^\d+\.\d+\.\d+-[\w.-]+$/.test(spec)) {
+    console.error(
+      `tag channel version must be x.y.z-<suffix> (always a pre-release); got: ${spec}`,
+    );
+    process.exit(1);
+  }
+  console.error(`Using tag version: ${spec}`);
+  return spec;
+}
+
+const channel = process.argv[2] as Channel | undefined;
+const spec = process.argv[3];
+
+if (!channel || !CHANNELS.includes(channel)) {
+  usage();
+}
+
+let newVersion: string;
+
+// Durability: if HEAD is already an exact release tag (commit-then-publish
+// flow committed and tagged on a previous attempt that failed before npm
+// publish completed), reuse that version instead of computing a new one.
+// Skipped for `tag` channel, where the explicit spec is authoritative.
+const headTagVersion = channel !== "tag" ? await getHeadTagVersion() : null;
+if (headTagVersion) {
+  console.error(
+    `HEAD is already tagged v${headTagVersion}; resuming with this version.`,
+  );
+  newVersion = headTagVersion;
+} else {
+  switch (channel) {
+    case "release":
+      newVersion = await resolveRelease(spec);
+      break;
+    case "beta":
+    case "alpha":
+      newVersion = await resolvePrerelease(channel, spec);
+      break;
+    case "tag":
+      newVersion = resolveTag(spec);
+      break;
+  }
+}
+
+for (const dir of PUBLISHABLE_DIRS) {
+  const pkgPath = join(process.cwd(), "packages", dir, "package.json");
+  const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
+  pkg.version = newVersion;
+  await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+}
+
+console.error("Running bun install to refresh bun.lock workspace versions...");
+await $`bun install`.quiet();
+
+console.log(newVersion);
diff --git a/.repos/alchemy-effect/scripts/release/discord-body.test.ts b/.repos/alchemy-effect/scripts/release/discord-body.test.ts
new file mode 100644
index 00000000000..b5f7025bb0b
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/discord-body.test.ts
@@ -0,0 +1,231 @@
+import { describe, expect, test } from "bun:test";
+import type { Commit } from "changelogithub";
+import { extractTagBody, toDiscordBody } from "./discord-body.ts";
+import { renderMarkdown, type RenderConfig } from "./render.ts";
+
+const baseConfig: RenderConfig = {
+  titles: { breakingChanges: "🚨 Breaking Changes" },
+  types: {
+    feat: { title: "🚀 Features" },
+    fix: { title: "🐞 Bug Fixes" },
+    perf: { title: "🏎 Performance" },
+  } as RenderConfig["types"],
+  capitalize: true,
+  emoji: true,
+  baseUrl: "github.com",
+  repo: "alchemy-run/alchemy-effect",
+  from: "v1",
+  to: "v2",
+};
+
+function makeCommit(input: {
+  type: string;
+  scope?: string;
+  description: string;
+  hash?: string;
+  pr?: string;
+  authors?: Array<{ login?: string; name: string }>;
+  isBreaking?: boolean;
+}): Commit {
+  const references: Commit["references"] = [];
+  if (input.hash) references.push({ type: "hash", value: input.hash });
+  if (input.pr) references.push({ type: "pull-request", value: input.pr });
+  return {
+    message: `${input.type}${input.scope ? `(${input.scope})` : ""}: ${input.description}`,
+    body: "",
+    shortHash: (input.hash ?? "").slice(0, 7),
+    author: { name: "t", email: "t@t" },
+    authors: [],
+    description: input.description,
+    type: input.type,
+    scope: input.scope ?? "",
+    references,
+    isBreaking: input.isBreaking ?? false,
+    resolvedAuthors: input.authors,
+  } as Commit;
+}
+
+describe("toDiscordBody", () => {
+  test("replaces every &nbsp; with a plain space", () => {
+    const input =
+      "### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes\n- foo &nbsp;-&nbsp; by @bar";
+    const out = toDiscordBody(input);
+    expect(out).not.toContain("&nbsp;");
+    // The heading regex further collapses the leading whitespace run.
+    expect(out).toContain("### 🐞 Bug Fixes");
+    // Inline `&nbsp;-&nbsp;` separators become ` - ` (with surrounding spaces).
+    expect(out).toContain("- foo  -  by @bar");
+  });
+
+  test("converts <samp>...</samp> to backticks", () => {
+    const input =
+      "- foo [<samp>(abcde)</samp>](https://example.com/commit/abcdef1)";
+    expect(toDiscordBody(input)).toContain("[`(abcde)`](https://example.com");
+    expect(toDiscordBody(input)).not.toMatch(/<\/?samp>/);
+  });
+
+  test("collapses indented ### headings to `### ` so Discord renders them", () => {
+    const input = "###    🐞 Bug Fixes";
+    expect(toDiscordBody(input)).toBe("### 🐞 Bug Fixes");
+  });
+
+  test("strips #### / ##### / ###### heading markers entirely", () => {
+    const input =
+      "##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://example.com)";
+    const out = toDiscordBody(input);
+    expect(out.startsWith("[View changes on GitHub]")).toBe(true);
+    expect(out).not.toMatch(/^#{4,6}/m);
+  });
+
+  test("preserves # / ## / ### headings (Discord renders these)", () => {
+    const input = "# Title\n## Subtitle\n### Section";
+    expect(toDiscordBody(input)).toBe("# Title\n## Subtitle\n### Section");
+  });
+
+  test("strips stray HTML tags other than <samp>", () => {
+    expect(toDiscordBody("<b>bold</b> and <i>italic</i>")).toBe(
+      "bold and italic",
+    );
+    expect(toDiscordBody('<a href="x">link</a>')).toBe("link");
+  });
+
+  test("leaves plain markdown untouched", () => {
+    const input = "- **scope**: description [link](https://example.com)";
+    expect(toDiscordBody(input)).toBe(input);
+  });
+
+  test("is idempotent", () => {
+    const input =
+      "### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes\n- foo &nbsp;-&nbsp; [<samp>(abc)</samp>](https://x/)\n##### [View](https://y/)";
+    const once = toDiscordBody(input);
+    expect(toDiscordBody(once)).toBe(once);
+  });
+});
+
+describe("extractTagBody", () => {
+  const changelog = `## v1.2.0
+
+### &nbsp;&nbsp;&nbsp;🚀 Features
+
+- Shiny new thing
+
+##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://x/)
+
+---
+
+## v1.1.0
+
+### &nbsp;&nbsp;&nbsp;🐞 Bug Fixes
+
+- Old fix
+
+---
+`;
+
+  test("extracts the entry body for the given tag", () => {
+    const body = extractTagBody(changelog, "v1.2.0");
+    expect(body).toBeDefined();
+    expect(body).toContain("Shiny new thing");
+    expect(body).not.toContain("v1.1.0");
+    expect(body).not.toContain("Old fix");
+  });
+
+  test("returns undefined for an unknown tag", () => {
+    expect(extractTagBody(changelog, "v9.9.9")).toBeUndefined();
+  });
+
+  test("falls back to next `## ` heading when no `---` separator exists", () => {
+    const noSep = `## v1.2.0\n\nBody line\n\n## v1.1.0\n\nOther\n`;
+    expect(extractTagBody(noSep, "v1.2.0")).toBe("Body line");
+  });
+
+  test("reads to end of file for the last entry", () => {
+    const single = `## v1.2.0\n\nOnly body\n`;
+    expect(extractTagBody(single, "v1.2.0")).toBe("Only body");
+  });
+});
+
+describe("toDiscordBody(renderMarkdown(...))", () => {
+  // End-to-end coverage: whatever `render.ts` emits today must survive the
+  // `discord-notify.ts` cleanup pipeline without leaking HTML entities, raw
+  // `<samp>` tags, or `####+` heading markers into Discord.
+  const commits = [
+    makeCommit({
+      type: "feat",
+      scope: "aws/lambda",
+      description: "scope public url invokes",
+      hash: "abcdef1234",
+      pr: "#42",
+      authors: [{ login: "sam", name: "Sam" }],
+    }),
+    makeCommit({
+      type: "fix",
+      scope: "aws/s3",
+      description: "handle presigned URLs",
+      hash: "1111111111",
+    }),
+    makeCommit({
+      type: "fix",
+      scope: "aws",
+      description: "top-level aws fix",
+      hash: "2222222222",
+    }),
+    makeCommit({
+      type: "fix",
+      scope: "Cloudflare",
+      description: "apply cloudflare access",
+      hash: "3333333333",
+      pr: "#160",
+    }),
+  ];
+
+  const md = renderMarkdown(commits, baseConfig);
+  const discord = toDiscordBody(md);
+
+  test("rendered markdown contains the intentional GitHub-flavored markup", () => {
+    // These MUST be present in CHANGELOG.md for GitHub Releases to render
+    // nicely. If someone removes them from render.ts this assertion will
+    // fail and force an intentional decision.
+    expect(md).toContain("&nbsp;");
+    expect(md).toContain("<samp>");
+    expect(md).toContain(
+      "##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub]",
+    );
+  });
+
+  test("discord output has no HTML entities", () => {
+    expect(discord).not.toContain("&nbsp;");
+    expect(discord).not.toMatch(/&[a-z]+;/i);
+  });
+
+  test("discord output has no raw HTML tags", () => {
+    expect(discord).not.toMatch(/<\/?samp>/);
+    expect(discord).not.toMatch(/<[a-z][^>]*>/i);
+  });
+
+  test("discord output has no #### / ##### / ###### heading markers", () => {
+    const deepHeading = discord
+      .split("\n")
+      .find((line) => /^#{4,6}\s/.test(line));
+    expect(deepHeading).toBeUndefined();
+  });
+
+  test("discord output preserves the nested scope structure", () => {
+    expect(discord).toContain("- **aws**:");
+    expect(discord).toContain("  - **lambda**: Scope public url invokes");
+    expect(discord).toContain("  - **s3**: Handle presigned URLs");
+    expect(discord).toContain("  - Top-level aws fix");
+  });
+
+  test("discord output preserves commit hash links as backtick-wrapped text", () => {
+    expect(discord).toMatch(
+      /\[`\(abcde\)`\]\(https:\/\/github\.com\/alchemy-run\/alchemy-effect\/commit\/abcdef1234\)/,
+    );
+  });
+
+  test("discord output preserves the `[View changes on GitHub]` link as plain text", () => {
+    expect(discord).toContain(
+      "[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v1...v2)",
+    );
+  });
+});
diff --git a/.repos/alchemy-effect/scripts/release/discord-body.ts b/.repos/alchemy-effect/scripts/release/discord-body.ts
new file mode 100644
index 00000000000..d8f61be2980
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/discord-body.ts
@@ -0,0 +1,56 @@
+/**
+ * Transform a CHANGELOG.md entry body (written for GitHub Releases, which
+ * render HTML) into text suitable for a Discord embed description.
+ *
+ * Discord renders neither HTML entities nor the `<samp>` tag, and only
+ * honors `#`, `##`, and `###` headings. The CHANGELOG entries produced by
+ * `render.ts` / `changelogithub` use:
+ *
+ *   - `&nbsp;` sequences to visually indent `###`/`#####` headings and
+ *     author/PR separators (`&nbsp;-&nbsp;`)
+ *   - `<samp>(hash)</samp>` to render commit-hash links in small caps
+ *   - A trailing `#####` "View changes on GitHub" line
+ *
+ * This converts those into plain-text / markdown equivalents.
+ */
+export function toDiscordBody(rawBody: string): string {
+  return (
+    rawBody
+      .replace(/&nbsp;/g, " ")
+      .replace(/<\/?samp>/g, "`")
+      // Collapse the long indent that the GitHub-flavored headings use.
+      .replace(/^(#{1,6})\s+/gm, "$1 ")
+      // Discord only renders #, ##, ### as headings; drop deeper levels so
+      // lines like "##### View changes on GitHub" become plain text.
+      .replace(/^#{4,6}\s+/gm, "")
+      // Strip any other stray HTML tags just in case.
+      .replace(/<\/?[a-z][^>]*>/gi, "")
+  );
+}
+
+/**
+ * Extract the body for a single `## <tag>` entry out of a CHANGELOG.md
+ * string. Stops at the `---` separator that `release-notes.ts` inserts
+ * between entries, or at the next `## ` heading if the separator is
+ * missing. Returns `undefined` if the tag isn't present.
+ */
+export function extractTagBody(
+  changelog: string,
+  tag: string,
+): string | undefined {
+  const heading = `## ${tag}\n`;
+  const start = changelog.indexOf(heading);
+  if (start === -1) return undefined;
+  const after = changelog.slice(start + heading.length);
+  const sepIdx = after.indexOf("\n---\n");
+  const nextHeadingIdx = after.indexOf("\n## ");
+  const end =
+    sepIdx === -1
+      ? nextHeadingIdx === -1
+        ? after.length
+        : nextHeadingIdx
+      : nextHeadingIdx === -1
+        ? sepIdx
+        : Math.min(sepIdx, nextHeadingIdx);
+  return after.slice(0, end).trim();
+}
diff --git a/.repos/alchemy-effect/scripts/release/discord-notify.ts b/.repos/alchemy-effect/scripts/release/discord-notify.ts
new file mode 100644
index 00000000000..c64180dbc1b
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/discord-notify.ts
@@ -0,0 +1,71 @@
+#!/usr/bin/env bun
+/**
+ * Post a release announcement to Discord as a single embed. The body is
+ * read verbatim from the CHANGELOG.md entry the release-notes step just
+ * wrote, so Discord matches the GitHub Release copy exactly.
+ *
+ * Reads DISCORD_WEBHOOK from the environment. Silently no-ops if unset.
+ *
+ * Usage: bun scripts/release/discord-notify.ts <tag> <release|beta|alpha|tag>
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { extractTagBody, toDiscordBody } from "./discord-body.ts";
+
+const REPO = "alchemy-run/alchemy-effect";
+// Discord embed description hard limit.
+const EMBED_DESCRIPTION_LIMIT = 4096;
+
+const tag = process.argv[2];
+const channel = process.argv[3];
+if (!tag || !channel) {
+  console.error("Usage: bun scripts/release/discord-notify.ts <tag> <channel>");
+  process.exit(1);
+}
+
+const webhook = process.env.DISCORD_WEBHOOK;
+if (!webhook) {
+  console.log("DISCORD_WEBHOOK not set, skipping Discord notification");
+  process.exit(0);
+}
+
+const changelogPath = join(process.cwd(), "CHANGELOG.md");
+const changelog = await readFile(changelogPath, "utf-8");
+const rawBody = extractTagBody(changelog, tag);
+if (rawBody === undefined) {
+  console.error(`CHANGELOG.md has no entry for ${tag}`);
+  process.exit(1);
+}
+
+const body = toDiscordBody(rawBody);
+
+const releaseUrl = `https://github.com/${REPO}/releases/tag/${tag}`;
+const description = `${body}\n\n[Full release notes →](${releaseUrl})`;
+
+if (description.length > EMBED_DESCRIPTION_LIMIT) {
+  console.error(
+    `Changelog (${description.length} chars) exceeds Discord embed description limit (${EMBED_DESCRIPTION_LIMIT}). Trim the changelog or split the release.`,
+  );
+  process.exit(1);
+}
+
+const res = await fetch(webhook, {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({
+    embeds: [
+      {
+        title: `${tag} (${channel}) released`,
+        url: releaseUrl,
+        description,
+      },
+    ],
+    allowed_mentions: { parse: [] },
+  }),
+});
+
+if (!res.ok) {
+  console.error(`Discord webhook failed: ${res.status} ${await res.text()}`);
+  process.exit(1);
+}
+console.log(`Posted Discord release notification for ${tag}`);
diff --git a/.repos/alchemy-effect/scripts/release/github-release.ts b/.repos/alchemy-effect/scripts/release/github-release.ts
new file mode 100644
index 00000000000..e4f586a5979
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/github-release.ts
@@ -0,0 +1,142 @@
+#!/usr/bin/env bun
+/**
+ * Create a GitHub release for a tag, with channel-aware prerelease/latest flags.
+ *
+ * GitHub's API does not allow a release to be both `prerelease=true` and
+ * `latest=true`. To show an alpha/beta as "Latest" when no stable release
+ * exists yet, we publish it with `prerelease=false` — a masquerade. This
+ * script compensates on the next release: if the currently-latest release
+ * has a pre-release-style tag and prerelease=false, we flip it back to
+ * `prerelease=true` before publishing the new one. That keeps the latest
+ * badge where the user wants it without leaving stale "stable" markers on
+ * alpha/beta tags.
+ *
+ * Channel → flags on the new release:
+ *   release        prerelease=false, latest=true
+ *   beta | alpha   if any true-stable release exists: prerelease=true, latest=false
+ *                  else:                              prerelease=false, latest=true (masquerade)
+ *   tag            prerelease=true, latest=false (always)
+ *
+ * Usage: bun scripts/release/github-release.ts <tag> <release|beta|alpha|tag>
+ */
+import { $ } from "bun";
+import { generate } from "changelogithub";
+
+type Channel = "release" | "beta" | "alpha" | "tag";
+const CHANNELS: readonly Channel[] = ["release", "beta", "alpha", "tag"];
+
+// A tag looks stable iff it's `v?X.Y.Z` with no prerelease suffix.
+// A "true stable" release is one with such a tag AND prerelease=false on GH;
+// a masquerading alpha/beta has prerelease=false but a non-stable-shaped tag.
+function isStableTag(tag: string): boolean {
+  return /^v?\d+\.\d+\.\d+$/.test(tag);
+}
+
+const tag = process.argv[2];
+const channel = process.argv[3] as Channel | undefined;
+if (!tag || !channel || !CHANNELS.includes(channel)) {
+  console.error(
+    "Usage: bun scripts/release/github-release.ts <tag> <release|beta|alpha|tag>",
+  );
+  process.exit(1);
+}
+
+const view = await $`gh release view ${tag}`.nothrow().quiet();
+if (view.exitCode === 0) {
+  console.log(`Release ${tag} already exists on GitHub, skipping`);
+  process.exit(0);
+}
+
+// Decide flags.
+let prerelease: boolean;
+let latest: boolean;
+if (channel === "release") {
+  prerelease = false;
+  latest = true;
+} else if (channel === "tag") {
+  prerelease = true;
+  latest = false;
+} else {
+  // alpha/beta — latest iff no true-stable release already exists.
+  const list = await $`gh release list --limit 500 --json tagName,isPrerelease`
+    .nothrow()
+    .quiet();
+  let hasStable = false;
+  if (list.exitCode === 0) {
+    const raw = list.stdout.toString().trim();
+    const releases = raw
+      ? (JSON.parse(raw) as Array<{ tagName: string; isPrerelease: boolean }>)
+      : [];
+    hasStable = releases.some((r) => isStableTag(r.tagName) && !r.isPrerelease);
+  }
+  if (hasStable) {
+    prerelease = true;
+    latest = false;
+  } else {
+    prerelease = false;
+    latest = true;
+    console.log(
+      "No true-stable release exists; publishing this prerelease with prerelease=false so it can be marked latest.",
+    );
+  }
+}
+
+// If we're about to become the new latest, correct the previous masquerade.
+// GH auto-removes the `latest` flag from the prior release when a new one
+// claims it — but it leaves prerelease=false in place, which is the lie we
+// need to undo. We must also pass --latest=false because GH's API rejects
+// prerelease=true + latest=true in one go.
+if (latest) {
+  const cur = await $`gh release view --latest --json tagName,isPrerelease`
+    .nothrow()
+    .quiet();
+  if (cur.exitCode === 0) {
+    const raw = cur.stdout.toString().trim();
+    if (raw) {
+      const current = JSON.parse(raw) as {
+        tagName: string;
+        isPrerelease: boolean;
+      };
+      if (
+        current.tagName !== tag &&
+        !isStableTag(current.tagName) &&
+        !current.isPrerelease
+      ) {
+        console.log(
+          `Demoting previous masquerading latest ${current.tagName}: prerelease=false → true`,
+        );
+        await $`gh release edit ${current.tagName} --prerelease=true --latest=false`;
+      }
+    }
+  }
+}
+
+const prev = await $`git describe --tags --abbrev=0 ${`${tag}^`}`
+  .nothrow()
+  .quiet();
+const from = prev.exitCode === 0 ? prev.stdout.toString().trim() : undefined;
+
+console.log(
+  `Generating release notes for ${tag}${from ? ` from ${from}` : ""}`,
+);
+const { md } = await generate({
+  from,
+  to: tag,
+  emoji: true,
+  contributors: true,
+  repo: "alchemy-run/alchemy-effect",
+});
+
+const args = [
+  "release",
+  "create",
+  tag,
+  "--title",
+  tag,
+  "--notes",
+  md,
+  `--latest=${latest ? "true" : "false"}`,
+];
+if (prerelease) args.push("--prerelease");
+
+await $`gh ${args}`;
diff --git a/.repos/alchemy-effect/scripts/release/publish-package.ts b/.repos/alchemy-effect/scripts/release/publish-package.ts
new file mode 100644
index 00000000000..13a88d480f7
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/publish-package.ts
@@ -0,0 +1,153 @@
+#!/usr/bin/env bun
+/**
+ * Publish one workspace package to npm, idempotently.
+ *
+ * - Skips if {name}@{version} is already on the registry.
+ * - Rewrites `workspace:*` in dependency sections to the concrete sibling
+ *   version read from each sibling's package.json. `bun pm pack`'s own
+ *   substitution resolves `workspace:*` via bun.lock, which can lag behind
+ *   a fresh version bump — in beta.12 every package shipped with its
+ *   siblings pinned to beta.11 for that reason. Doing the rewrite here
+ *   sidesteps the lockfile entirely.
+ * - Selects the npm dist-tag based on the release channel:
+ *     release → latest
+ *     beta|alpha → next
+ *     tag → derived from the version's prerelease suffix (e.g.
+ *           2.0.0-experimental.1 → experimental-1)
+ *
+ * Usage: bun scripts/release/publish-package.ts <package-dir> <channel>
+ */
+import { $ } from "bun";
+import {
+  existsSync,
+  readdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { join, resolve } from "node:path";
+
+type DepMap = Record<string, string>;
+type PackageJson = {
+  name: string;
+  version: string;
+  dependencies?: DepMap;
+  devDependencies?: DepMap;
+  peerDependencies?: DepMap;
+  optionalDependencies?: DepMap;
+};
+
+type Channel = "release" | "beta" | "alpha" | "tag";
+
+const DEP_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+] as const satisfies readonly (keyof PackageJson)[];
+
+const CHANNELS: readonly Channel[] = ["release", "beta", "alpha", "tag"];
+
+const packageArg = process.argv[2];
+const channel = process.argv[3] as Channel | undefined;
+if (!packageArg || !channel || !CHANNELS.includes(channel)) {
+  console.error(
+    "Usage: bun scripts/release/publish-package.ts <package-dir> <release|beta|alpha|tag>",
+  );
+  process.exit(1);
+}
+
+const repoRoot = process.cwd();
+const packageDir = resolve(repoRoot, packageArg);
+const pkgPath = join(packageDir, "package.json");
+
+if (!existsSync(pkgPath)) {
+  console.error(`No package.json at ${pkgPath}`);
+  process.exit(1);
+}
+
+const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as PackageJson;
+const { name, version } = pkg;
+
+console.log(`--- Publishing ${name}@${version} (channel: ${channel}) ---`);
+
+const existing = await $`npm view ${`${name}@${version}`} version`
+  .nothrow()
+  .quiet();
+if (existing.exitCode === 0 && existing.stdout.toString().trim().length > 0) {
+  console.log(`${name}@${version} already published, skipping`);
+  process.exit(0);
+}
+
+const siblingVersions = new Map<string, string>();
+const packagesRoot = join(repoRoot, "packages");
+for (const entry of readdirSync(packagesRoot, { withFileTypes: true })) {
+  if (!entry.isDirectory()) continue;
+  const siblingPkgPath = join(packagesRoot, entry.name, "package.json");
+  if (!existsSync(siblingPkgPath)) continue;
+  const sibling = JSON.parse(readFileSync(siblingPkgPath, "utf-8")) as {
+    name?: string;
+    version?: string;
+  };
+  if (sibling.name && sibling.version) {
+    siblingVersions.set(sibling.name, sibling.version);
+  }
+}
+
+let rewrote = false;
+for (const section of DEP_SECTIONS) {
+  const deps = pkg[section];
+  if (!deps) continue;
+  for (const [dep, value] of Object.entries(deps)) {
+    if (typeof value !== "string" || !value.startsWith("workspace:")) continue;
+    const spec = value.slice("workspace:".length);
+    const concrete = siblingVersions.get(dep);
+    if (!concrete) {
+      console.error(
+        `${name}: ${section}.${dep} is ${value} but no workspace package provides ${dep}`,
+      );
+      process.exit(1);
+    }
+    const rewritten =
+      spec === "*" || spec === ""
+        ? concrete
+        : spec === "^"
+          ? `^${concrete}`
+          : spec === "~"
+            ? `~${concrete}`
+            : spec;
+    deps[dep] = rewritten;
+    console.log(`  ${section}.${dep}: ${value} → ${rewritten}`);
+    rewrote = true;
+  }
+}
+
+if (rewrote) {
+  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+}
+
+const $pkg = $.cwd(packageDir);
+await $pkg`bun pm pack --destination .`;
+
+const tarballs = readdirSync(packageDir).filter((f) => f.endsWith(".tgz"));
+if (tarballs.length !== 1) {
+  console.error(
+    `Expected exactly one .tgz in ${packageDir}, found ${tarballs.length}: ${tarballs.join(", ")}`,
+  );
+  process.exit(1);
+}
+const tarball = tarballs[0]!;
+
+const distTag =
+  channel === "release"
+    ? "latest"
+    : channel === "beta" || channel === "alpha"
+      ? "next"
+      : version.replace(/^\d+\.\d+\.\d+-/, "").replace(/\./g, "-");
+console.log(`Publishing tarball: ${tarball} (dist-tag: ${distTag})`);
+
+await $pkg`npm publish ${tarball} --access public --tag ${distTag}`;
+
+unlinkSync(join(packageDir, tarball));
+
+console.log(`--- Published ${name}@${version} ---`);
diff --git a/.repos/alchemy-effect/scripts/release/release-notes.ts b/.repos/alchemy-effect/scripts/release/release-notes.ts
new file mode 100644
index 00000000000..e26696948e1
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/release-notes.ts
@@ -0,0 +1,52 @@
+#!/usr/bin/env bun
+/**
+ * Prepend release notes for a tag to CHANGELOG.md. Idempotent: if the tag
+ * already appears as a heading in CHANGELOG.md, does nothing.
+ *
+ * Usage: bun scripts/release/release-notes.ts v2.0.0-beta.13
+ *
+ * Uses `changelogithub` to parse commits and resolve authors, then renders
+ * markdown with `./render.ts` so scopes containing `/` (e.g.
+ * `fix(aws/lambda): ...`) nest hierarchically instead of becoming flat
+ * unrelated groups.
+ */
+import { $ } from "bun";
+import { generate } from "changelogithub";
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { renderMarkdown } from "./render.ts";
+
+const tag = process.argv[2];
+if (!tag) {
+  console.error("Usage: bun scripts/release/release-notes.ts <tag>");
+  process.exit(1);
+}
+
+const changelogPath = join(process.cwd(), "CHANGELOG.md");
+const existing = await readFile(changelogPath, "utf-8");
+if (existing.includes(`## ${tag}\n`)) {
+  console.log(`${tag} already in CHANGELOG.md, skipping`);
+  process.exit(0);
+}
+
+// changelogithub uses `to` as a git revision in `git log <from>...<to>`.
+// In the commit-then-tag flow this script runs BEFORE the tag is created,
+// so resolve the revision to HEAD while keeping the tag string for the
+// markdown heading. If the tag already exists locally (resumed run), use
+// it so the diff is stable.
+const tagExists =
+  (await $`git rev-parse --verify ${`refs/tags/${tag}`}`.nothrow().quiet())
+    .exitCode === 0;
+const toRev = tagExists ? tag : "HEAD";
+
+console.log(`Generating release notes for ${tag} (using ${toRev})`);
+const { commits, config } = await generate({
+  to: toRev,
+  emoji: true,
+  contributors: true,
+  repo: "alchemy-run/alchemy-effect",
+});
+
+const md = renderMarkdown(commits, config);
+
+await writeFile(changelogPath, `## ${tag}\n\n${md}\n\n---\n\n${existing}`);
diff --git a/.repos/alchemy-effect/scripts/release/render-parity.test.ts b/.repos/alchemy-effect/scripts/release/render-parity.test.ts
new file mode 100644
index 00000000000..d5ad0121030
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/render-parity.test.ts
@@ -0,0 +1,163 @@
+/**
+ * Parity test: for commits whose scopes contain no `/`, `renderMarkdown`
+ * must produce byte-identical output to `changelogithub.generateMarkdown`.
+ * This guards against accidentally regressing the existing release-notes
+ * format for all historical content that predates `/`-style scopes.
+ */
+import { describe, expect, test } from "bun:test";
+import { generateMarkdown, type Commit } from "changelogithub";
+import { renderMarkdown, type RenderConfig } from "./render.ts";
+
+const config = {
+  titles: { breakingChanges: "🚨 Breaking Changes" },
+  types: {
+    feat: { title: "🚀 Features" },
+    fix: { title: "🐞 Bug Fixes" },
+    perf: { title: "🏎 Performance" },
+  },
+  capitalize: true,
+  emoji: true,
+  baseUrl: "github.com",
+  repo: "alchemy-run/alchemy-effect",
+  from: "v1",
+  to: "v2",
+  group: true,
+  scopeMap: {},
+  contributors: true,
+  tag: "v%s",
+} as unknown as RenderConfig & Parameters<typeof generateMarkdown>[1];
+
+function makeCommit(input: {
+  type: string;
+  scope?: string;
+  description: string;
+  hash?: string;
+  pr?: string;
+  authors?: Array<{ login?: string; name: string }>;
+  isBreaking?: boolean;
+}): Commit {
+  const references: Commit["references"] = [];
+  if (input.hash) references.push({ type: "hash", value: input.hash });
+  if (input.pr) references.push({ type: "pull-request", value: input.pr });
+  return {
+    message: `${input.type}${input.scope ? `(${input.scope})` : ""}: ${input.description}`,
+    body: "",
+    shortHash: (input.hash ?? "").slice(0, 7),
+    author: { name: "t", email: "t@t" },
+    authors: [],
+    description: input.description,
+    type: input.type,
+    scope: input.scope ?? "",
+    references,
+    isBreaking: input.isBreaking ?? false,
+    resolvedAuthors: input.authors,
+  } as Commit;
+}
+
+describe("render.ts / changelogithub parity for non-`/` scopes", () => {
+  test("single commit, single scope", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "Cloudflare",
+        description: "apply access headers",
+        hash: "fd329e70",
+        pr: "#160",
+        authors: [{ login: "jj", name: "JJ" }],
+      }),
+    ];
+    expect(renderMarkdown(commits, config)).toBe(
+      generateMarkdown(commits, config),
+    );
+  });
+
+  test("multiple commits sharing a single-segment scope", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "first",
+        hash: "1111111",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "second",
+        hash: "2222222",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "third",
+        hash: "3333333",
+      }),
+    ];
+    expect(renderMarkdown(commits, config)).toBe(
+      generateMarkdown(commits, config),
+    );
+  });
+
+  test("mixed types, scopes, unscoped, and breaking changes", () => {
+    const commits = [
+      makeCommit({
+        type: "feat",
+        description: "unscoped feature",
+        hash: "aaa0000",
+      }),
+      makeCommit({
+        type: "feat",
+        scope: "api",
+        description: "new endpoint",
+        hash: "bbb0000",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "core fix one",
+        hash: "ccc0000",
+        pr: "#100",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "core fix two",
+        hash: "ddd0000",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "website",
+        description: "solo website fix",
+        hash: "eee0000",
+        authors: [{ login: "alice", name: "Alice" }, { name: "Bob" }],
+      }),
+      makeCommit({
+        type: "feat",
+        scope: "api",
+        description: "breaking api change",
+        hash: "fff0000",
+        isBreaking: true,
+      }),
+    ];
+    expect(renderMarkdown(commits, config)).toBe(
+      generateMarkdown(commits, config),
+    );
+  });
+
+  test("empty commit list", () => {
+    expect(renderMarkdown([], config)).toBe(generateMarkdown([], config));
+  });
+
+  test("perf type section", () => {
+    const commits = [
+      makeCommit({
+        type: "perf",
+        scope: "runtime",
+        description: "faster",
+        hash: "ppp0000",
+      }),
+    ];
+    expect(renderMarkdown(commits, config)).toBe(
+      generateMarkdown(commits, config),
+    );
+  });
+});
diff --git a/.repos/alchemy-effect/scripts/release/render.test.ts b/.repos/alchemy-effect/scripts/release/render.test.ts
new file mode 100644
index 00000000000..d7ed969f6f4
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/render.test.ts
@@ -0,0 +1,357 @@
+import { describe, expect, test } from "bun:test";
+import type { Commit } from "changelogithub";
+import { renderMarkdown, type RenderConfig } from "./render.ts";
+
+// Minimal config that matches the defaults used by `release-notes.ts`.
+const baseConfig: RenderConfig = {
+  titles: { breakingChanges: "🚨 Breaking Changes" },
+  types: {
+    feat: { title: "🚀 Features" },
+    fix: { title: "🐞 Bug Fixes" },
+    perf: { title: "🏎 Performance" },
+  } as RenderConfig["types"],
+  capitalize: true,
+  emoji: true,
+  baseUrl: "github.com",
+  repo: "alchemy-run/alchemy-effect",
+  from: "v1",
+  to: "v2",
+};
+
+function makeCommit(input: {
+  type: string;
+  scope?: string;
+  description: string;
+  hash?: string;
+  pr?: string;
+  authors?: Array<{ login?: string; name: string }>;
+  isBreaking?: boolean;
+}): Commit {
+  const references: Commit["references"] = [];
+  if (input.hash) references.push({ type: "hash", value: input.hash });
+  if (input.pr) references.push({ type: "pull-request", value: input.pr });
+  return {
+    message: `${input.type}${input.scope ? `(${input.scope})` : ""}: ${input.description}`,
+    body: "",
+    shortHash: (input.hash ?? "").slice(0, 7),
+    author: { name: "t", email: "t@t" },
+    authors: [],
+    description: input.description,
+    type: input.type,
+    scope: input.scope ?? "",
+    references,
+    isBreaking: input.isBreaking ?? false,
+    resolvedAuthors: input.authors,
+  } as Commit;
+}
+
+const COMPARE_LINE =
+  "##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](https://github.com/alchemy-run/alchemy-effect/compare/v1...v2)";
+
+describe("renderMarkdown", () => {
+  test("renders empty when no commits", () => {
+    const md = renderMarkdown([], baseConfig);
+    expect(md).toBe(`*No significant changes*\n\n${COMPARE_LINE}`);
+  });
+
+  test("nests commits that share a top-level scope via `/`", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "aws/lambda",
+        description: "scope public url invokes",
+        hash: "abcdef123456",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "aws/lambda",
+        description: "second lambda fix",
+        hash: "1111111111",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "aws/s3",
+        description: "handle presigned URLs",
+        hash: "2222222222",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "aws",
+        description: "top-level aws fix",
+        hash: "3333333333",
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+
+    // Single shared `aws` header for all four commits.
+    expect(md.match(/- \*\*aws\*\*:/g) ?? []).toHaveLength(1);
+    // `lambda` has two commits -> nested list with header.
+    expect(md).toContain("  - **lambda**:\n");
+    expect(md).toContain("    - Second lambda fix");
+    expect(md).toContain("    - Scope public url invokes");
+    // `s3` also emits a header + nested bullet (matches changelogithub's
+    // `group: true` default: if any sibling has >1 commits, every sibling
+    // gets a header for visual alignment).
+    expect(md).toContain("  - **s3**:\n    - Handle presigned URLs");
+    // Plain `fix(aws)` shows as a bare bullet under the aws header.
+    expect(md).toContain("  - Top-level aws fix");
+    // No stray flat `**aws/lambda**` or `**aws/s3**` groups.
+    expect(md).not.toContain("**aws/lambda**");
+    expect(md).not.toContain("**aws/s3**");
+  });
+
+  test("keeps single-segment scopes flat (byte-compatible with changelogithub)", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "Cloudflare",
+        description: "apply Cloudflare Access headers to HTTP requests",
+        hash: "fd329e70aaaa",
+        pr: "#160",
+        authors: [{ login: "jacobiajohnson", name: "jj" }],
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+
+    expect(md).toContain(
+      "- **Cloudflare**: Apply Cloudflare Access headers to HTTP requests &nbsp;-&nbsp; by @jacobiajohnson in https://github.com/alchemy-run/alchemy-effect/issues/160 [<samp>(fd329)</samp>](https://github.com/alchemy-run/alchemy-effect/commit/fd329e70aaaa)",
+    );
+    expect(md).not.toContain("- **Cloudflare**:\n");
+  });
+
+  test("nests multi-commit single-segment scopes with a header", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "Cloudflare",
+        description: "first",
+        hash: "aaaaaaa",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "Cloudflare",
+        description: "second",
+        hash: "bbbbbbb",
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+
+    expect(md).toContain("- **Cloudflare**:\n");
+    expect(md).toMatch(/- \*\*Cloudflare\*\*:\n\s+- Second[\s\S]+- First/);
+  });
+
+  test("renders unscoped commits as plain bullets at the top of their type", () => {
+    const commits = [
+      makeCommit({ type: "fix", description: "no scope", hash: "abcabca" }),
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "core thing",
+        hash: "deadbee",
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+
+    const bugFixesBlock = md.slice(md.indexOf("🐞 Bug Fixes"));
+    const noScopeIdx = bugFixesBlock.indexOf("- No scope");
+    const coreIdx = bugFixesBlock.indexOf("- **core**:");
+    expect(noScopeIdx).toBeGreaterThan(-1);
+    expect(coreIdx).toBeGreaterThan(-1);
+    expect(noScopeIdx).toBeLessThan(coreIdx);
+  });
+
+  test("groups types under their titles and partitions breaking changes", () => {
+    const commits = [
+      makeCommit({
+        type: "feat",
+        scope: "api",
+        description: "new endpoint",
+        hash: "feat0000",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "api",
+        description: "bug",
+        hash: "fix00000",
+      }),
+      makeCommit({
+        type: "feat",
+        scope: "api",
+        description: "breaking change",
+        hash: "brk00000",
+        isBreaking: true,
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+
+    const breakingIdx = md.indexOf("🚨 Breaking Changes");
+    const featuresIdx = md.indexOf("🚀 Features");
+    const fixesIdx = md.indexOf("🐞 Bug Fixes");
+    expect(breakingIdx).toBeGreaterThan(-1);
+    expect(featuresIdx).toBeGreaterThan(breakingIdx);
+    expect(fixesIdx).toBeGreaterThan(featuresIdx);
+    // Breaking change must not also appear under Features.
+    const featuresBlock = md.slice(featuresIdx, fixesIdx);
+    expect(featuresBlock).not.toContain("Breaking change");
+  });
+
+  test("honors scopeMap before splitting on `/`", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "aws-lambda",
+        description: "mapped",
+        hash: "map00000",
+      }),
+    ];
+
+    const md = renderMarkdown(commits, {
+      ...baseConfig,
+      scopeMap: { "aws-lambda": "aws/lambda" },
+    });
+
+    expect(md).toContain("- **aws**:");
+    expect(md).toContain("  - **lambda**: Mapped");
+  });
+
+  test("splits scopes with leading/trailing whitespace and empty segments", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: " aws / lambda ",
+        description: "trims segments",
+        hash: "trim0000",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "aws//s3",
+        description: "skips empty segments",
+        hash: "skip0000",
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+    expect(md).toContain("- **aws**:");
+    // Both children are single-commit leaves with no other siblings forcing
+    // a header, so they collapse inline.
+    expect(md).toContain("  - **lambda**: Trims segments");
+    expect(md).toContain("  - **s3**: Skips empty segments");
+  });
+
+  test("collapses single-commit scopes inline when no sibling forces a header", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "just one",
+        hash: "core0000",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "website",
+        description: "also one",
+        hash: "web00000",
+      }),
+    ];
+    const md = renderMarkdown(commits, baseConfig);
+    expect(md).toContain("- **core**: Just one");
+    expect(md).toContain("- **website**: Also one");
+    expect(md).not.toContain("- **core**:\n");
+  });
+
+  test("forces headers on all siblings when any has multiple commits", () => {
+    // `group: true` default behavior: `website` is a single-commit leaf but
+    // gets a header because `core` has multiple commits in the same section.
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "first core",
+        hash: "c1c1c1c",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "second core",
+        hash: "c2c2c2c",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "website",
+        description: "solo website",
+        hash: "w1w1w1w",
+      }),
+    ];
+    const md = renderMarkdown(commits, baseConfig);
+    expect(md).toContain("- **core**:\n");
+    expect(md).toContain("- **website**:\n");
+    expect(md).not.toContain("- **website**: Solo website");
+  });
+
+  test("renders three-level nesting", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "aws/lambda/urls",
+        description: "first",
+        hash: "aaa0000",
+      }),
+      makeCommit({
+        type: "fix",
+        scope: "aws/lambda/urls",
+        description: "second",
+        hash: "bbb0000",
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+
+    expect(md).toContain("- **aws**:");
+    expect(md).toContain("  - **lambda**:");
+    expect(md).toContain("    - **urls**:");
+    expect(md).toContain("      - First");
+    expect(md).toContain("      - Second");
+  });
+
+  test("formats multiple authors with `and`", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "thing",
+        hash: "a1b2c3d",
+        authors: [{ login: "alice", name: "Alice" }, { name: "Bob" }],
+      }),
+    ];
+
+    const md = renderMarkdown(commits, baseConfig);
+    expect(md).toContain("by @alice and **Bob**");
+  });
+
+  test("strips emojis from section titles when emoji=false", () => {
+    const commits = [
+      makeCommit({ type: "fix", description: "x", hash: "1234567" }),
+    ];
+    const md = renderMarkdown(commits, { ...baseConfig, emoji: false });
+    expect(md).toContain("### &nbsp;&nbsp;&nbsp;Bug Fixes");
+    expect(md).not.toContain("🐞");
+  });
+
+  test("respects capitalize=false", () => {
+    const commits = [
+      makeCommit({
+        type: "fix",
+        scope: "core",
+        description: "lowercase description",
+        hash: "1234567",
+      }),
+    ];
+    const md = renderMarkdown(commits, { ...baseConfig, capitalize: false });
+    expect(md).toContain("- **core**: lowercase description");
+  });
+});
diff --git a/.repos/alchemy-effect/scripts/release/render.ts b/.repos/alchemy-effect/scripts/release/render.ts
new file mode 100644
index 00000000000..20b055eabe6
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/release/render.ts
@@ -0,0 +1,239 @@
+/**
+ * Custom markdown renderer for changelogithub-parsed commits.
+ *
+ * Mirrors the output of changelogithub's built-in generator but groups
+ * conventional-commit scopes hierarchically by splitting on `/`. For
+ * example commits like `fix(aws/lambda): ...`, `fix(aws/s3): ...` and
+ * `fix(aws): ...` render as nested categories under a shared `**aws**`
+ * top-level scope rather than as three unrelated flat groups.
+ *
+ * Line-level formatting (authors, PR/issue links, `<samp>` hash tags,
+ * `&nbsp;` spacing) is kept byte-compatible with changelogithub so output
+ * for single-segment scopes is identical to the upstream renderer.
+ */
+import type { ChangelogOptions, Commit } from "changelogithub";
+
+export type RenderConfig = Required<
+  Pick<
+    ChangelogOptions,
+    | "titles"
+    | "types"
+    | "capitalize"
+    | "emoji"
+    | "baseUrl"
+    | "repo"
+    | "from"
+    | "to"
+  >
+> & {
+  scopeMap?: Record<string, string>;
+};
+
+const emojisRE =
+  /([\u2700-\u27BF\uE000-\uF8FF\u2011-\u26FF]|\uD83C[\uDC00-\uDFFF]|\uD83D[\uDC00-\uDFFF]|\uD83E[\uDD10-\uDDFF])/g;
+
+export function renderMarkdown(
+  commits: Commit[],
+  config: RenderConfig,
+): string {
+  const lines: string[] = [];
+  const [breaking, rest] = partition(commits, (c) => c.isBreaking);
+
+  if (config.titles?.breakingChanges) {
+    lines.push(
+      ...renderSection(breaking, config.titles.breakingChanges, config),
+    );
+  }
+
+  const byType = groupBy(rest, (c) => c.type);
+  for (const type of Object.keys(config.types)) {
+    const items = byType[type] || [];
+    lines.push(...renderSection(items, config.types[type].title, config));
+  }
+
+  if (!lines.length) lines.push("*No significant changes*");
+
+  const url = `https://${config.baseUrl}/${config.repo}/compare/${config.from}...${config.to}`;
+  lines.push(
+    "",
+    `##### &nbsp;&nbsp;&nbsp;&nbsp;[View changes on GitHub](${url})`,
+  );
+
+  return lines.join("\n").trim();
+}
+
+interface Node {
+  commits: Commit[];
+  children: Record<string, Node>;
+}
+
+function makeNode(): Node {
+  return { commits: [], children: {} };
+}
+
+function renderSection(
+  commits: Commit[],
+  sectionName: string,
+  config: RenderConfig,
+): string[] {
+  if (!commits.length) return [];
+  const out: string[] = ["", formatTitle(sectionName, config), ""];
+
+  // Build a tree keyed by the `/`-separated scope segments. Commits attach
+  // to the deepest node that matches their scope exactly.
+  const root = makeNode();
+  for (const commit of commits) {
+    const scope = (commit.scope ?? "").trim();
+    const mapped = config.scopeMap?.[scope] ?? scope;
+    const segments = mapped
+      ? mapped
+          .split("/")
+          .map((s) => s.trim())
+          .filter(Boolean)
+      : [];
+    let node = root;
+    for (const seg of segments) {
+      node.children[seg] ??= makeNode();
+      node = node.children[seg];
+    }
+    node.commits.push(commit);
+  }
+
+  out.push(...renderNode(root, 0, config));
+  return out;
+}
+
+function renderNode(node: Node, depth: number, config: RenderConfig): string[] {
+  const lines: string[] = [];
+  const pad = "  ".repeat(depth);
+
+  // Reverse to match changelogithub's ordering: commits come out of git log
+  // newest-first, and the upstream renderer flips them so the oldest entry
+  // in the range appears at the top of each bucket.
+  for (const commit of [...node.commits].reverse()) {
+    lines.push(`${pad}- ${formatLine(commit, config)}`);
+  }
+
+  const childNames = Object.keys(node.children).sort();
+
+  // Match changelogithub's `group: true` default: within a given level, if
+  // ANY sibling scope has more than a single inline-able commit (either
+  // multiple commits or further sub-scopes), force every sibling to render
+  // with a header. This keeps visual alignment consistent and is what the
+  // existing CHANGELOG.md entries already use, so it avoids regressing
+  // historical release-notes style.
+  const forceHeaders = childNames.some((name) => {
+    const child = node.children[name];
+    return countCommits(child) > 1 || Object.keys(child.children).length > 0;
+  });
+
+  for (const name of childNames) {
+    const child = node.children[name];
+    const label = `**${name}**`;
+
+    const childCommitCount = countCommits(child);
+    const hasGrandchildren = Object.keys(child.children).length > 0;
+
+    // Collapse inline only when NO sibling wants a header and this child is
+    // a single-commit leaf. Otherwise emit the header + nested bullets.
+    if (!forceHeaders && childCommitCount === 1 && !hasGrandchildren) {
+      const [commit] = child.commits;
+      lines.push(`${pad}- ${label}: ${formatLine(commit, config)}`);
+      continue;
+    }
+
+    lines.push(`${pad}- ${label}:`);
+    lines.push(...renderNode(child, depth + 1, config));
+  }
+
+  return lines;
+}
+
+function countCommits(node: Node): number {
+  let n = node.commits.length;
+  for (const child of Object.values(node.children)) n += countCommits(child);
+  return n;
+}
+
+function formatTitle(name: string, config: RenderConfig): string {
+  if (!config.emoji) name = name.replace(emojisRE, "");
+  return `### &nbsp;&nbsp;&nbsp;${name.trim()}`;
+}
+
+function formatLine(commit: Commit, config: RenderConfig): string {
+  const prRefs = formatReferences(commit.references, config, "issues");
+  const hashRefs = formatReferences(commit.references, config, "hash");
+  const authorNames = [
+    ...new Set(
+      (commit.resolvedAuthors ?? []).map((a) =>
+        a.login ? `@${a.login}` : `**${a.name}**`,
+      ),
+    ),
+  ];
+  const authors = joinWithAnd(authorNames).trim();
+  const authorStr = authors ? `by ${authors}` : "";
+  let refs = [authorStr, prRefs, hashRefs]
+    .filter((s) => s && s.trim())
+    .join(" ");
+  if (refs) refs = `&nbsp;-&nbsp; ${refs}`;
+  const description = config.capitalize
+    ? capitalize(commit.description)
+    : commit.description;
+  return [description, refs].filter((s) => s && s.trim()).join(" ");
+}
+
+function formatReferences(
+  references: Commit["references"],
+  config: RenderConfig,
+  kind: "issues" | "hash",
+): string {
+  const baseUrl = config.baseUrl;
+  const repo = config.repo;
+  const refs = references
+    .filter((r) =>
+      kind === "issues"
+        ? r.type === "issue" || r.type === "pull-request"
+        : r.type === "hash",
+    )
+    .map((ref) => {
+      if (!repo) return ref.value;
+      if (ref.type === "pull-request" || ref.type === "issue") {
+        return `https://${baseUrl}/${repo}/issues/${ref.value.slice(1)}`;
+      }
+      return `[<samp>(${ref.value.slice(0, 5)})</samp>](https://${baseUrl}/${repo}/commit/${ref.value})`;
+    });
+  const joined = joinWithAnd(refs).trim();
+  if (kind === "issues") return joined ? `in ${joined}` : "";
+  return joined;
+}
+
+function capitalize(s: string): string {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+
+function joinWithAnd(
+  array: string[],
+  glue = ", ",
+  finalGlue = " and ",
+): string {
+  if (!array || array.length === 0) return "";
+  if (array.length === 1) return array[0];
+  if (array.length === 2) return array.join(finalGlue);
+  return `${array.slice(0, -1).join(glue)}${finalGlue}${array.slice(-1)}`;
+}
+
+function partition<T>(items: T[], pred: (item: T) => boolean): [T[], T[]] {
+  const yes: T[] = [];
+  const no: T[] = [];
+  for (const item of items) (pred(item) ? yes : no).push(item);
+  return [yes, no];
+}
+
+function groupBy<T>(items: T[], key: (item: T) => string): Record<string, T[]> {
+  const out: Record<string, T[]> = {};
+  for (const item of items) {
+    const k = key(item);
+    (out[k] ??= []).push(item);
+  }
+  return out;
+}
diff --git a/.repos/alchemy-effect/scripts/test.ts b/.repos/alchemy-effect/scripts/test.ts
new file mode 100644
index 00000000000..c5b822abc2b
--- /dev/null
+++ b/.repos/alchemy-effect/scripts/test.ts
@@ -0,0 +1,53 @@
+import { $ } from "bun";
+import * as net from "net";
+
+const isLocal = !!process.env.LOCAL;
+
+if (isLocal) {
+  await $`rm -rf .alchemy`.quiet();
+
+  // Start localstack in detached mode (quiet - no stdout/stderr)
+  await $`pkill localstack || true`.quiet();
+  await $`localstack start -d`.quiet();
+
+  // Wait for localstack port 4566 to be open before proceeding
+  while (true) {
+    // INSERT_YOUR_CODE
+    // Try to connect with node to 127.0.0.1:$1 until successful.
+    try {
+      await new Promise((resolve, reject) => {
+        const socket = net.connect({ port: 4566, host: "127.0.0.1" }, () => {
+          socket.end();
+          resolve(true);
+        });
+        socket.on("error", () => {
+          reject(new Error("Failed to connect to localstack"));
+        });
+      });
+      break;
+    } catch {}
+  }
+  await new Promise((resolve) => setTimeout(resolve, 1000));
+}
+
+let exitCode = 1;
+
+try {
+  // Run tests with inherited stdout/stderr, passing through all args
+  const args = process.argv.slice(2);
+  const proc = Bun.spawn(["bun", "vitest", "run", ...args], {
+    stdio: ["inherit", "inherit", "inherit"],
+    env: process.env,
+    cwd: process.cwd(),
+  });
+
+  // Wait for the process to complete
+  exitCode = await proc.exited;
+} finally {
+  if (isLocal) {
+    // Stop localstack as cleanup
+    await $`localstack stop`.quiet();
+  }
+}
+
+process.exit(exitCode);
diff --git a/.repos/alchemy-effect/stacks/github.ts b/.repos/alchemy-effect/stacks/github.ts
new file mode 100644
index 00000000000..f7ed5bbdc54
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/github.ts
@@ -0,0 +1,169 @@
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Neon from "alchemy/Neon";
+import * as Output from "alchemy/Output";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+
+const REPO = { owner: "alchemy-run", repository: "alchemy-effect" } as const;
+
+export default Alchemy.Stack(
+  "AlchemyGitHubSecrets",
+  {
+    providers: Layer.mergeAll(
+      AWS.providers(),
+      Cloudflare.providers(),
+      GitHub.providers(),
+      Neon.providers(),
+    ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const testAccountId = yield* Config.string("TEST_CLOUDFLARE_ACCOUNT_ID");
+    const prodAccountId = yield* Config.string("PROD_CLOUDFLARE_ACCOUNT_ID");
+    const discordWebhookUrl = yield* Config.string("DISCORD_WEBHOOK_URL");
+    const prPackageAuthToken = yield* Config.string("PR_PACKAGE_TOKEN");
+
+    const testApiToken = yield* token("TestApiToken", {
+      accountId: testAccountId,
+    });
+
+    const prodApiToken = yield* token("ProdApiToken", {
+      accountId: prodAccountId,
+    });
+
+    // GitHub OIDC trust for AWS — lets `.github/workflows/test.yml` (and any
+    // future workflow) assume an IAM role via `aws-actions/configure-aws-credentials`
+    // with no long-lived AWS_ACCESS_KEY_ID secrets in the repo.
+    const oidc = yield* AWS.IAM.OpenIDConnectProvider("GitHubOidc", {
+      url: "https://token.actions.githubusercontent.com",
+      clientIDList: ["sts.amazonaws.com"],
+      // GitHub's well-known OIDC thumbprint. AWS auto-discovers thumbprints
+      // for github.com these days, but our `iam.updateOpenIDConnectProviderThumbprint`
+      // sync still requires a non-empty list when comparing against the
+      // cloud-observed value.
+      // https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/
+      thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
+    });
+
+    const role = yield* AWS.IAM.Role("GitHubActionsRole", {
+      roleName: "alchemy-github-actions",
+      assumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: {
+              Federated: oidc.openIDConnectProviderArn,
+            },
+            Action: ["sts:AssumeRoleWithWebIdentity"],
+            Condition: {
+              StringEquals: {
+                "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+              },
+              // Restrict to any branch / PR / tag inside this repo. Tighten
+              // further (e.g. `repo:.../environment:prod`) once we wire up
+              // GitHub Environments.
+              StringLike: {
+                "token.actions.githubusercontent.com:sub": `repo:${REPO.owner}/${REPO.repository}:*`,
+              },
+            },
+          },
+        ],
+      },
+      // The smoke suite deploys real Cloudflare workers, AWS Lambdas, S3
+      // buckets, DynamoDB tables, etc., so it needs broad access. Swap for
+      // a custom-managed policy enumerating `lambda:*`, `dynamodb:*`, … if
+      // you want least-privilege CI.
+      managedPolicyArns: ["arn:aws:iam::aws:policy/AdministratorAccess"],
+    });
+
+    const region = yield* AWS.Region;
+
+    yield* GitHub.Secrets({
+      ...REPO,
+      secrets: {
+        TEST_CLOUDFLARE_API_TOKEN: testApiToken.value,
+        TEST_CLOUDFLARE_ACCOUNT_ID: testAccountId,
+        PROD_CLOUDFLARE_API_TOKEN: prodApiToken.value,
+        PROD_CLOUDFLARE_ACCOUNT_ID: prodAccountId,
+        DISCORD_WEBHOOK_URL: discordWebhookUrl,
+        PR_PACKAGE_TOKEN: prPackageAuthToken,
+        NEON_API_KEY: (yield* Neon.NeonEnvironment).apiKey,
+      },
+    });
+
+    // Role ARN + region are not secret — publish as repo-level Variables
+    // so workflows can reference `vars.AWS_ROLE_ARN` / `vars.AWS_REGION`.
+    yield* GitHub.Variables({
+      ...REPO,
+      variables: {
+        AWS_ROLE_ARN: role.roleArn,
+        AWS_REGION: region,
+      },
+    });
+
+    return {
+      TEST_CLOUDFLARE_API_TOKEN: testApiToken.value.pipe(
+        Output.map(Redacted.value),
+      ),
+      TEST_CLOUDFLARE_ACCOUNT_ID: testAccountId,
+      PROD_CLOUDFLARE_API_TOKEN: prodApiToken.value.pipe(
+        Output.map(Redacted.value),
+      ),
+      PROD_CLOUDFLARE_ACCOUNT_ID: prodAccountId,
+      DISCORD_WEBHOOK_URL: discordWebhookUrl,
+      AWS_ROLE_ARN: role.roleArn,
+      AWS_REGION: region,
+    };
+  }).pipe(Effect.orDie),
+);
+
+const token = (
+  id: string,
+  props: {
+    accountId: string;
+  },
+) =>
+  Cloudflare.AccountApiToken(id, {
+    accountId: props.accountId,
+    policies: [
+      {
+        effect: "allow",
+        permissionGroups: [
+          // Worker / runtime data plane
+          "Workers Scripts Write",
+          "Workers KV Storage Write",
+          "Workers R2 Storage Write",
+          "Workers Routes Write",
+          "Workers Tail Read",
+          "Workers Observability Write",
+          // Storage / data services
+          "D1 Write",
+          "Queues Write",
+          "Hyperdrive Write",
+          "Pipelines Write",
+          "Vectorize Write",
+          // Higher-level Worker features used by examples
+          "AI Gateway Write",
+          // Containers
+          "Workers Containers Write",
+          "Cloudchamber Write",
+          "Browser Rendering Write",
+          // Static assets / sites
+          "Pages Write",
+          // Misc
+          "Account Settings Write",
+          "Secrets Store Write",
+          "Logs Write",
+        ],
+        resources: {
+          [`com.cloudflare.api.account.${props.accountId}`]: "*",
+        },
+      },
+    ],
+  });
diff --git a/.repos/alchemy-effect/stacks/otel.ts b/.repos/alchemy-effect/stacks/otel.ts
new file mode 100644
index 00000000000..682e6840f6f
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/otel.ts
@@ -0,0 +1,98 @@
+import * as Alchemy from "alchemy";
+import * as Axiom from "alchemy/Axiom";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { CliOverviewDashboard } from "./otel/Dashboard.ts";
+import { Logs, Metrics, Traces } from "./otel/Datasets.ts";
+import Ingester from "./otel/Ingester.ts";
+import {
+  ActiveUsersByCi,
+  ActiveUsersByVersion,
+  ActiveUsersHourly,
+  CliInvocations,
+  DeployDestroyLatency,
+  ResourceErrorRate,
+  ResourceLatency,
+  ResourcesUsed,
+} from "./otel/Views.ts";
+
+/**
+ * Provisions an Axiom OTEL ingestion pipeline:
+ *
+ * - Three datasets (`{stage}-traces`, `{stage}-logs`, `{stage}-metrics`),
+ *   each with the matching `otel:*:v1` `kind`.
+ * - One ingest-only API token scoped to those three datasets.
+ * - Outputs the OTLP endpoints + `Authorization` header value so callers can
+ *   wire them straight into a Worker / Lambda's env vars.
+ * - Optionally syncs the same values to the GitHub repo's Actions secrets
+ *   (set `SYNC_GITHUB_SECRETS=1` when deploying).
+ */
+export default Alchemy.Stack(
+  "AlchemyOtel",
+  {
+    providers: Layer.mergeAll(
+      Axiom.providers(),
+      Cloudflare.providers(),
+      GitHub.providers(),
+    ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const traces = yield* Traces;
+    const logs = yield* Logs;
+    const metrics = yield* Metrics;
+
+    // Public ingest relay. Bound to `otel.alchemy.run` and
+    // `analytics.alchemy.run` only in prod so dev stages exercise the same
+    // code path under a `*.workers.dev` URL. The same Worker also reverse-
+    // proxies PostHog Cloud for first-party browser analytics.
+    const relay = yield* Ingester;
+
+    // const posthogProjectKey = yield* Config.string("POSTHOG_PROJECT_KEY")
+    //   .pipe(Config.option)
+    //
+    //   .pipe(Effect.orDie);
+
+    // Saved APL queries — one per insight surfaced by the dashboard.
+    yield* ActiveUsersHourly;
+    yield* ActiveUsersByVersion;
+    yield* ActiveUsersByCi;
+    yield* ResourcesUsed;
+    yield* DeployDestroyLatency;
+    yield* ResourceLatency;
+    yield* CliInvocations;
+    yield* ResourceErrorRate;
+
+    // Composed dashboard combining the same signals on a 12-col grid.
+    yield* CliOverviewDashboard;
+
+    const env = {
+      OTEL_EXPORTER_OTLP_ENDPOINT: traces.otelEndpoint,
+      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: traces.otelTracesEndpoint,
+      OTEL_EXPORTER_OTLP_LOGS_ENDPOINT: logs.otelLogsEndpoint,
+      OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: metrics.otelMetricsEndpoint,
+      AXIOM_DATASET_TRACES: traces.name,
+      AXIOM_DATASET_LOGS: logs.name,
+      AXIOM_DATASET_METRICS: metrics.name,
+      RELAY_URL: relay.url,
+    };
+
+    if (process.env.SYNC_GITHUB_SECRETS === "1") {
+      yield* GitHub.Secrets({
+        owner: "alchemy-run",
+        repository: "alchemy-effect",
+        secrets: {
+          AXIOM_DATASET_TRACES: traces.name,
+          AXIOM_DATASET_LOGS: logs.name,
+          AXIOM_DATASET_METRICS: metrics.name,
+          OTEL_EXPORTER_OTLP_ENDPOINT: traces.otelEndpoint,
+        },
+      });
+    }
+
+    return env;
+  }),
+);
diff --git a/.repos/alchemy-effect/stacks/otel/Dashboard.ts b/.repos/alchemy-effect/stacks/otel/Dashboard.ts
new file mode 100644
index 00000000000..dbe48247e5e
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/otel/Dashboard.ts
@@ -0,0 +1,688 @@
+import * as Alchemy from "alchemy";
+import * as Axiom from "alchemy/Axiom";
+import type { Input } from "alchemy/Input";
+import * as Output from "alchemy/Output";
+import { Effect } from "effect";
+import { Traces } from "./Datasets.ts";
+
+/**
+ * `${stage} alchemy CLI overview` — a single dashboard answering the
+ * four questions we actually care about, laid out on a 12-column grid:
+ *
+ *   1. **How many active users are working on a project?**
+ *      Distinct `alchemy.user.id` per `alchemy.git.origin_hash`.
+ *   2. **How many distinct projects are there?**
+ *      Distinct `alchemy.git.origin_hash`.
+ *   3. **How many projects use CI/CD?**
+ *      Distinct `alchemy.git.origin_hash` where `alchemy.ci=true`.
+ *   4. **What state stores are people using?**
+ *      Sourced from `state_store.init` spans tagged with
+ *      `alchemy.state_store.id` (the open-ended `StateService.id`
+ *      slug; built-ins are `local` / `inmemory` / `http` /
+ *      `cloudflare-http`, third-party stores get tracked automatically
+ *      by setting their own slug). Emitted once per process via
+ *      `recordStateStoreInit` at every `Layer.effect(State, …)` site.
+ *
+ * Project identity uses `alchemy.git.origin_hash` rather than
+ * `alchemy.user.id`: ephemeral CI runners regenerate `~/.alchemy/id`
+ * every job, which dramatically inflates the user count. The git
+ * origin hash is stable across runs of the same repo and is the
+ * closest proxy we have for "a project".
+ *
+ * All queries target `${stage}-traces` — Axiom's metrics datasets
+ * cannot be queried via APL, but every metric we emit has an
+ * equivalent span (`cli.<command>`, `provider.<op>`,
+ * `state_store.deploy`, `state_store.init`).
+ *
+ * Each chart's APL query is built with `Output.interpolate` against
+ * `traces.name` so Alchemy sequences the dashboard after the dataset
+ * exists. Otherwise Axiom would reject creation with
+ * `BadRequest: failed to validate ... entity not found`.
+ */
+export const CliOverviewDashboard = Axiom.Dashboard(
+  "CliOverview",
+  Effect.gen(function* () {
+    const stack = yield* Alchemy.Stack;
+    const traces = yield* Traces;
+    const t = traces.name;
+    const isProd = stack.stage === "prod";
+
+    const prodTracesName: Input<string> = isProd
+      ? t
+      : (yield* Axiom.Dataset.ref("Traces", { stage: "prod" })).name;
+    // Global filter bar — a `SmartFilter` chart drives every other
+    // chart's APL via `declare query_parameters` parameters:
+    //
+    // - `alchemy_version` (every stage) narrows every chart to a
+    //   single alchemy version. An explicit "All" row with an empty
+    //   value short-circuits the filter via
+    //   `isempty(alchemy_version)`. APL-sourced filters don't get
+    //   the auto-"All" that `list` filters do, so the source query
+    //   unions one in.
+    //
+    // - `dataset_filter` (non-prod stages only) lets us preview
+    //   dashboard changes against `prod-traces` while defaulting to
+    //   the current stage's own dataset. Charts reference the
+    //   dataset via `table(dataset_filter)` instead of a literal
+    //   `['<name>']` so the parameter binding takes effect. On prod
+    //   we skip the filter entirely and hardcode `['prod-traces']`.
+    //
+    // Fresh stages have no spans yet, so `service.version` may not
+    // exist as a column. `column_ifexists` lets the queries parse
+    // against an empty dataset (otherwise APL rejects them with
+    // `invalid field: "service.version"`).
+    // `bin_size` drives every TimeSeries chart's bucket width so a
+    // single filter flips the whole dashboard between hourly / daily /
+    // weekly aggregation. Queries reference it as
+    // `bin(_time, totimespan(bin_size))`.
+    const declarations: Input<string> = isProd
+      ? `declare query_parameters (alchemy_version:string = "", bin_size:string = "1h");`
+      : Output.interpolate`declare query_parameters (dataset_filter:string = "${t}", alchemy_version:string = "", bin_size:string = "1h");`;
+    const datasetExpr: Input<string> = isProd
+      ? Output.interpolate`['${t}']`
+      : "table(dataset_filter)";
+    const versionFilterWhere = `\n              | where isempty(alchemy_version) or tostring(column_ifexists("service.version", "")) == alchemy_version`;
+    const charts: Input<Axiom.Chart>[] = [
+      {
+        id: "filter-bar",
+        type: "SmartFilter",
+        name: "Filters",
+        filters: [
+          ...(isProd
+            ? []
+            : [
+                {
+                  id: "dataset_filter",
+                  type: "select" as const,
+                  name: "dataset",
+                  active: true,
+                  selectType: "list" as const,
+                  options: [
+                    {
+                      id: "stage",
+                      key: `${stack.stage} (this stage)`,
+                      value: t,
+                      default: true,
+                    },
+                    {
+                      id: "prod",
+                      key: "prod (production data)",
+                      value: prodTracesName,
+                    },
+                  ],
+                },
+              ]),
+          {
+            id: "bin_size",
+            type: "select",
+            name: "aggregation period",
+            active: true,
+            selectType: "list",
+            options: [
+              { id: "1h", key: "1 hour", value: "1h", default: true },
+              { id: "6h", key: "6 hours", value: "6h" },
+              { id: "1d", key: "1 day", value: "1d" },
+              { id: "7d", key: "7 days", value: "7d" },
+            ],
+          },
+          {
+            id: "alchemy_version",
+            type: "select",
+            name: "alchemy version",
+            active: true,
+            selectType: "apl",
+            options: [],
+            apl: {
+              apl: Output.interpolate`
+                  ${declarations}
+                  let opts = ${datasetExpr}
+                    | extend sv = tostring(column_ifexists("service.version", ""))
+                    | where sv != ""
+                    | distinct sv
+                    | sort by sv desc
+                    | project key=sv, value=sv;
+                  let all = print key="All", value="";
+                  union all, opts
+                `,
+            },
+          },
+        ],
+      },
+      // Row 1 — top-line counts answering Qs 1, 2, 3.
+      {
+        id: "distinct-projects",
+        name: "Distinct projects (7d)",
+        type: "Statistic",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend project=tostring(['resource.custom']['alchemy.git.origin_hash'])
+              | where project != ""
+              | summarize projects=dcount(project)
+            `,
+        },
+      },
+      {
+        id: "projects-using-ci",
+        name: "Projects using CI/CD (7d)",
+        type: "Statistic",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend project=tostring(['resource.custom']['alchemy.git.origin_hash']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where project != "" and ci == "true"
+              | summarize projects=dcount(project)
+            `,
+        },
+      },
+      {
+        id: "active-users-7d",
+        name: "Active users — non-CI (7d)",
+        type: "Statistic",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend uid=tostring(['resource.custom']['alchemy.user.id']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where ci != "true"
+              | summarize users=dcount(uid)
+            `,
+        },
+      },
+
+      // Row 2 — Q1 broken out per-project, plus solo-vs-team split.
+      {
+        id: "users-per-project",
+        name: "Active users per project (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend project=tostring(['resource.custom']['alchemy.git.origin_hash']),
+                       uid=tostring(['resource.custom']['alchemy.user.id']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where project != ""
+              | summarize users_total=dcount(uid),
+                          users_local=dcountif(uid, ci != "true"),
+                          users_ci=dcountif(uid, ci == "true"),
+                          events=count()
+                  by project
+              | order by users_total desc
+              | take 100
+            `,
+        },
+      },
+      {
+        id: "project-team-size-distribution",
+        name: "Project team-size distribution (local users / project)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend project=tostring(['resource.custom']['alchemy.git.origin_hash']),
+                       uid=tostring(['resource.custom']['alchemy.user.id']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where project != "" and ci != "true"
+              | summarize users=dcount(uid) by project
+              | extend bucket = case(
+                  users == 1, "1 (solo)",
+                  users <= 3, "2-3",
+                  users <= 10, "4-10",
+                  "11+")
+              | summarize projects=count() by bucket
+              | order by bucket asc
+            `,
+        },
+      },
+
+      // Row 3 — Q4: state-store breakdown.
+      {
+        id: "state-store-projects-by-id",
+        name: "Projects by state store (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name == "state_store.init"
+              | extend store=tostring(['attributes.custom']['alchemy.state_store.id']),
+                       project=tostring(['resource.custom']['alchemy.git.origin_hash']),
+                       uid=tostring(['resource.custom']['alchemy.user.id'])
+              | summarize projects=dcountif(project, project != ""),
+                          users=dcount(uid),
+                          inits=count()
+                  by store
+              | order by projects desc
+            `,
+        },
+      },
+      {
+        id: "state-store-by-id-over-time",
+        name: "State store init by store / hour",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name == "state_store.init"
+              | extend store=tostring(['attributes.custom']['alchemy.state_store.id'])
+              | summarize count=count() by store, bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+
+      // Row 4 — adoption shape: project growth + CI-vs-local split.
+      {
+        id: "projects-over-time",
+        name: "Distinct projects per day",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend project=tostring(['resource.custom']['alchemy.git.origin_hash'])
+              | where project != ""
+              | summarize projects=dcount(project) by bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+      {
+        id: "active-users-over-time-hourly",
+        name: "Active users (non-CI)",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend uid=tostring(['resource.custom']['alchemy.user.id']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where ci != "true" and uid != ""
+              | summarize users=dcount(uid) by bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+      {
+        id: "active-users-over-time-daily",
+        name: "Active users (CI vs local)",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend uid=tostring(['resource.custom']['alchemy.user.id']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where uid != ""
+              | extend bucket=iff(ci == "true", "ci", "local")
+              | summarize users=dcount(uid) by bucket, bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+      {
+        id: "ci-vs-local-projects",
+        name: "Projects: CI vs local per day",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend project=tostring(['resource.custom']['alchemy.git.origin_hash']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | where project != ""
+              | extend bucket=iff(ci == "true", "ci", "local")
+              | summarize projects=dcount(project) by bucket, bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+
+      // Row 5 — keep the state-store deploy health signals for the
+      // Cloudflare-hosted store (not just init, but actual deploys).
+      {
+        id: "state-store-deploys",
+        name: "Cloudflare state store deploys (success vs error)",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name == "state_store.deploy"
+              | extend status=iff(tobool(['error']), "error", "success")
+              | summarize count=count() by status, bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+      {
+        id: "active-users-by-version",
+        name: "Active users by alchemy version (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | extend uid=tostring(['resource.custom']['alchemy.user.id']),
+                       version=tostring(['resource.custom']['alchemy.version']),
+                       ci=tostring(['resource.custom']['alchemy.ci'])
+              | summarize users_total=dcount(uid),
+                          users_local=dcountif(uid, ci != "true"),
+                          users_ci=dcountif(uid, ci == "true")
+                  by version
+              | order by users_total desc
+            `,
+        },
+      },
+
+      // ─── Cloudflare State Store ────────────────────────────────
+      //
+      // Two span sources feed this section:
+      //
+      //   - **CLI spans** (`state_store.init`, `state_store.bootstrap`,
+      //     `state_store.deploy`, ...) — emitted from the user's
+      //     terminal/CI. Carry `alchemy.cloudflare.account_hash` (a
+      //     SHA-256 of the CF accountId) so we can count distinct
+      //     deployments without leaking raw account IDs.
+      //
+      //   - **Worker handler spans** (`state_store.{getVersion,
+      //     listStacks,listStages,listResources,getState,setState,
+      //     deleteState,getReplacedResources,deleteStack}`) — emitted
+      //     from inside the deployed `alchemy-state-store` worker.
+      //     Distinguished by the `alchemy.state_store.script_name`
+      //     **resource** attribute (set on the worker's OTLP tracer
+      //     resource); CLI spans do not carry that resource attr.
+      //
+      // Worker handler spans carry `alchemy.state_store.{op,stack,
+      // stage,fqn}` as span attributes plus a `duration` field —
+      // that's what powers the latency / op-rate / stack-count
+      // charts. Account-hash sits on CLI spans only (worker-side
+      // injection would need a separate deploy-time env-var pass).
+      {
+        id: "state-store-distinct-cloudflare-stores",
+        name: "Distinct Cloudflare state-store deployments (7d)",
+        type: "Statistic",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name == "state_store.init"
+              | extend hash=tostring(['attributes.custom']['alchemy.cloudflare.account_hash'])
+              | where hash != ""
+              | summarize stores=dcount(hash)
+            `,
+        },
+      },
+      {
+        id: "state-store-distinct-stacks",
+        name: "Distinct stacks tracked (7d)",
+        type: "Statistic",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where ['resource.custom']['alchemy.state_store.script_name'] != ""
+              | extend stack=tostring(['attributes.custom']['alchemy.state_store.stack'])
+              | where stack != ""
+              | summarize stacks=dcount(stack)
+            `,
+        },
+      },
+      {
+        id: "state-store-total-ops",
+        name: "Cloudflare state store ops (7d)",
+        type: "Statistic",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where ['resource.custom']['alchemy.state_store.script_name'] != ""
+              | extend op=tostring(['attributes.custom']['alchemy.state_store.op'])
+              | where op != ""
+              | summarize ops=count()
+            `,
+        },
+      },
+      {
+        id: "state-store-op-latency",
+        name: "State store op latency (p50 / p95 / p99, 7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where ['resource.custom']['alchemy.state_store.script_name'] != ""
+              | extend op=tostring(['attributes.custom']['alchemy.state_store.op'])
+              | where op != ""
+              | summarize p50=percentile(duration, 50),
+                          p95=percentile(duration, 95),
+                          p99=percentile(duration, 99),
+                          calls=count()
+                  by op
+              | order by calls desc
+            `,
+        },
+      },
+      {
+        id: "state-store-ops-over-time",
+        name: "State store ops over time (by op)",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where ['resource.custom']['alchemy.state_store.script_name'] != ""
+              | extend op=tostring(['attributes.custom']['alchemy.state_store.op'])
+              | where op != ""
+              | summarize count=count() by op, bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+      {
+        id: "state-store-error-rate",
+        name: "State store error rate by op (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where ['resource.custom']['alchemy.state_store.script_name'] != ""
+              | extend op=tostring(['attributes.custom']['alchemy.state_store.op']),
+                       err=tobool(['error'])
+              | where op != ""
+              | summarize errors=countif(err == true),
+                          total=count()
+                  by op
+              | extend error_rate=todouble(errors) / todouble(total)
+              | order by total desc
+            `,
+        },
+      },
+      {
+        id: "state-store-top-stacks",
+        name: "Top stacks by activity (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where ['resource.custom']['alchemy.state_store.script_name'] != ""
+              | extend stack=tostring(['attributes.custom']['alchemy.state_store.stack'])
+              | where stack != ""
+              | summarize ops=count() by stack
+              | order by ops desc
+              | take 25
+            `,
+        },
+      },
+      {
+        id: "state-store-deployments-over-time",
+        name: "Distinct Cloudflare state-store deployments per day",
+        type: "TimeSeries",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name == "state_store.init"
+              | extend hash=tostring(['attributes.custom']['alchemy.cloudflare.account_hash'])
+              | where hash != ""
+              | summarize stores=dcount(hash) by bin(_time, totimespan(bin_size))
+              | order by _time asc
+            `,
+        },
+      },
+
+      // ─── Resource usage & reliability ──────────────────────────
+      //
+      // Every provider lifecycle invocation is wrapped in a
+      // `provider.<op>` span (see `instrumentLifecycle` in Apply.ts)
+      // carrying `alchemy.resource.type` and `alchemy.resource.op`
+      // (precreate/create/update/delete/read). `error` is set when
+      // the lifecycle effect fails.
+      {
+        id: "resource-usage-ranked",
+        name: "Resource usage — ranked by lifecycle ops (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name startswith "provider."
+              | extend resource_type=tostring(['attributes.custom']['alchemy.resource.type']),
+                       project=tostring(['resource.custom']['alchemy.git.origin_hash'])
+              | where resource_type != ""
+              | summarize ops=count(),
+                          projects=dcountif(project, project != ""),
+                          errors=countif(tobool(['error']) == true)
+                  by resource_type
+              | order by ops desc
+              | take 200
+            `,
+        },
+      },
+      {
+        id: "resource-error-rate-by-type",
+        name: "Resource error rate by resource type (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name startswith "provider."
+              | extend resource_type=tostring(['attributes.custom']['alchemy.resource.type']),
+                       err=tobool(['error'])
+              | where resource_type != ""
+              | summarize errors=countif(err == true),
+                          total=count()
+                  by resource_type
+              | extend error_rate=todouble(errors) / todouble(total)
+              | order by error_rate desc, total desc
+              | take 200
+            `,
+        },
+      },
+      {
+        id: "resource-error-rate-by-op",
+        name: "Resource error rate by lifecycle method (7d)",
+        type: "Table",
+        query: {
+          apl: Output.interpolate`
+              ${declarations}
+              ${datasetExpr}${versionFilterWhere}
+              | where name startswith "provider."
+              | extend op=tostring(['attributes.custom']['alchemy.resource.op']),
+                       err=tobool(['error'])
+              | where op != ""
+              | summarize errors=countif(err == true),
+                          total=count()
+                  by op
+              | extend error_rate=todouble(errors) / todouble(total)
+              | order by total desc
+            `,
+        },
+      },
+    ];
+
+    const layout: Axiom.LayoutCell[] = [
+      // Row 0 — filter bar (full width, narrow)
+      { i: "filter-bar", x: 0, y: 0, w: 12, h: 2 },
+      // Row 1
+      { i: "distinct-projects", x: 0, y: 2, w: 4, h: 4 },
+      { i: "projects-using-ci", x: 4, y: 2, w: 4, h: 4 },
+      { i: "active-users-7d", x: 8, y: 2, w: 4, h: 4 },
+      // Row 2 — active users over time
+      { i: "active-users-over-time-hourly", x: 0, y: 6, w: 6, h: 6 },
+      { i: "active-users-over-time-daily", x: 6, y: 6, w: 6, h: 6 },
+      // Row 3
+      { i: "users-per-project", x: 0, y: 12, w: 8, h: 8 },
+      { i: "project-team-size-distribution", x: 8, y: 12, w: 4, h: 8 },
+      // Row 4
+      { i: "state-store-projects-by-id", x: 0, y: 20, w: 6, h: 6 },
+      { i: "state-store-by-id-over-time", x: 6, y: 20, w: 6, h: 6 },
+      // Row 5
+      { i: "projects-over-time", x: 0, y: 26, w: 6, h: 6 },
+      { i: "ci-vs-local-projects", x: 6, y: 26, w: 6, h: 6 },
+      // Row 6
+      { i: "state-store-deploys", x: 0, y: 32, w: 6, h: 6 },
+      { i: "active-users-by-version", x: 6, y: 32, w: 6, h: 6 },
+      // Row 7 — Cloudflare State Store: top-line stats
+      {
+        i: "state-store-distinct-cloudflare-stores",
+        x: 0,
+        y: 38,
+        w: 4,
+        h: 4,
+      },
+      { i: "state-store-distinct-stacks", x: 4, y: 38, w: 4, h: 4 },
+      { i: "state-store-total-ops", x: 8, y: 38, w: 4, h: 4 },
+      // Row 8 — performance: latency table (full width)
+      { i: "state-store-op-latency", x: 0, y: 42, w: 12, h: 8 },
+      // Row 9 — ops over time + error rate
+      { i: "state-store-ops-over-time", x: 0, y: 50, w: 8, h: 6 },
+      { i: "state-store-error-rate", x: 8, y: 50, w: 4, h: 6 },
+      // Row 10 — distribution + adoption shape
+      { i: "state-store-top-stacks", x: 0, y: 56, w: 6, h: 8 },
+      { i: "state-store-deployments-over-time", x: 6, y: 56, w: 6, h: 8 },
+      // Row 11 — Resource usage ranking (full width)
+      { i: "resource-usage-ranked", x: 0, y: 64, w: 12, h: 10 },
+      // Row 12 — Error rate broken down by resource type and lifecycle method
+      { i: "resource-error-rate-by-type", x: 0, y: 74, w: 8, h: 10 },
+      { i: "resource-error-rate-by-op", x: 8, y: 74, w: 4, h: 10 },
+    ];
+
+    return {
+      dashboard: {
+        name: `${stack.stage} alchemy CLI overview`,
+        // Empty owner = X-AXIOM-EVERYONE (org-shared). API tokens
+        // can't create per-user "private" dashboards.
+        owner: "",
+        description:
+          "Adoption telemetry: distinct projects, active users per project, " +
+          "CI vs local usage, and state-store backend breakdown. Plus " +
+          "Cloudflare State Store ops: distinct deployments, stack count, " +
+          "per-op latency / error rate. " +
+          "Resource usage: ranked list of resource types by lifecycle ops, " +
+          "with error rates broken down by resource type and by lifecycle method. " +
+          "Project identity = alchemy.git.origin_hash (stable across CI runs); " +
+          "user identity = alchemy.user.id (ephemeral in CI); " +
+          "Cloudflare deployment identity = alchemy.cloudflare.account_hash " +
+          "(SHA-256 of accountId, set on CLI state_store.* spans).",
+        refreshTime: 60 as const,
+        schemaVersion: 2 as const,
+        // Axiom requires the `qr-now-{duration}` form for relative times.
+        timeWindowStart: "qr-now-7d",
+        timeWindowEnd: "qr-now",
+        charts,
+        layout,
+      },
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/stacks/otel/Datasets.ts b/.repos/alchemy-effect/stacks/otel/Datasets.ts
new file mode 100644
index 00000000000..76d1614f7f5
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/otel/Datasets.ts
@@ -0,0 +1,35 @@
+import * as Axiom from "alchemy/Axiom";
+import { Stack } from "alchemy/Stack";
+
+export const Traces = Axiom.Dataset(
+  "Traces",
+  Stack.useSync(({ stage }) => ({
+    name: `${stage}-traces`,
+    kind: "otel:traces:v1" as const,
+    description: `OTEL traces for stage '${stage}'`,
+    retentionDays: 30,
+    useRetentionPeriod: true,
+  })),
+);
+
+export const Logs = Axiom.Dataset(
+  "Logs",
+  Stack.useSync(({ stage }) => ({
+    name: `${stage}-logs`,
+    kind: "otel:logs:v1" as const,
+    description: `OTEL logs for stage '${stage}'`,
+    retentionDays: 30,
+    useRetentionPeriod: true,
+  })),
+);
+
+export const Metrics = Axiom.Dataset(
+  "Metrics",
+  Stack.useSync(({ stage }) => ({
+    name: `${stage}-metrics`,
+    kind: "otel:metrics:v1" as const,
+    description: `OTEL metrics for stage '${stage}'`,
+    retentionDays: 30,
+    useRetentionPeriod: true,
+  })),
+);
diff --git a/.repos/alchemy-effect/stacks/otel/IngestToken.ts b/.repos/alchemy-effect/stacks/otel/IngestToken.ts
new file mode 100644
index 00000000000..07d143a33b3
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/otel/IngestToken.ts
@@ -0,0 +1,28 @@
+import * as Alchemy from "alchemy";
+import * as Axiom from "alchemy/Axiom";
+import * as Output from "alchemy/Output";
+import { Effect } from "effect";
+import { Logs, Metrics, Traces } from "./Datasets.ts";
+
+export const IngestToken = Axiom.ApiToken(
+  "IngestToken",
+  Effect.all([Alchemy.Stack, Traces, Logs, Metrics]).pipe(
+    Effect.map(([stack, traces, logs, metrics]) => ({
+      name: `${stack.stage}-otel-ingest`,
+      description: `Ingest-only token for ${stack.stage} OTEL datasets`,
+      // Reference dataset Outputs (rather than literal strings) so Alchemy
+      // sequences the token after the datasets exist.
+      datasetCapabilities: Output.all(
+        traces.name,
+        logs.name,
+        metrics.name,
+      ).pipe(
+        Output.map(([t, l, m]) => ({
+          [t]: { ingest: ["create"] as const },
+          [l]: { ingest: ["create"] as const },
+          [m]: { ingest: ["create"] as const },
+        })),
+      ),
+    })),
+  ),
+);
diff --git a/.repos/alchemy-effect/stacks/otel/Ingester.ts b/.repos/alchemy-effect/stacks/otel/Ingester.ts
new file mode 100644
index 00000000000..8a1f6b6150c
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/otel/Ingester.ts
@@ -0,0 +1,159 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Logs, Metrics, Traces } from "./Datasets.ts";
+import { IngestToken } from "./IngestToken.ts";
+
+/**
+ * Public ingest relay used by both:
+ *
+ * 1. The alchemy CLI / services posting OTLP/JSON to `/v1/{traces,logs,metrics}`,
+ *    which we forward to Axiom with the ingest bearer token attached server-side.
+ * 2. The website's PostHog browser SDK, which posts to anything else
+ *    (`/e`, `/s`, `/flags`, `/decide`, `/static/*`, ...). PostHog ingest needs
+ *    no server secret, so we just reverse-proxy to PostHog Cloud (US region).
+ *
+ * Bound to two custom domains in prod:
+ * - `otel.alchemy.run`     — primary OTLP entrypoint
+ * - `analytics.alchemy.run` — first-party PostHog ingest (defeats ad-blockers)
+ *
+ * Environment (set by `stacks/otel.ts`):
+ * - `AXIOM_TRACES_ENDPOINT`  — full Axiom OTLP traces URL
+ * - `AXIOM_LOGS_ENDPOINT`    — full Axiom OTLP logs URL
+ * - `AXIOM_METRICS_ENDPOINT` — full Axiom OTLP metrics URL
+ * - `AXIOM_INGEST_TOKEN`     — Bearer token (Redacted)
+ */
+export default class Ingester extends Cloudflare.Worker<Ingester>()(
+  "OtelWorker",
+  Stack.useSync(({ stage }) => ({
+    main: import.meta.filename,
+    observability: { enabled: true },
+    domain:
+      stage === "prod"
+        ? ["otel.alchemy.run", "analytics.alchemy.run"]
+        : undefined,
+    compatibility: {
+      date: "2026-03-17",
+      flags: ["nodejs_compat"],
+    },
+  })),
+  Effect.gen(function* () {
+    const tokenValue = yield* (yield* IngestToken).token;
+    const traces = yield* Traces;
+    const logs = yield* Logs;
+    const metrics = yield* Metrics;
+    const tracesEndpoint = yield* traces.otelTracesEndpoint;
+    const logsEndpoint = yield* logs.otelLogsEndpoint;
+    const metricsEndpoint = yield* metrics.otelMetricsEndpoint;
+    const tracesDataset = yield* traces.name;
+    const logsDataset = yield* logs.name;
+    const metricsDataset = yield* metrics.name;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const url = new URL(request.url, "http://x");
+        const path = url.pathname;
+
+        // 1. OTLP → Axiom (POST /v1/{traces,logs,metrics})
+        const otlp =
+          request.method === "POST"
+            ? path === "/v1/traces"
+              ? {
+                  endpoint: yield* tracesEndpoint,
+                  dataset: yield* tracesDataset,
+                }
+              : path === "/v1/logs"
+                ? { endpoint: yield* logsEndpoint, dataset: yield* logsDataset }
+                : path === "/v1/metrics"
+                  ? {
+                      endpoint: yield* metricsEndpoint,
+                      dataset: yield* metricsDataset,
+                    }
+                  : undefined
+            : undefined;
+
+        if (otlp) {
+          const tokenRaw = yield* tokenValue.pipe(Effect.map(Redacted.value));
+          const token = Redacted.isRedacted(tokenRaw)
+            ? Redacted.value(tokenRaw)
+            : (tokenRaw as string);
+
+          const body = yield* request.arrayBuffer;
+
+          const response = yield* Effect.tryPromise({
+            try: () =>
+              fetch(otlp.endpoint, {
+                method: "POST",
+                headers: {
+                  "content-type":
+                    request.headers["content-type"] ?? "application/json",
+                  authorization: `Bearer ${token}`,
+                  "x-axiom-dataset": otlp.dataset,
+                },
+                body,
+              }),
+            catch: (e) => (e instanceof Error ? e : new Error(String(e))),
+          });
+
+          return HttpServerResponse.fromWeb(response);
+        }
+
+        // 2. Everything else → PostHog Cloud (US region)
+        // /static/* and /array/* live on the assets host; everything else on the
+        // ingest host. Static assets are cacheable at the edge.
+        const isAsset =
+          path.startsWith("/static/") || path.startsWith("/array/");
+        const upstreamHost = isAsset
+          ? "https://us-assets.i.posthog.com"
+          : "https://us.i.posthog.com";
+        const target = `${upstreamHost}${path}${url.search}`;
+
+        const raw = yield* HttpServerRequest.toWeb(request);
+
+        // Drop hop-by-hop / Cloudflare-internal headers; preserve everything
+        // else (content-type, accept, user-agent, x-forwarded-for, etc.).
+        const headers = new Headers(raw.headers);
+        headers.delete("host");
+        headers.delete("cookie");
+        for (const key of [...headers.keys()]) {
+          if (key.startsWith("cf-")) headers.delete(key);
+        }
+        const cfIp =
+          raw.headers.get("cf-connecting-ip") ??
+          raw.headers.get("x-real-ip") ??
+          undefined;
+        if (cfIp) headers.set("x-forwarded-for", cfIp);
+
+        const upstream = yield* Effect.tryPromise({
+          try: () =>
+            fetch(target, {
+              method: raw.method,
+              headers,
+              body:
+                raw.method === "GET" || raw.method === "HEAD" ? null : raw.body,
+              redirect: "manual",
+              ...(isAsset
+                ? // Cache the SDK loader / array bundles at the edge for an hour.
+                  ({ cf: { cacheTtl: 3600, cacheEverything: true } } as any)
+                : {}),
+            }),
+          catch: (e) => (e instanceof Error ? e : new Error(String(e))),
+        });
+
+        return HttpServerResponse.fromWeb(upstream);
+      }).pipe(
+        Effect.catch((err) =>
+          Effect.succeed(
+            HttpServerResponse.text(`Relay error: ${err.message}`, {
+              status: 502,
+            }),
+          ),
+        ),
+      ),
+    };
+  }),
+) {}
diff --git a/.repos/alchemy-effect/stacks/otel/Views.ts b/.repos/alchemy-effect/stacks/otel/Views.ts
new file mode 100644
index 00000000000..f91d0571387
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/otel/Views.ts
@@ -0,0 +1,186 @@
+import * as Alchemy from "alchemy";
+import * as Axiom from "alchemy/Axiom";
+import * as Output from "alchemy/Output";
+import { Effect } from "effect";
+import { Traces } from "./Datasets.ts";
+
+/**
+ * Saved Axiom views (APL queries) for the alchemy CLI's OTEL signals.
+ *
+ * All views target `${stage}-traces`. Axiom's metrics datasets cannot be
+ * queried via APL ("Please use the builder to query metrics datasets"),
+ * but every metric we emit has an equivalent span — `cli.<command>` for
+ * invocations, `provider.<op>` for resource lifecycle ops with
+ * `duration` for latency and `error` for status — so we derive
+ * everything from traces.
+ *
+ * Each view's `datasets` entry references `traces.name` (an Output) rather
+ * than a literal `${stage}-traces` string so Alchemy sequences view creation
+ * after the dataset exists. Without this, Axiom rejects the view with
+ * `BadRequest: failed to validate view: entity not found`.
+ *
+ * Attribute paths:
+ * - Resource attributes (per-process, set on `OtlpTracer.resource`):
+ *   `['resource.custom']['alchemy.user.id']`,
+ *   `['resource.custom']['alchemy.version']`, …
+ * - Span attributes (per-span, set on `Effect.withSpan(... { attributes })`):
+ *   `['attributes.custom']['alchemy.resource.type']`,
+ *   `['attributes.custom']['alchemy.resource.op']`, …
+ *
+ * `error` (bool) and `status.code` are first-class span fields.
+ */
+
+const viewProps = <A>(
+  fn: (ctx: { stage: string; traces: Output.Output<string> }) => A,
+) =>
+  Effect.all([Alchemy.Stack, Traces]).pipe(
+    Effect.map(([stack, traces]) =>
+      fn({ stage: stack.stage, traces: traces.name }),
+    ),
+  );
+
+export const ActiveUsersHourly = Axiom.View(
+  "ActiveUsersHourly",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-active-users-hourly`,
+    description: "Distinct alchemy.user.id per hour, last 7d",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | extend uid=tostring(['resource.custom']['alchemy.user.id'])
+      | summarize users=dcount(uid) by bin(_time, 1h)
+      | order by _time asc
+    `,
+  })),
+);
+
+export const ActiveUsersByVersion = Axiom.View(
+  "ActiveUsersByVersion",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-active-users-by-version`,
+    description: "Distinct users grouped by alchemy.version (last 7d)",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | extend uid=tostring(['resource.custom']['alchemy.user.id']),
+               version=tostring(['resource.custom']['alchemy.version'])
+      | summarize users=dcount(uid) by version
+      | order by users desc
+    `,
+  })),
+);
+
+export const ActiveUsersByCi = Axiom.View(
+  "ActiveUsersByCi",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-active-users-by-ci`,
+    description: "CI vs local users (last 7d)",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | extend uid=tostring(['resource.custom']['alchemy.user.id']),
+               ci=tostring(['resource.custom']['alchemy.ci'])
+      | summarize users=dcount(uid) by ci
+    `,
+  })),
+);
+
+export const ResourcesUsed = Axiom.View(
+  "ResourcesUsed",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-resources-used`,
+    description: "Top resource types by lifecycle op count (last 7d)",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | where name startswith "provider."
+      | extend rt=tostring(['attributes.custom']['alchemy.resource.type']),
+               op=tostring(['attributes.custom']['alchemy.resource.op'])
+      | summarize ops=count() by rt, op
+      | order by ops desc
+    `,
+  })),
+);
+
+export const DeployDestroyLatency = Axiom.View(
+  "DeployDestroyLatency",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-deploy-destroy-latency`,
+    description: "p50/p95/p99 of cli.deploy and cli.destroy spans",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | where name in ("cli.deploy", "cli.destroy")
+      | summarize p50=percentile(duration, 50),
+                  p95=percentile(duration, 95),
+                  p99=percentile(duration, 99)
+          by name, bin(_time, 1h)
+      | order by _time asc
+    `,
+  })),
+);
+
+export const ResourceLatency = Axiom.View(
+  "ResourceLatency",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-resource-latency`,
+    description:
+      "p50/p95 of provider.<op> spans by resource_type and op (last 7d)",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | where name startswith "provider."
+      | extend rt=tostring(['attributes.custom']['alchemy.resource.type']),
+               op=tostring(['attributes.custom']['alchemy.resource.op'])
+      | summarize p50=percentile(duration, 50),
+                  p95=percentile(duration, 95),
+                  count=count()
+          by rt, op
+      | order by p95 desc
+    `,
+  })),
+);
+
+export const CliInvocations = Axiom.View(
+  "CliInvocations",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-cli-invocations`,
+    description:
+      "cli.<command> span counts grouped by command and success/error",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | where name startswith "cli."
+      | extend command=extract("cli\\\\.(.+)", 1, name),
+               status=iff(tobool(['error']), "error", "success")
+      | summarize count=count() by command, status, bin(_time, 1h)
+      | order by _time asc
+    `,
+  })),
+);
+
+export const ResourceErrorRate = Axiom.View(
+  "ResourceErrorRate",
+  viewProps(({ stage, traces }) => ({
+    name: `${stage}-resource-error-rate`,
+    description:
+      "provider.<op> spans split by status (success vs error) per hour",
+    datasets: [traces],
+    aplQuery: `
+      ['${stage}-traces']
+      | where _time > ago(7d)
+      | where name startswith "provider."
+      | extend rt=tostring(['attributes.custom']['alchemy.resource.type']),
+               status=iff(tobool(['error']), "error", "success")
+      | summarize total=count() by rt, status, bin(_time, 1h)
+      | order by _time asc
+    `,
+  })),
+);
diff --git a/.repos/alchemy-effect/stacks/pr-package.ts b/.repos/alchemy-effect/stacks/pr-package.ts
new file mode 100644
index 00000000000..16bb9c463e1
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/pr-package.ts
@@ -0,0 +1,21 @@
+import * as PrPackage from "@alchemy.run/pr-package";
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Api from "./pr-package/Api.ts";
+
+export default Alchemy.Stack(
+  "PrPackage",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const authToken = yield* PrPackage.AuthTokenValue;
+    const api = yield* Api;
+    return {
+      url: api.url.as<string>(),
+      authToken: authToken.text,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/stacks/pr-package/Api.ts b/.repos/alchemy-effect/stacks/pr-package/Api.ts
new file mode 100644
index 00000000000..ac32ff777ce
--- /dev/null
+++ b/.repos/alchemy-effect/stacks/pr-package/Api.ts
@@ -0,0 +1,57 @@
+import * as PrPackage from "@alchemy.run/pr-package";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Stack } from "alchemy/Stack";
+
+export const ALCHEMY_HOSTS = [
+  "pkg.alchemy.run",
+  "xn--cu8h.alchemy.run", // 📦.alchemy.run
+];
+
+export const DISTILLED_HOSTS = [
+  "pkg.distilled.cloud",
+  "xn--cu8h.distilled.cloud", // 📦.distilled.cloud
+];
+
+const parseAliasUrl: PrPackage.ParseAliasUrl = (url) => {
+  const segments = url.pathname
+    .split("/")
+    .filter(Boolean)
+    .map((s) => {
+      try {
+        return decodeURIComponent(s);
+      } catch {
+        return s;
+      }
+    });
+
+  if (url.hostname === "pkg.ing" || ALCHEMY_HOSTS.includes(url.hostname)) {
+    if (segments.length === 2) {
+      return { pkgName: segments[0]!, tag: segments[1]! };
+    }
+    if (segments.length === 3 && segments[0]!.startsWith("@")) {
+      return { pkgName: `${segments[0]!}/${segments[1]!}`, tag: segments[2]! };
+    }
+  } else if (DISTILLED_HOSTS.includes(url.hostname)) {
+    if (segments.length === 2) {
+      return { pkgName: `@distilled.cloud/${segments[0]!}`, tag: segments[1]! };
+    }
+  }
+  return null;
+};
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "PrPackageWorker",
+  Stack.useSync(({ stage }) => ({
+    main: import.meta.filename,
+    url: true,
+    domain:
+      stage === "prod"
+        ? ["pkg.ing", ...ALCHEMY_HOSTS, ...DISTILLED_HOSTS]
+        : undefined,
+    compatibility: {
+      flags: ["nodejs_compat"],
+      date: "2026-03-17",
+    },
+  })),
+  PrPackage.handler({ parseAliasUrl }),
+) {}
diff --git a/.repos/alchemy-effect/test/smoke.test.ts b/.repos/alchemy-effect/test/smoke.test.ts
new file mode 100644
index 00000000000..6837ee69e22
--- /dev/null
+++ b/.repos/alchemy-effect/test/smoke.test.ts
@@ -0,0 +1,685 @@
+/**
+ * Smoke test suite that exercises `alchemy destroy → deploy → destroy` in each
+ * example directory with both `bun` and `pnpm`. Commands run in-place against
+ * whatever is currently installed in the workspace; stdio is inherited so
+ * output streams directly to the terminal.
+ *
+ * Modes:
+ *   default              → test against the workspace `workspace:*` deps as-is
+ *   SMOKE_CANARY=1       → pack + publish alchemy / better-auth / pr-package
+ *                          tarballs to pkg.ing under a fresh tag, add the
+ *                          pkg.ing URLs to the root workspace catalog, rewrite
+ *                          each example's `workspace:*` refs to `catalog:`,
+ *                          run a single root install, then `git checkout` the
+ *                          mutated package.json files and reinstall once on
+ *                          the way out.
+ *
+ * Env vars:
+ *   SMOKE_RUNTIME    `bun` or `pnpm`                        (default: "bun")
+ *   SMOKE_CANARY     "1" to enable canary mode              (default: off)
+ *   SMOKE_STAGE      stage prefix, e.g. `pr-123` or `main`  (default: "smoke")
+ *   PKGING_HOST      pkg.ing host                           (default: pkg.ing)
+ *
+ * Run with: `bun test ./test/smoke.test.ts`.
+ */
+import { $ } from "bun";
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+
+const ROOT = path.resolve(import.meta.dir, "..");
+const TIMEOUT = 10 * 60 * 1000;
+
+const examples = [
+  "aws-lambda",
+  "aws-lambda-httpapi",
+  "aws-lambda-rpc",
+  "cloudflare-git-artifacts",
+  "cloudflare-neon-drizzle",
+  "cloudflare-secrets-store",
+  "cloudflare-tanstack",
+  "cloudflare-vue",
+  // "cloudflare-solidstart",
+  // "cloudflare-solidjs-ssr",
+  "cloudflare-worker-async",
+  "cloudflare-worker",
+];
+const ALL_RUNTIMES = ["bun", "pnpm"] as const;
+type Runtime = (typeof ALL_RUNTIMES)[number];
+
+// `SMOKE_RUNTIME` is the CI escape hatch — the matrix workflow runs one
+// job per runtime so each can do its own `<runtime> install` and isolate
+// from the other. Unset locally, the test runs both runtimes against
+// each example with `bun` going first so it doesn't race `pnpm` on
+// shared build outputs (vite `dist/`, `.alchemy/`).
+const RUNTIMES: readonly Runtime[] = (() => {
+  const filter = process.env.SMOKE_RUNTIME?.trim();
+  if (!filter) return ALL_RUNTIMES;
+  if (filter !== "bun" && filter !== "pnpm") {
+    throw new Error(`SMOKE_RUNTIME must be "bun" or "pnpm" (got: ${filter})`);
+  }
+  return [filter];
+})();
+
+const PUBLISHED = [
+  { dir: "alchemy", name: "alchemy" },
+  { dir: "better-auth", name: "@alchemy.run/better-auth" },
+  { dir: "pr-package", name: "@alchemy.run/pr-package" },
+] as const;
+
+const canary = process.env.SMOKE_CANARY === "1";
+const host = process.env.PKGING_HOST ?? "pkg.ing";
+
+async function run(
+  cmd: string[] | readonly string[],
+  cwd: string,
+  env?: Record<string, string>,
+): Promise<number> {
+  const proc = Bun.spawn([...cmd], {
+    cwd,
+    stdout: "inherit",
+    stderr: "inherit",
+    env: { ...process.env, ALCHEMY_NO_TUI: "1", ...env },
+  });
+  return await proc.exited;
+}
+
+// Install every active runtime so each runtime's exec works against a
+// node_modules layout it understands. Bun runs first because it writes
+// the flat layout; pnpm 11 then layers its `.pnpm` virtual store on top
+// so `pnpm exec` doesn't trip its implicit `runDepsStatusCheck` install
+// inside an example directory at test time. When `SMOKE_RUNTIME` pins a
+// single runtime, only that one installs.
+//
+// Canary mode mutates example package.json files at runtime, so the
+// lockfile is intentionally stale during the run — `--no-frozen-lockfile`
+// lets the install resolve the new `catalog:` refs. CI defaults pnpm to
+// frozen-lockfile, which would otherwise fail with ERR_PNPM_OUTDATED_LOCKFILE.
+//
+// `Bun.spawn` has no TTY, so pnpm 11 aborts non-interactive `node_modules`
+// removal with `ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY` unless we set
+// `CI=1`. Only forwarded to pnpm — alchemy's `loadFromEnv` short-circuits
+// to env-only credentials when `CI=true`, which would break local runs
+// that rely on the AWS SDK credential chain.
+type InstallStep = { cmd: readonly string[]; env?: Record<string, string> };
+const installCmds = (): readonly InstallStep[] => {
+  const cmds: InstallStep[] = [];
+  if (RUNTIMES.includes("bun")) {
+    cmds.push({ cmd: ["bun", "install", "--no-frozen-lockfile"] });
+  }
+  if (RUNTIMES.includes("pnpm")) {
+    cmds.push({
+      cmd: ["pnpm", "install", "--no-frozen-lockfile"],
+      env: { CI: "1" },
+    });
+  }
+  return cmds;
+};
+
+const installAll = async (): Promise<void> => {
+  for (const { cmd, env } of installCmds()) {
+    expect(await run(cmd, ROOT, env)).toBe(0);
+  }
+};
+
+const ROOT_PKG_PATH = path.join(ROOT, "package.json");
+const examplePkgPath = (e: string) =>
+  path.join(ROOT, "examples", e, "package.json");
+
+type Pkg = {
+  workspaces?: { catalog?: Record<string, string> };
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+};
+
+const readJson = async <T>(p: string): Promise<T> =>
+  JSON.parse(await fs.readFile(p, "utf8")) as T;
+const writeJson = async (p: string, v: unknown) =>
+  fs.writeFile(p, `${JSON.stringify(v, null, 2)}\n`);
+
+const PNPM_WORKSPACE_PATH = path.join(ROOT, "pnpm-workspace.yaml");
+
+/**
+ * pnpm 11 runs an implicit `runDepsStatusCheck` before every `pnpm exec`,
+ * which performs a hidden `pnpm install`. Bun's catalog config lives in
+ * `package.json#workspaces.catalog` — pnpm doesn't read it. So we mirror
+ * the bun catalog (and workspaces list) into a `pnpm-workspace.yaml` for
+ * the duration of the suite. Generated, never checked in; cleaned up in
+ * `afterAll` and on SIGINT/SIGTERM.
+ *
+ * Delegates to `scripts/pnpm-workspace.ts` so the file shape (pinned
+ * catalog versions resolved from `bun.lock`, build-script allowlist) is
+ * identical to what CI's pre-`pnpm install` step writes — otherwise the
+ * smoke test would clobber CI's pinned catalogs with loose ranges and
+ * trip `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` on every per-example install.
+ */
+const writePnpmWorkspace = async () => {
+  const code = await run(
+    ["bun", path.join(ROOT, "scripts", "pnpm-workspace.ts")],
+    ROOT,
+  );
+  if (code !== 0) {
+    throw new Error(`scripts/pnpm-workspace.ts exited with code ${code}`);
+  }
+};
+
+const removePnpmWorkspace = async () => {
+  const code = await run(
+    ["bun", path.join(ROOT, "scripts", "pnpm-workspace.ts"), "--remove"],
+    ROOT,
+  );
+  if (code !== 0) {
+    // Best-effort — never fail teardown over a missing file.
+    await fs.rm(PNPM_WORKSPACE_PATH, { force: true });
+  }
+};
+
+if (canary) {
+  beforeAll(async () => {
+    // CI passes PR_PACKAGE_TOKEN directly via env (matches pr-package.yaml);
+    // locally we fall back to `doppler` so contributors don't have to export
+    // the secret manually. Either path works.
+    let token = process.env.PR_PACKAGE_TOKEN?.trim() ?? "";
+    if (!token) {
+      try {
+        token = (
+          await $`doppler secrets get PR_PACKAGE_TOKEN --plain -p alchemy-v2 -c dev`
+            .quiet()
+            .text()
+        ).trim();
+      } catch {
+        // doppler not installed / not authed — leave token empty, error below
+      }
+    }
+    if (!token) {
+      throw new Error(
+        "PR_PACKAGE_TOKEN is not set in env and `doppler -p alchemy-v2 -c dev` did not return one. " +
+          "Either export PR_PACKAGE_TOKEN, run `bun download:env`, or invoke via `doppler run`.",
+      );
+    }
+
+    const sha = (await $`git rev-parse HEAD`.quiet().text()).trim().slice(0, 7);
+    const stamp = new Date()
+      .toISOString()
+      .replace(/[-:T]/g, "")
+      .replace(/\..*/, "");
+    const tag = `canary-${sha}-${stamp}`;
+    const tags = JSON.stringify([tag, "canary"]);
+    console.log(`→ canary tag: ${tag} (host=${host})`);
+
+    expect(await run(["bun", "run", "build:packages"], ROOT)).toBe(0);
+
+    for (const { dir, name } of PUBLISHED) {
+      const pkgDir = path.join(ROOT, "packages", dir);
+      for (const f of await fs.readdir(pkgDir)) {
+        if (f.endsWith(".tgz")) await fs.rm(path.join(pkgDir, f));
+      }
+      expect(
+        await run(["bun", "pm", "pack", "--destination", "."], pkgDir),
+      ).toBe(0);
+      const tgz = (await fs.readdir(pkgDir)).find((f) => f.endsWith(".tgz"));
+      if (!tgz) throw new Error(`no tgz produced in ${pkgDir}`);
+      const abs = path.join(pkgDir, tgz);
+      console.log(`→ publish ${name} (${tgz})`);
+      const res = await fetch(`https://${host}/projects/${name}/packages`, {
+        method: "PUT",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "X-Tags": tags,
+          "X-TTL": "1 hour",
+          "Content-Type": "application/gzip",
+        },
+        body: Bun.file(abs),
+      });
+      if (!res.ok) {
+        throw new Error(
+          `publish ${name} failed: ${res.status} ${res.statusText}\n${await res.text()}`,
+        );
+      }
+    }
+
+    // Add the canary tarball URLs to the root catalog and rewrite each
+    // example's `workspace:*` ref for a published package to `catalog:`.
+    // One install at the root then resolves every example at once — much
+    // faster than `<runtime> add` per (example × published package).
+    const rootPkg = await readJson<Pkg>(ROOT_PKG_PATH);
+    rootPkg.workspaces ??= {};
+    rootPkg.workspaces.catalog ??= {};
+    for (const { name } of PUBLISHED) {
+      rootPkg.workspaces.catalog[name] = `https://${host}/${name}/${tag}`;
+    }
+    await writeJson(ROOT_PKG_PATH, rootPkg);
+
+    for (const example of examples) {
+      const p = examplePkgPath(example);
+      const pkg = await readJson<Pkg>(p);
+      let mutated = false;
+      for (const k of ["dependencies", "devDependencies"] as const) {
+        const deps = pkg[k];
+        if (!deps) continue;
+        for (const [n, v] of Object.entries(deps)) {
+          if (v === "workspace:*" && PUBLISHED.some((pp) => pp.name === n)) {
+            deps[n] = "catalog:";
+            mutated = true;
+          }
+        }
+      }
+      if (mutated) await writeJson(p, pkg);
+    }
+
+    // Mirror the new catalog entries into pnpm-workspace.yaml so the
+    // pnpm leg sees them too.
+    await writePnpmWorkspace();
+
+    await installAll();
+  }, TIMEOUT);
+}
+
+/**
+ * Restore the root + example package.json files via `git checkout` and
+ * reinstall once. No-op when nothing has been mutated (non-canary mode).
+ */
+const restoreWorkspaceDeps = async () => {
+  if (!canary) return;
+  const paths = [ROOT_PKG_PATH, ...examples.map(examplePkgPath)];
+  await run(["git", "checkout", "--", ...paths], ROOT);
+  await writePnpmWorkspace();
+  for (const { cmd, env } of installCmds()) {
+    await run(cmd, ROOT, env);
+  }
+};
+
+// Always-on setup: write `pnpm-workspace.yaml` mirroring bun's catalog so
+// `pnpm exec` works in CI (pnpm 11's deps-status check otherwise fails on
+// `catalog:` deps it doesn't know about).
+beforeAll(writePnpmWorkspace, TIMEOUT);
+
+// Always restore + clean up on a normal end-of-suite, regardless of canary
+// mode.
+afterAll(async () => {
+  await restoreWorkspaceDeps();
+  await removePnpmWorkspace();
+}, TIMEOUT);
+
+// Also restore + clean up if the suite is interrupted (Ctrl+C / SIGTERM).
+let restoring = false;
+for (const sig of ["SIGINT", "SIGTERM"] as const) {
+  process.on(sig, () => {
+    if (restoring) return;
+    restoring = true;
+    Promise.allSettled([restoreWorkspaceDeps(), removePnpmWorkspace()])
+      .catch((err) => console.error("teardown failed:", err))
+      .finally(() => process.exit(130));
+  });
+}
+
+// One `test.concurrent` per (example, runtime) so failures point at the
+// specific runtime that broke. Examples run in parallel, but within a
+// single example the runtimes are chained on a per-example promise so bun
+// finishes its destroy → deploy → destroy before pnpm starts in the same
+// directory (otherwise both runs race on shared build outputs like
+// vite's `dist/` and `.alchemy/`).
+// ────────────────────────────────────────────────────────────────────────
+// Monorepo smoke tests
+//
+// The monorepo examples (`monorepo-single-stack`, `monorepo-multi-stack`)
+// can't be tested in-place like the flat examples above — they ship with
+// a `_package.json` instead of `package.json` so the root workspace
+// install doesn't try to wire them in as nested workspaces with their
+// own `workspace:*` graphs.
+//
+// For each (monorepo, runtime) pair we:
+//   1. `bun pm pack` `packages/alchemy` once → tarball
+//   2. copy the example to a fresh temp dir (skipping build artifacts)
+//   3. rename `_package.json` → `package.json`
+//   4. rewrite every `alchemy: workspace:*` ref to `file:<tarball>`
+//      and substitute `catalog:` refs against the root catalog
+//   5. write `pnpm-workspace.yaml` when running under pnpm
+//   6. install with the runtime, then run destroy → deploy → destroy
+//
+// `monorepo-single-stack` has one `alchemy.run.ts` at the root.
+// `monorepo-multi-stack` has one per package; deploy backend → frontend,
+// destroy frontend → backend.
+// ────────────────────────────────────────────────────────────────────────
+
+type Monorepo = {
+  name: "monorepo-single-stack" | "monorepo-multi-stack";
+  // The directories (relative to the monorepo root) where `alchemy
+  // {deploy,destroy}` must run, in deploy order. Destroy runs in
+  // reverse.
+  deployDirs: readonly string[];
+};
+
+const monorepos: readonly Monorepo[] = [
+  { name: "monorepo-single-stack", deployDirs: ["."] },
+  { name: "monorepo-multi-stack", deployDirs: ["backend", "frontend"] },
+];
+
+let alchemyTarball: string | undefined;
+
+beforeAll(async () => {
+  const pkgDir = path.join(ROOT, "packages", "alchemy");
+  for (const f of await fs.readdir(pkgDir)) {
+    if (f.endsWith(".tgz")) await fs.rm(path.join(pkgDir, f));
+  }
+  // pnpm resolves `alchemy` via `lib/` (node import condition) so it
+  // must reflect current `src/`; bun pm pack does not run a build.
+  expect(await run(["bun", "run", "build"], pkgDir)).toBe(0);
+  expect(await run(["bun", "pm", "pack", "--destination", "."], pkgDir)).toBe(
+    0,
+  );
+  const tgz = (await fs.readdir(pkgDir)).find((f) => f.endsWith(".tgz"));
+  if (!tgz) throw new Error(`bun pm pack produced no tarball in ${pkgDir}`);
+  alchemyTarball = path.join(pkgDir, tgz);
+}, TIMEOUT);
+
+const SKIP_COPY = new Set([
+  "node_modules",
+  "dist",
+  ".alchemy",
+  ".turbo",
+  ".wrangler",
+  "tsconfig.tsbuildinfo",
+]);
+
+const copyMonorepo = async (src: string, dst: string): Promise<void> => {
+  await fs.mkdir(dst, { recursive: true });
+  for (const entry of await fs.readdir(src, { withFileTypes: true })) {
+    if (SKIP_COPY.has(entry.name)) continue;
+    const s = path.join(src, entry.name);
+    const d = path.join(dst, entry.name);
+    if (entry.isDirectory()) {
+      await copyMonorepo(s, d);
+    } else if (entry.isSymbolicLink()) {
+      // Skip — likely a workspace symlink that won't exist in the copy.
+    } else {
+      await fs.copyFile(s, d);
+    }
+  }
+};
+
+const PUBLISHED_NAMES = new Set<string>(PUBLISHED.map((p) => p.name));
+
+const resolveCatalog = (rootCatalog: Record<string, string>) => {
+  return (deps: Record<string, string> | undefined): boolean => {
+    if (!deps) return false;
+    let mutated = false;
+    for (const [name, version] of Object.entries(deps)) {
+      const isPublished = PUBLISHED_NAMES.has(name);
+      if (
+        isPublished &&
+        (version === "workspace:*" || version === "catalog:")
+      ) {
+        // In canary mode the root catalog has been rewritten with
+        // pkg.ing URLs (see canary `beforeAll`); resolve through it
+        // so the monorepo install actually exercises the canary
+        // install path. Otherwise fall back to the locally-packed
+        // tarball for `alchemy` so monorepos still test against the
+        // workspace's current source on a non-canary run.
+        const fromCatalog = rootCatalog[name];
+        if (canary && fromCatalog) {
+          deps[name] = fromCatalog;
+        } else if (name === "alchemy") {
+          if (!alchemyTarball) throw new Error("alchemy tarball not built");
+          deps[name] = `file:${alchemyTarball}`;
+        } else {
+          throw new Error(
+            `dependency ${name} is "${version}" but no entry in root catalog (canary=${canary})`,
+          );
+        }
+        mutated = true;
+      } else if (version === "catalog:") {
+        const resolved = rootCatalog[name];
+        if (!resolved) {
+          throw new Error(
+            `dependency ${name} is "catalog:" but no entry in root catalog`,
+          );
+        }
+        deps[name] = resolved;
+        mutated = true;
+      }
+    }
+    return mutated;
+  };
+};
+
+const rewritePackageJson = async (
+  pkgPath: string,
+  resolve: (deps: Record<string, string> | undefined) => boolean,
+): Promise<void> => {
+  const pkg = await readJson<
+    Pkg & { peerDependencies?: Record<string, string> }
+  >(pkgPath);
+  const a = resolve(pkg.dependencies);
+  const b = resolve(pkg.devDependencies);
+  const c = resolve(pkg.peerDependencies);
+  if (a || b || c) await writeJson(pkgPath, pkg);
+};
+
+const setupMonorepo = async (
+  m: Monorepo,
+  runtime: Runtime,
+): Promise<string> => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), `alchemy-${m.name}-`));
+  const dst = path.join(tmp, m.name);
+  await copyMonorepo(path.join(ROOT, "examples", m.name), dst);
+
+  // _package.json → package.json at root
+  const tmpRootPkg = path.join(dst, "_package.json");
+  const finalRootPkg = path.join(dst, "package.json");
+  await fs.rename(tmpRootPkg, finalRootPkg);
+
+  // Resolve `catalog:` refs using the example's own catalog first (it's
+  // the source of truth — `examples/monorepo-*/_package.json#workspaces.catalog`),
+  // falling back to the repo-root catalog for anything the example doesn't
+  // pin. Drop the example's `alchemy` catalog entry — it points at
+  // `file:../packages/alchemy` which doesn't exist in the temp checkout.
+  // `resolveCatalog` then rewrites `alchemy` (and other PUBLISHED refs)
+  // to either the canary pkg.ing URL (canary mode) or the locally-packed
+  // tarball (default).
+  const rootPkg = await readJson<Pkg>(ROOT_PKG_PATH);
+  const rootCatalog = rootPkg.workspaces?.catalog ?? {};
+  const copyRootPkg = await readJson<Pkg>(finalRootPkg);
+  const exampleCatalog = copyRootPkg.workspaces?.catalog ?? {};
+  delete exampleCatalog.alchemy;
+  if (copyRootPkg.workspaces) {
+    copyRootPkg.workspaces.catalog = exampleCatalog;
+    await writeJson(finalRootPkg, copyRootPkg);
+  }
+  const mergedCatalog: Record<string, string> = {
+    ...rootCatalog,
+    ...exampleCatalog,
+  };
+  const resolve = resolveCatalog(mergedCatalog);
+
+  // Root may declare deps too (single-stack runs `alchemy` from the
+  // root, so it needs `node_modules/.bin/alchemy` hoisted there).
+  await rewritePackageJson(finalRootPkg, resolve);
+  for (const sub of ["backend", "frontend"] as const) {
+    await rewritePackageJson(path.join(dst, sub, "package.json"), resolve);
+  }
+
+  if (runtime === "pnpm") {
+    // Mirror scripts/pnpm-workspace.ts — pnpm 11 fails install
+    // (`ERR_PNPM_IGNORED_BUILDS`) on `workerd` / `msgpackr-extract` /
+    // `esbuild` / `sharp` unless their build scripts are explicitly
+    // allowlisted.
+    const builds = [
+      "@parcel/watcher",
+      "esbuild",
+      "msgpackr-extract",
+      "sharp",
+      "workerd",
+    ];
+    const yaml = [
+      "onlyBuiltDependencies:",
+      ...builds.map((n) => `  - ${JSON.stringify(n)}`),
+      "",
+      "allowBuilds:",
+      ...builds.map((n) => `  ${JSON.stringify(n)}: true`),
+      "",
+      "packages:",
+      "  - backend",
+      "  - frontend",
+      "",
+    ].join("\n");
+    await fs.writeFile(path.join(dst, "pnpm-workspace.yaml"), yaml);
+  }
+
+  expect(
+    await run(
+      runtime === "bun"
+        ? ["bun", "install"]
+        : ["pnpm", "install", "--no-frozen-lockfile"],
+      dst,
+    ),
+  ).toBe(0);
+
+  // The frontend's Vite build resolves the backend via its `import`
+  // condition (`./lib/*.js`), so the workspace must be compiled
+  // (`tsc -b` at the root walks the project references) before any
+  // deploy runs.
+  expect(
+    await run(
+      runtime === "bun" ? ["bun", "run", "build"] : ["pnpm", "run", "build"],
+      dst,
+    ),
+  ).toBe(0);
+
+  return dst;
+};
+
+for (const m of monorepos) {
+  let prev: Promise<unknown> = Promise.resolve();
+  for (const runtime of RUNTIMES) {
+    const stagePrefix = (process.env.SMOKE_STAGE ?? "smoke")
+      .replace(/[^a-zA-Z0-9-]/g, "-")
+      .toLowerCase();
+    const stage = `${stagePrefix}-${runtime}-${m.name}`
+      .replace(/[^a-zA-Z0-9-]/g, "-")
+      .toLowerCase();
+    const cmd = (action: "destroy" | "deploy") =>
+      runtime === "bun"
+        ? ["bun", "alchemy", action, "--stage", stage, "--yes"]
+        : ["pnpm", "exec", "alchemy", action, "--stage", stage, "--yes"];
+
+    const myPrev = prev;
+    let release!: () => void;
+    prev = new Promise<void>((r) => {
+      release = r;
+    });
+
+    test.concurrent(
+      `${m.name} (${runtime}): destroy → deploy → destroy`,
+      async () => {
+        await myPrev.catch(() => {});
+        const dst = await setupMonorepo(m, runtime);
+        try {
+          const deployOrder = m.deployDirs.map((d) => path.join(dst, d));
+          const destroyOrder = [...deployOrder].reverse();
+          for (const d of destroyOrder) {
+            expect(await run(cmd("destroy"), d)).toBe(0);
+          }
+          for (const d of deployOrder) {
+            expect(await run(cmd("deploy"), d)).toBe(0);
+          }
+          for (const d of destroyOrder) {
+            expect(await run(cmd("destroy"), d)).toBe(0);
+          }
+        } finally {
+          release();
+          // Best-effort cleanup of the temp checkout; leave it on
+          // failure so a developer can inspect.
+          await fs.rm(path.dirname(dst), { recursive: true, force: true });
+        }
+      },
+      TIMEOUT,
+    );
+  }
+}
+
+// Some examples model the production "shared infra + per-PR compute"
+// pattern via cross-stage references (e.g. `cloudflare-neon-drizzle`
+// has a `pr-*` stage that references a long-lived `staging-*` stage
+// owning the Neon project). To keep tests isolated from one another,
+// each test owns *both* stages — `staging-${stage}` is deployed first,
+// then the main stage, then both are torn down in reverse order so the
+// dependency edge (pr → staging) is respected.
+//
+// We only set up the pre-stage when the main stage starts with `pr-`,
+// because that's the only branch in the example that crosses stages.
+// Local `smoke-*` and `dev_<user>` stages just stand up their own
+// project inline and don't need the pre-stage.
+const PRE_DEPLOY_STAGES: Record<string, (stage: string) => string[]> = {
+  "cloudflare-neon-drizzle": (stage) =>
+    stage.startsWith("pr-") ? [`staging-${stage}`] : [],
+};
+
+for (const example of examples) {
+  const cwd = path.join(ROOT, "examples", example);
+  let prev: Promise<unknown> = Promise.resolve();
+  for (const runtime of RUNTIMES) {
+    // Prefix the stage with $SMOKE_STAGE when provided so PR runs
+    // (`pr-<n>-…`) and main runs (`main-…`) never collide on the same
+    // cloud resource. Locally falls back to a fixed `smoke` prefix.
+    const stagePrefix = (process.env.SMOKE_STAGE ?? "smoke")
+      .replace(/[^a-zA-Z0-9-]/g, "-")
+      .toLowerCase();
+    const stage = `${stagePrefix}-${runtime}-${example}`
+      .replace(/[^a-zA-Z0-9-]/g, "-")
+      .toLowerCase();
+    const cmd = (action: "destroy" | "deploy", stageOverride = stage) =>
+      runtime === "bun"
+        ? ["bun", "alchemy", action, "--stage", stageOverride, "--yes"]
+        : [
+            "pnpm",
+            "exec",
+            "alchemy",
+            action,
+            "--stage",
+            stageOverride,
+            "--yes",
+          ];
+    const preStages = PRE_DEPLOY_STAGES[example]?.(stage) ?? [];
+
+    const myPrev = prev;
+    let release!: () => void;
+    prev = new Promise<void>((r) => {
+      release = r;
+    });
+
+    test.concurrent(
+      `${example} (${runtime}): destroy → deploy → destroy`,
+      async () => {
+        // Wait for the previous runtime in this example to release the
+        // shared working directory. `catch(() => {})` so a failed earlier
+        // runtime doesn't cascade-fail every later runtime — the failure
+        // is already attributed to the right test.
+        await myPrev.catch(() => {});
+        try {
+          // Clean up any leftovers across all stages before deploying.
+          // Order: dependents (main) first, dependencies (pre-stages) last.
+          expect(await run(cmd("destroy"), cwd)).toBe(0);
+          for (const s of [...preStages].reverse()) {
+            expect(await run(cmd("destroy", s), cwd)).toBe(0);
+          }
+          // Deploy: pre-stages first (data plane), main last (compute).
+          for (const s of preStages) {
+            expect(await run(cmd("deploy", s), cwd)).toBe(0);
+          }
+          expect(await run(cmd("deploy"), cwd)).toBe(0);
+          // Tear down in reverse so cross-stage refs stay resolvable
+          // until the dependent stage is gone.
+          expect(await run(cmd("destroy"), cwd)).toBe(0);
+          for (const s of [...preStages].reverse()) {
+            expect(await run(cmd("destroy", s), cwd)).toBe(0);
+          }
+        } finally {
+          release();
+        }
+      },
+      TIMEOUT,
+    );
+  }
+}
diff --git a/.repos/alchemy-effect/tsconfig.base.json b/.repos/alchemy-effect/tsconfig.base.json
new file mode 100644
index 00000000000..befa21471a9
--- /dev/null
+++ b/.repos/alchemy-effect/tsconfig.base.json
@@ -0,0 +1,34 @@
+{
+  "exclude": ["node_modules", "dist", "vendor"],
+  "compilerOptions": {
+    "types": ["bun"],
+    // Enable latest features
+    "lib": ["ESNext", "DOM"],
+    "target": "ESNext",
+    "moduleDetection": "force",
+    "jsx": "react-jsx",
+    "allowJs": true,
+    "resolveJsonModule": true,
+    "esModuleInterop": true,
+    "noEmit": true,
+    // Bundler mode
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "allowImportingTsExtensions": true,
+    "rewriteRelativeImportExtensions": true,
+    "verbatimModuleSyntax": true,
+    // Best practices
+    "strict": true,
+    "skipLibCheck": true,
+    "noFallthroughCasesInSwitch": true,
+    // Some stricter flags (disabled by default)
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noPropertyAccessFromIndexSignature": false,
+    "noImplicitThis": true,
+    "sourceMap": true,
+    "declaration": true,
+    "declarationMap": true,
+    "noErrorTruncation": true
+  }
+}
diff --git a/.repos/alchemy-effect/tsconfig.json b/.repos/alchemy-effect/tsconfig.json
new file mode 100644
index 00000000000..abf5f00a2bb
--- /dev/null
+++ b/.repos/alchemy-effect/tsconfig.json
@@ -0,0 +1,99 @@
+{
+  "files": [],
+  "exclude": ["node_modules", "dist"],
+  "references": [
+    {
+      "path": "./tsconfig.scripts.json"
+    },
+    {
+      "path": "./packages/alchemy/tsconfig.json"
+    },
+    {
+      "path": "./packages/alchemy/tsconfig.bin.json"
+    },
+    {
+      "path": "./packages/alchemy/tsconfig.test.json"
+    },
+    {
+      "path": "./packages/better-auth/tsconfig.json"
+    },
+    {
+      "path": "./packages/pr-package/tsconfig.json"
+    },
+    // TODO(sam): fix by upgrading starlight to ^0.39.2
+    // {
+    //   "path": "./website/tsconfig.json"
+    // },
+    {
+      "path": "./examples/aws-ec2/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-ecs/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-eks/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-lambda-httpapi/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-rest-api/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-lambda-rpc/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-lambda/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-rds/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-static-site/tsconfig.json"
+    },
+    {
+      "path": "./examples/aws-vite/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-static-site/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-tanstack/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-worker/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-email/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-neon-drizzle/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-planetscale-mysql-drizzle/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-planetscale-postgres-drizzle/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-secrets-store/tsconfig.json"
+    },
+    {
+      "path": "./examples/cloudflare-worker-async/tsconfig.json"
+    },
+    {
+      "path": "./examples/monorepo-single-stack/tsconfig.json"
+    },
+    {
+      "path": "./examples/monorepo-multi-stack/tsconfig.json"
+    }
+  ],
+  "compilerOptions": {
+    "plugins": [
+      // ... other LSPs (if any) and as last
+      {
+        "name": "@effect/language-service"
+      }
+    ]
+  }
+}
diff --git a/.repos/alchemy-effect/tsconfig.scripts.json b/.repos/alchemy-effect/tsconfig.scripts.json
new file mode 100644
index 00000000000..fae3e389a48
--- /dev/null
+++ b/.repos/alchemy-effect/tsconfig.scripts.json
@@ -0,0 +1,8 @@
+{
+  "extends": "./tsconfig.base.json",
+  "include": ["scripts/**/*.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "types": ["bun", "node"]
+  }
+}
diff --git a/.repos/alchemy-effect/vite.config.ts b/.repos/alchemy-effect/vite.config.ts
new file mode 100644
index 00000000000..4354307a740
--- /dev/null
+++ b/.repos/alchemy-effect/vite.config.ts
@@ -0,0 +1,12 @@
+// vitest.config.ts
+import tsconfigPaths from "vite-tsconfig-paths";
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  plugins: [tsconfigPaths() as any],
+  test: {
+    globals: true,
+    environment: "node", // or 'jsdom' for frontend tests
+    include: ["alchemy/test/**/*.test.ts"],
+  },
+});
diff --git a/.repos/alchemy-effect/vitest.config.ts b/.repos/alchemy-effect/vitest.config.ts
new file mode 100644
index 00000000000..9f2bbe8cad4
--- /dev/null
+++ b/.repos/alchemy-effect/vitest.config.ts
@@ -0,0 +1,78 @@
+import { defineConfig } from "vitest/config";
+import tsconfigPaths from "vite-tsconfig-paths";
+
+const apiGatewayInclude = ["test/AWS/ApiGateway/**/*.test.ts"];
+
+export default defineConfig({
+  plugins: [tsconfigPaths({ projects: ["./tsconfig.test.json"] })],
+  test: {
+    root: "packages/alchemy",
+    testTimeout: 120000,
+    hookTimeout: 120000,
+    passWithNoTests: true,
+    exclude: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/lib/**",
+      "**/.{idea,git,cache,output,temp}/**",
+    ],
+    env: { NODE_ENV: "test" },
+    globals: true,
+    setupFiles: ["test/vitest.setup.ts"],
+    coverage: {
+      provider: "v8",
+      reporter: ["text", "json", "html"],
+      exclude: [
+        ".distilled/**",
+        "coverage/**",
+        "dist/**",
+        "lib/**",
+        "**/node_modules/**",
+        "**/*.test.ts",
+        "**/*.config.*",
+      ],
+    },
+    projects: [
+      {
+        extends: true,
+        test: {
+          name: "alchemy",
+          // Bun's worker_threads segfaults under vitest's "threads" pool
+          // (tinypool) at worker spawn. "forks" uses child_process, which
+          // Bun handles reliably. Tests here are network/IO-bound, so the
+          // per-fork startup cost is negligible.
+          pool: "forks",
+          maxWorkers: 32,
+          sequence: { concurrent: true },
+          include: ["test/**/*.test.ts"],
+          exclude: [
+            "**/node_modules/**",
+            "**/dist/**",
+            "**/lib/**",
+            "**/.{idea,git,cache,output,temp}/**",
+            ...apiGatewayInclude,
+          ],
+        },
+      },
+      {
+        // API Gateway has account-wide throttles that are unworkable under
+        // any concurrency: DeleteRestApi alone allows 1 request per 30s.
+        // Force a single fork, no file parallelism, and sequential tests
+        // within each file so the whole suite runs as a single line of
+        // mutations. Bump timeouts so that retry budgets covering the
+        // throttle window don't blow the default 120s ceiling.
+        extends: true,
+        test: {
+          name: "apigateway",
+          pool: "forks",
+          singleFork: true,
+          fileParallelism: false,
+          sequence: { concurrent: false },
+          testTimeout: 600_000,
+          hookTimeout: 600_000,
+          include: apiGatewayInclude,
+        },
+      },
+    ],
+  },
+});
diff --git a/.repos/alchemy-effect/website/.gitignore b/.repos/alchemy-effect/website/.gitignore
new file mode 100644
index 00000000000..27bf4323eb4
--- /dev/null
+++ b/.repos/alchemy-effect/website/.gitignore
@@ -0,0 +1,12 @@
+.wrangler
+.astro
+node_modules
+.DS_Store
+static/
+# public/
+src/content/docs/providers/
+.link-checker/broken-links.log
+# Brand fonts vendored at build-time by scripts/download-fonts.ts.
+# Cached locally; regenerated by `bun run build` if missing.
+assets/fonts/*.ttf
+assets/fonts/*.otf
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/README.md b/.repos/alchemy-effect/website/README.md
new file mode 100644
index 00000000000..ced167421f9
--- /dev/null
+++ b/.repos/alchemy-effect/website/README.md
@@ -0,0 +1,39 @@
+# Alchemy Effect Website
+
+This workspace contains the customer-facing docs site for Alchemy Effect.
+
+## Build Pipeline
+
+The site is intentionally split into independent steps:
+
+1. `bun run build:reference` generates Zola-compatible API reference pages from the TypeScript source tree.
+2. `bun run build:assets` compiles the shared Tailwind CSS and the custom browser JavaScript bundle.
+3. `bun run build:site` renders the site with Zola.
+4. `bun run build:search` indexes the built HTML with Pagefind.
+5. `alchemy.run.ts` deploys the final `dist/` directory through `Cloudflare.StaticSite(...)`.
+
+This keeps the large markdown corpus on a Rust-first rendering path while still
+allowing a modern custom UI.
+
+## Local Commands
+
+- `bun run build`
+- `bun run dev:site`
+- `bun run deploy`
+- `bun run destroy`
+
+## Benchmark Snapshot
+
+Measured locally on 2026-04-02:
+
+- API reference generation: about `2.2s`
+- Tailwind + browser bundle build: about `0.9s`
+- Zola render: about `0.6s`
+- Pagefind indexing: about `0.3s`
+- Total built files in `dist/`: `693`
+- Total built bytes in `dist/`: `3,120,670`
+- Pagefind files: `350`
+- Pagefind bytes: `633,383`
+
+These numbers should be treated as a baseline for future changes to the docs
+pipeline.
diff --git a/.repos/alchemy-effect/website/alchemy.run.ts b/.repos/alchemy-effect/website/alchemy.run.ts
new file mode 100644
index 00000000000..642acea1257
--- /dev/null
+++ b/.repos/alchemy-effect/website/alchemy.run.ts
@@ -0,0 +1,84 @@
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export type WorkerEnv = Cloudflare.InferEnv<typeof Website>;
+
+const Website = Cloudflare.StaticSite(
+  "Website",
+  Alchemy.Stack.useSync((stack) => ({
+    command: "bun run build",
+    name:
+      stack.stage === "prod"
+        ? // FUCK: i deleted state lol, let's adopt this to avoid potential DNS prop issue
+          "alchemyeffectwebsite-worker-prod-piyvp3qw7565vvin"
+        : undefined,
+    main: "./src/worker.ts",
+    outdir: "dist",
+    domain: stack.stage === "prod" ? "v2.alchemy.run" : undefined,
+    memo: {
+      include: [
+        "src/**",
+        "astro.config.mjs",
+        "package.json",
+        "plugins/**",
+        "public/**",
+        "scripts/**",
+        "../bun.lock",
+      ],
+    },
+    compatibility: {
+      date: "2026-04-02",
+      flags: ["nodejs_compat"],
+    },
+    assetsConfig: {
+      runWorkerFirst: true,
+    },
+  })),
+);
+
+export default Alchemy.Stack(
+  "AlchemyEffectWebsite",
+  {
+    providers: Layer.mergeAll(Cloudflare.providers(), GitHub.providers()),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const { stage } = yield* Alchemy.Stack;
+    const website = yield* Website;
+
+    if (stage.startsWith("pr-")) {
+      yield* GitHub.Comment("preview-comment", {
+        owner: "alchemy-run",
+        repository: "alchemy-effect",
+        issueNumber: Number(process.env.PULL_REQUEST),
+        body: Output.interpolate`
+          ## Website Preview Deployed
+
+          **URL:** ${website.url}
+
+          Built from commit ${
+            // `BUILD_SHA` is set by .github/workflows/deploy.yml to the
+            // PR head SHA (or `github.sha` for push deploys). The
+            // ambient `GITHUB_SHA` would point at the synthetic merge
+            // commit on `pull_request` events, which is not what
+            // anyone wants to see in the comment.
+            process.env.BUILD_SHA
+              ? `[\`${process.env.BUILD_SHA.slice(0, 7)}\`](https://github.com/alchemy-run/alchemy-effect/commit/${process.env.BUILD_SHA})`
+              : "unknown"
+          }.
+
+          ---
+          _This comment updates automatically with each push._
+        `,
+      });
+    }
+
+    return {
+      url: website.url,
+    };
+  }),
+);
diff --git a/.repos/alchemy-effect/website/astro.config.mjs b/.repos/alchemy-effect/website/astro.config.mjs
new file mode 100644
index 00000000000..6d8746940d7
--- /dev/null
+++ b/.repos/alchemy-effect/website/astro.config.mjs
@@ -0,0 +1,249 @@
+// @ts-check
+import mdx from "@astrojs/mdx";
+import react from "@astrojs/react";
+import sitemap from "@astrojs/sitemap";
+import starlight from "@astrojs/starlight";
+import tailwindcss from "@tailwindcss/vite";
+import astroBrokenLinksChecker from "astro-broken-links-checker";
+import { defineConfig } from "astro/config";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import starlightBlog from "starlight-blog";
+import { pagefindIgnoreNoise } from "./plugins/pagefind-ignore-noise.mjs";
+
+/**
+ * Copies `src/content/docs/**\/*.{md,mdx}` into the build output dir, preserving
+ * the directory layout but normalizing extensions to `.md`. This lets the worker
+ * serve raw markdown for clients (e.g. coding agents) that prefer it.
+ *
+ * @returns {import("astro").AstroIntegration}
+ */
+function copyMarkdownSources() {
+  return {
+    name: "copy-markdown-sources",
+    hooks: {
+      "astro:build:done": async ({ dir }) => {
+        const outDir = fileURLToPath(dir);
+
+        /**
+         * @param {string} srcDir
+         * @param {{ lowercase?: boolean }} [opts]
+         * @param {string} [relTo]
+         */
+        async function walk(srcDir, opts = {}, relTo = srcDir) {
+          let entries;
+          try {
+            entries = await fs.readdir(srcDir, { withFileTypes: true });
+          } catch {
+            return;
+          }
+          for (const entry of entries) {
+            const full = path.join(srcDir, entry.name);
+            if (entry.isDirectory()) {
+              await walk(full, opts, relTo);
+              continue;
+            }
+            if (!entry.isFile()) continue;
+            const ext = path.extname(entry.name).toLowerCase();
+            if (ext !== ".md" && ext !== ".mdx") continue;
+            let rel = path.relative(relTo, full);
+            rel = rel.slice(0, rel.length - ext.length) + ".md";
+            // Starlight lowercases doc URLs (e.g. CamelCase source
+            // `providers/AWS/S3/Bucket.md` is served at `/providers/aws/s3/bucket`),
+            // so the raw-markdown copy must live at the lowercased path or the
+            // worker's `/providers/aws/s3/bucket.md` lookup 404s into HTML.
+            if (opts.lowercase) rel = rel.toLowerCase();
+            const target = path.join(outDir, rel);
+            await fs.mkdir(path.dirname(target), { recursive: true });
+            await fs.copyFile(full, target);
+          }
+        }
+
+        // Docs (Starlight content collection) — preserves nested layout under
+        // /content/docs/ → /<path>.md, lowercased to match Starlight's URLs.
+        await walk(
+          fileURLToPath(new URL("./src/content/docs/", import.meta.url)),
+          { lowercase: true },
+        );
+        // Marketing pages (top-level Astro pages) — exposes /<page>.md so
+        // agents can fetch raw MDX via the worker's content negotiation. Astro
+        // page routing preserves case, so don't lowercase these.
+        await walk(fileURLToPath(new URL("./src/pages/", import.meta.url)));
+      },
+    },
+  };
+}
+
+/**
+ * Case-sensitive internal-link checker. astro-broken-links-checker uses
+ * `fs.existsSync`, which is case-insensitive on macOS — so `/foo/Bar` will
+ * resolve to `/foo/bar` locally but 404 on Linux CI. This integration walks
+ * the build output once into a case-sensitive Set of paths and validates
+ * every `href`/`src` against it.
+ *
+ * @returns {import("astro").AstroIntegration}
+ */
+function caseSensitiveLinkChecker() {
+  return {
+    name: "case-sensitive-link-checker",
+    hooks: {
+      "astro:build:done": async ({ dir, logger }) => {
+        const distPath = fileURLToPath(dir);
+
+        /** @type {Set<string>} */
+        const paths = new Set();
+        /** @type {Set<string>} */
+        const dirs = new Set();
+        /**
+         * @param {string} d
+         */
+        async function walk(d) {
+          const entries = await fs.readdir(d, { withFileTypes: true });
+          for (const entry of entries) {
+            const full = path.join(d, entry.name);
+            if (entry.isDirectory()) {
+              dirs.add("/" + path.relative(distPath, full));
+              await walk(full);
+            } else if (entry.isFile()) {
+              paths.add("/" + path.relative(distPath, full));
+            }
+          }
+        }
+        await walk(distPath);
+
+        /** @type {Map<string, Set<string>>} */
+        const broken = new Map();
+        const htmlFiles = [...paths].filter((p) => p.endsWith(".html"));
+
+        for (const htmlFile of htmlFiles) {
+          const html = await fs.readFile(
+            path.join(distPath, htmlFile.slice(1)),
+            "utf8",
+          );
+          const links = [
+            ...html.matchAll(/<a\s+[^>]*href="([^"#?]+)/gi),
+            ...html.matchAll(/<img\s+[^>]*src="([^"#?]+)/gi),
+          ].map((m) => m[1]);
+
+          for (const link of links) {
+            if (!link.startsWith("/")) continue; // skip external, anchors, mailto, etc.
+            const clean = link.replace(/\/$/, "");
+            const fileCandidates = [
+              clean,
+              clean + "/index.html",
+              clean + ".html",
+            ];
+            const exists =
+              fileCandidates.some((c) => paths.has(c)) || dirs.has(clean);
+            if (!exists) {
+              if (!broken.has(link)) broken.set(link, new Set());
+              broken.get(link)?.add(htmlFile);
+            }
+          }
+        }
+
+        if (broken.size > 0) {
+          let msg = "Case-sensitive broken links detected:\n";
+          for (const [link, docs] of broken.entries()) {
+            msg += `\n  ${link}\n    Found in:\n`;
+            for (const doc of docs) msg += `      - ${doc}\n`;
+          }
+          logger.error(msg);
+          throw new Error(
+            `Case-sensitive broken links detected (${broken.size})`,
+          );
+        }
+        logger.info(
+          `Case-sensitive link check passed (${htmlFiles.length} pages)`,
+        );
+      },
+    },
+  };
+}
+
+export default defineConfig({
+  site: "https://v2.alchemy.run",
+  prefetch: true,
+  trailingSlash: "ignore",
+  integrations: [
+    react(),
+    pagefindIgnoreNoise(),
+    copyMarkdownSources(),
+    astroBrokenLinksChecker({
+      checkExternalLinks: false,
+      throwError: true,
+    }),
+    caseSensitiveLinkChecker(),
+    sitemap({
+      filter: (page) =>
+        !page.endsWith(".html") &&
+        !page.endsWith(".md") &&
+        !page.endsWith(".mdx"),
+    }),
+    starlight({
+      title: "alchemy",
+      favicon: "/favicon.svg",
+      customCss: ["./src/styles/global.css", "./src/styles/custom.css"],
+      components: {
+        ThemeProvider: "./src/components/ThemeProvider.astro",
+        Header: "./src/components/marketing/Nav.astro",
+        Head: "./src/components/starlight/Head.astro",
+      },
+      prerender: true,
+      social: [
+        {
+          icon: "github",
+          label: "GitHub",
+          href: "https://github.com/alchemy-run/alchemy-effect",
+        },
+      ],
+      editLink: {
+        baseUrl:
+          "https://github.com/alchemy-run/alchemy-effect/edit/main/website",
+      },
+      sidebar: [
+        { label: "What is Alchemy?", link: "/what-is-alchemy" },
+        { label: "Getting Started", link: "/getting-started" },
+        {
+          label: "Tutorial",
+          items: [
+            { label: "Part 1: Your First Stack", link: "/tutorial/part-1" },
+            { label: "Part 2: Add a Worker", link: "/tutorial/part-2" },
+            { label: "Part 3: Testing", link: "/tutorial/part-3" },
+            { label: "Part 4: Local Dev", link: "/tutorial/part-4" },
+            { label: "Part 5: CI/CD", link: "/tutorial/part-5" },
+            {
+              label: "Cloudflare",
+              autogenerate: { directory: "tutorial/cloudflare" },
+              collapsed: true,
+            },
+            {
+              label: "AWS",
+              autogenerate: { directory: "tutorial/aws" },
+              collapsed: true,
+            },
+          ],
+        },
+        {
+          label: "Concepts",
+          autogenerate: { directory: "concepts" },
+        },
+        {
+          label: "Guides",
+          autogenerate: { directory: "guides" },
+        },
+        {
+          label: "Providers",
+          autogenerate: { directory: "providers", collapsed: true },
+        },
+      ],
+      plugins: [starlightBlog()],
+      routeMiddleware: ["./src/blog-sidebar.ts"],
+    }),
+    mdx(),
+  ],
+  vite: {
+    plugins: [tailwindcss()],
+  },
+});
diff --git a/.repos/alchemy-effect/website/design-system/README.md b/.repos/alchemy-effect/website/design-system/README.md
new file mode 100644
index 00000000000..6ba3dde280b
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/README.md
@@ -0,0 +1,316 @@
+# Alchemy Design System
+
+> **Infrastructure-as-Effects** — a TypeScript framework that unifies cloud
+> infrastructure and application logic into a single type-safe program
+> powered by [Effect](https://effect.website).
+
+Alchemy is a developer-tool brand: terminal-first, code-dense, dark-mode only,
+with one signature color — mint green `#00e599`. Marketing moments lean on
+**hand-drawn sketch diagrams** (arrows, circles, scribbled labels) to explain
+abstract type-system concepts. Everything else is flat, quiet, and close to
+black.
+
+This design system captures the visuals, tone, and components needed to ship
+new marketing pages, docs, social posts, and slide decks that feel like
+Alchemy — without re-inventing tokens each time.
+
+---
+
+## Sources
+
+- **Repo:** `github.com/alchemy-run/alchemy-effect` — website (Astro +
+  Starlight), README, docs content, raw sketch PNGs under `images/`.
+- **Live docs:** https://alchemy.run
+- **Docs styling:** `website/src/styles/custom.css` — the ground truth for
+  color tokens, spacing, dark-only theme.
+- **Hero diagrams:** `website/images/alchemy-effect-*.png` — hand-drawn
+  Function → Binding → Resource triple, layers, terminal screenshots.
+- **Sibling repos** (same brand): `alchemy-run/alchemy` (core),
+  `alchemy-run/distilled` (Effect-native cloud SDKs).
+
+---
+
+## Index
+
+| File / folder         | What's in it                                                                    |
+| --------------------- | ------------------------------------------------------------------------------- |
+| `README.md`           | This doc — brand context, content & visual foundations, iconography             |
+| `SKILL.md`            | Agent Skill manifest (usable standalone in Claude Code)                         |
+| `colors_and_type.css` | All design tokens: colors, type, spacing, radii, shadows, motion                |
+| `fonts/`              | Local webfont fallbacks (Inter, JetBrains Mono, Caveat via Google Fonts import) |
+| `assets/`             | Logos, hand-drawn diagrams, product screenshots                                 |
+| `preview/`            | HTML specimen cards — one per token group / component cluster                   |
+| `ui_kits/website/`    | Marketing + docs UI kit (hero, feature grid, terminal, provider cards)          |
+| `ui_kits/docs/`       | Docs reader UI kit (sidebar nav, article, code blocks, callouts)                |
+
+### Products covered
+
+1. **alchemy.run marketing site** — landing, what-is, getting-started. Astro + Starlight.
+2. **alchemy.run docs** — sidebar nav, MDX articles, expressive-code blocks, terminal widget.
+
+No app UI exists — Alchemy is a CLI + library. The CLI's terminal output
+(`$ alchemy deploy`, colored plan/apply reports) is itself a visual surface
+and is recreated as a component.
+
+---
+
+## Content Fundamentals
+
+Alchemy's voice is **technical, calm, and quietly opinionated**. It talks to
+senior TypeScript engineers. It never hypes, never uses exclamation marks for
+emphasis, and never uses emoji outside the occasional Discord context.
+
+**Tone rules**
+
+- **Lowercase brand name** always: _alchemy_ — not "Alchemy" in body copy
+  (headings can capitalize for sentence case; the wordmark itself is always
+  lowercase).
+- **Short declarative sentences.** Max ~18 words. Break into paragraphs
+  instead of running on.
+- **"You" for the reader, "we" for the team.** "Come hang in our Discord."
+  "You'll install Alchemy and Effect."
+- **Technical terms are the nouns.** Capitalize product concepts when used
+  as proper nouns: _Stack_, _Resource_, _Provider_, _Binding_, _Layer_,
+  _Output Attribute_. Leave verbs lowercase: _deploy_, _bind_, _yield_.
+- **Code is a first-class citizen.** Almost every paragraph either
+  introduces a code block or refers to `monospace identifiers`. Don't
+  paraphrase what the code shows — show it.
+- **No hype adjectives.** Never say "amazing", "powerful", "revolutionary",
+  "magical". Say what it does.
+- **Specific numbers > vague claims.** "in under two minutes", "Node.js 22+",
+  "under 30 minutes" — concrete, verifiable.
+- **Em-dashes (—) for rhetorical pivots**; used frequently. Same character,
+  no spaces around it sometimes, with spaces sometimes — match the docs.
+- **Tagline form:** "**X.** Y." — two sentences, first is the category, second
+  is the value. _"Infrastructure-as-Effects. Your infrastructure and
+  application logic in a single, type-safe program."_
+
+**Casing**
+
+- Product name in prose: **alchemy** (lowercase)
+- Headings: **Sentence case** — "Getting started", "What is alchemy?",
+  "Plan, deploy, destroy"
+- `alchemy deploy`, `alchemy dev`, `alchemy destroy` — CLI verbs lowercase
+- TypeScript identifiers verbatim (`Cloudflare.R2Bucket`, `Effect.gen`)
+
+**Don't**
+
+- ❌ Emoji in marketing / docs body copy
+- ❌ Rhetorical questions as headings ("Why Alchemy?")
+- ❌ Marketing filler ("we're excited to announce…")
+- ❌ Capitalizing "Alchemy" mid-sentence
+- ❌ Introducing a concept without a code example nearby
+
+**Representative copy**
+
+> _"Infrastructure as **Effects**. Your infrastructure and application logic in
+> a single, type-safe program."_
+>
+> _"If it compiles, it deploys."_
+>
+> _"Resources are just Effects. Resources are declared as Effects and
+> composed with `yield_`. Import them from any file, bind them to Workers,
+> pass their outputs to other resources — it's all just TypeScript."\*
+>
+> _"Preview what will change with `plan`, apply it with `deploy`, and tear
+> it down with `destroy`. Stages isolate environments so `dev` and `prod`
+> never collide."_
+>
+> _"alchemy is in alpha and not ready for production use (expect breaking
+> changes). Come hang in our Discord to participate in the early stages of
+> development."_
+
+---
+
+## Visual Foundations
+
+### Mode
+
+**Dark mode only.** The `color-scheme: dark` declaration is hard-coded and
+the theme toggle is hidden. Every surface is on a near-black canvas. Do
+not produce light-mode variants unless explicitly asked — they don't exist.
+
+### Color
+
+- **One accent:** `#00e599` — a bright, slightly-yellow mint green. Used for
+  emphasis, success states, CTAs, link hovers, the wordmark dot, and the
+  single gradient stop in "Infrastructure as **Effects**" hero text.
+- **Canvas:** `#0a0a0a` (page) → `#111111` (nav/sidebar) → `#18181b` (elevated
+  cards) → `#1f1f23` (hover). Steps are ~1–2 lightness units apart — very
+  subtle.
+- **Neutrals:** Tailwind Zinc scale (50 → 950). Body text at zinc-200/300,
+  muted at zinc-400, captions at zinc-500.
+- **Hairlines:** `rgba(255,255,255,0.06)` for default borders, `0.10` for
+  hover/emphasis. No solid-gray borders.
+- **Semantic colors in terminal output:**
+  - Success / create: `#00e599` (same mint)
+  - Update: `#f5a524` (amber)
+  - Replace / destroy: `#f04b4b` (red)
+  - Info / tag: `#7cc5ff` (cyan)
+  - Dim: `#71717a`
+
+**No purple. No blue gradients. No "SaaS violet".** The only gradient in the
+entire brand is `linear-gradient(90deg, #fff, #00e599)` applied as
+`background-clip: text` on the word "Effects" in the hero.
+
+### Type
+
+- **Inter** (400/500/600/700/800) — UI, headings, body
+- **JetBrains Mono** (400/500/600) — all code, terminal output, eyebrows
+- **Caveat** (600) — hand-drawn diagram labels (see Iconography)
+- Letter-spacing: `-0.04em` on display, `-0.02em` on headings, `0` on body.
+- Headings are **sentence case**, weight 700, tightly tracked. No all-caps
+  except monospace eyebrows (`EYEBROW TEXT`, 12px, `letter-spacing: 0.1em`).
+
+### Spacing
+
+- 4px grid: 4 / 8 / 12 / 16 / 24 / 32 / 48 / 64 / 96.
+- Section rhythm on marketing pages: `margin-bottom: 5rem` (80px) between
+  hero / features / providers / CTA.
+- Max content width on landing: `72rem` (1152px).
+
+### Backgrounds
+
+- **Flat solid black-ish surfaces** — no patterns, no noise, no gradients.
+- **Hand-drawn sketch illustrations** are the signature decorative element —
+  they appear as standalone hero artwork, not backgrounds. See Iconography.
+- Occasional full-bleed terminal screenshots demonstrating CLI output.
+
+### Borders & cards
+
+- Border radius: **8px** standard (provider cards, buttons, code blocks),
+  **4–6px** for small chips/tags, **12px** for large hero panels.
+- Cards: `background: #18181b; border: 1px solid rgba(255,255,255,0.06);
+border-radius: 8px; padding: 1.5rem;`
+- **Never** a colored left-border accent. Never an "alert callout" stripe.
+- Hover on a card: border becomes `var(--alc-accent)`. That's it — no
+  transform, no shadow change, no scale.
+
+### Shadows
+
+- Near-zero by default. Dark surfaces don't need elevation shadows.
+- When used: `0 4px 14px rgba(0,0,0,0.5)` for floating elements.
+- **Accent glow** is allowed sparingly on focused/active CTA buttons:
+  `0 0 0 1px rgba(0,229,153,.4), 0 0 24px -4px rgba(0,229,153,.4)`.
+
+### Transparency & blur
+
+- Transparency is used for **hairlines** (`rgba(255,255,255,.06–.16)`) and
+  **accent washes** (`color-mix(in srgb, #00e599 12%, transparent)`).
+- No frosted-glass / backdrop-blur surfaces. Alchemy's surfaces are crisp
+  and opaque.
+
+### Motion
+
+- **Restrained.** Marketing page has essentially no animation. Hover
+  transitions are `120–180ms ease` on color/border only.
+- Easing: `cubic-bezier(0.2, 0, 0, 1)` — standard Material out-curve.
+- No bounces, no parallax, no auto-playing hero videos.
+- Prefer instant state changes for developers — they move fast and dislike
+  jank.
+
+### Hover states
+
+- **Links:** color → `var(--alc-accent)`.
+- **Cards with a link:** border-color → `var(--alc-accent)`. No translate.
+- **Primary buttons:** background slightly brighter, no transform.
+- **Secondary buttons / icon buttons:** background → `rgba(255,255,255,.04)`.
+
+### Press / active states
+
+- Buttons darken a touch (`filter: brightness(0.95)`) — no scale-down, no
+  inset shadow. The goal is "it registered" without bouncing.
+
+### Focus states
+
+- **2px mint outline, 2px offset.** Never remove focus rings.
+  `outline: 2px solid #00e599; outline-offset: 2px;`
+
+### Layout rules
+
+- Fixed top nav (64px tall, `#111` bg, hairline bottom border).
+- Docs: 260px left sidebar (`#111`), article body max-width 768–820px,
+  optional right-side "On this page" column.
+- Marketing: centered, 72rem max-width, generous 5rem between sections.
+
+### Imagery vibe
+
+- **Hand-drawn, warm, slightly-silly sketches** on otherwise austere dark
+  surfaces. Black ink on white paper, dropped into the dark theme as-is
+  (white backgrounds show through — it's a deliberate contrast).
+- Product screenshots (VS Code, terminal) appear in their native
+  github-dark-dimmed theme. Preserve as PNGs.
+- No stock photography. No AI-generated imagery. No people.
+
+### Code blocks
+
+- **Theme:** `github-dark-dimmed` (Expressive Code). Keyword `#f47067`, string
+  `#96d0ff`, function `#dcbdfb`, type `#6cb6ff`, comment `#768390`.
+- **Filename header:** small mono label at top-left, dim.
+- **Diff additions:** green `+` prefix with row tint; deletions: red `-`
+  prefix with row tint. TwoSlash-powered.
+
+---
+
+## Iconography
+
+**Alchemy does not use an icon font or lucide/heroicons in its marketing
+or docs.** The visual vocabulary splits into three categories:
+
+### 1. Hand-drawn sketch illustrations (signature)
+
+Black-ink marker sketches on white, scanned and dropped into the dark
+theme. Used for explaining concepts on the README and marketing site. They
+replace what would normally be iconographic diagrams.
+
+Available in `assets/`:
+
+- `diagram-triple.png` — **Function → Binding → Resource** (the core triple)
+- `diagram-triad.png` — triad diagram
+- `diagram-layers.png` — Effect Layer hierarchy sketch
+- `screenshot-plan-type.png` — VS Code type-hover screenshot
+- `screenshot-output.png` — VS Code stack output screenshot
+- `screenshot-policy-error.png` — VS Code IAM policy type error
+
+**Typography in sketches:** labels look like Caveat / marker handwriting.
+When recreating digitally, use **Caveat 600** as the nearest Google Fonts
+match. Flag to the user that true sketches should be produced by hand or
+with an illustrator.
+
+### 2. Code as decoration
+
+The biggest "icons" on the marketing site are **code blocks themselves**.
+Every feature card has a syntax-highlighted TypeScript snippet paired with
+a short paragraph. Treat code blocks as the primary visual unit — size
+them, pad them, give them room.
+
+### 3. CLI glyphs (terminal component)
+
+Inside the custom `<Terminal />` component, plain unicode / ASCII glyphs
+signal status:
+
+- `✓` success (mint)
+- `+` create (mint)
+- `~` update (amber)
+- `-` / `×` destroy (red)
+- `◉` / `○` radio selection
+- `•` bullet / separator (dim)
+- `[u]…[/u]` underline markup, `[b]…[/b]` bold, `[d]…[/d]` dim, `[g]…[/g]`
+  green/success, `[c]…[/c]` cyan
+
+### 4. Small UI icons (Starlight built-ins)
+
+The docs layout uses Starlight's stock icons — `right-arrow`, `open-book`,
+`github`, `bun`, `npm`, `pnpm`, `seti:yarn` — for link buttons and tabs.
+When recreating, **use Lucide** (CDN) as the closest stroke-weight match,
+or the original Starlight icons if available. Flag this substitution.
+
+### 5. Logo mark
+
+`assets/logo-mark.svg` — a mint dot on a rounded black square. This is a
+**placeholder** synthesized from the wordmark style on the live site; the
+repo does not contain an official logo file. **Ask the user for a real
+logo asset.**
+
+Emoji usage: **none** in marketing/docs. Fine in community spaces
+(Discord) but out of scope for the design system.
diff --git a/.repos/alchemy-effect/website/design-system/assets/diagram-layers.png b/.repos/alchemy-effect/website/design-system/assets/diagram-layers.png
new file mode 100644
index 00000000000..01051ed5719
Binary files /dev/null and b/.repos/alchemy-effect/website/design-system/assets/diagram-layers.png differ
diff --git a/.repos/alchemy-effect/website/design-system/assets/diagram-triad.png b/.repos/alchemy-effect/website/design-system/assets/diagram-triad.png
new file mode 100644
index 00000000000..d82b2c53fcd
Binary files /dev/null and b/.repos/alchemy-effect/website/design-system/assets/diagram-triad.png differ
diff --git a/.repos/alchemy-effect/website/design-system/assets/diagram-triple.png b/.repos/alchemy-effect/website/design-system/assets/diagram-triple.png
new file mode 100644
index 00000000000..f791fa78e0b
Binary files /dev/null and b/.repos/alchemy-effect/website/design-system/assets/diagram-triple.png differ
diff --git a/.repos/alchemy-effect/website/design-system/assets/logo-mark.svg b/.repos/alchemy-effect/website/design-system/assets/logo-mark.svg
new file mode 100644
index 00000000000..337eb038d3d
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/assets/logo-mark.svg
@@ -0,0 +1,5 @@
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="48" height="48">
+  <rect width="48" height="48" rx="10" fill="#0a0a0a"></rect>
+  <circle cx="24" cy="24" r="10" fill="#00e599"></circle>
+</svg>
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/design-system/assets/logo-wordmark-dark.svg b/.repos/alchemy-effect/website/design-system/assets/logo-wordmark-dark.svg
new file mode 100644
index 00000000000..70fd8dc3287
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/assets/logo-wordmark-dark.svg
@@ -0,0 +1,8 @@
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240 48" width="240" height="48">
+  
+  
+  <circle cx="14" cy="24" r="7" fill="#00e599"></circle>
+  
+  <text x="32" y="33" class="wm" fill="#f4f4f5">alchemy</text>
+</svg>
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/design-system/assets/logo-wordmark-light.svg b/.repos/alchemy-effect/website/design-system/assets/logo-wordmark-light.svg
new file mode 100644
index 00000000000..af362b9d5d5
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/assets/logo-wordmark-light.svg
@@ -0,0 +1,6 @@
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 240 48" width="240" height="48">
+  
+  <circle cx="14" cy="24" r="7" fill="#00b378"></circle>
+  <text x="32" y="33" class="wm" fill="#0a0a0a">alchemy</text>
+</svg>
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/design-system/assets/screenshot-output.png b/.repos/alchemy-effect/website/design-system/assets/screenshot-output.png
new file mode 100644
index 00000000000..37c805a9390
Binary files /dev/null and b/.repos/alchemy-effect/website/design-system/assets/screenshot-output.png differ
diff --git a/.repos/alchemy-effect/website/design-system/assets/screenshot-plan-type.png b/.repos/alchemy-effect/website/design-system/assets/screenshot-plan-type.png
new file mode 100644
index 00000000000..c6f94608694
Binary files /dev/null and b/.repos/alchemy-effect/website/design-system/assets/screenshot-plan-type.png differ
diff --git a/.repos/alchemy-effect/website/design-system/assets/screenshot-policy-error.png b/.repos/alchemy-effect/website/design-system/assets/screenshot-policy-error.png
new file mode 100644
index 00000000000..80be88e5031
Binary files /dev/null and b/.repos/alchemy-effect/website/design-system/assets/screenshot-policy-error.png differ
diff --git a/.repos/alchemy-effect/website/design-system/preview/_card.css b/.repos/alchemy-effect/website/design-system/preview/_card.css
new file mode 100644
index 00000000000..3d9754b0d66
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/_card.css
@@ -0,0 +1,22 @@
+/* Shared card harness — keep previews consistent. */
+@import url("../colors_and_type.css");
+
+* {
+  box-sizing: border-box;
+}
+html,
+body {
+  margin: 0;
+  padding: 0;
+  background: var(--alc-bg);
+  color: var(--alc-fg-2);
+  font-family: var(--alc-font-sans);
+  -webkit-font-smoothing: antialiased;
+}
+body {
+  width: 700px;
+  padding: 24px;
+}
+.card {
+  width: 100%;
+}
diff --git a/.repos/alchemy-effect/website/design-system/preview/brand-glyphs.html b/.repos/alchemy-effect/website/design-system/preview/brand-glyphs.html
new file mode 100644
index 00000000000..3e802b35a7f
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/brand-glyphs.html
@@ -0,0 +1,87 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Glyphs</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .grid {
+        display: grid;
+        grid-template-columns: repeat(6, 1fr);
+        gap: 10px;
+      }
+      .cell {
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 6px;
+        padding: 12px 8px;
+        text-align: center;
+      }
+      .glyph {
+        font-family: var(--alc-font-mono);
+        font-size: 22px;
+        line-height: 1;
+        margin-bottom: 6px;
+      }
+      .name {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-3);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="grid">
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-accent-deep)">✓</div>
+          <div class="name">success</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-accent-deep)">+</div>
+          <div class="name">create</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-warn)">~</div>
+          <div class="name">update</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-danger)">×</div>
+          <div class="name">destroy</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-info)">◉</div>
+          <div class="name">selected</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-4)">○</div>
+          <div class="name">radio</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-4)">•</div>
+          <div class="name">bullet</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-2)">→</div>
+          <div class="name">arrow</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-2)">⇄</div>
+          <div class="name">replace</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-2)">⌘</div>
+          <div class="name">kbd</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-2)">⌕</div>
+          <div class="name">search</div>
+        </div>
+        <div class="cell">
+          <div class="glyph" style="color: var(--alc-fg-2)">⟶</div>
+          <div class="name">flow</div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/brand-logo.html b/.repos/alchemy-effect/website/design-system/preview/brand-logo.html
new file mode 100644
index 00000000000..5e44cd25ea1
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/brand-logo.html
@@ -0,0 +1,84 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Logo</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .grid {
+        display: grid;
+        grid-template-columns: 1fr 1fr;
+        gap: 12px;
+      }
+      .cell {
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        padding: 24px;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        min-height: 100px;
+      }
+      .cell.cream {
+        background: var(--alc-bg-elev-1);
+      }
+      .cell.moss {
+        background: var(--alc-accent-deep);
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-3);
+        margin-top: 6px;
+        text-align: center;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+      .mark {
+        display: flex;
+        align-items: center;
+        gap: 12px;
+        font-family: var(--alc-font-serif);
+        font-weight: 500;
+        font-style: italic;
+        font-size: 34px;
+        letter-spacing: -0.02em;
+      }
+      .mark .dot {
+        width: 16px;
+        height: 16px;
+        border-radius: 50%;
+      }
+      .mark.on-cream {
+        color: var(--alc-fg-1);
+      }
+      .mark.on-cream .dot {
+        background: var(--alc-accent);
+      }
+      .mark.on-moss {
+        color: var(--alc-fg-invert);
+      }
+      .mark.on-moss .dot {
+        background: var(--alc-accent-bright);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="grid">
+        <div>
+          <div class="cell cream">
+            <div class="mark on-cream"><span class="dot"></span>alchemy</div>
+          </div>
+          <div class="label">wordmark on parchment — primary</div>
+        </div>
+        <div>
+          <div class="cell moss">
+            <div class="mark on-moss"><span class="dot"></span>alchemy</div>
+          </div>
+          <div class="label">wordmark on moss — inverse</div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/brand-sketch.html b/.repos/alchemy-effect/website/design-system/preview/brand-sketch.html
new file mode 100644
index 00000000000..31a16b07571
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/brand-sketch.html
@@ -0,0 +1,49 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Sketch diagram</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .wrap {
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        padding: 24px;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        filter: invert(0);
+      }
+      img {
+        max-width: 100%;
+        height: auto;
+        /* hand-drawn source is black ink on white — tint toward walnut to match the warm system */
+        mix-blend-mode: multiply;
+        opacity: 0.85;
+      }
+      .meta {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-3);
+        text-align: center;
+        margin-top: 10px;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="wrap">
+        <img
+          src="../assets/diagram-triple.png"
+          alt="Function → Binding → Resource"
+        />
+      </div>
+      <div class="meta">
+        Signature hand-drawn diagram · Caveat labels · walnut ink on parchment
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/colors-brand.html b/.repos/alchemy-effect/website/design-system/preview/colors-brand.html
new file mode 100644
index 00000000000..04e0752c520
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/colors-brand.html
@@ -0,0 +1,124 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: flex;
+        gap: 14px;
+        align-items: stretch;
+      }
+      .swatch {
+        flex: 1;
+        border-radius: 8px;
+        padding: 18px 16px;
+        min-height: 110px;
+        display: flex;
+        flex-direction: column;
+        justify-content: flex-end;
+        gap: 4px;
+        border: 1px solid var(--alc-hairline);
+      }
+      .swatch.lead {
+        flex: 1.6;
+      }
+      .name {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        letter-spacing: 0.04em;
+      }
+      .hex {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        opacity: 0.8;
+      }
+      .big {
+        font-family: var(--alc-font-serif);
+        font-size: 28px;
+        line-height: 1;
+        font-weight: 500;
+        font-style: italic;
+        margin-bottom: auto;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div
+          class="swatch lead"
+          style="background: var(--alc-accent); color: var(--alc-fg-on-accent)"
+        >
+          <div class="big">Moss</div>
+          <div>
+            <div class="name">--alc-accent</div>
+            <div class="hex">#5C7A3E</div>
+          </div>
+        </div>
+        <div
+          class="swatch"
+          style="
+            background: var(--alc-accent-deep);
+            color: var(--alc-fg-on-accent);
+          "
+        >
+          <div class="name">accent-deep</div>
+          <div class="hex">#3F5A2A</div>
+        </div>
+        <div
+          class="swatch"
+          style="
+            background: var(--alc-accent-warm);
+            color: var(--alc-fg-on-accent);
+          "
+        >
+          <div class="name">accent-warm</div>
+          <div class="hex">#7A9A5E</div>
+        </div>
+        <div
+          class="swatch"
+          style="background: var(--alc-accent-soft); color: var(--alc-fg-1)"
+        >
+          <div class="name">accent-soft</div>
+          <div class="hex">#D8E3C4</div>
+        </div>
+      </div>
+      <div style="margin-top: 14px; display: flex; gap: 14px">
+        <div
+          class="swatch"
+          style="
+            background: var(--alc-terracotta);
+            color: var(--alc-fg-on-accent);
+            flex: 1;
+          "
+        >
+          <div class="name">terracotta</div>
+          <div class="hex">#C56E3C</div>
+        </div>
+        <div
+          class="swatch"
+          style="
+            background: var(--alc-terracotta-deep);
+            color: var(--alc-fg-on-accent);
+            flex: 1;
+          "
+        >
+          <div class="name">terracotta-deep</div>
+          <div class="hex">#9A4F27</div>
+        </div>
+        <div
+          class="swatch"
+          style="
+            background: var(--alc-terracotta-soft);
+            color: var(--alc-fg-1);
+            flex: 1;
+          "
+        >
+          <div class="name">terracotta-soft</div>
+          <div class="hex">#ECCFB8</div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/colors-neutrals.html b/.repos/alchemy-effect/website/design-system/preview/colors-neutrals.html
new file mode 100644
index 00000000000..1954742811d
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/colors-neutrals.html
@@ -0,0 +1,83 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .grid {
+        display: grid;
+        grid-template-columns: repeat(11, 1fr);
+        gap: 4px;
+      }
+      .sw {
+        aspect-ratio: 1/1.35;
+        border-radius: 6px;
+        display: flex;
+        align-items: flex-end;
+        justify-content: center;
+        padding-bottom: 6px;
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        border: 1px solid var(--alc-hairline);
+      }
+      .sw.dark {
+        color: var(--alc-fg-invert);
+      }
+      .sw.light {
+        color: var(--alc-fg-1);
+      }
+      .k {
+        opacity: 0.85;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="grid">
+        <div class="sw light" style="background: #faf6ec">
+          <span class="k">50</span>
+        </div>
+        <div class="sw light" style="background: #f1ead8">
+          <span class="k">100</span>
+        </div>
+        <div class="sw light" style="background: #e2d7bc">
+          <span class="k">200</span>
+        </div>
+        <div class="sw light" style="background: #c7b795">
+          <span class="k">300</span>
+        </div>
+        <div class="sw light" style="background: #a89572">
+          <span class="k">400</span>
+        </div>
+        <div class="sw dark" style="background: #85714f">
+          <span class="k">500</span>
+        </div>
+        <div class="sw dark" style="background: #68573c">
+          <span class="k">600</span>
+        </div>
+        <div class="sw dark" style="background: #4e402c">
+          <span class="k">700</span>
+        </div>
+        <div class="sw dark" style="background: #363022">
+          <span class="k">800</span>
+        </div>
+        <div class="sw dark" style="background: #2a2620">
+          <span class="k">900</span>
+        </div>
+        <div class="sw dark" style="background: #1a1813">
+          <span class="k">950</span>
+        </div>
+      </div>
+      <div
+        style="
+          margin-top: 10px;
+          font-family: var(--alc-font-mono);
+          font-size: 11px;
+          color: var(--alc-fg-3);
+        "
+      >
+        Walnut scale · --alc-walnut-{50–950}
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/colors-semantic.html b/.repos/alchemy-effect/website/design-system/preview/colors-semantic.html
new file mode 100644
index 00000000000..ef0f9dae7ce
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/colors-semantic.html
@@ -0,0 +1,83 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .grid {
+        display: grid;
+        grid-template-columns: repeat(5, 1fr);
+        gap: 12px;
+      }
+      .cell {
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        padding: 14px;
+        text-align: center;
+      }
+      .dot {
+        width: 28px;
+        height: 28px;
+        border-radius: 50%;
+        margin: 0 auto 10px;
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-3);
+        text-transform: uppercase;
+        letter-spacing: 0.06em;
+      }
+      .name {
+        font-family: var(--alc-font-sans);
+        font-size: 13px;
+        color: var(--alc-fg-1);
+        font-weight: 600;
+        margin-top: 2px;
+      }
+      .hex {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-4);
+        margin-top: 2px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="grid">
+        <div class="cell">
+          <div class="dot" style="background: var(--alc-success)"></div>
+          <div class="label">plan: create</div>
+          <div class="name">Success</div>
+          <div class="hex">#5C7A3E</div>
+        </div>
+        <div class="cell">
+          <div class="dot" style="background: var(--alc-warn)"></div>
+          <div class="label">plan: update</div>
+          <div class="name">Warn</div>
+          <div class="hex">#D49A2A</div>
+        </div>
+        <div class="cell">
+          <div class="dot" style="background: var(--alc-danger)"></div>
+          <div class="label">plan: replace</div>
+          <div class="name">Danger</div>
+          <div class="hex">#B3462E</div>
+        </div>
+        <div class="cell">
+          <div class="dot" style="background: var(--alc-info)"></div>
+          <div class="label">info</div>
+          <div class="name">Info</div>
+          <div class="hex">#4A7A8A</div>
+        </div>
+        <div class="cell">
+          <div class="dot" style="background: var(--alc-muted)"></div>
+          <div class="label">unchanged</div>
+          <div class="name">Muted</div>
+          <div class="hex">#A89572</div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/colors-surfaces.html b/.repos/alchemy-effect/website/design-system/preview/colors-surfaces.html
new file mode 100644
index 00000000000..793c71760ac
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/colors-surfaces.html
@@ -0,0 +1,75 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .stack {
+        display: flex;
+        flex-direction: column;
+        gap: 2px;
+        border-radius: 8px;
+        overflow: hidden;
+        border: 1px solid var(--alc-hairline);
+      }
+      .layer {
+        padding: 14px 18px;
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        font-family: var(--alc-font-mono);
+        font-size: 12px;
+      }
+      .layer.dark {
+        color: var(--alc-fg-invert);
+      }
+      .layer.light {
+        color: var(--alc-fg-1);
+      }
+      .n {
+        font-weight: 500;
+      }
+      .h {
+        opacity: 0.65;
+      }
+      .desc {
+        font-family: var(--alc-font-sans);
+        font-size: 12px;
+        opacity: 0.75;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="stack">
+        <div class="layer light" style="background: #f5efe3">
+          <span class="n">--alc-bg</span
+          ><span class="desc">page / parchment</span
+          ><span class="h">#F5EFE3</span>
+        </div>
+        <div class="layer light" style="background: #efe7d6">
+          <span class="n">--alc-bg-nav</span
+          ><span class="desc">nav, sidebar</span><span class="h">#EFE7D6</span>
+        </div>
+        <div class="layer light" style="background: #fbf6ea">
+          <span class="n">--alc-bg-elev-1</span
+          ><span class="desc">cards, panels</span><span class="h">#FBF6EA</span>
+        </div>
+        <div class="layer light" style="background: #fffaf0">
+          <span class="n">--alc-bg-elev-2</span
+          ><span class="desc">hover / nested</span
+          ><span class="h">#FFFAF0</span>
+        </div>
+        <div class="layer light" style="background: #ebe3d0">
+          <span class="n">--alc-bg-sunk</span><span class="desc">insets</span
+          ><span class="h">#EBE3D0</span>
+        </div>
+        <div class="layer dark" style="background: #2a2620">
+          <span class="n">--alc-bg-code</span
+          ><span class="desc">terminal / code</span
+          ><span class="h">#2A2620</span>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/colors-syntax.html b/.repos/alchemy-effect/website/design-system/preview/colors-syntax.html
new file mode 100644
index 00000000000..9d8cd301e63
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/colors-syntax.html
@@ -0,0 +1,76 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Syntax</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .block {
+        background: var(--alc-bg-code);
+        color: var(--alc-code-var);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        padding: 16px 18px;
+        font-family: var(--alc-font-mono);
+        font-size: 13px;
+        line-height: 1.7;
+      }
+      .k {
+        color: var(--alc-code-keyword);
+      }
+      .s {
+        color: var(--alc-code-string);
+      }
+      .f {
+        color: var(--alc-code-fn);
+      }
+      .t {
+        color: var(--alc-code-type);
+      }
+      .c {
+        color: var(--alc-code-comment);
+        font-style: italic;
+      }
+      .v {
+        color: var(--alc-code-var);
+      }
+      .n {
+        color: var(--alc-code-literal);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="block">
+        <span class="c">// github-dark-dimmed</span><br />
+        <span class="k">import</span> * <span class="k">as</span>
+        <span class="v">Cloudflare</span> <span class="k">from</span>
+        <span class="s">"alchemy/Cloudflare"</span>;<br />
+        <br />
+        <span class="k">const</span> <span class="v">Bucket</span> =
+        <span class="v">Cloudflare</span>.<span class="f">R2Bucket</span>(<span
+          class="s"
+          >"Bucket"</span
+        >);<br />
+        <br />
+        <span class="k">export default</span>
+        <span class="v">Alchemy</span>.<span class="f">Stack</span>(<span
+          class="s"
+          >"MyApp"</span
+        >, {<br />
+        &nbsp;&nbsp;<span class="v">providers</span>:
+        <span class="v">Cloudflare</span>.<span class="f">providers</span
+        >(),<br />
+        }, <span class="v">Effect</span>.<span class="f">gen</span>(<span
+          class="k"
+          >function</span
+        >* () {<br />
+        &nbsp;&nbsp;<span class="k">const</span> <span class="v">bucket</span> =
+        <span class="k">yield</span>* <span class="v">Bucket</span>;<br />
+        &nbsp;&nbsp;<span class="k">return</span> { <span class="v">url</span>:
+        <span class="v">bucket</span>.<span class="v">bucketName</span> };<br />
+        }));
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-buttons.html b/.repos/alchemy-effect/website/design-system/preview/components-buttons.html
new file mode 100644
index 00000000000..ad5bc3efeb3
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-buttons.html
@@ -0,0 +1,99 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Buttons</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      body {
+        padding: 20px 24px;
+      }
+      .row {
+        display: flex;
+        gap: 10px;
+        align-items: center;
+        margin-bottom: 10px;
+        flex-wrap: wrap;
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-3);
+        width: 72px;
+        flex-shrink: 0;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+      .btn {
+        font-family: var(--alc-font-sans);
+        font-size: 14px;
+        font-weight: 500;
+        padding: 8px 16px;
+        border-radius: 8px;
+        border: 1px solid transparent;
+        cursor: pointer;
+        display: inline-flex;
+        align-items: center;
+        gap: 6px;
+        text-decoration: none;
+        white-space: nowrap;
+      }
+      .primary {
+        background: var(--alc-accent);
+        color: var(--alc-fg-on-accent);
+      }
+      .primary:hover {
+        background: var(--alc-accent-deep);
+      }
+      .secondary {
+        background: var(--alc-bg-elev-1);
+        border-color: var(--alc-hairline-3);
+        color: var(--alc-fg-1);
+      }
+      .secondary:hover {
+        border-color: var(--alc-accent);
+        color: var(--alc-accent-deep);
+      }
+      .ghost {
+        background: transparent;
+        color: var(--alc-fg-2);
+      }
+      .ghost:hover {
+        background: var(--alc-bg-sunk);
+        color: var(--alc-fg-1);
+      }
+      .danger {
+        background: transparent;
+        border-color: rgba(179, 70, 46, 0.4);
+        color: var(--alc-danger);
+      }
+      .focus {
+        outline: 2px solid var(--alc-accent);
+        outline-offset: 2px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="label">primary</div>
+        <a class="btn primary">Get Started →</a>
+        <a class="btn primary focus">Focused</a>
+      </div>
+      <div class="row">
+        <div class="label">secondary</div>
+        <a class="btn secondary">Tutorial</a>
+        <a class="btn secondary">View on GitHub</a>
+      </div>
+      <div class="row">
+        <div class="label">ghost</div>
+        <a class="btn ghost">Learn more</a>
+        <a class="btn ghost">Docs</a>
+      </div>
+      <div class="row">
+        <div class="label">danger</div>
+        <a class="btn danger">Destroy stack</a>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-callouts.html b/.repos/alchemy-effect/website/design-system/preview/components-callouts.html
new file mode 100644
index 00000000000..5ba2e178b57
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-callouts.html
@@ -0,0 +1,80 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Callouts</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .box {
+        border: 1px solid;
+        border-radius: 8px;
+        padding: 12px 14px;
+        margin-bottom: 10px;
+        display: flex;
+        gap: 10px;
+      }
+      .box .icon {
+        font-family: var(--alc-font-mono);
+        font-weight: 700;
+        flex-shrink: 0;
+      }
+      .box .body {
+        font-family: var(--alc-font-sans);
+        font-size: 13px;
+        line-height: 1.5;
+        color: var(--alc-fg-2);
+      }
+      .box strong {
+        color: var(--alc-fg-1);
+        font-weight: 600;
+      }
+      .tip {
+        border-color: rgba(92, 122, 62, 0.5);
+        background: rgba(92, 122, 62, 0.18);
+      }
+      .tip .icon {
+        color: var(--alc-accent-deep);
+      }
+      .note {
+        border-color: rgba(74, 122, 138, 0.5);
+        background: rgba(74, 122, 138, 0.18);
+      }
+      .note .icon {
+        color: var(--alc-info);
+      }
+      .warn {
+        border-color: rgba(179, 70, 46, 0.5);
+        background: rgba(179, 70, 46, 0.18);
+      }
+      .warn .icon {
+        color: var(--alc-danger);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="box tip">
+        <span class="icon">✓</span>
+        <span class="body"
+          ><strong>Tip.</strong> We recommend Bun for the best development
+          experience, but Node.js works too.</span
+        >
+      </div>
+      <div class="box note">
+        <span class="icon">i</span>
+        <span class="body"
+          ><strong>Note.</strong> By convention, Alchemy looks for
+          <code style="font-family: var(--alc-font-mono)">alchemy.run.ts</code>
+          at the root of your project.</span
+        >
+      </div>
+      <div class="box warn">
+        <span class="icon">!</span>
+        <span class="body"
+          ><strong>Alpha.</strong> alchemy is in alpha and not ready for
+          production use. Expect breaking changes.</span
+        >
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-code-block.html b/.repos/alchemy-effect/website/design-system/preview/components-code-block.html
new file mode 100644
index 00000000000..7fe408fe0a8
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-code-block.html
@@ -0,0 +1,75 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Code block</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .wrap {
+        background: var(--alc-bg-code);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        overflow: hidden;
+        box-shadow: var(--alc-shadow);
+      }
+      .head {
+        display: flex;
+        justify-content: space-between;
+        padding: 8px 14px;
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-code-comment);
+        border-bottom: 1px solid rgba(232, 220, 192, 0.08);
+      }
+      .pre {
+        font-family: var(--alc-font-mono);
+        font-size: 13px;
+        line-height: 1.6;
+        color: var(--alc-code-var);
+        padding: 14px 18px;
+        margin: 0;
+      }
+      .k {
+        color: var(--alc-code-keyword);
+      }
+      .s {
+        color: var(--alc-code-string);
+      }
+      .f {
+        color: var(--alc-code-fn);
+      }
+      .t {
+        color: var(--alc-code-type);
+      }
+      .c {
+        color: var(--alc-code-comment);
+        font-style: italic;
+      }
+      .add {
+        background: rgba(143, 177, 94, 0.18);
+        display: block;
+        padding: 0 18px;
+        margin: 0 -18px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="wrap">
+        <div class="head">
+          <span>alchemy.run.ts</span><span>typescript</span>
+        </div>
+        <pre
+          class="pre"
+        ><span class="k">import</span> * <span class="k">as</span> Alchemy <span class="k">from</span> <span class="s">"alchemy"</span>;
+<span class="k">import</span> * <span class="k">as</span> Cloudflare <span class="k">from</span> <span class="s">"alchemy/Cloudflare"</span>;
+
+<span class="k">export default</span> Alchemy.<span class="f">Stack</span>(<span class="s">"MyApp"</span>, {
+<span class="add">  providers: Cloudflare.<span class="f">providers</span>(),</span>
+}, Effect.<span class="f">gen</span>(<span class="k">function</span>* () {
+  <span class="k">const</span> bucket = <span class="k">yield</span>* Cloudflare.<span class="f">R2Bucket</span>(<span class="s">"Bucket"</span>);
+}));</pre>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-inputs.html b/.repos/alchemy-effect/website/design-system/preview/components-inputs.html
new file mode 100644
index 00000000000..7b1b59e409a
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-inputs.html
@@ -0,0 +1,98 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Inputs</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: grid;
+        grid-template-columns: 1fr 1fr;
+        gap: 14px;
+      }
+      .field {
+        display: flex;
+        flex-direction: column;
+        gap: 6px;
+      }
+      label {
+        font-family: var(--alc-font-sans);
+        font-size: 12px;
+        color: var(--alc-fg-3);
+      }
+      input,
+      select {
+        background: var(--alc-bg-elev-2);
+        border: 1px solid var(--alc-hairline-2);
+        color: var(--alc-fg-1);
+        border-radius: 6px;
+        padding: 8px 12px;
+        font-family: var(--alc-font-mono);
+        font-size: 13px;
+        outline: none;
+      }
+      input:focus {
+        border-color: var(--alc-accent);
+        box-shadow: 0 0 0 2px rgba(92, 122, 62, 0.22);
+      }
+      .kbd {
+        background: var(--alc-bg-sunk);
+        border: 1px solid var(--alc-hairline-2);
+        border-radius: 4px;
+        padding: 2px 6px;
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-2);
+      }
+      .search {
+        position: relative;
+      }
+      .search input {
+        padding-left: 32px;
+        padding-right: 56px;
+        width: 100%;
+        box-sizing: border-box;
+      }
+      .search::before {
+        content: "⌕";
+        position: absolute;
+        left: 10px;
+        top: 50%;
+        transform: translateY(-50%);
+        color: var(--alc-fg-4);
+        font-size: 14px;
+      }
+      .search .keys {
+        position: absolute;
+        right: 8px;
+        top: 50%;
+        transform: translateY(-50%);
+        display: flex;
+        gap: 3px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="field">
+          <label>Stage name</label>
+          <input type="text" value="prod" />
+        </div>
+        <div class="field">
+          <label>Cloudflare account</label>
+          <input type="text" value="a1b2c3d4e5" placeholder="account id" />
+        </div>
+      </div>
+      <div class="field" style="margin-top: 14px">
+        <label>Search docs</label>
+        <div class="search">
+          <input value="R2Bucket" />
+          <span class="keys"
+            ><span class="kbd">⌘</span><span class="kbd">K</span></span
+          >
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-provider-card.html b/.repos/alchemy-effect/website/design-system/preview/components-provider-card.html
new file mode 100644
index 00000000000..24d2c23b138
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-provider-card.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Provider card</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .grid {
+        display: grid;
+        grid-template-columns: repeat(3, 1fr);
+        gap: 14px;
+      }
+      .pc {
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        padding: 20px;
+        display: flex;
+        flex-direction: column;
+        gap: 8px;
+      }
+      .pc:hover {
+        border-color: var(--alc-accent);
+      }
+      .pc strong {
+        font-family: var(--alc-font-sans);
+        font-weight: 600;
+        font-size: 16px;
+        color: var(--alc-fg-1);
+      }
+      .pc p {
+        margin: 0;
+        font-family: var(--alc-font-sans);
+        font-size: 13px;
+        line-height: 1.5;
+        color: var(--alc-fg-3);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="grid">
+        <div class="pc">
+          <strong>Cloudflare</strong>
+          <p>
+            Workers, R2 Buckets, KV, D1, Durable Objects, Queues, Vectorize, AI
+          </p>
+        </div>
+        <div class="pc" style="border-color: var(--alc-accent)">
+          <strong>AWS</strong>
+          <p>Lambda, S3, DynamoDB, SQS, Kinesis, IAM, EC2, API Gateway</p>
+        </div>
+        <div class="pc">
+          <strong>More</strong>
+          <p>
+            GitHub, Stripe, DNS, and a growing ecosystem of community providers
+          </p>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-tags.html b/.repos/alchemy-effect/website/design-system/preview/components-tags.html
new file mode 100644
index 00000000000..c5cd23dd78c
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-tags.html
@@ -0,0 +1,100 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Tags / chips</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: flex;
+        gap: 8px;
+        flex-wrap: wrap;
+        align-items: center;
+        margin-bottom: 12px;
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-3);
+        width: 72px;
+        flex-shrink: 0;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+      .chip {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        padding: 3px 8px;
+        border-radius: 4px;
+        border: 1px solid;
+      }
+      .create {
+        color: var(--alc-accent-deep);
+        border-color: rgba(92, 122, 62, 0.35);
+        background: rgba(92, 122, 62, 0.1);
+      }
+      .update {
+        color: #8a5e1a;
+        border-color: rgba(212, 154, 42, 0.4);
+        background: rgba(212, 154, 42, 0.12);
+      }
+      .replace {
+        color: var(--alc-terracotta-deep);
+        border-color: rgba(179, 70, 46, 0.35);
+        background: rgba(179, 70, 46, 0.1);
+      }
+      .info {
+        color: #2f5d6a;
+        border-color: rgba(74, 122, 138, 0.35);
+        background: rgba(74, 122, 138, 0.1);
+      }
+      .neutral {
+        color: var(--alc-fg-2);
+        border-color: var(--alc-hairline-3);
+        background: var(--alc-bg-elev-1);
+      }
+      .pill {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        padding: 2px 8px;
+        border-radius: 999px;
+        color: var(--alc-fg-on-accent);
+        background: var(--alc-accent);
+        font-weight: 500;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="label">status</div>
+        <span class="chip create">+ create</span>
+        <span class="chip update">~ update</span>
+        <span class="chip replace">⇄ replace</span>
+        <span class="chip neutral">no-op</span>
+      </div>
+      <div class="row">
+        <div class="label">meta</div>
+        <span class="chip info">Cloudflare.R2Bucket</span>
+        <span class="chip info">AWS.Lambda.Function</span>
+        <span class="chip neutral">v0.1.0</span>
+      </div>
+      <div class="row">
+        <div class="label">badge</div>
+        <span class="pill">alpha</span>
+        <span class="pill" style="background: var(--alc-terracotta)">beta</span>
+        <span
+          class="pill"
+          style="
+            background: transparent;
+            color: var(--alc-accent-deep);
+            border: 1px solid var(--alc-accent-40);
+          "
+          >new</span
+        >
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/components-terminal.html b/.repos/alchemy-effect/website/design-system/preview/components-terminal.html
new file mode 100644
index 00000000000..7db41819c81
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/components-terminal.html
@@ -0,0 +1,94 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Terminal</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .term {
+        background: var(--alc-bg-code);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        overflow: hidden;
+        box-shadow: var(--alc-shadow);
+      }
+      .bar {
+        display: flex;
+        align-items: center;
+        gap: 6px;
+        padding: 10px 14px;
+        border-bottom: 1px solid rgba(232, 220, 192, 0.1);
+        background: rgba(255, 255, 255, 0.02);
+      }
+      .dot {
+        width: 10px;
+        height: 10px;
+        border-radius: 50%;
+      }
+      .pre {
+        font-family: var(--alc-font-mono);
+        font-size: 13px;
+        line-height: 1.75;
+        color: var(--alc-code-var);
+        padding: 16px 18px;
+        margin: 0;
+      }
+      .g {
+        color: #d4f26a;
+        font-weight: 500;
+      } /* electric spring green */
+      .tick {
+        color: #d4f26a;
+        font-weight: 700;
+      }
+      .y {
+        color: #ffe38a;
+      } /* bright honey */
+      .d {
+        color: #d6c79a;
+      } /* bright warm tan */
+      .b {
+        color: #ffffff;
+        font-weight: 600;
+      } /* pure white */
+      .u {
+        text-decoration: underline;
+        color: #ffffff;
+        font-weight: 600;
+      }
+      .c {
+        color: #c5efa8;
+      } /* bright mint */
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="term">
+        <div class="bar">
+          <span class="dot" style="background: var(--alc-danger)"></span>
+          <span class="dot" style="background: var(--alc-warn)"></span>
+          <span class="dot" style="background: var(--alc-accent-bright)"></span>
+          <span
+            style="
+              font-family: var(--alc-font-mono);
+              font-size: 11px;
+              color: var(--alc-code-comment);
+              margin-left: 10px;
+            "
+            >~/my-app</span
+          >
+        </div>
+        <pre class="pre"><span class="d">$</span> alchemy deploy --stage prod
+
+<span class="u">Plan</span>: <span class="y">2 to create</span>
+
+<span class="g">+</span> <span class="b">Bucket</span> <span class="d">(Cloudflare.R2Bucket)</span>
+<span class="g">+</span> <span class="b">Worker</span> <span class="d">(Cloudflare.Worker)</span> <span class="c">(1 bindings)</span>
+  <span class="g">+</span> <span class="c">Bucket</span>
+
+<span class="tick">✓</span> <span class="b">Bucket</span> <span class="d">(Cloudflare.R2Bucket)</span> <span class="g">created</span>
+<span class="tick">✓</span> <span class="b">Worker</span> <span class="d">(Cloudflare.Worker)</span> <span class="g">created</span></pre>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/spacing-elevation.html b/.repos/alchemy-effect/website/design-system/preview/spacing-elevation.html
new file mode 100644
index 00000000000..edfbdfac701
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/spacing-elevation.html
@@ -0,0 +1,70 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Elevation</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: grid;
+        grid-template-columns: repeat(3, 1fr);
+        gap: 20px;
+        padding: 20px 10px;
+      }
+      .cell {
+        text-align: center;
+      }
+      .box {
+        width: 120px;
+        height: 80px;
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        margin: 0 auto 10px;
+      }
+      .s1 {
+        box-shadow: var(--alc-shadow-sm);
+      }
+      .s2 {
+        box-shadow: var(--alc-shadow);
+      }
+      .s3 {
+        box-shadow: var(--alc-glow);
+        border-color: transparent;
+      }
+      .name {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-1);
+        font-weight: 500;
+      }
+      .desc {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-3);
+        margin-top: 2px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="cell">
+          <div class="box s1"></div>
+          <div class="name">shadow-sm</div>
+          <div class="desc">floating chips</div>
+        </div>
+        <div class="cell">
+          <div class="box s2"></div>
+          <div class="name">shadow</div>
+          <div class="desc">popovers, menus</div>
+        </div>
+        <div class="cell">
+          <div class="box s3"></div>
+          <div class="name">glow</div>
+          <div class="desc">focus, active CTA</div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/spacing-radius.html b/.repos/alchemy-effect/website/design-system/preview/spacing-radius.html
new file mode 100644
index 00000000000..75636281e6e
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/spacing-radius.html
@@ -0,0 +1,72 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Radii</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .grid {
+        display: grid;
+        grid-template-columns: repeat(6, 1fr);
+        gap: 12px;
+      }
+      .cell {
+        text-align: center;
+      }
+      .box {
+        width: 72px;
+        height: 72px;
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline-2);
+        margin: 0 auto 8px;
+      }
+      .name {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-1);
+      }
+      .px {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-4);
+        margin-top: 2px;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="grid">
+        <div class="cell">
+          <div class="box" style="border-radius: 2px"></div>
+          <div class="name">xs</div>
+          <div class="px">2</div>
+        </div>
+        <div class="cell">
+          <div class="box" style="border-radius: 4px"></div>
+          <div class="name">sm</div>
+          <div class="px">4</div>
+        </div>
+        <div class="cell">
+          <div class="box" style="border-radius: 8px"></div>
+          <div class="name">base</div>
+          <div class="px">8</div>
+        </div>
+        <div class="cell">
+          <div class="box" style="border-radius: 10px"></div>
+          <div class="name">md</div>
+          <div class="px">10</div>
+        </div>
+        <div class="cell">
+          <div class="box" style="border-radius: 12px"></div>
+          <div class="name">lg</div>
+          <div class="px">12</div>
+        </div>
+        <div class="cell">
+          <div class="box" style="border-radius: 16px"></div>
+          <div class="name">xl</div>
+          <div class="px">16</div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/spacing-scale.html b/.repos/alchemy-effect/website/design-system/preview/spacing-scale.html
new file mode 100644
index 00000000000..25190689063
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/spacing-scale.html
@@ -0,0 +1,82 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Spacing scale</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: flex;
+        align-items: center;
+        gap: 12px;
+        margin-bottom: 6px;
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-3);
+        width: 84px;
+        flex-shrink: 0;
+      }
+      .bar {
+        background: var(--alc-accent);
+        height: 10px;
+        border-radius: 2px;
+      }
+      .px {
+        font-family: var(--alc-font-mono);
+        font-size: 10px;
+        color: var(--alc-fg-4);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="label">space-1</div>
+        <div class="bar" style="width: 4px"></div>
+        <div class="px">4</div>
+      </div>
+      <div class="row">
+        <div class="label">space-2</div>
+        <div class="bar" style="width: 8px"></div>
+        <div class="px">8</div>
+      </div>
+      <div class="row">
+        <div class="label">space-3</div>
+        <div class="bar" style="width: 12px"></div>
+        <div class="px">12</div>
+      </div>
+      <div class="row">
+        <div class="label">space-4</div>
+        <div class="bar" style="width: 16px"></div>
+        <div class="px">16</div>
+      </div>
+      <div class="row">
+        <div class="label">space-5</div>
+        <div class="bar" style="width: 24px"></div>
+        <div class="px">24</div>
+      </div>
+      <div class="row">
+        <div class="label">space-6</div>
+        <div class="bar" style="width: 32px"></div>
+        <div class="px">32</div>
+      </div>
+      <div class="row">
+        <div class="label">space-7</div>
+        <div class="bar" style="width: 48px"></div>
+        <div class="px">48</div>
+      </div>
+      <div class="row">
+        <div class="label">space-8</div>
+        <div class="bar" style="width: 64px"></div>
+        <div class="px">64</div>
+      </div>
+      <div class="row">
+        <div class="label">space-9</div>
+        <div class="bar" style="width: 96px"></div>
+        <div class="px">96</div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/type-body.html b/.repos/alchemy-effect/website/design-system/preview/type-body.html
new file mode 100644
index 00000000000..0fb5f3ae39a
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/type-body.html
@@ -0,0 +1,94 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Body + mono</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: flex;
+        gap: 20px;
+        align-items: flex-start;
+        margin-bottom: 14px;
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-4);
+        width: 90px;
+        flex-shrink: 0;
+        padding-top: 3px;
+      }
+      .body-lg {
+        font-family: var(--alc-font-sans);
+        font-size: 18px;
+        line-height: 1.6;
+        color: var(--alc-fg-2);
+      }
+      .body {
+        font-family: var(--alc-font-sans);
+        font-size: 15px;
+        line-height: 1.6;
+        color: var(--alc-fg-2);
+      }
+      .small {
+        font-family: var(--alc-font-sans);
+        font-size: 13px;
+        line-height: 1.5;
+        color: var(--alc-fg-3);
+      }
+      .mono {
+        font-family: var(--alc-font-mono);
+        font-size: 13px;
+        color: var(--alc-fg-1);
+      }
+      .eyebrow {
+        font-family: var(--alc-font-mono);
+        font-size: 12px;
+        letter-spacing: 0.1em;
+        text-transform: uppercase;
+        font-weight: 500;
+        color: var(--alc-accent);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="label">eyebrow</div>
+        <div class="eyebrow">Getting Started</div>
+      </div>
+      <div class="row">
+        <div class="label">body-lg 18</div>
+        <div class="body-lg">
+          Your infrastructure and application logic in a single, type-safe
+          program.
+        </div>
+      </div>
+      <div class="row">
+        <div class="label">body 15</div>
+        <div class="body">
+          Resources are declared as Effects and composed with
+          <code
+            style="
+              font-family: var(--alc-font-mono);
+              font-size: 13px;
+              color: var(--alc-fg-1);
+            "
+            >yield*</code
+          >.
+        </div>
+      </div>
+      <div class="row">
+        <div class="label">small 13</div>
+        <div class="small">
+          New to Alchemy? Follow the hands-on tutorial from zero to CI/CD.
+        </div>
+      </div>
+      <div class="row">
+        <div class="label">mono 13</div>
+        <div class="mono">bun alchemy deploy --stage prod</div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/type-display.html b/.repos/alchemy-effect/website/design-system/preview/type-display.html
new file mode 100644
index 00000000000..539c1ac52d0
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/type-display.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Display type</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .display {
+        font-family: var(--alc-font-serif);
+        font-weight: 500;
+        font-size: 72px;
+        line-height: 1.02;
+        letter-spacing: -0.015em;
+        color: var(--alc-fg-1);
+      }
+      .display .em {
+        color: var(--alc-accent-deep);
+        font-style: italic;
+        font-weight: 500;
+      }
+      .meta {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-3);
+        margin-top: 16px;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="display">
+        Infrastructure as <span class="em">Effects</span>.
+      </div>
+      <div class="meta">
+        Source Serif 4 · 500 · 72/74 · -0.015em · italic moss on emphasis
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/type-hand.html b/.repos/alchemy-effect/website/design-system/preview/type-hand.html
new file mode 100644
index 00000000000..cdb1ba23bed
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/type-hand.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Hand lettering</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .wrap {
+        background: var(--alc-bg-elev-1);
+        border: 1px solid var(--alc-hairline);
+        border-radius: 8px;
+        padding: 28px 24px;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        gap: 14px;
+        flex-wrap: wrap;
+      }
+      .hand {
+        font-family: "Caveat", cursive;
+        font-weight: 700;
+        font-size: 42px;
+        color: var(--alc-accent-deep);
+        line-height: 1;
+      }
+      .arrow {
+        font-family: "Caveat", cursive;
+        font-size: 38px;
+        color: var(--alc-walnut-600);
+        font-weight: 600;
+      }
+      .meta {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-3);
+        margin-top: 12px;
+        text-align: center;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="wrap">
+        <span class="hand">Function</span>
+        <span class="arrow">→</span>
+        <span class="hand">Binding</span>
+        <span class="arrow">→</span>
+        <span class="hand">Resource</span>
+      </div>
+      <div class="meta">
+        Caveat 700 · hand-drawn diagram labels · moss on parchment
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/design-system/preview/type-headings.html b/.repos/alchemy-effect/website/design-system/preview/type-headings.html
new file mode 100644
index 00000000000..d94ebc78d9a
--- /dev/null
+++ b/.repos/alchemy-effect/website/design-system/preview/type-headings.html
@@ -0,0 +1,80 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>Heading scale</title>
+    <link rel="stylesheet" href="_card.css" />
+    <style>
+      .row {
+        display: flex;
+        align-items: baseline;
+        gap: 20px;
+        margin-bottom: 14px;
+      }
+      .label {
+        font-family: var(--alc-font-mono);
+        font-size: 11px;
+        color: var(--alc-fg-3);
+        width: 100px;
+        flex-shrink: 0;
+        text-transform: uppercase;
+        letter-spacing: 0.05em;
+      }
+      .h1 {
+        font-family: var(--alc-font-serif);
+        font-size: 52px;
+        font-weight: 500;
+        letter-spacing: -0.015em;
+        color: var(--alc-fg-1);
+        line-height: 1;
+      }
+      .h2 {
+        font-family: var(--alc-font-serif);
+        font-size: 34px;
+        font-weight: 500;
+        letter-spacing: -0.01em;
+        color: var(--alc-fg-1);
+        line-height: 1.1;
+      }
+      .h3 {
+        font-family: var(--alc-font-sans);
+        font-size: 22px;
+        font-weight: 600;
+        letter-spacing: -0.01em;
+        color: var(--alc-fg-1);
+        line-height: 1.2;
+      }
+      .h4 {
+        font-family: var(--alc-font-sans);
+        font-size: 17px;
+        font-weight: 600;
+        color: var(--alc-fg-1);
+        line-height: 1.35;
+      }
+      .em {
+        color: var(--alc-accent-deep);
+        font-style: italic;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <div class="row">
+        <div class="label">H1 · Serif 500</div>
+        <div class="h1">Resources as <span class="em">Effects</span></div>
+      </div>
+      <div class="row">
+        <div class="label">H2 · Serif 500</div>
+        <div class="h2">Plan, deploy, destroy</div>
+      </div>
+      <div class="row">
+        <div class="label">H3 · Sans 600</div>
+        <div class="h3">Type-safe from cloud to code</div>
+      </div>
+      <div class="row">
+        <div class="label">H4 · Sans 600</div>
+        <div class="h4">Local dev with hot reload</div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/.repos/alchemy-effect/website/ec.config.mjs b/.repos/alchemy-effect/website/ec.config.mjs
new file mode 100644
index 00000000000..a739446e7f5
--- /dev/null
+++ b/.repos/alchemy-effect/website/ec.config.mjs
@@ -0,0 +1,44 @@
+import { defineEcConfig } from "@astrojs/starlight/expressive-code";
+import ecTwoSlash from "expressive-code-twoslash";
+import { alchemyWalnutTheme } from "./plugins/alchemy-walnut-theme.mjs";
+import { capitalizedIdentifierColor } from "./plugins/capitalized-identifier-color.mjs";
+import {
+  twoslashDiffPrefixAnnotate,
+  twoslashDiffPrefixStrip,
+} from "./plugins/twoslash-diff-prefix.mjs";
+import { twoslashErrorTransform } from "./plugins/twoslash-error-transform.mjs";
+
+const baseUrl = new URL("../", import.meta.url).pathname;
+
+export default defineEcConfig({
+  themes: [alchemyWalnutTheme],
+  plugins: [
+    twoslashDiffPrefixStrip(),
+    ecTwoSlash({
+      instanceConfigs: {
+        twoslash: {
+          explicitTrigger: true,
+          languages: ["ts", "tsx", "typescript"],
+        },
+      },
+      twoslashOptions: {
+        customTags: ["error", "warn", "log", "annotate"],
+        compilerOptions: {
+          moduleResolution: /** @type {any} */ (100), // Bundler
+          module: /** @type {any} */ (99), // ESNext
+          target: /** @type {any} */ (9), // ES2022
+          strict: true,
+          types: ["bun"],
+          baseUrl,
+          paths: {
+            alchemy: ["./packages/alchemy/src/index.ts"],
+            "alchemy/*": ["./packages/alchemy/src/*"],
+          },
+        },
+      },
+    }),
+    twoslashDiffPrefixAnnotate(),
+    twoslashErrorTransform(),
+    capitalizedIdentifierColor(),
+  ],
+});
diff --git a/.repos/alchemy-effect/website/package.json b/.repos/alchemy-effect/website/package.json
new file mode 100644
index 00000000000..6b33df3aab3
--- /dev/null
+++ b/.repos/alchemy-effect/website/package.json
@@ -0,0 +1,56 @@
+{
+  "name": "website",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alchemy-run/alchemy-effect.git",
+    "directory": "website"
+  },
+  "type": "module",
+  "scripts": {
+    "build:reference": "bun ../scripts/generate-api-reference.ts",
+    "build:llms": "bun scripts/generate-llms-txt.ts",
+    "generate:readme-hero": "bun scripts/download-fonts.ts && bun scripts/generate-readme-hero.ts",
+    "build": "bun scripts/download-fonts.ts && bun scripts/generate-brand-assets.ts && bun run build:reference && bun run build:llms && NODE_OPTIONS=--max-old-space-size=8192 astro build",
+    "dev:site": "astro dev",
+    "deploy": "alchemy deploy",
+    "dev": "alchemy dev",
+    "destroy": "alchemy destroy",
+    "preview": "astro preview",
+    "astro": "astro"
+  },
+  "dependencies": {
+    "@astrojs/check": "^0.9.4",
+    "@astrojs/mdx": "^5.0.3",
+    "@astrojs/react": "^5.0.3",
+    "@astrojs/sitemap": "^3.5.0",
+    "@astrojs/starlight": "^0.34.3",
+    "@astrojs/starlight-tailwind": "^4.0.1",
+    "@effect/platform-node": "catalog:",
+    "@iconify-json/logos": "^1.2.11",
+    "@iconify-json/lucide": "^1.2.102",
+    "@iconify/react": "^6.0.2",
+    "@resvg/resvg-js": "^2.6.2",
+    "@tailwindcss/vite": "^4.1.14",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "alchemy": "workspace:*",
+    "astro": "^5.12.8",
+    "effect": "catalog:",
+    "expressive-code-twoslash": "^0.6.1",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
+    "react-icons": "^5.6.0",
+    "rehype-mermaid": "^3.0.0",
+    "satori": "^0.26.0",
+    "starlight-blog": "0.24.0",
+    "tailwindcss": "^4.1.14"
+  },
+  "devDependencies": {
+    "astro-broken-links-checker": "^1.1.0",
+    "typescript": "catalog:",
+    "zod": "^3"
+  }
+}
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/plugins/alchemy-walnut-theme.mjs b/.repos/alchemy-effect/website/plugins/alchemy-walnut-theme.mjs
new file mode 100644
index 00000000000..dbca295d47f
--- /dev/null
+++ b/.repos/alchemy-effect/website/plugins/alchemy-walnut-theme.mjs
@@ -0,0 +1,185 @@
+import { ExpressiveCodeTheme } from "@astrojs/starlight/expressive-code";
+
+/**
+ * Alchemy "walnut sunrise" Expressive Code theme.
+ *
+ * Dark walnut bg (#2a2620) + sunrise syntax tokens that match the design
+ * system's `--alc-code-*` variables. Designed for legibility on cream
+ * parchment pages where every other surface is light.
+ */
+const walnutSunrise = {
+  name: "alchemy-walnut-sunrise",
+  type: "dark",
+  semanticHighlighting: true,
+  colors: {
+    "editor.background": "#2a2620",
+    "editor.foreground": "#faf5e3",
+    "editor.lineHighlightBackground": "#36302280",
+    "editor.selectionBackground": "#5c7a3e66",
+    "editorLineNumber.foreground": "#85714f",
+    "editorLineNumber.activeForeground": "#faf5e3",
+    "editorIndentGuide.background": "#4e402c",
+    "editorIndentGuide.activeBackground": "#68573c",
+    "editorBracketMatch.background": "#5c7a3e33",
+    "editorBracketMatch.border": "#5c7a3e",
+    "editorWidget.background": "#363022",
+    "editorWidget.border": "#4e402c",
+    "editorHoverWidget.background": "#363022",
+    "editorHoverWidget.border": "#4e402c",
+    "editorGroupHeader.tabsBackground": "#1a1813",
+    "tab.activeBackground": "#2a2620",
+    "tab.inactiveBackground": "#1a1813",
+    "tab.activeForeground": "#faf5e3",
+    "tab.inactiveForeground": "#a89572",
+    "tab.border": "#4e402c",
+    focusBorder: "#5c7a3e",
+    "scrollbarSlider.background": "#4e402c80",
+    "scrollbarSlider.hoverBackground": "#68573c80",
+    "scrollbarSlider.activeBackground": "#85714f80",
+    "diffEditor.insertedTextBackground": "#5c7a3e26",
+    "diffEditor.removedTextBackground": "#b3462e26",
+  },
+  tokenColors: [
+    {
+      scope: ["comment", "punctuation.definition.comment", "string.comment"],
+      settings: { foreground: "#b3a27a", fontStyle: "italic" },
+    },
+    {
+      scope: [
+        "keyword",
+        "storage",
+        "storage.type",
+        "storage.modifier",
+        "keyword.control",
+        "keyword.operator.new",
+        "keyword.operator.expression",
+        "keyword.other",
+      ],
+      settings: { foreground: "#d4f26a" },
+    },
+    {
+      scope: [
+        "keyword.operator",
+        "punctuation.separator",
+        "punctuation.terminator",
+      ],
+      settings: { foreground: "#c7b795" },
+    },
+    {
+      scope: ["string", "string.quoted", "punctuation.definition.string"],
+      settings: { foreground: "#ffe38a" },
+    },
+    {
+      scope: ["string.template", "punctuation.definition.template-expression"],
+      settings: { foreground: "#ffe38a" },
+    },
+    {
+      scope: ["constant.numeric", "constant.language", "constant.character"],
+      settings: { foreground: "#ff9a6b" },
+    },
+    {
+      scope: [
+        "constant.language.boolean",
+        "constant.language.null",
+        "constant.language.undefined",
+      ],
+      settings: { foreground: "#ff9a6b" },
+    },
+    {
+      scope: [
+        "entity.name.function",
+        "support.function",
+        "meta.function-call entity.name.function",
+        "meta.function-call.method entity.name.function",
+        "variable.function",
+        "meta.definition.method entity.name.function",
+      ],
+      settings: { foreground: "#7ddfff" },
+    },
+    {
+      scope: [
+        "entity.name.type",
+        "entity.name.class",
+        "entity.name.interface",
+        "entity.name.namespace",
+        "support.type",
+        "support.class",
+        "support.other.namespace",
+        "support.module",
+        "meta.type",
+      ],
+      settings: { foreground: "#7ddfff" },
+    },
+    {
+      scope: [
+        "variable.other.object",
+        "variable.other.readwrite.alias",
+        "meta.import variable.other.readwrite",
+        "meta.export variable.other.readwrite",
+        "meta.object-literal.key support.type.object",
+      ],
+      settings: { foreground: "#7ddfff" },
+    },
+    {
+      scope: ["entity.name.tag", "meta.tag entity.name.tag"],
+      settings: { foreground: "#ffb968" },
+    },
+    {
+      scope: ["entity.other.attribute-name"],
+      settings: { foreground: "#d4f26a", fontStyle: "italic" },
+    },
+    {
+      scope: [
+        "variable",
+        "variable.other",
+        "variable.parameter",
+        "meta.definition.variable variable.other",
+      ],
+      settings: { foreground: "#faf5e3" },
+    },
+    {
+      scope: ["variable.other.constant"],
+      settings: { foreground: "#7ddfff" },
+    },
+    {
+      scope: ["variable.other.enummember"],
+      settings: { foreground: "#ff9a6b" },
+    },
+    {
+      scope: ["variable.other.property", "meta.object.member"],
+      settings: { foreground: "#faf5e3" },
+    },
+    {
+      scope: ["support.variable", "support.constant"],
+      settings: { foreground: "#7ddfff" },
+    },
+    {
+      scope: ["punctuation.section.embedded", "meta.embedded"],
+      settings: { foreground: "#faf5e3" },
+    },
+    {
+      scope: ["markup.heading", "markup.bold"],
+      settings: { foreground: "#faf5e3", fontStyle: "bold" },
+    },
+    {
+      scope: ["markup.italic"],
+      settings: { foreground: "#faf5e3", fontStyle: "italic" },
+    },
+    {
+      scope: ["markup.inserted", "markup.inserted.diff"],
+      settings: { foreground: "#8fb15e" },
+    },
+    {
+      scope: ["markup.deleted", "markup.deleted.diff"],
+      settings: { foreground: "#e07a5f" },
+    },
+    {
+      scope: ["invalid", "invalid.illegal"],
+      settings: { foreground: "#e07a5f" },
+    },
+  ],
+};
+
+export const alchemyWalnutTheme = ExpressiveCodeTheme.fromJSONString(
+  JSON.stringify(walnutSunrise),
+);
diff --git a/.repos/alchemy-effect/website/plugins/capitalized-identifier-color.mjs b/.repos/alchemy-effect/website/plugins/capitalized-identifier-color.mjs
new file mode 100644
index 00000000000..17f0bb0df60
--- /dev/null
+++ b/.repos/alchemy-effect/website/plugins/capitalized-identifier-color.mjs
@@ -0,0 +1,87 @@
+/**
+ * Expressive Code plugin that paints every bare capitalized identifier
+ * in TS/JS code blocks with the "type cyan" used by the marketing
+ * highlighter (`src/components/marketing/highlightTS.ts`).
+ *
+ * Why: the TextMate TS grammar shipped with shiki does NOT tokenize
+ * namespace references in expression position — `Alchemy` and `Effect`
+ * inside `Alchemy.Stack(...)` and `Effect.gen(...)` come out as plain
+ * untokenized text and fall back to the editor foreground. The
+ * marketing landing page colors every capitalized identifier cyan,
+ * giving snippets a distinct "type-y" rhythm. This plugin re-applies
+ * that same rule to docs code blocks so syntax matches across the
+ * whole site.
+ *
+ * The plugin runs AFTER syntax highlighting (which adds its own
+ * `InlineStyleAnnotation`s with the walnut-sunrise colors), and skips
+ * matches that overlap an existing string or comment annotation so
+ * we don't recolor things like `"MyApp"` inside a string literal.
+ */
+import { InlineStyleAnnotation } from "@astrojs/starlight/expressive-code";
+
+const TARGET_LANGS = new Set([
+  "ts",
+  "tsx",
+  "typescript",
+  "js",
+  "jsx",
+  "javascript",
+  "mts",
+  "cts",
+]);
+
+const CAP_IDENT_RE = /\b[A-Z][A-Za-z0-9_]*\b/g;
+
+const CYAN = "#7ddfff";
+const STRING_COLOR = "#ffe38a";
+const COMMENT_COLOR = "#b3a27a";
+
+const eq = (a, b) => (a || "").toLowerCase() === b.toLowerCase();
+
+export function capitalizedIdentifierColor() {
+  return {
+    name: "capitalized-identifier-color",
+    hooks: {
+      postprocessAnalyzedCode({ codeBlock }) {
+        if (!TARGET_LANGS.has(codeBlock.language)) return;
+
+        for (const line of codeBlock.getLines()) {
+          // Snapshot column ranges that already belong to strings or
+          // comments — we don't want to recolor characters inside them
+          // (e.g. the `MyApp` in `Alchemy.Stack("MyApp", ...)`).
+          const skipRanges = [];
+          for (const ann of line.getAnnotations()) {
+            if (!ann.inlineRange) continue;
+            const c = ann.color;
+            if (eq(c, STRING_COLOR) || eq(c, COMMENT_COLOR)) {
+              skipRanges.push(ann.inlineRange);
+            }
+          }
+
+          const text = line.text;
+          CAP_IDENT_RE.lastIndex = 0;
+          let m;
+          while ((m = CAP_IDENT_RE.exec(text)) !== null) {
+            const columnStart = m.index;
+            const columnEnd = columnStart + m[0].length;
+            const overlapsSkip = skipRanges.some(
+              (r) => columnStart < r.columnEnd && columnEnd > r.columnStart,
+            );
+            if (overlapsSkip) continue;
+
+            line.addAnnotation(
+              new InlineStyleAnnotation({
+                color: CYAN,
+                inlineRange: { columnStart, columnEnd },
+                // `normal` phase: runs after syntax highlighting
+                // (`earliest`), so the cyan wraps and overrides any
+                // walnut-sunrise color the tokenizer applied.
+                renderPhase: "normal",
+              }),
+            );
+          }
+        }
+      },
+    },
+  };
+}
diff --git a/.repos/alchemy-effect/website/plugins/pagefind-ignore-noise.mjs b/.repos/alchemy-effect/website/plugins/pagefind-ignore-noise.mjs
new file mode 100644
index 00000000000..ae905c37ace
--- /dev/null
+++ b/.repos/alchemy-effect/website/plugins/pagefind-ignore-noise.mjs
@@ -0,0 +1,86 @@
+// @ts-check
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Walks the build output and tags noisy elements with
+ * `data-pagefind-ignore` so Pagefind's excerpt picker reaches for prose
+ * instead of code samples, sidebar nav, TOC, page footer, etc.
+ *
+ * Must run before Starlight's own `astro:build:done` hook, which spawns
+ * Pagefind. Astro runs hooks in integration registration order, so this
+ * integration must be listed before `starlight()` in `integrations`.
+ *
+ * @returns {import("astro").AstroIntegration}
+ */
+export function pagefindIgnoreNoise() {
+  // Selectors (matched as opening-tag class strings) we want Pagefind to
+  // skip. We add the attribute as `data-pagefind-ignore="all"` so any
+  // headings inside also stop being indexed (otherwise headings inside a
+  // collapsed code block would still show up as sub-results).
+  const classMatchers = [
+    // Expressive Code wraps every fenced code block in this div.
+    "expressive-code",
+    // Starlight's TOC, sidebar, page footer, pagination, header.
+    "right-sidebar",
+    "sidebar-pane",
+    "sl-sidebar-state-persist",
+    "pagination-links",
+    "sl-mobile-toc",
+    "site-search",
+  ];
+  const classRegex = new RegExp(
+    `<(div|nav|aside|figure|header|footer|details|site-search)([^>]*?)class="([^"]*?\\b(?:${classMatchers.join("|")})\\b[^"]*?)"([^>]*?)>`,
+    "g",
+  );
+  // Also tag every <pre> directly, which catches the inner code element
+  // even if Expressive Code wrapping ever changes.
+  const preRegex = /<pre(\s[^>]*)?>/g;
+  // Provider docs auto-generated from JSDoc start with a
+  // "> **Source:** `src/...`" blockquote that's noise for search excerpts.
+  const sourceBlockquoteRegex =
+    /<blockquote>\s*<p><strong>Source:<\/strong>[\s\S]*?<\/p>\s*<\/blockquote>/g;
+
+  /** @param {string} html */
+  function rewrite(html) {
+    let out = html.replace(classRegex, (match, tag, pre, cls, post) => {
+      if (match.includes("data-pagefind-ignore")) return match;
+      return `<${tag}${pre}class="${cls}" data-pagefind-ignore="all"${post}>`;
+    });
+    out = out.replace(preRegex, (match, attrs = "") => {
+      if (match.includes("data-pagefind-ignore")) return match;
+      return `<pre${attrs} data-pagefind-ignore="all">`;
+    });
+    out = out.replace(sourceBlockquoteRegex, (match) =>
+      match.replace("<blockquote>", '<blockquote data-pagefind-ignore="all">'),
+    );
+    return out;
+  }
+
+  return {
+    name: "pagefind-ignore-noise",
+    hooks: {
+      "astro:build:done": async ({ dir }) => {
+        const outDir = fileURLToPath(dir);
+
+        /** @param {string} d */
+        async function walk(d) {
+          const entries = await fs.readdir(d, { withFileTypes: true });
+          for (const e of entries) {
+            const full = path.join(d, e.name);
+            if (e.isDirectory()) {
+              await walk(full);
+            } else if (e.isFile() && e.name.endsWith(".html")) {
+              const before = await fs.readFile(full, "utf8");
+              const after = rewrite(before);
+              if (after !== before) await fs.writeFile(full, after);
+            }
+          }
+        }
+
+        await walk(outDir);
+      },
+    },
+  };
+}
diff --git a/.repos/alchemy-effect/website/plugins/twoslash-diff-prefix.mjs b/.repos/alchemy-effect/website/plugins/twoslash-diff-prefix.mjs
new file mode 100644
index 00000000000..8d6e1bb3501
--- /dev/null
+++ b/.repos/alchemy-effect/website/plugins/twoslash-diff-prefix.mjs
@@ -0,0 +1,103 @@
+/**
+ * Expressive Code plugin pair that adds `+` / `-` line-prefix support to
+ * twoslash code blocks, similar to ```diff lang="typescript" but with
+ * twoslash type-checking.
+ *
+ * Usage:
+ *   ```typescript twoslash
+ *   // @errors: 2345
+ *   import { Bucket } from "./bucket.ts";
+ * + const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+ *   ```
+ *
+ * How it works:
+ *   1. `twoslashDiffPrefixStrip` runs BEFORE `ecTwoSlash` and rewrites
+ *      each `+ foo` / `- foo` line into `  foo ...` with a trailing tag
+ *      comment (`/_ __ALCHEMY_DIFF_INS__ _/` or `..._DEL__...`). This
+ *      gives the TypeScript compiler valid source while preserving a
+ *      marker that survives twoslash's rendered output.
+ *   2. `twoslashDiffPrefixAnnotate` runs AFTER `ecTwoSlash` has replaced
+ *      each block line with its rendered twoslash output. It scans the
+ *      rendered lines for the tag comment, strips it, and attaches a
+ *      full-line `highlight ins` / `highlight del` class annotation
+ *      using the same CSS that `@expressive-code/plugin-text-markers`
+ *      ships.
+ */
+import { ExpressiveCodeAnnotation } from "@astrojs/starlight/expressive-code";
+import { addClassName } from "@astrojs/starlight/expressive-code/hast";
+
+const INS_TAG = "/* __ALCHEMY_DIFF_INS__ */";
+const DEL_TAG = "/* __ALCHEMY_DIFF_DEL__ */";
+
+const isTwoslash = (codeBlock) => /\btwoslash\b/.test(codeBlock.meta);
+
+class DiffMarkerAnnotation extends ExpressiveCodeAnnotation {
+  constructor(markerType) {
+    super({});
+    this.markerType = markerType;
+  }
+  render({ nodesToTransform }) {
+    return nodesToTransform.map((node) => {
+      if (node.type === "element") {
+        addClassName(node, "highlight");
+        addClassName(node, this.markerType);
+      }
+      return node;
+    });
+  }
+}
+
+/** Register BEFORE `ecTwoSlash(...)` in the Expressive Code plugins array. */
+export function twoslashDiffPrefixStrip() {
+  return {
+    name: "twoslash-diff-prefix-strip",
+    hooks: {
+      preprocessCode({ codeBlock }) {
+        if (!isTwoslash(codeBlock)) return;
+        for (const line of codeBlock.getLines()) {
+          // Match a `+` or `-` at column 0 (but not `++`/`--`/`+-`/`-+`).
+          // If followed by a space (or end of line), replace the marker with
+          // a single space so column alignment of the rest of the line is
+          // preserved exactly as authored. If followed by a non-space
+          // character (e.g. `+import ...`), drop the marker entirely so
+          // top-level statements stay flush-left.
+          const match = line.text.match(/^([+-])(?![+-])(.*)$/);
+          if (!match) continue;
+          const [, marker, rest] = match;
+          const tag = marker === "+" ? INS_TAG : DEL_TAG;
+          const replacement =
+            rest.length === 0 || rest.startsWith(" ") ? ` ${rest}` : rest;
+          line.editText(0, line.text.length, `${replacement} ${tag}`);
+        }
+      },
+    },
+  };
+}
+
+/** Register AFTER `ecTwoSlash(...)` in the Expressive Code plugins array. */
+export function twoslashDiffPrefixAnnotate() {
+  return {
+    name: "twoslash-diff-prefix-annotate",
+    hooks: {
+      preprocessCode({ codeBlock }) {
+        if (!isTwoslash(codeBlock)) return;
+        for (const line of codeBlock.getLines()) {
+          const text = line.text;
+          let markerType;
+          let tagLength;
+          if (text.endsWith(` ${INS_TAG}`)) {
+            markerType = "ins";
+            tagLength = INS_TAG.length + 1; // +1 for leading space
+          } else if (text.endsWith(` ${DEL_TAG}`)) {
+            markerType = "del";
+            tagLength = DEL_TAG.length + 1;
+          } else {
+            continue;
+          }
+          line.editText(text.length - tagLength, text.length, "");
+          line.addAnnotation(new DiffMarkerAnnotation(markerType));
+        }
+      },
+    },
+  };
+}
diff --git a/.repos/alchemy-effect/website/plugins/twoslash-error-transform.mjs b/.repos/alchemy-effect/website/plugins/twoslash-error-transform.mjs
new file mode 100644
index 00000000000..ffa2d161dd7
--- /dev/null
+++ b/.repos/alchemy-effect/website/plugins/twoslash-error-transform.mjs
@@ -0,0 +1,42 @@
+/**
+ * Expressive Code plugin that transforms twoslash error text per code block.
+ *
+ * Use `errorReplace` in the code block meta to specify regex replacements:
+ *   errorReplace="pattern::replacement"
+ *
+ * Patterns are JavaScript regexes applied with the dotAll flag (. matches newlines).
+ * Must be the last attribute in the meta string.
+ * Use double quotes when the value contains single quotes, or vice versa.
+ */
+export function twoslashErrorTransform() {
+  return {
+    name: "twoslash-error-transform",
+    hooks: {
+      postprocessAnnotations({ codeBlock }) {
+        const meta = codeBlock.meta;
+        const match =
+          meta.match(/errorReplace="(.*)"\s*$/) ||
+          meta.match(/errorReplace='(.*)'\s*$/);
+        if (!match) return;
+
+        const raw = match[1];
+        const sepIndex = raw.indexOf("::");
+        if (sepIndex === -1) return;
+
+        const pattern = new RegExp(raw.slice(0, sepIndex), "s");
+        const replacement = raw.slice(sepIndex + 2);
+
+        for (const line of codeBlock.getLines()) {
+          for (const annotation of line.getAnnotations()) {
+            if (annotation.name === "twoslash-error-box") {
+              annotation.error.text = annotation.error.text.replace(
+                pattern,
+                replacement,
+              );
+            }
+          }
+        }
+      },
+    },
+  };
+}
diff --git a/.repos/alchemy-effect/website/probe-shiki.mjs b/.repos/alchemy-effect/website/probe-shiki.mjs
new file mode 100644
index 00000000000..9f844999a3b
--- /dev/null
+++ b/.repos/alchemy-effect/website/probe-shiki.mjs
@@ -0,0 +1,31 @@
+import { createHighlighter } from "shiki/index.mjs";
+import { createOnigurumaEngine } from "shiki/engine/oniguruma";
+const hl = await createHighlighter({
+  themes: ["github-dark"],
+  langs: ["typescript"],
+  engine: await createOnigurumaEngine(import("shiki/wasm")),
+});
+const code = `import * as Alchemy from "alchemy";
+import * as Effect from "effect/Effect";
+export default Alchemy.Stack(
+  "MyApp",
+  {},
+  Effect.gen(function* () {
+    yield* Photos;
+  }),
+);`;
+const tokens = hl.codeToTokensBase(code, {
+  lang: "typescript",
+  theme: "github-dark",
+  includeExplanation: "scopeName",
+});
+for (const line of tokens) {
+  for (const t of line) {
+    if (!t.content.trim()) continue;
+    const scopes = (t.explanation?.[0]?.scopes ?? [])
+      .map((s) => s.scopeName)
+      .join(" → ");
+    console.log(JSON.stringify(t.content).padEnd(14), scopes);
+  }
+  console.log("---");
+}
diff --git a/.repos/alchemy-effect/website/public/apple-touch-icon.png b/.repos/alchemy-effect/website/public/apple-touch-icon.png
new file mode 100644
index 00000000000..82cb3b24ecf
Binary files /dev/null and b/.repos/alchemy-effect/website/public/apple-touch-icon.png differ
diff --git a/.repos/alchemy-effect/website/public/bun-logo.svg b/.repos/alchemy-effect/website/public/bun-logo.svg
new file mode 100644
index 00000000000..7ef15001d2d
--- /dev/null
+++ b/.repos/alchemy-effect/website/public/bun-logo.svg
@@ -0,0 +1 @@
+<svg id="Bun" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 70"><title>Bun Logo</title><path id="Shadow" d="M71.09,20.74c-.16-.17-.33-.34-.5-.5s-.33-.34-.5-.5-.33-.34-.5-.5-.33-.34-.5-.5-.33-.34-.5-.5-.33-.34-.5-.5-.33-.34-.5-.5A26.46,26.46,0,0,1,75.5,35.7c0,16.57-16.82,30.05-37.5,30.05-11.58,0-21.94-4.23-28.83-10.86l.5.5.5.5.5.5.5.5.5.5.5.5.5.5C19.55,65.3,30.14,69.75,42,69.75c20.68,0,37.5-13.48,37.5-30C79.5,32.69,76.46,26,71.09,20.74Z"/><g id="Body"><path id="Background" d="M73,35.7c0,15.21-15.67,27.54-35,27.54S3,50.91,3,35.7C3,26.27,9,17.94,18.22,13S33.18,3,38,3s8.94,4.13,19.78,10C67,17.94,73,26.27,73,35.7Z" style="fill:#fbf0df"/><path id="Bottom_Shadow" data-name="Bottom Shadow" d="M73,35.7a21.67,21.67,0,0,0-.8-5.78c-2.73,33.3-43.35,34.9-59.32,24.94A40,40,0,0,0,38,63.24C57.3,63.24,73,50.89,73,35.7Z" style="fill:#f6dece"/><path id="Light_Shine" data-name="Light Shine" d="M24.53,11.17C29,8.49,34.94,3.46,40.78,3.45A9.29,9.29,0,0,0,38,3c-2.42,0-5,1.25-8.25,3.13-1.13.66-2.3,1.39-3.54,2.15-2.33,1.44-5,3.07-8,4.7C8.69,18.13,3,26.62,3,35.7c0,.4,0,.8,0,1.19C9.06,15.48,20.07,13.85,24.53,11.17Z" style="fill:#fffefc"/><path id="Top" d="M35.12,5.53A16.41,16.41,0,0,1,29.49,18c-.28.25-.06.73.3.59,3.37-1.31,7.92-5.23,6-13.14C35.71,5,35.12,5.12,35.12,5.53Zm2.27,0A16.24,16.24,0,0,1,39,19c-.12.35.31.65.55.36C41.74,16.56,43.65,11,37.93,5,37.64,4.74,37.19,5.14,37.39,5.49Zm2.76-.17A16.42,16.42,0,0,1,47,17.12a.33.33,0,0,0,.65.11c.92-3.49.4-9.44-7.17-12.53C40.08,4.54,39.82,5.08,40.15,5.32ZM21.69,15.76a16.94,16.94,0,0,0,10.47-9c.18-.36.75-.22.66.18-1.73,8-7.52,9.67-11.12,9.45C21.32,16.4,21.33,15.87,21.69,15.76Z" style="fill:#ccbea7;fill-rule:evenodd"/><path id="Outline" d="M38,65.75C17.32,65.75.5,52.27.5,35.7c0-10,6.18-19.33,16.53-24.92,3-1.6,5.57-3.21,7.86-4.62,1.26-.78,2.45-1.51,3.6-2.19C32,1.89,35,.5,38,.5s5.62,1.2,8.9,3.14c1,.57,2,1.19,3.07,1.87,2.49,1.54,5.3,3.28,9,5.27C69.32,16.37,75.5,25.69,75.5,35.7,75.5,52.27,58.68,65.75,38,65.75ZM38,3c-2.42,0-5,1.25-8.25,3.13-1.13.66-2.3,1.39-3.54,2.15-2.33,1.44-5,3.07-8,4.7C8.69,18.13,3,26.62,3,35.7,3,50.89,18.7,63.25,38,63.25S73,50.89,73,35.7C73,26.62,67.31,18.13,57.78,13,54,11,51.05,9.12,48.66,7.64c-1.09-.67-2.09-1.29-3-1.84C42.63,4,40.42,3,38,3Z"/></g><g id="Mouth"><g id="Background-2" data-name="Background"><path d="M45.05,43a8.93,8.93,0,0,1-2.92,4.71,6.81,6.81,0,0,1-4,1.88A6.84,6.84,0,0,1,34,47.71,8.93,8.93,0,0,1,31.12,43a.72.72,0,0,1,.8-.81H44.26A.72.72,0,0,1,45.05,43Z" style="fill:#b71422"/></g><g id="Tongue"><path id="Background-3" data-name="Background" d="M34,47.79a6.91,6.91,0,0,0,4.12,1.9,6.91,6.91,0,0,0,4.11-1.9,10.63,10.63,0,0,0,1-1.07,6.83,6.83,0,0,0-4.9-2.31,6.15,6.15,0,0,0-5,2.78C33.56,47.4,33.76,47.6,34,47.79Z" style="fill:#ff6164"/><path id="Outline-2" data-name="Outline" d="M34.16,47a5.36,5.36,0,0,1,4.19-2.08,6,6,0,0,1,4,1.69c.23-.25.45-.51.66-.77a7,7,0,0,0-4.71-1.93,6.36,6.36,0,0,0-4.89,2.36A9.53,9.53,0,0,0,34.16,47Z"/></g><path id="Outline-3" data-name="Outline" d="M38.09,50.19a7.42,7.42,0,0,1-4.45-2,9.52,9.52,0,0,1-3.11-5.05,1.2,1.2,0,0,1,.26-1,1.41,1.41,0,0,1,1.13-.51H44.26a1.44,1.44,0,0,1,1.13.51,1.19,1.19,0,0,1,.25,1h0a9.52,9.52,0,0,1-3.11,5.05A7.42,7.42,0,0,1,38.09,50.19Zm-6.17-7.4c-.16,0-.2.07-.21.09a8.29,8.29,0,0,0,2.73,4.37A6.23,6.23,0,0,0,38.09,49a6.28,6.28,0,0,0,3.65-1.73,8.3,8.3,0,0,0,2.72-4.37.21.21,0,0,0-.2-.09Z"/></g><g id="Face"><ellipse id="Right_Blush" data-name="Right Blush" cx="53.22" cy="40.18" rx="5.85" ry="3.44" style="fill:#febbd0"/><ellipse id="Left_Bluch" data-name="Left Bluch" cx="22.95" cy="40.18" rx="5.85" ry="3.44" style="fill:#febbd0"/><path id="Eyes" d="M25.7,38.8a5.51,5.51,0,1,0-5.5-5.51A5.51,5.51,0,0,0,25.7,38.8Zm24.77,0A5.51,5.51,0,1,0,45,33.29,5.5,5.5,0,0,0,50.47,38.8Z" style="fill-rule:evenodd"/><path id="Iris" d="M24,33.64a2.07,2.07,0,1,0-2.06-2.07A2.07,2.07,0,0,0,24,33.64Zm24.77,0a2.07,2.07,0,1,0-2.06-2.07A2.07,2.07,0,0,0,48.75,33.64Z" style="fill:#fff;fill-rule:evenodd"/></g></svg>
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/public/favicon-16.png b/.repos/alchemy-effect/website/public/favicon-16.png
new file mode 100644
index 00000000000..c77f40d0254
Binary files /dev/null and b/.repos/alchemy-effect/website/public/favicon-16.png differ
diff --git a/.repos/alchemy-effect/website/public/favicon-32.png b/.repos/alchemy-effect/website/public/favicon-32.png
new file mode 100644
index 00000000000..d76ac911a18
Binary files /dev/null and b/.repos/alchemy-effect/website/public/favicon-32.png differ
diff --git a/.repos/alchemy-effect/website/public/favicon.png b/.repos/alchemy-effect/website/public/favicon.png
new file mode 100644
index 00000000000..d76ac911a18
Binary files /dev/null and b/.repos/alchemy-effect/website/public/favicon.png differ
diff --git a/.repos/alchemy-effect/website/public/favicon.svg b/.repos/alchemy-effect/website/public/favicon.svg
new file mode 100644
index 00000000000..d07e4c1b7dd
--- /dev/null
+++ b/.repos/alchemy-effect/website/public/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 24 24" fill="none" stroke="#3f5a2a" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><rect width="24" height="24" fill="#f5efe3"/><circle cx="12" cy="12" r="9.5"/><path d="M12 21.5 L3.7272 7.25 L20.2728 7.25 Z"/><circle cx="12" cy="12" r="1.1" fill="#3f5a2a" stroke="none"/></svg>
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/public/fonts/Tinos-Regular.ttf b/.repos/alchemy-effect/website/public/fonts/Tinos-Regular.ttf
new file mode 100644
index 00000000000..893a1b52596
Binary files /dev/null and b/.repos/alchemy-effect/website/public/fonts/Tinos-Regular.ttf differ
diff --git a/.repos/alchemy-effect/website/public/icon-512.png b/.repos/alchemy-effect/website/public/icon-512.png
new file mode 100644
index 00000000000..db4c8b20793
Binary files /dev/null and b/.repos/alchemy-effect/website/public/icon-512.png differ
diff --git a/.repos/alchemy-effect/website/public/llms.txt b/.repos/alchemy-effect/website/public/llms.txt
new file mode 100644
index 00000000000..a30083a8ca6
--- /dev/null
+++ b/.repos/alchemy-effect/website/public/llms.txt
@@ -0,0 +1,302 @@
+# Alchemy
+
+> Alchemy Effect is an Infrastructure-as-Effects (IaE) framework that combines cloud infrastructure and application logic into a single, type-safe program powered by [Effect](https://effect.website). Resources are declared as Effects; bindings wire IAM, env vars, and typed SDKs in one call; deploys and runtime share the same code.
+
+This file is a navigation index for the documentation site at https://v2.alchemy.run. Every page under `/src/content/docs/` is listed below with its URL and a one-line summary, so an agent can pick the right page in one hop.
+
+## Start here
+
+- [What is Alchemy?](https://v2.alchemy.run/what-is-alchemy) — Alchemy is an Infrastructure-as-Effects framework that combines cloud infrastructure and application logic into a single type-safe program powered by Effect.
+- [Getting Started](https://v2.alchemy.run/getting-started) — Install Alchemy and create your first Stack in under two minutes.
+
+## Tutorial — main path (Cloudflare)
+
+A linear five-part walkthrough from zero to a tested, locally-developed, CI-deployed Cloudflare project. Each part builds on the previous one.
+
+- [Part 1: Your First Stack](https://v2.alchemy.run/tutorial/part-1) — Install Alchemy, create a Stack with a Cloudflare R2 Bucket, and deploy it.
+- [Part 2: Add a Worker](https://v2.alchemy.run/tutorial/part-2) — Create a Cloudflare Worker, bind the R2 Bucket, and implement GET/PUT routes.
+- [Part 3: Testing](https://v2.alchemy.run/tutorial/part-3) — Write integration tests that deploy your stack and make HTTP requests against your live Worker.
+- [Part 4: Local Dev](https://v2.alchemy.run/tutorial/part-4) — Run your stack locally with alchemy dev for hot reloading and instant feedback.
+- [Part 5: CI/CD](https://v2.alchemy.run/tutorial/part-5) — Set up GitHub Actions for automated deployments, PR previews, and remote state — with Cloudflare credentials managed as code.
+
+## Tutorial — Cloudflare add-ons
+
+Standalone tutorials that extend the main tutorial's Worker with a specific Cloudflare feature. Pick the ones that match your use case.
+
+- [Add a Durable Object](https://v2.alchemy.run/tutorial/cloudflare/durable-objects) — Add a Durable Object to your Worker — persist state per key, expose RPC methods, and stream values back to the client.
+- [Bind to another Worker's Durable Object](https://v2.alchemy.run/tutorial/cloudflare/cross-worker-durable-object) — Share a Durable Object across multiple Workers — one Worker hosts the runtime, others bind to it by scriptName for a typed RPC stub.
+- [Accept WebSockets](https://v2.alchemy.run/tutorial/cloudflare/hibernatable-websockets) — Accept WebSocket connections in a Durable Object, broadcast between peers, and survive Cloudflare's hibernation.
+- [Add a Vite SPA](https://v2.alchemy.run/tutorial/cloudflare/vite-spa) — Ship a Vite single-page app from the same Stack as your Worker — built, bundled, and deployed to Cloudflare in one command.
+- [Run a Container](https://v2.alchemy.run/tutorial/cloudflare/containers) — Run a long-lived container alongside a Durable Object, expose RPC methods, and proxy HTTP requests to ports inside the container.
+- [Add a Workflow](https://v2.alchemy.run/tutorial/cloudflare/workflows) — Orchestrate durable, multi-step work with Cloudflare Workflows — automatic retries, replayable steps, and at-least-once delivery.
+- [Add an AI Gateway](https://v2.alchemy.run/tutorial/cloudflare/ai-gateway) — Wire an AI Gateway into your Worker, turn it into a typed Effect LanguageModel, and run generations and streams through Workers AI with caching, rate limiting, and logs.
+- [Build a Git Repo API](https://v2.alchemy.run/tutorial/cloudflare/artifacts) — Build a mini-GitHub on Cloudflare — Artifacts for Git storage, a Durable Object per repo for metadata, fronted by a schema-typed HttpApi.
+- [Connect to a Database with Hyperdrive](https://v2.alchemy.run/tutorial/cloudflare/hyperdrive) — Provision a Postgres or MySQL database (Neon, PlanetScale Postgres, or PlanetScale MySQL) and front it with Cloudflare Hyperdrive so your Worker reaches the database with edge-pooled, low-latency connections.
+- [Add Drizzle ORM](https://v2.alchemy.run/tutorial/cloudflare/drizzle) — Replace raw pg with Drizzle's effect-postgres integration, manage your schema as a resource, and have alchemy generate and apply migrations on every deploy.
+- [Branch from a shared database](https://v2.alchemy.run/tutorial/cloudflare/branch-from-shared-database) — Have ephemeral PR-preview stages reference a long-lived Neon project from the staging stage instead of provisioning their own — fast previews, copy-on-write branches, no extra Postgres clusters.
+- [Consume from a Queue](https://v2.alchemy.run/tutorial/cloudflare/queue-consumer) — Receive messages from a Cloudflare Queue with Cloudflare.messages(queue).subscribe(...) — Effect-style stream handler with automatic ack/retry.
+- [Define an RPC Worker](https://v2.alchemy.run/tutorial/cloudflare/rpc-worker) — Define a typed Effect RPC group, serve it from `Cloudflare.RpcWorker`, drive it from an integration test, and (later) bind a typed client from another Worker.
+- [Add a typed RPC Durable Object](https://v2.alchemy.run/tutorial/cloudflare/rpc-durable-object) — Replace alchemy's built-in DO method bridge with `Cloudflare.RpcDurableObjectNamespace` — a typed RPC group served on the DO's `fetch`, with a class-instance-preserving wire format. Walk through a single DO, drive it from a test, then layer in a Worker.
+
+## Tutorial — AWS
+
+End-to-end AWS tutorials. Read the Lambda page first; the others bind storage and event sources to that Lambda.
+
+- [Deploy a Lambda Function](https://v2.alchemy.run/tutorial/aws/lambda) — Stand up an AWS Lambda Function from a single Effect, expose it over a Function URL, and call it from a test.
+- [Read & Write S3](https://v2.alchemy.run/tutorial/aws/s3) — Add an S3 Bucket to your Stack, bind PutObject and GetObject as runtime capabilities, and let Alchemy mint the IAM policy for you.
+- [React to S3 Events](https://v2.alchemy.run/tutorial/aws/s3-events) — Subscribe a Lambda Function to S3 bucket notifications, process them as an Effect Stream, and let Alchemy wire up the IAM and event-source plumbing.
+- [Store Records in DynamoDB](https://v2.alchemy.run/tutorial/aws/dynamodb) — Add a DynamoDB Table, bind GetItem and PutItem to your Lambda, and serve a typed key/value HTTP API backed by DynamoDB.
+- [Process DynamoDB Streams](https://v2.alchemy.run/tutorial/aws/dynamodb-streams) — Enable a DynamoDB Stream on your table and consume change records as a typed Effect Stream from the same Lambda.
+- [Send & Consume SQS Messages](https://v2.alchemy.run/tutorial/aws/sqs) — Add an SQS Queue, publish messages from your Lambda, and consume them from a second consumer Lambda — all wired through Alchemy bindings.
+- [Stream Records with Kinesis](https://v2.alchemy.run/tutorial/aws/kinesis) — Add a Kinesis Data Stream, publish records from one Lambda, and consume them in order from another — wired through the same Stream-shaped event source.
+- [REST API (API Gateway v1)](https://v2.alchemy.run/tutorial/aws/api-gateway) — Expose a Lambda with a regional Amazon API Gateway REST API using RestApi, Resource, Method, Deployment, and Stage primitives.
+
+## Concepts — the mental model
+
+Reference pages explaining what each primitive means and how they fit together. Read these when something in a tutorial feels magical, or before designing a new Stack.
+
+- [Stack](https://v2.alchemy.run/concepts/stack) — A Stack is a collection of Resources deployed together as a unit.
+- [Resource](https://v2.alchemy.run/concepts/resource) — Resources are named cloud entities with input properties and output attributes.
+- [Action](https://v2.alchemy.run/concepts/action) — A node in the dependency graph that runs an Effect during apply when its inputs change.
+- [Inputs and Outputs](https://v2.alchemy.run/concepts/outputs) — Output<T> is alchemy's lazy reference type — the lazy values that flow between resources, get composed with .pipe, mapped, interpolated, and resolved during deploy.
+- [References](https://v2.alchemy.run/concepts/references) — Read values out of another stack or stage at plan time — typed, lazy, and resolved from persisted state.
+- [Resource Lifecycle](https://v2.alchemy.run/concepts/resource-lifecycle) — How alchemy plans, applies, replaces, and destroys resources — and how to think about idempotency and recovery.
+- [Provider](https://v2.alchemy.run/concepts/provider) — Providers implement the lifecycle operations for a resource type — reconcile, delete, diff, read, and more.
+- [Platform](https://v2.alchemy.run/concepts/platform) — A Platform bundles infrastructure with the runtime code that runs on it — Workers, Lambda Functions, Containers — so your handler ships with its bindings.
+- [Phases](https://v2.alchemy.run/concepts/phases) — Alchemy programs run in two phases — plantime/init drives the deploy, runtime handles requests. Knowing which is which is the key to using Platforms.
+- [Binding](https://v2.alchemy.run/concepts/binding) — A binding connects a resource to a Worker or Lambda. It generates IAM policies, env vars, and a typed SDK in one call.
+- [Secrets and Config](https://v2.alchemy.run/concepts/secrets) — Use effect/Config to read env vars at init time and have Alchemy automatically bind them onto the deploy target.
+- [Layers](https://v2.alchemy.run/concepts/layers) — A Layer encapsulates a slice of infrastructure (resources, bindings, runtime logic) behind a typed service interface. Code that depends on the interface stays cloud-agnostic; swapping the implementation swaps the underlying infrastructure.
+- [State Store](https://v2.alchemy.run/concepts/state-store) — How Alchemy persists resource state between deploys to compute diffs and track infrastructure.
+- [Testing](https://v2.alchemy.run/concepts/testing) — Reference for alchemy/Test — every helper, hook, and option exposed by Test.make for Bun and Vitest.
+- [Local Development](https://v2.alchemy.run/concepts/local-development) — How alchemy dev provides hot reloading, local workerd execution, and cloud-backed resources for fast iteration.
+- [Observability](https://v2.alchemy.run/concepts/observability) — Effect emits OpenTelemetry — ship traces, metrics, and logs to Axiom, Datadog, CloudWatch, or any OTLP endpoint. Declare dashboards and alarms in code.
+- [Profiles](https://v2.alchemy.run/concepts/profiles) — Profiles store cloud credentials per environment in ~/.alchemy/profiles.json — switch between work and personal accounts, or between staging and prod credentials.
+- [Stages](https://v2.alchemy.run/concepts/stages) — Stages are isolated instances of a Stack — dev_sam, staging, prod, pr-42 — each with their own state and physical names.
+
+## Guides — task-oriented
+
+Standalone how-to pages. Each solves a specific problem; read in any order.
+
+- [Migrating from v1](https://v2.alchemy.run/guides/migrating-from-v1) — Migrate your Alchemy v1 (async/await) project to Alchemy v2.
+- [CLI Reference](https://v2.alchemy.run/guides/cli) — All Alchemy CLI commands — deploy, destroy, plan, dev, tail, logs, aws, cloudflare, login, profile, and state.
+- [Continuous Integration](https://v2.alchemy.run/guides/ci) — Set up CI/CD pipelines for alchemy projects with GitHub Actions, automated deployments, and PR previews — with provider credentials managed as code.
+- [Monorepos](https://v2.alchemy.run/guides/monorepo) — Two patterns for organizing an Alchemy monorepo with a backend API and a frontend website — one shared stack (recommended) or one stack per package — with the trade-offs and a working example for each.
+- [Secrets and env vars](https://v2.alchemy.run/guides/secrets) — Wire OPENAI_API_KEY from .env into a Cloudflare Worker as a secret_text binding.
+- [Effect HTTP API](https://v2.alchemy.run/guides/effect-http-api) — Build a schema-validated HTTP API with Effect's HttpApi module and deploy it as a Cloudflare Worker.
+- [Shared database across stages](https://v2.alchemy.run/guides/shared-database) — Have ephemeral PR-preview stages reference a long-lived Neon Postgres project from staging instead of provisioning their own — fast previews, copy-on-write branches, no extra Postgres clusters.
+- [Effect RPC](https://v2.alchemy.run/guides/effect-rpc) — Build a typed RPC API with Effect's Rpc module and deploy it as a Cloudflare Worker.
+- [Frontend frameworks](https://v2.alchemy.run/guides/frontends) — Deploy Vite-based frameworks (TanStack Start, Astro, SolidStart, Nuxt, React) and any custom-built static site (Hugo, Eleventy) to Cloudflare with one declaration.
+- [Circular Bindings](https://v2.alchemy.run/guides/circular-bindings) — How to model two services that reference each other (Worker A ↔ Worker B, Lambda ↔ Lambda) using tagged classes and Layers.
+- [Effect AI](https://v2.alchemy.run/guides/effect-ai) — Wire Effect's LanguageModel and Chat services into a Cloudflare Worker — read API keys with effect/Config, provide the model layer to your handler, plug in persistence.
+- [Building Infrastructure Layers](https://v2.alchemy.run/guides/infrastructure-layers) — Package resources + bindings + runtime glue into a typed Effect Layer, then swap a KV-backed implementation for an R2-backed one without touching the consumer.
+- [Writing a Custom State Store](https://v2.alchemy.run/guides/custom-state-store) — Build a Postgres-backed Alchemy state store step by step — implement the StateService interface, plug it into a stack, and test it end-to-end.
+- [Writing a Custom Resource Provider](https://v2.alchemy.run/guides/custom-provider) — Add support for a new cloud or third-party API by declaring a Resource type and implementing its lifecycle as an Effect Layer.
+
+## Providers
+
+Per-resource API reference, generated from JSDoc on the source `.ts` files via `bun generate:api-reference`. Each page documents the resource's input properties (with types, defaults, and constraints), output attributes, and Quick Reference / Examples sections derived from `@section` / `@example` JSDoc tags. Grouped by cloud below.
+
+### AWS
+
+- [AccessEntry](https://v2.alchemy.run/providers/aws/eks/accessentry) — An Amazon EKS access entry that grants an IAM principal access to a cluster.
+- [AccessKey](https://v2.alchemy.run/providers/aws/iam/accesskey) — An IAM access key for a user.
+- [Account](https://v2.alchemy.run/providers/aws/apigateway/account) — Account-level settings for Amazon API Gateway in the current region (CloudWatch logging role, etc.).
+- [Account](https://v2.alchemy.run/providers/aws/organizations/account) — A member account created and managed by AWS Organizations.
+- [AccountAlias](https://v2.alchemy.run/providers/aws/iam/accountalias) — The singleton IAM account alias for an AWS account.
+- [AccountAssignment](https://v2.alchemy.run/providers/aws/identitycenter/accountassignment) — Assigns an IAM Identity Center permission set to a user or group in an AWS account.
+- [AccountPasswordPolicy](https://v2.alchemy.run/providers/aws/iam/accountpasswordpolicy) — The singleton IAM account password policy.
+- [Addon](https://v2.alchemy.run/providers/aws/eks/addon) — An Amazon EKS managed add-on installed on a cluster.
+- [Alarm](https://v2.alchemy.run/providers/aws/cloudwatch/alarm) — A CloudWatch metric alarm.
+- [AlarmMuteRule](https://v2.alchemy.run/providers/aws/cloudwatch/alarmmuterule) — A CloudWatch alarm mute rule.
+- [AnomalyDetector](https://v2.alchemy.run/providers/aws/cloudwatch/anomalydetector) — A CloudWatch anomaly detector.
+- [ApiKey](https://v2.alchemy.run/providers/aws/apigateway/apikey) — API Gateway API key for usage plans and `apiKeyRequired` methods.
+- [AssetDeployment](https://v2.alchemy.run/providers/aws/website/assetdeployment) — Upload a local directory into S3 with website-friendly defaults.
+- [Authorizer](https://v2.alchemy.run/providers/aws/apigateway/authorizer) — REST API Lambda, Cognito, or gateway authorizer.
+- [AutoScalingGroup](https://v2.alchemy.run/providers/aws/autoscaling/autoscalinggroup) — An EC2 Auto Scaling Group that manages a fleet of instances from a launch template and can register that fleet with one or more load balancer target groups.
+- [BasePathMapping](https://v2.alchemy.run/providers/aws/apigateway/basepathmapping) — Maps a custom domain name path to a REST API stage.
+- [Bucket](https://v2.alchemy.run/providers/aws/s3/bucket) — An S3 bucket for storing objects in AWS.
+- [CachePolicy](https://v2.alchemy.run/providers/aws/cloudfront/cachepolicy) — A CloudFront cache policy.
+- [CapacityProvider](https://v2.alchemy.run/providers/aws/ecs/capacityprovider) — An Amazon ECS capacity provider backed by an EC2 Auto Scaling Group.
+- [Certificate](https://v2.alchemy.run/providers/aws/acm/certificate) — An ACM certificate for CloudFront and other AWS endpoints.
+- [Cluster](https://v2.alchemy.run/providers/aws/ecs/cluster) — An Amazon ECS cluster for running tasks and services.
+- [Cluster](https://v2.alchemy.run/providers/aws/eks/cluster) — An Amazon EKS cluster with support for EKS Auto Mode settings.
+- [CompositeAlarm](https://v2.alchemy.run/providers/aws/cloudwatch/compositealarm) — A CloudWatch composite alarm.
+- [Dashboard](https://v2.alchemy.run/providers/aws/cloudwatch/dashboard) — An Amazon CloudWatch dashboard.
+- [DBCluster](https://v2.alchemy.run/providers/aws/rds/dbcluster) — An Aurora DB cluster.
+- [DBClusterEndpoint](https://v2.alchemy.run/providers/aws/rds/dbclusterendpoint) — A custom Aurora cluster endpoint.
+- [DBClusterParameterGroup](https://v2.alchemy.run/providers/aws/rds/dbclusterparametergroup) — An Aurora cluster parameter group.
+- [DBInstance](https://v2.alchemy.run/providers/aws/rds/dbinstance) — An Aurora cluster instance.
+- [DBParameterGroup](https://v2.alchemy.run/providers/aws/rds/dbparametergroup) — An RDS DB parameter group, useful for Aurora cluster instances.
+- [DBProxy](https://v2.alchemy.run/providers/aws/rds/dbproxy) — An RDS Proxy for pooled Lambda-to-Aurora connectivity.
+- [DBProxyEndpoint](https://v2.alchemy.run/providers/aws/rds/dbproxyendpoint) — An additional RDS Proxy endpoint.
+- [DBProxyTargetGroup](https://v2.alchemy.run/providers/aws/rds/dbproxytargetgroup) — The proxy target group that registers Aurora clusters or instances behind an RDS Proxy.
+- [DBSubnetGroup](https://v2.alchemy.run/providers/aws/rds/dbsubnetgroup) — An RDS DB subnet group for Aurora clusters, instances, and proxies.
+- [DelegatedAdministrator](https://v2.alchemy.run/providers/aws/organizations/delegatedadministrator) — Registers a delegated administrator account for a trusted AWS service.
+- [Deployment](https://v2.alchemy.run/providers/aws/apigateway/deployment) — A point-in-time snapshot of a REST API, ready to be served through a `Stage`.
+- [Distribution](https://v2.alchemy.run/providers/aws/cloudfront/distribution) — A CloudFront distribution.
+- [DomainName](https://v2.alchemy.run/providers/aws/apigateway/domainname) — Custom domain name for an Amazon API Gateway REST API.
+- [EgressOnlyInternetGateway](https://v2.alchemy.run/providers/aws/ec2/egressonlyinternetgateway) — API reference for EgressOnlyInternetGateway
+- [EIP](https://v2.alchemy.run/providers/aws/ec2/eip) — API reference for EIP
+- [EventBus](https://v2.alchemy.run/providers/aws/eventbridge/eventbus) — An Amazon EventBridge event bus for receiving and routing events.
+- [EventSourceMapping](https://v2.alchemy.run/providers/aws/lambda/eventsourcemapping) — API reference for EventSourceMapping
+- [Function](https://v2.alchemy.run/providers/aws/cloudfront/function) — A CloudFront Function for viewer request and response customization.
+- [Function](https://v2.alchemy.run/providers/aws/lambda/function) — An AWS Lambda host resource that combines code bundling, IAM role provisioning, and runtime binding collection.
+- [GatewayResponse](https://v2.alchemy.run/providers/aws/apigateway/gatewayresponse) — Gateway response mapping for a REST API (e.g. DEFAULT_4XX, DEFAULT_5XX).
+- [Group](https://v2.alchemy.run/providers/aws/iam/group) — An IAM group that can own managed and inline policies.
+- [Group](https://v2.alchemy.run/providers/aws/identitycenter/group) — A group in the IAM Identity Center identity store.
+- [GroupMembership](https://v2.alchemy.run/providers/aws/iam/groupmembership) — An explicit IAM group membership resource that owns a group's managed users.
+- [InsightRule](https://v2.alchemy.run/providers/aws/cloudwatch/insightrule) — A CloudWatch Contributor Insights rule.
+- [Instance](https://v2.alchemy.run/providers/aws/ec2/instance) — An EC2 instance that can either act as a low-level compute primitive or run a bundled long-lived Effect program directly on the machine.
+- [Instance](https://v2.alchemy.run/providers/aws/identitycenter/instance) — An IAM Identity Center instance visible to the current account.
+- [InstanceProfile](https://v2.alchemy.run/providers/aws/iam/instanceprofile) — An IAM instance profile that can present a role to EC2 instances.
+- [InternetGateway](https://v2.alchemy.run/providers/aws/ec2/internetgateway) — API reference for InternetGateway
+- [Invalidation](https://v2.alchemy.run/providers/aws/cloudfront/invalidation) — A CloudFront cache invalidation request.
+- [KeyGroup](https://v2.alchemy.run/providers/aws/cloudfront/keygroup) — A CloudFront key group.
+- [KeyValueStore](https://v2.alchemy.run/providers/aws/cloudfront/keyvaluestore) — A CloudFront KeyValueStore for edge metadata.
+- [KvEntries](https://v2.alchemy.run/providers/aws/cloudfront/kventries) — Manages namespaced key-value entries in a CloudFront KeyValueStore.
+- [KvRoutesUpdate](https://v2.alchemy.run/providers/aws/cloudfront/kvroutesupdate) — Manages a single route entry in a JSON array stored in a CloudFront KeyValueStore.
+- [LaunchTemplate](https://v2.alchemy.run/providers/aws/autoscaling/launchtemplate) — A launch template that preserves the `Host` authoring model used by `AWS.EC2.Instance`, but packages that host configuration for use with an Auto Scaling Group.
+- [Listener](https://v2.alchemy.run/providers/aws/elbv2/listener) — API reference for Listener
+- [LoadBalancer](https://v2.alchemy.run/providers/aws/elbv2/loadbalancer) — API reference for LoadBalancer
+- [LogGroup](https://v2.alchemy.run/providers/aws/logs/loggroup) — A CloudWatch Logs log group.
+- [LoginProfile](https://v2.alchemy.run/providers/aws/iam/loginprofile) — An IAM console login profile for a user.
+- [Method](https://v2.alchemy.run/providers/aws/apigateway/method) — An HTTP method on an API Gateway Resource.
+- [MetricStream](https://v2.alchemy.run/providers/aws/cloudwatch/metricstream) — A CloudWatch metric stream.
+- [NatGateway](https://v2.alchemy.run/providers/aws/ec2/natgateway) — API reference for NatGateway
+- [NetworkAcl](https://v2.alchemy.run/providers/aws/ec2/networkacl) — API reference for NetworkAcl
+- [NetworkAclAssociation](https://v2.alchemy.run/providers/aws/ec2/networkaclassociation) — API reference for NetworkAclAssociation
+- [NetworkAclEntry](https://v2.alchemy.run/providers/aws/ec2/networkaclentry) — API reference for NetworkAclEntry
+- [OpenIDConnectProvider](https://v2.alchemy.run/providers/aws/iam/openidconnectprovider) — An IAM OpenID Connect provider for web identity federation.
+- [Organization](https://v2.alchemy.run/providers/aws/organizations/organization) — The AWS Organization for the current management account.
+- [OrganizationalUnit](https://v2.alchemy.run/providers/aws/organizations/organizationalunit) — An AWS Organizations organizational unit.
+- [OrganizationResourcePolicy](https://v2.alchemy.run/providers/aws/organizations/organizationresourcepolicy) — The singleton AWS Organizations resource policy.
+- [OriginAccessControl](https://v2.alchemy.run/providers/aws/cloudfront/originaccesscontrol) — A CloudFront Origin Access Control for private origins.
+- [OriginRequestPolicy](https://v2.alchemy.run/providers/aws/cloudfront/originrequestpolicy) — A CloudFront origin request policy.
+- [Permission](https://v2.alchemy.run/providers/aws/eventbridge/permission) — An EventBridge event bus permission statement.
+- [Permission](https://v2.alchemy.run/providers/aws/lambda/permission) — A Lambda permission that grants an AWS service or another account permission to invoke a function.
+- [PermissionSet](https://v2.alchemy.run/providers/aws/identitycenter/permissionset) — An IAM Identity Center permission set.
+- [PodIdentityAssociation](https://v2.alchemy.run/providers/aws/eks/podidentityassociation) — An Amazon EKS pod identity association that binds a service account to an IAM role.
+- [Policy](https://v2.alchemy.run/providers/aws/iam/policy) — A customer-managed IAM policy.
+- [Policy](https://v2.alchemy.run/providers/aws/organizations/policy) — An AWS Organizations policy such as an SCP or tag policy.
+- [PolicyAttachment](https://v2.alchemy.run/providers/aws/organizations/policyattachment) — Attaches an Organizations policy to a root, OU, or account.
+- [PublicKey](https://v2.alchemy.run/providers/aws/cloudfront/publickey) — A CloudFront public key.
+- [Queue](https://v2.alchemy.run/providers/aws/sqs/queue) — An Amazon SQS queue for reliable, decoupled message processing.
+- [Record](https://v2.alchemy.run/providers/aws/route53/record) — A Route 53 DNS record set.
+- [Repository](https://v2.alchemy.run/providers/aws/ecr/repository) — An Amazon ECR repository for container images.
+- [ResponseHeadersPolicy](https://v2.alchemy.run/providers/aws/cloudfront/responseheaderspolicy) — A CloudFront response headers policy.
+- [RestApi](https://v2.alchemy.run/providers/aws/apigateway/restapi) — An Amazon API Gateway REST API (v1).
+- [Role](https://v2.alchemy.run/providers/aws/iam/role) — An IAM role for AWS services and runtimes.
+- [Root](https://v2.alchemy.run/providers/aws/organizations/root) — The organization root.
+- [RootPolicyType](https://v2.alchemy.run/providers/aws/organizations/rootpolicytype) — Enables a policy type on an organization root.
+- [Route](https://v2.alchemy.run/providers/aws/ec2/route) — API reference for Route
+- [RouteTable](https://v2.alchemy.run/providers/aws/ec2/routetable) — API reference for RouteTable
+- [RouteTableAssociation](https://v2.alchemy.run/providers/aws/ec2/routetableassociation) — API reference for RouteTableAssociation
+- [Rule](https://v2.alchemy.run/providers/aws/eventbridge/rule) — An Amazon EventBridge rule that matches events and routes them to targets.
+- [SAMLProvider](https://v2.alchemy.run/providers/aws/iam/samlprovider) — An IAM SAML identity provider.
+- [ScalingPolicy](https://v2.alchemy.run/providers/aws/autoscaling/scalingpolicy) — A target-tracking scaling policy for an Auto Scaling Group.
+- [Schedule](https://v2.alchemy.run/providers/aws/scheduler/schedule) — An EventBridge Scheduler schedule.
+- [ScheduleGroup](https://v2.alchemy.run/providers/aws/scheduler/schedulegroup) — An EventBridge Scheduler schedule group.
+- [Secret](https://v2.alchemy.run/providers/aws/secretsmanager/secret) — An AWS Secrets Manager secret.
+- [SecurityGroup](https://v2.alchemy.run/providers/aws/ec2/securitygroup) — Ingress or egress rule for a security group.
+- [SecurityGroupRule](https://v2.alchemy.run/providers/aws/ec2/securitygrouprule) — API reference for SecurityGroupRule
+- [ServerCertificate](https://v2.alchemy.run/providers/aws/iam/servercertificate) — An IAM server certificate.
+- [Service](https://v2.alchemy.run/providers/aws/ecs/service) — An ECS Fargate service for running long-lived tasks.
+- [ServiceSpecificCredential](https://v2.alchemy.run/providers/aws/iam/servicespecificcredential) — A service-specific IAM credential.
+- [SigningCertificate](https://v2.alchemy.run/providers/aws/iam/signingcertificate) — An IAM signing certificate for a user.
+- [SSHPublicKey](https://v2.alchemy.run/providers/aws/iam/sshpublickey) — An IAM SSH public key for CodeCommit-compatible workflows.
+- [Stage](https://v2.alchemy.run/providers/aws/apigateway/stage) — A stage for a REST API deployment.
+- [Stream](https://v2.alchemy.run/providers/aws/kinesis/stream) — An Amazon Kinesis Data Stream.
+- [StreamConsumer](https://v2.alchemy.run/providers/aws/kinesis/streamconsumer) — A registered Kinesis enhanced fan-out consumer.
+- [Subnet](https://v2.alchemy.run/providers/aws/ec2/subnet) — API reference for Subnet
+- [Subscription](https://v2.alchemy.run/providers/aws/sns/subscription) — An Amazon SNS subscription that attaches an endpoint to a topic.
+- [Table](https://v2.alchemy.run/providers/aws/dynamodb/table) — An Amazon DynamoDB table with optional indexes, PITR, TTL, and stream-aware binding support.
+- [TargetGroup](https://v2.alchemy.run/providers/aws/elbv2/targetgroup) — API reference for TargetGroup
+- [Task](https://v2.alchemy.run/providers/aws/ecs/task) — API reference for Task
+- [Topic](https://v2.alchemy.run/providers/aws/sns/topic) — An Amazon SNS topic for fan-out messaging and notifications.
+- [TrustedServiceAccess](https://v2.alchemy.run/providers/aws/organizations/trustedserviceaccess) — Enables trusted access for an AWS service principal.
+- [UsagePlan](https://v2.alchemy.run/providers/aws/apigateway/usageplan) — Usage plan for API stages, throttling, and quotas.
+- [UsagePlanKey](https://v2.alchemy.run/providers/aws/apigateway/usageplankey) — Associates an API key with a usage plan.
+- [User](https://v2.alchemy.run/providers/aws/iam/user) — An IAM user with optional inline policies, managed policies, and tags.
+- [VirtualMFADevice](https://v2.alchemy.run/providers/aws/iam/virtualmfadevice) — An IAM virtual MFA device.
+- [Vpc](https://v2.alchemy.run/providers/aws/ec2/vpc) — API reference for Vpc
+- [VpcEndpoint](https://v2.alchemy.run/providers/aws/ec2/vpcendpoint) — API reference for VpcEndpoint
+- [VpcLink](https://v2.alchemy.run/providers/aws/apigateway/vpclink) — VPC link for private integrations (`connectionType: \"VPC_LINK\"` on a method integration).
+
+### Axiom
+
+- [Annotation](https://v2.alchemy.run/providers/axiom/annotation) — An Axiom annotation — a vertical marker overlaid on charts to flag a deploy, incident, feature flag flip, or any other point/range event you want correlated with telemetry.
+- [ApiToken](https://v2.alchemy.run/providers/axiom/apitoken) — An Axiom API token — a scoped bearer token used to authenticate API requests (ingest, query, admin). Capabilities are pinned at creation time; changing any field triggers a **replacement** because Axiom does not expose an update endpoint.
+- [Dashboard](https://v2.alchemy.run/providers/axiom/dashboard) — An Axiom dashboard — a named, layout-driven collection of charts. Each dashboard takes a full document (`charts` + `layout` array of grid cells + `timeWindow` + `refreshTime`) at version `schemaVersion: 2`.
+- [Dataset](https://v2.alchemy.run/providers/axiom/dataset) — An Axiom dataset — the top-level container that stores events, logs, traces, or metrics. Pick a `kind` up-front: it determines schema and how the data is shown in the UI, and **cannot be changed** after creation (changing it triggers a replacement, which deletes the data).
+- [Monitor](https://v2.alchemy.run/providers/axiom/monitor) — An Axiom monitor — a scheduled APL/MPL query that evaluates on a fixed cadence and fires alerts via {@link Notifier notifiers} when its condition is met.
+- [Notifier](https://v2.alchemy.run/providers/axiom/notifier) — An Axiom notifier — an alert destination (Slack, email, PagerDuty, Opsgenie, Discord, Microsoft Teams, generic webhook, or a fully custom webhook with templated body/headers) that {@link Monitor monitors} target via `notifierIds`. Exactly one channel under `properties` should be set.
+- [View](https://v2.alchemy.run/providers/axiom/view) — An Axiom saved view — a named, shareable APL query. Useful for building starter dashboards, providing canned \"open in Axiom\" links from your app, or pinning common investigations the team revisits.
+- [VirtualField](https://v2.alchemy.run/providers/axiom/virtualfield) — An Axiom virtual field — a saved APL expression that appears as a derived column on a dataset at query time. Use these to standardise common computations (status classes, latency buckets, parsed JSON paths) so dashboards and monitors don't have to redefine them.
+
+### Build
+
+- [Command](https://v2.alchemy.run/providers/build/command) — A Build resource that runs a shell command and produces an output asset. Input files are hashed using globs to avoid redundant rebuilds.
+
+### Cloudflare
+
+- [AccountApiToken](https://v2.alchemy.run/providers/cloudflare/accountapitoken) — A Cloudflare account-owned API token (`POST /accounts/{account_id}/tokens`).
+- [AiGateway](https://v2.alchemy.run/providers/cloudflare/aigateway) — A Cloudflare AI Gateway for observability, caching, rate limiting, and governance across AI provider requests.
+- [AiGatewayBinding](https://v2.alchemy.run/providers/cloudflare/aigatewaybinding) — Binding service that turns an {@link AiGatewayResource} resource into a typed {@link AiGatewayClient} for Worker runtime code. Wraps the Cloudflare AI Gateway runtime binding so each operation returns an Effect tagged with {@link AiGatewayError}, exposes the raw Workers AI handle for `ai.run(...)`, and provides a `model(options)` factory that produces an `effect/unstable/ai` `LanguageModel` `Layer`.
+- [AnalyticsEngineDataset](https://v2.alchemy.run/providers/cloudflare/analyticsenginedataset) — A Cloudflare Workers Analytics Engine dataset binding.
+- [BrowserRendering](https://v2.alchemy.run/providers/cloudflare/browserrendering) — A Cloudflare Browser Rendering binding for launching headless browser sessions from Workers via `@cloudflare/puppeteer`.
+- [Container](https://v2.alchemy.run/providers/cloudflare/container) — A Cloudflare Container that runs a long-lived process alongside a Durable Object.
+- [D1Database](https://v2.alchemy.run/providers/cloudflare/d1database) — A Cloudflare D1 serverless SQL database built on SQLite.
+- [DurableObjectNamespace](https://v2.alchemy.run/providers/cloudflare/durableobjectnamespace) — A Cloudflare Durable Object namespace that manages globally unique, stateful instances with WebSocket hibernation support.
+- [DynamicWorkerLoader](https://v2.alchemy.run/providers/cloudflare/dynamicworkerloader) — Load and run ephemeral Workers at runtime from inline JavaScript modules.
+- [EmailAddress](https://v2.alchemy.run/providers/cloudflare/emailaddress) — A verified destination email address on the account.
+- [EmailRouting](https://v2.alchemy.run/providers/cloudflare/emailrouting) — Enables Cloudflare Email Routing on a zone. This is the prerequisite for receiving mail at any address on the domain and for sending email from a Worker via `send_email` bindings.
+- [EmailRule](https://v2.alchemy.run/providers/cloudflare/emailrule) — A Cloudflare Email Routing rule.
+- [Hyperdrive](https://v2.alchemy.run/providers/cloudflare/hyperdrive) — A Cloudflare Hyperdrive configuration.
+- [HyperdriveBinding](https://v2.alchemy.run/providers/cloudflare/hyperdrivebinding) — A typed accessor for a Cloudflare Hyperdrive runtime binding inside a Worker. Provides the same shape as the raw `Hyperdrive` runtime object (connection string, host, port, user, password, database) plus a `raw` escape hatch for libraries that want direct access.
+- [KVNamespace](https://v2.alchemy.run/providers/cloudflare/kvnamespace) — A Cloudflare Workers KV namespace for key-value storage at the edge.
+- [Queue](https://v2.alchemy.run/providers/cloudflare/queue) — A Cloudflare Queue for reliable message passing between Workers.
+- [QueueConsumer](https://v2.alchemy.run/providers/cloudflare/queueconsumer) — A Cloudflare Queue Consumer that processes messages from a Queue.
+- [R2Bucket](https://v2.alchemy.run/providers/cloudflare/r2bucket) — A Cloudflare R2 object storage bucket with S3-compatible API.
+- [RpcDurableObjectNamespace](https://v2.alchemy.run/providers/cloudflare/rpcdurableobjectnamespace) — `RpcDurableObjectNamespace` is sugar over {@link DurableObjectNamespace} for Durable Objects whose surface is a typed Effect `RpcGroup`. The DO serves an `RpcServer.toHttpEffect(group)` on its own `fetch`, and consumers see `namespace.getByName(id)` as a typed `RpcClient` directly — no manual client wiring.
+- [RpcWorker](https://v2.alchemy.run/providers/cloudflare/rpcworker) — `RpcWorker` is a thin sugar over {@link Worker} for the common case where a worker's entire `fetch` surface is a typed Effect `RpcGroup`. It takes the rpc `schema` directly in props alongside `main`, and accepts an init Effect that returns the already-piped `RpcServer.toHttpEffect(...)`-producing Effect (no `{ fetch }` wrapper) — the wrapper plugs it into the worker's `fetch` for you.
+- [Secret](https://v2.alchemy.run/providers/cloudflare/secret) — A single secret stored inside a Cloudflare Secrets Store.
+- [SecretsStore](https://v2.alchemy.run/providers/cloudflare/secretsstore) — A Cloudflare Secrets Store, a per-account container for secrets that can be bound into Workers with full redaction and audit support.
+- [SendEmail](https://v2.alchemy.run/providers/cloudflare/sendemail) — A Cloudflare Workers `send_email` binding descriptor.
+- [SendEmailBinding](https://v2.alchemy.run/providers/cloudflare/sendemailbinding) — A typed runtime accessor for a Cloudflare `send_email` Worker binding.
+- [StaticSite](https://v2.alchemy.run/providers/cloudflare/staticsite) — A Cloudflare Worker that serves static assets built by a shell command.
+- [Tunnel](https://v2.alchemy.run/providers/cloudflare/tunnel) — A Cloudflare Tunnel that establishes a secure connection from your origin to Cloudflare's edge.
+- [UserApiToken](https://v2.alchemy.run/providers/cloudflare/userapitoken) — A Cloudflare user-owned API token (`POST /user/tokens`).
+- [VectorizeIndex](https://v2.alchemy.run/providers/cloudflare/vectorizeindex) — A Cloudflare Vectorize index for storing and querying vector embeddings.
+- [VectorizeMetadataIndex](https://v2.alchemy.run/providers/cloudflare/vectorizemetadataindex) — A metadata index on a Cloudflare Vectorize index.
+- [Vite](https://v2.alchemy.run/providers/cloudflare/vite) — A Cloudflare Worker deployed from a Vite project.
+- [VpcService](https://v2.alchemy.run/providers/cloudflare/vpcservice) — A Cloudflare VPC service that exposes a private host (IP or hostname) reachable through a Cloudflare Tunnel for Workers VPC.
+- [Worker](https://v2.alchemy.run/providers/cloudflare/worker) — A Cloudflare Worker host with deploy-time binding support and runtime export collection.
+- [Workflow](https://v2.alchemy.run/providers/cloudflare/workflow) — Service that carries the current workflow event payload. `yield* WorkflowEvent` inside a workflow body to access it.
+- [ZarazConfig](https://v2.alchemy.run/providers/cloudflare/zarazconfig) — A Cloudflare Zaraz zone configuration.
+
+### Drizzle
+
+- [Postgres](https://v2.alchemy.run/providers/drizzle/postgres) — Open a Drizzle/Postgres database from a connection URL using the `drizzle-orm/effect-postgres` integration.
+- [Schema](https://v2.alchemy.run/providers/drizzle/schema) — A Drizzle schema managed as an Alchemy resource.
+
+### GitHub
+
+- [Comment](https://v2.alchemy.run/providers/github/comment) — A GitHub issue or pull request comment.
+- [Secret](https://v2.alchemy.run/providers/github/secret) — A GitHub Actions repository or environment secret.
+- [Variable](https://v2.alchemy.run/providers/github/variable) — A GitHub Actions repository variable.
+
+### Neon
+
+- [Branch](https://v2.alchemy.run/providers/neon/branch) — A branch of a Neon project.
+- [Project](https://v2.alchemy.run/providers/neon/project) — A Neon serverless Postgres project.
+
+### Planetscale
+
+- [MySQLBranch](https://v2.alchemy.run/providers/planetscale/mysql/mysqlbranch) — A PlanetScale branch of a {@link MySQLDatabase}. For PostgreSQL branches use {@link PostgresBranch} instead.
+- [MySQLDatabase](https://v2.alchemy.run/providers/planetscale/mysql/mysqldatabase) — A MySQL PlanetScale database (powered by Vitess). For PostgreSQL use {@link PostgresDatabase} instead.
+- [MySQLPassword](https://v2.alchemy.run/providers/planetscale/mysql/mysqlpassword) — A PlanetScale password for accessing a MySQL database branch.
+- [PostgresBranch](https://v2.alchemy.run/providers/planetscale/postgres/postgresbranch) — A PlanetScale branch of a {@link PostgresDatabase}. For MySQL branches use {@link MySQLBranch} instead.
+- [PostgresDatabase](https://v2.alchemy.run/providers/planetscale/postgres/postgresdatabase) — A PostgreSQL PlanetScale database. For MySQL, use {@link MySQLDatabase} instead.
+- [PostgresDefaultRole](https://v2.alchemy.run/providers/planetscale/postgres/postgresdefaultrole) — The default PlanetScale PostgreSQL role for a database branch.
+- [PostgresRole](https://v2.alchemy.run/providers/planetscale/postgres/postgresrole) — A PlanetScale role for accessing a PostgreSQL database branch.
diff --git a/.repos/alchemy-effect/website/public/og-default.png b/.repos/alchemy-effect/website/public/og-default.png
new file mode 100644
index 00000000000..e65092aa24c
Binary files /dev/null and b/.repos/alchemy-effect/website/public/og-default.png differ
diff --git a/.repos/alchemy-effect/website/public/og-default.svg b/.repos/alchemy-effect/website/public/og-default.svg
new file mode 100644
index 00000000000..19e793dba5f
--- /dev/null
+++ b/.repos/alchemy-effect/website/public/og-default.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630">
+    <rect width="1200" height="630" fill="#f5efe3"/>
+    <!-- subtle hairline frame -->
+    <rect x="24" y="24" width="1152" height="582" fill="none" stroke="#3f5a2a" stroke-opacity="0.18" stroke-width="1"/>
+    <!-- yantra centered, slightly above midline so wordmark sits below -->
+    <g transform="translate(490 75)" viewBox="0 0 24 24">
+      <svg width="220" height="220" viewBox="0 0 24 24" fill="none" stroke="#3f5a2a" stroke-width="0.7" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9.5"/><path d="M12 21.5 L3.7272 7.25 L20.2728 7.25 Z"/><circle cx="12" cy="12" r="1.1" fill="#3f5a2a" stroke="none"/></svg>
+    </g>
+    <!-- wordmark -->
+    <text x="600" y="375" text-anchor="middle"
+      font-family="'Source Serif 4', 'Source Serif Pro', Georgia, serif"
+      font-style="italic" font-weight="500" font-size="96" fill="#2a2620"
+      letter-spacing="-2">alchemy</text>
+    <text x="600" y="435" text-anchor="middle"
+      font-family="'JetBrains Mono', ui-monospace, monospace"
+      font-size="20" fill="#3f5a2a" letter-spacing="4">
+      ZERO &#8594; PRODUCTION
+    </text>
+    <!-- bottom-right url tag -->
+    <text x="1152" y="582" text-anchor="end"
+      font-family="'JetBrains Mono', ui-monospace, monospace"
+      font-size="18" fill="#85714f">alchemy.run</text>
+  </svg>
\ No newline at end of file
diff --git a/.repos/alchemy-effect/website/scripts/download-fonts.ts b/.repos/alchemy-effect/website/scripts/download-fonts.ts
new file mode 100644
index 00000000000..6bcbaa8fbf2
--- /dev/null
+++ b/.repos/alchemy-effect/website/scripts/download-fonts.ts
@@ -0,0 +1,212 @@
+/**
+ * Downloads the static (non-variable) TTFs for our brand fonts. Two
+ * destinations:
+ *
+ * - `website/assets/fonts/` — build-time only, read by the OG image
+ *   renderer (satori) via `fs.readFile`. Never shipped to clients.
+ * - `website/public/fonts/` — served by Astro at `/fonts/<file>` for
+ *   the website's own `@font-face` declarations. Use this only for
+ *   fonts the runtime page actually needs.
+ *
+ * Why static, not variable: satori's opentype parser
+ * (`@shuding/opentype.js`) can't parse Google Fonts' variable TTFs (the
+ * ones with `[opsz,wght]` axes). Static TTFs work fine and the upstream
+ * static releases include the full glyph set unlike the `@fontsource/*`
+ * woff packages, which are subsetted to `latin` only and miss arrows.
+ *
+ * Files are cached on disk; subsequent runs are no-ops unless missing.
+ */
+
+import { mkdir, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const buildOnlyFontsDir = path.resolve(here, "../assets/fonts");
+const publicFontsDir = path.resolve(here, "../public/fonts");
+
+interface FontSource {
+  file: string;
+  url: string;
+  /**
+   * Where the file lands on disk. `"build"` (default) goes to
+   * `assets/fonts/` for OG-only consumption; `"public"` goes to
+   * `public/fonts/` so the website's CSS can fetch it at runtime.
+   */
+  scope?: "build" | "public";
+}
+
+const FONTS: FontSource[] = [
+  // Source Serif 4 — Adobe's official static TTFs.
+  //
+  // Two optical-size variants: Display (chunkier serifs, more stroke
+  // contrast) for the headline at ~100px, and Text (calmer, more even
+  // weight) for the description at ~26px. The website's hero uses the
+  // variable font which auto-selects optical size; satori needs us to
+  // pick explicitly per element.
+  {
+    file: "SourceSerif4-Regular.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4-Regular.ttf",
+  },
+  {
+    file: "SourceSerif4-It.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4-It.ttf",
+  },
+  {
+    file: "SourceSerif4Display-Regular.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4Display-Regular.ttf",
+  },
+  {
+    file: "SourceSerif4Display-It.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4Display-It.ttf",
+  },
+  {
+    file: "SourceSerif4Display-Light.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4Display-Light.ttf",
+  },
+  {
+    file: "SourceSerif4Display-LightIt.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4Display-LightIt.ttf",
+  },
+  // Semibold (600) — closest static cut to the website hero's runtime
+  // weight. The hero uses the variable font, which the browser
+  // interpolates to "Medium" (500) at the 60pt optical size; Adobe
+  // doesn't ship a static Medium Display variant, so we snap up to
+  // Semibold. Slightly heavier than the website but visibly closer
+  // than Light (300).
+  {
+    file: "SourceSerif4Display-Semibold.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4Display-Semibold.ttf",
+  },
+  {
+    file: "SourceSerif4Display-SemiboldIt.ttf",
+    url: "https://cdn.jsdelivr.net/gh/adobe-fonts/source-serif@release/TTF/SourceSerif4Display-SemiboldIt.ttf",
+  },
+
+  // Tinos — Apache-2.0, metrically and visually compatible with Times
+  // New Roman. Used exclusively for the arrow glyph in the marketing
+  // headline. Pinning U+2192 to a TNR-equivalent font on BOTH the
+  // website and the OG card keeps the two visuals consistent
+  // regardless of which subset/fallback the runtime picks. This font
+  // is served to the browser too (via @font-face in tokens.css), so
+  // it lands in `public/fonts/` rather than `assets/fonts/`.
+  {
+    file: "Tinos-Regular.ttf",
+    url: "https://cdn.jsdelivr.net/gh/google/fonts@main/ofl/tinos/Tinos-Regular.ttf",
+    scope: "public",
+  },
+
+  // JetBrains Mono — for the eyebrow label.
+  {
+    file: "JetBrainsMono-Regular.ttf",
+    url: "https://cdn.jsdelivr.net/gh/JetBrains/JetBrainsMono@v2.304/fonts/ttf/JetBrainsMono-Regular.ttf",
+  },
+
+  // Caveat — for the hand-drawn alchemy.run URL stamp.
+  {
+    file: "Caveat-Regular.ttf",
+    url: "https://cdn.jsdelivr.net/gh/googlefonts/caveat@main/fonts/ttf/Caveat-Regular.ttf",
+  },
+];
+
+async function exists(p: string): Promise<boolean> {
+  try {
+    const s = await stat(p);
+    return s.size > 1024;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Derive a list of mirror URLs to try in order. jsdelivr's `cdn.jsdelivr.net/gh/`
+ * surface intermittently 403s under burst load; raw.githubusercontent.com serves
+ * the same blob directly from GitHub and is a reliable fallback. Any other URL
+ * is used as-is with no fallback.
+ */
+function mirrorsFor(url: string): string[] {
+  const m = url.match(
+    /^https:\/\/cdn\.jsdelivr\.net\/gh\/([^/]+)\/([^@]+)@([^/]+)\/(.+)$/,
+  );
+  if (!m) return [url];
+  const [, owner, repo, ref, rest] = m;
+  return [
+    url,
+    `https://raw.githubusercontent.com/${owner}/${repo}/${ref}/${rest}`,
+  ];
+}
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+async function fetchWithRetry(
+  url: string,
+  attempts = 3,
+): Promise<Uint8Array | { error: string }> {
+  let lastErr = "";
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetch(url);
+      if (res.ok) {
+        const buf = new Uint8Array(await res.arrayBuffer());
+        if (buf.byteLength < 1024) {
+          lastErr = `${buf.byteLength} bytes (suspiciously small)`;
+        } else {
+          return buf;
+        }
+      } else if (res.status === 404) {
+        // No point retrying a hard 404 — the URL itself is wrong.
+        return { error: `404 Not Found` };
+      } else {
+        lastErr = `${res.status} ${res.statusText}`;
+      }
+    } catch (e) {
+      lastErr = (e as Error).message;
+    }
+    if (i < attempts - 1) await sleep(500 * 2 ** i); // 500ms, 1s
+  }
+  return { error: lastErr };
+}
+
+function dirFor(font: FontSource): string {
+  return font.scope === "public" ? publicFontsDir : buildOnlyFontsDir;
+}
+
+async function downloadOne(font: FontSource): Promise<"cached" | "fetched"> {
+  const dest = path.join(dirFor(font), font.file);
+  if (await exists(dest)) return "cached";
+
+  const mirrors = mirrorsFor(font.url);
+  const errors: string[] = [];
+  for (const url of mirrors) {
+    const result = await fetchWithRetry(url);
+    if (result instanceof Uint8Array) {
+      await writeFile(dest, result);
+      return "fetched";
+    }
+    errors.push(`${url} → ${result.error}`);
+  }
+  throw new Error(
+    `Failed to download ${font.file} from ${mirrors.length} mirror(s):\n  ${errors.join("\n  ")}`,
+  );
+}
+
+async function main() {
+  await mkdir(buildOnlyFontsDir, { recursive: true });
+  await mkdir(publicFontsDir, { recursive: true });
+  // Sequential, not parallel: jsdelivr rate-limits bursts of >5 concurrent
+  // requests from the same IP and starts returning 403s. Fonts are small
+  // and only fetched once per dev environment, so the speed difference
+  // is negligible.
+  let fetched = 0;
+  let cached = 0;
+  for (const font of FONTS) {
+    const r = await downloadOne(font);
+    if (r === "fetched") fetched++;
+    else cached++;
+  }
+  console.log(
+    `[fonts] ${fetched} downloaded, ${cached} cached → assets/fonts (build) + public/fonts (runtime)`,
+  );
+}
+
+await main();
diff --git a/.repos/alchemy-effect/website/scripts/generate-brand-assets.ts b/.repos/alchemy-effect/website/scripts/generate-brand-assets.ts
new file mode 100644
index 00000000000..c4ac6105b3f
--- /dev/null
+++ b/.repos/alchemy-effect/website/scripts/generate-brand-assets.ts
@@ -0,0 +1,156 @@
+/**
+ * Build-time brand asset generator. Runs before `astro build` and emits
+ * favicons + a fallback OG image into `website/public/`, all derived from
+ * the single yantra geometry source in `src/brand/yantra.ts`.
+ *
+ * The per-page OG images are rendered separately by the static endpoint at
+ * `src/pages/og/[...slug].png.ts` during `astro build`; this script only
+ * produces brand artifacts that need to exist on disk before Astro starts
+ * (so they're picked up by the public/ asset pipeline).
+ */
+
+import { Resvg } from "@resvg/resvg-js";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { YANTRA_COLORS, yantraSvg } from "../src/brand/yantra.ts";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const publicDir = path.resolve(here, "../public");
+
+/** Render an SVG string to PNG bytes at a target square size. */
+function rasterize(svg: string, size: number): Uint8Array {
+  const resvg = new Resvg(svg, {
+    fitTo: { mode: "width", value: size },
+    background: "rgba(0, 0, 0, 0)",
+  });
+  return resvg.render().asPng();
+}
+
+/**
+ * A favicon-friendly variant of the yantra: parchment tile with a small
+ * inner padding so the glyph reads well at 16px. The stroke weight is bumped
+ * because the lines collapse below ~1.4 viewBox units when downscaled.
+ */
+function faviconTileSvg(): string {
+  return yantraSvg({
+    size: 64,
+    bg: YANTRA_COLORS.bg,
+    stroke: YANTRA_COLORS.stroke,
+    dot: YANTRA_COLORS.dot,
+    strokeWidth: 1.4,
+  });
+}
+
+/**
+ * apple-touch-icon needs an opaque background and generous padding —
+ * iOS renders it inside its own rounded-rect mask.
+ */
+function appleTouchSvg(): string {
+  // Embed the standard 24-unit yantra centered inside a 32-unit padded canvas.
+  const inner = yantraSvg({
+    size: 24,
+    stroke: YANTRA_COLORS.stroke,
+    dot: YANTRA_COLORS.dot,
+    strokeWidth: 1.1,
+  });
+  // Strip the outer <svg> wrapper so we can re-mount the geometry inside a
+  // padded canvas — easier than computing translate() in two places.
+  const innerBody = inner.replace(/^<svg[^>]*>/, "").replace(/<\/svg>$/, "");
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="180" height="180" viewBox="0 0 32 32">
+    <rect width="32" height="32" fill="${YANTRA_COLORS.bg}"/>
+    <g transform="translate(4 4)" fill="none" stroke="${YANTRA_COLORS.stroke}" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round">${innerBody}</g>
+  </svg>`;
+}
+
+/**
+ * Static OG fallback (1200×630). Simple, hand-crafted SVG so this script
+ * has no satori/font dependency. Used when a page has no slug-specific OG
+ * image (e.g. external referrers hitting the bare domain).
+ */
+function ogFallbackSvg(): string {
+  const W = 1200;
+  const H = 630;
+  // Yantra glyph centered, large.
+  const glyphSize = 220;
+  const glyph = yantraSvg({
+    size: glyphSize,
+    stroke: YANTRA_COLORS.stroke,
+    dot: YANTRA_COLORS.dot,
+    strokeWidth: 0.7,
+  })
+    .replace(/^<svg[^>]*>/, "")
+    .replace(/<\/svg>$/, "");
+
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${W}" height="${H}" viewBox="0 0 ${W} ${H}">
+    <rect width="${W}" height="${H}" fill="${YANTRA_COLORS.bg}"/>
+    <!-- subtle hairline frame -->
+    <rect x="24" y="24" width="${W - 48}" height="${H - 48}" fill="none" stroke="${YANTRA_COLORS.stroke}" stroke-opacity="0.18" stroke-width="1"/>
+    <!-- yantra centered, slightly above midline so wordmark sits below -->
+    <g transform="translate(${(W - glyphSize) / 2} ${H / 2 - glyphSize - 20})" viewBox="0 0 24 24">
+      <svg width="${glyphSize}" height="${glyphSize}" viewBox="0 0 24 24" fill="none" stroke="${YANTRA_COLORS.stroke}" stroke-width="0.7" stroke-linecap="round" stroke-linejoin="round">${glyph}</svg>
+    </g>
+    <!-- wordmark -->
+    <text x="${W / 2}" y="${H / 2 + 60}" text-anchor="middle"
+      font-family="'Source Serif 4', 'Source Serif Pro', Georgia, serif"
+      font-style="italic" font-weight="500" font-size="96" fill="#2a2620"
+      letter-spacing="-2">alchemy</text>
+    <text x="${W / 2}" y="${H / 2 + 120}" text-anchor="middle"
+      font-family="'JetBrains Mono', ui-monospace, monospace"
+      font-size="20" fill="${YANTRA_COLORS.stroke}" letter-spacing="4">
+      ZERO &#8594; PRODUCTION
+    </text>
+    <!-- bottom-right url tag -->
+    <text x="${W - 48}" y="${H - 48}" text-anchor="end"
+      font-family="'JetBrains Mono', ui-monospace, monospace"
+      font-size="18" fill="#85714f">alchemy.run</text>
+  </svg>`;
+}
+
+async function main() {
+  await mkdir(publicDir, { recursive: true });
+
+  // 1. Vector favicon — parchment tile, bumped stroke for tab legibility.
+  const favSvg = faviconTileSvg();
+  await writeFile(path.join(publicDir, "favicon.svg"), favSvg);
+
+  // 2. Raster favicons.
+  await writeFile(
+    path.join(publicDir, "favicon-32.png"),
+    rasterize(favSvg, 32),
+  );
+  await writeFile(
+    path.join(publicDir, "favicon-16.png"),
+    rasterize(favSvg, 16),
+  );
+
+  // 3. apple-touch-icon (180×180, padded, opaque parchment).
+  const apple = appleTouchSvg();
+  await writeFile(
+    path.join(publicDir, "apple-touch-icon.png"),
+    rasterize(apple, 180),
+  );
+
+  // 4. Larger PWA / share fallback at 512×512.
+  await writeFile(path.join(publicDir, "icon-512.png"), rasterize(apple, 512));
+
+  // 5. Backwards-compat: keep the old /favicon.png reference (used by
+  //    some cached nav code) pointing to the 32px raster.
+  await writeFile(path.join(publicDir, "favicon.png"), rasterize(favSvg, 32));
+
+  // 6. OG fallback (1200×630). Per-page OG images come from the static
+  //    endpoint; this is the bare-domain fallback.
+  const ogSvg = ogFallbackSvg();
+  await writeFile(path.join(publicDir, "og-default.svg"), ogSvg);
+  await writeFile(
+    path.join(publicDir, "og-default.png"),
+    rasterize(ogSvg, 1200),
+  );
+
+  // eslint-disable-next-line no-console
+  console.log(
+    "[brand] wrote favicon.{svg,png}, favicon-{16,32}.png, apple-touch-icon.png, icon-512.png, og-default.{svg,png}",
+  );
+}
+
+await main();
diff --git a/.repos/alchemy-effect/website/scripts/generate-llms-txt.ts b/.repos/alchemy-effect/website/scripts/generate-llms-txt.ts
new file mode 100644
index 00000000000..020326f731e
--- /dev/null
+++ b/.repos/alchemy-effect/website/scripts/generate-llms-txt.ts
@@ -0,0 +1,275 @@
+/**
+ * Generates `public/llms.txt` — a navigation index of every docs page,
+ * grouped by section, with title + description pulled from each page's
+ * frontmatter.
+ *
+ * Run with: `bun scripts/generate-llms-txt.ts`
+ *
+ * Section ordering, headings, and prose intros are configured here.
+ * Page metadata (title, description) comes from the source frontmatter,
+ * so editing a page's frontmatter is enough to update llms.txt.
+ */
+
+import { readdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const docsDir = path.resolve(here, "../src/content/docs");
+const outFile = path.resolve(here, "../public/llms.txt");
+const siteUrl = "https://v2.alchemy.run";
+
+interface Page {
+  /** URL path, e.g. "/concepts/binding" */
+  href: string;
+  /** Path relative to docs dir without extension, e.g. "concepts/binding" */
+  slug: string;
+  title: string;
+  description: string;
+  draft: boolean;
+  /** `sidebar.order` from frontmatter; `Infinity` when unset. */
+  order: number;
+}
+
+interface Section {
+  /** H2 heading */
+  heading: string;
+  /** Optional prose paragraph after the heading. */
+  intro?: string;
+  /**
+   * Pages to include. Either a list of explicit slugs (relative to docs dir,
+   * no extension) in the desired order, or a directory to enumerate
+   * alphabetically.
+   */
+  pages: { slugs: string[] } | { directory: string; exclude?: string[] };
+}
+
+const SECTIONS: Section[] = [
+  {
+    heading: "Start here",
+    pages: { slugs: ["what-is-alchemy", "getting-started"] },
+  },
+  {
+    heading: "Tutorial — main path (Cloudflare)",
+    intro:
+      "A linear five-part walkthrough from zero to a tested, locally-developed, CI-deployed Cloudflare project. Each part builds on the previous one.",
+    pages: {
+      slugs: [
+        "tutorial/part-1",
+        "tutorial/part-2",
+        "tutorial/part-3",
+        "tutorial/part-4",
+        "tutorial/part-5",
+      ],
+    },
+  },
+  {
+    heading: "Tutorial — Cloudflare add-ons",
+    intro:
+      "Standalone tutorials that extend the main tutorial's Worker with a specific Cloudflare feature. Pick the ones that match your use case.",
+    pages: { directory: "tutorial/cloudflare" },
+  },
+  {
+    heading: "Tutorial — AWS",
+    intro:
+      "End-to-end AWS tutorials. Read the Lambda page first; the others bind storage and event sources to that Lambda.",
+    pages: { directory: "tutorial/aws" },
+  },
+  {
+    heading: "Concepts — the mental model",
+    intro:
+      "Reference pages explaining what each primitive means and how they fit together. Read these when something in a tutorial feels magical, or before designing a new Stack.",
+    pages: { directory: "concepts" },
+  },
+  {
+    heading: "Guides — task-oriented",
+    intro:
+      "Standalone how-to pages. Each solves a specific problem; read in any order.",
+    pages: { directory: "guides" },
+  },
+];
+
+const PROVIDERS_INTRO = `Per-resource API reference, generated from JSDoc on the source \`.ts\` files via \`bun generate:api-reference\`. Each page documents the resource's input properties (with types, defaults, and constraints), output attributes, and Quick Reference / Examples sections derived from \`@section\` / \`@example\` JSDoc tags. Grouped by cloud below.`;
+
+/**
+ * Enumerates every generated provider page under `providers/{Cloud}/...`,
+ * grouped by cloud. These pages are produced by `build:reference` (which runs
+ * before this script in the build), so they exist on disk at generation time
+ * even though they are gitignored.
+ */
+async function renderProvidersSection(): Promise<string> {
+  const providersDir = path.join(docsDir, "providers");
+  let clouds: string[];
+  try {
+    const entries = await readdir(providersDir, { withFileTypes: true });
+    clouds = entries
+      .filter((e) => e.isDirectory())
+      .map((e) => e.name)
+      .sort();
+  } catch (err: any) {
+    if (err?.code === "ENOENT") return `## Providers\n\n${PROVIDERS_INTRO}`;
+    throw err;
+  }
+
+  const blocks: string[] = [`## Providers`, PROVIDERS_INTRO];
+  for (const cloud of clouds) {
+    const slugs = await listSlugs(`providers/${cloud}`);
+    const pages = (await Promise.all(slugs.map(loadPage)))
+      .filter((p) => !p.draft)
+      // Starlight serves provider routes lowercased (e.g. the CamelCase source
+      // `providers/AWS/S3/Bucket.md` is reachable at `/providers/aws/s3/bucket`).
+      .map((p) => ({ ...p, href: p.href.toLowerCase() }))
+      .sort((a, b) => a.title.localeCompare(b.title));
+    if (pages.length === 0) continue;
+    blocks.push(`### ${cloud}`);
+    blocks.push(pages.map(renderPage).join("\n"));
+  }
+  return blocks.join("\n\n");
+}
+
+const HEADER = `# Alchemy
+
+> Alchemy Effect is an Infrastructure-as-Effects (IaE) framework that combines cloud infrastructure and application logic into a single, type-safe program powered by [Effect](https://effect.website). Resources are declared as Effects; bindings wire IAM, env vars, and typed SDKs in one call; deploys and runtime share the same code.
+
+This file is a navigation index for the documentation site at ${siteUrl}. Every page under \`/src/content/docs/\` is listed below with its URL and a one-line summary, so an agent can pick the right page in one hop.`;
+
+function parseFrontmatter(source: string): Record<string, string> {
+  if (!source.startsWith("---")) return {};
+  const end = source.indexOf("\n---", 3);
+  if (end === -1) return {};
+  const block = source.slice(3, end);
+  const out: Record<string, string> = {};
+  for (const rawLine of block.split("\n")) {
+    const line = rawLine.trimEnd();
+    const m = line.match(/^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/);
+    if (!m) continue;
+    let value = m[2].trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    out[m[1]] = value;
+  }
+  return out;
+}
+
+/**
+ * Extracts the nested `sidebar.order` value from a frontmatter block.
+ * Starlight uses this to order autogenerated sidebar groups; we mirror it
+ * so llms.txt lists pages in the same order the sidebar shows them.
+ * Returns `Infinity` when unset, so unordered pages sort after ordered ones.
+ */
+function parseSidebarOrder(source: string): number {
+  if (!source.startsWith("---")) return Number.POSITIVE_INFINITY;
+  const end = source.indexOf("\n---", 3);
+  if (end === -1) return Number.POSITIVE_INFINITY;
+  const block = source.slice(3, end);
+  const lines = block.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^sidebar:\s*$/.test(lines[i])) continue;
+    for (let j = i + 1; j < lines.length; j++) {
+      if (/^\S/.test(lines[j])) break; // dedented out of the sidebar block
+      const m = lines[j].match(/^\s+order:\s*(-?[\d.]+)\s*$/);
+      if (m) return Number.parseFloat(m[1]);
+    }
+    break;
+  }
+  return Number.POSITIVE_INFINITY;
+}
+
+async function loadPage(slug: string): Promise<Page> {
+  const candidates = [`${slug}.mdx`, `${slug}.md`];
+  for (const rel of candidates) {
+    const full = path.join(docsDir, rel);
+    try {
+      const source = await readFile(full, "utf8");
+      const fm = parseFrontmatter(source);
+      const title = fm.title;
+      const description = fm.description ?? fm.excerpt ?? "";
+      if (!title) {
+        throw new Error(`Missing title in frontmatter: ${rel}`);
+      }
+      return {
+        href: `/${slug}`,
+        slug,
+        title,
+        description,
+        draft: fm.draft === "true" || (fm.draft as unknown as boolean) === true,
+        order: parseSidebarOrder(source),
+      };
+    } catch (err: any) {
+      if (err?.code !== "ENOENT") throw err;
+    }
+  }
+  throw new Error(`Page not found: ${slug} (looked for .mdx and .md)`);
+}
+
+async function listSlugs(
+  directory: string,
+  exclude: string[] = [],
+): Promise<string[]> {
+  const dir = path.join(docsDir, directory);
+  const entries = await readdir(dir, { withFileTypes: true });
+  const slugs: string[] = [];
+  for (const entry of entries) {
+    const rel = `${directory}/${entry.name}`;
+    if (entry.isDirectory()) {
+      slugs.push(...(await listSlugs(rel, exclude)));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const ext = path.extname(entry.name);
+    if (ext !== ".md" && ext !== ".mdx") continue;
+    const slug = `${directory}/${entry.name.slice(0, -ext.length)}`;
+    if (exclude.includes(slug)) continue;
+    slugs.push(slug);
+  }
+  slugs.sort();
+  return slugs;
+}
+
+function byOrderThenTitle(a: Page, b: Page): number {
+  if (a.order !== b.order) return a.order - b.order;
+  return a.title.localeCompare(b.title);
+}
+
+function renderPage(page: Page): string {
+  const url = `${siteUrl}${page.href}`;
+  const desc = page.description ? ` — ${page.description}` : "";
+  return `- [${page.title}](${url})${desc}`;
+}
+
+async function main() {
+  const parts: string[] = [HEADER];
+
+  for (const section of SECTIONS) {
+    const isDirectory = !("slugs" in section.pages);
+    const slugs =
+      "slugs" in section.pages
+        ? section.pages.slugs
+        : await listSlugs(section.pages.directory, section.pages.exclude);
+    const pages = (await Promise.all(slugs.map(loadPage))).filter(
+      (p) => !p.draft,
+    );
+    // Directory sections mirror the sidebar's `sidebar.order` ordering; slug
+    // sections keep the curated order they were declared in.
+    if (isDirectory) pages.sort(byOrderThenTitle);
+
+    parts.push(`## ${section.heading}`);
+    if (section.intro) parts.push(section.intro);
+    parts.push(pages.map(renderPage).join("\n"));
+  }
+
+  parts.push(await renderProvidersSection());
+
+  const body = parts.join("\n\n") + "\n";
+  await writeFile(outFile, body, "utf8");
+  console.log(`Wrote ${outFile}`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
diff --git a/.repos/alchemy-effect/website/scripts/generate-readme-hero.ts b/.repos/alchemy-effect/website/scripts/generate-readme-hero.ts
new file mode 100644
index 00000000000..69c50320327
--- /dev/null
+++ b/.repos/alchemy-effect/website/scripts/generate-readme-hero.ts
@@ -0,0 +1,89 @@
+/**
+ * Renders the repo-root README hero image. Run once (or whenever the
+ * brand mark / wordmark changes) and the resulting PNG is committed to
+ * `images/readme-hero.png`. GitHub serves it straight out of the tree.
+ *
+ * Pipeline mirrors the per-page OG image endpoint
+ * (`src/pages/og/[...slug].png.ts`): satori → SVG → resvg → PNG, with
+ * the same static TTF fonts loaded from `website/assets/fonts/` so the
+ * artwork uses the website's headline face (Source Serif 4 Display)
+ * instead of a fallback.
+ */
+
+import { Resvg } from "@resvg/resvg-js";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import satori from "satori";
+import {
+  README_HERO_H,
+  README_HERO_W,
+  ReadmeHero,
+} from "../src/brand/ReadmeHero.tsx";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const fontsDir = path.resolve(here, "../assets/fonts");
+const outDir = path.resolve(here, "../../images");
+const outFile = path.join(outDir, "readme-hero.png");
+
+async function font(file: string): Promise<Buffer> {
+  return readFile(path.join(fontsDir, file));
+}
+
+async function main() {
+  const [serifIt, displayLightIt, displaySemiIt, displayReg, mono, caveat] =
+    await Promise.all([
+      font("SourceSerif4-It.ttf"),
+      font("SourceSerif4Display-LightIt.ttf"),
+      font("SourceSerif4Display-SemiboldIt.ttf"),
+      font("SourceSerif4Display-Regular.ttf"),
+      font("JetBrainsMono-Regular.ttf"),
+      font("Caveat-Regular.ttf"),
+    ]);
+
+  const fonts = [
+    { name: "Source Serif 4", data: serifIt, weight: 400, style: "italic" },
+    {
+      name: "Source Serif 4 Display",
+      data: displayLightIt,
+      weight: 300,
+      style: "italic",
+    },
+    {
+      name: "Source Serif 4 Display",
+      data: displayReg,
+      weight: 400,
+      style: "normal",
+    },
+    {
+      name: "Source Serif 4 Display",
+      data: displaySemiIt,
+      weight: 600,
+      style: "italic",
+    },
+    { name: "JetBrains Mono", data: mono, weight: 400, style: "normal" },
+    { name: "Caveat", data: caveat, weight: 400, style: "normal" },
+  ] as const;
+
+  const svg = await satori(ReadmeHero(), {
+    width: README_HERO_W,
+    height: README_HERO_H,
+    fonts: fonts as any,
+  });
+
+  const png = new Resvg(svg, {
+    fitTo: { mode: "width", value: README_HERO_W },
+  })
+    .render()
+    .asPng();
+
+  await mkdir(outDir, { recursive: true });
+  await writeFile(outFile, png);
+
+  // eslint-disable-next-line no-console
+  console.log(
+    `[readme-hero] wrote ${path.relative(process.cwd(), outFile)} (${README_HERO_W}×${README_HERO_H}, ${(png.byteLength / 1024).toFixed(1)} KiB)`,
+  );
+}
+
+await main();
diff --git a/.repos/alchemy-effect/website/scripts/preview-og.ts b/.repos/alchemy-effect/website/scripts/preview-og.ts
new file mode 100644
index 00000000000..febb5a9dc6d
--- /dev/null
+++ b/.repos/alchemy-effect/website/scripts/preview-og.ts
@@ -0,0 +1,109 @@
+/**
+ * One-shot preview generator for the blog OG card. Renders a sample
+ * card to /tmp/og-preview.png using the same satori + resvg pipeline
+ * as the production endpoint.
+ */
+import { Resvg } from "@resvg/resvg-js";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import satori from "satori";
+import { OgCard } from "../src/brand/OgCard";
+
+const fontsDir = fileURLToPath(new URL("../assets/fonts/", import.meta.url));
+const publicFontsDir = fileURLToPath(
+  new URL("../public/fonts/", import.meta.url),
+);
+const read = (name: string, pub = false) =>
+  fs.readFile(path.join(pub ? publicFontsDir : fontsDir, name));
+
+const [
+  serif,
+  serifIt,
+  displayLight,
+  displayLightIt,
+  displayReg,
+  displayRegIt,
+  displaySemi,
+  displaySemiIt,
+  tinos,
+  mono,
+  caveat,
+] = await Promise.all([
+  read("SourceSerif4-Regular.ttf"),
+  read("SourceSerif4-It.ttf"),
+  read("SourceSerif4Display-Light.ttf"),
+  read("SourceSerif4Display-LightIt.ttf"),
+  read("SourceSerif4Display-Regular.ttf"),
+  read("SourceSerif4Display-It.ttf"),
+  read("SourceSerif4Display-Semibold.ttf"),
+  read("SourceSerif4Display-SemiboldIt.ttf"),
+  read("Tinos-Regular.ttf", true),
+  read("JetBrainsMono-Regular.ttf"),
+  read("Caveat-Regular.ttf"),
+]);
+
+const fonts = [
+  { name: "Source Serif 4", data: serif, weight: 400, style: "normal" },
+  { name: "Source Serif 4", data: serifIt, weight: 400, style: "italic" },
+  {
+    name: "Source Serif 4 Display",
+    data: displayLight,
+    weight: 300,
+    style: "normal",
+  },
+  {
+    name: "Source Serif 4 Display",
+    data: displayLightIt,
+    weight: 300,
+    style: "italic",
+  },
+  {
+    name: "Source Serif 4 Display",
+    data: displayReg,
+    weight: 400,
+    style: "normal",
+  },
+  {
+    name: "Source Serif 4 Display",
+    data: displayRegIt,
+    weight: 400,
+    style: "italic",
+  },
+  {
+    name: "Source Serif 4 Display",
+    data: displaySemi,
+    weight: 600,
+    style: "normal",
+  },
+  {
+    name: "Source Serif 4 Display",
+    data: displaySemiIt,
+    weight: 600,
+    style: "italic",
+  },
+  { name: "Tinos", data: tinos, weight: 400, style: "normal" },
+  { name: "JetBrains Mono", data: mono, weight: 400, style: "normal" },
+  { name: "Caveat", data: caveat, weight: 400, style: "normal" },
+] as const;
+
+const element = OgCard({
+  kind: "blog",
+  title: "What's new in beta.39",
+  description:
+    "A small, high-impact fix release — VITE_* env props are now inlined into the client bundle, the Cloudflare Worker HTTP adapter runs handlers through Effect's standard HTTP lifecycle (unblocking RpcServer.toHttpEffect), and the SendEmail binding from beta.38 is now wired into Worker binding inference.",
+  date: "2026-05-13",
+});
+
+const svg = await satori(element, {
+  width: 1200,
+  height: 630,
+  fonts: fonts as any,
+});
+const png = new Resvg(svg, { fitTo: { mode: "width", value: 1200 } })
+  .render()
+  .asPng();
+
+const out = "/tmp/og-preview.png";
+await fs.writeFile(out, png);
+console.log(`wrote ${out}`);
diff --git a/.repos/alchemy-effect/website/src/blog-sidebar.ts b/.repos/alchemy-effect/website/src/blog-sidebar.ts
new file mode 100644
index 00000000000..cdd4be44914
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/blog-sidebar.ts
@@ -0,0 +1,77 @@
+/// <reference types="@astrojs/starlight/locals" />
+import { defineRouteMiddleware } from "@astrojs/starlight/route-data";
+import type { StarlightRouteData } from "@astrojs/starlight/route-data";
+import { getCollection } from "astro:content";
+import type { BlogCategory } from "./content.config";
+
+type SidebarItem = StarlightRouteData["sidebar"][number];
+type SidebarGroup = Extract<SidebarItem, { type: "group" }>;
+
+const groupLabels: Record<BlogCategory, string> = {
+  release: "Releases",
+  post: "Posts",
+};
+const groupOrder: BlogCategory[] = ["release", "post"];
+
+let categoryById: Map<string, BlogCategory> | undefined;
+
+async function loadCategoryById(): Promise<Map<string, BlogCategory>> {
+  if (categoryById) return categoryById;
+  const entries = await getCollection("docs", (entry) =>
+    entry.id.startsWith("blog/"),
+  );
+  const map = new Map<string, BlogCategory>();
+  for (const entry of entries) {
+    const data = entry.data as { category?: BlogCategory };
+    map.set(entry.id, data.category ?? "post");
+  }
+  categoryById = map;
+  return map;
+}
+
+function extractBlogId(href: string): string | undefined {
+  const match = href.match(/\/blog\/([^/]+)\/?$/);
+  return match ? `blog/${match[1]}` : undefined;
+}
+
+export const onRequest = defineRouteMiddleware(async (context, next) => {
+  await next();
+
+  const { starlightRoute, t } = context.locals;
+  const recentLabel = t("starlightBlog.sidebar.recent");
+
+  const recentIndex = starlightRoute.sidebar.findIndex(
+    (item): item is SidebarGroup =>
+      item.type === "group" && item.label === recentLabel,
+  );
+  if (recentIndex === -1) return;
+
+  const recentGroup = starlightRoute.sidebar[recentIndex] as SidebarGroup;
+  const categories = await loadCategoryById();
+
+  const buckets = new Map<BlogCategory, SidebarItem[]>();
+  for (const category of groupOrder) buckets.set(category, []);
+
+  for (const item of recentGroup.entries) {
+    if (item.type !== "link") continue;
+    const id = extractBlogId(item.href);
+    const category: BlogCategory =
+      (id !== undefined ? categories.get(id) : undefined) ?? "post";
+    buckets.get(category)!.push(item);
+  }
+
+  const replacement: SidebarGroup[] = [];
+  for (const category of groupOrder) {
+    const entries = buckets.get(category)!;
+    if (entries.length === 0) continue;
+    replacement.push({
+      type: "group",
+      label: groupLabels[category],
+      entries,
+      collapsed: false,
+      badge: undefined,
+    });
+  }
+
+  starlightRoute.sidebar.splice(recentIndex, 1, ...replacement);
+});
diff --git a/.repos/alchemy-effect/website/src/brand/OgCard.tsx b/.repos/alchemy-effect/website/src/brand/OgCard.tsx
new file mode 100644
index 00000000000..92609b694cc
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/brand/OgCard.tsx
@@ -0,0 +1,446 @@
+/**
+ * Satori template for Open Graph cards. Consumed only by the static
+ * `og/[...slug].png.ts` endpoint at build time — never shipped to the
+ * browser. The JSX is interpreted by satori, which supports a Flexbox
+ * subset and inline `style` props (no CSS classes).
+ *
+ * Two visual variants:
+ *
+ *   - `doc` / `marketing` — parchment background, serif headline, the
+ *     yantra glyph + eyebrow up top, hand-drawn "alchemy.run" caption
+ *     bottom-right. Mirrors the homepage hero.
+ *
+ *   - `blog` — dark variant inspired by Bun's release-note cards. Title
+ *     anchored top-left, dense multi-line description filling the body,
+ *     publish date + yantra mark in the footer. Designed to look full
+ *     and editorial; relies on posts having a meaty `description`/
+ *     `excerpt` in frontmatter.
+ *
+ * Title and description are rendered verbatim from the source page's
+ * frontmatter — no splitting, truncation, or glyph workarounds. The
+ * full unsubsetted variable TTFs loaded by the endpoint cover every
+ * Unicode codepoint we use.
+ */
+
+import { yantraSvg } from "./yantra";
+
+const COLORS = {
+  bg: "#f5efe3",
+  fg1: "#2a2620",
+  fg2: "#4e402c",
+  fg3: "#85714f",
+  accent: "#5c7a3e",
+  accentDeep: "#3f5a2a",
+  hairline: "rgba(42,38,32,0.14)",
+  // Blog (dark) palette.
+  darkBg: "#161310",
+  darkFg1: "#f5efe3",
+  darkFg2: "#bdb09a",
+  darkFg3: "#7d705c",
+  darkAccent: "#a8c47a",
+  // Dark-mode yantra — lifted moss stroke + terracotta bindu dot, mirroring
+  // the runtime tokens (--alc-accent / --alc-yantra-dot in the .dark block).
+  darkYantraStroke: "#7a9a5e",
+  darkYantraDot: "#c56e3c",
+  darkHairline: "rgba(245,239,227,0.12)",
+} as const;
+
+export type OgCardKind = "marketing" | "doc" | "blog";
+
+/**
+ * One styled segment of a structured title — mirrors the way the
+ * homepage hero declares its own emphasis with explicit `<span>` markup.
+ * Pages that want the accent treatment supply an array; doc pages pass
+ * a plain string and get plain text.
+ */
+export interface TitlePart {
+  text: string;
+  italic?: boolean;
+  /** Render this part in the deep-moss accent color. */
+  accent?: boolean;
+  /**
+   * Override the font family for this part. Use `"tinos"` for glyphs
+   * that should render from the TNR-equivalent face (the marketing
+   * arrow `→` — mirrors the website's font stack falling through to
+   * Times New Roman for U+2192). Default: Source Serif 4 Display.
+   */
+  font?: "tinos";
+}
+
+export interface OgCardProps {
+  title: string | TitlePart[];
+  description?: string;
+  /** Drives the eyebrow label (e.g. "guide", "concept", "blog"). */
+  eyebrow?: string;
+  kind?: OgCardKind;
+  /** ISO date string (YYYY-MM-DD). Rendered in the blog footer. */
+  date?: string;
+}
+
+const W = 1200;
+const H = 630;
+
+export function OgCard(props: OgCardProps): any {
+  const kind = props.kind ?? "doc";
+  if (kind === "blog") return BlogCard(props);
+  return DocCard(props);
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// Doc / marketing variant — parchment hero.
+// ────────────────────────────────────────────────────────────────────────────
+
+function DocCard({ title, description, eyebrow, kind }: OgCardProps): any {
+  const eyebrowText = (eyebrow ?? defaultEyebrow(kind ?? "doc")).toUpperCase();
+  const yantraDataUrl = yantraImage(COLORS.accentDeep);
+
+  return {
+    type: "div",
+    key: null,
+    props: {
+      style: {
+        width: W,
+        height: H,
+        display: "flex",
+        flexDirection: "column",
+        backgroundColor: COLORS.bg,
+        padding: "56px 64px",
+        fontFamily: "Source Serif 4",
+        color: COLORS.fg1,
+        position: "relative",
+      },
+      children: [
+        // Eyebrow row — yantra mark + monospace label.
+        {
+          type: "div",
+          key: "top",
+          props: {
+            style: { display: "flex", alignItems: "center", gap: 18 },
+            children: [
+              {
+                type: "img",
+                key: "y",
+                props: {
+                  src: yantraDataUrl,
+                  width: 56,
+                  height: 56,
+                  style: { display: "flex" },
+                },
+              },
+              {
+                type: "div",
+                key: "eb",
+                props: {
+                  style: {
+                    fontFamily: "JetBrains Mono",
+                    fontSize: 18,
+                    letterSpacing: 3,
+                    color: COLORS.accentDeep,
+                    fontWeight: 400,
+                  },
+                  children: eyebrowText,
+                },
+              },
+            ],
+          },
+        },
+        // Title.
+        {
+          type: "div",
+          key: "title",
+          props: {
+            style: {
+              display: "flex",
+              flexWrap: "wrap",
+              alignItems: "baseline",
+              marginTop: 56,
+              fontFamily: "Source Serif 4 Display",
+              fontWeight: 600,
+              fontSize: 110,
+              lineHeight: 1.02,
+              letterSpacing: -2,
+              color: COLORS.fg1,
+            },
+            children: renderTitle(title, COLORS.fg1, COLORS.accentDeep),
+          },
+        },
+        description
+          ? {
+              type: "div",
+              key: "desc",
+              props: {
+                style: {
+                  display: "flex",
+                  marginTop: 36,
+                  fontSize: 26,
+                  lineHeight: 1.45,
+                  color: COLORS.fg2,
+                  maxWidth: 980,
+                },
+                children: description,
+              },
+            }
+          : null,
+        // Spacer pushes the footer to the bottom.
+        {
+          type: "div",
+          key: "spacer",
+          props: { style: { display: "flex", flexGrow: 1 } },
+        },
+        // Footer — hairline + wordmark + hand-drawn URL.
+        {
+          type: "div",
+          key: "footer",
+          props: {
+            style: {
+              display: "flex",
+              alignItems: "flex-end",
+              justifyContent: "space-between",
+              borderTop: `1px solid ${COLORS.hairline}`,
+              paddingTop: 24,
+            },
+            children: [
+              {
+                type: "div",
+                key: "wm",
+                props: {
+                  style: {
+                    fontFamily: "Source Serif 4",
+                    fontStyle: "italic",
+                    fontWeight: 400,
+                    fontSize: 32,
+                    color: COLORS.fg1,
+                  },
+                  children: "alchemy",
+                },
+              },
+              {
+                type: "div",
+                key: "url",
+                props: {
+                  style: {
+                    fontFamily: "Caveat",
+                    fontWeight: 400,
+                    fontSize: 36,
+                    color: COLORS.accentDeep,
+                  },
+                  children: "alchemy.run",
+                },
+              },
+            ],
+          },
+        },
+      ].filter(Boolean),
+    },
+  };
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// Blog variant — dark, dense, Bun-inspired release card.
+// ────────────────────────────────────────────────────────────────────────────
+
+function BlogCard({ title, description, date }: OgCardProps): any {
+  const yantraDataUrl = yantraImage(
+    COLORS.darkYantraStroke,
+    COLORS.darkYantraDot,
+  );
+
+  return {
+    type: "div",
+    key: null,
+    props: {
+      style: {
+        width: W,
+        height: H,
+        display: "flex",
+        flexDirection: "column",
+        backgroundColor: COLORS.darkBg,
+        padding: "72px 80px",
+        fontFamily: "Source Serif 4",
+        color: COLORS.darkFg1,
+      },
+      children: [
+        // Title — large, top-anchored. Plain string for blog posts.
+        {
+          type: "div",
+          key: "title",
+          props: {
+            style: {
+              display: "flex",
+              flexWrap: "wrap",
+              fontFamily: "Source Serif 4 Display",
+              fontWeight: 600,
+              fontSize: 84,
+              lineHeight: 1.05,
+              letterSpacing: -1.5,
+              color: COLORS.darkFg1,
+            },
+            children: renderTitle(title, COLORS.darkFg1, COLORS.darkAccent),
+          },
+        },
+        // Description — fills the body. Larger maxWidth than doc cards
+        // so multi-sentence excerpts wrap to 4–6 lines.
+        description
+          ? {
+              type: "div",
+              key: "desc",
+              props: {
+                style: {
+                  display: "flex",
+                  marginTop: 32,
+                  fontSize: 28,
+                  lineHeight: 1.5,
+                  color: COLORS.darkFg2,
+                  maxWidth: 1040,
+                },
+                children: description,
+              },
+            }
+          : null,
+        // Spacer pushes the footer to the bottom.
+        {
+          type: "div",
+          key: "spacer",
+          props: { style: { display: "flex", flexGrow: 1 } },
+        },
+        // Footer — date on the left, yantra mark on the right.
+        {
+          type: "div",
+          key: "footer",
+          props: {
+            style: {
+              display: "flex",
+              alignItems: "center",
+              justifyContent: "space-between",
+              borderTop: `1px solid ${COLORS.darkHairline}`,
+              paddingTop: 28,
+            },
+            children: [
+              {
+                type: "div",
+                key: "date",
+                props: {
+                  style: {
+                    display: "flex",
+                    flexDirection: "column",
+                    gap: 4,
+                  },
+                  children: [
+                    {
+                      type: "div",
+                      key: "d",
+                      props: {
+                        style: {
+                          fontFamily: "Source Serif 4",
+                          fontSize: 24,
+                          color: COLORS.darkFg2,
+                        },
+                        children: formatDate(date),
+                      },
+                    },
+                    {
+                      type: "div",
+                      key: "wm",
+                      props: {
+                        style: {
+                          fontFamily: "JetBrains Mono",
+                          fontSize: 16,
+                          letterSpacing: 3,
+                          color: COLORS.darkFg3,
+                        },
+                        children: "ALCHEMY.RUN",
+                      },
+                    },
+                  ],
+                },
+              },
+              {
+                type: "img",
+                key: "y",
+                props: {
+                  src: yantraDataUrl,
+                  width: 72,
+                  height: 72,
+                  style: { display: "flex" },
+                },
+              },
+            ],
+          },
+        },
+      ].filter(Boolean),
+    },
+  };
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ────────────────────────────────────────────────────────────────────────────
+
+function yantraImage(stroke: string, dot: string = stroke): string {
+  const svg = yantraSvg({
+    size: 96,
+    stroke,
+    dot,
+    strokeWidth: 0.7,
+  });
+  return `data:image/svg+xml;base64,${Buffer.from(svg).toString("base64")}`;
+}
+
+function renderTitle(
+  title: string | TitlePart[],
+  fg: string,
+  accent: string,
+): any {
+  if (!Array.isArray(title)) return title;
+  return title.map((part, i) => ({
+    type: "span",
+    key: `tp${i}`,
+    props: {
+      style: {
+        fontFamily: part.font === "tinos" ? "Tinos" : "Source Serif 4 Display",
+        fontStyle: part.italic ? "italic" : "normal",
+        color: part.accent ? accent : fg,
+        fontWeight: part.font === "tinos" ? 400 : 600,
+      },
+      children: part.text,
+    },
+  }));
+}
+
+const MONTHS = [
+  "January",
+  "February",
+  "March",
+  "April",
+  "May",
+  "June",
+  "July",
+  "August",
+  "September",
+  "October",
+  "November",
+  "December",
+];
+
+function formatDate(iso: string | undefined): string {
+  if (!iso) return "";
+  // Parse YYYY-MM-DD without timezone surprises.
+  const m = /^(\d{4})-(\d{2})-(\d{2})/.exec(iso);
+  if (!m) return iso;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  return `${MONTHS[month - 1]} ${day}, ${year}`;
+}
+
+function defaultEyebrow(kind: OgCardKind): string {
+  switch (kind) {
+    case "marketing":
+      return "alchemy · zero to production";
+    case "blog":
+      return "blog · alchemy.run";
+    case "doc":
+    default:
+      return "alchemy · documentation";
+  }
+}
diff --git a/.repos/alchemy-effect/website/src/brand/ReadmeHero.tsx b/.repos/alchemy-effect/website/src/brand/ReadmeHero.tsx
new file mode 100644
index 00000000000..3849b4db724
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/brand/ReadmeHero.tsx
@@ -0,0 +1,78 @@
+/**
+ * Satori template for the README hero — a tight stacked lockup of the
+ * yantra mark above the italic "Alchemy" wordmark, centered on a
+ * parchment ground. No frame, no tagline, no URL stamp. Rendered offline
+ * by `scripts/generate-readme-hero.ts` to `images/readme-hero.png`.
+ *
+ * The native render size is 1200×720 (5:3). The README displays it at a
+ * fixed badge width (~360px) so it reads as a brand mark, not a banner.
+ */
+
+import { yantraSvg } from "./yantra";
+
+const COLORS = {
+  bg: "#f5efe3",
+  fg: "#2a2620",
+  accent: "#3f5a2a",
+} as const;
+
+export const README_HERO_W = 1200;
+export const README_HERO_H = 720;
+
+export function ReadmeHero(): any {
+  const yantra = yantraSvg({
+    size: 280,
+    stroke: COLORS.accent,
+    dot: COLORS.accent,
+    strokeWidth: 0.7,
+  });
+  const yantraDataUrl = `data:image/svg+xml;base64,${Buffer.from(yantra).toString("base64")}`;
+
+  return {
+    type: "div",
+    key: null,
+    props: {
+      style: {
+        width: README_HERO_W,
+        height: README_HERO_H,
+        display: "flex",
+        flexDirection: "column",
+        alignItems: "center",
+        justifyContent: "center",
+        gap: 16,
+        backgroundColor: COLORS.bg,
+        fontFamily: "Source Serif 4 Display",
+        color: COLORS.fg,
+      },
+      children: [
+        {
+          type: "img",
+          key: "yantra",
+          props: {
+            src: yantraDataUrl,
+            width: 280,
+            height: 280,
+            style: { display: "flex" },
+          },
+        },
+        {
+          type: "div",
+          key: "wm",
+          props: {
+            style: {
+              display: "flex",
+              fontFamily: "Source Serif 4 Display",
+              fontStyle: "italic",
+              fontWeight: 600,
+              fontSize: 280,
+              lineHeight: 1,
+              letterSpacing: -4,
+              color: COLORS.fg,
+            },
+            children: "Alchemy",
+          },
+        },
+      ],
+    },
+  };
+}
diff --git a/.repos/alchemy-effect/website/src/brand/Yantra.astro b/.repos/alchemy-effect/website/src/brand/Yantra.astro
new file mode 100644
index 00000000000..39043b20147
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/brand/Yantra.astro
@@ -0,0 +1,39 @@
+---
+import { yantraSvg } from "./yantra";
+
+interface Props {
+  size?: number;
+  stroke?: string;
+  dot?: string;
+  bg?: string;
+  strokeWidth?: number;
+  /** Inherit color from surrounding text (default true for inline use). */
+  useCurrentColor?: boolean;
+  class?: string;
+}
+
+const {
+  size = 42,
+  stroke,
+  dot,
+  bg,
+  strokeWidth,
+  useCurrentColor = true,
+  class: className,
+} = Astro.props;
+
+// Theme-aware bindu: green in light, terracotta in dark. Defined per
+// theme in tokens.css; falls back to deep moss outside the website.
+const resolvedDot = dot ?? "var(--alc-yantra-dot, #3f5a2a)";
+
+const svg = yantraSvg({
+  size,
+  stroke,
+  dot: resolvedDot,
+  bg,
+  strokeWidth,
+  useCurrentColor,
+});
+---
+
+<span class={className} aria-hidden="true" set:html={svg} />
diff --git a/.repos/alchemy-effect/website/src/brand/yantra.ts b/.repos/alchemy-effect/website/src/brand/yantra.ts
new file mode 100644
index 00000000000..aca821fe655
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/brand/yantra.ts
@@ -0,0 +1,91 @@
+/**
+ * Single source of truth for Alchemy's brand mark — a Sri-Yantra-style
+ * downward water triangle inscribed in a circle, with the centroid dot.
+ *
+ * Geometry (viewBox 24×24):
+ *   - circle: cx=12, cy=12, r=9.5
+ *   - apex (down) at (12, 12 + r=21.5)
+ *   - top-left  at (12 - r·cos30°, 12 - r·sin30°) ≈ (3.77, 7.25)
+ *   - top-right at (12 + r·cos30°, 12 - r·sin30°) ≈ (20.23, 7.25)
+ *   - centroid coincides with the circle center → dot at (12, 12)
+ *
+ * Both the runtime Astro component and the build-time asset generators
+ * (favicon, OG images) consume this module so the geometry is defined once.
+ */
+
+export const YANTRA_VIEWBOX = "0 0 24 24" as const;
+
+/**
+ * Path for the inscribed equilateral triangle (apex down). Vertices live
+ * exactly on the circle (cx=12, cy=12, r=9.5):
+ *
+ *   apex    : (12,                  12 + r)             = (12,        21.5)
+ *   top-left: (12 - r·cos30°, 12 - r·sin30°)            = (3.7728..., 7.25)
+ *   top-right (12 + r·cos30°, 12 - r·sin30°)            = (20.2272..., 7.25)
+ *
+ * Coordinates are kept at 4 decimals so that at any rasterized size the
+ * vertex never lands a sub-pixel outside the circle.
+ */
+export const YANTRA_TRIANGLE_PATH =
+  "M12 21.5 L3.7272 7.25 L20.2728 7.25 Z" as const;
+
+/** Brand color defaults — mirror tokens.css. */
+export const YANTRA_COLORS = {
+  /** Deep forest green — primary stroke. */
+  stroke: "#3f5a2a",
+  /** Centroid dot — same deep moss as the stroke. The runtime Astro
+   * component overrides this with a CSS variable so it can flip to
+   * terracotta in dark mode. */
+  dot: "#3f5a2a",
+  /** Parchment background (e.g. for OG cards). */
+  bg: "#f5efe3",
+} as const;
+
+export interface YantraOptions {
+  /** Pixel size of the rendered SVG (square). Default 24. */
+  size?: number;
+  /** Stroke color for the circle + triangle. Default deep forest. */
+  stroke?: string;
+  /** Centroid dot fill. Default deep forest. */
+  dot?: string;
+  /**
+   * Optional background color for the enclosing rect — useful for
+   * favicons and OG images. When omitted, the SVG is transparent.
+   */
+  bg?: string;
+  /**
+   * Stroke width (in viewBox units, 24×24). Default 1.
+   * Bump for small favicons (e.g. 1.4 at 16px) so the lines stay legible.
+   */
+  strokeWidth?: number;
+  /**
+   * If true, applies `currentColor` for the stroke instead of an explicit
+   * color so the icon adopts the surrounding text color. Used by the
+   * inline Astro component on the homepage.
+   */
+  useCurrentColor?: boolean;
+}
+
+/**
+ * Returns a complete, standalone SVG string for the brand mark.
+ * Safe for both raster pipelines (resvg, satori) and direct embedding.
+ */
+export function yantraSvg(opts: YantraOptions = {}): string {
+  const {
+    size = 24,
+    stroke = YANTRA_COLORS.stroke,
+    dot = YANTRA_COLORS.dot,
+    bg,
+    strokeWidth = 1,
+    useCurrentColor = false,
+  } = opts;
+
+  const strokeColor = useCurrentColor ? "currentColor" : stroke;
+  const bgRect = bg ? `<rect width="24" height="24" fill="${bg}"/>` : "";
+
+  // `stroke-linejoin="round"` is critical: at a 60° interior angle (equilateral
+  // triangle) a mitered join projects past the geometric vertex by ~1 stroke
+  // width, which makes the triangle tips visibly poke through the circle.
+  // Round joins keep the rendered tip flush with the circle's outer edge.
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}" viewBox="${YANTRA_VIEWBOX}" fill="none" stroke="${strokeColor}" stroke-width="${strokeWidth}" stroke-linecap="round" stroke-linejoin="round">${bgRect}<circle cx="12" cy="12" r="9.5"/><path d="${YANTRA_TRIANGLE_PATH}"/><circle cx="12" cy="12" r="1.1" fill="${dot}" stroke="none"/></svg>`;
+}
diff --git a/.repos/alchemy-effect/website/src/components/DAG.astro b/.repos/alchemy-effect/website/src/components/DAG.astro
new file mode 100644
index 00000000000..39156bb1da8
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/DAG.astro
@@ -0,0 +1,435 @@
+---
+/**
+ * `<DAG />` — server-rendered SVG of a small directed acyclic graph.
+ *
+ * Used in concept docs to illustrate resource dependency graphs and
+ * lifecycle flows. Auto-layouts nodes left-to-right using longest-path
+ * layering, then positions each node within its layer to minimize
+ * crossings (centered, tie-broken by input order).
+ *
+ * Styled to match the brand (parchment panel, moss accents, walnut
+ * text, JetBrains Mono labels).
+ *
+ * Usage in MDX:
+ *   import DAG from "../../../components/DAG.astro";
+ *   <DAG
+ *     nodes={[
+ *       { id: "Bucket",   label: "Bucket",   type: "Cloudflare.R2Bucket" },
+ *       { id: "Sessions", label: "Sessions", type: "Cloudflare.KVNamespace" },
+ *       { id: "Queue",    label: "Queue",    type: "AWS.SQS.Queue" },
+ *       { id: "Worker",   label: "Worker",   type: "Cloudflare.Worker" },
+ *     ]}
+ *     edges={[
+ *       { from: "Bucket",   to: "Queue" },
+ *       { from: "Bucket",   to: "Worker" },
+ *       { from: "Sessions", to: "Worker" },
+ *       { from: "Queue",    to: "Worker" },
+ *     ]}
+ *   />
+ */
+
+export interface NodeIn {
+  id: string;
+  /** Visible label inside the node (defaults to `id`). */
+  label?: string;
+  /** Smaller subtitle below the label (e.g. resource type). */
+  type?: string;
+  /** Optional layer override (0-indexed left-to-right). Otherwise computed. */
+  layer?: number;
+  /** Visual tone for the node. Defaults to "default". */
+  tone?: "default" | "accent" | "warn" | "danger";
+}
+
+export interface EdgeIn {
+  from: string;
+  to: string;
+  /** Optional small label drawn near the edge midpoint. */
+  label?: string;
+  /** Render as a dashed line (e.g. for "later" / "deferred" edges). */
+  dashed?: boolean;
+}
+
+interface Props {
+  nodes: NodeIn[];
+  edges: EdgeIn[];
+  /** Layout direction. Defaults to "LR" (left-to-right). */
+  direction?: "LR" | "TB";
+  /** Optional caption rendered below the graph. */
+  caption?: string;
+}
+
+const { nodes, edges, direction = "LR", caption } = Astro.props as Props;
+
+// ---------- Layout ----------
+
+const NODE_W = 140;
+const NODE_H = 56;
+const NODE_H_TYPED = 64; // slightly taller when subtitle present
+const COL_GAP = 80;
+const ROW_GAP = 28;
+const PAD = 24;
+
+const idIndex = new Map(nodes.map((n, i) => [n.id, i]));
+
+// Longest-path layering: layer(v) = 1 + max(layer(u)) over predecessors.
+const incoming = new Map<string, string[]>();
+const outgoing = new Map<string, string[]>();
+for (const n of nodes) {
+  incoming.set(n.id, []);
+  outgoing.set(n.id, []);
+}
+for (const e of edges) {
+  outgoing.get(e.from)?.push(e.to);
+  incoming.get(e.to)?.push(e.from);
+}
+
+// Longest-path layering, cycle-safe: any predecessor edge that would
+// re-enter a node currently on the recursion stack is treated as a
+// back-edge and ignored for the purposes of layer assignment. This
+// keeps cyclic graphs (A binds B, B binds A) layoutable side-by-side.
+const layerOf = new Map<string, number>();
+const visiting = new Set<string>();
+const visit = (id: string): number => {
+  const cached = layerOf.get(id);
+  if (cached !== undefined) return cached;
+  const override = nodes[idIndex.get(id)!]?.layer;
+  if (override !== undefined) {
+    layerOf.set(id, override);
+    return override;
+  }
+  if (visiting.has(id)) {
+    // Back-edge: caller will Math.max with our placeholder; returning
+    // -1 means "don't push my dependent down a layer for this edge".
+    return -1;
+  }
+  visiting.add(id);
+  const preds = incoming.get(id) ?? [];
+  const predLayers = preds.map(visit).filter((l) => l >= 0);
+  const l = predLayers.length === 0 ? 0 : Math.max(...predLayers) + 1;
+  visiting.delete(id);
+  layerOf.set(id, l);
+  return l;
+};
+nodes.forEach((n) => visit(n.id));
+
+const layers: string[][] = [];
+for (const n of nodes) {
+  const l = layerOf.get(n.id)!;
+  if (!layers[l]) layers[l] = [];
+  layers[l].push(n.id);
+}
+
+// Heights — bump rows that have a subtitle.
+const heightOf = (id: string): number =>
+  nodes[idIndex.get(id)!]?.type ? NODE_H_TYPED : NODE_H;
+
+// Position nodes within each layer; center on the tallest layer.
+const colMaxHeight = layers.map((col) =>
+  col.reduce((acc, id) => acc + heightOf(id) + ROW_GAP, -ROW_GAP),
+);
+const tallest = Math.max(...colMaxHeight);
+
+const positions = new Map<string, { x: number; y: number; h: number }>();
+
+if (direction === "LR") {
+  layers.forEach((col, ci) => {
+    const colH = colMaxHeight[ci]!;
+    let y = PAD + (tallest - colH) / 2;
+    for (const id of col) {
+      const h = heightOf(id);
+      positions.set(id, {
+        x: PAD + ci * (NODE_W + COL_GAP),
+        y,
+        h,
+      });
+      y += h + ROW_GAP;
+    }
+  });
+} else {
+  // TB — swap roles: each "layer" becomes a row.
+  layers.forEach((row, ri) => {
+    const rowW = row.length * (NODE_W + COL_GAP) - COL_GAP;
+    const totalW = Math.max(
+      ...layers.map((r) => r.length * (NODE_W + COL_GAP) - COL_GAP),
+    );
+    let x = PAD + (totalW - rowW) / 2;
+    for (const id of row) {
+      const h = heightOf(id);
+      positions.set(id, {
+        x,
+        y: PAD + ri * (NODE_H_TYPED + 60),
+        h,
+      });
+      x += NODE_W + COL_GAP;
+    }
+  });
+}
+
+const hasBackEdge = edges.some(
+  (e) => (layerOf.get(e.to) ?? 0) <= (layerOf.get(e.from) ?? 0),
+);
+const BACK_EDGE_GUTTER = 56;
+
+const W =
+  direction === "LR"
+    ? PAD * 2 +
+      layers.length * NODE_W +
+      (layers.length - 1) * COL_GAP +
+      (hasBackEdge ? BACK_EDGE_GUTTER : 0)
+    : PAD * 2 +
+      Math.max(...layers.map((r) => r.length * (NODE_W + COL_GAP) - COL_GAP));
+const H =
+  direction === "LR"
+    ? PAD * 2 + tallest + (hasBackEdge ? BACK_EDGE_GUTTER : 0)
+    : PAD * 2 +
+      layers.length * (NODE_H_TYPED + 60) -
+      60 +
+      (hasBackEdge ? BACK_EDGE_GUTTER : 0);
+
+// ---------- Edge geometry ----------
+
+interface Edge {
+  d: string;
+  midX: number;
+  midY: number;
+  label?: string;
+  dashed?: boolean;
+}
+
+const TIP = 6;
+
+const buildEdges = (): Edge[] =>
+  edges.map((e) => {
+    const a = positions.get(e.from)!;
+    const b = positions.get(e.to)!;
+    const aLayer = layerOf.get(e.from)!;
+    const bLayer = layerOf.get(e.to)!;
+    const isBack =
+      direction === "LR" ? bLayer <= aLayer : bLayer <= aLayer;
+
+    if (direction === "LR") {
+      if (!isBack) {
+        // Forward edge — straight cubic from source.right to target.left.
+        const x1 = a.x + NODE_W;
+        const y1 = a.y + a.h / 2;
+        const x2 = b.x - TIP;
+        const y2 = b.y + b.h / 2;
+        const cx = x1 + (x2 - x1) * 0.5;
+        const d = `M ${x1} ${y1} C ${cx} ${y1}, ${cx} ${y2}, ${x2} ${y2}`;
+        return {
+          d,
+          midX: (x1 + x2) / 2,
+          midY: (y1 + y2) / 2,
+          label: e.label,
+          dashed: e.dashed,
+        };
+      }
+      // Back-edge — arc beneath both nodes from source.bottom to target.bottom
+      // so arrow remains visibly between/under the nodes (not behind them).
+      const x1 = a.x + NODE_W * 0.5;
+      const y1 = a.y + a.h;
+      const x2 = b.x + NODE_W * 0.5;
+      const y2 = b.y + b.h + TIP;
+      const dropMax = 36;
+      const cy = Math.max(y1, y2) + dropMax;
+      const d = `M ${x1} ${y1} C ${x1} ${cy}, ${x2} ${cy}, ${x2} ${y2}`;
+      return {
+        d,
+        midX: (x1 + x2) / 2,
+        midY: cy,
+        label: e.label,
+        dashed: e.dashed,
+      };
+    }
+
+    // TB direction.
+    if (!isBack) {
+      const x1 = a.x + NODE_W / 2;
+      const y1 = a.y + a.h;
+      const x2 = b.x + NODE_W / 2;
+      const y2 = b.y - TIP;
+      const cy = y1 + (y2 - y1) * 0.5;
+      const d = `M ${x1} ${y1} C ${x1} ${cy}, ${x2} ${cy}, ${x2} ${y2}`;
+      return {
+        d,
+        midX: (x1 + x2) / 2,
+        midY: (y1 + y2) / 2,
+        label: e.label,
+        dashed: e.dashed,
+      };
+    }
+    // TB back-edge — arc to the right.
+    const x1 = a.x + NODE_W;
+    const y1 = a.y + a.h / 2;
+    const x2 = b.x + NODE_W + TIP;
+    const y2 = b.y + b.h / 2;
+    const dx = 36;
+    const cx = Math.max(x1, x2) + dx;
+    const d = `M ${x1} ${y1} C ${cx} ${y1}, ${cx} ${y2}, ${x2} ${y2}`;
+    return {
+      d,
+      midX: cx,
+      midY: (y1 + y2) / 2,
+      label: e.label,
+      dashed: e.dashed,
+    };
+  });
+
+const edgeShapes = buildEdges();
+---
+
+<figure class="alc-dag not-content">
+  <svg
+    class="alc-dag__svg"
+    viewBox={`0 0 ${W} ${H}`}
+    role="img"
+    aria-label={caption ?? "Dependency graph"}
+  >
+    <defs>
+      <marker
+        id="alc-dag-arrow"
+        viewBox="0 0 10 10"
+        refX="8"
+        refY="5"
+        markerWidth="6"
+        markerHeight="6"
+        orient="auto-start-reverse"
+      >
+        <path d="M 0 0 L 10 5 L 0 10 z" fill="var(--alc-accent)" />
+      </marker>
+    </defs>
+
+    {/* Edges first so they sit beneath nodes. */}
+    {edgeShapes.map((e) => (
+      <g class="alc-dag__edge">
+        <path
+          d={e.d}
+          fill="none"
+          stroke="var(--alc-accent-60)"
+          stroke-width="1.5"
+          stroke-dasharray={e.dashed ? "4 4" : undefined}
+          marker-end="url(#alc-dag-arrow)"
+        />
+        {e.label && (
+          <text
+            x={e.midX}
+            y={e.midY - 6}
+            class="alc-dag__edge-label"
+            text-anchor="middle"
+          >
+            {e.label}
+          </text>
+        )}
+      </g>
+    ))}
+
+    {/* Nodes. */}
+    {nodes.map((n) => {
+      const p = positions.get(n.id)!;
+      const tone = n.tone ?? "default";
+      return (
+        <g
+          class={`alc-dag__node alc-dag__node--${tone}`}
+          transform={`translate(${p.x}, ${p.y})`}
+        >
+          <rect
+            width={NODE_W}
+            height={p.h}
+            rx="8"
+            ry="8"
+            class="alc-dag__node-bg"
+          />
+          <text
+            x={NODE_W / 2}
+            y={n.type ? p.h / 2 - 4 : p.h / 2 + 1}
+            class="alc-dag__node-label"
+            text-anchor="middle"
+            dominant-baseline="middle"
+          >
+            {n.label ?? n.id}
+          </text>
+          {n.type && (
+            <text
+              x={NODE_W / 2}
+              y={p.h / 2 + 14}
+              class="alc-dag__node-type"
+              text-anchor="middle"
+              dominant-baseline="middle"
+            >
+              {n.type}
+            </text>
+          )}
+        </g>
+      );
+    })}
+  </svg>
+
+  {caption && <figcaption class="alc-dag__caption">{caption}</figcaption>}
+</figure>
+
+<style>
+  .alc-dag {
+    margin: 1.5rem 0;
+    background: var(--alc-bg-elev-1);
+    border: 1px solid var(--alc-hairline-2);
+    border-radius: var(--alc-radius);
+    padding: 0.75rem;
+    overflow-x: auto;
+  }
+
+  .alc-dag__svg {
+    display: block;
+    width: 100%;
+    height: auto;
+    max-width: 100%;
+  }
+
+  .alc-dag__node-bg {
+    fill: var(--alc-bg-elev-2);
+    stroke: var(--alc-accent-40);
+    stroke-width: 1.5;
+    transition: stroke 200ms ease, fill 200ms ease;
+  }
+
+  .alc-dag__node--accent .alc-dag__node-bg {
+    stroke: var(--alc-accent);
+    fill: color-mix(in srgb, var(--alc-accent-soft) 60%, var(--alc-bg-elev-2));
+  }
+
+  .alc-dag__node--warn .alc-dag__node-bg {
+    stroke: var(--alc-warn);
+    fill: color-mix(in srgb, var(--alc-warn) 12%, var(--alc-bg-elev-2));
+  }
+
+  .alc-dag__node--danger .alc-dag__node-bg {
+    stroke: var(--alc-danger);
+    fill: color-mix(in srgb, var(--alc-danger) 10%, var(--alc-bg-elev-2));
+  }
+
+  .alc-dag__node-label {
+    font-family: var(--alc-font-mono);
+    font-size: 13px;
+    font-weight: 600;
+    fill: var(--alc-fg-1);
+  }
+
+  .alc-dag__node-type {
+    font-family: var(--alc-font-mono);
+    font-size: 10.5px;
+    fill: var(--alc-fg-3);
+  }
+
+  .alc-dag__edge-label {
+    font-family: var(--alc-font-mono);
+    font-size: 10.5px;
+    fill: var(--alc-fg-3);
+  }
+
+  .alc-dag__caption {
+    margin-top: 0.5rem;
+    font-family: var(--alc-font-sans);
+    font-size: 13px;
+    color: var(--alc-fg-3);
+    text-align: center;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/Terminal.astro b/.repos/alchemy-effect/website/src/components/Terminal.astro
new file mode 100644
index 00000000000..fde3b7ec6d8
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/Terminal.astro
@@ -0,0 +1,90 @@
+---
+/**
+ * Renders styled terminal output matching Alchemy CLI colors.
+ *
+ * Pass content as a `content` prop (string) to avoid MDX processing.
+ * Use simple markup tags for styling:
+ *   [g]...[/g]  green    [r]...[/r]  red
+ *   [y]...[/y]  yellow   [c]...[/c]  cyan
+ *   [b]...[/b]  bold     [d]...[/d]  dim
+ *   [u]...[/u]  underline
+ */
+
+interface Props {
+  title?: string;
+  content: string;
+}
+
+const { title, content } = Astro.props;
+
+const html = content
+  .replace(/^\n/, '')
+  .replace(/\[g\]([\s\S]*?)\[\/g\]/g, '<span class="t-g">$1</span>')
+  .replace(/\[r\]([\s\S]*?)\[\/r\]/g, '<span class="t-r">$1</span>')
+  .replace(/\[y\]([\s\S]*?)\[\/y\]/g, '<span class="t-y">$1</span>')
+  .replace(/\[c\]([\s\S]*?)\[\/c\]/g, '<span class="t-c">$1</span>')
+  .replace(/\[b\]([\s\S]*?)\[\/b\]/g, '<span class="t-b">$1</span>')
+  .replace(/\[d\]([\s\S]*?)\[\/d\]/g, '<span class="t-d">$1</span>')
+  .replace(/\[u\]([\s\S]*?)\[\/u\]/g, '<span class="t-u">$1</span>')
+  .replace(/\[s2\]/g, '  ')
+  .replace(/\[s4\]/g, '    ');
+---
+
+<div class="terminal not-content">
+  <div class="terminal-header">
+    <span class="terminal-dot" style="background:#ff5f57"></span>
+    <span class="terminal-dot" style="background:#febc2e"></span>
+    <span class="terminal-dot" style="background:#28c840"></span>
+    {title && <span class="terminal-title">{title}</span>}
+  </div>
+  <pre class="terminal-body" set:html={html} />
+</div>
+
+<style>
+  .terminal {
+    background: var(--alc-bg-code);
+    border: 1px solid var(--alc-walnut-700);
+    border-radius: var(--alc-radius);
+    overflow: hidden;
+    margin: 1rem 0;
+    font-family: var(--alc-font-mono, 'JetBrains Mono', monospace);
+    font-size: 0.85rem;
+    line-height: 1.6;
+    box-shadow: var(--alc-shadow);
+  }
+  .terminal-header {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    padding: 10px 14px;
+    background: var(--alc-walnut-950);
+    border-bottom: 1px solid var(--alc-walnut-700);
+  }
+  .terminal-dot {
+    width: 12px;
+    height: 12px;
+    border-radius: 50%;
+  }
+  .terminal-title {
+    margin-left: 8px;
+    color: var(--alc-walnut-400);
+    font-size: 0.8rem;
+    font-family: var(--alc-font-mono);
+  }
+  .terminal-body {
+    padding: 16px 20px;
+    margin: 0;
+    color: var(--alc-fg-invert);
+    overflow-x: auto;
+    white-space: pre;
+    background: transparent;
+    border: none;
+  }
+  .terminal-body :global(.t-g) { color: var(--alc-accent-bright); }
+  .terminal-body :global(.t-r) { color: #e07a5f; }
+  .terminal-body :global(.t-y) { color: var(--alc-warn); }
+  .terminal-body :global(.t-c) { color: var(--alc-code-type); }
+  .terminal-body :global(.t-b) { font-weight: 700; color: var(--alc-fg-invert); }
+  .terminal-body :global(.t-d) { color: var(--alc-walnut-400); }
+  .terminal-body :global(.t-u) { text-decoration: underline; }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/ThemeProvider.astro b/.repos/alchemy-effect/website/src/components/ThemeProvider.astro
new file mode 100644
index 00000000000..53012eaf3c7
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/ThemeProvider.astro
@@ -0,0 +1,87 @@
+---
+/**
+ * Pre-paint theme initializer + browser-chrome metadata. Mirrors
+ * Starlight's default ThemeProvider contract so its built-in
+ * `<ThemeSelect>` (and our marketing nav toggle) keep working.
+ *
+ * Reads `localStorage["starlight-theme"]` first, falls back to
+ * `prefers-color-scheme`, and writes `data-theme` on <html> before any
+ * paint to avoid a flash. Imported by both the Starlight head override
+ * and the marketing layout so navigating between docs and marketing
+ * pages doesn't drop the user's theme.
+ *
+ * Also emits the `color-scheme` and `theme-color` meta tags so iOS /
+ * Android paint the URL bar / status bar / bottom nav with the page
+ * background instead of falling back to the OS-default white in dark
+ * mode.
+ *
+ * Exposes `window.StarlightThemeProvider.updatePickers(theme)` so the
+ * `<starlight-theme-select>` web component can sync its UI when storage
+ * or system preference changes.
+ */
+---
+
+<meta name="color-scheme" content="light dark" />
+{/* Cream parchment for light, deep walnut for dark — matches `--alc-bg`
+    in tokens.css. The browser picks based on `prefers-color-scheme` so
+    iOS Safari's URL bar / Android's status bar tint correctly even
+    before the inline script writes `data-theme`. */}
+<meta
+  name="theme-color"
+  content="#f5efe3"
+  media="(prefers-color-scheme: light)"
+/>
+<meta
+  name="theme-color"
+  content="#14110d"
+  media="(prefers-color-scheme: dark)"
+/>
+
+<script is:inline>
+  window.StarlightThemeProvider = (() => {
+    const storageKey = "starlight-theme";
+    const read = () => {
+      try {
+        return localStorage.getItem(storageKey);
+      } catch {
+        return null;
+      }
+    };
+    const resolve = (pref) => {
+      if (pref === "light" || pref === "dark") return pref;
+      return window.matchMedia("(prefers-color-scheme: dark)").matches
+        ? "dark"
+        : "light";
+    };
+    const apply = () => {
+      document.documentElement.dataset.theme = resolve(read() || "auto");
+    };
+    apply();
+
+    // Re-resolve when the system theme changes and the user is on "auto".
+    window
+      .matchMedia("(prefers-color-scheme: dark)")
+      .addEventListener("change", () => {
+        const stored = read();
+        if (!stored || stored === "auto") apply();
+      });
+
+    return {
+      updatePickers(theme = read() || "auto") {
+        document
+          .querySelectorAll("starlight-theme-select")
+          .forEach((picker) => {
+            const select = picker.querySelector("select");
+            if (select) select.value = theme;
+            const tmpl = document.querySelector("#theme-icons");
+            const newIcon =
+              tmpl && tmpl.content.querySelector("." + theme);
+            if (newIcon) {
+              const oldIcon = picker.querySelector("svg.label-icon");
+              if (oldIcon) oldIcon.outerHTML = newIcon.outerHTML;
+            }
+          });
+      },
+    };
+  })();
+</script>
diff --git a/.repos/alchemy-effect/website/src/components/analytics/PostHog.astro b/.repos/alchemy-effect/website/src/components/analytics/PostHog.astro
new file mode 100644
index 00000000000..312943dec34
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/analytics/PostHog.astro
@@ -0,0 +1,29 @@
+---
+/**
+ * PostHog Cloud (US region) browser SDK loader, fronted by our reverse-proxy
+ * Worker at `analytics.alchemy.run` (see `stacks/otel/Ingester.ts`). Routing
+ * the SDK through a first-party domain hides the PostHog hostname from
+ * clients, defeats most ad-blocker rules, and keeps event traffic on
+ * `alchemy.run`.
+ *
+ * The project API key is a public `phc_…` value provisioned by `stacks/otel.ts`
+ * and exposed to the build via `PUBLIC_POSTHOG_KEY`. Astro auto-inlines any
+ * `PUBLIC_*` env var into `import.meta.env`. We render nothing when the key is
+ * missing or in dev so PR previews / local builds don't ship events.
+ */
+const projectKey = import.meta.env.PUBLIC_POSTHOG_KEY as string | undefined;
+const enabled = import.meta.env.PROD && Boolean(projectKey);
+---
+
+{enabled && (
+  <script is:inline define:vars={{ projectKey }}>
+    !function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host.replace(".i.posthog.com","-assets.i.posthog.com")+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture register register_once register_for_session unregister unregister_for_session getFeatureFlag getFeatureFlagPayload isFeatureEnabled reloadFeatureFlags updateEarlyAccessFeatureEnrollment getEarlyAccessFeatures on onFeatureFlags onSessionId getSurveys getActiveMatchingSurveys renderSurvey canRenderSurvey getNextSurveyStep identify setPersonProperties group resetGroups setPersonPropertiesForFlags resetPersonPropertiesForFlags setGroupPropertiesForFlags resetGroupPropertiesForFlags reset get_distinct_id getGroups get_session_id get_session_replay_url alias set_config startSessionRecording stopSessionRecording sessionRecordingStarted captureException loadToolbar get_property getSessionProperty createPersonProfile opt_in_capturing opt_out_capturing has_opted_in_capturing has_opted_out_capturing clear_opt_in_out_capturing debug getPageViewId captureTraceFeedback captureTraceMetric".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[]);
+    posthog.init(projectKey, {
+      api_host: "https://analytics.alchemy.run",
+      ui_host: "https://us.posthog.com",
+      defaults: "2025-05-24",
+      person_profiles: "identified_only",
+      capture_pageview: "history_change"
+    });
+  </script>
+)}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/AsyncTabs.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/AsyncTabs.tsx
new file mode 100644
index 00000000000..0d66e111e33
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/AsyncTabs.tsx
@@ -0,0 +1,103 @@
+import { useEffect, useRef, useState } from "react";
+import { highlightTS } from "../marketing/highlightTS";
+
+interface Panel {
+  filename: string;
+  code: string;
+  caption: string;
+}
+
+const DWELL_MS = 5000;
+
+export default function AsyncTabs({ panels }: { panels: Panel[] }) {
+  const [active, setActive] = useState(0);
+  const wrapRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+    let timer: ReturnType<typeof setTimeout> | null = null;
+
+    const schedule = () => {
+      timer = setTimeout(() => {
+        if (cancelled) return;
+        setActive((i) => (i + 1) % panels.length);
+      }, DWELL_MS);
+    };
+
+    const obs = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting) {
+            schedule();
+          } else if (timer) {
+            clearTimeout(timer);
+            timer = null;
+          }
+        }
+      },
+      { threshold: 0.3 },
+    );
+    if (wrapRef.current) obs.observe(wrapRef.current);
+
+    return () => {
+      cancelled = true;
+      if (timer) clearTimeout(timer);
+      obs.disconnect();
+    };
+  }, [active, panels.length]);
+
+  const html = panels.map((p) => highlightTS(p.code));
+
+  return (
+    <div ref={wrapRef} className="async-tabs">
+      <div className="async-tabs__chrome">
+        <div className="async-tabs__header">
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-danger)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-warn)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-accent-bright)" }}
+          />
+          <div className="async-tabs__tabs" role="tablist">
+            {panels.map((p, i) => (
+              <button
+                key={p.filename}
+                type="button"
+                role="tab"
+                aria-selected={active === i}
+                data-active={active === i}
+                className="async-tabs__tab"
+                onClick={() => setActive(i)}
+              >
+                {p.filename}
+              </button>
+            ))}
+          </div>
+        </div>
+        <div className="async-tabs__body">
+          {panels.map((p, i) => (
+            <div
+              key={p.filename}
+              className="async-tabs__panel"
+              hidden={active !== i}
+            >
+              <pre
+                className="alc-code-block__pre async-tabs__pre"
+                dangerouslySetInnerHTML={{ __html: html[i] }}
+              />
+            </div>
+          ))}
+        </div>
+      </div>
+      <div key={active} className="alc-code-block__caption" aria-live="polite">
+        {panels[active].caption}
+      </div>
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/BindingsToIAM.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/BindingsToIAM.tsx
new file mode 100644
index 00000000000..008c11ba156
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/BindingsToIAM.tsx
@@ -0,0 +1,320 @@
+import { useEffect, useRef, useState, type ReactNode } from "react";
+import { Icon } from "@iconify/react";
+
+const tok =
+  (color: string) =>
+  ({ children }: { children: ReactNode }) => (
+    <span style={{ color }}>{children}</span>
+  );
+const K = tok("var(--alc-code-keyword)");
+const S = tok("var(--alc-code-string)");
+const F = tok("var(--alc-code-fn)");
+const T = tok("var(--alc-code-type)");
+const V = tok("var(--alc-code-var)");
+const C = ({ children }: { children: ReactNode }) => (
+  <span style={{ color: "var(--alc-code-comment)", fontStyle: "italic" }}>
+    {children}
+  </span>
+);
+
+interface BindRow {
+  id: string;
+  call: ReactNode;
+  resource: {
+    label: string;
+    sub: string;
+    kind: "s3" | "ddb" | "ddb-stream" | "sqs";
+  };
+  arrow: { kind: "iam" | "stream"; label: string };
+}
+
+const ROWS: BindRow[] = [
+  {
+    id: "get",
+    call: (
+      <>
+        <K>const</K> getPhoto = <K>yield</K>* <V>S3</V>.<V>GetObject</V>.
+        <F>bind</F>(<T>Photos</T>);
+      </>
+    ),
+    resource: { label: "Photos", sub: "S3.Bucket", kind: "s3" },
+    arrow: { kind: "iam", label: "Allow s3:GetObject" },
+  },
+  {
+    id: "put",
+    call: (
+      <>
+        <K>const</K> putJob = <K>yield</K>* <V>DynamoDB</V>.<V>PutItem</V>.
+        <F>bind</F>(<T>Jobs</T>);
+      </>
+    ),
+    resource: { label: "Jobs", sub: "DynamoDB.Table", kind: "ddb" },
+    arrow: { kind: "iam", label: "Allow dynamodb:PutItem" },
+  },
+  {
+    id: "stream",
+    call: (
+      <>
+        <K>yield</K>* <V>DynamoDB</V>.<F>stream</F>(<T>Jobs</T>).<F>process</F>
+        (handler);
+      </>
+    ),
+    resource: {
+      label: "Jobs.stream",
+      sub: "EventSourceMapping",
+      kind: "ddb-stream",
+    },
+    arrow: { kind: "stream", label: "EventSource" },
+  },
+];
+
+function ResourceIcon({ kind }: { kind: BindRow["resource"]["kind"] }) {
+  const icon =
+    kind === "s3"
+      ? "logos:aws-s3"
+      : kind === "ddb"
+        ? "logos:aws-dynamodb"
+        : kind === "ddb-stream"
+          ? "logos:aws-lambda"
+          : "logos:aws-sqs";
+  return (
+    <div
+      style={{
+        width: 28,
+        height: 28,
+        borderRadius: 6,
+        overflow: "hidden",
+        display: "inline-flex",
+        alignItems: "center",
+        justifyContent: "center",
+        flexShrink: 0,
+      }}
+    >
+      <Icon icon={icon} width={28} height={28} aria-hidden />
+    </div>
+  );
+}
+
+export default function BindingsToIAM() {
+  const wrapRef = useRef<HTMLDivElement>(null);
+  const [active, setActive] = useState(-1);
+
+  useEffect(() => {
+    const reduced = window.matchMedia(
+      "(prefers-reduced-motion: reduce)",
+    ).matches;
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    let cancelled = false;
+
+    const cycle = (i: number) => {
+      if (cancelled) return;
+      setActive(i);
+      if (reduced) {
+        setActive(ROWS.length - 1);
+        return;
+      }
+      const next = (i + 1) % (ROWS.length + 1); // +1 = "all visible" pause frame
+      const dwell = i === ROWS.length - 1 ? 2200 : 1300;
+      timer = setTimeout(() => cycle(next === ROWS.length ? -1 : next), dwell);
+    };
+
+    const obs = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting) {
+            cycle(0);
+            obs.disconnect();
+          }
+        }
+      },
+      { threshold: 0.2 },
+    );
+    if (wrapRef.current) obs.observe(wrapRef.current);
+    return () => {
+      cancelled = true;
+      if (timer) clearTimeout(timer);
+      obs.disconnect();
+    };
+  }, []);
+
+  return (
+    <div ref={wrapRef} className="bindings-iam">
+      {/* LEFT — Lambda code */}
+      <div className="alc-code-block bindings-iam__code">
+        <div className="alc-code-block__header">
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-danger)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-warn)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-accent-bright)" }}
+          />
+          <span className="alc-code-block__filename">src/JobApi.ts</span>
+        </div>
+        <pre className="alc-code-block__pre">
+          <K>export default</K> <V>AWS</V>.<V>Lambda</V>.<F>Function</F>
+          {"("}
+          {"\n  "}
+          <S>"JobApi"</S>,{"\n  "}
+          <V>Effect</V>.<F>gen</F>(<K>function</K>* () {"{"}
+          {"\n    "}
+          {ROWS.map((r, i) => (
+            <span key={r.id}>
+              <span
+                data-row={r.id}
+                className="bindings-iam__bind"
+                style={{
+                  padding: "1px 5px",
+                  margin: "0 -5px",
+                  borderRadius: 4,
+                  background:
+                    active === i ? "rgba(74, 110, 60, 0.22)" : "transparent",
+                  boxShadow:
+                    active === i ? "0 0 0 1px rgba(74, 110, 60, 0.55)" : "none",
+                  transition: "background 280ms ease, box-shadow 280ms ease",
+                }}
+              >
+                {r.call}
+              </span>
+              {"\n    "}
+            </span>
+          ))}
+          {"\n    "}
+          <K>return</K> {"{"}
+          {"\n      "}
+          <V>fetch</V>: (<V>req</V>) {"=>"} <V>Effect</V>.<F>gen</F>(
+          <K>function</K>* () {"{"}
+          {"\n        "}
+          <K>const</K> photo = <K>yield</K>* <F>getPhoto</F>({"{ "}
+          <V>key</V>: <V>req</V>.<V>key</V> {"}"});
+          {"\n        "}
+          <K>yield</K>* <F>putJob</F>({"{ "}
+          <V>id</V>: <V>req</V>.<V>id</V>, <V>photo</V> {"}"});
+          {"\n        "}
+          <K>return</K> <K>new</K> <T>Response</T>(<S>"ok"</S>);
+          {"\n      "}
+          {"}),"}
+          {"\n    "}
+          {"};"}
+          {"\n  "}
+          {"}),"}
+          {"\n"}
+          {");"}
+        </pre>
+      </div>
+
+      {/* MIDDLE — Animated arrows + labels */}
+      <div className="bindings-iam__arrows" aria-hidden>
+        <svg viewBox="0 0 200 280" preserveAspectRatio="none">
+          <defs>
+            <marker
+              id="bia-arrow-active"
+              viewBox="0 0 8 8"
+              refX="7"
+              refY="4"
+              markerWidth="6"
+              markerHeight="6"
+              orient="auto"
+            >
+              <path d="M0 0 L8 4 L0 8 Z" fill="var(--alc-accent-deep)" />
+            </marker>
+            <marker
+              id="bia-arrow-idle"
+              viewBox="0 0 8 8"
+              refX="7"
+              refY="4"
+              markerWidth="6"
+              markerHeight="6"
+              orient="auto"
+            >
+              <path d="M0 0 L8 4 L0 8 Z" fill="var(--alc-fg-3)" />
+            </marker>
+          </defs>
+          {ROWS.map((r, i) => {
+            const y = 50 + i * 90;
+            const isActive = active === i;
+            const stroke = isActive
+              ? "var(--alc-accent-deep)"
+              : "var(--alc-fg-3)";
+            const marker = isActive
+              ? "url(#bia-arrow-active)"
+              : "url(#bia-arrow-idle)";
+            return (
+              <g
+                key={r.id}
+                opacity={isActive ? 1 : 0.55}
+                style={{ transition: "opacity 320ms ease" }}
+              >
+                <path
+                  d={`M 0 ${y} L 190 ${y}`}
+                  stroke={stroke}
+                  strokeWidth={isActive ? 1.8 : 1.1}
+                  fill="none"
+                  markerEnd={marker}
+                  strokeDasharray={r.arrow.kind === "stream" ? "5 4" : "0"}
+                  style={{
+                    transition: "stroke 280ms ease, stroke-width 280ms ease",
+                  }}
+                />
+                <text
+                  x="100"
+                  y={y - 8}
+                  textAnchor="middle"
+                  fontFamily="var(--alc-font-mono)"
+                  fontSize="10"
+                  fill={isActive ? "var(--alc-accent-deep)" : "var(--alc-fg-3)"}
+                  style={{ transition: "fill 280ms ease" }}
+                >
+                  {r.arrow.label}
+                </text>
+              </g>
+            );
+          })}
+        </svg>
+      </div>
+
+      {/* RIGHT — Resources */}
+      <div className="bindings-iam__resources">
+        {ROWS.map((r, i) => {
+          const isActive = active === i;
+          return (
+            <div
+              key={r.id}
+              className="bindings-iam__resource"
+              style={{
+                borderColor: isActive
+                  ? "var(--alc-accent-deep)"
+                  : "var(--alc-hairline)",
+                boxShadow: isActive
+                  ? "0 0 0 2px rgba(74, 110, 60, 0.18)"
+                  : "none",
+                transition: "border-color 280ms ease, box-shadow 280ms ease",
+              }}
+            >
+              <ResourceIcon kind={r.resource.kind} />
+              <div style={{ flex: 1, minWidth: 0 }}>
+                <div className="bindings-iam__resource-label">
+                  {r.resource.label}
+                </div>
+                <div className="bindings-iam__resource-sub">
+                  {r.resource.sub}
+                </div>
+                <div
+                  className="bindings-iam__resource-iam"
+                  data-stream={r.arrow.kind === "stream" ? "true" : undefined}
+                >
+                  {r.arrow.kind === "stream" ? "↻" : "→"} {r.arrow.label}
+                </div>
+              </div>
+            </div>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/BrowserHotReload.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/BrowserHotReload.tsx
new file mode 100644
index 00000000000..d2e8840c5fc
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/BrowserHotReload.tsx
@@ -0,0 +1,433 @@
+import {
+  useEffect,
+  useRef,
+  useState,
+  type CSSProperties,
+  type ReactNode,
+} from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+/* ────────────────────────────────────────────────────────────
+ * Choreography
+ *
+ * A single state machine drives both the terminal log on the
+ * right and the rendered "page" inside the pseudo-browser on the
+ * left, so the two stay in lock-step (the user sees the cause
+ * and the effect).
+ * ──────────────────────────────────────────────────────────── */
+
+type Phase =
+  /** initial bring-up of the stack */
+  | "boot-photos"
+  | "boot-sessions"
+  | "boot-api"
+  | "ready-v1"
+  /** edit src/Api.ts → worker reloads, page rerenders with new copy */
+  | "edit-api"
+  | "reload-api"
+  | "request-hello"
+  | "ready-v2"
+  /** edit alchemy.run.ts → new Queue resource wired to Api */
+  | "edit-stack"
+  | "diff-queue"
+  | "wire-queue"
+  | "ready-v3";
+
+const PHASES: { phase: Phase; ms: number }[] = [
+  { phase: "boot-photos", ms: 600 },
+  { phase: "boot-sessions", ms: 500 },
+  { phase: "boot-api", ms: 700 },
+  { phase: "ready-v1", ms: 1300 },
+  { phase: "edit-api", ms: 1000 },
+  { phase: "reload-api", ms: 600 },
+  { phase: "request-hello", ms: 900 },
+  { phase: "ready-v2", ms: 1600 },
+  { phase: "edit-stack", ms: 1100 },
+  { phase: "diff-queue", ms: 700 },
+  { phase: "wire-queue", ms: 700 },
+  { phase: "ready-v3", ms: 2000 },
+];
+
+/* ────────────────────────────────────────────────────────────
+ * Terminal log driven by phase
+ * ──────────────────────────────────────────────────────────── */
+
+interface LogLine {
+  text: ReactNode;
+  key: string;
+}
+
+let _id = 0;
+const mkLine = (text: ReactNode): LogLine => ({ text, key: `${++_id}` });
+
+function bootLine(label: string, detail: string) {
+  return mkLine(
+    <>
+      <span style={{ color: "var(--alc-success)" }}>✓ </span>
+      <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+        {label}
+      </span>
+      <span style={{ color: "var(--alc-code-comment)" }}>{` (${detail})`}</span>
+      <span style={{ color: "var(--alc-success)" }}> created</span>
+    </>,
+  );
+}
+
+const READY_LINES: LogLine[] = [
+  mkLine(
+    <>
+      <span style={{ color: "var(--alc-code-comment)" }}> → </span>
+      <span style={{ color: "var(--alc-accent-bright)" }}>
+        http://localhost:1337
+      </span>
+    </>,
+  ),
+  mkLine(
+    <span style={{ color: "var(--alc-code-comment)" }}>
+      Watching for changes…
+    </span>,
+  ),
+];
+
+function editLine(file: string) {
+  return mkLine(
+    <>
+      <span style={{ color: "var(--alc-warn)" }}>↻ </span>
+      <span style={{ color: "var(--alc-code-comment)" }}>{file} changed</span>
+    </>,
+  );
+}
+
+const RELOAD_LINE = mkLine(
+  <>
+    <span style={{ color: "var(--alc-success)" }}>✓ </span>
+    <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>Api</span>
+    <span style={{ color: "var(--alc-code-comment)" }}>{` reloaded in `}</span>
+    <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>38ms</span>
+  </>,
+);
+
+function requestLine() {
+  return mkLine(
+    <>
+      <span
+        style={{ color: "var(--alc-code-comment)" }}
+      >{`[${new Date().toLocaleTimeString().slice(0, 8)}] `}</span>
+      <span style={{ color: "var(--alc-fg-invert)" }}>
+        GET /object/hello.txt
+      </span>
+      <span style={{ color: "var(--alc-success)" }}> 200</span>
+    </>,
+  );
+}
+
+const DIFF_LINE = mkLine(
+  <>
+    <span style={{ color: "var(--alc-success)" }}>+ </span>
+    <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+      Queue
+    </span>
+    <span
+      style={{ color: "var(--alc-code-comment)" }}
+    >{` (Cloudflare.Queue)`}</span>
+    <span style={{ color: "var(--alc-success)" }}> created</span>
+  </>,
+);
+
+const WIRE_LINE = mkLine(
+  <>
+    <span style={{ color: "var(--alc-warn)" }}>~ </span>
+    <span style={{ color: "var(--alc-code-comment)" }}>wired </span>
+    <span style={{ color: "var(--alc-code-type)" }}>Api → Queue.bind</span>
+  </>,
+);
+
+const PROMPT_LINE = mkLine(
+  <>
+    <span style={{ color: "var(--alc-code-comment)" }}>$ </span>
+    <span>alchemy dev</span>
+  </>,
+);
+
+/* ────────────────────────────────────────────────────────────
+ * Browser preview (the "rendered site")
+ * ──────────────────────────────────────────────────────────── */
+
+type AppVersion = "v1" | "v2" | "v3";
+
+function appVersionFor(phase: Phase): AppVersion {
+  switch (phase) {
+    case "ready-v1":
+    case "edit-api":
+      return "v1";
+    case "reload-api":
+    case "request-hello":
+    case "ready-v2":
+    case "edit-stack":
+    case "diff-queue":
+      return "v2";
+    case "wire-queue":
+    case "ready-v3":
+      return "v3";
+    default:
+      return "v1";
+  }
+}
+
+function isReloading(phase: Phase) {
+  // Worker is rebuilding (or app hasn't booted yet).
+  return (
+    phase === "boot-photos" ||
+    phase === "boot-sessions" ||
+    phase === "boot-api" ||
+    phase === "reload-api" ||
+    phase === "wire-queue"
+  );
+}
+
+function isBooting(phase: Phase) {
+  return (
+    phase === "boot-photos" || phase === "boot-sessions" || phase === "boot-api"
+  );
+}
+
+function PhotoTile({ label }: { label: string }) {
+  return (
+    <div className="bhr-tile">
+      <div className="bhr-tile__img" aria-hidden />
+      <div className="bhr-tile__label">{label}</div>
+    </div>
+  );
+}
+
+function PreviewApp({ version }: { version: AppVersion }) {
+  const heading = version === "v1" ? "Photos" : "Hello, photos";
+  return (
+    <div className="bhr-app" key={version}>
+      <header className="bhr-app__header">
+        <div>
+          <div className="bhr-app__eyebrow">my-app · cloudflare workers</div>
+          <h3 className="bhr-app__title">{heading}</h3>
+        </div>
+        {version === "v3" && (
+          <button type="button" className="bhr-app__btn">
+            + Send to Queue
+          </button>
+        )}
+      </header>
+      <div className="bhr-app__grid">
+        <PhotoTile label="hello.txt" />
+        <PhotoTile label="sunset.jpg" />
+        <PhotoTile label="forest.png" />
+        <PhotoTile label="diner.heic" />
+      </div>
+      {version === "v3" && (
+        <div className="bhr-app__footer">
+          <span className="bhr-app__chip">
+            queue: <strong>uploads</strong>
+          </span>
+          <span className="bhr-app__chip">
+            bucket: <strong>Photos</strong>
+          </span>
+          <span className="bhr-app__chip">
+            kv: <strong>Sessions</strong>
+          </span>
+        </div>
+      )}
+    </div>
+  );
+}
+
+/* ────────────────────────────────────────────────────────────
+ * Browser chrome
+ * ──────────────────────────────────────────────────────────── */
+
+function BrowserChrome({
+  reloading,
+  children,
+  style,
+}: {
+  reloading: boolean;
+  children: ReactNode;
+  style?: CSSProperties;
+}) {
+  return (
+    <div className="bhr-browser" style={style}>
+      <div className="bhr-browser__header">
+        <span
+          className="alc-code-block__dot"
+          style={{ background: "var(--alc-danger)" }}
+        />
+        <span
+          className="alc-code-block__dot"
+          style={{ background: "var(--alc-warn)" }}
+        />
+        <span
+          className="alc-code-block__dot"
+          style={{ background: "var(--alc-accent-bright)" }}
+        />
+        <div className="bhr-browser__nav" aria-hidden>
+          <span className="bhr-browser__navbtn">‹</span>
+          <span className="bhr-browser__navbtn">›</span>
+          <span
+            className={
+              "bhr-browser__navbtn bhr-browser__reload" +
+              (reloading ? " is-spinning" : "")
+            }
+          >
+            ↻
+          </span>
+        </div>
+        <div className="bhr-browser__url">
+          <span className="bhr-browser__lock" aria-hidden>
+            ●
+          </span>
+          <span className="bhr-browser__urlhost">localhost</span>
+          <span className="bhr-browser__urlmuted">:1337/</span>
+          <span style={{ flex: 1 }} />
+          <span className="bhr-browser__hmr">
+            <span className="bhr-browser__hmrdot" /> HMR
+          </span>
+        </div>
+      </div>
+      <div className="bhr-browser__body">
+        {reloading && <div className="bhr-browser__progress" aria-hidden />}
+        {children}
+      </div>
+    </div>
+  );
+}
+
+/* ────────────────────────────────────────────────────────────
+ * Main component
+ * ──────────────────────────────────────────────────────────── */
+
+export default function BrowserHotReload() {
+  const [phase, setPhase] = useState<Phase>("boot-photos");
+  const [lines, setLines] = useState<LogLine[]>([PROMPT_LINE]);
+  const [busy, setBusy] = useState(false);
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const push = (...newLines: LogLine[]) =>
+      setLines((ls) => [...ls, ...newLines].slice(-14));
+
+    const reset = () => {
+      setLines([PROMPT_LINE]);
+    };
+
+    const run = async () => {
+      while (!aborted()) {
+        reset();
+        setPhase("boot-photos");
+        await sleep(300);
+
+        for (const { phase: next, ms } of PHASES) {
+          if (aborted()) return;
+          setPhase(next);
+
+          // Show the spinner during clearly "busy" steps so the
+          // browser progress bar and the terminal feel coupled.
+          const showSpinner =
+            isBooting(next) || next === "reload-api" || next === "wire-queue";
+          setBusy(showSpinner);
+          await sleep(ms);
+          setBusy(false);
+
+          switch (next) {
+            case "boot-photos":
+              push(bootLine("Photos", "Cloudflare.R2Bucket"));
+              break;
+            case "boot-sessions":
+              push(bootLine("Sessions", "Cloudflare.KVNamespace"));
+              break;
+            case "boot-api":
+              push(bootLine("Api", "Cloudflare.Worker · local → workerd"));
+              break;
+            case "ready-v1":
+            case "ready-v2":
+            case "ready-v3":
+              push(...READY_LINES.map((l) => mkLine(l.text)));
+              break;
+            case "edit-api":
+              push(editLine("src/Api.ts"));
+              break;
+            case "reload-api":
+              push(RELOAD_LINE);
+              break;
+            case "request-hello":
+              push(requestLine());
+              break;
+            case "edit-stack":
+              push(editLine("alchemy.run.ts"));
+              break;
+            case "diff-queue":
+              push(DIFF_LINE);
+              break;
+            case "wire-queue":
+              push(WIRE_LINE);
+              break;
+          }
+        }
+
+        await sleep(1800);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const spinner = useSpinner(busy);
+  const reloading = isReloading(phase);
+  const version = appVersionFor(phase);
+  const booting = isBooting(phase);
+
+  return (
+    <div className="bhr-stage">
+      {/* Browser preview — hidden on small screens */}
+      <BrowserChrome reloading={reloading} style={{ minWidth: 0 }}>
+        {booting ? (
+          <div className="bhr-app bhr-app--boot">
+            <div className="bhr-app__skeleton" />
+            <div className="bhr-app__skeleton bhr-app__skeleton--sm" />
+            <div className="bhr-app__grid">
+              <div className="bhr-tile bhr-tile--ghost" />
+              <div className="bhr-tile bhr-tile--ghost" />
+              <div className="bhr-tile bhr-tile--ghost" />
+              <div className="bhr-tile bhr-tile--ghost" />
+            </div>
+          </div>
+        ) : (
+          <PreviewApp version={version} />
+        )}
+      </BrowserChrome>
+
+      {/* Terminal — always visible */}
+      <div className="bhr-term">
+        <TermChrome
+          title="~/my-app"
+          badge="DEV"
+          badgeColor="var(--alc-accent-bright)"
+          maxLines={15}
+        >
+          {lines.map((l) => (
+            <Line key={l.key}>{l.text}</Line>
+          ))}
+          {busy && (
+            <Line>
+              <span style={{ color: "var(--alc-code-comment)" }}>
+                {spinner}{" "}
+              </span>
+            </Line>
+          )}
+        </TermChrome>
+      </div>
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/CopyForAgent.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/CopyForAgent.tsx
new file mode 100644
index 00000000000..4f06d0f3464
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/CopyForAgent.tsx
@@ -0,0 +1,78 @@
+import { useState } from "react";
+import { AGENT_PROMPT as PROMPT } from "./agentPrompt";
+
+export default function CopyForAgent() {
+  const [copied, setCopied] = useState(false);
+
+  const onCopy = async () => {
+    try {
+      await navigator.clipboard.writeText(PROMPT);
+    } catch {
+      const ta = document.createElement("textarea");
+      ta.value = PROMPT;
+      ta.style.position = "fixed";
+      ta.style.opacity = "0";
+      document.body.appendChild(ta);
+      ta.select();
+      try {
+        document.execCommand("copy");
+      } finally {
+        document.body.removeChild(ta);
+      }
+    }
+    setCopied(true);
+    window.setTimeout(() => setCopied(false), 1600);
+  };
+
+  return (
+    <div className="alc-copy-agent">
+      <code className="alc-copy-agent__text">{PROMPT}</code>
+      <button
+        type="button"
+        onClick={onCopy}
+        className="alc-copy-agent__btn"
+        aria-label={copied ? "Copied to clipboard" : "Copy prompt to clipboard"}
+        title={copied ? "Copied" : "Copy prompt"}
+      >
+        {copied ? <CheckIcon /> : <CopyIcon />}
+      </button>
+    </div>
+  );
+}
+
+function CopyIcon() {
+  return (
+    <svg
+      aria-hidden
+      width="14"
+      height="14"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    >
+      <rect x="9" y="9" width="13" height="13" rx="2" />
+      <path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1" />
+    </svg>
+  );
+}
+
+function CheckIcon() {
+  return (
+    <svg
+      aria-hidden
+      width="14"
+      height="14"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="2.25"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    >
+      <path d="M20 6 9 17l-5-5" />
+    </svg>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/DeployTerminal.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/DeployTerminal.tsx
new file mode 100644
index 00000000000..74d5041b18b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/DeployTerminal.tsx
@@ -0,0 +1,392 @@
+import { useEffect, useRef, useState } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+const ACTION_ICON: Record<string, string> = {
+  create: "+",
+  update: "~",
+  delete: "-",
+  replace: "!",
+  noop: "•",
+};
+const ACTION_COLOR: Record<string, string> = {
+  create: "var(--alc-success)",
+  update: "var(--alc-warn)",
+  delete: "var(--alc-danger)",
+  replace: "#c4729a",
+};
+const MODE_ACCENT: Record<string, string> = {
+  idle: "var(--alc-code-comment)",
+  plan: "var(--alc-code-type)",
+  deploy: "var(--alc-accent-bright)",
+  destroy: "var(--alc-danger)",
+};
+const MODE_LABEL: Record<string, string> = {
+  plan: "PLAN",
+  deploy: "DEPLOY",
+  destroy: "DESTROY",
+};
+
+interface Resource {
+  id: string;
+  type: string;
+  bindings: string[];
+}
+const RESOURCES: Resource[] = [
+  { id: "Photos", type: "Cloudflare.R2Bucket", bindings: [] },
+  { id: "Sessions", type: "Cloudflare.KVNamespace", bindings: [] },
+  { id: "Api", type: "Cloudflare.Worker", bindings: ["Photos", "Sessions"] },
+];
+
+type RowStatus = "ready" | "creating" | "deleting" | "created" | "deleted";
+interface Row extends Resource {
+  action: string;
+  status: RowStatus;
+}
+
+export default function DeployTerminal({
+  title = "~/my-app",
+  bare,
+}: {
+  title?: string;
+  bare?: boolean;
+}) {
+  const [mode, setMode] = useState<"idle" | "plan" | "deploy" | "destroy">(
+    "idle",
+  );
+  const [cmd, setCmd] = useState("");
+  const [caret, setCaret] = useState(false);
+  const [header, setHeader] = useState<{
+    verb: string;
+    count: number;
+    action: string;
+  } | null>(null);
+  const [rows, setRows] = useState<Row[]>([]);
+  const [summary, setSummary] = useState<{
+    verb: string;
+    secs: string;
+    url?: string;
+  } | null>(null);
+  const [proceed, setProceed] = useState<null | "show" | "confirmed">(null);
+
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const typeCmd = async (text: string) => {
+      setCmd("");
+      setCaret(true);
+      for (let i = 1; i <= text.length; i++) {
+        if (aborted()) return;
+        setCmd(text.slice(0, i));
+        await sleep(36 + Math.random() * 24);
+      }
+      await sleep(180);
+      setCaret(false);
+    };
+
+    const updateRow = (id: string, patch: Partial<Row>) =>
+      setRows((rs) => rs.map((r) => (r.id === id ? { ...r, ...patch } : r)));
+
+    const setAllRowsAction = (action: string, status: RowStatus = "ready") =>
+      setRows((rs) => rs.map((r) => ({ ...r, action, status })));
+
+    const revealRows = async (action: string, perRowMs = 130) => {
+      setRows([]);
+      for (const r of RESOURCES) {
+        if (aborted()) return;
+        setRows((rs) => [
+          ...rs,
+          { ...r, action, status: "ready" as RowStatus },
+        ]);
+        await sleep(perRowMs);
+      }
+    };
+
+    const startResource = async (id: string, status: RowStatus, ms: number) => {
+      if (aborted()) return;
+      updateRow(id, { status });
+      await sleep(ms);
+      if (aborted()) return;
+      const done: RowStatus = status === "creating" ? "created" : "deleted";
+      updateRow(id, { status: done });
+    };
+
+    const run = async () => {
+      while (!aborted()) {
+        setMode("plan");
+        setHeader(null);
+        setRows([]);
+        setSummary(null);
+        setProceed(null);
+        await typeCmd("alchemy plan");
+        if (aborted()) return;
+        await sleep(250);
+        setHeader({ verb: "Plan", count: RESOURCES.length, action: "create" });
+        await sleep(150);
+        await revealRows("create");
+        await sleep(2400);
+
+        if (aborted()) return;
+        setMode("deploy");
+        setSummary(null);
+        await typeCmd("alchemy deploy");
+        if (aborted()) return;
+        setHeader({ verb: "Apply", count: RESOURCES.length, action: "create" });
+        await sleep(300);
+        setProceed("show");
+        await sleep(900);
+        if (aborted()) return;
+        setProceed("confirmed");
+        await sleep(450);
+        if (aborted()) return;
+        setProceed(null);
+        const t0 = Date.now();
+        await Promise.all([
+          startResource("Photos", "creating", 1000),
+          (async () => {
+            await sleep(220);
+            await startResource("Sessions", "creating", 900);
+          })(),
+        ]);
+        if (aborted()) return;
+        await startResource("Api", "creating", 1300);
+        if (aborted()) return;
+        const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
+        setSummary({
+          verb: "deployed",
+          secs: elapsed,
+          url: "https://api.my-app.workers.dev",
+        });
+        await sleep(2600);
+
+        if (aborted()) return;
+        setMode("destroy");
+        setSummary(null);
+        await typeCmd("alchemy destroy");
+        if (aborted()) return;
+        setHeader({ verb: "Apply", count: RESOURCES.length, action: "delete" });
+        setAllRowsAction("delete", "ready");
+        await sleep(350);
+        setProceed("show");
+        await sleep(900);
+        setProceed("confirmed");
+        await sleep(400);
+        setProceed(null);
+        const tD = Date.now();
+        await startResource("Api", "deleting", 900);
+        if (aborted()) return;
+        await Promise.all([
+          startResource("Photos", "deleting", 700),
+          (async () => {
+            await sleep(180);
+            await startResource("Sessions", "deleting", 650);
+          })(),
+        ]);
+        if (aborted()) return;
+        const elapsedD = ((Date.now() - tD) / 1000).toFixed(1);
+        setSummary({ verb: "destroyed", secs: elapsedD });
+        await sleep(2800);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const anyInFlight = rows.some(
+    (r) => r.status === "creating" || r.status === "deleting",
+  );
+  const spinner = useSpinner(anyInFlight);
+  const accent = MODE_ACCENT[mode]!;
+
+  const renderRow = (r: Row) => {
+    const actionColor = ACTION_COLOR[r.action] ?? "var(--alc-code-comment)";
+    let icon: string,
+      iconColor: string,
+      statusWord: string | null = null,
+      statusColor = "";
+    if (r.status === "ready") {
+      icon = ACTION_ICON[r.action] ?? "•";
+      iconColor = actionColor;
+    } else if (r.status === "creating" || r.status === "deleting") {
+      icon = spinner;
+      iconColor = actionColor;
+      statusWord = r.status;
+      statusColor = actionColor;
+    } else if (r.status === "created" || r.status === "deleted") {
+      icon = "✓";
+      iconColor = actionColor;
+      statusWord = r.status;
+      statusColor = actionColor;
+    } else {
+      icon = " ";
+      iconColor = "transparent";
+    }
+
+    const bindingIcon = ACTION_ICON[r.action] ?? "+";
+    const bindingCount = r.bindings.length;
+
+    return (
+      <div key={r.id}>
+        <div
+          style={{
+            minHeight: "1.55em",
+            whiteSpace: "pre",
+            transition: "opacity 200ms ease",
+          }}
+        >
+          <span
+            style={{
+              color: iconColor,
+              width: "1.2em",
+              display: "inline-block",
+              transition: "color 200ms ease",
+            }}
+          >
+            {icon}
+          </span>
+          <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+            {r.id}
+          </span>
+          <span
+            style={{ color: "var(--alc-code-comment)" }}
+          >{` (${r.type})`}</span>
+          {bindingCount > 0 && (
+            <span
+              style={{ color: "var(--alc-code-type)" }}
+            >{` (${bindingCount} bindings)`}</span>
+          )}
+          {statusWord && (
+            <span
+              style={{
+                color: statusColor,
+                marginLeft: 6,
+                transition: "color 200ms ease",
+              }}
+            >
+              {statusWord}
+            </span>
+          )}
+        </div>
+        {bindingCount > 0 &&
+          r.bindings.map((b) => (
+            <div
+              key={`${r.id}-${b}`}
+              style={{ minHeight: "1.55em", whiteSpace: "pre" }}
+            >
+              <span style={{ width: "1.2em", display: "inline-block" }}> </span>
+              <span
+                style={{
+                  color: actionColor,
+                  width: "1.2em",
+                  display: "inline-block",
+                  transition: "color 200ms ease",
+                }}
+              >
+                {bindingIcon}
+              </span>
+              <span style={{ color: "var(--alc-code-type)" }}>{b}</span>
+            </div>
+          ))}
+      </div>
+    );
+  };
+
+  return (
+    <TermChrome
+      title={title}
+      badge={mode !== "idle" ? MODE_LABEL[mode] : undefined}
+      badgeColor={accent}
+      maxLines={13}
+      bare={bare}
+    >
+      <Line>
+        <span style={{ color: accent, transition: "color 280ms ease" }}>
+          ${" "}
+        </span>
+        {cmd}
+        {caret && <span style={{ color: "var(--alc-fg-invert)" }}>▍</span>}
+      </Line>
+      {header && (
+        <>
+          <Line> </Line>
+          <Line>
+            <span
+              style={{
+                textDecoration: "underline",
+                color: accent,
+                transition: "color 280ms ease",
+                fontWeight: 600,
+              }}
+            >
+              {header.verb}
+            </span>
+            <span>: </span>
+            <span style={{ color: ACTION_COLOR[header.action] }}>
+              {header.count} to {header.action}
+            </span>
+          </Line>
+        </>
+      )}
+      {rows.length > 0 && (
+        <>
+          <Line> </Line>
+          {rows.map(renderRow)}
+        </>
+      )}
+      {proceed && (
+        <>
+          <Line> </Line>
+          <Line>Proceed?</Line>
+          <Line>
+            {proceed === "confirmed" ? (
+              <>
+                <span style={{ color: accent, transition: "color 200ms ease" }}>
+                  {"◉ Yes "}
+                </span>
+                <span style={{ color: "var(--alc-code-comment)" }}>
+                  {"○ No"}
+                </span>
+              </>
+            ) : (
+              <>
+                <span style={{ color: "var(--alc-fg-invert)" }}>
+                  {"◉ Yes "}
+                </span>
+                <span style={{ color: "var(--alc-code-comment)" }}>
+                  {"○ No"}
+                </span>
+              </>
+            )}
+          </Line>
+        </>
+      )}
+      {summary && (
+        <>
+          <Line> </Line>
+          <Line>
+            <span style={{ color: accent, transition: "color 280ms ease" }}>
+              ✓{" "}
+            </span>
+            <span>{summary.verb} in </span>
+            <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+              {summary.secs}s
+            </span>
+          </Line>
+          {summary.url && (
+            <Line>
+              <span style={{ color: "var(--alc-code-comment)" }}>{"  → "}</span>
+              <span style={{ color: accent, transition: "color 280ms ease" }}>
+                {summary.url}
+              </span>
+            </Line>
+          )}
+        </>
+      )}
+    </TermChrome>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/DevTerminal.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/DevTerminal.tsx
new file mode 100644
index 00000000000..042fadbfb8b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/DevTerminal.tsx
@@ -0,0 +1,214 @@
+import { useEffect, useRef, useState } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+interface Step {
+  kind: "boot" | "ready" | "edit" | "reload" | "diff" | "wire" | "request";
+  label?: string;
+  detail?: string;
+  ms: number;
+}
+
+const STEPS: Step[] = [
+  { kind: "boot", label: "Photos", detail: "Cloudflare.R2Bucket", ms: 600 },
+  {
+    kind: "boot",
+    label: "Sessions",
+    detail: "Cloudflare.KVNamespace",
+    ms: 500,
+  },
+  {
+    kind: "boot",
+    label: "Api",
+    detail: "Cloudflare.Worker · local → workerd",
+    ms: 700,
+  },
+  { kind: "ready", ms: 700 },
+  { kind: "edit", label: "src/Api.ts", ms: 900 },
+  { kind: "reload", detail: "38ms", ms: 600 },
+  { kind: "request", label: "GET /object/hello.txt", detail: "200", ms: 900 },
+  { kind: "edit", label: "alchemy.run.ts", ms: 1000 },
+  { kind: "diff", label: "Queue", detail: "Cloudflare.Queue", ms: 700 },
+  { kind: "wire", label: "Api → Queue.bind", ms: 700 },
+  { kind: "ready", ms: 1100 },
+];
+
+interface LogLine {
+  text: React.ReactNode;
+  key: string;
+}
+
+let _id = 0;
+
+export default function DevTerminal({
+  title = "~/my-app",
+}: {
+  title?: string;
+}) {
+  const [lines, setLines] = useState<LogLine[]>([]);
+  const [busy, setBusy] = useState(false);
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const push = (text: React.ReactNode) =>
+      setLines((ls) => [...ls, { text, key: `${++_id}` }].slice(-14));
+
+    const reset = () => setLines([]);
+
+    const run = async () => {
+      while (!aborted()) {
+        reset();
+        push(
+          <>
+            <span style={{ color: "var(--alc-code-comment)" }}>$ </span>
+            <span>alchemy dev</span>
+          </>,
+        );
+        await sleep(300);
+        if (aborted()) return;
+
+        for (const step of STEPS) {
+          if (aborted()) return;
+          if (step.kind === "boot") {
+            setBusy(true);
+            await sleep(step.ms);
+            setBusy(false);
+            push(
+              <>
+                <span style={{ color: "var(--alc-success)" }}>✓ </span>
+                <span
+                  style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                >
+                  {step.label}
+                </span>
+                <span
+                  style={{ color: "var(--alc-code-comment)" }}
+                >{` (${step.detail})`}</span>
+                <span style={{ color: "var(--alc-success)" }}> created</span>
+              </>,
+            );
+          } else if (step.kind === "ready") {
+            await sleep(step.ms);
+            push(
+              <>
+                <span style={{ color: "var(--alc-code-comment)" }}> → </span>
+                <span style={{ color: "var(--alc-accent-bright)" }}>
+                  http://localhost:1337
+                </span>
+              </>,
+            );
+            push(
+              <>
+                <span style={{ color: "var(--alc-code-comment)" }}>
+                  Watching for changes…
+                </span>
+              </>,
+            );
+          } else if (step.kind === "edit") {
+            await sleep(step.ms);
+            push(
+              <>
+                <span style={{ color: "var(--alc-warn)" }}>↻ </span>
+                <span style={{ color: "var(--alc-code-comment)" }}>
+                  {step.label} changed
+                </span>
+              </>,
+            );
+          } else if (step.kind === "reload") {
+            setBusy(true);
+            await sleep(step.ms);
+            setBusy(false);
+            push(
+              <>
+                <span style={{ color: "var(--alc-success)" }}>✓ </span>
+                <span
+                  style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                >
+                  Api
+                </span>
+                <span
+                  style={{ color: "var(--alc-code-comment)" }}
+                >{` reloaded in `}</span>
+                <span
+                  style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                >
+                  {step.detail}
+                </span>
+              </>,
+            );
+          } else if (step.kind === "diff") {
+            await sleep(step.ms);
+            push(
+              <>
+                <span style={{ color: "var(--alc-success)" }}>+ </span>
+                <span
+                  style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                >
+                  {step.label}
+                </span>
+                <span
+                  style={{ color: "var(--alc-code-comment)" }}
+                >{` (${step.detail})`}</span>
+                <span style={{ color: "var(--alc-success)" }}> created</span>
+              </>,
+            );
+          } else if (step.kind === "wire") {
+            await sleep(step.ms);
+            push(
+              <>
+                <span style={{ color: "var(--alc-warn)" }}>~ </span>
+                <span style={{ color: "var(--alc-code-comment)" }}>wired </span>
+                <span style={{ color: "var(--alc-code-type)" }}>
+                  {step.label}
+                </span>
+              </>,
+            );
+          } else if (step.kind === "request") {
+            await sleep(step.ms);
+            push(
+              <>
+                <span
+                  style={{ color: "var(--alc-code-comment)" }}
+                >{`[${new Date().toLocaleTimeString().slice(0, 8)}] `}</span>
+                <span style={{ color: "var(--alc-fg-invert)" }}>
+                  {step.label}
+                </span>
+                <span
+                  style={{ color: "var(--alc-success)" }}
+                >{`  ${step.detail}`}</span>
+              </>,
+            );
+          }
+        }
+        await sleep(2400);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const spinner = useSpinner(busy);
+
+  return (
+    <TermChrome
+      title={title}
+      badge="DEV"
+      badgeColor="var(--alc-accent-bright)"
+      maxLines={15}
+    >
+      {lines.map((l) => (
+        <Line key={l.key}>{l.text}</Line>
+      ))}
+      {busy && (
+        <Line>
+          <span style={{ color: "var(--alc-code-comment)" }}>{spinner} </span>
+        </Line>
+      )}
+    </TermChrome>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/DevTestTerminal.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/DevTestTerminal.tsx
new file mode 100644
index 00000000000..76a3ae2fa2f
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/DevTestTerminal.tsx
@@ -0,0 +1,437 @@
+import { Fragment, useEffect, useRef, useState, type ReactNode } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+/* ============================================================
+   Combined Dev + Test terminal. One TermChrome, two narratives.
+   Loops:
+     DEV   — alchemy dev (boot → ready → edit → reload → request)
+     TEST  — bun test    (deploy → tests → destroy)
+   The badge + title swap when the mode flips, reinforcing
+   "same primitive, two modes" without doubling vertical space.
+   ============================================================ */
+
+type Mode = "dev" | "test";
+
+interface DevStep {
+  kind: "boot" | "ready" | "edit" | "reload" | "diff" | "wire" | "request";
+  label?: string;
+  detail?: string;
+  ms: number;
+}
+
+const DEV_STEPS: DevStep[] = [
+  { kind: "boot", label: "Photos", detail: "Cloudflare.R2Bucket", ms: 600 },
+  {
+    kind: "boot",
+    label: "Sessions",
+    detail: "Cloudflare.KVNamespace",
+    ms: 500,
+  },
+  {
+    kind: "boot",
+    label: "Api",
+    detail: "Cloudflare.Worker · local → workerd",
+    ms: 700,
+  },
+  { kind: "ready", ms: 700 },
+  { kind: "edit", label: "src/Api.ts", ms: 900 },
+  { kind: "reload", detail: "38ms", ms: 600 },
+  { kind: "request", label: "GET /object/hello.txt", detail: "200", ms: 900 },
+  { kind: "edit", label: "alchemy.run.ts", ms: 900 },
+  { kind: "diff", label: "Queue", detail: "Cloudflare.Queue", ms: 700 },
+  { kind: "wire", label: "Api → Queue.bind", ms: 700 },
+  { kind: "ready", ms: 1000 },
+];
+
+const TEST_STAGE = "pr-1729";
+
+interface BaseTestStep {
+  id: string;
+  label: string;
+  runMs: number;
+}
+interface PhaseTestStep extends BaseTestStep {
+  kind: "phase";
+  detail: string;
+  durSec: string;
+  url?: string;
+}
+interface UnitTestStep extends BaseTestStep {
+  kind: "test";
+  durMs: string;
+}
+type TestStep = PhaseTestStep | UnitTestStep;
+type RunningTest = TestStep & { status: "running" | "done" };
+
+const TEST_STEPS: TestStep[] = [
+  {
+    id: "deploy",
+    kind: "phase",
+    label: "deploy",
+    detail: "3 resources",
+    runMs: 1000,
+    durSec: "4.2",
+    url: `https://api.${TEST_STAGE}.workers.dev`,
+  },
+  {
+    id: "t1",
+    kind: "test",
+    label: "PUT + GET round-trips through R2",
+    runMs: 800,
+    durMs: "312",
+  },
+  {
+    id: "t2",
+    kind: "test",
+    label: "Room DO preserves state across requests",
+    runMs: 700,
+    durMs: "184",
+  },
+  {
+    id: "destroy",
+    kind: "phase",
+    label: "destroy",
+    detail: "3 resources",
+    runMs: 800,
+    durSec: "1.8",
+  },
+];
+
+interface LogLine {
+  text: ReactNode;
+  key: string;
+}
+
+let _id = 0;
+
+const DEV_ACCENT = "var(--alc-accent-bright)";
+const TEST_ACCENT = "var(--alc-success)";
+
+export default function DevTestTerminal() {
+  const [mode, setMode] = useState<Mode>("dev");
+
+  // Dev state
+  const [devLines, setDevLines] = useState<LogLine[]>([]);
+  const [devBusy, setDevBusy] = useState(false);
+
+  // Test state
+  const [cmd, setCmd] = useState("");
+  const [caret, setCaret] = useState(false);
+  const [testSteps, setTestSteps] = useState<RunningTest[]>([]);
+  const [summary, setSummary] = useState<{
+    tests: number;
+    secs: string;
+  } | null>(null);
+
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const pushDev = (text: ReactNode) =>
+      setDevLines((ls) => [...ls, { text, key: `${++_id}` }].slice(-13));
+    const resetDev = () => setDevLines([]);
+
+    const typeCmd = async (text: string) => {
+      setCmd("");
+      setCaret(true);
+      for (let i = 1; i <= text.length; i++) {
+        if (aborted()) return;
+        setCmd(text.slice(0, i));
+        await sleep(34 + Math.random() * 22);
+      }
+      await sleep(160);
+      setCaret(false);
+    };
+
+    const runDev = async () => {
+      resetDev();
+      pushDev(
+        <>
+          <span style={{ color: "var(--alc-code-comment)" }}>$ </span>
+          <span>alchemy dev</span>
+        </>,
+      );
+      await sleep(280);
+      for (const step of DEV_STEPS) {
+        if (aborted()) return;
+        if (step.kind === "boot") {
+          setDevBusy(true);
+          await sleep(step.ms);
+          setDevBusy(false);
+          pushDev(
+            <>
+              <span style={{ color: "var(--alc-success)" }}>✓ </span>
+              <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+                {step.label}
+              </span>
+              <span
+                style={{ color: "var(--alc-code-comment)" }}
+              >{` (${step.detail})`}</span>
+              <span style={{ color: "var(--alc-success)" }}> created</span>
+            </>,
+          );
+        } else if (step.kind === "ready") {
+          await sleep(step.ms);
+          pushDev(
+            <>
+              <span style={{ color: "var(--alc-code-comment)" }}> → </span>
+              <span style={{ color: "var(--alc-accent-bright)" }}>
+                http://localhost:1337
+              </span>
+            </>,
+          );
+          pushDev(
+            <span style={{ color: "var(--alc-code-comment)" }}>
+              Watching for changes…
+            </span>,
+          );
+        } else if (step.kind === "edit") {
+          await sleep(step.ms);
+          pushDev(
+            <>
+              <span style={{ color: "var(--alc-warn)" }}>↻ </span>
+              <span style={{ color: "var(--alc-code-comment)" }}>
+                {step.label} changed
+              </span>
+            </>,
+          );
+        } else if (step.kind === "reload") {
+          setDevBusy(true);
+          await sleep(step.ms);
+          setDevBusy(false);
+          pushDev(
+            <>
+              <span style={{ color: "var(--alc-success)" }}>✓ </span>
+              <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+                Api
+              </span>
+              <span
+                style={{ color: "var(--alc-code-comment)" }}
+              >{` reloaded in `}</span>
+              <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+                {step.detail}
+              </span>
+            </>,
+          );
+        } else if (step.kind === "diff") {
+          await sleep(step.ms);
+          pushDev(
+            <>
+              <span style={{ color: "var(--alc-success)" }}>+ </span>
+              <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+                {step.label}
+              </span>
+              <span
+                style={{ color: "var(--alc-code-comment)" }}
+              >{` (${step.detail})`}</span>
+              <span style={{ color: "var(--alc-success)" }}> created</span>
+            </>,
+          );
+        } else if (step.kind === "wire") {
+          await sleep(step.ms);
+          pushDev(
+            <>
+              <span style={{ color: "var(--alc-warn)" }}>~ </span>
+              <span style={{ color: "var(--alc-code-comment)" }}>wired </span>
+              <span style={{ color: "var(--alc-code-type)" }}>
+                {step.label}
+              </span>
+            </>,
+          );
+        } else if (step.kind === "request") {
+          await sleep(step.ms);
+          pushDev(
+            <>
+              <span
+                style={{ color: "var(--alc-code-comment)" }}
+              >{`[${new Date().toLocaleTimeString().slice(0, 8)}] `}</span>
+              <span style={{ color: "var(--alc-fg-invert)" }}>
+                {step.label}
+              </span>
+              <span
+                style={{ color: "var(--alc-success)" }}
+              >{`  ${step.detail}`}</span>
+            </>,
+          );
+        }
+      }
+    };
+
+    const runTest = async () => {
+      setTestSteps([]);
+      setSummary(null);
+      setCmd("");
+      await sleep(200);
+      await typeCmd("bun test");
+      if (aborted()) return;
+      await sleep(260);
+
+      const t0 = Date.now();
+      for (const s of TEST_STEPS) {
+        if (aborted()) return;
+        setTestSteps((arr) => [...arr, { ...s, status: "running" }]);
+        await sleep(s.runMs);
+        if (aborted()) return;
+        setTestSteps((arr) =>
+          arr.map((r) => (r.id === s.id ? { ...r, status: "done" } : r)),
+        );
+        await sleep(140);
+      }
+      if (aborted()) return;
+      const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
+      setSummary({ tests: 2, secs: elapsed });
+    };
+
+    const loop = async () => {
+      while (!aborted()) {
+        setMode("dev");
+        await runDev();
+        if (aborted()) return;
+        await sleep(1600);
+
+        setMode("test");
+        await runTest();
+        if (aborted()) return;
+        await sleep(2400);
+      }
+    };
+
+    loop();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const devSpinner = useSpinner(devBusy);
+  const anyTestRunning = testSteps.some((s) => s.status === "running");
+  const testSpinner = useSpinner(anyTestRunning);
+
+  const accent = mode === "dev" ? DEV_ACCENT : TEST_ACCENT;
+  const title = mode === "dev" ? "~/my-app" : `ci · ${TEST_STAGE}`;
+  const badge = mode === "dev" ? "DEV" : "TEST";
+
+  return (
+    <TermChrome title={title} badge={badge} badgeColor={accent} maxLines={13}>
+      {mode === "dev" ? (
+        <>
+          {devLines.map((l) => (
+            <Line key={l.key}>{l.text}</Line>
+          ))}
+          {devBusy && (
+            <Line>
+              <span style={{ color: "var(--alc-code-comment)" }}>
+                {devSpinner}{" "}
+              </span>
+            </Line>
+          )}
+        </>
+      ) : (
+        <>
+          <Line>
+            <span style={{ color: accent }}>$ </span>
+            {cmd}
+            {caret && <span style={{ color: "var(--alc-fg-invert)" }}>▍</span>}
+          </Line>
+          {testSteps.length > 0 && (
+            <>
+              <Line> </Line>
+              {testSteps.map((s, i, arr) =>
+                renderTestStep(s, i, arr, accent, testSpinner),
+              )}
+            </>
+          )}
+          {summary && (
+            <>
+              <Line> </Line>
+              <Line>
+                <span
+                  style={{
+                    background: accent,
+                    color: "var(--alc-bg-code)",
+                    fontWeight: 700,
+                    padding: "0 8px",
+                    marginRight: 8,
+                  }}
+                >
+                  {" PASS "}
+                </span>
+                <span>{summary.tests} tests · </span>
+                <span
+                  style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                >
+                  {summary.secs}s
+                </span>
+              </Line>
+            </>
+          )}
+        </>
+      )}
+    </TermChrome>
+  );
+}
+
+function renderTestStep(
+  s: RunningTest,
+  idx: number,
+  arr: RunningTest[],
+  accent: string,
+  spinner: string,
+) {
+  const isRunning = s.status === "running";
+  const icon = isRunning ? spinner : "✓";
+  const iconColor = isRunning ? "var(--alc-code-type)" : accent;
+
+  if (s.kind === "phase") {
+    return (
+      <Fragment key={s.id}>
+        <Line>
+          <span
+            style={{
+              color: iconColor,
+              width: "1.2em",
+              display: "inline-block",
+            }}
+          >
+            {icon}
+          </span>
+          <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+            {s.label}
+          </span>
+          {!isRunning ? (
+            <span style={{ color: "var(--alc-code-comment)" }}>
+              {` (${s.detail} · ${s.durSec}s)`}
+            </span>
+          ) : (
+            <span
+              style={{ color: "var(--alc-code-comment)" }}
+            >{` (${s.detail})`}</span>
+          )}
+        </Line>
+        {s.url && !isRunning && (
+          <Line>
+            <span style={{ color: "var(--alc-code-comment)" }}>{"  → "}</span>
+            <span style={{ color: "var(--alc-code-comment)" }}>{s.url}</span>
+          </Line>
+        )}
+        {!isRunning && idx < arr.length - 1 && <Line> </Line>}
+      </Fragment>
+    );
+  }
+  return (
+    <Line key={s.id}>
+      <span
+        style={{ color: iconColor, width: "1.2em", display: "inline-block" }}
+      >
+        {icon}
+      </span>
+      <span style={{ color: "var(--alc-fg-invert)" }}>{s.label}</span>
+      {!isRunning && (
+        <span
+          style={{ color: "var(--alc-code-comment)" }}
+        >{` (${s.durMs}ms)`}</span>
+      )}
+    </Line>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/EffectPilledShowcase.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/EffectPilledShowcase.tsx
new file mode 100644
index 00000000000..7c5842616a4
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/EffectPilledShowcase.tsx
@@ -0,0 +1,719 @@
+import { useEffect, useRef, useState } from "react";
+import { Icon } from "@iconify/react";
+import { highlightTS } from "../marketing/highlightTS";
+
+/**
+ * Showcase for the "Compose Effects and Layers..." (Effect-pilled) section.
+ *
+ * Single terminal-chromed card with a tab strip in the header and one
+ * focused example per tab. Each panel pairs a trimmed code snippet (left)
+ * with a stylized "generated artifact" panel (right) that visually proves
+ * what Alchemy wired up. Tabs auto-cycle while in view; tap to pin.
+ *
+ * Tabs:
+ *   - IAM bindings   — `S3.GetObject.bind(...)` → permissions + env vars
+ *   - Event sources  — `DynamoDB.stream(...).process(...)` → EventSourceMapping
+ *   - Durable Objects — `Cloudflare.DurableObjectNamespace`
+ *   - Containers     — `Cloudflare.Container`
+ *   - Workflows      — `Cloudflare.Workflow`
+ *   - Layers         — `Layer.effect(JobStorage, ...)`
+ */
+
+type Tab = "iam" | "stream" | "do" | "container" | "workflow" | "layer";
+
+const TABS: { id: Tab; label: string }[] = [
+  { id: "iam", label: "IAM bindings" },
+  { id: "stream", label: "Event sources" },
+  { id: "do", label: "Durable Objects" },
+  { id: "container", label: "Containers" },
+  { id: "workflow", label: "Workflows" },
+  { id: "layer", label: "Layers" },
+];
+
+const CYCLE_MS = 6000;
+/** Longer dwell on the Layer tab so both impls (ddb / d1) get airtime. */
+const LAYER_CYCLE_MS = 13000;
+/** How long each Layer impl is "held" before the breathing cross-fade swaps. */
+const LAYER_IMPL_SWAP_MS = 3500;
+
+const IAM_CODE = `export default AWS.Lambda.Function(
+  "JobApi",
+  Effect.gen(function* () {
+    const getPhoto = yield* S3.GetObject.bind(Photos);
+    const putJob   = yield* DynamoDB.PutItem.bind(Jobs);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const req = yield* HttpServerRequest;
+        return yield* getPhoto({ key: req.url.slice(1) });
+      }),
+    };
+  }),
+);`;
+
+const STREAM_CODE = `export default AWS.Lambda.Function(
+  "JobsConsumer",
+  Effect.gen(function* () {
+    yield* DynamoDB.stream(Jobs).process((stream) =>
+      stream.pipe(
+        Stream.map((r) => r.dynamodb.NewImage),
+        Stream.tap((job) => Effect.log(\`new job: \${job.id.S}\`)),
+        Stream.runDrain,
+      ),
+    );
+  }),
+);`;
+
+const DO_CODE = `export default class Room extends Cloudflare.DurableObjectNamespace<Room>()(
+  "Rooms",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
+      return {
+        fetch: Effect.gen(function* () {
+          const [response, socket] = yield* Cloudflare.upgrade();
+          sessions.set(crypto.randomUUID(), socket);
+          return response;
+        }),
+      };
+    });
+  }),
+) {}`;
+
+const CONTAINER_CODE = `export class Sandbox extends Cloudflare.Container<Sandbox, {
+  exec: (cmd: string) => Effect.Effect<ExecResult>;
+}>()(
+  "Sandbox",
+  Stack.useSync((stack) => ({
+    instanceType: stack.stage === "prod" ? "standard-1" : "dev",
+  })),
+) {}
+
+export const SandboxLive = Sandbox.make(
+  Effect.gen(function* () {
+    const cp = yield* ChildProcessSpawner;
+    return Sandbox.of({
+      exec: (cmd) => cp.spawn(ChildProcess.make(cmd, { shell: true })),
+    });
+  }),
+);`;
+
+const WORKFLOW_CODE = `export default class Notifier extends Cloudflare.Workflow<Notifier>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
+    return Effect.gen(function* () {
+      const { roomId, message } = (yield* Cloudflare.WorkflowEvent).payload;
+      yield* Cloudflare.task("store",     rooms.getByName(roomId).store(message));
+      yield* Cloudflare.task("process",   processMessage(message));
+      yield* Cloudflare.task("broadcast", rooms.getByName(roomId).broadcast(message));
+      yield* Cloudflare.sleep("cooldown", "2 seconds");
+      yield* Cloudflare.task("finalize",  rooms.getByName(roomId).cleanup());
+    });
+  }),
+) {}`;
+
+type LayerImpl = "ddb" | "d1";
+
+/**
+ * The Layer tab renders a structural diff between JobStorageDynamoDB and
+ * JobStorageD1. The two snippets are split into segments: "common" lines
+ * stay static; each "diff" segment overlays the ddb and d1 variants in the
+ * same grid cell so the inactive one fully hides (opacity 0) and the active
+ * one occupies that space — crossfading smoothly between them.
+ *
+ * Structurally parallel layout keeps the diff readable column-for-column.
+ */
+type LayerSegment =
+  | { kind: "common"; lines: string[] }
+  | { kind: "diff"; ddb: string[]; d1: string[] };
+
+const LAYER_SEGMENTS: LayerSegment[] = [
+  {
+    kind: "common",
+    lines: [
+      "export class JobStorage extends Context.Service<JobStorage, {",
+      "  putJob: (job: Job) => Effect.Effect<Job, PutJobError>;",
+      "  getJob: (id: string) => Effect.Effect<Job | undefined, GetJobError>;",
+      '}>()("JobStorage") {}',
+      "",
+    ],
+  },
+  {
+    kind: "diff",
+    ddb: [
+      "export const JobStorageDynamoDB = Layer.effect(JobStorage, Effect.gen(function* () {",
+      '  const table   = yield* DynamoDB.Table("JobsTable", { partitionKey: "id" });',
+      "  const putItem = yield* DynamoDB.PutItem.bind(table);",
+      "  const getItem = yield* DynamoDB.GetItem.bind(table);",
+    ],
+    d1: [
+      "export const JobStorageD1 = Layer.effect(JobStorage, Effect.gen(function* () {",
+      '  const db   = yield* Cloudflare.D1Database("JobsDB");',
+      "  const conn = yield* Cloudflare.D1Connection.bind(db);",
+      "",
+    ],
+  },
+  {
+    kind: "common",
+    lines: ["  return JobStorage.of({"],
+  },
+  {
+    kind: "diff",
+    ddb: [
+      "    putJob: (job) => putItem({ Item: { id: { S: job.id } } }),",
+      "    getJob: (id)  => getItem({ Key:  { id: { S: id     } } }),",
+    ],
+    d1: [
+      "    putJob: (job) => conn.exec(`INSERT INTO jobs (id) VALUES ('${job.id}')`),",
+      "    getJob: (id)  => conn.exec(`SELECT * FROM jobs WHERE id = '${id}'`),",
+    ],
+  },
+  {
+    kind: "common",
+    lines: ["  });", "}));"],
+  },
+];
+
+const CODE_BY_TAB: Record<Exclude<Tab, "layer">, string> = {
+  iam: IAM_CODE,
+  stream: STREAM_CODE,
+  do: DO_CODE,
+  container: CONTAINER_CODE,
+  workflow: WORKFLOW_CODE,
+};
+
+export default function EffectPilledShowcase() {
+  const [tab, setTab] = useState<Tab>("iam");
+  const [pinned, setPinned] = useState(false);
+  const [layerImpl, setLayerImpl] = useState<LayerImpl>("ddb");
+  const wrapRef = useRef<HTMLDivElement>(null);
+
+  // Tab auto-cycle. Dwell longer on the Layer tab so both impls show
+  // before moving on to the next tab.
+  useEffect(() => {
+    if (pinned) return;
+    let cancelled = false;
+    let timer: ReturnType<typeof setTimeout> | null = null;
+
+    const schedule = () => {
+      const dwell = tab === "layer" ? LAYER_CYCLE_MS : CYCLE_MS;
+      timer = setTimeout(() => {
+        if (cancelled) return;
+        setTab((t) => {
+          const idx = TABS.findIndex((x) => x.id === t);
+          return TABS[(idx + 1) % TABS.length]!.id;
+        });
+      }, dwell);
+    };
+
+    const obs = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting) {
+            schedule();
+          } else if (timer) {
+            clearTimeout(timer);
+            timer = null;
+          }
+        }
+      },
+      { threshold: 0.3 },
+    );
+    if (wrapRef.current) obs.observe(wrapRef.current);
+
+    return () => {
+      cancelled = true;
+      if (timer) clearTimeout(timer);
+      obs.disconnect();
+    };
+  }, [tab, pinned]);
+
+  // Inner oscillation for the Layer tab — swap between ddb and d1
+  // implementations on a separate timer. Resets to "ddb" whenever we
+  // leave the tab so the user always sees the Dynamo example first.
+  useEffect(() => {
+    if (tab !== "layer") {
+      setLayerImpl("ddb");
+      return;
+    }
+    let cancelled = false;
+    const timer = setInterval(() => {
+      if (cancelled) return;
+      setLayerImpl((i) => (i === "ddb" ? "d1" : "ddb"));
+    }, LAYER_IMPL_SWAP_MS);
+    return () => {
+      cancelled = true;
+      clearInterval(timer);
+    };
+  }, [tab]);
+
+  const onTab = (next: Tab) => {
+    setPinned(true);
+    setTab(next);
+  };
+
+  const codeHtml = tab === "layer" ? null : highlightTS(CODE_BY_TAB[tab]);
+  // Drives the fade-in for the whole panel on tab switch. Intentionally
+  // does NOT include layerImpl — the Layer tab uses CSS transitions to
+  // breathe between its two impls without remounting.
+  const splitKey = tab;
+
+  return (
+    <div ref={wrapRef} className="eff-showcase">
+      <div className="eff-showcase__chrome">
+        <div className="eff-showcase__header">
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-danger)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-warn)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-accent-bright)" }}
+          />
+          <div className="eff-showcase__tabs" role="tablist">
+            {TABS.map((t) => (
+              <button
+                key={t.id}
+                type="button"
+                role="tab"
+                aria-selected={tab === t.id}
+                className="eff-showcase__tab"
+                data-active={tab === t.id}
+                onClick={() => onTab(t.id)}
+              >
+                {t.label}
+              </button>
+            ))}
+          </div>
+        </div>
+
+        <div className="eff-showcase__body">
+          <div className="eff-showcase__split" key={splitKey}>
+            <div className="eff-showcase__code">
+              {tab === "layer" ? (
+                <LayerCodeDiff impl={layerImpl} />
+              ) : (
+                <pre
+                  className="eff-showcase__pre eff-showcase__fade"
+                  dangerouslySetInnerHTML={{ __html: codeHtml ?? "" }}
+                />
+              )}
+            </div>
+            <div className="eff-showcase__artifact">
+              <ArtifactPanel tab={tab} layerImpl={layerImpl} />
+            </div>
+          </div>
+        </div>
+      </div>
+      <div className="eff-showcase__hint" aria-hidden>
+        {pinned ? (
+          <span>tap a tab to switch</span>
+        ) : (
+          <span>cycling · tap to pin</span>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function ArtifactPanel({ tab, layerImpl }: { tab: Tab; layerImpl: LayerImpl }) {
+  switch (tab) {
+    case "iam":
+      return <IamPanel />;
+    case "stream":
+      return <StreamPanel />;
+    case "do":
+      return <DurableObjectPanel />;
+    case "container":
+      return <ContainerPanel />;
+    case "workflow":
+      return <WorkflowPanel />;
+    case "layer":
+      return <LayerPanel impl={layerImpl} />;
+  }
+}
+
+/* ───────────────────────── IAM bindings ───────────────────────── */
+
+function IamPanel() {
+  const PERMISSIONS = [
+    { icon: "logos:aws-s3", action: "s3:GetObject", target: "Photos/*" },
+    { icon: "logos:aws-dynamodb", action: "dynamodb:PutItem", target: "Jobs" },
+  ];
+  const ENV_VARS = [
+    { name: "PHOTOS_BUCKET", value: "arn:aws:s3:::photos-…" },
+    { name: "JOBS_TABLE", value: "arn:aws:dynamodb:…:table/Jobs-…" },
+  ];
+  return (
+    <>
+      <div className="eff-showcase__group">
+        <div className="eff-showcase__group-title">Permissions</div>
+        {PERMISSIONS.map((p, i) => (
+          <div
+            className="eff-showcase__perm"
+            key={p.action}
+            style={{ animationDelay: `${120 + i * 120}ms` }}
+          >
+            <Icon
+              icon={p.icon}
+              width={20}
+              height={20}
+              aria-hidden
+              className="eff-showcase__perm-icon"
+            />
+            <span className="eff-showcase__perm-action">{p.action}</span>
+            <span className="eff-showcase__perm-arrow" aria-hidden>
+              →
+            </span>
+            <span className="eff-showcase__perm-target">{p.target}</span>
+          </div>
+        ))}
+      </div>
+      <div className="eff-showcase__group">
+        <div className="eff-showcase__group-title">Environment</div>
+        <div className="eff-showcase__envs">
+          {ENV_VARS.map((e, i) => (
+            <div
+              className="eff-showcase__env"
+              key={e.name}
+              style={{ animationDelay: `${360 + i * 100}ms` }}
+            >
+              <span className="eff-showcase__env-name">{e.name}</span>
+              <span className="eff-showcase__env-eq" aria-hidden>
+                =
+              </span>
+              <span className="eff-showcase__env-value">{e.value}</span>
+            </div>
+          ))}
+        </div>
+      </div>
+    </>
+  );
+}
+
+/* ───────────────────────── Event sources ───────────────────────── */
+
+function StreamPanel() {
+  return (
+    <div className="eff-showcase__group">
+      <div className="eff-showcase__group-title">Wired event source</div>
+      <div className="eff-showcase__flow">
+        <FlowNode
+          icon="logos:aws-dynamodb"
+          label="Jobs"
+          sub="DynamoDB.Table"
+          delay={120}
+        />
+        <FlowEdge label="stream" delay={260} />
+        <FlowNode
+          icon="logos:aws-lambda"
+          label="EventSourceMapping"
+          sub="created by alchemy"
+          accent
+          delay={320}
+        />
+        <FlowEdge label="invoke" delay={440} />
+        <FlowNode
+          icon="mdi:lambda"
+          label="handler"
+          sub="your function"
+          delay={500}
+        />
+      </div>
+    </div>
+  );
+}
+
+/* ───────────────────────── Durable Objects ───────────────────────── */
+
+function DurableObjectPanel() {
+  const FEATURES = [
+    {
+      icon: "logos:cloudflare-icon",
+      label: "Cloudflare.DurableObjectNamespace",
+      sub: "one instance per name · single-threaded",
+    },
+    {
+      icon: "mdi:database",
+      label: "DurableObjectState",
+      sub: "per-instance SQLite, persists across restarts",
+    },
+    {
+      icon: "mdi:transit-connection-variant",
+      label: "WebSocket sessions",
+      sub: "hibernation-safe via serializeAttachment",
+    },
+  ];
+  return (
+    <div className="eff-showcase__group">
+      <div className="eff-showcase__group-title">Generated DO</div>
+      {FEATURES.map((f, i) => (
+        <FeatureRow key={f.label} {...f} delay={120 + i * 120} />
+      ))}
+    </div>
+  );
+}
+
+/* ───────────────────────── Containers ───────────────────────── */
+
+function ContainerPanel() {
+  const FEATURES = [
+    {
+      icon: "logos:docker-icon",
+      label: "Image",
+      sub: "built from Dockerfile · pushed to registry",
+    },
+    {
+      icon: "mdi:server",
+      label: "Instance",
+      sub: "dev → 256 MB · prod → standard-1",
+    },
+    {
+      icon: "mdi:console",
+      label: "exec(cmd)",
+      sub: "typed Effect · spawns via ChildProcessSpawner",
+    },
+  ];
+  return (
+    <div className="eff-showcase__group">
+      <div className="eff-showcase__group-title">Generated container</div>
+      {FEATURES.map((f, i) => (
+        <FeatureRow key={f.label} {...f} delay={120 + i * 120} />
+      ))}
+    </div>
+  );
+}
+
+/* ───────────────────────── Workflows ───────────────────────── */
+
+function WorkflowPanel() {
+  const STEPS = [
+    { label: "store", sub: "task · durable retry" },
+    { label: "process", sub: "task · pure transform" },
+    { label: "broadcast", sub: "task · DO call" },
+    { label: "cooldown", sub: "sleep · 2 seconds" },
+    { label: "finalize", sub: "task · DO call" },
+  ];
+  return (
+    <div className="eff-showcase__group">
+      <div className="eff-showcase__group-title">Workflow steps</div>
+      <div className="eff-showcase__steps">
+        {STEPS.map((s, i) => (
+          <div
+            className="eff-showcase__step"
+            key={s.label}
+            style={{ animationDelay: `${100 + i * 90}ms` }}
+          >
+            <span className="eff-showcase__step-num">{i + 1}</span>
+            <span className="eff-showcase__step-label">{s.label}</span>
+            <span className="eff-showcase__step-sub">{s.sub}</span>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+}
+
+/* ───────────────────────── Layers ───────────────────────── */
+
+function LayerPanel({ impl }: { impl: LayerImpl }) {
+  // The "Composed from" group overlays the ddb and d1 row-stacks in the
+  // same grid cell so only the active variant is visible. Same crossfade
+  // pattern as the code diff on the left.
+  return (
+    <>
+      <div className="eff-showcase__group">
+        <div className="eff-showcase__group-title">Provides</div>
+        <FeatureRow
+          icon="mdi:layers-triple"
+          label="JobStorage"
+          sub="Context.Service · putJob · getJob"
+          delay={120}
+        />
+      </div>
+      <div className="eff-showcase__group">
+        <div className="eff-showcase__group-title">Composed from</div>
+        <div className="eff-showcase__variant-stack">
+          <div
+            className="eff-showcase__variant"
+            data-active={impl === "ddb"}
+            aria-hidden={impl !== "ddb"}
+          >
+            <FeatureRow
+              icon="logos:aws-dynamodb"
+              label="DynamoDB.Table"
+              sub='"JobsTable" · partitionKey: "id"'
+              delay={240}
+            />
+            <FeatureRow
+              icon="mdi:key"
+              label="GetItem · PutItem"
+              sub="bound capabilities · IAM auto-generated"
+              delay={340}
+            />
+          </div>
+          <div
+            className="eff-showcase__variant"
+            data-active={impl === "d1"}
+            aria-hidden={impl !== "d1"}
+          >
+            <FeatureRow
+              icon="logos:cloudflare-icon"
+              label="Cloudflare.D1Database"
+              sub='"JobsDB" · serverless SQL'
+              delay={240}
+            />
+            <FeatureRow
+              icon="mdi:database-cog"
+              label="D1Connection"
+              sub="bound capability · prepare · exec · batch"
+              delay={340}
+            />
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}
+
+/**
+ * Layer-tab code panel. Common lines render statically; each diff segment is
+ * an overlay (CSS grid with both variants in the same grid cell) so only the
+ * active variant is visible while the inactive one fades to opacity 0. The
+ * slot's height is the max of both variants, so the panel stays stable as
+ * the active impl swaps.
+ */
+function LayerCodeDiff({ impl }: { impl: LayerImpl }) {
+  return (
+    <div className="eff-showcase__diff">
+      {LAYER_SEGMENTS.map((seg, i) => {
+        if (seg.kind === "common") {
+          return (
+            <div key={i} className="eff-diff__common">
+              {seg.lines.map((line, j) => (
+                <CodeLine key={j} text={line} kind="common" />
+              ))}
+            </div>
+          );
+        }
+        return (
+          <div key={i} className="eff-diff__slot">
+            <div
+              className="eff-diff__variant"
+              data-active={impl === "ddb"}
+              aria-hidden={impl !== "ddb"}
+            >
+              {seg.ddb.map((line, j) => (
+                <CodeLine key={j} text={line} kind="ddb" />
+              ))}
+            </div>
+            <div
+              className="eff-diff__variant"
+              data-active={impl === "d1"}
+              aria-hidden={impl !== "d1"}
+            >
+              {seg.d1.map((line, j) => (
+                <CodeLine key={j} text={line} kind="d1" />
+              ))}
+            </div>
+          </div>
+        );
+      })}
+    </div>
+  );
+}
+
+function CodeLine({
+  text,
+  kind,
+}: {
+  text: string;
+  kind: "common" | "ddb" | "d1";
+}) {
+  const html = highlightTS(text) || "&nbsp;";
+  return (
+    <div className={`eff-diff__line eff-diff__line--${kind}`}>
+      <span className="eff-diff__marker" aria-hidden />
+      <span
+        className="eff-diff__content"
+        dangerouslySetInnerHTML={{ __html: html }}
+      />
+    </div>
+  );
+}
+
+/* ───────────────────────── Reusable building blocks ───────────────────────── */
+
+function FeatureRow({
+  icon,
+  label,
+  sub,
+  delay = 0,
+}: {
+  icon: string;
+  label: string;
+  sub: string;
+  delay?: number;
+}) {
+  return (
+    <div
+      className="eff-showcase__feature"
+      style={{ animationDelay: `${delay}ms` }}
+    >
+      <Icon
+        icon={icon}
+        width={22}
+        height={22}
+        aria-hidden
+        className="eff-showcase__feature-icon"
+      />
+      <div className="eff-showcase__feature-text">
+        <div className="eff-showcase__feature-label">{label}</div>
+        <div className="eff-showcase__feature-sub">{sub}</div>
+      </div>
+    </div>
+  );
+}
+
+function FlowNode({
+  icon,
+  label,
+  sub,
+  accent,
+  delay = 0,
+}: {
+  icon: string;
+  label: string;
+  sub: string;
+  accent?: boolean;
+  delay?: number;
+}) {
+  return (
+    <div
+      className={`eff-showcase__node${accent ? " eff-showcase__node--accent" : ""}`}
+      style={{ animationDelay: `${delay}ms` }}
+    >
+      <Icon icon={icon} width={22} height={22} aria-hidden />
+      <div className="eff-showcase__node-label">{label}</div>
+      <div className="eff-showcase__node-sub">{sub}</div>
+    </div>
+  );
+}
+
+function FlowEdge({ label, delay = 0 }: { label: string; delay?: number }) {
+  return (
+    <div
+      className="eff-showcase__edge"
+      data-label={label}
+      style={{ animationDelay: `${delay}ms` }}
+      aria-hidden
+    />
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/HeroCta.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/HeroCta.tsx
new file mode 100644
index 00000000000..514df697517
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/HeroCta.tsx
@@ -0,0 +1,136 @@
+import { useState } from "react";
+import { AGENT_PROMPT as PROMPT } from "./agentPrompt";
+
+export default function HeroCta() {
+  return (
+    <>
+      <div className="hero-cta hero-cta--cards">
+        <a
+          className="hero-cta__card hero-cta__card--human"
+          href="/getting-started"
+        >
+          <span className="hero-cta__eyebrow">For humans</span>
+          <span className="hero-cta__title">
+            Get started <span aria-hidden>→</span>
+          </span>
+        </a>
+        <CopyCard />
+      </div>
+      <div className="hero-cta hero-cta--simple">
+        <div className="hero-cta__buttons">
+          <a className="alc-btn alc-btn--primary" href="/getting-started">
+            Get started <span aria-hidden>→</span>
+          </a>
+          <a className="alc-btn alc-btn--secondary" href="/tutorial/part-1">
+            Tutorial
+          </a>
+        </div>
+        <div className="hero-cta__line">
+          <span>
+            <span aria-hidden>🤖</span> Using a coding agent?
+          </span>
+          <InlineCopyChip />
+        </div>
+      </div>
+    </>
+  );
+}
+
+function InlineCopyChip() {
+  const [copied, setCopied] = useState(false);
+  const onCopy = () => copy(PROMPT, setCopied);
+  return (
+    <button
+      type="button"
+      className="hero-cta__chip"
+      onClick={onCopy}
+      aria-label={copied ? "Copied" : "Copy prompt"}
+    >
+      {copied ? <CheckIcon /> : <CopyIcon />}
+      <span>{copied ? "Copied" : "Copy prompt"}</span>
+    </button>
+  );
+}
+
+function CopyCard() {
+  const [copied, setCopied] = useState(false);
+  const onCopy = () => copy(PROMPT, setCopied);
+  return (
+    <button
+      type="button"
+      className="hero-cta__card hero-cta__card--agent"
+      onClick={onCopy}
+      aria-label={
+        copied ? "Copied prompt" : "Copy prompt for your coding agent"
+      }
+    >
+      <span className="hero-cta__eyebrow">
+        For coding agents
+        <span className="hero-cta__icon" aria-hidden>
+          {copied ? <CheckIcon /> : <CopyIcon />}
+        </span>
+      </span>
+      <code className="hero-cta__prompt-code">{PROMPT}</code>
+    </button>
+  );
+}
+
+function copy(text: string, setCopied: (b: boolean) => void) {
+  const finish = () => {
+    setCopied(true);
+    window.setTimeout(() => setCopied(false), 1600);
+  };
+  if (navigator.clipboard?.writeText) {
+    navigator.clipboard.writeText(text).then(finish, finish);
+    return;
+  }
+  const ta = document.createElement("textarea");
+  ta.value = text;
+  ta.style.position = "fixed";
+  ta.style.opacity = "0";
+  document.body.appendChild(ta);
+  ta.select();
+  try {
+    document.execCommand("copy");
+  } finally {
+    document.body.removeChild(ta);
+  }
+  finish();
+}
+
+function CopyIcon() {
+  return (
+    <svg
+      aria-hidden
+      width="13"
+      height="13"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    >
+      <rect x="9" y="9" width="13" height="13" rx="2" />
+      <path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1" />
+    </svg>
+  );
+}
+
+function CheckIcon() {
+  return (
+    <svg
+      aria-hidden
+      width="13"
+      height="13"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="2.25"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    >
+      <path d="M20 6 9 17l-5-5" />
+    </svg>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/OutputGraphAnim.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/OutputGraphAnim.tsx
new file mode 100644
index 00000000000..05c32e23eec
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/OutputGraphAnim.tsx
@@ -0,0 +1,257 @@
+import { useEffect, useRef, useState, type ReactNode } from "react";
+import { tint } from "../marketing/diagrams/_colors";
+
+const ACCENT = "var(--alc-accent-deep)";
+const ACCENT_TINT = tint("#B88A4A", 0.18);
+
+const tok =
+  (color: string) =>
+  ({ children }: { children: ReactNode }) => (
+    <span style={{ color }}>{children}</span>
+  );
+const K = tok("var(--alc-code-keyword)");
+const S = tok("var(--alc-code-string)");
+const F = tok("var(--alc-code-fn)");
+const V = tok("var(--alc-code-var)");
+const T = tok("var(--alc-code-type)");
+const C = ({ children }: { children: ReactNode }) => (
+  <span style={{ color: "var(--alc-code-comment)", fontStyle: "italic" }}>
+    {children}
+  </span>
+);
+
+interface Step {
+  annotation: ReactNode;
+  show: { distribution: boolean; map: boolean; interpolate: boolean };
+}
+
+const STEPS: Step[] = [
+  {
+    annotation: (
+      <>
+        A resource produces typed <strong>Output</strong> attributes — lazy
+        references that resolve after deploy.
+      </>
+    ),
+    show: { distribution: false, map: false, interpolate: false },
+  },
+  {
+    annotation: (
+      <>
+        Pass an Output as input to another resource. Alchemy draws the
+        dependency edge and deploys <strong>Photos</strong> first.
+      </>
+    ),
+    show: { distribution: true, map: false, interpolate: false },
+  },
+  {
+    annotation: (
+      <>
+        <code>Output.map</code> composes lazily — the function runs only when
+        the upstream Output resolves.
+      </>
+    ),
+    show: { distribution: true, map: true, interpolate: false },
+  },
+  {
+    annotation: (
+      <>
+        <code>Output.interpolate</code> splices Outputs into template strings —
+        same lazy graph, ergonomic syntax.
+      </>
+    ),
+    show: { distribution: true, map: true, interpolate: true },
+  },
+];
+
+const STEP_DWELL = [2400, 2800, 2800, 3200];
+
+export default function OutputGraphAnim() {
+  const wrapRef = useRef<HTMLDivElement>(null);
+  const [step, setStep] = useState(0);
+
+  useEffect(() => {
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    let cancelled = false;
+    const reduced = window.matchMedia(
+      "(prefers-reduced-motion: reduce)",
+    ).matches;
+
+    const tick = (i: number) => {
+      if (cancelled) return;
+      setStep(i);
+      if (reduced) {
+        setStep(STEPS.length - 1);
+        return;
+      }
+      timer = setTimeout(() => tick((i + 1) % STEPS.length), STEP_DWELL[i]);
+    };
+
+    const obs = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting) {
+            tick(0);
+            obs.disconnect();
+          }
+        }
+      },
+      { threshold: 0.25 },
+    );
+    if (wrapRef.current) obs.observe(wrapRef.current);
+    return () => {
+      cancelled = true;
+      if (timer) clearTimeout(timer);
+      obs.disconnect();
+    };
+  }, []);
+
+  const s = STEPS[step]!;
+
+  // Highlight wrapper for code spans active in the current step.
+  const Hl = ({
+    active,
+    children,
+  }: {
+    active: boolean;
+    children: ReactNode;
+  }) => (
+    <span
+      style={{
+        background: active ? ACCENT_TINT : "transparent",
+        boxShadow: active ? `0 0 0 1px ${tint("#B88A4A", 0.4)}` : "none",
+        borderRadius: 4,
+        padding: "1px 4px",
+        margin: "0 -4px",
+        transition: "background 320ms ease, box-shadow 320ms ease",
+      }}
+    >
+      {children}
+    </span>
+  );
+
+  return (
+    <div ref={wrapRef} className="output-anim-grid">
+      {/* LEFT — code panel with progressive highlight */}
+      <div className="alc-code-block">
+        <div className="alc-code-block__header">
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-danger)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-warn)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-accent-bright)" }}
+          />
+          <span className="alc-code-block__filename">alchemy.run.ts</span>
+        </div>
+        <pre className="alc-code-block__pre">
+          <Hl active={step === 0}>
+            <K>const</K> bucket = <K>yield</K>* <V>Cloudflare</V>.
+            <F>R2Bucket</F>(<S>"Photos"</S>);
+            {"\n"}
+            bucket.<V>bucketName</V>; <C>{"// Output<string>"}</C>
+          </Hl>
+          {"\n\n"}
+          <Hl active={step === 1}>
+            <K>const</K> dist = <K>yield</K>* <V>CloudFront</V>.
+            <F>Distribution</F>(<S>"CDN"</S>, {"{"}
+            {"\n  "}
+            <V>origin</V>: bucket.<V>bucketName</V>,{"\n"}
+            {"});"}
+          </Hl>
+          {"\n\n"}
+          <Hl active={step === 2}>
+            <K>const</K> homepage = dist.<V>domainName</V>.<F>pipe</F>({"\n  "}
+            <V>Output</V>.<F>map</F>((d) {"=>"} <S>{"`https://${d}`"}</S>),
+            {"\n"}
+            {");"}
+          </Hl>
+          {"\n\n"}
+          <Hl active={step === 3}>
+            <K>const</K> banner = <V>Output</V>.<F>interpolate</F>
+            <S>{"`served from ${dist.domainName}`"}</S>;
+          </Hl>
+        </pre>
+      </div>
+
+      {/* RIGHT — progressive diagram + annotation */}
+      <div className="output-anim-stage">
+        <div className="output-anim-graph" aria-hidden>
+          {/* Row 1 */}
+          <div className="output-anim-node output-anim-node--accent">
+            <div className="output-anim-node__label">R2Bucket</div>
+            <div className="output-anim-node__id">"Photos"</div>
+          </div>
+
+          <Edge dir="h" visible={s.show.distribution} label="bucketName" />
+
+          <div
+            className="output-anim-node output-anim-node--accent"
+            style={{
+              opacity: s.show.distribution ? 1 : 0.15,
+              transform: s.show.distribution ? "scale(1)" : "scale(0.92)",
+              transition: "opacity 380ms ease, transform 380ms ease",
+            }}
+          >
+            <div className="output-anim-node__label">Distribution</div>
+            <div className="output-anim-node__id">"CDN"</div>
+          </div>
+
+          {/* Row 2 (vertical edge under Distribution) */}
+          <div />
+          <div />
+          <Edge dir="v" visible={s.show.map} label="domainName" />
+
+          {/* Row 3 (Output.map under Distribution) */}
+          <div />
+          <div />
+          <div
+            className="output-anim-node output-anim-node--ghost"
+            style={{
+              opacity: s.show.map ? 1 : 0.15,
+              transform: s.show.map ? "scale(1)" : "scale(0.92)",
+              transition: "opacity 380ms ease, transform 380ms ease",
+            }}
+          >
+            <div className="output-anim-node__label">Output.map</div>
+            <div className="output-anim-node__id">homepage</div>
+          </div>
+        </div>
+
+        <div className="output-anim-steps" aria-hidden>
+          {STEPS.map((_, i) => (
+            <span
+              key={i}
+              className={`output-anim-steps__dot${i === step ? " is-active" : ""}`}
+            />
+          ))}
+        </div>
+
+        <div className="output-anim-annotation">{s.annotation}</div>
+      </div>
+    </div>
+  );
+}
+
+function Edge({
+  dir,
+  visible,
+  label,
+}: {
+  dir: "h" | "v";
+  visible: boolean;
+  label: string;
+}) {
+  return (
+    <div
+      className={`output-anim-edge output-anim-edge--${dir}${visible ? " is-on" : ""}`}
+    >
+      <span className="output-anim-edge__label">{label}</span>
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/PRLifecycle.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/PRLifecycle.tsx
new file mode 100644
index 00000000000..4f7fef80f72
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/PRLifecycle.tsx
@@ -0,0 +1,499 @@
+import { useEffect, useRef, useState } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+type Phase = "open" | "deploy" | "comment" | "observe" | "destroy";
+
+const PHASES: { id: Phase; label: string }[] = [
+  { id: "open", label: "PR opened" },
+  { id: "deploy", label: "Deploy" },
+  { id: "comment", label: "Comment" },
+  { id: "observe", label: "Observe" },
+  { id: "destroy", label: "Destroyed" },
+];
+
+const RESOURCES = [
+  { id: "Photos", type: "Cloudflare.R2Bucket" },
+  { id: "Sessions", type: "Cloudflare.KVNamespace" },
+  { id: "Api", type: "Cloudflare.Worker" },
+];
+
+const PR_NUMBER = 147;
+const STAGE = `pr-${PR_NUMBER}`;
+const PREVIEW_URL = `https://${STAGE}.api.example.workers.dev`;
+
+export default function PRLifecycle() {
+  const [phase, setPhase] = useState<Phase>("open");
+  const [cmd, setCmd] = useState("");
+  const [caret, setCaret] = useState(false);
+  const [rows, setRows] = useState<
+    {
+      id: string;
+      type: string;
+      status: "ready" | "creating" | "created" | "deleting" | "deleted";
+    }[]
+  >([]);
+  const [done, setDone] = useState<{ verb: string; secs: string } | null>(null);
+
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const typeCmd = async (text: string) => {
+      setCmd("");
+      setCaret(true);
+      for (let i = 1; i <= text.length; i++) {
+        if (aborted()) return;
+        setCmd(text.slice(0, i));
+        await sleep(28 + Math.random() * 22);
+      }
+      await sleep(140);
+      setCaret(false);
+    };
+
+    const updateRow = (id: string, status: (typeof rows)[number]["status"]) =>
+      setRows((rs) => rs.map((r) => (r.id === id ? { ...r, status } : r)));
+
+    const run = async () => {
+      while (!aborted()) {
+        // Frame 1: PR opened
+        setPhase("open");
+        setCmd("");
+        setCaret(false);
+        setRows([]);
+        setDone(null);
+        await sleep(2200);
+        if (aborted()) return;
+
+        // Frame 2: deploy
+        setPhase("deploy");
+        await typeCmd(`alchemy deploy --stage ${STAGE}`);
+        if (aborted()) return;
+        await sleep(220);
+        setRows(RESOURCES.map((r) => ({ ...r, status: "ready" })));
+        await sleep(260);
+        const t0 = Date.now();
+        for (const r of RESOURCES) {
+          if (aborted()) return;
+          updateRow(r.id, "creating");
+          await sleep(560);
+          if (aborted()) return;
+          updateRow(r.id, "created");
+          await sleep(120);
+        }
+        const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
+        setDone({ verb: "deployed", secs: elapsed });
+        await sleep(900);
+        if (aborted()) return;
+
+        // Frame 3: comment posted
+        setPhase("comment");
+        await sleep(2400);
+        if (aborted()) return;
+
+        // Frame 4: observe — same alchemy.run.ts also declares
+        // dashboards/alarms; show a live dashboard mock.
+        setPhase("observe");
+        await sleep(3600);
+        if (aborted()) return;
+
+        // Frame 5: merged → destroy
+        setPhase("destroy");
+        setCmd("");
+        setDone(null);
+        await sleep(700);
+        await typeCmd(`alchemy destroy --stage ${STAGE}`);
+        if (aborted()) return;
+        await sleep(160);
+        const tD = Date.now();
+        for (const r of [...RESOURCES].reverse()) {
+          if (aborted()) return;
+          updateRow(r.id, "deleting");
+          await sleep(380);
+          if (aborted()) return;
+          updateRow(r.id, "deleted");
+          await sleep(80);
+        }
+        const elapsedD = ((Date.now() - tD) / 1000).toFixed(1);
+        setDone({ verb: "destroyed", secs: elapsedD });
+        await sleep(2400);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const anyInFlight = rows.some(
+    (r) => r.status === "creating" || r.status === "deleting",
+  );
+  const spinner = useSpinner(anyInFlight);
+
+  const accent =
+    phase === "destroy"
+      ? "var(--alc-danger)"
+      : phase === "observe"
+        ? "var(--alc-success)"
+        : "var(--alc-accent-bright)";
+  const badge =
+    phase === "open"
+      ? "PR OPENED"
+      : phase === "deploy"
+        ? "DEPLOY"
+        : phase === "comment"
+          ? "PREVIEW LIVE"
+          : phase === "observe"
+            ? "OBSERVE"
+            : "DESTROY";
+
+  return (
+    <div className="pr-lc">
+      <ol className="pr-lc__timeline" aria-label="PR lifecycle">
+        {PHASES.map((p, i) => {
+          const activeIdx = PHASES.findIndex((x) => x.id === phase);
+          const state =
+            i < activeIdx ? "done" : i === activeIdx ? "active" : "todo";
+          return (
+            <li key={p.id} className={`pr-lc__step pr-lc__step--${state}`}>
+              <span className="pr-lc__step-num">{i + 1}</span>
+              <span className="pr-lc__step-label">{p.label}</span>
+            </li>
+          );
+        })}
+      </ol>
+
+      <div className="pr-lc__stage">
+        {/* LEFT: PR card */}
+        <div className="pr-lc__pr">
+          <div className="pr-lc__pr-head">
+            <span
+              className={`pr-lc__pr-pill pr-lc__pr-pill--${phase === "destroy" ? "merged" : "open"}`}
+            >
+              {phase === "destroy" ? (
+                <>
+                  <span aria-hidden>⬣</span> Merged
+                </>
+              ) : (
+                <>
+                  <span aria-hidden>◍</span> Open
+                </>
+              )}
+            </span>
+            <span className="pr-lc__pr-num">#{PR_NUMBER}</span>
+          </div>
+          <div className="pr-lc__pr-title">Add image upload to /photos</div>
+          <div className="pr-lc__pr-meta">
+            <span className="pr-lc__pr-branch">feature/photo-upload</span>
+            <span className="pr-lc__pr-sep">→</span>
+            <span className="pr-lc__pr-branch pr-lc__pr-branch--base">
+              main
+            </span>
+          </div>
+          <div className="pr-lc__pr-checks">
+            <div
+              className={`pr-lc__check ${phase === "open" ? "pr-lc__check--running" : "pr-lc__check--done"}`}
+            >
+              <span className="pr-lc__check-dot" />
+              <span>Deploy preview</span>
+              {phase === "open" ? (
+                <span className="pr-lc__check-status">queued</span>
+              ) : (
+                <span className="pr-lc__check-status">success</span>
+              )}
+            </div>
+            {(phase === "comment" ||
+              phase === "observe" ||
+              phase === "destroy") && (
+              <div className="pr-lc__check pr-lc__check--done">
+                <span className="pr-lc__check-dot" />
+                <span>alchemy-bot commented</span>
+                <span className="pr-lc__check-status">just now</span>
+              </div>
+            )}
+            {(phase === "observe" || phase === "destroy") && (
+              <div className="pr-lc__check pr-lc__check--done">
+                <span className="pr-lc__check-dot" />
+                <span>Dashboard live</span>
+                <span className="pr-lc__check-status">2 widgets · 1 alarm</span>
+              </div>
+            )}
+          </div>
+        </div>
+
+        {/* RIGHT: terminal, github comment, or dashboard, depending on phase */}
+        <div className="pr-lc__panel">
+          {phase === "observe" ? (
+            <DashboardMock />
+          ) : phase === "comment" ? (
+            <div className="gh-mock pr-lc__gh">
+              <div className="gh-mock__head">
+                <div className="gh-mock__avatar">a</div>
+                <div className="gh-mock__author">
+                  <strong>alchemy-bot</strong>
+                  <span className="gh-mock__bot-tag">bot</span>
+                  <span className="gh-mock__meta">commented just now</span>
+                </div>
+              </div>
+              <div className="gh-mock__body">
+                <h3 className="gh-mock__h3">Preview Deployed</h3>
+                <p className="gh-mock__p">
+                  <strong>URL:</strong>{" "}
+                  <a
+                    href="#"
+                    className="gh-mock__url"
+                    onClick={(e) => e.preventDefault()}
+                  >
+                    {PREVIEW_URL}
+                  </a>
+                </p>
+                <p className="gh-mock__p">
+                  Built from commit{" "}
+                  <code className="gh-mock__code">a8f3d21</code>
+                </p>
+                <hr className="gh-mock__hr" />
+                <p className="gh-mock__small">
+                  <em>This comment updates automatically with each push.</em>
+                </p>
+              </div>
+            </div>
+          ) : (
+            <TermChrome
+              title={`ci · ${STAGE}`}
+              badge={badge}
+              badgeColor={accent}
+              maxLines={10}
+            >
+              <Line>
+                <span style={{ color: accent }}>$ </span>
+                {cmd}
+                {caret && (
+                  <span style={{ color: "var(--alc-fg-invert)" }}>▍</span>
+                )}
+              </Line>
+              {phase === "open" && (
+                <>
+                  <Line> </Line>
+                  <Line>
+                    <span style={{ color: "var(--alc-code-comment)" }}>
+                      {`# pull_request opened — STAGE=${STAGE}`}
+                    </span>
+                  </Line>
+                  <Line>
+                    <span style={{ color: "var(--alc-code-comment)" }}>
+                      # workflow queued…
+                    </span>
+                  </Line>
+                </>
+              )}
+              {rows.length > 0 && (
+                <>
+                  <Line> </Line>
+                  {rows.map((r) => {
+                    const isInFlight =
+                      r.status === "creating" || r.status === "deleting";
+                    const isDone =
+                      r.status === "created" || r.status === "deleted";
+                    const icon = isInFlight
+                      ? spinner
+                      : isDone
+                        ? "✓"
+                        : phase === "destroy"
+                          ? "-"
+                          : "+";
+                    return (
+                      <Line key={r.id}>
+                        <span
+                          style={{
+                            color: accent,
+                            width: "1.2em",
+                            display: "inline-block",
+                          }}
+                        >
+                          {icon}
+                        </span>
+                        <span
+                          style={{
+                            color: "var(--alc-fg-invert)",
+                            fontWeight: 600,
+                          }}
+                        >
+                          {r.id}
+                        </span>
+                        <span style={{ color: "var(--alc-code-comment)" }}>
+                          {` (${r.type})`}
+                        </span>
+                        {isInFlight && (
+                          <span style={{ color: accent, marginLeft: 6 }}>
+                            {r.status}
+                          </span>
+                        )}
+                      </Line>
+                    );
+                  })}
+                </>
+              )}
+              {done && (
+                <>
+                  <Line> </Line>
+                  <Line>
+                    <span style={{ color: accent }}>✓ </span>
+                    <span>{done.verb} in </span>
+                    <span
+                      style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                    >
+                      {done.secs}s
+                    </span>
+                  </Line>
+                  {phase === "deploy" && (
+                    <Line>
+                      <span style={{ color: "var(--alc-code-comment)" }}>
+                        {"  → "}
+                      </span>
+                      <span style={{ color: accent }}>{PREVIEW_URL}</span>
+                    </Line>
+                  )}
+                </>
+              )}
+            </TermChrome>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* ============================================================
+   Dashboard mock — shown during the `observe` phase.
+   Three tiles: p99 latency sparkline (Axiom violet),
+   requests/sec sparkline (Datadog purple), 5xx ratio big-number
+   (CloudWatch pink). Live-feel via cheap interval ticks.
+   ============================================================ */
+
+const SPARK_W = 220;
+const SPARK_H = 44;
+const SPARK_POINTS = 24;
+
+function useSeries(seed: number, range: [number, number]): number[] {
+  const [series, setSeries] = useState<number[]>(() => {
+    const arr: number[] = [];
+    let v = (range[0] + range[1]) / 2;
+    for (let i = 0; i < SPARK_POINTS; i++) {
+      v = clamp(
+        v + (pseudo(seed + i) - 0.5) * (range[1] - range[0]) * 0.35,
+        range[0],
+        range[1],
+      );
+      arr.push(v);
+    }
+    return arr;
+  });
+  useEffect(() => {
+    let i = SPARK_POINTS;
+    const t = setInterval(() => {
+      setSeries((prev) => {
+        const last = prev[prev.length - 1] ?? (range[0] + range[1]) / 2;
+        const next = clamp(
+          last + (pseudo(seed + i++) - 0.5) * (range[1] - range[0]) * 0.35,
+          range[0],
+          range[1],
+        );
+        return [...prev.slice(1), next];
+      });
+    }, 600);
+    return () => clearInterval(t);
+  }, [seed, range[0], range[1]]);
+  return series;
+}
+
+function pseudo(n: number): number {
+  const x = Math.sin(n * 9301 + 49297) * 233280;
+  return x - Math.floor(x);
+}
+function clamp(v: number, lo: number, hi: number) {
+  return Math.max(lo, Math.min(hi, v));
+}
+
+function Sparkline({
+  data,
+  color,
+  range,
+}: {
+  data: number[];
+  color: string;
+  range: [number, number];
+}) {
+  const [lo, hi] = range;
+  const stepX = SPARK_W / (data.length - 1);
+  const yFor = (v: number) => SPARK_H - ((v - lo) / (hi - lo)) * SPARK_H;
+  const d = data
+    .map(
+      (v, i) =>
+        `${i === 0 ? "M" : "L"} ${(i * stepX).toFixed(1)} ${yFor(v).toFixed(1)}`,
+    )
+    .join(" ");
+  const fillD = `${d} L ${SPARK_W} ${SPARK_H} L 0 ${SPARK_H} Z`;
+  return (
+    <svg
+      viewBox={`0 0 ${SPARK_W} ${SPARK_H}`}
+      className="pr-lc__spark"
+      preserveAspectRatio="none"
+    >
+      <path d={fillD} fill={color} fillOpacity={0.12} />
+      <path
+        d={d}
+        fill="none"
+        stroke={color}
+        strokeWidth={1.6}
+        strokeLinejoin="round"
+        strokeLinecap="round"
+      />
+    </svg>
+  );
+}
+
+function DashboardMock() {
+  const p99 = useSeries(11, [120, 320]);
+  const rps = useSeries(29, [180, 540]);
+  const errSeries = useSeries(53, [0.0, 0.9]);
+  const p99Last = p99[p99.length - 1] ?? 0;
+  const rpsLast = rps[rps.length - 1] ?? 0;
+  const errLast = errSeries[errSeries.length - 1] ?? 0;
+  return (
+    <div className="pr-lc__dash">
+      <div className="pr-lc__dash-head">
+        <span className="pr-lc__dash-title">ApiHealth</span>
+        <span className="pr-lc__dash-meta">stage · pr-{147} · live</span>
+        <span className="pr-lc__dash-pulse" aria-hidden />
+      </div>
+      <div className="pr-lc__dash-grid">
+        <div className="pr-lc__tile" style={{ ["--c" as never]: "#9F6FFF" }}>
+          <div className="pr-lc__tile-label">p99 latency</div>
+          <div className="pr-lc__tile-value">
+            {Math.round(p99Last)}
+            <span className="pr-lc__tile-unit">ms</span>
+          </div>
+          <Sparkline data={p99} color="#9F6FFF" range={[120, 320]} />
+        </div>
+        <div className="pr-lc__tile" style={{ ["--c" as never]: "#632CA6" }}>
+          <div className="pr-lc__tile-label">requests / sec</div>
+          <div className="pr-lc__tile-value">{Math.round(rpsLast)}</div>
+          <Sparkline data={rps} color="#632CA6" range={[180, 540]} />
+        </div>
+        <div className="pr-lc__tile" style={{ ["--c" as never]: "#E7157B" }}>
+          <div className="pr-lc__tile-label">5xx ratio</div>
+          <div className="pr-lc__tile-value">
+            {errLast.toFixed(2)}
+            <span className="pr-lc__tile-unit">%</span>
+          </div>
+          <div className="pr-lc__tile-foot">alarm &gt; 1.00 · ok</div>
+        </div>
+      </div>
+      <div className="pr-lc__dash-foot">
+        declared in <code>alchemy.run.ts</code> · exporter: Axiom
+      </div>
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/ServiceLayerSwap.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/ServiceLayerSwap.tsx
new file mode 100644
index 00000000000..2622d1743ad
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/ServiceLayerSwap.tsx
@@ -0,0 +1,388 @@
+import { useEffect, useRef, useState, type ReactNode } from "react";
+import { AWS_COLOR, CF_COLOR, tint } from "../marketing/diagrams/_colors";
+
+const tok =
+  (color: string) =>
+  ({ children }: { children: ReactNode }) => (
+    <span style={{ color }}>{children}</span>
+  );
+const K = tok("var(--alc-code-keyword)");
+const S = tok("var(--alc-code-string)");
+const F = tok("var(--alc-code-fn)");
+const V = tok("var(--alc-code-var)");
+const T = tok("var(--alc-code-type)");
+const C = ({ children }: { children: ReactNode }) => (
+  <span style={{ color: "var(--alc-code-comment)", fontStyle: "italic" }}>
+    {children}
+  </span>
+);
+
+type ResKind = "kv" | "ddb" | "d1";
+
+interface Impl {
+  layer: string; // Layer name shown in code
+  resourceLabel: string; // node label
+  resourceSub: string; // node sub-label
+  bindCall: string; // bind call shown on the arrow
+  color: string;
+  kind: ResKind;
+}
+
+const D1_COLOR = "#0080FF";
+
+const IMPLS: Impl[] = [
+  {
+    layer: "SessionsKV",
+    resourceLabel: "Sessions",
+    resourceSub: "Cloudflare.KVNamespace",
+    bindCall: "KVNamespace.bind",
+    color: CF_COLOR,
+    kind: "kv",
+  },
+  {
+    layer: "SessionsDynamoDB",
+    resourceLabel: "Sessions",
+    resourceSub: "AWS.DynamoDB.Table",
+    bindCall: "DynamoDB.PutItem.bind",
+    color: AWS_COLOR,
+    kind: "ddb",
+  },
+  {
+    layer: "SessionsD1",
+    resourceLabel: "Sessions",
+    resourceSub: "Cloudflare.D1Database",
+    bindCall: "D1Database.bind",
+    color: D1_COLOR,
+    kind: "d1",
+  },
+];
+
+const DWELL_MS = 2800;
+
+function ResourceIcon({ kind, color }: { kind: ResKind; color: string }) {
+  const fill = tint(color, 0.18);
+  if (kind === "kv") {
+    return (
+      <svg width="22" height="22" viewBox="0 0 32 32" fill="none" aria-hidden>
+        <circle
+          cx="11"
+          cy="16"
+          r="6"
+          fill={fill}
+          stroke={color}
+          strokeWidth="1.5"
+        />
+        <circle cx="11" cy="16" r="2.2" fill={color} />
+        <path
+          d="M17 16 L27 16 M23 16 L23 21 M27 16 L27 12"
+          stroke={color}
+          strokeWidth="1.5"
+          strokeLinecap="round"
+        />
+      </svg>
+    );
+  }
+  if (kind === "ddb") {
+    return (
+      <svg width="22" height="22" viewBox="0 0 32 32" fill="none" aria-hidden>
+        <ellipse
+          cx="16"
+          cy="8"
+          rx="10"
+          ry="3"
+          fill={fill}
+          stroke={color}
+          strokeWidth="1.4"
+        />
+        <ellipse
+          cx="16"
+          cy="16"
+          rx="10"
+          ry="3"
+          fill={fill}
+          stroke={color}
+          strokeWidth="1.4"
+        />
+        <ellipse
+          cx="16"
+          cy="24"
+          rx="10"
+          ry="3"
+          fill={fill}
+          stroke={color}
+          strokeWidth="1.4"
+        />
+      </svg>
+    );
+  }
+  // d1
+  return (
+    <svg width="22" height="22" viewBox="0 0 32 32" fill="none" aria-hidden>
+      <ellipse
+        cx="16"
+        cy="8"
+        rx="10"
+        ry="3"
+        fill={fill}
+        stroke={color}
+        strokeWidth="1.5"
+      />
+      <path
+        d="M6 8 V24 C6 25.7 10.5 27 16 27 C21.5 27 26 25.7 26 24 V8"
+        fill={fill}
+        stroke={color}
+        strokeWidth="1.5"
+      />
+      <path
+        d="M9 14 L23 14 M9 18 L23 18 M9 22 L19 22"
+        stroke={color}
+        strokeWidth="1.2"
+        strokeLinecap="round"
+      />
+    </svg>
+  );
+}
+
+export default function ServiceLayerSwap() {
+  const wrapRef = useRef<HTMLDivElement>(null);
+  const [idx, setIdx] = useState(0);
+
+  useEffect(() => {
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    let cancelled = false;
+    const reduced = window.matchMedia(
+      "(prefers-reduced-motion: reduce)",
+    ).matches;
+
+    const tick = (i: number) => {
+      if (cancelled) return;
+      setIdx(i);
+      if (reduced) return;
+      timer = setTimeout(() => tick((i + 1) % IMPLS.length), DWELL_MS);
+    };
+    const obs = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting) {
+            tick(0);
+            obs.disconnect();
+          }
+        }
+      },
+      { threshold: 0.25 },
+    );
+    if (wrapRef.current) obs.observe(wrapRef.current);
+    return () => {
+      cancelled = true;
+      if (timer) clearTimeout(timer);
+      obs.disconnect();
+    };
+  }, []);
+
+  const active = IMPLS[idx]!;
+
+  return (
+    <div ref={wrapRef} className="service-swap-grid">
+      {/* LEFT — code: Worker that consumes Sessions, Layer name swaps */}
+      <div className="alc-code-block">
+        <div className="alc-code-block__header">
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-danger)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-warn)" }}
+          />
+          <span
+            className="alc-code-block__dot"
+            style={{ background: "var(--alc-accent-bright)" }}
+          />
+          <span className="alc-code-block__filename">src/Api.ts</span>
+        </div>
+        <pre className="alc-code-block__pre">
+          <C>{"// Service interface — defined once."}</C>
+          {"\n"}
+          <K>export class</K> <T>Sessions</T> <K>extends</K> <V>Context</V>.
+          <F>Service</F>
+          {"<"}
+          <T>Sessions</T>, {"{"}
+          {"\n  "}
+          <V>get</V>: (<V>id</V>: <T>string</T>) {"=>"} <V>Effect</V>.
+          <T>Effect</T>
+          {"<"}
+          <T>Session</T>
+          {">"};{"\n  "}
+          <V>put</V>: (<V>s</V>: <T>Session</T>) {"=>"} <V>Effect</V>.
+          <T>Effect</T>
+          {"<"}
+          <T>void</T>
+          {">"};{"\n"}
+          {"}>()("}
+          <S>"Sessions"</S>
+          {") {}"}
+          {"\n\n"}
+          <C>{"// Worker code never knows which Layer is providing it."}</C>
+          {"\n"}
+          <K>export default class</K> <T>Api</T> <K>extends</K>{" "}
+          <V>Cloudflare</V>.<F>Worker</F>
+          {"<"}
+          <T>Api</T>
+          {">()("}
+          {"\n  "}
+          <S>"Api"</S>,{"\n  "}
+          <V>Effect</V>.<F>gen</F>(<K>function</K>* () {"{"}
+          {"\n    "}
+          <K>const</K> sessions = <K>yield</K>* <V>Sessions</V>;{"\n    "}
+          <K>return</K> {"{ fetch: handler(sessions) };"}
+          {"\n  "}
+          {"}).pipe("}
+          {"\n    "}
+          <C>
+            {"// Swap one Layer — resources, bindings, IAM all swap with it."}
+          </C>
+          {"\n    "}
+          <V>Effect</V>.<F>provide</F>(
+          <span
+            key={idx}
+            className="layer-swap"
+            style={{ color: active.color, fontWeight: 600 }}
+          >
+            {active.layer}
+          </span>
+          ),
+          {"\n  "}
+          {"),"}
+          {"\n"}
+          {") {}"}
+        </pre>
+      </div>
+
+      {/* RIGHT — visual: Sessions → Layer → Resource */}
+      <div className="service-swap-stage">
+        <div className="service-swap-stage__node service-swap-stage__node--accent">
+          <svg
+            width="22"
+            height="22"
+            viewBox="0 0 32 32"
+            fill="none"
+            aria-hidden
+          >
+            <rect
+              x="4"
+              y="6"
+              width="24"
+              height="20"
+              rx="4"
+              fill="rgba(184,138,74,0.15)"
+              stroke="var(--alc-accent-deep)"
+              strokeWidth="1.5"
+            />
+            <path
+              d="M9 13 H23 M9 17 H19 M9 21 H21"
+              stroke="var(--alc-accent-deep)"
+              strokeWidth="1.4"
+              strokeLinecap="round"
+            />
+          </svg>
+          <div className="service-swap-stage__label">Sessions</div>
+          <div className="service-swap-stage__sub">Context.Service</div>
+        </div>
+
+        <div
+          className="service-swap-stage__edge service-swap-stage__edge--down"
+          style={{ borderColor: active.color }}
+        >
+          <span
+            className="service-swap-stage__edge-label"
+            style={{ color: active.color, borderColor: active.color }}
+          >
+            Layer.effect
+          </span>
+        </div>
+
+        <div
+          key={`layer-${idx}`}
+          className="service-swap-stage__node layer-swap-node"
+          style={{
+            borderColor: active.color,
+            boxShadow: `0 0 0 2px ${tint(active.color, 0.12)}`,
+          }}
+        >
+          <svg
+            width="22"
+            height="22"
+            viewBox="0 0 32 32"
+            fill="none"
+            aria-hidden
+          >
+            <path
+              d="M16 4 L28 10 L16 16 L4 10 Z"
+              fill={tint(active.color, 0.18)}
+              stroke={active.color}
+              strokeWidth="1.4"
+              strokeLinejoin="round"
+            />
+            <path
+              d="M4 16 L16 22 L28 16"
+              stroke={active.color}
+              strokeWidth="1.4"
+              fill="none"
+              strokeLinejoin="round"
+              opacity="0.85"
+            />
+            <path
+              d="M4 22 L16 28 L28 22"
+              stroke={active.color}
+              strokeWidth="1.4"
+              fill="none"
+              strokeLinejoin="round"
+              opacity="0.55"
+            />
+          </svg>
+          <div
+            className="service-swap-stage__label"
+            style={{ color: active.color }}
+          >
+            {active.layer}
+          </div>
+          <div className="service-swap-stage__sub">Layer</div>
+        </div>
+
+        <div
+          className="service-swap-stage__edge service-swap-stage__edge--down"
+          style={{ borderColor: active.color }}
+        >
+          <span
+            className="service-swap-stage__edge-label"
+            style={{ color: active.color, borderColor: active.color }}
+          >
+            {active.bindCall}
+          </span>
+        </div>
+
+        <div
+          key={`res-${idx}`}
+          className="service-swap-stage__node layer-swap-node"
+          style={{ borderColor: active.color }}
+        >
+          <ResourceIcon kind={active.kind} color={active.color} />
+          <div className="service-swap-stage__label">
+            {active.resourceLabel}
+          </div>
+          <div className="service-swap-stage__sub">{active.resourceSub}</div>
+        </div>
+
+        <div className="service-swap-stage__steps" aria-hidden>
+          {IMPLS.map((_, i) => (
+            <span
+              key={i}
+              className={`service-swap-stage__dot${i === idx ? " is-active" : ""}`}
+              style={i === idx ? { background: active.color } : undefined}
+            />
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/StackOutputsTerminal.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/StackOutputsTerminal.tsx
new file mode 100644
index 00000000000..4913e2e61b3
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/StackOutputsTerminal.tsx
@@ -0,0 +1,178 @@
+import { useEffect, useRef, useState } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+const RESOURCES = [
+  { id: "Bucket", type: "Cloudflare.R2Bucket" },
+  { id: "Worker", type: "Cloudflare.Worker" },
+];
+
+const OUTPUTS: { key: string; value: string }[] = [
+  { key: "bucketName", value: '"myapp-dev_sam-bucket-a3f1"' },
+  {
+    key: "url",
+    value: '"https://myapp-worker-dev_sam-abc123.workers.dev"',
+  },
+];
+
+const STAGE = "dev_sam";
+const COMMAND = `alchemy deploy --stage ${STAGE}`;
+
+type RowStatus = "pending" | "creating" | "created";
+
+export default function StackOutputsTerminal({
+  maxLines = 12,
+}: {
+  maxLines?: number;
+}) {
+  const [cmd, setCmd] = useState("");
+  const [caret, setCaret] = useState(false);
+  const [rows, setRows] = useState<
+    { id: string; type: string; status: RowStatus }[]
+  >([]);
+  const [showOutputs, setShowOutputs] = useState(false);
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const typeCmd = async (text: string) => {
+      setCmd("");
+      setCaret(true);
+      for (let i = 1; i <= text.length; i++) {
+        if (aborted()) return;
+        setCmd(text.slice(0, i));
+        await sleep(28 + Math.random() * 22);
+      }
+      await sleep(160);
+      setCaret(false);
+    };
+
+    const update = (id: string, status: RowStatus) =>
+      setRows((rs) => rs.map((r) => (r.id === id ? { ...r, status } : r)));
+
+    const run = async () => {
+      while (!aborted()) {
+        setCmd("");
+        setCaret(false);
+        setRows([]);
+        setShowOutputs(false);
+        await sleep(900);
+        if (aborted()) return;
+
+        await typeCmd(COMMAND);
+        if (aborted()) return;
+
+        await sleep(220);
+        setRows(
+          RESOURCES.map((r) => ({ ...r, status: "pending" as RowStatus })),
+        );
+        await sleep(260);
+
+        for (const r of RESOURCES) {
+          if (aborted()) return;
+          update(r.id, "creating");
+          await sleep(620);
+          if (aborted()) return;
+          update(r.id, "created");
+          await sleep(140);
+        }
+
+        await sleep(260);
+        setShowOutputs(true);
+        await sleep(4200);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const anyInFlight = rows.some((r) => r.status === "creating");
+  const spinner = useSpinner(anyInFlight);
+  const accent = "var(--alc-accent-bright)";
+
+  return (
+    <TermChrome
+      title={`alchemy · ${STAGE}`}
+      badge="DEPLOY"
+      badgeColor={accent}
+      maxLines={maxLines}
+    >
+      <Line>
+        <span style={{ color: accent }}>$ </span>
+        {cmd}
+        {caret && <span style={{ color: "var(--alc-fg-invert)" }}>▍</span>}
+      </Line>
+      {rows.length > 0 && (
+        <>
+          <Line> </Line>
+          {rows.map((r) => {
+            const inFlight = r.status === "creating";
+            const done = r.status === "created";
+            const icon = inFlight ? spinner : done ? "✓" : "+";
+            return (
+              <Line key={r.id}>
+                <span
+                  style={{
+                    color: accent,
+                    width: "1.2em",
+                    display: "inline-block",
+                  }}
+                >
+                  {icon}
+                </span>
+                <span
+                  style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}
+                >
+                  {r.id}
+                </span>
+                <span style={{ color: "var(--alc-code-comment)" }}>
+                  {` (${r.type})`}
+                </span>
+                {inFlight && (
+                  <span style={{ color: accent, marginLeft: 6 }}>
+                    {r.status}
+                  </span>
+                )}
+              </Line>
+            );
+          })}
+        </>
+      )}
+      {showOutputs && (
+        <>
+          <Line> </Line>
+          <Line>
+            <span style={{ color: accent }}>✓ </span>
+            <span>deployed in </span>
+            <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+              3.4s
+            </span>
+          </Line>
+          <Line> </Line>
+          <Line>
+            <span style={{ color: "var(--alc-code-comment)" }}>outputs:</span>
+          </Line>
+          <Line>
+            <span style={{ color: "var(--alc-fg-invert)" }}>{"{"}</span>
+          </Line>
+          {OUTPUTS.map((o) => (
+            <Line key={o.key}>
+              <span style={{ color: "var(--alc-fg-invert)" }}>{"  "}</span>
+              <span style={{ color: "var(--alc-fg-invert)" }}>{o.key}</span>
+              <span style={{ color: "var(--alc-code-comment)" }}>: </span>
+              <span style={{ color: accent }}>{o.value}</span>
+              <span style={{ color: "var(--alc-fg-invert)" }}>,</span>
+            </Line>
+          ))}
+          <Line>
+            <span style={{ color: "var(--alc-fg-invert)" }}>{"}"}</span>
+          </Line>
+        </>
+      )}
+    </TermChrome>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/StateStoreBootstrap.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/StateStoreBootstrap.tsx
new file mode 100644
index 00000000000..ab558f9f446
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/StateStoreBootstrap.tsx
@@ -0,0 +1,234 @@
+import { useEffect, useRef, useState } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+interface BootstrapResource {
+  id: string;
+  type: string;
+  /** Optional sub-line shown beneath the resource while creating, e.g. progress notes. */
+  note?: string;
+}
+
+const RESOURCES: BootstrapResource[] = [
+  {
+    id: "AlchemyStateStoreToken",
+    type: "Cloudflare.SecretsStore.Secret",
+  },
+  {
+    id: "Api",
+    type: "Cloudflare.Worker",
+    note: "Enabling workers.dev subdomain...",
+  },
+  { id: "StateStoreAuthTokenValue", type: "Alchemy.Random" },
+  {
+    id: "StateStoreEncryptionKey",
+    type: "Cloudflare.SecretsStore.Secret",
+  },
+  { id: "StateStoreEncryptionKeyValue", type: "Alchemy.Random" },
+  { id: "StateStoreSecrets", type: "Cloudflare.SecretsStore" },
+];
+
+type RowStatus = "pending" | "creating" | "created";
+interface Row extends BootstrapResource {
+  status: RowStatus;
+}
+
+type PromptState = "hidden" | "asking" | "confirmed";
+
+const ACCENT = "var(--alc-accent-bright)";
+
+export default function StateStoreBootstrap({
+  title = "~/my-app",
+  bare,
+  maxLines = 12,
+}: {
+  title?: string;
+  bare?: boolean;
+  maxLines?: number;
+}) {
+  const [cmd, setCmd] = useState("");
+  const [caret, setCaret] = useState(false);
+  const [prompt, setPrompt] = useState<PromptState>("hidden");
+  const [rows, setRows] = useState<Row[]>([]);
+
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const typeCmd = async (text: string) => {
+      setCmd("");
+      setCaret(true);
+      for (let i = 1; i <= text.length; i++) {
+        if (aborted()) return;
+        setCmd(text.slice(0, i));
+        await sleep(36 + Math.random() * 24);
+      }
+      await sleep(220);
+      setCaret(false);
+    };
+
+    const updateRow = (id: string, patch: Partial<Row>) =>
+      setRows((rs) => rs.map((r) => (r.id === id ? { ...r, ...patch } : r)));
+
+    const reset = () => {
+      setCmd("");
+      setCaret(false);
+      setPrompt("hidden");
+      setRows([]);
+    };
+
+    const run = async () => {
+      while (!aborted()) {
+        reset();
+        await sleep(400);
+        await typeCmd("bun alchemy deploy");
+        if (aborted()) return;
+        await sleep(450);
+
+        setPrompt("asking");
+        await sleep(1100);
+        if (aborted()) return;
+        setPrompt("confirmed");
+        await sleep(550);
+        if (aborted()) return;
+
+        // Seed all rows as pending so the layout doesn't jump.
+        setRows(RESOURCES.map((r) => ({ ...r, status: "pending" })));
+        await sleep(280);
+
+        for (const r of RESOURCES) {
+          if (aborted()) return;
+          updateRow(r.id, { status: "creating" });
+          await sleep(r.note ? 1100 : 700);
+          if (aborted()) return;
+          updateRow(r.id, { status: "created" });
+          await sleep(180);
+        }
+
+        await sleep(3200);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const anyInFlight = rows.some((r) => r.status === "creating");
+  const spinner = useSpinner(anyInFlight);
+
+  const renderRow = (r: Row) => {
+    let icon: string;
+    let iconColor: string;
+
+    if (r.status === "pending") {
+      icon = "·";
+      iconColor = "var(--alc-code-comment)";
+    } else if (r.status === "creating") {
+      icon = spinner;
+      iconColor = ACCENT;
+    } else {
+      icon = "✓";
+      iconColor = ACCENT;
+    }
+
+    const labelColor =
+      r.status === "pending"
+        ? "var(--alc-code-comment)"
+        : "var(--alc-fg-invert)";
+    const labelWeight = r.status === "pending" ? 400 : 600;
+
+    return (
+      <div key={r.id}>
+        <div style={{ minHeight: "1.55em", whiteSpace: "pre" }}>
+          <span
+            style={{
+              color: iconColor,
+              width: "1.2em",
+              display: "inline-block",
+              transition: "color 200ms ease",
+            }}
+          >
+            {icon}
+          </span>
+          <span
+            style={{
+              color: labelColor,
+              fontWeight: labelWeight,
+              transition: "color 200ms ease",
+            }}
+          >
+            {r.id}
+          </span>
+          <span
+            style={{ color: "var(--alc-code-comment)" }}
+          >{` (${r.type})`}</span>
+          {r.status === "created" && (
+            <span style={{ color: ACCENT, marginLeft: 6 }}>created</span>
+          )}
+        </div>
+        {r.note && (r.status === "creating" || r.status === "created") && (
+          <div
+            style={{
+              minHeight: "1.55em",
+              whiteSpace: "pre",
+              color: "var(--alc-code-comment)",
+            }}
+          >
+            <span style={{ width: "1.2em", display: "inline-block" }}> </span>
+            <span>• {r.note}</span>
+          </div>
+        )}
+      </div>
+    );
+  };
+
+  return (
+    <TermChrome
+      title={title}
+      badge="DEPLOY"
+      badgeColor={ACCENT}
+      maxLines={maxLines}
+      bare={bare}
+    >
+      <Line>
+        <span style={{ color: ACCENT }}>$ </span>
+        {cmd}
+        {caret && <span style={{ color: "var(--alc-fg-invert)" }}>▍</span>}
+      </Line>
+      {prompt !== "hidden" && (
+        <>
+          <Line>
+            <span style={{ color: "var(--alc-code-comment)" }}>│</span>
+          </Line>
+          <Line>
+            <span style={{ color: ACCENT, marginRight: 4 }}>◇</span>
+            <span style={{ color: "var(--alc-fg-invert)" }}>
+              {"  Cloudflare State Store not found. Do you want to deploy it?"}
+            </span>
+          </Line>
+          <Line>
+            <span style={{ color: "var(--alc-code-comment)" }}>│</span>
+            <span
+              style={{
+                marginLeft: 4,
+                color: prompt === "confirmed" ? ACCENT : "var(--alc-fg-invert)",
+                transition: "color 200ms ease",
+              }}
+            >
+              {"  Yes"}
+            </span>
+          </Line>
+        </>
+      )}
+      {rows.length > 0 && (
+        <>
+          <Line> </Line>
+          {rows.map(renderRow)}
+        </>
+      )}
+    </TermChrome>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/TestTerminal.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/TestTerminal.tsx
new file mode 100644
index 00000000000..f5c84fb4825
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/TestTerminal.tsx
@@ -0,0 +1,220 @@
+import { Fragment, useEffect, useRef, useState } from "react";
+import { Line, sleep, TermChrome, useSpinner } from "./_terminal";
+
+const TEST_STAGE = "pr-1729";
+
+interface BaseStep {
+  id: string;
+  label: string;
+  runMs: number;
+}
+interface PhaseStep extends BaseStep {
+  kind: "phase";
+  detail: string;
+  durSec: string;
+  url?: string;
+}
+interface TestStep extends BaseStep {
+  kind: "test";
+  durMs: string;
+}
+type Step = PhaseStep | TestStep;
+type RunningStep = Step & { status: "running" | "done" };
+
+const TEST_STEPS: Step[] = [
+  {
+    id: "deploy",
+    kind: "phase",
+    label: "deploy",
+    detail: "3 resources",
+    runMs: 1100,
+    durSec: "4.2",
+    url: `https://api.${TEST_STAGE}.workers.dev`,
+  },
+  {
+    id: "t1",
+    kind: "test",
+    label: "PUT + GET round-trips through R2",
+    runMs: 850,
+    durMs: "312",
+  },
+  {
+    id: "t2",
+    kind: "test",
+    label: "Room DO preserves state across requests",
+    runMs: 700,
+    durMs: "184",
+  },
+  {
+    id: "destroy",
+    kind: "phase",
+    label: "destroy",
+    detail: "3 resources",
+    runMs: 900,
+    durSec: "1.8",
+  },
+];
+
+export default function TestTerminal({
+  title = `CI · ${TEST_STAGE}`,
+}: {
+  title?: string;
+}) {
+  const [cmd, setCmd] = useState("");
+  const [caret, setCaret] = useState(false);
+  const [steps, setSteps] = useState<RunningStep[]>([]);
+  const [summary, setSummary] = useState<{
+    tests: number;
+    secs: string;
+  } | null>(null);
+
+  const cancelRef = useRef(false);
+
+  useEffect(() => {
+    cancelRef.current = false;
+    const aborted = () => cancelRef.current;
+
+    const typeCmd = async (text: string) => {
+      setCmd("");
+      setCaret(true);
+      for (let i = 1; i <= text.length; i++) {
+        if (aborted()) return;
+        setCmd(text.slice(0, i));
+        await sleep(36 + Math.random() * 24);
+      }
+      await sleep(180);
+      setCaret(false);
+    };
+
+    const run = async () => {
+      while (!aborted()) {
+        setSteps([]);
+        setSummary(null);
+        await typeCmd("bun test");
+        if (aborted()) return;
+        await sleep(280);
+
+        const t0 = Date.now();
+        for (const s of TEST_STEPS) {
+          if (aborted()) return;
+          setSteps((arr) => [...arr, { ...s, status: "running" }]);
+          await sleep(s.runMs);
+          if (aborted()) return;
+          setSteps((arr) =>
+            arr.map((r) => (r.id === s.id ? { ...r, status: "done" } : r)),
+          );
+          await sleep(160);
+        }
+        if (aborted()) return;
+        const elapsed = ((Date.now() - t0) / 1000).toFixed(1);
+        setSummary({ tests: 2, secs: elapsed });
+        await sleep(2800);
+      }
+    };
+
+    run();
+    return () => {
+      cancelRef.current = true;
+    };
+  }, []);
+
+  const anyRunning = steps.some((s) => s.status === "running");
+  const spinner = useSpinner(anyRunning);
+  const accent = "var(--alc-accent-bright)";
+
+  const renderStep = (s: RunningStep, idx: number, arr: RunningStep[]) => {
+    const isRunning = s.status === "running";
+    const icon = isRunning ? spinner : "✓";
+    const iconColor = isRunning ? "var(--alc-code-type)" : accent;
+
+    if (s.kind === "phase") {
+      return (
+        <Fragment key={s.id}>
+          <Line>
+            <span
+              style={{
+                color: iconColor,
+                width: "1.2em",
+                display: "inline-block",
+              }}
+            >
+              {icon}
+            </span>
+            <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+              {s.label}
+            </span>
+            {!isRunning ? (
+              <span style={{ color: "var(--alc-code-comment)" }}>
+                {` (${s.detail} · ${s.durSec}s)`}
+              </span>
+            ) : (
+              <span
+                style={{ color: "var(--alc-code-comment)" }}
+              >{` (${s.detail})`}</span>
+            )}
+          </Line>
+          {s.url && !isRunning && (
+            <Line>
+              <span style={{ color: "var(--alc-code-comment)" }}>{"  → "}</span>
+              <span style={{ color: "var(--alc-code-comment)" }}>{s.url}</span>
+            </Line>
+          )}
+          {!isRunning && idx < arr.length - 1 && <Line> </Line>}
+        </Fragment>
+      );
+    }
+    return (
+      <Line key={s.id}>
+        <span
+          style={{ color: iconColor, width: "1.2em", display: "inline-block" }}
+        >
+          {icon}
+        </span>
+        <span style={{ color: "var(--alc-fg-invert)" }}>{s.label}</span>
+        {!isRunning && (
+          <span
+            style={{ color: "var(--alc-code-comment)" }}
+          >{` (${s.durMs}ms)`}</span>
+        )}
+      </Line>
+    );
+  };
+
+  return (
+    <TermChrome title={title} badge="TEST" badgeColor={accent} maxLines={10}>
+      <Line>
+        <span style={{ color: accent }}>$ </span>
+        {cmd}
+        {caret && <span style={{ color: "var(--alc-fg-invert)" }}>▍</span>}
+      </Line>
+      {steps.length > 0 && (
+        <>
+          <Line> </Line>
+          {steps.map((s, i, arr) => renderStep(s, i, arr))}
+        </>
+      )}
+      {summary && (
+        <>
+          <Line> </Line>
+          <Line>
+            <span
+              style={{
+                background: accent,
+                color: "var(--alc-bg-code)",
+                fontWeight: 700,
+                padding: "0 8px",
+                marginRight: 8,
+              }}
+            >
+              {" PASS "}
+            </span>
+            <span>{summary.tests} tests · </span>
+            <span style={{ color: "var(--alc-fg-invert)", fontWeight: 600 }}>
+              {summary.secs}s
+            </span>
+          </Line>
+        </>
+      )}
+    </TermChrome>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/_terminal.tsx b/.repos/alchemy-effect/website/src/components/marketing-islands/_terminal.tsx
new file mode 100644
index 00000000000..9e519324b03
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/_terminal.tsx
@@ -0,0 +1,168 @@
+import { useEffect, useState, type CSSProperties, type ReactNode } from "react";
+
+export const SPINNER_FRAMES = [
+  "⠋",
+  "⠙",
+  "⠹",
+  "⠸",
+  "⠼",
+  "⠴",
+  "⠦",
+  "⠧",
+  "⠇",
+  "⠏",
+];
+
+export const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+export function useSpinner(active: boolean, intervalMs = 80): string {
+  const [i, setI] = useState(0);
+  useEffect(() => {
+    if (!active) return;
+    const t = setInterval(
+      () => setI((v) => (v + 1) % SPINNER_FRAMES.length),
+      intervalMs,
+    );
+    return () => clearInterval(t);
+  }, [active, intervalMs]);
+  return SPINNER_FRAMES[i]!;
+}
+
+/** Run an async loop only once the element scrolls into view, and stop when it leaves. */
+export function useInViewLoop(
+  ref: React.RefObject<HTMLElement | null>,
+  run: (signal: { aborted: boolean }) => void | Promise<void>,
+) {
+  useEffect(() => {
+    const el = ref.current;
+    if (!el) return;
+    const signal = { aborted: false };
+    let started = false;
+    const obs = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting && !started) {
+            started = true;
+            void run(signal);
+            obs.disconnect();
+          }
+        }
+      },
+      { threshold: 0.2 },
+    );
+    obs.observe(el);
+    return () => {
+      signal.aborted = true;
+      obs.disconnect();
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+}
+
+export function TermChrome({
+  title,
+  badge,
+  badgeColor,
+  children,
+  bodyMinHeight,
+  maxLines,
+  bare,
+}: {
+  title: string;
+  badge?: string;
+  badgeColor?: string;
+  children: ReactNode;
+  bodyMinHeight?: number;
+  /**
+   * Locks the terminal body to exactly this many lines of content (computed
+   * from the body font-size × line-height + padding). Use in docs/embedded
+   * contexts where layout shift below the terminal must be avoided. Count
+   * the maximum number of visible lines the body ever renders. Takes
+   * precedence over `bodyMinHeight`.
+   */
+  maxLines?: number;
+  /**
+   * When true, omit the outer `.alc-term` wrapper and the dots/title header.
+   * Useful when this terminal is embedded inside another chrome (e.g. the
+   * mobile tab toggle that combines code + deploy into one card).
+   */
+  bare?: boolean;
+}) {
+  // `1lh` resolves to the computed line-height of `.alc-term__body`, so the
+  // reservation scales with font-size and browser zoom. Padding (28px = 14px
+  // top + 14px bottom) is fixed visual chrome; with `box-sizing: border-box`
+  // it's included in `height`.
+  const bodyStyle: CSSProperties | undefined =
+    maxLines !== undefined
+      ? {
+          boxSizing: "border-box",
+          height: `calc(${maxLines} * 1lh + 28px)`,
+          minHeight: `calc(${maxLines} * 1lh + 28px)`,
+          overflow: "hidden",
+        }
+      : bodyMinHeight
+        ? { minHeight: bodyMinHeight }
+        : undefined;
+  if (bare) {
+    return (
+      <pre className="alc-term__body" style={bodyStyle}>
+        {children}
+      </pre>
+    );
+  }
+  return (
+    <div className="alc-term not-content">
+      <div className="alc-term__header">
+        <span
+          className="alc-code-block__dot"
+          style={{ background: "var(--alc-danger)" }}
+        />
+        <span
+          className="alc-code-block__dot"
+          style={{ background: "var(--alc-warn)" }}
+        />
+        <span
+          className="alc-code-block__dot"
+          style={{ background: "var(--alc-accent-bright)" }}
+        />
+        <span className="alc-term__title">{title}</span>
+        <span style={{ flex: 1 }} />
+        {badge && badgeColor && (
+          <span
+            style={{
+              fontFamily: "var(--alc-font-mono)",
+              fontSize: 10,
+              letterSpacing: "0.14em",
+              fontWeight: 700,
+              padding: "2px 8px",
+              borderRadius: 4,
+              color: badgeColor,
+              border: `1px solid ${badgeColor}`,
+              background: "transparent",
+              transition: "color 280ms ease, border-color 280ms ease",
+            }}
+          >
+            {badge}
+          </span>
+        )}
+      </div>
+      <pre className="alc-term__body" style={bodyStyle}>
+        {children}
+      </pre>
+    </div>
+  );
+}
+
+export function Line({
+  children,
+  style,
+}: {
+  children?: ReactNode;
+  style?: CSSProperties;
+}) {
+  return (
+    <div style={{ minHeight: "1.55em", whiteSpace: "pre", ...style }}>
+      {children}
+    </div>
+  );
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing-islands/agentPrompt.ts b/.repos/alchemy-effect/website/src/components/marketing-islands/agentPrompt.ts
new file mode 100644
index 00000000000..b963aabc5c7
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing-islands/agentPrompt.ts
@@ -0,0 +1,18 @@
+export const AGENT_PROMPT = `Help me build an Alchemy app on Cloudflare. Start by reading https://v2.alchemy.run/getting-started and follow it exactly: scaffold a fresh project, install the dependencies, create the \`alchemy.run.ts\` Stack with a single Cloudflare R2 Bucket (no Worker yet), and run \`alchemy deploy\` so I sign in to Cloudflare and provision the Bucket. Confirm the Bucket is live before moving on.
+
+Then STOP and ASK ME what I want to build. From there, consult only the docs you need for what I asked for — don't march me through every tutorial. A Worker only gets added later if what I want to build needs one (the tutorial covers that in part-2).
+
+Tutorial — foundations, work through whichever parts I haven't touched:
+  https://v2.alchemy.run/tutorial/part-1  First Stack (state store + first resource)
+  https://v2.alchemy.run/tutorial/part-2  Add a Worker
+  https://v2.alchemy.run/tutorial/part-3  Testing
+  https://v2.alchemy.run/tutorial/part-4  Local Dev (\`alchemy dev\`)
+  https://v2.alchemy.run/tutorial/part-5  CI/CD (per-PR previews from GitHub Actions)
+
+For everything else (Cloudflare deep-dives, guides, concepts, API reference), fetch https://v2.alchemy.run/llms.txt — it's the index of every doc on the site. Use it to look up the specific page you need instead of guessing URLs.
+
+Important:
+- Confirm with me before each deploy. Don't batch.
+- Do NOT instruct me to export CLOUDFLARE_ACCOUNT_ID or CLOUDFLARE_API_TOKEN. Alchemy stores credentials in profiles — \`alchemy login\` (or the first \`alchemy deploy\`) prompts interactively for OAuth or an API token and saves it to ~/.alchemy/profiles.json.
+- Use \`bun alchemy deploy\` (or the npm/pnpm/yarn equivalent).
+- If I'm migrating from Alchemy v1 (async/await), find the v1 migration guide via llms.txt and read it first.`;
diff --git a/.repos/alchemy-effect/website/src/components/marketing/AlchemicalDivider.astro b/.repos/alchemy-effect/website/src/components/marketing/AlchemicalDivider.astro
new file mode 100644
index 00000000000..092aa263e59
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/AlchemicalDivider.astro
@@ -0,0 +1,142 @@
+---
+/**
+ * Section divider — hairlines tapering toward a centered geometric
+ * glyph, with small flanking dots for the 17th-c. engraved-rule feel.
+ *
+ * Glyphs are mathematically perfect regular polygons (or a line / a
+ * circle as the limit cases). The home page uses these to compose
+ * a "platonic descent" — line → triangle → square → pentagon →
+ * hexagon → heptagon → octagon → circle — down the page.
+ */
+
+type Variant =
+  | "line"
+  | "triangle"
+  | "square"
+  | "pentagon"
+  | "hexagon"
+  | "heptagon"
+  | "octagon"
+  | "circle";
+
+interface PolygonSpec {
+  /** number of sides; 0 means special-cased (line / circle) */
+  sides: number;
+  /** rotation of the first vertex in degrees (SVG: 0° = right, 90° = down) */
+  startDeg: number;
+}
+
+const POLYGON: Record<Variant, PolygonSpec> = {
+  line: { sides: 0, startDeg: 0 },
+  triangle: { sides: 3, startDeg: -90 }, // apex up
+  square: { sides: 4, startDeg: -45 }, // sides axis-aligned
+  pentagon: { sides: 5, startDeg: -90 }, // apex up
+  hexagon: { sides: 6, startDeg: 0 }, // flat-top
+  heptagon: { sides: 7, startDeg: -90 }, // apex up
+  octagon: { sides: 8, startDeg: -67.5 }, // flat-top
+  circle: { sides: 0, startDeg: 0 },
+};
+
+function polygonPoints(
+  sides: number,
+  startDeg: number,
+  cx = 12,
+  cy = 12,
+  r = 9.5,
+): string {
+  const pts: string[] = [];
+  for (let i = 0; i < sides; i++) {
+    const angle = ((startDeg + (360 / sides) * i) * Math.PI) / 180;
+    const x = cx + r * Math.cos(angle);
+    const y = cy + r * Math.sin(angle);
+    pts.push(`${x.toFixed(3)},${y.toFixed(3)}`);
+  }
+  return pts.join(" ");
+}
+
+interface Props {
+  variant?: Variant;
+  size?: number;
+  width?: string;
+  class?: string;
+}
+
+const {
+  variant = "circle",
+  size = 22,
+  width = "320px",
+  class: className,
+}: Props = Astro.props;
+
+const spec = POLYGON[variant as Variant];
+const points = spec.sides >= 3 ? polygonPoints(spec.sides, spec.startDeg) : "";
+---
+
+<div
+  class:list={["alc-divider", className]}
+  style={`--alc-divider-width:${width};`}
+  aria-hidden="true"
+>
+  <span class="alc-divider__rule"></span>
+  <span class="alc-divider__bullet"></span>
+  <svg
+    class="alc-divider__shape"
+    width={size}
+    height={size}
+    viewBox="0 0 24 24"
+    fill="none"
+    stroke="currentColor"
+    stroke-width="1.1"
+    stroke-linecap="round"
+    stroke-linejoin="miter"
+    stroke-miterlimit="6"
+  >
+    {variant === "line" && <line x1="2" y1="12" x2="22" y2="12" />}
+    {variant === "circle" && <circle cx="12" cy="12" r="9.5" />}
+    {points !== "" && <polygon points={points} />}
+  </svg>
+  <span class="alc-divider__bullet"></span>
+  <span class="alc-divider__rule"></span>
+</div>
+
+<style>
+  .alc-divider {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin: 0 auto;
+    max-width: var(--alc-divider-width, 320px);
+    padding: 28px 0;
+    color: var(--alc-fg-3);
+    opacity: 0.7;
+  }
+  .alc-divider__rule {
+    flex: 1;
+    height: 1px;
+    background: linear-gradient(
+      to right,
+      transparent,
+      currentColor 70%,
+      currentColor
+    );
+  }
+  .alc-divider__rule:last-child {
+    background: linear-gradient(
+      to left,
+      transparent,
+      currentColor 70%,
+      currentColor
+    );
+  }
+  .alc-divider__bullet {
+    flex: none;
+    width: 3px;
+    height: 3px;
+    border-radius: 50%;
+    background: currentColor;
+  }
+  .alc-divider__shape {
+    flex: none;
+    display: block;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/BetaBadge.astro b/.repos/alchemy-effect/website/src/components/marketing/BetaBadge.astro
new file mode 100644
index 00000000000..cfd782b4177
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/BetaBadge.astro
@@ -0,0 +1,41 @@
+---
+import { alchemyVersion } from "../../versions";
+---
+
+<div class="alc-beta-badge">
+  <span class="alc-beta-badge__dot"></span>
+  <span class="alc-beta-badge__label">BETA</span>
+  <span class="alc-beta-badge__sep">·</span>
+  v{alchemyVersion}
+</div>
+
+<style>
+  .alc-beta-badge {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 5px 12px;
+    border-radius: 999px;
+    white-space: nowrap;
+    border: 1px solid var(--alc-terracotta-deep);
+    background: var(--alc-bg-elev-1);
+    font-family: var(--alc-font-mono);
+    font-size: 11.5px;
+    color: var(--alc-fg-3);
+    letter-spacing: 0.02em;
+  }
+  .alc-beta-badge__dot {
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+    background: var(--alc-terracotta);
+  }
+  .alc-beta-badge__label {
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    color: var(--alc-terracotta-deep);
+  }
+  .alc-beta-badge__sep {
+    color: var(--alc-fg-4);
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/Button.astro b/.repos/alchemy-effect/website/src/components/marketing/Button.astro
new file mode 100644
index 00000000000..e0b565c812f
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/Button.astro
@@ -0,0 +1,96 @@
+---
+type Variant = "primary" | "secondary" | "ghost" | "accent";
+type Icon = "github" | "arrow" | "book" | "discord";
+
+interface Props {
+  variant?: Variant;
+  icon?: Icon;
+  href?: string;
+  class?: string;
+}
+
+const { variant = "primary", icon, href = "#", class: className } = Astro.props;
+---
+
+<a
+  href={href}
+  class:list={["alc-btn", `alc-btn--${variant}`, className]}
+>
+  {icon === "github" && (
+    <svg aria-hidden width="16" height="16" viewBox="0 0 24 24" fill="currentColor">
+      <path
+        d="M12 .5C5.73.5.5 5.73.5 12c0 5.08 3.29 9.39 7.86 10.91.58.1.79-.25.79-.56 0-.28-.01-1.02-.02-2-3.2.69-3.88-1.54-3.88-1.54-.52-1.33-1.28-1.69-1.28-1.69-1.05-.72.08-.71.08-.71 1.16.08 1.77 1.19 1.77 1.19 1.03 1.77 2.71 1.26 3.37.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.69 0-1.26.45-2.29 1.19-3.1-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.18 1.18a11.04 11.04 0 0 1 5.79 0c2.21-1.49 3.18-1.18 3.18-1.18.63 1.59.23 2.76.11 3.05.74.81 1.19 1.84 1.19 3.1 0 4.42-2.69 5.39-5.25 5.68.41.36.78 1.07.78 2.16 0 1.56-.01 2.81-.01 3.19 0 .31.21.67.8.56C20.71 21.39 24 17.08 24 12 24 5.73 18.27.5 12 .5z"
+      ></path>
+    </svg>
+  )}
+  <slot />
+  {icon === "arrow" && <span aria-hidden>→</span>}
+  {icon === "book" && <span aria-hidden>❏</span>}
+  {icon === "discord" && (
+    <svg aria-hidden width="16" height="16" viewBox="0 0 24 24" fill="currentColor">
+      <path
+        d="M20.317 4.369A19.79 19.79 0 0 0 16.558 3.2a.075.075 0 0 0-.079.037c-.34.6-.717 1.384-.98 2-1.797-.27-3.583-.27-5.342 0-.263-.63-.654-1.4-.997-2A.077.077 0 0 0 9.08 3.2a19.736 19.736 0 0 0-3.76 1.169.07.07 0 0 0-.032.027C1.533 9.046.6 13.58 1.057 18.058a.082.082 0 0 0 .031.056 19.9 19.9 0 0 0 5.993 3.029.077.077 0 0 0 .084-.027c.462-.63.873-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.108 13.108 0 0 1-1.872-.892.077.077 0 0 1-.008-.128c.126-.094.252-.192.372-.291a.074.074 0 0 1 .077-.01c3.927 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.099.246.197.373.291a.077.077 0 0 1-.006.128 12.3 12.3 0 0 1-1.873.892.077.077 0 0 0-.04.106c.36.699.772 1.364 1.225 1.994a.076.076 0 0 0 .084.028 19.84 19.84 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.548-13.66a.061.061 0 0 0-.031-.029ZM8.02 15.331c-1.183 0-2.157-1.085-2.157-2.42 0-1.333.956-2.418 2.157-2.418 1.21 0 2.176 1.094 2.157 2.418 0 1.335-.956 2.42-2.157 2.42Zm7.974 0c-1.183 0-2.157-1.085-2.157-2.42 0-1.333.955-2.418 2.157-2.418 1.21 0 2.176 1.094 2.157 2.418 0 1.335-.946 2.42-2.157 2.42Z"
+      ></path>
+    </svg>
+  )}
+</a>
+
+<style>
+  .alc-btn {
+    font-family: var(--alc-font-sans);
+    font-size: 14px;
+    font-weight: 500;
+    padding: 10px 18px;
+    border-radius: 8px;
+    border: 1px solid transparent;
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    white-space: nowrap;
+    cursor: pointer;
+    text-decoration: none;
+    transition:
+      background 120ms var(--alc-ease, cubic-bezier(0.2, 0, 0, 1)),
+      border-color 120ms var(--alc-ease, cubic-bezier(0.2, 0, 0, 1)),
+      color 120ms var(--alc-ease, cubic-bezier(0.2, 0, 0, 1));
+  }
+  .alc-btn--primary {
+    background: var(--alc-accent);
+    color: var(--alc-fg-on-accent);
+  }
+  .alc-btn--primary:hover {
+    background: var(--alc-accent-deep);
+  }
+  /* Secondary: transparent surface with a hairline border. Slimmer
+     padding than the primary so it doesn't feel oversized when sitting
+     next to a borderless ghost button. */
+  .alc-btn--secondary {
+    background: transparent;
+    border-color: var(--alc-hairline-3);
+    color: var(--alc-fg-1);
+    padding: 7px 14px;
+  }
+  .alc-btn--secondary:hover {
+    border-color: var(--alc-accent);
+    color: var(--alc-accent-deep);
+  }
+  .alc-btn--ghost {
+    background: transparent;
+    color: var(--alc-fg-2);
+  }
+  .alc-btn--ghost:hover {
+    color: var(--alc-accent-deep);
+  }
+  .alc-btn--accent {
+    background: var(--alc-terracotta);
+    color: var(--alc-fg-on-accent);
+  }
+  /* MDX wraps the button's slot text in a <p>, which inherits the UA
+     stylesheet's 1em block margin (~14px) and bloats the button
+     vertically. Flatten any <p> inside the button. `display: inline`
+     keeps the icon + label on one row inside the inline-flex anchor. */
+  .alc-btn :global(p) {
+    margin: 0;
+    display: inline;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/CTA.astro b/.repos/alchemy-effect/website/src/components/marketing/CTA.astro
new file mode 100644
index 00000000000..dfd9bcf6f0b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/CTA.astro
@@ -0,0 +1,33 @@
+---
+import Button from "./Button.astro";
+import Section from "./Section.astro";
+
+interface Props {
+  heading: string;
+}
+const { heading } = Astro.props;
+---
+
+<Section padding="20px 32px 40px">
+  <div class="alc-cta">
+    <h2 class="alc-h2">{heading}</h2>
+    <div class="alc-cta__buttons">
+      <Button variant="primary" icon="arrow" href="/getting-started">Start the tutorial</Button>
+      <Button variant="secondary" href="/">Read the docs</Button>
+      <Button variant="ghost" icon="github" href="https://github.com/alchemy-run/alchemy-effect">GitHub</Button>
+    </div>
+  </div>
+</Section>
+
+<style>
+  .alc-cta {
+    text-align: center;
+  }
+  .alc-cta__buttons {
+    display: flex;
+    gap: 10px;
+    justify-content: center;
+    flex-wrap: wrap;
+    margin-top: 16px;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/CodeBlock.astro b/.repos/alchemy-effect/website/src/components/marketing/CodeBlock.astro
new file mode 100644
index 00000000000..50f1cca27d0
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/CodeBlock.astro
@@ -0,0 +1,55 @@
+---
+import { highlightTS } from "./highlightTS";
+
+interface Props {
+  filename?: string;
+  code: string;
+  compact?: boolean;
+  caption?: string;
+}
+
+const { filename = "alchemy.run.ts", code, compact, caption } = Astro.props;
+const html = highlightTS(code);
+---
+
+{
+  caption ? (
+    <div class="alc-code-block__wrap">
+      <div class:list={["alc-code-block", compact && "alc-code-block--compact"]}>
+        <div class="alc-code-block__header">
+          <span
+            class="alc-code-block__dot"
+            style="background:var(--alc-danger);"
+          />
+          <span
+            class="alc-code-block__dot"
+            style="background:var(--alc-warn);"
+          />
+          <span
+            class="alc-code-block__dot"
+            style="background:var(--alc-accent-bright);"
+          />
+          <span class="alc-code-block__filename">{filename}</span>
+        </div>
+        <pre class="alc-code-block__pre" set:html={html} />
+      </div>
+      <div class="alc-code-block__caption">{caption}</div>
+    </div>
+  ) : (
+    <div class:list={["alc-code-block", compact && "alc-code-block--compact"]}>
+      <div class="alc-code-block__header">
+        <span
+          class="alc-code-block__dot"
+          style="background:var(--alc-danger);"
+        />
+        <span class="alc-code-block__dot" style="background:var(--alc-warn);" />
+        <span
+          class="alc-code-block__dot"
+          style="background:var(--alc-accent-bright);"
+        />
+        <span class="alc-code-block__filename">{filename}</span>
+      </div>
+      <pre class="alc-code-block__pre" set:html={html} />
+    </div>
+  )
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing/CodeTabs.astro b/.repos/alchemy-effect/website/src/components/marketing/CodeTabs.astro
new file mode 100644
index 00000000000..7db7d9a2479
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/CodeTabs.astro
@@ -0,0 +1,53 @@
+---
+import CodeBlock from "./CodeBlock.astro";
+
+interface Tab {
+  key: string;
+  label: string;
+  filename: string;
+  code: string;
+  compact?: boolean;
+}
+interface Props {
+  tabs: Tab[];
+}
+const { tabs } = Astro.props;
+---
+
+<div class="code-tabs" data-code-tabs>
+  <div class="code-tabs__nav" role="tablist">
+    {tabs.map((t, i) => (
+      <button
+        type="button"
+        class="code-tabs__btn"
+        data-tab-key={t.key}
+        data-active={i === 0}
+      >
+        {t.label}
+      </button>
+    ))}
+  </div>
+  {tabs.map((t, i) => (
+    <div
+      class="code-tabs__panel"
+      data-tab-panel={t.key}
+      data-active={i === 0}
+    >
+      <CodeBlock filename={t.filename} code={t.code} compact={t.compact} />
+    </div>
+  ))}
+</div>
+
+<script>
+  for (const root of document.querySelectorAll<HTMLElement>("[data-code-tabs]")) {
+    const buttons = root.querySelectorAll<HTMLButtonElement>("[data-tab-key]");
+    const panels = root.querySelectorAll<HTMLElement>("[data-tab-panel]");
+    for (const btn of buttons) {
+      btn.addEventListener("click", () => {
+        const k = btn.dataset.tabKey;
+        for (const b of buttons) b.dataset.active = String(b.dataset.tabKey === k);
+        for (const p of panels) p.dataset.active = String(p.dataset.tabPanel === k);
+      });
+    }
+  }
+</script>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/DiscordCallout.astro b/.repos/alchemy-effect/website/src/components/marketing/DiscordCallout.astro
new file mode 100644
index 00000000000..af136390005
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/DiscordCallout.astro
@@ -0,0 +1,51 @@
+---
+import Button from "./Button.astro";
+---
+
+<div class="alc-discord">
+  <span class="alc-discord__hand">hey —</span>
+  <div class="alc-discord__body">
+    alchemy is in beta. APIs are stabilizing but expect occasional breaking changes.
+    Come hang in our Discord and help shape the road to 2.0.
+  </div>
+  <Button variant="secondary" icon="discord" href="https://discord.gg/jwKw8dBJdN">Join Discord</Button>
+</div>
+
+<style>
+  .alc-discord {
+    max-width: 760px;
+    margin: 0 auto;
+    padding: 16px 20px;
+    background: var(--alc-bg-elev-1);
+    border: 1px solid var(--alc-hairline);
+    border-radius: 10px;
+    display: flex;
+    align-items: center;
+    gap: 16px;
+    font-family: var(--alc-font-sans);
+  }
+  .alc-discord__hand {
+    font-family: var(--alc-font-hand);
+    font-size: 30px;
+    color: var(--alc-accent-deep);
+    line-height: 1;
+  }
+  .alc-discord__body {
+    flex: 1;
+    min-width: 0;
+    font-size: 14px;
+    color: var(--alc-fg-2);
+    line-height: 1.5;
+  }
+  @media (max-width: 640px) {
+    .alc-discord {
+      flex-direction: column;
+      align-items: flex-start;
+      gap: 12px;
+      padding: 16px;
+    }
+    .alc-discord__hand { font-size: 26px; }
+    .alc-discord__body { font-size: 13.5px; }
+    .alc-discord :global(.alc-btn) { align-self: stretch; justify-content: center; }
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/Eyebrow.astro b/.repos/alchemy-effect/website/src/components/marketing/Eyebrow.astro
new file mode 100644
index 00000000000..4799e72f56b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/Eyebrow.astro
@@ -0,0 +1,33 @@
+---
+interface Props {
+  color?: string;
+}
+const { color } = Astro.props;
+---
+
+<div class="alc-eyebrow" style={color ? `color:${color};` : undefined}>
+  <slot />
+</div>
+
+<style>
+  .alc-eyebrow {
+    font-family: var(--alc-font-mono);
+    font-size: 11px;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--alc-accent-deep);
+    font-weight: 500;
+  }
+  @media (max-width: 480px) {
+    .alc-eyebrow {
+      font-size: 9.5px;
+      letter-spacing: 0.08em;
+    }
+  }
+  @media (max-width: 360px) {
+    .alc-eyebrow {
+      font-size: 9px;
+      letter-spacing: 0.06em;
+    }
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/Footer.astro b/.repos/alchemy-effect/website/src/components/marketing/Footer.astro
new file mode 100644
index 00000000000..1ad1d672357
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/Footer.astro
@@ -0,0 +1,148 @@
+---
+import Logo from "./Logo.astro";
+
+interface FooterLink {
+  label: string;
+  href: string;
+}
+interface FooterCol {
+  h: string;
+  links: FooterLink[];
+}
+
+const cols: FooterCol[] = [
+  {
+    h: "Product",
+    links: [
+      { label: "Docs", href: "/getting-started" },
+      { label: "Tutorial", href: "/tutorial/part-1" },
+      // todo(sam): create an /examples landing page (or sidebar entry)
+      // and re-enable: { label: "Examples", href: "/examples" }
+      // todo(sam): create /providers/index.md that lists every provider
+      // (Starlight currently autogenerates the sidebar from the
+      // providers/ folder but there's no overview page to link to).
+      // Re-enable: { label: "Providers", href: "/providers" }
+      // todo(sam): wire a /changelog page that mirrors the GitHub
+      // releases / CHANGELOG.md (either fetch at build time or add a
+      // generator that drops a markdown file under content/docs).
+      // Re-enable: { label: "Changelog", href: "/changelog" }
+    ],
+  },
+  {
+    h: "Community",
+    links: [
+      { label: "Discord", href: "https://discord.gg/jwKw8dBJdN" },
+      { label: "GitHub", href: "https://github.com/alchemy-run/alchemy-effect" },
+      { label: "X / Twitter", href: "https://x.com/alchemy_run" },
+      { label: "Blog", href: "/blog" },
+      { label: "Privacy", href: "/privacy" },
+    ],
+  },
+  // todo(sam): write the comparison pages and re-enable this whole
+  // column. Suggested locations: /compare/pulumi, /compare/sst,
+  // /compare/terraform, /compare/cdk.
+  // {
+  //   h: "Compare",
+  //   links: [
+  //     { label: "vs Pulumi",    href: "/compare/pulumi" },
+  //     { label: "vs SST",       href: "/compare/sst" },
+  //     { label: "vs Terraform", href: "/compare/terraform" },
+  //     { label: "vs CDK",       href: "/compare/cdk" },
+  //   ],
+  // },
+];
+---
+
+<footer class="alc-footer">
+  <div class="alc-footer__grid">
+    <div>
+      <Logo />
+      <p class="alc-footer__tag">
+        Infrastructure as Effects. A single, type-safe TypeScript program for your cloud.
+      </p>
+      <div class="alc-footer__copy">Apache-2.0 · © 2026</div>
+    </div>
+    {cols.map((col) => (
+      <div>
+        <div class="alc-footer__heading">{col.h}</div>
+        <ul class="alc-footer__list">
+          {col.links.map((l) => (
+            <li><a href={l.href} class="alc-footer__link">{l.label}</a></li>
+          ))}
+        </ul>
+      </div>
+    ))}
+  </div>
+</footer>
+
+<style>
+  .alc-footer {
+    padding: 40px 32px;
+    border-top: 1px solid var(--alc-hairline);
+    background: var(--alc-bg-nav);
+  }
+  .alc-footer__grid {
+    max-width: 1152px;
+    margin: 0 auto;
+    display: grid;
+    grid-template-columns: 1.6fr repeat(3, minmax(0, 1fr));
+    gap: 40px;
+  }
+  @media (max-width: 880px) {
+    .alc-footer__grid {
+      grid-template-columns: 1fr 1fr 1fr;
+      gap: 28px 24px;
+    }
+    .alc-footer__grid > :first-child {
+      grid-column: 1 / -1;
+      max-width: 520px;
+    }
+  }
+  @media (max-width: 640px) {
+    .alc-footer { padding: 32px 20px; }
+    .alc-footer__grid {
+      grid-template-columns: 1fr 1fr;
+      gap: 24px 20px;
+    }
+  }
+  @media (max-width: 380px) {
+    .alc-footer__grid { grid-template-columns: 1fr; }
+  }
+  .alc-footer__tag {
+    font-family: var(--alc-font-sans);
+    font-size: 13px;
+    line-height: 1.6;
+    color: var(--alc-fg-3);
+    margin: 14px 0 0;
+  }
+  .alc-footer__copy {
+    margin-top: 16px;
+    font-family: var(--alc-font-mono);
+    font-size: 11px;
+    color: var(--alc-fg-4);
+  }
+  .alc-footer__heading {
+    font-family: var(--alc-font-mono);
+    font-size: 11px;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--alc-fg-4);
+    margin-bottom: 12px;
+  }
+  .alc-footer__list {
+    list-style: none;
+    padding: 0;
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+  }
+  .alc-footer__link {
+    text-decoration: none;
+    color: var(--alc-fg-2);
+    font-size: 13px;
+  }
+  .alc-footer__link:hover {
+    color: var(--alc-accent-deep);
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/HeadingOrnament.astro b/.repos/alchemy-effect/website/src/components/marketing/HeadingOrnament.astro
new file mode 100644
index 00000000000..62343a23a1b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/HeadingOrnament.astro
@@ -0,0 +1,92 @@
+---
+/**
+ * Tiny inline alchemical glyph used as a heading prefix/suffix flourish.
+ *
+ * Glyph vocabulary is drawn from Nicolas Lemery's Cours de chymie
+ * (1675/1757) and the broader 17th–18th c. alchemical alphabet — the
+ * same glyphs the Principia-era natural philosophers used. Sized to
+ * ~0.85em so it sits as a printer's mark next to the heading rather
+ * than competing with it.
+ */
+type Variant =
+  | "sol" // ☉ Gold / Sun — mastery, production, completion
+  | "sulphur" // 🜍 Sulphur — fixation, transformation, deploy
+  | "fleuron"; // printer's leaf flourish
+
+interface Props {
+  variant?: Variant;
+  position?: "prefix" | "suffix";
+  size?: string;
+  class?: string;
+}
+
+const {
+  variant = "sol",
+  position = "prefix",
+  size = "0.85em",
+  class: className,
+} = Astro.props;
+---
+
+<span
+  class:list={["alc-orn", `alc-orn--${position}`, className]}
+  style={`--alc-orn-size:${size};`}
+  aria-hidden="true"
+>
+  <svg
+    viewBox="0 0 24 24"
+    fill="none"
+    stroke="currentColor"
+    stroke-width="1.1"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  >
+    {variant === "sol" && (
+      <>
+        <circle cx="12" cy="12" r="6" />
+        <circle cx="12" cy="12" r="1.2" fill="var(--alc-accent-deep)" stroke="none" />
+      </>
+    )}
+    {variant === "sulphur" && (
+      <>
+        {/* upward triangle */}
+        <path d="M12 3 L19 15 L5 15 Z" />
+        {/* cross beneath */}
+        <path d="M12 15 V21 M9 18 H15" />
+      </>
+    )}
+    {variant === "fleuron" && (
+      <>
+        <path d="M12 7 L15 12 L12 17 L9 12 Z" />
+        <path d="M9 12 C 5 12, 3 10, 2.5 7.5" />
+        <path d="M15 12 C 19 12, 21 14, 21.5 16.5" />
+        <circle cx="12" cy="12" r="0.9" fill="var(--alc-accent-deep)" stroke="none" />
+      </>
+    )}
+  </svg>
+</span>
+
+<style>
+  .alc-orn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: var(--alc-orn-size, 0.85em);
+    height: var(--alc-orn-size, 0.85em);
+    vertical-align: -0.08em;
+    color: var(--alc-fg-3);
+    opacity: 0.55;
+    flex: none;
+  }
+  .alc-orn--prefix {
+    margin-right: 0.5em;
+  }
+  .alc-orn--suffix {
+    margin-left: 0.5em;
+  }
+  .alc-orn svg {
+    width: 100%;
+    height: 100%;
+    display: block;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/HeroBgGraph.astro b/.repos/alchemy-effect/website/src/components/marketing/HeroBgGraph.astro
new file mode 100644
index 00000000000..dcdf463de73
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/HeroBgGraph.astro
@@ -0,0 +1,468 @@
+---
+/**
+ * Animated mandala background for the hero — endless lotus zoom
+ * emanating from the Yantra's bindu (center dot).
+ *
+ * The vanishing point is measured at runtime from the element matched
+ * by `center` (default `.alc-hero__mark`), so the animation truly
+ * radiates from the brand mark's dot rather than the canvas geometric
+ * center. The same coordinates are pushed back to CSS as `--alc-bg-cx`
+ * / `--alc-bg-cy` so the mask feather follows.
+ *
+ * Multiple stylistic variants live in this file. The active one is
+ * picked by the `?variant=N` query string (default 1) so we can A/B
+ * compare on the live page without editing the MDX.
+ *
+ * Only variant 1 is exposed: concentric rings + radial vesica arcs
+ * blooming back toward the bindu. The trippy/subtle baseline.
+ *
+ * Variant 2 is kept in this file as a backup (Sri-Yantra-style lotus
+ * petals from the canonical TikZ construction) but is intentionally
+ * not toggleable via `?variant=` — flip the dispatch in `draw()`
+ * manually to revisit it.
+ */
+
+interface Props {
+  /** CSS selector for the element whose center the animation emanates from. */
+  center?: string;
+  /** Stroke color. */
+  color?: string;
+  /** Multiplier on stroke alpha (0..1). */
+  intensity?: number;
+  /** Number of concurrent layers. */
+  count?: number;
+  /** Zoom rate. ~0.06 = one octave of growth per ~16s. */
+  zoom?: number;
+  /** Default variant number when no `?variant=` query is present.
+   * Only `1` is exposed in the public API; variant 2 is kept in the
+   * file as a backup but isn't toggleable from a query string. */
+  variant?: 1;
+}
+
+const {
+  center = ".alc-hero__mark",
+  color = "var(--alc-fg-1)",
+  intensity = 1,
+  count = 10,
+  zoom = 0.025,
+  variant = 1,
+} = Astro.props;
+---
+
+<canvas
+  class="alc-hero__bg-graph"
+  data-variant={variant}
+  data-center={center}
+  data-intensity={intensity}
+  data-count={count}
+  data-zoom={zoom}
+  style={`color: ${color};`}
+  aria-hidden="true"
+></canvas>
+
+<script>
+  /* eslint-disable */
+
+  const init = (canvas: HTMLCanvasElement) => {
+    const ctx = canvas.getContext("2d", { alpha: true });
+    if (!ctx) return;
+
+    const variant: number = Number(canvas.dataset.variant ?? 1);
+
+    const centerSel = canvas.dataset.center ?? ".alc-hero__mark";
+    const intensity = Number(canvas.dataset.intensity ?? 1);
+    const nLayers = Math.max(1, Number(canvas.dataset.count ?? 10));
+    const zoom = Number(canvas.dataset.zoom ?? 0.06);
+    const motionMq = window.matchMedia("(prefers-reduced-motion: reduce)");
+    let reduced = motionMq.matches;
+
+    let dpr = Math.min(window.devicePixelRatio || 1, 2);
+    let width = 0;
+    let height = 0;
+    /** Vanishing point in canvas-local CSS pixels. Updated by `resize`. */
+    let cx0 = 0;
+    let cy0 = 0;
+
+    const centerEl =
+      (centerSel && (document.querySelector(centerSel) as HTMLElement | null)) ||
+      null;
+
+    const measureCenter = () => {
+      if (centerEl) {
+        const heroRect = canvas.getBoundingClientRect();
+        const markRect = centerEl.getBoundingClientRect();
+        cx0 = markRect.left + markRect.width / 2 - heroRect.left;
+        cy0 = markRect.top + markRect.height / 2 - heroRect.top;
+        canvas.style.setProperty("--alc-bg-cx", `${cx0.toFixed(2)}px`);
+        canvas.style.setProperty("--alc-bg-cy", `${cy0.toFixed(2)}px`);
+      } else {
+        cx0 = width / 2;
+        cy0 = height / 2;
+      }
+    };
+
+    const resize = (): boolean => {
+      const rect = canvas.getBoundingClientRect();
+      const newW = rect.width;
+      const newH = rect.height;
+      const newDpr = Math.min(window.devicePixelRatio || 1, 2);
+      // iOS Safari fires `resize` continuously as the URL bar collapses
+      // / expands during scroll. Reassigning `canvas.width`/`height`
+      // wipes the bitmap *even when set to the same value*, which
+      // shows up as the mandala flashing every time you swipe. Skip
+      // when nothing actually changed; only the centerline (handled
+      // separately via ResizeObserver) needs to update on scroll.
+      if (newW === width && newH === height && newDpr === dpr) {
+        return false;
+      }
+      width = newW;
+      height = newH;
+      dpr = newDpr;
+      canvas.width = Math.round(width * dpr);
+      canvas.height = Math.round(height * dpr);
+      ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+      measureCenter();
+      return true;
+    };
+
+    const resolveRGB = (): [number, number, number] => {
+      const rgb = getComputedStyle(canvas).color;
+      const m = rgb.match(/\d+(\.\d+)?/g);
+      if (!m) return [0, 0, 0];
+      return [Number(m[0]), Number(m[1]), Number(m[2])];
+    };
+
+    let rgb = resolveRGB();
+    const rgba = (a: number) =>
+      `rgba(${rgb[0]},${rgb[1]},${rgb[2]},${a.toFixed(3)})`;
+
+    /** Tiny bindu marker — drawn for every variant so the dot visually
+     * sources the emanation. */
+    const drawBindu = () => {
+      ctx.fillStyle = rgba(0.55 * intensity);
+      ctx.beginPath();
+      ctx.arc(cx0, cy0, 1.8, 0, Math.PI * 2);
+      ctx.fill();
+    };
+
+    // ============================================================
+    // Variant 1 — concentric rings + radial vesica arcs (original)
+    // ============================================================
+
+    /** Petal count per ring index. Grows outward so outer rings bloom
+     * into more detail while inner rings stay restful. */
+    const petalsAtRing = (i: number) => {
+      const seq = [6, 8, 12, 16, 18, 20, 24, 28, 32, 36, 40];
+      return seq[Math.min(i, seq.length - 1)];
+    };
+
+    const drawV1 = (t: number) => {
+      const minR = Math.max(width, height) * 0.02;
+      const maxR = Math.max(width, height) * 0.95;
+      const logRange = Math.log(maxR / minR);
+      const clock = ((t * 0.001 * zoom) % 1 + 1) % 1;
+      const tSec = t * 0.001;
+
+      drawBindu();
+
+      ctx.lineWidth = 1;
+      const cap = 0.32 * intensity;
+
+      for (let i = 0; i < nLayers; i++) {
+        const phase = (i / nLayers + clock) % 1;
+        const r = minR * Math.exp(phase * logRange);
+        const fade = Math.pow(Math.sin(phase * Math.PI), 1.2);
+        const a = cap * fade;
+        if (a < 0.01) continue;
+
+        // Very slow uniform drift — adjacent rings counter-rotate,
+        // but at the same gentle rate (no per-ring parallax speed-up).
+        // ~1 revolution per ~3 minutes.
+        const spin = tSec * 0.035 * (i % 2 === 0 ? 1 : -1);
+
+        // Concentric ring.
+        ctx.strokeStyle = rgba(a * 0.85);
+        ctx.beginPath();
+        ctx.arc(cx0, cy0, r, 0, Math.PI * 2);
+        ctx.stroke();
+
+        // Radial petal arcs — small arcs centered on points around the
+        // ring, drawing a vesica-like bloom. Arc radius scales with
+        // the ring radius so they read as part of the same petal.
+        const k = petalsAtRing(i);
+        const petalR = r * 0.35;
+        const petalSweep = Math.PI * 0.55;
+        ctx.strokeStyle = rgba(a * 0.65);
+        for (let p = 0; p < k; p++) {
+          const ang = spin + (p * 2 * Math.PI) / k;
+          const px = cx0 + Math.cos(ang) * r;
+          const py = cy0 + Math.sin(ang) * r;
+          // Arc faces back toward the bindu so each petal forms a leaf
+          // pointing outward.
+          ctx.beginPath();
+          ctx.arc(
+            px,
+            py,
+            petalR,
+            ang + Math.PI - petalSweep / 2,
+            ang + Math.PI + petalSweep / 2,
+          );
+          ctx.stroke();
+        }
+      }
+    };
+
+    // ============================================================
+    // Variant 2 (backup, not query-string toggleable) — Sri Yantra
+    // lotus rim built from the canonical TikZ construction
+    // (bhaskatripathi/SriYantra). Two cubic Beziers per side + an
+    // arc base on the inner circle, so the petal silhouette has a
+    // smooth scalloped base and a single sharp tip on the outer
+    // circle. Petal-band aspect (r1/r0 = 1.2) is decoupled from the
+    // inter-layer log spacing.
+    // ============================================================
+
+    /** Stroke a single canonical lotus petal — the TikZ Sri Yantra
+     * construction.
+     *
+     * The petal occupies angular span `[theta - halfAngle, theta +
+     * halfAngle]` on the inner circle (radius `r0`). Its tip sits on
+     * the outer circle (radius `r1`) at the petal's center angle
+     * `theta`. Two cubic Beziers form the upward + downward sides;
+     * the base is a circular arc along `r0` between the two anchor
+     * points, so neighbors share an arc segment (not a single point)
+     * — that's what gives the silhouette a smooth, rounded base
+     * rather than the spiky triangle we had before.
+     *
+     * Control radii / angular offsets follow the proportions used in
+     * the bhaskatripathi/SriYantra LaTeX source (8-petal: anchors
+     * 45° apart, controls at ±5° / ±17.5° at radii 0.7·len /
+     * 0.5·len above the inner circle). Generalized here to any
+     * petal count. */
+    const strokeLotusPetal = (
+      theta: number,
+      r0: number,
+      r1: number,
+      halfAngle: number,
+    ) => {
+      const len = r1 - r0;
+
+      // Anchor points where the petal meets the inner circle.
+      const startAng = theta + halfAngle;
+      const endAng = theta - halfAngle;
+      const sx = cx0 + Math.cos(startAng) * r0;
+      const sy = cy0 + Math.sin(startAng) * r0;
+      const ex = cx0 + Math.cos(endAng) * r0;
+      const ey = cy0 + Math.sin(endAng) * r0;
+
+      // Tip on the outer circle.
+      const tx = cx0 + Math.cos(theta) * r1;
+      const ty = cy0 + Math.sin(theta) * r1;
+
+      // First cubic: from start anchor up to the tip. Two controls
+      // bow the curve up + sideways before pinching back to the tip.
+      const c1Ang = theta + halfAngle * (7 / 9);
+      const c1R = r0 + 0.7 * len;
+      const c1x = cx0 + Math.cos(c1Ang) * c1R;
+      const c1y = cy0 + Math.sin(c1Ang) * c1R;
+
+      const c2Ang = theta + halfAngle * (2 / 9);
+      const c2R = r0 + 0.5 * len;
+      const c2x = cx0 + Math.cos(c2Ang) * c2R;
+      const c2y = cy0 + Math.sin(c2Ang) * c2R;
+
+      // Second cubic (mirror): tip down to end anchor.
+      const c3Ang = theta - halfAngle * (2 / 9);
+      const c3R = r0 + 0.5 * len;
+      const c3x = cx0 + Math.cos(c3Ang) * c3R;
+      const c3y = cy0 + Math.sin(c3Ang) * c3R;
+
+      const c4Ang = theta - halfAngle * (7 / 9);
+      const c4R = r0 + 0.7 * len;
+      const c4x = cx0 + Math.cos(c4Ang) * c4R;
+      const c4y = cy0 + Math.sin(c4Ang) * c4R;
+
+      ctx.beginPath();
+      ctx.moveTo(sx, sy);
+      ctx.bezierCurveTo(c1x, c1y, c2x, c2y, tx, ty);
+      ctx.bezierCurveTo(c3x, c3y, c4x, c4y, ex, ey);
+      // Close the base with an arc along the inner circle from the
+      // end anchor back to the start anchor (anticlockwise=true in
+      // canvas coords traces the short arc from endAng up to
+      // startAng).
+      ctx.arc(cx0, cy0, r0, endAng, startAng, true);
+      ctx.closePath();
+      ctx.stroke();
+    };
+
+    const drawV2 = (t: number) => {
+      const minR = Math.max(width, height) * 0.015;
+      const maxR = Math.max(width, height) * 1.0;
+      const logRange = Math.log(maxR / minR);
+      // Petal-band aspect (`r1/r0`) is decoupled from inter-layer
+      // spacing — the LaTeX reference uses 1.2 for nice wide petals.
+      const petalRatio = 1.2;
+      const clock = ((t * 0.001 * zoom) % 1 + 1) % 1;
+      const tSec = t * 0.001;
+
+      drawBindu();
+
+      const cap = 0.5 * intensity;
+
+      for (let i = 0; i < nLayers; i++) {
+        const phase = (i / nLayers + clock) % 1;
+        const r0 = minR * Math.exp(phase * logRange);
+        const r1 = r0 * petalRatio;
+        // Asymmetric envelope: quick fade-in near the bindu, then a
+        // steep (1−phase)^2 falloff so outer layers dissolve faster
+        // than they grow.
+        const fadeIn = Math.min(1, phase / 0.12);
+        const fadeOut = Math.pow(1 - phase, 1.8);
+        const fade = fadeIn * fadeOut;
+        const a = cap * fade;
+        if (a < 0.01) continue;
+
+        const spinScale = 0.06 / Math.max(0.06, phase + 0.05);
+        const spin = tSec * spinScale * (i % 2 === 0 ? 1 : -1);
+
+        // Bounding circles for this lotus rim — faint so the petal
+        // silhouettes dominate (matches the block-print reference).
+        ctx.lineWidth = 1;
+        ctx.strokeStyle = rgba(a * 0.4);
+        ctx.beginPath();
+        ctx.arc(cx0, cy0, r0, 0, Math.PI * 2);
+        ctx.stroke();
+        ctx.beginPath();
+        ctx.arc(cx0, cy0, r1, 0, Math.PI * 2);
+        ctx.stroke();
+
+        const k = 8;
+        const halfAngle = Math.PI / k;
+
+        ctx.lineWidth = 1.05;
+        ctx.strokeStyle = rgba(a * 0.9);
+        for (let p = 0; p < k; p++) {
+          const ang = spin + (p * 2 * Math.PI) / k;
+          strokeLotusPetal(ang, r0, r1, halfAngle);
+        }
+      }
+    };
+
+    // ============================================================
+    // Frame loop
+    // ============================================================
+
+    const draw = (t: number) => {
+      ctx.clearRect(0, 0, width, height);
+      // Variant 2 (`drawV2`) is intentionally unreachable from the
+      // public API — uncomment the case below to revisit it.
+      void drawV2;
+      switch (variant) {
+        case 1:
+        default:
+          drawV1(t);
+          break;
+      }
+    };
+
+    let raf = 0;
+    let visible = true;
+    const loop = (t: number) => {
+      draw(t);
+      if (visible && !reduced) raf = requestAnimationFrame(loop);
+    };
+
+    resize();
+    if (reduced) {
+      draw(0);
+    } else {
+      raf = requestAnimationFrame(loop);
+    }
+
+    let resizeQueued = false;
+    const onResize = () => {
+      if (resizeQueued) return;
+      resizeQueued = true;
+      requestAnimationFrame(() => {
+        resizeQueued = false;
+        const changed = resize();
+        rgb = resolveRGB();
+        // In reduced-motion mode the RAF loop is stopped, so when the
+        // canvas was actually resized we need to explicitly redraw the
+        // static frame. If `resize()` no-op'd (mobile URL-bar wiggle
+        // with unchanged dimensions) we don't need to redraw at all.
+        if (reduced && changed) draw(0);
+      });
+    };
+    window.addEventListener("resize", onResize, { passive: true });
+
+    // The stroke color is derived from `getComputedStyle(canvas).color`,
+    // which resolves `var(--alc-fg-1)` against the current theme. When
+    // the user toggles light/dark mid-session the cached `rgb` would
+    // otherwise stay frozen on the previous theme until the next resize
+    // — observable as a flash of stale-color strokes after the theme
+    // switch. Re-resolve whenever `<html data-theme>` changes.
+    const themeObs = new MutationObserver(() => {
+      rgb = resolveRGB();
+      if (reduced) draw(0);
+    });
+    themeObs.observe(document.documentElement, {
+      attributes: true,
+      attributeFilter: ["data-theme"],
+    });
+
+    // Honor live changes to the user's `prefers-reduced-motion` setting.
+    // When the user enables reduced motion mid-session, stop the loop and
+    // hold a static frame; when they disable it, resume the animation.
+    const onMotionChange = (e: MediaQueryListEvent) => {
+      reduced = e.matches;
+      cancelAnimationFrame(raf);
+      if (reduced) {
+        draw(0);
+      } else if (visible) {
+        raf = requestAnimationFrame(loop);
+      }
+    };
+    motionMq.addEventListener("change", onMotionChange);
+
+    if (centerEl && typeof ResizeObserver !== "undefined") {
+      const ro = new ResizeObserver(() => {
+        measureCenter();
+        if (reduced) draw(0);
+      });
+      ro.observe(centerEl);
+      const hero = canvas.parentElement;
+      if (hero) ro.observe(hero);
+    }
+
+    const io = new IntersectionObserver(
+      (entries) => {
+        const wasVisible = visible;
+        visible = entries[0]?.isIntersecting ?? true;
+        if (visible && !wasVisible) {
+          // Restart the loop when the canvas scrolls back into view, or
+          // — in reduced-motion mode — redraw the single static frame
+          // (it may have been cleared / sized while off-screen).
+          if (reduced) draw(0);
+          else raf = requestAnimationFrame(loop);
+        } else if (!visible) {
+          cancelAnimationFrame(raf);
+        }
+      },
+      { threshold: 0 },
+    );
+    io.observe(canvas);
+  };
+
+  const start = () => {
+    document
+      .querySelectorAll<HTMLCanvasElement>("canvas.alc-hero__bg-graph")
+      .forEach(init);
+  };
+
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", start, { once: true });
+  } else {
+    start();
+  }
+</script>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/Logo.astro b/.repos/alchemy-effect/website/src/components/marketing/Logo.astro
new file mode 100644
index 00000000000..23d226cc906
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/Logo.astro
@@ -0,0 +1,46 @@
+---
+import Yantra from "../../brand/Yantra.astro";
+
+interface Props {
+  size?: number;
+}
+const { size = 22 } = Astro.props;
+// The yantra reads best when sized roughly to the cap-height of the
+// accompanying wordmark — slightly larger than the old solid dot so the
+// inner triangle stays legible.
+const markSize = Math.round(size * 0.95);
+---
+
+<span class="alc-logo">
+  <Yantra
+    class="alc-logo__mark"
+    size={markSize}
+    stroke="var(--alc-accent-deep)"
+    dot="var(--alc-accent-deep)"
+    useCurrentColor={false}
+  />
+  <span class="alc-logo__word" style={`font-size:${size}px;`}>Alchemy</span>
+</span>
+
+<style>
+  .alc-logo {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+  }
+  .alc-logo__mark {
+    display: inline-flex;
+    align-items: center;
+    color: var(--alc-accent-deep);
+  }
+  .alc-logo__mark :global(svg) {
+    display: block;
+  }
+  .alc-logo__word {
+    font-family: var(--alc-font-serif);
+    font-style: italic;
+    font-weight: 500;
+    color: var(--alc-fg-1);
+    letter-spacing: -0.01em;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/Nav.astro b/.repos/alchemy-effect/website/src/components/marketing/Nav.astro
new file mode 100644
index 00000000000..43b72b72093
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/Nav.astro
@@ -0,0 +1,389 @@
+---
+import Search from "@astrojs/starlight/components/Search.astro";
+import Logo from "./Logo.astro";
+---
+
+<nav class="alc-nav">
+  <a href="/" class="alc-nav__brand">
+    <Logo />
+  </a>
+
+  <div class="alc-nav__spacer"></div>
+  <div class="alc-nav__search">
+    <Search />
+  </div>
+  <a href="/getting-started" class="alc-nav__link">Docs</a>
+  <a href="/blog" class="alc-nav__link">Blog</a>
+  <a
+    href="https://github.com/alchemy-run/alchemy-effect"
+    class="alc-nav__link alc-nav__link--icon"
+    aria-label="GitHub"
+  >
+    <svg aria-hidden width="18" height="18" viewBox="0 0 24 24" fill="currentColor">
+      <path
+        d="M12 .5C5.73.5.5 5.73.5 12c0 5.08 3.29 9.39 7.86 10.91.58.1.79-.25.79-.56 0-.28-.01-1.02-.02-2-3.2.69-3.88-1.54-3.88-1.54-.52-1.33-1.28-1.69-1.28-1.69-1.05-.72.08-.71.08-.71 1.16.08 1.77 1.19 1.77 1.19 1.03 1.77 2.71 1.26 3.37.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.69 0-1.26.45-2.29 1.19-3.1-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.18 1.18a11.04 11.04 0 0 1 5.79 0c2.21-1.49 3.18-1.18 3.18-1.18.63 1.59.23 2.76.11 3.05.74.81 1.19 1.84 1.19 3.1 0 4.42-2.69 5.39-5.25 5.68.41.36.78 1.07.78 2.16 0 1.56-.01 2.81-.01 3.19 0 .31.21.67.8.56C20.71 21.39 24 17.08 24 12 24 5.73 18.27.5 12 .5z"
+      ></path>
+    </svg>
+    <span class="alc-nav__link-text">GitHub</span>
+  </a>
+  <a
+    href="https://discord.gg/jwKw8dBJdN"
+    class="alc-nav__link alc-nav__link--icon"
+    aria-label="Discord"
+  >
+    <svg aria-hidden width="18" height="18" viewBox="0 0 24 24" fill="currentColor">
+      <path
+        d="M20.317 4.369A19.79 19.79 0 0 0 16.558 3.2a.075.075 0 0 0-.079.037c-.34.6-.717 1.384-.98 2-1.797-.27-3.583-.27-5.342 0-.263-.63-.654-1.4-.997-2A.077.077 0 0 0 9.08 3.2a19.736 19.736 0 0 0-3.76 1.169.07.07 0 0 0-.032.027C1.533 9.046.6 13.58 1.057 18.058a.082.082 0 0 0 .031.056 19.9 19.9 0 0 0 5.993 3.029.077.077 0 0 0 .084-.027c.462-.63.873-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.108 13.108 0 0 1-1.872-.892.077.077 0 0 1-.008-.128c.126-.094.252-.192.372-.291a.074.074 0 0 1 .077-.01c3.927 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.099.246.197.373.291a.077.077 0 0 1-.006.128 12.3 12.3 0 0 1-1.873.892.077.077 0 0 0-.04.106c.36.699.772 1.364 1.225 1.994a.076.076 0 0 0 .084.028 19.84 19.84 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.548-13.66a.061.061 0 0 0-.031-.029ZM8.02 15.331c-1.183 0-2.157-1.085-2.157-2.42 0-1.333.956-2.418 2.157-2.418 1.21 0 2.176 1.094 2.157 2.418 0 1.335-.956 2.42-2.157 2.42Zm7.974 0c-1.183 0-2.157-1.085-2.157-2.42 0-1.333.955-2.418 2.157-2.418 1.21 0 2.176 1.094 2.157 2.418 0 1.335-.946 2.42-2.157 2.42Z"
+      ></path>
+    </svg>
+    <span class="alc-nav__link-text">Discord</span>
+  </a>
+  <button
+    type="button"
+    class="alc-nav__theme-toggle"
+    aria-label="Toggle color theme"
+    title="Toggle color theme"
+    data-theme-toggle
+  >
+    {/* Sun — shown in dark mode (click → light) */}
+    <svg
+      class="alc-theme-icon alc-theme-icon--sun"
+      aria-hidden="true"
+      width="18"
+      height="18"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      stroke-width="1.75"
+      stroke-linecap="round"
+      stroke-linejoin="round"
+    >
+      <circle cx="12" cy="12" r="4"></circle>
+      <path
+        d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M4.93 19.07l1.41-1.41M17.66 6.34l1.41-1.41"
+      ></path>
+    </svg>
+    {/* Moon — shown in light mode (click → dark) */}
+    <svg
+      class="alc-theme-icon alc-theme-icon--moon"
+      aria-hidden="true"
+      width="18"
+      height="18"
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      stroke-width="1.75"
+      stroke-linecap="round"
+      stroke-linejoin="round"
+    >
+      <path d="M21 12.79A9 9 0 1 1 11.21 3a7 7 0 0 0 9.79 9.79z"></path>
+    </svg>
+  </button>
+</nav>
+
+<style>
+  .alc-nav,
+  .alc-nav * {
+    box-sizing: border-box;
+  }
+  .alc-nav {
+    height: 100%;
+    display: flex;
+    align-items: center;
+    gap: 24px;
+  }
+  .alc-nav__brand {
+    text-decoration: none;
+  }
+  .alc-nav__spacer {
+    flex: 1;
+  }
+  .alc-nav__search {
+    display: flex;
+    align-items: center;
+    width: 220px;
+  }
+  .alc-nav__search :global(site-search) {
+    display: block;
+    width: 100%;
+  }
+  .alc-nav__search :global(button[data-open-modal]) {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    width: 100%;
+    height: 32px;
+    padding: 0 8px 0 12px;
+    background: var(--alc-bg);
+    border: 1px solid var(--alc-hairline-2);
+    border-radius: 8px;
+    font-size: 12px;
+    color: var(--alc-fg-4);
+    cursor: pointer;
+    font-family: inherit;
+  }
+  .alc-nav__search :global(button[data-open-modal]:hover) {
+    border-color: var(--alc-fg-4);
+    color: var(--alc-fg-2);
+  }
+  .alc-nav__search :global(button[data-open-modal] svg) {
+    width: 14px;
+    height: 14px;
+    flex-shrink: 0;
+  }
+  .alc-nav__search :global(button[data-open-modal] > :last-child) {
+    margin-inline-start: auto;
+  }
+  .alc-nav__search :global(button[data-open-modal] kbd) {
+    display: inline-flex;
+    align-items: center;
+    gap: 2px;
+    background: transparent;
+    border: 0;
+    padding: 0;
+    font-family: var(--alc-font-mono);
+    font-size: 11px;
+    color: var(--alc-fg-2);
+  }
+  .alc-nav__search :global(button[data-open-modal] kbd kbd) {
+    background: var(--alc-bg-elev-1);
+    border: 1px solid var(--alc-hairline-2);
+    border-radius: 4px;
+    padding: 1px 5px;
+  }
+  .alc-nav__theme-toggle {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    height: 32px;
+    padding: 0;
+    border: 1px solid var(--alc-hairline-2);
+    border-radius: 8px;
+    background: transparent;
+    color: var(--alc-fg-2);
+    cursor: pointer;
+    font: inherit;
+    transition:
+      color var(--alc-dur) var(--alc-ease),
+      border-color var(--alc-dur) var(--alc-ease),
+      background-color var(--alc-dur) var(--alc-ease);
+  }
+  .alc-nav__theme-toggle:hover {
+    color: var(--alc-accent-deep);
+    border-color: var(--alc-accent-40);
+    background: var(--alc-bg-elev-1);
+  }
+  .alc-nav__theme-toggle:focus-visible {
+    outline: 2px solid var(--alc-accent-40);
+    outline-offset: 2px;
+  }
+  .alc-theme-icon {
+    display: block;
+  }
+  /* Show one icon per mode. Default (no [data-theme] yet, before pre-paint
+     script runs) shows the moon — matches the historical light bias. */
+  .alc-theme-icon--sun { display: none; }
+  :global([data-theme="dark"]) .alc-theme-icon--sun { display: block; }
+  :global([data-theme="dark"]) .alc-theme-icon--moon { display: none; }
+  .alc-nav__link {
+    color: var(--alc-fg-2);
+    text-decoration: none;
+    font-size: 14px;
+  }
+  .alc-nav__link:hover {
+    color: var(--alc-accent-deep);
+  }
+  .alc-nav__link--icon {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+  }
+
+  @media (max-width: 880px) {
+    .alc-nav__search {
+      display: none;
+    }
+    .alc-nav__link--icon .alc-nav__link-text {
+      display: none;
+    }
+  }
+  @media (max-width: 640px) {
+    .alc-nav { gap: 16px; }
+  }
+</style>
+
+<style is:global>
+  /*
+   * Starlight's Search dialog is rendered in the top layer (outside any
+   * scoped style boundary) and relies on Starlight tokens / utility classes
+   * (`--sl-color-*`, `sl-hidden`, `md:sl-hidden`) that are not loaded on
+   * marketing pages. We map the missing Starlight color tokens onto our
+   * parchment palette inside the search dialog so Starlight's own Pagefind
+   * styling (page icon, sub-result tree connector, focus rings, etc.)
+   * "just works" on every page.
+   */
+  site-search {
+    /* Starlight color tokens, mapped to our palette. Scoped to site-search
+       so docs pages keep their existing Starlight theme untouched. */
+    --sl-color-white: var(--alc-fg-1);
+    --sl-color-text: var(--alc-fg-1);
+    --sl-color-text-accent: var(--alc-accent-deep);
+    --sl-color-accent: var(--alc-accent);
+    --sl-color-accent-high: var(--alc-accent-deep);
+    --sl-color-accent-low: var(--alc-accent-12);
+    --sl-color-gray-1: var(--alc-fg-1);
+    --sl-color-gray-2: var(--alc-fg-2);
+    --sl-color-gray-3: var(--alc-fg-3);
+    --sl-color-gray-4: var(--alc-fg-4);
+    --sl-color-gray-5: var(--alc-hairline-2);
+    --sl-color-gray-6: var(--alc-bg-sunk);
+    --sl-color-black: var(--alc-bg-elev-1);
+    --sl-color-backdrop-overlay: rgba(42, 38, 32, 0.35);
+    --sl-shadow-lg: 0 24px 64px rgba(42, 38, 32, 0.25);
+    --__sl-font: var(--alc-font-sans);
+  }
+
+  site-search dialog {
+    color: var(--alc-fg-2);
+    border-radius: 12px;
+    font-family: var(--alc-font-sans);
+  }
+  site-search dialog::backdrop {
+    -webkit-backdrop-filter: blur(6px);
+    backdrop-filter: blur(6px);
+  }
+
+  /* Hide the mobile-only Cancel button on desktop. Starlight uses
+     `md:sl-hidden` for this but the utility CSS isn't loaded on the
+     marketing pages, so it otherwise leaks into the input on desktop. */
+  site-search button[data-close-modal] {
+    display: none;
+    font-family: var(--alc-font-sans);
+  }
+  @media (max-width: 50rem) {
+    site-search button[data-close-modal] {
+      display: inline-flex;
+    }
+  }
+
+  /* ── Pagefind UI re-skin (Effect-style result cards) ────────────────── */
+  site-search #starlight__search {
+    --pagefind-ui-primary: var(--alc-fg-1);
+    --pagefind-ui-text: var(--alc-fg-2);
+    --pagefind-ui-background: var(--alc-bg-sunk);
+    --pagefind-ui-border: var(--alc-hairline-2);
+    --pagefind-ui-tag: var(--alc-bg-sunk);
+    --pagefind-ui-border-width: 1px;
+    --pagefind-ui-font: var(--alc-font-sans);
+    --pagefind-ui-scale: 0.85;
+  }
+  /* Search input — sits on a slightly sunk surface so the white result
+     cards beneath it have something to pop against. */
+  site-search #starlight__search .pagefind-ui__form {
+    border-bottom: 1px solid var(--alc-hairline-2);
+    padding-bottom: 0.75rem;
+    margin-bottom: 0.25rem;
+  }
+  site-search #starlight__search .pagefind-ui__search-input {
+    color: var(--alc-fg-1);
+    background: var(--alc-bg-elev-1);
+    font-family: var(--alc-font-sans);
+    border: 1px solid var(--alc-hairline-2);
+    border-radius: 8px;
+  }
+  site-search #starlight__search input:focus {
+    --pagefind-ui-border: var(--alc-accent);
+    box-shadow: 0 0 0 3px var(--alc-accent-12);
+  }
+  site-search #starlight__search .pagefind-ui__message {
+    color: var(--alc-fg-3);
+    font-weight: 500;
+    padding-block: 0.5rem;
+  }
+
+  /* Each "result" = a page = a white elevated card. */
+  site-search #starlight__search .pagefind-ui__results {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+  }
+  site-search #starlight__search .pagefind-ui__results > * + * {
+    margin-top: 0;
+  }
+  site-search #starlight__search .pagefind-ui__result {
+    background: var(--alc-bg-elev-1);
+    border: 1px solid var(--alc-hairline);
+    border-radius: 10px;
+    box-shadow: 0 1px 2px rgba(42, 38, 32, 0.04);
+    overflow: hidden;
+  }
+  site-search #starlight__search .pagefind-ui__result-inner {
+    background: transparent;
+  }
+  /* Top-level page row + sub-result rows share the same elevated card,
+     so we drop the per-row backgrounds Starlight applies. */
+  site-search
+    #starlight__search
+    .pagefind-ui__result-title:not(:where(.pagefind-ui__result-nested *)),
+  site-search #starlight__search .pagefind-ui__result-nested {
+    background: transparent;
+  }
+  /* Hover/focus highlight — soft accent tint instead of a hard outline. */
+  site-search
+    #starlight__search
+    .pagefind-ui__result-title:not(:where(.pagefind-ui__result-nested *)):hover,
+  site-search #starlight__search .pagefind-ui__result-nested:hover,
+  site-search
+    #starlight__search
+    .pagefind-ui__result-title:not(
+      :where(.pagefind-ui__result-nested *)
+    ):focus-within,
+  site-search #starlight__search .pagefind-ui__result-nested:focus-within {
+    outline: none;
+    background: var(--alc-accent-12);
+  }
+
+  site-search #starlight__search .pagefind-ui__result-link {
+    --pagefind-ui-text: var(--alc-fg-1);
+    color: var(--alc-fg-1);
+    font-weight: 700;
+    font-size: 1rem;
+  }
+  site-search #starlight__search .pagefind-ui__result-excerpt {
+    color: var(--alc-fg-3);
+    font-size: 0.9rem;
+    line-height: 1.55;
+    margin-top: 0.25rem;
+  }
+  site-search #starlight__search mark {
+    color: var(--alc-accent-deep);
+    background: transparent;
+    font-weight: 700;
+  }
+  /* Page / tree icons recolored to fit parchment. */
+  site-search #starlight__search .pagefind-ui__result-title::before {
+    background: var(--alc-fg-4) !important;
+  }
+  site-search #starlight__search .pagefind-ui__result-nested::before {
+    background: var(--alc-hairline-3) !important;
+  }
+</style>
+
+<script is:inline>
+  (() => {
+    const button = document.querySelector("[data-theme-toggle]");
+    if (!button) return;
+    const STORAGE_KEY = "starlight-theme";
+    button.addEventListener("click", () => {
+      const current = document.documentElement.dataset.theme === "dark"
+        ? "dark"
+        : "light";
+      const next = current === "dark" ? "light" : "dark";
+      document.documentElement.dataset.theme = next;
+      try {
+        localStorage.setItem(STORAGE_KEY, next);
+      } catch {}
+    });
+  })();
+</script>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/PageHero.astro b/.repos/alchemy-effect/website/src/components/marketing/PageHero.astro
new file mode 100644
index 00000000000..60022979c8b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/PageHero.astro
@@ -0,0 +1,67 @@
+---
+interface Props {
+  eyebrow: string;
+  title: string;
+  highlight?: string;
+  description?: string;
+}
+const { eyebrow, title, highlight, description } = Astro.props;
+---
+
+<div class="page-hero">
+  <div class="page-hero__inner">
+    <div class="page-hero__eyebrow">{eyebrow}</div>
+    <h1 class="page-hero__title">
+      {highlight && <span class="page-hero__highlight">{highlight}</span>}
+      {highlight && " "}
+      {title}
+    </h1>
+    {description && <p class="page-hero__desc">{description}</p>}
+    <div class="page-hero__cta"><slot name="cta" /></div>
+  </div>
+</div>
+
+<style>
+  .page-hero {
+    text-align: center;
+    padding: 8px 0 8px;
+  }
+  .page-hero__inner {
+    max-width: 760px;
+    margin: 0 auto;
+  }
+  .page-hero__eyebrow {
+    font-family: var(--alc-font-mono);
+    font-size: 11px;
+    letter-spacing: 0.14em;
+    text-transform: uppercase;
+    color: var(--alc-accent-deep);
+    font-weight: 500;
+  }
+  .page-hero__title {
+    font-family: var(--alc-font-serif);
+    font-weight: 500;
+    font-size: 56px;
+    line-height: 1.06;
+    letter-spacing: -0.02em;
+    margin: 18px 0 18px;
+    color: var(--alc-fg-1);
+  }
+  .page-hero__highlight {
+    color: var(--alc-accent-deep);
+    font-style: italic;
+  }
+  .page-hero__desc {
+    font-size: 17px;
+    line-height: 1.55;
+    color: var(--alc-fg-2);
+    max-width: 620px;
+    margin: 0 auto 26px;
+  }
+  .page-hero__cta {
+    display: flex;
+    justify-content: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/ProductCard.astro b/.repos/alchemy-effect/website/src/components/marketing/ProductCard.astro
new file mode 100644
index 00000000000..24ac9d446c0
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/ProductCard.astro
@@ -0,0 +1,102 @@
+---
+interface Props {
+  eyebrow: string;
+  title: string;
+  body: string;
+  href: string;
+  learnMore?: string;
+}
+const { eyebrow, title, body, href, learnMore = "Learn more" } = Astro.props;
+---
+
+<a class="product-card" href={href}>
+  <div class="product-card__art">
+    <slot />
+  </div>
+  <div class="product-card__body">
+    <div class="product-card__eyebrow">{eyebrow}</div>
+    <div class="product-card__title">{title}</div>
+    <p class="product-card__text">{body}</p>
+    <span class="product-card__cta">
+      {learnMore} <span aria-hidden>&rarr;</span>
+    </span>
+  </div>
+</a>
+
+<style>
+  .product-card {
+    display: flex;
+    flex-direction: column;
+    background: var(--alc-bg-elev-1);
+    border: 1px solid var(--alc-hairline);
+    border-radius: 14px;
+    overflow: hidden;
+    text-decoration: none;
+    color: inherit;
+    transition:
+      border-color 200ms ease,
+      transform 200ms ease,
+      box-shadow 200ms ease;
+    box-shadow: var(--alc-shadow-sm);
+  }
+  .product-card:hover {
+    border-color: var(--alc-accent-deep);
+    transform: translateY(-2px);
+    box-shadow: 0 6px 20px rgba(184, 138, 74, 0.12);
+  }
+  .product-card:hover .product-card__cta {
+    color: var(--alc-accent-deep);
+  }
+  .product-card__art {
+    height: 152px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-bottom: 1px solid var(--alc-hairline);
+    background: linear-gradient(
+      180deg,
+      color-mix(in srgb, var(--alc-bg-nav) 90%, transparent) 0%,
+      var(--alc-bg-elev-1) 100%
+    );
+    overflow: hidden;
+    padding: 14px;
+  }
+  .product-card__body {
+    padding: 18px 20px 20px;
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    flex: 1;
+  }
+  .product-card__eyebrow {
+    font-family: var(--alc-font-mono);
+    font-size: 10.5px;
+    letter-spacing: 0.14em;
+    text-transform: uppercase;
+    color: var(--alc-accent-deep);
+    font-weight: 500;
+  }
+  .product-card__title {
+    font-family: var(--alc-font-serif);
+    font-size: 20px;
+    font-weight: 500;
+    color: var(--alc-fg-1);
+    letter-spacing: -0.01em;
+    line-height: 1.2;
+    margin-top: 2px;
+  }
+  .product-card__text {
+    font-size: 13.5px;
+    line-height: 1.55;
+    color: var(--alc-fg-2);
+    margin: 4px 0 0;
+    flex: 1;
+  }
+  .product-card__cta {
+    font-family: var(--alc-font-mono);
+    font-size: 12px;
+    color: var(--alc-fg-3);
+    margin-top: 12px;
+    transition: color 200ms ease;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/ProductGrid.astro b/.repos/alchemy-effect/website/src/components/marketing/ProductGrid.astro
new file mode 100644
index 00000000000..4cc0cf36ee3
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/ProductGrid.astro
@@ -0,0 +1,21 @@
+---
+---
+<div class="product-grid">
+  <slot />
+</div>
+
+<style>
+  .product-grid {
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    gap: 18px;
+    max-width: 1180px;
+    margin: 0 auto;
+  }
+  @media (max-width: 980px) {
+    .product-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+  }
+  @media (max-width: 640px) {
+    .product-grid { grid-template-columns: 1fr; }
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/Section.astro b/.repos/alchemy-effect/website/src/components/marketing/Section.astro
new file mode 100644
index 00000000000..1da5094c2dc
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/Section.astro
@@ -0,0 +1,37 @@
+---
+interface Props {
+  maxWidth?: number;
+  padding?: string;
+  background?: string;
+  class?: string;
+  step?: number;
+}
+const {
+  maxWidth = 1152,
+  padding = "88px 32px",
+  background,
+  class: className,
+  step,
+} = Astro.props;
+---
+
+<section
+  class:list={["alc-section", className]}
+  style={`padding:${padding};${background ? `background:${background};` : ""}`}
+  data-step={step}
+>
+  <div class="alc-section__inner" style={`max-width:${maxWidth}px;`}>
+    <slot />
+  </div>
+</section>
+
+<style>
+  .alc-section__inner {
+    margin: 0 auto;
+    min-width: 0;
+    max-width: 100%;
+  }
+  .alc-section {
+    overflow-x: clip;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/SketchLabel.astro b/.repos/alchemy-effect/website/src/components/marketing/SketchLabel.astro
new file mode 100644
index 00000000000..527442569f9
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/SketchLabel.astro
@@ -0,0 +1,13 @@
+---
+---
+
+<span class="alc-sketch-label"><slot /></span>
+
+<style>
+  .alc-sketch-label {
+    font-family: var(--alc-font-hand);
+    font-size: 28px;
+    color: var(--alc-accent-deep);
+    font-weight: 600;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagArrow.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagArrow.astro
new file mode 100644
index 00000000000..86d4a56ad7d
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagArrow.astro
@@ -0,0 +1,41 @@
+---
+import { CF_COLOR } from "./_colors";
+
+interface Props {
+  label?: string;
+  height?: number;
+  color?: string;
+}
+
+const { label, height = 22, color = CF_COLOR } = Astro.props;
+---
+
+<div class="diag-arrow">
+  {label && <div class="diag-arrow__label">{label}</div>}
+  <svg width="14" height={height} viewBox={`0 0 14 ${height}`}>
+    <path d={`M7 0 L7 ${height - 6}`} stroke={color} stroke-width="1.4" />
+    <path
+      d={`M3 ${height - 8} L7 ${height - 1} L11 ${height - 8}`}
+      stroke={color}
+      stroke-width="1.4"
+      fill="none"
+      stroke-linecap="round"
+      stroke-linejoin="round"
+    />
+  </svg>
+</div>
+
+<style>
+  .diag-arrow {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 2px;
+    padding: 2px 0;
+  }
+  .diag-arrow__label {
+    font-family: var(--alc-font-mono);
+    font-size: 10px;
+    color: var(--alc-fg-3);
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagNode.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagNode.astro
new file mode 100644
index 00000000000..ee073b12e3b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagNode.astro
@@ -0,0 +1,53 @@
+---
+import { CF_COLOR, tint } from "./_colors";
+
+interface Props {
+  label: string;
+  sub?: string;
+  accent?: boolean;
+  dim?: boolean;
+  color?: string;
+}
+
+const { label, sub, accent, dim, color = CF_COLOR } = Astro.props;
+const borderColor = accent ? color : "var(--alc-hairline-2)";
+const bg = dim ? "var(--alc-bg)" : "var(--alc-bg-elev-1)";
+const shadow = accent ? `0 0 0 2px ${tint(color, 0.12)}` : "none";
+---
+
+<div
+  class="diag-node"
+  style={`background:${bg};border-color:${borderColor};box-shadow:${shadow};`}
+>
+  <slot name="icon" />
+  <div class="diag-node__label">{label}</div>
+  {sub && <div class="diag-node__sub">{sub}</div>}
+</div>
+
+<style>
+  .diag-node {
+    border-radius: 10px;
+    padding: 10px 12px 8px;
+    min-width: 92px;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 4px;
+    text-align: center;
+    border-width: 1px;
+    border-style: solid;
+  }
+  .diag-node__label {
+    font-family: var(--alc-font-sans);
+    font-size: 12px;
+    font-weight: 600;
+    color: var(--alc-fg-1);
+    line-height: 1.2;
+  }
+  .diag-node__sub {
+    font-family: var(--alc-font-mono);
+    font-size: 10px;
+    color: var(--alc-fg-3);
+    line-height: 1.25;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagWrap.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagWrap.astro
new file mode 100644
index 00000000000..912eec51e2b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/DiagWrap.astro
@@ -0,0 +1,16 @@
+---
+---
+<div class="diag-wrap">
+  <slot />
+</div>
+
+<style>
+  .diag-wrap {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 8px 4px;
+    gap: 0;
+    width: 100%;
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/_colors.ts b/.repos/alchemy-effect/website/src/components/marketing/diagrams/_colors.ts
new file mode 100644
index 00000000000..30ab6fd1ef2
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/_colors.ts
@@ -0,0 +1,16 @@
+export const CF_COLOR = "#F38020";
+export const AWS_COLOR = "#2563EB";
+export const PS_COLOR = "#56C7B7";
+export const AXIOM_COLOR = "#9F6FFF";
+export const DD_COLOR = "#632CA6";
+export const CW_COLOR = "#E7157B";
+export const OTEL_COLOR = "#F5A623";
+export const GH_COLOR = "#8B949E";
+
+export function tint(hex: string, a = 0.15): string {
+  const n = parseInt(hex.slice(1), 16);
+  const r = (n >> 16) & 255;
+  const g = (n >> 8) & 255;
+  const b = n & 255;
+  return `rgba(${r},${g},${b},${a})`;
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconAxiom.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconAxiom.astro
new file mode 100644
index 00000000000..9eb8b2d041c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconAxiom.astro
@@ -0,0 +1,11 @@
+---
+import { AXIOM_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = AXIOM_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <rect x="4" y="4" width="24" height="24" rx="5" fill={fill} stroke={color} stroke-width="1.5" />
+  <path d="M9 22 L16 9 L23 22" stroke={color} stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" fill="none" />
+  <path d="M12 18 L20 18" stroke={color} stroke-width="1.4" stroke-linecap="round" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconClient.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconClient.astro
new file mode 100644
index 00000000000..7211147c564
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconClient.astro
@@ -0,0 +1,9 @@
+---
+interface Props { size?: number }
+const { size = 26 } = Astro.props;
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <circle cx="16" cy="16" r="11" stroke="var(--alc-fg-3)" stroke-width="1.4" />
+  <ellipse cx="16" cy="16" rx="5" ry="11" stroke="var(--alc-fg-3)" stroke-width="1.2" />
+  <line x1="5" y1="16" x2="27" y2="16" stroke="var(--alc-fg-3)" stroke-width="1.2" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconCloudWatch.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconCloudWatch.astro
new file mode 100644
index 00000000000..c0bae898bec
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconCloudWatch.astro
@@ -0,0 +1,17 @@
+---
+import { CW_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CW_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path
+    d="M9 21 C5 21 3 18 3 15 C3 12 5 10 8 10 C9 6 13 4 16 4 C20 4 23 7 23 11 C26 11 29 13 29 17 C29 20 26 22 23 22 L9 22 Z"
+    fill={fill}
+    stroke={color}
+    stroke-width="1.5"
+    stroke-linejoin="round"
+  />
+  <circle cx="22" cy="24" r="3" fill={fill} stroke={color} stroke-width="1.4" />
+  <path d="M24.2 26.2 L27 29" stroke={color} stroke-width="1.6" stroke-linecap="round" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconContainer.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconContainer.astro
new file mode 100644
index 00000000000..7a7e0c6f43d
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconContainer.astro
@@ -0,0 +1,10 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path d="M16 3 L27 9 V22 L16 28 L5 22 V9 Z" fill={fill} stroke={color} stroke-width="1.5" stroke-linejoin="round" />
+  <path d="M5 9 L16 15 L27 9 M16 15 V28" stroke={color} stroke-width="1.4" stroke-linejoin="round" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconD1.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconD1.astro
new file mode 100644
index 00000000000..e204a5d049f
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconD1.astro
@@ -0,0 +1,11 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <ellipse cx="16" cy="8" rx="10" ry="3" fill={fill} stroke={color} stroke-width="1.5" />
+  <path d="M6 8 V24 C6 25.7 10.5 27 16 27 C21.5 27 26 25.7 26 24 V8" fill={fill} stroke={color} stroke-width="1.5" />
+  <path d="M9 14 L23 14 M9 18 L23 18 M9 22 L19 22" stroke={color} stroke-width="1.2" stroke-linecap="round" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDO.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDO.astro
new file mode 100644
index 00000000000..eed05f6e2c0
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDO.astro
@@ -0,0 +1,10 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path d="M16 3 L28 10 L28 22 L16 29 L4 22 L4 10 Z" fill={fill} stroke={color} stroke-width="1.5" />
+  <circle cx="16" cy="16" r="3.5" fill={color} />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDatadog.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDatadog.astro
new file mode 100644
index 00000000000..34a31a38806
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDatadog.astro
@@ -0,0 +1,17 @@
+---
+import { DD_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = DD_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path
+    d="M5 16 L13 8 L19 14 L24 9 L27 12 L24 15 L20 19 L13 13 L8 18 Z"
+    fill={fill}
+    stroke={color}
+    stroke-width="1.5"
+    stroke-linejoin="round"
+  />
+  <circle cx="22" cy="11" r="1.6" fill={color} />
+  <path d="M5 23 L27 23" stroke={color} stroke-width="1.2" stroke-linecap="round" opacity="0.5" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDynamoDB.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDynamoDB.astro
new file mode 100644
index 00000000000..d3edc00ad4a
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconDynamoDB.astro
@@ -0,0 +1,11 @@
+---
+import { AWS_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = AWS_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <ellipse cx="16" cy="8" rx="10" ry="3" fill={fill} stroke={color} stroke-width="1.4" />
+  <ellipse cx="16" cy="16" rx="10" ry="3" fill={fill} stroke={color} stroke-width="1.4" />
+  <ellipse cx="16" cy="24" rx="10" ry="3" fill={fill} stroke={color} stroke-width="1.4" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconIAM.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconIAM.astro
new file mode 100644
index 00000000000..493c918952b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconIAM.astro
@@ -0,0 +1,10 @@
+---
+import { AWS_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = AWS_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path d="M16 3 L27 7 V16 C27 22.5 22 27 16 29 C10 27 5 22.5 5 16 V7 Z" fill={fill} stroke={color} stroke-width="1.5" stroke-linejoin="round" />
+  <path d="M11 15 L15 19 L22 12" stroke={color} stroke-width="1.8" fill="none" stroke-linecap="round" stroke-linejoin="round" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconKV.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconKV.astro
new file mode 100644
index 00000000000..20f47236a11
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconKV.astro
@@ -0,0 +1,11 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <circle cx="11" cy="16" r="6" fill={fill} stroke={color} stroke-width="1.5" />
+  <circle cx="11" cy="16" r="2.2" fill={color} />
+  <path d="M17 16 L27 16 M23 16 L23 21 M27 16 L27 12" stroke={color} stroke-width="1.5" stroke-linecap="round" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconLambda.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconLambda.astro
new file mode 100644
index 00000000000..f10b047778a
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconLambda.astro
@@ -0,0 +1,10 @@
+---
+import { AWS_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = AWS_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <rect x="3" y="3" width="26" height="26" rx="6" fill={fill} stroke={color} stroke-width="1.4" />
+  <path d="M9 8 H13 L21 24 H17 L15 19 L11 24 H7 L13 16 L11 12 H9 Z" fill={color} />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconLayerStack.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconLayerStack.astro
new file mode 100644
index 00000000000..4256ba2a84e
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconLayerStack.astro
@@ -0,0 +1,11 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path d="M16 4 L28 10 L16 16 L4 10 Z" fill={fill} stroke={color} stroke-width="1.4" stroke-linejoin="round" />
+  <path d="M4 16 L16 22 L28 16" stroke={color} stroke-width="1.4" fill="none" stroke-linejoin="round" opacity="0.85" />
+  <path d="M4 22 L16 28 L28 22" stroke={color} stroke-width="1.4" fill="none" stroke-linejoin="round" opacity="0.55" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconOtel.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconOtel.astro
new file mode 100644
index 00000000000..220e1baf767
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconOtel.astro
@@ -0,0 +1,21 @@
+---
+import { OTEL_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = OTEL_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <circle cx="11" cy="21" r="6" fill={fill} stroke={color} stroke-width="1.5" />
+  <rect
+    x="17"
+    y="6"
+    width="10"
+    height="10"
+    rx="2"
+    transform="rotate(38 22 11)"
+    fill={fill}
+    stroke={color}
+    stroke-width="1.5"
+  />
+  <circle cx="11" cy="21" r="2.4" fill={color} />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconPlanetscale.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconPlanetscale.astro
new file mode 100644
index 00000000000..b7c910669a6
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconPlanetscale.astro
@@ -0,0 +1,15 @@
+---
+import { PS_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = PS_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <circle cx="16" cy="16" r="11" fill={fill} stroke={color} stroke-width="1.5" />
+  <path
+    d="M16 5 A11 11 0 0 1 27 16 L16 16 Z"
+    fill={color}
+    opacity="0.85"
+  />
+  <circle cx="16" cy="16" r="3.2" fill="var(--alc-bg-code)" stroke={color} stroke-width="1.2" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconR2.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconR2.astro
new file mode 100644
index 00000000000..0d21c810f5c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconR2.astro
@@ -0,0 +1,11 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <ellipse cx="16" cy="9" rx="10" ry="3" fill={fill} stroke={color} stroke-width="1.5" />
+  <path d="M6 9 V23 C6 24.7 10.5 26 16 26 C21.5 26 26 24.7 26 23 V9" fill={fill} stroke={color} stroke-width="1.5" />
+  <path d="M6 16 C6 17.7 10.5 19 16 19 C21.5 19 26 17.7 26 16" stroke={color} stroke-width="1" stroke-opacity="0.55" fill="none" />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconS3.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconS3.astro
new file mode 100644
index 00000000000..a2a2380ccb4
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconS3.astro
@@ -0,0 +1,11 @@
+---
+import { AWS_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = AWS_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <path d="M7 8 H25 L23 26 H9 Z" fill={fill} stroke={color} stroke-width="1.5" stroke-linejoin="round" />
+  <path d="M7 8 H25" stroke={color} stroke-width="1.5" />
+  <circle cx="22" cy="11.5" r="1.2" fill={color} />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconWorker.astro b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconWorker.astro
new file mode 100644
index 00000000000..15cfe858cf3
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/diagrams/icons/IconWorker.astro
@@ -0,0 +1,10 @@
+---
+import { CF_COLOR, tint } from "../_colors";
+interface Props { size?: number; color?: string }
+const { size = 26, color = CF_COLOR } = Astro.props;
+const fill = tint(color);
+---
+<svg width={size} height={size} viewBox="0 0 32 32" fill="none" aria-hidden="true">
+  <rect x="3" y="3" width="26" height="26" rx="6" fill={fill} stroke={color} stroke-width="1.4" />
+  <path d="M19 7 L10 18 H15 L13 25 L22 13 H17 Z" fill={color} />
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/highlightTS.ts b/.repos/alchemy-effect/website/src/components/marketing/highlightTS.ts
new file mode 100644
index 00000000000..a444313975c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/highlightTS.ts
@@ -0,0 +1,76 @@
+// Lightweight single-pass TS highlighter, ported from the homegrown one in
+// public/landing/lib/TrackCloud.jsx. Outputs HTML with <span class="alc-tok-*">
+// elements; the styling for those classes lives in src/styles/marketing.css.
+//
+// This isn't a real tokenizer — it's a regex sweep that's good enough for the
+// short snippets shown in the marketing pages. Real prose code blocks should
+// use expressive-code via standard MDX ```ts fences.
+
+const KEYWORDS = new Set([
+  "import",
+  "export",
+  "default",
+  "class",
+  "extends",
+  "const",
+  "let",
+  "var",
+  "function",
+  "return",
+  "yield",
+  "if",
+  "else",
+  "for",
+  "of",
+  "in",
+  "as",
+  "new",
+  "typeof",
+  "async",
+  "await",
+  "from",
+  "interface",
+  "type",
+  "null",
+  "true",
+  "false",
+  "this",
+  "void",
+  "throw",
+]);
+
+const RE =
+  /(\/\/[^\n]*)|(\/\*[\s\S]*?\*\/)|("(?:[^"\\]|\\.)*")|('(?:[^'\\]|\\.)*')|(`(?:[^`\\]|\\.)*`)|\b([A-Za-z_$][a-zA-Z0-9_$]*)\b|\b(\d+)\b/g;
+
+function escape(s: string): string {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+export function highlightTS(src: string): string {
+  let out = "";
+  let last = 0;
+  let m: RegExpExecArray | null;
+  RE.lastIndex = 0;
+  while ((m = RE.exec(src)) !== null) {
+    if (m.index > last) out += escape(src.slice(last, m.index));
+    if (m[1] || m[2]) {
+      out += `<span class="alc-tok-c">${escape(m[0])}</span>`;
+    } else if (m[3] || m[4] || m[5]) {
+      out += `<span class="alc-tok-s">${escape(m[0])}</span>`;
+    } else if (m[6]) {
+      const id = m[6];
+      if (KEYWORDS.has(id)) {
+        out += `<span class="alc-tok-k">${id}</span>`;
+      } else if (/^[A-Z]/.test(id)) {
+        out += `<span class="alc-tok-t">${id}</span>`;
+      } else {
+        out += `<span class="alc-tok-v">${id}</span>`;
+      }
+    } else if (m[7]) {
+      out += `<span class="alc-tok-n">${m[0]}</span>`;
+    }
+    last = RE.lastIndex;
+  }
+  if (last < src.length) out += escape(src.slice(last));
+  return out;
+}
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationCICD.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationCICD.astro
new file mode 100644
index 00000000000..6248e0e2382
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationCICD.astro
@@ -0,0 +1,51 @@
+---
+const accent = "var(--alc-accent-deep)";
+const ok = "var(--alc-success)";
+const open = "#1A7F37";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <!-- PR badge (left) -->
+  <g transform="translate(18 38)">
+    <rect width="92" height="54" rx="8" fill="var(--alc-bg-elev-1)" stroke="var(--alc-hairline-2)" stroke-width="1" />
+    <!-- pull-request glyph -->
+    <g transform="translate(10 14)" fill="none" stroke={open} stroke-width="1.6">
+      <circle cx="4" cy="4" r="3" />
+      <line x1="4" y1="7" x2="4" y2="20" />
+      <circle cx="4" cy="22" r="3" />
+      <circle cx="18" cy="22" r="3" />
+      <path d="M18 4 L18 19 M18 4 L14 8 M18 4 L22 8" />
+    </g>
+    <text x="42" y="22" font-family="var(--alc-font-sans)" font-size="11" font-weight="600" fill="var(--alc-fg-1)">PR #147</text>
+    <text x="42" y="36" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-3)">@alice</text>
+    <!-- Open badge -->
+    <g transform="translate(42 42)">
+      <rect width="38" height="12" rx="6" fill="rgba(26, 127, 55, 0.14)" stroke={open} stroke-width="0.8" />
+      <text x="19" y="9" text-anchor="middle" font-family="var(--alc-font-sans)" font-size="9" font-weight="600" fill={open}>Open</text>
+    </g>
+  </g>
+
+  <!-- arrow -->
+  <g stroke={accent} stroke-width="1.4" fill="none">
+    <path d="M 116 65 L 158 65" />
+    <path d="M 152 60 L 158 65 L 152 70" stroke-linejoin="round" stroke-linecap="round" />
+  </g>
+  <text x="137" y="58" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="8" fill="var(--alc-fg-3)">deploy</text>
+
+  <!-- preview pill (right) -->
+  <g transform="translate(166 38)">
+    <rect width="96" height="54" rx="8" fill="var(--alc-bg-elev-1)" stroke={ok} stroke-width="1.2" />
+    <text x="10" y="22" font-family="var(--alc-font-sans)" font-size="11" font-weight="600" fill="var(--alc-fg-1)">preview</text>
+    <circle cx="80" cy="18" r="3.5" fill={ok} />
+    <text x="10" y="38" font-family="var(--alc-font-mono)" font-size="9" fill={accent}>pr-147.workers.dev</text>
+    <g transform="translate(10 44)">
+      <rect width="44" height="12" rx="6" fill="rgba(76, 137, 88, 0.16)" stroke={ok} stroke-width="0.8" />
+      <text x="22" y="9" text-anchor="middle" font-family="var(--alc-font-sans)" font-size="9" font-weight="600" fill={ok}>Ready</text>
+    </g>
+  </g>
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill={accent} font-style="italic">
+    every PR. preview. destroy.
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationEffect.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationEffect.astro
new file mode 100644
index 00000000000..a188c8d7eba
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationEffect.astro
@@ -0,0 +1,42 @@
+---
+const accent = "var(--alc-accent-deep)";
+const ok = "var(--alc-success)";
+const warn = "var(--alc-warn)";
+const err = "var(--alc-danger)";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <!-- big lambda symbol -->
+  <text
+    x="36"
+    y="92"
+    font-family="var(--alc-font-serif)"
+    font-size="92"
+    font-weight="500"
+    fill={accent}
+    opacity="0.85"
+  >λ</text>
+
+  <!-- pipe to typed channels -->
+  <line x1="115" y1="65" x2="155" y2="65" stroke={accent} stroke-width="1.4" />
+
+  <!-- three typed channels -->
+  <g transform="translate(155 30)" font-family="var(--alc-font-mono)" font-size="10.5">
+    <rect x="0" y="0" width="100" height="20" rx="5" fill="rgba(76, 137, 88, 0.12)" stroke={ok} stroke-width="1.2" />
+    <circle cx="9" cy="10" r="3" fill={ok} />
+    <text x="18" y="13.5" fill="var(--alc-fg-1)">Result&lt;A&gt;</text>
+
+    <rect x="0" y="26" width="100" height="20" rx="5" fill="rgba(212, 145, 39, 0.12)" stroke={warn} stroke-width="1.2" />
+    <circle cx="9" cy="36" r="3" fill={warn} />
+    <text x="18" y="39.5" fill="var(--alc-fg-1)">Retry × 3</text>
+
+    <rect x="0" y="52" width="100" height="20" rx="5" fill="rgba(193, 84, 84, 0.12)" stroke={err} stroke-width="1.2" />
+    <circle cx="9" cy="62" r="3" fill={err} />
+    <text x="18" y="65.5" fill="var(--alc-fg-1)">Typed Error</text>
+  </g>
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill={accent} font-style="italic">
+    typed errors · retries · streams
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationFrontends.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationFrontends.astro
new file mode 100644
index 00000000000..3d8d5120339
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationFrontends.astro
@@ -0,0 +1,32 @@
+---
+const accent = "var(--alc-accent-deep)";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <!-- Browser chrome -->
+  <g transform="translate(40 22)">
+    <rect width="200" height="80" rx="8" fill="var(--alc-bg-elev-1)" stroke="var(--alc-hairline-2)" stroke-width="1" />
+    <circle cx="10" cy="10" r="2.4" fill="var(--alc-danger)" />
+    <circle cx="18" cy="10" r="2.4" fill="var(--alc-warn)" />
+    <circle cx="26" cy="10" r="2.4" fill="var(--alc-accent-bright)" />
+    <rect x="36" y="5" width="158" height="11" rx="5" fill="var(--alc-bg)" stroke="var(--alc-hairline-2)" stroke-width="0.8" />
+    <text x="44" y="13" font-family="var(--alc-font-mono)" font-size="7" fill="var(--alc-fg-3)">https://app.workers.dev</text>
+
+    <!-- mock page content with framework dots -->
+    <rect x="14" y="26" width="172" height="6" rx="2" fill={accent} opacity="0.85" />
+    <rect x="14" y="38" width="120" height="4" rx="2" fill="var(--alc-fg-3)" opacity="0.5" />
+    <rect x="14" y="48" width="146" height="4" rx="2" fill="var(--alc-fg-3)" opacity="0.45" />
+    <rect x="14" y="58" width="100" height="4" rx="2" fill="var(--alc-fg-3)" opacity="0.4" />
+
+    <!-- framework brand dots -->
+    <circle cx="148" cy="64" r="3" fill="#FF6154" />
+    <circle cx="158" cy="64" r="3" fill="#FF5D01" />
+    <circle cx="168" cy="64" r="3" fill="#00DC82" />
+    <circle cx="178" cy="64" r="3" fill="#61DAFB" />
+  </g>
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill={accent} font-style="italic">
+    Vite · TanStack · Astro · React · Hugo
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationIaC.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationIaC.astro
new file mode 100644
index 00000000000..849a2aa4431
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationIaC.astro
@@ -0,0 +1,36 @@
+---
+// Two nodes in a circular reference — the differentiator.
+const accent = "var(--alc-accent-deep)";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <defs>
+    <marker id="iac-arrow" viewBox="0 0 8 8" refX="7" refY="4" markerWidth="6" markerHeight="6" orient="auto">
+      <path d="M0 0 L8 4 L0 8 Z" fill={accent} />
+    </marker>
+  </defs>
+
+  <!-- left node -->
+  <g transform="translate(50 40)">
+    <rect x="0" y="0" width="60" height="46" rx="8" fill="rgba(184, 138, 74, 0.10)" stroke={accent} stroke-width="1.4" />
+    <text x="30" y="20" text-anchor="middle" font-family="var(--alc-font-sans)" font-size="11" font-weight="600" fill="var(--alc-fg-1)">Worker A</text>
+    <text x="30" y="34" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-3)">.bind(B)</text>
+  </g>
+
+  <!-- right node -->
+  <g transform="translate(170 40)">
+    <rect x="0" y="0" width="60" height="46" rx="8" fill="rgba(184, 138, 74, 0.10)" stroke={accent} stroke-width="1.4" />
+    <text x="30" y="20" text-anchor="middle" font-family="var(--alc-font-sans)" font-size="11" font-weight="600" fill="var(--alc-fg-1)">Worker B</text>
+    <text x="30" y="34" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-3)">.bind(A)</text>
+  </g>
+
+  <!-- top arrow A -> B -->
+  <path d="M 110 50 C 130 28, 150 28, 170 50" stroke={accent} stroke-width="1.4" fill="none" marker-end="url(#iac-arrow)" />
+  <!-- bottom arrow B -> A -->
+  <path d="M 170 76 C 150 98, 130 98, 110 76" stroke={accent} stroke-width="1.4" fill="none" marker-end="url(#iac-arrow)" />
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill={accent} font-style="italic">
+    circular references — supported
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationIterate.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationIterate.astro
new file mode 100644
index 00000000000..b527d46db7a
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationIterate.astro
@@ -0,0 +1,44 @@
+---
+const accent = "var(--alc-accent-deep)";
+const ok = "var(--alc-success)";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <!-- editor pane -->
+  <g transform="translate(28 22)">
+    <rect width="100" height="74" rx="8" fill="var(--alc-bg-code)" stroke="var(--alc-hairline-2)" stroke-width="1" />
+    <circle cx="10" cy="9" r="2.4" fill="var(--alc-danger)" />
+    <circle cx="18" cy="9" r="2.4" fill="var(--alc-warn)" />
+    <circle cx="26" cy="9" r="2.4" fill="var(--alc-accent-bright)" />
+    <line x1="10" y1="22" x2="80" y2="22" stroke={accent} stroke-width="2" stroke-linecap="round" />
+    <line x1="10" y1="32" x2="60" y2="32" stroke="var(--alc-fg-3)" stroke-width="1.5" stroke-linecap="round" opacity="0.7" />
+    <line x1="10" y1="42" x2="74" y2="42" stroke="var(--alc-fg-3)" stroke-width="1.5" stroke-linecap="round" opacity="0.55" />
+    <line x1="10" y1="52" x2="50" y2="52" stroke={ok} stroke-width="2" stroke-linecap="round" />
+    <line x1="10" y1="62" x2="68" y2="62" stroke="var(--alc-fg-3)" stroke-width="1.5" stroke-linecap="round" opacity="0.55" />
+  </g>
+
+  <!-- hot-reload curved arrow -->
+  <g stroke={accent} stroke-width="1.6" fill="none" stroke-linecap="round">
+    <path d="M 138 60 C 154 40, 174 40, 188 60" />
+    <path d="M 184 56 L 188 60 L 184 64" stroke-linejoin="round" />
+    <path d="M 188 76 C 174 96, 154 96, 138 76" />
+    <path d="M 142 80 L 138 76 L 142 72" stroke-linejoin="round" />
+  </g>
+  <text x="163" y="70" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="9" fill={accent} font-weight="700">42ms</text>
+
+  <!-- test tube -->
+  <g transform="translate(208 22)">
+    <rect width="44" height="74" rx="8" fill="var(--alc-bg-elev-1)" stroke="var(--alc-hairline-2)" stroke-width="1" />
+    <!-- tube glyph -->
+    <path d="M22 18 L22 50 C22 56, 30 56, 30 50 L30 18 Z" fill="rgba(76, 137, 88, 0.15)" stroke={ok} stroke-width="1.4" stroke-linejoin="round" />
+    <line x1="20" y1="18" x2="32" y2="18" stroke={ok} stroke-width="1.4" stroke-linecap="round" />
+    <circle cx="26" cy="44" r="1.5" fill={ok} />
+    <circle cx="24" cy="48" r="1" fill={ok} />
+    <text x="22" y="68" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="8" fill={ok} font-weight="700">PASS</text>
+  </g>
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill={accent} font-style="italic">
+    edit · save · tested
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationObs.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationObs.astro
new file mode 100644
index 00000000000..597bfa4316c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationObs.astro
@@ -0,0 +1,42 @@
+---
+const accent = "var(--alc-accent-deep)";
+const danger = "var(--alc-danger)";
+const ok = "var(--alc-success)";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <!-- chart background -->
+  <g transform="translate(28 22)">
+    <rect width="224" height="74" rx="8" fill="var(--alc-bg-code)" stroke="var(--alc-hairline-2)" stroke-width="1" />
+
+    <!-- axis label -->
+    <text x="10" y="14" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-3)">p99 latency</text>
+    <text x="214" y="14" text-anchor="end" font-family="var(--alc-font-mono)" font-size="9" fill={danger} font-weight="700">▲ ALARM</text>
+
+    <!-- gridlines -->
+    <line x1="10" y1="32" x2="214" y2="32" stroke="var(--alc-hairline-2)" stroke-width="0.8" opacity="0.5" />
+    <line x1="10" y1="50" x2="214" y2="50" stroke="var(--alc-hairline-2)" stroke-width="0.8" opacity="0.5" />
+
+    <!-- threshold dashed -->
+    <line x1="10" y1="38" x2="214" y2="38" stroke={danger} stroke-width="1" stroke-dasharray="4 4" opacity="0.7" />
+    <text x="208" y="36" text-anchor="end" font-family="var(--alc-font-mono)" font-size="8" fill={danger} opacity="0.85">500ms</text>
+
+    <!-- sparkline rising and crossing threshold -->
+    <path
+      d="M 10 60 L 30 56 L 50 58 L 70 50 L 90 52 L 110 46 L 130 48 L 150 42 L 170 38 L 185 32 L 200 24 L 214 18"
+      stroke={danger}
+      stroke-width="1.6"
+      fill="none"
+      stroke-linecap="round"
+      stroke-linejoin="round"
+    />
+    <circle cx="214" cy="18" r="3" fill={danger} />
+    <!-- threshold cross marker -->
+    <circle cx="185" cy="32" r="2" fill={ok} opacity="0.7" />
+  </g>
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill={accent} font-style="italic">
+    OTel · dashboards · alarms — in code
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationProviders.astro b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationProviders.astro
new file mode 100644
index 00000000000..57cc3d471dd
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/marketing/illustrations/IllustrationProviders.astro
@@ -0,0 +1,43 @@
+---
+const cf = "#F38020";
+const aws = "#FF9900";
+const ps = "#56C7B7";
+---
+
+<svg viewBox="0 0 280 130" width="100%" height="100%" aria-hidden="true" preserveAspectRatio="xMidYMid meet">
+  <!-- Cloudflare tile -->
+  <g transform="translate(28 28)">
+    <rect width="64" height="64" rx="12" fill="rgba(243, 128, 32, 0.10)" stroke={cf} stroke-width="1.4" />
+    <!-- minimal cloud -->
+    <path d="M16 42 C12 42, 12 36, 16 36 C18 28, 32 28, 34 36 C42 36, 44 44, 36 44 L18 44 Z" fill={cf} opacity="0.85" />
+    <text x="32" y="58" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-2)">Cloudflare</text>
+  </g>
+
+  <!-- AWS tile -->
+  <g transform="translate(108 28)">
+    <rect width="64" height="64" rx="12" fill="rgba(255, 153, 0, 0.10)" stroke={aws} stroke-width="1.4" />
+    <!-- minimal AWS cube glyph -->
+    <path d="M22 28 L42 28 L42 44 L32 50 L22 44 Z" fill="none" stroke={aws} stroke-width="1.6" stroke-linejoin="round" />
+    <path d="M22 28 L32 34 L42 28 M32 34 L32 50" stroke={aws} stroke-width="1.6" fill="none" />
+    <text x="32" y="58" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-2)">AWS</text>
+  </g>
+
+  <!-- Planetscale tile (faded — coming soon) -->
+  <g transform="translate(188 28)" opacity="0.55">
+    <rect width="64" height="64" rx="12" fill="rgba(86, 199, 183, 0.10)" stroke={ps} stroke-width="1.4" stroke-dasharray="3 3" />
+    <circle cx="32" cy="32" r="14" fill="none" stroke={ps} stroke-width="1.4" />
+    <path d="M32 18 A14 14 0 0 1 46 32 L32 32 Z" fill={ps} opacity="0.8" />
+    <text x="32" y="58" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="9" fill="var(--alc-fg-2)">Planetscale</text>
+  </g>
+
+  <!-- coming soon badge -->
+  <g transform="translate(188 12)">
+    <rect width="64" height="14" rx="7" fill="var(--alc-bg-elev-1)" stroke={ps} stroke-width="1" />
+    <text x="32" y="10" text-anchor="middle" font-family="var(--alc-font-mono)" font-size="8" fill={ps} font-weight="700" letter-spacing="1.2">SOON</text>
+  </g>
+
+  <!-- caption -->
+  <text x="140" y="118" text-anchor="middle" font-family="var(--alc-font-hand)" font-size="13" fill="var(--alc-accent-deep)" font-style="italic">
+    deploy any cloud
+  </text>
+</svg>
diff --git a/.repos/alchemy-effect/website/src/components/starlight/Head.astro b/.repos/alchemy-effect/website/src/components/starlight/Head.astro
new file mode 100644
index 00000000000..b50eeea85cd
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/components/starlight/Head.astro
@@ -0,0 +1,55 @@
+---
+/**
+ * Starlight `Head` override that wraps the default head and appends our
+ * per-page Open Graph image and Twitter card metadata. The image URL is
+ * derived from the Starlight route slug and points at the static
+ * `/og/<slug>.png` artifact emitted at build time by
+ * `src/pages/og/[...slug].png.ts`.
+ *
+ * We intentionally append (rather than replace) so all of Starlight's
+ * default `<title>`, description, canonical, RSS, and theme-color tags
+ * still ship.
+ */
+import Default from "@astrojs/starlight/components/Head.astro";
+import PostHog from "../analytics/PostHog.astro";
+
+// Starlight injects route data via Astro.locals at runtime; the public
+// types aren't ambient-declared in this project, so we cast through any.
+const { slug } = (Astro.locals as { starlightRoute: { slug: string } }).starlightRoute;
+// Starlight normalizes the index entry's slug to an empty string.
+const ogSlug = slug === "" ? "index" : slug;
+const ogImage = new URL(`/og/${ogSlug}.png`, Astro.site);
+---
+
+<Default><slot /></Default>
+
+{/* Brand mark — Starlight emits a `favicon.ico`/svg pair via its own
+    config; we add the PNG/apple-touch fallbacks here for parity with
+    the marketing layout. */}
+<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png" />
+<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png" />
+<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+
+{/* Open Graph image (Starlight's default Head emits og:title/description). */}
+<meta property="og:image" content={ogImage.href} />
+<meta property="og:image:width" content="1200" />
+<meta property="og:image:height" content="630" />
+
+{/* Twitter / X */}
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:image" content={ogImage.href} />
+
+<PostHog />
+
+<script>
+  // Copy the heading link to the clipboard whenever a user clicks one of
+  // Starlight's auto-generated anchor buttons. Navigation still happens
+  // normally — we just piggyback the copy on top of it.
+  document.addEventListener("click", (event) => {
+    const target = event.target as Element | null;
+    const link = target?.closest?.("a.sl-anchor-link") as HTMLAnchorElement | null;
+    if (!link) return;
+    // `link.href` resolves to the absolute URL including the hash.
+    void navigator.clipboard?.writeText(link.href).catch(() => {});
+  });
+</script>
diff --git a/.repos/alchemy-effect/website/src/content.config.ts b/.repos/alchemy-effect/website/src/content.config.ts
new file mode 100644
index 00000000000..13683f42043
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content.config.ts
@@ -0,0 +1,19 @@
+import { docsLoader } from "@astrojs/starlight/loaders";
+import { docsSchema } from "@astrojs/starlight/schema";
+import { defineCollection, z } from "astro:content";
+import { blogSchema } from "starlight-blog/schema";
+
+export const blogCategories = ["release", "post"] as const;
+export type BlogCategory = (typeof blogCategories)[number];
+
+export const collections = {
+  docs: defineCollection({
+    loader: docsLoader(),
+    schema: docsSchema({
+      extend: (ctx) =>
+        blogSchema(ctx).extend({
+          category: z.enum(blogCategories).optional(),
+        }),
+    }),
+  }),
+};
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-04-25-circular-references.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-04-25-circular-references.md
new file mode 100644
index 00000000000..6de9aa4d3cb
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-04-25-circular-references.md
@@ -0,0 +1,300 @@
+---
+title: Circular references, without the deadlock
+date: 2026-04-25
+draft: true
+excerpt: Two Workers can call each other. A Lambda's role and the KMS key it uses can grant each other access. Alchemy plans these as graphs with cycles — at both the runtime layer and the type system layer.
+---
+
+Say you have two services that need to talk to each other.
+A web app handles login, an internal service handles
+billing, and each one calls the other.
+
+To deploy them, you need to tell each service where to
+find the other. Easy enough if you're deploying by hand —
+deploy the first, copy its URL, paste it into the second,
+deploy that, copy its URL back into the first. Done.
+
+But you want this in your infra code, so it's repeatable.
+And now you have a problem: which one does the deployer
+create first? Whichever you pick, you don't yet have the
+other one's URL to give it.
+
+This is a **circular dependency**, and most infrastructure
+tools refuse to handle it. They'll plan your resources in
+order, and the moment they detect a cycle they stop and
+ask you to break it manually.
+
+Alchemy doesn't. It plans the cycle in two passes.
+
+## The observation that makes it work
+
+When two resources depend on each other, they almost never
+need the *whole* other resource. They need one piece of
+identifying information — a URL, an ARN, a name. Something
+short and stable that's known the moment the resource
+exists, even before it's fully configured.
+
+That's the wedge. If we can produce identifiers before we
+do the rest of the work, we can plan the cycle as two
+passes:
+
+1. Reserve the identifiers for both resources.
+2. Now that both identifiers exist, finish configuring each
+   one — including the cross-reference to the other side.
+
+Alchemy gives providers a lifecycle hook for step 1 called
+**`precreate`**, and a regular lifecycle hook for step 2
+called **`reconcile`**.
+
+## `precreate` — reserving identifiers before reconcile
+
+When the planner sees a cycle, it asks each participating
+resource: *can you produce your stable identifiers without
+needing the other side?* If the provider implements
+`precreate`, the answer is yes.
+
+Here's the Cloudflare `Worker` provider's `precreate`
+(abbreviated from [`Worker.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/Workers/Worker.ts)):
+
+```typescript
+precreate: Effect.fnUntraced(function* ({ id, news, session }) {
+  const name = yield* createWorkerName(id, news.name);
+
+  // Upload a placeholder script. Just enough to reserve the
+  // worker name and any Durable Object class IDs the cycle
+  // might reference.
+  yield* putScript({
+    accountId,
+    scriptName: name,
+    metadata: { mainModule: "main.js", /* ...DO stubs... */ },
+    files: [new File([placeholderScript], "main.js")],
+  });
+
+  return {
+    workerId: name,
+    workerName: name,
+    url: undefined,                          // not yet — filled in by reconcile
+    durableObjectNamespaces,
+    // ...
+  } satisfies Worker["Attributes"];
+}),
+```
+
+The placeholder script is a no-op. It returns
+`"Alchemy worker is being deployed..."`. That's fine — its
+job isn't to handle traffic, it's to reserve a script name
+and (if there are Durable Objects) generate stable namespace
+IDs that other resources can refer to.
+
+In alchemy v1 this was an explicit `WorkerStub` resource you
+had to declare in your stack. In v2 it's invisible — the
+planner detects the cycle, calls `precreate` on the
+participating resources first, and then runs `reconcile` on
+all of them with the cross-references resolved.
+
+For [`AWS/S3/Bucket.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/S3/Bucket.ts)
+the `precreate` is even shorter — it just calls
+`ensureBucketExists`, since for the BucketPolicy → Lambda
+cycle all the other side needs is the bucket ARN, which is
+known the moment the bucket exists.
+
+If a provider *doesn't* implement `precreate`, the planner
+still works — it just can't participate in a cycle. You'd
+get the same DAG-only behavior as Terraform. `precreate` is
+an opt-in for the resources where the cycle pattern matters.
+
+## The type-system problem
+
+Engine support is half the battle. The other half is
+authoring code that *expresses* the cycle without the
+TypeScript compiler exploding.
+
+The naive thing to write looks like this:
+
+```typescript
+// src/A.ts
+import { B } from "./B.ts";
+
+export const A = Cloudflare.Worker("A", { main: import.meta.path },
+  Effect.gen(function* () {
+    const b = yield* Cloudflare.Worker.bind(B);
+    return { fetch: ... };
+  }),
+);
+
+// src/B.ts
+import { A } from "./A.ts";
+
+export const B = Cloudflare.Worker("B", { main: import.meta.path },
+  Effect.gen(function* () {
+    const a = yield* Cloudflare.Worker.bind(A);
+    return { fetch: ... };
+  }),
+);
+```
+
+Three things go wrong:
+
+1. **Bundle bloat.** Each Worker's `import` pulls in the
+   other Worker's entire implementation. When you bundle `A`
+   for deployment, you also bundle `B`'s handler code — and
+   vice versa. The Cloudflare Worker that's supposed to be
+   small now contains both implementations.
+
+2. **Circular type inference.** TypeScript needs `B`'s type
+   to type-check `A`, but `B`'s type depends on `A`'s type
+   (because the Effect inside `B` references `A`). The
+   compiler bails with:
+
+   > `'A' implicitly has return type 'any' because it does not have a return type annotation and is referenced directly or indirectly in one of its return expressions.ts(7023)`
+
+3. **Runtime initialization order.** Even if the types
+   resolved, the module loader has to execute *something*
+   first. Whichever module loads first sees `undefined` on
+   the other side.
+
+## Tag-based design
+
+The fix is to separate **identity** from **implementation**.
+The class is the Tag — it carries the type, the resource ID,
+the binding contract — and it's cheap to import. The
+implementation is attached via a separate `.make()` call
+that runs only when the Stack provides it.
+
+```typescript
+// src/A.ts — just the Tag
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export class A extends Cloudflare.Worker<A>()("A", {
+  main: import.meta.path,
+}) {}
+```
+
+That's the whole identity declaration. Importing `A` from
+another file gets you the type and the resource ID. It does
+*not* pull in any handler code — there is no handler code
+yet. The class is the Tag.
+
+The runtime piece is a second file-level export:
+
+```diff lang="typescript"
+  // src/A.ts
+  import * as Cloudflare from "alchemy/Cloudflare";
++ import * as Effect from "effect/Effect";
++ import { B } from "./B.ts";
+
+  export class A extends Cloudflare.Worker<A>()("A", {
+    main: import.meta.path,
+  }) {}
+
++ export default A.make(
++   Effect.gen(function* () {
++     const b = yield* Cloudflare.Worker.bind(B);
++     return {
++       fetch: Effect.gen(function* () {
++         return yield* b.fetch(new Request("https://b/work"));
++       }),
++     };
++   }),
++ );
+```
+
+The `import { B }` here imports B's Tag only — its identity
+and binding contract. `Worker.bind(B)` returns a typed
+callable; at plan time the URL is an `Output<URL>`
+placeholder, at runtime it's a real `fetch` stub.
+
+`B.ts` mirrors the pattern: imports `A`'s Tag, binds it
+inside its own `.make()`. Each file's `Effect.gen` references
+the *other* class as a Tag, not as a value that has to be
+initialized. The bundler sees the Tag import as type-only
+and tree-shakes it from the runtime bundle. The TypeScript
+compiler can resolve the types because each Tag is a single
+class declaration with no dependencies on the other side's
+implementation.
+
+### Why `.make()` and not the inline form
+
+For the non-cyclic case Alchemy lets you write the resource
+and its implementation in a single expression:
+
+```typescript
+export default Cloudflare.Worker("MyWorker", { main: import.meta.path },
+  Effect.gen(function* () { /* ... */ }),
+);
+```
+
+This is the convenient default — one file, one expression,
+type inference flows in one direction. But the moment the
+generator references *itself*'s tag (`yield* MyWorker`), TS
+trips on the self-reference. The class-form-plus-`.make()`
+splits the declaration from the inferred body, which is
+what unblocks both self-references and cross-references.
+
+The rule of thumb: use the inline form for DAG-shaped
+resources, use the class form when something else
+references the resource before its implementation is in
+scope — including the resource itself.
+
+## How the two pieces compose
+
+At plan time, the engine builds a dependency graph from the
+Stack expression. When it sees a cycle, it routes the
+participating resources through a two-pass lifecycle:
+
+```
+1. precreate — reserve identifiers (placeholder Worker scripts,
+                empty Buckets, KMS keys without policies).
+                Cross-references now have valid Output<…> values.
+2. reconcile — every resource runs with the resolved bindings.
+                For Worker A this means a real putScript with
+                the binding to B's reserved URL; for the KMS
+                key, the full resource policy referencing the
+                role's ARN.
+```
+
+The Tag/Layer split is what makes step 2 *authorable* — the
+generator inside `A.make(...)` can `yield* Worker.bind(B)`
+without anyone needing to evaluate `B`'s `.make()` body. The
+`precreate` hook is what makes step 2 *executable* — by the
+time the generator runs, `B` already has a reserved URL.
+
+You need both layers. Engine support without the Tag/Layer
+split leaves you writing un-bundle-able, un-type-checkable
+code. The Tag/Layer split without engine support leaves you
+with code that type-checks but deadlocks at deploy time.
+
+## When you don't need any of this
+
+If your services form a DAG, write them inline. The
+machinery exists for the cases where the natural shape of
+your system has cycles — bidirectional resource policies,
+mutually-recursive services, queue-mediated callbacks. For
+everything else, the simple form is still simple:
+
+```typescript
+export default Cloudflare.Worker("Web", { main: import.meta.path },
+  Effect.gen(function* () {
+    const db = yield* Database;
+    return { fetch: /* ... */ };
+  }),
+);
+```
+
+The interesting design choice is that the *engine*
+capability — `precreate` and cycle-aware planning — is
+opt-in per provider, not part of the framework's core
+contract. Most providers don't need it. The ones that do
+(Cloudflare `Worker`, AWS `Bucket`, KMS `Key`, IAM `Role`,
+Lambda `Function`) implement it explicitly, and the planner
+only invokes it when a cycle is actually present.
+
+## Where to go next
+
+- [Guides › Circular Bindings](/guides/circular-bindings) —
+  the step-by-step Worker A ↔ Worker B walkthrough.
+- [`Cloudflare/Workers/Worker.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/Workers/Worker.ts)
+  — the canonical `precreate` reference, including Durable
+  Object namespace reservation.
+- [`AWS/S3/Bucket.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/S3/Bucket.ts)
+  — `precreate` for the BucketPolicy ↔ Lambda Role cycle.
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-04-30-bindings.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-04-30-bindings.md
new file mode 100644
index 00000000000..096db738219
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-04-30-bindings.md
@@ -0,0 +1,310 @@
+---
+title: Bindings — one line, two phases
+date: 2026-04-30
+draft: true
+excerpt: A single `yield* S3.GetObject.bind(Photos)` in your handler grants the IAM policy at deploy and calls the SDK at runtime. The IAM logic never lands in your bundle.
+---
+
+You're writing a Cloudflare Worker (or an AWS Lambda — same
+story). It needs to read an object from an S3 bucket. In
+Alchemy it looks like this:
+
+```typescript
+Effect.gen(function* () {
+  const getPhoto = yield* S3.GetObject.bind(Photos);
+  return {
+    fetch: Effect.gen(function* () {
+      const photo = yield* getPhoto({ Key: "cover.jpg" });
+      return HttpServerResponse.raw(photo.Body);
+    }),
+  };
+});
+```
+
+The shape is "bind and use" — the standard
+[`Layer`](https://effect.website/docs/requirements-management/layers/)
+constructor pattern from Effect. `yield*` your dependencies
+at the top, then return a `fetch` Effect that uses them.
+Bind runs once; `fetch` runs per request.
+
+Focus on the `S3.GetObject.bind(Photos)` call. Two things
+have to happen for it to work.
+
+- **At deploy time**, the Worker's IAM role needs
+  `s3:GetObject` on the `Photos` bucket. If it doesn't, the
+  call fails at runtime with `AccessDenied`.
+- **At runtime**, the Worker process needs a real S3 SDK
+  client that knows how to talk to AWS, signs the request,
+  and gets back bytes.
+
+These are very different jobs. The first is infrastructure
+authoring — IAM policy documents, role attachments, deploy
+orchestration. The second is application code — SDK calls,
+retries, response parsing. Most frameworks make you write
+them in two separate places: the IAM in your IaC config,
+the SDK call in your handler. You're responsible for
+keeping the two in sync.
+
+Alchemy lets you write *one* line for both, then arranges
+for each half to run in the right phase — and crucially,
+arranges for the *deploy-side* half to never end up in your
+runtime bundle.
+
+## Capabilities have two halves
+
+Every capability in Alchemy — `S3.GetObject`, `S3.PutObject`,
+`SQS.SendMessage`, `DynamoDB.GetItem`, and so on — is
+implemented as a pair of Effect Services:
+
+```typescript
+// AWS/S3/GetObject.ts
+export class GetObject extends Binding.Service<GetObject, ...>()
+  ("AWS.S3.GetObject") {}
+
+export class GetObjectPolicy extends Binding.Policy<GetObjectPolicy, ...>()
+  ("AWS.S3.GetObject") {}
+```
+
+The `Binding.Service` is the runtime half — an Effect
+service whose `Live` layer wraps the actual SDK client.
+When you `yield*` it, you get back a typed callable that
+takes a bucket and a request and gives you back the
+response.
+
+The `Binding.Policy` is the deploy-time half — an Effect
+service whose `Live` layer doesn't do any I/O at all. It
+takes the bucket your handler referenced and records a
+policy statement onto the calling Worker's role:
+
+```typescript
+yield* host.bind`Allow(${host}, AWS.S3.GetObject(${bucket}))`({
+  policyStatements: [{
+    Effect: "Allow",
+    Action: ["s3:GetObject", "s3:GetObjectVersion"],
+    Resource: [Output.interpolate`${bucket.bucketArn}/*`],
+  }, /* + s3:ListBucket so 404s aren't 403s */],
+});
+```
+
+Two services, one capability name (`AWS.S3.GetObject`). One
+gets bundled into your Worker; one runs only during plan.
+
+## The TypeScript trick
+
+The interesting bit is how Alchemy distinguishes "this
+service must be provided" from "this service is allowed to
+be absent."
+
+When you `yield* S3.GetObject.bind(Photos)` inside a Worker,
+the Effect's `R` channel picks up `GetObject` (the runtime
+service) as a hard requirement. If you forget to attach the
+`GetObjectLive` layer to the Worker, the compiler tells you:
+
+```
+Argument of type 'Effect<…, …, GetObject>' is not assignable to
+parameter of type 'Effect<…, …, never>'.
+```
+
+`GetObjectPolicy` (the deploy-time service) is also
+referenced by the same line. But it doesn't show up in `R`,
+because the framework resolves it via
+`Effect.serviceOption` — it's *optional* at the type level.
+
+The relevant snippet is the comment right in
+[`Binding.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Binding.ts):
+
+```typescript
+// we use a service option because at runtime (e.g. in a Lambda
+// Function or Cloudflare Worker) the Policy Layer is not provided
+// and this becomes a no-op
+```
+
+The runtime layer must be provided or TypeScript breaks
+your build. The policy layer is allowed to be missing —
+and at runtime, it is. The same `S3.GetObject.bind(...)`
+expression is a real SDK-client construction at runtime and
+a no-op at runtime *for the policy half*.
+
+## What happens if the policy *is* needed but missing
+
+If you forget to provide `GetObjectPolicyLive` at deploy
+time, you don't want a silent no-op — you want a loud
+failure that tells you the role won't get the right IAM.
+
+Alchemy checks the deploy phase explicitly. From
+`Binding.ts`:
+
+```typescript
+service
+  ? Effect.succeed(service)
+  : Effect.all([CurrentStack, ALCHEMY_PHASE]).pipe(
+      Effect.flatMap(([stack, phase]) =>
+        stack && phase === "plan"
+          ? Effect.die(
+              `Binding.Policy provider 'Policy<${Identifier}>' was not provided at Plan Time in Stack '${stack.name}'`,
+            )
+          : Effect.succeed((() => Effect.void) as any as Shape),
+      ),
+    ),
+```
+
+In plan phase + with a Stack in scope, missing the policy
+layer dies with a clear message. Outside plan (e.g. inside
+the deployed Worker), it falls through to `Effect.void` and
+is invisible. Same expression, different behavior, scoped
+to the phase that needs each half.
+
+## The Stack is where policies live
+
+A `Cloudflare.Worker` (or `Lambda.Function`) lets you
+provide the runtime layers it needs *on the Worker itself*:
+
+```typescript
+const Photos = yield* Cloudflare.R2Bucket("Photos");
+const Api = yield* Cloudflare.Worker("Api", { main: "./src/api.ts" },
+  Effect.gen(function* () {
+    return { fetch: handler };
+  }).pipe(
+    Effect.provide(GetObjectLive),     // ← Binding.Service: bundled
+  ),
+);
+```
+
+`GetObjectLive` (the runtime service) gets bundled into the
+Worker. Nothing else here mentions IAM.
+
+The Stack is where the *Policy* layers live:
+
+```typescript
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: AWS.providers() },        // ← Binding.Policy layers: NOT bundled
+  Effect.gen(function* () {
+    const photos = yield* Photos;
+    const api = yield* Api;
+    return { url: api.url };
+  }),
+);
+```
+
+`AWS.providers()` is a Layer that bundles every
+`Binding.Policy` AWS exposes — `GetObjectPolicyLive`,
+`PutObjectPolicyLive`, `SendMessagePolicyLive`, etc. The
+Stack runs your generator in plan phase with those
+provided. When the planner walks into your Worker's
+generator and reaches `S3.GetObject.bind(Photos)`, the
+policy lookup succeeds, the role gets the right statement,
+the deploy proceeds.
+
+Then the planner walks back out. Your Worker bundle is
+written. The bundle has `GetObjectLive` (runtime SDK) but
+*not* `GetObjectPolicyLive` (IAM logic) — because the
+Worker's `R` never required it.
+
+## What ends up in your bundle
+
+The mental model is: **the Worker bundle is whatever its
+Effect's `R` channel demands, and nothing else.**
+
+In the bundle:
+
+- Your handler.
+- `Binding.Service` runtime layers (SDK wrappers) — every
+  `getObject`/`putObject`/`sendMessage` you actually call.
+- Resource data structures — `{ LogicalId: "Photos", ... }`
+  is all the runtime needs to identify a bucket. The
+  *output values* (bucket name, ARN) get resolved at deploy
+  time and inlined as constants by the bundler.
+
+Not in the bundle:
+
+- `Binding.Policy` layers — they're optional services, so
+  the Worker's `R` never required them.
+- Provider implementations — the code that knows how to
+  `reconcile` a Bucket lives in `AWS.providers()`, which
+  is provided to the Stack, not the Worker.
+- Other Workers' handlers — same reasoning, different
+  resource type. Worker A binding Worker B only needs B's
+  Tag (its `LogicalId` and binding contract), not B's
+  handler code.
+
+The tree-shake property falls out of the type system. You
+didn't have to opt in; you'd have to opt *out* to leak
+deploy-time code into a runtime bundle, by explicitly
+providing the Policy layer where it isn't needed.
+
+## Inline and Tag forms produce the same bundle
+
+There are two ways to author a Worker. The inline form, for
+when nothing else references this Worker:
+
+```typescript
+export const Api = Cloudflare.Worker("Api", { main: "./src/api.ts" },
+  Effect.gen(function* () {
+    const getPhoto = yield* S3.GetObject.bind(Photos);
+    return {
+      fetch: Effect.gen(function* () {
+        const photo = yield* getPhoto({ Key: "cover.jpg" });
+        /* ... */
+      }),
+    };
+  }),
+);
+```
+
+The Tag-and-Layer form, for when this Worker has to be
+referenced before its implementation is in scope (a cycle,
+self-reference, or just a Worker exported across files):
+
+```typescript
+export class Api extends Cloudflare.Worker<Api>()("Api", {
+  main: import.meta.path,
+}) {}
+
+export default Api.make(
+  Effect.gen(function* () {
+    const getPhoto = yield* S3.GetObject.bind(Photos);
+    return {
+      fetch: Effect.gen(function* () {
+        const photo = yield* getPhoto({ Key: "cover.jpg" });
+        /* ... */
+      }),
+    };
+  }),
+);
+```
+
+Both produce the same runtime bundle. The Tag form just
+splits identity (the class declaration) from implementation
+(the `.make()` call), so other files can import the Tag
+without pulling in the handler. See
+[Circular references, without the deadlock](/blog/2026-04-25-circular-references)
+for the full story on when each form pays off.
+
+## Composable units of infrastructure
+
+The same shape — Binding.Service required, Binding.Policy
+optional — is what makes pieces of infrastructure composable
+as Effect Layers. A "feature" can be a Layer that brings
+its own Workers, Tables, and bindings, with all the
+internal cross-references already wired. The Stack that
+consumes the feature provides `providers()` and gets the
+IAM right for free; the Workers inside the feature bundle
+exactly their own runtime code, nothing else.
+
+We'll get into that pattern in a separate post. For now,
+the takeaway is: the line you write — `yield* S3.GetObject.bind(Photos)`
+— is a complete specification of what your Worker needs.
+The framework handles the rest, in the right phase, without
+mixing the two phases' code together.
+
+## Where to go next
+
+- [`Binding.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Binding.ts)
+  — the `Binding.Service` / `Binding.Policy` machinery.
+- [`AWS/S3/GetObject.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/S3/GetObject.ts)
+  — a canonical capability: runtime layer + policy layer
+  in one file.
+- [Circular references, without the deadlock](/blog/2026-04-25-circular-references)
+  — the Tag-and-Layer pattern for cyclic and self-referential
+  bindings.
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-04-reconcile.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-04-reconcile.md
new file mode 100644
index 00000000000..1b9ddea419b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-04-reconcile.md
@@ -0,0 +1,467 @@
+---
+title: One reconcile, no create vs. update
+date: 2026-05-04
+draft: true
+excerpt: We replaced `create` and `update` with a single `reconcile` function. Both halves were already converging on the same defensive code.
+---
+
+Most IaC tools you've probably used are CRUD-based.
+CloudFormation, Terraform, Pulumi, SST, and the CDK all
+model a resource's lifecycle as four distinct operations:
+**Create**, **Read**, **Update**, **Delete**. When you write
+a provider, you write four functions, and the engine picks
+which one to call based on whether prior state exists.
+
+Kubernetes took a different approach. A controller doesn't
+"create" or "update" — it *reconciles*. It looks at desired
+state, looks at actual state, and does whatever it takes to
+make them match. Same function, every time. But Kubernetes
+pays for that simplicity with a **continuous control loop**:
+controllers run forever, polling and reconciling on every
+tick. There's no `plan` step, no `apply` step, no human in
+the loop telling it "yes, do that now."
+
+Alchemy wants both halves. We keep Terraform's *plan and
+apply* model — you run `alchemy deploy`, the engine computes
+a diff, shows you what's about to change, and applies it
+once. But inside that apply step, each resource runs a
+Kubernetes-style reconcile instead of a CRUD branch. One
+shot, not a loop; but the function itself doesn't care
+whether the resource is new, stale, drifted, or adopted —
+it just makes the cloud match desired state and returns.
+
+This post is about why we made that switch, and why the
+providers got noticeably smaller for it.
+
+## What `create` and `update` actually look like
+
+If you've written an SST or CDK custom resource, or a
+Terraform provider, you've seen the shape. Two functions —
+`create` provisions from nothing, `update` mutates toward
+new props.
+
+Let's build one up for a DynamoDB `Table`, which we'll keep
+using as the running example. Alchemy is Effect-native, so
+the lifecycle functions are written as `Effect.fn` generators
+that `yield*` AWS SDK calls instead of awaiting promises —
+but the *shape* is the same as any CRUD provider. Start
+with the skeleton:
+
+```typescript
+{
+  create: Effect.fn(function* ({ id, news }) {
+    // resource doesn't exist. provision it from `news`.
+  }),
+  update: Effect.fn(function* ({ id, news, olds, output }) {
+    // resource exists. mutate it from `olds` toward `news`.
+  }),
+}
+```
+
+`create` runs once, when the engine has no prior state.
+`update` runs every time after, with the previous props
+(`olds`), the new props (`news`), and the attributes the
+resource returned last time (`output`).
+
+### Fill in `create`
+
+DynamoDB's `CreateTable` call takes the whole table shape
+in a single round trip — key schema, attributes, billing
+mode, tags, all of it:
+
+```diff lang="typescript"
+  create: Effect.fn(function* ({ id, news }) {
++   const tableName = yield* createTableName(id, news);
++   const desiredTags = yield* createTags(id, news.tags);
++
++   yield* dynamodb.createTable({
++     TableName: tableName,
++     KeySchema: toKeySchema(news),
++     AttributeDefinitions: toAttributeDefinitions(news.attributes),
++     BillingMode: news.billingMode ?? "PAY_PER_REQUEST",
++     StreamSpecification: news.stream,
++     Tags: createTagsList(desiredTags),
++   });
++
++   yield* waitForTableActive(tableName);
++   return { tableName, tableArn: ... };
+  }),
+```
+
+Notice `Tags` is a field on `CreateTable` itself — there's
+no follow-up `TagResource` call. AWS designed it so a fresh
+table comes out of the API fully tagged in one round trip.
+This is the natural shape of `create`: take props, hand them
+to the cloud, return attributes.
+
+### Fill in `update` — tags
+
+After the table exists, AWS won't let you change tags via
+`UpdateTable`. There are separate `TagResource` and
+`UntagResource` APIs, so `update` has to *diff* old props
+against new props:
+
+```diff lang="typescript"
+  update: Effect.fn(function* ({ id, news, olds, output }) {
++   const desiredTags = yield* createTags(id, news.tags);
++   const oldTags = yield* createTags(id, olds.tags);
++   const { removed, upsert } = diffTags(oldTags, desiredTags);
++
++   if (upsert.length > 0) {
++     yield* dynamodb.tagResource({
++       ResourceArn: output.tableArn,
++       Tags: upsert,
++     });
++   }
++   if (removed.length > 0) {
++     yield* dynamodb.untagResource({
++       ResourceArn: output.tableArn,
++       TagKeys: removed,
++     });
++   }
+  }),
+```
+
+This is the line we'll keep coming back to:
+`diffTags(oldTags, desiredTags)`, where `oldTags` is derived
+from `olds`. `update` is using `olds` as its baseline —
+*the props we last wrote down* — rather than what's actually
+attached to the table in AWS right now. Hold onto that.
+
+### Fill in `update` — stream config
+
+Stream configuration is mutable, but via `UpdateTable`
+rather than `CreateTable`:
+
+```diff lang="typescript"
+  update: Effect.fn(function* ({ id, news, olds, output }) {
+    // ...tag sync above...
++   if (news.stream !== olds.stream) {
++     yield* dynamodb.updateTable({
++       TableName: output.tableName,
++       StreamSpecification: news.stream,
++     });
++     yield* waitForTableActive(output.tableName);
++   }
++   return output;
+  }),
+```
+
+Same shape: compare `news` to `olds`, fire the delta API if
+they differ. Every mutable aspect of the table — tags,
+stream, TTL, PITR, GSIs — is its own `if (news.X !== olds.X)`
+branch.
+
+That's a textbook CRUD provider — `create` is a single-shot
+bootstrap that consumes every prop at once, `update` is a
+per-aspect diff between `news` and `olds`. Clean.
+Reasonable. It falls apart in three places.
+
+## Break #1 — adoption
+
+A user has an existing DynamoDB table called `Orders` in
+their account. They want to start managing it with Alchemy
+without re-creating it:
+
+```sh
+alchemy deploy --adopt
+```
+
+The engine has no prior state for `Orders`. Whichever of
+the two lifecycle functions we call, we end up writing the
+same defensive code.
+
+### If we call `create`
+
+The first `yield*` hits `dynamodb.createTable(...)`. AWS
+rejects it with `ResourceInUseException`. So we catch it.
+Now we're inside the `create` body holding a table we may
+or may not own, and we need to figure out which:
+
+```typescript
+yield* dynamodb.createTable({ ... }).pipe(
+  Effect.catchTag("ResourceInUseException", () =>
+    Effect.gen(function* () {
+      // It already exists — is it ours?
+      const liveTags = yield* dynamodb.listTagsOfResource({ ResourceArn });
+      if (yield* hasAlchemyTags(id, liveTags)) {
+        return; // ours — silent adopt, fall through to sync
+      }
+      // Foreign — gate on AdoptPolicy
+      const allowed = yield* AdoptPolicy;
+      if (!allowed) return yield* Effect.fail(new OwnedBySomeoneElse({ ... }));
+    }),
+  ),
+);
+
+// ...and now what? We passed `BillingMode`, `StreamSpecification`,
+// `Tags`, GSIs — none of them got applied, because we didn't actually
+// create the table. We have to read live state and diff every aspect
+// against desired, applying deltas where they differ.
+```
+
+By the time we're done, `create` contains:
+
+1. A creation attempt.
+2. A conflict-recovery branch with an ownership check.
+3. An `AdoptPolicy` gate.
+4. A per-aspect sync against live cloud state.
+
+Steps 2-4 are exactly what `update` would have done.
+
+### If we call `update`
+
+Wait — we *can* route here, sort of. The engine has a `read`
+lifecycle op precisely for this: when there's no prior state
+but `--adopt` is set, `read` fetches live attributes and
+seeds `output` before any lifecycle call. So `output` is
+populated.
+
+But `olds` is still `undefined` — there are no "previous
+props" for a table we just met. And `update`'s tag-sync
+line was:
+
+```typescript
+const oldTags = yield* createTags(id, olds.tags); // 💥 olds is undefined
+```
+
+The fix is the same shape as in `create`: don't trust
+`olds`. Read tags from the cloud, diff observed against
+desired:
+
+```typescript
+const observedTags = yield* dynamodb.listTagsOfResource({ ResourceArn });
+const { removed, upsert } = diffTags(observedTags, desiredTags);
+```
+
+And every other `if (news.X !== olds.X)` branch in
+`update` has to be rewritten the same way: read the live
+value from the cloud, diff observed against desired, fire
+the delta API.
+
+Compare that to step 4 of the `create` body above. It's
+the same code. `create` ended up needing it because the
+table already existed when it tried to make one; `update`
+needs it because `olds` is gone. Different reasons,
+identical implementation.
+
+### The point
+
+Both branches converge on the same shape because **both
+need to assume nothing and observe everything.** You can't
+trust `olds` (it may be missing on adoption, or stale after
+drift). You can't trust that `createTable` will succeed
+(it'll conflict on adoption). The only thing that's
+authoritative is what the cloud says right now.
+
+Once `create` and `update` have both grown an "observe live
+state, then converge per-aspect" prefix, the split is
+purely cosmetic. This is the actual reconciler in
+[`AWS/DynamoDB/Table.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/DynamoDB/Table.ts),
+which collapses both into one flow:
+
+```typescript
+let state = yield* readTableState(tableName);
+
+if (state === undefined) {
+  yield* dynamodb.createTable({ /* ...full props, tags inline... */ }).pipe(
+    // Race: a peer reconciler created the table between our observe and create.
+    Effect.catchTag("ResourceInUseException", () => adoptExistingTable(tableName)),
+  );
+  state = yield* readTableState(tableName);
+}
+
+// From here on, every aspect (tags, GSIs, PITR, TTL, stream) is synced
+// against `state` — the OBSERVED cloud state — not against `olds`.
+```
+
+`create` is now just one step inside the flow ("if it
+doesn't exist yet, make it"). The rest is sync. Adoption
+just means `state` was already populated when the function
+started — no separate code path.
+
+## Break #2 — partial creates
+
+A Cloudflare `Worker` is more than a script. It's a script,
+plus a workers.dev subdomain toggle, plus any custom
+domains, plus the binding/migration metadata for Durable
+Objects. The `create` body has to:
+
+1. `PUT` the script (`putWorker`)
+2. Toggle the `workers.dev` subdomain on or off
+3. Attach each custom domain via `putDomain`
+4. Persist returned IDs (domain IDs, zone IDs) into state
+
+Now imagine the process gets `SIGKILL`'d between step 1 and
+step 3 — laptop lid closes, CI runner gets evicted, network
+times out. The script is uploaded. The domain isn't. State
+hasn't been persisted, because we crashed before returning.
+
+Next deploy, the engine still has no prior state, so it
+routes to `create` again. `putWorker` runs and succeeds
+(it's an upsert). Then `putDomain` runs and tries to attach
+the hostname — except now Cloudflare may already know
+about it from the partial run, or it may not, or it may be
+attached to a *different* Worker because someone retried
+elsewhere. The `create` body wasn't written for any of those
+cases; it was written assuming a clean account.
+
+The textbook fix is "make `create` idempotent." But the
+moment you do that — catch `WorkerAlreadyExists`, query the
+domain table to see what's attached, conditionally PUT —
+your `create` body is *already* a reconciler. It's reading
+observed state and applying deltas. It just happens to be
+named `create`.
+
+[`Cloudflare/Workers/Worker.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/Workers/Worker.ts)
+makes the reconciler explicit. `putWorker` is a true upsert;
+`reconcileDomains` queries the live domain list and computes
+attach/detach deltas. There's no "first time" path. Crash
+anywhere, re-run, converge.
+
+## Break #3 — drift
+
+Same Worker, fully deployed, state persisted, everyone
+happy. Between deploys, a teammate opens the Cloudflare
+dashboard and detaches `api.example.com` because they
+were debugging something.
+
+Next deploy, the engine has prior state, so it routes to
+`update`. `update` compares `news.domain` to `olds.domain`,
+sees no diff, and skips the domain logic. The cloud is
+wrong, but `update` thinks everything is fine because
+**`olds` is not the cloud — it's our cached belief about
+the cloud.**
+
+The fix, again, is to query live state instead of trusting
+`olds`. From the real reconciler:
+
+```typescript
+// Always query the live state of domains attached to *this*
+// Worker rather than trusting `_previous` from local state.
+// State may have been wiped, populated by another machine, or
+// simply be out of date. Without this we PUT domains that are
+// already registered to this same Worker and Cloudflare
+// returns a confusing "hostname already in use" error.
+const liveAll = yield* listDomains({ accountId, service: scriptName });
+```
+
+Once you're querying live state and diffing against it,
+`olds` has no role left to play. It's at best a hint to skip
+a no-op API call, never the source of truth.
+
+## The split was always a state machine
+
+In all three breaks, the underlying problem is the same:
+`create` and `update` form a two-state machine where
+`update` assumes `create`'s postcondition holds. The cloud
+doesn't honor that assumption. Adoption skips `create`
+entirely. Partial creates leave the postcondition unmet.
+Drift invalidates the postcondition after the fact.
+
+By the time you've handled all three, `create` reads
+observed state before doing anything, and `update` reads
+observed state before doing anything. The two functions
+have converged on the same shape — just under different
+names, with different sets of edge cases papered over.
+
+## The new shape
+
+The provider surface is now three operations:
+
+```typescript
+{
+  diff,       // replace? update? skip?
+  read,       // load actual cloud state into the store
+  reconcile,  // converge cloud → desired
+  delete: ...,
+}
+```
+
+`read` is called first whenever there's no prior state. If
+it finds a resource, the engine checks the
+[`AdoptPolicy`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AdoptPolicy.ts)
+— set globally with `--adopt`, or per-scope with
+`.pipe(adopt(true))`. If adoption is allowed (or the
+resource carries our ownership tags), the engine seeds state
+from `read`'s output and proceeds. If not, it fails with
+`OwnedBySomeoneElse` and tells the user how to opt in.
+
+Then `reconcile` runs. Its contract is one sentence:
+
+> Given desired state and current state, make the current
+> state match.
+
+It receives `output: Attributes | undefined` and
+`olds: Props | undefined`. All three combinations are valid:
+
+| `output`    | `olds`      | meaning                          |
+| ----------- | ----------- | -------------------------------- |
+| `undefined` | `undefined` | greenfield create                |
+| defined     | defined     | routine update                   |
+| defined     | `undefined` | adoption — first time we own it  |
+
+The body must work for all three. It's written as one flow:
+
+```
+1. Observe — derive the physical id; read live cloud state
+2. Ensure  — if missing, create it; tolerate AlreadyExists races
+3. Sync    — for each mutable aspect:
+             • read OBSERVED cloud state
+             • compute desired state
+             • diff observed vs. desired
+             • apply the delta (skip the API on no-op)
+```
+
+The forbidden pattern is `if (output === undefined) {
+/* create body */ } else { /* update body */ }`. That's
+rename-and-branch — it brings back every false assumption
+we just deleted.
+
+## Plan didn't change
+
+This is important: the *plan* still talks about create and
+update. Open [`Plan.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Plan.ts)
+and you'll find an `action` field on every node, with the
+same values as before:
+
+```typescript
+type Action = "create" | "update" | "replace" | "delete" | "noop";
+```
+
+The planner still computes a diff and decides, per resource,
+which of those actions applies. The terraform-style preview
+you see in your terminal still says "Plan: 4 to create,
+2 to update, 1 to replace, 0 to destroy."
+
+What changed is what happens at *apply* time. Both `create`
+and `update` actions now route into the same provider
+function — `reconcile`. The distinction lives in the plan
+(because users want to know "is this a fresh resource or a
+modification?"), but it doesn't live in the provider. The
+provider's job is identical either way: read live state,
+converge it toward desired.
+
+In other words, the create/update split was useful as a
+*user-facing concept* — "tell me what's about to change" —
+but harmful as a *provider-authoring concept*. We kept the
+former and deleted the latter.
+
+## Where to go next
+
+This is part 1 of two. Part 2 covers how we actually
+migrated all 50+ providers from `create` + `update` to
+`reconcile`: we used a single AI prompt run in parallel
+across the codebase, with the existing per-resource tests as
+the ground truth, and the apply/plan integration tests as
+the safety net for the engine changes themselves.
+
+- [Part 2 — Migrating 50+ providers in an afternoon](/blog/2026-05-06-reconcile-ai-migration)
+- [`AdoptPolicy`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AdoptPolicy.ts)
+  — the engine-side spec for `read` → `Unowned` → adopt/fail routing.
+- Canonical reconcilers:
+  [`AWS/S3/Bucket.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/S3/Bucket.ts),
+  [`AWS/Kinesis/Stream.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/Kinesis/Stream.ts),
+  [`AWS/DynamoDB/Table.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/AWS/DynamoDB/Table.ts).
+- [PR #179](https://github.com/alchemy-run/alchemy-effect/issues/179)
+  — the migration itself, every provider in one diff.
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-06-reconcile-ai-migration.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-06-reconcile-ai-migration.md
new file mode 100644
index 00000000000..02790060fe5
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-06-reconcile-ai-migration.md
@@ -0,0 +1,148 @@
+---
+title: How we migrated 50+ providers to reconcile in an afternoon
+date: 2026-05-06
+draft: true
+excerpt: One prompt, fifty resources, run in parallel. Tests were the ground truth. The engine got the same treatment.
+---
+
+[Part 1](/blog/2026-05-04-reconcile) covered why we replaced
+`create` and `update` with a single `reconcile` function.
+This post is about the part that surprised us: how
+unreasonably fast it was to actually do the migration.
+
+Alchemy has 50+ provider files in [`packages/alchemy/src/`](https://github.com/alchemy-run/alchemy-effect/tree/main/packages/alchemy/src).
+The old shape was two functions per resource — `create` and
+`update` — both written defensively against each other's
+edge cases. The new shape is one function. Rewriting every
+provider by hand would have been a multi-week slog.
+
+It took one afternoon, with a single AI prompt fanned out
+across the codebase in parallel. The existing tests were
+the ground truth.
+
+## Why `reconcile` is easier to *generate* than `create` + `update`
+
+The reason this worked isn't that the model got smarter. It's
+that `reconcile` is a strictly easier function to write
+correctly — for a human or an AI — than the pair it
+replaced.
+
+To write `create` correctly you need to hold in your head:
+
+- What happens if the resource half-exists from a prior
+  crash? (probably need to catch `AlreadyExists` and read
+  what's there)
+- What happens if it fully exists and we're adopting? (need
+  an ownership check)
+- What does `update` assume `create` left behind? (because
+  if `create` skips a step, `update` will silently skip it
+  too)
+
+To write `update` correctly you need to hold in your head:
+
+- What if `olds` is stale because someone clicked in the
+  console? (need to query live state instead of trusting it)
+- What if a previous `update` half-completed? (need every
+  step to be independently idempotent)
+- What did `create` guarantee about the starting state?
+  (because every assumption you make has to match)
+
+`reconcile` collapses both into one mental model:
+**read live state, compute the delta, apply the delta.**
+There's no other function whose behavior you have to
+predict. There's no postcondition to maintain across calls.
+Each sync step is independently idempotent — crash, re-run,
+converge.
+
+The AI doesn't have to reason about which function it's in
+or what the other one already did. There is no other one.
+
+## Tests were the ground truth
+
+Every provider already had test coverage:
+[`test/AWS/S3/Bucket.test.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/test/AWS/S3/Bucket.test.ts),
+[`test/AWS/DynamoDB/Table.test.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/test/AWS/DynamoDB/Table.test.ts),
+and so on. These weren't unit tests with mocked SDKs — they
+hit the real cloud, run through the full apply path, and
+assert on the actual state of the resource.
+
+That made them perfect as a migration substrate. The AI's
+contract for each provider was:
+
+1. Fold `create` and `update` into one `reconcile` function.
+2. The existing tests must still pass.
+
+Behavior changes that survived the tests were fine.
+Behavior changes that broke them were rejected and retried.
+We weren't reviewing the AI's prose about what it intended
+to do — we were running its output against scenarios that
+already encoded "the bucket must have these tags after step
+3," "this update must not replace the resource," "adoption
+of a tagged bucket must be silent."
+
+For aspects that weren't yet covered, we added tests
+*first*, then asked the AI to migrate. The new tests acted
+as an executable spec for the gap.
+
+## The engine got the same treatment
+
+The provider-side change was the visible half. The other
+half was inside the engine — [`Plan.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Plan.ts)
+and [`Apply.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Apply.ts) —
+which decide *which* provider function to call and route
+the lifecycle.
+
+`Plan.ts` kept its `"create" | "update" | "replace"` action
+shape (see part 1 for why). `Apply.ts` is what changed:
+both `create` and `update` actions now dispatch into the
+same provider function, with the action distinction
+preserved only for telemetry, terminal output, and `read`
+gating.
+
+The engine has its own integration tests — apply/plan
+fixtures that simulate the full lifecycle including
+adoption, drift, partial failures, retries. Those tests
+became the ground truth for the engine rewrite, the same
+way per-resource tests were the ground truth for providers.
+The AI modified `Plan.ts` and `Apply.ts` against that test
+surface; what passed shipped.
+
+## What you get out of this
+
+The headline number — 50 providers in an afternoon — is a
+function of two things, not one.
+
+The first is that AI is unreasonably good at translating
+between two function shapes when both are well-specified
+and the translation is mechanical. That's table stakes for
+the model now.
+
+The second is that **the target shape was simpler than what
+it replaced.** That's the part you can engineer for. If the
+migration had been the other direction — splitting one
+function into two, with the AI having to invent the
+boundary — it would have been slow and fragile and full of
+incorrect assumptions about who owns what postcondition.
+Going the other way, toward less structure and more
+observation, was a downhill walk.
+
+The other measurable outcome: providers got shorter. A
+typical file lost 30-40% of its lifecycle code. The
+DynamoDB `Table` provider, which had the gnarliest split
+(GSIs, PITR, TTL, tags, stream config — each with its own
+update API), dropped about 200 lines and got *more* correct
+in the process. There's a generalizable lesson there:
+**framework changes that make code easier to AI-generate
+tend to make code easier to read and maintain too**, because
+both are downstream of the same thing — fewer hidden
+assumptions, fewer postconditions, fewer state machines in
+your head.
+
+## Where to go next
+
+- [Part 1 — One reconcile, no create vs. update](/blog/2026-05-04-reconcile)
+- [PR #179](https://github.com/alchemy-run/alchemy-effect/issues/179)
+  — the migration in one diff.
+- Per-resource test conventions:
+  [`test/AWS/DynamoDB/Table.test.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/test/AWS/DynamoDB/Table.test.ts),
+  [`test/Cloudflare/Workers/Worker.test.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/test/Cloudflare/Workers/Worker.test.ts).
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-08-beta-35.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-08-beta-35.md
new file mode 100644
index 00000000000..c70bd412fe5
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-08-beta-35.md
@@ -0,0 +1,242 @@
+---
+title: alchemy@2.0.0-beta.35
+date: 2026-05-08
+category: release
+excerpt: A Stream-shaped Effect consumer for Cloudflare Queues, R2 bucket custom domains, non-string env bindings on Workers, Neon logical replication, and a round of CLI quality-of-life.
+---
+
+`v2.0.0-beta.35` is out. The headline addition is an
+Effect-native, `Stream`-shaped consumer API for Cloudflare
+Queues — write a queue handler the same way you'd write
+any other Effect pipeline. Plus R2 bucket custom domains,
+non-string Worker env bindings, Neon logical replication,
+and a handful of CLI polish. Community contributors get
+inline shoutouts; full credits in the
+[Contributors section](#contributors).
+
+## `Cloudflare.messages(queue).subscribe(...)` — Effect-native queue consumer
+
+Process Cloudflare Queue batches as a typed Effect `Stream`,
+with `ack`/`retry` exposed per message. The handler returns
+when the batch is done; failed messages get retried up to
+`maxRetries`. Same Worker, same Effect runtime, same
+bindings — the queue consumer is just another `yield*` in
+the init phase.
+
+A real producer-and-consumer pair: a Worker accepts POSTs
+to `/queue/send`, the consumer writes each message to R2
+as JSON so the result is observable. Bindings already on
+the Worker (`bucket`, `queue`) are in scope inside the
+stream handler — the consumer is a peer to the Worker's
+init phase, not a separate file.
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+import { Bucket } from "./Bucket.ts";
+import { Queue } from "./Queue.ts";
+
+interface QueueMessageBody {
+  id: string;
+  text: string;
+  sentAt: number;
+}
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    const queueResource = yield* Queue;
+    const queue = yield* Cloudflare.QueueBinding.bind(queueResource);
+
+    // Consumer side. Each batch arrives as a Stream of QueueMessage<Body>;
+    // success ack()s every message, failure retry()s. Crash mid-batch and
+    // unprocessed messages are redelivered.
+    yield* Cloudflare.messages<QueueMessageBody>(queueResource, {
+      batchSize: 25,
+      maxRetries: 3,
+    }).subscribe((stream) =>
+      Stream.runForEach(stream, (msg) =>
+        bucket
+          .put(`/queue/${msg.body.id}`, JSON.stringify(msg.body), {
+            httpMetadata: { contentType: "application/json" },
+          })
+          .pipe(Effect.asVoid),
+      ),
+    );
+
+    return {
+      // Producer side: POST /queue/send adds a message.
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        if (request.url === "/queue/send" && request.method === "POST") {
+          const text = yield* request.text;
+          const msg: QueueMessageBody = {
+            id: crypto.randomUUID(),
+            text,
+            sentAt: Date.now(),
+          };
+          yield* queue.send(msg);
+          return yield* HttpServerResponse.json({ sent: msg }, { status: 202 });
+        }
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        Cloudflare.R2BucketBindingLive,
+        Cloudflare.QueueBindingLive,
+        Cloudflare.QueueEventSourceLive, // required for `messages(...)` to dispatch
+      ),
+    ),
+  ),
+) {}
+```
+
+The full round-trip lives in
+[`examples/cloudflare-worker/src/Api.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/examples/cloudflare-worker/src/Api.ts).
+[Tutorial › Queue consumer](/tutorial/cloudflare/queue-consumer)
+
+## R2 bucket custom domains
+
+Attach custom hostnames to an R2 bucket directly from the
+resource declaration. Add or remove entries by editing the
+array — Alchemy reconciles the live attachments on the
+next deploy.
+
+```typescript
+const Assets = yield* Cloudflare.R2Bucket("Assets", {
+  customDomains: [
+    "assets.example.com",
+    "cdn.example.com",
+  ],
+});
+```
+
+Each domain points at the bucket's public origin; pair
+with a Cloudflare `Zone` if you want the DNS record
+provisioned in the same stack.
+
+— *Thanks to **Alex** ([#241](https://github.com/alchemy-run/alchemy-effect/pull/241))
+for the contribution.*
+
+## Non-string env bindings on Workers
+
+Worker `bindings` now accept non-string values directly —
+numbers, booleans, objects — without manual JSON encoding
+on either side. Alchemy serializes at deploy and the typed
+runtime binding gives you the original shape back.
+
+```typescript
+const Api = yield* Cloudflare.Worker("Api", {
+  main: "./src/worker.ts",
+  bindings: {
+    MAX_ITEMS: 100,                         // number
+    DEBUG: true,                            // boolean
+    FEATURES: { beta: true, alpha: false }, // object
+  },
+});
+
+// inside the Worker
+const limit    = env.MAX_ITEMS;   // ^? number — 100
+const debug    = env.DEBUG;       // ^? boolean — true
+const features = env.FEATURES;    // ^? { beta: boolean; alpha: boolean }
+```
+
+Previously you'd round-trip through `JSON.stringify` at
+the binding site and `JSON.parse` on the runtime side
+with an `as` cast for typing. Now it's just `env.MAX_ITEMS`.
+
+— *Thanks to **Michael K**
+([#269](https://github.com/alchemy-run/alchemy-effect/pull/269))
+for the contribution.*
+
+## Neon logical replication
+
+Opt-in flag on `Neon.Project` for enabling logical
+replication — needed for downstream CDC tools, change-data
+pipelines, and some replicas. Defaults to off.
+
+```typescript
+const Project = yield* Neon.Project("App", {
+  region: "aws-us-east-1",
+  enableLogicalReplication: true,
+});
+```
+
+Toggling the flag on an existing project applies in place —
+no replacement needed.
+
+— *Thanks to **Baptiste Arnaud**
+([#268](https://github.com/alchemy-run/alchemy-effect/pull/268))
+for the contribution.*
+
+## CLI: version-on-npm warning
+
+`alchemy` now checks the latest version on npm at startup
+and prints a one-line nudge when you're behind. Skips in
+CI / non-TTY automatically.
+
+```text
+$ alchemy deploy
+ℹ A newer version of alchemy (2.0.0-beta.36) is available.
+  Run `bun add alchemy@latest` to upgrade.
+```
+
+## CLI: plain-text renderer in non-interactive terminals
+
+The interactive deploy UI now downgrades to a plain-text
+progress renderer when run outside a TTY (CI logs, piped
+output). No more ANSI control sequences cluttering CI logs.
+
+## CLI: `alchemy cloudflare` / `alchemy aws` namespaces
+
+Cloud-scoped subcommands are now grouped under provider
+namespaces — e.g. `alchemy cloudflare state` for inspecting
+the Cloudflare-backed state store. Top-level commands
+(`deploy`, `destroy`, `plan`, `dev`, `test`) are unchanged.
+
+```sh
+alchemy cloudflare state ls     # list state entries
+alchemy aws state get <key>     # read a state entry
+```
+
+## Fixes worth knowing about
+
+- **Auth providers moved into layers.** The `R` requirement
+  on stack effects is `never` again — credential resolution
+  is internal to the provider layer instead of leaking into
+  the user-facing stack type.
+- **Dev mode Node compatibility & profiles.** Several
+  Node-specific runtime issues in `alchemy dev` fixed,
+  including profile handling for AWS/Cloudflare credentials.
+- **`QueueConsumer.listConsumers` paginates.** Previously
+  truncated at the API's default page size when a Worker
+  was listed as a consumer on many queues. Now paginates
+  and surfaces conflicting consumer registrations with a
+  clear error.
+- **R2 custom domain interface simplified** to a plain
+  string array (was a verbose object shape).
+- **Drizzle schema flag tightened** — only marked as
+  updated when migrations actually drift, not on every
+  `drizzle-kit generate` run.
+- **Vite `builder.sharedConfigBuild` disabled.** Fixes a
+  class of build failures when bundling Workers via the
+  Vite plugin.
+- **Distilled Cloudflare runtime bumped to 0.3.1.**
+
+## Contributors
+
+Big thank-you to everyone who shipped code in this beta:
+
+- **Alex** — R2 bucket custom domains ([#241](https://github.com/alchemy-run/alchemy-effect/pull/241))
+- **Michael K** — non-string env bindings on Workers ([#269](https://github.com/alchemy-run/alchemy-effect/pull/269))
+- **Baptiste Arnaud** — Neon `enableLogicalReplication` ([#268](https://github.com/alchemy-run/alchemy-effect/pull/268))
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta35)
+- [Compare v2.0.0-beta.34 → v2.0.0-beta.35](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.34...v2.0.0-beta.35)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-09-beta-36.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-09-beta-36.md
new file mode 100644
index 00000000000..b245ab9e0d1
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-09-beta-36.md
@@ -0,0 +1,203 @@
+---
+title: alchemy@2.0.0-beta.36
+date: 2026-05-09
+category: release
+excerpt: Cloudflare Images binding, Hyperdrive as a Worker binding, R2 object lifecycle rules, and a dev-mode networking fix.
+---
+
+`v2.0.0-beta.36` is mostly a Cloudflare-themed release —
+three new Worker bindings (Images, Hyperdrive,
+R2 lifecycle policies), all from outside the core team.
+Props to the contributors throughout, and full credits in
+the [Contributors section](#contributors).
+
+## Cloudflare Images binding
+
+Cloudflare's image transformation runtime, exposed as a
+Worker binding. The Effect-native client takes an Effect
+`Stream<Uint8Array>` input — typically the request body —
+and either streams a transformed image back out or returns
+typed metadata.
+
+```typescript
+// alchemy.run.ts — declare the pipeline resource
+export const Pipeline = yield* Cloudflare.Images({ name: "PIPELINE" });
+
+// in your Worker
+export default class ImageWorker extends Cloudflare.Worker<ImageWorker>()(
+  "ImageWorker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const images = yield* Cloudflare.Images.bind(Pipeline);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        // Probe the upload — returns format, width, height, etc.
+        if (request.url.endsWith("/info")) {
+          const info = yield* images.info(request.stream);
+          return yield* HttpServerResponse.json(info);
+        }
+
+        // Transform: resize to 512×512 WebP, stream the result back.
+        const transformed = yield* images
+          .input(request.stream)
+          .transform({ width: 512, height: 512 })
+          .output({ format: "image/webp" });
+        return HttpServerResponse.stream(transformed.body);
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.ImagesBindingLive)),
+) {}
+```
+
+— *Thanks to **Alex** ([#237](https://github.com/alchemy-run/alchemy-effect/pull/237))
+for the contribution.*
+[`Images.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/Images/Images.ts)
+
+## Hyperdrive in Worker bindings
+
+`Hyperdrive` resources are bindable on Workers the same way
+as R2, KV, D1. Two flavors to know:
+
+**Declare a Hyperdrive over an existing origin string.**
+Useful when the database lives outside of Alchemy (existing
+RDS, Supabase, etc.):
+
+```typescript
+const Hyperdrive = yield* Cloudflare.Hyperdrive("DbPool", {
+  origin: { connectionString: process.env.POSTGRES_URL! },
+});
+```
+
+**Wire it onto a Neon branch you already deployed.**
+`Neon.Branch` exposes a pre-parsed `origin` output that
+`Cloudflare.Hyperdrive` takes directly — Alchemy orders the
+deploy graph correctly:
+
+```typescript
+// src/Db.ts
+export const NeonDb = Effect.gen(function* () {
+  const project = yield* Neon.Project("app-db", { region: "aws-us-east-1" });
+  const branch  = yield* Neon.Branch("app-branch", { project });
+  return { project, branch };
+});
+
+export const Hyperdrive = Effect.gen(function* () {
+  const { branch } = yield* NeonDb;
+  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+    origin: branch.origin,            // direct (non-pooled) Neon endpoint
+  });
+});
+```
+
+Bind it on the Worker and read the pooled connection
+string at runtime — Hyperdrive does the connection pooling
+so the Worker can spin up a fresh `pg` client per request
+without exhausting the database:
+
+```typescript
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.path,
+    compatibility: { flags: ["nodejs_compat"] },
+  },
+  Effect.gen(function* () {
+    const hd = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const connectionString = yield* hd.connectionString;
+        const rows = yield* Effect.promise(async () => {
+          const client = new Client({ connectionString });
+          await client.connect();
+          try {
+            const r = await client.query("SELECT now() as now");
+            return r.rows;
+          } finally {
+            await client.end().catch(() => {});
+          }
+        });
+        return yield* HttpServerResponse.json({ rows });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.HyperdriveConnectionLive)),
+) {}
+```
+
+— *Thanks to **Baptiste Arnaud**
+([#282](https://github.com/alchemy-run/alchemy-effect/pull/282))
+for the contribution.*
+[Tutorial › Hyperdrive](/tutorial/cloudflare/hyperdrive)
+
+## R2 lifecycle rules
+
+Object lifecycle policies on `R2Bucket` — age-based
+deletion, storage-class transitions, multipart-upload
+abort — declared inline alongside the rest of the bucket
+config. Max 1000 rules per bucket; pass an empty array (or
+omit) to clear all rules.
+
+```typescript
+const Logs = yield* Cloudflare.R2Bucket("Logs", {
+  lifecycleRules: [
+    {
+      id: "archive-then-delete",
+      prefix: "logs/",
+      // After 60 days: move to Infrequent Access.
+      storageClassTransitions: [
+        {
+          condition: { type: "Age", maxAge: 60 * 60 * 24 * 60 },
+          storageClass: "InfrequentAccess",
+        },
+      ],
+      // After 365 days: delete entirely.
+      deleteObjectsTransition: {
+        condition: { type: "Age", maxAge: 60 * 60 * 24 * 365 },
+      },
+      // Stale multipart uploads — drop after 7 days.
+      abortMultipartUploadsTransition: {
+        condition: { type: "Age", maxAge: 60 * 60 * 24 * 7 },
+      },
+    },
+  ],
+});
+```
+
+Each entry is reconciled in place — edit the array and the
+next deploy applies the delta against R2's live policy.
+
+— *Thanks to **Baptiste Arnaud**
+([#284](https://github.com/alchemy-run/alchemy-effect/pull/284))
+for the contribution.* See [Cloudflare R2 docs › Object
+lifecycles](https://developers.cloudflare.com/r2/buckets/object-lifecycles/)
+for the underlying behavior.
+
+## Fixes worth knowing about
+
+- **`*.localhost` resolution in dev mode.** `bun alchemy
+  dev` now routes `*.localhost` hostnames through a
+  custom undici dispatcher, so cross-Worker `fetch` calls
+  to e.g. `https://backend.localhost` resolve to the local
+  sidecar instead of failing DNS.
+
+## Performance
+
+- **Smoke tests install canaries at the workspace root**
+  rather than per-fixture. Batched smoke runs are
+  noticeably faster on cold caches.
+
+## Contributors
+
+Big thank-you to everyone who shipped code in this beta:
+
+- **Alex** — Cloudflare Images binding ([#237](https://github.com/alchemy-run/alchemy-effect/pull/237))
+- **Baptiste Arnaud** — Hyperdrive in Worker bindings ([#282](https://github.com/alchemy-run/alchemy-effect/pull/282))
+- **Baptiste Arnaud** — R2 lifecycle rules ([#284](https://github.com/alchemy-run/alchemy-effect/pull/284))
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta36)
+- [Compare v2.0.0-beta.35 → v2.0.0-beta.36](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.35...v2.0.0-beta.36)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-12-beta-37.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-12-beta-37.md
new file mode 100644
index 00000000000..ac85758f8e4
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-12-beta-37.md
@@ -0,0 +1,529 @@
+---
+title: alchemy@2.0.0-beta.37
+date: 2026-05-12
+category: release
+excerpt: Cross-stack and cross-stage references, fully-typed Worker-to-Worker bindings, Workflows with typed I/O, `Alchemy.Secret` / `Alchemy.Variable`, cron triggers, an Analytics Engine binding, and R2 buckets that finally empty themselves on destroy.
+---
+
+`v2.0.0-beta.37` is the biggest beta in a while. The
+headline addition is **cross-stack and cross-stage
+references** — the missing piece that lets PR-preview
+stages share a database with `staging` instead of
+re-provisioning a whole Postgres cluster every time someone
+opens a draft PR. On top of that: fully-typed
+Worker-to-Worker bindings, typed Workflow I/O, the new
+`Alchemy.Secret` / `Alchemy.Variable` one-liners, cron
+triggers, and an Analytics Engine binding.
+
+A bunch of this came from outside the core team — props
+to the contributors throughout, and full credits at the
+[bottom of the post](#contributors).
+
+## Cross-stack and cross-stage references
+
+Lazy, typed references to resources deployed by a
+*different* stack or stage. The use case it was built for:
+ephemeral PR-preview stages that need a Neon project,
+shouldn't pay for their own, and should instead share one
+that's owned by `staging`.
+
+### Pointing a PR stage at `staging`'s database
+
+Same `alchemy.run.ts`, conditional on the stage. If the
+stage looks like a PR preview (`pr-147`, `pr-148`, …),
+`Neon.Project.ref` reaches into the `staging` stage's state
+file and pulls out the already-deployed project. Otherwise
+the stage creates its own.
+
+```typescript
+// src/Db.ts
+import * as Alchemy from "alchemy";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const NeonDb = Effect.gen(function* () {
+  const { stage } = yield* Alchemy.Stack;
+
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  // PR previews share the long-lived staging project.
+  // Every other stage gets its own.
+  const project = stage.startsWith("pr-")
+    ? yield* Neon.Project.ref("app-db", { stage: "staging" })
+    : yield* Neon.Project("app-db", { region: "aws-us-east-1" });
+
+  // Branches are cheap and per-stage either way.
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+    migrationsDir: schema.out,
+  });
+
+  return { project, branch, schema };
+});
+```
+
+Three things to note:
+
+- **Same logical id, same type.** `"app-db"` matches the
+  id `staging` uses to create the project; `project` is
+  `Neon.Project` either way, so downstream
+  (`Neon.Branch({ project })`) doesn't know or care
+  whether it's real or referenced.
+- **Resolved at plan time.** Alchemy reads the project's
+  attributes (id, host, etc.) out of `staging`'s persisted
+  [state store](/concepts/state-store). If `staging`
+  hasn't been deployed yet, plan fails loudly with
+  `InvalidReferenceError`.
+- **PR teardown stays scoped.** `alchemy destroy --stage
+  pr-147` deletes the per-PR `Neon.Branch` but doesn't
+  touch the shared project — this stage doesn't own it.
+
+Deploy `staging` once, then PR stages can point at it:
+
+```sh
+alchemy deploy --stage staging        # creates the project once
+alchemy deploy --stage pr-147         # references it, creates only the branch
+```
+
+The full file lives in
+[`examples/cloudflare-neon-drizzle/src/Db.ts`](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-neon-drizzle/src/Db.ts);
+the guide is at
+[Guides › Shared database across stages](/guides/shared-database).
+
+### Referencing an entire stack's outputs
+
+The example above pulls one **resource** across stages.
+The other shape — pulling a **whole stack's outputs** —
+is what you reach for in a monorepo where the frontend
+package wants to read the backend stack's deployed URL.
+
+Declare a typed stack handle once:
+
+```typescript
+// backend/src/Stack.ts
+import * as Alchemy from "alchemy";
+
+export class Backend extends Alchemy.Stack<
+  Backend,
+  { url: string }
+>()("Backend") {}
+```
+
+Deploy the backend with `Backend.make(...)` (the typed
+shorthand for `Alchemy.Stack`), then `yield* Backend` from
+the frontend's stack to get its outputs back, type-checked:
+
+```typescript
+// frontend/alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Backend } from "backend";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "Frontend",
+  { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    // Resolves Backend's outputs from the same stage of the same
+    // stack name. `pr-42` frontend reads `pr-42` backend.
+    const backend = yield* Backend;
+    //    ^? { url: string }
+
+    return yield* Cloudflare.Vite("Website", {
+      env: { VITE_API_URL: backend.url },
+    });
+  }),
+);
+```
+
+`yield* Backend` defaults to "same stage as the consumer".
+When you need to pin — say, the prod frontend always reads
+the prod backend regardless of which branch deploys it —
+use `Backend.stage.<name>`:
+
+```typescript
+const backend = yield* Backend.stage.prod;        // always pin to prod
+const backend = yield* Backend.stage["pr-42"];    // arbitrary stage name
+```
+
+Under the hood, both shapes are
+[`Output.stackRef`](/concepts/outputs#ref) /
+[`Resource.ref`](/concepts/resource#ref) reading the
+state store. The new APIs just make them ergonomic.
+
+[Concepts › References](/concepts/references) ·
+[Guides › Shared database](/guides/shared-database) ·
+[Guides › Monorepos](/guides/monorepo) ·
+[Tutorial › Branch from a shared database](/tutorial/cloudflare/branch-from-shared-database)
+
+## `Alchemy.Secret` and `Alchemy.Variable`
+
+The boring part of a stack — wiring an env var into a
+deploy target — used to leak across three files. One yield
+now collapses it into a line that's also a typed runtime
+accessor.
+
+```typescript
+// alchemy.run.ts — declare once on the Worker
+export default Cloudflare.Worker("Api",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const apiKey = yield* Alchemy.Secret("OPENAI_API_KEY");
+    //    ^? Output<Redacted<string>>
+
+    return {
+      fetch: Effect.gen(function* () {
+        // …and read the bound value inside the handler.
+        const key = yield* apiKey; // Redacted<string>
+        return HttpServerResponse.text(
+          `key has ${Redacted.value(key).length} chars`,
+        );
+      }),
+    };
+  }),
+);
+```
+
+`Alchemy.Variable` is the same shape without `Redacted`:
+
+```typescript
+const port  = yield* Alchemy.Variable("PORT", 3000);
+const flags = yield* Alchemy.Variable("FLAGS", { beta: true });
+
+// inside fetch
+const p = yield* port;   // number — 3000
+const f = yield* flags;  // { beta: true }
+```
+
+Both accept a literal, an `Effect`, a `Config`, or default
+to reading the value from the active `ConfigProvider` under
+the same name. The same call routes to the platform's
+native secret/variable binding — Cloudflare `secret_text`
+for `Secret`, Lambda encrypted env vars on AWS — and the
+runtime accessor decodes back to the original type.
+
+The docs are at [Concepts › Secrets](/concepts/secrets) and [Guides › Secrets and env vars](/guides/secrets).
+
+## Worker-to-Worker bindings, fully typed
+
+A Worker is now bindable as a binding on another Worker,
+and the caller gets full RPC types on the other side — no
+codegen, no manual interfaces, no `as` casts on `env`.
+Three call shapes are supported, all on the same
+deployment.
+
+The example: a `Backend` Worker exposing both an RPC method
+and an HTTP route, plus a TanStack Start frontend calling
+it three different ways. (This is the
+[`examples/cloudflare-tanstack`](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-tanstack)
+project — cut down to the relevant pieces.)
+
+The backend Worker:
+
+```typescript
+// src/backend.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+
+export default class Backend extends Cloudflare.Worker<Backend>()(
+  "Backend",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      // RPC method — callable via `backend.hello(key)` on the other side.
+      hello: Effect.fn("Backend.hello")(function* (key: string) {
+        const object = yield* bucket.get(key);
+        return object === null ? null : yield* object.text();
+      }),
+
+      // HTTP handler — callable via `env.BACKEND.fetch(...)`.
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = new URL(request.url, "http://backend").searchParams.get("key");
+        if (!key) return HttpServerResponse.text("missing key", { status: 400 });
+
+        if (request.method === "GET") {
+          const object = yield* bucket.get(key);
+          return object === null
+            ? HttpServerResponse.text("not found", { status: 404 })
+            : HttpServerResponse.stream(object.body);
+        }
+        return HttpServerResponse.text("method not allowed", { status: 405 });
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+) {}
+```
+
+Wire it into another Worker as a binding:
+
+```typescript
+// alchemy.run.ts
+import Backend, { Bucket } from "./src/backend.ts";
+
+export const Website = Cloudflare.Vite("Website", {
+  bindings: {
+    BUCKET: Bucket,       // R2 binding
+    BACKEND: Backend,     // Worker-to-Worker binding
+  },
+});
+```
+
+Now the caller has three ways to talk to the backend. All
+three are real, all three are typed, all three work in the
+same handler — pick whichever fits the call site.
+
+```typescript
+// frontend route handler
+import * as Cloudflare from "alchemy/Cloudflare";
+import type Backend from "../backend.ts";
+import { env } from "../env.ts";
+
+// Option 1 — async binding (just call the platform API directly).
+const object = await env.BUCKET.get(key);
+
+// Option 2 — Worker-to-Worker fetch over the service binding.
+const res = await env.BACKEND.fetch(`https://backend/?key=${encodeURIComponent(key)}`);
+
+// Option 3 — typed RPC. `toPromiseApi<Backend>` wraps the wire-shape
+// binding into a Promise<T> view that throws on `Effect.fail` and
+// unwraps stream envelopes — full method signatures from `Backend`.
+const backend = Cloudflare.toPromiseApi<Backend>(env.BACKEND);
+const value = await backend.hello(key);
+//    ^? string | null  (typed end-to-end)
+```
+
+Effect-native callers also get a fourth path — `yield*
+Backend.bind(env.BACKEND)` returns the same RPC surface
+without the Promise envelope. The HTTP option (#2) is the
+right one when you need request/response semantics with
+streaming bodies; the RPC option (#3) is the right one
+when you want typed method calls.
+
+[Tutorial › Vite SPA + Worker bridge](/tutorial/cloudflare/vite-spa) ·
+[Example › `cloudflare-tanstack`](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-tanstack)
+
+## Workflows with typed input and output
+
+`Cloudflare.Workflow` is now generic over input *and*
+output types. The body is an `Effect.fn` that takes the
+typed input directly; `workflow.create(input)` is
+type-checked end to end; the returned value flows through
+to `instance.status().output`.
+
+A realistic example — a notifier workflow that touches KV,
+reads an `Alchemy.Secret`, broadcasts through a Durable
+Object, sleeps, and finalizes — with each side effect
+wrapped in a `task` so a crash + replay returns the
+persisted result instead of re-running:
+
+```typescript
+// src/NotifyWorkflow.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { KV } from "./KV.ts";
+import Room from "./Room.ts";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    // Outer init phase: resolve shared dependencies once.
+    const rooms = yield* Room;
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+    const secret = yield* Alchemy.Secret("WORKFLOW_SECRET");
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+
+      // Each `task` is a checkpoint — replay-safe.
+      const stored = yield* Cloudflare.task("kv-roundtrip",
+        Effect.gen(function* () {
+          const key = `notify:${roomId}`;
+          yield* kv.put(key, message);
+          return (yield* kv.get(key)) ?? message;
+        }).pipe(Effect.orDie),
+      );
+
+      const value = Redacted.value(yield* secret);
+      const processed = yield* Cloudflare.task("process",
+        Effect.succeed({ text: `Processed: ${stored}`, secret: value }),
+      );
+
+      yield* Cloudflare.task("broadcast",
+        rooms.getByName(roomId).broadcast(`[workflow] ${processed.text}`),
+      );
+
+      yield* Cloudflare.sleep("cooldown", "2 seconds");
+      yield* Cloudflare.task("finalize",
+        rooms.getByName(roomId).broadcast(`[workflow] complete for ${roomId}`),
+      );
+
+      return processed;
+    });
+  }),
+) {}
+```
+
+Start it from a Worker — `create` is typed against the
+input shape, `instance.status()` reports the typed output:
+
+```typescript
+// inside a Worker's fetch handler
+const notifier = yield* NotifyWorkflow;
+
+const instance = yield* notifier.create({
+  roomId: "room-42",
+  message: "hello",
+});
+// instance.id: string
+
+const status = yield* (yield* notifier.get(instance.id)).status();
+// status.output: { text: string; secret: string } | undefined
+```
+
+[Tutorial › Workflows](/tutorial/cloudflare/workflows)
+
+## Cron triggers via `Cloudflare.cron(...)`
+
+Subscribe to a Cloudflare Cron Trigger with an Effect
+handler. The deploy-time half attaches the cron expression
+to the host Worker; the runtime half registers a
+`scheduled` listener. Use it alongside any other binding
+you've already wired up — the handler runs inside the same
+Worker context.
+
+```typescript
+export default Cloudflare.Worker("Reporter",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const kv = yield* Cloudflare.KVNamespace.bind(Counters);
+
+    // Fires once at the top of every hour.
+    yield* Cloudflare.cron("0 * * * *").subscribe((controller) =>
+      Effect.gen(function* () {
+        yield* kv.put(`tick:${controller.scheduledTime}`, "ok");
+        yield* Effect.log(`tick at ${new Date(controller.scheduledTime).toISOString()}`);
+      }),
+    );
+
+    return { fetch: Effect.succeed(HttpServerResponse.text("ok")) };
+  }),
+);
+```
+
+Multiple `cron("…")` calls register multiple schedules on
+the same Worker; the cheapest cron granularity Cloudflare
+offers is one minute (`* * * * *`).
+
+— *Thanks to **Dawson** ([#288](https://github.com/alchemy-run/alchemy-effect/pull/288))
+for the contribution.*
+
+## Analytics Engine binding
+
+Cloudflare Workers Analytics Engine, exposed as a
+zero-provisioning Worker binding. Declare a dataset
+resource, bind it on a Worker, and call `writeDataPoint`
+from the handler — same Effect-error channel as every
+other Alchemy binding.
+
+```typescript
+// alchemy.run.ts
+export const Events = Cloudflare.AnalyticsEngineDataset("Events", {
+  dataset: "app-events",
+});
+
+// inside the Worker
+export default Cloudflare.Worker("Api",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const analytics = yield* Cloudflare.AnalyticsEngineDataset.bind(Events);
+
+    return {
+      fetch: Effect.gen(function* () {
+        yield* analytics.writeDataPoint({
+          indexes: ["account-1"],   // queryable, low-cardinality
+          blobs: ["signup"],        // arbitrary string columns
+          doubles: [1],             // numeric metrics
+        });
+        return HttpServerResponse.text("recorded");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.AnalyticsEngineDatasetBindingLive)),
+);
+```
+
+— *Thanks to **Dawson** ([#286](https://github.com/alchemy-run/alchemy-effect/pull/286))
+for the contribution.*
+
+## R2 buckets empty themselves on destroy
+
+`destroy` on an `R2Bucket` now drains the contents before
+deleting the bucket. No more `BucketNotEmpty` failures
+during teardown — ephemeral PR previews and integration
+tests tear down cleanly with a single `alchemy destroy`.
+
+```typescript
+const Photos = Cloudflare.R2Bucket("Photos");
+// `alchemy destroy` empties Photos and deletes it in one go
+```
+
+If you want the old behavior (fail if non-empty) for
+production guards, opt out per-bucket:
+
+```typescript
+const Photos = Cloudflare.R2Bucket("Photos", { emptyOnDestroy: false });
+```
+
+— *Thanks to **Michael K** ([#276](https://github.com/alchemy-run/alchemy-effect/pull/276))
+for the contribution.*
+
+## Fixes worth knowing about
+
+- **D1 `prepare()` / `bind()` are synchronous now.** Matches
+  the upstream Cloudflare Workers API — no more `yield*`
+  on trivial statement construction.
+- **WASM modules in the local sidecar bundle.** `bun alchemy
+  dev` now correctly bundles `.wasm` modules into the local
+  sidecar, fixing a class of "module not found" errors for
+  Workers that depend on WASM. *Thanks to **Baptiste
+  Arnaud**
+  ([#305](https://github.com/alchemy-run/alchemy-effect/pull/305)).*
+- **Unresolved `Output` JS-coercion throws.** Accidentally
+  using an unresolved `Output<string>` in a template
+  literal (e.g. `` `${bucket.bucketName}` `` outside an
+  Effect) previously coerced to `"[object Output]"` and
+  shipped garbage to the cloud. It now throws. *Thanks to
+  **Zé Yuri**
+  ([#306](https://github.com/alchemy-run/alchemy-effect/pull/306)).*
+- **Deprecated libsodium wrapper types removed.** No public
+  API impact; if you were importing internal types they're
+  gone. *Thanks to **齐天大圣**
+  ([#311](https://github.com/alchemy-run/alchemy-effect/pull/311)).*
+
+## Contributors
+
+Big thank-you to everyone who shipped code in this beta:
+
+- **Michael K** — R2 empty-on-destroy ([#276](https://github.com/alchemy-run/alchemy-effect/pull/276))
+- **Dawson** — Worker cron triggers ([#288](https://github.com/alchemy-run/alchemy-effect/pull/288))
+- **Dawson** — Analytics Engine binding ([#286](https://github.com/alchemy-run/alchemy-effect/pull/286))
+- **Baptiste Arnaud** — WASM in local sidecar bundle ([#305](https://github.com/alchemy-run/alchemy-effect/pull/305))
+- **Zé Yuri** — throw on unresolved `Output` JS-coercion ([#306](https://github.com/alchemy-run/alchemy-effect/pull/306))
+- **齐天大圣** — remove deprecated libsodium wrapper types ([#311](https://github.com/alchemy-run/alchemy-effect/pull/311))
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta37)
+- [Compare v2.0.0-beta.36 → v2.0.0-beta.37](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.36...v2.0.0-beta.37)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-actions.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-actions.md
new file mode 100644
index 00000000000..98cc1db48d6
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-actions.md
@@ -0,0 +1,321 @@
+---
+title: Actions — run an Effect on deploy, skip when nothing changed
+date: 2026-05-13
+draft: true
+excerpt: A node in the dependency graph that isn't a Resource. Runs at deploy time, gets typed inputs from upstream resources, returns an Output downstream nodes can consume, and skips when its input hash hasn't moved.
+---
+
+You finish deploying a stack. The Worker URL changes
+because you switched to a custom domain. Now you want to:
+
+- ping Slack with the new URL,
+- invalidate a CDN cache that lives outside this stack,
+- seed a database with the latest schema version.
+
+None of these are *resources* — they don't reconcile a
+cloud entity, they don't have a lifecycle, they don't need
+to track drift. They're one-shot Effects you want the deploy
+pipeline to run when the inputs change, and skip when they
+haven't.
+
+You can hack this with an exec resource that runs a shell
+command on every apply. Or a CloudFormation custom resource
+that pretends to be CRUD-shaped just so the engine will call
+it. Neither is what you actually want.
+
+What you want is a node in the same dependency graph as
+your resources, with the same typed Output references, but
+without the lifecycle machinery — just a function that runs
+when its input changes.
+
+Alchemy has one. It's called an **Action**.
+
+## The shape
+
+Define the Action with its type name and a body:
+
+```typescript
+const Sync = Action("Sync", Effect.fn(function* (input: { table: string }) {
+  yield* Effect.log(`syncing ${input.table}`);
+  return { rows: 42 };
+}));
+```
+
+Call it inside a stack to register an instance:
+
+```typescript
+const rows = yield* Sync({ table: bucket.name });
+//          ^ Output<{ rows: number }>
+rows.rows  // Output<number>
+```
+
+That's the whole API. The yield does four things:
+
+- registers an Action instance on the stack under the
+  logical id `"Sync"` (or an explicit id if you pass one)
+- captures the input as an `Output<…>` expression — any
+  upstream resource references get resolved during apply
+- arranges for the body to run when the resolved input
+  hash differs from what we persisted last time
+- returns the body's return value as an `Output<…>` for
+  downstream resources or other Actions to consume
+
+The body is just an Effect. It can `yield*` whatever
+services it needs — log, fetch, Slack, anything. Inputs are
+typed. The output is typed. The graph is the same graph
+your resources live in.
+
+## What `Sync(...)` actually returns
+
+Look closely at the call site:
+
+```typescript
+const rows = yield* Sync({ table: bucket.name });
+```
+
+`rows` is not a Task object with a `.output` field. It's an
+`Output` directly. You can pass it as input to another
+resource, project a field out of it (`rows.rows` →
+`Output<number>`), or yield it inside a Worker to materialize
+the value at runtime.
+
+```typescript
+const Worker = yield* Cloudflare.Worker("Api", { main: "./src/api.ts" },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        const r = yield* rows; // Accessor<{ rows: number }>
+        const n = (yield* r).rows;
+        return HttpServerResponse.text(`${n} rows synced`);
+      }),
+    };
+  }),
+);
+```
+
+There is no separate concept to learn. An Action's output
+is an Output. It composes with everything else.
+
+## The diff is a hash
+
+Resources reconcile against observed cloud state. Actions
+don't — there's no cloud state to read. So how do we know
+whether the body should run?
+
+We hash the resolved input.
+
+When the plan walks the stack, it evaluates the Action's
+input expression against the current attribute values of any
+upstream resources, computes a SHA-256 over the resolved
+JSON, and compares it to the hash we stored on the previous
+deploy. Match → skip. Mismatch → run. No prior state → run.
+
+```typescript
+const sameInput =
+  prior?.status === "ran" && prior.inputHash === inputHash;
+if (sameInput && !options.force) {
+  return { action: "noop", /* ... skip the body ... */ };
+}
+return { action: "run", /* ... run the body ... */ };
+```
+
+`--force` flips skip→run for actions, the same flag that
+flips noop→update for resources.
+
+The state row that records all this is tiny — there are no
+provider props to track, no attributes to drift against. Just
+the input hash, the input we ran with, and the output:
+
+```typescript
+type ActionState =
+  | { kind: "action"; status: "running"; inputHash; input; … }
+  | { kind: "action"; status: "ran";     inputHash; input; output; … };
+```
+
+Remove the Action from the stack, and the row gets dropped
+on the next deploy. No body invoked. No lifecycle.
+
+## Wait for the *terminal* upstream, not the stub
+
+The interesting bit, the one we got wrong on the first try.
+
+Resources have a `precreate` hook that lets cyclic resources
+publish a stub identifier — a placeholder Worker script with
+a reserved name — before the real `reconcile` runs. That's
+what makes Worker A ↔ Worker B cycles work
+([see the cycles post](/blog/2026-04-25-circular-references)).
+Other resources can use that stub identifier early because
+they only need the name or ARN, not the configured resource.
+
+Actions can't. If an Action body runs against an upstream's
+precreate stub, it sees a placeholder URL, hashes that, and
+records "I ran with this URL." Then the real reconcile fills
+in the actual URL, the converge phase notices the input
+drifted, and re-runs the body. You've now invoked the body
+twice — once against bad data, once against good — and
+emitted "running" before either of them was really running.
+
+The fix is a separate signal per node: `readyStable`. It
+fires *only* after the real reconcile completes. Resources
+keep both signals (so they can still consume each other's
+precreate stubs); Actions wait on `readyStable` only. The
+body never runs against placeholder data.
+
+```typescript
+// resources.ts — keeps two signals
+yield* signalReady;        // fires after precreate (early)
+// ... reconcile ...
+yield* signalReadyStable;  // fires only after reconcile (terminal)
+
+// actions.ts — only waits on terminal
+yield* waitForStableDeps(upstreamFqns);
+```
+
+The plan log lines up with what actually happened:
+
+```text
+[Bucket]         creating
+[Api]            creating
+[Api]            Uploading worker (280.32 KB) ...
+[Api]            Enabling workers.dev subdomain...
+[AnnounceDeploy] running         ← only here, after Api's reconcile
+[AnnounceDeploy] ran
+```
+
+## Pulling in dependencies
+
+The runner signature so far is plain: `(input) => Effect<Out, _, _>`.
+But sometimes the runner itself needs a service — a database
+handle, a logger, an HTTP client. You don't want to construct
+those every time the body runs.
+
+`Action` accepts a *constructor* form. The second argument
+is an Effect that yields its dependencies and returns the
+runner:
+
+```typescript
+const Sync = Action("Sync", Effect.gen(function* () {
+  const db = yield* Database;
+  const logger = yield* Logger;
+  return Effect.fn(function* (input: { table: string }) {
+    yield* logger.info(`syncing ${input.table}`);
+    return { rows: yield* db.count(input.table) };
+  });
+}));
+```
+
+The init Effect's `Req` bubbles to the call site:
+
+```typescript
+const rows = yield* Sync({ table: bucket.name });
+//          ^ Effect.Effect<Output<…>, never, Database | Logger | Stack>
+```
+
+The init runs once per process — `Effect.cached` memoizes
+it — and every Action instance reuses the resolved runner.
+Dependencies show up in your stack's `R`, your stack's
+providers satisfy them, the body gets a fully-constructed
+closure to call.
+
+This is the same pattern as Effect's `Layer` construction.
+You yield what you need, return what you produce. Most
+Alchemy features follow it; Actions are no different.
+
+## Tag form for splitting contract and implementation
+
+If you want the contract — "there is an Action called Sync
+with this input shape and this output shape" — to live in a
+different file from the implementation, use the class form:
+
+```typescript
+class Sync extends Action<Sync, { table: string }, { rows: number }>()
+  ("Sync") {}
+
+const SyncLive = Sync.make(
+  Effect.gen(function* () {
+    const db = yield* Database;
+    return Effect.fn(function* (input) {
+      return { rows: yield* db.count(input.table) };
+    });
+  }),
+);
+```
+
+Same pattern as
+[Cloudflare.Worker's class form](/blog/2026-04-25-circular-references) —
+the class is a Tag carrying the input/output types; `.make()`
+binds an implementation Layer that resolves the Tag. Stack
+providers include `SyncLive`, the constructor's `Req` picks
+up `Sync`, the planner has a runner to call.
+
+`.make()` accepts either a direct runner or an init Effect.
+
+## In the plan
+
+In the terraform-style preview, Actions get their own
+symbol — `λ` for a run, `·` for a skip:
+
+```text
+Plan: 1 to create | 1 to update | 1 to run
+
+~ Api (Cloudflare.Worker)
++ BucketA (Cloudflare.R2Bucket)
+λ AnnounceDeploy (AnnounceDeploy) [action]
+· DbMigrate (DbMigrate) [action]
+```
+
+The `[action]` tag distinguishes them from resources without
+moving them out of the namespace tree — they sort
+alongside the resources they're related to. During apply
+`λ` swaps in a spinner; on success it switches to `✓` (cyan).
+
+## What this is not
+
+An Action is not a runtime function. To run code from inside
+a deployed Worker or Lambda, use a
+[Platform](/concepts/platform). Actions run at deploy time,
+once per input change, never on a request.
+
+An Action is not a Resource. It has no `read`, no
+`reconcile`, no drift detection. If you need lifecycle
+management of a cloud entity, model that entity as a
+Resource.
+
+An Action is not idempotent for free. The engine guarantees
+the body runs only when the input hash changes, but the
+body itself has to be safe to retry if the run is
+interrupted before it commits — its `running` state is
+persisted, the side effect inside the body is your
+responsibility.
+
+## Where this fits
+
+Resources are the right shape when you're modeling a cloud
+entity that needs to converge to a desired state. Actions
+are the right shape for everything else that wants to
+participate in the same graph — deploy-time scripts,
+notifications, one-shot migrations, derived values
+computed from resource outputs.
+
+The same graph means: upstream Outputs flow in as typed
+inputs, downstream resources can read outputs back, cycles
+are detected at plan time, `--force` works, removal drops
+state cleanly. The same graph means: Actions don't sit
+alongside your stack — they live *inside* it, one node
+among the others.
+
+## Where to go next
+
+- [Concepts › Action](/concepts/action) — the full reference
+  for the inline, init-effect, and tagged forms, plus the
+  state model and lifecycle table.
+- [`packages/alchemy/src/Action.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Action.ts)
+  — the source. Around 270 lines including JSDoc.
+- [Bindings — one line, two phases](/blog/2026-04-30-bindings) —
+  the deploy-vs-runtime split that Actions also follow at
+  the type level (Stack `Req` picks up the runner Tag, the
+  runtime bundle excludes deploy-time code).
+- [Circular references, without the deadlock](/blog/2026-04-25-circular-references) —
+  the cycle-aware planner that Actions participate in too,
+  including the `readyStable` signal that keeps action
+  bodies off of precreate stubs.
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-beta-38.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-beta-38.md
new file mode 100644
index 00000000000..549c2eb7dda
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-beta-38.md
@@ -0,0 +1,213 @@
+---
+title: alchemy@2.0.0-beta.38
+date: 2026-05-13
+category: release
+excerpt: Cloudflare Email Routing and the `send_email` Worker binding, a new `Action` plan node for arbitrary Effects that run during apply, a leaner Neon provider on the typed `@distilled.cloud/neon` SDK, and a transport-error retry fix.
+---
+
+`v2.0.0-beta.38` adds two new building blocks — full
+**Cloudflare Email** (zone routing + the `send_email`
+Worker binding) and the **`Action`** plan node for
+arbitrary Effects that run during apply — plus a
+behind-the-scenes Neon refactor onto the typed
+`@distilled.cloud/neon` SDK and a fault-tolerance fix in
+the apply transport.
+
+## Cloudflare Email
+
+Four new resources and one binding cover the whole flow:
+turn on Email Routing for a zone, register verified
+destination addresses, forward inbound mail with routing
+rules, and send outbound mail from a Worker.
+
+```typescript
+// alchemy.run.ts — enable Email Routing on a zone you own
+const routing = yield* Cloudflare.EmailRouting("Routing", {
+  zone: "example.com",
+});
+
+// Register a verified destination
+const ops = yield* Cloudflare.EmailAddress("Ops", {
+  email: "ops@example.com",
+});
+
+// Forward inbound info@ → ops@
+const rule = yield* Cloudflare.EmailRule("InfoForward", {
+  zone: "example.com",
+  matchers: [{ type: "literal", field: "to", value: "info@example.com" }],
+  actions: [{ type: "forward", value: ["ops@example.com"] }],
+});
+
+// Declare a `send_email` binding (the id is the env key)
+export const Email = Cloudflare.SendEmail("EmailOps", {
+  destinationAddress: "ops@example.com",
+  allowedSenderAddresses: ["noreply@example.com"],
+});
+```
+
+Bind `SendEmail` on a Worker and the runtime client gives
+you `send` (parsed) and `sendRaw` (RFC 822 bytes) with the
+same Effect error channel as every other binding:
+
+```typescript
+export default Cloudflare.Worker("Notifier",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const email = yield* Cloudflare.SendEmail.bind(Email);
+
+    return {
+      fetch: Effect.gen(function* () {
+        yield* email.send({
+          from: "noreply@example.com",
+          to: "ops@example.com",
+          subject: "Hello",
+          text: "Hi from the edge",
+        });
+        return HttpServerResponse.text("sent");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.SendEmailBindingLive)),
+);
+```
+
+[Providers › `EmailRouting`](/providers/cloudflare/emailrouting) ·
+[`EmailAddress`](/providers/cloudflare/emailaddress) ·
+[`EmailRule`](/providers/cloudflare/emailrule) ·
+[`SendEmail`](/providers/cloudflare/sendemail)
+
+## `Action` — Effects that run as part of apply
+
+An **Action** is a node in the stack DAG that runs an
+arbitrary Effect during apply when its resolved input
+changes — the missing primitive for things like database
+migrations, cache invalidation, deploy announcements, or
+anything else that isn't a cloud resource but needs to run
+in order alongside one.
+
+The shape is intentionally close to `Resource`: define
+once, instantiate in a stack, pass it inputs, get an
+`Output` back that downstream nodes can depend on.
+
+```typescript
+import * as Alchemy from "alchemy";
+import * as Effect from "effect/Effect";
+
+const Sync = Alchemy.Action("Sync",
+  Effect.fn(function* (input: { table: string }) {
+    return { rows: 42 };
+  }),
+);
+
+// In a stack:
+const rows = yield* Sync({ table: bucket.name });
+//          ^? Output<{ rows: number }>
+```
+
+Unlike a Resource, an Action has no
+create/update/replace/delete lifecycle — the engine just
+hashes the resolved input and runs the body when it
+drifts. Removing the Action from the stack drops its
+persisted state in the GC pass; the body is never
+re-invoked on delete.
+
+The plan reports actions on their own row:
+
+```
+Plan: 1 to create | 1 to update | 1 to run
+
+~ Api (Cloudflare.Worker)
++ BucketA (Cloudflare.R2Bucket)
+λ AnnounceDeploy (AnnounceDeploy) [action]
+· DbMigrate (DbMigrate) [action]
+```
+
+`λ` (cyan) means *will run this apply*; `·` (gray) means
+*input hash matches, skip*. `--force` flips skip→run for
+actions the same way it does for resources.
+
+Init-style construction works too, for the common case
+where the body needs Effect Services from the stack's
+layers:
+
+```typescript
+const Sync = Alchemy.Action("Sync",
+  Effect.gen(function* () {
+    const db = yield* Database;
+    const logger = yield* Logger;
+    return Effect.fn(function* (input: { table: string }) {
+      yield* logger.info(`syncing ${input.table}`);
+      return { rows: yield* db.count(input.table) };
+    });
+  }),
+);
+```
+
+The init Effect runs once per process (memoized), so the
+runner is shared across every instance and every re-run.
+
+Actions also participate in the dependency graph in both
+directions — they can take resource Outputs as input *and*
+their own output can be consumed by downstream resources
+or other actions. The scheduler waits on a separate
+"stable" signal so an action body never observes a
+resource's precreate stub; it only sees terminal cloud
+state.
+
+[Concepts › Actions](/concepts/action)
+
+## Neon on `@distilled.cloud/neon`
+
+`Neon.Project` and `Neon.Branch` no longer ship a
+hand-rolled HTTP wrapper — they route through the typed
+[`@distilled.cloud/neon`](https://www.npmjs.com/package/@distilled.cloud/neon)
+SDK. The user-facing API is unchanged; what's gone is the
+`api.ts` shim, the manual JSON shapes, and the per-call
+error mapping.
+
+```diff
+- import * as api from "./api.ts";
++ import { getProject, updateProject, deleteProject } from "@distilled.cloud/neon/Operations";
+```
+
+404 handling now uses the SDK's tagged error directly:
+
+```typescript
+getProject({ project_id }).pipe(
+  Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+)
+```
+
+This is mostly an internal cleanup, but it pays off
+immediately: errors carry typed tags instead of opaque
+strings, retries hang off `Schedule` instead of
+hand-written `try/catch`, and the next time the upstream
+OpenAPI spec moves we regenerate one package instead of
+patching one file.
+
+## Fault tolerance in the apply transport
+
+The transport that streams resource lifecycle events
+between the apply worker and the renderer now treats
+transient send/receive errors as retryable instead of
+collapsing the whole run. A flaky connection that drops
+mid-apply no longer aborts the stack — the transport
+backs off, reconnects, and resumes.
+
+## Other changes worth knowing about
+
+- **`effect@4.0.0-beta.66`.** Tracks the latest Effect
+  release. No public Alchemy API change; downstream apps
+  pinning Effect themselves should bump in lockstep.
+- **`ignore` is now vendored.** The MIT-licensed
+  `ignore` package is inlined into the Alchemy build to
+  shrink the supply-chain surface (one less transitive
+  dependency for everyone running `alchemy deploy` in CI).
+- **OTLP dashboard refresh.** Self-hosted OTel dashboards
+  now have resource-usage ranking and error-rate charts
+  per Stack / Stage. No code change in user code — it's
+  all dashboard config.
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta38)
+- [Compare v2.0.0-beta.37 → v2.0.0-beta.38](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.37...v2.0.0-beta.38)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-beta-39.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-beta-39.md
new file mode 100644
index 00000000000..da3bdcef2da
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-13-beta-39.md
@@ -0,0 +1,108 @@
+---
+title: alchemy@2.0.0-beta.39
+date: 2026-05-13T18:00:00Z
+category: release
+excerpt: A small, high-impact fix release — `VITE_*` env props are now inlined into the client bundle, the Cloudflare Worker HTTP adapter runs handlers through Effect's standard HTTP lifecycle (unblocking `RpcServer.toHttpEffect`), and the `SendEmail` binding from beta.38 is now wired into Worker binding inference.
+---
+
+`v2.0.0-beta.39` is a fix-only release that lands three
+things people hit immediately after beta.38: SPAs reading
+`import.meta.env.VITE_*`, Effect RPC servers running under
+the Cloudflare Worker adapter, and the brand-new
+`SendEmail` binding showing up in Worker binding types.
+
+## `Cloudflare.Vite` inlines `VITE_*` env into the bundle
+
+`Cloudflare.Vite("Site", { env: { ... } })` was forwarding
+`env` only as runtime Worker bindings — the values never
+made it into the client (or SSR) bundle. SPAs reading
+`import.meta.env.VITE_API_URL` fell back to whatever
+default the code hardcoded, breaking dynamic backend URLs
+at build time.
+
+The build step now passes `props.env` through Vite's
+`define` hook, emulating `vite build`'s env semantics:
+
+```typescript
+const web = yield* Cloudflare.Vite("Web", {
+  env: { VITE_API_URL: worker.url.as<string>() },
+});
+// SPA: `import.meta.env.VITE_API_URL` now contains the deployed worker URL.
+```
+
+The rules match Vite itself:
+
+- Only `VITE_`-prefixed keys are inlined into the bundle
+  as `import.meta.env.<key>` (matches Vite's default
+  `envPrefix`).
+- Non-`VITE_` entries stay out of the bundle but are still
+  attached to the deployed Worker as runtime bindings.
+- `Redacted` values are unwrapped when they're
+  `VITE_`-prefixed — opting them into the public bundle
+  is an explicit choice you make by naming them that way.
+
+The tutorial gains an [Inject the Worker URL at build
+time](/tutorial/cloudflare/vite-spa) section covering the
+pattern end-to-end.
+
+## Cloudflare Worker HTTP adapter — Effect's handled lifecycle
+
+The Worker HTTP adapter previously hand-rolled the
+`HttpServerRequest` / `HttpServerResponse` bridge. That
+worked for simple handlers but diverged from Effect's
+`HttpEffect.toHandled` / `toWebHandler` lifecycle in ways
+that broke scoped HTTP apps under workerd — most visibly,
+`RpcServer.toHttpEffect` hung when served through Alchemy
+even though the same app worked under raw Wrangler.
+
+The adapter now runs handlers through Effect's standard
+HTTP lifecycle while preserving every Worker-specific
+behavior:
+
+- `cf-connecting-ip` → `remoteAddress`
+- the original Cloudflare `Request` service
+- patched `request.raw` access
+- existing 500 response mapping from `serveWebRequest`
+
+…plus the parts that were missing: stream-scope transfer,
+HEAD body suppression, and request-abort interruption.
+
+The net effect: anything that worked under
+`@effect/platform`'s standard HTTP lifecycle now works
+under `Cloudflare.Worker` too. `RpcServer.toHttpEffect`,
+in particular, is unblocked.
+
+— *Thanks to **[Will King](https://github.com/wking-io)**
+([#328](https://github.com/alchemy-run/alchemy-effect/pull/328))
+for the fix.* Fixes
+[#327](https://github.com/alchemy-run/alchemy-effect/issues/327).
+
+## `SendEmail` binding type inference
+
+beta.38 added `Cloudflare.SendEmail` but two wiring sites
+in `Worker.ts` were missed — the binding type inference
+didn't know about it, and the deploy-time binding
+metadata didn't emit a `send_email` entry. The result:
+typing `bindings: { EMAIL: Email }` on a Worker errored,
+and deploys silently dropped the binding.
+
+Both are wired up now — `SendEmail` is a first-class
+member of the Worker binding union, the env key carries
+the right runtime type, and Cloudflare receives the
+expected `send_email` binding metadata at deploy time.
+
+— *Thanks to **[Gerben Mulder](https://github.com/Gerbuuun)**
+([#326](https://github.com/alchemy-run/alchemy-effect/pull/326))
+for catching this.*
+
+## Contributors
+
+Big thank-you to everyone who shipped code in this beta:
+
+- **[Will King](https://github.com/wking-io)** — Cloudflare Worker HTTP effect lifecycle ([#328](https://github.com/alchemy-run/alchemy-effect/pull/328))
+- **[Gerben Mulder](https://github.com/Gerbuuun)** — `SendEmail` Worker binding type and meta ([#326](https://github.com/alchemy-run/alchemy-effect/pull/326))
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta39)
+- [Compare v2.0.0-beta.38 → v2.0.0-beta.39](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.38...v2.0.0-beta.39)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-15-beta-40.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-15-beta-40.md
new file mode 100644
index 00000000000..8085461669b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-15-beta-40.md
@@ -0,0 +1,139 @@
+---
+title: alchemy@2.0.0-beta.40
+date: 2026-05-15T22:00:00Z
+category: release
+excerpt: Cloudflare local dev gains a real Vite dev server (HMR, SSR, client + worker in one process), AiGateway stops reporting spurious updates on every deploy, the Worker HTTP server returns generic 500s while logging the full Cause server-side, and a handful of fixes around entrypoint generation, container startup, and the dev lockfile.
+---
+
+:::caution
+**Upgrade immediately if you're on beta.39.** This release
+reverts a critical bug introduced in beta.39 where
+`scopeTransferToStream` caused **415** responses from
+Workers and **500** errors against the Cloudflare state
+store. The state store version has also been bumped to
+**v5** — older clients will refuse to load mismatched
+state and prompt you to upgrade.
+:::
+
+`v2.0.0-beta.40` is headlined by a real Vite dev server
+for Cloudflare Workers — `Cloudflare.Vite` now boots a
+single process that serves your client, SSR, and Worker
+through Vite, with HMR. The rest of the release is fixes
+that quiet noisy diffs, tighten error responses, and
+harden codegen against odd file paths.
+
+## `Cloudflare.Vite` — real Vite dev server
+
+`bun alchemy dev` for a `Cloudflare.Vite` resource
+previously bundled the Worker and served the built output
+through the sidecar. That worked, but it skipped the part
+of the Vite toolchain people actually want during
+development: HMR, on-demand SSR, the client/SSR/worker
+environments wired together.
+
+beta.40 replaces that with `vite.createServer` driven
+through `@distilled.cloud/cloudflare-vite-plugin`. The
+sidecar now hosts a Vite dev server that serves your
+client and SSR, while the Worker runs in the same process
+against the live module graph:
+
+```typescript
+const web = yield* Cloudflare.Vite("Web", {
+  main: "./src/worker.ts",
+  env: { VITE_API_URL: api.url.as<string>() },
+});
+```
+
+- HMR works in dev — edit a route component, the browser
+  hot-reloads; edit the worker, the Worker reloads.
+- `props.env` keeps the beta.39 semantics: `VITE_`-prefixed
+  keys are inlined into the client/SSR bundle via
+  `import.meta.env.*`, everything else is a runtime
+  Worker binding.
+- Vite is resolved from the project's own `node_modules`
+  first (via `createRequire`) so you control the version.
+
+## AiGateway: no more update-every-deploy
+
+`Cloudflare.AiGateway` was reporting `update` on every
+`bun alchemy deploy`, even when nothing had changed. Two
+things were going on:
+
+1. The provider was diffing against `news` instead of
+   observed cloud state.
+2. The provider's defaults didn't match what the
+   Cloudflare API actually returns, so the first
+   post-create diff always showed drift.
+
+Both are fixed. Defaults now match the API's response
+shape (`0`, `false`, `null` where the API returns those),
+and `Diff.ts` gained the helpers needed to compare
+observed-vs-desired correctly. Deploys are quiet again
+unless something genuinely changed.
+
+Fixes [#332](https://github.com/alchemy-run/alchemy-effect/issues/332)
+and [#334](https://github.com/alchemy-run/alchemy-effect/issues/334).
+
+## Worker HTTP: log full Cause server-side, return generic 500
+
+The Cloudflare Worker HTTP adapter was leaking internal
+error detail into 500 responses. The fix flips that: the
+full `Cause` (stack, annotations, defects) is logged on
+the server, and the client receives a generic
+`Internal Server Error` 500. Same behavior as Effect's
+own `HttpServer.serve` defaults — just now consistent
+under `Cloudflare.Worker`.
+
+This pairs with the beta.39 lifecycle adapter fix and
+finishes the cleanup of the Worker HTTP path.
+
+Fixes [#336](https://github.com/alchemy-run/alchemy-effect/pull/336).
+
+## Sanitize entrypoint URLs in generated code
+
+Codegen for Lambda, ECS, EC2-hosted, Cloudflare Worker,
+and Cloudflare Container entrypoints was interpolating
+`importPath` directly into a template string:
+
+```diff lang="typescript"
+-import entrypoint from "${importPath}";
++import entrypoint from ${JSON.stringify(importPath)};
+```
+
+On macOS/Linux this never bit anyone. On Windows, paths
+containing backslashes (or any path with embedded quotes,
+unicode, etc.) generated invalid TypeScript. `JSON.stringify`
+emits a guaranteed-valid JS string literal across every
+codegen site.
+
+## Other fixes
+
+- **Cloudflare.start forwards startup options** — `start`'s
+  options were silently dropped before they reached the
+  container runtime. Thanks
+  **[Christopher Yovanovitch](https://github.com/yovanoc)**
+  ([#341](https://github.com/alchemy-run/alchemy-effect/pull/341)).
+- **`bun alchemy dev` lockfile** moves to
+  `@alchemy.run/node-utils` and the legacy `Sidecar/Lock.ts`
+  is gone ([#345](https://github.com/alchemy-run/alchemy-effect/pull/345)).
+- **Cloudflare state store version bumped to 5** — clients
+  pinned to older versions will refuse to load mismatched
+  state and prompt you to upgrade.
+- **`scopeTransferToStream` reverted** — the optimization
+  was causing 415 responses under workerd; reverting
+  restores the previous (correct) HTTP semantics.
+- **Axiom `smartfilter` chart subtype** — used by the
+  internal otel dashboard; available now if you build
+  your own Axiom charts via `Axiom.Chart`
+  ([#339](https://github.com/alchemy-run/alchemy-effect/pull/339)).
+
+## Contributors
+
+Big thank-you to everyone who shipped code in this beta:
+
+- **[Christopher Yovanovitch](https://github.com/yovanoc)** — `Cloudflare.start` options forwarding ([#341](https://github.com/alchemy-run/alchemy-effect/pull/341))
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta40)
+- [Compare v2.0.0-beta.39 → v2.0.0-beta.40](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.39...v2.0.0-beta.40)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-20-beta-41.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-20-beta-41.md
new file mode 100644
index 00000000000..43436ce7381
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-20-beta-41.md
@@ -0,0 +1,276 @@
+---
+title: alchemy@2.0.0-beta.41
+date: 2026-05-20T22:00:00Z
+category: release
+excerpt: A big internal rewrite of the Cloudflare Worker runtime fixes hung requests and dropped responses from RPC and HTTP API workers. The Worker entrypoint is now a thin shell over `WorkerBridge.ts`, scopes are linearized per request, and the same schema-driven pattern (HTTP API, RPC, and Durable Object proxies) is now stable end-to-end.
+---
+
+:::caution
+**Upgrade if you're using `Cloudflare.Worker` with `HttpApi` or
+`RpcServer`.** beta.40 and earlier shared a Worker-level Effect
+runtime across requests, which caused intermittent 500s, hung
+`fetch` calls under load, and "promise resolved on the wrong I/O
+context" errors from workerd. beta.41 scopes everything per
+request — the failure modes documented in
+[#374](https://github.com/alchemy-run/alchemy-effect/pull/374)
+no longer reproduce.
+:::
+
+`v2.0.0-beta.41` is mostly the bridge rewrite. The Worker
+entrypoint is now a thin generated shell that calls into a
+type-checked `WorkerBridge.ts`; scope construction is linear,
+per-request, and no longer mixes promises across the workerd I/O
+boundary. The same fix lands across `Cloudflare.Worker`,
+`Cloudflare.DurableObjectNamespace`, and `Cloudflare.Workflow`,
+so the schema-driven pattern in the [HTTP API](/guides/effect-http-api)
+and [RPC](/guides/effect-rpc) guides now holds together under
+real traffic.
+
+## RPC and HTTP API — per-request scopes, no more cross-context promises
+
+The Worker runtime had been caching the user's Worker Effect once
+as a module-scope `Promise`, then mixing and matching scopes
+between `WorkerBundle`, `WorkerRuntime`, and `HttpServer` on each
+request. Three things went wrong in production:
+
+1. **Too many scopes.** Every layer in the stack created its own
+   `Scope`, and the close order between them wasn't well-defined.
+   Finalizers ran against scopes that had already been torn down,
+   or never ran at all.
+2. **Promises crossed the workerd I/O boundary.** A single cached
+   promise was awaited from multiple requests. workerd treats
+   that as "promise resolved on the wrong I/O context" and aborts
+   the request — manifesting as hung `fetch`es and dropped
+   responses.
+3. **Global vs request-level scope confusion.** Construction-time
+   layers (provided once) and per-request layers (provided per
+   `fetch`) were being merged in the wrong order, so request-level
+   services occasionally got resolved from the global scope and
+   then captured stale state from a previous request.
+
+beta.41 refactors the entrypoint into
+[`WorkerBridge.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/Workers/WorkerBridge.ts).
+The generated entrypoint is now thin — it just instantiates the
+bridge class. Everything else is type-checked TypeScript in the
+package. Scoping is linear: one `Scope.makeUnsafe()` per request,
+provided into the user's Effect, and closed via `ctx.waitUntil`
+when the response finishes streaming. Nothing is cached as a
+promise; the user's Worker Effect is re-evaluated per request
+against the request's own scope.
+
+> Performance note: the rewrite trades a small amount of
+> per-request setup for correctness. The previous "cache the
+> Worker once" path was the source of the bugs, so we've left it
+> off by default. There's a follow-up to identify what's actually
+> safe to cache (anything that doesn't capture a promise) — for
+> now, correctness first.
+
+[#374](https://github.com/alchemy-run/alchemy-effect/pull/374)
+
+### The schema-driven pattern, end to end
+
+The pattern the [HTTP API guide](/guides/effect-http-api) and
+[RPC guide](/guides/effect-rpc) describe — define a schema, build
+a server, wrap it as `{ fetch }`, and optionally proxy through a
+Durable Object — is the same shape regardless of which transport
+you pick. beta.41 is the release where it actually works for all
+three combinations.
+
+**1. Define the schema once.** Same `Task` schema feeds the HTTP
+API endpoint declarations and the RPC procedure declarations:
+
+```typescript
+// src/task.ts
+import * as Schema from "effect/Schema";
+
+export class Task extends Schema.Class<Task>("Task")({
+  id: Schema.String,
+  title: Schema.String,
+  completed: Schema.Boolean,
+}) {}
+
+export class TaskNotFound extends Schema.TaggedClass<TaskNotFound>()(
+  "TaskNotFound",
+  { id: Schema.String },
+) {}
+```
+
+**2a. HTTP API — declare endpoints, return `{ fetch }`.**
+`HttpApiBuilder.layer(TaskApi).pipe(..., HttpRouter.toHttpEffect)`
+is exactly the `HttpEffect` Workers expect:
+
+```typescript
+// src/worker.ts
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    const tasksGroup = HttpApiBuilder.group(TaskApi, "Tasks", (h) =>
+      h.handle("getTask", ({ params }) =>
+        tasks.get(params.id).pipe(
+          Effect.flatMap((o) =>
+            o ? decodeTask(o) : Effect.fail(new TaskNotFound({ id: params.id })),
+          ),
+        ),
+      ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(TaskApi).pipe(
+        Layer.provide(tasksGroup),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+**2b. RPC — declare procedures, return `{ fetch }`.** Same
+schemas, same Worker shape, different transport. The RPC server
+also produces an `HttpEffect`:
+
+```typescript
+// src/rpcs.ts
+export class TaskRpcs extends RpcGroup.make(
+  Rpc.make("getTask", {
+    payload: { id: Schema.String },
+    success: Task,
+    error: TaskNotFound,
+  }),
+  Rpc.make("createTask", {
+    payload: { title: Schema.String },
+    success: Task,
+  }),
+) {}
+```
+
+```typescript
+// src/worker.ts
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    const handlersLayer = TaskRpcs.toLayer({
+      getTask: ({ id }) => /* ... */,
+      createTask: ({ title }) => /* ... */,
+    });
+
+    return {
+      fetch: RpcServer.toHttpEffect(TaskRpcs).pipe(
+        Effect.provide(handlersLayer),
+        Effect.provide(RpcSerialization.layerJson),
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+**3. Bind a Durable Object, get a typed fetcher per instance.**
+The DO's Init returns the same `{ fetch }` shape — an
+`HttpEffect` from either `HttpApiBuilder` or
+`RpcServer.toHttpEffect`. Inside the Worker, bind the DO and use
+`Cloudflare.toHttpClient(stub)` to turn each instance into a
+typed client:
+
+```typescript
+const tasksDO = yield* TasksObject;
+
+const getDOClient = (id: string = "default") =>
+  HttpApiClient.makeWith(TaskDOApi, {
+    baseUrl: "http://localhost",
+    httpClient: Cloudflare.toHttpClient(tasksDO.getByName(id)),
+  });
+```
+
+The `baseUrl` is a placeholder — `toHttpClient` short-circuits
+straight to `tasksDO.getByName(id).fetch`, so the call never
+leaves the isolate. The same wrapper plugs into
+`RpcClient.layerProtocolHttp` if the DO speaks RPC instead:
+
+```typescript
+const makeDOClient = (id: string = "default") =>
+  RpcClient.make(DoRpcs).pipe(
+    Effect.provide(
+      RpcClient.layerProtocolHttp({ url: "http://localhost" }).pipe(
+        Layer.provide(
+          Layer.succeed(
+            HttpClient.HttpClient,
+            Cloudflare.toHttpClient(tasksDO.getByName(id)),
+          ),
+        ),
+        Layer.provide(RpcSerialization.layerNdjson),
+      ),
+    ),
+  );
+```
+
+One `Task` schema. Worker exposes HTTP API or RPC. DO speaks the
+same protocol back to the Worker. Per-DO-instance fetchers via
+`getByName(id)`. With beta.41's per-request scoping, the whole
+chain runs without scope leaks or cross-context promise errors.
+
+The guides walk through the full thing:
+
+- [Effect HTTP API](/guides/effect-http-api) — schema → endpoints
+  → Worker → typed client, plus the DO-backed variant.
+- [Effect RPC](/guides/effect-rpc) — schema → procedures →
+  Worker → typed client, plus streaming and DO-backed RPCs.
+
+## Other fixes
+
+- **`WorkerProps.env` flows into `InferEnv`** — typing
+  `worker.env.MY_VAR` now picks up keys you declared in
+  `env: { ... }` on the Worker, not just bindings
+  ([#351](https://github.com/alchemy-run/alchemy-effect/pull/351)).
+- **`WorkerExecutionContext` + `ExecutionContext` in fetch types** —
+  the Worker fetch handler now exposes both the Effect-side
+  `ExecutionContext` (with the request scope) and the raw
+  workerd `WorkerExecutionContext`, so `ctx.waitUntil(...)` and
+  friends are reachable from inside the handler without an
+  extra cast. Thanks
+  **[Michael K](https://github.com/michaelkleene)**
+  ([#358](https://github.com/alchemy-run/alchemy-effect/pull/358)).
+- **DO methods receive the Worker env** — previously, RPC methods
+  on a `DurableObjectNamespace` were running with an empty `env`
+  context, breaking any binding the DO needed to call into. Thanks
+  **[Dillon Mulroy](https://github.com/dmmulroy)**
+  ([#369](https://github.com/alchemy-run/alchemy-effect/pull/369)).
+- **`Redacted` survives sidecar RPC serialization** — sidecar
+  was unwrapping `Redacted` values during JSON round-trips,
+  leaking secrets in dev logs. They're now preserved end to end.
+  Thanks **[Juliaan](https://github.com/Juliaan)**
+  ([#356](https://github.com/alchemy-run/alchemy-effect/pull/356)).
+- **`lightningcss` + `fsevents` externalized in the Worker
+  bundler** — both are platform-specific native deps that don't
+  belong in the Worker bundle. Thanks
+  **[Michael K](https://github.com/michaelkleene)**
+  ([#363](https://github.com/alchemy-run/alchemy-effect/pull/363)).
+- **Worker teardown force-deletes scripts** — if a Worker had
+  stuck Durable Object migrations from a previous failed deploy,
+  `destroy` would hang. It now force-deletes the script and
+  proceeds ([#348](https://github.com/alchemy-run/alchemy-effect/pull/348)).
+- **Eager terminal status events while waiting on deps** — the
+  CLI now shows `pending` for resources blocked on dependencies
+  and emits terminal status (created/updated/failed) as soon as
+  the resource's own reconcile finishes, rather than batching at
+  the end. Thanks **[Michael K](https://github.com/michaelkleene)**
+  ([#376](https://github.com/alchemy-run/alchemy-effect/pull/376)).
+
+## Contributors
+
+Big thank-you to everyone who shipped code in this beta:
+
+- **[Michael K](https://github.com/michaelkleene)** — Worker fetch type fix ([#358](https://github.com/alchemy-run/alchemy-effect/pull/358)), `lightningcss`/`fsevents` externalization ([#363](https://github.com/alchemy-run/alchemy-effect/pull/363)), eager terminal status events ([#376](https://github.com/alchemy-run/alchemy-effect/pull/376))
+- **[Dillon Mulroy](https://github.com/dmmulroy)** — DO methods receive Worker env ([#369](https://github.com/alchemy-run/alchemy-effect/pull/369))
+- **[Juliaan](https://github.com/Juliaan)** — `Redacted` across sidecar RPC ([#356](https://github.com/alchemy-run/alchemy-effect/pull/356))
+
+## Where to go next
+
+- [Effect HTTP API guide](/guides/effect-http-api)
+- [Effect RPC guide](/guides/effect-rpc)
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta41)
+- [Compare v2.0.0-beta.40 → v2.0.0-beta.41](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.40...v2.0.0-beta.41)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-21-beta-43.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-21-beta-43.md
new file mode 100644
index 00000000000..ce81187594f
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-21-beta-43.md
@@ -0,0 +1,249 @@
+---
+title: alchemy@2.0.0-beta.43
+date: 2026-05-21T22:00:00Z
+category: release
+excerpt: v2.0.0-beta.43 includes a new `alchemy/Planetscale` provider, improvements to how Resources and Bindings are encapsulated in Layers, and a handful of other fixes.
+---
+
+`v2.0.0-beta.43` includes a new `alchemy/Planetscale` provider,
+improvements to how Resources and Bindings are encapsulated in
+Layers, and a handful of other fixes.
+
+The headline is **PlanetScale** — typed `MySQLDatabase` and
+`PostgresDatabase` resources, branches, credentials, and a
+Drizzle integration that plugs straight into Cloudflare
+Hyperdrive, the same way every other Alchemy provider plugs
+into the rest of the graph.
+([#113](https://github.com/alchemy-run/alchemy-effect/pull/113))
+
+We'll walk it end-to-end against Postgres. The MySQL deltas are
+noted along the way — the shape is one-for-one.
+
+| MySQL                       | Postgres                       |
+| --------------------------- | ------------------------------ |
+| `Planetscale.MySQLDatabase` | `Planetscale.PostgresDatabase` |
+| `Planetscale.MySQLBranch`   | `Planetscale.PostgresBranch`   |
+| `Planetscale.MySQLPassword` | `Planetscale.PostgresRole`     |
+
+## Register the provider
+
+Add `Planetscale.providers()` to your stack. This registers the
+deploy-time policy bindings and an auth step that, on next
+`bun alchemy login`, either reads `PLANETSCALE_API_TOKEN_ID`,
+`PLANETSCALE_API_TOKEN`, and `PLANETSCALE_ORGANIZATION` from the
+environment or stores them under
+`~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+
+```diff lang="typescript"
+ // alchemy.run.ts
+ import * as Alchemy from "alchemy";
+ import * as Cloudflare from "alchemy/Cloudflare";
++import * as Planetscale from "alchemy/Planetscale";
++import * as Layer from "effect/Layer";
+
+ export default Alchemy.Stack("App", {
+-  providers: Cloudflare.providers(),
++  providers: Layer.mergeAll(
++    Cloudflare.providers(),
++    Planetscale.providers(),
++  ),
+   state: Alchemy.localState(),
+ }, /* ... */);
+```
+
+## Cluster → branch → role
+
+The three database resources mirror PlanetScale's own model: the
+**cluster** owns storage and region, **branches** are cheap
+forks per environment, and **roles** mint credentials against a
+branch.
+
+```typescript
+// src/Db.ts
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  const database = yield* Planetscale.PostgresDatabase("app-db", {
+    region: { slug: "us-east" },
+    clusterSize: "PS_10",
+  });
+
+  const branch = yield* Planetscale.PostgresBranch("app-branch", {
+    database,
+  });
+
+  const role = yield* Planetscale.PostgresRole("app-role", {
+    database,
+    branch,
+    inheritedRoles: ["postgres"],
+  });
+
+  return { database, branch, role };
+});
+```
+
+## Snap Hyperdrive on top
+
+Because `role.origin` is an `Output`, the deploy graph orders
+itself: `PostgresDatabase` → `PostgresBranch` → `PostgresRole` →
+`Hyperdrive` → `Worker`. No `dependsOn`, no `await` — the graph
+follows the dataflow.
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Hyperdrive = Effect.gen(function* () {
+  const { role } = yield* Db;
+  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+    origin: role.origin,
+  });
+});
+```
+
+For MySQL, pass `password.origin`; Hyperdrive sees
+`scheme: "mysql"` and provisions a MySQL pooler.
+
+## Drizzle on Hyperdrive
+
+`Cloudflare.Hyperdrive.bind(Hyperdrive)` returns a binding whose
+`connectionString` resolves at runtime to a `Redacted` pooled
+endpoint. The new `Drizzle.postgres` helper takes that
+connection string and gives you an Effect-native Drizzle client
+— queries are `yield*`-able and errors land on the Effect error
+channel.
+
+```diff lang="typescript"
+ // src/Api.ts
+ import * as Cloudflare from "alchemy/Cloudflare";
++import * as Drizzle from "alchemy/Drizzle";
+ import * as Effect from "effect/Effect";
++import { relations, Users } from "./schema.ts";
+ import { Hyperdrive } from "./Db.ts";
+
+ export default class Api extends Cloudflare.Worker<Api>()(
+   "Api",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
+     const conn = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
++    const db = yield* Drizzle.postgres(conn.connectionString, { relations });
+
+     return {
+       fetch: Effect.gen(function* () {
++        const users = yield* db.select().from(Users);
+         return yield* HttpServerResponse.json({ users });
+       }),
+     };
+   }).pipe(Effect.provide(Cloudflare.HyperdriveBindingLive)),
+ ) {}
+```
+
+(For MySQL there's no `Drizzle.mysql` helper yet — pair with
+`mysql2` directly inside `fetch`.)
+
+## Migrations as a resource
+
+`Drizzle.Schema` wraps drizzle-kit's programmatic API as an
+Alchemy resource. On each deploy it diffs `./src/schema.ts`
+against the latest snapshot and, if it drifted, writes a new
+migration directory. Wire its `out` into the branch's
+`migrationsDir` and the branch scans the directory and applies
+new SQL files transactionally — schema → migration files →
+applied migrations, in one deploy.
+
+```diff lang="typescript"
+ export const Db = Effect.gen(function* () {
++  const schema = yield* Drizzle.Schema("app-schema", {
++    schema: "./src/schema.ts",
++    out: "./migrations",
++  });
+
+   const database = yield* Planetscale.PostgresDatabase("app-db", { /* ... */ });
+
+   const branch = yield* Planetscale.PostgresBranch("app-branch", {
+     database,
++    migrationsDir: schema.out,
+   });
+   // role / hyperdrive unchanged
+ });
+```
+
+Don't forget to add `Drizzle.providers()` alongside
+`Planetscale.providers()` in the stack.
+
+## `.ref()` — fork from a centralised staging database
+
+The walkthrough so far creates a fresh `PostgresDatabase` for
+every stage. That's right for `dev_<user>` and `prod`, but wrong
+for PR previews — spinning up a new Postgres cluster per PR is
+slow, expensive, and out of step with how PlanetScale itself
+thinks about branching.
+
+beta.43 ships `Resource.ref()` on every resource type. It reads
+output attributes from another stage's state instead of
+provisioning, returns a handle of the same type, and is
+indistinguishable from the owned resource to anything
+downstream. Combined with a two-tier stage layout —
+`staging-*` owns long-lived databases, `pr-*` owns ephemeral
+compute — the fork point collapses into one ternary:
+
+```diff lang="typescript"
+ export const Db = Effect.gen(function* () {
++  const { stage } = yield* Alchemy.Stack;
+
+-  const database = yield* Planetscale.PostgresDatabase("app-db", {
+-    region: { slug: "us-east" },
+-    clusterSize: "PS_10",
+-  });
++  const database = stage.startsWith("pr-")
++    ? yield* Planetscale.PostgresDatabase.ref("app-db", {
++        stage: `staging-${stage}`,
++      })
++    : yield* Planetscale.PostgresDatabase("app-db", {
++        region: { slug: "us-east" },
++        clusterSize: "PS_10",
++      });
+   // branch / role / hyperdrive stay the same
+ });
+```
+
+When `pr-123` deploys, `staging-pr-123` has already run and
+owns the cluster; `pr-123` references it and provisions only
+its own branch, role, Hyperdrive, and Worker. Tear-down on PR
+close drops the per-PR resources without touching the cluster.
+Same code, three deployment topologies.
+
+## Also in this release
+
+A smaller but load-bearing change: **Infrastructure Layers no
+longer leak `WorkerEnvironment`**. Every binding API method
+(`kv.get`, `db.prepare(...).first()`, `Hyperdrive.bind`) used
+to return an `Effect` whose `R` channel carried
+`WorkerEnvironment`, which propagated up through every Layer
+that wrapped it. `WorkerEnvironment` is now resolved once
+inside each `*BindingLive` Layer and closed over, leaving only
+`Alchemy.RuntimeContext` — the cloud-agnostic color for "runs
+inside a deployed Function or Worker" — in the requirement
+channel.
+
+```diff lang="typescript"
+-kv.get(key, "json"): Effect.Effect<Job | null, KVNamespaceError, WorkerEnvironment>
++kv.get(key, "json"): Effect.Effect<Job | null, KVNamespaceError, RuntimeContext>
+```
+
+A `JobService` wrapping KV can now expose
+`Effect<Job, _, RuntimeContext>` to consumers without
+mentioning Cloudflare at all. See
+[Concepts › Layers](https://v2.alchemy.run/concepts/layers/) for
+the underlying model.
+([#383](https://github.com/alchemy-run/alchemy-effect/pull/383),
+[#386](https://github.com/alchemy-run/alchemy-effect/pull/386))
+
+## Where to go next
+
+- [Hyperdrive tutorial](/tutorial/cloudflare/hyperdrive) — PlanetScale Postgres and MySQL tabs alongside Neon
+- [Drizzle tutorial](/tutorial/cloudflare/drizzle) — `Drizzle.Schema` and deploy-driven migrations
+- [Branch from a shared database](/tutorial/cloudflare/branch-from-shared-database) — `.ref()` as a guided tutorial
+- [PlanetScale Postgres + Drizzle example](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-planetscale-postgres-drizzle)
+- [PlanetScale MySQL + Drizzle example](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-planetscale-mysql-drizzle)
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md) · [v2.0.0-beta.42 → v2.0.0-beta.43](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.42...v2.0.0-beta.43)
diff --git a/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-22-beta-44.md b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-22-beta-44.md
new file mode 100644
index 00000000000..becae75c031
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/blog/2026-05-22-beta-44.md
@@ -0,0 +1,172 @@
+---
+title: alchemy@2.0.0-beta.44
+date: 2026-05-22T20:00:00Z
+category: release
+excerpt: v2.0.0-beta.44 adds a new `Cloudflare.ZarazConfig` resource, a bundle analyzer for Workers, and Artifacts binding support in dev, plus a handful of bundler and dev-server fixes.
+---
+
+`v2.0.0-beta.44` is a polish release. Two new things worth
+calling out — a new **`Cloudflare.ZarazConfig`** resource and a
+**bundle analyzer plugin** for the Worker bundler — plus a
+batch of bundler and dev-server fixes.
+
+## `Cloudflare.ZarazConfig`
+
+New resource for managing a zone's Zaraz config — tools,
+triggers, variables, consent, analytics, and workflow mode —
+declaratively alongside the rest of your Cloudflare stack.
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+
+const zaraz = yield* Cloudflare.ZarazConfig("analytics", {
+  zone: "example.com",
+  tools: {
+    "google-analytics": { /* tool config */ },
+  },
+  consent: { enabled: true },
+});
+```
+
+A couple of design notes worth knowing:
+
+- Fields you omit (`tools`, `triggers`, `variables`, `workflow`)
+  are **left alone** rather than wiped. This means you can adopt
+  a zone's existing Zaraz setup incrementally.
+- Destroy is **opt-in** via `delete: true`. By default,
+  destroying the resource removes it from Alchemy state and
+  leaves the zone's Zaraz config intact. With `delete: true`,
+  destroy restores Cloudflare's defaults (including resetting
+  `workflow` to real-time mode).
+- Typed Zaraz event helpers ship as `defineZarazEvents`.
+
+Thanks **[Alex](https://github.com/gogl-alex)** for the
+contribution.
+([#371](https://github.com/alchemy-run/alchemy-effect/pull/371))
+
+## Bundle analyzer for Workers
+
+The Worker bundler can now emit a per-build report describing
+exactly what ended up in your bundle: chunks, modules, the
+import graph reachable from each entry point, and which entry
+pulled in which module.
+
+Opt in via `build.bundleAnalyzer` on the Worker:
+
+```diff lang="typescript"
+ export default class Api extends Cloudflare.Worker<Api>()(
+   "Api",
+   {
+     main: import.meta.filename,
++    build: { bundleAnalyzer: true },
+   },
+   /* ... */
+ ) {}
+```
+
+By default this writes `analyze-data.md` next to the bundle in `.alchemy/bundles/<id>`.
+Pass an object to customize:
+
+```typescript
+build: {
+  bundleAnalyzer: { fileName: "bundle.json", format: "json" },
+}
+```
+
+Under the hood it wraps rolldown's experimental
+`bundleAnalyzerPlugin`, exported as `Bundle.bundleAnalyzerPlugin`
+for anyone composing their own bundles.
+([#405](https://github.com/alchemy-run/alchemy-effect/pull/405))
+
+This replaces the previous `build.metafile` option, which is now removed.
+
+## `Cloudflare.Artifacts` in dev
+
+The `Cloudflare.Artifacts` binding now works under
+`bun alchemy dev` — previously it was only wired up in deployed
+Workers. No code change required; existing artifact bindings
+light up locally on upgrade.
+([#419](https://github.com/alchemy-run/alchemy-effect/pull/419))
+
+## `RpcProvider` for more reliable local development
+
+Until beta.43, local providers (the runtime that backs
+`Cloudflare.Worker`, `DurableObjectNamespace`, etc. under
+`alchemy dev`) ran inside an in-process "sidecar" tied to the
+dev server. That worked, but it leaked: when the dev process
+exited — Ctrl-C, crash, HMR restart — the child `workerd`
+processes it had spawned could survive, holding ports
+open and consuming memory until you noticed and killed them by
+hand.
+
+beta.44 refactors this into a generic `Local/Rpc*` provider
+abstraction. Local providers now run in their own child process
+managed by a new `RpcSpawner`, and the parent talks to them
+over RPC. Concretely:
+
+- It registers an `exitHook` that `SIGKILL`s the entire process
+  group when the parent exits, plus a scoped finalizer for the
+  graceful path. Dangling `workerd` processes are gone.
+- Sessions are cached per
+  `(serverEntryUrl, alchemyContext, stack)` and respawned
+  automatically if the child dies mid-session.
+- `RpcProvider.providerServicesEffect` lets heavy provider-only
+  layers (e.g. the Cloudflare local runtime and proxy) build
+  lazily inside the child rather than eagerly in the parent —
+  the parent stays lean.
+
+The defining shape for a provider is now thin:
+
+```typescript
+export const LocalWorkerProvider = () =>
+  RpcProvider.effect(
+    Worker,
+    import.meta.resolve(/* ./Local.ts | ./Local.js */),
+    Effect.gen(function* () { /* … */ }),
+  );
+```
+
+## Also in this release
+
+- **Vite-style `?raw` imports in the Worker bundler** —
+  `import sql from "./schema.sql?raw"` now works, matching the
+  Vite convention for inlining a file as a string
+  ([#411](https://github.com/alchemy-run/alchemy-effect/pull/411)).
+- **Local Durable Objects hardened** — fixes swapped
+  `className`/`namespaceId` in the local provider output, makes
+  the local `namespaceId` deterministic and independent of the
+  binding name, and stops DOs declared on other Workers in the
+  stack from being registered against the current Worker
+  ([#408](https://github.com/alchemy-run/alchemy-effect/pull/408)).
+- **`alchemy dev` now honors your Workers `assets` config** —
+  the configured asset behavior was previously ignored in local
+  dev
+  ([#403](https://github.com/alchemy-run/alchemy-effect/pull/403)).
+- **`mysql2` no longer errors at bundle time** in the Worker
+  bundler
+  ([#403](https://github.com/alchemy-run/alchemy-effect/pull/403)).
+- **`x-forwarded-for` and `x-forwarded-proto` headers** are now
+  forwarded on incoming requests in `alchemy dev`
+  ([#403](https://github.com/alchemy-run/alchemy-effect/pull/403)).
+- **Rolldown bumped to 1.0.1 stable** — out of pre-release
+  ([#409](https://github.com/alchemy-run/alchemy-effect/pull/409)).
+- **`@alchemy.run/node-utils` import resolution fix** — resolves
+  an ESM resolution error on Node
+  ([#406](https://github.com/alchemy-run/alchemy-effect/pull/406)).
+- **CLI filters Bun's "not in project directory" watcher warning** —
+  no more spurious warnings during dev. Thanks
+  **[Michael K](https://github.com/michaelkleene)**
+  ([#124](https://github.com/alchemy-run/alchemy-effect/pull/124)).
+
+## Contributors
+
+Thanks to everyone who shipped code in this beta:
+
+- **[Alex](https://github.com/gogl-alex)** — `Cloudflare.ZarazConfig` ([#371](https://github.com/alchemy-run/alchemy-effect/pull/371))
+- **[Michael K](https://github.com/michaelkleene)** — CLI watcher warning filter ([#124](https://github.com/alchemy-run/alchemy-effect/pull/124))
+- **[sam](https://github.com/samgoodwin)** — privacy page styling cleanup ([#398](https://github.com/alchemy-run/alchemy-effect/pull/398))
+
+## Where to go next
+
+- [CHANGELOG](https://github.com/alchemy-run/alchemy-effect/blob/main/CHANGELOG.md#v200-beta44)
+- [Compare v2.0.0-beta.43 → v2.0.0-beta.44](https://github.com/alchemy-run/alchemy-effect/compare/v2.0.0-beta.43...v2.0.0-beta.44)
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/action.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/action.mdx
new file mode 100644
index 00000000000..63cb1dc9088
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/action.mdx
@@ -0,0 +1,145 @@
+---
+title: Action
+description: A node in the dependency graph that runs an Effect during apply when its inputs change.
+sidebar:
+  order: 2
+---
+
+An **Action** is a node in the stack's dependency graph that runs an
+arbitrary Effect during `apply`. Unlike a [Resource](/concepts/resource), it has
+no provider lifecycle — no replace, no read, no delete. The engine just
+diffs the resolved input against the last persisted hash and either runs
+the body or skips it.
+
+Actions are useful for one-off deploy-time work that needs to be
+reproducible and dependency-aware: seeding a database, posting a
+release notification, generating an artifact and uploading it,
+invalidating a CDN cache, running a migration check.
+
+## Declaring an Action
+
+Define an Action with its type name and a body, then call it inside a
+stack to register an instance. `yield*` returns `Output<Out>` ready to
+feed into downstream nodes:
+
+```typescript
+const Sync = Action("Sync", Effect.fn(function* (input: { table: string }) {
+  yield* Effect.log(`syncing ${input.table}`);
+  return { rows: 42 };
+}));
+
+// In a stack — default form uses the Type as the LogicalId:
+const rows = yield* Sync({ table: bucket.name });
+//          ^ Output<{ rows: number }>
+rows.rows // Output<number>
+```
+
+The body Effect receives the **resolved** input — any
+[Output](/concepts/outputs) references in the input are evaluated against the
+current tracker before the body runs.
+
+### Init constructor (pulling in dependencies)
+
+Pass an Effect that yields the runner instead of the runner itself.
+The init Effect can `yield*` services, and those dependencies surface
+as `Req` on the call site:
+
+```typescript
+const Sync = Action("Sync", Effect.gen(function* () {
+  const db = yield* Database;
+  const logger = yield* Logger;
+  return Effect.fn(function* (input: { table: string }) {
+    yield* logger.info(`syncing ${input.table}`);
+    return { rows: yield* db.count(input.table) };
+  });
+}));
+
+// `yield* Sync({...})` now requires `Database | Logger | Stack`.
+```
+
+The init runs at most once per process and the resolved runner is
+reused across every instance and re-run.
+
+### Multiple instances
+
+Pass an explicit logical id to register more than one instance of the
+same Action definition:
+
+```typescript
+const nightly = yield* Sync("nightly", { table: usersBucket.name });
+const hourly  = yield* Sync("hourly",  { table: eventsBucket.name });
+```
+
+### Tagged form (service + layer)
+
+When you want to split the contract from the implementation — e.g. for
+testing or to keep stack code declarative — use the class form. It
+mirrors [Platform](/concepts/platform):
+
+```typescript
+export class Sync extends Action<Sync, { table: string }, { rows: number }>()("Sync") {}
+
+export const SyncLive = Sync.make(
+  Effect.gen(function* () {
+    const db = yield* Database;
+    return Effect.fn(function* (input) {
+      return { rows: yield* db.count(input.table) };
+    });
+  }),
+);
+
+// In a stack:
+const rows = yield* Sync({ table: bucket.name });
+//          ^ requires `Sync` — add `SyncLive` to the stack's providers.
+```
+
+`.make(...)` accepts either a direct runner or an init Effect.
+
+## Lifecycle
+
+An Action has only two terminal states:
+
+| Action | Symbol | When |
+| --- | --- | --- |
+| **run**  | `λ` | First time, or `inputHash` differs from the last persisted run, or `--force` is set |
+| **skip** | `·` | Persisted `inputHash` matches the newly resolved input |
+
+There is no `replace` and no `delete`. When an Action is removed from the
+stack, its persisted state is dropped without the body being invoked.
+
+### Input hashing
+
+The Action's input is JSON-serialized and SHA-256 hashed after upstream
+Outputs are resolved. The hash is persisted alongside the result; on
+the next plan, a new hash that matches means "skip", a new hash that
+differs means "run".
+
+### Forcing a re-run
+
+```sh
+alchemy deploy --force
+```
+
+`--force` flips every `skip` to `run` at plan time, including actions.
+
+### Dependencies
+
+Actions live in the same FQN namespace as Resources. They can:
+
+- Take Resource outputs as input (`{ table: bucket.name }`)
+- Be referenced by Resources via `action.output` (downstream resource
+  waits for the action before reconciling)
+- Reference other Actions
+
+Cycles are rejected at plan time just like resource cycles.
+
+## What Actions are not
+
+- **Not a Resource.** No `diff`/`read`/`reconcile`/`delete`. If you
+  need lifecycle management of a cloud entity, model it as a Resource.
+- **Not a runtime function.** An Action runs at deploy time. To call code
+  from a deployed Worker/Lambda, use a [Platform](/concepts/platform).
+- **Not idempotent for free.** The engine guarantees the body runs
+  only when inputs change, but the body itself must tolerate retries
+  on apply restart (its `running` state is persisted but not its
+  side effects).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/binding.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/binding.mdx
new file mode 100644
index 00000000000..4baf6b07bf6
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/binding.mdx
@@ -0,0 +1,249 @@
+---
+title: Binding
+description: A binding connects a resource to a Worker or Lambda. It generates IAM policies, env vars, and a typed SDK in one call.
+sidebar:
+  order: 7
+---
+
+A **Binding** connects a [Resource](/concepts/resource) to a
+[Platform](/concepts/platform) — a Worker, a Lambda Function, a
+Container. One `bind()` call generates the IAM policies, the
+environment variables, **and** the typed SDK wrapper your handler
+uses. You don't write any of that by hand.
+
+This page covers the mechanics. For the bigger picture of how
+bindings fit into a Platform's runtime, see
+[Platform › Bindings in action](/concepts/platform#bindings-in-action).
+
+## A binding in one line
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+// later, in fetch:
+yield* bucket.put("hello.txt", "world");
+```
+
+`bucket` here is the resource itself, presented as a typed client.
+There is no `env.BUCKET`, no `BUCKET_NAME` lookup — the binding **is**
+the SDK.
+
+## Effect style vs async style
+
+Bindings work in both handler styles a Platform supports. Pick
+whichever your Worker / Lambda is using.
+
+**Effect style** — `bind()` inside the init Effect, returns a typed
+handle:
+
+```typescript
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
+        const obj = yield* bucket.get("key");
+        // ...
+      }),
+    };
+  }),
+);
+```
+
+**Async style** — declare bindings on the resource's `env` prop,
+type the env with `InferEnv`:
+
+```typescript
+// alchemy.run.ts
+export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: { Bucket, KV },
+});
+
+// src/worker.ts
+export default {
+  async fetch(request: Request, env: WorkerEnv) {
+    const obj = await env.Bucket.get("key");
+    // ...
+  },
+};
+```
+
+The rest of this page walks through the Effect style; the same
+deploy-time mechanics apply to both.
+
+## What `.bind()` does at deploy time
+
+Each call records three things on the platform's plan:
+
+1. **Permissions** — IAM (AWS) or Worker bindings (Cloudflare)
+2. **Environment / configuration** — physical names, ARNs, URLs
+3. **A typed SDK wrapper** — bundled into the handler
+
+### Automatic IAM (AWS)
+
+Each binding maps to specific IAM actions on the exact resource
+ARNs. Alchemy generates **least-privilege** policies — `Resource:
+"*"` is only used when the API genuinely doesn't support
+resource-level scoping.
+
+| Binding                        | IAM Actions        | Resource                     |
+| ------------------------------ | ------------------ | ---------------------------- |
+| `S3.GetObject.bind(bucket)`    | `s3:GetObject`     | `arn:aws:s3:::bucket-name/*` |
+| `S3.PutObject.bind(bucket)`    | `s3:PutObject`     | `arn:aws:s3:::bucket-name/*` |
+| `SQS.SendMessage.bind(queue)`  | `sqs:SendMessage`  | Queue ARN                    |
+| `DynamoDB.GetItem.bind(table)` | `dynamodb:GetItem` | Table ARN                    |
+| `DynamoDB.PutItem.bind(table)` | `dynamodb:PutItem` | Table ARN                    |
+
+Multi-resource bindings enumerate every ARN they touch:
+
+```typescript
+const get = yield* DynamoDB.GetItem.bind(JobsTable, AuditTable);
+// → policy enumerates both table ARNs explicitly
+```
+
+### Automatic environment variables
+
+Bindings inject the env vars the SDK wrapper needs — `BUCKET_NAME`,
+`QUEUE_URL`, `TABLE_ARN`, etc. You don't read these yourself; the
+typed wrapper takes care of it.
+
+## Cloudflare bindings
+
+On Cloudflare, the same call attaches a native Worker binding (R2,
+KV, D1, Durable Object…) instead of an IAM policy:
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+const kv = yield* Cloudflare.KVNamespace.bind(Sessions);
+```
+
+The runtime API is identical to the AWS counterpart — code that
+consumes one consumes the other.
+
+## Event sources
+
+An **event source** is a binding that triggers your function when
+something happens on a resource. It hands you the records as an
+Effect `Stream`, so the whole event loop becomes a value you can map,
+filter, batch, and pipe:
+
+```typescript
+yield* SQS.messages(InboundQueue).subscribe((records) =>
+  records.pipe(
+    Stream.map((r) => r.body),
+    Stream.runForEach(Console.log),
+  ),
+);
+```
+
+The other event sources have the same shape — only the record type
+and the entry-point name change:
+
+| Source                    | Entry point                | Stream element        |
+| ------------------------- | -------------------------- | --------------------- |
+| `SQS.messages(queue)`     | `.subscribe(fn)`           | `SQSRecord`           |
+| `Kinesis.records(stream)` | `.process(fn)`             | `KinesisStreamRecord` |
+| `DynamoDB.stream(table)`  | `.process(fn)`             | `StreamRecord<T>`     |
+
+One call wires the event-source mapping, the IAM (or Cloudflare
+binding), and the typed `Stream`.
+
+## Sinks
+
+A **sink** is the dual of an event source: a binding for *writing*
+that exposes the resource as an Effect [`Sink`](https://effect.website/docs/sink/introduction/).
+It batches input chunks into the underlying batch API
+(`SendMessageBatch`, `PutRecords`, `PublishBatch`) and emits the
+minimal IAM to go with it.
+
+```typescript
+const sink = yield* SQS.QueueSink.bind(OutboundQueue);
+// → Sink<void, string, readonly string[], never>
+// → policy: sqs:SendMessage + sqs:SendMessageBatch on OutboundQueue's ARN
+
+yield* Stream.fromIterable(["a", "b", "c"]).pipe(Stream.run(sink));
+```
+
+Sinks are typed by the element they accept, so the type system stops
+you from feeding the wrong shape in: `QueueSink` and `TopicSink` take
+`string`, `StreamSink` takes `PutRecordsRequestEntry` (you keep
+control of `PartitionKey`).
+
+### Source → transform → sink
+
+Where the model pays off is when you compose them. Because every step
+is just `Stream` / `Sink`, the whole pipe-and-transform pipeline is
+one expression:
+
+```typescript
+const outbound = yield* SQS.Queue("Outbound");
+const sink = yield* SQS.QueueSink.bind(outbound);
+
+yield* DynamoDB.stream(OrdersTable, {
+  streamViewType: "NEW_AND_OLD_IMAGES",
+  startingPosition: "LATEST",
+}).process<Order>((records) =>
+  records.pipe(
+    Stream.filterMap((r) => Option.fromNullable(r.dynamodb.NewImage)),
+    Stream.filter((order) => order.status === "PAID"),
+    Stream.map((order) => JSON.stringify({ orderId: order.id })),
+    Stream.run(sink),
+  ),
+);
+```
+
+Two `bind()` calls, one pipeline. Alchemy generates **both** sides
+of the policy automatically — `dynamodb:DescribeStream` /
+`GetRecords` / `GetShardIterator` on `OrdersTable`'s stream,
+`sqs:SendMessageBatch` on `Outbound` — plus the event-source
+mapping. There is no env-var plumbing, no `SendMessageBatchCommand`
+chunking by hand, and the sink coalesces the stream into 10-message
+batches under the hood.
+
+Drop in `Effect.retry`, `Stream.throttle`, `Stream.groupedWithin`,
+or `Stream.mapEffect` anywhere along the chain — they're all the
+same `Stream` you'd write in a plain Effect program.
+
+## How it works under the hood
+
+Internally each binding splits into two layers — and which one runs
+depends on the [phase](/concepts/phases):
+
+- **`Binding.Service`** — the runtime SDK wrapper that gets bundled
+  into your function. This is what `bucket.get(...)` actually calls.
+- **`Binding.Policy`** — the deploy-time logic that emits IAM,
+  Worker bindings, and env vars. This is **not** included in the
+  runtime bundle.
+
+At plantime the Policy layer is provided, so `bind()` records what
+the function needs. At runtime the Policy layer is absent, so the
+same call resolves to just the lightweight Service wrapper. The
+runtime bundle stays small because none of the planning code ships.
+
+See [Plantime and Runtime › `Binding.Service` vs
+`Binding.Policy`](/concepts/phases#bindingservice-vs-bindingpolicy)
+for a deeper look.
+
+## All of Effect, on every binding
+
+Bindings return `Effect` values. That means `Effect.retry`,
+`timeout`, `catchTag` — they all just work, with typed error
+channels:
+
+```typescript
+const sendWithRetry = enqueue({ MessageBody: msg }).pipe(
+  Effect.retry({ times: 3, schedule: Schedule.exponential("100 millis") }),
+  Effect.timeout("5 seconds"),
+  Effect.catchTag("ThrottlingException", () => Effect.succeed(undefined)),
+);
+```
+
+Because every binding is an Effect with the same shape, you can
+hide them behind a service interface and swap implementations
+without touching handler code. That's exactly what
+[Layers](/concepts/layers) is about — read on.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/layers.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/layers.mdx
new file mode 100644
index 00000000000..bae25d2d13d
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/layers.mdx
@@ -0,0 +1,281 @@
+---
+title: Layers
+description: A Layer encapsulates a slice of infrastructure (resources, bindings, runtime logic) behind a typed service interface. Code that depends on the interface stays cloud-agnostic; swapping the implementation swaps the underlying infrastructure.
+sidebar:
+  order: 9
+---
+
+A [Binding](/concepts/binding) connects one [Resource](/concepts/resource)
+to a [Platform](/concepts/platform). A **Layer** is the next abstraction
+up: a unit of *encapsulated infrastructure*. It owns whatever resources
+and bindings it needs, returns a typed implementation of a service
+interface, and hides everything behind that interface.
+
+Layers are the mechanism that makes Alchemy code portable. A Worker
+written against an abstract `JobService` doesn't know whether its
+underlying storage is a KV namespace, a DynamoDB table, or an
+in-memory map — it depends on the *service*, and a Layer wires up
+the rest.
+
+## The encapsulation problem
+
+Say you want a Worker that serves jobs from a KV namespace. The
+straightforward thing is to bind the KV in the Worker's init
+closure and call it from `fetch`:
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default Cloudflare.Worker(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const kv = yield* Cloudflare.KVNamespaceBinding.bind(MyKV);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const job = yield* kv.get<Job>("job-1", "json");
+        return HttpServerResponse.json(job);
+      }),
+    };
+  }),
+);
+```
+
+This works, but the handler is welded to KV. The `fetch` body
+mentions `kv.get`, knows the value shape comes back as `"json"`,
+and propagates `KVNamespaceError`. Moving the data to DynamoDB or
+swapping in an in-memory fake for tests means rewriting `fetch` —
+not just the storage wiring.
+
+A Layer is the answer.
+
+## A service is a contract
+
+A service is a `Context.Service` — a typed Tag that names a
+capability without saying how it's provided:
+
+```typescript
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Alchemy from "alchemy";
+
+export class JobService extends Context.Service<
+  JobService,
+  {
+    getJob(id: string): Effect.Effect<Job, JobError, Alchemy.RuntimeContext>;
+  }
+>()("JobService") {}
+```
+
+A consumer writes `yield* JobService` and gets the typed object —
+nothing else. The signature deliberately mentions
+`Alchemy.RuntimeContext` (more on this below) but says nothing about
+KV, DynamoDB, or any specific cloud primitive.
+
+## A Layer encapsulates the infrastructure
+
+A Layer is the implementation side of a service. It declares the
+resources it needs, wires up bindings, and returns the typed value:
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export const JobServiceKV = Layer.effect(
+  JobService,
+  Effect.gen(function* () {
+    const MyKV = yield* Cloudflare.KVNamespace("MyKV");
+    const kv = yield* Cloudflare.KVNamespaceBinding.bind(MyKV);
+
+    return {
+      getJob: Effect.fn(function* (id: string) {
+        return yield* kv.get<Job>(id, "json");
+      }),
+    };
+  }),
+);
+```
+
+Three things happen in one expression:
+
+1. **The KV namespace is a real resource.** It joins the
+   [Stack](/concepts/stack), goes through plan/create/update like
+   anything else.
+2. **The binding is wired** — `KVNamespaceBinding.bind(MyKV)`
+   attaches the KV namespace to whichever Worker eventually consumes
+   this Layer.
+3. **A typed `JobService` is returned.** Callers see only `getJob`.
+
+## Cloud-agnostic consumers
+
+A Worker that wants jobs depends on `JobService` and provides a
+Layer to satisfy it:
+
+```typescript
+export default Cloudflare.Worker(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const jobs = yield* JobService;
+
+    return {
+      fetch: Effect.gen(function* () {
+        return yield* jobs.getJob("job-1");
+      }),
+    };
+  }).pipe(Effect.provide(JobServiceKV)),
+);
+```
+
+The handler never mentions KV. Swapping the implementation is a
+one-line change:
+
+```diff lang="typescript"
+-.pipe(Effect.provide(JobServiceKV))
++.pipe(Effect.provide(JobServiceDynamo))
+```
+
+The next deploy tears down the KV namespace and creates whatever
+`JobServiceDynamo` declares. The handler is untouched.
+
+## Where runtime requirements live
+
+The handler that called `kv.get` directly had a `fetch` body typed
+roughly:
+
+```typescript
+Effect.Effect<Response, KVNamespaceError, Alchemy.RuntimeContext>
+```
+
+The KV-specific error and the implicit dependence on a Cloudflare
+binding both leak into the handler's signature. The Layer-wrapped
+equivalent collapses to:
+
+```typescript
+Effect.Effect<Response, JobError, Alchemy.RuntimeContext>
+```
+
+The Cloudflare-specific surface is gone — absorbed by the Layer:
+
+```typescript
+export const KVNamespaceBindingLive = Layer.effect(
+  KVNamespaceBinding,
+  Effect.gen(function* () {
+    const env = yield* WorkerEnvironment; // ← required here, once
+    // ...returns a client that closes over env
+  }),
+);
+```
+
+The Worker that consumes `KVNamespaceBindingLive` satisfies
+`WorkerEnvironment` in one place; downstream callers see only
+`RuntimeContext`. Try the swap on a Cloudflare Worker:
+
+```diff lang="typescript"
+-.pipe(Effect.provide(JobServiceKV))         // requires WorkerEnvironment ✓
++.pipe(Effect.provide(JobServiceDynamo))     // requires AWS.FunctionEnvironment ✗
+```
+
+The Cloudflare Worker can't satisfy `AWS.FunctionEnvironment`, so
+the program won't type-check. Platforms and Layers fit together by
+type, not by convention.
+
+## Runtime as a colored function
+
+A Platform program has two [phases](/concepts/phases): the **init**
+closure (outer) runs at both plantime and cold start, and the
+**runtime** closure (inner) runs only inside the deployed handler.
+Bindings live in init; the actual cloud calls live in runtime:
+
+```typescript
+Cloudflare.Worker(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    // ─── Init: declare dependencies ───
+    const kv = yield* Cloudflare.KVNamespaceBinding.bind(MyKV);
+
+    return {
+      // ─── Runtime: use them ───
+      fetch: Effect.gen(function* () {
+        return yield* kv.get<Job>("job-1", "json");
+      }),
+    };
+  }),
+);
+```
+
+`Alchemy.RuntimeContext` is the Effect service that exists *only*
+inside the runtime closure. It is not provided at plantime, cold
+start init, or anywhere else. So an Effect like:
+
+```typescript
+kv.get(...): Effect.Effect<Job | null, KVNamespaceError, Alchemy.RuntimeContext>
+```
+
+is one the type system *guarantees* can only run in the runtime
+phase. Move that call up into the init closure and the type checker
+rejects it — `RuntimeContext` is not satisfied there.
+
+You can think of it as a "color" in the sense of
+[colored functions](https://journal.stuffwithstuff.com/2015/02/01/what-color-is-your-function/):
+
+```ts
+runtime function getJob(id: string): Job
+```
+
+TypeScript doesn't have keyword-level coloring, so Alchemy encodes
+the color as an Effect requirement. The compiler enforces the
+init/runtime boundary for you.
+
+## What you compose with
+
+A typical app stack mixes several Layers, one per capability:
+
+```typescript
+.pipe(
+  Effect.provide(Layer.mergeAll(
+    JobServiceKV,         // provides JobService
+    BetterAuthD1,         // provides BetterAuth
+    RateLimiterDurable,   // provides RateLimiter
+  )),
+)
+```
+
+Each Layer brings its own resources into the Stack and its own
+typed service into scope. Consumers stay declarative and ignorant
+of the underlying primitives.
+
+| Combinator             | Use it for                                                |
+| ---------------------- | --------------------------------------------------------- |
+| `Layer.mergeAll(a, b)` | Provide multiple independent services                     |
+| `Layer.provideMerge`   | A Layer that supplies *and* exposes a service             |
+| `Layer.provide`        | Satisfy one Layer's dependencies privately from another   |
+
+For the deploy-time mechanics that make Layers possible — typed
+clients, IAM, env injection — see [Binding](/concepts/binding). For
+the step-by-step of building one yourself, see
+[Building Infrastructure Layers](/guides/infrastructure-layers).
+
+## Why this matters
+
+Because Layers are normal Effect Layers, the patterns scale all the
+way out:
+
+- **Distribute on npm.** A service is just a TypeScript module
+  exporting a `Context.Service` and one or more Layers. Publish
+  `@org/jobs`, `npm install` it, `Effect.provide` it.
+- **Substitute for tests.** Provide a `JobServiceMemory` Layer
+  backed by a `Map`; the Worker under test never knows.
+- **Migrate without rewrites.** Moving from KV to DynamoDB is a
+  Layer swap, not a Worker rewrite.
+- **Type-safe portability.** Cloud-specific requirements are
+  confined to Layer construction; the consumer-facing surface
+  speaks only `RuntimeContext`.
+
+Infrastructure becomes a value you can encapsulate, name, and
+substitute — like any other module.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/local-development.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/local-development.mdx
new file mode 100644
index 00000000000..d19ebee154e
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/local-development.mdx
@@ -0,0 +1,110 @@
+---
+title: Local Development
+description: How alchemy dev provides hot reloading, local workerd execution, and cloud-backed resources for fast iteration.
+sidebar:
+  order: 12
+---
+
+import Terminal from "../../../components/Terminal.astro";
+
+`alchemy dev` gives you a fast local development loop without
+sacrificing access to real cloud services. Infrastructure is deployed
+to the cloud while your code runs locally with hot reloading.
+
+## How it works
+
+```sh
+alchemy dev
+```
+
+<Terminal content={`[g]✓[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [g]created[/g]
+[g]✓[/g] [b]DB[/b] [d](Cloudflare.D1Database)[/d] [g]created[/g]
+[g]✓[/g] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [g]created[/g] [d](local → workerd)[/d]
+[s2][d]• http://localhost:1337[/d]
+
+[d]Watching for changes ...[/d]`} />
+
+Three things happen:
+
+1. **Infrastructure deploys to the cloud** — R2 Buckets, D1
+   Databases, KV Namespaces are created on the real provider. No
+   emulation, no fidelity gaps.
+2. **Workers run locally in workerd** — your code executes in
+   workerd, the same runtime used in production. A proxy routes
+   requests between the cloud and your local process.
+3. **File changes hot reload** — edit your code and the Worker
+   rebuilds instantly.
+
+## Hot module reloading
+
+<Terminal content={`[d]Watching for changes ...[/d]
+
+[y]↻[/y] [d]src/worker.ts changed[/d]
+[s2][d]• Rebuilding worker ...[/d]
+[g]✓[/g] [b]Worker[/b] [d]reloaded in 42ms[/d]
+
+[y]↻[/y] [d]src/api.ts changed[/d]
+[s2][d]• Rebuilding worker ...[/d]
+[g]✓[/g] [b]Worker[/b] [d]reloaded in 38ms[/d]`} />
+
+- Code changes take effect in **milliseconds**, not minutes
+- Cloud resources stay deployed across reloads — only your
+  application code is rebuilt
+- Edit, save, refresh
+
+## Why not emulate everything?
+
+Full local emulation (Miniflare, LocalStack) replicates cloud APIs
+on your machine. This leads to fidelity gaps, missing features, and
+false confidence — tests pass locally but fail in production.
+
+Alchemy avoids this. Your R2 Bucket is a real R2 Bucket. Your D1
+Database is a real D1 Database. The only thing running locally is
+your application code.
+
+## Debugging
+
+Because Workers run locally in workerd, you can attach a debugger:
+
+- Set breakpoints in your IDE
+- Inspect variables and call stacks
+- Profile performance
+
+No more `console.log` debugging against deployed Workers.
+
+## Resource adaptation
+
+Resources adapt their behavior in dev mode:
+
+- **Cloudflare Workers** — run locally in workerd with a cloud proxy
+  instead of deploying to the edge
+- **Vite dev servers** — integrate with Alchemy's dev server for
+  frontend hot reloading alongside your backend
+- **Databases** — connect to real cloud instances, eliminating schema
+  drift between dev and prod
+
+Each resource's provider checks `ALCHEMY_PHASE` (set to `dev`) and
+adjusts accordingly.
+
+## Custom port
+
+```typescript
+export default Cloudflare.Worker("Worker", {
+  main: import.meta.path,
+  dev: {
+    port: 3000,
+  },
+  // ...
+});
+```
+
+## Dev vs Deploy
+
+|                  | `alchemy dev`           | `alchemy deploy`     |
+| ---------------- | ----------------------- | -------------------- |
+| Infrastructure   | Deployed to cloud       | Deployed to cloud    |
+| Application code | Runs locally in workerd | Deployed to cloud    |
+| File watching    | Hot reload on change    | Manual redeploy      |
+| Debugging        | Attach local debugger   | Tail logs            |
+| Speed            | Milliseconds            | Seconds to minutes   |
+| Fidelity         | Real cloud resources    | Real cloud resources |
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/observability.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/observability.mdx
new file mode 100644
index 00000000000..53f5653c871
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/observability.mdx
@@ -0,0 +1,78 @@
+---
+title: Observability
+description: Effect emits OpenTelemetry — ship traces, metrics, and logs to Axiom, Datadog, CloudWatch, or any OTLP endpoint. Declare dashboards and alarms in code.
+sidebar:
+  order: 13
+---
+
+Effect already emits traces, metrics, and logs. Alchemy declares the
+exporter as a Layer — point it at Axiom, Datadog, CloudWatch, or any
+OTLP endpoint. Then declare your dashboards and alarms next to the
+code that emits the metrics.
+
+## OTel everywhere
+
+Every Effect spans a trace. Every `Metric` increments a counter.
+Every `logInfo` ships a log line. The exporter is a Layer — swap one
+line, ship to a different vendor.
+
+```typescript
+// Effect emits OpenTelemetry by default.
+// Pick an exporter Layer; the Worker code never changes.
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  Effect.gen(function* () {
+    yield* Effect.logInfo("request received");
+    yield* Metric.increment(requestsTotal);
+    return { fetch: handler };
+  }).pipe(
+    Effect.provide(AxiomExporter), // or CloudWatch, Datadog, OTLP …
+  ),
+) {}
+```
+
+Supported destinations include Axiom, Datadog, CloudWatch, and any
+OTLP-compatible collector.
+
+## Dashboards and alarms in code
+
+Declare CloudWatch (or Grafana, or Datadog) dashboards and alarms
+next to the resources they observe. Threshold change? It's a diff in
+the PR — reviewable, revertable, audited.
+
+```typescript
+// alchemy.run.ts — same program. same diff. operations included.
+export const Dashboard = AWS.CloudWatch.Dashboard("ApiHealth", {
+  widgets: [
+    Widget.line({ title: "p99 latency", metric: api.metrics.p99 }),
+    Widget.line({ title: "requests / sec", metric: api.metrics.rps }),
+    Widget.number({ title: "5xx ratio", metric: api.metrics.errorRate }),
+  ],
+});
+
+export const P99Alarm = AWS.CloudWatch.Alarm("p99Latency", {
+  metric: api.metrics.p99,
+  threshold: 500,
+  comparisonOperator: ">",
+  evaluationPeriods: 5,
+  alarmActions: [pagerDuty, slackWebhook],
+});
+```
+
+- Widgets reference typed `.metrics` outputs from your resources.
+- Alarms compose. Same alarm wired to PagerDuty, Slack, SQS — typed
+  actions.
+- Per-stage dashboards: `prod`, `staging`, `pr-42` all separate.
+
+## Alerts wired to anything
+
+Alarm actions are typed resources too. Wire your alarms to PagerDuty,
+Slack, an SQS queue, an SNS topic — reuse the same notification
+channel across every alarm in the stack.
+
+- **Threshold + window** — Configure evaluation periods, statistic,
+  comparison operator — all typed, autocompleted in your editor.
+- **Composite alarms** — AND/OR multiple alarm states into a
+  higher-level alert — declared as values, not console rules.
+- **Audit trail in git** — Every threshold and channel lives in
+  source. Who changed it, when, and why — answered by `git blame`.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/outputs.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/outputs.mdx
new file mode 100644
index 00000000000..282d8e3c0ce
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/outputs.mdx
@@ -0,0 +1,321 @@
+---
+title: Inputs and Outputs
+description: Output<T> is alchemy's lazy reference type — the lazy values that flow between resources, get composed with .pipe, mapped, interpolated, and resolved during deploy.
+sidebar:
+  order: 2
+---
+
+A [Resource](/concepts/resource)'s **inputs** are the props you pass
+in. Its **outputs** are the attributes the cloud returns after
+creation. The catch: outputs don't exist when you write the code.
+They only exist after the resource is deployed.
+
+Alchemy bridges this with **`Output<T>`** — a lazy, typed reference
+that resolves once the upstream resource has run. You can read
+properties off it, transform it with `pipe`, combine it with other
+outputs, and feed it as input to the next resource. The resource
+graph is built from these dependencies.
+
+This page is a reference for every operator. For the bigger picture
+of how the graph deploys, see
+[Resource Lifecycle](/concepts/resource-lifecycle).
+
+## What an Output is
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket("Bucket");
+
+bucket.bucketName;
+// ^? Output<string>
+```
+
+Three things to know:
+
+1. **Lazy** — `bucket.bucketName` doesn't have a value yet. It's a
+   description of "the bucket's name once it's created."
+2. **Typed** — TypeScript still knows it's `string`, even though
+   you can't `console.log` it directly.
+3. **Tracked** — passing it as input to another resource registers
+   a dependency edge. Alchemy uses these edges to deploy in the
+   right order.
+
+You almost never construct an `Output` yourself — they fall out of
+resource declarations and the operators below.
+
+## Property access
+
+Reading a property off a resource (or any `Output`) returns another
+`Output`:
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket("Bucket");
+
+bucket.bucketName;        // Output<string>
+bucket.bucketArn;         // Output<string>
+bucket.tags?.environment; // Output<string | undefined>
+```
+
+Nested access works too — `expr.nested.deep` walks down the object
+without forcing the value.
+
+## `literal`
+
+When you need an `Output` shape but the value is already known:
+
+```typescript
+import * as Output from "alchemy/Output";
+
+Output.literal("hello");      // Output<string>
+Output.literal(42);           // Output<number>
+Output.literal({ a: 1 });     // Output<{ a: number }>
+```
+
+Useful as a default for an optional output, or as a placeholder in
+templates and `Output.all` calls.
+
+## `asOutput`
+
+Lifts a plain value, an `Effect`, or an existing `Output` into an
+`Output`:
+
+```typescript
+Output.asOutput("foo");                  // wraps as a literal
+Output.asOutput(Effect.succeed(123));    // wraps as an EffectExpr
+Output.asOutput(existingOutput);         // returns it unchanged
+```
+
+Use this when writing helpers that should accept "anything output-y."
+
+## `map`
+
+`Output.map` transforms an `Output<A>` into an `Output<B>` without
+forcing it. The function runs once, after the upstream resource
+resolves:
+
+```typescript
+import * as Output from "alchemy/Output";
+
+const upper = bucket.bucketName.pipe(
+  Output.map((name) => name.toUpperCase()),
+);
+// Output<string>
+```
+
+It also supports a data-first form when you don't want to use
+`pipe`:
+
+```typescript
+Output.map(bucket.bucketName, (name) => name.toUpperCase());
+```
+
+`map` composes — pipe several together to build up a chain:
+
+```typescript
+const slug = bucket.bucketName.pipe(
+  Output.map((s) => s.toLowerCase()),
+  Output.map((s) => s.replaceAll("_", "-")),
+);
+```
+
+The function only runs once (per evaluation) and only after every
+upstream `Output` is ready. There is no risk of "the function ran
+before the resource existed."
+
+## `mapEffect`
+
+`Output.mapEffect` is the same idea but the transform returns an
+`Effect`. Use this when the transformation needs to do real work —
+read a file, hit an API, decode a JWT — and you want it to live in
+the Effect graph.
+
+```typescript
+const decoded = secret.value.pipe(
+  Output.mapEffect((s) =>
+    Effect.gen(function* () {
+      const result = yield* JwtDecoder.decode(s);
+      return result.payload;
+    }),
+  ),
+);
+// Output<Payload>
+```
+
+Chain them just like `map`:
+
+```typescript
+"a".pipe(
+  Output.mapEffect((s) => Effect.succeed(s + "b")),
+  Output.mapEffect((s) => Effect.succeed(s + "c")),
+);
+// resolves to "abc"
+```
+
+Requirements (the `R` channel of the inner Effects) are tracked in
+the resulting `Output`'s requirements, so anything those Effects
+need must be provided wherever the Output is finally evaluated.
+
+## `all`
+
+`Output.all` zips several `Output`s into one. The result resolves
+to a tuple (preserving the input shape and types):
+
+```typescript
+const both = Output.all(bucket.bucketName, queue.queueUrl);
+// Output<[string, string]>
+
+const url = both.pipe(
+  Output.map(([name, queue]) => `s3://${name}?dlq=${queue}`),
+);
+```
+
+If you pass an array of `Output<T>` of unknown length, the result
+is `Output<T[]>` instead of a fixed tuple.
+
+## `interpolate`
+
+The most common combination of `all` + `map` is "build a string
+from outputs." `Output.interpolate` is a tagged template literal
+for exactly that:
+
+```typescript
+const arn = Output.interpolate`arn:aws:s3:::${bucket.bucketName}/objects/*`;
+// Output<string>
+
+const dsn = Output.interpolate`postgres://${db.host}:${db.port}/${db.name}`;
+```
+
+Nullish interpolated values render as the empty string.
+
+Behind the scenes this is `Output.all(...args).pipe(Output.map(...))` —
+so the dependency graph is wired up automatically.
+
+## `of`
+
+You rarely call this directly because resources already act like
+`Output`s, but it's how the conversion happens internally:
+
+```typescript
+const bucketOut = Output.of(bucket);          // Output<R2BucketAttrs>
+const refOut    = Output.of(Ref({ id: "B" })); // for cross-stack refs
+```
+
+Use `Output.of(Ref(...))` (or [`Output.ref`](#ref))
+to read a resource's attributes from another stack — see below.
+
+## `ref`
+
+`Output.ref` produces an `Output` referencing a deployed
+resource's attributes in another stack or stage:
+
+```typescript
+const sharedBucket = Output.ref<typeof Bucket>("Bucket", {
+  stack: "shared-infra",
+  stage: "prod",
+});
+
+sharedBucket.bucketName; // Output<string>
+```
+
+Resolved at plan time against the persisted state store, fails
+with `InvalidReferenceError` when the target is missing. In
+day-to-day code prefer `Resource.ref` — same primitive, more
+ergonomic surface.
+
+See [References](/concepts/references) for the full reference
+surface (`Output.ref`, `Resource.ref`, `Output.stackRef`,
+`Stack.stage`) and how each is resolved.
+
+## How Outputs compose in props
+
+You can pass an `Output` (or any structure containing Outputs) as
+the input prop of another resource. Alchemy walks the structure,
+collects upstream dependencies, and waits for them to resolve
+before calling the provider.
+
+```typescript
+const queue = yield* AWS.SQS.Queue("Jobs", {
+  name: Output.interpolate`${bucket.bucketName}-events`,
+  tags: {
+    bucket: bucket.bucketName,
+    region: Output.literal("us-west-2"),
+  },
+  deadLetter: {
+    queueUrl: dlq.queueUrl,
+  },
+});
+```
+
+Plain values, Outputs, nested objects, and arrays are all valid —
+the engine evaluates them recursively.
+
+## Helpers
+
+| Helper                 | Returns                                       |
+| ---------------------- | --------------------------------------------- |
+| `Output.isOutput(v)`   | `true` if `v` is an `Output<T>`               |
+| `Output.isExpr(v)`     | `true` for any internal expression node       |
+| `Output.upstream(o)`   | Map of upstream resources `o` depends on      |
+| `Output.hasOutputs(v)` | `true` if `v` (or anything inside) is lazy    |
+| `Output.toEnvKey(id, suffix)` | `"my-bucket" + "name"` → `"MY_BUCKET_NAME"` |
+
+`upstream` and `hasOutputs` power the dependency graph — most code
+won't call them directly, but they're useful when writing custom
+providers.
+
+## Redacted values
+
+Alchemy preserves `Redacted<T>` (Effect's secret wrapper) through
+evaluation. Logs and console output show `<redacted>` instead of
+the underlying value:
+
+```typescript
+import * as Redacted from "effect/Redacted";
+
+const apiKey = Redacted.make(env.API_KEY);
+
+yield* MyService("svc", {
+  apiKey, // stays Redacted in state and logs
+});
+```
+
+## Evaluation semantics
+
+When alchemy needs the actual value of an `Output` (to call a
+provider, to print outputs at the end of a deploy, to satisfy a
+binding), it runs `Output.evaluate(expr, upstream)`:
+
+1. **Resource expressions** look up the resolved attributes of
+   their upstream resource.
+2. **Property expressions** evaluate their parent and read the
+   property.
+3. **Apply / EffectExpr** evaluate the parent first, then run the
+   user function.
+4. **All** evaluates its children in parallel.
+5. **Ref** reads from the state store using `{ stack, stage, id }`.
+6. **Plain values** (objects, arrays, primitives) are walked
+   recursively so Outputs inside them get evaluated too.
+7. **`Redacted`** values are preserved as-is.
+
+You normally never call `Output.evaluate` yourself — alchemy invokes
+it during plan and apply. But understanding the ordering helps:
+**every Output is lazy until alchemy decides to resolve it**, and
+the deploy graph is exactly the set of dependencies your Outputs
+declared.
+
+## Cheat sheet
+
+| You want to…                                | Use                                          |
+| ------------------------------------------- | -------------------------------------------- |
+| Reference an attribute that doesn't exist yet | `resource.attr`                            |
+| Wrap a constant as an Output                | `Output.literal(value)`                      |
+| Coerce a value / Effect / Output to Output  | `Output.asOutput(x)`                         |
+| Transform an Output                         | `output.pipe(Output.map(fn))`                |
+| Transform with an Effect                    | `output.pipe(Output.mapEffect(fn))`          |
+| Combine several Outputs                     | `Output.all(a, b, c)`                        |
+| Build a string from Outputs                 | `` Output.interpolate`a/${b}/c` ``           |
+| Read a resource from another stack          | `Output.ref<typeof X>("id", { stack, stage })` |
+| Inspect dependencies                        | `Output.upstream(output)`                    |
+
+For the surrounding model — what an `Output` actually flows into,
+and how the graph deploys — see [Resource](/concepts/resource) and
+[Resource Lifecycle](/concepts/resource-lifecycle).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/phases.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/phases.mdx
new file mode 100644
index 00000000000..190981990b8
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/phases.mdx
@@ -0,0 +1,156 @@
+---
+title: Phases
+description: Alchemy programs run in two phases — plantime/init drives the deploy, runtime handles requests. Knowing which is which is the key to using Platforms.
+sidebar:
+  order: 6
+---
+
+import DAG from "../../../components/DAG.astro";
+
+:::tip
+Read this after [Platform](/concepts/platform). The init/runtime
+pattern shown there is what this page explains in depth.
+:::
+
+Every alchemy program operates in two distinct phases:
+
+- **Plantime** — the deploy. Runs `alchemy deploy`, `plan`, or
+  `dev`. Produces the resource graph, runs providers, persists state.
+- **Runtime** — the deployed handler. Runs inside a Worker or Lambda
+  Function whenever a request comes in.
+
+Platform resources express both in a single program by **returning
+an Effect from inside an Effect**.
+
+## Init vs Runtime
+
+```typescript
+Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    // ─── Init phase ───
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      // ─── Runtime phase ───
+      fetch: Effect.gen(function* () {
+        const obj = yield* bucket.get("key");
+        return HttpServerResponse.text(yield* obj.text());
+      }),
+    };
+  }),
+);
+```
+
+| Phase   | Code   | When it runs                          |
+| ------- | ------ | ------------------------------------- |
+| Init    | outer  | At plantime **and** at cold start     |
+| Runtime | inner  | Only inside a deployed handler        |
+
+The `bucket` value is established once during init and captured by
+the runtime closure. Init runs at most once per cold start; the
+runtime body runs per request with everything already wired up.
+
+The runtime phase is the *only* place where `Alchemy.RuntimeContext`
+is available. Any Effect whose requirements include `RuntimeContext`
+can only execute inside the runtime closure — the type system
+rejects it everywhere else. See
+[Layers › Runtime as a colored function](/concepts/layers#runtime-as-a-colored-function).
+
+## What runs when
+
+<DAG
+  caption="Plantime (top) records bindings and builds the plan. Runtime (bottom) starts on cold start and runs the handler per request."
+  nodes={[
+    { id: "Plan", label: "alchemy deploy", type: "plantime", tone: "accent" },
+    { id: "InitP", label: "init()", type: "records bindings" },
+    { id: "Apply", label: "apply", type: "create / update" },
+    { id: "Deploy", label: "deployed", type: "Worker / Lambda" },
+    { id: "Cold", label: "cold start", type: "runtime", tone: "accent", layer: 0 },
+    { id: "InitR", label: "init()", type: "builds SDK clients", layer: 1 },
+    { id: "Runtime", label: "fetch()", type: "per request", layer: 2 },
+  ]}
+  edges={[
+    { from: "Plan", to: "InitP" },
+    { from: "InitP", to: "Apply" },
+    { from: "Apply", to: "Deploy" },
+    { from: "Cold", to: "InitR" },
+    { from: "InitR", to: "Runtime" },
+  ]}
+/>
+
+- At **plantime**, init runs to discover bindings — alchemy needs
+  to know which resources the handler will use so it can wire
+  permissions, env vars, and references.
+- At **runtime cold start**, init runs again — this time inside the
+  deployed Worker, where the same `bind()` calls return live SDK
+  clients backed by the deployed resource.
+- The **runtime body** only runs in the deployed handler. It never
+  executes at plantime, so you can put real per-request work there
+  without affecting deploy speed.
+
+## `ALCHEMY_PHASE`
+
+The current phase is exposed as the `ALCHEMY_PHASE` environment
+variable / config key:
+
+| Value     | Context                                                    |
+| --------- | ---------------------------------------------------------- |
+| `plan`    | Default. Running `alchemy deploy` or `alchemy plan`.       |
+| `dev`     | Running `alchemy dev` (local development with hot reload). |
+| `runtime` | Running inside a deployed Worker or Lambda Function.       |
+
+Most user code never reads this directly — but providers and
+[bindings](/concepts/binding) use it internally to behave
+differently across phases.
+
+## `Binding.Service` vs `Binding.Policy`
+
+A binding has two layers under the hood — and which one runs depends
+on the phase:
+
+| Layer              | Phase   | Job                                                   |
+| ------------------ | ------- | ----------------------------------------------------- |
+| `Binding.Service`  | Runtime | The lightweight typed SDK that ships with the bundle. |
+| `Binding.Policy`   | Plan    | The deploy-time logic that emits IAM / env / config.  |
+
+At plantime the Policy layer is provided, so calling `bind()`
+records what the function will need. At runtime the Policy layer is
+absent — `bind()` returns just the Service wrapper. The runtime
+bundle stays small because none of the planning code is included.
+
+This is also how alchemy can let you write `bucket.get(...)` inside
+a Worker without bundling AWS / Cloudflare provisioning code:
+provisioning lives in `Policy`, not `Service`.
+
+## Why this matters
+
+The init/runtime split lets you write code that:
+
+1. **Resolves infrastructure references at deploy time** — bindings
+   know which bucket ARN, queue URL, etc. to inject.
+2. **Initializes SDK clients once at cold start** — not on every
+   request.
+3. **Handles requests with a pre-configured context** — the `bucket`
+   variable in the runtime body already knows which resource to
+   talk to.
+
+```typescript
+Effect.gen(function* () {
+  // Init: runs once per cold start
+  const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+  const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+  return {
+    // Runtime: runs per request
+    fetch: Effect.gen(function* () {
+      const obj = yield* bucket.get("key");
+      // ...
+    }),
+  };
+});
+```
+
+Continue to [Binding](/concepts/binding) for the full mechanics of
+how `.bind()` wires resources into your handler.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/platform.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/platform.mdx
new file mode 100644
index 00000000000..03eb8b4a123
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/platform.mdx
@@ -0,0 +1,187 @@
+---
+title: Platform
+description: A Platform bundles infrastructure with the runtime code that runs on it — Workers, Lambda Functions, Containers — so your handler ships with its bindings.
+sidebar:
+  order: 5
+---
+
+A **Platform** is a special kind of [Resource](/concepts/resource)
+that ships **runtime code along with its infrastructure**. Cloudflare
+Workers, AWS Lambda Functions, and Cloudflare Containers are all
+platforms. When you declare a platform you describe both:
+
+- The cloud configuration (memory, region, compatibility flags…)
+- The Effect that runs inside it
+
+Both deploy together as one resource. There is no separate "infra
+project" plus "handler project" — the handler is part of the
+platform's declaration.
+
+## A Worker, end to end
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Api",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    // Init: bind a resource. The binding is the typed SDK.
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      // Runtime: per-request handler.
+      fetch: Effect.gen(function* () {
+        const obj = yield* bucket.get("hello.txt");
+        return obj
+          ? HttpServerResponse.text(yield* obj.text())
+          : HttpServerResponse.text("Not found", { status: 404 });
+      }),
+    };
+  }),
+);
+```
+
+`bucket` is the resource itself, exposed as a typed SDK. There's no
+`env.BUCKET`, no environment variable wiring — the binding **is** the
+client. For the deploy-time mechanics that make this work (IAM, env
+injection, typed wrappers) see [Binding](/concepts/binding).
+
+## Bindings in action
+
+A binding is what connects a resource to the platform's runtime. The
+syntax `yield* SomeResource.bind(target)` does three things at once:
+
+1. Records the binding on the platform's deploy plan
+2. Generates any needed permissions/configuration
+3. Returns a typed handle you call at runtime
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+const kv = yield* Cloudflare.KVNamespace.bind(Sessions);
+
+// Inside fetch:
+yield* bucket.put("key", "value");
+yield* kv.get("session-id");
+```
+
+Every binding obeys the same shape across providers — a Cloudflare
+R2 binding and an AWS S3 binding are interchangeable from the
+caller's point of view.
+
+## Automatic IAM (and bindings) on AWS
+
+On AWS, every binding maps to specific IAM actions on specific
+resources. Alchemy generates **least-privilege policies** scoped to
+the exact resource ARNs — you never write `PolicyStatement` objects
+by hand:
+
+```typescript
+export default AWS.Lambda.Function(
+  "Api",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const getJob = yield* DynamoDB.GetItem.bind(JobsTable);
+    const enqueue = yield* SQS.SendMessage.bind(JobQueue);
+
+    return {
+      fetch: Effect.gen(function* () {
+        // The binding alone is enough — IAM is generated automatically.
+        const job = yield* getJob({ Key: { id: { S: "abc" } } });
+        yield* enqueue({ MessageBody: JSON.stringify(job) });
+      }),
+    };
+  }),
+);
+```
+
+The deployed function has exactly:
+
+- `dynamodb:GetItem` on `JobsTable.tableArn`
+- `sqs:SendMessage` on `JobQueue.queueArn`
+
+…and nothing else. If you bind multiple tables to one operation, the
+generated policy enumerates each ARN explicitly rather than
+falling back to `Resource: "*"`. On Cloudflare, the same call
+records a Worker binding instead — the runtime API stays identical.
+
+## Writing your own platform
+
+A platform is a [Provider](/concepts/provider) that builds
+infrastructure **and** bundles a runtime Effect. Most users won't
+need to write one — Worker, Lambda, and Container cover the common
+cases — but the surface is open.
+
+```typescript
+export const MyPlatform = Platform<MyConfig, Handlers>(
+  "MyPlatform",
+  // ...lifecycle hooks (reconcile / delete) that build the
+  //    infrastructure and upload the bundled handler.
+);
+```
+
+See [Provider](/concepts/provider#authoring-a-custom-provider) for
+how lifecycle hooks compose into a Layer, and
+[Resource Lifecycle](/concepts/resource-lifecycle) for when each
+hook fires.
+
+## Effect handlers vs async handlers
+
+Platforms support two styles for the runtime code. Both deploy
+through the same provider and produce the same artifact.
+
+**Effect style** — handlers are Effects, with typed errors,
+composable retries, structured concurrency, and bindings resolved
+through Effect's context:
+
+```typescript
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
+        /* ... */
+      }),
+    };
+  }),
+);
+```
+
+**Async style** — handlers are standard `async fetch` functions.
+Bindings are declared on the resource's `env` prop and typed via
+`InferEnv`:
+
+```typescript
+// alchemy.run.ts
+export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: { Bucket },
+});
+```
+
+```typescript
+// src/worker.ts
+import type { WorkerEnv } from "../alchemy.run.ts";
+
+export default {
+  async fetch(request: Request, env: WorkerEnv) {
+    const object = await env.Bucket.get("key");
+    return new Response(object?.body ?? null);
+  },
+};
+```
+
+Pick whichever fits your team. The Effect style unlocks
+[Layers](/concepts/layers), structured retries, and fine-grained
+testing; the async style integrates better with existing handler
+code.
+
+For a deeper look at when init code runs vs when exec code runs (and
+why), see [Plantime and Runtime](/concepts/phases).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/profiles.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/profiles.mdx
new file mode 100644
index 00000000000..0b55fa54ea8
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/profiles.mdx
@@ -0,0 +1,113 @@
+---
+title: Profiles
+description: Profiles store cloud credentials per environment in ~/.alchemy/profiles.json — switch between work and personal accounts, or between staging and prod credentials.
+sidebar:
+  hidden: true
+---
+
+A **profile** is a named bundle of cloud credentials stored locally
+in `~/.alchemy/profiles.json`. Profiles let you:
+
+- Keep work and personal accounts separate
+- Use a different IAM role for `prod` vs `dev`
+- Rotate or refresh tokens without losing other configurations
+
+Profiles are independent from [Stages](/concepts/stages). A stage
+controls **what** is deployed; a profile controls **how alchemy
+authenticates** to deploy it.
+
+## The default profile
+
+Every command uses the profile named **`default`** unless you pass
+`--profile <name>` or set `$ALCHEMY_PROFILE`. New users never need
+to think about profiles — the first deploy creates `default`
+automatically.
+
+```sh
+alchemy deploy
+# uses profile `default`
+```
+
+## How credentials get there
+
+The first time you `alchemy deploy` (or `destroy`, `dev`, `plan`),
+alchemy walks each cloud provider registered in your stack and
+prompts you to authenticate. Pick OAuth, paste an API token, point
+at an SSO profile — whatever the provider offers. The result is
+saved under your current profile.
+
+To re-run that flow at any time:
+
+```sh
+# Refresh credentials for the current profile
+alchemy login
+
+# Re-run the interactive setup (e.g. switch from OAuth → API token)
+alchemy login --configure
+
+# Log into a separate profile
+alchemy login --profile prod --configure
+```
+
+`login` imports your stack file to discover which providers are
+needed, so the prompts match the providers you actually use.
+
+## Inspecting a profile
+
+Use `alchemy profile show` to see what's stored (credentials are
+redacted):
+
+```sh
+alchemy profile show
+alchemy profile show --profile prod
+```
+
+Sample output:
+
+```text
+Profile: default
+
+── AWS ──
+  accessKeyId:     ASIA****
+  secretAccessKey: Pj5T****
+  region:          us-west-2
+  source: sso - default
+
+── Cloudflare ──
+  accessToken: Xl06****
+  expires: in 59m 58s 999ms
+  accountId: 123456789...
+  source: oauth
+```
+
+## Switching profiles
+
+Pass `--profile` to any command, or export `ALCHEMY_PROFILE` in your
+shell:
+
+```sh
+alchemy deploy --stage prod --profile prod
+alchemy destroy --stage pr-42 --profile work
+
+export ALCHEMY_PROFILE=work
+alchemy deploy
+```
+
+A typical pairing in CI is one profile per environment:
+
+```sh
+alchemy deploy --stage staging --profile staging
+alchemy deploy --stage prod --profile prod
+```
+
+## Where profiles live
+
+Profiles are stored at `~/.alchemy/profiles.json`. The file is plain
+JSON keyed by profile name; you can edit it manually, but
+`alchemy login --configure` is usually safer because it knows the
+shape each provider expects.
+
+For the full set of CLI flags involving profiles see
+[`alchemy login`](/guides/cli#login) and
+[`alchemy profile show`](/guides/cli#profile) in the CLI reference.
+For environment isolation, see [Stages](/concepts/stages).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/provider.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/provider.mdx
new file mode 100644
index 00000000000..b8ae18551df
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/provider.mdx
@@ -0,0 +1,276 @@
+---
+title: Provider
+description: Providers implement the lifecycle operations for a resource type — reconcile, delete, diff, read, and more.
+sidebar:
+  order: 4
+---
+
+A **Provider** implements the lifecycle operations for a resource
+type. When you `yield*` a resource inside a Stack, alchemy looks up
+the provider for that resource's type and calls the appropriate
+lifecycle method. This is what gives meaning to a
+[Resource](/concepts/resource) declaration — the engine plans, the
+provider acts.
+
+## Provider Layers
+
+Providers are registered as Effect Layers. `Cloudflare.providers()`
+and `AWS.providers()` return Layers bundling every built-in provider
+for that cloud:
+
+```typescript
+Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    yield* Cloudflare.R2Bucket("Bucket");
+  }),
+);
+```
+
+The type system enforces this — using a Cloudflare resource without
+`Cloudflare.providers()` raises a compile-time error.
+
+To mix clouds, merge the layers:
+
+```typescript
+import * as Layer from "effect/Layer";
+
+Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Layer.mergeAll(Cloudflare.providers(), AWS.providers()),
+  },
+  Effect.gen(function* () {
+    yield* Cloudflare.R2Bucket("Bucket");
+    yield* AWS.SQS.Queue("Jobs");
+  }),
+);
+```
+
+## Lifecycle operations
+
+A provider is an object implementing some subset of these operations.
+`reconcile` and `delete` are required; the rest are optional hooks
+alchemy uses for richer behavior.
+
+### `reconcile`
+
+Required. Called for every "make it so" intent — first-time
+provisioning, routine updates, and adoption takeovers. Returns the
+**output attributes** that downstream resources can reference.
+
+A reconciler is a single observe → ensure → sync → return flow:
+
+```typescript
+reconcile: Effect.fnUntraced(function* ({ news, output }) {
+  const stripe = yield* StripeClient;
+
+  // Observe — fetch live state if we have a cached id.
+  let product = output?.productId
+    ? yield* Effect.tryPromise(() =>
+        stripe.products.retrieve(output.productId),
+      ).pipe(Effect.catchAll(() => Effect.succeed(undefined)))
+    : undefined;
+
+  // Ensure — create if missing.
+  if (!product) {
+    product = yield* Effect.tryPromise(() =>
+      stripe.products.create({ name: news.name }),
+    );
+  }
+
+  // Sync — patch any field that drifted from desired.
+  if (product.name !== news.name) {
+    product = yield* Effect.tryPromise(() =>
+      stripe.products.update(product!.id, { name: news.name }),
+    );
+  }
+
+  return { productId: product.id, name: product.name };
+}),
+```
+
+The provider receives `output: Attributes | undefined` and
+`olds: Props | undefined`:
+
+| `output`    | `olds`      | Meaning                              |
+| ----------- | ----------- | ------------------------------------ |
+| `undefined` | `undefined` | Greenfield — no prior resource       |
+| defined     | defined     | Routine update                       |
+| defined     | `undefined` | Adoption — engine adopted via `read` |
+
+The reconciler must work for all three combinations. **Do not
+branch the body on `output === undefined`** — that just renames the
+old `create`/`update` split. Trust observed cloud state, not `olds`.
+
+`reconcile` must be **idempotent**: alchemy may retry it after a
+state persistence failure. Deterministic physical names plus the
+observe step ensure a retry finds the existing resource and re-syncs
+any drifted fields.
+
+See the [custom provider guide](/guides/custom-provider#implement-reconcile)
+for the full walkthrough.
+
+### `delete`
+
+Required. Called when a resource is removed from code, replaced, or
+when running `alchemy destroy`. Like `create`, must be **idempotent**
+— treat "already deleted" as success.
+
+```typescript
+delete: ({ output }) =>
+  Effect.promise(() => stripe.products.del(output.productId));
+```
+
+### `diff`
+
+Optional. Called during planning to decide what kind of change is
+needed when properties differ. Returns a tagged `Diff` describing
+the action:
+
+```typescript
+diff: Effect.fnUntraced(function* ({ news, olds }) {
+  if (news.region !== olds.region) {
+    return { action: "replace" } as const;
+  }
+  if (news.name !== olds.name) {
+    return { action: "update" } as const;
+  }
+  return { action: "noop" } as const;
+}),
+```
+
+The shape is one of:
+
+- **`{ action: "noop" }`** — properties differ trivially; don't
+  call `update`.
+- **`{ action: "update", stables?: [...] }`** — apply an in-place
+  update. `stables` lists props that are guaranteed not to change
+  during this update.
+- **`{ action: "replace", deleteFirst?: boolean }`** — destroy and
+  recreate (see [Resource Lifecycle › Replace](/concepts/resource-lifecycle#replace)).
+  Set `deleteFirst: true` for resources that can't coexist with
+  their replacement (e.g. unique-name constraints).
+- **`void` / `undefined`** — fall back to the default behavior
+  (treat the change as an `update`).
+
+A provider can also declare top-level `stables` for attributes that
+are immutable across all updates (e.g. ARNs, resource IDs).
+
+For comparing nested objects, use the `deepEqual` and
+`anyPropsAreDifferent` helpers from `alchemy/Diff`. If any input
+might still be unresolved when `diff` runs (an unresolved `Output`),
+guard with `isResolved` first and return `undefined` to let the
+default path handle it.
+
+### `read`
+
+Optional. The engine consults `read` whenever a resource has no prior
+state — both for **state recovery** (state lost between create and
+persist) and for **adoption** (a fresh state store deploying against
+existing cloud infrastructure). It is the single source of truth for
+"does this resource exist, and is it ours?".
+
+```typescript
+read: Effect.fnUntraced(function* ({ id, olds, output }) {
+  const stripe = yield* StripeClient;
+  if (!output?.productId) return undefined;
+  const product = yield* Effect.tryPromise(() =>
+    stripe.products.retrieve(output.productId),
+  ).pipe(Effect.catchAll(() => Effect.succeed(undefined)));
+  if (!product) return undefined;
+  return { productId: product.id, name: product.name };
+}),
+```
+
+`read` returns one of three values:
+
+- **`undefined`** — the resource doesn't exist. The engine will
+  drive a normal `create`.
+- **plain attributes** — the resource exists and we own it.
+  The engine silently adopts: it persists the attributes as the
+  initial `created` state and lets ordinary `diff` decide whether
+  the next deploy is a noop or update.
+- **`Unowned(attributes)`** — the resource exists but we *don't*
+  own it. By default the engine fails with `OwnedBySomeoneElse`
+  so you don't accidentally clobber a production resource.
+  Re-running with `--adopt` (or scoping the effect with
+  `adopt(true)`) unlocks a takeover.
+
+`Unowned` is a brand from `alchemy/AdoptPolicy` — there's no wrapper
+to unwrap, just a hidden symbol on the attributes object:
+
+```typescript
+import { Unowned } from "alchemy/AdoptPolicy";
+
+read: Effect.fnUntraced(function* ({ id, olds }) {
+  const live = yield* lookup(olds.name);
+  if (!live) return undefined;
+  const attrs = { productId: live.id, name: live.name };
+  return ownsResource(id, live.tags) ? attrs : Unowned(attrs);
+}),
+```
+
+**Inputs.** `read` may be called for an existence/adoption probe with
+`output: undefined` (no prior state). Resources whose live lookup
+requires a previously-persisted ID (e.g. `output.productId`) should
+return `undefined` in that case — they have no way to find the
+resource without it.
+
+**Ownership detection.** Resources with no notion of ownership (e.g.
+"the cloud API just gives us a single global object by name") should
+always return plain attributes. The engine treats them as owned and
+silent adoption is the default, so `--adopt` is unnecessary.
+Resources with tag-based or naming-based ownership (most cloud
+resources) should brand foreign-owned attributes with `Unowned`.
+
+> **Lifecycle methods don't gate on ownership.** Once `read` clears a
+> resource for write, `reconcile` can assume it's safe to proceed.
+> Don't repeat the ownership check inside `reconcile` — that just
+> hides the policy decision from the engine.
+
+### `precreate`
+
+Optional. Reserves a physical name (or stub resource) before
+`create` runs. This is what enables [circular
+bindings](/guides/circular-bindings) — Worker A can know Worker B's
+URL before either is fully created.
+
+### `tail` / `logs`
+
+Optional. Power `alchemy tail` (live log streaming) and
+`alchemy logs` (historical fetch). Each returns a `Stream` or
+`Effect` of `LogLine` values respectively.
+
+## Plan and apply
+
+Alchemy combines every provider's lifecycle operations into a single
+**plan**, then **applies** it.
+
+- **Plan** — for each declared resource, alchemy compares the
+  desired props against persisted state and uses `diff` to decide
+  whether it's a `create`, `update`, `replace`, or `noop`. Anything
+  in state but no longer declared is marked for `delete`.
+- **Apply** — alchemy walks the plan in dependency order and calls
+  the matching lifecycle operation on each provider, surfacing the
+  results as `Output`s for downstream resources.
+
+See [Resource Lifecycle](/concepts/resource-lifecycle) for how a
+resource moves through these phases over time.
+
+## Authoring a custom provider
+
+To add support for a new cloud or third-party API, declare a
+[Resource type](/concepts/resource) and implement its provider as
+an Effect `Layer`. Because providers are just Layers, you can
+merge them with `Cloudflare.providers()` or `AWS.providers()` —
+one stack, mixed clouds, no codegen.
+
+See [Writing a Custom Resource Provider](/guides/custom-provider)
+for a step-by-step walkthrough that builds a Stripe `Product`
+provider end-to-end (props, attributes, resource constructor,
+provider Layer, `providers()` bundle, and tests).
+
+For the lifecycle semantics that govern when each operation fires,
+see [Resource Lifecycle](/concepts/resource-lifecycle).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/references.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/references.mdx
new file mode 100644
index 00000000000..1f1a8afc680
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/references.mdx
@@ -0,0 +1,213 @@
+---
+title: References
+description: Read values out of another stack or stage at plan time — typed, lazy, and resolved from persisted state.
+sidebar:
+  order: 3
+---
+
+Stacks deploy independently. A PR-preview stage wants to share
+`staging`'s expensive database instead of provisioning its own.
+A frontend stack needs the URL of a backend that lives in a
+different repo. A tools script wants to read prod's bucket name
+without re-running prod's plan.
+
+A **reference** points at something **already deployed**
+somewhere else — a different stage, a different stack, or both —
+and resolves to that thing's live attributes at plan time by
+reading the persisted [state store](/concepts/state-store).
+
+References are lazy. They don't hit any cloud API at declaration
+time, and they don't drift — every plan re-reads the upstream's
+persisted state, so what flows into your downstream resources is
+always whatever was actually last deployed.
+
+## Reference a resource — `Resource.ref`
+
+The most common case: read one resource from another stage of
+the same stack.
+
+```typescript
+const db = yield* Neon.Project.ref("app-db", { stage: "staging" });
+
+db.connectionString; // Output<Redacted<string>>
+```
+
+`Neon.Project.ref("app-db", …)` returns a `Neon.Project` — the
+same shape you'd get from `yield* Neon.Project("app-db", { … })`.
+You can pass it anywhere a `Neon.Project` is accepted; the rest
+of the graph doesn't know (or care) that it's a reference.
+
+If `app-db` hasn't been deployed in `staging` yet, the plan
+fails fast with `InvalidReferenceError` — there is no
+"deploy-and-hope" path.
+
+A common pattern is long-lived `staging` / `prod` stages owning
+the expensive resources while ephemeral `pr-*` stages reference
+them. See [Shared database across stages](/guides/shared-database)
+for the full walkthrough.
+
+## Cross a stack boundary
+
+Pass `stack` to read from a completely different stack:
+
+```typescript
+const sharedBucket = yield* Storage.Bucket.ref("Assets", {
+  stack: "shared-infra",
+  stage: "prod",
+});
+```
+
+`{ stack, stage, id }` is the full address. Anything you omit
+defaults to the current stack/stage, so `MyResource.ref("foo")`
+with no options is "the `foo` in this same stack and stage" —
+useful for adopting a resource that another part of the program
+already declared.
+
+## Reference a whole stack — `yield* MyStack`
+
+Sometimes one resource isn't the right unit — you want the
+**outputs** the upstream stack chose to expose. Declare a typed
+stack handle and `yield*` it:
+
+```typescript
+// backend/src/Stack.ts
+export class Backend extends Alchemy.Stack<
+  Backend,
+  { url: string }
+>()("Backend") {}
+```
+
+```typescript
+// frontend/alchemy.run.ts
+const a = yield* Backend;                // current stage
+const b = yield* Backend.stage.prod;     // pinned to "prod"
+const c = yield* Backend.stage["pr-42"]; // any stage name
+```
+
+- `yield* Backend` defaults to the current stage — `sam`
+  frontend reads `sam` backend, `pr-42` reads `pr-42`. Use this
+  when stages line up across stacks.
+- `Backend.stage.<name>` pins to a specific stage. Use it when
+  you need to **break** stage symmetry — e.g. a feature-branch
+  frontend that must always read `prod`'s backend.
+
+At the end of every successful `apply`, Alchemy persists
+whatever the stack's effect returned as a per-stack-per-stage
+**stack output** record. `yield* Backend` reads that record and
+returns a proxy that turns property access into typed Outputs,
+so `(yield* Backend).url` is `Output<string>`.
+
+See [Monorepos](/guides/monorepo) for the full walkthrough.
+
+## Escape hatches — `Output.ref` and `Output.stackRef`
+
+When the resource constructor isn't in scope (e.g. inside a
+generic helper), use the underlying `Output.ref` primitive:
+
+```typescript
+import * as Output from "alchemy/Output";
+
+const bucket = Output.ref<typeof Bucket>("Bucket", {
+  stack: "shared-infra",
+  stage: "prod",
+});
+
+bucket.bucketName; // Output<string>
+```
+
+Same `{ stack, stage, id }` lookup, same `InvalidReferenceError`
+failure mode. Prefer `Resource.ref` whenever you can — the
+proxied attribute access is identical, and the type erases to
+the resource interface instead of a bare `Output`.
+
+Similarly, when a typed stack handle isn't in scope, `Output.stackRef`
+reads the stack-output record directly:
+
+```typescript
+const backend = yield* Output.stackRef<{ url: string }>("Backend", {
+  stage: "prod",
+});
+
+backend.url; // Output<string>
+```
+
+Prefer `yield* MyStack` whenever you can — it's the same lookup
+with a real type binding instead of an inline shape.
+
+## How resolution works
+
+Every reference — resource or stack — carries a
+`{ stack, stage, id }` triple:
+
+| Field | Default when omitted |
+| ----- | -------------------- |
+| `stack` | The current stack's name |
+| `stage` | The current stage |
+| `id` | required for resource refs; equals the stack name for stack refs |
+
+At plan time Alchemy:
+
+1. Reads the upstream's persisted state under that triple
+   (`state.get` for resource refs, `state.getOutput` for stack
+   refs).
+2. Substitutes the resolved attributes into downstream resource
+   props.
+3. Hands the result to the provider.
+
+This is the same flow as an in-stack Output, with one
+difference: an in-stack Output's upstream is reconciled in this
+same plan; a reference's upstream was reconciled by a previous
+deploy and only its persisted attributes participate now.
+
+Per-resource state and per-stack outputs are stored separately —
+`state.set({ stack, stage, fqn })` for resources,
+`state.setOutput({ stack, stage })` for stack outputs. The
+separation keeps `O(1)` stack-output lookups and means destroying
+a stage clears both. See [State Store](/concepts/state-store) for
+the contract.
+
+## When a reference misses
+
+If the upstream hasn't been deployed, evaluation fails with:
+
+```ts
+class InvalidReferenceError extends Data.TaggedError(
+  "InvalidReferenceError",
+)<{
+  message: string;
+  stack: string;
+  stage: string;
+  resourceId: string;
+}> {}
+```
+
+For resource refs, this propagates as a typed failure through
+`Output.evaluate`. For stack refs and the `Plan.make` call path
+it becomes a defect (`Effect.die`) — the call site can't
+reasonably recover mid-deploy.
+
+The fix is always the same: deploy the upstream first.
+
+## Selection cheatsheet
+
+| Goal | Use |
+| --- | --- |
+| Reference a resource in the current stack/stage (create OR adopt) | `MyResource.ref(id)` |
+| Reference a resource in a different stage of the current stack | `MyResource.ref(id, { stage })` |
+| Reference a resource in a different stack | `MyResource.ref(id, { stack, stage })` |
+| Reference a single resource without the constructor in scope | `Output.ref<R>(id, opts?)` |
+| Reference a whole stack's outputs at the matching stage | `yield* MyStack` |
+| Reference a whole stack's outputs at a pinned stage | `MyStack.stage[name]` |
+| Reference a whole stack's outputs without a typed handle | `Output.stackRef<A>(name, opts?)` |
+
+## Related
+
+- [Monorepos](/guides/monorepo) — `Stack.stage` / `yield* Stack`
+  in practice.
+- [Shared database across stages](/guides/shared-database) —
+  `Resource.ref` for sharing expensive cloud resources between
+  PR-preview and long-lived stages.
+- [Inputs and Outputs](/concepts/outputs) — the broader Output
+  model that references plug into.
+- [State Store](/concepts/state-store) — where persisted state
+  lives and how it's read.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/resource-lifecycle.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/resource-lifecycle.mdx
new file mode 100644
index 00000000000..bb5bdba6eed
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/resource-lifecycle.mdx
@@ -0,0 +1,201 @@
+---
+title: Resource Lifecycle
+description: How alchemy plans, applies, replaces, and destroys resources — and how to think about idempotency and recovery.
+sidebar:
+  order: 3
+---
+
+import Terminal from "../../../components/Terminal.astro";
+import DAG from "../../../components/DAG.astro";
+
+Every [Resource](/concepts/resource) goes through the same lifecycle:
+**plan → reconcile → (replace) → delete**. The plan classifies each
+resource as create, update, replace, delete, or no-op, but the
+provider implements a single `reconcile` function that converges the
+cloud's actual state to what's declared — whether that's the first
+provisioning, a routine update, or an adoption takeover. This page
+walks through each step, what triggers it, and how alchemy recovers
+when things go wrong. For the CLI flags that drive these operations,
+see the [CLI reference](/guides/cli).
+
+## The lifecycle, end-to-end
+
+<DAG
+  nodes={[
+    { id: "Plan", tone: "accent" },
+    { id: "Reconcile (create)" },
+    { id: "Reconcile (update)" },
+    { id: "Replace", tone: "warn" },
+    { id: "Delete", tone: "danger" },
+    { id: "Noop" },
+  ]}
+  edges={[
+    { from: "Plan", to: "Reconcile (create)", label: "new" },
+    { from: "Plan", to: "Reconcile (update)", label: "changed" },
+    { from: "Plan", to: "Replace", label: "breaking" },
+    { from: "Plan", to: "Delete", label: "removed" },
+    { from: "Plan", to: "Noop", label: "unchanged" },
+    { from: "Replace", to: "Delete", dashed: true },
+  ]}
+/>
+
+Both create and update intents resolve to the provider's single
+`reconcile` function. Replace runs `reconcile` against a fresh
+instance id and then deletes the old generation. The same engine
+drives `alchemy deploy`, `alchemy destroy`, and `alchemy dev`.
+
+## Plan
+
+When you run `alchemy deploy`, alchemy first **plans** the change.
+It compares the desired state (what your code declares) against the
+last persisted state and classifies each resource:
+
+- **Create** (`+`) — declared in code, not in state
+- **Update** (`~`) — declared and persisted, but properties differ
+- **Replace** (`±`) — change requires destroy-and-recreate
+- **Delete** (`-`) — persisted but no longer declared
+- **No-op** (`•`) — unchanged
+
+<Terminal content={`[u]Plan[/u]: [g]1 to create[/g], [y]1 to update[/y]
+
+[g]+[/g] [b]Queue[/b] [d](AWS.SQS.Queue)[/d]
+[y]~[/y] [b]Worker[/b] [d](Cloudflare.Worker)[/d]
+[d]•[/d] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]`} />
+
+The classification comes from each provider's `diff` function. See
+[Provider › diff](/concepts/provider#diff) for how providers decide
+between in-place updates and replacements.
+
+Use `alchemy plan` (or `alchemy deploy --dry-run`) to see the plan
+without applying it.
+
+## Reconcile
+
+Whether a resource is being created for the first time, updated in
+place, or adopted from existing infrastructure, alchemy calls a
+single function: `provider.reconcile`.
+
+Reconcile must be **convergent**: given the desired state in `news`,
+it brings the cloud to that state regardless of starting point. It
+receives:
+
+- `news` — desired props
+- `output` — current attributes (`undefined` on greenfield, defined
+  after a prior reconcile or after adoption)
+- `olds` — previous props (`undefined` on greenfield AND on adoption;
+  defined only on routine updates)
+- `bindings` — resolved binding payload from upstream policies
+
+A reconciler is shaped like **observe → ensure → sync → return**:
+read live cloud state via `getX`/`describeX`, create the resource if
+missing (catching `AlreadyExists`-style errors as races), then for
+each mutable aspect diff observed cloud state against desired and
+apply only the delta.
+
+Because each step is independently idempotent, a partial reconcile
+that crashed midway resumes correctly on the next run. Physical
+names are deterministic from `stack/stage/logical-id`, so the
+"observe" step finds the previous reconcile's output even if state
+persistence failed.
+
+A second pass — **convergence** — re-runs `reconcile` for any
+resource whose inputs changed because an upstream output changed
+mid-deploy.
+
+## Replace
+
+Some property changes can't be applied in place — for example,
+changing a DynamoDB table's partition key. The provider's `diff`
+returns `{ action: "replace" }`, and alchemy:
+
+1. Creates a new resource with a new instance ID
+2. Updates downstream resources to reference the new resource
+3. Deletes the old resource
+
+Because new and old coexist briefly, dependents get a clean cutover
+without downtime.
+
+## Delete
+
+`provider.delete` is called when a resource disappears from your
+code, when a replacement supersedes it, or when you run
+`alchemy destroy`. Like create, delete must be **idempotent**:
+deleting an already-gone resource is a success, not an error.
+
+`alchemy destroy` is just a plan where every persisted resource is
+marked for deletion. Resources are removed in **reverse dependency
+order** — dependents go first.
+
+<Terminal content={`[u]Plan[/u]: [r]2 to delete[/r]
+
+[r]-[/r] [b]Worker[/b] [d](Cloudflare.Worker)[/d]
+[r]-[/r] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]
+
+Proceed?
+◉ Yes ○ No
+[r]✗[/r] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [r]deleted[/r]
+[r]✗[/r] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [r]deleted[/r]`} />
+
+## Idempotency and recovery
+
+State persistence can fail after the cloud operation succeeds — the
+network drops between "bucket created" and "state saved". Alchemy
+handles this by requiring `reconcile` and `delete` to be safe to
+retry:
+
+- **Reconcile**: deterministic physical names plus the observe-step
+  mean a retry finds the existing resource instead of creating a
+  duplicate, and re-syncs any aspect that drifted.
+- **Delete**: a missing resource is treated as already deleted.
+- **Read**: providers can implement `read` so alchemy can recover
+  state from the live cloud when persistence fails partway, and to
+  detect adoptable resources on a fresh state store.
+
+## Adoption
+
+When planning a resource that has no prior state, the engine calls
+`provider.read` (if the provider implements it). This serves two
+overlapping purposes:
+
+- **State recovery** — the resource was created on a previous
+  deploy, but state was lost between the cloud op succeeding and the
+  store persisting. `read` finds the live resource and the engine
+  rebuilds `created` state from its attributes.
+- **Adoption** — you're deploying against existing infrastructure
+  you didn't manage with Alchemy yet (or you wiped state
+  intentionally). `read` recognizes the resource and the engine
+  imports it into the new state.
+
+Providers signal "this is mine" vs. "this exists but isn't mine" via
+the `Unowned(attrs)` brand. The engine routes:
+
+| `read` returns      | `--adopt` off             | `--adopt` on          |
+| ------------------- | ------------------------- | --------------------- |
+| `undefined`         | create                    | create                |
+| owned (plain attrs) | silent adopt              | silent adopt          |
+| `Unowned(attrs)`    | fail `OwnedBySomeoneElse` | take over (silently)  |
+
+See [Provider › read](/concepts/provider#read) for the implementation
+contract and [CLI › Adoption](/guides/cli#adoption) for the CLI flag.
+
+## Errors
+
+- **Retryable errors** (eventual consistency, dependency races) are
+  retried automatically with backoff.
+- **Non-retryable errors** (validation, authorization) fail
+  immediately and surface in the plan output.
+- **Partial failures** are safe to re-run thanks to idempotency.
+
+## Driving the lifecycle from the CLI
+
+The same engine powers all of these commands:
+
+| Command            | What it does                                  |
+| ------------------ | --------------------------------------------- |
+| `alchemy plan`     | Run plan, print diff, exit                    |
+| `alchemy deploy`   | Plan, prompt for approval, apply              |
+| `alchemy destroy`  | Plan with everything marked deleted, apply    |
+| `alchemy dev`      | Plan + apply continuously on file changes     |
+
+See the [CLI reference](/guides/cli) for the full set of flags
+(`--yes`, `--force`, `--dry-run`, `--stage`, `--profile`, ...).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/resource.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/resource.mdx
new file mode 100644
index 00000000000..b4a24a8e588
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/resource.mdx
@@ -0,0 +1,386 @@
+---
+title: Resource
+description: Resources are named cloud entities with input properties and output attributes.
+sidebar:
+  order: 1
+---
+
+import DAG from "../../../components/DAG.astro";
+
+A **Resource** represents a cloud entity managed by Alchemy — a
+bucket, database, queue, function, DNS record, or anything else that
+has a lifecycle of reconcile and delete.
+
+## Declaring a Resource
+
+Resources are declared with a **logical ID** and optional **input
+properties**:
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket("Bucket");
+const queue = yield* AWS.SQS.Queue("Jobs", {
+  fifoQueue: true,
+});
+```
+
+The logical ID (`"Bucket"`, `"Jobs"`) is stable across deploys. It
+identifies this resource within the stack and is used to track state.
+
+## Input Properties and Output Attributes
+
+Every resource has two sides:
+
+- **Input Properties** — the desired configuration you pass in
+  (e.g. `fifoQueue: true`)
+- **Output Attributes** — the values produced after creation
+  (e.g. `queueUrl`, `queueArn`)
+
+Output attributes are available as [`Output`](/concepts/outputs)
+expressions on the resource — lazy, typed references that resolve
+once the upstream resource has been created:
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket("Bucket");
+bucket.bucketName; // Output<string>
+```
+
+See [Inputs and Outputs](/concepts/outputs) for the full set of
+operators (`map`, `mapEffect`, `all`, `interpolate`, `ref`).
+
+These are lazy references that resolve after the resource is created.
+You can pass them as inputs to other resources to express
+dependencies.
+
+## Resources are Effects
+
+A resource declaration like `Cloudflare.R2Bucket("Bucket")` is just
+an `Effect` — calling it doesn't talk to the cloud. `yield*`-ing it
+inside a [Stack](/concepts/stack) doesn't either; it just **registers
+the resource on the stack** and hands you back a typed
+[`Output`](/concepts/outputs) reference for its attributes:
+
+```typescript
+// 1. Build the Effect. No API calls. No state mutation.
+const Bucket = Cloudflare.R2Bucket("Bucket");
+
+// 2. Register it on the stack. Still no API calls — alchemy is
+//    just collecting the desired-state graph.
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const bucket = yield* Bucket;
+    return { name: bucket.bucketName };
+  }),
+);
+```
+
+The cloud is only touched later, when `alchemy deploy` runs the
+collected graph through plan and apply. See
+[Resource Lifecycle](/concepts/resource-lifecycle) for what happens
+after registration.
+
+### Sharing across files
+
+Because the declaration is just a value, you can `export` it and
+import it from anywhere — handlers, layers, other resources:
+
+```typescript
+// src/bucket.ts
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+```
+
+```typescript
+// alchemy.run.ts
+import { Bucket } from "./src/bucket.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    yield* Bucket;
+  }),
+);
+```
+
+Importing the same `Bucket` from multiple files is safe. Alchemy
+keys resources by their fully qualified name, so even if two
+modules `yield*` it, it registers on the stack exactly once.
+
+## `ref`
+
+Every resource constructor exposes a static `ref` returning a
+typed reference to a resource that's already been deployed
+**elsewhere** — another stage of this stack, or a different
+stack entirely:
+
+```typescript
+const project = yield* Neon.Project.ref("app-db", {
+  stage: "staging",
+});
+// project: Neon.Project — same shape, same typed attributes
+```
+
+Lookup keyed by `{ stack, stage, id }`; both options default to
+the current stack/stage. Lazy — no cloud calls at declaration
+time. Typed — the result has the same interface as a freshly
+deployed resource. Strict — fails fast with
+`InvalidReferenceError` when the target is missing.
+
+A typical pattern: PR-preview stages reference long-lived
+`staging` resources instead of provisioning their own:
+
+```typescript
+const project = stage.startsWith("pr-")
+  ? yield* Neon.Project.ref("app-db", { stage: "staging" })
+  : yield* Neon.Project("app-db", { region: "aws-us-east-1" });
+```
+
+See [References](/concepts/references) for the full reference
+surface and the [Shared database across
+stages](/guides/shared-database) guide for the canonical
+walkthrough.
+
+## Logical ID
+
+The first argument you pass to a resource constructor is its
+**logical ID** — a name **you** choose to identify the resource
+within its stack:
+
+```typescript
+const Bucket = Cloudflare.R2Bucket("Bucket"); // logical ID: "Bucket"
+const Jobs = AWS.SQS.Queue("Jobs");           // logical ID: "Jobs"
+```
+
+The logical ID is how alchemy tracks the resource in state across
+deploys:
+
+- **Stable across deploys** — keep the same ID and alchemy keeps
+  updating the same underlying cloud resource.
+- **Stable across renames** — change the variable name, change the
+  TypeScript class, move the file; as long as the logical ID stays
+  the same, alchemy still recognizes it.
+- **Rename = replace** — change the logical ID and alchemy treats
+  it as a new resource (and deletes the old one on the next deploy).
+
+Logical IDs only need to be unique **within a stack**.
+
+## Physical Name
+
+The **physical name** is what the cloud actually sees — `myapp-dev_sam-bucket-a3f1`
+on R2, an ARN suffix on AWS, etc. Alchemy generates it for you from
+three things:
+
+```text
+{stack-name}-{stage}-{logical-id}-{instance-id}
+   "myapp"    "dev_sam"  "Bucket"     "a3f1"
+```
+
+The first three are obvious. The **instance ID** is a short,
+deterministic suffix tied to *this specific instance* of the
+resource. While the resource lives, the instance ID stays the same,
+so re-running create finds the existing resource instead of
+duplicating it.
+
+The whole scheme means:
+
+- **Stages don't collide** — `dev_sam` and `prod` produce different
+  physical names from the same code.
+- **Creates are idempotent** — same logical ID + same instance ID =
+  same physical name on retry.
+- **State can recover** — if persistence fails, alchemy can re-run
+  create and find the existing cloud resource.
+
+The instance ID is the part that **does** change when a resource is
+replaced — which leads us to…
+
+## Replacement
+
+Some property changes can't be applied in place. Changing a
+DynamoDB table's partition key, for example, can't be done on a
+live table — it has to be re-created.
+
+Before:
+
+```typescript
+const Jobs = DynamoDB.Table("Jobs", {
+  partitionKey: "id",
+  attributes: { id: "S" },
+});
+```
+
+After:
+
+```diff lang="typescript"
+  const Jobs = DynamoDB.Table("Jobs", {
+-   partitionKey: "id",
+-   attributes: { id: "S" },
++   partitionKey: "tenantId",
++   attributes: { tenantId: "S" },
+  });
+```
+
+The logical ID (`"Jobs"`) doesn't change, but the **instance ID
+does** — which means the physical name does too:
+
+```text
+before:  myapp-prod-jobs-a3f1
+after:   myapp-prod-jobs-9b2c
+```
+
+When the next plan runs, alchemy:
+
+1. Creates a new table with the new instance ID (and physical name)
+2. Updates downstream resources to reference the new one
+3. Deletes the old table
+
+The resource's [provider](/concepts/provider) decides which property
+changes trigger replacement vs in-place update (via
+[`diff`](/concepts/provider#diff)). For the full lifecycle
+(reconcile / replace / delete) see
+[Resource Lifecycle](/concepts/resource-lifecycle).
+
+## Defining your own Resource type
+
+A resource is just a typed Effect. To support a new cloud or
+third-party API, declare a `Resource` type with its input props and
+output attributes — then implement its provider as a `Layer`. Same
+engine plans, deploys, and destroys it.
+
+See [Writing a Custom Resource Provider](/guides/custom-provider)
+for a step-by-step walkthrough of declaring the type and
+implementing each lifecycle hook (`reconcile`, `delete`, `diff`,
+`read`).
+
+```typescript
+// 1. Declare the type + constructor.
+export type StripeProduct = Resource<
+  "Stripe.Product",
+  { name: string; price: number }, // input props
+  { productId: string; priceId: string } // output attrs
+>;
+export const StripeProduct = Resource<StripeProduct>("Stripe.Product");
+
+// 2. Use it like any built-in resource.
+const Pro = yield* StripeProduct("Pro", {
+  name: "Pro plan",
+  price: 2900,
+});
+// ^? typed Pro.productId, Pro.priceId
+```
+
+- **Inputs & outputs are typed** — Props you pass in, attributes the
+  provider returns. Both fully typed, both checked at the call site.
+- **Compose with built-in providers** — Merge your provider Layer with
+  `Cloudflare.providers()` or `AWS.providers()`. One stack, mixed
+  clouds.
+
+The lifecycle hooks the provider implements — `reconcile`,
+`delete`, `diff`, `read` — are documented in
+[Provider](/concepts/provider#lifecycle-operations).
+
+## The resource graph
+
+Passing an `Output` from one resource as input to another draws an
+edge in the dependency graph. Take this stack:
+
+```typescript
+const Bucket = yield* Cloudflare.R2Bucket("Bucket");
+const Sessions = yield* Cloudflare.KVNamespace("Sessions");
+
+const Queue = yield* AWS.SQS.Queue("Queue", {
+  name: Output.interpolate`${Bucket.bucketName}-events`,
+});
+
+const Worker = yield* Cloudflare.Worker("Worker", {
+  main: import.meta.path,
+  env: { Bucket, Sessions, Queue },
+});
+```
+
+Alchemy reads the Outputs in each resource's props and builds:
+
+<DAG
+  nodes={[
+    { id: "Bucket", type: "Cloudflare.R2Bucket" },
+    { id: "Sessions", type: "Cloudflare.KVNamespace" },
+    { id: "Queue", type: "AWS.SQS.Queue" },
+    { id: "Worker", type: "Cloudflare.Worker", tone: "accent" },
+  ]}
+  edges={[
+    { from: "Bucket", to: "Queue" },
+    { from: "Bucket", to: "Worker" },
+    { from: "Sessions", to: "Worker" },
+    { from: "Queue", to: "Worker" },
+  ]}
+/>
+
+It then deploys in topological order:
+
+1. `Bucket` and `Sessions` have no dependencies → created **in
+   parallel**.
+2. `Queue` depends on `Bucket.bucketName` → waits for `Bucket`,
+   then created.
+3. `Worker` depends on all three → created last, after every
+   upstream Output has resolved.
+
+Cycles (Worker A binds Worker B, Worker B binds Worker A) are
+handled with a two-phase plan — see
+[Circular Bindings](/guides/circular-bindings).
+
+## Circular references
+
+Real systems have cycles. Two Workers that call each other. A Lambda
+that invokes another Lambda. Tables that reference each other. Most
+IaC engines reject these — alchemy resolves them by splitting each
+[Platform](/concepts/platform) resource into two pieces:
+
+- A **class** that acts as the Tag (the identity / declaration)
+- A **`.make(...)`** Layer that supplies the runtime implementation
+
+The class can be referenced before its implementation exists, so two
+Workers can name each other in their handlers without a hard
+ordering constraint.
+
+For a circular Worker pair, the resource graph contains edges in
+both directions:
+
+<DAG
+  nodes={[
+    { id: "A", label: "Worker A", type: "Cloudflare.Worker", tone: "accent" },
+    { id: "B", label: "Worker B", type: "Cloudflare.Worker", tone: "accent" },
+  ]}
+  edges={[
+    { from: "A", to: "B", label: "binds" },
+    { from: "B", to: "A", label: "binds" },
+  ]}
+/>
+
+```typescript
+// src/MyWorker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+// The class is the Tag — used as a typed identifier elsewhere.
+export class MyWorker extends Cloudflare.Worker<MyWorker>()("MyWorker", {
+  main: import.meta.path,
+}) {}
+
+// The default export is the Layer — the runtime implementation.
+export default MyWorker.make(
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("hello");
+      }),
+    };
+  }),
+);
+```
+
+To compose Workers that reference each other, provide both Layers
+to your Stack with `Effect.provide`. See the
+[Circular Bindings guide](/guides/circular-bindings) for a complete
+worked A↔B example, including how alchemy plans the two-phase
+create-then-wire deploy.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/secrets.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/secrets.mdx
new file mode 100644
index 00000000000..68f4ff3b855
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/secrets.mdx
@@ -0,0 +1,167 @@
+---
+title: Secrets and Config
+description: Use effect/Config to read env vars at init time and have Alchemy automatically bind them onto the deploy target.
+sidebar:
+  order: 8
+---
+
+Alchemy integrates with [effect/Config](https://effect.website/docs/configuration)
+to automatically bind env vars to your [Platform](/concepts/platform) environment. 
+
+## Bind a secret to your Worker
+
+Any `Config` value that is evaluated with `yield*` in the [Init phase](/concepts/phases)
+of (for example) a Worker, is automatically bound to its environment
+at deploy time.
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const apiKey = yield* Config.redacted("API_KEY"); 
+    // apiKey is Redacted<string> — usable here in Init AND captured as a binding
+
+    return {
+      fetch: Effect.gen(function* () {
+        return new Response(`Bearer ${Redacted.value(apiKey)}`);
+      }),
+    };
+  }),
+);
+```
+
+:::tip
+See [Phases](/concepts/phases) for why Init and Runtime run separately.
+:::
+
+## Use the value during Init
+
+Unlike an [Output](/concepts/outputs), the value can be used immediately
+within the Init phase. For example, to initialize a client:
+
+```typescript
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const apiKey = yield* Config.redacted("OPENAI_API_KEY");
+    const client = createOpenAI(Redacted.value(apiKey));
+
+    return {
+      fetch: Effect.gen(function* () {
+        const reply = yield* Effect.tryPromise(() => client.chat(/* ... */));
+        return new Response(reply);
+      }),
+    };
+  }),
+);
+```
+
+
+## Transformations
+
+Any combinator works — `withDefault`, `orElse`, `mapAttempt`, and so
+on. What gets bound is the *source* value (the raw env var), not the
+transformed result; the combinators run again at runtime against that
+source.
+
+```typescript
+const port = yield* Config.number("PORT").pipe(
+  Config.withDefault(3000),
+);
+```
+
+- If `PORT` is set, its raw value is bound. At runtime `Config.number("PORT")`
+  reads it from the binding and the combinators re-apply.
+- If `PORT` is not set, nothing is bound. At runtime the source is
+  still empty and `Config.withDefault(3000)` produces `3000` again.
+
+Because a default is never bound, its code runs in both phases — keep
+it deterministic, so both phases evaluate to the same value.
+
+## Footgun: don't `yield*` Config at runtime
+
+If you only `yield*` the `Config` in `fetch`, it will not be bound to the environment
+because `fetch` does not run during deployment, so the engine never discovers it.
+
+```typescript
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        // 🚫 nothing is bound to the Worker — API_KEY won't exist at runtime
+        const apiKey = yield* Config.redacted("API_KEY");
+        // ...
+      }),
+    };
+  }),
+);
+```
+
+Always resolve the `Config` in the outer `Effect.gen` (Init) — even
+if you only need the value inside `fetch`. Capture it in a `const`,
+and reference that `const` from the runtime body:
+
+```typescript
+// ✅ bound in Init, used in Runtime
+Effect.gen(function* () {
+  const apiKey = yield* Config.redacted("API_KEY");
+  return {
+    fetch: Effect.gen(function* () {
+      return new Response(Redacted.value(apiKey));
+    }),
+  };
+});
+```
+
+## Async Workers — bind via `env`
+
+Async (non-Effect) Workers don't have an Init `Effect.gen` to
+`yield*` into, so you put the `Config` on the resource's `env`
+prop instead. Alchemy resolves each `Config` at deploy time and
+records the appropriate binding — same end result as the `yield*`
+form, just declared statically:
+
+```typescript
+// alchemy.run.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: {
+    API_KEY: Config.redacted("API_KEY"),
+    HOST:    Config.string("HOST"),
+    Bucket, // resource references work the same
+  },
+});
+
+export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+```
+
+```typescript
+// src/worker.ts
+import type { WorkerEnv } from "../alchemy.run.ts";
+
+export default {
+  async fetch(request: Request, env: WorkerEnv) {
+    return new Response(`Bearer ${env.API_KEY}`);
+  },
+};
+```
+
+`env.API_KEY` is the resolved string at runtime — Cloudflare hands
+the `secret_text` value to the async handler directly, no
+`Redacted.value` unwrap. The always-binds-as-secret rule and
+transformation semantics from the previous sections still apply.
+
+For the step-by-step "wire up `OPENAI_API_KEY` from `.env`" walk,
+see [Guides › Secrets and env vars](/guides/secrets).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/stack.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/stack.mdx
new file mode 100644
index 00000000000..b94d665f6bb
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/stack.mdx
@@ -0,0 +1,191 @@
+---
+title: Stack
+description: A Stack is a collection of Resources deployed together as a unit.
+sidebar:
+  order: 0
+---
+
+import StackOutputsTerminal from "../../../components/marketing-islands/StackOutputsTerminal.tsx";
+
+A **Stack** is the top-level unit of deployment in Alchemy. It groups
+resources together, wires up providers, and tracks state across
+deploys.
+
+## Defining a Stack
+
+A Stack is just an Effect that you `export default` from a TypeScript
+file:
+
+```typescript
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket("Bucket");
+    return { bucketName: bucket.bucketName };
+  }),
+);
+```
+
+`Alchemy.Stack` takes three arguments:
+
+1. **Name** — identifies this stack in state storage
+2. **Options** — `providers` (required), `state` (optional)
+3. **Effect** — a generator that declares resources and returns outputs
+
+:::note[`alchemy.run.ts` is a convention]
+The CLI looks for `alchemy.run.ts` by default, but **any TypeScript
+file with a default-exported Stack works**. Pass the path as the
+first positional argument:
+
+```sh
+alchemy deploy infra/my-stack.ts
+alchemy destroy stacks/github.ts
+```
+
+See the [CLI reference](/guides/cli#deploy) for the full invocation
+syntax.
+:::
+
+## Stack outputs
+
+The value returned from the generator becomes the **stack output**.
+After a deploy, outputs are printed to the console and available
+programmatically in tests.
+
+```typescript
+Effect.gen(function* () {
+  const bucket = yield* Cloudflare.R2Bucket("Bucket");
+  const worker = yield* Worker;
+
+  return {
+    bucketName: bucket.bucketName,
+    url: worker.url,
+  };
+});
+```
+
+The CLI renders them after every successful deploy:
+
+<StackOutputsTerminal client:visible />
+
+## Stages
+
+Every deploy targets a **stage** — an isolated instance of the stack
+like `dev_sam`, `staging`, or `prod`. The stage defaults to
+`dev_$USER`, so each developer gets their own environment
+automatically. State and physical names are namespaced by stage.
+
+```sh
+alchemy deploy --stage prod
+alchemy deploy --stage pr-42
+```
+
+For naming patterns, isolation, and per-stage configuration see
+[Stages](/concepts/stages). Credentials per environment are managed
+via [Profiles](/concepts/profiles).
+
+## Accessing the Stack
+
+Inside a resource or layer, you can access the current Stack's
+metadata via the `Stack` service:
+
+```typescript
+import { Stack } from "alchemy/Stack";
+
+Effect.gen(function* () {
+  const stack = yield* Stack;
+  console.log(stack.name); // "MyApp"
+  console.log(stack.stage); // "dev_sam"
+
+  const queue = yield* SQS.Queue("Jobs").pipe(
+    RemovalPolicy.retain(stack.stage === "prod"),
+  );
+});
+```
+
+### `Stack.useSync` for module-scope resources
+
+When you declare a resource at module scope (outside any
+`Effect.gen`), there is no `yield*` available to read the `Stack`
+service. `Stack.useSync` lets you compute props synchronously from
+the current stack — useful for parameterizing names by stage:
+
+```typescript
+import * as Axiom from "alchemy/Axiom";
+import { Stack } from "alchemy/Stack";
+
+export const Traces = Axiom.Dataset(
+  "Traces",
+  Stack.useSync(({ stage }) => ({
+    name: `${stage}-traces`,
+    kind: "otel:traces:v1" as const,
+    description: `OTEL traces for stage '${stage}'`,
+    retentionDays: 30,
+  })),
+);
+```
+
+The function runs once at plan time, after the stage is resolved.
+Use it anywhere a resource accepts a `props` object.
+
+## Cross-stack references
+
+A typed `Alchemy.Stack` handle lets one stack read another's
+persisted outputs at plan time:
+
+```typescript
+// backend/src/Stack.ts — typed handle shared across packages
+export class Backend extends Alchemy.Stack<
+  Backend,
+  { url: string }
+>()("Backend") {}
+```
+
+```typescript
+// frontend/alchemy.run.ts — reads the matching stage of Backend
+const backend = yield* Backend;             // current stage
+const pinned = yield* Backend.stage.prod;   // pinned stage
+yield* Cloudflare.Vite("Website", {
+  env: { VITE_API_URL: backend.url },
+});
+```
+
+`yield* Backend` defaults to the **current stage** — `sam`
+frontend reads `sam` backend, `pr-42` reads `pr-42`. Use
+`Backend.stage.<name>` to pin to a specific stage instead.
+
+See [References](/concepts/references) for the underlying
+operators and [Monorepos](/guides/monorepo) for the
+end-to-end walkthrough (package layout, schema sharing, deploy
+ordering).
+
+## Stack and stages — the engine
+
+After every deploy, alchemy persists the state of each resource so
+the next plan knows exactly what changed. Stages keep these state
+files (and physical names) isolated:
+
+```sh
+# Each stage = its own state file + its own physical names.
+$ alchemy deploy --stage dev_sam     # -> myapp-dev_sam-photos-a3f1
+$ alchemy deploy --stage pr-147      # -> myapp-pr_147-photos-9b2c
+$ alchemy deploy --stage prod        # -> myapp-prod-photos-7d4e
+
+# Three independent deployments. Destroying one
+# never touches the others.
+```
+
+- **State, per stack** — Each stack gets a state file (local, S3, R2,
+  D1 — pluggable). The plan diffs declared resources against persisted
+  state.
+- **Stages = isolation** — Stages namespace both state and physical
+  names. Two PRs deploy the same code into different resources without
+  colliding.
+- **Deterministic physical names** — Physical names derive from
+  `stack/stage/logical-id`. Re-running create is idempotent — alchemy
+  finds the existing resource.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/stages.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/stages.mdx
new file mode 100644
index 00000000000..2d21c870479
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/stages.mdx
@@ -0,0 +1,132 @@
+---
+title: Stages
+description: Stages are isolated instances of a Stack — dev_sam, staging, prod, pr-42 — each with their own state and physical names.
+sidebar:
+  hidden: true
+---
+
+A **stage** is an isolated instance of a [Stack](/concepts/stack).
+Every deploy targets exactly one stage, and resources from different
+stages never overlap. This is how Alchemy gives every developer their
+own sandbox, every PR its own preview, and production its own
+dedicated environment — all from one program.
+
+## The default stage
+
+If you don't pass `--stage`, alchemy uses **`dev_$USER`** (e.g.
+`dev_sam`). Each developer on your team automatically gets a
+personal stage without any config.
+
+```sh
+$ whoami
+sam
+
+$ alchemy deploy
+# deploys to stage `dev_sam`
+```
+
+The resolution order is:
+
+1. `--stage <name>` flag
+2. `$STAGE` environment variable
+3. `dev_${USER}` (or `dev_${USERNAME}` on Windows)
+4. `dev_unknown` if no user is set
+
+## Common stage patterns
+
+| Stage             | Purpose                                  |
+| ----------------- | ---------------------------------------- |
+| `dev_<user>`      | Per-developer sandbox (default)          |
+| `pr-<n>`          | Per-pull-request preview environment     |
+| `staging`         | Shared pre-production                    |
+| `prod`            | Production                               |
+| `dev`             | Shared development                       |
+
+Stage names must match `[a-z0-9][-_a-z0-9]*`.
+
+```sh
+alchemy deploy --stage prod
+alchemy deploy --stage pr-42
+alchemy destroy --stage pr-42
+```
+
+## Isolation
+
+Each stage gets its own:
+
+- **State file** — the persisted record of what's deployed
+- **Physical names** — `myapp-prod-bucket-abc123` vs
+  `myapp-dev_sam-bucket-9b2c`
+- **Logs and metrics** — scoped per deployed function/worker
+
+Because of this, deploying or destroying one stage **never touches**
+another:
+
+```sh
+$ alchemy deploy --stage dev_sam     # -> myapp-dev_sam-photos-a3f1
+$ alchemy deploy --stage pr-147      # -> myapp-pr_147-photos-9b2c
+$ alchemy deploy --stage prod        # -> myapp-prod-photos-7d4e
+
+$ alchemy destroy --stage pr-147     # only removes pr-147 resources
+```
+
+## Per-stage configuration
+
+The current stage is exposed through the `Stack` service, so the
+same program can branch on it:
+
+```typescript
+import { Stack } from "alchemy/Stack";
+
+Effect.gen(function* () {
+  const stack = yield* Stack;
+
+  const queue = yield* SQS.Queue("Jobs").pipe(
+    RemovalPolicy.retain(stack.stage === "prod"),
+  );
+});
+```
+
+For resources declared at module scope, use
+[`Stack.useSync`](/concepts/stack#stackusesync-for-module-scope-resources):
+
+```typescript
+export class JobFunction extends AWS.Lambda.Function<JobFunction>()(
+  "JobFunction",
+  Stack.useSync((stack) => ({
+    main: import.meta.filename,
+    memory: stack.stage === "prod" ? 1024 : 512,
+  })),
+) {}
+```
+
+## Pull request previews
+
+A common pattern in CI: spin up a fresh stage for every PR, comment
+the URL on the PR, and tear it down on merge.
+
+```yaml
+# .github/workflows/preview.yml
+- run: alchemy deploy --stage pr-${{ github.event.number }} --yes
+
+# on PR close:
+- run: alchemy destroy --stage pr-${{ github.event.number }} --yes
+```
+
+See the [CI guide](/guides/ci) for a complete example.
+
+## Stage vs profile
+
+Stages isolate **what** is deployed (state, physical names).
+[Profiles](/concepts/profiles) isolate **how** alchemy authenticates
+to your cloud providers. They're orthogonal — you can pair a `prod`
+stage with a `prod` profile, or use the same credentials across many
+stages:
+
+```sh
+alchemy deploy --stage prod --profile prod
+alchemy deploy --stage pr-42 --profile default
+```
+
+For the full set of CLI flags, see the
+[CLI reference](/guides/cli#common-options).
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/state-store.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/state-store.mdx
new file mode 100644
index 00000000000..fde0302b0bd
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/state-store.mdx
@@ -0,0 +1,176 @@
+---
+title: State Store
+description: How Alchemy persists resource state between deploys to compute diffs and track infrastructure.
+sidebar:
+  order: 10
+---
+
+import StateStoreBootstrap from "../../../components/marketing-islands/StateStoreBootstrap.tsx";
+
+Alchemy persists resource state between deploys so it can compute
+diffs — comparing the desired state in your code against the current
+state of your infrastructure.
+
+## How state is stored
+
+Each resource's state is keyed by its **fully qualified name** (FQN),
+which includes the namespace path and logical ID. State is scoped by
+**stack name** and **stage**, so different stacks and environments
+are fully isolated.
+
+A resource's persisted state includes:
+
+- **Resource type** — e.g. `Cloudflare.R2Bucket`
+- **Input properties** — the props you passed when creating it
+- **Output attributes** — the values returned after creation
+- **Instance ID** — a unique identifier for this instance
+- **Lifecycle status** — `created`, `updating`, `deleting`, etc.
+- **Bindings** — data attached by policies and event sources
+
+## Local state
+
+By default, state is stored on disk in the `.alchemy/` directory:
+
+```
+.alchemy/
+  state/
+    MyApp/
+      dev_sam/
+        Bucket.json
+        Worker.json
+```
+
+Add `.alchemy/` to your `.gitignore`:
+
+```sh
+echo ".alchemy/" >> .gitignore
+```
+
+Local state works for solo development. Each developer gets their own
+state via their default stage (`dev_$USER`).
+
+## Remote state
+
+For teams and CI, configure a remote state store so all deploys share
+the same state. Alchemy includes a Cloudflare-backed store:
+
+```typescript
+Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    // ...
+  }),
+);
+```
+
+## Cloudflare state store
+
+`Cloudflare.state()` is the recommended state store for projects
+already running on Cloudflare. It persists state in a Worker backed
+by a Durable Object with embedded SQLite, with the auth token and
+encryption key kept in your account's Secrets Store.
+
+### First-run bootstrap
+
+The first time you run `alchemy deploy`, `plan`, or `dev` against a
+stack configured with `Cloudflare.state()`, Alchemy can't find the
+state-store Worker on your account and pauses to ask permission
+before deploying it. Confirming kicks off a one-time deploy of the
+state-store and its supporting resources:
+
+<StateStoreBootstrap client:visible />
+
+What gets created:
+
+- **`Api`** — the state-store Worker itself (a Durable Object with
+  embedded SQLite, enabled on a `workers.dev` subdomain)
+- **`AlchemyStateStoreToken`** — bearer token used by the CLI to
+  authenticate to the Worker, stored in your Secrets Store
+- **`StateStoreEncryptionKey`** — symmetric key used to encrypt
+  resource state at rest inside the Durable Object's SQLite
+- **`StateStoreSecrets`** — the Secrets Store that holds the two
+  secrets above, scoped to your Cloudflare account
+- **`StateStoreAuthTokenValue` / `StateStoreEncryptionKeyValue`** —
+  the generated random values bound into the secrets above
+
+These resources are reused across every stack and stage that uses
+`Cloudflare.state()` on this account — no duplication per project.
+Subsequent runs detect the existing Worker and skip the prompt.
+
+### Where credentials live
+
+After the bootstrap, Alchemy writes the state-store URL and bearer
+token to a credentials file under your Alchemy profile directory
+(`~/.alchemy/<profile>/cloudflare-state-store.json` by default). On
+CI, set `CI=true`; the credentials are resolved from the Secrets
+Store on every run via a short-lived edge-preview Worker, so nothing
+needs to be persisted to disk.
+
+### Customizing the worker name
+
+By default the state-store Worker is named `alchemy-state-store`.
+Pass `workerName` to use a separate state store — for example, when
+you want a dedicated store per Cloudflare account or per team:
+
+```typescript
+state: Cloudflare.state({ workerName: "alchemy-state-store-team-a" }),
+```
+
+## State and lifecycle
+
+State transitions track the lifecycle of each resource:
+
+| Status      | Meaning                                                          |
+| ----------- | ---------------------------------------------------------------- |
+| `creating`  | Create operation in progress                                     |
+| `created`   | Resource exists and is healthy                                   |
+| `updating`  | Update operation in progress                                     |
+| `updated`   | Resource was updated successfully                                |
+| `deleting`  | Delete operation in progress                                     |
+| `replacing` | Resource is being replaced (new one created, old pending delete) |
+
+These intermediate states (`creating`, `updating`, `deleting`) exist
+because state is persisted before the cloud operation completes. If
+the process crashes mid-operation, Alchemy uses the intermediate
+state to recover on the next deploy.
+
+## Writing your own state store
+
+A state store is just an Effect `Layer` that provides the `State`
+service. If the built-in stores don't fit, you can back one with
+Postgres, S3, Redis, DynamoDB, or any other backend.
+
+The `State` service holds an `Effect<StateService>` — a deferred
+initializer — rather than a `StateService` directly. Wrap your
+builder in `Effect.cached` so the backend is only contacted on first
+use and the result is reused afterwards. This keeps commands that
+provide the layer but never read state (like `alchemy login`) from
+connecting to your backend or prompting for credentials.
+
+See [Writing a Custom State Store](/guides/custom-state-store) for
+a walkthrough of the `StateService` interface, an end-to-end
+implementation, and references to the built-in stores you can copy
+from.
+
+## In-memory state (testing)
+
+For tests, Alchemy provides an in-memory state store so tests don't
+touch the filesystem:
+
+```typescript
+import * as TestState from "alchemy/Test/TestState";
+
+// Seed with existing resource state
+const state = TestState.state({
+  Bucket: {
+    /* ... */
+  },
+});
+```
+
+The test harness (`alchemy/Test/Bun` and `alchemy/Test/Vitest`)
+handles state setup automatically.
diff --git a/.repos/alchemy-effect/website/src/content/docs/concepts/testing.mdx b/.repos/alchemy-effect/website/src/content/docs/concepts/testing.mdx
new file mode 100644
index 00000000000..fcf2db5b9a2
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/concepts/testing.mdx
@@ -0,0 +1,350 @@
+---
+title: Testing
+description: Reference for alchemy/Test — every helper, hook, and option exposed by Test.make for Bun and Vitest.
+sidebar:
+  order: 11
+---
+
+`alchemy/Test/Bun` and `alchemy/Test/Vitest` provide an
+Effect-aware test harness for both runners. This page documents
+every helper, hook, and option exposed by `Test.make` — for the
+walkthrough, see [Tutorial Part 3](/tutorial/part-3); for the
+custom-provider use case, see
+[Build a custom provider → Test the lifecycle](/guides/custom-provider#test-the-lifecycle).
+
+## What Test.make returns
+
+A single call returns a self-contained API for the file:
+
+```typescript
+const { test, beforeAll, beforeEach, afterAll, afterEach, deploy, destroy } =
+  Test.make({
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  });
+```
+
+| Helper | Purpose |
+|---|---|
+| `test(name, effect)` | Effect-aware test. `HttpClient` and your providers Layer are in scope. |
+| `test.skip` / `test.skipIf` / `test.only` / `test.todo` | Skip / focus / todo modifiers (same shape as `bun.test`). |
+| `test.provider(name, fn)` | Provider-lifecycle test against a scratch in-memory stack. |
+| `beforeAll(effect)` | Run an Effect once. Returns a lazy accessor (`yield* result`) usable inside tests. |
+| `beforeEach(effect)` | Run an Effect before every test. |
+| `afterAll(effect)` / `afterAll.skipIf(predicate)` | Cleanup hook with conditional teardown. |
+| `afterEach(effect)` | Run an Effect after every test. |
+| `deploy(Stack, opts?)` | Plan + apply a stack, resolve to its outputs. |
+| `destroy(Stack, opts?)` | Plan + apply against an empty desired state. |
+
+`expect` (and `describe`) come from the underlying runner —
+`bun:test` or `@effect/vitest` — directly.
+
+## Test.make options
+
+```typescript
+Test.make({
+  providers,   // required
+  state,       // optional
+  profile,     // optional
+  stage,       // optional
+});
+```
+
+### `providers` (required)
+
+The provider Layer that resolves resource implementations.
+Usually the same one your `Stack` uses:
+
+```typescript
+providers: Cloudflare.providers(),
+// or merge multiple:
+providers: Layer.mergeAll(Cloudflare.providers(), Stripe.providers()),
+```
+
+Credentials resolve through the same `AuthProviders` registry as
+`alchemy deploy`, so tests pick up `alchemy login` profiles or
+the env-var auth methods registered by each provider.
+
+### `state`
+
+The state store used by top-level `deploy(Stack)` and
+`destroy(Stack)` (not by `test.provider`). Defaults to
+`localState()` — `.alchemy/` on disk.
+
+```typescript
+state: Cloudflare.state(),  // R2-backed, survives across CI runners
+state: localState({ path: ".alchemy-test/" }),  // separate dir
+state: undefined,  // omit → defaults to localState()
+```
+
+A persistent state lets `deploy(Stack)` skip recreating unchanged
+resources between runs, which is the whole point of running
+tests against real cloud resources without paying the
+provisioning cost every time.
+
+### `profile`
+
+Override `ALCHEMY_PROFILE` for this file only. Useful for
+pinning tests to a sandbox profile regardless of what's set in
+the environment:
+
+```typescript
+Test.make({
+  providers: AWS.providers(),
+  profile: "test-sandbox",
+});
+```
+
+When omitted, the harness reads `ALCHEMY_PROFILE` from env / `.env`
+the same way the CLI does.
+
+### `stage`
+
+Default stage for `deploy(Stack)` / `destroy(Stack)`. Defaults to
+`"test"`. Override per file, or per call:
+
+```typescript
+Test.make({ providers, stage: "ci-pr-42" });
+
+// or per-call:
+beforeAll(deploy(Stack, { stage: "ci-pr-42" }));
+afterAll.skipIf(!process.env.CI)(destroy(Stack, { stage: "ci-pr-42" }));
+```
+
+A unique stage per PR or test run lets multiple suites run in
+parallel against the same provider account without colliding.
+
+## Hooks
+
+### `beforeAll(effect) → Effect.Effect<A>`
+
+Runs the Effect once before any test in the file. Stores the
+result and returns a lazy accessor — `yield* accessor` inside
+any test or other hook returns the resolved value:
+
+```typescript
+const stack = beforeAll(deploy(Stack));
+const seed = beforeAll(Effect.gen(function* () {
+  yield* DynamoDB.putItem({ /* ... */ });
+  return Date.now();
+}));
+
+test(
+  "uses both",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const startedAt = yield* seed;
+    /* ... */
+  }),
+);
+```
+
+Default timeout is **120s**. Override with the second argument:
+
+```typescript
+beforeAll(deploy(Stack), { timeout: 300_000 });
+```
+
+### `beforeEach(effect)`
+
+Runs the Effect before every test. No accessor returned — for
+side-effect setup only (truncate a table, reset a feature flag,
+…).
+
+### `afterAll(effect)` and `afterAll.skipIf(predicate)`
+
+Cleanup hook with conditional teardown:
+
+```typescript
+afterAll(destroy(Stack));                          // always destroy
+afterAll.skipIf(!process.env.CI)(destroy(Stack));  // CI only
+afterAll.skipIf(true)(destroy(Stack));             // never (debugging)
+```
+
+`afterAll.skipIf(true)` short-circuits without registering a
+hook at all — there's no risk of an `Effect` being constructed
+and dropped.
+
+### `afterEach(effect)`
+
+Runs after every test. Combine with `beforeEach` for
+test-isolated fixtures.
+
+## Test variants
+
+```typescript
+test.skip("not ready yet", Effect.gen(function* () { /* ... */ }));
+
+test.skipIf(process.env.CI)(
+  "local-only smoke test",
+  Effect.gen(function* () { /* ... */ }),
+);
+
+test.only(
+  "the one I'm debugging",
+  Effect.gen(function* () { /* ... */ }),
+);
+
+test.todo("backfill once R2 has multipart helper");
+```
+
+`test.provider` mirrors the same shape:
+
+```typescript
+test.provider.skip(name, fn);
+test.provider.skipIf(condition)(name, fn);
+```
+
+:::note[Vitest differences]
+On Vitest, `test.only` is supported but `test.todo` is a stub
+(maps to `it.todo`). `test.skip` / `test.skipIf` work identically.
+:::
+
+## HttpClient is in scope
+
+`HttpClient` is wired into every `test` Effect, so you can call
+it directly:
+
+```typescript
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+
+test(
+  "PUT and GET round-trip",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    const put = yield* HttpClient.put(`${url}/k`, {
+      body: HttpBody.text("hello"),
+    });
+    expect(put.status).toBe(201);
+
+    const get = yield* HttpClient.get(`${url}/k`);
+    expect(yield* get.text).toBe("hello");
+  }),
+);
+```
+
+The implementation comes from
+`effect/unstable/http/FetchHttpClient` — same client the CLI
+uses.
+
+## test.provider for provider-lifecycle tests
+
+`test.provider(name, (stack) => effect)` builds a **scratch
+stack** with a private in-memory state store, isolated from
+`.alchemy/` and from sibling tests. Use it to exercise create /
+update / replace / delete paths of a provider:
+
+```typescript
+test.provider(
+  "create, update, delete",
+  (stack) => Effect.gen(function* () {
+    // create
+    const v1 = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* MyResource("Test", { name: "v1" });
+      }),
+    );
+
+    // update — same logical ID, new inputs
+    const v2 = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* MyResource("Test", { name: "v2" });
+      }),
+    );
+    expect(v2.id).toBe(v1.id);
+
+    // destroy
+    yield* stack.destroy();
+  }),
+);
+```
+
+Inside the test body the configured `providers` Layer is
+already in scope, so SDK calls (`DynamoDB.describeTable`,
+`stripe.products.retrieve`, …) work without extra setup —
+handy for asserting the cloud actually matches the resource's
+reported outputs.
+
+For a full walkthrough using a real custom provider, see
+[Build a custom provider → Test the lifecycle](/guides/custom-provider#test-the-lifecycle).
+
+### Scratch state vs persistent state
+
+| | `test` + `deploy(Stack)` | `test.provider` |
+|---|---|---|
+| State store | `state` option (default `localState()`) | private in-memory, per test |
+| Survives runs | yes (the point) | no |
+| Use case | end-to-end against a real stack | provider unit tests |
+
+## Bun vs Vitest
+
+The two adapters expose the **same API**:
+
+```diff lang="typescript"
+-import * as Test from "alchemy/Test/Bun";
+-import { expect } from "bun:test";
++import * as Test from "alchemy/Test/Vitest";
++import { expect } from "@effect/vitest";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+```
+
+- **Bun** uses `bun:test` directly. Every `test(...)` becomes a
+  `bun.test(...)` call wrapped with `Effect.runPromise`.
+- **Vitest** uses `@effect/vitest`'s `it.live`, so Effect-aware
+  tests stay first-class. Default hook timeout is the same
+  (120s).
+
+Pick whichever runner your project already uses; nothing in the
+test code changes.
+
+## Patterns
+
+### Run tests against an existing deployed stack
+
+`afterAll.skipIf(!process.env.CI)(destroy(Stack))` is the
+default pattern — `bun test test/integ.test.ts` deploys once,
+re-runs reuse the cached state. To skip the deploy too (e.g.
+you've already run `alchemy deploy` manually and just want to
+hit the live URL), promote the stack outputs into a
+`beforeAll` that reads them instead:
+
+```typescript
+const stack = beforeAll(
+  process.env.SKIP_DEPLOY
+    ? Effect.succeed({ url: process.env.STACK_URL! })
+    : deploy(Stack),
+);
+```
+
+### Share state across files
+
+Each `Test.make` call creates its own runtime, but they all
+hit the same `state` Layer if you give them the same one. To
+share one deployed stack across multiple test files, use a
+remote state store (`Cloudflare.state()` / S3-backed) and the
+same `stage` in every file's `Test.make`.
+
+### Seed pre-existing resources in a scratch stack
+
+`test.provider`'s in-memory state is exposed as the `state`
+field on `ScratchStack` for advanced cases. For simpler seeds,
+just call `stack.deploy(...)` once with the seed, then again
+with the actual test inputs — the second call sees the first
+call's output as existing state.
+
+## See also
+
+- [Tutorial Part 3](/tutorial/part-3) — your first integration
+  test, walked through step by step.
+- [Build a custom provider](/guides/custom-provider) —
+  including a full `test.provider` example.
+- [State store](/concepts/state-store) — choosing between
+  `localState()`, `Cloudflare.state()`, and friends.
+- [Profiles](/concepts/profiles) — how `ALCHEMY_PROFILE` and
+  the `profile` factory option resolve credentials.
diff --git a/.repos/alchemy-effect/website/src/content/docs/getting-started.mdx b/.repos/alchemy-effect/website/src/content/docs/getting-started.mdx
new file mode 100644
index 00000000000..24c84ce4491
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/getting-started.mdx
@@ -0,0 +1,146 @@
+---
+title: Getting Started
+description: Install Alchemy and create your first Stack in under two minutes.
+sidebar:
+  order: 1
+---
+
+import Terminal from "../../components/Terminal.astro";
+import { Code, Tabs, TabItem } from "@astrojs/starlight/components";
+import { effectVersion } from "../../versions";
+
+export const pkgs = `"alchemy@next" "effect@${effectVersion}" "@effect/platform-bun@${effectVersion}" "@effect/platform-node@${effectVersion}"`;
+
+## Prerequisites
+
+- [Bun](https://bun.sh) (recommended) or Node.js 22+
+- A [Cloudflare](https://dash.cloudflare.com/sign-up) account
+
+## Create a project
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code="mkdir my-app && cd my-app && bun init -y" lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code="mkdir my-app && cd my-app && npm init -y" lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code="mkdir my-app && cd my-app && pnpm init" lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code="mkdir my-app && cd my-app && yarn init -y" lang="sh" />
+  </TabItem>
+</Tabs>
+
+## Install
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code={`bun add ${pkgs}`} lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code={`npm install ${pkgs}`} lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code={`pnpm add ${pkgs}`} lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code={`yarn add ${pkgs}`} lang="sh" />
+  </TabItem>
+</Tabs>
+
+## Create your Stack
+
+Every Alchemy program starts with a Stack — create `alchemy.run.ts`:
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket("Bucket");
+
+    return {
+      bucketName: bucket.bucketName,
+    };
+  }),
+);
+```
+
+## Deploy
+
+Run `alchemy deploy` to create the Bucket on Cloudflare:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code="bun alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code="npx alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code="pnpm alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code="yarn alchemy deploy" lang="sh" />
+  </TabItem>
+</Tabs>
+
+The first time you deploy, Alchemy walks each provider in your stack
+(here, Cloudflare) through an interactive login and saves the
+credentials to your **`default`** [profile](/concepts/profiles) at
+`~/.alchemy/profiles.json`. For Cloudflare you can sign in with
+OAuth in the browser or paste an API token — no environment
+variables required.
+
+Once you're authenticated, Alchemy shows a plan, asks for
+confirmation, and provisions the resource:
+
+<Terminal content={`[u]Plan[/u]: [g]1 to create[/g]
+[g]+[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]
+
+Proceed?
+◉ Yes ○ No
+[g]✓[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [g]created[/g]
+{
+[s2]bucketName: "myapp-bucket-a1b2c3d4e5",
+}`} />
+
+That's it — you have a live R2 Bucket on Cloudflare.
+
+:::tip
+To re-run the credential prompt later (e.g. to switch from OAuth to
+an API token, or to add a `prod` profile) use
+`alchemy login --configure` or `alchemy login --profile prod --configure`.
+See [Profiles](/concepts/profiles) for the full picture.
+:::
+
+## What's next
+
+<div class="next-steps">
+
+<a href="/tutorial/part-1" class="next-card">
+  <strong>Tutorial — recommended</strong>
+  <span>Adds a Worker to this Stack and covers the core concepts.</span>
+</a>
+
+<a href="/providers" class="next-card">
+  <strong>Providers reference</strong>
+  <span>Every supported Resource with copy-pasteable examples.</span>
+</a>
+
+<a href="/guides/migrating-from-v1" class="next-card">
+  <strong>Migrating from v1</strong>
+  <span>Upgrading from async/await Alchemy? Start here.</span>
+</a>
+
+</div>
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/ci.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/ci.mdx
new file mode 100644
index 00000000000..f8dd14507eb
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/ci.mdx
@@ -0,0 +1,781 @@
+---
+title: Continuous Integration
+description: Set up CI/CD pipelines for alchemy projects with GitHub Actions, automated deployments, and PR previews — with provider credentials managed as code.
+sidebar:
+  order: 2
+---
+
+import { Code, Steps, TabItem, Tabs } from "@astrojs/starlight/components";
+import yaml from "yaml";
+
+export function DeployWorkflow({ manager = "bun" }) {
+  const managers = {
+    bun: {
+      setup: [
+        {
+          name: "Setup Bun",
+          uses: "oven-sh/setup-bun@v2",
+        },
+      ],
+      install: "bun install",
+      run: "bun alchemy",
+      destroy: "bun alchemy",
+    },
+    npm: {
+      setup: [
+        {
+          name: "Setup Node.js",
+          uses: "actions/setup-node@v4",
+          with: {
+            "node-version": "24",
+          },
+        },
+      ],
+      install: "npm ci",
+      run: "npx alchemy",
+      destroy: "npx alchemy",
+    },
+    pnpm: {
+      setup: [
+        {
+          name: "Setup pnpm",
+          uses: "pnpm/action-setup@v4",
+          with: {
+            version: "10",
+            run_install: false,
+          },
+        },
+        {
+          name: "Setup Node.js",
+          uses: "actions/setup-node@v4",
+          with: {
+            "node-version": "24",
+            cache: "pnpm",
+          },
+        },
+      ],
+      install: "pnpm install",
+      run: "pnpm dlx alchemy",
+      destroy: "pnpm dlx alchemy",
+    },
+    yarn: {
+      setup: [
+        {
+          name: "Setup Node.js",
+          uses: "actions/setup-node@v4",
+          with: {
+            "node-version": "24",
+            cache: "yarn",
+          },
+        },
+        {
+          name: "Install yarn",
+          run: "npm install -g yarn",
+        },
+      ],
+      install: "yarn install",
+      run: "yarn dlx alchemy",
+      destroy: "yarn dlx alchemy",
+    },
+  };
+
+const cfg = managers[manager] || managers.bun;
+
+const content = yaml.stringify({
+name: "Deploy Application",
+on: {
+push: {
+branches: ["main"],
+},
+pull_request: {
+types: ["opened", "reopened", "synchronize", "closed"],
+},
+},
+concurrency: {
+group: "deploy-${{ github.ref }}",
+      "cancel-in-progress": false,
+    },
+    env: {
+      STAGE:
+        "${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || (github.ref == 'refs/heads/main' && 'prod' || github.ref_name) }}",
+},
+jobs: {
+deploy: {
+if: "${{ github.event.action != 'closed' }}",
+        "runs-on": "ubuntu-latest",
+        permissions: {
+          contents: "read",
+          "pull-requests": "write",
+        },
+        steps: [
+          {
+            uses: "actions/checkout@v4",
+          },
+          ...cfg.setup,
+          {
+            name: "Install dependencies",
+            run: cfg.install,
+          },
+          {
+            name: "Deploy",
+            run: `${cfg.run} deploy --stage \${{ env.STAGE }}`,
+            env: {
+              PULL_REQUEST: "${{ github.event.number }}",
+              GITHUB_SHA: "${{ github.sha }}",
+              GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}",
+            },
+          },
+        ],
+      },
+      cleanup: {
+        "runs-on": "ubuntu-latest",
+        if: "${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}",
+        permissions: {
+          contents: "read",
+          "pull-requests": "write",
+        },
+        steps: [
+          {
+            uses: "actions/checkout@v4",
+          },
+          ...cfg.setup,
+          {
+            name: "Install dependencies",
+            run: cfg.install,
+          },
+          {
+            name: "Safety Check",
+            run: `if [ "\${{ env.STAGE }}" = "prod" ]; then
+echo "ERROR: Cannot destroy prod environment in cleanup job"
+exit 1
+fi`,
+          },
+          {
+            name: "Destroy Preview Environment",
+            run: `${cfg.destroy} destroy --stage \${{ env.STAGE }}`,
+            env: {
+              PULL_REQUEST: "${{ github.event.number }}",
+},
+},
+],
+},
+},
+}, { aliasDuplicateObjects: false });
+
+return <Code lang="yaml" code={content} />;
+}
+
+This guide walks you through wiring up GitHub Actions for an Alchemy
+project: a deploy workflow with PR previews, a `stacks/github.ts`
+that mints scoped CI credentials and pushes them into your repo, and
+provider-specific recipes for Cloudflare and AWS.
+
+The unifying idea is **credentials as code**. Rather than copy-paste
+API keys into the GitHub UI, you let Alchemy provision exactly the
+credentials your CI needs — a scoped Cloudflare API token, an AWS
+IAM role for OIDC, etc. — and write them straight into the repo as
+encrypted secrets.
+
+## How PR previews work
+
+Open a PR. Alchemy does the rest.
+
+1. **A pull request is opened.** GitHub fires `pull_request`. The
+   workflow computes `STAGE = pr-{number}` and runs the deploy job.
+2. **Alchemy deploys the stack to that stage.** An isolated copy of
+   every resource — Workers, Lambdas, queues, tables. Stage state
+   lives separately, so PRs can't touch each other or prod.
+3. **A bot comment is posted (or updated) on the PR.** The
+   `GitHub.Comment` resource keeps its logical id stable, so the
+   comment updates in place on each push.
+4. **PR is merged or closed → cleanup runs.** A second job runs
+   `alchemy destroy --stage pr-{n}`. Resources gone. Costs gone.
+
+## What we'll build
+
+By the end you'll have:
+
+1. A GitHub Actions workflow (`.github/workflows/deploy.yml`) with
+   PR previews, prod deploys, and automatic cleanup.
+2. A `stacks/github.ts` that creates provider credentials and writes
+   them to your repo as `GitHub.Secret` / `GitHub.Variable`.
+3. A PR-comment resource in your `alchemy.run.ts` that posts the
+   preview URL on each push.
+
+## GitHub Actions Workflow
+
+<Steps>
+
+1. **Add preview comments to your stack**
+
+   Update your `alchemy.run.ts` to post a preview URL on each pull
+   request. The comment auto-updates on every push because the
+   logical ID stays the same.
+
+   ```typescript twoslash
+   // @noErrors
+   import * as Alchemy from "alchemy";
+   + import * as GitHub from "alchemy/GitHub";
+   + import * as Output from "alchemy/Output";
+   import * as Effect from "effect/Effect";
+
+   export default Alchemy.Stack(
+     "my-app",
+     { providers: /* ... */ },
+     Effect.gen(function* () {
+       const app = yield* App;
+
+   +   if (process.env.PULL_REQUEST) {
+   +     yield* GitHub.Comment("preview-comment", {
+   +       owner: "your-org",
+   +       repository: "your-repo",
+   +       issueNumber: Number(process.env.PULL_REQUEST),
+   +       body: Output.interpolate`
+   +         ## Preview Deployed
+   +
+   +         **URL:** ${app.url}
+   +
+   +         Built from commit ${process.env.GITHUB_SHA?.slice(0, 7)}
+   +
+   +         ---
+   +         _This comment updates automatically with each push._
+   +       `,
+   +     });
+   +   }
+
+       return { url: app.url };
+     }),
+   );
+   ```
+
+2. **Create the base deployment workflow**
+
+   Create `.github/workflows/deploy.yml`. This workflow deploys `prod` on
+   pushes to `main` and a `pr-<number>` stage for each pull request. When a
+   PR is closed the preview environment is destroyed automatically.
+
+   <Tabs syncKey="pkgManager">
+     <TabItem label="bun">
+       <DeployWorkflow manager="bun" />
+     </TabItem>
+     <TabItem label="npm">
+       <DeployWorkflow manager="npm" />
+     </TabItem>
+     <TabItem label="pnpm">
+       <DeployWorkflow manager="pnpm" />
+     </TabItem>
+     <TabItem label="yarn">
+       <DeployWorkflow manager="yarn" />
+     </TabItem>
+   </Tabs>
+
+   :::note[STAGE Variable Logic]
+   The `STAGE` environment variable is computed from the GitHub event:
+
+   ```yaml
+   env:
+     STAGE: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || (github.ref == 'refs/heads/main' && 'prod' || github.ref_name) }}
+   ```
+
+   - Pull request events → `pr-{number}`
+   - Pushes to `main` → `prod`
+   - Other branches → the branch name
+
+   The cleanup job includes a safety check to prevent accidental destruction
+   of the production environment.
+   :::
+
+3. **Add provider credentials**
+
+   The base workflow above doesn't include any provider credentials yet.
+   Pick the section below that matches your provider and apply the changes
+   to your workflow.
+
+   `GITHUB_TOKEN` is provided automatically by GitHub Actions and is used
+   by the `GitHub.Comment` resource to post PR comments.
+
+</Steps>
+
+## The GitHub Stack
+
+Before CI can deploy, your repo needs provider credentials configured
+as Actions secrets and variables. We recommend managing this with a
+dedicated `stacks/github.ts` that you deploy once locally — that way
+the credential set is reviewable, diffable, and reproducible.
+
+The stack uses `GitHub.Secret` and `GitHub.Variable` to write into
+your repository, and provider resources like
+`Cloudflare.AccountApiToken` or `AWS.IAM.Role` to mint the
+credentials themselves.
+
+### Set up an `admin` profile
+
+The `stacks/github.ts` you're about to write needs more privilege
+than your day-to-day app stack. Creating a Cloudflare API token
+requires `API Tokens > Write`; creating an IAM role and OIDC
+provider requires IAM admin rights.
+
+Rather than hand those rights to your default profile, create a
+separate `admin` profile:
+
+```sh
+alchemy login --profile admin
+```
+
+:::danger[Heads up]
+The credentials stored under `--profile admin` can mint new tokens
+and roles with arbitrary scope. Treat it like root. Use it only
+when deploying `stacks/github.ts`, and keep your default profile
+on a narrowly scoped credential (OAuth, a scoped API token, or
+OIDC) for everyday `alchemy deploy` runs.
+:::
+
+After creating the file, deploy it once locally under the admin
+profile:
+
+```sh
+alchemy deploy stacks/github.ts --profile admin
+```
+
+You only need to re-run this stack when you want to rotate
+credentials or change permissions.
+
+## Cloudflare
+
+The simplest case: a single Cloudflare account, used for both prod
+and PR previews. Your `admin` profile mints a scoped API token, and
+the stack pushes it into your repo as a GitHub Actions secret.
+
+:::caution[Required Cloudflare permissions]
+The credential behind `--profile admin` must be allowed to create
+API tokens. The two practical options are:
+
+- The **Global API Key** (API Key + Email) — has full account
+  access, including token management.
+- An **API Token** with at least `User > API Tokens > Write` (for
+  user-owned tokens) **and** `Account > API Tokens > Write` for the
+  target account.
+
+A standard "Edit Cloudflare Workers" token is **not** enough — it
+can deploy Workers but cannot mint other tokens. Use the Global API
+Key for `--profile admin` unless you've explicitly configured a
+token-management token.
+:::
+
+```typescript
+// stacks/github.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+
+export default Alchemy.Stack(
+  "github",
+  {
+    providers: Layer.mergeAll(
+      Cloudflare.providers(),
+      GitHub.providers(),
+    ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const accountId = yield* Config.string("CLOUDFLARE_ACCOUNT_ID");
+
+    const apiToken = yield* Cloudflare.AccountApiToken("CIToken", {
+      accountId,
+      policies: [
+        {
+          effect: "allow",
+          permissionGroups: [
+            "Workers Scripts Write",
+            "Workers KV Storage Write",
+            "Workers R2 Storage Write",
+            "D1 Write",
+            "Queues Write",
+            "Pages Write",
+            "Account Settings Write",
+            "Secrets Store Write",
+            "Workers Tail Read",
+          ],
+          resources: {
+            [`com.cloudflare.api.account.${accountId}`]: "*",
+          },
+        },
+      ],
+    });
+
+    yield* GitHub.Secret("cf-api-token", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "CLOUDFLARE_API_TOKEN",
+      value: apiToken.value,
+    });
+
+    yield* GitHub.Secret("cf-account-id", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "CLOUDFLARE_ACCOUNT_ID",
+      value: Redacted.make(accountId),
+    });
+  }),
+);
+```
+
+A few details worth knowing:
+
+- `Cloudflare.AccountApiToken` calls
+  `POST /accounts/{account_id}/tokens` and Cloudflare returns the
+  freshly minted token value exactly once. Alchemy captures it,
+  stores it in state, and pipes it straight into `GitHub.Secret` —
+  the raw token never appears in your terminal or in CI logs.
+- Trim the `permissionGroups` list to just what your app needs.
+  Listed above is a sensible default for a Workers + KV + R2 + D1
+  app.
+- The resource diff is stable across redeploys. Editing a policy
+  produces a clean update against the same token ID.
+
+:::note[Why `Secrets Store Write`?]
+`Cloudflare.state()` keeps the state-store worker's bearer token in
+the account-wide [Cloudflare Secrets Store](https://developers.cloudflare.com/secrets-store/).
+On every CI run Alchemy reads that secret back by uploading a
+short-lived edge-preview worker that *binds* the secret — and
+binding a Secrets Store secret to a worker (even an ephemeral
+preview) requires the **`Secrets Store Write`** permission, not
+just `Read`. `Read` is only enough to enumerate the store via
+`GET /accounts/{id}/secrets_store/stores`; the
+`POST .../scripts/{name}/edge-preview` call that mounts the
+binding is rejected without `Write`.
+:::
+
+Then add the secrets to your workflow's deploy and cleanup steps:
+
+```diff lang="yaml"
+      - name: Deploy
+        run: bun alchemy deploy --stage ${{ env.STAGE }}
+        env:
++         CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
++         CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+```diff lang="yaml"
+      - name: Destroy Preview Environment
+        run: bun alchemy destroy --stage ${{ env.STAGE }}
+        env:
++         CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
++         CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+```
+
+### Optional: separate test and prod accounts
+
+For stricter isolation you can run preview environments on one
+Cloudflare account and production on another. Mint two tokens from
+the same `stacks/github.ts` and prefix the secrets so the workflow
+can pick the right pair based on `STAGE`.
+
+```typescript
+// stacks/github.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+
+export default Alchemy.Stack(
+  "github",
+  {
+    providers: Layer.mergeAll(
+      Cloudflare.providers(),
+      GitHub.providers(),
+    ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const testAccountId = yield* Config.string("TEST_CLOUDFLARE_ACCOUNT_ID");
+    const prodAccountId = yield* Config.string("PROD_CLOUDFLARE_ACCOUNT_ID");
+
+    const policies = (accountId: string) => [
+      {
+        effect: "allow" as const,
+        permissionGroups: [
+          "Workers Scripts Write",
+          "Workers KV Storage Write",
+          "Workers R2 Storage Write",
+          "D1 Write",
+          "Queues Write",
+          "Pages Write",
+          "Account Settings Write",
+          "Secrets Store Write",
+          "Workers Tail Read",
+        ],
+        resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+      },
+    ];
+
+    const testToken = yield* Cloudflare.AccountApiToken("TestApiToken", {
+      accountId: testAccountId,
+      policies: policies(testAccountId),
+    });
+
+    const prodToken = yield* Cloudflare.AccountApiToken("ProdApiToken", {
+      accountId: prodAccountId,
+      policies: policies(prodAccountId),
+    });
+
+    const secrets: Record<string, Redacted.Redacted<string>> = {
+      TEST_CLOUDFLARE_API_TOKEN: testToken.value,
+      TEST_CLOUDFLARE_ACCOUNT_ID: Redacted.make(testAccountId),
+      PROD_CLOUDFLARE_API_TOKEN: prodToken.value,
+      PROD_CLOUDFLARE_ACCOUNT_ID: Redacted.make(prodAccountId),
+    };
+
+    yield* Effect.all(
+      Object.entries(secrets).map(([name, value]) =>
+        GitHub.Secret(name, {
+          owner: "your-org",
+          repository: "your-repo",
+          name,
+          value,
+        }),
+      ),
+    );
+  }),
+);
+```
+
+Your `admin` profile needs API-token-write permission on **both**
+accounts. The simplest setup is to log in with the Global API Key of
+a user that's a member of both.
+
+In your workflow, switch on `STAGE` to choose the right credential
+pair:
+
+```diff lang="yaml"
+      - name: Deploy
+        run: bun alchemy deploy --stage ${{ env.STAGE }}
+        env:
++         CLOUDFLARE_API_TOKEN: ${{ env.STAGE == 'prod' && secrets.PROD_CLOUDFLARE_API_TOKEN || secrets.TEST_CLOUDFLARE_API_TOKEN }}
++         CLOUDFLARE_ACCOUNT_ID: ${{ env.STAGE == 'prod' && secrets.PROD_CLOUDFLARE_ACCOUNT_ID || secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+## AWS with GitHub OIDC (recommended)
+
+GitHub OIDC lets your workflow assume an IAM role without storing
+long-lived access keys. The GitHub stack creates the OIDC provider
+and an IAM role scoped to your repo, then writes the role ARN and
+region to the repo as Actions **variables** (not secrets — they're
+not sensitive).
+
+Your `--profile admin` AWS credentials need IAM admin rights for
+this stack: it creates an `OpenIDConnectProvider` and an IAM `Role`.
+Run `alchemy login --profile admin` and choose a credential
+(SSO/OIDC, access keys, etc.) that's authorized for IAM
+administration.
+
+```typescript
+// stacks/github.ts
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as GitHub from "alchemy/GitHub";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "github",
+  {
+    providers: Layer.mergeAll(
+      AWS.providers(),
+      GitHub.providers(),
+    ),
+  },
+  Effect.gen(function* () {
+    const oidc = yield* AWS.IAM.OpenIDConnectProvider("GitHubOidc", {
+      url: "https://token.actions.githubusercontent.com",
+      clientIDList: ["sts.amazonaws.com"],
+      // GitHub's well-known OIDC thumbprint. AWS auto-discovers
+      // thumbprints for github.com these days, but the provider's
+      // thumbprint sync still requires a non-empty list.
+      // https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/
+      thumbprintList: ["6938fd4d98bab03faadb97b34396831e3780aea1"],
+    });
+
+    const role = yield* AWS.IAM.Role("GitHubActionsRole", {
+      roleName: "github-actions",
+      assumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: {
+              Federated: oidc.openIDConnectProviderArn,
+            },
+            Action: ["sts:AssumeRoleWithWebIdentity"],
+            Condition: {
+              StringEquals: {
+                "token.actions.githubusercontent.com:aud":
+                  "sts.amazonaws.com",
+              },
+              StringLike: {
+                "token.actions.githubusercontent.com:sub":
+                  "repo:your-org/your-repo:*",
+              },
+            },
+          },
+        ],
+      },
+      managedPolicyArns: [
+        "arn:aws:iam::aws:policy/AdministratorAccess",
+      ],
+    });
+
+    const region = yield* AWS.Region;
+
+    yield* GitHub.Variable("aws-role-arn", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "AWS_ROLE_ARN",
+      value: role.roleArn,
+    });
+
+    yield* GitHub.Variable("aws-region", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "AWS_REGION",
+      value: region,
+    });
+  }),
+);
+```
+
+:::tip[Tighten the role]
+`AdministratorAccess` is the path of least resistance for getting
+CI working, but for production you should swap it for a
+custom-managed policy that grants only the actions your app needs
+(for example, `lambda:*`, `dynamodb:*`, and the bucket actions
+you use). The `assumeRolePolicyDocument` already restricts who can
+assume the role to your specific repo via the `sub` condition.
+:::
+
+After deploying, update the workflow to add `id-token: write` and
+the `configure-aws-credentials` step. No secrets needed:
+
+```diff lang="yaml"
+    deploy:
+      permissions:
++       id-token: write
+        contents: read
+        pull-requests: write
+      steps:
+        - uses: actions/checkout@v4
+        # ...setup and install...
++       - name: Configure AWS credentials
++         uses: aws-actions/configure-aws-credentials@v4
++         with:
++           role-to-assume: ${{ vars.AWS_ROLE_ARN }}
++           aws-region: ${{ vars.AWS_REGION }}
+        - name: Deploy
+          run: bun alchemy deploy --stage ${{ env.STAGE }}
+```
+
+```diff lang="yaml"
+    cleanup:
+      permissions:
++       id-token: write
+        contents: read
+        pull-requests: write
+      steps:
+        - uses: actions/checkout@v4
+        # ...setup, install, and safety check...
++       - name: Configure AWS credentials
++         uses: aws-actions/configure-aws-credentials@v4
++         with:
++           role-to-assume: ${{ vars.AWS_ROLE_ARN }}
++           aws-region: ${{ vars.AWS_REGION }}
+        - name: Destroy Preview Environment
+          run: bun alchemy destroy --stage ${{ env.STAGE }}
+```
+
+## AWS with access keys
+
+If OIDC isn't an option (some sandbox accounts disallow it, or
+you're targeting an account you don't fully control), fall back to
+static IAM access keys stored as repo secrets. The stack pushes
+existing keys from your environment into the repo — it does **not**
+mint a new IAM user, since most teams prefer to do that step in the
+AWS console.
+
+```typescript
+// stacks/github.ts
+import * as Alchemy from "alchemy";
+import * as GitHub from "alchemy/GitHub";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+
+export default Alchemy.Stack(
+  "github",
+  {
+    providers: GitHub.providers(),
+  },
+  Effect.gen(function* () {
+    const accessKeyId = yield* Config.string("AWS_ACCESS_KEY_ID");
+    const secretAccessKey = yield* Config.redacted("AWS_SECRET_ACCESS_KEY");
+
+    yield* GitHub.Secret("aws-access-key-id", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "AWS_ACCESS_KEY_ID",
+      value: Redacted.make(accessKeyId),
+    });
+
+    yield* GitHub.Secret("aws-secret-access-key", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "AWS_SECRET_ACCESS_KEY",
+      value: secretAccessKey,
+    });
+
+    yield* GitHub.Variable("aws-region", {
+      owner: "your-org",
+      repository: "your-repo",
+      name: "AWS_REGION",
+      value: "us-east-1",
+    });
+  }),
+);
+```
+
+Then add the secrets to your workflow's deploy and cleanup steps:
+
+```diff lang="yaml"
+      - name: Deploy
+        run: bun alchemy deploy --stage ${{ env.STAGE }}
+        env:
++         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
++         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
++         AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+```diff lang="yaml"
+      - name: Destroy Preview Environment
+        run: bun alchemy destroy --stage ${{ env.STAGE }}
+        env:
++         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
++         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
++         AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
+          PULL_REQUEST: ${{ github.event.number }}
+```
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/circular-bindings.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/circular-bindings.mdx
new file mode 100644
index 00000000000..bf1662af19d
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/circular-bindings.mdx
@@ -0,0 +1,219 @@
+---
+title: Circular Bindings
+description: How to model two services that reference each other (Worker A ↔ Worker B, Lambda ↔ Lambda) using tagged classes and Layers.
+sidebar:
+  order: 6
+---
+
+import DAG from "../../../components/DAG.astro";
+
+Real systems have cycles. A web Worker calls an internal Worker for
+auth; the internal Worker calls back into the web Worker for
+billing. Two Lambdas trigger each other through a queue.
+
+Most IaC engines reject these — you can't create A before B if A
+needs B's URL, but B needs A's URL too. Alchemy resolves the
+deadlock by separating **identity** (a class used as a Tag) from
+**implementation** (a Layer attached via `.make()`).
+
+In this guide you'll build two Workers that call each other, one
+step at a time.
+
+## Sketch the cycle
+
+The goal: two Workers, `A` and `B`. Each one delegates half of its
+work to the other.
+
+```
+GET /  →  A  ──fetch──▶  B
+              ◀──fetch───
+```
+
+Naively you'd write `import { B } from "./B.ts"` inside `A.ts` and
+`import { A } from "./A.ts"` inside `B.ts`. The imports succeed at
+the module level, but at deploy time neither Worker can be created
+first — each needs the other's URL.
+
+The fix is to import only the **Tag** (cheap, side-effect free)
+across the cycle, and keep each Worker's **runtime implementation**
+behind a `.make()` call that runs only when the Stack provides it.
+
+## Create A as a Tag
+
+Start `src/A.ts` with just the class — no runtime yet. The class
+extends `Cloudflare.Worker<A>()(...)`, which produces a typed
+identifier you can `yield*` from anywhere.
+
+```typescript
+// src/A.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export class A extends Cloudflare.Worker<A>()("A", {
+  main: import.meta.path,
+}) {}
+```
+
+`A` is now a Tag. Importing it from another file does **not** force
+its implementation to load — there is no implementation yet. This is
+what makes the cycle resolvable.
+
+## Create B as a Tag
+
+Do the same for `B`. Both files only declare identity at this point.
+
+```typescript
+// src/B.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export class B extends Cloudflare.Worker<B>()("B", {
+  main: import.meta.path,
+}) {}
+```
+
+Now `A` and `B` can freely `import` each other — neither side
+triggers any runtime code by importing the other's class.
+
+## Add A's runtime, binding B
+
+Attach A's implementation with `A.make(...)`. Inside the Init phase,
+`yield* Cloudflare.Worker.bind(B)` produces a typed callable that
+will dispatch to B's deployed URL at runtime.
+
+```diff lang="typescript"
+  // src/A.ts
+  import * as Cloudflare from "alchemy/Cloudflare";
++ import * as Effect from "effect/Effect";
++ import { B } from "./B.ts";
+
+  export class A extends Cloudflare.Worker<A>()("A", {
+    main: import.meta.path,
+  }) {}
+
++ export default A.make(
++   Effect.gen(function* () {
++     const b = yield* Cloudflare.Worker.bind(B);
++     return {
++       fetch: Effect.gen(function* () {
++         return yield* b.fetch(new Request("https://b/work"));
++       }),
++     };
++   }),
++ );
+```
+
+The `import { B }` line pulls in B's Tag only. `Worker.bind(B)`
+returns a deferred reference — at plan time it's an `Output<URL>`
+placeholder; at runtime it's a real `fetch` stub.
+
+## Add B's runtime, binding A
+
+Mirror the same pattern in `B.ts`. B's runtime imports A's Tag and
+binds it.
+
+```diff lang="typescript"
+  // src/B.ts
+  import * as Cloudflare from "alchemy/Cloudflare";
++ import * as Effect from "effect/Effect";
++ import { A } from "./A.ts";
+
+  export class B extends Cloudflare.Worker<B>()("B", {
+    main: import.meta.path,
+  }) {}
+
++ export default B.make(
++   Effect.gen(function* () {
++     const a = yield* Cloudflare.Worker.bind(A);
++     return {
++       fetch: Effect.gen(function* () {
++         return yield* a.fetch(new Request("https://a/callback"));
++       }),
++     };
++   }),
++ );
+```
+
+This is the symmetric half of the cycle. `A` imports `B`'s Tag and
+binds it; `B` imports `A`'s Tag and binds it. Neither file needs the
+other's `.make()` to be evaluated.
+
+## Wire both into the Stack
+
+The Stack pulls in both Tags (via `import { A }` / `import { B }`)
+and both Layers (via the default exports). `Effect.provide` attaches
+the Layers to the generator so the Tags resolve to real Workers.
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import ALive, { A } from "./src/A.ts";
+import BLive, { B } from "./src/B.ts";
+
+export default Alchemy.Stack(
+  "AB",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const a = yield* A;
+    const b = yield* B;
+    return { aUrl: a.url, bUrl: b.url };
+  }).pipe(Effect.provide(Layer.mergeAll(ALive, BLive))),
+);
+```
+
+`yield* A` and `yield* B` only succeed because `ALive` and `BLive`
+are provided. Forget one, and TypeScript flags the missing layer at
+the call site.
+
+## How alchemy resolves the cycle
+
+Under the hood, alchemy plans the cycle in two passes:
+
+<DAG
+  nodes={[
+    { id: "Decl", label: "declare", type: "A & B Tags" },
+    { id: "Pre", label: "precreate", type: "reserve URLs", tone: "accent" },
+    { id: "Create", label: "create", type: "deferred Outputs" },
+    { id: "Wire", label: "update", type: "wire bindings", tone: "accent" },
+  ]}
+  edges={[
+    { from: "Decl", to: "Pre" },
+    { from: "Pre", to: "Create" },
+    { from: "Create", to: "Wire" },
+  ]}
+/>
+
+1. The **Tags** are registered up front, so the graph knows that A
+   and B both exist.
+2. Each provider's [`precreate`](/concepts/provider#precreate) hook
+   reserves the resource (and its physical URL) without needing the
+   other side's outputs.
+3. `create` runs in parallel using deferred Outputs — bindings see
+   `Output<string>` placeholders that resolve later.
+4. A converge pass calls `update` once both sides exist, wiring the
+   real cross-references in. Types stay sound the whole way through
+   because Outputs are typed.
+
+The same pattern works for Lambda↔Lambda, Worker↔Container, or any
+mix of platforms — the Tag/Layer split is a property of every
+[Platform](/concepts/platform) resource, not just Workers.
+
+## When you don't need this
+
+If your services form a DAG (no cycles), you can keep declaration
+and implementation in one expression:
+
+```typescript
+export default Cloudflare.Worker(
+  "MyWorker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    /* ... */
+  }),
+);
+```
+
+The tagged-class pattern only pays off when something else needs to
+reference the Worker before its implementation is in scope. For
+non-circular reuse across files, see [Layers](/concepts/layers).
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/cli.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/cli.mdx
new file mode 100644
index 00000000000..1ed0ba9d319
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/cli.mdx
@@ -0,0 +1,691 @@
+---
+title: CLI Reference
+description: All Alchemy CLI commands — deploy, destroy, plan, dev, tail, logs, aws, cloudflare, login, profile, and state.
+sidebar:
+  order: 1
+---
+
+import Terminal from "../../../components/Terminal.astro";
+
+The Alchemy CLI manages the lifecycle of your stacks. Every command
+operates on an `alchemy.run.ts` file (or a custom entrypoint) and
+targets a **stage** — an isolated environment like `dev_sam`, `prod`,
+or `pr-42`.
+
+```sh
+alchemy <command> [file] [options]
+```
+
+If no file is specified, the CLI looks for `alchemy.run.ts` in the
+current directory.
+
+## Common options
+
+These options are shared across most commands:
+
+| Option              | Description                                                                                  |
+| ------------------- | -------------------------------------------------------------------------------------------- |
+| `--stage <name>`    | Stage to target. Defaults to `dev_$USER` (e.g. `dev_sam`). Must match `[a-z0-9][-_a-z0-9]*`. |
+| `--env-file <path>` | Load environment variables from a file before running.                                       |
+
+## `deploy`
+
+Compute a plan, ask for approval, and create/update/delete resources
+to match the desired state.
+
+```sh
+alchemy deploy [file] [options]
+```
+
+<Terminal content={`[u]Plan[/u]: [g]2 to create[/g]
+
+[g]+[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]
+[g]+[/g] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [c](1 bindings)[/c]
+[s2][g]+[/g] [c]Bucket[/c]
+
+Proceed?
+◉ Yes ○ No
+[g]✓[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [g]created[/g]
+[g]✓[/g] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [g]created[/g]
+[s2][d]• Uploading worker (14.20 KB) ...[/d]
+[s2][d]• Enabling workers.dev subdomain...[/d]
+{
+[s2]url: "https://myapp-worker-dev-you-abc123.workers.dev",
+}`} />
+
+On subsequent deploys, only changed resources are updated:
+
+<Terminal content={`[u]Plan[/u]: [y]1 to update[/y]
+
+[y]~[/y] [b]Worker[/b] [d](Cloudflare.Worker)[/d]
+
+Proceed?
+◉ Yes ○ No
+[g]✓[/g] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [y]updated[/y]
+[s2][d]• Uploading worker (15.10 KB) ...[/d]
+{
+[s2]url: "https://myapp-worker-dev-you-abc123.workers.dev",
+}`} />
+
+| Option              | Description                                                                                                                |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `--stage <name>`    | Stage to deploy to (defaults to `dev_$USER`)                                                                               |
+| `--yes`             | Skip the approval prompt                                                                                                   |
+| `--dry-run`         | Show the plan without applying (same as `alchemy plan`)                                                                    |
+| `--force`           | Force updates for resources that would otherwise no-op                                                                     |
+| `--adopt`           | Adopt pre-existing cloud resources that conflict with this stack instead of failing. Useful for re-importing into a fresh state store. |
+| `--profile <name>`  | Auth profile to use (defaults to `default` or `$ALCHEMY_PROFILE`)                                                          |
+| `--env-file <path>` | Load environment variables from a file                                                                                     |
+
+```sh
+# Deploy to production, skip the prompt
+alchemy deploy --stage prod --yes
+
+# Deploy a different stack file
+alchemy deploy stacks/github.ts
+
+# Preview what would change
+alchemy deploy --dry-run
+
+# Re-import existing cloud resources into a fresh state store
+alchemy deploy --adopt
+```
+
+### Adoption
+
+When a resource has no prior state, the engine calls the provider's
+`read` to check whether the resource already exists in the cloud. The
+return value drives one of three paths:
+
+| `read` returns      | Without `--adopt`         | With `--adopt`        |
+| ------------------- | ------------------------- | --------------------- |
+| `undefined`         | create                    | create                |
+| owned (plain attrs) | silent adopt              | silent adopt          |
+| `Unowned(attrs)`    | fail `OwnedBySomeoneElse` | take over (silently)  |
+
+"Owned" means the provider can prove the resource was created by
+*this* stack/stage/logical-id — typically by inspecting tags or a
+naming convention. Recovering a wiped state store for resources you
+already own is the **default** behavior: no flag required.
+
+`--adopt` only matters when the provider reports a resource exists
+but isn't ours. That's the deliberately load-bearing case: by
+default Alchemy refuses to silently overwrite tags/config of a
+resource it can't prove ownership of. `--adopt` says "yes, take it
+over."
+
+```sh
+# Re-import existing alchemy-tagged resources into a fresh state
+# store — no flag needed for these. Ones with foreign ownership tags
+# will surface as `OwnedBySomeoneElse` errors.
+alchemy deploy
+
+# Force takeover of any conflicting resource regardless of tags.
+alchemy deploy --adopt
+```
+
+You can also enable adoption programmatically by piping the
+`adopt` combinator onto a deploy effect from `alchemy/AdoptPolicy`:
+
+```typescript
+import { adopt } from "alchemy/AdoptPolicy";
+
+yield* deploy(
+  Effect.gen(function* () {
+    yield* Cloudflare.Worker("API", { /* ... */ });
+  }),
+).pipe(adopt(true));
+```
+
+`AdoptPolicy` is consulted at plan time, so the combinator must
+wrap the *deploy* (or test runner's `stack.deploy(...)`) — not the
+inner resource-declaration effect.
+
+Resources without ownership semantics (e.g. APIs that always
+return a singleton by name, with no tag concept) silently adopt
+unconditionally — `--adopt` is a no-op for them.
+
+## `plan`
+
+Preview what would change without applying anything. Equivalent to
+`alchemy deploy --dry-run`.
+
+```sh
+alchemy plan [file] [options]
+```
+
+<Terminal content={`[u]Plan[/u]: [g]1 to create[/g], [y]1 to update[/y]
+
+[g]+[/g] [b]Queue[/b] [d](AWS.SQS.Queue)[/d]
+[y]~[/y] [b]Worker[/b] [d](Cloudflare.Worker)[/d]`} />
+
+The plan uses `+` for creates, `~` for updates, `-` for deletes,
+and `•` for no-ops. No approval prompt is shown and no changes are
+made.
+
+| Option              | Description                                     |
+| ------------------- | ----------------------------------------------- |
+| `--stage <name>`    | Stage to plan against (defaults to `dev_$USER`) |
+| `--env-file <path>` | Load environment variables from a file          |
+
+## `destroy`
+
+Delete every resource in a stack. Computes a plan where all existing
+resources are marked for deletion, asks for approval, and removes
+them in dependency order.
+
+```sh
+alchemy destroy [file] [options]
+```
+
+<Terminal content={`[u]Plan[/u]: [r]2 to delete[/r]
+
+[r]-[/r] [b]Worker[/b] [d](Cloudflare.Worker)[/d]
+[r]-[/r] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]
+
+Proceed?
+◉ Yes ○ No
+[r]✗[/r] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [r]deleted[/r]
+[r]✗[/r] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [r]deleted[/r]`} />
+
+| Option              | Description                                          |
+| ------------------- | ---------------------------------------------------- |
+| `--stage <name>`    | Stage to destroy (defaults to `dev_$USER`)           |
+| `--yes`             | Skip the approval prompt                             |
+| `--dry-run`         | Show what would be deleted without actually deleting |
+| `--env-file <path>` | Load environment variables from a file               |
+
+```sh
+# Destroy a PR preview environment
+alchemy destroy --stage pr-42 --yes
+```
+
+## `dev`
+
+Run your stack in development mode with hot reloading.
+
+```sh
+alchemy dev [file] [options]
+```
+
+Resources are deployed to the cloud while Workers run locally in
+workerd. File changes trigger automatic rebuilds and hot reloads.
+
+| Option              | Description                                    |
+| ------------------- | ---------------------------------------------- |
+| `--stage <name>`    | Stage to use for dev (defaults to `dev_$USER`) |
+| `--env-file <path>` | Load environment variables from a file         |
+
+```sh
+# Start dev mode
+alchemy dev
+
+# Use a custom stage
+alchemy dev --stage dev
+```
+
+## `tail`
+
+Stream live logs from deployed resources in real time.
+
+```sh
+alchemy tail [file] [options]
+```
+
+<Terminal content={`Tailing: Worker, Api
+
+[c]2026-04-15 14:32:01.123 PST [Worker][/c] GET /hello.txt 200
+[c]2026-04-15 14:32:01.456 PST [Worker][/c] PUT /world.txt 201
+[y]2026-04-15 14:32:02.789 PST [Api][/y] POST /api/data 200`} />
+
+Logs from multiple resources are interleaved and color-coded by
+resource. The command streams indefinitely until you interrupt it
+with `Ctrl+C`.
+
+| Option              | Description                                                         |
+| ------------------- | ------------------------------------------------------------------- |
+| `--stage <name>`    | Stage to tail (defaults to `dev_$USER`)                             |
+| `--filter <ids>`    | Comma-separated logical resource IDs to include (e.g. `Worker,Api`) |
+| `--env-file <path>` | Load environment variables from a file                              |
+
+```sh
+# Tail only the Worker resource
+alchemy tail --filter Worker
+
+# Tail a specific stage
+alchemy tail --stage prod
+```
+
+## `logs`
+
+Fetch historical logs from deployed resources.
+
+```sh
+alchemy logs [file] [options]
+```
+
+Unlike `tail`, `logs` fetches a batch of past log entries and exits.
+
+| Option              | Description                                                             |
+| ------------------- | ----------------------------------------------------------------------- |
+| `--stage <name>`    | Stage to fetch logs from (defaults to `dev_$USER`)                      |
+| `--filter <ids>`    | Comma-separated logical resource IDs to include                         |
+| `--limit <n>`       | Number of log entries to fetch (default: 100)                           |
+| `--since <time>`    | Fetch logs since this time — a duration (`1h`, `30m`, `2d`) or ISO date |
+| `--env-file <path>` | Load environment variables from a file                                  |
+
+```sh
+# Last 50 log entries from all resources
+alchemy logs --limit 50
+
+# Logs from the last hour, Worker only
+alchemy logs --filter Worker --since 1h
+
+# Logs from a specific stage since a date
+alchemy logs --stage prod --since 2026-04-01T00:00:00Z
+```
+
+## `aws`
+
+Cloud-provider commands for AWS — managing the per-account
+infrastructure that Alchemy itself relies on.
+
+```sh
+alchemy aws <subcommand> [options]
+```
+
+### `aws bootstrap`
+
+Set up the AWS assets bucket required for deploying Lambda functions
+and other AWS resources that need artifact storage.
+
+```sh
+alchemy aws bootstrap [options]
+```
+
+| Option              | Description                                                |
+| ------------------- | ---------------------------------------------------------- |
+| `--profile <name>`  | AWS profile to use for credentials (default: `default`)    |
+| `--region <region>` | AWS region to bootstrap (defaults to `AWS_REGION` env var) |
+| `--destroy`         | Destroy all bootstrap buckets in the selected region       |
+| `--env-file <path>` | Load environment variables from a file                     |
+
+```sh
+# Bootstrap with the default profile
+alchemy aws bootstrap
+
+# Bootstrap a specific region and profile
+alchemy aws bootstrap --profile prod --region us-west-2
+
+# Remove bootstrap resources
+alchemy aws bootstrap --destroy
+```
+
+## `cloudflare`
+
+Cloud-provider commands for Cloudflare — managing the state-store
+worker that backs `Cloudflare.state(...)`, and inspecting its logs.
+
+```sh
+alchemy cloudflare <subcommand> [options]
+```
+
+### `cloudflare bootstrap`
+
+Manually deploy (or repair) the Cloudflare-hosted HTTP State Store —
+the worker + Secrets Store + auth-token secret that back the
+remote-state layer used by `Cloudflare.state(...)`.
+
+You normally don't need to run this: the very first stack deploy
+that uses `Cloudflare.state(...)` will prompt you to bootstrap
+automatically. Use this command to re-run that flow on demand —
+typically to recover from a previous deploy that was interrupted
+mid-bootstrap.
+
+```sh
+alchemy cloudflare bootstrap [options]
+```
+
+| Option                  | Description                                                                                                                       |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| `--profile <name>`      | Alchemy auth profile (defaults to `default` or `$ALCHEMY_PROFILE`). Determines which `~/.alchemy/profiles.json` entry is used.    |
+| `--force`               | Force a full redeploy even if the worker already exists. Without this flag, an existing worker is **adopted** and only its credentials are refreshed. |
+| `--worker-name <name>`  | Override the default state-store worker name. Advanced; only needed if you run multiple state stores per Cloudflare account.      |
+| `--env-file <path>`     | Load environment variables from a file                                                                                            |
+
+The bootstrap is idempotent and self-healing:
+
+- If the worker already exists in your Cloudflare account, it is
+  **adopted**: the auth token is re-fetched live via a short-lived
+  edge-preview probe (the only way to read a Secrets Store value),
+  and `~/.alchemy/credentials/<profile>/cloudflare-state-store.json`
+  is rewritten with the current token.
+- If a previous run failed mid-flight (e.g. the worker got created
+  but credentials never landed on disk), the leftover local state
+  stack is detected and the deploy resumes where it left off. The
+  bootstrap is only considered complete once the local stack has
+  been hoisted into the remote store and removed.
+- With `--force`, the deploy runs again unconditionally. Existing
+  Cloudflare resources (worker, Secrets Store, secret) are still
+  reconciled in place rather than replaced — adoption is enabled
+  automatically for the bootstrap stack.
+
+```sh
+# First-time bootstrap (or repair after a failed deploy)
+alchemy cloudflare bootstrap
+
+# Bootstrap a separate profile
+alchemy cloudflare bootstrap --profile staging
+
+# Force a full redeploy (e.g. to roll out an updated state-store worker)
+alchemy cloudflare bootstrap --force
+```
+
+### `cloudflare create-token`
+
+Mint a Cloudflare API token (`POST /user/tokens`) from the CLI. Useful
+for creating the `CLOUDFLARE_API_TOKEN` you hand to CI, or a broad local
+token for `alchemy deploy`. You'll be pointed to
+[your Cloudflare profile](https://dash.cloudflare.com/profile/api-tokens)
+once to grab your Global API Key (unless it's already in the environment);
+everything else happens in the terminal.
+
+```sh
+alchemy cloudflare create-token [options]
+```
+
+This command is **standalone** — it does not use an Alchemy auth
+profile. Cloudflare only mints a token whose permissions the
+authenticating credential is allowed to grant, and OAuth/scoped tokens
+silently produce a token with **zero** permissions. So this command
+always authenticates with your account's **Global API Key**, read from
+`CLOUDFLARE_API_KEY` / `CLOUDFLARE_EMAIL` (or prompted). The key is used
+only to create the token and is never stored.
+
+By default it grants a curated set of permissions covering the services
+Alchemy commonly deploys (Workers, KV, R2, D1, Queues, DNS, etc.). Pass
+`--all-permissions` for a "superuser" token spanning **every** permission
+group your account exposes (after a confirmation prompt).
+
+<Terminal content={`◇  Select a Cloudflare account
+│  My Account
+│
+◇  Token name
+│  alchemy-superuser
+│
+◇  Create a superuser token with all permissions?
+│  Yes
+
+Created Cloudflare API token "alchemy-superuser" (7cb070fe...).
+Granted 360 permission group(s) across 3 policy(ies); token status: active.
+
+cfut_pMtBzTOGHWyFC2RSNvfw8f7p2cc...
+
+Store this value now — Cloudflare only shows it once. Use it as CLOUDFLARE_API_TOKEN.`} />
+
+| Option               | Description                                                                                       |
+| -------------------- | ------------------------------------------------------------------------------------------------- |
+| `--all-permissions`  | Grant every Cloudflare permission group (a "superuser" token). Prompts for confirmation.          |
+| `--name <name>`      | Token name. Prompted (required) if omitted.                                                       |
+| `--account-id <id>`  | Account to scope the token to. If omitted, you'll be prompted to select one.                      |
+| `--env-file <path>`  | Load environment variables (e.g. `CLOUDFLARE_API_KEY`, `CLOUDFLARE_EMAIL`) from a file            |
+
+The permission groups are resolved **live** from your account (so the
+token always uses IDs valid for that account), and the freshly minted
+token is verified against `/user/tokens/verify` before the value is
+printed.
+
+:::note
+The Cloudflare dashboard has a long-standing rendering bug where
+API-created tokens show a **blank** permission summary (and a greyed-out
+"View") on first load. The permissions are applied regardless — the
+`Granted N permission group(s)` line and `token status: active` confirm
+it. To see them in the UI, open the token and click "← Edit token".
+:::
+
+```sh
+# Curated set of permissions for typical Alchemy deploys
+alchemy cloudflare create-token --name ci-token
+
+# Full-access "superuser" token
+alchemy cloudflare create-token --all-permissions --name admin
+
+# Non-interactive: key/email from the environment, explicit account
+CLOUDFLARE_API_KEY=... CLOUDFLARE_EMAIL=you@example.com \
+  alchemy cloudflare create-token --name ci --account-id <account-id>
+```
+
+### `cloudflare state logs`
+
+Get or tail logs from the `alchemy-state-store` Worker on your
+Cloudflare account. Talks directly to the Workers Observability
+Telemetry API — no stack file required — so you can debug the
+state-store itself.
+
+```sh
+alchemy cloudflare state logs [options]
+```
+
+Requires `workers_observability:read` and
+`workers_observability_telemetry:write` OAuth scopes (included in the
+default scope set; existing profiles need to re-run `alchemy login`
+to pick them up).
+
+| Option                 | Description                                                                                                  |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------ |
+| `--tail`               | Stream logs in real time via the Cloudflare tail websocket instead of fetching past entries                  |
+| `--limit <n>`          | Number of log entries to fetch when not tailing (default: 100)                                               |
+| `--since <time>`       | Fetch logs since this time — a duration (`1h`, `30m`, `2d`) or ISO date                                       |
+| `--worker-name <name>` | Override the default state-store worker name. Only needed if you run multiple state stores per account.       |
+| `--profile <name>`     | Alchemy auth profile (defaults to `default` or `$ALCHEMY_PROFILE`)                                           |
+| `--env-file <path>`    | Load environment variables from a file                                                                        |
+
+```sh
+# Last hour of state-store logs
+alchemy cloudflare state logs
+
+# Stream live in a separate terminal while you reproduce a bug
+alchemy cloudflare state logs --tail
+
+# Just the last 30 minutes
+alchemy cloudflare state logs --since 30m --limit 200
+```
+
+## `login`
+
+Configure and log in to each cloud provider used by your stack. The
+command imports your stack file to discover which `AuthProvider`s are
+registered, then walks through each one — prompting for the auth method
+the first time, and refreshing tokens (e.g. Cloudflare OAuth) on
+subsequent runs.
+
+Credentials are written to `~/.alchemy/profiles.json`, keyed by
+**profile name** (defaults to `default`, overridable with
+`$ALCHEMY_PROFILE` or `--profile`).
+
+```sh
+alchemy login [file] [options]
+```
+
+| Option              | Description                                                                |
+| ------------------- | -------------------------------------------------------------------------- |
+| `--profile <name>`  | Profile to write to (defaults to `default` or `$ALCHEMY_PROFILE`)          |
+| `--configure`       | Re-run the provider's interactive configure step before logging in         |
+| `--stage <name>`    | Stage used while loading the stack (defaults to `dev_$USER`)               |
+| `--env-file <path>` | Load environment variables from a file                                     |
+
+```sh
+# Log in with the default profile
+alchemy login
+
+# Log in to a separate profile
+alchemy login --profile prod
+
+# Re-configure (e.g. switch from OAuth to API token) and log in
+alchemy login --configure
+```
+
+## `profile`
+
+Inspect credentials stored in `~/.alchemy/profiles.json`.
+
+### `profile show`
+
+Print every auth method configured under a profile, along with its
+resolved credentials (redacted). Unlike `login`, this does **not**
+import your stack file — it reads the profile store directly and uses
+the bundled providers (Cloudflare, AWS) to pretty-print each entry.
+
+```sh
+alchemy profile show [options]
+```
+
+<Terminal content={`Profile: default
+
+── AWS ──
+  accessKeyId:     ASIA****
+  secretAccessKey: Pj5T****
+  sessionToken:    IQoJ****
+  region:          us-west-2
+  source: sso - default
+
+── Cloudflare ──
+  accessToken: Xl06****
+  expires: in 59m 58s 999ms (2026-04-27T20:45:47.937Z)
+  accountId: 123456789...
+  source: oauth`} />
+
+| Option              | Description                                                       |
+| ------------------- | ----------------------------------------------------------------- |
+| `--profile <name>`  | Profile to show (defaults to `default` or `$ALCHEMY_PROFILE`)     |
+| `--env-file <path>` | Load environment variables from a file                            |
+
+```sh
+# Show the default profile
+alchemy profile show
+
+# Show a named profile
+alchemy profile show --profile prod
+```
+
+## `state`
+
+Inspect and manage the state store — the record of which resources
+Alchemy thinks exist for each stack/stage. Reads from whatever state
+layer the stack file configures (e.g. `Cloudflare.state(...)`), or
+from the on-disk `.alchemy/state` directory with `--local`.
+
+```sh
+alchemy state <subcommand> [options]
+```
+
+The stack file is imported to resolve its configured state layer, so
+all subcommands accept the same `--stage`, `--profile`, and
+`--env-file` options as `deploy`. Pass `[file]` via the standard
+positional `script` argument inherited from the root command.
+
+| Option              | Description                                                                       |
+| ------------------- | --------------------------------------------------------------------------------- |
+| `--local`           | Read from local `.alchemy/state` instead of the stack's configured state store    |
+| `--stage <name>`    | Stage used while loading the stack (defaults to `dev_$USER`)                      |
+| `--profile <name>`  | Auth profile to use (defaults to `default` or `$ALCHEMY_PROFILE`)                 |
+| `--env-file <path>` | Load environment variables from a file                                            |
+
+### `state stacks`
+
+List every stack name present in the state store.
+
+```sh
+alchemy state stacks [file] [options]
+```
+
+### `state stages <stack>`
+
+List every stage that has state recorded under `<stack>`.
+
+```sh
+alchemy state stages <stack> [file] [options]
+```
+
+### `state resources <stack> <stage>`
+
+List the fully-qualified resource names (FQNs) tracked under a given
+stack/stage.
+
+```sh
+alchemy state resources <stack> <stage> [file] [options]
+```
+
+### `state get <stack> <stage> <fqn>`
+
+Print a single resource's persisted state as JSON. Output uses the
+same encoding the store persists: redacted secrets are unwrapped into
+`{ __redacted__: ... }` and Resources are flattened.
+
+```sh
+alchemy state get <stack> <stage> <fqn> [file] [options]
+```
+
+### `state tree`
+
+Render the entire state store as a tree of stacks → stages →
+resources.
+
+```sh
+alchemy state tree [file] [options]
+```
+
+<Terminal content={`AlchemyEffectWebsite
+├─ dev_sam
+│  ├─ Bucket
+│  └─ Worker
+└─ prod
+   ├─ Bucket
+   └─ Worker`} />
+
+### `state clear [stack] [stage]`
+
+Delete state entries from the store. **Destructive but local-only** —
+the actual cloud resources are not touched, only Alchemy's record of
+them. A subsequent `deploy` will see an empty state and try to
+re-create everything (use `--adopt` to reconcile against existing
+infrastructure).
+
+```sh
+alchemy state clear [stack] [stage] [file] [options]
+```
+
+- Omit both arguments to clear **all stacks** in the store.
+- Pass `<stack>` to clear every stage under that stack.
+- Pass `<stack> <stage>` to clear a single stage.
+
+| Option  | Description              |
+| ------- | ------------------------ |
+| `--yes` | Skip the confirmation prompt |
+
+```sh
+# Inspect what's in the store
+alchemy state tree
+
+# Drop a single PR-preview stage
+alchemy state clear myapp pr-42 --yes
+
+# Wipe local state after a botched bootstrap
+alchemy state clear --local
+```
+
+## Stages
+
+Every command targets a **stage** — an isolated instance of your
+stack. The stage defaults to `dev_$USER` (e.g. `dev_sam`), so each
+developer gets their own environment automatically.
+
+```sh
+alchemy deploy --stage prod
+alchemy deploy --stage pr-42
+alchemy destroy --stage dev_sam
+```
+
+Resources are namespaced by stage. Physical names include the stage
+(e.g. `myapp-prod-bucket-abc123`), so environments never interfere
+with each other.
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/custom-provider.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/custom-provider.mdx
new file mode 100644
index 00000000000..1895337d20c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/custom-provider.mdx
@@ -0,0 +1,919 @@
+---
+title: Writing a Custom Resource Provider
+description: Add support for a new cloud or third-party API by declaring a Resource type and implementing its lifecycle as an Effect Layer.
+sidebar:
+  order: 8
+---
+
+A **provider** is what gives meaning to a [Resource](/concepts/resource)
+declaration. When you `yield*` a resource inside a Stack, Alchemy
+looks up the provider for that resource's type and calls the
+appropriate lifecycle method — `reconcile`, `delete`, and
+optionally `diff`, `read`, `precreate`, `tail`, `logs`.
+
+Providers are just Effect `Layer`s, which means **adding support for
+a new cloud or third-party API is "declare a type, implement a
+Layer"** — no codegen, no registry, no schema.
+
+This guide walks through building a Stripe `Product` provider
+end-to-end: declaring props and attributes, defining the resource
+type, implementing the lifecycle, bundling it into a `providers()`
+layer, and writing a test.
+
+See [Provider](/concepts/provider) for the conceptual overview and
+[Resource Lifecycle](/concepts/resource-lifecycle) for the semantics
+of when each lifecycle method fires.
+
+## Declare props and attributes
+
+Every resource has two sides:
+
+- **Input properties** — the desired configuration you pass in
+- **Output attributes** — the values the cloud returns after creation
+
+Start with two plain TypeScript types. Both are pure data, so
+they're trivial to share between the provider and call sites.
+
+Create `src/stripe/Product.ts`:
+
+```typescript
+// src/stripe/Product.ts
+export interface StripeProductProps {
+  name: string;
+  description?: string;
+  active?: boolean;
+}
+
+export interface StripeProductAttributes {
+  productId: string;
+  created: number;
+}
+```
+
+## Declare the Resource type
+
+A `Resource<Type, Props, Attributes>` is a phantom type that ties a
+string `Type` to its props and attributes. The string `Type` (here
+`"Stripe.Product"`) is what Alchemy uses to look up the provider at
+plan time — it must be globally unique.
+
+```diff lang="typescript"
+// src/stripe/Product.ts
++import { Resource } from "alchemy";
++
+export interface StripeProductProps {
+  name: string;
+  description?: string;
+  active?: boolean;
+}
+
+export interface StripeProductAttributes {
+  productId: string;
+  created: number;
+}
++
++export type StripeProduct = Resource<
++  "Stripe.Product",
++  StripeProductProps,
++  StripeProductAttributes
++>;
+```
+
+## Declare the Resource constructor (the "tag")
+
+`Resource<T>(type)` returns the value users actually call —
+`StripeProduct("Pro", { ... })`. It also doubles as the **tag**
+the provider Layer registers itself against, so by convention the
+type and the value share the same name.
+
+```diff lang="typescript"
+// src/stripe/Product.ts
+import { Resource } from "alchemy";
+
+// ... props / attributes / type unchanged ...
+
+export type StripeProduct = Resource<
+  "Stripe.Product",
+  StripeProductProps,
+  StripeProductAttributes
+>;
++
++export const StripeProduct = Resource<StripeProduct>("Stripe.Product");
+```
+
+You can already use this constructor in a stack — but with no
+provider registered, planning will fail with `Provider not found
+for Stripe.Product`. Let's fix that.
+
+## Scaffold the provider layer
+
+A provider layer is a `Layer<Provider<R>>` produced by
+`Provider.effect(ResourceClass, effect)`. The inner Effect
+constructs a `ProviderService` — an object with `reconcile`,
+`delete` (required) and optional hooks like `diff`, `read`,
+`precreate`.
+
+Start with stubs so the types compile, then fill them in:
+
+```diff lang="typescript"
+// src/stripe/Product.ts
+-import { Resource } from "alchemy";
++import * as Provider from "alchemy/Provider";
++import { Resource } from "alchemy";
++import * as Effect from "effect/Effect";
+
+// ... props / attributes / type / constructor unchanged ...
+
+export const StripeProduct = Resource<StripeProduct>("Stripe.Product");
++
++export const StripeProductProvider = () =>
++  Provider.effect(
++    StripeProduct,
++    Effect.gen(function* () {
++      return StripeProduct.Provider.of({
++        reconcile: () => Effect.die("not implemented"),
++        delete: () => Effect.die("not implemented"),
++      });
++    }),
++  );
+```
+
+A few patterns worth knowing:
+
+- **`Provider.effect`** wraps an Effect that returns a
+  `ProviderService` into a `Layer<Provider<StripeProduct>>`.
+- **`StripeProduct.Provider.of({...})`** is a typed constructor —
+  it forces every method's input/output to match the resource's
+  props and attributes.
+- **The outer `Effect.gen`** runs once when the layer is built. Use
+  it to acquire shared dependencies (clients, credentials, HTTP).
+
+## Acquire dependencies in the outer Effect
+
+The Stripe API needs a client, and the client needs an API key.
+Don't take the key as a constructor argument — that puts it in
+your code, your env, or your CI secret store, and ignores the
+profile/login system that makes Alchemy ergonomic across stages.
+
+Instead, declare a `StripeCredentials` service. Later we'll
+implement an `AuthProvider` that supplies it from the configured
+profile (or env on CI).
+
+Create `src/stripe/Credentials.ts`:
+
+```typescript
+// src/stripe/Credentials.ts
+import * as Context from "effect/Context";
+import * as Redacted from "effect/Redacted";
+
+export class StripeCredentials extends Context.Tag("StripeCredentials")<
+  StripeCredentials,
+  { apiKey: Redacted.Redacted<string> }
+>() {}
+```
+
+Yield it inside the provider's outer Effect, then build the SDK
+client once. Anything you yield there becomes a requirement on the
+resulting Layer:
+
+```diff lang="typescript"
+// src/stripe/Product.ts
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy";
+import * as Effect from "effect/Effect";
++import * as Redacted from "effect/Redacted";
++import Stripe from "stripe";
++import { StripeCredentials } from "./Credentials.ts";
+
+// ...
+
+export const StripeProductProvider = () =>
+  Provider.effect(
+    StripeProduct,
+    Effect.gen(function* () {
++      const { apiKey } = yield* StripeCredentials;
++      const stripe = new Stripe(Redacted.value(apiKey));
++
+      return StripeProduct.Provider.of({
+        reconcile: () => Effect.die("not implemented"),
+        delete: () => Effect.die("not implemented"),
+      });
+    }),
+  );
+```
+
+:::tip[Always wrap secrets in `Redacted`]
+`Redacted<string>` prevents the API key from leaking into logs,
+error messages, or `console.log`. The provider unwraps it with
+`Redacted.value(...)` only when handing it to the SDK.
+:::
+
+The provider Layer now has type
+`Layer<Provider<StripeProduct>, never, StripeCredentials>` —
+Alchemy won't let you use it in a stack without supplying
+credentials. We'll provide them via an AuthProvider in a later
+step.
+
+## Implement `reconcile`
+
+`reconcile` is the single lifecycle method that converges the
+cloud's actual state to the desired state. It runs on every apply
+— first-time provisioning, routine updates, and adoption
+takeovers — so its body must work correctly for all three.
+
+It receives `news` (resolved input props), `id` (logical ID),
+`instanceId` (deterministic suffix), `bindings`, plus two
+context-dependent inputs:
+
+- **`output: Attributes | undefined`** — `undefined` on greenfield
+  creates; defined on updates and on adoption (where the engine
+  imported an existing cloud resource via `read`).
+- **`olds: Props | undefined`** — `undefined` on greenfield AND
+  on adoption (the engine has no prior props for a resource it
+  just discovered); defined only on routine updates.
+
+A reconciler is shaped like:
+
+```
+1. Observe   — derive the physical id; read live cloud state
+2. Ensure    — if missing, create it; tolerate AlreadyExists/etc.
+3. Sync      — for each mutable aspect: read observed, diff vs
+                desired, apply only the delta
+4. Return    — fresh Attributes
+```
+
+:::warning[Don't branch the body on `output === undefined`]
+Writing `if (output === undefined) { /* create body */ } else { /* update body */ }`
+just renames the old `create`/`update` split. The reconciler must be a single
+flow that produces correct cloud state regardless of starting point. Trust
+observed cloud state, not `olds`.
+:::
+
+:::tip[Use `Effect.tryPromise`, not `Effect.promise`]
+`Effect.tryPromise` surfaces SDK errors as Effect failures the
+lifecycle machinery can report cleanly. `Effect.promise` swallows
+them and turns rejections into defects.
+:::
+
+:::note[Bindings]
+The `bindings` argument carries data attached by upstream policies
+and event sources (IAM grants, queue subscriptions, etc.). If your
+resource type supports being a binding target, read them here. See
+[Binding](/concepts/binding) for the full contract.
+:::
+
+For the Stripe product, the SDK gives us `retrieve`, `create`, and
+`update`. The reconciler observes via `retrieve`, ensures via
+`create` (catching the cached-id case), and syncs the mutable name
++ description + active flag in a single `update` call:
+
+```diff lang="typescript"
+return StripeProduct.Provider.of({
+-  reconcile: () => Effect.die("not implemented"),
++  reconcile: Effect.fnUntraced(function* ({ news, output }) {
++    // Observe — fetch live state if we have a cached id.
++    let product = output?.productId
++      ? yield* Effect.tryPromise(() =>
++          stripe.products.retrieve(output.productId),
++        ).pipe(Effect.catchAll(() => Effect.succeed(undefined)))
++      : undefined;
++
++    // Ensure — create if missing.
++    if (!product) {
++      product = yield* Effect.tryPromise(() =>
++        stripe.products.create({
++          name: news.name,
++          description: news.description,
++          active: news.active,
++        }),
++      );
++    }
++
++    // Sync — patch any mutable field that drifted from desired.
++    if (
++      product.name !== news.name ||
++      product.description !== (news.description ?? null) ||
++      product.active !== (news.active ?? true)
++    ) {
++      product = yield* Effect.tryPromise(() =>
++        stripe.products.update(product!.id, {
++          name: news.name,
++          description: news.description,
++          active: news.active,
++        }),
++      );
++    }
++
++    return {
++      productId: product.id,
++      created: product.created,
++    };
++  }),
+   delete: () => Effect.die("not implemented"),
+ });
+```
+
+The reconciler is **idempotent** by construction — running it
+twice with the same `news` and a fresh `output` cache produces
+the same end state. Alchemy may retry it if state persistence
+fails, and the same body recovers gracefully. Adoption (where
+`output` is set but `olds` is `undefined`) goes through the same
+path: `retrieve` finds the resource, the sync step rewrites any
+fields that drifted from `news`, and we're converged.
+
+## Implement `delete`
+
+`delete` runs when the resource is removed from code, replaced, or
+when `alchemy destroy` runs.
+
+:::tip[Treat 404 as success]
+Like `create`, `delete` **must be idempotent**. Alchemy may retry
+it if persistence fails between the cloud call succeeding and state
+being written. Catch "not found" errors and return `Effect.void`.
+:::
+
+```diff lang="typescript"
+return StripeProduct.Provider.of({
+   reconcile: Effect.fnUntraced(function* ({ news, output }) { /* ... */ }),
+-  delete: () => Effect.die("not implemented"),
++  delete: Effect.fnUntraced(function* ({ output }) {
++    yield* Effect.tryPromise(() =>
++      stripe.products.del(output.productId),
++    ).pipe(
++      Effect.catchAll((cause) =>
++        cause instanceof Error && cause.message.includes("No such product")
++          ? Effect.void
++          : Effect.fail(cause),
++      ),
++    );
++  }),
+ });
+```
+
+## Implement `diff` (optional)
+
+Some property changes can't be applied in place. For Stripe
+products the `name` is mutable but (hypothetically) the
+`description` is not — changing it requires recreating the
+product. Implement `diff` to tell Alchemy which kind of change to
+plan.
+
+`diff` runs at **plan time**, before `update`, and returns one of:
+
+- `{ action: "noop" }` — change is trivial, skip `update`
+- `{ action: "update", stables?: [...] }` — apply in place
+- `{ action: "replace", deleteFirst?: boolean }` — destroy and
+  recreate
+- `undefined` / `void` — fall back to default (treat as `update`)
+
+:::note[`diff` runs during planning]
+Props may still be unresolved `Output`s when `diff` is called —
+they're only fully resolved at apply time. Always guard with
+`isResolved(news)` and return `undefined` to defer to the default
+path when you can't decide.
+:::
+
+```diff lang="typescript"
++import { isResolved } from "alchemy/Diff";
++
+// ...
+
+return StripeProduct.Provider.of({
++  diff: Effect.fnUntraced(function* ({ news, olds }) {
++    if (!isResolved(news)) return undefined;
++    if (news.description !== olds.description) {
++      return { action: "replace" } as const;
++    }
++    return undefined;
++  }),
+   reconcile: Effect.fnUntraced(function* ({ news, output }) { /* ... */ }),
+   delete: Effect.fnUntraced(function* ({ output }) { /* ... */ }),
+ });
+```
+
+For attributes that are immutable across **all** updates (e.g.
+the Stripe `productId`, an ARN), declare them in
+`stables` at the top level:
+
+```diff lang="typescript"
+return StripeProduct.Provider.of({
++  stables: ["productId"],
+   diff: Effect.fnUntraced(function* ({ news, olds }) { /* ... */ }),
+   // ...
+ });
+```
+
+## Implement `read` (optional, for recovery and adoption)
+
+The engine calls `read` whenever a resource has no prior state, both
+to recover from interrupted reconciles *and* to import pre-existing
+cloud resources into a fresh state store. Returning `undefined` tells
+Alchemy the resource doesn't exist and should be created.
+
+```diff lang="typescript"
+return StripeProduct.Provider.of({
+   stables: ["productId"],
+   diff: Effect.fnUntraced(function* ({ news, olds }) { /* ... */ }),
++  read: Effect.fnUntraced(function* ({ output }) {
++    if (!output?.productId) return undefined;
++    const product = yield* Effect.tryPromise(() =>
++      stripe.products.retrieve(output.productId),
++    ).pipe(
++      Effect.catchAll(() => Effect.succeed(undefined)),
++    );
++    if (!product) return undefined;
++    return { productId: product.id, created: product.created };
++  }),
+   reconcile: Effect.fnUntraced(function* ({ news, output }) { /* ... */ }),
+   delete: Effect.fnUntraced(function* ({ output }) { /* ... */ }),
+ });
+```
+
+This Stripe example only finds resources by an ID we previously
+saved (`output.productId`) — without a prior output it can't
+locate anything, so it returns `undefined`. That's a fine default.
+
+**Ownership-aware reads.** If your provider can detect an existing
+resource from props alone (e.g. by tag-aware lookup or deterministic
+naming), brand the returned attributes with `Unowned` when they
+belong to someone else:
+
+```typescript
+import { Unowned } from "alchemy/AdoptPolicy";
+
+read: Effect.fnUntraced(function* ({ id, olds }) {
+  const live = yield* lookupByName(olds.name);
+  if (!live) return undefined;
+  const attrs = { productId: live.id, created: live.created };
+  // Compare tags/owner against this stack/stage/id.
+  return ownsResource(id, live.tags) ? attrs : Unowned(attrs);
+}),
+```
+
+The engine uses this to decide:
+
+- plain attrs → silently import the resource as our own
+- `Unowned(attrs)` → fail with `OwnedBySomeoneElse` unless the user
+  passed `--adopt` (or wrapped the effect in `adopt(true)`), in
+  which case it's a takeover.
+
+See [Resource Lifecycle › Adoption](/concepts/resource-lifecycle#adoption)
+for the full flow.
+
+## Implement an `AuthProvider`
+
+Alchemy ships a profile/login system: `alchemy login` walks the
+user through configuring credentials, stores them under
+`~/.alchemy/credentials/{profile}/{provider}.json`, and resolves
+them per-stack at deploy time. CI runs read from environment
+variables instead.
+
+Plug into it by implementing `AuthProvider`. It's a five-method
+interface — `configure`, `login`, `logout`, `prettyPrint`, `read`
+— that Alchemy's `login` command and credential-resolution layer
+both use.
+
+### Declare the config and resolved-credentials types
+
+Start with two types per supported method (env, stored, OAuth,
+etc.). The `Config` is what gets persisted under the profile; the
+`Resolved` shape is what your provider Layer consumes:
+
+```typescript
+// src/stripe/AuthProvider.ts
+import * as Redacted from "effect/Redacted";
+
+export type StripeAuthConfig =
+  | { method: "env" }
+  | { method: "stored" };
+
+export type StripeStoredCredentials = {
+  apiKey: string;
+};
+
+export type StripeResolvedCredentials = {
+  apiKey: Redacted.Redacted<string>;
+  source: { type: StripeAuthConfig["method"] };
+};
+
+export const STRIPE_AUTH_PROVIDER_NAME = "Stripe";
+const STORAGE_KEY = "stripe-stored";
+```
+
+### Build the AuthProvider layer
+
+`AuthProviderLayer<Config, Credentials>()(name, impl)` wraps your
+implementation in a Layer that registers itself into Alchemy's
+`AuthProviders` registry. `alchemy login` discovers it by name.
+
+```diff lang="typescript"
+// src/stripe/AuthProvider.ts
++import * as Console from "effect/Console";
++import * as Effect from "effect/Effect";
++import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
++import {
++  AuthError,
++  AuthProviderLayer,
++  type ConfigureContext,
++} from "alchemy/Auth/AuthProvider";
++import {
++  deleteCredentials,
++  displayRedacted,
++  readCredentials,
++  writeCredentials,
++} from "alchemy/Auth/Credentials";
++import { getEnvRedacted, retryOnce } from "alchemy/Auth/Env";
++import * as Clank from "alchemy/Util/Clank";
+
+// ... config / credential types unchanged ...
+
++export const StripeAuth = AuthProviderLayer<
++  StripeAuthConfig,
++  StripeResolvedCredentials
++>()(STRIPE_AUTH_PROVIDER_NAME, {
++  configure: (profileName, ctx) => configureCredentials(profileName, ctx),
++  login: (profileName, config) => login(profileName, config),
++  logout: (profileName, config) => logout(profileName, config),
++  prettyPrint: (profileName, config) => prettyPrint(profileName, config),
++  read: (profileName, config) => resolveCredentials(profileName, config),
++});
+```
+
+### `configure` — pick a method (with `Clank` prompts)
+
+`configure` runs once when the user runs `alchemy login` for a
+profile that doesn't yet have a Stripe entry. Use
+[`alchemy/Util/Clank`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/Util/Clank.ts)
+for terminal prompts — it wraps `@clack/prompts` in Effect with
+proper cancellation handling.
+
+:::tip[Respect `ci`]
+The `ConfigureContext.ci` flag is `true` when running in CI.
+`configure` **must not prompt** in that case — pick a sensible
+non-interactive default (almost always `{ method: "env" }`).
+:::
+
+```diff lang="typescript"
++const configureCredentials = (profileName: string, ctx: ConfigureContext) =>
++  Effect.gen(function* () {
++    if (ctx.ci) {
++      return { method: "env" as const };
++    }
++
++    const method = yield* Clank.select({
++      message: "Stripe authentication method",
++      options: [
++        {
++          value: "env" as const,
++          label: "Environment Variables",
++          hint: "STRIPE_API_KEY",
++        },
++        {
++          value: "stored" as const,
++          label: "API Key",
++          hint: "enter interactively, stored in ~/.alchemy/credentials",
++        },
++      ],
++    }).pipe(retryOnce);
++
++    return yield* Match.value(method).pipe(
++      Match.when("env", () => Effect.succeed({ method: "env" as const })),
++      Match.when("stored", () => loginStored(profileName)),
++      Match.exhaustive,
++    );
++  }).pipe(
++    Effect.mapError(
++      (e) => new AuthError({ message: "configure failed", cause: e }),
++    ),
++  );
++
++const loginStored = Effect.fnUntraced(function* (profileName: string) {
++  const apiKey = yield* Clank.password({
++    message: "Stripe API Key",
++    validate: (v) =>
++      v.length === 0
++        ? "Required"
++        : v.startsWith("sk_") || v.startsWith("rk_")
++          ? undefined
++          : "Expected a key starting with sk_ or rk_",
++  }).pipe(retryOnce);
++
++  yield* writeCredentials<StripeStoredCredentials>(
++    profileName,
++    STORAGE_KEY,
++    { apiKey: Redacted.value(apiKey) },
++  );
++  yield* Clank.success("Stripe: credentials saved.");
++
++  return { method: "stored" as const };
++});
+```
+
+`Clank` provides `select`, `text`, `password`, `confirm`,
+`multiselect`, `success`, `info`, `warn`, `error`, and `openUrl`
+— enough to build any login flow including OAuth device codes.
+Wrap each prompt in `retryOnce` so a stray Ctrl+C doesn't abort
+the whole login.
+
+### `login` / `logout` — handle re-auth and credential removal
+
+`login` runs whenever `alchemy login` is invoked for an
+already-configured profile (e.g. to refresh an expired token).
+`logout` removes stored credentials.
+
+```diff lang="typescript"
++const login = (profileName: string, config: StripeAuthConfig) =>
++  Match.value(config).pipe(
++    Match.when({ method: "env" }, () => Effect.void),
++    Match.when({ method: "stored" }, () =>
++      readCredentials<StripeStoredCredentials>(profileName, STORAGE_KEY).pipe(
++        Effect.flatMap((creds) =>
++          creds == null ? loginStored(profileName).pipe(Effect.asVoid) : Effect.void,
++        ),
++      ),
++    ),
++    Match.exhaustive,
++  );
++
++const logout = (profileName: string, config: StripeAuthConfig) =>
++  Match.value(config).pipe(
++    Match.when({ method: "env" }, () => Effect.void),
++    Match.when({ method: "stored" }, () =>
++      deleteCredentials(profileName, STORAGE_KEY).pipe(
++        Effect.andThen(Clank.success("Stripe: stored credentials removed")),
++      ),
++    ),
++    Match.exhaustive,
++  );
+```
+
+### `read` — resolve credentials at deploy time
+
+`read` is called every deploy to materialize the credentials. For
+`env`, pull from environment variables (using `getEnvRedacted` so
+the value stays redacted); for `stored`, read from the credentials
+file under the profile.
+
+```diff lang="typescript"
++const resolveCredentials = (
++  profileName: string,
++  config: StripeAuthConfig,
++) =>
++  Match.value(config).pipe(
++    Match.when({ method: "env" }, () =>
++      Effect.gen(function* () {
++        const apiKey = yield* getEnvRedacted("STRIPE_API_KEY");
++        if (!apiKey) {
++          return yield* new AuthError({
++            message: "Stripe env credentials not found. Set STRIPE_API_KEY.",
++          });
++        }
++        return {
++          apiKey,
++          source: { type: "env" as const },
++        } satisfies StripeResolvedCredentials;
++      }),
++    ),
++    Match.when({ method: "stored" }, () =>
++      readCredentials<StripeStoredCredentials>(profileName, STORAGE_KEY).pipe(
++        Effect.flatMap((creds) =>
++          creds == null
++            ? Effect.fail(
++                new AuthError({
++                  message:
++                    "Stripe stored credentials not found. Run: alchemy login --configure",
++                }),
++              )
++            : Effect.succeed({
++                apiKey: Redacted.make(creds.apiKey),
++                source: { type: "stored" as const },
++              } satisfies StripeResolvedCredentials),
++        ),
++      ),
++    ),
++    Match.exhaustive,
++  );
+```
+
+### `prettyPrint` — show resolved credentials in `alchemy auth`
+
+```diff lang="typescript"
++const prettyPrint = (profileName: string, config: StripeAuthConfig) =>
++  resolveCredentials(profileName, config).pipe(
++    Effect.tap((creds) =>
++      Effect.all([
++        Console.log(`  apiKey: ${displayRedacted(creds.apiKey, 7)}`),
++        Console.log(`  source: ${creds.source.type}`),
++      ]),
++    ),
++    Effect.catch((e) =>
++      Console.error(`  Failed to retrieve credentials: ${e}`),
++    ),
++  );
+```
+
+## Wire credentials into the provider
+
+The provider needs `StripeCredentials`; the AuthProvider produces
+`StripeResolvedCredentials`. Bridge them with a `fromAuthProvider`
+layer that resolves the auth provider from the registry, runs
+`read`, and supplies the result as `StripeCredentials`:
+
+```typescript
+// src/stripe/Credentials.ts (additions)
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { getAuthProvider } from "alchemy/Auth/AuthProvider";
+import { ALCHEMY_PROFILE, Profile } from "alchemy/Auth/Profile";
+import {
+  STRIPE_AUTH_PROVIDER_NAME,
+  type StripeAuthConfig,
+  type StripeResolvedCredentials,
+} from "./AuthProvider.ts";
+
+export const fromAuthProvider = () =>
+  Layer.effect(
+    StripeCredentials,
+    Effect.gen(function* () {
+      const profile = yield* Profile;
+      const auth = yield* getAuthProvider<
+        StripeAuthConfig,
+        StripeResolvedCredentials
+      >(STRIPE_AUTH_PROVIDER_NAME);
+      const profileName = yield* ALCHEMY_PROFILE;
+      const ci = yield* Config.boolean("CI").pipe(Config.withDefault(false));
+
+      const config = yield* profile.loadOrConfigure(auth, profileName, { ci });
+      const creds = yield* auth.read(profileName, config as StripeAuthConfig);
+      return { apiKey: creds.apiKey };
+    }),
+  );
+```
+
+`Profile.loadOrConfigure` reads any existing config for the profile, and
+falls back to `configure` (interactive in TTYs, env in CI) if
+nothing is stored yet. `ALCHEMY_PROFILE` resolves the active
+profile name (`default` unless `ALCHEMY_PROFILE` is set).
+
+## Bundle into a `providers()` layer
+
+Users expect the same one-line ergonomics as the built-ins
+(`Cloudflare.providers()`, `AWS.providers()`). Bundle everything
+into a single layer: the resource collection, every provider
+implementation, the credentials bridge, and the `AuthProviderLayer`
+so `alchemy login` can discover it.
+
+```typescript
+// src/stripe/Providers.ts
+import * as Provider from "alchemy/Provider";
+import * as Layer from "effect/Layer";
+import { StripeAuth } from "./AuthProvider.ts";
+import { fromAuthProvider } from "./Credentials.ts";
+import { StripeProduct, StripeProductProvider } from "./Product.ts";
+
+export class Providers extends Provider.ProviderCollection<Providers>()(
+  "Stripe",
+) {}
+
+export const providers = () =>
+  Layer.effect(
+    Providers,
+    Provider.collection([StripeProduct]),
+  ).pipe(
+    Layer.provide(StripeProductProvider()),
+    Layer.provideMerge(fromAuthProvider()),
+    Layer.provideMerge(StripeAuth),
+  );
+```
+
+`Layer.provide` (private) wires each resource provider to the
+collection, while `Layer.provideMerge` (public) keeps the auth
+machinery in scope so the host stack can also use it.
+
+Now users plug your providers in like any built-in — no API key in
+sight:
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Effect from "effect/Effect";
+import * as Stripe from "./src/stripe";
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Stripe.providers() },
+  Effect.gen(function* () {
+    const pro = yield* Stripe.Product("Pro", {
+      name: "Pro plan",
+      description: "Everything in Free, plus...",
+    });
+    return { productId: pro.productId };
+  }),
+);
+```
+
+The first time they deploy, Alchemy walks them through
+`alchemy login` (or reads `STRIPE_API_KEY` on CI), stores the
+result under their profile, and resolves it for every subsequent
+deploy.
+
+To mix with another cloud, merge the layers:
+
+```typescript
+import * as Layer from "effect/Layer";
+
+providers: Layer.mergeAll(Cloudflare.providers(), Stripe.providers()),
+```
+
+## Test the lifecycle
+
+Alchemy's test harness (`alchemy/Test/Vitest` or `alchemy/Test/Bun`)
+configures providers + state once at the top of the file, then
+exposes `test.provider(name, (stack) => ...)` for provider-level
+tests. Each `test.provider` body receives a fresh in-memory scratch
+stack with `.deploy(effect)` and `.destroy()` helpers.
+
+:::note[Three things the harness gives you]
+- **`Test.make({ providers })`** — wires your provider Layer into
+  every test in the file so the resource type resolves.
+- **`stack.deploy(effect)`** — runs a sub-stack with an in-memory
+  state store. The same logical ID across two `stack.deploy` calls
+  triggers an `update` (or `replace`, depending on `diff`).
+- **`stack.destroy()`** — replans against an empty desired state to
+  tear everything down. Call at the end of the test.
+:::
+
+Create `test/Product.test.ts`:
+
+```typescript
+// test/Product.test.ts
+import * as Test from "alchemy/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import Stripe from "stripe";
+import * as StripeProvider from "../src/stripe";
+
+// Configure providers once per file. Credentials resolve through the
+// same AuthProvider system as `alchemy deploy` — set STRIPE_API_KEY
+// (with `method: "env"`) or run `alchemy login` against a test
+// profile beforehand.
+const { test } = Test.make({ providers: StripeProvider.providers() });
+
+const stripe = new Stripe(process.env.STRIPE_API_KEY!);
+
+test.provider(
+  "create, update, delete a product",
+  (stack) => Effect.gen(function* () {
+    // Create
+    const created = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* StripeProvider.Product("TestProduct", {
+          name: "v1",
+          description: "first version",
+        });
+      }),
+    );
+    expect(created.productId).toBeDefined();
+
+    const live1 = yield* Effect.promise(() =>
+      stripe.products.retrieve(created.productId),
+    );
+    expect(live1.name).toBe("v1");
+
+    // Update (in place)
+    const updated = yield* stack.deploy(
+      Effect.gen(function* () {
+        return yield* StripeProvider.Product("TestProduct", {
+          name: "v2",
+          description: "first version",
+        });
+      }),
+    );
+    expect(updated.productId).toBe(created.productId);
+
+    const live2 = yield* Effect.promise(() =>
+      stripe.products.retrieve(updated.productId),
+    );
+    expect(live2.name).toBe("v2");
+
+    // Destroy
+    yield* stack.destroy();
+  }),
+);
+```
+
+To verify replacement semantics, change a `stables` field (or the
+field your `diff` flags as `replace`) and assert that
+`updated.productId !== created.productId`.
+
+## Reference implementations
+
+If you'd rather start from a real provider:
+
+- [`Axiom/VirtualField.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/Axiom/VirtualField.ts) — minimal CRUD with `diff` and `read`
+- [`Cloudflare/R2/Bucket.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/R2/Bucket.ts) — production provider with bindings and replace semantics
+- [`Axiom/AuthProvider.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/Axiom/AuthProvider.ts) — full `AuthProvider` with `env` + `stored` methods and `Clank` prompts
+- [`Axiom/Credentials.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/Axiom/Credentials.ts) — `fromAuthProvider()` bridge layer
+- [`Axiom/Providers.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/Axiom/Providers.ts) — example of bundling a `providers()` layer with `AuthProviderLayer`
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/custom-state-store.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/custom-state-store.mdx
new file mode 100644
index 00000000000..d375e44a3a2
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/custom-state-store.mdx
@@ -0,0 +1,440 @@
+---
+title: Writing a Custom State Store
+description: Build a Postgres-backed Alchemy state store step by step — implement the StateService interface, plug it into a stack, and test it end-to-end.
+sidebar:
+  order: 7
+---
+
+A state store is just an Effect `Layer` that provides Alchemy's
+`State` service. The built-in stores (`localState()` on disk,
+`Cloudflare.state()` on Cloudflare) cover most cases — but if you
+already run Postgres, S3, Redis, or DynamoDB, you can back state
+with that instead.
+
+This guide builds a Postgres-backed state store from scratch. By the
+end you'll have a `postgresState()` layer you can drop into any
+`Alchemy.Stack`, and a test that round-trips a resource through it.
+
+See [State Store](/concepts/state-store) for an overview of what
+state Alchemy persists and why.
+
+## Scaffold the layer
+
+A state store is a `Layer.Layer<State, never, R>` where `R` is any
+ambient services your implementation needs. The `State` service does
+**not** hold a `StateService` directly — it holds an
+`Effect<StateService>` that lazily builds one:
+
+```typescript
+class State extends Context.Service<State, Effect.Effect<StateService>>()(
+  "alchemy/State",
+) {}
+```
+
+This indirection matters. Commands like `alchemy login` provide the
+state layer but never touch state, so a store must not connect to its
+backend (open a DB connection, deploy a worker, prompt for
+credentials) just because the layer was built. Wrapping the builder
+in [`Effect.cached`](https://effect.website/docs/getting-started/control-flow/#caching)
+**defers** initialization until the first `yield* State` and **caches**
+it so subsequent accesses reuse the same `StateService`.
+
+Start with an empty `StateService` so the types compile, then fill it
+in one method at a time.
+
+Create `src/postgres-state.ts`:
+
+```typescript
+// src/postgres-state.ts
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { State, type StateService } from "alchemy/State";
+
+export interface PostgresStateProps {
+  connectionString: string;
+}
+
+export const postgresState = (props: PostgresStateProps) =>
+  // `Effect.cached` returns an `Effect<Effect<StateService>>`; yielding
+  // it inside `Layer.effect` hands `State` the deferred, memoized
+  // initializer. The body below only runs on first `yield* State`.
+  Layer.effect(State, Effect.cached(makePostgresState(props)));
+
+const makePostgresState = (_props: PostgresStateProps) =>
+  Effect.gen(function* () {
+    const service: StateService = {
+      listStacks: () => Effect.die("not implemented"),
+      listStages: () => Effect.die("not implemented"),
+      list: () => Effect.die("not implemented"),
+      get: () => Effect.die("not implemented"),
+      set: () => Effect.die("not implemented"),
+      delete: () => Effect.die("not implemented"),
+      deleteStack: () => Effect.die("not implemented"),
+      getReplacedResources: () => Effect.die("not implemented"),
+    };
+    return service;
+  });
+```
+
+You now have a layer Alchemy will accept — it just dies on every
+operation. Next we'll wire up the database.
+
+## Connect to Postgres
+
+We'll use the [`postgres`](https://github.com/porsager/postgres)
+package and create one schema with a single `state` table keyed by
+`(stack, stage, fqn)`. Acquire the connection with `Effect.acquireRelease`
+so it's released when the stack tears down — this requires a `Scope`,
+so the layer becomes `Layer.scoped`.
+
+Because initialization is deferred, capture the scope at layer-build
+time and provide it to the cached initializer, so the connection's
+release is still tied to the stack's lifetime even though it opens
+lazily on first use:
+
+```diff lang="typescript"
+// src/postgres-state.ts
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
++import * as Scope from "effect/Scope";
++import postgres from "postgres";
+import { State, type StateService } from "alchemy/State";
+
+export interface PostgresStateProps {
+  connectionString: string;
+}
+
+export const postgresState = (props: PostgresStateProps) =>
+-  Layer.effect(State, Effect.cached(makePostgresState(props)));
++  Layer.scoped(
++    State,
++    Effect.gen(function* () {
++      // Capture the layer's scope so the deferred initializer can
++      // register the connection's release on it.
++      const context = yield* Effect.context<Scope.Scope>();
++      const make = makePostgresState(props).pipe(
++        Effect.provideContext(context),
++      );
++      return yield* Effect.cached(make);
++    }),
++  );
+
+const makePostgresState = (props: PostgresStateProps) =>
+  Effect.gen(function* () {
++    const sql = yield* Effect.acquireRelease(
++      Effect.sync(() => postgres(props.connectionString)),
++      (sql) => Effect.promise(() => sql.end()),
++    );
++
++    yield* Effect.promise(
++      () => sql`
++        create table if not exists alchemy_state (
++          stack text not null,
++          stage text not null,
++          fqn   text not null,
++          value jsonb not null,
++          primary key (stack, stage, fqn)
++        )
++      `,
++    );
++
+    const service: StateService = {
+      listStacks: () => Effect.die("not implemented"),
+      // ...
+    };
+    return service;
+  });
+```
+
+## Implement `set` and `get`
+
+These are the two hot-path methods Alchemy calls during every
+deploy.
+
+A few things to know before writing them:
+
+- **Use `encodeState` / `reviveState`** from `alchemy/State` when
+  serializing. They handle `Secret` values, `Date`s, and other
+  non-JSON types in `ResourceState`.
+- **Return `undefined` from `get`** for missing rows — don't error.
+  `StateStoreError` is for transport failures only.
+- **Map thrown errors** through `StateStoreError` so Alchemy can
+  surface them with context.
+
+```diff lang="typescript"
+// src/postgres-state.ts
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import postgres from "postgres";
+-import { State, type StateService } from "alchemy/State";
++import {
++  State,
++  StateStoreError,
++  encodeState,
++  reviveState,
++  type StateService,
++} from "alchemy/State";
+
+// ...
+
+const makePostgresState = (props: PostgresStateProps) =>
+  Effect.gen(function* () {
+    const sql = yield* Effect.acquireRelease(
+      Effect.sync(() => postgres(props.connectionString)),
+      (sql) => Effect.promise(() => sql.end()),
+    );
+
+    // ... create table ...
+
++    const run = <A>(thunk: () => Promise<A>) =>
++      Effect.tryPromise({
++        try: thunk,
++        catch: (cause) =>
++          new StateStoreError({
++            message: cause instanceof Error ? cause.message : String(cause),
++            cause: cause instanceof Error ? cause : undefined,
++          }),
++      });
++
+    const service: StateService = {
+      listStacks: () => Effect.die("not implemented"),
+      listStages: () => Effect.die("not implemented"),
+      list: () => Effect.die("not implemented"),
+-      get: () => Effect.die("not implemented"),
+-      set: () => Effect.die("not implemented"),
++      get: ({ stack, stage, fqn }) =>
++        run(
++          () => sql<{ value: string }[]>`
++            select value::text from alchemy_state
++            where stack = ${stack} and stage = ${stage} and fqn = ${fqn}
++          `,
++        ).pipe(
++          Effect.map((rows) =>
++            rows.length === 0
++              ? undefined
++              : JSON.parse(rows[0].value, reviveState),
++          ),
++        ),
++
++      set: ({ stack, stage, fqn, value }) =>
++        run(
++          () => sql`
++            insert into alchemy_state (stack, stage, fqn, value)
++            values (${stack}, ${stage}, ${fqn}, ${sql.json(encodeState(value))})
++            on conflict (stack, stage, fqn)
++            do update set value = excluded.value
++          `,
++        ).pipe(Effect.as(value)),
++
+      delete: () => Effect.die("not implemented"),
+      deleteStack: () => Effect.die("not implemented"),
+      getReplacedResources: () => Effect.die("not implemented"),
+    };
+    return service;
+  });
+```
+
+## Implement `list`, `listStacks`, `listStages`
+
+These power `alchemy destroy`, drift detection, and the CLI's
+inspection commands. They're straightforward `select distinct`
+queries:
+
+```diff lang="typescript"
+const service: StateService = {
+-  listStacks: () => Effect.die("not implemented"),
+-  listStages: () => Effect.die("not implemented"),
+-  list: () => Effect.die("not implemented"),
++  listStacks: () =>
++    run(() => sql<{ stack: string }[]>`
++      select distinct stack from alchemy_state order by stack
++    `).pipe(Effect.map((rows) => rows.map((r) => r.stack))),
++
++  listStages: (stack) =>
++    run(() => sql<{ stage: string }[]>`
++      select distinct stage from alchemy_state
++      where stack = ${stack} order by stage
++    `).pipe(Effect.map((rows) => rows.map((r) => r.stage))),
++
++  list: ({ stack, stage }) =>
++    run(() => sql<{ fqn: string }[]>`
++      select fqn from alchemy_state
++      where stack = ${stack} and stage = ${stage} order by fqn
++    `).pipe(Effect.map((rows) => rows.map((r) => r.fqn))),
++
+  // get / set unchanged ...
+  delete: () => Effect.die("not implemented"),
+  deleteStack: () => Effect.die("not implemented"),
+  getReplacedResources: () => Effect.die("not implemented"),
+};
+```
+
+## Implement `delete` and `deleteStack`
+
+`deleteStack` deletes the entire stack when `stage` is omitted, or
+just one stage when provided:
+
+```diff lang="typescript"
+const service: StateService = {
+  // listStacks / listStages / list / get / set unchanged ...
+
+-  delete: () => Effect.die("not implemented"),
+-  deleteStack: () => Effect.die("not implemented"),
++  delete: ({ stack, stage, fqn }) =>
++    run(() => sql`
++      delete from alchemy_state
++      where stack = ${stack} and stage = ${stage} and fqn = ${fqn}
++    `).pipe(Effect.asVoid),
++
++  deleteStack: ({ stack, stage }) =>
++    run(() =>
++      stage === undefined
++        ? sql`delete from alchemy_state where stack = ${stack}`
++        : sql`delete from alchemy_state where stack = ${stack} and stage = ${stage}`,
++    ).pipe(Effect.asVoid),
++
+  getReplacedResources: () => Effect.die("not implemented"),
+};
+```
+
+## Implement `getReplacedResources`
+
+When Alchemy replaces a resource, the old one is kept in the store
+with `status: "replaced"` until its destroy operation succeeds.
+`getReplacedResources` returns that backlog so the next deploy can
+finish cleanup.
+
+You can implement this on top of `list` + `get`, but it's cheaper to
+push the filter into Postgres:
+
+```diff lang="typescript"
+const service: StateService = {
+  // ...
+
+-  getReplacedResources: () => Effect.die("not implemented"),
++  getReplacedResources: ({ stack, stage }) =>
++    run(
++      () => sql<{ value: string }[]>`
++        select value::text from alchemy_state
++        where stack = ${stack}
++          and stage = ${stage}
++          and value->>'status' = 'replaced'
++      `,
++    ).pipe(
++      Effect.map((rows) =>
++        rows.map((r) => JSON.parse(r.value, reviveState)),
++      ),
++    ),
+};
+```
+
+## Plug it into a stack
+
+Pass your layer as the `state` option, exactly like the built-in
+stores:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { postgresState } from "./src/postgres-state.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+-    state: Cloudflare.state(),
++    state: postgresState({
++      connectionString: process.env.DATABASE_URL!,
++    }),
+  },
+  Effect.gen(function* () {
+    // resources...
+  }),
+);
+```
+
+## Test the round-trip
+
+Spin up a throwaway Postgres (Docker, Testcontainers, or a local
+instance) and verify a resource round-trips through your store. Note
+the double `yield*`: the first resolves the `State` service to its
+`Effect<StateService>` initializer, the second runs it to get the
+`StateService`.
+
+```typescript
+// test/postgres-state.test.ts
+import { describe, expect, it } from "vitest";
+import * as Effect from "effect/Effect";
+import { State } from "alchemy/State";
+import { postgresState } from "../src/postgres-state.ts";
+
+const layer = postgresState({
+  connectionString: process.env.TEST_DATABASE_URL!,
+});
+
+describe("postgresState", () => {
+  it("round-trips a resource", () =>
+    Effect.gen(function* () {
+      const state = yield* yield* State;
+
+      yield* state.set({
+        stack: "Test",
+        stage: "dev",
+        fqn: "Bucket",
+        value: {
+          id: "Bucket",
+          fqn: "Bucket",
+          status: "created",
+          kind: "Cloudflare.R2Bucket",
+          props: { name: "my-bucket" },
+          output: { name: "my-bucket" },
+        } as any,
+      });
+
+      const got = yield* state.get({
+        stack: "Test",
+        stage: "dev",
+        fqn: "Bucket",
+      });
+      expect(got?.id).toBe("Bucket");
+
+      const fqns = yield* state.list({ stack: "Test", stage: "dev" });
+      expect(fqns).toContain("Bucket");
+
+      yield* state.deleteStack({ stack: "Test" });
+      const after = yield* state.list({ stack: "Test", stage: "dev" });
+      expect(after).toEqual([]);
+    }).pipe(Effect.provide(layer), Effect.scoped, Effect.runPromise));
+});
+```
+
+For end-to-end testing of a real stack against your store, see the
+[Testing](/concepts/testing) reference.
+
+## Things to know
+
+A few details that aren't obvious from the interface but matter in
+production:
+
+- **FQNs are arbitrary strings** containing `/` and other
+  characters. Postgres handles them fine as parameterized values,
+  but if your backend uses FQNs in keys (filenames, S3 keys, Redis
+  keys) you'll need to escape them — Alchemy ships
+  `encodeFqn` / `decodeFqn` from `alchemy/FQN`.
+- **Concurrent writes happen** during a deploy as Alchemy applies
+  resources in parallel. Your backend needs row-level (or
+  equivalent) consistency on the `(stack, stage, fqn)` key.
+- **State persists between deploys**, so schema changes to
+  `ResourceState` are effectively migrations. Be conservative with
+  the encoded shape, and use `reviveState` so future Alchemy
+  versions can deserialize what you wrote.
+
+## Reference implementations
+
+If you'd rather start from one of the built-ins:
+
+- [`LocalState.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/State/LocalState.ts) — filesystem-backed, the simplest end-to-end example
+- [`HttpStateStore.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/State/HttpStateStore.ts) — HTTP client against the Alchemy state API
+- [`InMemoryState.ts`](https://github.com/sam-goodwin/alchemy-effect/blob/main/packages/alchemy/src/State/InMemoryState.ts) — minimal in-process map, useful as a template
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/effect-ai.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/effect-ai.mdx
new file mode 100644
index 00000000000..9b09036029c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/effect-ai.mdx
@@ -0,0 +1,234 @@
+---
+title: Effect AI
+description: Wire Effect's LanguageModel and Chat services into a Cloudflare Worker — read API keys with effect/Config, provide the model layer to your handler, plug in persistence.
+sidebar:
+  order: 6
+---
+
+Effect's [`@effect/ai`](https://effect.website/docs/ai/introduction)
+package gives you a single `LanguageModel.LanguageModel` service that
+every model provider (OpenAI, Anthropic, Workers AI, …) ships as a
+`Layer`. Once that layer is in scope, the rest of the surface
+(`generateText`, `streamText`, `Toolkit`, `Chat`, …) is
+provider-agnostic.
+
+This guide is about the *Alchemy* side of that picture: how to build
+the `LanguageModel` layer inside a [Platform](/concepts/platform)
+(`Cloudflare.Worker`, `AWS.Lambda.Function`), where to read the API
+key from, and how to plug `Chat.Persistence` into a backing store
+that matches the platform. For the AI calls themselves —
+`LanguageModel.generateText`, `streamText`, `Toolkit`, structured
+outputs — refer to
+[Effect's AI documentation](https://effect.website/docs/ai/introduction).
+
+## The pattern
+
+Every Effect AI provider is two stacked layers:
+
+1. A **client** Layer that holds the API key and HTTP transport
+   (`OpenAiClient.layer({ apiKey })`, `AnthropicClient.layer({ apiKey })`, …).
+2. A **language model** Layer that picks the model and any defaults
+   (`OpenAiLanguageModel.layer({ model: "gpt-4o-mini" })`, …).
+
+You build that stack once in the Platform's **init phase** and
+`Effect.provide(...)` it on the handler:
+
+```typescript
+Effect.gen(function* () {
+  // 1. Init: build the LanguageModel layer (deploy bindings happen here).
+  const languageModel = ...;
+
+  return {
+    // 2. Exec: per-request handler with the model available.
+    fetch: Effect.gen(function* () {
+      const response = yield* LanguageModel.generateText({ prompt });
+      return HttpServerResponse.json({ text: response.text });
+    }).pipe(Effect.provide(languageModel)),
+  };
+});
+```
+
+`fetch` is just one example — the same `Effect.provide(languageModel)`
+pattern works in a Lambda handler, an HTTP API endpoint, an RPC
+procedure, a Workflow, or any other Effect.
+
+## Read the API key with `Config.redacted`
+
+Every upstream provider's client Layer (`OpenAiClient.layer`,
+`AnthropicClient.layer`, …) takes an `apiKey: Redacted<string>`.
+[`Config.redacted`](/concepts/secrets) resolved in the Platform's
+Init phase gives you exactly that `Redacted<string>` — and Alchemy
+automatically binds the value as a `secret_text` binding
+(Cloudflare) or environment variable (Lambda) at deploy time:
+
+```typescript
+import * as Config from "effect/Config";
+
+// outer init — resolves the value AND records the binding
+const apiKey = yield* Config.redacted("OPENAI_API_KEY");
+```
+
+`Config.redacted("OPENAI_API_KEY")` reads `OPENAI_API_KEY` from your
+`ConfigProvider` (e.g. `.env`) at deploy time, records the binding,
+and resolves from that binding again at runtime — one line, both
+phases. See [Concepts › Secrets and Config](/concepts/secrets) for
+the Init/Runtime split, `.env`, and transformations.
+
+Because the value is in scope right in Init, the model Layer can be
+built eagerly — no `Layer.unwrap` needed:
+
+```typescript
+import * as Layer from "effect/Layer";
+
+const languageModel = OpenAiLanguageModel.layer({
+  model: "gpt-4o-mini",
+}).pipe(
+  Layer.provide(OpenAiClient.layer({ apiKey })),
+  Layer.provide(FetchHttpClient.layer),
+);
+```
+
+## In a Cloudflare Worker
+
+`FetchHttpClient.layer` plugs the runtime `fetch` API into the
+Effect HTTP client that every provider's client Layer depends on:
+
+```typescript
+// src/Worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { LanguageModel } from "effect/unstable/ai";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { OpenAiClient, OpenAiLanguageModel } from "@effect/ai-openai";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const apiKey = yield* Config.redacted("OPENAI_API_KEY");
+
+    const languageModel = OpenAiLanguageModel.layer({
+      model: "gpt-4o-mini",
+    }).pipe(
+      Layer.provide(OpenAiClient.layer({ apiKey })),
+      Layer.provide(FetchHttpClient.layer),
+    );
+
+    return {
+      fetch: Effect.gen(function* () {
+        const response = yield* LanguageModel.generateText({
+          prompt: "Say hello.",
+        }).pipe(Effect.orDie);
+        return yield* HttpServerResponse.json({ text: response.text });
+      }).pipe(Effect.provide(languageModel)),
+    };
+  }),
+);
+```
+
+## Persisting chats
+
+For multi-turn conversations, Effect's `Chat` service holds the
+turn history and exposes the same `generateText` / `streamText`
+surface. `Chat.layerPersisted` wraps it with a
+`Chat.Persistence` interface that needs a `BackingPersistence`
+Layer underneath:
+
+```typescript
+import { Chat } from "effect/unstable/ai";
+import * as Persistence from "effect/unstable/persistence/Persistence";
+
+// inside your handler:
+const chat = yield* (yield* Chat.Persistence).getOrCreate("session-id");
+yield* chat.generateText({ prompt: "Hello again." });
+```
+
+The `BackingPersistence` Layer is what makes the chat history
+durable. Pick the one that matches your platform:
+
+| Platform | Backing |
+| --- | --- |
+| Cloudflare Worker + Durable Object | `Cloudflare.DurableObjectChatPersistence` — bytes live in `state.storage`, one DO instance per session |
+| Any platform, in-memory (tests) | `Persistence.layerBackingMemory` — lost on restart |
+| Anything else (KV, R2, DynamoDB, …) | Implement `BackingPersistence` against your store |
+
+The `Chat.Persistence` API and handler code never change — only the
+backing layer does.
+
+## Cloudflare AI Gateway
+
+For Workers AI on Cloudflare, `Cloudflare.AiGateway` declares an AI
+Gateway as a resource and `.bind(Gateway).model({...})` returns a
+`LanguageModel` Layer that proxies Workers AI through the gateway —
+with caching, rate limiting, retries, and a unified request log.
+
+Bind the gateway in the Init phase and call `aiGateway.model({...})`
+with a Workers AI model id. It returns a `LanguageModel` Layer
+directly — no API key, no `Layer.unwrap`, since the gateway binding
+handles auth and the URL:
+
+```typescript
+const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+const languageModel = aiGateway.model({
+  client: aiGateway,
+  model: "@cf/meta/llama-3.1-8b-instruct",
+  parameters: { temperature: 0.7, maxTokens: 1024 },
+});
+```
+
+That `languageModel` Layer slots into the same `Effect.provide(...)`
+spot as any other provider — the rest of your handler doesn't
+change. Provide `Cloudflare.AiGatewayBindingLive` once at the
+bottom of the Init layer chain so the binding resolves at runtime:
+
+```typescript
+Effect.gen(function* () {
+  const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+  const languageModel = aiGateway.model({
+    client: aiGateway,
+    model: "@cf/meta/llama-3.1-8b-instruct",
+    parameters: { temperature: 0.7, maxTokens: 1024 },
+  });
+
+  return {
+    fetch: Effect.gen(function* () {
+      const response = yield* LanguageModel.generateText({
+        prompt: "Say hello.",
+      }).pipe(Effect.orDie);
+      return yield* HttpServerResponse.json({ text: response.text });
+    }).pipe(Effect.provide(languageModel)),
+  };
+}).pipe(Effect.provide(Cloudflare.AiGatewayBindingLive));
+```
+
+The [AI Gateway tutorial](/tutorial/cloudflare/ai-gateway) walks
+through it end to end — declaring the resource, streaming with
+`streamText`, and tuning caching, rate limits, and DLP.
+
+## Picking a provider
+
+Each upstream provider is its own `@effect/ai-*` package. The
+shape — `*Client.layer({ apiKey })` + `*LanguageModel.layer({
+model })` — is the same.
+
+- [`@effect/ai-openai`](https://www.npmjs.com/package/@effect/ai-openai)
+- [`@effect/ai-anthropic`](https://www.npmjs.com/package/@effect/ai-anthropic)
+- [`@effect/ai-google`](https://www.npmjs.com/package/@effect/ai-google)
+- [`@effect/ai-amazon-bedrock`](https://www.npmjs.com/package/@effect/ai-amazon-bedrock)
+- `Cloudflare.AiGateway` (Workers AI, via Alchemy itself)
+
+## Where to go next
+
+- [Effect AI documentation](https://effect.website/docs/ai/introduction)
+  — the API surface (`generateText`, `streamText`, `Toolkit`,
+  structured outputs, embeddings).
+- [Add an AI Gateway](/tutorial/cloudflare/ai-gateway) — wire
+  Workers AI behind a Cloudflare AI Gateway with caching and
+  streaming.
+- [Secrets and env vars](/guides/secrets) — how `Config.redacted`
+  feeds the upstream providers' API keys at deploy and runtime.
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/effect-http-api.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/effect-http-api.mdx
new file mode 100644
index 00000000000..7f37be1b53d
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/effect-http-api.mdx
@@ -0,0 +1,568 @@
+---
+title: Effect HTTP API
+description: Build a schema-validated HTTP API with Effect's HttpApi module and deploy it as a Cloudflare Worker.
+sidebar:
+  order: 4
+---
+
+In the [tutorial](/tutorial/part-2), you built a Worker with manual
+`if/else` routing and raw request parsing. That works, but as your
+API grows you lose type safety at the boundary — request payloads
+aren't validated, response shapes aren't enforced, and errors slip
+through untyped.
+
+Effect's `HttpApi` module solves this. You declare endpoints with
+schemas for payloads, responses, and errors, then implement handlers
+against those schemas. The result is an `HttpEffect` — the same type
+a Worker's `fetch` expects — so it plugs in directly.
+
+The mental model we'll follow is:
+
+1. **Define the schema and API outside the Worker.** Both are pure
+   descriptions and can be imported by clients.
+2. **Construct the service inside the Worker's Init phase.**
+   The Init phase runs at plan time *and* runtime, so we only do
+   pure construction here — we never `yield*` something that needs
+   a request to exist.
+3. **Return `{ fetch }`** where `fetch` is an `HttpEffect`.
+   That's the value Workers invoke on every request.
+4. **Bonus:** deploy, grab the URL, and call the API from a fully
+   typed client.
+
+## 1. Define the schema
+
+Start with a domain model. The schema lives outside the Worker so
+the same file can be imported by clients without pulling in any
+runtime code.
+
+```typescript
+// src/task.ts
+import * as Schema from "effect/Schema";
+
+export class Task extends Schema.Class<Task>("Task")({
+  id: Schema.String,
+  title: Schema.String,
+  completed: Schema.Boolean,
+}) {}
+
+export class TaskNotFound extends Schema.TaggedClass<TaskNotFound>()(
+  "TaskNotFound",
+  { id: Schema.String },
+) {}
+```
+
+`Schema.Class` gives you a runtime-validated class with an inferred
+TypeScript type. `Schema.TaggedClass` gives you a typed error you
+can return from handlers and discriminate against on the client.
+
+## 2. Declare the API
+
+Endpoints are declarations — they describe `(method, path,
+payload, success, error)` without implementing anything yet. Putting
+them in their own file keeps the spec importable from both the
+server *and* a typed client.
+
+```typescript
+// src/api.ts
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import { Task, TaskNotFound } from "./task.ts";
+
+export const decodeTask = Schema.decodeUnknownEffect(Task);
+export const encodeTask = Schema.encodeUnknownSync(Task);
+
+const getTask = HttpApiEndpoint.get("getTask", "/:id", {
+  success: Task,
+  error: TaskNotFound,
+});
+
+const createTask = HttpApiEndpoint.post("createTask", "/", {
+  success: Task,
+  payload: Schema.Struct({
+    title: Schema.String,
+  }),
+});
+
+export class TasksGroup extends HttpApiGroup.make("Tasks")
+  .add(getTask)
+  .add(createTask) {}
+
+export class TaskApi extends HttpApi.make("TaskApi").add(TasksGroup) {}
+```
+
+Nothing executes yet — `TaskApi` is purely a value-level description.
+The same `TaskApi` constant is what we'll hand to the client at the
+end of this guide.
+
+## 3. Build the Worker
+
+Now we wire it up. Create `src/worker.ts` with an empty Init phase:
+
+```typescript
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    return {};
+  }),
+);
+```
+
+The generator inside `Cloudflare.Worker` is the **Init phase**. It
+runs both at *plan time* (when Alchemy builds the deployment graph)
+and at *runtime* (when the Worker boots a fresh isolate). Anything
+you `yield*` here must be safe in both contexts — typically resource
+binding factories like `R2Bucket.bind(...)`, never per-request work.
+
+### 3a. Bind an R2 bucket for storage
+
+Tasks need to live somewhere durable. Declare an `R2Bucket` resource
+and bind it inside Init — `bind()` returns a typed handle whose
+`get` / `put` / `delete` / `list` methods we'll call from the
+handlers below.
+
+```typescript
+// src/bucket.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Tasks = Cloudflare.R2Bucket("Tasks");
+```
+
+```typescript twoslash
+// @noErrors
++import { Tasks } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
++   const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
+
+    return {};
+  }),
+);
+```
+
+We'll provide the runtime side of this binding
+(`Cloudflare.R2BucketBindingLive`) in step 3c when we wire up the
+`fetch` handler.
+
+### 3b. Construct the handler group inside Init
+
+`HttpApiBuilder.group` *constructs* a `Layer` that wires handlers
+into the API spec. It's pure — it doesn't run them. That makes it
+safe to call inside Init.
+
+> Don't `yield*` `HttpApiBuilder.layer(TaskApi)` here — building the
+> layer is fine, but actually executing the server requires an
+> incoming request. Init only does construction; the work happens
+> later, on each `fetch` call.
+
+```typescript twoslash
+// @noErrors
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
+
++   const tasksGroup = HttpApiBuilder.group(TaskApi, "Tasks", (handlers) =>
++     handlers
++       .handle("getTask", ({ path }) =>
++         Effect.gen(function* () {
++           const object = yield* tasks.get(path.id);
++           if (!object) {
++             return yield* Effect.fail(new TaskNotFound({ id: path.id }));
++           }
++           return Schema.decodeUnknownSync(Task)(JSON.parse(yield* object.text()));
++         }).pipe(Effect.orDie),
++       )
++       .handle("createTask", ({ payload }) =>
++         Effect.gen(function* () {
++           const task = new Task({
++             id: crypto.randomUUID(),
++             title: payload.title,
++             completed: false,
++           });
++           yield* tasks.put(task.id, JSON.stringify(task));
++           return task;
++         }).pipe(Effect.orDie),
++       ),
++   );
+
+    return {};
+  }),
+```
+
+Each handler receives a typed request. `path.id` is a `string`
+because that's what the endpoint declared, and the return type must
+satisfy `Task` (or fail with `TaskNotFound`). Mismatches are caught
+at compile time.
+
+`tasks.get` and `tasks.put` can fail with `R2Error`, which isn't in
+either endpoint's declared error set. `Effect.orDie` converts those
+into defects so the HttpApi runtime turns them into 500 responses —
+keeping the typed error channel reserved for `TaskNotFound`.
+
+### 3c. Return `{ fetch }`
+
+The return value of Init is the *Worker's surface* — for a
+fetch-style Worker that means an object with a `fetch` field. The
+value of `fetch` must be an `HttpEffect`: an `Effect` that, given an
+`HttpServerRequest`, produces an `HttpServerResponse`.
+
+We assemble it in three layers:
+
+- `HttpApiBuilder.layer(TaskApi)` — the top-level API layer.
+- `Layer.provide(tasksGroup)` — plug in the handlers we just built.
+- `Layer.provide([HttpPlatform.layer, Etag.layer])` — platform
+  services the builder needs (content negotiation, ETag generation).
+- `HttpRouter.toHttpEffect` — convert the assembled layer into an
+  `HttpEffect`.
+
+```typescript twoslash
+// @noErrors
+    return {
++     fetch: HttpApiBuilder.layer(TaskApi).pipe(
++       Layer.provide(tasksGroup),
++       Layer.provide([HttpPlatform.layer, Etag.layer]),
++       HttpRouter.toHttpEffect,
++     ),
+    };
+```
+
+### 3d. Enable CORS
+
+`HttpRouter.cors(...)` returns a `Layer` that registers a global
+router middleware. Plug it in alongside the platform services with
+another `Layer.provide`.
+
+```diff lang="typescript"
+    return {
+      fetch: HttpApiBuilder.layer(TaskApi).pipe(
+        Layer.provide(tasksGroup),
+        Layer.provide([HttpPlatform.layer, Etag.layer]),
++       Layer.provide(HttpRouter.cors({
++         allowedOrigins: ["*"],
++         allowedMethods: ["GET", "POST", "OPTIONS"],
++         allowedHeaders: ["Content-Type"],
++       })),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+```
+
+The middleware wraps every response — including the automatic
+`OPTIONS` preflight — with the configured `Access-Control-*` headers.
+Because it's a `Layer<never, never, HttpRouter>`, it composes the same
+way as the rest of the API stack: order doesn't matter, and there's
+no per-handler plumbing.
+
+### Putting it together
+
+Here's the complete `src/worker.ts`:
+
+```typescript
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { TaskApi } from "./api.ts";
+import { Tasks } from "./bucket.ts";
+import { Task, TaskNotFound } from "./task.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
+
+    const tasksGroup = HttpApiBuilder.group(TaskApi, "Tasks", (handlers) =>
+      handlers
+        .handle("getTask", ({ path }) =>
+          Effect.gen(function* () {
+            const object = yield* tasks.get(path.id);
+            if (!object) {
+              return yield* Effect.fail(new TaskNotFound({ id: path.id }));
+            }
+            return Schema.decodeUnknownSync(Task)(
+              JSON.parse(yield* object.text()),
+            );
+          }).pipe(Effect.orDie),
+        )
+        .handle("createTask", ({ payload }) =>
+          Effect.gen(function* () {
+            const task = new Task({
+              id: crypto.randomUUID(),
+              title: payload.title,
+              completed: false,
+            });
+            yield* tasks.put(task.id, JSON.stringify(task));
+            return task;
+          }).pipe(Effect.orDie),
+        ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(TaskApi).pipe(
+        Layer.provide(tasksGroup),
+        Layer.provide([HttpPlatform.layer, Etag.layer]),
+        Layer.provide(
+          HttpRouter.cors({
+            allowedOrigins: ["*"],
+            allowedMethods: ["GET", "POST", "OPTIONS"],
+            allowedHeaders: ["Content-Type"],
+          }),
+        ),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+## 4. Add to the Stack
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "TaskApi",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
+    return { url: worker.url };
+  }),
+);
+```
+
+## 5. Deploy
+
+```sh
+alchemy deploy
+```
+
+You can hit it directly with `curl`:
+
+```sh
+curl -X POST https://your-worker.workers.dev/ \
+  -H "Content-Type: application/json" \
+  -d '{"title": "Write docs"}'
+# → {"id":"...","title":"Write docs","completed":false}
+
+curl https://your-worker.workers.dev/<id>
+# → {"id":"...","title":"Write docs","completed":false}
+```
+
+Invalid payloads get automatic 400 responses with structured
+validation errors — no manual checking needed.
+
+## Bonus: call it from a typed client
+
+Because `TaskApi` is just a value, the same spec drives a fully
+typed client. There's no codegen step — `HttpApiClient.make`
+produces methods whose argument and return types come straight from
+the endpoint schemas.
+
+```typescript
+// scripts/client.ts
+import * as Effect from "effect/Effect";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { TaskApi } from "../src/api.ts";
+
+const program = Effect.gen(function* () {
+  const client = yield* HttpApiClient.make(TaskApi, {
+    baseUrl: process.env.TASK_API_URL!,
+  });
+
+  const created = yield* client.Tasks.createTask({
+    payload: { title: "Write docs" },
+  });
+  console.log("Created:", created.id);
+
+  const fetched = yield* client.Tasks.getTask({
+    path: { id: created.id },
+  });
+  console.log("Fetched:", fetched.title);
+});
+
+Effect.runPromise(program);
+```
+
+Get the URL from the deploy output and run it:
+
+```sh
+TASK_API_URL=https://your-worker.workers.dev bun scripts/client.ts
+```
+
+`client.Tasks.getTask` returns `Effect<Task, TaskNotFound | HttpClientError>`.
+The `TaskNotFound` branch is a real typed value you can pattern-match
+on, not an HTTP status code you have to interpret.
+
+## Bonus: route some endpoints to a Durable Object
+
+The same `HttpApi` machinery can run *inside* a Durable Object. The
+DO becomes a typed sub-API that the Worker delegates to, while the
+public `TaskApi` shape remains a single value clients can import.
+
+### Define a DO-side group
+
+The DO exposes its own group built from the same endpoint
+declarations. Add two more endpoints to the public spec — one for
+`get` and one for `create` — that the Worker will proxy to the DO,
+then make a private group for the DO with just the two original
+endpoints:
+
+```typescript
+// src/api.ts
+const getTaskDO = HttpApiEndpoint.get("getTaskDO", "/do/:id", {
+  success: Task,
+  error: TaskNotFound,
+});
+
+const createTaskDO = HttpApiEndpoint.post("createTaskDO", "/do", {
+  success: Task,
+  payload: Schema.Struct({ title: Schema.String }),
+});
+
+export class TasksGroup extends HttpApiGroup.make("Tasks")
+  .add(getTask)
+  .add(createTask)
+  .add(getTaskDO)
+  .add(createTaskDO) {}
+
+export class TasksDOGroup extends HttpApiGroup.make("TasksDO")
+  .add(getTask)
+  .add(createTask) {}
+
+export class TaskDOApi extends HttpApi.make("TaskDOApi").add(TasksDOGroup) {}
+```
+
+### Implement the DO
+
+The DO's Init returns `{ fetch }` — an `HttpEffect` produced exactly
+the same way the Worker produces one, just scoped to its own
+`TaskDOApi`. Storage is the DO's transactional `state.storage`
+instead of R2.
+
+```typescript
+// src/object.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { TaskDOApi, decodeTask, encodeTask } from "./api.ts";
+import { Task } from "./task.ts";
+
+export default class TasksObject extends Cloudflare.DurableObjectNamespace<TasksObject>()(
+  "TasksObject",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      const tasksGroup = HttpApiBuilder.group(TaskDOApi, "TasksDO", (handlers) =>
+        handlers
+          .handle("getTask", ({ path }) =>
+            state.storage.get<Task>(path.id).pipe(
+              Effect.flatMap(decodeTask),
+              Effect.orDie,
+            ),
+          )
+          .handle("createTask", ({ payload }) => {
+            const task = new Task({
+              id: crypto.randomUUID(),
+              title: payload.title,
+              completed: false,
+            });
+            return state.storage.put(task.id, encodeTask(task)).pipe(Effect.as(task));
+          }),
+      );
+
+      return {
+        fetch: HttpApiBuilder.layer(TaskDOApi).pipe(
+          Layer.provide(tasksGroup),
+          HttpRouter.toHttpEffect,
+        ),
+      };
+    });
+  }),
+) {}
+```
+
+### Bridge the DO into a typed client
+
+Inside the Worker's Init, `Cloudflare.toHttpClient(stub)` wraps a DO
+stub as an `HttpClient`. Hand that client to `HttpApiClient.makeWith`
+and you get a fully typed client whose every call is a DO `fetch`
+under the hood:
+
+```diff lang="typescript"
++import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
++import TasksObject, { TaskDOApi } from "./object.ts";
+
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
++   const tasksDO = yield* TasksObject;
++
++   const getTaskDOClient = (id: string = "default") =>
++     HttpApiClient.makeWith(TaskDOApi, {
++       baseUrl: "http://localhost",
++       httpClient: Cloudflare.toHttpClient(tasksDO.getByName(id)),
++     });
+```
+
+The `baseUrl` is irrelevant — requests never leave the isolate; the
+`httpClient` short-circuits straight to `tasksDO.getByName(id).fetch`.
+
+### Wire the proxy handlers
+
+The Worker's two new handlers just construct a per-request DO client
+and forward the typed call. Errors from the DO already match the
+public endpoint's error schema, so there's no remapping:
+
+```diff lang="typescript"
+    const tasksGroup = HttpApiBuilder.group(TaskApi, "Tasks", (handlers) =>
+      handlers
+        .handle("getTask", /* ... R2 implementation ... */)
+        .handle("createTask", /* ... R2 implementation ... */)
++       .handle("getTaskDO", ({ path }) =>
++         getTaskDOClient().pipe(
++           Effect.flatMap((client) => client.TasksDO.getTask({ path })),
++         ),
++       )
++       .handle("createTaskDO", ({ payload }) =>
++         getTaskDOClient().pipe(
++           Effect.flatMap((client) => client.TasksDO.createTask({ payload })),
++         ),
++       ),
+    );
+```
+
+`GET /do/:id` and `POST /do` now hit the DO; `GET /:id` and `POST /`
+still hit R2. Same `TaskApi`, same client, two different storage
+backends behind the scenes.
+
+## Recap
+
+- The **schema** (`Task`, `TaskNotFound`) and the **API spec**
+  (`TaskApi`) live outside the Worker — they're pure descriptions.
+- The **handlers** are constructed inside the Worker's Init phase
+  closure. We build a `Layer` with `HttpApiBuilder.group` but never
+  `yield*` the running server — that only makes sense per-request.
+- The Worker's surface is `{ fetch }`, where `fetch` is an
+  `HttpEffect` produced by `HttpRouter.toHttpEffect`.
+- The same `TaskApi` value drives a fully typed client via
+  `HttpApiClient.make` — no codegen, no string URLs.
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/effect-rpc.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/effect-rpc.mdx
new file mode 100644
index 00000000000..f0d3276d981
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/effect-rpc.mdx
@@ -0,0 +1,698 @@
+---
+title: Effect RPC
+description: Build a typed RPC API with Effect's Rpc module and deploy it as a Cloudflare Worker.
+sidebar:
+  order: 5
+---
+
+The [HTTP API guide](/guides/effect-http-api) showed how to build
+REST-style endpoints with schema validation. Effect RPC takes a
+different angle — you define **procedures** instead of HTTP
+endpoints, and you get a fully typed client for free with no URL
+construction or manual serialization.
+
+The transport is still HTTP under the hood, and both patterns
+produce the same `HttpEffect` type, so the wiring story is
+identical to the HTTP API guide:
+
+1. **Define schemas outside.** Domain types and tagged errors,
+   importable by both server and client.
+2. **Construct the service inside the Worker's Init phase.**
+   `RpcGroup.toLayer` is pure construction — safe to call at plan
+   time. Don't `yield*` the running server; it can't run without a
+   request.
+3. **Return `{ fetch }`** where `fetch` is the `HttpEffect`
+   produced by `RpcServer.toHttpEffect`.
+4. **Bonus:** deploy and call the procedures from a typed client
+   that shares the exact same `RpcGroup` value.
+
+## 1. Define the schemas
+
+Domain model and error types — pure schemas, no runtime concerns:
+
+```typescript
+// src/task.ts
+import * as Schema from "effect/Schema";
+
+export class Task extends Schema.Class<Task>("Task")({
+  id: Schema.String,
+  title: Schema.String,
+  completed: Schema.Boolean,
+}) {}
+
+export class TaskNotFound extends Schema.TaggedClass<TaskNotFound>()(
+  "TaskNotFound",
+  { id: Schema.String },
+) {}
+
+export class CreateTaskFailed extends Schema.TaggedClass<CreateTaskFailed>()(
+  "CreateTaskFailed",
+  { message: Schema.String },
+) {}
+```
+
+RPC errors are schema-backed tagged classes. The client receives
+them as typed values you can `match` on — not raw HTTP status codes.
+
+## 2. Declare the RPCs
+
+Each `Rpc.make` declares one procedure: a name, a payload schema,
+a success schema, and an error schema. `RpcGroup.make` collects them
+into a single value that both the server and the client will share.
+
+```typescript
+// src/rpcs.ts
+import * as Schema from "effect/Schema";
+import { Rpc, RpcGroup } from "effect/unstable/rpc";
+import { Task, TaskNotFound, CreateTaskFailed } from "./task.ts";
+
+const getTask = Rpc.make("getTask", {
+  success: Task,
+  error: TaskNotFound,
+  payload: { id: Schema.String },
+});
+
+const createTask = Rpc.make("createTask", {
+  success: Task,
+  error: CreateTaskFailed,
+  payload: { title: Schema.String },
+});
+
+export class TaskRpcs extends RpcGroup.make(getTask, createTask) {}
+```
+
+`TaskRpcs` is just a value-level description. Nothing executes yet.
+
+## 3. Build the Worker
+
+Create `src/worker.ts` with an empty Init phase:
+
+```typescript
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    return {};
+  }),
+);
+```
+
+The generator inside `Cloudflare.Worker` is the **Init phase** — it
+runs both at *plan time* and at *runtime*. Only do pure construction
+or resource-binding factories here; never `yield*` work that needs
+an incoming request.
+
+### 3a. Bind an R2 bucket for storage
+
+Tasks need durable storage. Declare an `R2Bucket` resource and bind
+it inside Init — `bind()` returns a typed handle whose `get` /
+`put` / `delete` / `list` methods we'll call from the handlers
+below.
+
+```typescript
+// src/bucket.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Tasks = Cloudflare.R2Bucket("Tasks");
+```
+
+```typescript twoslash
+// @noErrors
++import { Tasks } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
++   const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
+
+    return {};
+  }),
+);
+```
+
+We'll provide the runtime side of this binding
+(`Cloudflare.R2BucketBindingLive`) in step 3c when we wire up the
+`fetch` handler.
+
+### 3b. Construct the handlers inside Init
+
+`TaskRpcs.toLayer` takes an `Effect` that returns one handler per
+procedure and produces a `Layer`. Like `HttpApiBuilder.group`, this
+is pure construction — it builds a value, it doesn't run the server.
+
+> Don't `yield* TaskRpcs.toLayer(...)` here. Building a layer is
+> fine, but actually executing the procedures requires an incoming
+> request. Init only constructs; the work happens later, on each
+> `fetch` call.
+
+```typescript twoslash
+// @noErrors
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
+
++   const handlersLayer = TaskRpcs.toLayer({
++     getTask: ({ id }) =>
++       Effect.gen(function* () {
++         const object = yield* tasks.get(id);
++         if (!object) {
++           return yield* Effect.fail(new TaskNotFound({ id }));
++         }
++         return Schema.decodeUnknownSync(Task)(JSON.parse(yield* object.text()));
++       }).pipe(Effect.orDie),
++     createTask: ({ title }) =>
++       Effect.gen(function* () {
++         const task = new Task({
++           id: crypto.randomUUID(),
++           title,
++           completed: false,
++         });
++         yield* tasks.put(task.id, JSON.stringify(task));
++         return task;
++       }).pipe(
++         Effect.catchTag("R2Error", (error) =>
++           Effect.fail(new CreateTaskFailed({ message: error.message })),
++         ),
++       ),
++   });
+
+    return {};
+  }),
+```
+
+Each handler receives the typed payload and returns an `Effect`
+that either succeeds with the declared success schema or fails with
+the declared error schema. `getTask` uses `Effect.orDie` to turn
+unexpected R2 failures into 500s — `TaskNotFound` is the only
+client-visible error. `createTask` maps R2 failures into the
+declared `CreateTaskFailed` error so the client can match on it.
+
+### 3c. Return `{ fetch }`
+
+`RpcServer.toHttpEffect` converts the `RpcGroup` into an
+`HttpEffect` — exactly the type Workers expect for `fetch`. We
+provide two layers to it:
+
+- The `handlersLayer` we just built.
+- `RpcSerialization.layerJson` — tells the server to encode and
+  decode messages as JSON. (Swap for `layerNdjson`, `layerMsgPack`,
+  etc. as needed.)
+
+Unlike the HTTP API approach, RPC doesn't need `HttpPlatform.layer`
+or `Etag.layer` — the RPC server handles message framing internally.
+
+```typescript twoslash
+// @noErrors
+    return {
++     fetch: RpcServer.toHttpEffect(TaskRpcs).pipe(
++       Effect.provide(handlersLayer),
++       Effect.provide(RpcSerialization.layerJson),
++     ),
+    };
+```
+
+### Putting it together
+
+```typescript
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { Tasks } from "./bucket.ts";
+import { CreateTaskFailed, Task, TaskNotFound } from "./task.ts";
+import { TaskRpcs } from "./rpcs.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
+
+    const handlersLayer = TaskRpcs.toLayer({
+      getTask: ({ id }) =>
+        Effect.gen(function* () {
+          const object = yield* tasks.get(id);
+          if (!object) {
+            return yield* Effect.fail(new TaskNotFound({ id }));
+          }
+          return Schema.decodeUnknownSync(Task)(
+            JSON.parse(yield* object.text()),
+          );
+        }).pipe(Effect.orDie),
+      createTask: ({ title }) =>
+        Effect.gen(function* () {
+          const task = new Task({
+            id: crypto.randomUUID(),
+            title,
+            completed: false,
+          });
+          yield* tasks.put(task.id, JSON.stringify(task));
+          return task;
+        }).pipe(
+          Effect.catchTag("R2Error", (error) =>
+            Effect.fail(new CreateTaskFailed({ message: error.message })),
+          ),
+        ),
+    });
+
+    return {
+      fetch: RpcServer.toHttpEffect(TaskRpcs).pipe(
+        Effect.provide(handlersLayer),
+        Effect.provide(RpcSerialization.layerJson),
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+## 4. Add to the Stack
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "TaskRpc",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
+    return { url: worker.url };
+  }),
+);
+```
+
+## 5. Deploy
+
+```sh
+alchemy deploy
+```
+
+## Bonus: call it from a typed client
+
+Because `TaskRpcs` is just a value, the same group drives a fully
+typed client — no codegen. `client.createTask` accepts
+`{ title: string }` and returns `Effect<Task, CreateTaskFailed>`.
+
+```typescript
+// scripts/client.ts
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import { FetchHttpClient } from "effect/unstable/http/FetchHttpClient";
+import { RpcClient, RpcSerialization } from "effect/unstable/rpc";
+import { TaskRpcs } from "../src/rpcs.ts";
+
+const program = Effect.gen(function* () {
+  const client = yield* RpcClient.make(TaskRpcs);
+
+  const task = yield* client.createTask({ title: "Write docs" });
+  console.log("Created:", task.id);
+
+  const fetched = yield* client.getTask({ id: task.id });
+  console.log("Fetched:", fetched.title);
+});
+
+Effect.runPromise(
+  program.pipe(
+    Effect.provide(
+      RpcClient.layerProtocolHttp({
+        url: process.env.TASK_RPC_URL!,
+      }),
+    ),
+    Effect.provide(RpcSerialization.layerJson),
+    Effect.provide(FetchHttpClient.layer),
+  ),
+);
+```
+
+Get the URL from the deploy output and run it:
+
+```sh
+TASK_RPC_URL=https://your-worker.workers.dev bun scripts/client.ts
+```
+
+The errors are typed values: `client.getTask` returns
+`Effect<Task, TaskNotFound>`, and you can `Effect.catchTag(
+"TaskNotFound", ...)` to handle the missing case explicitly.
+
+## Bonus: streaming responses
+
+An RPC's `success` doesn't have to be a single value. Wrapping it in
+`RpcSchema.Stream(item, error)` produces a procedure whose handler
+returns a `Stream` and whose client method also returns a `Stream`.
+The wire format is one frame per item, so pick a streaming-friendly
+serialization like `RpcSerialization.layerNdjson` instead of the
+buffered `layerJson` we used above.
+
+```typescript
+// src/rpcs.ts
+import * as RpcSchema from "effect/unstable/rpc/RpcSchema";
+
+const countTasks = Rpc.make("countTasks", {
+  payload: { upto: Schema.Number },
+  success: RpcSchema.Stream(Schema.Number, Schema.Never),
+});
+
+export class TaskRpcs extends RpcGroup.make(getTask, createTask, countTasks) {}
+```
+
+The handler returns a `Stream<number>` directly:
+
+```diff lang="typescript"
++import * as Stream from "effect/Stream";
+
+    const handlersLayer = TaskRpcs.toLayer({
+      getTask: /* ... */,
+      createTask: /* ... */,
++     countTasks: ({ upto }) =>
++       Stream.fromIterable(Array.from({ length: upto }, (_, i) => i + 1)),
+    });
+
+    return {
+      fetch: RpcServer.toHttpEffect(TaskRpcs).pipe(
+        Effect.provide(handlersLayer),
+-       Effect.provide(RpcSerialization.layerJson),
++       Effect.provide(RpcSerialization.layerNdjson),
+      ),
+    };
+```
+
+On the client, `client.countTasks({ upto: 5 })` is a `Stream<number>`
+you consume with `Stream.runCollect`, `Stream.runForEach`, etc. Each
+emitted item arrives as soon as the server flushes its frame.
+
+## Bonus: route some RPCs to a Durable Object
+
+Just like an HTTP API can delegate endpoints to a DO, an `RpcServer`
+can run inside a Durable Object and the Worker can proxy calls to it
+through a typed `RpcClient`. The bridge is the same
+`Cloudflare.toHttpClient(stub)` helper — it just plugs into
+`RpcClient.layerProtocolHttp` instead of `HttpApiClient.makeWith`.
+
+### Split the RPCs into two groups
+
+Put the procedures the DO implements into one group, and the
+Worker-only proxies into another. `merge` produces the public group
+the Worker exposes:
+
+```typescript
+// src/rpcs.ts
+export const InnerRpcs = RpcGroup.make(getTask, createTask);
+
+export const DoRpcs = RpcGroup.make(
+  Rpc.make("getTaskDO", {
+    payload: { id: Schema.String },
+    success: Task,
+    error: TaskNotFound,
+  }),
+  Rpc.make("createTaskDO", {
+    payload: { title: Schema.String },
+    success: Task,
+    error: CreateTaskFailed,
+  }),
+);
+
+export class TaskRpcs extends InnerRpcs.merge(DoRpcs) {}
+```
+
+### Implement the DO
+
+The DO's Init returns `{ fetch }` produced by
+`RpcServer.toHttpEffect(InnerRpcs)`. State lives in
+`state.storage` instead of R2:
+
+```typescript
+// src/object.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+import * as RpcServer from "effect/unstable/rpc/RpcServer";
+import { InnerRpcs } from "./rpcs.ts";
+import { Task, TaskNotFound } from "./task.ts";
+
+export default class TasksObject extends Cloudflare.DurableObjectNamespace<TasksObject>()(
+  "TasksObject",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+
+      const handlersLayer = InnerRpcs.toLayer({
+        getTask: ({ id }) =>
+          state.storage.get<Task>(id).pipe(
+            Effect.flatMap((task) =>
+              task ? Effect.succeed(task) : Effect.fail(new TaskNotFound({ id })),
+            ),
+          ),
+        createTask: ({ title }) =>
+          Effect.sync(() => new Task({ id: crypto.randomUUID(), title, completed: false }))
+            .pipe(Effect.tap((task) => state.storage.put(task.id, task))),
+      });
+
+      return {
+        fetch: RpcServer.toHttpEffect(InnerRpcs).pipe(
+          Effect.provide(Layer.mergeAll(handlersLayer, RpcSerialization.layerNdjson)),
+        ),
+      };
+    });
+  }),
+) {}
+```
+
+### Bridge the DO into a typed RpcClient
+
+`Cloudflare.toHttpClient(stub)` produces an `HttpClient` whose
+`execute` calls into the DO's `fetch`. Provide that as the transport
+for `RpcClient.layerProtocolHttp` and you get a typed
+`RpcClient<DoRpcs>`:
+
+```diff lang="typescript"
++import * as HttpClient from "effect/unstable/http/HttpClient";
++import * as RpcClient from "effect/unstable/rpc/RpcClient";
++import TasksObject from "./object.ts";
++import { DoRpcs } from "./rpcs.ts";
+
+  Effect.gen(function* () {
+    const tasks = yield* Cloudflare.R2Bucket.bind(Tasks);
++   const tasksDO = yield* TasksObject;
++
++   const makeDOClient = (id: string = "default") =>
++     RpcClient.make(DoRpcs).pipe(
++       Effect.provide(
++         RpcClient.layerProtocolHttp({ url: "http://localhost" }).pipe(
++           Layer.provide(
++             Layer.succeed(
++               HttpClient.HttpClient,
++               Cloudflare.toHttpClient(tasksDO.getByName(id)),
++             ),
++           ),
++           Layer.provide(RpcSerialization.layerNdjson),
++         ),
++       ),
++     );
+```
+
+The `url` is a placeholder — the request never hits the network; it
+short-circuits to `tasksDO.getByName(id).fetch`.
+
+### Wire the proxy handlers
+
+The Worker's `*DO` handlers just construct a per-request DO client
+and forward the typed call:
+
+```diff lang="typescript"
+    const handlersLayer = TaskRpcs.toLayer({
+      getTask: /* ... R2 implementation ... */,
+      createTask: /* ... R2 implementation ... */,
++     getTaskDO: (payload) =>
++       makeDOClient().pipe(Effect.flatMap((client) => client.getTask(payload))),
++     createTaskDO: (payload) =>
++       makeDOClient().pipe(Effect.flatMap((client) => client.createTask(payload))),
+    });
+```
+
+For streaming RPCs the same pattern works with `Stream.unwrap`:
+
+```typescript
+countTasksDO: (payload) =>
+  Stream.unwrap(
+    makeDOClient().pipe(Effect.map((client) => client.countTasks(payload))),
+  ),
+```
+
+`getTaskDO` / `createTaskDO` now hit the DO; `getTask` / `createTask`
+still hit R2. One `TaskRpcs` value, one client, two storage backends.
+
+## HTTP API vs RPC
+
+Both approaches produce the same `HttpEffect` and wire into a Worker
+the same way. The difference is in how clients interact:
+
+- **HTTP API** — standard REST endpoints, any HTTP client can call
+  them. Best for public APIs.
+- **RPC** — typed procedures, ideal for service-to-service
+  communication where both sides share the schema definitions.
+
+You can even combine them in the same Worker — serve an HTTP API
+for external consumers and RPC for internal services.
+
+## Recap
+
+- **Schemas** (`Task`, `TaskNotFound`, `CreateTaskFailed`) and the
+  **RPC group** (`TaskRpcs`) live outside the Worker — pure
+  descriptions, importable by clients.
+- The **handlers** are constructed inside the Worker's Init phase
+  closure via `TaskRpcs.toLayer`. We build a `Layer` but never
+  `yield*` the running server.
+- The Worker's surface is `{ fetch }`, where `fetch` is the
+  `HttpEffect` produced by `RpcServer.toHttpEffect`.
+- The same `TaskRpcs` value drives a fully typed client via
+  `RpcClient.make`, with errors as typed values rather than HTTP
+  status codes.
+
+## Sugar: `Cloudflare.RpcWorker`
+
+The `Cloudflare.Worker(...)` + `RpcServer.toHttpEffect(...)` recipe is
+identical for every RPC Worker, so Alchemy ships a thin wrapper that
+takes the `RpcGroup` directly in props and removes the `{ fetch }`
+wrapper:
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { TaskRpcs } from "./rpcs.ts";
+
+export default class Worker extends Cloudflare.RpcWorker<Worker>()(
+  "Worker",
+  { main: import.meta.filename, schema: TaskRpcs },
+  Effect.gen(function* () {
+    const handlers = TaskRpcs.toLayer({ getTask: /* ... */ });
+    return RpcServer.toHttpEffect(TaskRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
+    );
+  }),
+) {}
+```
+
+Functionally identical to the long form above — yielding the class
+returns the same `Worker` resource — but `props.schema` lets a second
+Worker bind a typed client without re-importing `RpcClient`:
+
+```typescript
+// INIT: register the binding, get the typed client
+const tasks = yield* Cloudflare.RpcWorker.bind(TaskWorker);
+
+// PER-REQUEST: just call methods directly
+proxyGetTask: ({ id }) => tasks.getTask({ id }),
+```
+
+The bind goes over the in-account service binding (not the public
+internet) and the client is typed by `TaskWorker`'s declared schema.
+A `Proxy` defers each call's underlying `RpcClient` construction so
+Cloudflare's "no cross-request I/O" rule is satisfied transparently.
+See the [RPC Worker tutorial](/tutorial/cloudflare/rpc-worker) for an
+end-to-end walk-through.
+
+`RpcWorker` also supports a **modular form** that separates the
+class declaration from its runtime — useful when a consumer Worker
+should be able to import the class for binding without pulling in
+the host's runtime:
+
+```typescript
+// Modular: class declaration carries no impl.
+export class TaskWorker extends Cloudflare.RpcWorker<TaskWorker>()(
+  "TaskWorker",
+  { main: import.meta.filename, schema: TaskRpcs },
+) {}
+
+// Runtime lives in a separate Layer — only the host script imports it.
+export default TaskWorker.make(
+  Effect.gen(function* () {
+    const handlers = TaskRpcs.toLayer({ /* ... */ });
+    return RpcServer.toHttpEffect(TaskRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
+    );
+  }),
+);
+```
+
+The class can also declare DOs it publishes via the second type
+argument — `RpcWorker<Self, Deps>()` mirrors
+`Cloudflare.Worker<Self, Bindings, Deps>` so cross-script
+`Counter.from(TaskWorker)` type-checks.
+
+## Sugar: `Cloudflare.RpcDurableObjectNamespace`
+
+The same shape applies to Durable Objects.
+`Cloudflare.RpcDurableObjectNamespace<Self>()(...)` mirrors the
+regular DO class but the inner Effect returns the piped
+`RpcServer.toHttpEffect(schema)` Effect directly:
+
+```typescript
+export default class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+  "Counter",
+  { schema: CounterRpcs },
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      const handlers = CounterRpcs.toLayer({ /* ... */ });
+      return RpcServer.toHttpEffect(CounterRpcs).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+      );
+    });
+  }),
+) {}
+```
+
+`counters.getByName(id)` returns an `Effect<RpcClient<CounterRpcs>>`
+(yield it inside a per-request scope) rather than alchemy's built-in
+DO method bridge. Reach for this whenever DO method return values
+cross a `Schema.Class` boundary — the built-in bridge
+`JSON.stringify`s each value and loses class identity, while the RPC
+namespace round-trips through the shared `RpcSerialization` codec.
+
+Like `RpcWorker`, the RPC DO supports a **modular form** that
+separates the class from its runtime so consumer Workers can bind
+to it cross-script:
+
+```typescript
+// counter.ts — class declaration carries no impl.
+export class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+  "Counter",
+  { schema: CounterRpcs },
+) {}
+
+// Runtime lives in a separate Layer — only the host Worker imports it.
+export default Counter.make(
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      const handlers = CounterRpcs.toLayer({ /* ... */ });
+      return RpcServer.toHttpEffect(CounterRpcs).pipe(
+        Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+      );
+    });
+  }),
+);
+```
+
+From a consumer Worker, `Counter.from(HostWorker)` produces a
+typed namespace bound to the host's running DO instances:
+
+```typescript
+const counters = yield* Counter.from(HostWorker);
+const stub = yield* counters.getByName("shared");
+yield* stub.setTitle({ title: "hi" });
+```
+
+See the [RPC Durable Object tutorial](/tutorial/cloudflare/rpc-durable-object)
+for the full walk-through.
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/frontends.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/frontends.mdx
new file mode 100644
index 00000000000..07bf9b1376f
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/frontends.mdx
@@ -0,0 +1,94 @@
+---
+title: Frontend frameworks
+description: Deploy Vite-based frameworks (TanStack Start, Astro, SolidStart, Nuxt, React) and any custom-built static site (Hugo, Eleventy) to Cloudflare with one declaration.
+sidebar:
+  order: 5
+---
+
+`Cloudflare.Vite` covers TanStack Start, Astro, SolidStart, Nuxt, and
+plain React. `Cloudflare.StaticSite` wraps any custom build pipeline
+— Hugo, Eleventy, mdBook, Jekyll. One declaration. Alchemy builds
+and deploys to Cloudflare.
+
+## Vite-based frameworks
+
+`Cloudflare.Vite` uses Cloudflare's Vite plugin to build the server
+bundle and client assets in one `vite build`. No manual entrypoint,
+no Wrangler config, no asset directory plumbing. Inputs are
+content-hashed so unchanged projects skip the build entirely.
+
+**TanStack Start (SSR)**
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const App = Cloudflare.Vite("App", {
+  compatibility: { flags: ["nodejs_compat"] },
+});
+```
+
+**Astro**
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+
+// Astro builds via Vite — one declaration, static or SSR.
+export const Site = Cloudflare.Vite("Site");
+```
+
+**React + Vite**
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const App = Cloudflare.Vite("App");
+```
+
+- **SSR with `nodejs_compat`** — For frameworks that need Node APIs
+  at runtime (TanStack Start, SolidStart, Nuxt), enable
+  `nodejs_compat` in one line.
+- **Static — also one line** — Pure SPA or static site? Drop the
+  `compatibility` option. The Worker just serves the built assets.
+- **Content-hashed builds** — Every input file is hashed (respecting
+  `.gitignore` by default). Unchanged projects skip both build and
+  deploy.
+
+## Static sites with any build pipeline
+
+For everything Vite doesn't build, `Cloudflare.StaticSite` runs a
+shell command, hashes the output directory, and deploys the result
+as a Worker with static assets:
+
+```typescript
+import * as Cloudflare from "alchemy/Cloudflare";
+
+// Any custom build pipeline — point command at the script,
+// outdir at the output directory.
+export const Blog = Cloudflare.StaticSite("Blog", {
+  command: "hugo --minify",
+  outdir: "public",
+});
+```
+
+Hugo, Eleventy, mdBook, Jekyll — anything that produces a directory
+of files.
+
+## Bind backend resources from your SSR Worker
+
+The Worker that powers your SSR app can bind to R2, KV, D1,
+DynamoDB — anything you've declared elsewhere in the stack. Server
+functions and loaders read a typed `env` with no extra wiring.
+
+```typescript
+// Frontend Workers can bind to backend resources.
+import { Bucket } from "./Bucket.ts";
+import { DB } from "./DB.ts";
+
+export const App = Cloudflare.Vite("App", {
+  env: { Bucket, DB },
+});
+
+// In your SSR loader / server function:
+//   env.Bucket.get(key)   // typed via Cloudflare.InferEnv
+//   env.DB.prepare(sql)
+```
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/infrastructure-layers.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/infrastructure-layers.mdx
new file mode 100644
index 00000000000..5a5aa1ec5c3
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/infrastructure-layers.mdx
@@ -0,0 +1,322 @@
+---
+title: Building Infrastructure Layers
+description: Package resources + bindings + runtime glue into a typed Effect Layer, then swap a KV-backed implementation for an R2-backed one without touching the consumer.
+sidebar:
+  order: 7
+---
+
+A [Layer](/concepts/layers) packages infrastructure behind a typed
+service. This guide builds a `JobService` backed by a Cloudflare KV
+namespace, plugs it into a Worker, then swaps the storage backend
+to an R2 bucket — without touching the Worker.
+
+## Define the service interface
+
+Start with the abstract contract — no infrastructure, no cloud.
+
+```typescript
+// src/JobService.ts
+import * as Alchemy from "alchemy";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+
+export interface Job {
+  id: string;
+  status: "pending" | "done";
+}
+
+export class JobService extends Context.Service<
+  JobService,
+  {
+    getJob(id: string): Effect.Effect<Job | null, never, Alchemy.RuntimeContext>;
+    putJob(job: Job): Effect.Effect<void, never, Alchemy.RuntimeContext>;
+  }
+>()("JobService") {}
+```
+
+`Alchemy.RuntimeContext` on the return types marks these methods as
+runtime-only. The compiler will reject any attempt to call them
+from a deploy script.
+
+## Scaffold the Layer
+
+`Layer.effect(Tag, effect)` says "to build the service identified
+by `Tag`, run this Effect". Start with the methods stubbed out:
+
+```typescript
+// src/JobService.KV.ts
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { JobService, type Job } from "./JobService.ts";
+
+export const JobServiceKV = Layer.effect(
+  JobService,
+  Effect.gen(function* () {
+    return {
+      getJob: Effect.fn(function* (id: string) {
+        // TODO: read from KV
+      }),
+      putJob: Effect.fn(function* (job: Job) {
+        // TODO: write to KV
+      }),
+    };
+  }),
+);
+```
+
+`Effect.fn(function* …)` is sugar for an Effect-returning function;
+it preserves the inferred argument types.
+
+## Declare the KV namespace
+
+`Cloudflare.KVNamespace("Jobs")` describes a real resource. Yielding
+it inside the Layer attaches it to whichever Stack consumes the
+Layer.
+
+```diff lang="typescript"
++import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
+ import * as Layer from "effect/Layer";
+ import { JobService, type Job } from "./JobService.ts";
+
+ export const JobServiceKV = Layer.effect(
+   JobService,
+   Effect.gen(function* () {
++    const Namespace = yield* Cloudflare.KVNamespace("Jobs");
++
+     return {
+       // ...
+     };
+   }),
+ );
+```
+
+## Bind the namespace
+
+`KVNamespaceBinding.bind(Namespace)` wires the namespace into the
+consuming Worker — binding name, IAM, env injection — and returns
+a typed client.
+
+```diff lang="typescript"
+ export const JobServiceKV = Layer.effect(
+   JobService,
+   Effect.gen(function* () {
+     const Namespace = yield* Cloudflare.KVNamespace("Jobs");
++    const kv = yield* Cloudflare.KVNamespaceBinding.bind(Namespace);
+
+     return {
+       // ...
+     };
+   }),
+ );
+```
+
+`kv.get` / `kv.put` carry an `Alchemy.RuntimeContext` requirement,
+which matches what `JobService` declared.
+
+## Implement the methods
+
+Replace the TODO bodies with calls to the typed client:
+
+```diff lang="typescript"
+     return {
+       getJob: Effect.fn(function* (id: string) {
+-        // TODO: read from KV
++        return yield* kv.get<Job>(id, "json");
+       }),
+       putJob: Effect.fn(function* (job: Job) {
+-        // TODO: write to KV
++        yield* kv.put(job.id, JSON.stringify(job));
+       }),
+     };
+```
+
+## Scaffold the Worker
+
+Start with a minimal Worker that responds to every request with a
+placeholder. Init and runtime closures are both empty.
+
+```typescript
+// src/Api.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default Cloudflare.Worker(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }),
+);
+```
+
+## Resolve the service
+
+Yield `JobService` in the init closure to get a typed handle, then
+call it from `fetch`:
+
+```diff lang="typescript"
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
+ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import { JobService } from "./JobService.ts";
+
+ export default Cloudflare.Worker(
+   "Api",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
++    const jobs = yield* JobService;
++
+     return {
+       fetch: Effect.gen(function* () {
+-        return HttpServerResponse.text("ok");
++        const job = yield* jobs.getJob("job-1");
++        return yield* HttpServerResponse.json(job);
+       }),
+     };
+   }),
+ );
+```
+
+At this point the Worker doesn't type-check — `JobService` is in the
+requirements but nothing satisfies it.
+
+## Provide the Layer
+
+`Effect.provide(JobServiceKV)` satisfies `JobService` and brings the
+KV namespace resource into the Stack:
+
+```diff lang="typescript"
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
++import * as Layer from "effect/Layer";
+ import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+ import { JobService } from "./JobService.ts";
++import { JobServiceKV } from "./JobService.KV.ts";
+
+ export default Cloudflare.Worker(
+   "Api",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
+     // ...
+-  }),
++  }).pipe(Effect.provide(JobServiceKV)),
+ );
+```
+
+The Worker still doesn't type-check — `JobServiceKV` itself depends
+on `KVNamespaceBinding`, which is satisfied by
+`KVNamespaceBindingLive`.
+
+## Provide the runtime binding
+
+`Layer.provide` satisfies `JobServiceKV`'s dependency on
+`KVNamespaceBinding` privately, so the consumer only sees `JobService`:
+
+```diff lang="typescript"
+   }).pipe(
+     Effect.provide(
+-      JobServiceKV,
++      JobServiceKV.pipe(Layer.provide(Cloudflare.KVNamespaceBindingLive)),
+     ),
+   ),
+```
+
+`KVNamespaceBindingLive` requires `WorkerEnvironment`, which the
+Cloudflare Worker runtime satisfies automatically at cold start.
+
+## Reuse a Layer across Workers
+
+A Layer is just a value. Any Worker that provides `JobServiceKV`
+shares the same KV namespace, because `Cloudflare.KVNamespace("Jobs")`
+has a stable logical id:
+
+```diff lang="typescript"
+ // src/Admin.ts
+ export default Cloudflare.Worker(
+   "Admin",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
+     const jobs = yield* JobService;
+     // ...
+   }).pipe(
+     Effect.provide(
++      JobServiceKV.pipe(Layer.provide(Cloudflare.KVNamespaceBindingLive)),
+     ),
+   ),
+ );
+```
+
+The Stack ends up with one `Jobs` KV namespace, bound to both `Api`
+and `Admin` with the correct env vars on each.
+
+## Swap the backend to R2
+
+`JobService` is a contract, not a resource. The same Worker can
+run against an R2 bucket instead of a KV namespace — only the
+Layer implementation and the runtime binding provided to it
+change. Drop a second implementation alongside `JobService.KV.ts`:
+
+```typescript
+// src/JobService.R2.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { JobService, type Job } from "./JobService.ts";
+
+export const JobServiceR2 = Layer.effect(
+  JobService,
+  Effect.gen(function* () {
+    const Bucket = yield* Cloudflare.R2Bucket("Jobs");
+    const r2 = yield* Cloudflare.R2BucketBinding.bind(Bucket);
+
+    return {
+      getJob: Effect.fn(function* (id: string) {
+        const object = yield* r2.get(id);
+        if (!object) return null;
+        return yield* object.json<Job>();
+      }),
+      putJob: Effect.fn(function* (job: Job) {
+        yield* r2.put(job.id, JSON.stringify(job));
+      }),
+    };
+  }),
+);
+```
+
+Same `Layer.effect(JobService, …)` shape, same `getJob`/`putJob`
+contract — internally it yields an `R2Bucket` resource and binds
+it instead of a KV namespace.
+
+## Swap the Layer on the Worker
+
+The Worker doesn't change. Only the Layer it provides — and the
+runtime binding provided to that Layer — swap over:
+
+```diff lang="typescript"
+   }).pipe(
+     Effect.provide(
+-      JobServiceKV.pipe(Layer.provide(Cloudflare.KVNamespaceBindingLive)),
++      JobServiceR2.pipe(Layer.provide(Cloudflare.R2BucketBindingLive)),
+     ),
+   ),
+```
+
+The Worker still yields `JobService` and calls `getJob`/`putJob`;
+`fetch` is byte-for-byte unchanged. The Stack now contains a
+`Jobs` R2 bucket (no KV namespace) and the Worker is configured
+to talk to it.
+
+## Related
+
+- [Layers](/concepts/layers) — the concept behind this guide
+- [Binding](/concepts/binding) — what `.bind(...)` does under the hood
+- [Phases](/concepts/phases) — when init vs runtime code runs
+- [Circular Bindings](/guides/circular-bindings) — two Layers
+  referencing each other
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/migrating-from-v1.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/migrating-from-v1.mdx
new file mode 100644
index 00000000000..14b96f030f0
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/migrating-from-v1.mdx
@@ -0,0 +1,215 @@
+---
+title: Migrating from v1
+description: Migrate your Alchemy v1 (async/await) project to Alchemy v2.
+sidebar:
+  order: 0
+---
+
+Alchemy v1 uses `async/await` with top-level `await` for
+orchestration. Alchemy v2 replaces this with Effect generators for
+type-safe error handling, composable retries, and declarative
+resource wiring.
+
+Your existing `async fetch` handlers **do not need to change** — you
+can keep them as-is and still get all the benefits of the new engine.
+
+## Step 1: Replace the Stack
+
+In v1, you create an app with `await alchemy(...)` and finalize it
+at the end:
+
+```typescript
+// v1 — alchemy.run.ts
+import alchemy from "alchemy";
+import { Worker, R2Bucket } from "alchemy/cloudflare";
+
+const app = await alchemy("my-app", {});
+
+const bucket = await R2Bucket("bucket", {});
+const worker = await Worker("worker", {
+  entrypoint: "./src/worker.ts",
+  bindings: { BUCKET: bucket },
+});
+
+console.log(worker.url);
+
+await app.finalize();
+```
+
+In v2, you export a default `Alchemy.Stack` and use `yield*` instead
+of `await`:
+
+```typescript
+// v2 — alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: { Bucket },
+});
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
+    return { url: worker.url };
+  }),
+);
+```
+
+Key differences:
+
+- `await alchemy("name")` + `await app.finalize()` → `Alchemy.Stack("name", { providers }, effect)`
+- `await R2Bucket("name", {})` → `Cloudflare.R2Bucket("name")`
+- `await Worker("name", { entrypoint })` → `Cloudflare.Worker("name", { main })`
+- `entrypoint` is now called `main`
+- Resources are declared at the top level, then `yield*`-ed inside the Stack
+- No more `finalize()` — the Stack handles lifecycle automatically
+
+## Step 2: Keep your async handler
+
+Your existing Worker runtime code does not need to change. The async
+pattern declares bindings on the Worker's `env` prop and uses
+`Cloudflare.InferEnv` to type the `env` object:
+
+```typescript twoslash
+// @noErrors
+// alchemy.run.ts
++export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: { Bucket },
+});
+```
+
+Your handler stays the same — just update the type import:
+
+```typescript twoslash
+// @noErrors
+// src/worker.ts
+-import type { Env } from "../alchemy.run.ts";
++import type { WorkerEnv } from "../alchemy.run.ts";
+
+export default {
+- async fetch(request: Request, env: Env) {
++ async fetch(request: Request, env: WorkerEnv) {
+-   const object = await env.BUCKET.get("key");
++   const object = await env.Bucket.get("key");
+    return new Response(object?.body ?? null);
+  },
+};
+```
+
+`Cloudflare.InferEnv` derives a fully typed `env` object from the
+`env` declared on the Worker. You get type safety on the binding
+names and their APIs without using Effect in your runtime code.
+
+:::tip
+This is the recommended migration path. Get your infrastructure on v2
+first, then optionally adopt Effect for runtime code later.
+:::
+
+## Step 3: Deploy
+
+The CLI commands are the same:
+
+```sh
+alchemy deploy
+alchemy destroy
+```
+
+Your v1 state is not compatible with v2. On your first deploy, Alchemy
+creates new resources. You should destroy your v1 stack first, then
+deploy with v2.
+
+## (Optional) Adopt Effect for runtime code
+
+When you're ready, you can switch to Effect-native Workers. This
+gives you typed errors, composable retries, and Effect's `HttpServer`
+integration.
+
+Instead of declaring `env` bindings on the resource props, you bind
+resources in the Worker's Init phase using `yield*`:
+
+```typescript twoslash
+// @noErrors
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+-export default {
+-  async fetch(request: Request, env: WorkerEnv) {
+-    const object = await env.Bucket.get("key");
+-    return new Response(object?.body ?? null);
+-  },
+-};
++export default Cloudflare.Worker("Worker",
++  { main: import.meta.path },
++  Effect.gen(function* () {
++    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
++
++    return {
++      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++        const key = request.url.split("/").pop()!;
++        const object = yield* bucket.get(key);
++        return object
++          ? HttpServerResponse.text(yield* object.text())
++          : HttpServerResponse.text("Not found", { status: 404 });
++      }),
++    };
++  }),
++);
+```
+
+The Worker resource declaration moves from `alchemy.run.ts` into the
+Worker file itself (using `import.meta.path` as the `main`), and the
+Stack just `yield*`-s the imported Worker:
+
+```typescript twoslash
+// @noErrors
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
++import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import Worker from "./src/worker.ts";
++import { Bucket } from "./src/bucket.ts";
+
+-export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+-
+-export const Worker = Cloudflare.Worker("Worker", {
+-  main: "./src/worker.ts",
+-  env: { Bucket },
+-});
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
++   const bucket = yield* Bucket;
+    const worker = yield* Worker;
+    return { url: worker.url };
+  }),
+);
+```
+
+## Summary
+
+|              | v1 (async)                    | v2 (async style)              | v2 (Effect style)                  |
+| ------------ | ----------------------------- | ----------------------------- | ---------------------------------- |
+| Stack        | `await alchemy("name")`       | `Alchemy.Stack("name", ...)`  | `Alchemy.Stack("name", ...)`       |
+| Resources    | `await R2Bucket(...)`         | `Cloudflare.R2Bucket(...)`    | `Cloudflare.R2Bucket(...)`         |
+| Worker entry | `entrypoint`                  | `main`                        | `main: import.meta.path`           |
+| Bindings     | `bindings: { KEY: resource }` | `env: { Key: resource }`      | `yield* Resource.bind(ref)`        |
+| Runtime code | `async fetch(req, env)`       | `async fetch(req, env)`       | `Effect.gen(function* () { ... })` |
+| Lifecycle    | `await app.finalize()`        | automatic                     | automatic                          |
+| Type safety  | runtime errors                | typed `env` via `InferEnv`    | full Effect type system            |
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/monorepo.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/monorepo.mdx
new file mode 100644
index 00000000000..fd27721d14e
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/monorepo.mdx
@@ -0,0 +1,504 @@
+---
+title: Monorepos
+description: Two patterns for organizing an Alchemy monorepo with a backend API and a frontend website — one shared stack (recommended) or one stack per package — with the trade-offs and a working example for each.
+sidebar:
+  order: 3
+---
+
+A real app usually ships a backend API and a frontend that calls
+it. In a monorepo, you have two ways to organize the deploy:
+
+1. **Single-stack** — one `alchemy.run.ts` at the workspace root
+   that deploys both packages together. **Recommended** for most
+   projects.
+2. **Multi-stack** — each package owns its own `alchemy.run.ts`
+   and the frontend reads the backend's deployed outputs through
+   a typed cross-stack reference.
+
+Both shapes share the same package layout and the same browser
+client. The only thing that changes is **where the deploy lives**
+and how the frontend discovers the backend's URL.
+
+## Which one should I use?
+
+Start with **single-stack**. It's simpler, faster to iterate on,
+and avoids the deploy-ordering and reference-resolution gotchas
+that come with cross-stack references.
+
+| Situation                                                                  | Use          |
+| -------------------------------------------------------------------------- | ------------ |
+| One team owns both packages, ships them together                           | Single-stack |
+| You want one `deploy` / `destroy` command per environment                  | Single-stack |
+| Just starting out                                                          | Single-stack |
+| Backend and frontend deploy on different cadences (different teams, CI)    | Multi-stack  |
+| Backend has consumers besides the frontend, with their own deploy lifecycle | Multi-stack |
+| You want to be able to `destroy` the frontend without touching the backend | Multi-stack  |
+
+The two example projects:
+
+- [`examples/monorepo-single-stack`](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/monorepo-single-stack)
+- [`examples/monorepo-multi-stack`](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/monorepo-multi-stack)
+
+## Shared layout
+
+Both shapes start from the same workspace + backend package
+layout. Walk through this section once; the next two sections
+just add the deploy glue on top.
+
+### Workspace root
+
+Set up the workspace `package.json`:
+
+```json
+{
+  "name": "monorepo",
+  "private": true,
+  "type": "module",
+  "workspaces": ["frontend", "backend"]
+}
+```
+
+Workspaces let `frontend` import from `backend` by package name
+— that's the channel the runtime client (and, in the multi-stack
+shape, the typed stack handle) flow through.
+
+### Backend package
+
+Create `backend/package.json`:
+
+```json
+{
+  "name": "backend",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "alchemy": "workspace:*",
+    "effect": "catalog:"
+  },
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "import": "./lib/index.js",
+      "default": "./lib/index.js"
+    }
+  }
+}
+```
+
+The `bun` condition resolves `import "backend"` straight to the
+TypeScript source under Bun, which keeps inner-loop iteration fast.
+
+### Define the API schema
+
+Put the `HttpApi` schema in its own file so it's importable from
+both the Worker (which serves it) and the React app (which calls
+it through a typed client):
+
+```typescript
+// backend/src/Spec.ts
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
+export class Greeting extends Schema.Class<Greeting>("Greeting")({
+  message: Schema.String,
+}) {}
+
+export const hello = HttpApiEndpoint.get("hello", "/", {
+  success: Greeting,
+});
+
+export class HelloGroup extends HttpApiGroup.make("Hello").add(hello) {}
+
+export class BackendApi extends HttpApi.make("BackendApi").add(HelloGroup) {}
+```
+
+Pure value-level descriptions. Both sides of the wire share the
+same `BackendApi` constant.
+
+### Implement the Worker
+
+```typescript
+// backend/src/Service.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { BackendApi, Greeting } from "./Spec.ts";
+
+export default class Service extends Cloudflare.Worker<Service>()(
+  "Service",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const helloGroup = HttpApiBuilder.group(BackendApi, "Hello", (handlers) =>
+      handlers.handle("hello", () =>
+        Effect.succeed(new Greeting({ message: "Hello World" })),
+      ),
+    );
+    return {
+      fetch: HttpApiBuilder.layer(BackendApi).pipe(
+        Layer.provide(helloGroup),
+        Layer.provide([HttpPlatform.layer, Etag.layer]),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }),
+) {}
+```
+
+Standard `HttpApi` plumbing — see
+[Effect HTTP API](/guides/effect-http-api) for the long-form
+walkthrough.
+
+### Build the typed client
+
+```typescript
+// backend/src/Client.ts
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { BackendApi } from "./Spec.ts";
+
+export const BackendClient = (baseUrl: string) =>
+  HttpApiClient.make(BackendApi, { baseUrl });
+```
+
+A function that takes the deployed URL and returns a fully-typed
+`HttpApiClient` for `BackendApi`. The React app calls this with
+`VITE_API_URL`.
+
+### Re-export the runtime modules
+
+```typescript
+// backend/src/index.ts
+export * from "./Client.ts";
+export * from "./Spec.ts";
+```
+
+`import { BackendApi, BackendClient } from "backend"` now works
+across the workspace.
+
+### Add a `./Client` subpath for the browser
+
+The browser doesn't need anything but `BackendClient` — and
+under tree-shaking it's safer to import it through its own
+subpath rather than the package barrel. That keeps the React
+build's dependency graph tightly scoped to the runtime client:
+
+```diff lang="json"
+   "exports": {
+     ".": {
+       "bun": "./src/index.ts",
+       "import": "./lib/index.js",
+       "default": "./lib/index.js"
++    },
++    "./Client": {
++      "bun": "./src/Client.ts",
++      "import": "./lib/Client.js",
++      "default": "./lib/Client.js"
+     }
+   }
+```
+
+The React app will use `import { BackendClient } from "backend/Client"`.
+
+### Frontend package
+
+`frontend/package.json` declares `backend` as a workspace
+dependency:
+
+```json
+{
+  "name": "frontend",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "alchemy": "workspace:*",
+    "backend": "workspace:*",
+    "effect": "catalog:",
+    "react": "^19.2.6",
+    "react-dom": "^19.2.6",
+    "vite": "catalog:"
+  }
+}
+```
+
+### React entry point
+
+```typescript
+// frontend/src/main.tsx
+import { BackendClient } from "backend/Client";
+import * as Effect from "effect/Effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import React from "react";
+import ReactDOM from "react-dom/client";
+
+const API_URL = import.meta.env.VITE_API_URL ?? "http://localhost:8787";
+
+const client = BackendClient(API_URL).pipe(
+  Effect.provide(FetchHttpClient.layer),
+);
+
+function App() {
+  // … call `client.Hello.hello()` and render the result
+}
+
+ReactDOM.createRoot(document.getElementById("root")!).render(<App />);
+```
+
+The browser only ever imports from `"backend/Client"` and never
+from `"backend"`. The React bundle stays scoped to the runtime
+client; nothing else from the backend package leaks into it.
+
+That's the shared base. From here, choose a deploy shape.
+
+## Option 1 — Single-stack (recommended)
+
+One `alchemy.run.ts` at the workspace root deploys both packages.
+The Worker and the Vite-built website are siblings inside one
+stack; the frontend reads the Worker's URL directly off the
+in-memory output, no cross-stack reference required.
+
+### Wire it up
+
+Create `alchemy.run.ts` at the workspace root:
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Path } from "effect/Path";
+import Service from "./backend/src/Service.ts";
+
+export default Alchemy.Stack(
+  "Monorepo",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const backend = yield* Service;
+    const path = yield* Path;
+
+    const website = yield* Cloudflare.Vite("Website", {
+      rootDir: path.resolve(import.meta.dirname, "frontend"),
+      env: {
+        VITE_API_URL: backend.url.as<string>(),
+      },
+    });
+
+    return {
+      backendUrl: backend.url.as<string>(),
+      websiteUrl: website.url.as<string>(),
+    };
+  }),
+);
+```
+
+Two things to call out:
+
+- The Worker's `backend.url` is an `Output<string>`. Passing it
+  into `Cloudflare.Vite`'s `env` makes Alchemy build the website
+  *after* the Worker is deployed, with the resolved URL baked in.
+- `Cloudflare.Vite` takes a `rootDir` so a single stack can build
+  a Vite project that lives elsewhere in the workspace — here,
+  the `frontend/` directory.
+
+### Deploy
+
+```sh
+alchemy deploy
+```
+
+One plan, one apply, one set of state. Both resources go up
+together; both come down together with `alchemy destroy`.
+
+That's it. No subpath-versus-barrel for the stack handle, no
+deploy ordering, no `Output.stackRef`. The single-stack shape is
+the one to reach for unless you have a reason not to.
+
+## Option 2 — Multi-stack
+
+Each package owns its own `alchemy.run.ts`. The frontend reads
+the backend's deployed outputs through a **cross-stack
+reference** (`yield* Backend`), resolved at plan time against the
+state store. Each package can deploy and destroy independently.
+
+You pay for that with two extra moving parts:
+
+- A typed `Backend` stack handle declared in `backend/src/Stack.ts`.
+- An order-of-deploys constraint: backend must be deployed (to
+  the same stage you're referencing) before the frontend plan
+  can resolve.
+
+### Declare the typed Stack handle
+
+```typescript
+// backend/src/Stack.ts
+import * as Alchemy from "alchemy";
+
+export class Backend extends Alchemy.Stack<
+  Backend,
+  {
+    url: string;
+  }
+>()("Backend") {}
+```
+
+`Alchemy.Stack<Self, Outputs>()(name)` produces a class that:
+
+1. Names the stack (`"Backend"`) — must match across both stacks.
+2. Declares the output shape — TypeScript enforces it on both sides.
+3. Exposes `.make(...)` to deploy the stack.
+4. Exposes `.stage[name]` to reference a deployed stage.
+
+### Re-export the stack handle
+
+Add `Stack.ts` to the package barrel so the frontend can import
+it by package name:
+
+```diff lang="typescript"
+ // backend/src/index.ts
+ export * from "./Client.ts";
+ export * from "./Spec.ts";
++export * from "./Stack.ts";
+```
+
+`import { Backend } from "backend"` now resolves the typed handle.
+The browser never imports from the bare `"backend"` barrel —
+it goes through `"backend/Client"` — so adding `Stack.ts` here
+does not affect the React bundle.
+
+### Deploy the backend with `Backend.make`
+
+```typescript
+// backend/alchemy.run.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Service from "./src/Service.ts";
+import { Backend } from "./src/Stack.ts";
+
+export default Backend.make(
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const api = yield* Service;
+    return {
+      url: api.url.as<string>(),
+    };
+  }),
+);
+```
+
+`Backend.make` is a typed shorthand for `Alchemy.Stack` that uses
+the name and output shape declared on the handle. If the returned
+object doesn't match `{ url: string }`, the file fails to
+typecheck.
+
+### Deploy the frontend with a cross-stack reference
+
+```typescript
+// frontend/alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Backend } from "backend";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "Frontend",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const backend = yield* Backend;
+
+    const website = yield* Cloudflare.Vite("Website", {
+      env: {
+        VITE_API_URL: backend.url,
+      },
+    });
+
+    return {
+      url: website.url.as<string>(),
+    };
+  }),
+);
+```
+
+`yield* Backend` resolves to the **same stage** of the named
+stack that the frontend is being deployed to — `sam` frontend
+reads `sam` backend, `pr-42` reads `pr-42`, and so on. Under the
+hood it's [`Output.stackRef`](/concepts/outputs#ref) reading
+the backend's persisted stack output from the state store.
+
+### Deploy
+
+Deploy in dependency order — backend first, then frontend, with
+matching stage flags:
+
+```sh
+cd backend && alchemy deploy --stage sam
+cd frontend && alchemy deploy --stage sam
+```
+
+The frontend's plan resolves `Backend` against the state store
+under the current stage (`sam`). The backend must be deployed to
+the same stage first; otherwise evaluation fails with
+`InvalidReferenceError`.
+
+Destroy in reverse — frontend first, then backend.
+
+### Pin to a specific stage
+
+The bare `yield* Backend` is the right default. Sometimes you
+want to **break** stage symmetry — e.g. the production frontend
+always points at the production backend even when deployed from
+a feature branch. Use `Backend.stage.<name>` to pin:
+
+```diff lang="typescript"
+   Effect.gen(function* () {
+-    const backend = yield* Backend;
++    const backend = yield* Backend.stage.prod;
+     // ...
+   })
+```
+
+`Backend.stage` is a proxy keyed by stage name. Any string works:
+
+```typescript
+const backend = yield* Backend.stage.staging;
+const backend = yield* Backend.stage["pr-42"];
+```
+
+| You want…                                                | Use                          |
+| -------------------------------------------------------- | ---------------------------- |
+| Frontend's stage maps 1:1 to the backend's stage         | `yield* Backend`             |
+| Always pin to a specific backend stage                   | `yield* Backend.stage.prod`  |
+| Branch on the current stage (e.g. PR previews → staging) | a conditional, see [Shared database across stages](/guides/shared-database) |
+
+## Comparison
+
+| Concern                           | Single-stack                | Multi-stack                              |
+| --------------------------------- | --------------------------- | ---------------------------------------- |
+| Number of `alchemy.run.ts` files  | 1                           | 2                                        |
+| Number of state files per stage   | 1                           | 2                                        |
+| Deploy ordering                   | Implicit (one plan)         | Backend first, then frontend             |
+| Cross-package reference mechanism | Direct `Output<string>`     | `yield* Backend` → state-store lookup    |
+| `destroy` blast radius            | Whole app                   | One package at a time                    |
+| Best for                          | Most projects               | Independent deploy cadences / consumers  |
+
+## Related
+
+- [Stack](/concepts/stack) — defining stacks and stack outputs.
+- [Inputs and Outputs](/concepts/outputs#ref) — the underlying
+  `Output.stackRef` and `Output.ref` operators.
+- [Shared database across stages](/guides/shared-database) —
+  per-resource references between stages of the same stack.
+- [Stages](/concepts/stages) — naming and isolating per-environment
+  deploys.
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/secrets.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/secrets.mdx
new file mode 100644
index 00000000000..d1a5b5b75f1
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/secrets.mdx
@@ -0,0 +1,100 @@
+---
+title: Secrets and env vars
+description: Wire OPENAI_API_KEY from .env into a Cloudflare Worker as a secret_text binding.
+sidebar:
+  order: 3
+---
+
+Wire an `OPENAI_API_KEY` from your `.env` into a Cloudflare Worker
+as a `secret_text` binding.
+
+For the bigger picture — how this works, the Init/Runtime split,
+trade-offs, and `Cloudflare.Secret` — see
+[Concepts › Secrets and Variables](/concepts/secrets).
+
+## 1. Add the env var
+
+```sh
+# .env
+OPENAI_API_KEY=sk-proj-...
+```
+
+## 2. Resolve it in the Worker's Init phase
+
+```diff lang="typescript"
+// src/worker.ts
+ import * as Cloudflare from "alchemy/Cloudflare";
++import * as Config from "effect/Config";
+ import * as Effect from "effect/Effect";
+ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+ export default Cloudflare.Worker(
+   "Worker",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
++    const apiKey = yield* Config.redacted("OPENAI_API_KEY");
+
+     return {
+       fetch: Effect.gen(function* () {
+         return HttpServerResponse.text("Hello, world!");
+       }),
+     };
+   }),
+ );
+```
+
+:::tip
+At deploy time, Alchemy reads `OPENAI_API_KEY` from your `.env`
+and records it as a `secret_text` binding on the Worker. At
+runtime, the same `Config.redacted("OPENAI_API_KEY")` resolves
+from that binding — one line, both phases.
+
+See [Concepts › Secrets and Variables](/concepts/secrets) for how
+the Init/Runtime hook-up works.
+:::
+
+## 3. Use it inside `fetch`
+
+```diff lang="typescript"
+ // src/worker.ts
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Config from "effect/Config";
+ import * as Effect from "effect/Effect";
+ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import * as Redacted from "effect/Redacted";
+
+ export default Cloudflare.Worker(
+   "Worker",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
+     const apiKey = yield* Config.redacted("OPENAI_API_KEY");
+
+     return {
+       fetch: Effect.gen(function* () {
++        const response = yield* Effect.tryPromise(() =>
++          fetch("https://api.openai.com/v1/models", {
++            headers: { Authorization: `Bearer ${Redacted.value(apiKey)}` },
++          }),
++        );
++        return HttpServerResponse.text(
++          yield* Effect.promise(() => response.text()),
++        );
+-        return HttpServerResponse.text("Hello, world!");
+       }),
+     };
+   }),
+ );
+```
+
+Unwrap with `Redacted.value` only at the call site that needs the
+raw string.
+
+## 4. Deploy
+
+```sh
+alchemy deploy
+```
+
+The Worker now has an `OPENAI_API_KEY` `secret_text` binding, and
+`Config.redacted("OPENAI_API_KEY")` resolves from that binding at
+runtime — not from `process.env`.
diff --git a/.repos/alchemy-effect/website/src/content/docs/guides/shared-database.mdx b/.repos/alchemy-effect/website/src/content/docs/guides/shared-database.mdx
new file mode 100644
index 00000000000..a565d392316
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/guides/shared-database.mdx
@@ -0,0 +1,224 @@
+---
+title: Shared database across stages
+description: Have ephemeral PR-preview stages reference a long-lived Neon Postgres project from staging instead of provisioning their own — fast previews, copy-on-write branches, no extra Postgres clusters.
+sidebar:
+  order: 4
+---
+
+[Stages](/concepts/stages) make it cheap to spin up isolated copies
+of a stack — per-developer, `pr-42`, `prod`. Most resources should
+be isolated. But some — a Neon Postgres project, a shared S3
+bucket, a global rate limiter — are too expensive or too stateful
+to re-provision per stage. PR-preview stages should *point at* the
+shared instance instead.
+
+`Resource.ref(id, { stage })` reads a deployed resource's
+attributes from another stage of the same stack — typed, lazy,
+resolved at plan time against the persisted state store. See
+[References](/concepts/references) for the full reference surface
+(`Output.ref`, `Output.stackRef`, `Stack.stage`).
+
+The example we'll build: a Neon Postgres project that's owned by
+`staging`, with PR-preview stages (`pr-*`) referencing it instead
+of creating their own. The full file lives in
+[`examples/cloudflare-neon-drizzle/src/Db.ts`](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-neon-drizzle/src/Db.ts).
+
+## Start with the unconditional version
+
+A Neon project plus a per-stage branch. Every stage gets its own
+project — wasteful for short-lived PR previews:
+
+```typescript
+// src/Db.ts
+import * as Alchemy from "alchemy";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const NeonDb = Effect.gen(function* () {
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  const project = yield* Neon.Project("app-db", {
+    region: "aws-us-east-1",
+  });
+
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+    migrationsDir: schema.out,
+  });
+
+  return { project, branch, schema };
+});
+```
+
+Each stage that runs this gets:
+
+- its own `Neon.Project` (a whole Postgres cluster),
+- its own `Neon.Branch` against that project,
+- migrations re-applied from scratch.
+
+Fine for `staging` and `prod`. Overkill for `pr-147`.
+
+## Read the current stage
+
+Pull the active stage from the `Stack` service so we can branch on
+it. `Alchemy.Stack` is the same handle used everywhere — it gives
+you `name`, `stage`, and friends:
+
+```diff lang="typescript"
+ export const NeonDb = Effect.gen(function* () {
++  const { stage } = yield* Alchemy.Stack;
++
+   const schema = yield* Drizzle.Schema("app-schema", {
+     schema: "./src/schema.ts",
+     out: "./migrations",
+   });
+```
+
+`stage` is whatever was passed to `alchemy deploy --stage <name>`.
+We'll use it to route PR previews to the shared project.
+
+## Swap in `Neon.Project.ref` for PR stages
+
+Here's the key step. Replace the unconditional `Neon.Project(...)`
+with a conditional that uses `Neon.Project.ref(...)` when the stage
+is a PR preview, and creates a real project otherwise:
+
+```diff lang="typescript"
+-  const project = yield* Neon.Project("app-db", {
+-    region: "aws-us-east-1",
+-  });
++  const project = stage.startsWith("pr-")
++    ? yield* Neon.Project.ref("app-db", { stage: "staging" })
++    : yield* Neon.Project("app-db", {
++        region: "aws-us-east-1",
++      });
+```
+
+Three things to know about `Resource.ref`:
+
+1. **Same logical ID.** `"app-db"` — the same logical ID the
+   `staging` stage uses to create the project. The ref lookup is
+   keyed by `{ stack, stage, id }`.
+2. **Typed.** `project` is `Neon.Project` either way — same
+   attributes, same downstream API. The branch resource doesn't
+   know or care that one stage's `project` is real and another's
+   is a reference.
+3. **Resolved at plan time.** Alchemy reads the attributes (project
+   id, host, etc.) from the staging stage's state file. If
+   `staging` hasn't been deployed yet, plan fails with
+   `InvalidReferenceError` — deploy `staging` first, then PR
+   stages can reference it.
+
+The signature is
+`Resource.ref(id, { stage?: string, stack?: string })`. Both
+options default to the current stack and stage; here we override
+`stage` to point at the long-lived shared environment.
+
+## Pass the reference downstream
+
+Once `project` exists (real or referenced), the rest of the file
+is identical. The branch creates per-stage:
+
+```typescript
+const branch = yield* Neon.Branch("app-branch", {
+  project,
+  migrationsDir: schema.out,
+});
+```
+
+Each PR stage gets its own ephemeral Neon **branch** off the
+shared **project** — which is exactly the point. Branches are
+copy-on-write and free; projects aren't.
+
+## The whole picture
+
+```typescript
+// src/Db.ts
+import * as Alchemy from "alchemy";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const NeonDb = Effect.gen(function* () {
+  const { stage } = yield* Alchemy.Stack;
+
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  const project = stage.startsWith("pr-")
+    ? yield* Neon.Project.ref("app-db", { stage: "staging" })
+    : yield* Neon.Project("app-db", {
+        region: "aws-us-east-1",
+      });
+
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+    migrationsDir: schema.out,
+  });
+
+  return { project, branch, schema };
+});
+```
+
+## Deploy
+
+Deploy `staging` once to materialize the shared project:
+
+```sh
+alchemy deploy --stage staging
+```
+
+Then PR stages can reference it:
+
+```sh
+alchemy deploy --stage pr-147
+```
+
+Plan reads `staging`'s state, resolves `app-db` against it, and
+provisions only the per-stage `Neon.Branch`. Tearing down a PR
+stage with `alchemy destroy --stage pr-147` deletes the branch but
+leaves the shared project alone — Alchemy doesn't own it from this
+stage's perspective.
+
+## Cross-stack too
+
+`Resource.ref` also takes a `stack` option for pulling a resource
+out of a *different* stack:
+
+```typescript
+const project = yield* Neon.Project.ref("app-db", {
+  stack: "shared-infra",
+  stage: "prod",
+});
+```
+
+The lookup is `{ stack, stage, id }` — change any of them and
+you're pointing at a different deployed resource. For pulling a
+whole stack's outputs (instead of a single resource) see the
+multi-stack section of [Monorepos](/guides/monorepo).
+
+## When to use which
+
+| Goal                                        | Use                                            |
+| ------------------------------------------- | ---------------------------------------------- |
+| Reference a single resource, same stack, different stage | `Resource.ref(id, { stage })`            |
+| Reference a single resource, different stack | `Resource.ref(id, { stack, stage })`           |
+| Reference an entire stack's outputs         | `Backend.stage[name]` ([guide](/guides/monorepo))             |
+| Reference an arbitrary deployed Output      | [`Output.ref`](/concepts/outputs#ref)          |
+
+All four resolve through the same state store — they just differ
+in what shape they return.
+
+## Related
+
+- [Resource](/concepts/resource#ref) — `Resource.ref` reference.
+- [Stages](/concepts/stages) — naming conventions for `pr-*`,
+  `dev_*`, `staging`, `prod`.
+- [Monorepos](/guides/monorepo) — whole-stack references via
+  typed `Stack` handles.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/api-gateway.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/api-gateway.mdx
new file mode 100644
index 00000000000..bffab9ce623
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/api-gateway.mdx
@@ -0,0 +1,74 @@
+---
+title: REST API (API Gateway v1)
+description: Expose a Lambda with a regional Amazon API Gateway REST API using RestApi, Resource, Method, Deployment, and Stage primitives.
+sidebar:
+  order: 8
+---
+
+The [Deploy a Lambda Function](/tutorial/aws/lambda) tutorial uses a **Function URL** for HTTP. Many teams still use **Amazon API Gateway** (REST, v1) as the front door.
+
+Alchemy models the v1 REST control plane as separate resources so you can wire integrations, stages, and custom domains explicitly.
+
+## Try the example
+
+The repo includes **`examples/aws-rest-api`**: a minimal **regional** REST API with `ANY` on the root and a `{proxy+}` resource, **AWS_PROXY** integration to a Lambda, then **Deployment**, **Stage** (`prod`), and **Lambda.Permission** so API Gateway can invoke the function.
+
+```sh
+cd examples/aws-rest-api
+bun install
+bun run deploy
+```
+
+After deploy, open the printed `invokeUrl` in a browser; you should see the Lambda’s text response.
+
+## Shape of the stack
+
+Typical order inside `Effect.gen`:
+
+1. **`AWS.ApiGateway.RestApi`** — creates the API and exposes `restApiId` / `rootResourceId`.
+2. **`AWS.ApiGateway.Resource`** — optional path segments (e.g. `{proxy+}`).
+3. **`AWS.ApiGateway.Method`** — HTTP verb + integration (`AWS_PROXY` Lambda ARNs use `Output.interpolate` with `arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/${functionArn}/invocations`).
+4. **`AWS.ApiGateway.Deployment`** — snapshots the current resource graph; change **`triggers`** (or other props) to force a new deployment when only integrations changed.
+5. **`AWS.ApiGateway.Stage`** — attaches a deployment to a named stage (`prod`, `dev`, …).
+6. **`AWS.Lambda.Permission`** — `principal: "apigateway.amazonaws.com"` and `sourceArn` covering `execute-api` for your API.
+
+Use **`yield* AWS.AWSEnvironment`** for `region` and `accountId` when building ARNs (as in the example).
+
+## Private integration (VPC link)
+
+For **private** HTTP integrations, create a **`AWS.ApiGateway.VpcLink`** with your load balancer target ARNs, then reference `vpcLinkId` as **`integration.connectionId`** with **`connectionType: "VPC_LINK"`** on `AWS.ApiGateway.Method` (`integration.uri` points at your private backend URL).
+
+```typescript
+const link = yield* AWS.ApiGateway.VpcLink("InternalLink", {
+  name: "internal-nlb",
+  targetArns: [loadBalancer.loadBalancerArn],
+});
+
+yield* AWS.ApiGateway.Method("PrivateGet", {
+  restApiId: api.restApiId,
+  resourceId: resource.resourceId,
+  httpMethod: "GET",
+  integration: {
+    type: "HTTP_PROXY",
+    integrationHttpMethod: "GET",
+    uri: "https://api.internal.example/resource",
+    connectionType: "VPC_LINK",
+    connectionId: link.vpcLinkId,
+  },
+});
+```
+
+See also [VpcLink](/providers/aws/apigateway/vpclink) in the generated API reference.
+
+## API reference
+
+Generated docs for each primitive live under **Providers → AWS → ApiGateway** in the sidebar (for example [RestApi](/providers/aws/apigateway/restapi)). Run `bun generate:api-reference` locally after changing JSDoc on resources.
+
+## Next steps
+
+- **Custom domains:** `AWS.ApiGateway.DomainName` and `AWS.ApiGateway.BasePathMapping`.
+- **API keys / throttling:** `ApiKey`, `UsagePlan`, `UsagePlanKey`.
+- **Authorizers:** `Authorizer` for Cognito or Lambda TOKEN / REQUEST flows.
+- **Gateway responses:** `GatewayResponse` for consistent 4xx/5xx bodies.
+
+HTTP APIs (v2) are a different product; this tutorial is **REST v1** only.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/dynamodb-streams.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/dynamodb-streams.mdx
new file mode 100644
index 00000000000..96521103127
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/dynamodb-streams.mdx
@@ -0,0 +1,193 @@
+---
+title: Process DynamoDB Streams
+description: Enable a DynamoDB Stream on your table and consume change records as a typed Effect Stream from the same Lambda.
+sidebar:
+  order: 5
+---
+
+The DynamoDB table from the previous part stores records, but
+writes happen in the dark — there's no way for downstream systems
+to react. **DynamoDB Streams** fix that: every change to the
+table emits a change record (insert / modify / remove) you can
+stream into a Lambda. In Alchemy this is one helper call.
+
+## Subscribe to the stream
+
+Start with the smallest possible subscription: log just the
+event name (`INSERT` / `MODIFY` / `REMOVE`) for each change.
+Add it alongside the existing bindings:
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
+import * as DynamoDB from "alchemy/AWS/DynamoDB";
++import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
++import * as Stream from "effect/Stream";
+// ...
+
+const table = yield* DynamoDB.Table("Items", { /* ... */ });
+const putItem = yield* DynamoDB.PutItem.bind(table);
+const getItem = yield* DynamoDB.GetItem.bind(table);
+
++yield* DynamoDB.stream(table).process((stream) =>
++  stream.pipe(
++    Stream.runForEach((record) =>
++      Console.log(`${record.eventName}: ${record.dynamodb.Keys?.id?.S}`),
++    ),
++  ),
++);
+```
+
+That single `.process(...)` call enables a stream on the table,
+creates a Lambda `EventSourceMapping` that polls it, and adds
+the IAM grants for `dynamodb:GetRecords`, `GetShardIterator`,
+`DescribeStream`, and `ListStreams` — all from the call site.
+
+## Pick the view type
+
+By default the stream emits keys only. Most handlers want the
+full row before and after the change — set `streamViewType` to
+`NEW_AND_OLD_IMAGES`:
+
+```diff lang="typescript"
+-yield* DynamoDB.stream(table).process((stream) =>
++yield* DynamoDB.stream(table, {
++  streamViewType: "NEW_AND_OLD_IMAGES",
++}).process((stream) =>
+  stream.pipe(/* ... */),
+);
+```
+
+The other options (`KEYS_ONLY`, `NEW_IMAGE`, `OLD_IMAGE`) trade
+payload size for less detail — pick the smallest one your
+handler actually needs.
+
+## Control where consumption starts
+
+`startingPosition: "LATEST"` is the default and ignores history;
+the consumer only sees records that arrive after the
+event-source mapping is enabled. Switch to `"TRIM_HORIZON"` to
+replay everything currently in the stream's 24-hour retention
+window:
+
+```diff lang="typescript"
+yield* DynamoDB.stream(table, {
+  streamViewType: "NEW_AND_OLD_IMAGES",
++  startingPosition: "TRIM_HORIZON",
++  batchSize: 10,
+}).process((stream) =>
+  stream.pipe(/* ... */),
+);
+```
+
+`batchSize` caps the number of records the function sees per
+invocation. Larger batches are more efficient; smaller batches
+fail in smaller blast radii.
+
+## Type the row payload
+
+DynamoDB stream records use the same attribute-value shape as
+`GetItem`/`PutItem`. Describe the row inline as a generic on
+`.process` and TypeScript will help you destructure
+`NewImage`/`OldImage`:
+
+```diff lang="typescript"
+yield* DynamoDB.stream(table, {
+  streamViewType: "NEW_AND_OLD_IMAGES",
+  startingPosition: "TRIM_HORIZON",
+  batchSize: 10,
+-}).process((stream) =>
++}).process<{ id: { S: string }; content: { S: string } }>((stream) =>
+  stream.pipe(
+    Stream.runForEach((record) =>
+-      Console.log(`${record.eventName}: ${record.dynamodb.Keys?.id?.S}`),
++      Console.log(
++        `${record.eventName}: ${record.dynamodb.Keys?.id?.S} -> ` +
++          `${record.dynamodb.NewImage?.content.S ?? "(deleted)"}`,
++      ),
+    ),
+  ),
+);
+```
+
+## Provide the runtime layer
+
+The Lambda-specific implementation of `TableEventSource` is in
+`Lambda.TableEventSource`. Add it to the merged layer:
+
+```diff lang="typescript"
+}).pipe(
+  Effect.provide(
+    Layer.mergeAll(
+      AWS.Lambda.BucketEventSource,
++      AWS.Lambda.TableEventSource,
+      DynamoDB.GetItemLive,
+      DynamoDB.PutItemLive,
+      S3.PutObjectLive,
+      S3.GetObjectLive,
+    ),
+  ),
+),
+```
+
+`TableEventSource` is the binding that mutates the table's stream
+configuration during deploy and creates the event source mapping.
+You don't have to think about either — they're both side effects
+of `.process(...)`.
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Alchemy enables the stream on the table (takes a few seconds for
+the table to settle) then creates the event source mapping. Once
+the mapping is `Enabled`, every `PutItem`/`UpdateItem`/`DeleteItem`
+shows up in your function's CloudWatch logs.
+
+## Verify
+
+Reuse the `PUT /items/:id` route to publish changes, then tail
+the function logs to confirm they arrive:
+
+```sh
+bun alchemy logs Api --follow
+```
+
+In another terminal:
+
+```sh
+curl -X PUT --data 'first' "$URL/items/one"
+curl -X PUT --data 'second' "$URL/items/two"
+curl -X PUT --data 'updated' "$URL/items/one"
+```
+
+You'll see three `MODIFY`/`INSERT` log lines stream past — one
+per write. Stream records typically arrive within 1–2 seconds of
+the originating change.
+
+## Why a Stream instead of a callback?
+
+The `process(handler)` signature mirrors the S3 events helper for
+a reason — once your event source is a typed `Stream<Record>`,
+back-pressure, batching, retries, parallel side effects, and
+in-order processing are all just composition:
+
+```typescript
+stream.pipe(
+  Stream.groupedWithin(50, "5 seconds"),
+  Stream.mapEffect((batch) => writeToWarehouse(batch), { concurrency: 4 }),
+  Stream.runDrain,
+);
+```
+
+The same operators work for DynamoDB Streams, S3 events, SQS
+messages, and Kinesis records — the only thing that changes is
+the element type.
+
+Next we'll add an [SQS Queue](/tutorial/aws/sqs) so the Lambda
+can fan changes (or anything else) out to a different consumer
+process and pick them up downstream.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/dynamodb.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/dynamodb.mdx
new file mode 100644
index 00000000000..77a00d8be6a
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/dynamodb.mdx
@@ -0,0 +1,182 @@
+---
+title: Store Records in DynamoDB
+description: Add a DynamoDB Table, bind GetItem and PutItem to your Lambda, and serve a typed key/value HTTP API backed by DynamoDB.
+sidebar:
+  order: 4
+---
+
+S3 is great for blobs, but most applications want **structured
+records** they can look up by key. In this part you'll add a
+**DynamoDB Table** to your Stack and bind `GetItem` + `PutItem`
+to the Lambda — same pattern as S3, different storage.
+
+## Define the table
+
+DynamoDB tables need a partition key (and optionally a sort key)
+declared up-front. Yield the `Table` resource in the function's
+outer init, mirroring how you added the bucket:
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
++import * as DynamoDB from "alchemy/AWS/DynamoDB";
+import * as S3 from "alchemy/AWS/S3";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+// ...
+
+Effect.gen(function* () {
+  const bucket = yield* S3.Bucket("Blobs");
++  const table = yield* DynamoDB.Table("Items", {
++    partitionKey: "id",
++    attributes: {
++      id: "S",
++    },
++  });
+
+  // ... existing bindings + handler ...
+});
+```
+
+`attributes` only needs to list the attributes used by keys (and
+secondary indexes) — DynamoDB itself is schemaless on the rest of
+the row. `"S"` is the AWS shorthand for "string"; `"N"` is number
+and `"B"` is binary.
+
+## Bind GetItem and PutItem
+
+Same shape as the S3 bindings — `bind(table)` returns a callable
+Effect and quietly attaches a least-privilege IAM policy scoped to
+this table's ARN:
+
+```diff lang="typescript"
+Effect.gen(function* () {
+  const bucket = yield* S3.Bucket("Blobs");
+  const table = yield* DynamoDB.Table("Items", { /* ... */ });
+
+  const putObject = yield* S3.PutObject.bind(bucket);
+  const getObject = yield* S3.GetObject.bind(bucket);
++  const putItem = yield* DynamoDB.PutItem.bind(table);
++  const getItem = yield* DynamoDB.GetItem.bind(table);
+
+  return { fetch: /* ... */ };
+});
+```
+
+## Write items with `PUT /items/:id`
+
+Add a branch to `fetch` that writes a row keyed by the URL
+segment. DynamoDB takes attribute values in their native typed
+form — `{ S: "..." }` for strings, `{ N: "42" }` for numbers —
+and Alchemy bindings deliberately **don't** auto-marshal so you
+stay on the raw SDK shape:
+
+```diff lang="typescript"
+fetch: Effect.gen(function* () {
+  const request = yield* HttpServerRequest;
+  const url = new URL(request.url);
+  const path = url.pathname;
+
++  if (path.startsWith("/items/") && request.method === "PUT") {
++    const id = path.slice("/items/".length);
++    const content = yield* request.text;
++    yield* putItem({
++      Item: {
++        id: { S: id },
++        content: { S: content },
++      },
++    });
++    return HttpServerResponse.empty({ status: 204 });
++  }
+
+  // ... existing /:key blob routes ...
+}).pipe(Effect.orDie),
+```
+
+Skipping marshalling keeps the binding tiny and avoids a
+debate over which marshalling layer to use. If you want a
+typed-object API across your codebase, build it as a thin
+wrapper around `putItem` — the binding won't fight you.
+
+## Read items with `GET /items/:id`
+
+The read path uses `getItem` with the same `{ S: id }` key
+shape:
+
+```diff lang="typescript"
+if (path.startsWith("/items/") && request.method === "PUT") {
+  // ... unchanged ...
+}
+
++if (path.startsWith("/items/") && request.method === "GET") {
++  const id = path.slice("/items/".length);
++  const result = yield* getItem({ Key: { id: { S: id } } });
++  if (!result.Item) {
++    return HttpServerResponse.text("Not found", { status: 404 });
++  }
++  return yield* HttpServerResponse.json({
++    id: result.Item.id?.S,
++    content: result.Item.content?.S,
++  });
++}
+```
+
+`getItem` returns `result.Item` as `undefined` when the row
+doesn't exist — no need for a typed `catchTag` like S3's
+`NoSuchKey`. Map the AWS attribute-value shape back to a plain
+object at the response boundary.
+
+## Provide the runtime layers
+
+Add the DynamoDB lives next to the S3 ones:
+
+```diff lang="typescript"
+}).pipe(
+  Effect.provide(
+    Layer.mergeAll(
+      AWS.Lambda.BucketEventSource,
++      DynamoDB.GetItemLive,
++      DynamoDB.PutItemLive,
+      S3.PutObjectLive,
+      S3.GetObjectLive,
+    ),
+  ),
+),
+```
+
+## Deploy and verify
+
+```sh
+bun alchemy deploy
+```
+
+Add a round-trip test that exercises the new routes:
+
+```typescript
+// test/integ.test.ts
+test(
+  "DynamoDB round-trip",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    yield* HttpClient.put(`${url}/items/abc`, {
+      body: HttpBody.text("hello dynamo"),
+    });
+
+    const get = yield* HttpClient.get(`${url}/items/abc`);
+    expect(yield* get.json).toEqual({ id: "abc", content: "hello dynamo" });
+  }),
+);
+```
+
+```sh
+bun test test/integ.test.ts
+```
+
+The IAM policy attached to your function role now includes
+`dynamodb:GetItem` and `dynamodb:PutItem` — both scoped to this
+specific table — alongside the S3 grants.
+
+Next you'll [process DynamoDB Streams](/tutorial/aws/dynamodb-streams)
+so changes to the table fan out into a Lambda-side `Stream` you
+can react to.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/kinesis.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/kinesis.mdx
new file mode 100644
index 00000000000..12d7e863b0a
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/kinesis.mdx
@@ -0,0 +1,283 @@
+---
+title: Stream Records with Kinesis
+description: Add a Kinesis Data Stream, publish records from one Lambda, and consume them in order from another — wired through the same Stream-shaped event source.
+sidebar:
+  order: 7
+---
+
+SQS is great for unordered work. **Kinesis Data Streams** are the
+right tool when you need **ordered** delivery within a partition,
+high throughput, replay from arbitrary points in time, and
+multiple independent consumers reading the same records. In this
+final part of the AWS track you'll add a Kinesis stream, publish
+to it from your producer Lambda, and consume it from a new
+worker.
+
+## Add the stream
+
+Lift the Kinesis stream into a shared module the same way you
+did with the SQS queue, so both producer and consumer can
+import the same handle:
+
+```typescript
+// src/stream.ts
+import * as Kinesis from "alchemy/AWS/Kinesis";
+
+export const Events = Kinesis.Stream("Events", {
+  streamMode: "ON_DEMAND",
+});
+```
+
+`"ON_DEMAND"` lets AWS auto-scale the shards based on load —
+fine for the example. Switch to `"PROVISIONED"` with an explicit
+`shardCount` when you know your throughput.
+
+## Bind PutRecord on the producer
+
+```diff lang="typescript"
+// src/api.ts
+import * as DynamoDB from "alchemy/AWS/DynamoDB";
++import * as Kinesis from "alchemy/AWS/Kinesis";
+import * as S3 from "alchemy/AWS/S3";
+import * as SQS from "alchemy/AWS/SQS";
+import { Jobs } from "./queue.ts";
++import { Events } from "./stream.ts";
+// ...
+
+const queue = yield* Jobs;
++const events = yield* Events;
+const sendMessage = yield* SQS.SendMessage.bind(queue);
++const putRecord = yield* Kinesis.PutRecord.bind(events);
+```
+
+The shape mirrors every other binding you've seen: `bind(stream)`
+returns a callable Effect, plus an IAM policy with
+`kinesis:PutRecord` scoped to this stream's ARN.
+
+## Publish a record
+
+Use `putRecord` inside the `PUT /items/:id` route — alongside
+the SQS publish — to send an ordered audit record for each
+write:
+
+```diff lang="typescript"
+yield* sendMessage({
+  MessageBody: JSON.stringify({ type: "job.created", id, content }),
+});
++yield* putRecord({
++  PartitionKey: id,
++  Data: new TextEncoder().encode(
++    JSON.stringify({ type: "job.created", id, content, at: Date.now() }),
++  ),
++});
+```
+
+`PartitionKey` controls which shard a record lands in. All
+records with the same partition key are delivered in order to
+the same consumer instance — the entity id is exactly what you
+want here.
+
+`Data` is an arbitrary `Uint8Array`, not a string. JSON-encoded
+UTF-8 bytes are the most common payload but you can ship Avro,
+protobuf, or raw blobs without changing the binding.
+
+## Provide the runtime layer
+
+```diff lang="typescript"
+}).pipe(
+  Effect.provide(
+    Layer.mergeAll(
+      // ... existing layers ...
++      Kinesis.PutRecordLive,
+      SQS.SendMessageLive,
+    ),
+  ),
+),
+```
+
+## Stand up a consumer Lambda
+
+Create `src/audit.ts` with a bare consumer shell — no event
+source yet, just the empty class importing the shared stream
+handle:
+
+```typescript
+// src/audit.ts
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+import { Events } from "./stream.ts";
+
+export default class Audit extends AWS.Lambda.Function<Audit>()(
+  "Audit",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const events = yield* Events;
+    return {};
+  }),
+) {}
+```
+
+## Subscribe to records
+
+`Kinesis.records(stream).process(...)` mirrors the SQS
+`messages(...).subscribe(...)` shape from the previous part.
+Add the smallest possible subscription — log each record's
+partition key:
+
+```diff lang="typescript"
+// src/audit.ts
+import * as AWS from "alchemy/AWS";
++import * as Kinesis from "alchemy/AWS/Kinesis";
++import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
++import * as Stream from "effect/Stream";
+import { Events } from "./stream.ts";
+
+export default class Audit extends AWS.Lambda.Function<Audit>()(
+  "Audit",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const events = yield* Events;
++
++    yield* Kinesis.records(events, {
++      startingPosition: "LATEST",
++      batchSize: 100,
++    }).process((stream) =>
++      stream.pipe(
++        Stream.runForEach((record) =>
++          Console.log(`[${record.kinesis.partitionKey}]`),
++        ),
++      ),
++    );
+
+    return {};
+  }),
+) {}
+```
+
+`batchSize: 100` lets Lambda gather up to 100 records per
+invocation; the whole batch is delivered as one stream emission
+sequence, then the stream completes and Lambda checkpoints.
+`startingPosition: "LATEST"` skips history — switch to
+`"TRIM_HORIZON"` to replay the 24-hour retention window.
+
+## Decode the binary payload
+
+Kinesis record data arrives base64-encoded inside the Lambda
+envelope (an artifact of the event shape, not the stream
+itself). Decode it back to bytes and on to a string, and run
+the work as an Effect per record:
+
+```diff lang="typescript"
+yield* Kinesis.records(events, {
+  startingPosition: "LATEST",
+  batchSize: 100,
+}).process((stream) =>
+  stream.pipe(
+-    Stream.runForEach((record) =>
+-      Console.log(`[${record.kinesis.partitionKey}]`),
+-    ),
++    Stream.mapEffect((record) =>
++      Effect.gen(function* () {
++        const text = new TextDecoder().decode(
++          Buffer.from(record.kinesis.data, "base64"),
++        );
++        yield* Console.log(`[${record.kinesis.partitionKey}] ${text}`);
++      }),
++    ),
++    Stream.runDrain,
+  ),
+);
+```
+
+## Provide the runtime layer
+
+`Lambda.StreamEventSource` is the binding that enables the event
+source mapping and grants `kinesis:GetRecords`,
+`GetShardIterator`, `DescribeStream`, and `ListShards` on the
+stream ARN. Provide it at the bottom of the function:
+
+```diff lang="typescript"
+    return {};
+-  }),
++  }).pipe(Effect.provide(AWS.Lambda.StreamEventSource)),
+) {}
+```
+
+## Wire the consumer into the Stack
+
+```diff lang="typescript"
+// alchemy.run.ts
+import Api from "./src/api.ts";
++import Audit from "./src/audit.ts";
+import Worker from "./src/worker.ts";
+
+Effect.gen(function* () {
+  const api = yield* Api;
+  yield* Worker;
++  yield* Audit;
+  return { url: api.functionUrl };
+}),
+```
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Three functions now coexist: `Api` produces records, `Worker`
+consumes the SQS queue, and `Audit` consumes the Kinesis stream.
+Each one gets a least-privilege policy that names exactly the
+resources its `bind`/`subscribe`/`process` calls touched — no
+`"*"`, no IAM JSON to maintain.
+
+## Verify
+
+```sh
+curl -X PUT --data 'audit me' "$URL/items/k1"
+bun alchemy logs Audit --follow
+```
+
+You'll see a line like:
+
+```
+[k1] {"type":"job.created","id":"k1","content":"audit me","at":1718000000000}
+```
+
+Subsequent writes against the same `id` (`k1`) all land in the
+same shard and arrive in order at the same `Audit` invocation
+context — that's the ordering guarantee Kinesis provides per
+partition key.
+
+## Bonus: in-order side effects
+
+Because each batch is delivered as a `Stream`, **per-shard ordering
+is preserved end-to-end**. If you need strict ordering for side
+effects, drop the concurrency to 1 and let the stream do the work:
+
+```typescript
+stream.pipe(
+  Stream.mapEffect(
+    (record) => persistInOrder(record).pipe(Effect.orDie),
+    { concurrency: 1 },
+  ),
+  Stream.runDrain,
+);
+```
+
+Or fan out per-partition with `Stream.groupByKey(record => record.kinesis.partitionKey)`
+when ordering only matters within a key.
+
+## What you've built
+
+Across the AWS track you've gone from a single Lambda to a small
+event-driven system: a public HTTP API backed by S3 blobs and a
+DynamoDB table, table change events on a stream, an SQS work
+queue, and a high-throughput Kinesis pipeline — all wired through
+the same binding pattern, with IAM policies that match exactly
+the operations you call. The same `Stream`-shaped consumer
+surface drives every event source you've added, so adding more
+(SNS topics, EventBridge buses, Step Functions invocations) is
+a matter of declaring the resource and pointing `.subscribe` /
+`.process` at it.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/lambda.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/lambda.mdx
new file mode 100644
index 00000000000..34ddcdd3dad
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/lambda.mdx
@@ -0,0 +1,275 @@
+---
+title: Deploy a Lambda Function
+description: Stand up an AWS Lambda Function from a single Effect, expose it over a Function URL, and call it from a test.
+sidebar:
+  order: 1
+---
+
+In this part you'll stand up the smallest piece of compute AWS
+offers — a single **Lambda Function** with a public **Function
+URL** — and grow it across the rest of this section into S3,
+DynamoDB, SQS, and Kinesis.
+
+## Prerequisites
+
+- [Bun](https://bun.sh) (recommended) or Node.js 22+.
+- An AWS account with credentials available locally (an SSO
+  profile, `~/.aws/credentials`, or `AWS_*` environment variables).
+- The AWS profile you want to use exported as `AWS_PROFILE` (or
+  `default` will be used).
+
+## Create a project
+
+Start with an empty directory and install Alchemy and Effect:
+
+```sh
+mkdir my-app && cd my-app && bun init -y
+bun add alchemy@next effect @effect/platform-bun
+```
+
+## Create the Stack
+
+Every Alchemy app has an `alchemy.run.ts` at the root that
+declares the resources to deploy. Create one with the AWS
+providers wired in:
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: AWS.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
+    return {};
+  }),
+);
+```
+
+`Alchemy.Stack` is the root of every app. The first argument
+(`"MyApp"`) doubles as a logical id and as the prefix Alchemy
+uses when AWS asks for physical resource names.
+
+`providers: AWS.providers()` registers every AWS resource and
+IAM policy binding that ships with Alchemy, and resolves
+credentials from the ambient `AWS_PROFILE` (defaulting to
+`default`).
+
+`state: Alchemy.localState()` stores deploy state under
+`.alchemy/` next to your code — good enough for local iteration;
+remote state for CI is covered later.
+
+The trailing `Effect.gen` block is where you'll declare the
+resources to deploy. It's empty for now.
+
+:::tip[Pinning a region or profile per stage]
+`AWS.providers()` reads `AWS_PROFILE` and `AWS_REGION` at deploy
+time. To pin a different profile or region per stage, wrap the
+layer with `Layer.provide(AWS.makeEnvironment({ profile, region }))`.
+:::
+
+## Declare a Lambda Function
+
+A Lambda Function in Alchemy is a class. Create `src/api.ts`
+with the smallest possible declaration — just the class
+ceremony, an entrypoint, and an empty runtime:
+
+```typescript
+// src/api.ts
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+
+export default class Api extends AWS.Lambda.Function<Api>()(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    return {};
+  }),
+) {}
+```
+
+The `<Api>` type argument plus the empty `()` is a one-time bit
+of ceremony — it lets TypeScript reason about `Api` as a typed
+handle that other resources can later bind against. The rest of
+your code looks completely normal.
+
+`main: import.meta.filename` tells Alchemy this same file is the
+bundle entrypoint. At deploy time it'll be bundled with Rolldown
+into a zip and uploaded as the function's code.
+
+## Serve HTTP from a Function URL
+
+The empty function compiles, but it doesn't do anything yet.
+Add a `fetch` field — Alchemy treats anything returned from the
+`Effect.gen` block as the runtime API, and `fetch` specifically
+is wired up to handle incoming HTTP requests:
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
++import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default class Api extends AWS.Lambda.Function<Api>()(
+  "Api",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+-    return {};
++    return {
++      fetch: Effect.succeed(HttpServerResponse.text("Hello from Lambda!")),
++    };
+  }),
+) {}
+```
+
+`HttpServerResponse.text(...)` is the same `effect/unstable/http`
+API used everywhere else — Alchemy adapts it to the Lambda event
+envelope under the hood, so your handler never sees the raw
+`APIGatewayProxyEvent` shape.
+
+## Expose a public URL
+
+`fetch` exists, but no one can call it yet. Set `url: true` on
+the props to ask AWS for a public **Function URL** — no API
+Gateway, no auth, just a public HTTPS endpoint:
+
+```diff lang="typescript"
+export default class Api extends AWS.Lambda.Function<Api>()(
+  "Api",
+-  { main: import.meta.filename },
++  { main: import.meta.filename, url: true },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.succeed(HttpServerResponse.text("Hello from Lambda!")),
+    };
+  }),
+) {}
+```
+
+The resolved `Api` resource will now expose a `functionUrl`
+field carrying that endpoint — we'll surface it from the Stack
+in a moment.
+
+## Customize per stage
+
+Lambda has knobs you'll want to tune per stage — memory,
+timeout, log retention. Swap the static props object for
+`Stack.useSync`, which gives you a synchronous accessor for any
+value in the surrounding Effect context:
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
++import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default class Api extends AWS.Lambda.Function<Api>()(
+  "Api",
+-  { main: import.meta.filename, url: true },
++  Stack.useSync((stack) => ({
++    main: import.meta.filename,
++    url: true,
++    memory: stack.stage === "prod" ? 1024 : 512,
++  })),
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.succeed(HttpServerResponse.text("Hello from Lambda!")),
+    };
+  }),
+) {}
+```
+
+`Stack.useSync` is the synchronous accessor for any value in the
+surrounding Effect context — handy for stack-level config like
+`stage`, `appName`, or anything else you'd want to vary per
+environment.
+
+## Wire the function into the Stack
+
+The `Api` class is just a typed identifier — yielding it inside
+the Stack's Effect is what registers the resource and starts the
+deploy:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
++import Api from "./src/api.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: AWS.providers(),
+    state: Alchemy.localState(),
+  },
+  Effect.gen(function* () {
++    const api = yield* Api;
++    return { url: api.functionUrl };
+-    return {};
+  }),
+);
+```
+
+Yielding `Api` returns the resolved Lambda outputs — the function
+ARN, role ARN, log group, and the public Function URL we asked
+for with `url: true`. We surface `functionUrl` as the Stack's
+`url` so the test harness can find it.
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Alchemy bundles `src/api.ts` with Rolldown, packages it into a
+zip, creates the IAM execution role, uploads the function, and
+provisions the Function URL. The first deploy takes a moment
+because of role propagation; subsequent deploys are seconds.
+
+## Verify
+
+Drop a quick integration test that hits the Function URL and
+checks the body:
+
+```typescript
+// test/integ.test.ts
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: AWS.providers(),
+  state: Alchemy.localState(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+test(
+  "Api responds over Function URL",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const response = yield* HttpClient.get(url);
+    expect(yield* response.text).toBe("Hello from Lambda!");
+  }),
+);
+```
+
+```sh
+bun test test/integ.test.ts
+```
+
+You now have a deployable Lambda with a public URL. Next we'll
+add an [S3 Bucket](/tutorial/aws/s3) and bind read/write
+operations into the function — IAM policies generated from the
+call sites, no policy JSON to hand-write.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/s3-events.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/s3-events.mdx
new file mode 100644
index 00000000000..925004c753b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/s3-events.mdx
@@ -0,0 +1,198 @@
+---
+title: React to S3 Events
+description: Subscribe a Lambda Function to S3 bucket notifications, process them as an Effect Stream, and let Alchemy wire up the IAM and event-source plumbing.
+sidebar:
+  order: 3
+---
+
+Reading and writing S3 objects on demand is one half of the story.
+The other half is **reacting** to objects as they arrive — for
+indexing, virus scanning, thumbnail generation, you name it. In
+this part you'll subscribe the same Lambda from the previous part
+to bucket notifications and process them as an Effect `Stream`.
+
+## Subscribe to bucket notifications
+
+Bucket notifications live behind an Alchemy helper:
+`S3.notifications(bucket).subscribe(process)`. Add the smallest
+possible subscription — log every new object's key — alongside
+the existing bindings:
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
+import * as S3 from "alchemy/AWS/S3";
++import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
++import * as Stream from "effect/Stream";
+// ...
+
+Effect.gen(function* () {
+  const bucket = yield* S3.Bucket("Blobs");
+  const putObject = yield* S3.PutObject.bind(bucket);
+  const getObject = yield* S3.GetObject.bind(bucket);
+
++  yield* S3.notifications(bucket).subscribe((stream) =>
++    stream.pipe(
++      Stream.runForEach((event) =>
++        Console.log(`new object: ${event.key}`),
++      ),
++    ),
++  );
+
+  return {
+    fetch: /* ... unchanged ... */,
+  };
+});
+```
+
+That single `yield*` does three things in one shot: it
+configures the bucket's notification settings to push events
+into the function, adds the `lambda:InvokeFunction` permission
+S3 needs to call you, and registers the stream handler that
+runs every time an event batch lands.
+
+## Filter the event types
+
+Without a filter you get every notification S3 emits — object
+created, deleted, restored, replicated, the lot. Constrain the
+subscription to a specific subset with `events`:
+
+```diff lang="typescript"
+-yield* S3.notifications(bucket).subscribe((stream) =>
++yield* S3.notifications(bucket, {
++  events: ["s3:ObjectCreated:*"],
++}).subscribe((stream) =>
+  stream.pipe(
+    Stream.runForEach((event) =>
+      Console.log(`new object: ${event.key}`),
+    ),
+  ),
+);
+```
+
+The `events` filter is type-checked against the AWS S3 event
+catalog, so typos surface at the call site rather than at deploy
+time.
+
+## What the stream actually carries
+
+`stream` is a `Stream.Stream<BucketNotification>` — a normalized
+shape with `type`, `bucket`, `key`, `size`, and `eTag`. Each
+Lambda invocation delivers one batch as one stream emission
+sequence, then completes; the next invocation starts a fresh
+stream. Treating events as a `Stream` means the usual operators
+(`mapEffect`, `groupedWithin`, `mapAccum`) work without thinking
+about the Lambda payload envelope.
+
+## Provide the runtime layer
+
+The runtime side of the subscription lives in
+`Lambda.BucketEventSource`. It's the layer that turns the abstract
+`BucketEventSource` capability into a concrete Lambda event-source
+mapping plus IAM grant. Add it alongside the S3 bindings:
+
+```diff lang="typescript"
+}).pipe(
+  Effect.provide(
+-    Layer.mergeAll(S3.PutObjectLive, S3.GetObjectLive),
++    Layer.mergeAll(
++      AWS.Lambda.BucketEventSource,
++      S3.PutObjectLive,
++      S3.GetObjectLive,
++    ),
+  ),
+),
+```
+
+`BucketEventSource` and the `PutObject`/`GetObject` lives are all
+peers here — none of them require each other — so a flat
+`Layer.mergeAll(...)` is enough.
+
+## Run an Effect per event
+
+Logging is a good smoke test, but a real handler usually wants
+to do something async per event. Swap `runForEach` for
+`mapEffect` so each event runs through a generator block:
+
+```diff lang="typescript"
+yield* S3.notifications(bucket, {
+  events: ["s3:ObjectCreated:*"],
+}).subscribe((stream) =>
+  stream.pipe(
+-    Stream.runForEach((event) =>
+-      Console.log(`new object: ${event.key}`),
+-    ),
++    Stream.mapEffect((event) =>
++      Console.log(`new object: ${event.key}`),
++    ),
++    Stream.runDrain,
++  ),
+);
+```
+
+`Stream.runDrain` consumes the stream without collecting — we
+only care about the side effects, not the return values.
+
+## Read the object back
+
+`getObject` is already bound to the bucket, so the per-event
+Effect can fetch the new object's contents inline:
+
+```diff lang="typescript"
+stream.pipe(
+  Stream.mapEffect((event) =>
+-    Console.log(`new object: ${event.key}`),
++    Effect.gen(function* () {
++      const result = yield* getObject({ Key: event.key });
++      const body = yield* result.Body!.pipe(
++        Stream.decodeText,
++        Stream.mkString,
++      );
++      yield* Console.log(`${event.key} -> ${body}`);
++    }).pipe(Effect.orDie),
+  ),
+  Stream.runDrain,
+),
+```
+
+`Stream.mapEffect` is back-pressured by default — events flow
+through one at a time. Pass a `concurrency` option (we'll see it
+in later parts) when you want fan-out.
+
+## Deploy and verify
+
+```sh
+bun alchemy deploy
+```
+
+The CLI applies the new bucket notification configuration and
+redeploys the function with the broader IAM policy. Then trigger
+the subscription end-to-end by `PUT`ing an object via the HTTP
+route from the previous part:
+
+```typescript
+// test/integ.test.ts
+test(
+  "PUT triggers notification handler",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    yield* HttpClient.put(`${url}/notify-me.txt`, {
+      body: HttpBody.text("payload"),
+    });
+    // ...optionally tail CloudWatch logs to assert the message landed
+  }),
+);
+```
+
+You'll see the `notify-me.txt -> payload` line in the function's
+log group within a couple of seconds.
+
+S3 events typically arrive in batches of up to 10 records — the
+same `Stream` is fed each batch and completes between invocations,
+so you get the same composition story whether the batch is one
+event or a hundred.
+
+Next we'll trade blob storage for structured records and
+[add a DynamoDB table](/tutorial/aws/dynamodb).
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/s3.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/s3.mdx
new file mode 100644
index 00000000000..95b5f248293
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/s3.mdx
@@ -0,0 +1,294 @@
+---
+title: Read & Write S3
+description: Add an S3 Bucket to your Stack, bind PutObject and GetObject as runtime capabilities, and let Alchemy mint the IAM policy for you.
+sidebar:
+  order: 2
+---
+
+The Lambda you built in [Deploy a Lambda Function](/tutorial/aws/lambda)
+serves a static string. Real services need somewhere to put data.
+In this part you'll add an **S3 Bucket** for blob storage and bind
+**PutObject** + **GetObject** to the function — Alchemy will mint
+a least-privilege IAM policy from the bindings you actually use.
+
+## Add the bucket
+
+S3 buckets are canonical Alchemy resources, so you create them
+the same way as the Lambda — yield the resource inside an Effect
+and the Stack captures it. Open `src/api.ts` and add a bucket in
+the outer init:
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
++import * as S3 from "alchemy/AWS/S3";
+import { Stack } from "alchemy/Stack";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default class Api extends AWS.Lambda.Function<Api>()(
+  "Api",
+  Stack.useSync((stack) => ({
+    main: import.meta.filename,
+    url: true,
+    memory: stack.stage === "prod" ? 1024 : 512,
+  })),
+  Effect.gen(function* () {
++    const bucket = yield* S3.Bucket("Blobs");
+
+    return {
+      fetch: Effect.succeed(HttpServerResponse.text("Hello from Lambda!")),
+    };
+  }),
+) {}
+```
+
+`yield* S3.Bucket("Blobs")` registers the resource with the Stack
+under the logical id `Blobs` and returns a typed `Bucket` handle.
+Other resources — including this Lambda — can use that handle to
+bind operations or grant access.
+
+## Bind PutObject and GetObject
+
+S3 operations like `s3:PutObject` and `s3:GetObject` are exposed
+as **bindings**. A binding is two things:
+
+1. A typed runtime function you call from your handler.
+2. An IAM policy statement that gets attached to the function
+   role automatically — scoped to the exact bucket ARN.
+
+Bind them in the outer init, alongside the bucket:
+
+```diff lang="typescript"
+Effect.gen(function* () {
+  const bucket = yield* S3.Bucket("Blobs");
++  const putObject = yield* S3.PutObject.bind(bucket);
++  const getObject = yield* S3.GetObject.bind(bucket);
+
+  return {
+    fetch: Effect.succeed(HttpServerResponse.text("Hello from Lambda!")),
+  };
+});
+```
+
+Both `bind(bucket)` calls return a callable Effect: `putObject`
+takes a `PutObjectRequest` (the AWS SDK shape, minus the `Bucket`
+field Alchemy fills in for you) and `getObject` takes a
+`GetObjectRequest`.
+
+### One binding, one IAM statement
+
+Each `.bind(...)` call is **1:1 with an IAM policy statement**
+attached to your function's execution role. The mapping is
+deterministic:
+
+| Code                              | IAM `Action`     | IAM `Resource`           |
+| --------------------------------- | ---------------- | ------------------------ |
+| `S3.PutObject.bind(bucket)`       | `s3:PutObject`   | `bucket.bucketArn`       |
+| `S3.GetObject.bind(bucket)`       | `s3:GetObject`   | `bucket.bucketArn/*`     |
+| `DynamoDB.PutItem.bind(table)`    | `dynamodb:PutItem` | `table.tableArn`       |
+| `SQS.SendMessage.bind(queue)`     | `sqs:SendMessage` | `queue.queueArn`        |
+
+So the two `bind` calls above produce exactly two statements on
+the role:
+
+```json
+[
+  {
+    "Sid": "AWSS3PutObjectBlobs",
+    "Effect": "Allow",
+    "Action": ["s3:PutObject"],
+    "Resource": "arn:aws:s3:::myapp-prod-blobs/*"
+  },
+  {
+    "Sid": "AWSS3GetObjectBlobs",
+    "Effect": "Allow",
+    "Action": ["s3:GetObject"],
+    "Resource": "arn:aws:s3:::myapp-prod-blobs/*"
+  }
+]
+```
+
+The role is generated, never `"*"`-scoped, and regenerated from
+the call sites on every deploy — delete a `bind` call and the
+matching statement disappears next deploy. **The code is the
+policy.**
+
+## Write objects with `PUT /:key`
+
+Replace the static handler with one that takes the URL path as
+the object key and writes the request body to the bucket:
+
+```diff lang="typescript"
+return {
+-  fetch: Effect.succeed(HttpServerResponse.text("Hello from Lambda!")),
++  fetch: Effect.gen(function* () {
++    const request = yield* HttpServerRequest;
++    const key = new URL(request.url).pathname.slice(1);
++
++    if (request.method === "PUT") {
++      const body = yield* request.text;
++      yield* putObject({ Key: key, Body: body });
++      return HttpServerResponse.empty({ status: 204 });
++    }
++
++    return HttpServerResponse.text("Method not allowed", { status: 405 });
++  }),
+};
+```
+
+`putObject({ Key, Body })` is the same shape as
+`s3:PutObject` in the AWS SDK, minus the `Bucket` field — Alchemy
+fills that in from the bucket you bound, so the call site stays
+focused on what's actually variable.
+
+## Read objects with `GET /:key`
+
+Add a `GET` branch that fetches the object and pipes it back to
+the client:
+
+```diff lang="typescript"
+if (request.method === "PUT") {
+  const body = yield* request.text;
+  yield* putObject({ Key: key, Body: body });
+  return HttpServerResponse.empty({ status: 204 });
+}
+
++if (request.method === "GET") {
++  const result = yield* getObject({ Key: key });
++  return HttpServerResponse.stream(result.Body!);
++}
+
+return HttpServerResponse.text("Method not allowed", { status: 405 });
+```
+
+`result.Body` is an Effect `Stream<Uint8Array>`, not a buffered
+`Buffer`. `HttpServerResponse.stream` flushes each chunk to the
+HTTP response as it arrives, so even a multi-gigabyte object
+moves through the function without ever being held in memory.
+
+## Handle missing objects
+
+If the key doesn't exist, the AWS SDK throws `NoSuchKey`. The
+binding surfaces that as a typed error tag on the Effect, so
+`Effect.catchTag` recovers from it without inspecting strings:
+
+```diff lang="typescript"
+if (request.method === "GET") {
+-  const result = yield* getObject({ Key: key });
++  const result = yield* getObject({ Key: key }).pipe(
++    Effect.catchTag("NoSuchKey", () => Effect.succeed(undefined)),
++  );
++  if (!result?.Body) {
++    return HttpServerResponse.text("Not found", { status: 404 });
++  }
+  return HttpServerResponse.stream(result.Body!);
+}
+```
+
+Every binding's failure channel is enumerated this way: the AWS
+SDK error names become Effect tags, so the type-checker tells
+you which failures the call site needs to handle.
+
+## Convert unhandled errors to 500s
+
+Any failure you didn't `catchTag` is a programmer error — a
+missing IAM grant, a transient AWS outage, a bug. Surface those
+as 500s by applying `Effect.orDie` once at the request boundary,
+rather than per call:
+
+```diff lang="typescript"
+fetch: Effect.gen(function* () {
+  // ... PUT and GET branches ...
+  return HttpServerResponse.text("Method not allowed", { status: 405 });
+-}),
++}).pipe(Effect.orDie),
+```
+
+Applying `orDie` once at the outer layer keeps the inner code
+free of repetitive error plumbing — the only errors you handle
+explicitly are the ones you actually have a recovery for
+(`NoSuchKey`, in this case).
+
+## Provide the runtime layers
+
+Bindings declare a capability; **runtime layers** implement it.
+For S3 those are `S3.PutObjectLive` and `S3.GetObjectLive` — both
+ship in `alchemy/AWS/S3` and depend only on the AWS SDK and the
+ambient credentials. Provide them at the bottom of the function:
+
+```diff lang="typescript"
+// src/api.ts
++import * as Layer from "effect/Layer";
+// ...
+export default class Api extends AWS.Lambda.Function<Api>()(
+  "Api",
+  /* ... props ... */,
+  Effect.gen(function* () {
+    /* ... bindings + fetch ... */
+-  }),
++  }).pipe(
++    Effect.provide(Layer.mergeAll(S3.PutObjectLive, S3.GetObjectLive)),
++  ),
+) {}
+```
+
+`Layer.mergeAll` unions multiple layers into one — no order
+required — and `Effect.provide` satisfies the binding requirements
+declared by `PutObject` and `GetObject`.
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Alchemy creates the bucket if it doesn't exist, attaches the
+generated IAM policy to your Lambda's execution role, and
+redeploys the function bundle.
+
+## Verify
+
+```typescript
+// test/integ.test.ts
+import * as Alchemy from "alchemy";
+import * as AWS from "alchemy/AWS";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: AWS.providers(),
+  state: Alchemy.localState(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+test(
+  "S3 round-trip",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+
+    const put = yield* HttpClient.put(`${url}/hello.txt`, {
+      body: HttpBody.text("world"),
+    });
+    expect(put.status).toBe(204);
+
+    const get = yield* HttpClient.get(`${url}/hello.txt`);
+    expect(yield* get.text).toBe("world");
+  }),
+);
+```
+
+```sh
+bun test test/integ.test.ts
+```
+
+You now have a Lambda that owns a bucket, with no IAM JSON in
+sight. Next we'll [react to S3 events](/tutorial/aws/s3-events)
+so the same function can be notified whenever a new object lands
+in the bucket — wired through the same binding pipeline.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/sqs.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/sqs.mdx
new file mode 100644
index 00000000000..96404cfb83c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/aws/sqs.mdx
@@ -0,0 +1,364 @@
+---
+title: Send & Consume SQS Messages
+description: Add an SQS Queue, publish messages from your Lambda, and consume them from a second consumer Lambda — all wired through Alchemy bindings.
+sidebar:
+  order: 6
+---
+
+DynamoDB Streams notify you of **table changes**. Sometimes you
+want a more general-purpose mailbox — anything you can serialize
+to JSON, dropped into a queue, processed asynchronously somewhere
+else. That's what **SQS** is for. In this part you'll add a
+**Queue**, send messages to it from the Lambda you've been
+building, and stand up a **second Lambda** that consumes them.
+
+## Add the queue
+
+```diff lang="typescript"
+// src/api.ts
+import * as AWS from "alchemy/AWS";
+import * as DynamoDB from "alchemy/AWS/DynamoDB";
++import * as SQS from "alchemy/AWS/SQS";
+// ...
+
+Effect.gen(function* () {
+  const bucket = yield* S3.Bucket("Blobs");
+  const table = yield* DynamoDB.Table("Items", { /* ... */ });
++  const queue = yield* SQS.Queue("Jobs");
+
+  // ... existing bindings ...
+});
+```
+
+Calling `SQS.Queue("Jobs")` provisions a standard queue with the
+defaults (4-day retention, 30-second visibility timeout, no
+delivery delay). FIFO queues, dead-letter targets, and the rest
+of the props can be supplied as a second argument when you need
+them.
+
+## Bind SendMessage on the producer
+
+`SQS.SendMessage.bind(queue)` returns a callable Effect — same
+shape as `S3.PutObject` or `DynamoDB.PutItem` — and quietly
+attaches `sqs:SendMessage` scoped to the queue ARN:
+
+```diff lang="typescript"
+const putItem = yield* DynamoDB.PutItem.bind(table);
++const sendMessage = yield* SQS.SendMessage.bind(queue);
+```
+
+Let's hook it into the existing `PUT /items/:id` route so every
+new record also drops a `job.created` message onto the queue:
+
+```diff lang="typescript"
+if (request.method === "PUT") {
+  const content = yield* request.text;
+  yield* putItem({
+    Item: {
+      id: { S: id },
+      content: { S: content },
+    },
+  });
++  yield* sendMessage({
++    MessageBody: JSON.stringify({
++      type: "job.created",
++      id,
++      content,
++    }),
++  });
+  return HttpServerResponse.empty({ status: 204 });
+}
+```
+
+The producer also needs the runtime layer for `SendMessage` —
+add it to the merged layer alongside the others:
+
+```diff lang="typescript"
+}).pipe(
+  Effect.provide(
+    Layer.mergeAll(
+      AWS.Lambda.BucketEventSource,
+      AWS.Lambda.TableEventSource,
+      DynamoDB.GetItemLive,
+      DynamoDB.PutItemLive,
+      S3.PutObjectLive,
+      S3.GetObjectLive,
++      SQS.SendMessageLive,
+    ),
+  ),
+),
+```
+
+## Stand up a consumer Lambda
+
+Consumers live as their own Lambda Function. Create
+`src/worker.ts` — bare shell first, no event source yet:
+
+```typescript
+// src/worker.ts
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
+
+export default class Worker extends AWS.Lambda.Function<Worker>()(
+  "JobsWorker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    return {};
+  }),
+) {}
+```
+
+This consumer doesn't need a Function URL — its only entrypoint
+is the SQS message poller AWS will configure for it.
+
+## Share the queue between two functions
+
+Both producer and consumer need to reference the same queue —
+the cleanest way to do that is to lift the declaration out of
+`api.ts` into a small shared module:
+
+```typescript
+// src/queue.ts
+import * as SQS from "alchemy/AWS/SQS";
+
+export const Jobs = SQS.Queue("Jobs");
+```
+
+Now both functions can import `Jobs`. Update the producer to use
+the shared handle instead of declaring the queue inline:
+
+```diff lang="typescript"
+// src/api.ts
++import { Jobs } from "./queue.ts";
+// ...
+-const queue = yield* SQS.Queue("Jobs");
++const queue = yield* Jobs;
+```
+
+## Resolve the queue in the consumer
+
+Yield the same `Jobs` handle in the consumer's outer init to get
+a typed `Queue` resource:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as AWS from "alchemy/AWS";
+import * as Effect from "effect/Effect";
++import { Jobs } from "./queue.ts";
+
+export default class Worker extends AWS.Lambda.Function<Worker>()(
+  "JobsWorker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
++    const queue = yield* Jobs;
+    return {};
+  }),
+) {}
+```
+
+## Subscribe to messages
+
+`SQS.messages(queue).subscribe(...)` is the consumer-side mirror
+of `notifications` / `stream`: a typed `Stream<SQSRecord>` you
+can compose with any operator. Add the smallest possible
+subscription — log each message body:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as AWS from "alchemy/AWS";
++import * as SQS from "alchemy/AWS/SQS";
++import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
++import * as Stream from "effect/Stream";
+import { Jobs } from "./queue.ts";
+
+export default class Worker extends AWS.Lambda.Function<Worker>()(
+  "JobsWorker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const queue = yield* Jobs;
++
++    yield* SQS.messages(queue, { batchSize: 10 }).subscribe((stream) =>
++      stream.pipe(
++        Stream.runForEach((record) =>
++          Console.log(`received: ${record.body}`),
++        ),
++      ),
++    );
+
+    return {};
+  }),
+) {}
+```
+
+That single `.subscribe(...)` call creates the Lambda event
+source mapping pointing at the queue and grants the function
+`sqs:ReceiveMessage`, `DeleteMessage`, and `GetQueueAttributes`
+on the queue ARN.
+
+## Provide the runtime layer
+
+The consumer-side machinery for queue subscriptions ships in
+`Lambda.QueueEventSource`. Provide it at the bottom of the
+function:
+
+```diff lang="typescript"
++import * as Layer from "effect/Layer";
+// ...
+    return {};
+-  }),
++  }).pipe(Effect.provide(AWS.Lambda.QueueEventSource)),
+) {}
+```
+
+## Wire the worker into the Stack
+
+The Worker needs to be yielded so Alchemy actually deploys it:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import Api from "./src/api.ts";
++import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: AWS.providers(), state: Alchemy.localState() },
+  Effect.gen(function* () {
+    const api = yield* Api;
++    yield* Worker;
+    return { url: api.functionUrl };
+  }),
+);
+```
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Two functions deploy in parallel — `Api` (with `SendMessage`
+permissions) and `JobsWorker` (with `ReceiveMessage` permissions
+plus an event source mapping pointing at `Jobs`).
+
+## Verify
+
+Trigger a write, then watch the consumer's logs:
+
+```sh
+curl -X PUT --data 'hello queue' "$URL/items/q1"
+bun alchemy logs JobsWorker --follow
+```
+
+Within a couple of seconds you'll see:
+
+```
+received: {"type":"job.created","id":"q1","content":"hello queue"}
+```
+
+## Bonus: process records in parallel
+
+`Stream.mapEffect` accepts a `concurrency` option, so you can
+fan out per-record work without rewriting anything:
+
+```typescript
+stream.pipe(
+  Stream.mapEffect(
+    (record) => doSomethingWith(record.body).pipe(Effect.orDie),
+    { concurrency: 4 },
+  ),
+  Stream.runDrain,
+);
+```
+
+Up to 4 records process concurrently, and the event source
+mapping won't ack them until the stream completes — which is the
+same delivery semantics SQS already gives you, just with
+controllable concurrency on top.
+
+## Bonus: forward a stream to SQS with `QueueSink`
+
+`SendMessage.bind(queue)` is perfect for one-off sends from a
+request handler, but if you've got a `Stream` of payloads —
+DynamoDB change records, S3 notifications, anything — you don't
+want to call `sendMessage` per item. **`SQS.QueueSink`** is the
+sink-shaped counterpart: it consumes a `Stream<string>`, batches
+items into chunks of up to 10, and ships each chunk through
+`sqs:SendMessageBatch` for you.
+
+Skip the per-write `sendMessage` in `PUT /items/:id` and forward
+the existing DynamoDB stream straight into the queue instead:
+
+```diff lang="typescript"
+// src/api.ts
+import * as Stream from "effect/Stream";
+import { Jobs } from "./queue.ts";
+// ...
+
+const queue = yield* Jobs;
+const putItem = yield* DynamoDB.PutItem.bind(table);
+-const sendMessage = yield* SQS.SendMessage.bind(queue);
++const sink = yield* SQS.QueueSink.bind(queue);
+
+yield* DynamoDB.stream(table, {
+  streamViewType: "NEW_AND_OLD_IMAGES",
+}).process((stream) =>
+  stream.pipe(
++    Stream.map((record) =>
++      JSON.stringify({
++        eventName: record.eventName,
++        keys: record.dynamodb.Keys,
++        newImage: record.dynamodb.NewImage,
++      }),
++    ),
++    Stream.run(sink),
+  ),
+);
+```
+
+`QueueSink.bind(queue)` grants `sqs:SendMessage` and
+`sqs:SendMessageBatch` on the queue ARN, then returns a
+`Sink<void, string, readonly string[]>` you compose with
+`Stream.run`. `QueueSinkLive` is itself implemented on top of
+`SendMessageBatch`, so split the merged layer into two tiers
+with `Layer.provideMerge` — sink + event sources on top,
+the underlying request layers + policy on the bottom:
+
+```diff lang="typescript"
+}).pipe(
+  Effect.provide(
+-    Layer.mergeAll(
+-      AWS.Lambda.BucketEventSource,
+-      AWS.Lambda.TableEventSource,
+-      DynamoDB.GetItemLive,
+-      DynamoDB.PutItemLive,
+-      S3.PutObjectLive,
+-      S3.GetObjectLive,
+-      SQS.SendMessageLive,
+-    ),
++    Layer.provideMerge(
++      Layer.mergeAll(
++        AWS.Lambda.BucketEventSource,
++        AWS.Lambda.TableEventSource,
++        SQS.QueueSinkLive,
++      ),
++      Layer.mergeAll(
++        DynamoDB.GetItemLive,
++        DynamoDB.PutItemLive,
++        S3.PutObjectLive,
++        S3.GetObjectLive,
++        SQS.SendMessageBatchLive,
++        SQS.SendMessageBatchPolicyLive,
++      ),
++    ),
+  ),
+),
+```
+
+The consumer doesn't change — `JobsWorker` still subscribes via
+`SQS.messages(queue)` and now sees one record per DynamoDB
+change, batched ten-at-a-time on the producer side.
+
+Next you'll [stream higher-volume records through Kinesis](/tutorial/aws/kinesis) —
+ordered, sharded, and with the same `Stream` consumer surface
+you've used everywhere else in this section.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/ai-gateway.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/ai-gateway.mdx
new file mode 100644
index 00000000000..b3836de4ad9
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/ai-gateway.mdx
@@ -0,0 +1,275 @@
+---
+title: Add an AI Gateway
+description: Wire an AI Gateway into your Worker, turn it into a typed Effect LanguageModel, and run generations and streams through Workers AI with caching, rate limiting, and logs.
+sidebar:
+  order: 6
+---
+
+You've now wired Durable Objects, hibernatable WebSockets, a
+container, and a Workflow into your Worker. The last piece in the
+Cloudflare track is an **AI Gateway** — a stable account-scoped
+endpoint that fronts every model provider (Workers AI, OpenAI,
+Anthropic, Bedrock, …) and gives you caching, rate limiting, retries,
+DLP, and a single dashboard of every request, token, and cost.
+
+In Alchemy the gateway is a single resource. Once you've declared and
+bound it, `.model({...})` returns an Effect `LanguageModel.LanguageModel`
+Layer — and from there you're using the same `generateText` /
+`streamText` APIs you'd use against any other provider.
+
+## Declare the gateway
+
+Create `src/AiGateway.ts` with a single resource definition. The
+two flags below enable response caching (60-second TTL) and request
+logging — every prompt, completion, latency, and token count will
+show up in the AI Gateway dashboard.
+
+```typescript
+// src/AiGateway.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Gateway = Cloudflare.AiGateway("Gateway", {
+  cacheTtl: 60,
+  collectLogs: true,
+});
+```
+
+Every prop is optional, but explicit defaults make the intent
+visible. We'll tune more knobs at the end of the tutorial.
+
+## Add it to the stack
+
+```diff lang="typescript"
+// alchemy.run.ts
++import { Gateway } from "./src/AiGateway.ts";
+ import Api from "./src/Api.ts";
+
+ export default Alchemy.Stack(
+   "CloudflareWorkerExample",
+   { providers: Cloudflare.providers(), state: Cloudflare.state() },
+   Effect.gen(function* () {
+     const api = yield* Api;
++    const gateway = yield* Gateway;
+
+     return {
+       url: api.url.as<string>(),
++      gatewayId: gateway.gatewayId,
+     };
+   }),
+ );
+```
+
+`yield* Gateway` registers the resource so it gets created/updated on
+the next deploy. `gateway.gatewayId` is exposed as a stack output so
+you can find it in the dashboard.
+
+## Bind the gateway into the Worker
+
+`Cloudflare.AiGateway.bind(Gateway)` returns a typed client whose
+methods are wrapped in Effect — `run` for raw inference, `getUrl` for
+the gateway endpoint, `getLog`/`patchLog` for the request log, and
+`model({...})` for building a `LanguageModel` layer.
+
+```diff lang="typescript"
+// src/Api.ts
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
++import { Gateway } from "./AiGateway.ts";
+
+ export default class Api extends Cloudflare.Worker<Api>()(
+   "Api",
+   { main: import.meta.path },
+   Effect.gen(function* () {
++    const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
+
+     return {
+       fetch: Effect.gen(function* () {
+         // …existing routes
+       }),
+     };
+-  }),
++  }).pipe(Effect.provide(Cloudflare.AiGatewayBindingLive)),
+ ) {}
+```
+
+`Cloudflare.AiGatewayBindingLive` is the runtime side of the
+binding. Provide it once at the bottom of the Init layer chain and
+every `bind(...)` further up will resolve.
+
+## Build a `LanguageModel` layer
+
+Call `aiGateway.model({...})` with a Workers AI model id and
+parameters. The result is a `Layer<LanguageModel.LanguageModel, …>`
+that satisfies Effect's standard AI service.
+
+```diff lang="typescript"
+   Effect.gen(function* () {
+     const aiGateway = yield* Cloudflare.AiGateway.bind(Gateway);
++
++    const languageModel = aiGateway.model({
++      client: aiGateway,
++      model: "@cf/meta/llama-3.3-70b-instruct-fp8-fast",
++      parameters: { temperature: 0.7, maxTokens: 1024 },
++    });
+
+     return {
+       fetch: Effect.gen(function* () {
+         // …
+       }),
+     };
+   })
+```
+
+`parameters` is the per-call default; any individual call can still
+override it. The Init phase is the right place to build this layer —
+construction is pure and the binding factory only exists here.
+
+## Generate text on `/generate`
+
+`LanguageModel.generateText` returns a typed response with `text`,
+`finishReason`, structured token `usage`, and any `toolCalls`. Provide
+the `languageModel` layer to the handler and call it like any other
+Effect.
+
+```diff lang="typescript"
++import { LanguageModel } from "effect/unstable/ai";
+ import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+   return {
+     fetch: Effect.gen(function* () {
+       const request = yield* HttpServerRequest;
++      const url = new URL(request.url, "http://api");
+
++      if (url.pathname === "/generate" && request.method === "POST") {
++        const body = (yield* request.json) as { prompt?: string };
++        const prompt = body.prompt?.trim() ?? "Say hello in one sentence.";
++
++        const response = yield* LanguageModel.generateText({ prompt }).pipe(
++          Effect.orDie,
++        );
++
++        return yield* HttpServerResponse.json({
++          text: response.text,
++          usage: {
++            inputTokens: response.usage.inputTokens.total,
++            outputTokens: response.usage.outputTokens.total,
++          },
++        });
++      }
+
+       return HttpServerResponse.text("Not Found", { status: 404 });
+-    }),
++    }).pipe(Effect.provide(languageModel)),
+   };
+```
+
+`Effect.provide(languageModel)` makes `LanguageModel.LanguageModel`
+available to every handler in `fetch`. `Effect.orDie` collapses
+`AiError` to a defect so a model failure surfaces as a 500 — if you
+need typed handling instead, `Effect.catchTag("AiError", …)` works.
+
+## Try it
+
+```sh
+bun alchemy deploy
+curl -X POST "$(bun alchemy stack output url)/generate" \
+  -H "content-type: application/json" \
+  -d '{"prompt":"Write a haiku about Effect"}'
+```
+
+The first call takes ~1–2 seconds. Send the **exact same** prompt
+again and it returns in milliseconds — that's the `cacheTtl: 60`
+config doing its job. Open the Cloudflare dashboard → **AI** →
+**AI Gateway** → your gateway and you'll see both requests, with the
+second flagged as a cache hit, plus latency and token usage on every
+entry.
+
+## Stream tokens on `/stream`
+
+For chat-style UIs you want tokens to arrive as the model produces
+them, not in one big response. `LanguageModel.streamText` returns an
+`Effect.Stream` of typed response parts — `text-delta`, `tool-call`,
+`finish`, and so on. Pipe it through `Sse.encode` and
+`HttpServerResponse.stream` to get a server-sent-event stream that
+flushes through the Worker → edge → client without buffering.
+
+```diff lang="typescript"
++import * as Stream from "effect/Stream";
++import * as Sse from "effect/unstable/encoding/Sse";
+
++      if (url.pathname === "/stream" && request.method === "POST") {
++        const body = (yield* request.json) as { prompt?: string };
++        const prompt = body.prompt?.trim() ?? "Tell me a haiku about Effect.";
++
++        const stream = LanguageModel.streamText({ prompt }).pipe(
++          Stream.provide(languageModel),
++          Sse.encode,
++        );
++
++        return HttpServerResponse.stream(stream, {
++          headers: {
++            "content-type": "text/event-stream",
++            "cache-control": "no-cache",
++            "x-accel-buffering": "no",
++          },
++        });
++      }
+```
+
+`Stream.provide(languageModel)` is the stream-aware equivalent of
+`Effect.provide` — the `LanguageModel` needs to be available for the
+entire lifetime of the stream, not just the initial setup.
+
+```sh
+curl -N -X POST "$(bun alchemy stack output url)/stream" \
+  -H "content-type: application/json" \
+  -d '{"prompt":"Write a haiku about Effect, slowly."}'
+```
+
+`-N` disables curl's response buffering so you see each SSE event as
+soon as the Worker flushes it.
+
+## Tune caching, rate limits, and DLP
+
+Every prop on `Cloudflare.AiGateway` maps to an update API call — no
+replacement, no downtime. A production-grade config might look like:
+
+```typescript
+export const Gateway = Cloudflare.AiGateway("Gateway", {
+  id: "prod-gateway",
+  cacheTtl: 300,
+  cacheInvalidateOnUpdate: true,
+  rateLimitingInterval: 60,
+  rateLimitingLimit: 100,
+  rateLimitingTechnique: "sliding",
+  collectLogs: true,
+  logManagement: 100_000,
+  logManagementStrategy: "DELETE_OLDEST",
+  authentication: true,
+});
+```
+
+Bumping `cacheTtl`, `rateLimitingLimit`, or toggling `authentication`
+is a single `bun alchemy deploy` away — the diff updates the gateway
+in place.
+
+## What you have now
+
+- A `Cloudflare.AiGateway` resource with caching, logging, and (when
+  you want them) rate limiting and auth.
+- An Effect `LanguageModel.LanguageModel` Layer that proxies Workers
+  AI through that gateway.
+- `/generate` and `/stream` routes that use the standard
+  `LanguageModel.generateText` and `streamText` APIs — provider-
+  agnostic, so swapping Workers AI for OpenAI or Anthropic later is
+  a layer-level change, not a code-level one.
+
+The natural next step is to give the model **memory** — wrapping the
+same `LanguageModel` with `Chat.Service` and storing the conversation
+in a Durable Object's `state.storage`, so every session is resumable
+across requests, restarts, and hibernation.
+
+For the wider API surface — `generateObject`, `Toolkit`, structured
+outputs, and how the same `LanguageModel` composes inside an HTTP
+API or RPC handler — see the [Effect AI guide](/guides/effect-ai).
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/artifacts.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/artifacts.mdx
new file mode 100644
index 00000000000..c0e613856c2
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/artifacts.mdx
@@ -0,0 +1,857 @@
+---
+title: Build a Git Repo API
+description: Build a mini-GitHub on Cloudflare — Artifacts for Git storage, a Durable Object per repo for metadata, fronted by a schema-typed HttpApi.
+sidebar:
+  order: 7
+---
+
+So far the Cloudflare track has added stateful primitives one at a
+time. This tutorial pulls two of them together into something
+recognizable: a tiny GitHub. **Cloudflare Artifacts** stores the
+actual Git history (clone, push, pull all work against it), and a
+**Durable Object per repo** holds the metadata you don't want
+inside the repo itself — description, topics, star count.
+
+We'll front the whole thing with Effect's
+[HttpApi](/guides/effect-http-api) so every route is
+schema-validated end-to-end and the integration test can call the
+worker through the same typed client a real consumer would use.
+
+By the end you'll have a Worker that lets a client create a repo,
+`git clone` against it, read combined info, star it, and update
+its description.
+
+## Declare the namespace
+
+A Cloudflare Artifacts namespace is the top-level container for
+Git-compatible repos. Namespaces are *implicit* — there's nothing
+to provision at deploy time, so the resource is a thin binding
+marker. Repos themselves are created at runtime through the
+binding.
+
+Create `src/Repos.ts`:
+
+```typescript twoslash
+// src/Repos.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Repos = Cloudflare.Artifacts("Repos");
+```
+
+That's the whole declaration. The Worker provider will see this
+the moment we `.bind(...)` it.
+
+## Define the API
+
+The schema and endpoint declarations live outside the Worker so
+the same file can be imported by clients and tests without
+pulling in any runtime code. Start with one endpoint —
+`POST /repos`:
+
+```typescript twoslash
+// src/Api.ts
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
+export class CreateRepoResponse extends Schema.Class<CreateRepoResponse>(
+  "CreateRepoResponse",
+)({
+  name: Schema.String,
+  remote: Schema.String,
+  token: Schema.String,
+  defaultBranch: Schema.String,
+}) {}
+
+export class RepoConflict extends Schema.TaggedErrorClass<RepoConflict>()(
+  "RepoConflict",
+  { message: Schema.String },
+) {}
+
+export const createRepo = HttpApiEndpoint.post("createRepo", "/repos", {
+  payload: Schema.Struct({
+    name: Schema.String,
+    description: Schema.optional(Schema.String),
+  }),
+  success: CreateRepoResponse,
+  error: RepoConflict,
+});
+
+export class ReposGroup extends HttpApiGroup.make("repos").add(createRepo) {}
+
+export class RepoApi extends HttpApi.make("RepoApi").add(ReposGroup) {}
+```
+
+`Schema.Class` gives you a runtime-validated class with an inferred
+TypeScript type. `Schema.TaggedErrorClass` gives you a typed error
+that becomes a discriminated union member on the client.
+
+## Implement the Worker
+
+Create `src/Worker.ts`. The handler group is *constructed* with
+`HttpApiBuilder.group` (pure — safe inside the Worker's Init
+phase), and the `fetch` field is the result of layering the API
+into an `HttpEffect`:
+
+```typescript twoslash
+// @noErrors
+// src/Worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Etag from "effect/unstable/http/Etag";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { CreateRepoResponse, RepoApi, RepoConflict } from "./Api.ts";
+import { Repos } from "./Repos.ts";
+
+// Workers don't have a FileSystem, so HttpPlatform's file-response
+// surface is stubbed. The repo API never serves files.
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+  fileResponse: () => Effect.die("HttpPlatform.fileResponse not supported"),
+  fileWebResponse: () =>
+    Effect.die("HttpPlatform.fileWebResponse not supported"),
+});
+
+export default class Worker extends Cloudflare.Worker<Worker>()(
+  "Api",
+  {
+    main: import.meta.path,
+    compatibility: { flags: ["nodejs_compat"], date: "2026-03-17" },
+  },
+  Effect.gen(function* () {
+    const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
+
+    const handlers = HttpApiBuilder.group(RepoApi, "repos", (h) =>
+      h.handle("createRepo", ({ payload }) =>
+        artifacts
+          .create(payload.name, {
+            description: payload.description,
+            setDefaultBranch: "main",
+          })
+          .pipe(
+            Effect.map(
+              (c) =>
+                new CreateRepoResponse({
+                  name: c.name,
+                  remote: c.remote,
+                  token: c.token,
+                  defaultBranch: c.defaultBranch,
+                }),
+            ),
+            Effect.catchTag("ArtifactsError", (err) =>
+              Effect.fail(new RepoConflict({ message: err.message })),
+            ),
+          ),
+      ),
+    );
+
+    return {
+      fetch: HttpApiBuilder.layer(RepoApi).pipe(
+        Layer.provide(handlers),
+        Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]),
+        HttpRouter.toHttpEffect,
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.ArtifactsBindingLive)),
+) {}
+```
+
+The handler returns a `CreateRepoResponse` instance — `Schema.Class`
+expects an actual instance, not a plain object. Errors from
+`artifacts.create` (the only declared error path) are translated to
+`RepoConflict`; anything else dies and surfaces as a 500.
+
+## Set up the integration test
+
+Same `Test.make` shape as
+[Add a Durable Object](/tutorial/cloudflare/durable-objects), but
+this time the test calls the worker through `HttpApiClient.make` —
+the same `RepoApi` value drives the typed client:
+
+```typescript
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+import { RepoApi } from "../src/Api.ts";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+const repoName = `tutorial-${Date.now().toString(36)}`;
+```
+
+Add the first assertion. `client.repos.createRepo` returns
+`Effect<CreateRepoResponse, RepoConflict | HttpClientError>` — fields
+are typed straight from the schema:
+
+```diff lang="typescript"
+const repoName = `tutorial-${Date.now().toString(36)}`;
+
++test(
++  "repo lifecycle",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++    const client = yield* HttpApiClient.make(RepoApi, { baseUrl: url });
++
++    const created = yield* client.repos.createRepo({
++      payload: { name: repoName, description: "tutorial repo" },
++    });
++    expect(created.name).toBe(repoName);
++    expect(created.remote).toBeString();
++    expect(created.token).toBeString();
++  }),
++  { timeout: 120_000 },
++);
+```
+
+```sh
+bun test
+```
+
+Alchemy deploys the Worker, the test posts to `/repos`, and you
+get back a `remote` and `token`. You could `git clone` against
+them right now.
+
+## Look up an existing repo
+
+`artifacts.get(name)` returns an opaque RPC stub — useful for
+`createToken` later, but its fields aren't enumerable. To return
+repo info as JSON, use `artifacts.list(...)` and find the entry by
+name; every record in the list is a plain object.
+
+Add a `RepoInfo` schema and a `getRepo` endpoint to the API:
+
+```diff lang="typescript"
+// src/Api.ts
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+
++export class RepoInfo extends Schema.Class<RepoInfo>("RepoInfo")({
++  id: Schema.String,
++  name: Schema.String,
++  description: Schema.NullOr(Schema.String),
++  defaultBranch: Schema.String,
++  remote: Schema.String,
++  status: Schema.String,
++  readOnly: Schema.Boolean,
++  createdAt: Schema.String,
++  updatedAt: Schema.String,
++  lastPushAt: Schema.NullOr(Schema.String),
++}) {}
+
+export class CreateRepoResponse extends Schema.Class<CreateRepoResponse>(
+  "CreateRepoResponse",
+)({ /* … */ }) {}
+
++export class RepoNotFound extends Schema.TaggedErrorClass<RepoNotFound>()(
++  "RepoNotFound",
++  { name: Schema.String },
++) {}
+
+export class RepoConflict extends Schema.TaggedErrorClass<RepoConflict>()(
+  "RepoConflict",
+  { message: Schema.String },
+) {}
+
+export const createRepo = HttpApiEndpoint.post("createRepo", "/repos", { /* … */ });
+
++export const getRepo = HttpApiEndpoint.get("getRepo", "/repos/:name", {
++  params: Schema.Struct({ name: Schema.String }),
++  success: RepoInfo,
++  error: RepoNotFound,
++});
+
+-export class ReposGroup extends HttpApiGroup.make("repos").add(createRepo) {}
++export class ReposGroup extends HttpApiGroup.make("repos")
++  .add(createRepo)
++  .add(getRepo) {}
+
+export class RepoApi extends HttpApi.make("RepoApi").add(ReposGroup) {}
+```
+
+Implement the handler in the Worker, and factor out a `findRepo`
+helper since several handlers will need to look up a repo:
+
+```diff lang="typescript"
+// src/Worker.ts — inside Effect.gen
+const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
+
++const findRepo = (name: string) =>
++  artifacts.list({ limit: 100 }).pipe(
++    Effect.flatMap((res) => {
++      const found = res.repos.find((r: { name: string }) => r.name === name);
++      return found
++        ? Effect.succeed(found)
++        : Effect.fail(new RepoNotFound({ name }));
++    }),
++    Effect.catchTag("ArtifactsError", () =>
++      Effect.fail(new RepoNotFound({ name })),
++    ),
++  );
+
+const handlers = HttpApiBuilder.group(RepoApi, "repos", (h) =>
+  h
+    .handle("createRepo", ({ payload }) =>
+      // …existing
+    )
++   .handle("getRepo", ({ params }) =>
++     findRepo(params.name).pipe(
++       Effect.map(
++         (found) =>
++           new RepoInfo({
++             id: found.id,
++             name: found.name,
++             description: found.description ?? null,
++             defaultBranch: found.defaultBranch,
++             remote: found.remote,
++             status: found.status,
++             readOnly: found.readOnly,
++             createdAt: found.createdAt,
++             updatedAt: found.updatedAt,
++             lastPushAt: found.lastPushAt ?? null,
++           }),
++       ),
++     ),
++   ),
+);
+```
+
+Extend the test:
+
+```diff lang="typescript"
+test(
+  "repo lifecycle",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpApiClient.make(RepoApi, { baseUrl: url });
+
+    const created = yield* client.repos.createRepo({
+      payload: { name: repoName, description: "tutorial repo" },
+    });
+    expect(created.name).toBe(repoName);
+    expect(created.remote).toBeString();
+    expect(created.token).toBeString();
++
++   const info = yield* client.repos.getRepo({ params: { name: repoName } });
++   expect(info.name).toBe(repoName);
++   expect(info.defaultBranch).toBe("main");
++   expect(info.description).toBe("tutorial repo");
+  }),
+  { timeout: 120_000 },
+);
+```
+
+```sh
+bun test
+```
+
+## Mint a fresh clone token
+
+The token returned by `create` expires. Clients that already know
+a repo's name should be able to ask for a new one without
+recreating the repo. Add a `cloneToken` endpoint:
+
+```diff lang="typescript"
+// src/Api.ts
++export class CloneToken extends Schema.Class<CloneToken>("CloneToken")({
++  id: Schema.String,
++  plaintext: Schema.String,
++  scope: Schema.Literals(["read", "write"]),
++  expiresAt: Schema.String,
++}) {}
+
+export const getRepo = HttpApiEndpoint.get("getRepo", "/repos/:name", { /* … */ });
+
++export const cloneToken = HttpApiEndpoint.post(
++  "cloneToken",
++  "/repos/:name/clone-token",
++  {
++    params: Schema.Struct({ name: Schema.String }),
++    payload: Schema.Struct({
++      scope: Schema.optional(Schema.Literals(["read", "write"])),
++      ttl: Schema.optional(Schema.Number),
++    }),
++    success: CloneToken,
++    error: RepoNotFound,
++  },
++);
+
+export class ReposGroup extends HttpApiGroup.make("repos")
+  .add(createRepo)
+  .add(getRepo)
++ .add(cloneToken) {}
+```
+
+`repo.createToken(scope, ttl)` on the runtime stub returns
+`{ id, plaintext, scope, expiresAt }` — wrap it in a `CloneToken`
+instance:
+
+```diff lang="typescript"
+.handle("getRepo", ({ params }) => /* … */)
++.handle("cloneToken", ({ params, payload }) =>
++  artifacts.get(params.name).pipe(
++    Effect.flatMap((handle) =>
++      handle.createToken(payload.scope ?? "read", payload.ttl ?? 3600),
++    ),
++    Effect.map(
++      (t) =>
++        new CloneToken({
++          id: t.id,
++          plaintext: t.plaintext,
++          scope: t.scope as "read" | "write",
++          expiresAt: t.expiresAt,
++        }),
++    ),
++    Effect.catchTag("ArtifactsError", () =>
++      Effect.fail(new RepoNotFound({ name: params.name })),
++    ),
++  ),
++),
+```
+
+```diff lang="typescript"
+test(
+  "repo lifecycle",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpApiClient.make(RepoApi, { baseUrl: url });
+
+    const created = yield* client.repos.createRepo({
+      payload: { name: repoName, description: "tutorial repo" },
+    });
+    expect(created.name).toBe(repoName);
+    expect(created.remote).toBeString();
+    expect(created.token).toBeString();
+
+    const info = yield* client.repos.getRepo({ params: { name: repoName } });
+    expect(info.name).toBe(repoName);
+    expect(info.defaultBranch).toBe("main");
+    expect(info.description).toBe("tutorial repo");
++
++   const token = yield* client.repos.cloneToken({
++     params: { name: repoName },
++     payload: { scope: "read", ttl: 600 },
++   });
++   expect(token.plaintext).toBeString();
++   expect(token.scope).toBe("read");
+  }),
+  { timeout: 120_000 },
+);
+```
+
+That covers the Git half. Artifacts is now storing history and
+handing out tokens. Next we'll add the metadata that lives
+*around* the repo.
+
+## Add the `Repo` Durable Object
+
+Artifacts owns commits, refs, and the clone protocol. It does not
+store the things a GitHub-like API needs alongside that —
+descriptions you can rename, topics, stars. The `Repo` Durable
+Object represents one repository: a single addressable instance
+per repo name with its own transactional storage.
+
+Start with the smallest possible DO — empty public API, no state:
+
+```typescript twoslash
+// src/Repo.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default class Repo extends Cloudflare.DurableObjectNamespace<Repo>()(
+  "Repo",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      return {};
+    });
+  }),
+) {}
+```
+
+## Persist the metadata
+
+Each DO instance has its own SQLite-backed key/value storage. Pull
+the current metadata out of storage in the inner init so it
+survives restarts and hibernation:
+
+```diff lang="typescript"
++export type Meta = {
++  description: string;
++  topics: string[];
++  stars: number;
++  createdAt: number;
++};
+
+export default class Repo extends Cloudflare.DurableObjectNamespace<Repo>()(
+  "Repo",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
++     const state = yield* Cloudflare.DurableObjectState;
++     let meta = (yield* state.storage.get<Meta>("meta")) ?? null;
+      return {};
+    });
+  }),
+) {}
+```
+
+`meta` is `null` until the repo is initialized.
+
+## Add `init` and `get`
+
+Any function returned from the inner Effect that produces an
+`Effect` becomes a typed RPC method. Add one to seed the metadata
+the first time a repo is created, and one to read it:
+
+```diff lang="typescript"
+return Effect.gen(function* () {
+  const state = yield* Cloudflare.DurableObjectState;
+  let meta = (yield* state.storage.get<Meta>("meta")) ?? null;
+
++ const ensure = Effect.gen(function* () {
++   if (meta === null) {
++     return yield* Effect.fail(new Error("repo not initialized"));
++   }
++   return meta;
++ });
+
+- return {};
++ return {
++   init: (description: string) =>
++     Effect.gen(function* () {
++       if (meta !== null) return meta;
++       meta = { description, topics: [], stars: 0, createdAt: Date.now() };
++       yield* state.storage.put("meta", meta);
++       return meta;
++     }),
++   get: () => ensure,
++ };
+});
+```
+
+## Wire the DO into the API
+
+Add a `Metadata` schema to `Api.ts` and extend `RepoInfo` with a
+nullable `metadata` field:
+
+```diff lang="typescript"
+// src/Api.ts
++export class Metadata extends Schema.Class<Metadata>("Metadata")({
++  description: Schema.String,
++  topics: Schema.Array(Schema.String),
++  stars: Schema.Number,
++  createdAt: Schema.Number,
++}) {}
+
+export class RepoInfo extends Schema.Class<RepoInfo>("RepoInfo")({
+  id: Schema.String,
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  defaultBranch: Schema.String,
+  remote: Schema.String,
+  status: Schema.String,
+  readOnly: Schema.Boolean,
+  createdAt: Schema.String,
+  updatedAt: Schema.String,
+  lastPushAt: Schema.NullOr(Schema.String),
++ metadata: Schema.NullOr(Metadata),
+}) {}
+```
+
+Yield the `Repo` class in the Worker's init phase. The handle is a
+DO namespace — `repos.getByName(name)` returns a typed RPC stub for
+that repo's instance:
+
+```diff lang="typescript"
+// src/Worker.ts
++import Repo from "./Repo.ts";
+import {
+  CloneToken,
+  CreateRepoResponse,
++ Metadata,
+  RepoApi,
+  RepoConflict,
+  RepoInfo,
+  RepoNotFound,
+} from "./Api.ts";
+
+  Effect.gen(function* () {
+    const artifacts = yield* Cloudflare.Artifacts.bind(Repos);
++   const repos = yield* Repo;
+    // …findRepo helper
+```
+
+Now extend the handlers — `createRepo` calls `init` after the repo
+is created, `getRepo` reads metadata and merges it:
+
+```diff lang="typescript"
+.handle("createRepo", ({ payload }) =>
+  artifacts
+    .create(payload.name, {
+      description: payload.description,
+      setDefaultBranch: "main",
+    })
+    .pipe(
++     Effect.tap(() =>
++       repos
++         .getByName(payload.name)
++         .init(payload.description ?? "")
++         .pipe(Effect.orDie),
++     ),
+      Effect.map(
+        (c) =>
+          new CreateRepoResponse({
+            name: c.name,
+            remote: c.remote,
+            token: c.token,
+            defaultBranch: c.defaultBranch,
+          }),
+      ),
+      Effect.catchTag("ArtifactsError", (err) =>
+        Effect.fail(new RepoConflict({ message: err.message })),
+      ),
+    ),
+)
+.handle("getRepo", ({ params }) =>
+  findRepo(params.name).pipe(
++   Effect.flatMap((found) =>
++     repos
++       .getByName(params.name)
++       .get()
++       .pipe(
++         Effect.catch(() => Effect.succeed(null)),
++         Effect.map((m) => ({ found, meta: m })),
++       ),
++   ),
+-   Effect.map(
+-     (found) =>
+-       new RepoInfo({
++   Effect.map(
++     ({ found, meta }) =>
++       new RepoInfo({
+          id: found.id,
+          name: found.name,
+          description: found.description ?? null,
+          defaultBranch: found.defaultBranch,
+          remote: found.remote,
+          status: found.status,
+          readOnly: found.readOnly,
+          createdAt: found.createdAt,
+          updatedAt: found.updatedAt,
+          lastPushAt: found.lastPushAt ?? null,
++         metadata: meta ? new Metadata(meta) : null,
+        }),
+    ),
+  ),
+),
+```
+
+The DO's `get()` fails with a plain `Error` when the repo wasn't
+initialised — recover with `Effect.catch` so the route still
+returns the Artifacts info even if the DO has no metadata yet.
+
+Update the test — `info.metadata` is now typed as
+`Metadata | null`:
+
+```diff lang="typescript"
+const info = yield* client.repos.getRepo({ params: { name: repoName } });
+expect(info.name).toBe(repoName);
+expect(info.defaultBranch).toBe("main");
+expect(info.description).toBe("tutorial repo");
++expect(info.metadata?.description).toBe("tutorial repo");
++expect(info.metadata?.stars).toBe(0);
+```
+
+```sh
+bun test
+```
+
+## Update description and topics
+
+Add an `update` method to the DO:
+
+```diff lang="typescript"
+return {
+  init: (description: string) =>
+    Effect.gen(function* () {
+      if (meta !== null) return meta;
+      meta = { description, topics: [], stars: 0, createdAt: Date.now() };
+      yield* state.storage.put("meta", meta);
+      return meta;
+    }),
+  get: () => ensure,
++ update: (patch: Partial<Pick<Meta, "description" | "topics">>) =>
++   Effect.gen(function* () {
++     const current = yield* ensure;
++     meta = { ...current, ...patch };
++     yield* state.storage.put("meta", meta);
++     return meta;
++   }),
+};
+```
+
+Add an `updateRepo` endpoint to the API:
+
+```diff lang="typescript"
+// src/Api.ts
++export const updateRepo = HttpApiEndpoint.patch(
++  "updateRepo",
++  "/repos/:name",
++  {
++    params: Schema.Struct({ name: Schema.String }),
++    payload: Schema.Struct({
++      description: Schema.optional(Schema.String),
++      topics: Schema.optional(Schema.Array(Schema.String)),
++    }),
++    success: Metadata,
++    error: RepoNotFound,
++  },
++);
+
+export class ReposGroup extends HttpApiGroup.make("repos")
+  .add(createRepo)
+  .add(getRepo)
+  .add(cloneToken)
++ .add(updateRepo) {}
+```
+
+And the handler:
+
+```diff lang="typescript"
+.handle("cloneToken", ({ params, payload }) => /* … */)
++.handle("updateRepo", ({ params, payload }) =>
++  findRepo(params.name).pipe(
++    Effect.flatMap(() =>
++      repos
++        .getByName(params.name)
++        .update({
++          description: payload.description,
++          topics: payload.topics ? [...payload.topics] : undefined,
++        })
++        .pipe(Effect.orDie),
++    ),
++    Effect.map((m) => new Metadata(m)),
++  ),
++),
+```
+
+Test it:
+
+```diff lang="typescript"
+expect(token.scope).toBe("read");
+
++const updated = yield* client.repos.updateRepo({
++  params: { name: repoName },
++  payload: { description: "now with stars", topics: ["demo", "alchemy"] },
++});
++expect(updated.description).toBe("now with stars");
++expect(updated.topics).toEqual(["demo", "alchemy"]);
+```
+
+## Star a repo
+
+Same pattern — add `star` to the DO, `starRepo` to the API, and
+the handler:
+
+```diff lang="typescript"
+// src/Repo.ts
+return {
+  // …
+  update: (patch) => /* … */,
++ star: () =>
++   Effect.gen(function* () {
++     const current = yield* ensure;
++     meta = { ...current, stars: current.stars + 1 };
++     yield* state.storage.put("meta", meta);
++     return meta;
++   }),
+};
+```
+
+```diff lang="typescript"
+// src/Api.ts
++export const starRepo = HttpApiEndpoint.post(
++  "starRepo",
++  "/repos/:name/star",
++  {
++    params: Schema.Struct({ name: Schema.String }),
++    success: Metadata,
++    error: RepoNotFound,
++  },
++);
+
+export class ReposGroup extends HttpApiGroup.make("repos")
+  .add(createRepo)
+  .add(getRepo)
+  .add(cloneToken)
+  .add(updateRepo)
++ .add(starRepo) {}
+```
+
+```diff lang="typescript"
+// src/Worker.ts
+.handle("updateRepo", ({ params, payload }) => /* … */)
++.handle("starRepo", ({ params }) =>
++  findRepo(params.name).pipe(
++    Effect.flatMap(() =>
++      repos.getByName(params.name).star().pipe(Effect.orDie),
++    ),
++    Effect.map((m) => new Metadata(m)),
++  ),
++),
+```
+
+```diff lang="typescript"
+expect(updated.topics).toEqual(["demo", "alchemy"]);
+
++const starred = yield* client.repos.starRepo({
++  params: { name: repoName },
++});
++expect(starred.stars).toBe(1);
+```
+
+## Run the full suite
+
+```sh
+bun test
+```
+
+Each call round-trips through Artifacts, the Durable Object, or
+both — created via `artifacts.create`, looked up via `artifacts.list`,
+mutated via the DO's `init`/`update`/`star` RPC methods. The whole
+flow is type-checked end-to-end through the same `RepoApi` schema,
+on both the server and the client.
+
+## Why this shape
+
+Artifacts and the per-repo DO each do one thing well:
+
+- **Artifacts** is the Git server — it owns commits, refs, and the
+  clone/push protocol. Tokens are scoped and short-lived, so you
+  mint them on demand instead of handing out long-lived secrets.
+- **The DO** is the source of truth for everything that lives
+  *around* the repo. Each repo gets its own instance, so a hot
+  repo's writes never contend with another's.
+- **HttpApi** ties the two together. The same `RepoApi` value
+  drives the Worker, the integration test, and any external
+  client — so contract drift between server and consumer is
+  caught at compile time, not in production.
+
+Combine more primitives the same way: a Workflow that runs CI on
+push, a Container that builds and publishes artifacts, an AI
+Gateway that summarizes diffs. The Worker stays a thin handler;
+each primitive owns its own state.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/branch-from-shared-database.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/branch-from-shared-database.mdx
new file mode 100644
index 00000000000..dd13de82f02
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/branch-from-shared-database.mdx
@@ -0,0 +1,253 @@
+---
+title: Branch from a shared database
+description: Have ephemeral PR-preview stages reference a long-lived Neon project from the staging stage instead of provisioning their own — fast previews, copy-on-write branches, no extra Postgres clusters.
+sidebar:
+  order: 9
+---
+
+import { Code, Tabs, TabItem } from "@astrojs/starlight/components";
+
+In the [Hyperdrive](/tutorial/cloudflare/hyperdrive)
+tutorial you provisioned a `Neon.Project` and a `Neon.Branch`, then
+[Drizzle](/tutorial/cloudflare/drizzle) layered automatic
+migrations on top. Both work fine with a single stage — but the
+moment you start deploying PR previews (`pr-147`, `pr-148`, …) the
+default flow becomes painful:
+
+- Every PR stage provisions its own `Neon.Project` — a whole
+  Postgres cluster, with cold starts, project-count limits, and a
+  full migration replay against an empty branch.
+- Tearing the PR stage down deletes the project too, throwing away
+  the data and any seeds you'd attached.
+
+The fix is to share the **project** across stages — long-lived,
+owned by `staging` — and only fork a per-stage **branch** off it.
+PR stages get a fast, isolated, copy-on-write database without
+touching project creation.
+
+## Where we left off
+
+Recap of `src/Db.ts` from the Drizzle tutorial — every stage
+unconditionally creates its own `Neon.Project`:
+
+```typescript
+// src/Db.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const NeonDb = Effect.gen(function* () {
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  const project = yield* Neon.Project("app-db", {
+    region: "aws-us-east-1",
+  });
+
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+    migrationsDir: schema.out,
+  });
+
+  return { project, branch, schema };
+});
+
+export const Hyperdrive = Effect.gen(function* () {
+  const { branch } = yield* NeonDb;
+  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+    origin: branch.origin,
+  });
+});
+```
+
+Today we'll change the project line — and only the project line —
+so PR stages reuse `staging`'s.
+
+## Read the active stage
+
+The branching decision needs to know which stage is being
+deployed. Pull it off the `Stack` service, which Alchemy provides
+to every stack effect:
+
+```diff lang="typescript"
++import * as Alchemy from "alchemy";
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Drizzle from "alchemy/Drizzle";
+ import * as Neon from "alchemy/Neon";
+ import * as Effect from "effect/Effect";
+
+ export const NeonDb = Effect.gen(function* () {
++  const { stage } = yield* Alchemy.Stack;
++
+   const schema = yield* Drizzle.Schema("app-schema", {
+     schema: "./src/schema.ts",
+     out: "./migrations",
+   });
+```
+
+`stage` is whatever was passed to `bun alchemy deploy --stage <name>`
+— `dev_sam`, `staging`, `prod`, or `pr-147`. We'll branch on
+`stage.startsWith("pr-")` to decide whether to create a project or
+reference one.
+
+## Reference the shared project for PR stages
+
+Replace the unconditional `Neon.Project(...)` with a conditional
+that uses `Neon.Project.ref(...)` when the stage is a PR preview:
+
+```diff lang="typescript"
+-  const project = yield* Neon.Project("app-db", {
+-    region: "aws-us-east-1",
+-  });
++  const project = stage.startsWith("pr-")
++    ? yield* Neon.Project.ref("app-db", { stage: "staging" })
++    : yield* Neon.Project("app-db", {
++        region: "aws-us-east-1",
++      });
+```
+
+`Resource.ref` returns a typed reference to a resource that's
+already been deployed in another stage. The lookup is keyed by
+`{ stack, stage, id }`:
+
+- The logical ID `"app-db"` matches the project the `staging`
+  stage creates.
+- `stage: "staging"` tells the lookup which stage's state file to
+  read from.
+- The current stack is implied — both stages share it.
+
+`project` has type `Neon.Project` regardless of which branch ran.
+The downstream `Neon.Branch` doesn't know (or care) which path
+produced it.
+
+For the bigger picture see [Shared database across stages](/guides/shared-database).
+
+## The branch is still per-stage
+
+Nothing changes below the project line. `Neon.Branch` still creates
+a fresh branch per stage, off whichever project the conditional
+returned:
+
+```typescript
+const branch = yield* Neon.Branch("app-branch", {
+  project,
+  migrationsDir: schema.out,
+});
+```
+
+Branches are copy-on-write and free, so each PR stage gets a fully
+isolated database — its own writes, its own migration history —
+without paying for a whole Postgres cluster.
+
+## Assembled file
+
+```typescript
+// src/Db.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const NeonDb = Effect.gen(function* () {
+  const { stage } = yield* Alchemy.Stack;
+
+  const schema = yield* Drizzle.Schema("app-schema", {
+    schema: "./src/schema.ts",
+    out: "./migrations",
+  });
+
+  const project = stage.startsWith("pr-")
+    ? yield* Neon.Project.ref("app-db", { stage: "staging" })
+    : yield* Neon.Project("app-db", {
+        region: "aws-us-east-1",
+      });
+
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+    migrationsDir: schema.out,
+  });
+
+  return { project, branch, schema };
+});
+
+export const Hyperdrive = Effect.gen(function* () {
+  const { branch } = yield* NeonDb;
+  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
+    origin: branch.origin,
+  });
+});
+```
+
+## Deploy `staging` to seed the shared project
+
+PR stages can only reference what `staging` has already deployed,
+so `staging` has to go first:
+
+```sh
+bun alchemy deploy --stage staging
+```
+
+This runs the full path — creates `app-db` (the project),
+`app-branch` against it, and `app-hyperdrive` in front. The state
+for `Neon.Project("app-db")` lands in the `staging` state file,
+which is what PR stages will read against.
+
+## Deploy a PR stage
+
+Now deploy a PR-preview stage. The same code, different stage flag:
+
+```sh
+bun alchemy deploy --stage pr-147
+```
+
+The plan is noticeably shorter:
+
+- `Neon.Project("app-db")` → resolved as a **reference** to
+  staging's project. No API call.
+- `Neon.Branch("app-branch")` → freshly created against the
+  referenced project.
+- `Cloudflare.Hyperdrive("app-hyperdrive")` → points at the new
+  branch's `origin`.
+- `Api` → freshly created.
+
+The PR stage has its own isolated branch, its own Hyperdrive, its
+own Worker — and it shares the project with `staging`.
+
+:::tip
+If you `alchemy deploy --stage pr-147` *before* `staging` exists,
+plan fails with `InvalidReferenceError` because there's nothing
+under `{ stack, stage: "staging", id: "app-db" }` to read. Deploy
+`staging` first.
+:::
+
+## Tear it down
+
+```sh
+bun alchemy destroy --stage pr-147
+```
+
+Destroy removes the per-stage resources — the branch, the
+Hyperdrive, the Worker — but leaves the referenced project
+untouched. Alchemy doesn't own `app-db` from this stage's
+perspective, so it can't delete it. The shared project keeps
+serving every other PR stage and `staging` itself.
+
+## Where to from here
+
+You now have:
+
+- A **shared** Neon project owned by `staging`, surviving every
+  PR stage's lifecycle.
+- **Per-stage** Neon branches with their own migrations and data.
+- A deploy/destroy story that scales to dozens of preview
+  environments without flooding Neon with one project per PR.
+
+The same `Resource.ref` pattern works for any other expensive,
+shared resource you have — an S3 bucket of seed fixtures, a global
+rate-limiter Durable Object, a DNS zone. Anywhere a per-stage
+copy is wasteful, lift it to a long-lived stage and reference it
+from the rest.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/containers.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/containers.mdx
new file mode 100644
index 00000000000..29a71ba1844
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/containers.mdx
@@ -0,0 +1,504 @@
+---
+title: Run a Container
+description: Run a long-lived container alongside a Durable Object, expose RPC methods, and proxy HTTP requests to ports inside the container.
+sidebar:
+  order: 4
+---
+
+Some workloads need a long-lived process — a sandboxed shell, a
+database client, a binary you can't compile to wasm. In this part
+you'll add a **Cloudflare Container** that runs alongside a Durable
+Object instance, and call into it to execute shell commands.
+
+## Declare the Sandbox class
+
+Create `src/Sandbox.ts` with the bare class declaration. No methods
+yet — just the name and the entrypoint file:
+
+```typescript
+// src/Sandbox.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export class Sandbox extends Cloudflare.Container<Sandbox>()(
+  "Sandbox",
+  { main: import.meta.filename },
+) {}
+```
+
+The `Cloudflare.Container<Sandbox>()(...)` shape is the same
+ceremony as `DurableObjectNamespace` — the empty `()` lets
+TypeScript capture the class identity for the typed RPC stub.
+
+## Add a typed interface
+
+Pin the public RPC surface with a second type parameter. This is
+analogous to declaring an Effect `Context.Service` — the type lists
+every method callers can invoke, and the runtime implementation has
+to match:
+
+```diff lang="typescript"
+// src/Sandbox.ts
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as Effect from "effect/Effect";
++import type { PlatformError } from "effect/PlatformError";
+
+-export class Sandbox extends Cloudflare.Container<Sandbox>()(
++export class Sandbox extends Cloudflare.Container<
++  Sandbox,
++  {
++    exec: (command: string) => Effect.Effect<
++      { exitCode: number; stdout: string; stderr: string },
++      PlatformError
++    >;
++  }
++>()(
+  "Sandbox",
+  { main: import.meta.filename },
+) {}
+```
+
+Once the interface is declared, anything that binds `Sandbox` sees
+`exec(command)` as a typed RPC method returning
+`Effect<{ exitCode, stdout, stderr }, PlatformError>`.
+
+## Customize per stage
+
+The container's deploy-time props can read the surrounding Stack
+through `Stack.useSync`. Use it to pick a beefier instance type in
+`prod` and the cheap `dev` instance everywhere else:
+
+```diff lang="typescript"
+// src/Sandbox.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import type { PlatformError } from "effect/PlatformError";
++import { Stack } from "alchemy/Stack";
+
+export class Sandbox extends Cloudflare.Container<
+  Sandbox,
+  {
+    exec: (command: string) => Effect.Effect<
+      { exitCode: number; stdout: string; stderr: string },
+      PlatformError
+    >;
+  }
+>()(
+  "Sandbox",
+-  { main: import.meta.filename },
++  Stack.useSync((stack) => ({
++    main: import.meta.filename,
++    instanceType: stack.stage === "prod" ? "standard-1" : "dev",
++    observability: { logs: { enabled: true } },
++  })),
+) {}
+```
+
+`Stack.useSync` is the synchronous accessor for any data in the
+surrounding Effect context — handy for stack-level config like
+stage, app name, or anything else you'd want to vary per
+environment.
+
+## Add the runtime file
+
+The class above is just a typed identifier — it has no
+implementation yet. Containers always split the implementation
+into a **separate file** because the Durable Object that binds the
+container imports the class. If the runtime lived in the same
+file, the DO bundle would pull in process spawners, Node APIs,
+SDKs, etc. and Cloudflare Workers would reject it.
+
+Create `src/Sandbox.runtime.ts` with an empty `.make()` shell:
+
+```typescript
+// src/Sandbox.runtime.ts
+import * as Effect from "effect/Effect";
+import { Sandbox } from "./Sandbox.ts";
+
+export const SandboxLive = Sandbox.make(
+  Effect.gen(function* () {
+    return Sandbox.of({
+      // exec + fetch will go here
+    });
+  }),
+);
+
+export default SandboxLive;
+```
+
+`Sandbox.of(...)` is an identity function carrying the container's
+typed shape — it ensures your implementation matches the interface
+you declared on the class. Right now it complains because `exec`
+is missing. Let's fill it in.
+
+## Implement `exec` as an RPC method
+
+Containers have **RPC methods** — the same pattern you used on
+the `Counter` Durable Object in
+[Add a Durable Object](/tutorial/cloudflare/durable-objects).
+Anything you return from `Sandbox.of({ ... })` whose value is an
+`Effect` becomes a typed RPC method that callers can invoke
+through the typed handle.
+
+The interface declared on the class promised an `exec(command)`
+method. Implement it now:
+
+```diff lang="typescript"
+// src/Sandbox.runtime.ts
+import * as Effect from "effect/Effect";
++import * as Stream from "effect/Stream";
++import * as ChildProcess from "effect/unstable/process/ChildProcess";
++import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { Sandbox } from "./Sandbox.ts";
+
+export const SandboxLive = Sandbox.make(
+  Effect.gen(function* () {
++   const cp = yield* ChildProcessSpawner;
+
+    return Sandbox.of({
++     exec: (command) =>
++       cp
++         .spawn(ChildProcess.make(command, { shell: true }))
++         .pipe(
++           Effect.flatMap((handle) =>
++             Effect.all(
++               [
++                 handle.exitCode,
++                 handle.stdout.pipe(Stream.decodeText, Stream.mkString),
++                 handle.stderr.pipe(Stream.decodeText, Stream.mkString),
++               ],
++               { concurrency: "unbounded" },
++             ),
++           ),
++           Effect.map(([exitCode, stdout, stderr]) => ({
++             exitCode,
++             stdout,
++             stderr,
++           })),
++           Effect.scoped,
++         ),
+    });
+  }),
+);
+
+export default SandboxLive;
+```
+
+The body shells out via Effect's `ChildProcessSpawner` and
+collects stdout/stderr/exit code, but the **shape** is what
+matters: a function returning an `Effect` becomes a typed RPC
+method. When the Worker (via the Durable Object) calls
+`agent.exec("echo hi")`, it gets back an
+`Effect<{ exitCode, stdout, stderr }>` — exactly the type
+declared on the class.
+
+## Add an HTTP handler
+
+A container can also serve HTTP. Add a `fetch` field — Alchemy
+binds it to port `3000` inside the container by default, so any
+HTTP server you'd normally run inside Docker just works:
+
+```diff lang="typescript"
+// src/Sandbox.runtime.ts
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
++import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import { Sandbox } from "./Sandbox.ts";
+
+export const SandboxLive = Sandbox.make(
+  Effect.gen(function* () {
+    const cp = yield* ChildProcessSpawner;
+
+    return Sandbox.of({
+      exec: /* ... unchanged ... */,
++      fetch: Effect.succeed(
++        HttpServerResponse.text("Hello from the Sandbox container!"),
++      ),
+    });
+  }),
+);
+```
+
+`fetch` and RPC methods like `exec` are independent — a caller
+decides which they want by either calling `getTcpPort(3000).fetch`
+(HTTP) or invoking `.exec(...)` directly (RPC). We'll use both
+later in the bonus section.
+
+## Bind the container from a Durable Object
+
+Workers don't talk to containers directly — every container has a
+**Durable Object in front of it** that owns its lifecycle. Create
+`src/Agent.ts` with the bare DO shell that imports the `Sandbox`
+class:
+
+```typescript
+// src/Agent.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Sandbox } from "./Sandbox.ts";
+
+export default class Agent extends Cloudflare.DurableObjectNamespace<Agent>()(
+  "Agents",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      return {};
+    });
+  }),
+) {}
+```
+
+Importing `Sandbox` (the class) does **not** pull in the runtime —
+that lives in `Sandbox.runtime.ts` and Rolldown tree-shakes it out.
+
+## Bind the container in the outer phase
+
+`Cloudflare.Container.bind(Sandbox)` registers the binding the
+same way `R2Bucket.bind` or `KVNamespace.bind` do. It belongs in
+the **outer** init phase — that runs once when the DO class is
+wired to its Worker. If you put it in the inner phase, every new
+DO instance would re-bind, which is wasteful and wrong.
+
+```diff lang="typescript"
+export default class Agent extends Cloudflare.DurableObjectNamespace<Agent>()(
+  "Agents",
+  Effect.gen(function* () {
++   const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+
+    return Effect.gen(function* () {
+      return {};
+    });
+  }),
+) {}
+```
+
+`sandbox` is now an `Effect` that, when yielded, produces a typed
+container handle. We yield it in the next step, inside the inner
+phase, so each DO instance gets its own running container.
+
+## Start the container per instance
+
+`Cloudflare.start(sandbox)` ensures the container process is
+running for **this** DO instance, then hands you the typed shape
+you declared on the class. Add it to the **inner** init and wire
+the result up as an RPC method:
+
+```diff lang="typescript"
+Effect.gen(function* () {
+  const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+
+  return Effect.gen(function* () {
++   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+
+-   return {};
++   return {
++     exec: (command: string) => container.exec(command),
++   };
+  });
+}),
+```
+running for **this** DO instance, then hands you the typed shape
+you declared on the class. Add it to the **inner** init and wire
+the result up as an RPC method:
+
+```diff lang="typescript"
+Effect.gen(function* () {
+  const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+
+  return Effect.gen(function* () {
+   const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+
+-   return {};
++   return {
++     exec: (command: string) => container.exec(command),
++   };
+  });
+}),
+```
+
+The DO instance is now a thin RPC bridge: callers invoke
+`agent.exec(cmd)`, the DO forwards to `container.exec(cmd)`, and
+the captured stdout/stderr/exitCode flow back through the typed
+shape. `Cloudflare.start` also exposes a `getTcpPort` helper for
+HTTP requests against container ports — we'll use it in the bonus
+section.
+
+## Wire the Container into the Stack
+
+The Container's `.make()` is the side-effect that registers the
+runtime — it has to be reachable from `alchemy.run.ts`. Provide
+`SandboxLive` to the Stack via `Effect.provide`:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import SandboxLive from "./src/Sandbox.runtime.ts";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
+    return { url: worker.url };
++  }).pipe(Effect.provide(SandboxLive)),
+);
+```
+
+The Worker binds `Agent` and exposes the `/sandbox/exec` route:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import Agent from "./Agent.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
++    const agents = yield* Agent;
+
+    return {
+      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++
++        if (request.url === "/sandbox/exec" && request.method === "POST") {
++          const command = yield* request.text;
++          const result = yield* agents
++            .getByName("default")
++            .exec(command)
++            .pipe(Effect.orDie);
++          return yield* HttpServerResponse.json(result);
++        }
++
+        return HttpServerResponse.text("Hello from my Worker!");
+      }),
+    };
+  }),
+);
+```
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+The first deploy uploads the container image to Cloudflare and
+provisions the registry — expect it to take a minute or two longer
+than usual.
+
+## Verify
+
+Add a test that POSTs a shell command and expects the captured
+stdout in the response:
+
+```diff lang="typescript"
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
++import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++test(
++  "Sandbox container executes a shell command",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++
++    const response = yield* HttpClient.post(`${url}/sandbox/exec`, {
++      body: HttpBody.text("echo hi"),
++    });
++    const body = yield* response.json;
++    expect(body).toMatchObject({ stdout: "hi\n", exitCode: 0 });
++  }),
++  { timeout: 60_000 },
++);
+```
+
+```sh
+bun test test/integ.test.ts
+```
+
+The first request boots the container (which takes a few seconds —
+hence the bumped timeout); subsequent requests reuse the warm
+instance until Cloudflare evicts it for inactivity.
+
+## Bonus: HTTP requests against a container port
+
+Containers can run any HTTP server. The `Sandbox.runtime.ts` above
+exposes `fetch` on port `3000` by default. Add a `hello` RPC method
+to `Agent.ts` that proxies to it via `getTcpPort`:
+
+```diff lang="typescript"
+// src/Agent.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { Sandbox } from "./Sandbox.ts";
+
+export default class Agent extends Cloudflare.DurableObjectNamespace<Agent>()(
+  "Agents",
+  Effect.gen(function* () {
+    const sandbox = yield* Cloudflare.Container.bind(Sandbox);
+
+    return Effect.gen(function* () {
+      const container = yield* Cloudflare.start(sandbox, { enableInternet: true });
+
+      return {
+        exec: (command: string) => container.exec(command),
++        hello: () =>
++          Effect.gen(function* () {
++            const { fetch } = yield* container.getTcpPort(3000);
++            const response = yield* fetch(
++              HttpClientRequest.get("http://container/"),
++            );
++            return yield* response.text;
++          }),
+      };
+    });
+  }),
+) {}
+```
+
+And the matching `/sandbox/hello` route on the Worker:
+
+```diff lang="typescript"
+// src/worker.ts (inside fetch)
+if (request.url === "/sandbox/exec" && request.method === "POST") {
+  // ... unchanged ...
+}
+
++if (request.url === "/sandbox/hello") {
++  const text = yield* agents
++    .getByName("default")
++    .hello()
++    .pipe(Effect.orDie);
++  return HttpServerResponse.text(text);
++}
+```
+
+`getTcpPort(n)` returns a `Fetcher`-shaped object whose `fetch`
+method retries with backoff while the container is still booting,
+so you don't have to coordinate readiness yourself.
+
+Next you'll [add a Workflow](/tutorial/cloudflare/workflows) to
+orchestrate multi-step durable work that the container or DOs can
+trigger — perfect for jobs that need to outlive any single request.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/cross-worker-durable-object.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/cross-worker-durable-object.mdx
new file mode 100644
index 00000000000..95172c86a97
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/cross-worker-durable-object.mdx
@@ -0,0 +1,313 @@
+---
+title: Bind to another Worker's Durable Object
+description: Share a Durable Object across multiple Workers — one Worker hosts the runtime, others bind to it by scriptName for a typed RPC stub.
+sidebar:
+  order: 1.5
+---
+
+A Durable Object is _hosted_ by exactly one Worker, but any
+number of **other** Workers can bind to the same DO. This is how
+you share state across Workers: one Worker hosts the DO, every
+other Worker addresses it by `scriptName` and gets a typed RPC
+stub.
+
+By the end of this part you'll have two Workers, `WorkerA` and
+`WorkerB`, sharing a single `Counter` Durable Object. Writes
+through either Worker are visible from the other.
+
+## Move the DO into its own module
+
+The DO class lives in a separate file so both Workers can import
+it as a typed identifier without pulling in the runtime
+implementation.
+
+```typescript
+// src/object.ts
+import type { RuntimeContext } from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export class Counter extends Cloudflare.DurableObjectNamespace<
+  Counter,
+  {
+    increment: () => Effect.Effect<number, never, RuntimeContext>;
+    get: () => Effect.Effect<number, never, RuntimeContext>;
+  }
+>()("Counter") {}
+```
+
+The class is purely a tagged identifier. Both Workers can import
+it without dragging in the runtime — the bundler tree-shakes
+`.make()` (which we'll add next) out of any consumer that
+doesn't actually host the DO.
+
+## Add the runtime implementation
+
+`Counter.make(...)` provides the per-instance Effect that runs
+inside the DO. Export it as `default` so it can be tree-shaken
+when imported by name.
+
+```diff lang="typescript"
+// src/object.ts
+ export class Counter extends Cloudflare.DurableObjectNamespace<
+   Counter,
+   {
+     increment: () => Effect.Effect<number, never, RuntimeContext>;
+     get: () => Effect.Effect<number, never, RuntimeContext>;
+   }
+ >()("Counter") {}
+
++export default Counter.make(
++  Effect.gen(function* () {
++    return Effect.gen(function* () {
++      const state = yield* Cloudflare.DurableObjectState;
++      let count = (yield* state.storage.get<number>("count")) ?? 0;
++
++      return {
++        increment: () =>
++          Effect.gen(function* () {
++            count += 1;
++            yield* state.storage.put("count", count);
++            return count;
++          }),
++        get: () => Effect.succeed(count),
++      };
++    });
++  }),
++);
+```
+
+Only Workers that import this file as `import CounterLive from "./object.ts"`
+will pull in the runtime. Workers that only import the class
+(`import { Counter } from "./object.ts"`) get just the type.
+
+## Declare WorkerA as the host
+
+`WorkerA` _hosts_ `Counter` — its bundle contains the DO runtime
+and Cloudflare runs the DO class inside WorkerA's script.
+
+The key move is the **third type argument** on `Cloudflare.Worker`:
+
+```typescript
+// src/workerA.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import { Counter } from "./object.ts";
+
+export class WorkerA extends Cloudflare.Worker<WorkerA, {}, Counter>()(
+  "WorkerA",
+  { main: import.meta.filename },
+) {}
+```
+
+`Worker<Self, Bindings, Deps>` — the third slot `Deps` is what
+the script publishes as part of its public contract. By writing
+`, Counter`, we're saying "WorkerA hosts Counter; other scripts
+may bind to it."
+
+:::caution[The third type argument is what unlocks cross-script binding]
+You can omit `, Counter` and the runtime still works — but
+`Counter.from(WorkerA)` from another Worker will be a **TypeScript
+error** because `WorkerA` doesn't declare `Counter` as part of its
+contract. Always declare cross-script DOs in `Deps`.
+:::
+
+## Provide the DO runtime from WorkerA
+
+`WorkerA.make(...)` is where the runtime lives. Provide
+`CounterLive` (the default export from `object.ts`) so that
+WorkerA's bundle actually contains the DO class:
+
+```diff lang="typescript"
+// src/workerA.ts
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
++import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+-import { Counter } from "./object.ts";
++import CounterLive, { Counter } from "./object.ts";
+
+ export class WorkerA extends Cloudflare.Worker<WorkerA, {}, Counter>()(
+   "WorkerA",
+   { main: import.meta.filename },
+ ) {}
+
++export default WorkerA.make(
++  Effect.gen(function* () {
++    const counters = yield* Counter;
++    return {
++      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++        const name = new URL(request.url, "http://x").pathname.slice(1);
++        const next = yield* counters.getByName(name).increment();
++        return HttpServerResponse.json({ value: next });
++      }),
++    };
++  }).pipe(Effect.provide(CounterLive)),
++);
+```
+
+`yield* Counter` inside WorkerA's init binds the DO _locally_ —
+WorkerA's `env.Counter` is wired up at deploy time and the class
+ships in the bundle.
+
+## Bind WorkerA's Counter from WorkerB
+
+`WorkerB` does **not** host the DO. It imports `WorkerA` purely
+as a type and uses `Counter.from(WorkerA)` to declare a binding
+to the existing namespace running under WorkerA's script:
+
+```typescript
+// src/workerB.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Counter } from "./object.ts";
+import { WorkerA } from "./workerA.ts";
+
+export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+  "WorkerB",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const counters = yield* Counter.from(WorkerA);
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const name = new URL(request.url, "http://x").pathname.slice(1);
+        const value = yield* counters.getByName(name).get();
+        return HttpServerResponse.json({ value });
+      }),
+    };
+  }),
+) {}
+```
+
+`Counter.from(WorkerA)` reads `WorkerA`'s `Deps` to confirm that
+`Counter` is part of its public contract, then produces a typed
+namespace stub. Under the hood it emits a Cloudflare binding with
+`scriptName: "WorkerA"` so the runtime routes every call to
+WorkerA's hosted instance.
+
+:::tip[Only the host provides `CounterLive`]
+WorkerB imports `Counter` but **never** `CounterLive`. Rolldown
+tree-shakes the runtime out of WorkerB's bundle — only WorkerA
+ships the DO class. This keeps consumer bundles small and avoids
+duplicate runtime instances.
+:::
+
+## Deploy both Workers from one Stack
+
+The Stack composes both Workers. WorkerA's Layer is provided so
+its `Counter` runtime is hooked up; WorkerB consumes it via
+binding only:
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import WorkerALive, { WorkerA } from "./src/workerA.ts";
+import WorkerB from "./src/workerB.ts";
+
+export default Alchemy.Stack(
+  "CrossWorkerDO",
+  { state: Cloudflare.state(), providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const a = yield* WorkerA;
+    const b = yield* WorkerB;
+    return {
+      urlA: a.url.as<string>(),
+      urlB: b.url.as<string>(),
+    };
+  }).pipe(Effect.provide(WorkerALive)),
+);
+```
+
+`Effect.provide(WorkerALive)` is the only place the DO runtime
+enters the program. Without it, `yield* WorkerA` would fail to
+resolve.
+
+## Verify shared state
+
+Hit `urlA/foo` to increment, then `urlB/foo` to read — both
+Workers route to the same DO instance by name:
+
+```typescript
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Vitest";
+import { expect } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+test(
+  "WorkerB reads counter written by WorkerA",
+  Effect.gen(function* () {
+    const { urlA, urlB } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    yield* client.post(`${urlA}/`);
+    yield* client.post(`${urlA}/`);
+
+    const res = yield* client.get(`${urlB}/`);
+    expect((yield* res.json) as { value: number }).toEqual({ value: 2 });
+  }),
+);
+```
+
+## Prefer `Counter.from(Self)` inside Layers
+
+Inside `WorkerA.make` we wrote `yield* Counter` to bind the
+locally-hosted DO. That works, but it's not the form you want
+when the code might be extracted into a reusable Layer or shared
+between scripts.
+
+`Counter.from(WorkerA)` also works inside `WorkerA` itself —
+calling `.from(Self)` on the host resolves to the same local
+namespace as `yield* Counter`:
+
+```diff lang="typescript"
+// src/workerA.ts
+ export default WorkerA.make(
+   Effect.gen(function* () {
+-    const counters = yield* Counter;
++    const counters = yield* Counter.from(WorkerA);
+     return {
+       fetch: Effect.gen(function* () { ... }),
+     };
+   }).pipe(Effect.provide(CounterLive)),
+ );
+```
+
+This matters most when you extract `fetch` logic into a Layer
+(or any service) that wants a `Counter` namespace. With
+`Counter.from(Self)`, the service is explicit about _which_
+script's Counter it talks to. A Worker that hosts its own
+isolated namespace uses `.from(Self)`; a consumer Worker uses
+`.from(Host)`. The shape is identical, which keeps the Layer
+host-agnostic.
+
+:::tip[A Worker can host its own isolated namespace]
+If `WorkerC` declares `Counter` in its own contract
+(`Worker<WorkerC, {}, Counter>`) and provides `CounterLive`,
+then `Counter.from(WorkerC)` from inside `WorkerC` binds to a
+**separate** DO namespace — instances under WorkerC are
+isolated from WorkerA's. This is how you give each script its
+own private set of DO instances using the same class.
+:::
+
+## Closing
+
+Two Workers, one DO, type-safe end-to-end. The third type argument
+`, Counter` on `WorkerA` is the small but critical piece that
+makes `Counter.from(WorkerA)` type-check from `WorkerB` — and
+that same form (`Counter.from(Self)`) lets a host script bind to
+its own DO from inside a Layer without caring whether it's the
+host or a consumer.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/drizzle.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/drizzle.mdx
new file mode 100644
index 00000000000..77022cba1fe
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/drizzle.mdx
@@ -0,0 +1,311 @@
+---
+title: Add Drizzle ORM
+description: Replace raw pg with Drizzle's effect-postgres integration, manage your schema as a resource, and have alchemy generate and apply migrations on every deploy.
+sidebar:
+  order: 8
+---
+
+import { Code, Tabs, TabItem } from "@astrojs/starlight/components";
+
+export const drizzleDeps = `drizzle-orm@^1.0.0-rc.1 @effect/sql-pg pg`;
+export const drizzleDevDeps = `drizzle-kit@^1.0.0-rc.1 @types/pg`;
+
+The previous tutorial wired your Worker to Neon Postgres through
+Hyperdrive. Now we'll layer **Drizzle ORM** on top: typed schemas,
+typed queries, and — most usefully — a `Drizzle.Schema` resource
+that regenerates migration SQL programmatically on every deploy
+and lets `Neon.Branch` apply them transactionally.
+
+## Define the schema
+
+Drizzle schemas are plain TypeScript modules. Create
+`src/schema.ts`:
+
+```typescript
+// src/schema.ts
+import {
+  integer,
+  pgTable,
+  serial,
+  text,
+  timestamp,
+} from "drizzle-orm/pg-core";
+
+export const Users = pgTable("users", {
+  id: serial("id").primaryKey(),
+  email: text("email").notNull().unique(),
+  name: text("name").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+
+export const Posts = pgTable("posts", {
+  id: serial("id").primaryKey(),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => Users.id, { onDelete: "cascade" }),
+  title: text("title").notNull(),
+  body: text("body").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+```
+
+## Add the Drizzle provider
+
+`Drizzle.Schema` is registered through its own `providers()` layer
+— a build-time provider that owns your migrations directory:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyStack",
+  {
+-    providers: Layer.mergeAll(Cloudflare.providers(), Neon.providers()),
++    providers: Layer.mergeAll(
++      Cloudflare.providers(),
++      Drizzle.providers(),
++      Neon.providers(),
++    ),
+    state: Alchemy.localState(),
+  },
+  // ...
+);
+```
+
+The provider has no required credentials — it just needs
+`drizzle-kit` installed (declared as an optional peer of `alchemy`).
+Add `drizzle-orm`, `@effect/sql-pg`, and `pg` as runtime deps and
+`drizzle-kit` + `@types/pg` as dev deps:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code={`bun add ${drizzleDeps}\nbun add -d ${drizzleDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code={`npm install ${drizzleDeps}\nnpm install -D ${drizzleDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code={`pnpm add ${drizzleDeps}\npnpm add -D ${drizzleDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code={`yarn add ${drizzleDeps}\nyarn add -D ${drizzleDevDeps}`} lang="sh" />
+  </TabItem>
+</Tabs>
+
+## Add `Drizzle.Schema` to your Db effect
+
+Inline the schema resource directly into `NeonDb` — its `out`
+output becomes the input to `Neon.Branch`'s `migrationsDir`, so
+alchemy automatically schedules `Drizzle.Schema` *before* the
+branch resource each deploy:
+
+```diff lang="typescript"
+// src/Db.ts
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as Drizzle from "alchemy/Drizzle";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const NeonDb = Effect.gen(function* () {
++  const schema = yield* Drizzle.Schema("app-schema", {
++    schema: "./src/schema.ts",
++    out: "./migrations",
++  });
++
+  const project = yield* Neon.Project("app-db", { region: "aws-us-east-1" });
+-  const branch = yield* Neon.Branch("app-branch", { project });
++  const branch = yield* Neon.Branch("app-branch", {
++    project,
++    migrationsDir: schema.out,
++  });
+-  return { project, branch };
++  return { project, branch, schema };
+});
+```
+
+On every `bun alchemy deploy`, the provider:
+
+1. Loads `./src/schema.ts` via dynamic `import()`.
+2. Calls `drizzle-kit/api-postgres`'s `generateDrizzleJson` against
+   the schema and `generateMigration` against the previous
+   snapshot under `./migrations`.
+3. If anything changed, writes a new
+   `migrations/<timestamp>_migration/{migration.sql, snapshot.json}`
+   directory.
+4. `Neon.Branch` then runs every pending `.sql` file
+   transactionally against the branch's primary database.
+
+No `drizzle-kit generate` step in your CI — the deploy owns it.
+
+## Open the connection with `Drizzle.postgres`
+
+`Drizzle.postgres` takes Hyperdrive's connection string and returns a
+typed `EffectPgDatabase` whose pool lives for the lifetime of the
+Worker isolate. Bind it once at init and use it directly inside
+`fetch` — no per-request `Client` setup, no `Effect.promise(...)`
+wrappers around queries:
+
+```typescript
+// src/Api.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Drizzle from "alchemy/Drizzle";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Hyperdrive } from "./Db.ts";
+import { Users } from "./schema.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.path,
+    compatibility: {
+      // node-postgres needs Node.js APIs to run inside a Worker.
+      flags: ["nodejs_compat"],
+    },
+  },
+  Effect.gen(function* () {
+    const hd = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+    const db = yield* Drizzle.postgres(hd.connectionString);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const users = yield* db.select().from(Users);
+        return yield* HttpServerResponse.json(users);
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.HyperdriveConnectionLive)),
+) {}
+```
+
+A few things to call out:
+
+- `db.select().from(Users)` is an `Effect`. You `yield*` it directly.
+  The full drizzle/effect-postgres builder is supported (`select`,
+  `insert`, `update`, `delete`, `with`, transactions).
+- The pool is created exactly once per Worker isolate. Subsequent
+  requests reuse the same pool — there's no per-request connection
+  setup.
+- `nodejs_compat` is required because `pg` (node-postgres) powers the
+  underlying transport.
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+The first deploy regenerates `./migrations` from your schema (since
+no snapshot exists yet) and applies the resulting `CREATE TABLE`
+statements to your branch. Hit your Worker URL and you should see:
+
+```json
+[]
+```
+
+## Define relations for typed `db.query`
+
+The basic client supports the SQL builder (`select`, `insert`, etc.)
+but not the relational query API. To unlock `db.query.*` with typed
+`with` clauses, declare your relations using `defineRelations` and
+export them from `src/schema.ts`:
+
+```diff lang="typescript"
+// src/schema.ts
++import { defineRelations } from "drizzle-orm";
+ import {
+   integer,
+   pgTable,
+   serial,
+   text,
+   timestamp,
+ } from "drizzle-orm/pg-core";
+
+ export const Users = pgTable("users", { /* ... */ });
+ export const Posts = pgTable("posts", { /* ... */ });
+
++export const relations = defineRelations({ Users, Posts }, (t) => ({
++  Users: {
++    posts: t.many.Posts(),
++  },
++  Posts: {
++    user: t.one.Users({
++      from: t.Posts.userId,
++      to: t.Users.id,
++    }),
++  },
++}));
+```
+
+`defineRelations` is purely a type-level + metadata wiring step — it
+doesn't touch the generated migration SQL. The foreign key was
+already declared on `Posts.userId.references(...)`.
+
+## Pass `relations` to `Drizzle.postgres`
+
+Hand the relations object to `Drizzle.postgres` as its second
+argument. The returned `db` now exposes a typed `db.query` namespace
+keyed by your table names:
+
+```diff lang="typescript"
+// src/Api.ts
+ import { Hyperdrive } from "./Db.ts";
+-import { Users } from "./schema.ts";
++import { relations, Users } from "./schema.ts";
+
+ Effect.gen(function* () {
+   const hd = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
+-  const db = yield* Drizzle.postgres(hd.connectionString);
++  const db = yield* Drizzle.postgres(hd.connectionString, {
++    relations,
++  });
+
+   return {
+     fetch: Effect.gen(function* () {
+-      const users = yield* db.select().from(Users);
+-      return yield* HttpServerResponse.json(users);
++      const user = yield* db.query.Users.findFirst({
++        where: { id: 1 },
++        with: { posts: true },
++      });
++      return yield* HttpServerResponse.json({ user });
+     }),
+   };
+ })
+```
+
+`db.query.Users.findFirst` is fully typed: `where` accepts a typed
+predicate object keyed by `Users` columns, and `with: { posts: true }`
+is only valid because `relations` declared `Users.posts`. The result
+type includes `posts: Post[]` automatically — no manual joins.
+
+## Iterate on the schema
+
+Add a column or a table to `src/schema.ts` and run
+`bun alchemy deploy` again. The provider:
+
+1. Diffs the new schema against the latest snapshot.
+2. Writes a *new* migration directory with just the delta SQL.
+3. `Neon.Branch` notices the new file, runs it inside a
+   transaction, and records it in the `neon_migrations` tracking
+   table so it's not re-applied.
+
+Roll back simply by reverting your schema change and redeploying —
+or by spinning up a `Neon.Branch` that forks from a point-in-time
+LSN before the migration.
+
+## Where to from here
+
+Your Worker now has typed Postgres queries through Drizzle, an
+edge-pooled connection through Hyperdrive, automatically-generated
+migrations, and per-deploy state validated against your TypeScript
+schema. That's the full database story for the Cloudflare track —
+combine it freely with the Durable Objects, Workflows, AI Gateway,
+and Container primitives from earlier tutorials.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/durable-objects.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/durable-objects.mdx
new file mode 100644
index 00000000000..1a537f7fd28
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/durable-objects.mdx
@@ -0,0 +1,347 @@
+---
+title: Add a Durable Object
+description: Add a Durable Object to your Worker — persist state per key, expose RPC methods, and stream values back to the client.
+sidebar:
+  order: 1
+---
+
+By the end of [Part 5](/tutorial/part-5) you have a Worker
+deploying to multiple stages from CI. From here, the Cloudflare
+track adds one stateful primitive at a time. First up: a `Counter`
+Durable Object that keeps a per-key count in transactional storage,
+exposes RPC methods, and streams a sequence of numbers back to the
+caller.
+
+## Create the Counter file
+
+A Durable Object is a globally-unique stateful instance addressed
+by name (or by id). Like Workers, it has two `Effect.gen` blocks:
+the outer one runs at init time, and the inner one runs every time
+a new instance starts up and returns the public API.
+
+Create `src/counter.ts` with the smallest possible DO — empty
+public API, no state yet:
+
+```typescript twoslash
+// src/counter.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default class Counter extends Cloudflare.DurableObjectNamespace<Counter>()(
+  "Counter",
+  Effect.gen(function* () {
+    // Outer (init): runs once when the DO class is bound to a
+    // Worker. Resolve shared dependencies here.
+    return Effect.gen(function* () {
+      // Inner (per-instance): runs every time a new DO instance is
+      // constructed. Returns the public API for that instance.
+      return {};
+    });
+  }),
+) {}
+```
+
+:::tip[Why `Counter<Counter>()(...)` ?]
+The empty `()` after `Counter<Counter>` lets TypeScript capture the
+class identity for the typed RPC stub. It's a one-time bit of
+ceremony — the rest of your DO code looks completely normal.
+:::
+
+## Persist the count
+
+Each DO instance has its own key/value storage, backed by SQLite.
+Pull the current count out of storage in the inner init so it
+survives restarts and hibernation:
+
+```diff lang="typescript"
+return Effect.gen(function* () {
++  const state = yield* Cloudflare.DurableObjectState;
++  let count = (yield* state.storage.get<number>("count")) ?? 0;
+  return {};
+});
+```
+
+`Cloudflare.DurableObjectState` is the same per-instance handle
+Cloudflare exposes for `storage`, `setAlarm`, `acceptWebSocket`,
+and friends. We'll use it more in the next part for WebSockets.
+
+## Add `increment` and `get`
+
+Any function you return from the inner Effect that produces an
+`Effect` becomes a typed RPC method. Add one to mutate the count
+and one to read it:
+
+```diff lang="typescript"
+return Effect.gen(function* () {
+  const state = yield* Cloudflare.DurableObjectState;
+  let count = (yield* state.storage.get<number>("count")) ?? 0;
+-  return {};
++  return {
++    increment: () =>
++      Effect.gen(function* () {
++        count += 1;
++        yield* state.storage.put("count", count);
++        return count;
++      }),
++    get: () => Effect.succeed(count),
++  };
+});
+```
+
+Workers will see `counter.increment()` returning
+`Effect<number>` and `counter.get()` returning `Effect<number>`,
+fully type-checked through the Cloudflare RPC machinery.
+
+## Bind the DO to the Worker
+
+Yield the `Counter` class in your Worker's init phase to get a
+namespace handle:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import Counter from "./counter.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
++    const counters = yield* Counter;
+
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello from my Worker!");
+      }),
+    };
+  }),
+);
+```
+
+`yield* Counter` in init registers the DO with the Worker
+(binding + class-migration metadata) and hands you the namespace.
+
+## Call the DO from `fetch`
+
+Inside the `fetch` handler, route `POST /counter/:name` to the DO
+by calling `getByName(...)` to obtain a typed stub, then invoking
+`increment()`:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import Counter from "./counter.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const counters = yield* Counter;
+
+    return {
+      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++
++        if (request.url.startsWith("/counter/") && request.method === "POST") {
++          const name = request.url.split("/").pop()!;
++          const next = yield* counters.getByName(name).increment();
++          return HttpServerResponse.text(String(next));
++        }
++
+        return HttpServerResponse.text("Hello from my Worker!");
+      }),
+    };
+  }),
+);
+```
+
+`counters.getByName(name)` returns a typed stub: the Worker sees
+`increment(): Effect<number>` and `get(): Effect<number>` exactly as
+you defined them. Calling `.increment()` round-trips through
+Cloudflare's RPC machinery to the durable instance.
+
+## Deploy and verify
+
+Re-deploy. Alchemy plans a Worker update and a new `Counter`
+namespace:
+
+```sh
+bun alchemy deploy
+```
+
+Add a test that hits `/counter/foo` twice (expecting `1` then `2`)
+and `/counter/bar` once (expecting `1`) — each name addresses its
+own stateful instance:
+
+```diff lang="typescript"
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++test(
++   "Counter persists per key",
++   Effect.gen(function* () {
++     const { url } = yield* stack;
++
++     const a1 = yield* HttpClient.post(`${url}/counter/foo`);
++     expect(yield* a1.text).toBe("1");
++
++     const a2 = yield* HttpClient.post(`${url}/counter/foo`);
++     expect(yield* a2.text).toBe("2");
++
++     const b1 = yield* HttpClient.post(`${url}/counter/bar`);
++     expect(yield* b1.text).toBe("1");
++   }),
++);
+```
+
+```sh
+bun test test/integ.test.ts
+```
+
+## Stream RPC return values
+
+RPC isn't limited to single values — any `Effect` (or `Stream`) you
+return becomes a typed RPC method. Let's add a `tick(n)` method that
+emits a sequence of numbers `100ms` apart, then expose an HTTP route
+that streams them back to the client.
+
+Add `tick` to `src/counter.ts`:
+
+```diff lang="typescript"
+// src/counter.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import * as Schedule from "effect/Schedule";
++import * as Stream from "effect/Stream";
+
+export default class Counter extends Cloudflare.DurableObjectNamespace<Counter>()(
+  "Counter",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      const state = yield* Cloudflare.DurableObjectState;
+      let count = (yield* state.storage.get<number>("count")) ?? 0;
+
+      return {
+        increment: () =>
+          Effect.gen(function* () {
+            count += 1;
+            yield* state.storage.put("count", count);
+            return count;
+          }),
+        get: () => Effect.succeed(count),
++        tick: (n: number) =>
++          Stream.iterate(0, (i) => i + 1).pipe(
++            Stream.take(n),
++            Stream.schedule(Schedule.spaced("100 millis")),
++          ),
+      };
+    });
+  }),
+) {}
+```
+
+Forward the stream from the Worker's `fetch` handler. Use
+`HttpServerResponse.stream` to flush each chunk as it arrives:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import * as Stream from "effect/Stream";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import Counter from "./counter.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const counters = yield* Counter;
+
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+
+        if (request.url.startsWith("/counter/") && request.method === "POST") {
+          const name = request.url.split("/").pop()!;
+          const next = yield* counters.getByName(name).increment();
+          return HttpServerResponse.text(String(next));
+        }
+
++        if (request.url.startsWith("/tick/") && request.method === "GET") {
++          const n = Number(request.url.split("/").pop()!);
++          const stream = counters.getByName("tick").tick(n).pipe(
++            Stream.map((i) => `${i}\n`),
++            Stream.encodeText,
++          );
++          return HttpServerResponse.stream(stream, {
++            headers: { "content-type": "text/plain" },
++          });
++        }
++
+        return HttpServerResponse.text("Hello from my Worker!");
+      }),
+    };
+  }),
+);
+```
+
+Add the test:
+
+```diff lang="typescript"
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
++import * as Stream from "effect/Stream";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++test(
++   "tick streams 5 sequential values",
++   Effect.gen(function* () {
++     const { url } = yield* stack;
++
++     const response = yield* HttpClient.get(`${url}/tick/5`);
++     const lines = yield* response.stream.pipe(
++       Stream.decodeText,
++       Stream.splitLines,
++       Stream.runCollect,
++     );
++     expect([...lines]).toEqual(["0", "1", "2", "3", "4"]);
++   }),
++);
+```
+
+The DO produces values lazily, the runtime ferries each chunk back
+to the Worker, and the Worker pipes them straight onto the HTTP
+response — all type-checked end-to-end.
+
+Next you'll teach a Durable Object to
+[accept WebSocket connections](/tutorial/cloudflare/hibernatable-websockets) —
+and learn how Cloudflare hibernates idle DOs while keeping
+connections alive.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/hibernatable-websockets.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/hibernatable-websockets.mdx
new file mode 100644
index 00000000000..bc620f9bb80
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/hibernatable-websockets.mdx
@@ -0,0 +1,556 @@
+---
+title: Accept WebSockets
+description: Accept WebSocket connections in a Durable Object, broadcast between peers, and survive Cloudflare's hibernation.
+sidebar:
+  order: 2
+---
+
+The `Counter` Durable Object you added in the previous part holds
+state per key but only over plain HTTP. Now you'll build `Room` — a
+chat Durable Object that accepts WebSocket connections, broadcasts
+messages between peers, and **survives hibernation**.
+
+Cloudflare can evict an idle Durable Object from memory while
+keeping its WebSocket connections open. When a message arrives the
+DO is reconstructed from scratch, your init Effect runs again, and
+your `webSocketMessage` handler is invoked. Any per-instance state
+you held in JavaScript variables is gone — you have to put it back.
+
+## Accept a connection
+
+Start with the smallest possible Room — just enough to complete
+the WebSocket handshake. Create `src/room.ts`:
+
+```typescript
+// src/room.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default class Room extends Cloudflare.DurableObjectNamespace<Room>()(
+  "Rooms",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      return {
+        fetch: Effect.gen(function* () {
+          const [response, socket] = yield* Cloudflare.upgrade();
+          return response;
+        }),
+      };
+    });
+  }),
+) {}
+```
+
+`Cloudflare.upgrade()` does two things in one call: it builds a
+`101 Switching Protocols` response with the right headers, and it
+hands you a `DurableWebSocket` you can `send` / `close` /
+`serializeAttachment` on. Returning the response from `fetch` is
+what tells Cloudflare to hijack the TCP connection and complete the
+handshake.
+
+This compiles and accepts connections, but messages go nowhere yet.
+
+## Remember who's connected
+
+Add a `sessions` map and stash the new socket into it on every
+upgrade. Tag each socket with an id so we know which session sent
+what later:
+
+```diff lang="typescript"
+// src/room.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default class Room extends Cloudflare.DurableObjectNamespace<Room>()(
+  "Rooms",
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
++      const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
+      return {
+        fetch: Effect.gen(function* () {
+          const [response, socket] = yield* Cloudflare.upgrade();
++          const id = crypto.randomUUID();
++          socket.serializeAttachment({ id });
++          sessions.set(id, socket);
+          return response;
+        }),
+      };
+    });
+  }),
+) {}
+```
+
+`socket.serializeAttachment({ id })` persists a JSON-safe value
+**alongside the socket itself**. Cloudflare keeps it across
+hibernation, so when the DO wakes back up the socket still
+remembers which session it belongs to. We'll need that in the next
+two steps.
+
+## Handle incoming messages
+
+Add a `webSocketMessage` handler. Cloudflare invokes it every time
+a peer sends data; we look up the sender's session id from the
+attachment, prefix each message with a short label, and fan it out
+to everyone in the room:
+
+```diff lang="typescript"
+return {
+  fetch: Effect.gen(function* () {
+    const [response, socket] = yield* Cloudflare.upgrade();
+    const id = crypto.randomUUID();
+    socket.serializeAttachment({ id });
+    sessions.set(id, socket);
+    return response;
+  }),
++  webSocketMessage: Effect.fnUntraced(function* (
++    socket: Cloudflare.DurableWebSocket,
++    message: string | ArrayBuffer,
++  ) {
++     const attachment = socket.deserializeAttachment<{ id: string }>();
++     if (!attachment) return;
++     const text =
++       typeof message === "string"
++         ? message
++         : new TextDecoder().decode(message);
++     const label = attachment.id.slice(0, 8);
++     for (const peer of sessions.values()) {
++       yield* peer.send(`[${label}] ${text}`);
++     }
++   }),
+};
+```
+
+`Effect.fnUntraced` lets you write a generator function with
+arbitrary parameters. The Cloudflare runtime calls it with the
+socket and the inbound payload (which can be a string or an
+`ArrayBuffer` depending on how the client sent it).
+
+## Clean up on disconnect
+
+When a peer disconnects, drop them from the `sessions` map so we
+don't try to send to a dead socket:
+
+```diff lang="typescript"
+return {
+  fetch: /* ... */,
+  webSocketMessage: /* ... */,
++  webSocketClose: Effect.fnUntraced(function* (
++    ws: Cloudflare.DurableWebSocket,
++    code: number,
++    reason: string,
++  ) {
++    const attachment = ws.deserializeAttachment<{ id: string }>();
++    if (attachment) sessions.delete(attachment.id);
++    yield* ws.close(code, reason);
++  }),
+};
+```
+
+## Restore sessions after hibernation
+
+Here's the catch. Cloudflare can evict an idle DO from memory
+while keeping its WebSockets open. When the next message arrives,
+the DO is reconstructed: the inner `Effect.gen` runs again, and
+your `sessions` map starts empty — but the open sockets are still
+there.
+
+Rehydrate the map at the top of the inner init by reading every
+attached socket back from the runtime:
+
+```diff lang="typescript"
+Effect.gen(function* () {
++  const state = yield* Cloudflare.DurableObjectState;
+  const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
++  for (const socket of yield* state.getWebSockets()) {
++    const data = socket.deserializeAttachment<{ id: string }>();
++    if (data) sessions.set(data.id, socket);
++  }
+
+  return {
+    fetch: /* ... */,
+    webSocketMessage: /* ... */,
+    webSocketClose: /* ... */,
+  };
+});
+```
+
+`state.getWebSockets()` returns every still-attached socket on the
+current instance, and `deserializeAttachment` recovers the
+`{ id }` we stashed in the upgrade step. Without this loop the
+first message after hibernation would broadcast to nobody.
+
+## Extract a broadcast helper
+
+Before wiring this up, pull the broadcast loop into a reusable
+`broadcast` function — we'll need it again when we add scheduled
+reminders below:
+
+```diff lang="typescript"
+Effect.gen(function* () {
+  const state = yield* Cloudflare.DurableObjectState;
+  const sessions = new Map<string, Cloudflare.DurableWebSocket>();
+
+  for (const socket of yield* state.getWebSockets()) {
+    const data = socket.deserializeAttachment<{ id: string }>();
+    if (data) sessions.set(data.id, socket);
+  }
+
++  const broadcast = (text: string) =>
++    Effect.gen(function* () {
++      for (const peer of sessions.values()) {
++        yield* peer.send(text);
++      }
++    });
+
+  return {
+    fetch: /* ... */,
+    webSocketMessage: Effect.fnUntraced(function* (socket, message) {
+      const attachment = socket.deserializeAttachment<{ id: string }>();
+      if (!attachment) return;
+      const text = typeof message === "string"
+        ? message
+        : new TextDecoder().decode(message);
+-      for (const peer of sessions.values()) {
+-        yield* peer.send(`[${attachment.id.slice(0, 8)}] ${text}`);
+-      }
++      yield* broadcast(`[${attachment.id.slice(0, 8)}] ${text}`);
+    }),
+    webSocketClose: /* ... */,
++    broadcast,
+  };
+});
+```
+
+Returning `broadcast` from the inner Effect makes it callable as an
+RPC method — handy when other resources (a Workflow, a Container)
+want to push messages into the room.
+
+## Wire the Room into the Worker
+
+The Worker forwards any `Upgrade: websocket` request on `/room/:id`
+to the matching DO instance:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import Room from "./room.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
++    const rooms = yield* Room;
+
+    return {
+      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++
++        if (request.url.startsWith("/room/")) {
++          if (request.headers.upgrade !== "websocket") {
++            return HttpServerResponse.text(
++              "Expected Upgrade: websocket",
++              { status: 426 },
++            );
++          }
++          const id = request.url.split("/").pop()!;
++          return yield* rooms.getByName(id).fetch(request);
++        }
++
+        return HttpServerResponse.text("Hello from my Worker!");
+      }),
+    };
+  }),
+);
+```
+
+`rooms.getByName(id).fetch(request)` is the typed equivalent of
+"forward this HTTP request to the DO". Because the DO returned a
+`fetch` field with the upgrade response, the runtime hijacks the
+TCP connection — the Worker's response **is** the WebSocket
+handshake.
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+## Connect from a test
+
+The integration test connects to the deployed Worker over a real
+WebSocket using Effect's native [`Socket`](https://effect.website/docs/platform/socket/)
+module. Unlike the raw `WebSocket` global, `Socket` is fully
+Effect-aware: the connection lifecycle is tied to a `Scope`,
+incoming frames flow through a `Queue`, and the open handshake is
+signalled with a `Deferred`.
+
+Start the test file with the imports and a `stack` deployed once
+per run:
+
+```typescript
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Queue from "effect/Queue";
+import * as Socket from "effect/unstable/socket/Socket";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+```
+
+`beforeAll(deploy(Stack))` deploys your Worker + Room once and
+exposes the result (including the public `url`) as an `Effect`
+the tests can `yield*`.
+
+## Open the socket and acquire a writer
+
+We want each test to say "give me a connected client" and get back
+something with `send` and `next` methods. Start by opening the
+socket and grabbing a writer for sending frames:
+
+```typescript
+const connect = (url: string) =>
+  Effect.gen(function* () {
+    const socket = yield* Socket.makeWebSocket(url);
+    const send = yield* socket.writer;
+
+    return {
+      send: (msg: string) => send(msg),
+    };
+  });
+```
+
+`Socket.makeWebSocket(url)` builds a `Socket` resource. It needs a
+`WebSocketConstructor` in context, which we'll provide at the test
+boundary. `socket.writer` returns a function for sending frames —
+acquiring it once is more efficient than re-deriving it per send.
+
+## Drain inbound frames into a queue
+
+To let the test consume incoming messages, push each frame into an
+unbounded `Queue` and expose a `next` accessor that pulls one off:
+
+```diff lang="typescript"
+const connect = (url: string) =>
+  Effect.gen(function* () {
+    const socket = yield* Socket.makeWebSocket(url);
++    const messages = yield* Queue.unbounded<string>();
+    const send = yield* socket.writer;
+
++    yield* Effect.forkScoped(
++      socket.runString((msg) => Queue.offer(messages, msg)),
++    );
++
+    return {
+      send: (msg: string) => send(msg),
++      next: Queue.take(messages),
+    };
+  });
+```
+
+`socket.runString` consumes inbound text frames and hands each one
+to your callback. `Effect.forkScoped` runs the read loop in the
+background, tied to the surrounding scope — when the test scope
+closes, the loop is interrupted and the socket is closed.
+
+## Wait for the open handshake
+
+Returning before the socket is actually open lets the caller race
+the handshake — `send` could fire before the server is ready. Block
+on a `Deferred` that the `onOpen` hook fulfils:
+
+```diff lang="typescript"
+const connect = (url: string) =>
+  Effect.gen(function* () {
+    const socket = yield* Socket.makeWebSocket(url);
+    const messages = yield* Queue.unbounded<string>();
+    const send = yield* socket.writer;
++    const opened = yield* Deferred.make<void>();
+
+    yield* Effect.forkScoped(
+-      socket.runString((msg) => Queue.offer(messages, msg)),
++      socket.runString((msg) => Queue.offer(messages, msg), {
++        onOpen: Deferred.succeed(opened, undefined),
++      }),
+    );
++    yield* Deferred.await(opened);
+
+    return {
+      send: (msg: string) => send(msg),
+      next: Queue.take(messages),
+    };
+  });
+```
+
+`Deferred.await(opened)` blocks the helper until `onOpen` fires, so
+the caller can `send` immediately on return without racing the
+handshake.
+
+## Write the test body
+
+Open two clients to the same room, have one send `"hello bob"`,
+and assert the other receives the broadcast. Wrap the whole effect
+in `Effect.scoped` so the test scope closes when it finishes:
+
+```typescript
+test(
+  "Room broadcasts messages between peers",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const wsUrl = url.replace(/^http/, "ws") + "/room/test";
+
+    const alice = yield* connect(wsUrl);
+    const bob = yield* connect(wsUrl);
+
+    yield* alice.send("hello bob");
+
+    const received = yield* bob.next;
+    expect(received).toMatch(/hello bob$/);
+  }).pipe(Effect.scoped),
+  { timeout: 30_000 },
+);
+```
+
+`Effect.scoped` closes the scope at the end of the test, which
+interrupts every forked read loop in `connect` and closes both
+sockets.
+
+## Provide the WebSocket constructor
+
+`Socket.makeWebSocket` doesn't know how to actually open a
+connection by itself — it depends on a `WebSocketConstructor`
+service. Provide the global one:
+
+```diff lang="typescript"
+test(
+  "Room broadcasts messages between peers",
+  Effect.gen(function* () {
+    // ...
+  }).pipe(
+    Effect.scoped,
++    Effect.provide(Socket.layerWebSocketConstructorGlobal),
+  ),
+  { timeout: 30_000 },
+);
+```
+
+`layerWebSocketConstructorGlobal` supplies the runtime's global
+`WebSocket` constructor. On Bun and Node 22+ this picks up the
+built-in `WebSocket`.
+
+Run it:
+
+```sh
+bun test test/integ.test.ts
+```
+
+Alice's `"hello bob"` arrives at the Room as a `webSocketMessage`,
+the broadcast loop sends `"[<alice-id>] hello bob"` to every peer,
+and Bob's `next` resolves with it from the queue.
+
+## Schedule a future broadcast (alarms)
+
+Durable Objects have **alarms** — single-shot timers backed by the
+DO's storage. Alchemy ships a small SQLite-backed scheduler on top
+so you can register many named events instead of juggling a single
+alarm timestamp yourself. We'll use it to add a
+`/remind <seconds> <message>` chat command.
+
+First, recognise the command inside `webSocketMessage` and schedule
+the event:
+
+```diff lang="typescript"
+webSocketMessage: Effect.fnUntraced(function* (socket, message) {
+  const attachment = socket.deserializeAttachment<{ id: string }>();
+  if (!attachment) return;
+  const text = typeof message === "string"
+    ? message
+    : new TextDecoder().decode(message);
+
++  const remindMatch = text.match(/^\/remind\s+(\d+)\s+(.+)$/);
++  if (remindMatch) {
++    const delaySec = parseInt(remindMatch[1], 10);
++    const reminder = remindMatch[2];
++    const id = crypto.randomUUID();
++    const runAt = new Date(Date.now() + delaySec * 1000);
++    yield* Cloudflare.scheduleEvent(id, runAt, { message: reminder });
++    yield* socket.send(`[system] Reminder scheduled in ${delaySec}s`);
++    return;
++  }
+
+  yield* broadcast(`[${attachment.id.slice(0, 8)}] ${text}`);
+}),
+```
+
+`scheduleEvent` upserts a row into a DO-local SQLite table and
+sets the DO alarm to the earliest pending timestamp. The `id` is
+the upsert key, so reusing it overwrites the previous schedule.
+
+Now add an `alarm` handler to drain fired events:
+
+```diff lang="typescript"
+return {
+  fetch: /* ... */,
+  webSocketMessage: /* ... */,
+  webSocketClose: /* ... */,
++  alarm: () =>
++    Effect.gen(function* () {
++      const fired = yield* Cloudflare.processScheduledEvents;
++      for (const event of fired) {
++        const payload = event.payload as { message: string };
++        yield* broadcast(`[reminder] ${payload.message}`);
++      }
++    }),
+  broadcast,
+};
+```
+
+`processScheduledEvents` returns every event whose `runAt <= now`,
+deletes the one-shot ones (or re-schedules repeating ones), and
+re-sets the alarm to the next pending event. All you do is loop
+over the returned events and act on them.
+
+Verify it with a test that sends `/remind 1 hello` and waits up to
+5 seconds for the broadcast to arrive:
+
+```typescript
+// test/integ.test.ts (additions)
+test(
+  "Room schedules a reminder broadcast",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const wsUrl = url.replace(/^http/, "ws") + "/room/reminders";
+
+    const peer = yield* connect(wsUrl);
+    yield* peer.send("/remind 1 hello");
+
+    // First message back is the [system] confirmation;
+    // the second is the [reminder] broadcast a second later.
+    yield* peer.next;
+    const reminder = yield* peer.next;
+    expect(reminder).toContain("[reminder] hello");
+  }).pipe(
+    Effect.scoped,
+    Effect.provide(Socket.layerWebSocketConstructorGlobal),
+  ),
+  { timeout: 30_000 },
+);
+```
+
+You now have an interesting backend. Next you'll
+[add a Vite SPA](/tutorial/cloudflare/vite-spa) so users have a UI
+to talk to it — frontend and backend deploying together from the
+same `alchemy.run.ts`.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/hyperdrive.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/hyperdrive.mdx
new file mode 100644
index 00000000000..c3c8ae86792
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/hyperdrive.mdx
@@ -0,0 +1,590 @@
+---
+title: Connect to a Database with Hyperdrive
+description: Provision a Postgres or MySQL database (Neon, PlanetScale Postgres, or PlanetScale MySQL) and front it with Cloudflare Hyperdrive so your Worker reaches the database with edge-pooled, low-latency connections.
+sidebar:
+  order: 7
+---
+
+import { Code, Tabs, TabItem } from "@astrojs/starlight/components";
+
+export const pgDeps = `pg`;
+export const pgDevDeps = `@types/pg`;
+export const mysqlDeps = `mysql2`;
+
+You've now wired Durable Objects, hibernatable WebSockets, a
+Container, a Workflow, and an AI Gateway into your Worker. The
+last missing piece for most apps is a real database. This tutorial
+provisions a serverless database and fronts it with **Cloudflare
+Hyperdrive**, then binds the connection into your Worker.
+
+Hyperdrive is a Cloudflare-managed pooler that sits between
+Workers and your origin database. The Worker sees a familiar
+Postgres / MySQL connection string, but the connection itself is
+already pooled at the edge — no per-request TCP handshakes, no
+cold-start connection storms.
+
+Three providers are wired up out of the box. Pick whichever you
+prefer; the rest of the tutorial follows your selection:
+
+- **Neon** — serverless Postgres with copy-on-write branching.
+- **PlanetScale (Postgres)** — managed Postgres with branch-per-PR
+  workflows.
+- **PlanetScale (MySQL)** — Vitess-backed MySQL, same branching model.
+
+## Add the provider
+
+Each database provider is its own `providers()` layer. Register it
+alongside `Cloudflare.providers()` in your stack:
+
+<Tabs syncKey="db-provider">
+  <TabItem label="Neon">
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as Neon from "alchemy/Neon";
++import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyStack",
+  {
+-    providers: Cloudflare.providers(),
++    providers: Layer.mergeAll(Cloudflare.providers(), Neon.providers()),
+    state: Alchemy.localState(),
+  },
+  // ...
+);
+```
+
+Neon's auth is API-key-based. The first `bun alchemy login` after
+this change adds a `Neon` step that either reads `NEON_API_KEY`
+from the environment (good for CI) or stores a key under
+`~/.alchemy/credentials/<profile>/neon-stored.json`.
+
+  </TabItem>
+  <TabItem label="PlanetScale (Postgres)">
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as Planetscale from "alchemy/Planetscale";
++import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyStack",
+  {
+-    providers: Cloudflare.providers(),
++    providers: Layer.mergeAll(Cloudflare.providers(), Planetscale.providers()),
+    state: Alchemy.localState(),
+  },
+  // ...
+);
+```
+
+PlanetScale's auth uses an API token id + secret. `bun alchemy login`
+adds a `Planetscale` step that either reads `PLANETSCALE_API_TOKEN_ID`,
+`PLANETSCALE_API_TOKEN`, and `PLANETSCALE_ORGANIZATION` from the
+environment (good for CI) or stores the credentials under
+`~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+
+  </TabItem>
+  <TabItem label="PlanetScale (MySQL)">
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as Planetscale from "alchemy/Planetscale";
++import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyStack",
+  {
+-    providers: Cloudflare.providers(),
++    providers: Layer.mergeAll(Cloudflare.providers(), Planetscale.providers()),
+    state: Alchemy.localState(),
+  },
+  // ...
+);
+```
+
+PlanetScale's auth uses an API token id + secret. `bun alchemy login`
+adds a `Planetscale` step that either reads `PLANETSCALE_API_TOKEN_ID`,
+`PLANETSCALE_API_TOKEN`, and `PLANETSCALE_ORGANIZATION` from the
+environment (good for CI) or stores the credentials under
+`~/.alchemy/credentials/<profile>/planetscale-stored.json`.
+
+  </TabItem>
+</Tabs>
+
+## Provision the database
+
+Create `src/Db.ts`. The shape is the same across providers — a
+top-level database resource, a branch, and (for PlanetScale) a
+credentials resource that owns the password.
+
+<Tabs syncKey="db-provider">
+  <TabItem label="Neon">
+
+A `Neon.Project` is the top-level container. It owns a default
+branch, a default role, and the WAL history that copy-on-write
+branches fork from:
+
+```typescript
+// src/Db.ts
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  const project = yield* Neon.Project("app-db", {
+    region: "aws-us-east-1",
+  });
+
+  const branch = yield* Neon.Branch("app-branch", {
+    project,
+  });
+
+  return { project, branch };
+});
+```
+
+`Neon.Branch` is a copy-on-write fork — cheap to create, fast to
+destroy, and ideal for preview environments. Each branch has its
+own connection string (`branch.connectionUri`) and a pooled variant
+(`branch.pooledConnectionUri`).
+
+  </TabItem>
+  <TabItem label="PlanetScale (Postgres)">
+
+A `Planetscale.PostgresDatabase` owns the long-lived cluster.
+`PostgresBranch` is a branch off of it (cheap to fork for previews),
+and `PostgresRole` materializes a user + password we can feed to
+Hyperdrive:
+
+```typescript
+// src/Db.ts
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  const database = yield* Planetscale.PostgresDatabase("app-db", {
+    region: { slug: "us-east" },
+    clusterSize: "PS_10",
+  });
+
+  const branch = yield* Planetscale.PostgresBranch("app-branch", {
+    database,
+    isProduction: false,
+  });
+
+  const role = yield* Planetscale.PostgresRole("app-role", {
+    database,
+    branch,
+    inheritedRoles: ["postgres"],
+  });
+
+  return { database, branch, role };
+});
+```
+
+The role's `origin` (host / port / database / user / password) is
+what Hyperdrive consumes — it's materialized lazily so the actual
+password never lands in plan output.
+
+  </TabItem>
+  <TabItem label="PlanetScale (MySQL)">
+
+A `Planetscale.MySQLDatabase` is the long-lived cluster.
+`MySQLBranch` is a branch off of it (cheap to fork for previews),
+and `MySQLPassword` materializes a user + password we can feed to
+Hyperdrive:
+
+```typescript
+// src/Db.ts
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  const database = yield* Planetscale.MySQLDatabase("app-db", {
+    region: { slug: "us-east" },
+    clusterSize: "PS_10",
+    allowForeignKeyConstraints: true,
+  });
+
+  const branch = yield* Planetscale.MySQLBranch("app-branch", {
+    database,
+    isProduction: false,
+  });
+
+  const password = yield* Planetscale.MySQLPassword("app-password", {
+    database,
+    branch,
+    role: "readwriter",
+  });
+
+  return { database, branch, password };
+});
+```
+
+The password's `origin` (host / port / database / user / password)
+is what Hyperdrive consumes — it's materialized lazily so the
+actual secret never lands in plan output.
+
+  </TabItem>
+</Tabs>
+
+## Put Hyperdrive in front
+
+Hyperdrive needs an `origin` describing where your database lives.
+Each provider exposes a pre-parsed `origin` output (`{ scheme, host,
+port, database, user, password }`) ready to feed straight in:
+
+<Tabs syncKey="db-provider">
+  <TabItem label="Neon">
+
+```diff lang="typescript"
+// src/Db.ts
++import * as Cloudflare from "alchemy/Cloudflare";
+import * as Neon from "alchemy/Neon";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  const project = yield* Neon.Project("app-db", { region: "aws-us-east-1" });
+  const branch = yield* Neon.Branch("app-branch", { project });
+  return { project, branch };
+});
+
++export const Hyperdrive = Effect.gen(function* () {
++  const { branch } = yield* Db;
++  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
++    origin: branch.origin,
++  });
++});
+```
+
+`branch.origin` points at the **direct** (non-pooled) Neon endpoint —
+the recommended target when sitting behind Hyperdrive, since
+Hyperdrive already does its own connection pooling.
+
+  </TabItem>
+  <TabItem label="PlanetScale (Postgres)">
+
+```diff lang="typescript"
+// src/Db.ts
++import * as Cloudflare from "alchemy/Cloudflare";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  // ...
+  return { database, branch, role };
+});
+
++export const Hyperdrive = Effect.gen(function* () {
++  const { role } = yield* Db;
++  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
++    origin: role.origin,
++  });
++});
+```
+
+`role.origin` is the connection target Hyperdrive will pool. The
+`origin` is an `Output`, so alchemy orders PostgresDatabase →
+PostgresBranch → PostgresRole → Hyperdrive on the deploy graph.
+
+  </TabItem>
+  <TabItem label="PlanetScale (MySQL)">
+
+```diff lang="typescript"
+// src/Db.ts
++import * as Cloudflare from "alchemy/Cloudflare";
+import * as Planetscale from "alchemy/Planetscale";
+import * as Effect from "effect/Effect";
+
+export const Db = Effect.gen(function* () {
+  // ...
+  return { database, branch, password };
+});
+
++export const Hyperdrive = Effect.gen(function* () {
++  const { password } = yield* Db;
++  return yield* Cloudflare.Hyperdrive("app-hyperdrive", {
++    origin: password.origin,
++  });
++});
+```
+
+`password.origin` is the connection target Hyperdrive will pool —
+its `scheme` is `"mysql"`, so Hyperdrive provisions a MySQL pooler.
+The `origin` is an `Output`, so alchemy orders MySQLDatabase →
+MySQLBranch → MySQLPassword → Hyperdrive on the deploy graph.
+
+  </TabItem>
+</Tabs>
+
+## Install the client library
+
+The Worker uses a Node-compatible driver to talk to Hyperdrive over
+the binding. Pick the one that matches your engine:
+
+<Tabs syncKey="db-provider">
+  <TabItem label="Neon">
+
+[`pg`](https://node-postgres.com) — node-postgres:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code={`bun add ${pgDeps}\nbun add -d ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code={`npm install ${pgDeps}\nnpm install -D ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code={`pnpm add ${pgDeps}\npnpm add -D ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code={`yarn add ${pgDeps}\nyarn add -D ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+</Tabs>
+
+  </TabItem>
+  <TabItem label="PlanetScale (Postgres)">
+
+[`pg`](https://node-postgres.com) — node-postgres:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code={`bun add ${pgDeps}\nbun add -d ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code={`npm install ${pgDeps}\nnpm install -D ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code={`pnpm add ${pgDeps}\npnpm add -D ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code={`yarn add ${pgDeps}\nyarn add -D ${pgDevDeps}`} lang="sh" />
+  </TabItem>
+</Tabs>
+
+  </TabItem>
+  <TabItem label="PlanetScale (MySQL)">
+
+[`mysql2`](https://github.com/sidorares/node-mysql2):
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code={`bun add ${mysqlDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code={`npm install ${mysqlDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code={`pnpm add ${mysqlDeps}`} lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code={`yarn add ${mysqlDeps}`} lang="sh" />
+  </TabItem>
+</Tabs>
+
+  </TabItem>
+</Tabs>
+
+## Bind Hyperdrive to your Worker
+
+`Cloudflare.Hyperdrive.bind(...)` returns a typed accessor for the
+runtime binding — connection string, host, port, user, password,
+database — plus a `raw` escape hatch for libraries that want the
+underlying `Hyperdrive` object:
+
+<Tabs syncKey="db-provider">
+  <TabItem label="Neon">
+
+```diff lang="typescript"
+// src/Api.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import { Client } from "pg";
++import { Hyperdrive } from "./Db.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.path,
++    compatibility: {
++      // node-postgres needs Node.js APIs to run inside a Worker.
++      flags: ["nodejs_compat"],
++    },
+  },
+  Effect.gen(function* () {
++    const hd = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
++
+    return {
+      fetch: Effect.gen(function* () {
++        const connectionString = yield* hd.connectionString;
++        const rows = yield* Effect.promise(async () => {
++          // One client per request — Hyperdrive does the pooling.
++          const client = new Client({ connectionString });
++          await client.connect();
++          try {
++            const r = await client.query("SELECT now() as now");
++            return r.rows;
++          } finally {
++            await client.end().catch(() => {});
++          }
++        });
++        return yield* HttpServerResponse.json({ ok: true, rows });
+      }),
+    };
+-  }),
++  }).pipe(Effect.provide(Cloudflare.HyperdriveConnectionLive)),
+) {}
+```
+
+  </TabItem>
+  <TabItem label="PlanetScale (Postgres)">
+
+```diff lang="typescript"
+// src/Api.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import { Client } from "pg";
++import { Hyperdrive } from "./Db.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.path,
++    compatibility: {
++      // node-postgres needs Node.js APIs to run inside a Worker.
++      flags: ["nodejs_compat"],
++    },
+  },
+  Effect.gen(function* () {
++    const hd = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
++
+    return {
+      fetch: Effect.gen(function* () {
++        const connectionString = yield* hd.connectionString;
++        const rows = yield* Effect.promise(async () => {
++          // One client per request — Hyperdrive does the pooling.
++          const client = new Client({ connectionString });
++          await client.connect();
++          try {
++            const r = await client.query("SELECT now() as now");
++            return r.rows;
++          } finally {
++            await client.end().catch(() => {});
++          }
++        });
++        return yield* HttpServerResponse.json({ ok: true, rows });
+      }),
+    };
+-  }),
++  }).pipe(Effect.provide(Cloudflare.HyperdriveConnectionLive)),
+) {}
+```
+
+  </TabItem>
+  <TabItem label="PlanetScale (MySQL)">
+
+```diff lang="typescript"
+// src/Api.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import { createConnection } from "mysql2/promise";
++import { Hyperdrive } from "./Db.ts";
+
+export default class Api extends Cloudflare.Worker<Api>()(
+  "Api",
+  {
+    main: import.meta.path,
++    compatibility: {
++      // mysql2 needs Node.js APIs to run inside a Worker.
++      flags: ["nodejs_compat"],
++    },
+  },
+  Effect.gen(function* () {
++    const hd = yield* Cloudflare.Hyperdrive.bind(Hyperdrive);
++
+    return {
+      fetch: Effect.gen(function* () {
++        const connectionString = yield* hd.connectionString;
++        const rows = yield* Effect.promise(async () => {
++          // One connection per request — Hyperdrive does the pooling.
++          const conn = await createConnection(connectionString);
++          try {
++            const [r] = await conn.query("SELECT NOW() as now");
++            return r;
++          } finally {
++            await conn.end().catch(() => {});
++          }
++        });
++        return yield* HttpServerResponse.json({ ok: true, rows });
+      }),
+    };
+-  }),
++  }).pipe(Effect.provide(Cloudflare.HyperdriveConnectionLive)),
+) {}
+```
+
+  </TabItem>
+</Tabs>
+
+Two things to notice (regardless of engine):
+
+- The `nodejs_compat` flag is required because the driver uses
+  Node's `net` and `crypto` APIs.
+- The fetch handler opens a fresh connection per request and ends
+  it on the way out. This is intentional — Hyperdrive does the
+  pooling on Cloudflare's side, so the Worker doesn't need its
+  own. (We'll revisit this in the Drizzle tutorial when we want
+  long-lived clients.)
+
+## Wire the resources into the stack
+
+Update `alchemy.run.ts` to yield `Db` and `Hyperdrive` so they
+become part of the deploy graph:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import Api from "./src/Api.ts";
++import { Db, Hyperdrive } from "./src/Db.ts";
+
+export default Alchemy.Stack(
+  "MyStack",
+  { /* ... */ },
+  Effect.gen(function* () {
++    yield* Db;
++    yield* Hyperdrive;
+    const api = yield* Api;
+    return { url: api.url.as<string>() };
+  }),
+);
+```
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Watch the deploy plan: alchemy creates the database, then the
+branch, then the credentials (for PlanetScale), then the Hyperdrive
+that points at the connection origin, then the Worker with the
+Hyperdrive binding attached. After it completes, hit your Worker
+URL and you should see something like:
+
+```json
+{ "ok": true, "rows": [{ "now": "2026-05-04T07:53:48.123Z" }] }
+```
+
+You're now talking to your database from the edge through
+Hyperdrive. The next tutorial swaps the raw driver client for
+**Drizzle ORM** and lets alchemy own migration generation as part
+of every deploy.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/queue-consumer.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/queue-consumer.mdx
new file mode 100644
index 00000000000..322073d37a4
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/queue-consumer.mdx
@@ -0,0 +1,237 @@
+---
+title: Consume from a Queue
+description: Receive messages from a Cloudflare Queue with Cloudflare.messages(queue).subscribe(...) — Effect-style stream handler with automatic ack/retry.
+sidebar:
+  order: 10
+---
+
+A Cloudflare Queue gives you reliable, at-least-once delivery
+between Workers. The Worker that *sends* messages uses
+`Cloudflare.QueueBinding.bind(...)` from the [Queue producer
+binding](/providers/cloudflare/queue) — covered in the resource
+docs. This tutorial focuses on the *consumer* side: receiving
+batches with the Effect-style
+`Cloudflare.messages(queue).subscribe(...)` API.
+
+`subscribe(...)` does both halves in one call: it registers a
+runtime queue listener on the Worker, and it auto-creates the
+`Cloudflare.QueueConsumer` resource that tells Cloudflare to
+dispatch messages from the queue to this Worker. No separate
+deploy-time wiring is needed.
+
+By the end you'll have a Worker that:
+
+- Sends a JSON message via `POST /queue/send`.
+- Receives the message in a queue handler registered on the same
+  Worker, persists the body to R2, and acks the batch.
+- Reads the persisted body via `GET /queue/result/:id`.
+
+## Create the Queue and Bucket
+
+Both resources are plain `yield*` calls — no special config.
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export const Queue = Cloudflare.Queue("Queue");
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+```
+
+The Queue's name is generated from the stack/stage/id. The Bucket
+will store each consumed message at `/queue/<id>` so the integ
+test can read it back.
+
+## Bind the Queue producer
+
+In the Worker init phase, yield the queue resource and ask
+`QueueBinding` for a typed sender. The sender exposes `send` /
+`sendBatch` that round-trip through Cloudflare's runtime.
+
+```typescript
+// src/Api.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Bucket } from "./Bucket.ts";
+import { Queue } from "./Queue.ts";
+
+export default Cloudflare.Worker(
+  "Api",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    const queueResource = yield* Queue;
+    const queue = yield* Cloudflare.QueueBinding.bind(queueResource);
+
+    return { fetch: Effect.gen(function* () { return new Response("ok"); }) };
+  }).pipe(
+    Effect.provide(Cloudflare.QueueBindingLive),
+    Effect.provide(Cloudflare.R2BucketBindingLive),
+  ),
+);
+```
+
+`queueResource` (the resolved `Queue` resource) is what you pass to
+`messages(...)` next — it's the same handle, not a new one.
+
+## Subscribe to incoming messages
+
+`Cloudflare.messages(queue).subscribe(handler)` registers a queue
+event listener on the Worker. The handler receives a
+`Stream.Stream<Message<Body>>` — one stream per batch — and is
+expected to return `Effect.Effect<void>`.
+
+```diff lang="typescript"
++import * as Stream from "effect/Stream";
++
++interface QueueMessageBody {
++  id: string;
++  text: string;
++  sentAt: number;
++}
+
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    const queueResource = yield* Queue;
+    const queue = yield* Cloudflare.QueueBinding.bind(queueResource);
+
++   yield* Cloudflare.messages<QueueMessageBody>(queueResource).subscribe(
++     (stream) =>
++       Stream.runForEach(stream, (msg) =>
++         bucket
++           .put(`/queue/${msg.body.id}`, JSON.stringify(msg.body), {
++             httpMetadata: { contentType: "application/json" },
++           })
++           .pipe(Effect.asVoid),
++       ),
++   );
+```
+
+Acking is automatic: if the handler succeeds, every message in the
+batch is `ack()`ed; if it fails, every message is `retry()`ed and
+Cloudflare applies the consumer's `maxRetries` and `retryDelay`
+before dead-lettering. For finer control, call `msg.ack()` /
+`msg.retry()` per message inside the handler.
+
+## Tune batching and backoff
+
+`messages(queue, props)` accepts a settings object. Time fields are
+`Duration.Input` — any of these are accepted:
+
+```typescript
+maxWaitTime: Duration.seconds(5)   // a Duration value
+maxWaitTime: 5_000                 // a number of milliseconds
+maxWaitTime: "5 seconds"           // a "<number> <unit>" string
+retryDelay: "1 second"             // singular and plural units both work
+```
+
+```diff lang="typescript"
++import * as Duration from "effect/Duration";
+
+- Cloudflare.messages<QueueMessageBody>(queueResource).subscribe(
++ Cloudflare.messages<QueueMessageBody>(queueResource, {
++   batchSize: 25,
++   maxRetries: 3,
++   maxWaitTime: "5 seconds",
++   retryDelay: Duration.seconds(30),
++ }).subscribe(
+```
+
+`maxWaitTime` is rounded up to whole milliseconds and `retryDelay`
+to whole seconds when forwarded to Cloudflare.
+
+## Provide the runtime layer
+
+`messages(...).subscribe(...)` is a `Context.Service` call —
+`QueueEventSourceLive` is the layer that registers the listener
+with the Worker's runtime context. Add it to the layer stack
+alongside the other binding lives.
+
+```diff lang="typescript"
+  }).pipe(
++   Effect.provide(Cloudflare.QueueEventSourceLive),
+    Effect.provide(Cloudflare.QueueBindingLive),
+    Effect.provide(Cloudflare.R2BucketBindingLive),
+  ),
+```
+
+Without the live layer, the subscribe call fails at deploy with
+`Service not found: Cloudflare.Queue.QueueEventSource`.
+
+## Add the producer route
+
+`POST /queue/send` enqueues a message and returns the generated id.
+The integ test uses the id to poll for the consumed result.
+
+```typescript
+return {
+  fetch: Effect.gen(function* () {
+    const request = yield* HttpServerRequest;
+    if (request.url === "/queue/send" && request.method === "POST") {
+      const text = yield* request.text;
+      const msg: QueueMessageBody = {
+        id: crypto.randomUUID(),
+        text,
+        sentAt: Date.now(),
+      };
+      yield* queue.send(msg).pipe(Effect.orDie);
+      return yield* HttpServerResponse.json({ sent: msg }, { status: 202 });
+    }
+    return HttpServerResponse.text("Not Found", { status: 404 });
+  }),
+};
+```
+
+## Add the result-read route
+
+`GET /queue/result/:id` reads `/queue/<id>` from the bucket. The
+consumer runs asynchronously, so the test polls this route with a
+short backoff until the object appears.
+
+```typescript
+if (request.url.startsWith("/queue/result/") && request.method === "GET") {
+  const id = request.url.split("/queue/result/")[1];
+  return yield* bucket.get(`/queue/${id}`).pipe(
+    Effect.flatMap((object) =>
+      object === null
+        ? Effect.succeed(HttpServerResponse.text("not yet", { status: 404 }))
+        : object.text().pipe(
+            Effect.map((body) =>
+              HttpServerResponse.text(body, {
+                headers: { "content-type": "application/json" },
+              }),
+            ),
+          ),
+    ),
+    Effect.catchTag("R2Error", (e) =>
+      Effect.succeed(HttpServerResponse.text(e.message, { status: 500 })),
+    ),
+  );
+}
+```
+
+## What's the difference vs. a native `queue()` handler?
+
+Cloudflare's runtime delivers queue events to a `queue(batch, env)`
+export on the worker module. You can write that directly — see
+[`examples/cloudflare-worker-async`](https://github.com/alchemy-run/alchemy-effect/blob/main/examples/cloudflare-worker-async)
+for the plain async-handler shape:
+
+```typescript
+export default {
+  async queue(batch, env) {
+    for (const msg of batch.messages) {
+      await env.Bucket.put(`/queue/${msg.body.id}`, ...);
+      msg.ack();
+    }
+  },
+};
+```
+
+`Cloudflare.messages(queue).subscribe(...)` is the same primitive
+on the Effect side — the Worker bundle's runtime context routes
+the dispatch to the registered listener — but you get
+`Effect.gen` composition, typed errors, automatic batch
+ack/retry, and the same surface as `AWS.SQS.messages(queue).subscribe(...)`.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/rpc-durable-object.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/rpc-durable-object.mdx
new file mode 100644
index 00000000000..1029b805708
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/rpc-durable-object.mdx
@@ -0,0 +1,481 @@
+---
+title: Add a typed RPC Durable Object
+description: Replace alchemy's built-in DO method bridge with `Cloudflare.RpcDurableObjectNamespace` — a typed RPC group served on the DO's `fetch`, with a class-instance-preserving wire format. Walk through a single DO, drive it from a test, then layer in a Worker.
+sidebar:
+  order: 12
+---
+
+The [Durable Objects tutorial](/tutorial/cloudflare/durable-objects)
+uses alchemy's built-in DO method bridge: any function returned from
+the inner Effect becomes a typed method on the stub. That bridge
+`JSON.stringify`s each return value, which strips class identity —
+fine for primitives, but a problem when values contain `Schema.Class`
+instances. `Cloudflare.RpcDurableObjectNamespace` runs an Effect RPC
+server on the DO's `fetch` so both ends share one codec.
+
+This tutorial walks through a single typed DO end-to-end: declare the
+schema, implement the DO, wire a thin Worker driver, deploy it, and
+test it.
+
+## Declare a procedure
+
+```typescript
+// src/rpcs.ts
+import * as Schema from "effect/Schema";
+import { Rpc } from "effect/unstable/rpc";
+
+const setTitle = Rpc.make("setTitle", {
+  payload: { title: Schema.String },
+  success: Schema.Void,
+});
+```
+
+DO-scoped procedures don't need a per-session id in the payload — the
+DO instance *is* the session.
+
+## Add a second procedure
+
+```diff lang="typescript"
+ const setTitle = Rpc.make("setTitle", {
+   payload: { title: Schema.String },
+   success: Schema.Void,
+ });
++
++const getTitle = Rpc.make("getTitle", {
++  payload: {},
++  success: Schema.String,
++});
+```
+
+Each `Rpc.make` is independent, so adding procedures is purely
+additive.
+
+## Group them into an `RpcGroup`
+
+```diff lang="typescript"
+ import * as Schema from "effect/Schema";
+-import { Rpc } from "effect/unstable/rpc";
++import { Rpc, RpcGroup } from "effect/unstable/rpc";
+
+ // ...
+
++export class CounterRpcs extends RpcGroup.make(setTitle, getTitle) {}
+```
+
+`CounterRpcs` is the single value the DO, the consumer, and any
+tests all import.
+
+## Define the DO class
+
+```typescript
+// src/counter.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { CounterRpcs } from "./rpcs.ts";
+
+export default class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+  "Counter",
+  { schema: CounterRpcs },
+  Effect.gen(function* () {
+    return Effect.gen(function* () {
+      return Effect.succeed(undefined as never);
+    });
+  }),
+) {}
+```
+
+`Cloudflare.RpcDurableObjectNamespace<Self>()(...)` mirrors
+`Cloudflare.DurableObjectNamespace<Self>()(...)` — same outer/inner
+Effect pattern. The outer Effect resolves shared deps; the inner
+Effect runs once per DO instance.
+
+## Pull `state` out of context
+
+```diff lang="typescript"
+ Effect.gen(function* () {
+   return Effect.gen(function* () {
++    const state = yield* Cloudflare.DurableObjectState;
+-    return Effect.succeed(undefined as never);
+   });
+ }),
+```
+
+`Cloudflare.DurableObjectState` is the same per-instance handle
+Cloudflare exposes for `storage`, `setAlarm`, `acceptWebSocket`, and
+friends.
+
+## Wire the handlers
+
+```diff lang="typescript"
+ Effect.gen(function* () {
+   return Effect.gen(function* () {
+     const state = yield* Cloudflare.DurableObjectState;
++    const handlers = CounterRpcs.toLayer({
++      setTitle: ({ title }) => state.storage.put("title", title),
++      getTitle: () =>
++        Effect.map(state.storage.get<string>("title"), (t) => t ?? ""),
++    });
+   });
+ }),
+```
+
+`CounterRpcs.toLayer({...})` is type-checked against the group —
+every procedure must be implemented, with the right payload and
+return type.
+
+## Return the piped Effect
+
+```diff lang="typescript"
++import * as Layer from "effect/Layer";
++import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+
+ // ...
+     const handlers = CounterRpcs.toLayer({ /* ... */ });
++    return RpcServer.toHttpEffect(CounterRpcs).pipe(
++      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
++    );
+   });
+ }),
+```
+
+The inner Effect returns the piped `RpcServer.toHttpEffect` Effect
+directly — no `{ fetch }` wrapper. NDJSON is required if any
+procedure is a streaming RPC; use `layerJson` if every procedure is
+request/response.
+
+## Define a thin Worker driver
+
+The DO can only be reached through a Worker. A minimal one routes
+two HTTP verbs to `getTitle` / `setTitle` for the test to call:
+
+```typescript
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import Counter from "./counter.ts";
+
+export default class Worker extends Cloudflare.Worker<Worker>()(
+  "Worker",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const counters = yield* Counter;
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const id = new URL(request.url).searchParams.get("id") ?? "default";
+
+        const client = yield* counters.getByName(id);
+
+        if (request.method === "POST") {
+          const { title } = (yield* request.json) as { title: string };
+          yield* client.setTitle({ title }).pipe(Effect.orDie);
+          return HttpServerResponse.text("ok");
+        }
+        const title = yield* client.getTitle({}).pipe(Effect.orDie);
+        return HttpServerResponse.text(title);
+      }).pipe(Effect.scoped),
+    };
+  }),
+) {}
+```
+
+`yield* Counter` registers the binding on the surrounding Worker;
+`counters.getByName(id)` returns an `Effect<RpcClient<CounterRpcs>>`
+in the per-request scope — `Effect.scoped` on the handler keeps the
+client alive for the duration of the request.
+
+## Deploy
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "Counter",
+  { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
+    return { url: worker.url.as<string>() };
+  }),
+);
+```
+
+## Drive it from a test
+
+```typescript
+// test/counter.test.ts
+import { expect } from "@effect/vitest";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Vitest";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+
+const stack = beforeAll(deploy(Stack));
+afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+
+test(
+  "setTitle / getTitle round-trip",
+  Effect.gen(function* () {
+    const { url } = yield* stack;
+    const client = yield* HttpClient.HttpClient;
+
+    yield* client
+      .post(`${url}?id=alpha`, { body: HttpClient.body("text/plain")(`{"title":"Hello"}`) })
+      .pipe(
+        Effect.retry({
+          schedule: Schedule.exponential("500 millis"),
+          times: 5,
+        }),
+      );
+
+    const res = yield* client.get(`${url}?id=alpha`);
+    const title = yield* res.text;
+    expect(title).toBe("Hello");
+  }),
+  { timeout: 60_000 },
+);
+```
+
+`Test.make({ providers: Cloudflare.providers() })` deploys the stack
+once, the test drives the Worker (which proxies into the DO via
+`getByName(id)`), and asserts on the round-trip.
+
+## When to reach for this
+
+Use the built-in DO bridge when method return values are primitives
+or `Schema.encodeUnknown`-compatible structs — it's lighter and
+ergonomic.
+
+Switch to `RpcDurableObjectNamespace` when:
+
+- Return values contain **`Schema.Class` instances** that downstream
+  code branches on — the built-in bridge will silently flatten them.
+- You want **streaming** procedures (NDJSON codec round-trips
+  `Stream.Stream`).
+- You want a **single shared schema** across multiple call-sites
+  (Worker, script, tests) — the same `RpcGroup` value drives every
+  client.
+
+## Bonus: yield the namespace from inside the DO
+
+Mirrors `yield* DurableObjectNamespace` on the regular class — useful
+for fanning a call out to sibling instances:
+
+```typescript
+Effect.gen(function* () {
+  const self = yield* Cloudflare.RpcDurableObjectNamespace;
+  const peer = yield* self.getByName("peer-1");
+  yield* peer.setTitle({ title: "Sibling call" });
+});
+```
+
+## Modular form: split the class from its runtime
+
+The single-arg form above bundles the runtime into the class
+declaration. For cross-script binding (one Worker hosts the DO,
+others bind to it) you want the class to be a pure tagged
+identifier so consumers can import it without pulling the runtime
+into their bundle. Use the **two-arg form** — `(name, { schema })`
+with no impl — and provide the runtime via `static make`:
+
+```typescript
+// src/counter.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { CounterRpcs } from "./rpcs.ts";
+
+export class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+  "Counter",
+  { schema: CounterRpcs },
+) {}
+```
+
+This is just a tagged identifier — both the host and any
+consumer Worker can `import { Counter }` without dragging in
+the runtime.
+
+## Provide the runtime as a Layer
+
+`Counter.make(impl)` returns a `Layer<Counter>` that populates
+the tag with a running instance. Only the host script imports
+this:
+
+```diff lang="typescript"
+// src/counter.ts
+ export class Counter extends Cloudflare.RpcDurableObjectNamespace<Counter>()(
+   "Counter",
+   { schema: CounterRpcs },
+ ) {}
+
++export default Counter.make(
++  Effect.gen(function* () {
++    return Effect.gen(function* () {
++      const state = yield* Cloudflare.DurableObjectState;
++      const handlers = CounterRpcs.toLayer({
++        setTitle: ({ title }) => state.storage.put("title", title),
++        getTitle: () =>
++          Effect.map(state.storage.get<string>("title"), (t) => t ?? ""),
++      });
++      return RpcServer.toHttpEffect(CounterRpcs).pipe(
++        Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
++      );
++    });
++  }),
++);
+```
+
+The impl shape is identical to the inline form — outer Effect for
+shared deps, inner Effect for per-instance setup, returning the
+piped `RpcServer.toHttpEffect`. The only difference is that
+`Counter.make(...)` returns a `Layer` instead of binding the impl
+to the class declaration.
+
+## Declare the host Worker
+
+The Worker that hosts the DO names it in its third type argument
+(`Worker<Self, Bindings, Deps>` — `Deps` is what the script
+publishes for cross-script binding):
+
+```diff lang="typescript"
+// src/worker.ts
++import { Counter } from "./counter.ts";
+
+-export default class Worker extends Cloudflare.Worker<Worker>()(
++export class WorkerA extends Cloudflare.Worker<WorkerA, {}, Counter>()(
+   "Worker",
+   { main: import.meta.filename },
+-  Effect.gen(function* () {
+-    const counters = yield* Counter;
+-    ...
+-  }),
+ ) {}
+```
+
+`Worker<WorkerA, {}, Counter>` declares that WorkerA publishes
+`Counter` — without this third arg, `Counter.from(WorkerA)` from
+another Worker would be a TypeScript error.
+
+## Provide the runtime from the host
+
+`WorkerA.make(...)` is where the runtime lives. Provide
+`CounterLive` (the default export of `counter.ts`) so the DO class
+actually ships in WorkerA's bundle:
+
+```typescript
+// src/worker.ts
+export default WorkerA.make(
+  Effect.gen(function* () {
+    const counters = yield* Counter;
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const id = new URL(request.url).searchParams.get("id") ?? "default";
+        const client = yield* counters.getByName(id);
+        if (request.method === "POST") {
+          const { title } = (yield* request.json) as { title: string };
+          yield* client.setTitle({ title }).pipe(Effect.orDie);
+          return HttpServerResponse.text("ok");
+        }
+        const title = yield* client.getTitle({}).pipe(Effect.orDie);
+        return HttpServerResponse.text(title);
+      }).pipe(Effect.scoped),
+    };
+  }).pipe(Effect.provide(CounterLive)),
+);
+```
+
+`yield* Counter` resolves the tag populated by `CounterLive`.
+Inside the host script this is equivalent to `Counter.from(WorkerA)`
+— see the next section for why the `.from` form is sometimes
+preferred.
+
+## Bind from a second Worker
+
+A second Worker can address the same DO instances by binding to
+WorkerA's namespace — no public URL, no service binding, just
+`Counter.from(WorkerA)`:
+
+```typescript
+// src/workerB.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Counter } from "./counter.ts";
+import { WorkerA } from "./worker.ts";
+
+export default class WorkerB extends Cloudflare.Worker<WorkerB>()(
+  "WorkerB",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    const counters = yield* Counter.from(WorkerA);
+    return {
+      fetch: Effect.gen(function* () {
+        const stub = yield* counters.getByName("shared");
+        const title = yield* stub.getTitle({}).pipe(Effect.orDie);
+        return HttpServerResponse.text(title);
+      }).pipe(Effect.scoped),
+    };
+  }),
+) {}
+```
+
+`Counter.from(WorkerA)` reads WorkerA's `Deps` to confirm `Counter`
+is part of its contract, then emits a Cloudflare binding with
+`scriptName: "WorkerA"`. Writes through WorkerA's `getByName(name)`
+are visible from WorkerB's `getByName(name)` — same DO instance.
+
+WorkerB never imports `CounterLive`, so Rolldown tree-shakes the
+runtime out of WorkerB's bundle.
+
+## Host an isolated namespace
+
+A Worker can also host its **own** isolated `Counter` namespace
+by declaring `Counter` in its `Deps` and providing `CounterLive`.
+Inside that Worker, use `Counter.from(Self)` to be explicit about
+which script's namespace you're binding to:
+
+```typescript
+// src/workerC.ts
+export class WorkerC extends Cloudflare.Worker<WorkerC, {}, Counter>()(
+  "WorkerC",
+  { main: import.meta.filename },
+) {}
+
+export default WorkerC.make(
+  Effect.gen(function* () {
+    const counters = yield* Counter.from(WorkerC);
+    // ... fetch handler ...
+  }).pipe(Effect.provide(CounterLive)),
+);
+```
+
+Instances under WorkerC are separate from WorkerA's — same class,
+different namespace, completely isolated state.
+
+## Recap
+
+- `Cloudflare.RpcDurableObjectNamespace<Self>()(name, { schema }, impl)`
+  is the inline form — class declaration carries the runtime.
+- `(name, { schema })` (no impl) is the **modular form** — pair it
+  with `Class.make(impl)` so consumer scripts can import the class
+  without bundling the runtime.
+- `Class.from(Worker)` binds to a DO hosted by another script. The
+  host declares the DO in its `Worker<Self, Bindings, Deps>` third
+  type arg so the `.from(...)` call type-checks.
+- `counters.getByName(id)` is `Effect<RpcClient<...>>` — yield it
+  inside an `Effect.scoped` per-request handler to get a typed
+  client.
+- A single `Test.make` + `beforeAll(deploy(Stack))` + `HttpClient`
+  pair drives the Worker, which in turn drives the DO.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/rpc-worker.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/rpc-worker.mdx
new file mode 100644
index 00000000000..1ed86b98083
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/rpc-worker.mdx
@@ -0,0 +1,442 @@
+---
+title: Define an RPC Worker
+description: Define a typed Effect RPC group, serve it from `Cloudflare.RpcWorker`, drive it from an integration test, and (later) bind a typed client from another Worker.
+sidebar:
+  order: 11
+---
+
+The [Effect RPC guide](/guides/effect-rpc) walks through the long-form
+`Cloudflare.Worker(...)` recipe: build the handler `Layer`, pipe it
+into `RpcServer.toHttpEffect`, return `{ fetch }`. Most of that is
+identical for every RPC Worker. `Cloudflare.RpcWorker` takes the
+`RpcGroup` directly in props and wraps the `{ fetch }` shape for you.
+
+This tutorial walks through a single RPC Worker end-to-end: declare
+the schema, implement the worker, deploy it, and drive it from an
+integration test. Cross-Worker binding via `RpcWorker.bind` shows up
+at the end as a follow-on.
+
+## Declare a tagged error
+
+```typescript
+// src/rpcs.ts
+import * as Schema from "effect/Schema";
+
+export class TaskNotFound extends Schema.TaggedClass<TaskNotFound>()(
+  "TaskNotFound",
+  { id: Schema.String },
+) {}
+```
+
+RPC errors are schema-typed values rather than HTTP status codes —
+clients pattern-match on them with `Effect.catchTag`.
+
+## Declare a procedure
+
+```diff lang="typescript"
+ import * as Schema from "effect/Schema";
++import { Rpc } from "effect/unstable/rpc";
+
+ export class TaskNotFound extends Schema.TaggedClass<TaskNotFound>()(
+   "TaskNotFound",
+   { id: Schema.String },
+ ) {}
++
++const getTask = Rpc.make("getTask", {
++  payload: { id: Schema.String },
++  success: Schema.String,
++  error: TaskNotFound,
++});
+```
+
+Each `Rpc.make` declares one procedure: a name, a payload schema, a
+success schema, and an error schema.
+
+## Group procedures into an `RpcGroup`
+
+```diff lang="typescript"
+-import { Rpc } from "effect/unstable/rpc";
++import { Rpc, RpcGroup } from "effect/unstable/rpc";
+
+ // ...
+
++export class TaskRpcs extends RpcGroup.make(getTask) {}
+```
+
+`TaskRpcs` is a single value the server, the client, and any tests
+all import. Both ends share the same schema.
+
+## Define the Worker
+
+```typescript
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { TaskRpcs } from "./rpcs.ts";
+
+export default class Worker extends Cloudflare.RpcWorker<Worker>()(
+  "Worker",
+  { main: import.meta.filename, schema: TaskRpcs },
+  Effect.gen(function* () {
+    return Effect.succeed(undefined as never);
+  }),
+) {}
+```
+
+`Cloudflare.RpcWorker<Self>()(...)` is class-shaped just like
+`Cloudflare.Worker<Self>()(...)`. The only new prop is `schema`,
+which carries the `RpcGroup`.
+
+## Wire the handlers
+
+```diff lang="typescript"
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
+ import { TaskRpcs } from "./rpcs.ts";
+
+ export default class Worker extends Cloudflare.RpcWorker<Worker>()(
+   "Worker",
+   { main: import.meta.filename, schema: TaskRpcs },
+   Effect.gen(function* () {
+-    return Effect.succeed(undefined as never);
++    const handlers = TaskRpcs.toLayer({
++      getTask: ({ id }) => Effect.succeed(`task-${id}`),
++    });
+   }),
+ ) {}
+```
+
+`TaskRpcs.toLayer({ getTask: ... })` is type-checked against the
+group — every procedure must be implemented, with the right payload
+and return type.
+
+## Return the piped Effect
+
+```diff lang="typescript"
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
++import * as Layer from "effect/Layer";
++import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+ import { TaskRpcs } from "./rpcs.ts";
+
+ export default class Worker extends Cloudflare.RpcWorker<Worker>()(
+   "Worker",
+   { main: import.meta.filename, schema: TaskRpcs },
+   Effect.gen(function* () {
+     const handlers = TaskRpcs.toLayer({
+       getTask: ({ id }) => Effect.succeed(`task-${id}`),
+     });
++    return RpcServer.toHttpEffect(TaskRpcs).pipe(
++      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
++    );
+   }),
+ ) {}
+```
+
+The init returns the **piped `RpcServer.toHttpEffect` Effect
+directly** — no `{ fetch }` wrapper.
+
+## Deploy the Worker
+
+```typescript
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "Tasks",
+  { providers: Cloudflare.providers(), state: Cloudflare.state() },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
+    return { url: worker.url.as<string>() };
+  }),
+);
+```
+
+Yielding the class returns the underlying `Worker` resource;
+`worker.url` is the public `workers.dev` URL the test will hit.
+
+## Set up the test runner
+
+```typescript
+// test/worker.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Vitest";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+});
+```
+
+`Test.make({ providers: Cloudflare.providers() })` returns
+`test`/`beforeAll`/`afterAll`/`deploy`/`destroy` bound to a real
+Cloudflare deployment. These are drop-in replacements for vitest's
+own — `test` is the same shape, `beforeAll` / `afterAll` are wired
+to the alchemy deploy/destroy lifecycle.
+
+## Deploy the stack once for the file
+
+```diff lang="typescript"
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Test from "alchemy/Test/Vitest";
++import Stack from "../alchemy.run.ts";
+
+ const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+   providers: Cloudflare.providers(),
+ });
++
++const stack = beforeAll(deploy(Stack));
++afterAll.skipIf(!!process.env.NO_DESTROY)(destroy(Stack));
+```
+
+`beforeAll(deploy(Stack))` deploys once at the start of the file and
+returns a handle each test `yield*`s for the stack's outputs.
+`afterAll(destroy(Stack))` tears the deployment down at the end —
+skip with `NO_DESTROY=1` to keep it around between iterations.
+
+## Build a typed RPC client layer
+
+```diff lang="typescript"
++import * as Layer from "effect/Layer";
++import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
++import * as RpcClient from "effect/unstable/rpc/RpcClient";
++import * as RpcSerialization from "effect/unstable/rpc/RpcSerialization";
+
+ // ...
++const clientLayer = (url: string) =>
++  RpcClient.layerProtocolHttp({ url }).pipe(
++    Layer.provide(FetchHttpClient.layer),
++    Layer.provide(
++      Layer.succeed(RpcSerialization.RpcSerialization, RpcSerialization.json),
++    ),
++  );
+```
+
+The same `TaskRpcs` value the worker serves drives the test client.
+`layerProtocolHttp` carries requests over `fetch`; `RpcSerialization.json`
+matches the worker's wire codec (use `RpcSerialization.ndjson` if any
+procedure is a streaming RPC).
+
+## Write the round-trip test
+
+```diff lang="typescript"
++import { expect } from "@effect/vitest";
++import * as Effect from "effect/Effect";
++import { TaskRpcs } from "../src/rpcs.ts";
+
+ // ...
++test(
++  "getTask round-trip",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++    yield* Effect.gen(function* () {
++      const client = yield* RpcClient.make(TaskRpcs);
++      const result = yield* client.getTask({ id: "abc" });
++      expect(result).toBe("task-abc");
++    }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
++  }),
++);
+```
+
+`yield* stack` resolves the deploy handle to its outputs, including
+`url`. `RpcClient.make(TaskRpcs)` gives you a fully typed client — the
+test asserts on `client.getTask({...})` directly, with schema decoding
+and tagged errors built in.
+
+## Ride the cold-start with retries
+
+```diff lang="typescript"
++import * as Schedule from "effect/Schedule";
+
+ test(
+   "getTask round-trip",
+   Effect.gen(function* () {
+     const { url } = yield* stack;
+     yield* Effect.gen(function* () {
+       const client = yield* RpcClient.make(TaskRpcs);
+-      const result = yield* client.getTask({ id: "abc" });
++      const result = yield* client
++        .getTask({ id: "abc" })
++        .pipe(
++          Effect.retry({
++            schedule: Schedule.exponential("500 millis"),
++            times: 5,
++          }),
++        );
+       expect(result).toBe("task-abc");
+     }).pipe(Effect.scoped, Effect.provide(clientLayer(url)));
+   }),
++  { timeout: 60_000 },
+ );
+```
+
+Fresh `workers.dev` URLs take a few seconds to start serving 200s.
+The retry schedule rides through that warm-up so the first test in
+the file doesn't fail on edge propagation.
+
+## Streaming procedures
+
+If any procedure in the group is a streaming RPC, switch the wire
+codec from `layerJson` to `layerNdjson` (newline framing is required):
+
+```diff lang="typescript"
+-      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
++      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerNdjson)),
+```
+
+Use the matching serialization layer in your test client.
+
+## Bonus: call it from another Worker
+
+Once the single-worker flow is solid, any other Worker in the same
+account can call it via `Cloudflare.RpcWorker.bind` — no public URL,
+no extra schema. To keep the example focused on the cross-Worker
+call, the caller is a plain `Cloudflare.Worker` with a `fetch`
+handler. Start with a bare class:
+
+```typescript
+// src/caller.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default class Caller extends Cloudflare.Worker<Caller>()(
+  "Caller",
+  { main: import.meta.filename },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("ok");
+      }),
+    };
+  }),
+) {}
+```
+
+A regular Worker — same shape as any other `Cloudflare.Worker`.
+
+## Bind the typed client at init
+
+```diff lang="typescript"
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
+ import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import TaskWorker from "./worker.ts";
+
+ export default class Caller extends Cloudflare.Worker<Caller>()(
+   "Caller",
+   { main: import.meta.filename },
+   Effect.gen(function* () {
++    const tasks = yield* Cloudflare.RpcWorker.bind(TaskWorker);
++
+     return {
+       fetch: Effect.gen(function* () {
+         return HttpServerResponse.text("ok");
+       }),
+     };
+   }),
+ ) {}
+```
+
+`Cloudflare.RpcWorker.bind(TaskWorker)` registers the service
+binding on this Worker so workerd surfaces the stub on `env`, and
+returns a typed `RpcClient` that mirrors `TaskWorker`'s schema.
+
+## Call it from `fetch`
+
+```diff lang="typescript"
+ return {
+   fetch: Effect.gen(function* () {
++    const task = yield* tasks.getTask({ id: "abc" });
++    return HttpServerResponse.text(task);
+-    return HttpServerResponse.text("ok");
+   }),
+ };
+```
+
+`tasks.getTask({...})` is just an Effect — fully typed against
+`TaskWorker`'s schema (success type `string`, error channel includes
+`TaskNotFound`). Each call goes over the in-account service binding,
+not the public network.
+
+:::note[How it works under the hood]
+Cloudflare rejects I/O objects (the service-binding `stub.fetch`
+body) created on a previous request, which means the underlying
+`RpcClient` has to be fresh every call. The bind hides that behind a
+`Proxy`: each method invocation transparently builds a fresh client,
+runs the call inside its own scope, and tears the client down with
+the call. The consumer just sees a normal `RpcClient`.
+:::
+
+## Modular form: separate the class from its runtime
+
+The inline form above bakes the runtime into the class
+declaration. The **two-arg form** — `(id, props)` with no impl —
+declares the class as a pure tagged identifier and provides the
+runtime via `static make(impl)`:
+
+```typescript
+// src/worker.ts
+export class Worker extends Cloudflare.RpcWorker<Worker>()(
+  "Worker",
+  { main: import.meta.filename, schema: TaskRpcs },
+) {}
+
+export default Worker.make(
+  Effect.gen(function* () {
+    const handlers = TaskRpcs.toLayer({
+      getTask: ({ id }) => Effect.succeed(`task-${id}`),
+    });
+    return RpcServer.toHttpEffect(TaskRpcs).pipe(
+      Effect.provide(Layer.mergeAll(handlers, RpcSerialization.layerJson)),
+    );
+  }),
+);
+```
+
+`Worker.make(impl)` returns a `Layer<Worker>`. Consumers import
+the class for type information; only the script that actually
+hosts the Worker imports the default Layer.
+
+## Host a Durable Object for cross-script binding
+
+`RpcWorker<Self, Deps>()` mirrors `Cloudflare.Worker<Self, Bindings, Deps>`
+— the optional second type argument declares DOs the script
+publishes for cross-script binding:
+
+```diff lang="typescript"
++import { Counter } from "./counter.ts";
+
+-export class Worker extends Cloudflare.RpcWorker<Worker>()(
++export class Worker extends Cloudflare.RpcWorker<Worker, Counter>()(
+   "Worker",
+   { main: import.meta.filename, schema: TaskRpcs },
+ ) {}
+```
+
+With `Counter` declared in `Deps`, any other Worker can write
+`Counter.from(Worker)` and have it type-check — see the
+[RPC Durable Object tutorial](/tutorial/cloudflare/rpc-durable-object)
+for the full cross-script pattern.
+
+## Recap
+
+- `Cloudflare.RpcWorker` keeps everything from
+  [Effect RPC](/guides/effect-rpc) and removes the `{ fetch }`
+  wrapper. `props.schema` declares the served `RpcGroup`; the init
+  returns the piped `RpcServer.toHttpEffect(schema)` Effect directly.
+- Inline form `(id, props, impl)` bundles the runtime into the
+  class; modular form `(id, props)` + `Class.make(impl)` keeps the
+  class importable without the runtime.
+- `RpcWorker<Self, Deps>()` declares cross-script DOs that
+  consumers can bind to via `Counter.from(Worker)`.
+- A single `Test.make` + `beforeAll(deploy(Stack))` + typed
+  `RpcClient.make(TaskRpcs)` gets you an integration test that
+  hammers a real `workers.dev` URL.
+- For streaming procedures, switch `layerJson` → `layerNdjson` on
+  both ends.
+- `Cloudflare.RpcWorker.bind(WorkerClass)` works from any Worker —
+  `RpcWorker` or plain `Cloudflare.Worker` — and gives you a typed
+  client over the in-account service binding.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/vite-spa.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/vite-spa.mdx
new file mode 100644
index 00000000000..c17c747120c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/vite-spa.mdx
@@ -0,0 +1,587 @@
+---
+title: Add a Vite SPA
+description: Ship a Vite single-page app from the same Stack as your Worker — built, bundled, and deployed to Cloudflare in one command.
+sidebar:
+  order: 3
+---
+
+`Cloudflare.Vite` invokes Vite programmatically (via
+`createBuilder`), builds your client assets, ships them to
+Cloudflare, and serves them through a Worker — so your frontend
+and backend share one URL surface and one deploy.
+
+Pick the path that fits where you're starting from:
+
+1. [Set it up manually](#set-it-up-manually) — start from an
+   empty project; the bare minimum is an `index.html` and an
+   entry module.
+2. [Use the `create-vite` template](#use-the-create-vite-template)
+   — start from Vite's official React + TS scaffold.
+3. [Deploy an existing Vite project](#deploy-an-existing-vite-project)
+   — point Alchemy at a SPA you already have.
+
+## Set it up manually
+
+The bare minimum is **an `index.html` with a script tag**. No
+`vite.config.ts`, no `package.json` `build` script, no `main`
+entry. Alchemy supplies the Vite config itself.
+
+A minimal React SPA looks like:
+
+```
+.
+├── index.html          # entry HTML, references the client bundle
+└── src/
+    └── main.tsx        # client entry imported by index.html
+```
+
+### Install React
+
+```sh
+bun add react react-dom
+bun add -d @types/react @types/react-dom @vitejs/plugin-react
+```
+
+### Create index.html
+
+`index.html` just needs to load your entry module:
+
+```html
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <title>My App</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
+```
+
+:::caution[index.html must be at rootDir]
+Vite resolves `index.html` relative to its project root. Alchemy's
+`rootDir` defaults to `process.cwd()` — so place `index.html`
+next to your `alchemy.run.ts`, or set `rootDir` to the folder
+that contains it. See Vite's
+[project structure docs](https://vite.dev/guide/#index-html-and-project-root).
+:::
+
+### Create src/main.tsx
+
+Mount a React component into the `#root` div:
+
+```tsx
+// src/main.tsx
+import React from "react";
+import ReactDOM from "react-dom/client";
+
+function App() {
+  return (
+    <main>
+      <h1>Hello from Alchemy + Vite</h1>
+      <p>Edit <code>src/main.tsx</code> and redeploy.</p>
+    </main>
+  );
+}
+
+ReactDOM.createRoot(document.getElementById("root")!).render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>,
+);
+```
+
+### Add it to the Stack
+
+Yield `Cloudflare.Vite("Website")` from your Stack:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const worker = yield* Worker;
++    const web = yield* Cloudflare.Vite("Website");
+    return {
+      url: worker.url,
++      webUrl: web.url,
+    };
+  }),
+);
+```
+
+The defaults set `notFoundHandling: "single-page-application"`,
+which is what makes client-side routing work — a deep link like
+`/about` returns `index.html` instead of a 404, and your router
+handles it on the client.
+
+Any framework Vite supports works the same way — vanilla TS,
+Vue, Solid, Svelte — bring whatever `src/` layout the framework
+wants.
+
+### Inject the Worker URL at build time
+
+A pure SPA needs the backend's URL baked into the JS bundle at
+build time — there's no server to resolve it on each request. Pass
+`env` to `Cloudflare.Vite` and any `VITE_`-prefixed entry is
+inlined as `import.meta.env.<KEY>` during the Vite build, the same
+as if you'd run `VITE_API_URL=https://… vite build`:
+
+```diff lang="typescript"
+// alchemy.run.ts
+ const worker = yield* Worker;
+ const web = yield* Cloudflare.Vite("Website", {
++  env: {
++    VITE_API_URL: worker.url.as<string>(),
++  },
+ });
+```
+
+Then read it from the SPA:
+
+```tsx
+// src/main.tsx
+const apiUrl = import.meta.env.VITE_API_URL;
+
+await fetch(`${apiUrl}/api/hello`);
+```
+
+A few notes:
+
+- **Only `VITE_`-prefixed keys are inlined into the bundle**, matching
+  Vite's default `envPrefix`. Other keys are still attached to the
+  deployed Worker as runtime bindings but stay out of the SPA's JS.
+- **`Redacted` values are unwrapped** when they're `VITE_`-prefixed —
+  prefixing means "this is public", so the redaction is taken as a
+  marker for log scrubbing, not for hiding the value from the bundle.
+  Don't prefix secrets with `VITE_`.
+- **`Output` values resolve at deploy time** before the build runs,
+  so `worker.url.as<string>()` works as shown.
+
+## Use the create-vite template
+
+If you'd rather start from a real framework scaffold (React + TS
+with HMR, ESLint, etc.), use Vite's official template:
+
+```sh
+bun create vite@latest web -- --template react-ts
+cd web && bun install && cd ..
+```
+
+That drops a complete project into `./web/` with its own
+`package.json`, `tsconfig.json`, and `vite.config.ts`.
+
+### Point Cloudflare.Vite at the subfolder
+
+Since the SPA isn't at the project root, set `rootDir`:
+
+```diff lang="typescript"
+// alchemy.run.ts
+Effect.gen(function* () {
+  const worker = yield* Worker;
++  const web = yield* Cloudflare.Vite("Website", {
++    rootDir: "./web",
++  });
+  return {
+    url: worker.url,
+    webUrl: web.url,
+  };
+}),
+```
+
+`rootDir` defaults to `process.cwd()`, so you only set it when
+your `index.html` isn't next to `alchemy.run.ts`.
+
+## Deploy an existing Vite project
+
+Already have a Vite SPA? Point `Cloudflare.Vite` at it with
+`rootDir` and you're done:
+
+```ts
+// alchemy.run.ts
+const web = yield* Cloudflare.Vite("Website", {
+  rootDir: "./path/to/your/spa",
+});
+```
+
+Your existing `vite.config.ts`, plugins, aliases, and `tsconfig`
+are all preserved — Alchemy merges its Cloudflare integration on
+top of your config. Two things to check first:
+
+:::caution[Remove @cloudflare/vite-plugin if present]
+Remove @cloudflare/vite-plugin if present from your `vite.config.ts`.
+Alchemy ships its own Cloudflare integration and is **not compatible** with `@cloudflare/vite-plugin`.
+
+
+```diff lang="typescript"
+// vite.config.ts
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+-import cloudflare from "@cloudflare/vite-plugin";
+
+export default defineConfig({
+-  plugins: [react(), cloudflare()],
++  plugins: [react()],
+});
+```
+:::
+
+## Deploy
+
+```sh
+bun alchemy deploy
+```
+
+Alchemy runs Vite on `rootDir`, uploads the assets, creates a
+Worker that serves them, and prints the new `webUrl` stack output:
+
+```
+{
+  url: "https://myapp-worker-dev-you.workers.dev",
+  webUrl: "https://myapp-web-dev-you.workers.dev",
+}
+```
+
+## Verify
+
+Hit it with `curl`:
+
+```sh
+curl -s https://myapp-web-dev-you.workers.dev | head -5
+# <!doctype html>
+# <html lang="en">
+#   <head>
+#     <meta charset="UTF-8" />
+#     ...
+```
+
+Or add an integration test alongside the existing ones:
+
+```diff lang="typescript"
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++test(
++  "Web SPA serves index.html",
++  Effect.gen(function* () {
++    const { webUrl } = yield* stack;
++
++    const response = yield* HttpClient.get(webUrl);
++    expect(response.status).toBe(200);
++    expect(yield* response.text).toContain("<!doctype html>");
++  }),
++);
+```
+
+## Local dev
+
+Coming soon.
+
+## Use a different framework
+
+`Cloudflare.Vite` works with any Vite-based framework. The setup
+above is the SPA case (no SSR). For SSR frameworks, drop the
+`assets.config` block and let the framework's Vite plugin own the
+entry. Common choices:
+
+- **TanStack Start** — full-stack React with file-based routing and
+  server functions. See [examples/cloudflare-tanstack](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-tanstack).
+- **SolidStart** — SSR Solid with file-based routing. See
+  [examples/cloudflare-solidstart](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-solidstart).
+- **SolidJS SSR (manual)** — when you want full control over the
+  SSR pipeline rather than SolidStart's conventions. See
+  [examples/cloudflare-solidjs-ssr](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-solidjs-ssr).
+- **Vue 3 SPA** — Vite's default Vue template, with the same
+  `notFoundHandling: "single-page-application"` config as above.
+  See [examples/cloudflare-vue](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-vue).
+- **Plain static site** — a single `index.html` (no framework)
+  ships through `Cloudflare.Vite("Website")` with no extra config.
+  See [examples/cloudflare-static-site](https://github.com/alchemy-run/alchemy-effect/tree/main/examples/cloudflare-static-site).
+
+For deeper coverage of framework-specific patterns (asset configs,
+SSR vs SPA tradeoffs, custom build steps), see the
+[Frontend frameworks guide](/guides/frontends).
+
+## Add a backend resource
+
+Most SPAs need to talk to a real backing service — a bucket for
+uploads, a database for state. Bindings give your Worker a typed
+handle to those resources.
+
+The walkthrough below uses a TanStack Start route handler because
+a pure SPA only ships static assets — there's no server-side `env`
+to call. The same `bindings` map and the same three call patterns
+work in any Vite framework that exposes server routes (SolidStart,
+Astro SSR, etc.).
+
+Start with the simplest backend: an R2 bucket.
+
+```typescript
+// src/backend.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+```
+
+`Cloudflare.R2Bucket("Bucket")` is a description, not a deploy.
+Alchemy provisions the real bucket on the next run as soon as
+something binds to it.
+
+## Bind the bucket to your worker
+
+Add the bucket to the Vite worker's `bindings` map:
+
+```diff lang="typescript"
+// alchemy.run.ts
++import { Bucket } from "./src/backend.ts";
+
+ const web = yield* Cloudflare.Vite("Website", {
++  env: {
++    BUCKET: Bucket,
++  },
+ });
+```
+
+The key (`BUCKET`) is the field name on `env`; the value identifies
+the resource. `env.BUCKET` is now typed as `R2Bucket` end to end.
+
+## Pull in Cloudflare's binding types
+
+`InferEnv` maps each binding to a Cloudflare runtime type
+(`R2Bucket`, `Service`, `KVNamespace`, …) — those types live in
+`@cloudflare/workers-types`. Add it to your `tsconfig.json` so the
+TypeScript checker can find them:
+
+```sh
+bun add -d @cloudflare/workers-types
+```
+
+```diff lang="json"
+// tsconfig.json
+ {
+   "compilerOptions": {
+     "types": [
+       "bun",
+-      "vite/client"
++      "vite/client",
++      "@cloudflare/workers-types"
+     ]
+   }
+ }
+```
+
+Without this you'll see `Cannot find name 'R2Bucket'` (or `Service`,
+etc.) the moment you reference `env.BUCKET` inside a route handler.
+
+## Option 1 — call the binding directly
+
+Inside a server route, `env.BUCKET` is the standard Cloudflare R2
+client. Use it as a regular `async`/`await` API:
+
+```typescript
+// src/routes/api.hello.ts
+import { createFileRoute } from "@tanstack/react-router";
+import { env } from "../env.ts";
+
+export const Route = createFileRoute("/api/hello")({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        const key = new URL(request.url).searchParams.get("key");
+        if (!key) return new Response("Missing 'key'", { status: 400 });
+
+        // option 1 — use the async binding directly
+        const object = await env.BUCKET.get(key);
+        if (!object) return new Response("Not found", { status: 404 });
+        return new Response(object.body);
+      },
+    },
+  },
+});
+```
+
+This is the most direct path — no extra workers, no extra code.
+Reach for it when the route handler owns all the logic itself.
+
+## Add an Effect-native Worker
+
+When the work is shared across routes, deserves typed errors, or
+needs Effect-native primitives (retries, layers, structured
+concurrency), factor it into its own Worker:
+
+```diff lang="typescript"
+// src/backend.ts
+ import * as Cloudflare from "alchemy/Cloudflare";
++import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
++import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+ export const Bucket = Cloudflare.R2Bucket("Bucket");
++
++export default class Backend extends Cloudflare.Worker<Backend>()(
++  "Backend",
++  { main: import.meta.path },
++  Effect.gen(function* () {
++    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
++
++    return {
++      hello: Effect.fn("Backend.hello")(function* (key: string) {
++        const object = yield* bucket.get(key);
++        if (object === null) return null;
++        return yield* object.text();
++      }),
++      fetch: Effect.gen(function* () {
++        const request = yield* HttpServerRequest;
++        const key = new URL(request.url, "http://x").searchParams.get("key");
++        if (!key) {
++          return HttpServerResponse.text("Missing 'key'", { status: 400 });
++        }
++        const object = yield* bucket.get(key);
++        if (object === null) {
++          return HttpServerResponse.text("Not found", { status: 404 });
++        }
++        return HttpServerResponse.raw(object.body);
++      }),
++    };
++  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
++) {}
+```
+
+`hello` is a typed RPC method — any worker bound to `Backend` can
+call it across worker boundaries. `fetch` is the standard HTTP
+handler. The R2 binding lives once on the Backend; the Vite worker
+no longer needs to bind it directly unless it also wants to call
+R2 itself.
+
+## Bind the Backend as a service
+
+Add `Backend` next to (or instead of) `BUCKET` in the Vite worker's
+`env`:
+
+```diff lang="typescript"
+// alchemy.run.ts
+-import { Bucket } from "./src/backend.ts";
++import Backend, { Bucket } from "./src/backend.ts";
+
+ const web = yield* Cloudflare.Vite("Website", {
+   env: {
+     BUCKET: Bucket,
++    BACKEND: Backend,
+   },
+ });
+```
+
+`env.BACKEND` is a Cloudflare service binding, typed for the wire
+shape Alchemy emits — Effect/Stream return values come back as
+encoded envelopes (more on that in option 3).
+
+## Option 2 — call the worker's `fetch`
+
+`env.BACKEND.fetch(input, init?)` is the standard Cloudflare
+service-binding `fetch`. Use it like any other HTTP service:
+
+```diff lang="typescript"
+// src/routes/api.hello.ts
+       GET: async ({ request }) => {
+         const key = new URL(request.url).searchParams.get("key");
+         if (!key) return new Response("Missing 'key'", { status: 400 });
+
+-        // option 1 — use the async binding directly
+-        const object = await env.BUCKET.get(key);
+-        if (!object) return new Response("Not found", { status: 404 });
+-        return new Response(object.body);
++        // option 2 — call the worker's fetch handler
++        return env.BACKEND.fetch(
++          `https://backend/?key=${encodeURIComponent(key)}`,
++        );
+       },
+```
+
+The Backend already handles the R2 lookup behind its own `fetch`,
+so the response flows straight through. Reach for this when the
+backend logic is HTTP-shaped (REST endpoints, streaming responses)
+and you don't want to duplicate it in the route handler.
+
+## Wrap the binding for typed RPC
+
+Effect-native workers serialize their results as wire envelopes:
+`Effect.fail` becomes an `RpcErrorEnvelope`, `Stream` becomes an
+encoded `ReadableStream`. `toPromiseApi` is the consumer-side
+wrapper that auto-decodes those envelopes into a clean `Promise<T>`
+API:
+
+```diff lang="typescript"
+// src/routes/api.hello.ts
+ import { createFileRoute } from "@tanstack/react-router";
++import * as Cloudflare from "alchemy/Cloudflare";
++import type Backend from "../backend.ts";
+ import { env } from "../env.ts";
+
++const backend = Cloudflare.toPromiseApi<Backend>(env.BACKEND);
+```
+
+Error envelopes are thrown so `await` rejects; stream envelopes
+unwrap to their raw `ReadableStream<Uint8Array>` body.
+`Service.fetch` and `Service.connect` pass through unchanged so the
+returned proxy is still a usable `Service` binding.
+
+## Option 3 — call the worker's RPC method
+
+Now `hello` is a normal typed `await`:
+
+```diff lang="typescript"
+// src/routes/api.hello.ts
+       GET: async ({ request }) => {
+         const key = new URL(request.url).searchParams.get("key");
+         if (!key) return new Response("Missing 'key'", { status: 400 });
+
+-        // option 2 — call the worker's fetch handler
+-        return env.BACKEND.fetch(
+-          `https://backend/?key=${encodeURIComponent(key)}`,
+-        );
++        // option 3 — call the worker's RPC method
++        const value = await backend.hello(key);
++        if (value === null) return new Response("Not found", { status: 404 });
++        return new Response(value);
+       },
+```
+
+RPC keeps you off the HTTP detour — the call is a typed function,
+not a request, and the return value is the value itself (no
+`.json()`, no status codes to plumb).
+
+:::tip[Calling RPC from another Effect-native Worker?]
+Use [`Cloudflare.bindWorker(Backend)`](/providers/cloudflare/worker)
+instead of `toPromiseApi`. It returns the same shape with `Effect`
+return values, preserving typed errors and decoded streams instead
+of throwing them away.
+:::
+
+Your app now ships a Worker backend and a Vite frontend from the
+same `alchemy.run.ts`, deploying together with one command. Next
+you'll [run a Container](/tutorial/cloudflare/containers) so each
+Durable Object instance has its own long-lived process for
+executing untrusted code or running binaries.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/workflows.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/workflows.mdx
new file mode 100644
index 00000000000..413ff5de6f7
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/cloudflare/workflows.mdx
@@ -0,0 +1,481 @@
+---
+title: Add a Workflow
+description: Orchestrate durable, multi-step work with Cloudflare Workflows — automatic retries, replayable steps, and at-least-once delivery.
+sidebar:
+  order: 5
+---
+
+The `Sandbox` container handles long-lived compute, but sometimes
+you need to coordinate **many** steps that should outlive any single
+request — a checkout flow, a multi-stage data pipeline, a "send a
+reminder in 24 hours" job. That's what **Cloudflare Workflows** are
+for: durable, retryable, replayable task sequences with at-least-once
+delivery semantics. The example below broadcasts each task's
+progress back to the chat `Room` you built two parts ago.
+
+## How a Workflow looks
+
+The shape mirrors what you've seen for Workers and Durable Objects.
+The outer `Effect.gen` resolves shared dependencies; the returned
+`Effect.fn` is the workflow body — a typed function from an `input`
+payload to an Effect that the Cloudflare Workflows runtime steps
+through:
+
+```typescript
+Effect.gen(function* () {
+  // Phase 1: init — runs at deploy and once per workflow instance.
+  const room = yield* Room;
+
+  return Effect.fn(function* (input: { orderId: string }) {
+    // Phase 2: workflow body — runs as durable steps.
+    const result = yield* Cloudflare.task("process", doWork(input.orderId));
+    yield* Cloudflare.sleep("cooldown", "10 seconds");
+    return result;
+  });
+});
+```
+
+Each `task` call is a checkpoint. If the worker crashes mid-task,
+Cloudflare replays the workflow from the last completed task — your
+code is _not_ retried, the persisted result is.
+
+## Create the workflow file
+
+Create `src/NotifyWorkflow.ts` with a typed workflow body. The
+`Effect.fn` takes the `input` payload directly, so `notifier.create({
+roomId, message })` is type-checked end to end — and the workflow's
+return value flows through to `instance.status().output`:
+
+```typescript
+// src/NotifyWorkflow.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Room from "./room.ts";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+      return { roomId, message };
+    });
+  }),
+) {}
+```
+
+The outer init resolves shared dependencies — here, the `Room` DO
+namespace from the previous tutorial so we can broadcast back to
+it. The inner `Effect.fn` is the workflow body that the Cloudflare
+runtime executes task by task.
+
+## Declare a KV namespace
+
+Tasks need somewhere durable to read and write. Give the workflow
+a KV namespace by declaring it in its own file:
+
+```typescript
+// src/KV.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const KV = Cloudflare.KVNamespace("KV");
+```
+
+`Cloudflare.KVNamespace("KV")` is just a description — Alchemy
+provisions the real namespace on the next deploy as soon as
+something binds to it.
+
+## Bind KV to the workflow
+
+`Cloudflare.KVNamespace.bind(KV)` belongs in the workflow's outer
+init phase. It registers the binding on the workflow's worker and
+returns a typed Effect-native client whose methods (`get`, `put`,
+`list`, `delete`) are Effects you can `yield*` directly:
+
+```diff lang="typescript"
+// src/NotifyWorkflow.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { KV } from "./KV.ts";
+import Room from "./room.ts";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
++   const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+      return { roomId, message };
+    });
+  }),
+) {}
+```
+
+Yielding the binding in the outer init is a one-time setup — the
+inner workflow body closes over `kv` and uses it on every run.
+
+## Add a task
+
+`Cloudflare.task("name", effect)` runs the inner Effect inside a
+Cloudflare workflow step — the result is checkpointed so a crash +
+replay returns the persisted value instead of re-running the side
+effect. Wrap **anything** that touches the outside world — HTTP
+calls, binding I/O, file writes — in a task:
+
+```diff lang="typescript"
+// src/NotifyWorkflow.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { KV } from "./KV.ts";
+import Room from "./room.ts";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+
++     const stored = yield* Cloudflare.task(
++       "kv-roundtrip",
++       Effect.gen(function* () {
++         const key = `workflow:${roomId}`;
++         yield* kv.put(key, message);
++         return yield* kv.get(key);
++       }).pipe(Effect.orDie),
++     );
+
+-     return { roomId, message };
++     return { roomId, message: stored };
+    });
+  }),
+) {}
+```
+
+`task` automatically threads the binding's service requirement
+through, so `kv.put` / `kv.get` work directly inside the inner
+Effect with no extra plumbing.
+
+:::caution[Always wrap I/O in `task`]
+The body Effect can re-execute many times during a replay. Anything
+you do outside a `task` (like a raw `kv.put`) runs on every replay.
+Wrapping the I/O in `task` makes the result persisted and the side
+effect run exactly once.
+:::
+
+## Broadcast to the chat room
+
+Add another task that fans the stored value out to the matching
+`Room` instance:
+
+```diff lang="typescript"
+// src/NotifyWorkflow.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { KV } from "./KV.ts";
+import Room from "./room.ts";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+
+      const stored = yield* Cloudflare.task(
+        "kv-roundtrip",
+        Effect.gen(function* () {
+          const key = `workflow:${roomId}`;
+          yield* kv.put(key, message);
+          return yield* kv.get(key);
+        }).pipe(Effect.orDie),
+      );
+
++     const room = rooms.getByName(roomId);
++     yield* Cloudflare.task(
++       "broadcast",
++       room.broadcast(`[workflow] ${stored}`),
++     );
+
+      return { roomId, message: stored };
+    });
+  }),
+) {}
+```
+
+Calling the DO's `broadcast` RPC method from inside a `task` makes
+the message-send durable too — replays don't double-broadcast.
+
+## Sleep between tasks
+
+`Cloudflare.sleep("name", "2 seconds")` parks the workflow without
+billing for compute, then resumes at the requested time. Names are
+required because Cloudflare uses them as replay keys:
+
+```diff lang="typescript"
+// src/NotifyWorkflow.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { KV } from "./KV.ts";
+import Room from "./room.ts";
+
+export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+  "Notifier",
+  Effect.gen(function* () {
+    const rooms = yield* Room;
+    const kv = yield* Cloudflare.KVNamespace.bind(KV);
+
+    return Effect.fn(function* (input: { roomId: string; message: string }) {
+      const { roomId, message } = input;
+
+      const stored = yield* Cloudflare.task(
+        "kv-roundtrip",
+        Effect.gen(function* () {
+          const key = `workflow:${roomId}`;
+          yield* kv.put(key, message);
+          return yield* kv.get(key);
+        }).pipe(Effect.orDie),
+      );
+
+      const room = rooms.getByName(roomId);
+      yield* Cloudflare.task(
+        "broadcast",
+        room.broadcast(`[workflow] ${stored}`),
+      );
+
++     yield* Cloudflare.sleep("cooldown", "2 seconds");
++
++     yield* Cloudflare.task(
++       "finalize",
++       room.broadcast(`[workflow] complete for ${roomId}`),
++     );
+
+      return { roomId, message: stored };
+    });
+  }),
+) {}
+```
+
+After the cool-down the workflow broadcasts a "complete" message
+and finishes. The whole sequence — KV roundtrip → broadcast →
+sleep → broadcast → return — is durable end to end.
+
+## Bind a secret
+
+Most real workflows need credentials — an upstream API key, a
+signing token, etc. `Alchemy.Secret` registers a `secret_text`
+binding on the workflow at plantime and hands back an accessor
+for use inside steps:
+
+```diff lang="typescript"
++import * as Alchemy from "alchemy";
+ import * as Cloudflare from "alchemy/Cloudflare";
+ import * as Effect from "effect/Effect";
+ import Room from "./room.ts";
+
+ export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+   "Notifier",
+   Effect.gen(function* () {
+     const rooms = yield* Room;
++    const apiKey = yield* Alchemy.Secret("API_KEY");
+```
+
+`Alchemy.Secret("API_KEY")` reads `API_KEY` from the active
+`Config` provider (env vars, `.env`, …) at plantime and binds it
+into the workflow as `secret_text`. Set it in your local `.env`:
+
+```sh
+# .env
+API_KEY=sk-test-123
+```
+
+See [Concepts › Secrets](/concepts/secrets) for the full set of
+input shapes (literals, `Effect`, `Config`, …).
+
+## Use the secret in a task
+
+The accessor returned in init is yielded inside the Runtime phase to resolve a
+`Redacted<string>`. Unwrap with `Redacted.value` only at the call
+site that needs it (here, an `Authorization` header):
+
+```diff lang="typescript"
++import * as Redacted from "effect/Redacted";
++import * as HttpClient from "effect/unstable/http/HttpClient";
++import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+
+ export default class NotifyWorkflow extends Cloudflare.Workflow<NotifyWorkflow>()(
+   "Notifier",
+   Effect.gen(function* () {
+     const rooms = yield* Room;
+     const apiKey = yield* Alchemy.Secret("API_KEY");
+
+     return Effect.gen(function* () {
+       const env = yield* Cloudflare.WorkerEnvironment;
+       const event = yield* Cloudflare.WorkflowEvent;
+       const { roomId, message } = event.payload as {
+         roomId: string;
+         message: string;
+       };
+
+       const stored = yield* Cloudflare.task("kv-roundtrip", /* ... */);
+
+       const room = rooms.getByName(roomId);
+       yield* Cloudflare.task(
+         "broadcast",
+         room.broadcast(`[workflow] ${stored}`),
+       );
+
++      const key = yield* apiKey;
++      yield* Cloudflare.task(
++        "fetch-with-auth",
++        HttpClientRequest.get("https://example.com/data").pipe(
++          HttpClientRequest.bearerToken(Redacted.value(key)),
++          HttpClient.execute,
++          Effect.flatMap((r) => r.text),
++        ),
++      );
+
+       return { roomId, message: stored };
+     });
+   }),
+ ) {}
+```
+
+`yield* apiKey` lives inside the body Effect — the Runtime phase —
+not at module scope. `HttpClient.execute` runs inside
+`Cloudflare.task`, so the response is checkpointed and the
+request only fires once across replays. `Redacted.value` is
+called at the single header site that needs the cleartext;
+elsewhere the value stays redacted.
+
+## Trigger from the Worker
+
+A Workflow becomes a typed handle when you `yield*` it in the
+Worker's init phase. Use `create()` to start an instance and
+`get(id).status()` to poll it:
+
+```diff lang="typescript"
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import NotifyWorkflow from "./NotifyWorkflow.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
++   const notifier = yield* NotifyWorkflow;
+
+    return {
+      fetch: Effect.gen(function* () {
++       const request = yield* HttpServerRequest;
++
++       if (
++         request.url.startsWith("/workflow/start/") &&
++         request.method === "POST"
++       ) {
++         const roomId = request.url.split("/").pop()!;
++         const instance = yield* notifier.create({
++           roomId,
++           message: "hello from workflow",
++         });
++         return yield* HttpServerResponse.json({ instanceId: instance.id });
++       }
++
++       if (request.url.startsWith("/workflow/status/")) {
++         const instanceId = request.url.split("/").pop()!;
++         const instance = yield* notifier.get(instanceId);
++         const status = yield* instance.status();
++         return yield* HttpServerResponse.json(status);
++       }
++
+        return HttpServerResponse.text("Hello from my Worker!");
+      }),
+    };
+  }),
+);
+```
+
+`notifier.create({ ... })` immediately returns an instance id — the
+workflow runs asynchronously on Cloudflare's side. `instance.status()`
+returns one of `"queued"`, `"running"`, `"paused"`, `"complete"`, or
+`"errored"` along with the `output` (what the body Effect returned)
+or `error`.
+
+Deploy:
+
+```sh
+bun alchemy deploy
+```
+
+Add a test that POSTs to `/workflow/start/:roomId`, then polls
+`/workflow/status/:instanceId` until the workflow reaches
+`complete`:
+
+```diff lang="typescript"
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, deploy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++test(
++  "Notifier workflow completes within 60s",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++    const roomId = `room-${Date.now()}`;
++
++    const start = yield* HttpClient.post(`${url}/workflow/start/${roomId}`);
++    const { instanceId } = (yield* start.json) as { instanceId: string };
++    expect(instanceId).toBeString();
++
++    const status = yield* HttpClient.get(
++      `${url}/workflow/status/${instanceId}`,
++    ).pipe(
++      Effect.flatMap((res) => res.json),
++      Effect.map((s) => s as { status: string }),
++      Effect.repeat({
++        schedule: Schedule.spaced("2 seconds"),
++        until: (s) => s.status === "complete" || s.status === "errored",
++      }),
++      Effect.timeout("60 seconds"),
++    );
++
++    expect(status.status).toBe("complete");
++  }),
++  { timeout: 120_000 },
++);
+```
+
+```sh
+bun test test/integ.test.ts
+```
+
+The polling loop should see the workflow transition through
+`running` and finish in `complete` within ~5 seconds (most of which
+is the `sleep("cooldown", "2 seconds")` cooldown).
+
+Your app now spans a Worker, a Vite frontend, Durable Objects,
+hibernatable WebSockets, a Container, and a Workflow — all
+deploying from CI thanks to [Part 5](/tutorial/part-5). From here,
+browse the [Concepts](/concepts/stack), [Guides](/guides/cli), and
+[Providers](/providers) sections for whatever you need next.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/part-1.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-1.mdx
new file mode 100644
index 00000000000..d66089ac7be
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-1.mdx
@@ -0,0 +1,302 @@
+---
+title: "Part 1: Your First Stack"
+description: Install Alchemy, create a Stack with a Cloudflare R2 Bucket, and deploy it.
+sidebar:
+  order: 1
+---
+
+import Terminal from "../../../components/Terminal.astro";
+import StateStoreBootstrap from "../../../components/marketing-islands/StateStoreBootstrap.tsx";
+import { Code, Tabs, TabItem } from "@astrojs/starlight/components";
+import { effectVersion } from "../../../versions";
+
+export const pkgs = `"alchemy@next" "effect@${effectVersion}" "@effect/platform-bun@${effectVersion}" "@effect/platform-node@${effectVersion}"`;
+
+In this first part you'll install Alchemy and Effect, create a Stack
+with a Cloudflare R2 Bucket, and deploy it — all in under five
+minutes.
+
+## Prerequisites
+
+- [Bun](https://bun.sh) (recommended) or Node.js 22+
+- A [Cloudflare](https://dash.cloudflare.com/sign-up) account
+
+## Create a project
+
+Start with an empty directory and initialize a `package.json`:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code="mkdir my-app && cd my-app && bun init -y" lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code="mkdir my-app && cd my-app && npm init -y" lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code="mkdir my-app && cd my-app && pnpm init" lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code="mkdir my-app && cd my-app && yarn init -y" lang="sh" />
+  </TabItem>
+</Tabs>
+
+## Install dependencies
+
+Install <code>alchemy@next</code> and <code>effect@{effectVersion}</code>:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code={`bun add ${pkgs}`} lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code={`npm install ${pkgs}`} lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code={`pnpm add ${pkgs}`} lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code={`yarn add ${pkgs}`} lang="sh" />
+  </TabItem>
+</Tabs>
+
+:::tip
+We recommend Bun for the best development experience, but Node.js
+works too.
+:::
+
+## Create the Stack
+
+Every Alchemy program starts with a `Stack` — a collection of
+Resources managed by Providers with state tracked between deploys.
+
+Create an `alchemy.run.ts` file:
+
+```typescript twoslash
+// @errors: 2345
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Layer.empty,
+  },
+  Effect.gen(function* () {
+    // we'll add resources here next
+  }),
+);
+```
+
+TypeScript is unhappy: the `state` property is required. Every Stack
+needs a **state store** so Alchemy can persist resource state between
+deploys and compute diffs against your infrastructure.
+
+## Configure state
+
+For this tutorial we'll use `Cloudflare.state()`, which persists state
+in a Cloudflare-hosted Worker backed by a Durable Object:
+
+```typescript twoslash
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
++import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Layer.empty,
++   state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    // we'll add resources here next
+  }),
+);
+```
+
+The first time you run `alchemy deploy`, `plan`, or `dev`, Alchemy
+will prompt for permission and bootstrap the state-store Worker into
+your Cloudflare account. It looks like this:
+
+<StateStoreBootstrap client:visible />
+
+This is a one-time event — the state-store Worker, its Durable
+Object, and the Secrets Store entries holding its auth token and
+encryption key are reused across every stack and stage on this
+Cloudflare account. See [State Store](/concepts/state-store) for
+the full picture.
+
+:::note[Other state stores]
+Don't want to deploy a Worker just for state? Swap `Cloudflare.state()`
+for `State.localState()` from `alchemy/State` to keep state on disk
+under `.alchemy/`, or [write your own](/concepts/state-store).
+:::
+
+## Add a Resource
+
+Resources represent cloud infrastructure — buckets, queues, functions,
+databases, and so on. Each resource is `yield*`-ed inside the Stack's
+Effect generator.
+
+Let's add a Cloudflare R2 Bucket to our Stack and observe the type error:
+
+```typescript twoslash errorReplace='ProviderCollectionShape<"Cloudflare">::Cloudflare.Providers'
+// @errors: 2322
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Layer.empty,
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
++   const bucket = yield* Cloudflare.R2Bucket("Bucket");
+  }),
+);
+```
+
+TypeScript is telling us that `Layer.empty` doesn't provide
+`Cloudflare.Providers` — the layer required by `R2Bucket`.
+
+## Fix the Providers
+
+Replace `Layer.empty` with `Cloudflare.providers()` to resolve the
+type error:
+
+```typescript twoslash
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+-import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
++   providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket("Bucket");
+  }),
+);
+```
+
+Now the program type-checks. The providers layer tells Alchemy how to
+talk to Cloudflare's APIs, and the type system ensures you never
+forget to wire it up.
+
+## Return Stack outputs
+
+Stack outputs let you see important values after a deploy. Return an
+object from the generator to expose them:
+
+```typescript twoslash
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket("Bucket");
+
++   return {
++     bucketName: bucket.bucketName,
++     //    ^?
+    };
+  }),
+);
+```
+
+## Deploy
+
+Run `alchemy deploy` to create the Bucket on Cloudflare:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code="bun alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code="npm run alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code="pnpm alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code="yarn alchemy deploy" lang="sh" />
+  </TabItem>
+</Tabs>
+
+The first time you deploy, Alchemy walks each provider in your stack
+through an interactive login and saves the credentials to your
+**`default`** [profile](/concepts/profiles) at
+`~/.alchemy/profiles.json`. For Cloudflare you can sign in with
+OAuth in the browser or paste an API token — no environment
+variables or `wrangler login` required.
+
+:::tip
+To re-run the credential prompt later (e.g. to switch from OAuth to
+an API token, or to add a `prod` profile) use
+`alchemy login --configure` or
+`alchemy login --profile prod --configure`.
+:::
+
+<Terminal content={`[u]Plan[/u]: [g]1 to create[/g]
+[g]+[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]
+
+Proceed?
+◉ Yes ○ No
+[g]✓[/g] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [g]created[/g]
+{
+[s2]bucketName: "myapp-bucket-a1b2c3d4e5",
+}`} />
+
+Alchemy shows a plan, asks for confirmation, creates the resource,
+and prints the stack outputs. Your bucket is live on Cloudflare.
+
+:::tip
+By convention, Alchemy looks for `alchemy.run.ts` at the root of your
+project. You can specify a different file with
+`alchemy deploy <file>`.
+:::
+
+## Verify it worked
+
+Your newly created R2 bucket will be listed on the [Cloudflare R2 Object Storage Dashboard](https://dash.cloudflare.com/?to=/:account/r2/overview).
+
+Run `alchemy deploy` again. Because nothing changed, the bucket shows
+as a no-op:
+
+<Terminal content={`[u]Plan[/u]: [d]no changes[/d]
+
+{
+[s2]bucketName: "myapp-bucket-a1b2c3d4e5",
+}`} />
+
+This is the core loop — declare resources in code, deploy, and
+Alchemy figures out what changed.
+
+## Recap
+
+You now have:
+
+- An `alchemy.run.ts` with a Stack and a Cloudflare R2 Bucket
+- A live bucket deployed to your Cloudflare account
+- Stack outputs showing the bucket name
+
+In [Part 2](/tutorial/part-2), you'll add a Cloudflare Worker that
+uses this bucket to serve HTTP requests.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/part-2.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-2.mdx
new file mode 100644
index 00000000000..da48637d036
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-2.mdx
@@ -0,0 +1,432 @@
+---
+title: "Part 2: Add a Worker"
+description: Create a Cloudflare Worker, bind the R2 Bucket, and implement GET/PUT routes.
+sidebar:
+  order: 2
+---
+
+import Terminal from "../../../components/Terminal.astro";
+import { Code, Tabs, TabItem } from "@astrojs/starlight/components";
+
+In [Part 1](/tutorial/part-1) you deployed an R2 Bucket. Now you'll
+create a Cloudflare Worker that reads and writes objects in that
+bucket over HTTP.
+
+## Create the Worker file
+
+Create `src/worker.ts`. A Worker is a special kind of Resource — it
+has both an infrastructure definition and a runtime implementation
+expressed as an Effect.
+
+```typescript twoslash
+// src/worker.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+export default Cloudflare.Worker(
+  "Worker",
+  {
+    main: import.meta.path,
+  },
+  Effect.gen(function* () {
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello, world!");
+      }),
+    };
+  }),
+);
+```
+
+:::note
+Notice the "Effect returning an Effect" pattern. The outer generator
+is the **Init phase** — it runs at both plan time and runtime. The
+inner `fetch` generator is the **Runtime phase** — it runs only when
+handling a request.
+:::
+
+## Bind the Bucket to the Worker
+
+Now let's bind the R2 Bucket from Part 1 to our new Worker. The
+problem is that the Bucket is declared inside the Stack's generator
+in `alchemy.run.ts` — we can't import it from there.
+
+A common pattern in Alchemy is to give each resource its own file.
+Create `src/bucket.ts`:
+
+```typescript twoslash
+// src/bucket.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+```
+
+Update `alchemy.run.ts` to import it instead of declaring it inline:
+
+```typescript twoslash
+// @filename: ./src/bucket.ts
+// ---cut---
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { Bucket } from "./src/bucket.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+-   const bucket = yield* Cloudflare.R2Bucket("Bucket");
++   const bucket = yield* Bucket;
+
+    return {
+      bucketName: bucket.bucketName,
+    };
+  }),
+);
+```
+
+:::tip
+Resource declarations like `Cloudflare.R2Bucket("Bucket")` are just
+descriptions — they don't execute until you `yield*` them inside a
+Stack. You can safely import them from multiple files.
+:::
+
+Now the Worker can import `Bucket` and bind it in the Init phase:
+
+```typescript twoslash errorReplace='.*::Type 'R2BucketBinding' is not assignable to type 'WorkerServices | PlatformServices'.'
+// src/worker.ts
+// @errors: 2345
+// @noEmit: true
+// @allowImportingTsExtensions: true
+// @filename: bucket.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+// @filename: index.ts
+// ---cut---
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
++import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  {
+    main: import.meta.path,
+  },
+  Effect.gen(function* () {
++   const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello, world!");
+      }),
+    };
+  }),
+);
+```
+
+## Provide the binding layer
+
+The previous step showed a type error — `R2Bucket.bind` requires the
+`R2BucketBinding` service. Fix it by piping the outer Effect through
+`R2BucketBindingLive`:
+
+```typescript twoslash errorReplace='.*::Type 'R2Error' is not assignable to type 'HttpServerError | HttpBodyError'.'
+// src/worker.ts
+// @noEmit: true
+// @allowImportingTsExtensions: true
+// @filename: ./bucket.ts
+// ---cut---
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      fetch: Effect.gen(function* () {
+        return HttpServerResponse.text("Hello, world!");
+      }),
+    };
++ }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+`R2BucketBindingLive` tells the Worker runtime how to look up the
+underlying R2 binding from the Cloudflare environment. Without it,
+`bind` wouldn't know where to find the bucket at runtime.
+
+## Add the PUT handler
+
+Let's replace the placeholder response with a PUT route that stores
+objects in the bucket. Add `HttpServerRequest` to access the incoming
+request:
+
+```typescript twoslash errorReplace=".*::Type 'R2Error' is not assignable to type 'HttpServerError | HttpBodyError'."
+// src/worker.ts
+// @errors: 2345
+// @noEmit: true
+// @allowImportingTsExtensions: true
+// @filename: ./bucket.ts
+// ---cut---
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
++import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
++       const request = yield* HttpServerRequest;
++       const key = request.url.split("/").pop()!;
++
++       if (request.method === "PUT") {
++         yield* bucket.put(key, request.stream, {
++           contentLength: Number(request.headers["content-length"] ?? 0),
++         });
++         return HttpServerResponse.empty({ status: 201 });
++       }
+
+        return HttpServerResponse.text("Hello, world!");
+      }),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+TypeScript flags a type error. The `bucket.put` call can fail with
+`R2Error`, but a Worker's `fetch` handler only allows
+`HttpServerError` or `HttpBodyError`. Effect tracks this in the type
+system — you can't forget to handle it.
+
+## Handle R2 errors
+
+Pipe the fetch Effect through `Effect.catchTag` to convert `R2Error`
+into a 500 response:
+
+```typescript twoslash
+// src/worker.ts
+// @noEmit: true
+// @allowImportingTsExtensions: true
+// @filename: ./bucket.ts
+// ---cut---
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.url.split("/").pop()!;
+
+        if (request.method === "PUT") {
+          yield* bucket.put(key, request.stream, {
+            contentLength: Number(request.headers["content-length"] ?? 0),
+          });
+          return HttpServerResponse.empty({ status: 201 });
+        }
+
+        return HttpServerResponse.text("Hello, world!");
++     }).pipe(
++       Effect.catchTag("R2Error", (error) =>
++         Effect.succeed(
++           HttpServerResponse.text(error.message, { status: 500 }),
++         ),
++       ),
++     ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+`Effect.catchTag` matches errors by their `_tag` field. If an R2
+operation fails at runtime, the Worker returns a 500 instead of
+crashing — and the type error disappears because `R2Error` is now
+fully handled.
+
+## Add the GET handler
+
+Complete the fetch handler by reading objects from the bucket when the
+request isn't a PUT:
+
+```typescript twoslash
+// src/worker.ts
+// @noEmit: true
+// @allowImportingTsExtensions: true
+// @filename: ./bucket.ts
+// ---cut---
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
+        const request = yield* HttpServerRequest;
+        const key = request.url.split("/").pop()!;
+
+        if (request.method === "PUT") {
+          yield* bucket.put(key, request.stream, {
+            contentLength: Number(request.headers["content-length"] ?? 0),
+          });
+          return HttpServerResponse.empty({ status: 201 });
+        }
+
++       const object = yield* bucket.get(key);
++       if (object === null) {
++         return HttpServerResponse.text("Not found", { status: 404 });
++       }
++       const text = yield* object.text();
++       return HttpServerResponse.text(text);
+-       return HttpServerResponse.text("Hello, world!");
+      }).pipe(
+        Effect.catchTag("R2Error", (error) =>
+          Effect.succeed(
+            HttpServerResponse.text(error.message, { status: 500 }),
+          ),
+        ),
+      ),
+    };
+  }).pipe(Effect.provide(Cloudflare.R2BucketBindingLive)),
+);
+```
+
+The Worker now handles two routes:
+
+- **`PUT /:key`** — stores the request body in the bucket
+- **`GET /:key`** — retrieves the object, returning 404 if missing
+
+Because `bucket.get` also returns `R2Error`, the `catchTag` you added
+in the previous step already covers it — no additional error handling
+needed.
+
+## Wire the Worker into the Stack
+
+Add the Worker to `alchemy.run.ts` and expose its URL as a stack
+output:
+
+```typescript twoslash
+// alchemy.run.ts
+// @filename: ./src/bucket.ts
+// @filename: ./src/worker.ts
+// ---cut---
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { Bucket } from "./src/bucket.ts";
++import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Bucket;
++   const worker = yield* Worker;
+
+    return {
+      bucketName: bucket.bucketName,
++     url: worker.url,
+    };
+  }),
+);
+```
+
+## Deploy
+
+Deploy again. Alchemy detects the new Worker and the unchanged Bucket:
+
+<Tabs syncKey="pkgManager">
+  <TabItem label="bun" icon="bun">
+    <Code code="bun alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="npm" icon="npm">
+    <Code code="npm run alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="pnpm" icon="pnpm">
+    <Code code="pnpm alchemy deploy" lang="sh" />
+  </TabItem>
+  <TabItem label="yarn" icon="seti:yarn">
+    <Code code="yarn alchemy deploy" lang="sh" />
+  </TabItem>
+</Tabs>
+
+<Terminal content={`[u]Plan[/u]: [g]1 to create[/g]
+
+[g]+[/g] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [c](1 bindings)[/c]
+[s2][g]+[/g] [c]Bucket[/c]
+[d]•[/d] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d]
+
+Proceed?
+◉ Yes ○ No
+[d]•[/d] [b]Bucket[/b] [d](Cloudflare.R2Bucket)[/d] [d]no change[/d]
+[g]✓[/g] [b]Worker[/b] [d](Cloudflare.Worker)[/d] [g]created[/g]
+[s2][d]• Uploading worker (14.20 KB) ...[/d]
+[s2][d]• Enabling workers.dev subdomain...[/d]
+{
+[s2]bucketName: "myapp-bucket-a1b2c3d4e5",
+[s2]url: "https://myapp-worker-dev-you-abc123.workers.dev",
+}`} />
+
+## Try it out
+
+Use `curl` to write and read an object:
+
+```sh
+# Store an object
+curl -X PUT https://myapp-worker-dev-you-abc123.workers.dev/hello.txt \
+  -d 'Hello, world!'
+
+# Retrieve it
+curl https://myapp-worker-dev-you-abc123.workers.dev/hello.txt
+# → Hello, world!
+```
+
+## Recap
+
+You now have:
+
+- A Cloudflare Worker with GET and PUT routes
+- An R2 Bucket bound to the Worker
+- Stack outputs showing both the bucket name and worker URL
+
+In [Part 3](/tutorial/part-3), you'll learn about stages and state
+stores so multiple developers (and CI) can deploy isolated environments.
+
+:::tip[Want to start building now?]
+You have a deployed Worker — that's enough to skip ahead and
+[add a Durable Object](/tutorial/cloudflare/durable-objects)
+(or any other Cloudflare deep-dive) if you'd rather build something
+interesting first and circle back to testing, local dev, and CI/CD
+when you need them.
+:::
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/part-3.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-3.mdx
new file mode 100644
index 00000000000..7dc1d30b609
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-3.mdx
@@ -0,0 +1,223 @@
+---
+title: "Part 3: Testing"
+description: Write integration tests that deploy your stack and make HTTP requests against your live Worker.
+sidebar:
+  order: 3
+---
+
+In [Part 2](/tutorial/part-2) you deployed a Worker with R2 Bucket
+bindings. Now you'll write integration tests that deploy the stack,
+hit the live Worker over HTTP, and verify it works.
+
+## Create the test file
+
+Alchemy ships test utilities for Bun that wrap `bun:test` with Effect
+support. Configure providers (and state) once at the top of the file
+with `Test.make({...})` — the same `Cloudflare.providers()` /
+`Cloudflare.state()` you used in your `Stack`:
+
+```typescript twoslash
+// @filename: ../alchemy.run.ts
+// ---cut---
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+```
+
+`expect` (and any other `bun:test` helpers like `describe`) come
+from `bun:test` directly — `Test.make` only provides the
+Effect-aware test runner pieces.
+
+## Deploy the stack before tests
+
+Use `beforeAll` with `deploy` to deploy your stack once before any
+tests run:
+
+```typescript twoslash
+// @filename: ../alchemy.run.ts
+// ---cut---
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
++const stack = beforeAll(deploy(Stack));
+```
+
+`deploy(Stack)` returns an Effect that plans and applies the stack.
+`beforeAll` runs it once, then returns a lazy accessor you can
+`yield*` inside each test to get the stack outputs.
+
+## Access the stack outputs
+
+Write your first test. Use `yield* stack` to get the outputs you
+returned from your Stack in Part 2:
+
+```typescript twoslash
+// @filename: ../alchemy.run.ts
+// ---cut---
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++test(
++  "worker returns a url",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++
++    expect(url).toBeString();
++  }),
++);
+```
+
+`test(name, effect)` wraps `bun:test` — you write an Effect generator
+instead of an async function.
+
+## Run the tests
+
+```sh
+bun test test/integ.test.ts
+```
+
+The first run deploys the stack (or reuses the existing one if
+already deployed). Subsequent runs are fast because Alchemy diffs
+and skips unchanged resources.
+
+## Add HTTP assertions
+
+The basic test just checks that a URL exists. Let's verify the Worker
+actually handles requests:
+
+```typescript twoslash
+// @filename: ../alchemy.run.ts
+// ---cut---
+// test/integ.test.ts
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
++import * as HttpBody from "effect/unstable/http/HttpBody";
++import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
+-test(
+-  "worker returns a url",
+-  Effect.gen(function* () {
+-    const { url } = yield* stack;
+-
+-    expect(url).toBeString();
+-  }),
+-);
++test(
++  "PUT and GET round-trip an object",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++
++    const put = yield* HttpClient.put(`${url}/hello.txt`, {
++      body: HttpBody.text("Hello, World!"),
++    });
++    expect(put.status).toBe(201);
++
++    const get = yield* HttpClient.get(`${url}/hello.txt`);
++    expect(yield* get.text).toBe("Hello, World!");
++  }),
++);
++
++test(
++  "GET missing key returns 404",
++  Effect.gen(function* () {
++    const { url } = yield* stack;
++    const response = yield* HttpClient.get(`${url}/no-such-key`);
++    expect(response.status).toBe(404);
++  }),
++);
+```
+
+`HttpClient` is provided automatically by the test harness — no
+extra setup needed.
+
+## Destroy after tests on CI
+
+Right now the stack stays deployed after tests finish. That's great
+locally — you can re-run tests instantly against the already-deployed
+stack. But on CI you want to clean up.
+
+Add `afterAll` with `destroy`, using `skipIf` to only tear down when
+`CI` is set:
+
+```typescript twoslash
+// @filename: ../alchemy.run.ts
+// ---cut---
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Test from "alchemy/Test/Bun";
+import { expect } from "bun:test";
+import * as Effect from "effect/Effect";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import Stack from "../alchemy.run.ts";
+
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+});
+
+const stack = beforeAll(deploy(Stack));
+
++afterAll.skipIf(!process.env.CI)(destroy(Stack));
+
+test(/* .. */);
+
+test(/* .. */);
+```
+
+- **Locally** — `CI` is not set, so `skipIf` skips the destroy. You
+  iterate fast against the live stack.
+- **On CI** — set `CI=true` and the stack is torn down automatically
+  after tests complete.
+
+## Recap
+
+You now have:
+
+- `Test.make({ providers, state })` to wire your provider Layer and
+  state store into the test runner once per file
+- `beforeAll(deploy(Stack))` to deploy once before tests
+- `yield* stack` to access outputs in each test
+- HTTP assertions using Effect's `HttpClient`
+- `afterAll.skipIf(!process.env.CI)(destroy(Stack))` for automatic
+  cleanup on CI with fast iteration locally
+
+In [Part 4](/tutorial/part-4), you'll run your stack locally with
+`alchemy dev` for instant feedback during development.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/part-4.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-4.mdx
new file mode 100644
index 00000000000..76106f3b6b1
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-4.mdx
@@ -0,0 +1,113 @@
+---
+title: "Part 4: Local Dev"
+description: Run your stack locally with alchemy dev for hot reloading and instant feedback.
+sidebar:
+  order: 4
+---
+
+In [Part 3](/tutorial/part-3) you wrote integration tests against
+your deployed stack. But deploying to Cloudflare on every code change
+is slow. In this part you'll use `bun alchemy dev` to run everything
+locally with hot reloading.
+
+## Start dev mode
+
+```sh
+bun alchemy dev
+```
+
+That's it. Alchemy deploys your stack to the cloud and proxies
+requests to Workers running locally in workerd. It watches for file
+changes and hot reloads your Worker automatically.
+
+Your Worker is available at `http://localhost:1337` by default:
+
+```sh
+curl http://localhost:1337/hello.txt
+```
+
+## How it works
+
+`bun alchemy dev` does three things:
+
+1. **Deploys to the cloud** — resources like R2 Buckets are created
+   on Cloudflare, while Workers run locally in workerd
+2. **Watches for changes** — when you edit `src/worker.ts` or any
+   file it imports, the Worker is rebuilt and reloaded instantly
+3. **Preserves local state** — data in your local R2 Bucket persists
+   across restarts
+
+The same `alchemy.run.ts` is used for both `dev` and `deploy` — no
+separate dev config needed.
+
+## Custom port
+
+Set a custom port for your Worker:
+
+```diff lang="typescript"
+// src/worker.ts
+export default Cloudflare.Worker(
+  "Worker",
+  {
+    main: import.meta.path,
++   dev: {
++     port: 3000,
++   },
+  },
+  // ...
+);
+```
+
+## Run tests in dev mode
+
+You don't need to run `bun alchemy dev` in a separate terminal to test
+against locally-emulated resources. The test harness has its own
+`dev` flag that flips every Worker over to workerd inside the test
+process — same wiring as `bun alchemy dev`, no extra terminal.
+
+```diff lang="typescript"
+// test/integ.test.ts
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
++ dev: true,
+});
+```
+
+`beforeAll(deploy(Stack))` now boots the Workers locally; HTTP
+assertions hit `http://localhost:1337` and roundtrip into your code
+with full stack traces.
+
+## Toggle dev mode from CI
+
+Hardcoding `dev: true` would force CI runs to local emulation too.
+Read it from the environment instead so the same test file runs
+against real cloud resources in CI and locally-emulated ones on your
+laptop.
+
+```diff lang="typescript"
+const { test, beforeAll, afterAll, deploy, destroy } = Test.make({
+  providers: Cloudflare.providers(),
+  state: Cloudflare.state(),
+- dev: true,
+});
+```
+
+Drop the explicit flag and the harness falls back to the
+`ALCHEMY_DEV` env var — set `ALCHEMY_DEV=1` in your shell to flip
+to local mode, leave it unset in CI.
+
+```sh
+ALCHEMY_DEV=1 bun test test/integ.test.ts
+```
+
+## Recap
+
+You now have:
+
+- Local development with `bun alchemy dev`
+- Hot reloading on file changes
+- Local emulation of Cloudflare resources
+
+In [Part 5](/tutorial/part-5), you'll set up GitHub Actions for
+automated deployments and PR preview environments.
diff --git a/.repos/alchemy-effect/website/src/content/docs/tutorial/part-5.mdx b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-5.mdx
new file mode 100644
index 00000000000..91461afd65e
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/tutorial/part-5.mdx
@@ -0,0 +1,474 @@
+---
+title: "Part 5: CI/CD"
+description: Set up GitHub Actions for automated deployments, PR previews, and remote state — with Cloudflare credentials managed as code.
+sidebar:
+  order: 5
+---
+
+import { Steps, Tabs, TabItem } from "@astrojs/starlight/components";
+
+In [Part 4](/tutorial/part-4) you ran your stack locally. Now you'll
+hand it off to GitHub Actions: pushes to `main` deploy to production,
+pull requests get isolated preview environments, and merged PRs clean
+up after themselves.
+
+The trick to doing this safely is **letting Alchemy provision its own
+CI credentials**. Instead of pasting your personal Cloudflare API key
+into GitHub, you'll write a small `stacks/github.ts` that mints a
+scoped Cloudflare API token, then stores it as a GitHub Actions
+secret — all from code, all checked in.
+
+## Confirm your state store is remote
+
+CI needs to share state across runs, so a local `.alchemy/` directory
+won't cut it. You already configured `Cloudflare.state()` back in
+[Part 1](/tutorial/part-1#configure-state), which deploys a Worker
+backed by a Durable Object with SQLite. Every deploy — local or
+from CI — reads and writes state remotely through that Worker.
+
+Double-check it's still wired up in `alchemy.run.ts`:
+
+```typescript
+// alchemy.run.ts
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Cloudflare.providers(),
+    state: Cloudflare.state(),
+  },
+  // ...
+);
+```
+
+:::caution
+If you're using `State.localState()` instead, switch it to
+`Cloudflare.state()` (or another shared store) before continuing —
+GitHub Actions runners can't see your local filesystem.
+:::
+
+## Set up an `admin` profile
+
+Your `alchemy.run.ts` only needs enough permission to deploy your
+app. The `stacks/github.ts` you're about to write needs more: it
+creates a brand-new Cloudflare API token, which requires the
+`API Tokens > Write` permission.
+
+Rather than hand those elevated rights to your day-to-day profile,
+create a dedicated `admin` profile:
+
+```sh
+alchemy login --profile admin
+```
+
+When prompted for a Cloudflare credential, pick one of:
+
+- **API Key + Email** (the Global API Key) — has full account
+  access, including the ability to mint tokens.
+- **API Token** — must be a token with at least
+  `User > API Tokens > Write` (for user-owned tokens) **and**
+  `Account > API Tokens > Write` (for the account whose tokens
+  you'll be creating). Most people use the Global API Key here
+  because the token-permissions UI in the Cloudflare dashboard is
+  fiddly.
+
+:::danger[Heads up]
+The credential stored under `--profile admin` can create new API
+tokens with arbitrary scopes. Treat it like root. Do **not** use it
+for everyday `alchemy deploy` runs against your application — keep
+your default profile on a narrowly scoped API Token (or OAuth) and
+only reach for `admin` when you're touching `stacks/github.ts`.
+:::
+
+You'll also be prompted for a GitHub credential. Pick `gh-cli` if
+you have the GitHub CLI installed, otherwise paste a Personal
+Access Token with the `repo` scope.
+
+## Scaffold the GitHub stack
+
+Create `stacks/github.ts` with an empty stack that loads both
+provider layers and reuses your remote state store. This is a
+one-shot stack you'll deploy from your laptop (under the `admin`
+profile) to provision the Cloudflare API token CI will use.
+
+```typescript
+// stacks/github.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+
+export default Alchemy.Stack(
+  "github",
+  {
+    providers: Layer.mergeAll(
+      Cloudflare.providers(),
+      GitHub.providers(),
+    ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const accountId = yield* Config.string("CLOUDFLARE_ACCOUNT_ID");
+  }),
+);
+```
+
+Reusing the same `Cloudflare.state()` you set up in Part 1 means the
+token's ID is tracked alongside the rest of your infrastructure, so
+any future edit (rename, policy change) produces a clean diff.
+
+## Mint a scoped Cloudflare API token
+
+Add an `AccountApiToken` resource. Under the hood it calls
+`POST /accounts/{account_id}/tokens` and returns the freshly minted
+secret. Cloudflare only reveals that value once, so Alchemy stores it
+in state — the raw token never touches your terminal.
+
+```diff lang="typescript"
+  Effect.gen(function* () {
+    const accountId = yield* Config.string("CLOUDFLARE_ACCOUNT_ID");
++
++   const apiToken = yield* Cloudflare.AccountApiToken("CIToken", {
++     accountId,
++     policies: [
++       {
++         effect: "allow",
++         permissionGroups: [
++           "Workers Scripts Write",
++           "Workers KV Storage Write",
++           "Workers R2 Storage Write",
++           "D1 Write",
++           "Queues Write",
++           "Pages Write",
++           "Account Settings Write",
++           "Workers Tail Read",
++         ],
++         resources: {
++           [`com.cloudflare.api.account.${accountId}`]: "*",
++         },
++       },
++     ],
++   });
+  }),
+```
+
+The `permissionGroups` list scopes the token down to exactly what
+your app needs. If you don't use D1 or R2, drop those entries.
+
+## Push the token into GitHub
+
+Pipe `apiToken.value` straight into a `GitHub.Secret` so CI can read
+it without the secret ever round-tripping through your shell.
+
+```diff lang="typescript"
+    });
++
++   yield* GitHub.Secret("cf-api-token", {
++     owner: "your-org",
++     repository: "your-repo",
++     name: "CLOUDFLARE_API_TOKEN",
++     value: apiToken.value,
++   });
+  }),
+```
+
+Replace `your-org` and `your-repo` with your GitHub org and repo
+slug.
+
+## Expose the account ID to CI
+
+The workflow also needs `CLOUDFLARE_ACCOUNT_ID`. It isn't a secret in
+the cryptographic sense, but storing it as a GitHub Actions secret
+keeps all CI configuration in one place and out of your workflow YAML.
+
+```diff lang="typescript"
+      value: apiToken.value,
+    });
++
++   yield* GitHub.Secret("cf-account-id", {
++     owner: "your-org",
++     repository: "your-repo",
++     name: "CLOUDFLARE_ACCOUNT_ID",
++     value: Redacted.make(accountId),
++   });
+  }),
+```
+
+`Redacted.make` wraps the plain string so it gets the same masking
+treatment as the API token.
+
+## Deploy the GitHub stack
+
+Run it once from your laptop, under the `admin` profile:
+
+```sh
+alchemy deploy stacks/github.ts --profile admin
+```
+
+You'll see Alchemy plan two creates — the Cloudflare token and the
+GitHub secret — then apply them. When it's done, head to your repo's
+**Settings → Secrets and variables → Actions** page; you should see
+`CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` listed there.
+
+You only need to re-run this stack when you want to rotate the token
+or change its permissions.
+
+## Create the workflow
+
+Create `.github/workflows/deploy.yml`:
+
+```yaml
+name: Deploy
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, synchronize, closed]
+
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  STAGE: >-
+    ${{ github.event_name == 'pull_request'
+      && format('pr-{0}', github.event.number)
+      || (github.ref == 'refs/heads/main' && 'prod' || github.ref_name) }}
+
+jobs:
+  deploy:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - name: Deploy
+        run: bun alchemy deploy --stage ${{ env.STAGE }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+          GITHUB_SHA: ${{ github.sha }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  cleanup:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - name: Safety Check
+        run: |
+          if [ "${{ env.STAGE }}" = "prod" ]; then
+            echo "ERROR: Cannot destroy prod environment in cleanup job"
+            exit 1
+          fi
+      - name: Destroy Preview
+        run: bun alchemy destroy --stage ${{ env.STAGE }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          PULL_REQUEST: ${{ github.event.number }}
+```
+
+:::note[How STAGE is computed]
+
+- Pull requests → `pr-{number}` (e.g. `pr-42`)
+- Push to `main` → `prod`
+- Other branches → the branch name
+
+The cleanup job includes a safety check so `prod` can never be
+accidentally destroyed.
+:::
+
+## Add PR preview comments
+
+Post the live URL as a comment on every PR. Update `alchemy.run.ts`:
+
+```diff lang="typescript"
+// alchemy.run.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
++import * as GitHub from "alchemy/GitHub";
++import * as Output from "alchemy/Output";
+import * as Effect from "effect/Effect";
++import * as Layer from "effect/Layer";
+import { Bucket } from "./src/bucket.ts";
+import Worker from "./src/worker.ts";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+-   providers: Cloudflare.providers(),
++   providers: Layer.mergeAll(
++     Cloudflare.providers(),
++     GitHub.providers(),
++   ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Bucket;
+    const worker = yield* Worker;
+
++   if (process.env.PULL_REQUEST) {
++     yield* GitHub.Comment("preview-comment", {
++       owner: "your-org",
++       repository: "your-repo",
++       issueNumber: Number(process.env.PULL_REQUEST),
++       body: Output.interpolate`
++         ## Preview Deployed
++
++         **URL:** ${worker.url}
++
++         Built from commit ${process.env.GITHUB_SHA?.slice(0, 7)}
++
++         ---
++         _This comment updates automatically with each push._
++       `,
++     });
++   }
+
+    return {
+      bucketName: bucket.bucketName,
+      url: worker.url,
+    };
+  }),
+);
+```
+
+The logical ID `"preview-comment"` stays the same across pushes, so
+Alchemy updates the existing comment instead of creating a new one.
+`GITHUB_TOKEN` is provided automatically by Actions and authorizes
+the comment.
+
+## The full picture
+
+Here's how everything fits together:
+
+1. You ran `stacks/github.ts` once under `--profile admin`. That
+   minted a scoped Cloudflare API token and pushed it into your
+   repo as a GitHub Actions secret.
+2. A developer pushes a branch and opens a PR.
+3. GitHub Actions checks out the code, installs deps, and runs
+   `alchemy deploy --stage pr-42` using the CI token.
+4. Alchemy creates an isolated copy of every resource (bucket,
+   worker, etc.) under the `pr-42` stage and posts the preview URL
+   as a PR comment.
+5. The reviewer clicks the URL and tests the preview.
+6. The PR is merged — the cleanup job runs
+   `alchemy destroy --stage pr-42` and the preview infrastructure
+   disappears.
+7. The push to `main` deploys `--stage prod`.
+
+Each environment is fully isolated with its own bucket, worker, and
+state.
+
+## Optional: separate test and prod Cloudflare accounts
+
+If you want to keep preview environments on one Cloudflare account
+and production on another, deploy two tokens from the same
+`stacks/github.ts` and prefix the secrets accordingly.
+
+```typescript
+// stacks/github.ts
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as GitHub from "alchemy/GitHub";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+
+export default Alchemy.Stack(
+  "github",
+  {
+    providers: Layer.mergeAll(
+      Cloudflare.providers(),
+      GitHub.providers(),
+    ),
+    state: Cloudflare.state(),
+  },
+  Effect.gen(function* () {
+    const testAccountId = yield* Config.string("TEST_CLOUDFLARE_ACCOUNT_ID");
+    const prodAccountId = yield* Config.string("PROD_CLOUDFLARE_ACCOUNT_ID");
+
+    const testToken = yield* Cloudflare.AccountApiToken("TestApiToken", {
+      accountId: testAccountId,
+      policies: [/* same policies as above */],
+    });
+
+    const prodToken = yield* Cloudflare.AccountApiToken("ProdApiToken", {
+      accountId: prodAccountId,
+      policies: [/* same policies as above */],
+    });
+
+    const secrets: Record<string, Redacted.Redacted<string>> = {
+      TEST_CLOUDFLARE_API_TOKEN: testToken.value,
+      TEST_CLOUDFLARE_ACCOUNT_ID: Redacted.make(testAccountId),
+      PROD_CLOUDFLARE_API_TOKEN: prodToken.value,
+      PROD_CLOUDFLARE_ACCOUNT_ID: Redacted.make(prodAccountId),
+    };
+
+    yield* Effect.all(
+      Object.entries(secrets).map(([name, value]) =>
+        GitHub.Secret(name, {
+          owner: "your-org",
+          repository: "your-repo",
+          name,
+          value,
+        }),
+      ),
+    );
+  }),
+);
+```
+
+In your workflow, choose which set of credentials to expose based
+on `STAGE`:
+
+```yaml
+env:
+  CLOUDFLARE_API_TOKEN: ${{ env.STAGE == 'prod' && secrets.PROD_CLOUDFLARE_API_TOKEN || secrets.TEST_CLOUDFLARE_API_TOKEN }}
+  CLOUDFLARE_ACCOUNT_ID: ${{ env.STAGE == 'prod' && secrets.PROD_CLOUDFLARE_ACCOUNT_ID || secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
+```
+
+Your `admin` profile needs API-token-write permission on **both**
+accounts. The simplest way is to log in with the Global API Key of
+a user that's a member of both.
+
+## Recap
+
+You've completed the tutorial. You now know how to:
+
+- **Part 1** — Create a Stack and deploy a resource
+- **Part 2** — Add a Worker with bindings to other resources
+- **Part 3** — Write integration tests against deployed stacks
+- **Part 4** — Run locally with `alchemy dev`
+- **Part 5** — Mint scoped CI credentials with
+  `Cloudflare.AccountApiToken`, push them to GitHub with
+  `GitHub.Secret`, and deploy from Actions
+
+## What's next
+
+- Go deeper on Cloudflare in the
+  [Cloudflare track](/tutorial/cloudflare/durable-objects) — layer
+  Durable Objects, hibernatable WebSockets, Containers, Workflows,
+  and Queues onto the Worker you built
+- Read the [Resource Lifecycle](/concepts/resource-lifecycle)
+  guide for all CLI flags and options
+- Explore the [CI guide](/guides/ci) for the AWS equivalents
+  (OIDC and access keys) and more workflow patterns
+- Check out the [Testing reference](/concepts/testing) for more
+  advanced testing patterns
+- Browse the [Providers](/providers) reference for all available
+  resources
diff --git a/.repos/alchemy-effect/website/src/content/docs/what-is-alchemy.mdx b/.repos/alchemy-effect/website/src/content/docs/what-is-alchemy.mdx
new file mode 100644
index 00000000000..fcdb7ebe858
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/content/docs/what-is-alchemy.mdx
@@ -0,0 +1,267 @@
+---
+title: What is Alchemy?
+description: Alchemy is an Infrastructure-as-Effects framework that combines cloud infrastructure and application logic into a single type-safe program powered by Effect.
+sidebar:
+  order: 0
+---
+
+Alchemy is an **Infrastructure-as-Effects** framework. It extends
+Infrastructure-as-Code by combining your cloud resources and the
+application logic that uses them into a single, type-safe program
+powered by [Effect](https://effect.website).
+
+## Infrastructure-as-Code vs Infrastructure-as-Effects
+
+Traditional IaC tools like Terraform, Pulumi, and CDK separate
+infrastructure definitions from application code. You write your
+infrastructure in one place and your business logic in another, then
+wire them together with environment variables, ARNs, and config
+files.
+
+Alchemy takes a different approach: infrastructure and logic are
+**Effects** in the same program.
+
+```typescript
+// alchemy.run.ts — infrastructure and logic in one program
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import Worker from "./src/worker.ts";
+
+const Bucket = Cloudflare.R2Bucket("Bucket");
+
+export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const bucket = yield* Bucket;
+    const worker = yield* Worker;
+    return { url: worker.url };
+  }),
+);
+```
+
+```typescript
+// src/worker.ts — the Worker binds the Bucket directly
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import { Bucket } from "./bucket.ts";
+
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+    return {
+      fetch: Effect.gen(function* () {
+        const obj = yield* bucket.get("hello.txt");
+        return obj
+          ? HttpServerResponse.text(yield* obj.text())
+          : HttpServerResponse.text("Not found", { status: 404 });
+      }),
+    };
+  }),
+);
+```
+
+The Bucket resource, the Worker resource, and the runtime fetch
+handler all live in the same codebase, composed with the same
+`yield*` syntax. There's no separate "infra" project — it's one
+program.
+
+## Type safety
+
+Alchemy uses TypeScript and Effect's type system to catch mistakes at
+compile time. If you forget to provide the right providers for your
+resources, the compiler tells you:
+
+```typescript twoslash
+// @errors: 2322
+import * as Alchemy from "alchemy";
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+export default Alchemy.Stack(
+  "MyApp",
+  {
+    providers: Layer.empty,
+  },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket("Bucket");
+  }),
+);
+```
+
+This error goes away when you provide `Cloudflare.providers()`. The
+type system ensures every resource has its provider wired up before
+you can deploy.
+
+## Resources
+
+A **Resource** is any cloud entity managed by Alchemy — buckets,
+databases, queues, workers, IAM roles, DNS records, and more. Each
+resource is declared as an Effect and `yield*`-ed inside a Stack:
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket("Bucket");
+const db = yield* Cloudflare.D1Database("DB");
+const queue = yield* AWS.SQS.Queue("Jobs");
+```
+
+Resources are just descriptions until they're yielded. You can
+declare them in separate files and import them from anywhere:
+
+```typescript
+// src/bucket.ts
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+```
+
+```typescript
+// src/worker.ts
+import { Bucket } from "./bucket.ts";
+const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+```
+
+## Bindings
+
+A **Binding** connects a resource to a Worker or Lambda. A single
+`bind()` call hands your handler a typed client and — at deploy time
+— wires up the permissions, environment variables, and platform
+bindings that client needs:
+
+```typescript
+const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+
+// later, inside fetch:
+yield* bucket.put("hello.txt", "world");
+```
+
+`bucket` is the resource presented as a typed SDK. There's no
+`env.BUCKET`, no `BUCKET_NAME` lookup, and no hand-written IAM policy
+— the binding **is** the client.
+
+On AWS, `bind()` emits least-privilege IAM scoped to the exact
+resource ARN. On Cloudflare, it attaches the native Worker binding
+(R2, KV, D1, Durable Object). The runtime API is identical, so code
+written against one consumes the other.
+
+Bindings also enable **circular references** between resources —
+Worker A can hold a typed client to Worker B and vice versa — which
+plain props, a directed acyclic graph, can't express.
+
+See [Bindings](/concepts/binding) for event sources, sinks, and the
+deploy-time mechanics.
+
+## Stacks and stages
+
+A **Stack** is a collection of resources deployed together. Every
+deploy targets a **stage** — an isolated environment like `dev`,
+`prod`, or `pr-42`:
+
+```sh
+alchemy deploy              # deploys to dev_$USER by default
+alchemy deploy --stage prod # deploys to prod
+```
+
+Each stage has its own resources with distinct physical names, so
+environments never interfere with each other.
+
+## Providers
+
+A **Provider** teaches Alchemy how to manage a resource type. Behind
+every resource is a provider implementing four lifecycle operations:
+
+- **`read`** — look up the resource's live state in the cloud. It
+  tells the engine whether the resource exists and whether we own
+  it.
+- **`diff`** — compare the desired props against the previous ones
+  and decide whether the change is a no-op, an in-place update, or a
+  full replacement.
+- **`reconcile`** — make the cloud match the desired state. One flow
+  handles first-time creation, updates, and adoption: observe the
+  live state, create the resource if it's missing, sync any drifted
+  fields, and return the output attributes.
+- **`delete`** — remove the resource. Idempotent, so "already gone"
+  counts as success.
+
+The engine drives these in a **plan → apply** loop: `read` and
+`diff` build the plan, then `reconcile` and `delete` apply it in
+dependency order.
+
+Providers are Effect Layers, wired into a Stack with
+`Cloudflare.providers()` or `AWS.providers()`:
+
+```typescript
+Alchemy.Stack(
+  "App",
+  { providers: Cloudflare.providers() } /* ... */,
+);
+```
+
+The type system checks the wiring — using a Cloudflare resource
+without `Cloudflare.providers()`, or providing the wrong cloud's
+providers, is a compile-time error. To support a new cloud or
+third-party API, see [Writing a Custom Resource
+Provider](/guides/custom-provider).
+
+## Two styles: Effect and Async
+
+Alchemy supports two styles for writing Workers:
+
+**Effect style** — your runtime code is an Effect, with typed errors,
+composable retries, and bindings resolved through the Effect system:
+
+```typescript
+export default Cloudflare.Worker(
+  "Worker",
+  { main: import.meta.path },
+  Effect.gen(function* () {
+    const bucket = yield* Cloudflare.R2Bucket.bind(Bucket);
+    return {
+      fetch: Effect.gen(function* () {
+        // Effect-native runtime code
+      }),
+    };
+  }),
+);
+```
+
+**Async style** — your runtime code is a standard `async fetch`
+handler. Bindings are passed as props and you get a typed `env`
+object via `InferEnv`:
+
+```typescript
+// alchemy.run.ts
+export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: { Bucket },
+});
+```
+
+```typescript
+// src/worker.ts
+import type { WorkerEnv } from "../alchemy.run.ts";
+
+export default {
+  async fetch(request: Request, env: WorkerEnv) {
+    const object = await env.Bucket.get("key");
+    return new Response(object?.body ?? null);
+  },
+};
+```
+
+Both styles use the same infrastructure declarations, the same CLI,
+and the same deployment pipeline. Choose whichever fits your team.
+
+## What's next
+
+- [Get Started](/getting-started) — install and deploy in two minutes
+- [Tutorial](/tutorial/part-1) — hands-on walkthrough from zero to
+  CI/CD
+- [Migrating from v1](/guides/migrating-from-v1) — upgrade from
+  Alchemy v1
diff --git a/.repos/alchemy-effect/website/src/layouts/Marketing.astro b/.repos/alchemy-effect/website/src/layouts/Marketing.astro
new file mode 100644
index 00000000000..fac192addcf
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/layouts/Marketing.astro
@@ -0,0 +1,126 @@
+---
+import "../styles/tokens.css";
+import "../styles/marketing.css";
+
+import Nav from "../components/marketing/Nav.astro";
+import Footer from "../components/marketing/Footer.astro";
+import PostHog from "../components/analytics/PostHog.astro";
+import ThemeProvider from "../components/ThemeProvider.astro";
+
+interface Props {
+  title?: string;
+  description?: string;
+  /**
+   * Path to the page's OG image, relative to the site root. Defaults to
+   * the build-time generated card for the current page (slug derived from
+   * the URL pathname). The OG endpoint at `/og/[...slug].png` produces
+   * these during `astro build`.
+   */
+  image?: string;
+  /**
+   * MDX/Markdown layouts receive their YAML frontmatter under this key
+   * rather than as flat props. We accept both shapes so an .astro page
+   * can pass `title=…` directly while an .mdx page's frontmatter just
+   * works.
+   */
+  frontmatter?: { title?: string; description?: string; image?: string };
+}
+
+const props = Astro.props;
+const fm = props.frontmatter ?? {};
+const title = props.title ?? fm.title ?? "alchemy";
+const description = props.description ?? fm.description;
+const image = props.image ?? fm.image;
+
+// Derive an OG image slug from the URL pathname when not explicitly set:
+//   "/"           → /og/index.png
+//   "/some/page"  → /og/some/page.png  (currently unused, but future-proof)
+const slug = (() => {
+  const p = Astro.url.pathname.replace(/^\/+|\/+$/g, "");
+  return p === "" ? "index" : p;
+})();
+const ogImage = new URL(image ?? `/og/${slug}.png`, Astro.site);
+const canonical = new URL(Astro.url.pathname, Astro.site);
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    {/* Pre-paint theme script + color-scheme/theme-color metas. Must
+        run before any paint so navigating from a docs page (where the
+        Starlight head includes the same partial) doesn't drop the
+        user's theme on a marketing page. */}
+    <ThemeProvider />
+    <title>{title}</title>
+    {description && <meta name="description" content={description} />}
+    <link rel="canonical" href={canonical.href} />
+
+    {/* Brand mark — vector first, with PNG fallback for older browsers. */}
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png" />
+    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png" />
+    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
+
+    {/* Open Graph */}
+    <meta property="og:type" content="website" />
+    <meta property="og:site_name" content="alchemy" />
+    <meta property="og:title" content={title} />
+    {description && <meta property="og:description" content={description} />}
+    <meta property="og:url" content={canonical.href} />
+    <meta property="og:image" content={ogImage.href} />
+    <meta property="og:image:width" content="1200" />
+    <meta property="og:image:height" content="630" />
+
+    {/* Twitter / X */}
+    <meta name="twitter:card" content="summary_large_image" />
+    <meta name="twitter:title" content={title} />
+    {description && <meta name="twitter:description" content={description} />}
+    <meta name="twitter:image" content={ogImage.href} />
+
+    <PostHog />
+  </head>
+  <body class="alc-root">
+    <header class="alc-marketing-header">
+      <Nav />
+    </header>
+    <main>
+      <slot />
+    </main>
+    <Footer />
+  </body>
+</html>
+
+<style is:global>
+  html,
+  body {
+    margin: 0;
+    padding: 0;
+    background: var(--alc-bg);
+    color: var(--alc-fg-2);
+    font-family: var(--alc-font-sans);
+    -webkit-font-smoothing: antialiased;
+    overflow-x: clip;
+  }
+  a:focus-visible {
+    outline: 2px solid var(--alc-accent);
+    outline-offset: 2px;
+  }
+  .alc-marketing-header {
+    position: sticky;
+    top: 0;
+    z-index: 10;
+    height: 64px;
+    padding: 0 32px;
+    background: color-mix(in srgb, var(--alc-bg-nav) 92%, transparent);
+    backdrop-filter: saturate(140%) blur(8px);
+    border-bottom: 1px solid var(--alc-hairline);
+  }
+  @media (max-width: 640px) {
+    .alc-marketing-header { padding: 0 20px; }
+  }
+  @media (max-width: 480px) {
+    .alc-marketing-header { padding: 0 16px; }
+  }
+</style>
diff --git a/.repos/alchemy-effect/website/src/pages/index.mdx b/.repos/alchemy-effect/website/src/pages/index.mdx
new file mode 100644
index 00000000000..26bc1d75f56
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/pages/index.mdx
@@ -0,0 +1,359 @@
+---
+layout: ../layouts/Marketing.astro
+title: "alchemy — zero to production. TypeScript IaC on Effect."
+description: "Alchemy is the IaC tool that's actually TypeScript. Stand up your whole cloud in one program, type-check the IAM, hot-reload it locally, run tests against the real cloud, preview every PR, and ship dashboards & alarms in the same file."
+---
+
+import Section from "../components/marketing/Section.astro";
+import Eyebrow from "../components/marketing/Eyebrow.astro";
+import Button from "../components/marketing/Button.astro";
+import BetaBadge from "../components/marketing/BetaBadge.astro";
+import DiscordCallout from "../components/marketing/DiscordCallout.astro";
+import CodeBlock from "../components/marketing/CodeBlock.astro";
+import SketchLabel from "../components/marketing/SketchLabel.astro";
+import DeployTerminal from "../components/marketing-islands/DeployTerminal.tsx";
+import AsyncTabs from "../components/marketing-islands/AsyncTabs.tsx";
+import EffectPilledShowcase from "../components/marketing-islands/EffectPilledShowcase.tsx";
+import DevTerminal from "../components/marketing-islands/DevTerminal.tsx";
+import BrowserHotReload from "../components/marketing-islands/BrowserHotReload.tsx";
+import TestTerminal from "../components/marketing-islands/TestTerminal.tsx";
+import PRLifecycle from "../components/marketing-islands/PRLifecycle.tsx";
+import CopyForAgent from "../components/marketing-islands/CopyForAgent.tsx";
+import HeroCta from "../components/marketing-islands/HeroCta.tsx";
+import HeadingOrnament from "../components/marketing/HeadingOrnament.astro";
+import AlchemicalDivider from "../components/marketing/AlchemicalDivider.astro";
+import HeroBgGraph from "../components/marketing/HeroBgGraph.astro";
+import Yantra from "../brand/Yantra.astro";
+
+export const STACK_SRC = `export default Alchemy.Stack(
+  "MyApp",
+  { providers: Cloudflare.providers() },
+  Effect.gen(function* () {
+    const Photos = yield* Cloudflare.R2Bucket("Photos");
+    const Sessions = yield* Cloudflare.KVNamespace("Sessions");
+    const api = yield* Cloudflare.Worker("Api", {
+      main: "./src/worker.ts",
+      env: { Photos, Sessions },
+    });
+    return { url: api.url };
+  }),
+);`;
+
+export const ASYNC_RUN_SRC = `// alchemy.run.ts — declare resources, attach via env.
+export const Bucket = Cloudflare.R2Bucket("Bucket");
+
+export const Worker = Cloudflare.Worker("Worker", {
+  main: "./src/worker.ts",
+  env: { Bucket },
+});
+
+export type WorkerEnv = Cloudflare.InferEnv<typeof Worker>;`;
+
+export const ASYNC_WORKER_SRC = `// src/worker.ts — keep your existing async handler.
+import type { WorkerEnv } from "../alchemy.run.ts";
+
+export default {
+  async fetch(req: Request, env: WorkerEnv) {
+    const obj = await env.Bucket.get("hello.txt");
+    return new Response(obj?.body ?? "Not found");
+  },
+};`;
+
+export const TEST_SRC = `// test/api.test.ts — isolated stack per suite.
+const stack = beforeAll(deploy(Stack));   // real R2, real DynamoDB
+afterAll(destroy(stack));                 // torn down at the end
+
+test("PUT + GET round-trips through R2", Effect.gen(function* () {
+const { url } = yield* stack;
+const res = yield* HttpClient.get(\`\${url}/object/hello.txt\`);
+expect(yield* res.text).toBe("hi!");
+}));`;
+
+export const OTEL_SRC = `// src/Api.ts — Effect emits OpenTelemetry. Exporter is a Layer.
+const requestsTotal = Metric.counter("requests_total");
+
+export default Cloudflare.Worker(
+  "Api",
+  Effect.gen(function* () {
+    yield* Effect.logInfo("request received");
+    yield* Metric.increment(requestsTotal);
+    return { fetch: handler };
+  }).pipe(Effect.provide(Otel)),     // ← Axiom, Datadog, OTLP …
+);`;
+
+export const DASH_SRC = `// alchemy.run.ts — dashboards and alarms, in code.
+export const Dashboard = AWS.CloudWatch.Dashboard("ApiHealth", {
+  widgets: [
+    Widget.line({   title: "p99 latency",    metric: api.metrics.p99 }),
+    Widget.line({   title: "requests / sec", metric: api.metrics.rps }),
+    Widget.number({ title: "5xx ratio",      metric: api.metrics.errorRate }),
+  ],
+});
+
+export const P99Alarm = AWS.CloudWatch.Alarm("p99Latency", {
+  metric: api.metrics.p99,
+  threshold: 500,
+  evaluationPeriods: 5,
+  alarmActions: [pagerDuty, slackWebhook],
+});`;
+
+{/* ───────────────────────── HERO ───────────────────────── */}
+
+<Section padding="72px 32px 40px" class="alc-hero">
+  <HeroBgGraph />
+
+  <div style="position:relative;z-index:1;text-align:center;margin-bottom:24px;">
+    <BetaBadge />
+  </div>
+  <div class="alc-hero__inner">
+    <Yantra class="alc-hero__mark" size={42} />
+
+    <Eyebrow>typescript · effect · infrastructure as code</Eyebrow>
+    <h1 class="alc-hero__title">
+      <span style="color:var(--alc-accent-deep);font-style:italic;">Zero</span>{" "}
+      &rarr; production.
+    </h1>
+    <h2 class="alc-hero__subtitle">
+      Ship <span style="color:var(--alc-accent-deep);font-style:italic;">safely</span> with fast feedback loops, ephemeral test stacks, type-checked IAM policies, and built-in observability.
+    </h2>
+    <HeroCta client:load />
+  </div>
+</Section>
+
+<AlchemicalDivider variant="line" />
+
+{/* ───── 1 · STAND UP / TEAR DOWN ───── */}
+
+<Section padding="40px 32px 96px" id="plan-deploy-destroy">
+  <div style="text-align:center;margin-bottom:36px;">
+    <Eyebrow>plan · deploy · destroy</Eyebrow>
+    <h2 class="alc-h2" style="margin:10px 0 12px;">Stand up infrastructure. <span style="color:var(--alc-accent-deep);font-style:italic;">Tear it down just as fast.</span></h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:720px;margin:0 auto;">
+      Your whole cloud as one TypeScript program. <code class="alc-code-inline" style="color:var(--alc-accent-deep);">plan</code> previews the diff, <code class="alc-code-inline" style="color:var(--alc-accent-deep);">deploy</code> applies it, <code class="alc-code-inline" style="color:var(--alc-accent-deep);">destroy</code> unwinds it — predictably, every time. <a class="alc-learn-more" href="/concepts/resource-lifecycle">Learn more &rarr;</a>
+    </p>
+  </div>
+
+<div class="stack-deploy-diagram">
+  <div class="stack-deploy-diagram__col">
+    <CodeBlock filename="alchemy.run.ts" code={STACK_SRC} />
+    <div class="stack-deploy-diagram__caption">
+      <SketchLabel>Stack</SketchLabel>
+      <span>one TypeScript program</span>
+    </div>
+  </div>
+  <div class="stack-deploy-diagram__arrow" aria-hidden>
+    <span>plan</span>
+    <span style="font-size:24px;line-height:1;">&rarr;</span>
+    <span>deploy</span>
+  </div>
+  <div class="stack-deploy-diagram__col">
+    <DeployTerminal client:visible />
+    <div class="stack-deploy-diagram__caption">
+      <SketchLabel>Resources</SketchLabel>
+      <span>live across your accounts</span>
+    </div>
+  </div>
+</div>
+
+{/* Mobile-only: just the deploy terminal — the alchemy.run.ts source
+reads poorly when stacked above it on narrow screens. */}
+
+  <div class="stack-deploy-mobile">
+    <DeployTerminal client:visible />
+  </div>
+</Section>
+
+<AlchemicalDivider variant="triangle" />
+
+{/* ───── 2 · EFFECT-PILLED MODE ───── */}
+
+<Section padding="80px 32px" id="effect-pilled">
+  <div style="text-align:center;margin-bottom:36px;">
+    <Eyebrow>effect-pilled mode</Eyebrow>
+    <h2 class="alc-section-statement">
+      Compose <span style="color:var(--alc-accent-deep);font-style:italic;">Effects</span> and <span style="color:var(--alc-accent-deep);font-style:italic;">Layers</span> into type-safe cloud applications.
+    </h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:760px;margin:20px auto 0;">
+      <code class="alc-code-inline" style="color:var(--alc-accent-deep);">export default</code> your function and Alchemy derives the rest: <code class="alc-code-inline" style="color:var(--alc-accent-deep);">.bind()</code> generates the IAM and env vars, <code class="alc-code-inline" style="color:var(--alc-accent-deep);">.stream(…).process(…)</code> wires up the event sources. <span style="color:var(--alc-fg-1);font-weight:500;">No more missing policies or subscriptions.</span> <a class="alc-learn-more" href="/concepts/binding">Learn more &rarr;</a>
+    </p>
+  </div>
+
+  <EffectPilledShowcase client:visible />
+</Section>
+
+<AlchemicalDivider variant="square" />
+
+{/* ───── 3 · ASYNC FETCH ESCAPE HATCH ───── */}
+
+<Section padding="80px 32px" id="async-fetch">
+  <div style="text-align:center;margin-bottom:36px;">
+    <Eyebrow>no effect required · still fully typed</Eyebrow>
+    <h2 class="alc-h2" style="margin:10px 0 12px;">
+      Drop down to <code class="alc-code-inline" style="color:var(--alc-accent-deep);">async&nbsp;fetch</code> when you need it.
+    </h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:760px;margin:0 auto;">
+      Effect is optional. Declare resources, attach them as bindings, and Alchemy infers a fully typed <code class="alc-code-inline">env</code> for your async worker — no codegen, no <code class="alc-code-inline">wrangler types</code>, no manual interfaces. <a class="alc-learn-more" href="/guides/migrating-from-v1">Learn more &rarr;</a>
+    </p>
+  </div>
+
+<div class="alc-split-2 async-split-desktop">
+  <CodeBlock
+    filename="alchemy.run.ts"
+    code={ASYNC_RUN_SRC}
+    caption="infer your WorkerEnv"
+    compact
+  />
+  <CodeBlock
+    filename="src/worker.ts"
+    code={ASYNC_WORKER_SRC}
+    caption="import and use in your worker"
+    compact
+  />
+</div>
+
+{/* Narrow-screen replacement: a single tabbed card that auto-flips
+between the two files with a short caption explaining each step. */}
+
+  <div class="async-split-mobile">
+    <AsyncTabs
+      client:visible
+      panels={[
+        {
+          filename: "alchemy.run.ts",
+          code: ASYNC_RUN_SRC,
+          caption: "infer your WorkerEnv",
+        },
+        {
+          filename: "src/worker.ts",
+          code: ASYNC_WORKER_SRC,
+          caption: "import and use in your worker",
+        },
+      ]}
+    />
+  </div>
+</Section>
+
+<AlchemicalDivider variant="pentagon" />
+
+{/* ───── 3 · HOT RELOAD AS YOU DEVELOP ───── */}
+
+<Section padding="80px 32px" background="var(--alc-bg-nav)" id="hot-reload">
+  <div style="text-align:center;margin-bottom:32px;">
+    <Eyebrow>any vite framework · one dev loop · live cloud</Eyebrow>
+    <h2 class="alc-h2" style="margin:10px 0 12px;">Bring any frontend. <span style="color:var(--alc-accent-deep);font-style:italic;">Hot-reload the cloud underneath it.</span></h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:680px;margin:0 auto;">
+      Vite, Astro, TanStack, SolidStart — frontend, backend, and infra hot-reload together against real R2 / KV / D1. <a class="alc-learn-more" href="/concepts/local-development">Learn more &rarr;</a>
+    </p>
+  </div>
+
+<BrowserHotReload client:visible />
+
+  <div class="alc-stat-strip">
+    <span class="alc-stat-strip__item"><strong>TanStack · SolidStart · Nuxt · Vue</strong></span>
+    <span class="alc-stat-strip__sep">·</span>
+    <span class="alc-stat-strip__item">infra + app in <strong>one watcher</strong></span>
+    <span class="alc-stat-strip__sep">·</span>
+    <span class="alc-stat-strip__item"><strong>~100ms</strong> hot reload</span>
+    <span class="alc-stat-strip__sep">·</span>
+    <span class="alc-stat-strip__item">live <strong>R2 / KV / D1</strong></span>
+  </div>
+</Section>
+
+<AlchemicalDivider variant="hexagon" />
+
+{/* ───── 4 · TEST AGAINST LIVE CLOUD ───── */}
+
+<Section padding="80px 32px" id="live-tests">
+  <div style="text-align:center;margin-bottom:32px;">
+    <Eyebrow>alchemy test · isolated stages · live cloud</Eyebrow>
+    <h2 class="alc-h2" style="margin:10px 0 12px;">Verify against live resources: <span style="color:var(--alc-accent-deep);font-style:italic;">deploy</span> &rarr; <span style="color:var(--alc-accent-deep);font-style:italic;">assert</span> &rarr; <span style="color:var(--alc-accent-deep);font-style:italic;">destroy</span>.</h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:720px;margin:0 auto;">
+      Each suite spins up its own isolated stack — live R2, DynamoDB, Workers — runs your assertions, then tears it back down. No mocks to babysit, no drift between fixture and production. <a class="alc-learn-more" href="/concepts/testing">Learn more &rarr;</a>
+    </p>
+  </div>
+
+<div class="alc-split-2 alc-split-2--wide-left">
+  <TestTerminal client:visible />
+  <CodeBlock filename="test/api.test.ts" code={TEST_SRC} compact />
+</div>
+
+  <div class="alc-stat-strip">
+    <span class="alc-stat-strip__item"><strong>per-suite</strong> stages</span>
+    <span class="alc-stat-strip__sep">·</span>
+    <span class="alc-stat-strip__item">vitest + bun, <strong>Effect-aware</strong></span>
+    <span class="alc-stat-strip__sep">·</span>
+    <span class="alc-stat-strip__item">deploy → assert → <strong>destroy</strong></span>
+    <span class="alc-stat-strip__sep">·</span>
+    <span class="alc-stat-strip__item"><strong>no mocks</strong>, no fakes</span>
+  </div>
+</Section>
+
+<AlchemicalDivider variant="heptagon" />
+
+{/* ───── 5 · PR PREVIEW ENVIRONMENTS ───── */}
+
+<Section padding="80px 32px" background="var(--alc-bg-nav)" id="ci-previews">
+  <div style="text-align:center;margin-bottom:32px;">
+    <Eyebrow>github actions · per-pr environments</Eyebrow>
+    <h2 class="alc-h2" style="margin:10px 0 12px;">Preview every PR with an <span style="color:var(--alc-accent-deep);font-style:italic;">ephemeral</span> environment.</h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:720px;margin:0 auto;">
+      An Alchemy program is just TypeScript — drop one into GitHub Actions to deploy a per-PR stack for review, then let merge or close tear it down. <a class="alc-learn-more" href="/guides/ci">Learn more &rarr;</a>
+    </p>
+  </div>
+
+  <PRLifecycle client:visible />
+</Section>
+
+<AlchemicalDivider variant="octagon" />
+
+{/* ───── 6 · PRODUCTIONIZE FROM DAY ONE ───── */}
+
+<Section padding="80px 32px" id="operational-readiness">
+  <div style="text-align:center;margin-bottom:32px;">
+    <Eyebrow>observability as iac · otel from effect</Eyebrow>
+    <h2 class="alc-h2" style="margin:10px 0 12px;">Dashboards and alarms <span style="color:var(--alc-accent-deep);font-style:italic;">ship with the resources</span>.<HeadingOrnament variant="sol" position="suffix" /></h2>
+    <p style="font-size:15.5px;line-height:1.6;color:var(--alc-fg-2);max-width:760px;margin:0 auto;">
+      Effect emits logs, spans, and metrics by default. Wire dashboards and alarms in the same <code class="alc-code-inline" style="color:var(--alc-accent-deep);">alchemy.run.ts</code> as the workers they watch — swap the OTLP exporter for Axiom, Datadog, or anywhere else. <a class="alc-learn-more" href="/concepts/observability">Learn more &rarr;</a>
+    </p>
+  </div>
+
+  <div class="alc-split-2">
+    <div class="alc-ops-col">
+      <SketchLabel>OTel from Effect</SketchLabel>
+      <CodeBlock filename="src/Api.ts" code={OTEL_SRC} compact />
+      <p class="alc-ops-caption">Effect already emits logs, spans, and metrics. Swap the OTLP Layer to ship them to <strong>Axiom</strong>, <strong>Datadog</strong>, <strong>CloudWatch</strong>, or any OTLP endpoint. Your worker code doesn't change.</p>
+    </div>
+    <div class="alc-ops-col">
+      <SketchLabel>Dashboards &amp; alarms</SketchLabel>
+      <CodeBlock filename="alchemy.run.ts" code={DASH_SRC} compact />
+      <p class="alc-ops-caption">Declared next to the resources they watch. <code class="alc-code-inline" style="color:var(--alc-accent-deep);">deploy</code> ships them; <code class="alc-code-inline" style="color:var(--alc-accent-deep);">destroy</code> tears them down with the rest.</p>
+    </div>
+  </div>
+</Section>
+
+<AlchemicalDivider variant="circle" />
+
+{/* ───── OUTRO ───── */}
+
+<Section padding="56px 32px 64px" id="outro">
+  <DiscordCallout />
+  <div class="alc-cta" style="margin-top:48px;text-align:center;">
+    <h2 class="alc-h2">
+      <HeadingOrnament variant="fleuron" position="prefix" />
+      Paste this into your coding agent<br /><span style="color:var(--alc-accent-deep);font-style:italic;">to get started</span>.
+    </h2>
+    <CopyForAgent client:load />
+    <div class="cta-buttons" style="margin-top:24px;">
+      <Button variant="secondary" icon="arrow" href="/getting-started">
+        Read the tutorial
+      </Button>
+      <Button
+        variant="ghost"
+        icon="github"
+        href="https://github.com/alchemy-run/alchemy-effect"
+      >
+        GitHub
+      </Button>
+    </div>
+  </div>
+</Section>
diff --git a/.repos/alchemy-effect/website/src/pages/og/[...slug].png.ts b/.repos/alchemy-effect/website/src/pages/og/[...slug].png.ts
new file mode 100644
index 00000000000..388e19e0a5d
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/pages/og/[...slug].png.ts
@@ -0,0 +1,268 @@
+/**
+ * Static Open Graph image endpoint. During `astro build` Astro invokes this
+ * for every entry returned by `getStaticPaths`, writing a PNG into
+ * `dist/og/<slug>.png`. Pages reference these via `<meta property="og:image">`
+ * in their layout/head.
+ *
+ * - Marketing pages (top-level `src/pages/*.{astro,mdx}`) → /og/<page>.png
+ *   (the homepage is keyed as `index`).
+ * - Starlight docs (`getCollection("docs")`) → /og/<entry.slug>.png.
+ *
+ * The card itself lives in `src/brand/OgCard.tsx` and is rendered via
+ * satori → resvg. Fonts are the same families used on the website
+ * (`tokens.css`), loaded as full unsubsetted variable TTFs from
+ * `website/assets/fonts/` so satori has complete Unicode coverage —
+ * arrows, em-dashes, fancy quotes, etc. all render verbatim.
+ */
+
+import { Resvg } from "@resvg/resvg-js";
+import type { APIRoute, GetStaticPaths } from "astro";
+import { getCollection } from "astro:content";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import satori from "satori";
+import { OgCard, type OgCardKind, type TitlePart } from "../../brand/OgCard";
+
+interface Entry {
+  slug: string;
+  title: string | TitlePart[];
+  description?: string;
+  kind: OgCardKind;
+  eyebrow?: string;
+  /** ISO date string — rendered in the footer for blog cards. */
+  date?: string;
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// Font loading. The website's font stack for the hero is
+//   "Source Serif 4", "Source Serif Pro", Georgia, "Times New Roman", serif
+// We mirror that here with Source Serif 4 as the primary face (regular,
+// italic, semibold, semibold-italic), plus JetBrains Mono for the eyebrow
+// label and Caveat for the hand-drawn URL stamp. All loaded as static TTFs
+// from `website/assets/fonts/` (populated by `scripts/download-fonts.ts`),
+// which carry the full Unicode glyph table — arrows, em-dashes, etc. — so
+// the source content renders verbatim with no glyph workarounds.
+// ────────────────────────────────────────────────────────────────────────────
+
+const buildFontsDir = fileURLToPath(
+  new URL("../../../assets/fonts/", import.meta.url),
+);
+const publicFontsDir = fileURLToPath(
+  new URL("../../../public/fonts/", import.meta.url),
+);
+
+async function readFont(
+  filename: string,
+  publicScope = false,
+): Promise<Buffer> {
+  return fs.readFile(
+    path.join(publicScope ? publicFontsDir : buildFontsDir, filename),
+  );
+}
+
+const fontsPromise = (async () => {
+  const [
+    serif,
+    serifIt,
+    displayLight,
+    displayLightIt,
+    displayReg,
+    displayRegIt,
+    displaySemi,
+    displaySemiIt,
+    tinos,
+    mono,
+    caveat,
+  ] = await Promise.all([
+    readFont("SourceSerif4-Regular.ttf"),
+    readFont("SourceSerif4-It.ttf"),
+    readFont("SourceSerif4Display-Light.ttf"),
+    readFont("SourceSerif4Display-LightIt.ttf"),
+    readFont("SourceSerif4Display-Regular.ttf"),
+    readFont("SourceSerif4Display-It.ttf"),
+    readFont("SourceSerif4Display-Semibold.ttf"),
+    readFont("SourceSerif4Display-SemiboldIt.ttf"),
+    readFont("Tinos-Regular.ttf", true),
+    readFont("JetBrainsMono-Regular.ttf"),
+    readFont("Caveat-Regular.ttf"),
+  ]);
+
+  return [
+    // Text optical-size variant (description, wordmark, etc.).
+    { name: "Source Serif 4", data: serif, weight: 400, style: "normal" },
+    { name: "Source Serif 4", data: serifIt, weight: 400, style: "italic" },
+
+    // Display optical-size variant for the headline. Carries chunkier
+    // serifs and more stroke contrast at large sizes — matches the
+    // website hero, which uses the variable font's display optical axis
+    // automatically. Light (300) is what the hero renders at ~72px;
+    // Regular (400) is the default fallback.
+    {
+      name: "Source Serif 4 Display",
+      data: displayLight,
+      weight: 300,
+      style: "normal",
+    },
+    {
+      name: "Source Serif 4 Display",
+      data: displayLightIt,
+      weight: 300,
+      style: "italic",
+    },
+    {
+      name: "Source Serif 4 Display",
+      data: displayReg,
+      weight: 400,
+      style: "normal",
+    },
+    {
+      name: "Source Serif 4 Display",
+      data: displayRegIt,
+      weight: 400,
+      style: "italic",
+    },
+
+    // Semibold (600) approximates the website hero's runtime "Medium"
+    // (500) — Adobe doesn't ship a static Medium Display cut, so we
+    // snap up. Used by the title.
+    {
+      name: "Source Serif 4 Display",
+      data: displaySemi,
+      weight: 600,
+      style: "normal",
+    },
+    {
+      name: "Source Serif 4 Display",
+      data: displaySemiIt,
+      weight: 600,
+      style: "italic",
+    },
+
+    // Tinos — TNR-equivalent. Used only for the marketing arrow glyph
+    // so the OG matches the website's font stack (which lands on Times
+    // New Roman for U+2192). See OgCard.tsx — this family is opted into
+    // explicitly via fontFamily on individual title spans.
+    { name: "Tinos", data: tinos, weight: 400, style: "normal" },
+
+    { name: "JetBrains Mono", data: mono, weight: 400, style: "normal" },
+    { name: "Caveat", data: caveat, weight: 400, style: "normal" },
+  ] as const;
+})();
+
+// ────────────────────────────────────────────────────────────────────────────
+// Page enumeration
+// ────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Fallbacks for the marketing pages — these aren't in a content collection
+ * so we hand-curate their OG metadata. Keys are URL-style slugs (e.g.
+ * `index` for `/`).
+ */
+const MARKETING_PAGES: Record<string, Omit<Entry, "slug" | "kind">> = {
+  // Title parts mirror the homepage hero markup, which explicitly
+  // italicizes "Zero" in the deep-moss accent — see index.mdx:
+  //   <span style="color:var(--alc-accent-deep);font-style:italic;">Zero</span>
+  //   {" "}&rarr; production.
+  index: {
+    title: [
+      { text: "Zero", italic: true, accent: true },
+      // Arrow rendered from Tinos (TNR-equivalent) so the OG mirrors
+      // the website, where this glyph falls through the font stack to
+      // Times New Roman. Non-breaking spaces flank it so the line
+      // doesn't break around the arrow.
+      { text: "\u00A0\u2192\u00A0", font: "tinos" },
+      { text: "production." },
+    ],
+    description:
+      "TypeScript IaC on Effect. Stand up your whole cloud in one program, type-check the IAM, hot-reload it locally, run tests against the real cloud, preview every PR.",
+    eyebrow: "typescript · effect · infrastructure as code",
+  },
+};
+
+function classifyDoc(slug: string): { kind: OgCardKind; eyebrow: string } {
+  if (slug.startsWith("blog/"))
+    return { kind: "blog", eyebrow: "blog · alchemy.run" };
+  if (slug.startsWith("guides/"))
+    return { kind: "doc", eyebrow: "guide · alchemy" };
+  if (slug.startsWith("concepts/"))
+    return { kind: "doc", eyebrow: "concept · alchemy" };
+  if (slug.startsWith("tutorial/"))
+    return { kind: "doc", eyebrow: "tutorial · alchemy" };
+  if (slug.startsWith("providers/"))
+    return { kind: "doc", eyebrow: "provider · alchemy" };
+  if (slug.startsWith("compare/"))
+    return { kind: "doc", eyebrow: "compare · alchemy" };
+  return { kind: "doc", eyebrow: "alchemy · documentation" };
+}
+
+export const getStaticPaths: GetStaticPaths = async () => {
+  const docs = await getCollection("docs");
+  const docPaths = docs.map((entry: any) => {
+    const slug = (entry as { slug?: string; id?: string }).slug ?? entry.id;
+    const meta = classifyDoc(slug);
+    const data = entry.data as {
+      title?: string;
+      description?: string;
+      excerpt?: string;
+      date?: string | Date;
+    };
+    return {
+      params: { slug },
+      props: {
+        slug,
+        title: data.title ?? slug,
+        // Blog frontmatter uses `excerpt` (starlight-blog schema). Fall
+        // back to it so the OG card has body copy to fill the layout.
+        description: data.description ?? data.excerpt,
+        kind: meta.kind,
+        eyebrow: meta.eyebrow,
+        date:
+          data.date instanceof Date
+            ? data.date.toISOString().slice(0, 10)
+            : data.date,
+      } satisfies Entry,
+    };
+  });
+
+  const marketingPaths = Object.entries(MARKETING_PAGES).map(
+    ([slug, meta]) => ({
+      params: { slug },
+      props: {
+        slug,
+        title: meta.title,
+        description: meta.description,
+        kind: "marketing" as const,
+        eyebrow: meta.eyebrow,
+      } satisfies Entry,
+    }),
+  );
+
+  return [...marketingPaths, ...docPaths];
+};
+
+export const GET: APIRoute = async ({ props }) => {
+  const { title, description, kind, eyebrow, date } = props as Entry;
+  const fonts = await fontsPromise;
+
+  const element = OgCard({ title, description, eyebrow, kind, date });
+
+  const svg = await satori(element, {
+    width: 1200,
+    height: 630,
+    fonts: fonts as any,
+  });
+
+  const png = new Resvg(svg, {
+    fitTo: { mode: "width", value: 1200 },
+  })
+    .render()
+    .asPng();
+
+  return new Response(png as any, {
+    headers: {
+      "Content-Type": "image/png",
+      "Cache-Control": "public, max-age=31536000, immutable",
+    },
+  });
+};
diff --git a/.repos/alchemy-effect/website/src/pages/privacy.mdx b/.repos/alchemy-effect/website/src/pages/privacy.mdx
new file mode 100644
index 00000000000..90bbf21f66b
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/pages/privacy.mdx
@@ -0,0 +1,156 @@
+---
+layout: ../layouts/Marketing.astro
+title: "Privacy & Telemetry — alchemy"
+description: What data the Alchemy CLI and Cloudflare State Store collect, where it goes, and how to opt out.
+---
+import "../styles/privacy.css";
+
+<div class="alc-privacy">
+
+# Privacy & Telemetry
+
+The Alchemy CLI and the Cloudflare State Store worker emit
+OpenTelemetry traces, metrics, and logs to a relay we operate at
+`otel.alchemy.run`, which forwards to our Axiom workspace. The data
+helps us prioritize providers, find bugs, and understand which
+features people actually use.
+
+This page documents exactly what is collected, what is not, where
+it goes, and how to opt out. Source of truth is the code:
+[`Telemetry/Attributes.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Telemetry/Attributes.ts)
+and [`Cloudflare/StateStore/Api.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/packages/alchemy/src/Cloudflare/StateStore/Api.ts).
+
+## What we collect
+
+### From the CLI
+
+Resource attributes attached to every span/metric/log:
+
+| Attribute | Value |
+| --- | --- |
+| `alchemy.user.id` | Random UUID generated on first run, persisted at `~/.alchemy/id`. Not your shell user, email, or hostname. |
+| `alchemy.session.id` | Random UUID per CLI invocation. |
+| `alchemy.version` | The version of the `alchemy` package you're running. |
+| `alchemy.git.root_commit` | SHA of the first commit in your repo. Acts as a stable repo fingerprint. |
+| `alchemy.git.origin_hash` | SHA-256 of `git config remote.origin.url`. The raw URL is never sent. |
+| `alchemy.git.branch_hash` | SHA-256 of the current branch name. |
+| `alchemy.runtime.name` / `.version` | `bun` / `node` / `deno` and its version. |
+| `alchemy.ci` / `alchemy.ci.provider` | Whether this looks like a CI run, and which provider (GitHub Actions, GitLab, etc.). |
+| `host.arch`, `os.type`, `os.version`, `host.cpus`, `host.memory_mb` | Coarse machine info. |
+
+Per-operation span attributes:
+
+- `cli.<command>` spans carry the command name (`deploy`, `destroy`, `plan`, ...) and outcome (`success` / `error`).
+- `provider.<op>` spans carry the resource type (`AWS.S3.Bucket`, `Cloudflare.Workers.Worker`, ...), op (`create` / `update` / `delete` / `read`), and outcome.
+- `state_store.init` spans carry the state-store backend slug (`local`, `inmemory`, `http`, `cloudflare-http`, or any third-party slug).
+
+### From the Cloudflare State Store
+
+When you deploy the [Cloudflare State Store](/guides/custom-state-store) it runs as a Worker on **your** Cloudflare account. The worker emits OTLP traces/metrics/logs to the same `otel.alchemy.run` relay.
+
+Resource attributes (set on every signal from the worker):
+
+| Attribute | Value |
+| --- | --- |
+| `service.name` | `alchemy-state-store` |
+| `service.version` | The deployed worker contract version (currently `2`). |
+| `alchemy.state_store.script_name` | `alchemy-state-store`. |
+
+Per-request span attributes (one per state-store API call):
+
+| Attribute | Value |
+| --- | --- |
+| `alchemy.state_store.op` | `getState` / `setState` / `deleteState` / `listStacks` / `listStages` / `listResources` / `getReplacedResources` / `deleteStack` / `getVersion` |
+| `alchemy.state_store.stack` | The stack name from your `alchemy.run.ts` (e.g. `MyApp`). |
+| `alchemy.state_store.stage` | The stage name (e.g. `prod`, `dev_alice`). |
+| `alchemy.state_store.fqn` | The fully-qualified resource name within the stack (e.g. `bucket/uploads`). |
+| `duration` | Op latency. |
+
+CLI-side spans that touch the Cloudflare State Store
+(`state_store.bootstrap`, `state_store.deploy`, `state_store.init`)
+also carry `alchemy.cloudflare.account_hash` — a SHA-256 of your
+Cloudflare account ID. The raw account ID is never sent. We use the
+hash to count distinct deployments without identifying anyone.
+
+## What we don't collect
+
+- Secrets, API tokens, environment variables, `.env` contents.
+- Resource property values, source code, file contents.
+- Raw filesystem paths, hostnames, or shell user names.
+- Raw git URLs, raw branch names, raw Cloudflare account IDs (only SHA-256 hashes of these).
+- IP addresses (the relay strips them before forwarding).
+- Any tracking cookies, advertising IDs, or third-party identifiers.
+
+## Where it goes
+
+`otel.alchemy.run` is a Cloudflare Worker we operate. It accepts
+standard OTLP/HTTP at `/v1/traces`, `/v1/logs`, and `/v1/metrics`,
+attaches an Axiom ingest token server-side, and forwards to our
+Axiom workspace. Source for the relay lives at
+[`stacks/otel/Ingester.ts`](https://github.com/alchemy-run/alchemy-effect/blob/main/stacks/otel/Ingester.ts).
+
+We do not share or sell the data. Aggregated stats may appear in
+public talks, posts, or dashboards.
+
+## How to opt out
+
+### CLI — kill all telemetry
+
+Any one of these disables the OTLP exporter entirely. The CLI's
+default tracer becomes a no-op, so nothing leaves your machine:
+
+```sh
+DO_NOT_TRACK=1 alchemy deploy
+NO_TRACK=1 alchemy deploy
+ALCHEMY_TELEMETRY_DISABLED=1 alchemy deploy
+```
+
+To make the opt-out persistent without setting an env var on every
+run, create the marker file:
+
+```sh
+mkdir -p ~/.alchemy
+echo "true" > ~/.alchemy/telemetry-disabled
+```
+
+To re-enable, delete the file:
+
+```sh
+rm ~/.alchemy/telemetry-disabled
+```
+
+### Cloudflare State Store — opt out per-deployment
+
+The state-store worker exports its own OTLP signals — these go
+through the same relay but flow even if your CLI's telemetry is
+disabled (because the worker runs on your CF account, not your
+machine). Two mechanisms exist:
+
+**`noTrack` option.** Passes through to the CLI-side state-store
+spans, suppressing the `alchemy.cloudflare.account_hash` attribute:
+
+```ts
+import * as Cloudflare from "alchemy/Cloudflare";
+
+Cloudflare.state({ noTrack: true });
+```
+
+**`NO_TRACK` env var.** When `Cloudflare.state()` is called without
+an explicit `noTrack`, it falls back to `NO_TRACK` from the
+environment.
+
+```sh
+NO_TRACK=1 alchemy deploy
+```
+
+`noTrack` only suppresses the account-hash attribute on state-store
+spans. To stop the worker from emitting signals at all, you'd need
+to remove the OTLP layer in your own fork of `Api.ts`, or run a
+custom HTTP state store via [/guides/custom-state-store](/guides/custom-state-store).
+
+## Questions
+
+Email [sam@alchemy.run](mailto:sam@alchemy.run) or open an issue at
+[alchemy-run/alchemy-effect](https://github.com/alchemy-run/alchemy-effect/issues).
+
+</div>
diff --git a/.repos/alchemy-effect/website/src/styles/custom.css b/.repos/alchemy-effect/website/src/styles/custom.css
new file mode 100644
index 00000000000..fb026b92a2f
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/styles/custom.css
@@ -0,0 +1,856 @@
+/* Theme bridge: maps our --alc-* design tokens onto Starlight's --sl-color-*
+   tokens. Each --alc-* token already adapts per `[data-theme]` (see tokens.css),
+   so most of this mapping is mode-agnostic. The walnut neutral scale is the
+   exception — its numeric steps don't flip semantically, so we override the
+   gray scale and `--sl-color-black` per-mode below. */
+
+:root {
+  --sl-font: var(--alc-font-sans);
+  --sl-font-mono: var(--alc-font-mono);
+  --sl-font-headings: var(--alc-font-serif);
+  /* Match the marketing header (64px tall, 32px horizontal padding, no
+     vertical padding) so docs and landing pages line up pixel-for-pixel. */
+  --sl-nav-height: 4rem;
+  --sl-nav-pad-x: 2rem;
+  --sl-nav-pad-y: 0;
+  color-scheme: light;
+}
+
+[data-theme="dark"] {
+  color-scheme: dark;
+}
+
+:root,
+[data-theme="dark"],
+[data-theme="light"] {
+  /* Page surfaces */
+  --sl-color-bg: var(--alc-bg);
+  --sl-color-bg-nav: var(--alc-bg-nav);
+  --sl-color-bg-sidebar: var(--alc-bg-nav);
+  --sl-color-bg-inline-code: var(--alc-bg-sunk);
+  --sl-color-bg-accent: var(--alc-accent);
+
+  /* Walnut neutral scale — light-mode convention: gray-1 = darkest text,
+     gray-7 = lightest surface. Starlight's hero `.tagline`, body copy,
+     and muted prose all read off this scale.
+
+     IMPORTANT: Starlight uses `--sl-color-white` as the darkest text token
+     and `--sl-color-black` as the lightest surface token in light mode
+     (the names refer to their dark-mode roles; the values flip in light).
+     The mobile sidebar pane and mobile TOC dropdown both paint their
+     background with `--sl-color-black`, so it MUST resolve to a light
+     surface — otherwise we get dark walnut text on a dark walnut panel. */
+  --sl-color-white: var(--alc-fg-1);
+  --sl-color-black: var(--alc-bg-nav);
+  --sl-color-gray-1: var(--alc-walnut-900);
+  --sl-color-gray-2: var(--alc-walnut-700);
+  --sl-color-gray-3: var(--alc-walnut-600);
+  --sl-color-gray-4: var(--alc-walnut-500);
+  --sl-color-gray-5: var(--alc-walnut-300);
+  --sl-color-gray-6: var(--alc-walnut-100);
+  --sl-color-gray-7: var(--alc-bg-nav);
+
+  /* Text */
+  --sl-color-text: var(--alc-fg-2);
+  --sl-color-text-accent: var(--alc-accent-deep);
+  --sl-color-text-invert: var(--alc-fg-invert);
+
+  /* Accent (moss) */
+  --sl-color-accent: var(--alc-accent);
+  --sl-color-accent-high: var(--alc-accent-deep);
+  --sl-color-accent-low: var(--alc-accent-12);
+  --sl-color-accent-light: var(--alc-accent-40);
+
+  /* Hairlines */
+  --sl-color-hairline-light: var(--alc-hairline);
+  --sl-color-hairline: var(--alc-hairline-2);
+  --sl-color-hairline-shade: var(--alc-hairline-3);
+
+  /* Selection */
+  --sl-color-selection-bg: var(--alc-accent-soft);
+  --sl-color-selection-text: var(--alc-fg-1);
+}
+
+/* Dark mode: flip the walnut gray scale so gray-1 = lightest text and
+   gray-7 = darkest surface (Starlight's convention, with the values inverted).
+   `--sl-color-black` is reused by Starlight as the mobile sidebar and TOC
+   panel background, so it must resolve to a surface that is *visible* against
+   the page bg — we use bg-elev-1 (one step lifted from the page). */
+[data-theme="dark"] {
+  --sl-color-white: var(--alc-fg-1);
+  --sl-color-black: var(--alc-bg-elev-1);
+  --sl-color-gray-1: var(--alc-walnut-50);
+  --sl-color-gray-2: var(--alc-walnut-200);
+  --sl-color-gray-3: var(--alc-walnut-300);
+  --sl-color-gray-4: var(--alc-walnut-400);
+  --sl-color-gray-5: var(--alc-walnut-700);
+  --sl-color-gray-6: var(--alc-walnut-800);
+  --sl-color-gray-7: var(--alc-bg-nav);
+  /* Starlight paints the selected sidebar entry with `--sl-color-text-accent`
+     as background and `--sl-color-text-invert` as text. In dark mode the
+     accent lifts to a bright lime (`--alc-accent-deep` ≈ #a3c473) — cream
+     (`--alc-fg-invert`) on lime is ~1.7:1, well below AA. Flip the invert
+     token to the dark page background so the selected pill reads as dark
+     text on lime (~10:1, AAA). */
+  --sl-color-text-invert: var(--alc-bg);
+}
+
+/* ── Headings: serif for h1/h2, sans for h3/h4 (matches alc-h* scale) ── */
+.sl-markdown-content :is(h1, h2),
+h1.hero-title,
+.hero h1 {
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+  letter-spacing: -0.015em;
+  color: var(--alc-fg-1);
+}
+.sl-markdown-content :is(h3, h4, h5, h6) {
+  font-family: var(--alc-font-sans);
+  font-weight: 600;
+  letter-spacing: -0.01em;
+  color: var(--alc-fg-1);
+}
+
+/* ── Hero "Effects" italic-serif accent ── deep moss, the design-system
+   "alc-text-accent" treatment used in the Claude landing variants. */
+.text-gradient {
+  font-family: var(--alc-font-serif);
+  font-style: italic;
+  font-weight: 500;
+  color: var(--alc-accent-deep);
+  background: none;
+  -webkit-text-fill-color: currentColor;
+}
+
+/* ── Starlight hero refinements (splash template) ── */
+.hero h1 {
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+  font-size: clamp(44px, 7vw, 76px);
+  line-height: 1.02;
+  letter-spacing: -0.02em;
+  color: var(--alc-fg-1);
+}
+.hero .tagline {
+  font-family: var(--alc-font-sans);
+  font-size: clamp(17px, 1.8vw, 20px);
+  line-height: 1.55;
+  color: var(--alc-fg-2);
+  max-width: 36rem;
+}
+.hero .actions a[data-variant="primary"] {
+  background: var(--alc-accent);
+  color: var(--alc-fg-on-accent);
+  border-color: var(--alc-accent);
+}
+.hero .actions a[data-variant="primary"]:hover {
+  background: var(--alc-accent-deep);
+  border-color: var(--alc-accent-deep);
+  color: var(--alc-fg-on-accent);
+}
+.hero .actions a[data-variant="secondary"] {
+  background: transparent;
+  color: var(--alc-fg-1);
+  border: 1px solid var(--alc-hairline-3);
+}
+.hero .actions a[data-variant="secondary"]:hover {
+  background: var(--alc-bg-elev-1);
+  border-color: var(--alc-accent);
+  color: var(--alc-fg-1);
+}
+
+/* ── Section eyebrow (mono uppercase, deep moss) ── */
+.section-eyebrow {
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  line-height: 1;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  font-weight: 500;
+  color: var(--alc-accent-deep);
+  display: block;
+  margin: 0 0 0.75rem;
+}
+
+/* Serif H2 for section headers on the landing page. */
+.section-title {
+  font-family: var(--alc-font-serif);
+  font-size: clamp(28px, 3vw, 34px);
+  line-height: 1.15;
+  letter-spacing: -0.01em;
+  font-weight: 500;
+  color: var(--alc-fg-1);
+  margin: 0 0 1rem;
+}
+.section-lede {
+  font-family: var(--alc-font-sans);
+  font-size: 1rem;
+  line-height: 1.65;
+  color: var(--alc-fg-2);
+  max-width: 36rem;
+  margin: 0 auto 2.25rem;
+}
+
+/* Centered intro block above a section grid (features, providers, etc). */
+.section-intro {
+  text-align: center;
+  max-width: 48rem;
+  margin: 0 auto 3rem;
+}
+.section-intro .section-lede {
+  margin-bottom: 0;
+}
+
+/* ── Landing page ── */
+
+.landing {
+  max-width: 72rem;
+  margin: 0 auto;
+  padding: 0 1.5rem;
+}
+.landing :is(pre, .expressive-code, figure) {
+  max-width: 100%;
+  overflow-x: auto;
+}
+.landing pre code {
+  white-space: pre;
+}
+/* Allow grid/flex items to shrink below their content width so long code blocks
+   scroll internally instead of forcing the page wider than the viewport. */
+.hero-code-grid > *,
+.features > *,
+.provider-grid > * {
+  min-width: 0;
+}
+.landing {
+  overflow-x: clip;
+}
+/* Hide the auto-generated heading anchor link icon on the landing page —
+   these are marketing headings, not navigable anchors. */
+.landing .sl-anchor-link {
+  display: none;
+}
+@media (max-width: 480px) {
+  .landing {
+    padding: 0 1rem;
+  }
+}
+@media (max-width: 640px) {
+  .landing pre code {
+    font-size: 0.8rem;
+    line-height: 1.5;
+  }
+  .hero-code {
+    margin: 2.5rem 0 3rem;
+  }
+  .hero-code-grid {
+    gap: 1.25rem;
+  }
+  .hero-code-text h3 {
+    font-size: 1.35rem;
+    margin-bottom: 0.75rem;
+  }
+  .hero-code-text p {
+    font-size: 0.95rem;
+  }
+  .features {
+    gap: 1.75rem;
+    margin-bottom: 3rem;
+  }
+  .feature h3 {
+    font-size: 1.05rem;
+  }
+  .providers-section {
+    margin-bottom: 3rem;
+  }
+  .providers-section h3,
+  .cta-section h3 {
+    font-size: 1.25rem;
+  }
+  .cta-section {
+    padding: 2rem 0 2.5rem;
+  }
+}
+@media (max-width: 420px) {
+  .cta-buttons {
+    flex-direction: column;
+    align-items: stretch;
+  }
+  .cta-buttons > * {
+    justify-content: center;
+    text-align: center;
+  }
+}
+
+/* ── Hero overrides: center on mobile/tablet, keep 3 actions on one row ── */
+
+@media (max-width: 60rem) {
+  .hero .stack {
+    text-align: center;
+  }
+  .hero .copy {
+    align-items: center;
+  }
+  .hero .copy > * {
+    margin-inline: auto;
+  }
+  .hero .actions {
+    justify-content: center;
+    gap: 0.75rem;
+  }
+  .hero .actions > a {
+    padding-inline: 1rem;
+  }
+}
+
+@media (max-width: 30rem) {
+  .hero .actions {
+    gap: 0.5rem;
+  }
+  .hero .actions > a {
+    padding-inline: 0.75rem;
+    font-size: 0.9rem;
+  }
+}
+
+.hero-code {
+  margin: 2rem 0 5rem;
+}
+.hero-code-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 3rem;
+  align-items: center;
+}
+.hero-code-text h3 {
+  font-family: var(--alc-font-serif);
+  font-size: 1.75rem;
+  font-weight: 500;
+  letter-spacing: -0.015em;
+  margin: 0 0 1rem;
+  color: var(--alc-fg-1);
+}
+.hero-code-text p {
+  color: var(--alc-fg-2);
+  line-height: 1.7;
+  margin: 0 0 0.75rem;
+}
+@media (max-width: 768px) {
+  .hero-code-grid {
+    grid-template-columns: 1fr;
+    gap: 2rem;
+  }
+}
+
+/* Features grid: .feature uses display: contents so each feature's three
+   children (heading / body / code) become direct grid items of .features.
+   We then explicitly pin each child to a grid row and column. This guarantees
+   headings, paragraphs, and code blocks all align across the two columns in
+   a visual row, regardless of content height. */
+.features {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  column-gap: 3rem;
+  row-gap: 0.75rem;
+  margin: 0 0 5rem;
+}
+.feature {
+  display: contents;
+}
+.features > .feature > * {
+  margin: 0 !important;
+  min-width: 0;
+}
+.features > .feature > :nth-child(1) {
+  /* heading row */
+  font-family: var(--alc-font-sans);
+  font-size: 1.15rem;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+}
+.features > .feature > :nth-child(2) {
+  /* body row */
+  color: var(--alc-fg-2);
+  line-height: 1.6;
+  font-size: 0.95rem;
+}
+.features > .feature > :nth-child(3) {
+  /* code row – anchor to the top of the row so terminals and code blocks
+     sit directly under the paragraph, regardless of snippet height. */
+  align-self: start;
+  width: 100%;
+}
+
+/* Explicit row/column placement for each of the 6 features.
+   Visual row 1 (features 1,2) occupies grid rows 1-3,
+   visual row 2 (features 3,4) occupies rows 5-7 (row 4 is the gap),
+   visual row 3 (features 5,6) occupies rows 9-11 (row 8 is the gap). */
+.features > .feature:nth-of-type(odd) > * {
+  grid-column: 1;
+}
+.features > .feature:nth-of-type(even) > * {
+  grid-column: 2;
+}
+
+.features > .feature:nth-of-type(1) > :nth-child(1),
+.features > .feature:nth-of-type(2) > :nth-child(1) {
+  grid-row: 1;
+}
+.features > .feature:nth-of-type(1) > :nth-child(2),
+.features > .feature:nth-of-type(2) > :nth-child(2) {
+  grid-row: 2;
+}
+.features > .feature:nth-of-type(1) > :nth-child(3),
+.features > .feature:nth-of-type(2) > :nth-child(3) {
+  grid-row: 3;
+}
+
+.features > .feature:nth-of-type(3) > :nth-child(1),
+.features > .feature:nth-of-type(4) > :nth-child(1) {
+  grid-row: 5;
+}
+.features > .feature:nth-of-type(3) > :nth-child(2),
+.features > .feature:nth-of-type(4) > :nth-child(2) {
+  grid-row: 6;
+}
+.features > .feature:nth-of-type(3) > :nth-child(3),
+.features > .feature:nth-of-type(4) > :nth-child(3) {
+  grid-row: 7;
+}
+
+.features > .feature:nth-of-type(5) > :nth-child(1),
+.features > .feature:nth-of-type(6) > :nth-child(1) {
+  grid-row: 9;
+}
+.features > .feature:nth-of-type(5) > :nth-child(2),
+.features > .feature:nth-of-type(6) > :nth-child(2) {
+  grid-row: 10;
+}
+.features > .feature:nth-of-type(5) > :nth-child(3),
+.features > .feature:nth-of-type(6) > :nth-child(3) {
+  grid-row: 11;
+}
+
+/* Larger gap between visual rows via empty tracks 4 and 8. */
+.features {
+  grid-template-rows:
+    auto auto auto /* row 1: h, p, code */
+    3rem /* gap */
+    auto auto auto /* row 2 */
+    3rem /* gap */
+    auto auto auto; /* row 3 */
+}
+
+@media (max-width: 768px) {
+  /* Collapse to single column: each .feature stacks naturally. */
+  .features {
+    grid-template-columns: 1fr;
+    grid-template-rows: none;
+    row-gap: 2.5rem;
+  }
+  .feature {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+  }
+  .features > .feature > * {
+    grid-row: auto !important;
+    grid-column: auto !important;
+  }
+}
+
+.providers-section {
+  margin: 0 0 5rem;
+  text-align: center;
+}
+.providers-section h3 {
+  font-family: var(--alc-font-serif);
+  font-size: 1.75rem;
+  font-weight: 500;
+  letter-spacing: -0.015em;
+  color: var(--alc-fg-1);
+  margin: 0 0 1rem;
+}
+.providers-section > p {
+  color: var(--alc-fg-2);
+  max-width: 36rem;
+  margin: 0 auto 2rem;
+  line-height: 1.6;
+}
+.provider-grid {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 1.5rem;
+  align-items: stretch;
+}
+.provider-card {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline-2);
+  border-radius: var(--alc-radius);
+  padding: 1.5rem;
+  text-align: left;
+  height: 100%;
+  box-shadow: var(--alc-shadow-sm);
+  transition:
+    border-color var(--alc-dur) var(--alc-ease),
+    box-shadow var(--alc-dur) var(--alc-ease);
+}
+.provider-card:hover {
+  border-color: var(--alc-accent);
+  box-shadow: var(--alc-shadow);
+}
+.provider-card > * {
+  margin: 0;
+}
+.provider-card strong {
+  color: var(--alc-fg-1);
+  font-size: 1.05rem;
+  font-weight: 600;
+}
+.provider-card p {
+  color: var(--alc-fg-2);
+  font-size: 0.9rem;
+  line-height: 1.5;
+}
+@media (max-width: 768px) {
+  .provider-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* 4-column variant for the AB-test "Explore alternate framings" cards. */
+.explore-section .provider-grid {
+  grid-template-columns: repeat(4, 1fr);
+}
+.explore-section a.provider-card {
+  text-decoration: none;
+  color: inherit;
+}
+@media (max-width: 1024px) {
+  .explore-section .provider-grid {
+    grid-template-columns: repeat(2, 1fr);
+  }
+}
+@media (max-width: 540px) {
+  .explore-section .provider-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+.cta-section {
+  text-align: center;
+  padding: 3rem 0 4rem;
+  border-top: 1px solid var(--alc-hairline-2);
+}
+.cta-section h3 {
+  font-family: var(--alc-font-serif);
+  font-size: 1.75rem;
+  font-weight: 500;
+  letter-spacing: -0.015em;
+  color: var(--alc-fg-1);
+  margin: 0 0 1rem;
+}
+.cta-section > p {
+  color: var(--alc-fg-2);
+  max-width: 36rem;
+  margin: 0 auto 2rem;
+  line-height: 1.6;
+}
+.cta-buttons {
+  display: flex;
+  gap: 1rem;
+  justify-content: center;
+  flex-wrap: wrap;
+}
+/* Neutralize Starlight's default LinkButton margins inside .sl-markdown-content
+   so our flex container controls spacing. */
+.cta-buttons .sl-link-button,
+.cta-buttons > p {
+  margin: 0 !important;
+}
+.cta-buttons > p {
+  display: contents;
+}
+/* MDX wraps loose JSX children in <p> (and sometimes emits an empty
+   <p> sibling when JSX sits between paragraphs). Use :has() to flatten
+   any paragraph that contains an `.alc-btn`, and hide empty wrapper
+   paragraphs anywhere inside the outro CTA — the User Agent's default
+   1em block margin on those empty <p>s is what was making the
+   "Read the tutorial" row look chunky. */
+p:has(> .alc-btn) {
+  margin: 0;
+  display: contents;
+}
+.alc-cta > p:empty {
+  display: none;
+}
+
+/* ── Getting Started next-steps cards ── */
+
+.next-steps {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 1rem;
+  margin-top: 1rem;
+}
+.next-card {
+  display: block;
+  padding: 1.25rem 1.5rem;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline-2);
+  border-radius: var(--alc-radius);
+  text-decoration: none;
+  transition:
+    border-color var(--alc-dur) var(--alc-ease),
+    box-shadow var(--alc-dur) var(--alc-ease);
+  box-shadow: var(--alc-shadow-sm);
+}
+.next-card:hover {
+  border-color: var(--alc-accent);
+  box-shadow: var(--alc-shadow);
+}
+.next-card strong {
+  display: block;
+  color: var(--alc-fg-1);
+  font-size: 1.05rem;
+  font-weight: 600;
+  margin-bottom: 0.35rem;
+}
+.next-card span {
+  color: var(--alc-fg-2);
+  font-size: 0.9rem;
+  line-height: 1.5;
+}
+@media (max-width: 600px) {
+  .next-steps {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* ============================================================
+   Starlight Asides (Note / Tip / Caution / Danger)
+
+   Starlight's defaults use saturated info-blue / yellow / red
+   panels that clash with the warm parchment + moss palette.
+   Override to match the design-system callout spec from
+   claude/design-system/preview/components-callouts.html:
+     - tip:     moss green
+     - note:    slate teal (--alc-info)
+     - caution: honey amber (--alc-warn)
+     - danger:  brick red  (--alc-danger)
+   ============================================================ */
+
+.sl-markdown-content .starlight-aside {
+  border-radius: 8px;
+  border-width: 1px;
+  border-style: solid;
+  padding: 12px 14px;
+  margin: 1rem 0;
+  background: var(--aside-tint, var(--alc-bg-elev-1));
+  border-color: var(--aside-border, var(--alc-hairline-2));
+  color: var(--alc-fg-2);
+  font-family: var(--alc-font-sans);
+}
+
+.sl-markdown-content .starlight-aside__title {
+  color: var(--aside-accent, var(--alc-fg-1));
+  font-family: var(--alc-font-sans);
+  font-weight: 600;
+  font-size: 13.5px;
+  letter-spacing: 0;
+  text-transform: none;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.sl-markdown-content .starlight-aside__icon {
+  color: var(--aside-accent, var(--alc-fg-1));
+  font-size: 1rem;
+}
+
+.sl-markdown-content .starlight-aside__content {
+  color: var(--alc-fg-2);
+  font-size: 14px;
+  line-height: 1.55;
+}
+.sl-markdown-content .starlight-aside__content > :first-child {
+  margin-top: 4px;
+}
+.sl-markdown-content .starlight-aside__content > :last-child {
+  margin-bottom: 0;
+}
+.sl-markdown-content .starlight-aside__content a {
+  color: var(--aside-accent, var(--alc-accent-deep));
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.sl-markdown-content .starlight-aside__content a:hover {
+  color: var(--alc-accent-deep);
+}
+/* Inline-code only — must NOT match the per-token <code> elements that
+   Expressive Code emits inside <pre>, otherwise the dark walnut code-block
+   background and bright sunrise syntax tokens get repainted to cream + walnut
+   and the whole block bleaches out. */
+.sl-markdown-content .starlight-aside__content :not(pre) > code {
+  background: var(--alc-bg-sunk);
+  border: 1px solid var(--alc-hairline);
+  color: var(--alc-fg-1);
+}
+.sl-markdown-content .starlight-aside__content strong {
+  color: var(--alc-fg-1);
+}
+
+/* ── Variants ── */
+.sl-markdown-content .starlight-aside--note {
+  --aside-accent: var(--alc-info);
+  --aside-tint: color-mix(in srgb, var(--alc-info) 14%, transparent);
+  --aside-border: color-mix(in srgb, var(--alc-info) 45%, transparent);
+}
+.sl-markdown-content .starlight-aside--tip {
+  --aside-accent: var(--alc-accent-deep);
+  --aside-tint: color-mix(in srgb, var(--alc-accent) 14%, transparent);
+  --aside-border: color-mix(in srgb, var(--alc-accent) 45%, transparent);
+}
+.sl-markdown-content .starlight-aside--caution {
+  --aside-accent: color-mix(in srgb, var(--alc-warn) 75%, var(--alc-fg-1));
+  --aside-tint: color-mix(in srgb, var(--alc-warn) 16%, transparent);
+  --aside-border: color-mix(in srgb, var(--alc-warn) 50%, transparent);
+}
+.sl-markdown-content .starlight-aside--danger {
+  --aside-accent: var(--alc-danger);
+  --aside-tint: color-mix(in srgb, var(--alc-danger) 14%, transparent);
+  --aside-border: color-mix(in srgb, var(--alc-danger) 45%, transparent);
+}
+
+/* ============================================================
+   Expressive Code frames (the file-name tab on docs code blocks)
+
+   The default Starlight rendering of the editor-style frame paints
+   the tab title with a very low-contrast walnut on a near-walnut
+   strip — practically unreadable on the cream page. Force the
+   active tab to use the bright sunrise palette so the file name
+   reads cleanly against the dark code surface.
+   ============================================================ */
+
+.expressive-code .frame {
+  --ec-frm-edBg: var(--alc-bg-code);
+  --ec-frm-edTabBarBg: var(--alc-bg-code);
+  --ec-frm-edTabBarBrdBtmCol: var(--alc-walnut-700);
+  --ec-frm-edActTabBg: var(--alc-bg-code);
+  --ec-frm-edActTabFg: var(--alc-walnut-100);
+  --ec-frm-edActTabBrdCol: var(--alc-walnut-700);
+  --ec-frm-edActTabIndTopCol: var(--alc-accent-warm);
+  --ec-frm-edActTabIndBtmCol: transparent;
+  --ec-frm-edTabsMargBlkStart: 0;
+  --ec-frm-edTabsMargInlStart: 0;
+  --ec-frm-trmTtbBg: var(--alc-bg-code);
+  --ec-frm-trmTtbBrdBtmCol: var(--alc-walnut-700);
+  --ec-frm-trmTtbFg: var(--alc-walnut-100);
+}
+
+.expressive-code .frame.has-title:not(.is-terminal) .title {
+  color: var(--alc-walnut-100);
+  font-family: var(--alc-font-mono);
+  font-weight: 500;
+}
+
+.expressive-code .frame.is-terminal .title {
+  color: var(--alc-walnut-100);
+}
+
+/* ============================================================
+   Starlight Tabs (Code/Tabs component used on Getting Started
+   for bun / npm / pnpm / yarn).
+
+   - Tab labels use a soft mushroom for inactive and deep moss
+     for the active tab; the active underline is the moss accent.
+   - Icons are sized larger (1.25em) and painted with each
+     product's official brand color via positional selectors
+     (the package-manager tab order is bun → npm → pnpm → yarn,
+     and is consistent across the docs).
+   ============================================================ */
+
+starlight-tabs [role="tablist"] {
+  border-bottom-color: var(--alc-hairline-2);
+}
+
+starlight-tabs [role="tab"] {
+  color: var(--alc-fg-3);
+  font-family: var(--alc-font-sans);
+  font-size: 14px;
+  font-weight: 500;
+  letter-spacing: 0;
+  border-bottom-color: transparent;
+  gap: 0.45rem;
+  transition:
+    color 160ms ease,
+    border-color 160ms ease;
+}
+
+starlight-tabs [role="tab"]:hover {
+  color: var(--alc-accent-deep);
+}
+
+starlight-tabs [role="tab"][aria-selected="true"] {
+  color: var(--alc-accent-deep);
+  border-bottom-color: var(--alc-accent);
+}
+
+/* Icon sizing — undo Starlight's tight 1em so the package-manager
+   marks read at glance, and lock dimensions so the SVG can't shrink
+   below this when the tab text is small. */
+starlight-tabs [role="tab"] > svg {
+  width: 1.25em;
+  height: 1.25em;
+  flex: 0 0 auto;
+  font-size: inherit;
+}
+
+/* ── Per-package brand colors ──
+   The Tabs.astro markup wraps each tab anchor in <li class="tab">,
+   so we color the SVG icon inside each LI by position. Order on
+   our docs is bun(1), npm(2), pnpm(3), yarn(4). Colors come from
+   each project's brand guidelines, tuned slightly for contrast
+   on the warm cream surface. */
+
+/* Bun: Starlight's built-in `bun` icon is a single-path silhouette —
+   painting it any single color loses the eyes, cheeks and mouth that
+   make the mascot recognizable. We hide that path and overlay the
+   official multi-color mascot from bun.com/logo.svg (saved locally as
+   /bun-logo.svg) via a background image. */
+starlight-tabs [role="tablist"] > li:nth-child(1) [role="tab"] > svg {
+  color: transparent;
+  background-image: url("/bun-logo.svg");
+  background-repeat: no-repeat;
+  background-position: center;
+  background-size: contain;
+}
+starlight-tabs [role="tablist"] > li:nth-child(2) [role="tab"] > svg {
+  color: #cb3837; /* npm — npm red */
+}
+starlight-tabs [role="tablist"] > li:nth-child(3) [role="tab"] > svg {
+  color: #f59f00; /* pnpm — orange */
+}
+starlight-tabs [role="tablist"] > li:nth-child(4) [role="tab"] > svg {
+  color: #2c8ebb; /* yarn — yarn blue */
+}
+
+/* Match Starlight's docs <header> chrome to the marketing <header>: same
+   translucent cream + backdrop-blur + hairline border. Defined in custom.css
+   (rather than scoped to a single component) so the docs layout picks it up
+   without a Page/Header override.
+
+   IMPORTANT: must be scoped to the <header> element, not bare `.header`.
+   Expressive Code emits a <div class="header"> for its terminal titlebar
+   inside every shell/sh code block, and an unscoped `.header` rule with
+   !important repaints that titlebar in cream parchment instead of the
+   intended dark walnut, leaving an ugly cream strip above shell snippets. */
+header.header {
+  background: color-mix(in srgb, var(--alc-bg-nav) 92%, transparent) !important;
+  backdrop-filter: saturate(140%) blur(8px);
+  border-bottom: 1px solid var(--alc-hairline) !important;
+}
diff --git a/.repos/alchemy-effect/website/src/styles/global.css b/.repos/alchemy-effect/website/src/styles/global.css
new file mode 100644
index 00000000000..291784a1591
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/styles/global.css
@@ -0,0 +1,7 @@
+@layer base, starlight, theme, components, utilities;
+
+@import "./tokens.css";
+@import "./terminal.css";
+@import "@astrojs/starlight-tailwind";
+@import "tailwindcss/theme.css" layer(theme);
+@import "tailwindcss/utilities.css" layer(utilities);
diff --git a/.repos/alchemy-effect/website/src/styles/marketing.css b/.repos/alchemy-effect/website/src/styles/marketing.css
new file mode 100644
index 00000000000..4de58dc7717
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/styles/marketing.css
@@ -0,0 +1,3380 @@
+/* ============================================================
+   Marketing layout primitives. Lean — only the pieces actually
+   used by the home + product pages remain. Token defs live in
+   tokens.css; terminal chrome (shared with docs) lives in
+   terminal.css.
+   ============================================================ */
+
+@import "./terminal.css";
+
+body.alc-root,
+.alc-root {
+  background: var(--alc-bg);
+  color: var(--alc-fg-2);
+  font-family: var(--alc-font-sans);
+  font-size: 15px;
+  line-height: 1.6;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+::selection {
+  background: var(--alc-accent-soft);
+  color: var(--alc-fg-1);
+}
+
+/* Inline "Learn more →" link used at the end of section descriptions. */
+.alc-learn-more {
+  color: var(--alc-accent-deep);
+  font-weight: 500;
+  text-decoration: none;
+  white-space: nowrap;
+  margin-left: 4px;
+  transition: opacity 140ms ease;
+}
+.alc-learn-more:hover {
+  opacity: 0.7;
+  text-decoration: underline;
+  text-underline-offset: 3px;
+}
+
+/* ============================================================
+   Code block — terminal-themed wrapper used by static <CodeBlock>
+   ============================================================ */
+
+.alc-code-block {
+  background: var(--alc-bg-code);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  max-width: 100%;
+}
+.alc-code-block__header {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 10px 14px;
+  border-bottom: 1px solid rgba(232, 220, 192, 0.08);
+  background: rgba(255, 255, 255, 0.02);
+  flex: 0 0 auto;
+}
+.alc-code-block__filename {
+  margin-left: 10px;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-code-comment);
+}
+/* Wrapper used when CodeBlock has a caption — keeps the block + the
+   hand-written caption visually grouped beneath the window chrome. */
+.alc-code-block__wrap {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+.alc-code-block__caption {
+  font-family: var(--alc-font-hand);
+  font-size: 20px;
+  line-height: 1.2;
+  color: var(--alc-accent-deep);
+  text-align: center;
+  letter-spacing: 0.01em;
+  animation: alc-code-caption-in 320ms ease;
+}
+@keyframes alc-code-caption-in {
+  from {
+    opacity: 0;
+    transform: translateY(-2px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .alc-code-block__caption {
+    animation: none;
+  }
+}
+.alc-code-block__pre {
+  margin: 0;
+  padding: 18px 20px;
+  font-family: var(--alc-font-mono);
+  font-size: 13px;
+  line-height: 1.7;
+  color: var(--alc-code-var);
+  overflow-x: auto;
+}
+.alc-code-block--compact .alc-code-block__pre {
+  padding: 12px 16px;
+  font-size: 12px;
+}
+
+/* ============================================================
+   Bindings → IAM / EventSource animation (/product/providers/aws)
+   Code on the left, animated arrows in the middle, resources
+   on the right, generated IAM policy below.
+   ============================================================ */
+
+.bindings-iam {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 200px minmax(0, 0.85fr);
+  grid-template-rows: minmax(280px, auto);
+  gap: 18px;
+  align-items: stretch;
+  max-width: 1180px;
+  margin: 0 auto;
+}
+.bindings-iam__code {
+  grid-column: 1;
+  grid-row: 1;
+  min-width: 0;
+}
+.bindings-iam__arrows {
+  grid-column: 2;
+  grid-row: 1;
+  position: relative;
+  align-self: stretch;
+}
+.bindings-iam__arrows svg {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  overflow: visible;
+}
+.bindings-iam__resources {
+  grid-column: 3;
+  grid-row: 1;
+  display: flex;
+  flex-direction: column;
+  justify-content: space-around;
+  gap: 14px;
+  min-width: 0;
+}
+.bindings-iam__resource {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 12px;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+}
+.bindings-iam__resource-label {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  line-height: 1.2;
+}
+.bindings-iam__resource-sub {
+  font-family: var(--alc-font-mono);
+  font-size: 10px;
+  color: var(--alc-fg-3);
+  line-height: 1.3;
+  margin-top: 2px;
+}
+.bindings-iam__policy {
+  display: none;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+}
+@media (max-width: 980px) {
+  .bindings-iam {
+    grid-template-columns: 1fr;
+    grid-template-rows: auto auto auto auto;
+  }
+  .bindings-iam__code,
+  .bindings-iam__arrows,
+  .bindings-iam__resources,
+  .bindings-iam__policy {
+    grid-column: 1;
+    grid-row: auto;
+  }
+  .bindings-iam__arrows {
+    display: none;
+  }
+}
+
+/* ============================================================
+   Stack → DeployTerminal diagram (/product/iac)
+   ============================================================ */
+
+.stack-deploy-diagram {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 60px minmax(0, 1fr);
+  align-items: stretch;
+  gap: 16px;
+  max-width: 1180px;
+  margin: 0 auto;
+}
+.stack-deploy-diagram__col {
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+/* Lock both panels to the same fixed height so the captions align and
+   the right terminal's animated content can't push it taller than the
+   left code block (or vice versa). The terminal is rendered inside an
+   <astro-island> hydration wrapper, so the selectors must be descendant
+   (not direct-child) and the wrapper itself must stretch. */
+.stack-deploy-diagram__col,
+.stack-deploy-diagram__col > astro-island {
+  display: flex;
+  flex-direction: column;
+}
+.stack-deploy-diagram__col > astro-island {
+  flex: 0 0 auto;
+}
+.stack-deploy-diagram__col .alc-code-block,
+.stack-deploy-diagram__col .alc-term {
+  flex: 0 0 auto;
+  height: 360px;
+  min-height: 360px;
+  max-height: 360px;
+  box-sizing: border-box;
+}
+.stack-deploy-diagram__col .alc-code-block .alc-code-block__pre,
+.stack-deploy-diagram__col .alc-term .alc-term__body {
+  flex: 1;
+  min-height: 0;
+}
+/* Static code snippet fits the fixed-height card already; allowing
+   `overflow: auto` here causes a few-pixel scroll region that
+   hijacks page wheel events. Clip instead. */
+.stack-deploy-diagram__col .alc-code-block .alc-code-block__pre {
+  overflow: hidden;
+}
+/* The animated deploy terminal grows as resources stream in, so it
+   genuinely needs to scroll. */
+.stack-deploy-diagram__col .alc-term .alc-term__body {
+  overflow: auto;
+}
+.stack-deploy-diagram__caption {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  text-align: center;
+  gap: 2px;
+}
+.stack-deploy-diagram__caption span {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--alc-fg-3);
+}
+.stack-deploy-diagram__arrow {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  align-self: center;
+  gap: 4px;
+  color: var(--alc-accent-deep);
+  font-family: var(--alc-font-hand);
+  font-size: 16px;
+}
+
+/* ============================================================
+   Effect-pilled showcase (home page section 2)
+   One terminal-chromed card with two tabs (IAM bindings / Event
+   sources). Each panel is code on the left and a stylized
+   "generated artifact" panel on the right. On narrow screens the
+   split collapses into a vertical stack with a "↓ generates" cue
+   between code and artifact, so nothing depends on SVG arrows that
+   break on mobile.
+   ============================================================ */
+
+.eff-showcase {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  max-width: 1080px;
+  margin: 0 auto;
+}
+.eff-showcase__chrome {
+  background: var(--alc-bg-code);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+  display: flex;
+  flex-direction: column;
+}
+.eff-showcase__header {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 8px 12px;
+  border-bottom: 1px solid rgba(232, 220, 192, 0.08);
+  background: rgba(255, 255, 255, 0.02);
+}
+.eff-showcase__tabs {
+  display: flex;
+  gap: 4px;
+  margin-left: 12px;
+  flex: 1;
+  min-width: 0;
+  overflow-x: auto;
+  scrollbar-width: none;
+}
+.eff-showcase__tabs::-webkit-scrollbar {
+  display: none;
+}
+.eff-showcase__tab {
+  flex: 0 0 auto;
+  appearance: none;
+  background: transparent;
+  border: 1px solid transparent;
+  color: var(--alc-code-comment);
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  padding: 4px 10px;
+  border-radius: 5px;
+  cursor: pointer;
+  transition:
+    color 160ms ease,
+    background 160ms ease,
+    border-color 160ms ease;
+}
+.eff-showcase__tab:hover {
+  color: var(--alc-fg-invert);
+}
+.eff-showcase__tab[data-active="true"] {
+  color: var(--alc-fg-invert);
+  background: rgba(255, 255, 255, 0.05);
+  border-color: rgba(232, 220, 192, 0.12);
+}
+.eff-showcase__body {
+  position: relative;
+  display: flex;
+  flex-direction: column;
+}
+.eff-showcase__panel {
+  display: flex;
+  flex-direction: column;
+}
+.eff-showcase__panel[hidden] {
+  display: none;
+}
+.eff-showcase__split {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(0, 1.1fr);
+  gap: 0;
+  /* Fixed height keeps the page below stable as the auto-cycle swaps
+     between tabs whose code/artifact have different intrinsic heights. */
+  height: 420px;
+}
+.eff-showcase__code {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  border-right: 1px solid rgba(232, 220, 192, 0.08);
+}
+.eff-showcase__pre {
+  margin: 0;
+  padding: 16px 18px;
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+  line-height: 1.7;
+  color: var(--alc-code-var);
+  overflow: auto;
+  flex: 1;
+  min-height: 0;
+}
+.eff-showcase__artifact {
+  display: flex;
+  flex-direction: column;
+  gap: 18px;
+  padding: 18px 20px;
+  /* Slightly sunken vs the main terminal bg so the lifted cards inside
+     read as "panels on a panel" rather than "dark on dark". */
+  background: var(--alc-walnut-950);
+  min-width: 0;
+  overflow: auto;
+  min-height: 0;
+}
+.eff-showcase__group {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  min-width: 0;
+}
+.eff-showcase__group-title {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--alc-walnut-300);
+}
+.eff-showcase__perm {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 12px;
+  background: var(--alc-walnut-700);
+  border: 1px solid var(--alc-walnut-600);
+  border-radius: 8px;
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+  color: var(--alc-fg-invert);
+  min-width: 0;
+  opacity: 0;
+  animation: eff-fade-up 460ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+.eff-showcase__perm-icon {
+  flex: 0 0 auto;
+  border-radius: 4px;
+}
+.eff-showcase__perm-action {
+  color: var(--alc-code-keyword);
+  font-weight: 600;
+  white-space: nowrap;
+}
+.eff-showcase__perm-arrow {
+  color: var(--alc-accent-bright);
+  flex: 0 0 auto;
+}
+.eff-showcase__perm-target {
+  color: var(--alc-fg-invert);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  min-width: 0;
+}
+.eff-showcase__envs {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.eff-showcase__env {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+  padding: 8px 12px;
+  background: var(--alc-walnut-700);
+  border: 1px solid var(--alc-walnut-600);
+  border-left: 2px solid var(--alc-accent-bright);
+  border-radius: 6px;
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-invert);
+  min-width: 0;
+  opacity: 0;
+  animation: eff-fade-up 460ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+.eff-showcase__env-name {
+  color: var(--alc-code-keyword);
+  font-weight: 600;
+  flex: 0 0 auto;
+}
+.eff-showcase__env-eq {
+  color: var(--alc-code-comment);
+}
+.eff-showcase__env-value {
+  color: var(--alc-fg-invert);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  min-width: 0;
+  flex: 1;
+}
+
+/* Feature row — used by Durable Objects / Containers / Layers tabs.
+   Icon on the left, label + sub stacked on the right. Same lifted card
+   treatment as .eff-showcase__perm so the artifact panels feel related. */
+.eff-showcase__feature {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 10px 12px;
+  background: var(--alc-walnut-700);
+  border: 1px solid var(--alc-walnut-600);
+  border-radius: 8px;
+  min-width: 0;
+  opacity: 0;
+  animation: eff-fade-up 460ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+.eff-showcase__feature-icon {
+  flex: 0 0 auto;
+}
+.eff-showcase__feature-text {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 0;
+  flex: 1;
+}
+.eff-showcase__feature-label {
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+  color: var(--alc-code-keyword);
+  font-weight: 600;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.eff-showcase__feature-sub {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-walnut-300);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+/* Workflow steps — numbered ordered list with rounded badges. */
+.eff-showcase__steps {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.eff-showcase__step {
+  display: grid;
+  grid-template-columns: 22px minmax(0, auto) minmax(0, 1fr);
+  align-items: center;
+  gap: 10px;
+  padding: 8px 12px;
+  background: var(--alc-walnut-700);
+  border: 1px solid var(--alc-walnut-600);
+  border-radius: 8px;
+  min-width: 0;
+  opacity: 0;
+  animation: eff-fade-up 460ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+.eff-showcase__step-num {
+  width: 22px;
+  height: 22px;
+  border-radius: 50%;
+  background: var(--alc-accent-bright);
+  color: var(--alc-bg-code);
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  font-weight: 700;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+.eff-showcase__step-label {
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+  font-weight: 600;
+  color: var(--alc-code-keyword);
+  white-space: nowrap;
+}
+.eff-showcase__step-sub {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-walnut-300);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  text-align: right;
+}
+
+/* Event source flow — three nodes connected by labelled edges. */
+.eff-showcase__flow {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto minmax(0, 1fr);
+  align-items: center;
+  gap: 6px;
+  margin-top: 4px;
+}
+.eff-showcase__node {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 4px;
+  padding: 14px 10px;
+  background: var(--alc-walnut-700);
+  border: 1px solid var(--alc-walnut-600);
+  border-radius: 10px;
+  text-align: center;
+  min-width: 0;
+  opacity: 0;
+  animation: eff-fade-up 460ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+.eff-showcase__node--accent {
+  background: var(--alc-walnut-600);
+  border-color: var(--alc-accent-bright);
+  box-shadow: 0 0 0 2px rgba(143, 177, 94, 0.18);
+}
+.eff-showcase__node-label {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--alc-fg-invert);
+  line-height: 1.2;
+}
+.eff-showcase__node-sub {
+  font-family: var(--alc-font-mono);
+  font-size: 10px;
+  color: var(--alc-walnut-300);
+  line-height: 1.2;
+}
+.eff-showcase__edge {
+  position: relative;
+  width: 28px;
+  height: 1.6px;
+  background: var(--alc-accent-bright);
+  opacity: 0;
+  animation: eff-fade-in 320ms ease both;
+}
+.eff-showcase__edge::after {
+  content: "";
+  position: absolute;
+  right: -1px;
+  top: 50%;
+  width: 0;
+  height: 0;
+  border-top: 4px solid transparent;
+  border-bottom: 4px solid transparent;
+  border-left: 6px solid var(--alc-accent-bright);
+  transform: translateY(-50%);
+}
+.eff-showcase__edge::before {
+  content: attr(data-label);
+  position: absolute;
+  left: 50%;
+  bottom: 100%;
+  transform: translate(-50%, -2px);
+  font-family: var(--alc-font-mono);
+  font-size: 9.5px;
+  letter-spacing: 0.04em;
+  color: var(--alc-walnut-300);
+  white-space: nowrap;
+  background: var(--alc-walnut-950);
+  padding: 0 4px;
+}
+
+.eff-showcase__hint {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-3);
+  text-align: center;
+  letter-spacing: 0.04em;
+}
+
+@keyframes eff-fade-up {
+  from {
+    opacity: 0;
+    transform: translateY(6px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+@keyframes eff-fade-in {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+
+/* Used on the code <pre> so it fades in alongside the artifact rows
+   when the panel remounts (tab switch). */
+.eff-showcase__fade {
+  animation: eff-fade-in 320ms ease both;
+}
+
+/* ------------------------------------------------------------
+   Layer tab — diff renderer with overlay variant crossfade.
+   Common lines render statically. Each diff segment is a "slot"
+   that overlays both variants in the same grid cell so only the
+   active one is visible — the inactive fades to opacity 0 and is
+   replaced by the active in a long ease-in-out crossfade.
+   ------------------------------------------------------------ */
+
+.eff-showcase__diff {
+  margin: 0;
+  padding: 14px 16px 14px 12px;
+  font-family: var(--alc-font-mono);
+  font-size: 11.5px;
+  line-height: 1.7;
+  /* Bright parchment for any character that isn't tokenized by
+     highlightTS (punctuation: <, =, (, ), {, }, ;, etc.) so symbols
+     don't disappear into the walnut bg. */
+  color: var(--alc-code-var);
+  overflow: auto;
+  flex: 1;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
+}
+
+.eff-diff__common {
+  display: flex;
+  flex-direction: column;
+}
+
+/* Slot: a CSS grid with one cell. Both variants share that cell, so the
+   slot's height is the max of the two variants and the panel never jumps
+   when the impl swaps. */
+.eff-diff__slot {
+  display: grid;
+  grid-template-areas: "stack";
+}
+.eff-diff__variant {
+  grid-area: stack;
+  display: flex;
+  flex-direction: column;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 1100ms cubic-bezier(0.4, 0, 0.2, 1);
+}
+.eff-diff__variant[data-active="true"] {
+  opacity: 1;
+  pointer-events: auto;
+}
+
+.eff-diff__line {
+  display: grid;
+  grid-template-columns: 14px minmax(0, 1fr);
+  align-items: baseline;
+  gap: 6px;
+  padding: 0 6px;
+  margin: 0 -6px;
+}
+.eff-diff__marker {
+  display: inline-block;
+  width: 12px;
+  text-align: center;
+  font-weight: 700;
+  user-select: none;
+  color: var(--alc-accent-bright);
+}
+.eff-diff__content {
+  display: block;
+  white-space: pre;
+  min-width: 0;
+}
+
+/* Diff lines get a subtle green tint background so the whole line
+   reads as "added" — not just the "+" prefix. The tint is soft enough
+   not to fight the syntax-highlighted tokens. */
+.eff-diff__line--ddb,
+.eff-diff__line--d1 {
+  background-color: rgba(143, 177, 94, 0.12);
+  box-shadow: inset 2px 0 0 var(--alc-accent-bright);
+}
+.eff-diff__line--ddb .eff-diff__marker::before,
+.eff-diff__line--d1 .eff-diff__marker::before {
+  content: "+";
+}
+
+/* ------------------------------------------------------------
+   Layer tab — artifact panel uses the same overlay pattern for
+   the "Composed from" group so the ddb / d1 feature-row stacks
+   crossfade in place rather than competing for visual weight.
+   ------------------------------------------------------------ */
+
+.eff-showcase__variant-stack {
+  display: grid;
+  grid-template-areas: "stack";
+}
+.eff-showcase__variant {
+  grid-area: stack;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 1100ms cubic-bezier(0.4, 0, 0.2, 1);
+}
+.eff-showcase__variant[data-active="true"] {
+  opacity: 1;
+  pointer-events: auto;
+}
+
+/* Mobile: drop the right-hand artifact panel entirely — the generated
+   permissions / environment / flow visualizations don't read well at narrow
+   widths and the code itself is the primary story. */
+@media (max-width: 880px) {
+  .eff-showcase__split {
+    grid-template-columns: minmax(0, 1fr);
+    /* Code-only: let the panel size to the code's natural height instead
+       of holding the desktop's fixed 420px slot. */
+    height: auto;
+  }
+  .eff-showcase__code {
+    border-right: 0;
+  }
+  .eff-showcase__pre {
+    overflow-x: auto;
+  }
+  .eff-showcase__artifact {
+    display: none;
+  }
+  .eff-showcase__flow {
+    grid-template-columns: minmax(0, 1fr);
+    grid-auto-flow: row;
+    gap: 4px;
+    justify-items: stretch;
+  }
+  .eff-showcase__edge {
+    width: 1.6px;
+    height: 24px;
+    margin: 0 auto;
+  }
+  .eff-showcase__edge::after {
+    right: 50%;
+    top: auto;
+    bottom: -1px;
+    transform: translateX(50%);
+    border-left: 4px solid transparent;
+    border-right: 4px solid transparent;
+    border-top: 6px solid var(--alc-accent-bright);
+    border-bottom: 0;
+  }
+  .eff-showcase__edge::before {
+    left: 100%;
+    bottom: 50%;
+    transform: translate(4px, 50%);
+  }
+}
+
+/* ============================================================
+   Stack / Deploy — narrow-screen fallback (home page section 1)
+   The 3-column "code + arrow + terminal" diagram needs horizontal
+   room to read well. On iPad-and-narrower we drop the source code
+   panel entirely and just show the live deploy terminal — the
+   Alchemy.Stack code is already visible elsewhere on the page.
+   ============================================================ */
+
+.stack-deploy-mobile {
+  display: none;
+  max-width: 720px;
+  margin: 0 auto;
+}
+.stack-deploy-mobile > .alc-term {
+  width: 100%;
+}
+
+@media (max-width: 880px) {
+  .stack-deploy-diagram {
+    display: none;
+  }
+  .stack-deploy-mobile {
+    display: block;
+  }
+}
+
+/* ============================================================
+   Async-fetch escape hatch — narrow-screen tabs
+   On wide screens the two files sit side-by-side. Below 1024px
+   they collapse into a single tabbed card that auto-flips between
+   alchemy.run.ts and src/worker.ts with a short caption.
+   ============================================================ */
+
+.async-split-mobile {
+  display: none;
+}
+.async-tabs {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  max-width: 720px;
+  margin: 0 auto;
+}
+.async-tabs__chrome {
+  background: var(--alc-bg-code);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+  display: flex;
+  flex-direction: column;
+}
+.async-tabs__header {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 8px 12px;
+  border-bottom: 1px solid rgba(232, 220, 192, 0.08);
+  background: rgba(255, 255, 255, 0.02);
+}
+.async-tabs__tabs {
+  display: flex;
+  gap: 4px;
+  margin-left: 12px;
+  flex: 1;
+  min-width: 0;
+  overflow-x: auto;
+  scrollbar-width: none;
+}
+.async-tabs__tabs::-webkit-scrollbar {
+  display: none;
+}
+.async-tabs__tab {
+  flex: 0 0 auto;
+  appearance: none;
+  background: transparent;
+  border: 1px solid transparent;
+  color: var(--alc-code-comment);
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  padding: 4px 10px;
+  border-radius: 5px;
+  cursor: pointer;
+  transition:
+    color 160ms ease,
+    background 160ms ease,
+    border-color 160ms ease;
+}
+.async-tabs__tab:hover {
+  color: var(--alc-fg-invert);
+}
+.async-tabs__tab[data-active="true"] {
+  color: var(--alc-fg-invert);
+  background: rgba(255, 255, 255, 0.05);
+  border-color: rgba(232, 220, 192, 0.12);
+}
+.async-tabs__body {
+  position: relative;
+  display: flex;
+  flex-direction: column;
+}
+.async-tabs__panel {
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  min-width: 0;
+}
+.async-tabs__panel[hidden] {
+  display: none;
+}
+.async-tabs__pre {
+  margin: 0;
+  padding: 14px 16px;
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  line-height: 1.65;
+  color: var(--alc-code-var);
+  overflow-x: auto;
+  flex: 1;
+}
+@media (max-width: 880px) {
+  .alc-split-2.async-split-desktop {
+    display: none;
+  }
+  .async-split-mobile {
+    display: block;
+  }
+}
+
+/* ============================================================
+   Animated Output / resource-graph (/product/iac)
+   Code on the left, progressive nodes/edges on the right with
+   a step indicator + rotating annotation.
+   ============================================================ */
+
+.output-anim-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1.15fr) minmax(0, 1fr);
+  gap: 24px;
+  align-items: stretch;
+  max-width: 1100px;
+  margin: 0 auto;
+}
+.output-anim-grid > .alc-code-block {
+  min-height: 100%;
+}
+
+.output-anim-stage {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 14px;
+  padding: 22px 22px 18px;
+  display: flex;
+  flex-direction: column;
+  gap: 18px;
+}
+
+.output-anim-graph {
+  flex: 1;
+  display: grid;
+  grid-template-columns: minmax(0, auto) minmax(60px, 1fr) minmax(0, auto);
+  grid-template-rows: auto minmax(48px, 1fr) auto;
+  align-items: center;
+  justify-items: center;
+  gap: 0;
+}
+
+.output-anim-node {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 2px;
+  padding: 10px 18px;
+  border-radius: 10px;
+  min-width: 110px;
+  white-space: nowrap;
+  transition:
+    opacity 380ms ease,
+    transform 380ms ease;
+}
+.output-anim-node--accent {
+  background: rgba(184, 138, 74, 0.1);
+  border: 1.4px solid var(--alc-accent-deep);
+}
+.output-anim-node--ghost {
+  background: var(--alc-bg);
+  border: 1.4px dashed var(--alc-hairline-2);
+}
+.output-anim-node__label {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  line-height: 1.15;
+}
+.output-anim-node__id {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-3);
+  line-height: 1.15;
+}
+
+.output-anim-edge {
+  position: relative;
+  width: 100%;
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  opacity: 0.18;
+  transition: opacity 360ms ease;
+}
+.output-anim-edge.is-on {
+  opacity: 1;
+}
+
+.output-anim-edge--h::before {
+  content: "";
+  position: absolute;
+  left: 6px;
+  right: 14px;
+  top: 50%;
+  height: 1.6px;
+  background: var(--alc-accent-deep);
+  transform: translateY(-50%);
+}
+.output-anim-edge--h::after {
+  content: "";
+  position: absolute;
+  right: 6px;
+  top: 50%;
+  width: 0;
+  height: 0;
+  border-top: 5px solid transparent;
+  border-bottom: 5px solid transparent;
+  border-left: 7px solid var(--alc-accent-deep);
+  transform: translateY(-50%);
+}
+.output-anim-edge--v::before {
+  content: "";
+  position: absolute;
+  top: 4px;
+  bottom: 12px;
+  left: 50%;
+  width: 1.6px;
+  background: var(--alc-accent-deep);
+  transform: translateX(-50%);
+}
+.output-anim-edge--v::after {
+  content: "";
+  position: absolute;
+  bottom: 2px;
+  left: 50%;
+  width: 0;
+  height: 0;
+  border-left: 5px solid transparent;
+  border-right: 5px solid transparent;
+  border-top: 7px solid var(--alc-accent-deep);
+  transform: translateX(-50%);
+}
+.output-anim-edge__label {
+  position: relative;
+  z-index: 1;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+  background: var(--alc-bg-elev-1);
+  padding: 2px 8px;
+  border-radius: 4px;
+}
+
+.output-anim-steps {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  padding-top: 4px;
+}
+.output-anim-steps__dot {
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--alc-hairline-2);
+  transition:
+    background 280ms ease,
+    transform 280ms ease;
+}
+.output-anim-steps__dot.is-active {
+  background: var(--alc-accent-deep);
+  transform: scale(1.35);
+}
+
+.output-anim-annotation {
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--alc-fg-2);
+  text-align: center;
+  min-height: 3.2em; /* reserve space so layout doesn't jump */
+}
+.output-anim-annotation strong {
+  color: var(--alc-fg-1);
+  font-weight: 600;
+}
+.output-anim-annotation code {
+  font-family: var(--alc-font-mono);
+  font-size: 0.92em;
+  color: var(--alc-accent-deep);
+  background: rgba(184, 138, 74, 0.1);
+  padding: 0 4px;
+  border-radius: 3px;
+}
+
+@media (max-width: 880px) {
+  .output-anim-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* ============================================================
+   Service-as-Layer swap (/product/iac)
+   Worker code on left, Sessions → Layer → Resource on right
+   cycles through KV, DynamoDB, D1 backings.
+   ============================================================ */
+
+.service-swap-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1.25fr) minmax(280px, 1fr);
+  gap: 24px;
+  align-items: stretch;
+  max-width: 1100px;
+  margin: 0 auto;
+}
+
+.service-swap-stage {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 14px;
+  padding: 22px 18px 14px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 0;
+}
+
+.service-swap-stage__node {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 3px;
+  padding: 10px 16px 8px;
+  background: var(--alc-bg-elev-1);
+  border: 1.4px solid var(--alc-hairline-2);
+  border-radius: 10px;
+  min-width: 150px;
+  text-align: center;
+  transition:
+    border-color 320ms ease,
+    box-shadow 320ms ease;
+}
+.service-swap-stage__node--accent {
+  border-color: var(--alc-accent-deep);
+  box-shadow: 0 0 0 2px rgba(184, 138, 74, 0.12);
+}
+.service-swap-stage__label {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  line-height: 1.2;
+}
+.service-swap-stage__sub {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-3);
+  line-height: 1.2;
+}
+
+.service-swap-stage__edge {
+  position: relative;
+  height: 28px;
+  width: 1.6px;
+  background: currentColor;
+  margin: 4px 0;
+  color: var(--alc-accent-deep);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition:
+    background 320ms ease,
+    color 320ms ease;
+}
+.service-swap-stage__edge--down::after {
+  content: "";
+  position: absolute;
+  bottom: -1px;
+  left: 50%;
+  transform: translateX(-50%);
+  width: 0;
+  height: 0;
+  border-left: 5px solid transparent;
+  border-right: 5px solid transparent;
+  border-top: 7px solid currentColor;
+  transition: border-top-color 320ms ease;
+}
+.service-swap-stage__edge-label {
+  position: absolute;
+  left: 100%;
+  top: 50%;
+  transform: translateY(-50%);
+  margin-left: 10px;
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid currentColor;
+  padding: 1px 7px;
+  border-radius: 3px;
+  white-space: nowrap;
+  transition:
+    color 320ms ease,
+    border-color 320ms ease;
+}
+
+.service-swap-stage__steps {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  padding-top: 14px;
+}
+.service-swap-stage__dot {
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--alc-hairline-2);
+  transition:
+    background 280ms ease,
+    transform 280ms ease;
+}
+.service-swap-stage__dot.is-active {
+  transform: scale(1.35);
+}
+
+/* Reuse the existing layer-cycle-node keyframes for the fade-in
+   when the active Layer/Resource node swaps. */
+@keyframes service-swap-pop {
+  0% {
+    opacity: 0;
+    transform: scale(0.92) translateY(-3px);
+    filter: blur(2px);
+  }
+  18% {
+    opacity: 1;
+    transform: scale(1) translateY(0);
+    filter: blur(0);
+  }
+  100% {
+    opacity: 1;
+  }
+}
+.service-swap-stage .layer-swap-node {
+  animation: service-swap-pop 700ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+@keyframes layer-swap-text {
+  0% {
+    opacity: 0;
+    transform: translateY(-2px);
+  }
+  20% {
+    opacity: 1;
+    transform: translateY(0);
+  }
+  100% {
+    opacity: 1;
+  }
+}
+.alc-code-block .layer-swap {
+  display: inline-block;
+  padding: 1px 5px;
+  margin: 0 -1px;
+  border-radius: 3px;
+  animation: layer-swap-text 700ms cubic-bezier(0.4, 0, 0.2, 1) both;
+}
+
+@media (max-width: 880px) {
+  .service-swap-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
+/* ============================================================
+   Output graph diagram (/product/iac)
+   ============================================================ */
+
+.output-graph {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 14px;
+  padding: 22px 22px 18px;
+  display: flex;
+  flex-direction: column;
+  justify-content: center; /* center stage+caption so extra column height
+                               is split top/bottom instead of dumped below */
+  gap: 18px;
+  align-self: stretch;
+}
+
+/* 3x3 grid: nodes occupy corners, edges occupy middle cells. */
+.output-graph__stage {
+  display: grid;
+  grid-template-columns: minmax(0, auto) minmax(48px, 1fr) minmax(0, auto);
+  grid-template-rows: auto minmax(40px, 1fr) auto;
+  align-items: center;
+  justify-items: center;
+  gap: 0;
+  padding: 8px 4px;
+}
+
+.output-graph__node {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 2px;
+  padding: 10px 18px;
+  background: rgba(184, 138, 74, 0.1);
+  border: 1.4px solid var(--alc-accent-deep);
+  border-radius: 10px;
+  min-width: 110px;
+  white-space: nowrap;
+}
+.output-graph__node--ghost {
+  background: var(--alc-bg);
+  border-color: var(--alc-hairline-2);
+  border-style: dashed;
+}
+.output-graph__node-label {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  line-height: 1.15;
+}
+.output-graph__node-id {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-3);
+  line-height: 1.15;
+}
+
+/* An edge cell renders a line + arrowhead via pseudo-elements,
+   plus a label on top via the inner span. */
+.output-graph__edge {
+  position: relative;
+  width: 100%;
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.output-graph__edge--h::before {
+  content: "";
+  position: absolute;
+  left: 8px;
+  right: 14px;
+  top: 50%;
+  height: 1.6px;
+  background: var(--alc-accent-deep);
+  transform: translateY(-50%);
+}
+.output-graph__edge--h::after {
+  content: "";
+  position: absolute;
+  right: 8px;
+  top: 50%;
+  width: 0;
+  height: 0;
+  border-top: 5px solid transparent;
+  border-bottom: 5px solid transparent;
+  border-left: 7px solid var(--alc-accent-deep);
+  transform: translateY(-50%);
+}
+.output-graph__edge--v::before {
+  content: "";
+  position: absolute;
+  top: 4px;
+  bottom: 12px;
+  left: 50%;
+  width: 1.6px;
+  background: var(--alc-accent-deep);
+  transform: translateX(-50%);
+}
+.output-graph__edge--v::after {
+  content: "";
+  position: absolute;
+  bottom: 4px;
+  left: 50%;
+  width: 0;
+  height: 0;
+  border-left: 5px solid transparent;
+  border-right: 5px solid transparent;
+  border-top: 7px solid var(--alc-accent-deep);
+  transform: translateX(-50%);
+}
+.output-graph__edge-label {
+  position: relative;
+  z-index: 1;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+  background: var(--alc-bg-elev-1);
+  padding: 2px 8px;
+  border-radius: 4px;
+}
+
+.output-graph__caption {
+  font-size: 12.5px;
+  line-height: 1.55;
+  color: var(--alc-fg-3);
+  text-align: center;
+}
+.output-graph__caption strong {
+  color: var(--alc-fg-1);
+  font-weight: 600;
+}
+.output-graph__caption code {
+  font-family: var(--alc-font-mono);
+  font-size: 0.92em;
+  color: var(--alc-accent-deep);
+  background: rgba(184, 138, 74, 0.1);
+  padding: 0 4px;
+  border-radius: 3px;
+}
+
+@media (max-width: 720px) {
+  .output-graph__stage {
+    gap: 14px 40px;
+  }
+  .output-graph__node {
+    min-width: 100px;
+    padding: 8px 12px;
+  }
+}
+
+/* ============================================================
+   Async-style code tabs (/product/providers/cloudflare)
+   ============================================================ */
+
+.code-tabs {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 12px;
+  overflow: hidden;
+}
+.code-tabs__nav {
+  display: flex;
+  background: var(--alc-bg-nav);
+  border-bottom: 1px solid var(--alc-hairline);
+}
+.code-tabs__btn {
+  flex: 0 0 auto;
+  padding: 10px 16px;
+  background: transparent;
+  border: 0;
+  color: var(--alc-fg-2);
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  cursor: pointer;
+  border-bottom: 2px solid transparent;
+  transition:
+    color 160ms ease,
+    border-color 160ms ease,
+    background 160ms ease;
+}
+.code-tabs__btn[data-active="true"] {
+  color: var(--alc-fg-1);
+  border-bottom-color: var(--alc-accent-deep);
+  background: var(--alc-bg-elev-1);
+}
+.code-tabs__btn:hover {
+  color: var(--alc-fg-1);
+}
+.code-tabs__panel {
+  display: none;
+}
+.code-tabs__panel[data-active="true"] {
+  display: block;
+}
+.code-tabs__panel .alc-code-block {
+  border: 0;
+  border-radius: 0;
+  box-shadow: none;
+}
+
+/* TS token colors used inside .alc-code-block */
+.alc-tok-k {
+  color: var(--alc-code-keyword);
+}
+.alc-tok-s {
+  color: var(--alc-code-string);
+}
+.alc-tok-f {
+  color: var(--alc-code-fn);
+}
+.alc-tok-t {
+  color: var(--alc-code-type);
+}
+.alc-tok-c {
+  color: var(--alc-code-comment);
+  font-style: italic;
+}
+.alc-tok-v {
+  color: var(--alc-code-var);
+}
+.alc-tok-n {
+  color: var(--alc-code-literal);
+}
+
+/* ============================================================
+   Card / panel utilities — used widely across product pages
+   ============================================================ */
+
+.alc-card {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  padding: 18px;
+}
+.alc-card--lg {
+  border-radius: 12px;
+  padding: 22px;
+}
+.alc-card__title {
+  font-family: var(--alc-font-sans);
+  font-size: 15px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  margin-bottom: 6px;
+}
+.alc-card__title--lg {
+  font-size: 17px;
+}
+.alc-card__body {
+  font-size: 13px;
+  line-height: 1.55;
+  color: var(--alc-fg-3);
+}
+
+/* ============================================================
+   Provider overview cards (/product/providers)
+   ============================================================ */
+
+.provider-overview {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 18px;
+  max-width: 1100px;
+  margin: 0 auto;
+}
+@media (max-width: 980px) {
+  .provider-overview {
+    grid-template-columns: 1fr;
+  }
+}
+.provider-overview__card {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 14px;
+  padding: 22px;
+  text-decoration: none;
+  color: inherit;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  transition:
+    border-color 200ms ease,
+    transform 200ms ease;
+}
+.provider-overview__card:hover {
+  border-color: var(--prov-color);
+  transform: translateY(-2px);
+}
+.provider-overview__card--soon {
+  background: linear-gradient(
+    180deg,
+    var(--alc-bg-elev-1) 0%,
+    color-mix(in srgb, var(--alc-bg-nav) 60%, transparent) 100%
+  );
+}
+.provider-overview__head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+.provider-overview__name {
+  font-family: var(--alc-font-serif);
+  font-size: 22px;
+  font-weight: 500;
+  color: var(--alc-fg-1);
+}
+.provider-overview__badge {
+  margin-left: auto;
+  font-family: var(--alc-font-mono);
+  font-size: 9.5px;
+  font-weight: 700;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--prov-color);
+  background: color-mix(in srgb, var(--prov-color) 14%, transparent);
+  padding: 2px 7px;
+  border-radius: 4px;
+}
+.provider-overview__body {
+  font-size: 13.5px;
+  line-height: 1.55;
+  color: var(--alc-fg-2);
+  margin: 0;
+  flex: 1;
+}
+.provider-overview__body code {
+  font-family: var(--alc-font-mono);
+  font-size: 0.92em;
+  color: var(--alc-accent-deep);
+  background: rgba(184, 138, 74, 0.1);
+  padding: 0 4px;
+  border-radius: 3px;
+}
+.provider-overview__cta {
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--prov-color);
+  margin-top: 4px;
+}
+
+/* ============================================================
+   IAM action table (/product/providers/aws)
+   ============================================================ */
+
+.iam-table {
+  width: 100%;
+  border-collapse: collapse;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+}
+.iam-table th {
+  text-align: left;
+  padding: 10px 14px;
+  background: var(--alc-bg-nav);
+  color: var(--alc-fg-2);
+  font-weight: 600;
+  font-size: 11px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  border-bottom: 1px solid var(--alc-hairline);
+}
+.iam-table td {
+  padding: 9px 14px;
+  border-bottom: 1px solid var(--alc-hairline);
+  color: var(--alc-fg-2);
+}
+.iam-table tr:last-child td {
+  border-bottom: none;
+}
+.iam-table code {
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-1);
+}
+.iam-table td:nth-child(2) code {
+  color: #ff9900;
+}
+
+/* ============================================================
+   CI walkthrough steps (/product/cicd)
+   ============================================================ */
+
+.ci-steps {
+  list-style: none;
+  margin: 0 auto;
+  padding: 0;
+  max-width: 820px;
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+.ci-step {
+  display: grid;
+  grid-template-columns: 36px 1fr;
+  gap: 16px;
+  align-items: flex-start;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  padding: 16px 18px;
+}
+.ci-step__num {
+  width: 28px;
+  height: 28px;
+  border-radius: 50%;
+  background: var(--alc-accent-deep);
+  color: var(--alc-bg-elev-1);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  font-weight: 700;
+}
+.ci-step__title {
+  font-family: var(--alc-font-sans);
+  font-size: 15px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  margin-bottom: 2px;
+}
+.ci-step__body {
+  margin: 0;
+  font-size: 13.5px;
+  color: var(--alc-fg-2);
+  line-height: 1.55;
+}
+
+/* GitHub-styled comment mock (/product/cicd) */
+.gh-mock {
+  max-width: 720px;
+  margin: 0 auto;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+}
+.gh-mock__head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 14px;
+  border-bottom: 1px solid var(--alc-hairline);
+  background: var(--alc-bg-nav);
+}
+.gh-mock__avatar {
+  width: 28px;
+  height: 28px;
+  border-radius: 50%;
+  background: var(--alc-accent-deep);
+  color: var(--alc-bg-elev-1);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  font-family: var(--alc-font-mono);
+  font-size: 13px;
+  font-weight: 700;
+}
+.gh-mock__author {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 13px;
+  color: var(--alc-fg-2);
+}
+.gh-mock__author strong {
+  color: var(--alc-fg-1);
+}
+.gh-mock__bot-tag {
+  font-family: var(--alc-font-mono);
+  font-size: 9.5px;
+  font-weight: 700;
+  color: var(--alc-fg-3);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 4px;
+  padding: 1px 6px;
+  background: var(--alc-bg);
+}
+.gh-mock__meta {
+  font-size: 11.5px;
+  color: var(--alc-fg-3);
+  margin-left: 4px;
+}
+.gh-mock__body {
+  padding: 16px 18px;
+}
+.gh-mock__h3 {
+  font-family: var(--alc-font-sans);
+  font-size: 16px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  margin: 0 0 10px;
+}
+.gh-mock__p {
+  margin: 6px 0;
+  font-size: 13.5px;
+  color: var(--alc-fg-2);
+}
+.gh-mock__url {
+  color: var(--alc-accent-deep);
+  text-decoration: underline;
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+}
+.gh-mock__code {
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-1);
+  background: var(--alc-bg);
+  padding: 1px 5px;
+  border-radius: 3px;
+}
+.gh-mock__hr {
+  border: none;
+  border-top: 1px solid var(--alc-hairline);
+  margin: 12px 0;
+}
+.gh-mock__small {
+  color: var(--alc-fg-3);
+  font-size: 12px;
+  margin: 0;
+}
+
+/* ============================================================
+   OTel destination cards (/product/observability)
+   ============================================================ */
+
+.otel-card {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-left: 3px solid var(--c);
+  border-radius: 8px;
+  padding: 12px 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+.otel-card__name {
+  font-family: var(--alc-font-sans);
+  font-size: 13.5px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+}
+.otel-card__sub {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+}
+@media (max-width: 760px) {
+  .otel-card {
+    font-size: 12px;
+  }
+}
+
+/* ============================================================
+   PR lifecycle animation (home page section 5)
+   ============================================================ */
+
+.pr-lc {
+  max-width: 1080px;
+  margin: 0 auto;
+  display: flex;
+  flex-direction: column;
+  gap: 24px;
+}
+
+.pr-lc__timeline {
+  list-style: none;
+  margin: 0 auto;
+  padding: 0;
+  display: flex;
+  align-items: stretch;
+  gap: 0;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 999px;
+  padding: 6px;
+  max-width: 820px;
+  width: 100%;
+}
+.pr-lc__step {
+  flex: 1;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 8px 12px;
+  border-radius: 999px;
+  font-size: 12.5px;
+  color: var(--alc-fg-3);
+  transition:
+    background 280ms ease,
+    color 280ms ease;
+  white-space: nowrap;
+}
+.pr-lc__step-num {
+  width: 20px;
+  height: 20px;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  font-weight: 700;
+  background: var(--alc-bg);
+  color: var(--alc-fg-3);
+  border: 1px solid var(--alc-hairline);
+  transition:
+    background 280ms ease,
+    color 280ms ease,
+    border-color 280ms ease;
+}
+.pr-lc__step--done {
+  color: var(--alc-fg-2);
+}
+.pr-lc__step--done .pr-lc__step-num {
+  background: var(--alc-accent-deep);
+  border-color: var(--alc-accent-deep);
+  color: var(--alc-bg-elev-1);
+}
+.pr-lc__step--active {
+  background: var(--alc-bg);
+  color: var(--alc-fg-1);
+  font-weight: 600;
+}
+.pr-lc__step--active .pr-lc__step-num {
+  background: var(--alc-accent-bright);
+  border-color: var(--alc-accent-bright);
+  color: var(--alc-bg-code);
+  box-shadow: 0 0 0 4px rgba(184, 138, 74, 0.15);
+}
+
+.pr-lc__stage {
+  display: grid;
+  grid-template-columns: minmax(0, 0.85fr) minmax(0, 1.15fr);
+  gap: 20px;
+  align-items: stretch;
+}
+
+/* PR card on the left */
+.pr-lc__pr {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 12px;
+  padding: 18px;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  box-shadow: var(--alc-shadow-sm);
+}
+/* Let the right panel (terminal/comment/dashboard) drive the row height
+   so the PR card doesn't grow a big empty middle when its content is short. */
+.pr-lc__pr-checks {
+  margin-top: 8px;
+}
+.pr-lc__pr-head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+.pr-lc__pr-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 4px 10px;
+  border-radius: 999px;
+  font-size: 11.5px;
+  font-weight: 600;
+  font-family: var(--alc-font-sans);
+  transition:
+    background 280ms ease,
+    color 280ms ease;
+}
+.pr-lc__pr-pill--open {
+  background: rgba(95, 174, 110, 0.16);
+  color: #3d8b58;
+}
+.pr-lc__pr-pill--merged {
+  background: rgba(149, 100, 200, 0.16);
+  color: #7b50b8;
+}
+.pr-lc__pr-num {
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+  color: var(--alc-fg-3);
+}
+.pr-lc__pr-title {
+  font-family: var(--alc-font-sans);
+  font-size: 15px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+  line-height: 1.3;
+}
+.pr-lc__pr-meta {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 12px;
+  color: var(--alc-fg-3);
+}
+.pr-lc__pr-branch {
+  font-family: var(--alc-font-mono);
+  font-size: 11.5px;
+  background: var(--alc-bg);
+  border: 1px solid var(--alc-hairline-2);
+  border-radius: 4px;
+  padding: 1px 6px;
+  color: var(--alc-fg-2);
+}
+.pr-lc__pr-branch--base {
+  color: var(--alc-fg-3);
+}
+.pr-lc__pr-sep {
+  color: var(--alc-fg-4);
+}
+.pr-lc__pr-checks {
+  margin-top: auto;
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  border-top: 1px solid var(--alc-hairline);
+  padding-top: 12px;
+}
+.pr-lc__check {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 12.5px;
+  color: var(--alc-fg-2);
+}
+.pr-lc__check-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--alc-fg-4);
+  transition: background 280ms ease;
+}
+.pr-lc__check--running .pr-lc__check-dot {
+  background: var(--alc-warn);
+  animation: pr-lc-pulse 1s ease-in-out infinite;
+}
+.pr-lc__check--done .pr-lc__check-dot {
+  background: var(--alc-success);
+}
+@keyframes pr-lc-pulse {
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.4;
+  }
+}
+.pr-lc__check-status {
+  margin-left: auto;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+}
+
+/* Right panel — terminal, comment, or dashboard */
+.pr-lc__panel {
+  display: flex;
+  flex-direction: column;
+  justify-content: stretch;
+}
+.pr-lc__panel > * {
+  flex: 1;
+}
+.pr-lc__gh {
+  max-width: none;
+  margin: 0;
+}
+
+/* Dashboard mock — shown during the `observe` phase */
+.pr-lc__dash {
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+  display: flex;
+  flex-direction: column;
+}
+.pr-lc__dash-head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 14px;
+  border-bottom: 1px solid var(--alc-hairline);
+  background: var(--alc-bg-nav);
+}
+.pr-lc__dash-title {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+}
+.pr-lc__dash-meta {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+  margin-left: auto;
+}
+.pr-lc__dash-pulse {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--alc-success);
+  box-shadow: 0 0 0 0 rgba(95, 174, 110, 0.6);
+  animation: pr-lc-dash-pulse 1.4s ease-out infinite;
+}
+@keyframes pr-lc-dash-pulse {
+  0% {
+    box-shadow: 0 0 0 0 rgba(95, 174, 110, 0.55);
+  }
+  70% {
+    box-shadow: 0 0 0 8px rgba(95, 174, 110, 0);
+  }
+  100% {
+    box-shadow: 0 0 0 0 rgba(95, 174, 110, 0);
+  }
+}
+.pr-lc__dash-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 1px;
+  background: var(--alc-hairline);
+  flex: 1;
+}
+.pr-lc__tile {
+  background: var(--alc-bg-elev-1);
+  padding: 12px 14px;
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  border-top: 2px solid var(--c, var(--alc-accent-deep));
+  min-width: 0;
+}
+.pr-lc__tile-label {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--alc-fg-3);
+}
+.pr-lc__tile-value {
+  font-family: var(--alc-font-serif);
+  font-size: 26px;
+  font-weight: 500;
+  color: var(--alc-fg-1);
+  line-height: 1.05;
+}
+.pr-lc__tile-unit {
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-3);
+  margin-left: 3px;
+  font-weight: 400;
+}
+.pr-lc__spark {
+  display: block;
+  width: 100%;
+  height: 36px;
+  margin-top: auto;
+}
+.pr-lc__tile-foot {
+  margin-top: auto;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+}
+.pr-lc__dash-foot {
+  padding: 8px 14px;
+  border-top: 1px solid var(--alc-hairline);
+  background: var(--alc-bg-nav);
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-fg-3);
+}
+.pr-lc__dash-foot code {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-accent-deep);
+  background: rgba(184, 138, 74, 0.1);
+  padding: 0 4px;
+  border-radius: 3px;
+}
+
+@media (max-width: 760px) {
+  .pr-lc__stage {
+    grid-template-columns: 1fr;
+  }
+  .pr-lc__timeline {
+    overflow-x: auto;
+    border-radius: 12px;
+  }
+  .pr-lc__step {
+    font-size: 11.5px;
+  }
+}
+@media (max-width: 480px) {
+  .pr-lc__step-num {
+    display: none;
+  }
+  .pr-lc__step {
+    padding: 8px 10px;
+    font-size: 11px;
+  }
+}
+
+/* ============================================================
+   Operational readiness — code-pair illustration
+   ============================================================ */
+
+.alc-ops-col {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  min-width: 0;
+}
+.alc-ops-caption {
+  font-size: 13.5px;
+  line-height: 1.55;
+  color: var(--alc-fg-2);
+  margin: 2px 2px 0;
+}
+.alc-ops-caption strong {
+  color: var(--alc-fg-1);
+  font-weight: 600;
+}
+
+/* ============================================================
+   Hero (home page)
+   ============================================================ */
+
+.alc-hero {
+  position: relative;
+  isolation: isolate;
+}
+/* Aged-paper plate behind the entire hero. Two layers of SVG fractal
+   noise — a fine fiber grain plus a large-scale foxing/aging blotch
+   pattern — combine to read as old printed paper rather than a uniform
+   texture. No directional banding (which would look like slats). */
+/* Faint paper-fiber grain behind the hero. Single layer of fine SVG
+   fractal noise, multiply-blended into the parchment background and
+   feathered with a vignette so it never reads as a hard plate. */
+.alc-hero::before {
+  content: "";
+  position: absolute;
+  inset: 0;
+  z-index: -1;
+  pointer-events: none;
+  opacity: 0.28;
+  mix-blend-mode: multiply;
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='280' height='280'><filter id='g'><feTurbulence type='fractalNoise' baseFrequency='1.3' numOctaves='2' seed='6' stitchTiles='stitch'/><feColorMatrix values='0 0 0 0 0.30  0 0 0 0 0.22  0 0 0 0 0.13  0 0 0 0.5 0'/></filter><rect width='100%' height='100%' filter='url(%23g)'/></svg>");
+  background-size: 280px 280px;
+  -webkit-mask-image: radial-gradient(
+    ellipse 100% 95% at 50% 45%,
+    #000 55%,
+    transparent 100%
+  );
+  mask-image: radial-gradient(
+    ellipse 100% 95% at 50% 45%,
+    #000 55%,
+    transparent 100%
+  );
+}
+/* In dark mode the brown noise multiplied onto the dark page just turns
+   to mud. Flip to `screen` so the same noise pattern adds a faint warm
+   highlight grain instead of subtracting into black. */
+[data-theme="dark"] .alc-hero::before {
+  mix-blend-mode: screen;
+  opacity: 0.16;
+}
+/* Parchment "halo" between the animation canvas and the hero text.
+   Solid parchment at the center (where the headline + subtitle live)
+   so the animation never competes with type, fading to transparent
+   well before the edges so the corners of the canvas stay visible.
+   z-index 0 + source order (rendered after the canvas) keeps it
+   above the canvas (z:0) and below the content (z:1). */
+.alc-hero::after {
+  content: "";
+  position: absolute;
+  inset: 0;
+  z-index: 0;
+  pointer-events: none;
+  /* The halo's job is to fade the page color *over* the canvas animation
+     so the headline reads cleanly. Anchored to `--alc-bg` so it matches
+     whatever theme is active. */
+  background: radial-gradient(
+    ellipse 55% 50% at 50% 52%,
+    color-mix(in srgb, var(--alc-bg) 92%, transparent) 0%,
+    color-mix(in srgb, var(--alc-bg) 78%, transparent) 30%,
+    color-mix(in srgb, var(--alc-bg) 40%, transparent) 60%,
+    transparent 100%
+  );
+}
+
+/* Animated 3D cubic-coordinate tunnel behind the hero, rendered to
+   <canvas>. Sits above the ::before paper grain (z-index: -1) and below
+   the ::after parchment halo + content layer. */
+.alc-hero__bg-graph {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  z-index: 0;
+  pointer-events: none;
+  opacity: 0.9;
+  mix-blend-mode: multiply;
+  color: var(--alc-fg-1);
+  /* Vanishing-point coordinates pushed in from JS once it has measured
+     the Yantra mark. Defaults are the canvas geometric center, so the
+     mask still looks reasonable before the script runs. */
+  --alc-bg-cx: 50%;
+  --alc-bg-cy: 50%;
+  /* Feather around the vanishing point so the animation appears to
+     emanate from the bindu and fades into the parchment at the edges. */
+  -webkit-mask-image: radial-gradient(
+    ellipse 95% 90% at var(--alc-bg-cx) var(--alc-bg-cy),
+    #000 60%,
+    transparent 100%
+  );
+  mask-image: radial-gradient(
+    ellipse 95% 90% at var(--alc-bg-cx) var(--alc-bg-cy),
+    #000 60%,
+    transparent 100%
+  );
+}
+/* In dark mode `multiply` collapses the strokes into the page (cream × dark
+   walnut ≈ dark walnut). Flip to `screen` so the same stroke reads as a
+   light highlight on the dark page. Color is bumped to pure white and
+   opacity raised so the screen-blended markings sit a notch above
+   light-mode visibility — they otherwise read as muted warm cream. */
+[data-theme="dark"] .alc-hero__bg-graph {
+  mix-blend-mode: screen;
+  color: #ffffff;
+  opacity: 1;
+  /* Strokes are drawn at low alpha by the JS (cap ~0.32). Boost the
+     compositing brightness so they read clearly above the dark page. */
+  filter: brightness(3.6);
+}
+/* On phones the hero canvas takes up a much larger fraction of the
+   viewport than on desktop, so the same brightness multiplier plus
+   wide mask makes the mandala bloom over the headline / subtitle and
+   reads as harsher than the dark-mode desktop view. Pull the brightness
+   back, drop opacity, and tighten the mask so strokes feather out well
+   before they reach the type. */
+@media (max-width: 640px) {
+  [data-theme="dark"] .alc-hero__bg-graph {
+    filter: brightness(2.2);
+    opacity: 0.75;
+    -webkit-mask-image: radial-gradient(
+      ellipse 80% 70% at var(--alc-bg-cx) var(--alc-bg-cy),
+      #000 35%,
+      transparent 100%
+    );
+    mask-image: radial-gradient(
+      ellipse 80% 70% at var(--alc-bg-cx) var(--alc-bg-cy),
+      #000 35%,
+      transparent 100%
+    );
+  }
+}
+.alc-hero__inner {
+  position: relative;
+  z-index: 1;
+  text-align: center;
+  max-width: 880px;
+  margin: 0 auto 16px;
+}
+/* Centered alchemical glyph above the title — the "title-page mark"
+   in the spirit of an engraved frontispiece. */
+.alc-hero__mark {
+  display: flex;
+  justify-content: center;
+  margin: 0 auto 18px;
+  color: var(--alc-fg-3);
+  opacity: 0.65;
+}
+.alc-hero__mark svg {
+  display: block;
+}
+.alc-hero__title {
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+  font-size: clamp(40px, 8.4vw, 72px);
+  line-height: 1.04;
+  letter-spacing: -0.02em;
+  margin: 18px 0 0;
+  color: var(--alc-fg-1);
+}
+.alc-hero__subtitle {
+  font-family: var(--alc-font-serif);
+  font-weight: 400;
+  font-size: clamp(18px, 3.4vw, 30px);
+  line-height: 1.25;
+  letter-spacing: -0.005em;
+  margin: 8px auto 32px;
+  color: var(--alc-fg-2);
+  max-width: 780px;
+}
+.alc-hero__cta {
+  display: flex;
+  gap: 10px;
+  justify-content: center;
+  flex-wrap: wrap;
+}
+
+/* ============================================================
+   Responsive overrides for home page sections
+   ============================================================ */
+
+/* Reduce side gutters on small phones. Inline padding on <Section>
+   uses shorthand, so we override via a more-specific selector. */
+@media (max-width: 640px) {
+  section.alc-section {
+    padding-left: 20px !important;
+    padding-right: 20px !important;
+  }
+}
+@media (max-width: 480px) {
+  section.alc-section {
+    padding-left: 16px !important;
+    padding-right: 16px !important;
+  }
+}
+
+/* Fluid section heading */
+.alc-h2 {
+  font-size: clamp(26px, 4.8vw, 34px);
+}
+/* MDX wraps loose text fragments inside JSX headings in <p> tags
+   (e.g. the outro CTA's split "Paste this … to get started" h2 ends
+   up as `<p>…</p><span><p>…</p></span><p>.</p>`). The UA's default
+   1em block margin on those <p>s opens up a big gap between the two
+   wrapped lines. Flatten them back to inline so the heading reads as
+   one piece of text. */
+.alc-h2 p {
+  display: inline;
+  margin: 0;
+}
+/* Prefix ornament on a centered CTA heading sits ABOVE the text as a
+   printer's mark, not inline next to the first word. (The previous
+   behavior — where the ornament happened to land on its own line —
+   was an accidental side-effect of UA <p> margins inside the h2 that
+   we just collapsed.) */
+.alc-cta .alc-h2 > .alc-orn--prefix {
+  display: block;
+  width: 1.4em;
+  height: 1.4em;
+  margin: 0 auto 14px;
+}
+
+/* Hero-scale serif statement used in place of an .alc-h2 + small lede
+   when a section's value-prop reads better as one big sentence. */
+.alc-section-statement {
+  font-family: var(--alc-font-serif);
+  font-weight: 400;
+  font-size: clamp(22px, 3.6vw, 34px);
+  line-height: 1.25;
+  letter-spacing: -0.005em;
+  color: var(--alc-fg-1);
+  max-width: 820px;
+  margin: 12px auto 0;
+}
+
+/* Sub-section heading inside a section (e.g. Effect-pilled / async fetch
+   modes inside the bindings-iam section). */
+.alc-h3 {
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+  font-size: clamp(20px, 2.6vw, 24px);
+  line-height: 1.2;
+  letter-spacing: -0.01em;
+  color: var(--alc-fg-1);
+  margin: 6px 0 0;
+}
+
+/* ============================================================
+   Modes stack — used inside the "Type IAM + env vars" section
+   to present the Effect-pilled (recommended) and async-fetch
+   (escape hatch) sub-sections one above the other. The escape
+   hatch is visually softened so the recommended path leads.
+   ============================================================ */
+
+.alc-modes {
+  display: flex;
+  flex-direction: column;
+  gap: 56px;
+  max-width: 1100px;
+  margin: 0 auto;
+}
+.alc-mode {
+  display: grid;
+  grid-template-columns: minmax(0, 0.9fr) minmax(0, 1.1fr);
+  gap: 28px;
+  align-items: start;
+}
+.alc-mode__head {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  min-width: 0;
+  padding-top: 4px;
+}
+.alc-mode__lede {
+  margin: 0;
+  font-size: 14.5px;
+  line-height: 1.6;
+  color: var(--alc-fg-2);
+}
+.alc-mode__lede code {
+  font-family: var(--alc-font-mono);
+  font-size: 0.92em;
+  color: var(--alc-accent-deep);
+  background: rgba(184, 138, 74, 0.1);
+  padding: 0 4px;
+  border-radius: 3px;
+}
+/* The escape-hatch mode keeps a 2-up code split inside the right column,
+   so on desktop we let it span the full row instead of competing with
+   the head column. Keeps reading order: title → details → 2 code blocks. */
+.alc-mode--escape {
+  grid-template-columns: minmax(0, 1fr);
+  gap: 18px;
+}
+.alc-mode--escape .alc-mode__head {
+  text-align: center;
+  align-items: center;
+  max-width: 760px;
+  margin: 0 auto;
+}
+.alc-mode--escape .alc-mode__lede {
+  text-align: center;
+}
+@media (max-width: 880px) {
+  .alc-mode {
+    grid-template-columns: minmax(0, 1fr);
+    gap: 16px;
+  }
+  .alc-modes {
+    gap: 44px;
+  }
+}
+
+/* ============================================================
+   Dev terminal stage (Hot reload section). Single, centered
+   terminal — narrower than full-width so it doesn't sprawl.
+   ============================================================ */
+.alc-dev-stage {
+  max-width: 880px;
+  margin: 0 auto;
+}
+
+/* ============================================================
+   Browser hot-reload demo (Hot reload section).
+
+   Desktop: two columns — a pseudo browser rendering a sample
+   app on the left, the alchemy dev terminal on the right.
+   They are driven by the same state machine so an edit in the
+   terminal causes the page to reload.
+
+   Mobile (<= 760px): the browser preview is hidden and only the
+   terminal is shown — the rendered app is too small to read on
+   phones, but the terminal narrative still lands.
+   ============================================================ */
+.bhr-stage {
+  display: grid;
+  grid-template-columns: minmax(0, 1.25fr) minmax(0, 1fr);
+  gap: 18px;
+  align-items: stretch;
+  max-width: 1180px;
+  margin: 0 auto;
+}
+.bhr-stage > * {
+  min-width: 0;
+}
+.bhr-term {
+  display: flex;
+  min-width: 0;
+}
+.bhr-term > .alc-term {
+  flex: 1;
+}
+@media (max-width: 760px) {
+  .bhr-stage {
+    grid-template-columns: minmax(0, 1fr);
+  }
+  .bhr-stage > .bhr-browser {
+    display: none;
+  }
+}
+
+/* Pseudo browser chrome. */
+.bhr-browser {
+  display: flex;
+  flex-direction: column;
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline-2);
+  border-radius: 12px;
+  overflow: hidden;
+  box-shadow:
+    0 1px 0 rgba(42, 38, 32, 0.04),
+    0 8px 20px -10px rgba(42, 38, 32, 0.18),
+    0 24px 48px -24px rgba(42, 38, 32, 0.22);
+  min-height: 360px;
+}
+.bhr-browser__header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 12px 10px 14px;
+  background: var(--alc-bg-nav);
+  border-bottom: 1px solid var(--alc-hairline);
+}
+.bhr-browser__nav {
+  display: flex;
+  align-items: center;
+  gap: 2px;
+  margin-left: 6px;
+  color: var(--alc-fg-3);
+  font-size: 14px;
+  line-height: 1;
+}
+.bhr-browser__navbtn {
+  width: 22px;
+  height: 22px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 5px;
+  font-family: var(--alc-font-mono);
+  user-select: none;
+}
+.bhr-browser__navbtn:hover {
+  background: var(--alc-bg-elev-2);
+}
+.bhr-browser__reload.is-spinning {
+  animation: bhr-spin 700ms linear infinite;
+  color: var(--alc-accent-deep);
+}
+@keyframes bhr-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .bhr-browser__reload.is-spinning {
+    animation: none;
+  }
+}
+.bhr-browser__url {
+  flex: 1;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 12px;
+  background: var(--alc-bg-elev-2);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 999px;
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-2);
+  min-width: 0;
+}
+.bhr-browser__lock {
+  color: var(--alc-success);
+  font-size: 8px;
+  line-height: 1;
+}
+.bhr-browser__urlhost {
+  color: var(--alc-fg-1);
+  font-weight: 500;
+}
+.bhr-browser__urlmuted {
+  color: var(--alc-fg-3);
+}
+.bhr-browser__hmr {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  font-size: 10px;
+  letter-spacing: 0.1em;
+  color: var(--alc-accent-deep);
+  font-weight: 600;
+}
+.bhr-browser__hmrdot {
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--alc-accent-bright);
+  box-shadow: 0 0 0 3px var(--alc-accent-12);
+  animation: bhr-pulse 1800ms ease-in-out infinite;
+}
+@keyframes bhr-pulse {
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.35;
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .bhr-browser__hmrdot {
+    animation: none;
+  }
+}
+
+.bhr-browser__body {
+  position: relative;
+  flex: 1;
+  background: var(--alc-bg);
+  padding: 22px 24px 26px;
+  overflow: hidden;
+}
+
+/* Indeterminate top-progress bar shown while the worker rebuilds. */
+.bhr-browser__progress {
+  position: absolute;
+  top: 0;
+  left: 0;
+  height: 2px;
+  width: 40%;
+  background: linear-gradient(
+    90deg,
+    transparent,
+    var(--alc-accent-bright),
+    transparent
+  );
+  animation: bhr-progress 900ms ease-in-out infinite;
+}
+@keyframes bhr-progress {
+  0% {
+    transform: translateX(-100%);
+  }
+  100% {
+    transform: translateX(350%);
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .bhr-browser__progress {
+    animation: none;
+    opacity: 0.4;
+  }
+}
+
+/* Sample "rendered app" inside the browser. */
+.bhr-app {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  animation: bhr-fade-in 280ms ease;
+}
+@keyframes bhr-fade-in {
+  from {
+    opacity: 0;
+    transform: translateY(4px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .bhr-app {
+    animation: none;
+  }
+}
+.bhr-app__header {
+  display: flex;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 12px;
+}
+.bhr-app__eyebrow {
+  font-family: var(--alc-font-mono);
+  font-size: 10px;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--alc-fg-3);
+  margin-bottom: 4px;
+}
+.bhr-app__title {
+  margin: 0;
+  font-family: var(--alc-font-serif, var(--alc-font-sans));
+  font-size: 22px;
+  line-height: 1.15;
+  color: var(--alc-fg-1);
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+.bhr-app__btn {
+  appearance: none;
+  border: 1px solid var(--alc-accent-deep);
+  background: var(--alc-accent-deep);
+  color: var(--alc-fg-on-accent);
+  padding: 6px 12px;
+  border-radius: 6px;
+  font-family: var(--alc-font-sans);
+  font-size: 12px;
+  font-weight: 600;
+  cursor: default;
+  animation: bhr-pop 320ms ease;
+}
+@keyframes bhr-pop {
+  from {
+    opacity: 0;
+    transform: scale(0.92);
+  }
+  to {
+    opacity: 1;
+    transform: scale(1);
+  }
+}
+.bhr-app__grid {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 10px;
+}
+.bhr-tile {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+.bhr-tile__img {
+  aspect-ratio: 1 / 1;
+  border-radius: 8px;
+  background:
+    linear-gradient(135deg, var(--alc-accent-soft), var(--alc-bg-sunk)),
+    var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+}
+.bhr-tile:nth-child(2) .bhr-tile__img {
+  background: linear-gradient(135deg, #d4b888, var(--alc-bg-sunk));
+}
+.bhr-tile:nth-child(3) .bhr-tile__img {
+  background: linear-gradient(
+    135deg,
+    var(--alc-accent-warm),
+    var(--alc-accent-soft)
+  );
+}
+.bhr-tile:nth-child(4) .bhr-tile__img {
+  background: linear-gradient(135deg, #c89a6a, var(--alc-accent-soft));
+}
+.bhr-tile__label {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-3);
+  text-align: center;
+}
+.bhr-tile--ghost {
+  height: 70px;
+  background: var(--alc-bg-sunk);
+  border: 1px dashed var(--alc-hairline-2);
+  border-radius: 8px;
+  opacity: 0.5;
+}
+
+.bhr-app__footer {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-top: 4px;
+  animation: bhr-fade-in 320ms ease;
+}
+.bhr-app__chip {
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-2);
+  background: var(--alc-bg-elev-1);
+  border: 1px solid var(--alc-hairline);
+  padding: 3px 8px;
+  border-radius: 999px;
+}
+.bhr-app__chip strong {
+  color: var(--alc-accent-deep);
+  font-weight: 600;
+}
+
+.bhr-app--boot .bhr-app__skeleton {
+  height: 22px;
+  width: 40%;
+  border-radius: 6px;
+  background: linear-gradient(
+    90deg,
+    var(--alc-bg-sunk),
+    var(--alc-bg-elev-1),
+    var(--alc-bg-sunk)
+  );
+  background-size: 200% 100%;
+  animation: bhr-shimmer 1400ms linear infinite;
+}
+.bhr-app--boot .bhr-app__skeleton--sm {
+  height: 12px;
+  width: 25%;
+  margin-top: 8px;
+}
+@keyframes bhr-shimmer {
+  to {
+    background-position: -200% 0;
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .bhr-app--boot .bhr-app__skeleton {
+    animation: none;
+  }
+}
+
+/* Two-column code+illustration splits */
+.alc-split-2 {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+  gap: 24px;
+  align-items: start;
+  max-width: 1100px;
+  margin: 0 auto;
+}
+.alc-split-2 > * {
+  min-width: 0;
+}
+.alc-split-2--wide-left {
+  grid-template-columns: minmax(0, 1.2fr) minmax(0, 1fr);
+}
+@media (max-width: 880px) {
+  .alc-split-2,
+  .alc-split-2--wide-left {
+    grid-template-columns: minmax(0, 1fr);
+    gap: 18px;
+  }
+}
+
+/* Three-up cards */
+.alc-cards-3 {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 14px;
+  max-width: 1080px;
+  margin: 32px auto 0;
+}
+.alc-cards-3 > * {
+  min-width: 0;
+}
+@media (max-width: 880px) {
+  .alc-cards-3 {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+}
+@media (max-width: 560px) {
+  .alc-cards-3 {
+    display: none;
+  }
+}
+
+/* Two-up small cards (e.g. OTel destinations) */
+.alc-cards-2 {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 10px;
+}
+.alc-cards-2 > * {
+  min-width: 0;
+}
+@media (max-width: 380px) {
+  .alc-cards-2 {
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+@media (max-width: 560px) {
+  .alc-cards-2 {
+    display: none;
+  }
+}
+
+/* Inline "stat strip" — a single row of monospace labels separated
+   by middots. Used in place of card grids when the artifact above
+   already carries the narrative and we just want a tight caption. */
+.alc-stat-strip {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: center;
+  gap: 10px 18px;
+  max-width: 920px;
+  margin: 24px auto 0;
+  padding: 12px 18px;
+  border-top: 1px solid var(--alc-hairline);
+  border-bottom: 1px solid var(--alc-hairline);
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-3);
+  text-align: center;
+}
+.alc-stat-strip__item {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  white-space: nowrap;
+}
+.alc-stat-strip__item strong {
+  color: var(--alc-fg-1);
+  font-weight: 600;
+}
+.alc-stat-strip__item code {
+  color: var(--alc-accent-deep);
+  background: rgba(184, 138, 74, 0.1);
+  padding: 0 4px;
+  border-radius: 3px;
+  font-size: 11.5px;
+}
+.alc-stat-strip__sep {
+  color: var(--alc-hairline-2);
+}
+@media (max-width: 560px) {
+  .alc-stat-strip {
+    font-size: 11.5px;
+    padding: 10px 12px;
+  }
+  .alc-stat-strip__sep {
+    display: none;
+  }
+}
+
+/* Local-dev right-hand card column: fills space at >tablet, then
+   becomes 2-up on tablet, then a single column on phones. */
+.alc-card-stack {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+  min-width: 0;
+}
+.alc-card-stack > * {
+  min-width: 0;
+}
+@media (max-width: 880px) {
+  .alc-card-stack {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+}
+@media (max-width: 560px) {
+  .alc-card-stack {
+    display: none;
+  }
+}
+
+/* ============================================================
+   Bindings -> IAM mobile additions
+   When the arrows column is hidden (<=980px), each resource card
+   shows its IAM action inline so the binding -> permission
+   relationship isn't lost.
+   ============================================================ */
+
+.bindings-iam__resource-iam {
+  display: none;
+  font-family: var(--alc-font-mono);
+  font-size: 10.5px;
+  color: var(--alc-fg-3);
+  margin-top: 4px;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.bindings-iam__resource-iam[data-stream] {
+  font-style: italic;
+}
+
+@media (max-width: 980px) {
+  .bindings-iam__resource-iam {
+    display: block;
+  }
+  .bindings-iam__code .alc-code-block__pre {
+    font-size: 11.5px;
+    padding: 14px 14px;
+  }
+}
+
+/* ============================================================
+   Outro: copy-prompt-for-coding-agent pill.
+   ============================================================ */
+
+.alc-copy-agent {
+  position: relative;
+  max-width: 720px;
+  margin: 24px auto 0;
+  background: var(--alc-bg-sunk);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  text-align: left;
+}
+.alc-copy-agent__text {
+  display: block;
+  /* Reserve space at the right edge so long prompt lines never run
+     under the floating copy icon. */
+  padding: 12px 52px 12px 16px;
+  font-family: var(--alc-font-mono);
+  font-size: 13.5px;
+  line-height: 1.5;
+  color: var(--alc-fg-1);
+  background: transparent;
+  border: 0;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  text-align: left;
+  max-height: 240px;
+  overflow-y: auto;
+}
+.alc-copy-agent__btn {
+  position: absolute;
+  top: 8px;
+  right: 8px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 32px;
+  height: 32px;
+  padding: 0;
+  background: transparent;
+  border: 1px solid transparent;
+  border-radius: 8px;
+  color: var(--alc-fg-3);
+  cursor: pointer;
+  transition:
+    color 120ms ease,
+    background 120ms ease,
+    border-color 120ms ease;
+}
+.alc-copy-agent__btn:hover {
+  color: var(--alc-accent-deep);
+  background: var(--alc-bg-elev-1);
+  border-color: var(--alc-hairline-2);
+}
+.alc-copy-agent__btn:focus-visible {
+  outline: 2px solid var(--alc-accent-40);
+  outline-offset: 2px;
+}
+
+/* ============================================================
+   Button styles (also defined scoped in Button.astro). Copied
+   here so React islands can render the same look.
+   ============================================================ */
+
+.alc-btn {
+  font-family: var(--alc-font-sans);
+  font-size: 14px;
+  font-weight: 500;
+  padding: 10px 18px;
+  border-radius: 8px;
+  border: 1px solid transparent;
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  white-space: nowrap;
+  cursor: pointer;
+  text-decoration: none;
+  transition:
+    background 120ms var(--alc-ease, cubic-bezier(0.2, 0, 0, 1)),
+    border-color 120ms var(--alc-ease, cubic-bezier(0.2, 0, 0, 1)),
+    color 120ms var(--alc-ease, cubic-bezier(0.2, 0, 0, 1));
+}
+.alc-btn--primary {
+  background: var(--alc-accent);
+  color: var(--alc-fg-on-accent);
+}
+.alc-btn--primary:hover {
+  background: var(--alc-accent-deep);
+}
+.alc-btn--secondary {
+  background: transparent;
+  border-color: var(--alc-hairline-3);
+  color: var(--alc-fg-1);
+}
+.alc-btn--secondary:hover {
+  border-color: var(--alc-accent);
+  color: var(--alc-accent-deep);
+}
+.alc-btn--ghost {
+  background: transparent;
+  color: var(--alc-fg-2);
+}
+.alc-btn--ghost:hover {
+  color: var(--alc-accent-deep);
+}
+.alc-btn--accent {
+  background: var(--alc-terracotta);
+  color: var(--alc-fg-on-accent);
+}
+
+/* ============================================================
+   Hero CTA — two-up "for humans / for coding agents".
+   Tight: eyebrow + single content row.
+   ============================================================ */
+
+.hero-cta {
+  display: grid;
+  grid-template-columns: minmax(160px, 0.7fr) 1fr;
+  gap: 10px;
+  max-width: 520px;
+  margin: 6px auto 0;
+  text-align: left;
+}
+.hero-cta__card {
+  display: flex;
+  flex-direction: column;
+  justify-content: space-between;
+  gap: 4px;
+  padding: 10px 14px;
+  min-width: 0;
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  text-decoration: none;
+  color: inherit;
+  cursor: pointer;
+  font-family: var(--alc-font-sans);
+  text-align: left;
+  background: var(--alc-bg-sunk);
+  /* The CTA cards sit directly on the hero mandala, and their tint
+     fills are translucent so the pattern bleeds through. Blur what
+     sits behind so the card text stays readable — same approach as
+     the marketing header. */
+  backdrop-filter: saturate(140%) blur(8px);
+  -webkit-backdrop-filter: saturate(140%) blur(8px);
+  transition:
+    border-color 140ms ease,
+    transform 140ms ease;
+}
+.hero-cta__card:hover {
+  transform: translateY(-1px);
+}
+.hero-cta__eyebrow {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  font-size: 10.5px;
+  font-weight: 600;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--alc-fg-3);
+}
+.hero-cta__icon {
+  display: inline-flex;
+  align-items: center;
+  color: var(--alc-fg-2);
+}
+.hero-cta__title {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 15px;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+}
+.hero-cta__card--human {
+  background: var(--alc-accent-soft);
+  border-color: var(--alc-accent);
+}
+.hero-cta__card--human:hover {
+  border-color: var(--alc-accent-deep);
+}
+.hero-cta__card--agent {
+  background: var(--alc-terracotta-soft);
+  border-color: var(--alc-terracotta);
+}
+.hero-cta__card--agent:hover {
+  border-color: var(--alc-terracotta-deep);
+}
+.hero-cta__prompt-code {
+  display: block;
+  min-width: 0;
+  max-width: 100%;
+  font-family: var(--alc-font-mono);
+  font-size: 11.5px;
+  line-height: 1.4;
+  color: var(--alc-fg-2);
+  background: transparent;
+  border: 0;
+  padding: 0;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.hero-cta--simple {
+  display: none;
+}
+
+@media (max-width: 640px) {
+  .hero-cta--cards {
+    display: none;
+  }
+  .hero-cta--simple {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 12px;
+    margin-top: 6px;
+  }
+}
+
+.hero-cta__buttons {
+  display: inline-flex;
+  gap: 10px;
+  flex-wrap: wrap;
+  justify-content: center;
+}
+.hero-cta__line {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  font-size: 13px;
+  color: var(--alc-fg-3);
+}
+.hero-cta__chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 5px 10px;
+  background: var(--alc-bg-sunk);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 6px;
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  color: var(--alc-fg-1);
+  cursor: pointer;
+  transition:
+    color 120ms ease,
+    border-color 120ms ease;
+}
+.hero-cta__chip:hover {
+  color: var(--alc-accent-deep);
+  border-color: var(--alc-accent);
+}
diff --git a/.repos/alchemy-effect/website/src/styles/privacy.css b/.repos/alchemy-effect/website/src/styles/privacy.css
new file mode 100644
index 00000000000..7bc86e601d4
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/styles/privacy.css
@@ -0,0 +1,97 @@
+.alc-privacy {
+  max-width: 760px;
+  margin: 0 auto;
+  padding: 56px 24px 80px;
+  color: var(--alc-fg-2);
+  font-size: 15px;
+  line-height: 1.7;
+}
+.alc-privacy h1 {
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+  font-size: 44px;
+  line-height: 1.1;
+  letter-spacing: -0.02em;
+  color: var(--alc-fg-1);
+  margin: 0 0 28px;
+}
+.alc-privacy h2 {
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+  font-size: 26px;
+  color: var(--alc-fg-1);
+  margin: 44px 0 14px;
+  letter-spacing: -0.01em;
+}
+.alc-privacy h3 {
+  font-family: var(--alc-font-sans);
+  font-weight: 600;
+  font-size: 16px;
+  color: var(--alc-fg-1);
+  margin: 28px 0 10px;
+}
+.alc-privacy p {
+  margin: 0 0 16px;
+}
+.alc-privacy a {
+  color: var(--alc-accent-deep);
+  text-decoration: none;
+}
+.alc-privacy a:hover {
+  text-decoration: underline;
+  text-underline-offset: 3px;
+}
+.alc-privacy ul {
+  padding-left: 22px;
+  margin: 0 0 18px;
+}
+.alc-privacy li {
+  margin: 6px 0;
+}
+.alc-privacy code {
+  font-family: var(--alc-font-mono);
+  font-size: 0.88em;
+  background: var(--alc-bg-code);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 4px;
+  padding: 1px 5px;
+}
+.alc-privacy pre {
+  background: var(--alc-bg-code);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 8px;
+  padding: 14px 16px;
+  overflow-x: auto;
+  font-size: 13px;
+  line-height: 1.55;
+  margin: 0 0 18px;
+}
+.alc-privacy pre code {
+  background: transparent;
+  border: 0;
+  padding: 0;
+}
+.alc-privacy table {
+  width: 100%;
+  border-collapse: collapse;
+  margin: 0 0 22px;
+  font-size: 14px;
+}
+.alc-privacy th,
+.alc-privacy td {
+  text-align: left;
+  vertical-align: top;
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--alc-hairline);
+}
+.alc-privacy th {
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--alc-fg-4);
+  font-weight: 500;
+}
+.alc-privacy strong {
+  color: var(--alc-fg-1);
+}
diff --git a/.repos/alchemy-effect/website/src/styles/terminal.css b/.repos/alchemy-effect/website/src/styles/terminal.css
new file mode 100644
index 00000000000..6e2f478a71a
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/styles/terminal.css
@@ -0,0 +1,62 @@
+/* ============================================================
+   Terminal chrome — shared by marketing islands (DeployTerminal,
+   DevTerminal, StateStoreBootstrap, …) on the marketing layout
+   and when embedded in docs MDX. Imported from both
+   global.css (docs) and marketing.css (marketing) so a single
+   source of truth styles either context.
+
+   The React/Astro components carry `.not-content` so Starlight's
+   prose plugin leaves them alone in docs.
+   ============================================================ */
+
+.alc-term {
+  background: var(--alc-bg-code);
+  border: 1px solid var(--alc-hairline);
+  border-radius: 10px;
+  overflow: hidden;
+  box-shadow: var(--alc-shadow-sm);
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  max-width: 100%;
+}
+.alc-term__header {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 10px 14px;
+  border-bottom: 1px solid rgba(232, 220, 192, 0.08);
+  background: rgba(255, 255, 255, 0.02);
+}
+.alc-term__title {
+  margin-left: 10px;
+  font-family: var(--alc-font-mono);
+  font-size: 11px;
+  color: var(--alc-code-comment);
+}
+.alc-term__body {
+  margin: 0;
+  padding: 14px 18px;
+  font-family: var(--alc-font-mono);
+  font-size: 12.5px;
+  line-height: 1.65;
+  color: var(--alc-code-var);
+  white-space: pre-wrap;
+  background: transparent;
+  border: none;
+  border-radius: 0;
+  min-height: 296px;
+}
+.alc-term .alc-code-block__dot {
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+
+/* Docs MDX context: Starlight wraps content in `.sl-markdown-content`
+   which adds vertical rhythm to direct children. Re-add a small
+   margin so embedded terminals breathe like other block elements. */
+.sl-markdown-content > .alc-term {
+  margin: 1rem 0;
+}
diff --git a/.repos/alchemy-effect/website/src/styles/tokens.css b/.repos/alchemy-effect/website/src/styles/tokens.css
new file mode 100644
index 00000000000..640fa6f3bbb
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/styles/tokens.css
@@ -0,0 +1,363 @@
+/* ============================================================
+   Alchemy Design System — Colors & Type
+   Sunny-forest palette: warm cream parchment, muted moss green,
+   terracotta accents, walnut browns. Light mode, earthy, calm.
+   ============================================================ */
+
+@import url("https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=Source+Serif+4:opsz,wght@8..60,400;8..60,500;8..60,600;8..60,700&family=JetBrains+Mono:wght@400;500;600&family=Caveat:wght@500;600;700&display=swap");
+
+/* Tinos (Apache 2.0, Steve Matteson / Ascender / Google) — metrically
+   compatible with Times New Roman. Self-hosted because we use it as a
+   pinned target for specific glyphs (currently just the marketing
+   arrow `→` U+2192). The OG image renderer reads the same TTF from
+   `assets/fonts/Tinos-Regular.ttf` so the website and the OG card
+   render that glyph from the same face. unicode-range scopes the
+   download so it only fires when a Tinos glyph actually appears. */
+@font-face {
+  font-family: "Tinos";
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url("/fonts/Tinos-Regular.ttf") format("truetype");
+  unicode-range: U+2192; /* → only — keep payload focused */
+}
+
+:root {
+  /* ---------- Brand: muted forest greens ---------- */
+  --alc-accent: #5c7a3e; /* moss — primary brand */
+  --alc-accent-deep: #3f5a2a; /* deep forest — pressed/emphasis */
+  --alc-accent-warm: #7a9a5e; /* sage — lighter, sunny */
+  --alc-accent-bright: #8fb15e; /* lit leaves — accents on cream */
+  /* Translucent so surfaces using `accent-soft` (hero CTA cards, asides,
+     selection) let the underlying texture show through — same approach
+     as the dark-mode token below. */
+  --alc-accent-soft: color-mix(in srgb, #5c7a3e 18%, transparent);
+  --alc-accent-60: color-mix(in srgb, #5c7a3e 60%, transparent);
+  --alc-accent-40: color-mix(in srgb, #5c7a3e 40%, transparent);
+  --alc-accent-12: color-mix(in srgb, #5c7a3e 12%, transparent);
+
+  /* Bindu (yantra centroid dot) — deep moss in light mode. The dark
+     block overrides this to terracotta so the brand mark gets a warm
+     focal point against the dark page. */
+  --alc-yantra-dot: #3f5a2a;
+
+  /* ---------- Secondary: warm terracotta ---------- */
+  --alc-terracotta: #c56e3c;
+  --alc-terracotta-deep: #9a4f27;
+  --alc-terracotta-soft: color-mix(in srgb, #c56e3c 18%, transparent);
+
+  /* ---------- Surfaces (warm cream / parchment) ---------- */
+  --alc-bg: #f5efe3; /* page — parchment */
+  --alc-bg-nav: #efe7d6; /* nav, sidebar — a touch deeper */
+  --alc-bg-elev-1: #fbf6ea; /* cards, panels — lifted, paper */
+  --alc-bg-elev-2: #fffaf0; /* hover / nested */
+  --alc-bg-code: #2a2620; /* terminal / code blocks — walnut */
+  --alc-bg-sunk: #ebe3d0; /* insets */
+
+  /* ---------- Neutrals (warm walnut scale) ---------- */
+  --alc-walnut-50: #faf6ec;
+  --alc-walnut-100: #f1ead8;
+  --alc-walnut-200: #e2d7bc;
+  --alc-walnut-300: #c7b795;
+  --alc-walnut-400: #a89572;
+  --alc-walnut-500: #85714f;
+  --alc-walnut-600: #68573c;
+  --alc-walnut-700: #4e402c;
+  --alc-walnut-800: #363022;
+  --alc-walnut-900: #2a2620;
+  --alc-walnut-950: #1a1813;
+
+  /* ---------- Text ---------- */
+  --alc-fg-1: #2a2620; /* primary — walnut */
+  --alc-fg-2: #4e402c; /* body — deep tan */
+  --alc-fg-3: #85714f; /* muted — mushroom */
+  --alc-fg-4: #a89572; /* tertiary / captions */
+  --alc-fg-invert: #fbf6ea; /* on dark (code/term) */
+  --alc-fg-on-accent: #fbf6ea; /* on moss */
+
+  /* ---------- Hairlines / borders ---------- */
+  --alc-hairline: rgba(42, 38, 32, 0.08);
+  --alc-hairline-2: rgba(42, 38, 32, 0.14);
+  --alc-hairline-3: rgba(42, 38, 32, 0.22);
+
+  /* ---------- Semantic (status) — earthy ---------- */
+  --alc-success: #5c7a3e; /* plan: create — moss */
+  --alc-warn: #d49a2a; /* plan: update — honey */
+  --alc-danger: #b3462e; /* plan: replace / destroy — brick */
+  --alc-info: #4a7a8a; /* info — slate teal */
+  --alc-muted: #a89572; /* dim text */
+
+  /* ---------- Syntax (on walnut bg, SUNRISE — bright & distinct) ---------- */
+  --alc-code-keyword: #d4f26a; /* electric spring green — keywords, export, const */
+  --alc-code-string: #ffe38a; /* bright honey — strings */
+  --alc-code-fn: #ffb968; /* sunrise amber — function calls */
+  --alc-code-type: #7ddfff; /* sky cyan — types */
+  --alc-code-comment: #b3a27a; /* bright readable tan */
+  --alc-code-var: #faf5e3; /* near-white parchment — identifiers */
+  --alc-code-literal: #ff9a6b; /* coral sunrise — numbers/literals */
+
+  /* ---------- Type ---------- */
+  --alc-font-sans:
+    "Inter", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+  --alc-font-serif:
+    "Source Serif 4", "Tinos", "Source Serif Pro", Georgia, "Times New Roman",
+    serif;
+  --alc-font-mono:
+    "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+  --alc-font-hand:
+    "Caveat", "Comic Sans MS", cursive; /* hand-drawn diagram labels */
+
+  /* ---------- Radius ---------- */
+  --alc-radius-xs: 2px;
+  --alc-radius-sm: 4px;
+  --alc-radius: 8px;
+  --alc-radius-md: 10px;
+  --alc-radius-lg: 12px;
+  --alc-radius-xl: 16px;
+
+  /* ---------- Spacing (4px grid) ---------- */
+  --alc-space-1: 4px;
+  --alc-space-2: 8px;
+  --alc-space-3: 12px;
+  --alc-space-4: 16px;
+  --alc-space-5: 24px;
+  --alc-space-6: 32px;
+  --alc-space-7: 48px;
+  --alc-space-8: 64px;
+  --alc-space-9: 96px;
+
+  /* ---------- Shadows (warm, soft) ---------- */
+  --alc-shadow-sm: 0 1px 2px rgba(78, 64, 44, 0.08);
+  --alc-shadow: 0 4px 14px rgba(78, 64, 44, 0.1);
+  --alc-shadow-lg: 0 20px 40px rgba(78, 64, 44, 0.14);
+  --alc-glow:
+    0 0 0 1px var(--alc-accent-40), 0 0 24px -4px var(--alc-accent-40);
+
+  /* ---------- Motion ---------- */
+  --alc-ease: cubic-bezier(0.2, 0, 0, 1);
+  --alc-dur-fast: 120ms;
+  --alc-dur: 180ms;
+  --alc-dur-slow: 320ms;
+}
+
+/* ============================================================
+   Dark mode — "night forest, walnut interior".
+   Same warm/earthy logic as light, inverted around the walnut
+   scale. The page joins the dark code-block surface; cream
+   becomes the text scale; moss & terracotta lift one step so
+   they read on dark.
+   ============================================================ */
+
+[data-theme="dark"] {
+  /* Brand: lifted moss for emphasis on dark walnut */
+  --alc-accent: #7a9a5e;
+  --alc-accent-deep: #a3c473; /* emphasis / text-accent — lifted, not darkened */
+  --alc-accent-warm: #8fb15e;
+  --alc-accent-bright: #b3d188;
+  --alc-accent-soft: color-mix(in srgb, #7a9a5e 22%, transparent);
+  --alc-accent-60: color-mix(in srgb, #a3c473 60%, transparent);
+  --alc-accent-40: color-mix(in srgb, #a3c473 40%, transparent);
+  --alc-accent-12: color-mix(in srgb, #a3c473 18%, transparent);
+
+  /* Bindu pops in terracotta against the dark page. */
+  --alc-yantra-dot: #c56e3c;
+
+  /* Secondary: warm terracotta — lifted */
+  --alc-terracotta: #d8835a;
+  --alc-terracotta-deep: #e89a72;
+  --alc-terracotta-soft: color-mix(in srgb, #d8835a 20%, transparent);
+
+  /* Surfaces — page joins the code-block aesthetic. In dark mode the
+     code surface LIFTS above the page (vs. light mode where it sinks),
+     so terminal/code chrome still reads as a distinct card on the page. */
+  --alc-bg: #14110d;
+  --alc-bg-nav: #1a1613;
+  --alc-bg-elev-1: #221e18;
+  --alc-bg-elev-2: #2a2620;
+  --alc-bg-code: #2a2620; /* same as light-mode code surface — chrome/syntax tuning carries over */
+  --alc-bg-sunk: #100c08;
+
+  /* Text — cream scale */
+  --alc-fg-1: #faf6ec; /* primary — parchment */
+  --alc-fg-2: #e2d7bc; /* body — washed parchment */
+  --alc-fg-3: #a89572; /* muted — walnut-400 still reads */
+  --alc-fg-4: #85714f; /* tertiary / captions */
+  /* `--alc-fg-invert` is text on the dark code surface, which stays dark in
+     both modes — so this token is the same in light and dark. */
+  --alc-fg-invert: #fbf6ea;
+  --alc-fg-on-accent: #fbf6ea;
+
+  /* Hairlines — cream over walnut */
+  --alc-hairline: rgba(250, 246, 236, 0.08);
+  --alc-hairline-2: rgba(250, 246, 236, 0.14);
+  --alc-hairline-3: rgba(250, 246, 236, 0.22);
+
+  /* Semantic — lifted on dark for AA contrast */
+  --alc-success: #8fb15e;
+  --alc-warn: #e8b04a;
+  --alc-danger: #d76a4e;
+  --alc-info: #6da4b4;
+  --alc-muted: #85714f;
+
+  /* Shadows — heavier black, less warmth shows through */
+  --alc-shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.4);
+  --alc-shadow: 0 4px 14px rgba(0, 0, 0, 0.5);
+  --alc-shadow-lg: 0 20px 40px rgba(0, 0, 0, 0.6);
+  --alc-glow:
+    0 0 0 1px var(--alc-accent-40), 0 0 24px -4px var(--alc-accent-40);
+}
+
+/* ============================================================
+   Semantic text styles
+   ============================================================ */
+
+.alc-display {
+  font-family: var(--alc-font-serif);
+  font-size: 76px;
+  line-height: 1.02;
+  letter-spacing: -0.02em;
+  font-weight: 500;
+  color: var(--alc-fg-1);
+}
+
+.alc-h1 {
+  font-family: var(--alc-font-serif);
+  font-size: 52px;
+  line-height: 1.06;
+  letter-spacing: -0.015em;
+  font-weight: 500;
+  color: var(--alc-fg-1);
+}
+
+.alc-h2 {
+  font-family: var(--alc-font-serif);
+  font-size: 34px;
+  line-height: 1.15;
+  letter-spacing: -0.01em;
+  font-weight: 500;
+  color: var(--alc-fg-1);
+}
+
+.alc-h3 {
+  font-family: var(--alc-font-sans);
+  font-size: 22px;
+  line-height: 1.25;
+  letter-spacing: -0.01em;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+}
+
+.alc-h4 {
+  font-family: var(--alc-font-sans);
+  font-size: 17px;
+  line-height: 1.35;
+  font-weight: 600;
+  color: var(--alc-fg-1);
+}
+
+.alc-eyebrow {
+  font-family: var(--alc-font-mono);
+  font-size: 12px;
+  line-height: 1;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  font-weight: 500;
+  color: var(--alc-accent-deep);
+}
+
+.alc-body-lg {
+  font-family: var(--alc-font-sans);
+  font-size: 18px;
+  line-height: 1.6;
+  font-weight: 400;
+  color: var(--alc-fg-2);
+}
+
+.alc-body {
+  font-family: var(--alc-font-sans);
+  font-size: 15px;
+  line-height: 1.6;
+  font-weight: 400;
+  color: var(--alc-fg-2);
+}
+
+.alc-small {
+  font-family: var(--alc-font-sans);
+  font-size: 13px;
+  line-height: 1.5;
+  color: var(--alc-fg-3);
+}
+
+.alc-caption {
+  font-family: var(--alc-font-sans);
+  font-size: 12px;
+  line-height: 1.4;
+  color: var(--alc-fg-4);
+}
+
+.alc-code {
+  font-family: var(--alc-font-mono);
+  font-size: 14px;
+  line-height: 1.55;
+  font-variant-ligatures: none;
+  color: var(--alc-fg-invert);
+}
+
+.alc-code-inline {
+  font-family: var(--alc-font-mono);
+  font-size: 0.9em;
+  padding: 0.12em 0.38em;
+  border-radius: var(--alc-radius-sm);
+  background: var(--alc-bg-sunk);
+  border: 1px solid var(--alc-hairline);
+  color: var(--alc-fg-1);
+  white-space: nowrap;
+  vertical-align: baseline;
+}
+
+/* In large headings the inline-code pill's padding + border makes the box
+   taller than the heading's line-height, so it visually clips into adjacent
+   lines. Shrink it slightly and align to baseline so it sits cleanly. */
+h1 .alc-code-inline,
+h2 .alc-code-inline,
+h3 .alc-code-inline {
+  font-size: 0.78em;
+  padding: 0.08em 0.34em;
+  vertical-align: 0.04em;
+  line-height: 1;
+}
+
+.alc-hand {
+  font-family: var(--alc-font-hand);
+  font-size: 40px;
+  line-height: 1;
+  font-weight: 600;
+  color: var(--alc-accent-deep);
+}
+
+.alc-text-accent {
+  color: var(--alc-accent-deep);
+  font-style: italic;
+  font-family: var(--alc-font-serif);
+  font-weight: 500;
+}
+
+/* ============================================================
+   Body defaults
+   ============================================================ */
+
+body.alc-root,
+.alc-root {
+  background: var(--alc-bg);
+  color: var(--alc-fg-2);
+  font-family: var(--alc-font-sans);
+  font-size: 15px;
+  line-height: 1.6;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+::selection {
+  background: var(--alc-accent-soft);
+  color: var(--alc-fg-1);
+}
diff --git a/.repos/alchemy-effect/website/src/versions.ts b/.repos/alchemy-effect/website/src/versions.ts
new file mode 100644
index 00000000000..aca0942e47c
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/versions.ts
@@ -0,0 +1,5 @@
+import rootPkg from "../../package.json" with { type: "json" };
+import alchemyPkg from "../../packages/alchemy/package.json" with { type: "json" };
+
+export const alchemyVersion = alchemyPkg.version;
+export const effectVersion = rootPkg.workspaces.catalog.effect;
diff --git a/.repos/alchemy-effect/website/src/worker.ts b/.repos/alchemy-effect/website/src/worker.ts
new file mode 100644
index 00000000000..940f0b3effb
--- /dev/null
+++ b/.repos/alchemy-effect/website/src/worker.ts
@@ -0,0 +1,154 @@
+import type { WorkerEnv } from "../alchemy.run.ts";
+
+// Minimal `HTMLRewriter` shape — the workers runtime exposes it as a
+// global, but we don't pull in `@cloudflare/workers-types`, so declare
+// just what this file uses.
+declare class HTMLRewriter {
+  on(
+    selector: string,
+    handler: { element(el: HTMLRewriterElement): void },
+  ): HTMLRewriter;
+  transform(response: Response): Response;
+}
+interface HTMLRewriterElement {
+  getAttribute(name: string): string | null;
+  setAttribute(name: string, value: string): HTMLRewriterElement;
+}
+
+/**
+ * Astro bakes absolute URLs into `<meta property="og:image">`,
+ * `og:url`, `twitter:image`, and `<link rel="canonical">` at build time
+ * using the `site` config (`https://v2.alchemy.run`). PR previews and
+ * custom domains then advertise OG / canonical URLs that point back at
+ * the canonical host — so a Slack/Twitter unfurl of a preview URL
+ * fetches the *production* card, not the one for the page being
+ * shared.
+ *
+ * Rewrite those tags at the edge to match the request's actual host so
+ * each deployment unfurls itself.
+ */
+const CANONICAL_HOST = "v2.alchemy.run";
+
+export default {
+  fetch: async (request: Request, env: WorkerEnv) => {
+    if (request.method === "GET" && prefersMarkdown(request)) {
+      const mdUrl = toMarkdownUrl(new URL(request.url)).toString();
+      const res = await env.ASSETS.fetch(new Request(mdUrl, request));
+      // Astro's asset server labels `.md` as `application/octet-stream`, which
+      // agents treat as a binary download instead of rendering. Force the
+      // correct text type + charset since this branch only ever serves markdown.
+      if (res.status !== 404)
+        return withContentType(res, "text/markdown; charset=utf-8");
+    }
+    const res = await env.ASSETS.fetch(request);
+    return withUtf8Charset(rewriteCanonicalHost(request, res));
+  },
+};
+
+/**
+ * Astro's static asset server labels `.txt` as `text/plain` with no charset.
+ * UTF-8 bytes (em dashes, arrows in our docs and `llms.txt`) then get decoded
+ * as latin-1 by browsers and agents, showing up as mojibake (`â€"`). Stamp
+ * `charset=utf-8` on text responses that omit it.
+ */
+const withUtf8Charset = (res: Response): Response => {
+  const ct = res.headers.get("content-type");
+  if (!ct || !ct.startsWith("text/") || /charset=/i.test(ct)) return res;
+  return withContentType(res, `${ct}; charset=utf-8`);
+};
+
+const withContentType = (res: Response, contentType: string): Response => {
+  const next = new Response(res.body, res);
+  next.headers.set("content-type", contentType);
+  return next;
+};
+
+const rewriteCanonicalHost = (request: Request, res: Response): Response => {
+  const ct = res.headers.get("content-type") ?? "";
+  if (!ct.includes("text/html")) return res;
+  const reqUrl = new URL(request.url);
+  if (reqUrl.host === CANONICAL_HOST) return res;
+
+  class HostRewriter {
+    attr: "content" | "href";
+    constructor(attr: "content" | "href") {
+      this.attr = attr;
+    }
+    element(el: HTMLRewriterElement) {
+      const value = el.getAttribute(this.attr);
+      if (!value) return;
+      let u: URL;
+      try {
+        u = new URL(value);
+      } catch {
+        return;
+      }
+      if (u.host !== CANONICAL_HOST) return;
+      u.protocol = reqUrl.protocol;
+      u.host = reqUrl.host;
+      el.setAttribute(this.attr, u.toString());
+    }
+  }
+
+  const content = new HostRewriter("content");
+  const href = new HostRewriter("href");
+
+  return new HTMLRewriter()
+    .on('meta[property="og:image"]', content)
+    .on('meta[property="og:url"]', content)
+    .on('meta[name="twitter:image"]', content)
+    .on('link[rel="canonical"]', href)
+    .transform(res);
+};
+
+/**
+ * Returns true if the accept header prefers markdown or plain text over HTML.
+ *
+ * Examples:
+ * - opencode - accept: text/markdown;q=1.0, text/x-markdown;q=0.9, text/plain;q=0.8, text/html;q=0.7, *\/*;q=0.1
+ * - claude code - accept: application/json, text/plain, *\/*
+ *
+ * Notes:
+ * - ChatGPT and Claude web don't set an accept header; maybe check the user agent instead?
+ * - Cursor's headers are too generic (accept: *, user-agent: https://github.com/sindresorhus/got)
+ */
+const prefersMarkdown = (request: Request) => {
+  const accept = request.headers.get("accept");
+  if (!accept) return false;
+
+  // parse accept header and sort by quality; highest quality first
+  const types = accept
+    .split(",")
+    .map((part) => {
+      const type = part.split(";")[0].trim();
+      const q = part.match(/q=([^,]+)/)?.[1];
+      return { type, q: q ? Number.parseFloat(q) : 1 };
+    })
+    .sort((a, b) => b.q - a.q)
+    .map((type) => type.type);
+
+  const markdown = types.indexOf("text/markdown");
+  const plain = types.indexOf("text/plain");
+  const html = types.indexOf("text/html");
+
+  // if no HTML is specified, and either markdown or plain text is specified, prefer markdown
+  if (html === -1) {
+    return markdown !== -1 || plain !== -1;
+  }
+
+  // prefer markdown if higher quality than HTML
+  if ((markdown !== -1 && markdown < html) || (plain !== -1 && plain < html)) {
+    return true;
+  }
+
+  // otherwise, prefer HTML
+  return false;
+};
+
+function toMarkdownUrl(url: URL): URL {
+  const md = new URL(url.toString());
+  let p = md.pathname.replace(/\/$/, "");
+  if (p === "") p = "/index";
+  md.pathname = `${p}.md`;
+  return md;
+}
diff --git a/.repos/alchemy-effect/website/tsconfig.json b/.repos/alchemy-effect/website/tsconfig.json
new file mode 100644
index 00000000000..b53a42e2b64
--- /dev/null
+++ b/.repos/alchemy-effect/website/tsconfig.json
@@ -0,0 +1,13 @@
+{
+  "extends": "astro/tsconfigs/strict",
+  "include": ["src/**/*", "alchemy.run.ts", ".astro/*.d.ts"],
+  "compilerOptions": {
+    "noEmit": true,
+    "types": ["astro/client"]
+  },
+  "references": [
+    {
+      "path": "../packages/alchemy/tsconfig.json"
+    }
+  ]
+}
diff --git a/AGENTS.md b/AGENTS.md
index cc18486464f..df9441bc105 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -67,3 +67,5 @@ agents.
   `.repos/` matches the installed dependency version.
 - When writing Effect code, read `.repos/effect-smol/LLMS.md` first and inspect `.repos/effect-smol/` for
   examples of idiomatic usage, tests, module structure, and API design.
+- When writing relay infrastructure code with Alchemy, inspect `.repos/alchemy-effect/` for examples of
+  idiomatic usage, tests, module structure, and API design.
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 2e84e4255d4..74651036320 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -16,6 +16,7 @@
   },
   "dependencies": {
     "@effect/platform-node": "catalog:",
+    "@t3tools/client-runtime": "workspace:*",
     "@t3tools/contracts": "workspace:*",
     "@t3tools/shared": "workspace:*",
     "@t3tools/ssh": "workspace:*",
diff --git a/apps/desktop/src/ipc/DesktopIpcHandlers.ts b/apps/desktop/src/ipc/DesktopIpcHandlers.ts
index 8717c877951..d0b08c8dac7 100644
--- a/apps/desktop/src/ipc/DesktopIpcHandlers.ts
+++ b/apps/desktop/src/ipc/DesktopIpcHandlers.ts
@@ -22,7 +22,7 @@ import {
   ensureSshEnvironment,
   fetchSshEnvironmentDescriptor,
   fetchSshSessionState,
-  issueSshWebSocketToken,
+  issueSshWebSocketTicket,
   resolveSshPasswordPrompt,
 } from "./methods/sshEnvironment.ts";
 import {
@@ -62,7 +62,7 @@ export const installDesktopIpcHandlers = Effect.gen(function* () {
   yield* ipc.handle(fetchSshEnvironmentDescriptor);
   yield* ipc.handle(bootstrapSshBearerSession);
   yield* ipc.handle(fetchSshSessionState);
-  yield* ipc.handle(issueSshWebSocketToken);
+  yield* ipc.handle(issueSshWebSocketTicket);
   yield* ipc.handle(resolveSshPasswordPrompt);
 
   yield* ipc.handle(getServerExposureState);
diff --git a/apps/desktop/src/ipc/methods/sshEnvironment.test.ts b/apps/desktop/src/ipc/methods/sshEnvironment.test.ts
new file mode 100644
index 00000000000..fa53486d5e2
--- /dev/null
+++ b/apps/desktop/src/ipc/methods/sshEnvironment.test.ts
@@ -0,0 +1,115 @@
+import { assert, describe, it } from "@effect/vitest";
+import { SshHttpBridgeError } from "@t3tools/ssh/errors";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+
+import {
+  DesktopSshEnvironmentRequestError,
+  fetchSshEnvironmentDescriptor,
+} from "./sshEnvironment.ts";
+
+function jsonResponse(request: HttpClientRequest.HttpClientRequest, body: unknown, status = 200) {
+  return HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+function makeHttpClientLayer(
+  handler: (
+    request: HttpClientRequest.HttpClientRequest,
+  ) => Effect.Effect<HttpClientResponse.HttpClientResponse, never>,
+) {
+  return Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => handler(request)),
+  );
+}
+
+describe("SSH environment IPC", () => {
+  it.effect("fetches and decodes the remote environment descriptor", () => {
+    const requestUrls: string[] = [];
+    const layer = makeHttpClientLayer((request) =>
+      Effect.sync(() => {
+        requestUrls.push(request.url);
+        return jsonResponse(request, {
+          environmentId: "remote-env",
+          label: "Remote Devbox",
+          platform: { os: "linux", arch: "x64" },
+          serverVersion: "1.2.3",
+          capabilities: { repositoryIdentity: true },
+        });
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const descriptor = yield* fetchSshEnvironmentDescriptor.handler({
+        httpBaseUrl: "http://127.0.0.1:41773/",
+      });
+
+      assert.deepEqual(descriptor, {
+        environmentId: "remote-env",
+        label: "Remote Devbox",
+        platform: { os: "linux", arch: "x64" },
+        serverVersion: "1.2.3",
+        capabilities: { repositoryIdentity: true },
+      });
+      assert.deepEqual(requestUrls, ["http://127.0.0.1:41773/.well-known/t3/environment"]);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("wraps schema decode failures in a typed request error", () => {
+    const layer = makeHttpClientLayer((request) =>
+      Effect.succeed(jsonResponse(request, { environmentId: "remote-env" })),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        fetchSshEnvironmentDescriptor.handler({
+          httpBaseUrl: "http://127.0.0.1:41773/",
+        }),
+      );
+      assert(Exit.isFailure(exit));
+      const failure = Cause.findErrorOption(exit.cause);
+      assert(Option.isSome(failure));
+      const error = failure.value;
+
+      assert.instanceOf(error, DesktopSshEnvironmentRequestError);
+      assert.equal(error.operation, "fetch-environment-descriptor");
+      assert.equal(error.cause instanceof SshHttpBridgeError, false);
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.effect("rejects non-loopback HTTP endpoints before issuing a request", () => {
+    let requestCount = 0;
+    const layer = makeHttpClientLayer((request) =>
+      Effect.sync(() => {
+        requestCount += 1;
+        return jsonResponse(request, {});
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(
+        fetchSshEnvironmentDescriptor.handler({
+          httpBaseUrl: "http://remote.example.com:41773/",
+        }),
+      );
+      assert(Exit.isFailure(exit));
+      const failure = Cause.findErrorOption(exit.cause);
+      assert(Option.isSome(failure));
+      const error = failure.value;
+
+      assert.instanceOf(error, DesktopSshEnvironmentRequestError);
+      assert.instanceOf(error.cause, SshHttpBridgeError);
+      assert.equal(requestCount, 0);
+    }).pipe(Effect.provide(layer));
+  });
+});
diff --git a/apps/desktop/src/ipc/methods/sshEnvironment.ts b/apps/desktop/src/ipc/methods/sshEnvironment.ts
index efea3dd132d..9a50339c8d8 100644
--- a/apps/desktop/src/ipc/methods/sshEnvironment.ts
+++ b/apps/desktop/src/ipc/methods/sshEnvironment.ts
@@ -1,3 +1,9 @@
+import {
+  bootstrapRemoteBearerSession,
+  fetchRemoteEnvironmentDescriptor,
+  fetchRemoteSessionState,
+  issueRemoteWebSocketTicket,
+} from "@t3tools/client-runtime";
 import {
   DesktopDiscoveredSshHostSchema,
   DesktopSshBearerBootstrapInputSchema,
@@ -9,10 +15,12 @@ import {
   DesktopSshPasswordPromptCancelledType,
   DesktopSshPasswordPromptResolutionInputSchema,
   ExecutionEnvironmentDescriptor,
-  AuthBearerBootstrapResult,
+  AuthAccessTokenResult,
   AuthSessionState,
-  AuthWebSocketTokenResult,
+  AuthWebSocketTicketResult,
 } from "@t3tools/contracts";
+import { resolveLoopbackSshHttpBaseUrl } from "@t3tools/ssh/tunnel";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 
@@ -20,7 +28,34 @@ import * as IpcChannels from "../channels.ts";
 import { makeIpcMethod } from "../DesktopIpc.ts";
 import * as DesktopSshEnvironment from "../../ssh/DesktopSshEnvironment.ts";
 import * as DesktopSshPasswordPrompts from "../../ssh/DesktopSshPasswordPrompts.ts";
-import * as DesktopSshRemoteApi from "../../ssh/DesktopSshRemoteApi.ts";
+
+type DesktopSshEnvironmentRequestOperation =
+  | "fetch-environment-descriptor"
+  | "bootstrap-bearer-session"
+  | "fetch-session-state"
+  | "issue-websocket-ticket";
+
+export class DesktopSshEnvironmentRequestError extends Data.TaggedError(
+  "DesktopSshEnvironmentRequestError",
+)<{
+  readonly operation: DesktopSshEnvironmentRequestOperation;
+  readonly cause: unknown;
+}> {
+  override get message() {
+    return `SSH remote API request failed during ${this.operation}.`;
+  }
+}
+
+const withLoopbackSshApi =
+  <A, E, R>(
+    operation: DesktopSshEnvironmentRequestOperation,
+    use: (httpBaseUrl: string) => Effect.Effect<A, E, R>,
+  ) =>
+  (httpBaseUrl: string): Effect.Effect<A, DesktopSshEnvironmentRequestError, R> =>
+    resolveLoopbackSshHttpBaseUrl(httpBaseUrl).pipe(
+      Effect.flatMap(use),
+      Effect.mapError((cause) => new DesktopSshEnvironmentRequestError({ operation, cause })),
+    );
 
 export const discoverSshHosts = makeIpcMethod({
   channel: IpcChannels.DISCOVER_SSH_HOSTS_CHANNEL,
@@ -69,21 +104,26 @@ export const fetchSshEnvironmentDescriptor = makeIpcMethod({
   payload: DesktopSshHttpBaseUrlInputSchema,
   result: ExecutionEnvironmentDescriptor,
   handler: Effect.fn("desktop.ipc.sshEnvironment.fetchDescriptor")(function* ({ httpBaseUrl }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.fetchEnvironmentDescriptor({ httpBaseUrl });
+    return yield* withLoopbackSshApi("fetch-environment-descriptor", (resolvedHttpBaseUrl) =>
+      fetchRemoteEnvironmentDescriptor({ httpBaseUrl: resolvedHttpBaseUrl }),
+    )(httpBaseUrl);
   }),
 });
 
 export const bootstrapSshBearerSession = makeIpcMethod({
   channel: IpcChannels.BOOTSTRAP_SSH_BEARER_SESSION_CHANNEL,
   payload: DesktopSshBearerBootstrapInputSchema,
-  result: AuthBearerBootstrapResult,
+  result: AuthAccessTokenResult,
   handler: Effect.fn("desktop.ipc.sshEnvironment.bootstrapBearerSession")(function* ({
     httpBaseUrl,
     credential,
   }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.bootstrapBearerSession({ httpBaseUrl, credential });
+    return yield* withLoopbackSshApi("bootstrap-bearer-session", (resolvedHttpBaseUrl) =>
+      bootstrapRemoteBearerSession({
+        httpBaseUrl: resolvedHttpBaseUrl,
+        credential,
+      }),
+    )(httpBaseUrl);
   }),
 });
 
@@ -95,21 +135,29 @@ export const fetchSshSessionState = makeIpcMethod({
     httpBaseUrl,
     bearerToken,
   }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.fetchSessionState({ httpBaseUrl, bearerToken });
+    return yield* withLoopbackSshApi("fetch-session-state", (resolvedHttpBaseUrl) =>
+      fetchRemoteSessionState({
+        httpBaseUrl: resolvedHttpBaseUrl,
+        bearerToken,
+      }),
+    )(httpBaseUrl);
   }),
 });
 
-export const issueSshWebSocketToken = makeIpcMethod({
+export const issueSshWebSocketTicket = makeIpcMethod({
   channel: IpcChannels.ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL,
   payload: DesktopSshBearerRequestInputSchema,
-  result: AuthWebSocketTokenResult,
-  handler: Effect.fn("desktop.ipc.sshEnvironment.issueWebSocketToken")(function* ({
+  result: AuthWebSocketTicketResult,
+  handler: Effect.fn("desktop.ipc.sshEnvironment.issueWebSocketTicket")(function* ({
     httpBaseUrl,
     bearerToken,
   }) {
-    const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-    return yield* remoteApi.issueWebSocketToken({ httpBaseUrl, bearerToken });
+    return yield* withLoopbackSshApi("issue-websocket-ticket", (resolvedHttpBaseUrl) =>
+      issueRemoteWebSocketTicket({
+        httpBaseUrl: resolvedHttpBaseUrl,
+        bearerToken,
+      }),
+    )(httpBaseUrl);
   }),
 });
 
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index 0bc1badff2d..8c458db0122 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -40,7 +40,6 @@ import * as DesktopAppSettings from "./settings/DesktopAppSettings.ts";
 import * as DesktopShellEnvironment from "./shell/DesktopShellEnvironment.ts";
 import * as DesktopSshEnvironment from "./ssh/DesktopSshEnvironment.ts";
 import * as DesktopSshPasswordPrompts from "./ssh/DesktopSshPasswordPrompts.ts";
-import * as DesktopSshRemoteApi from "./ssh/DesktopSshRemoteApi.ts";
 import * as DesktopState from "./app/DesktopState.ts";
 import * as DesktopUpdates from "./updates/DesktopUpdates.ts";
 import * as DesktopWindow from "./window/DesktopWindow.ts";
@@ -116,7 +115,7 @@ const desktopFoundationLayer = Layer.mergeAll(
   DesktopObservability.layer,
 ).pipe(Layer.provideMerge(desktopEnvironmentLayer));
 
-const desktopSshLayer = Layer.mergeAll(desktopSshEnvironmentLayer, DesktopSshRemoteApi.layer).pipe(
+const desktopSshLayer = desktopSshEnvironmentLayer.pipe(
   Layer.provideMerge(DesktopSshPasswordPrompts.layer()),
 );
 
diff --git a/apps/desktop/src/preload.ts b/apps/desktop/src/preload.ts
index 173be8fb54a..737567990de 100644
--- a/apps/desktop/src/preload.ts
+++ b/apps/desktop/src/preload.ts
@@ -66,7 +66,7 @@ contextBridge.exposeInMainWorld("desktopBridge", {
     }),
   fetchSshSessionState: (httpBaseUrl, bearerToken) =>
     ipcRenderer.invoke(IpcChannels.FETCH_SSH_SESSION_STATE_CHANNEL, { httpBaseUrl, bearerToken }),
-  issueSshWebSocketToken: (httpBaseUrl, bearerToken) =>
+  issueSshWebSocketTicket: (httpBaseUrl, bearerToken) =>
     ipcRenderer.invoke(IpcChannels.ISSUE_SSH_WEBSOCKET_TOKEN_CHANNEL, { httpBaseUrl, bearerToken }),
   onSshPasswordPrompt: (listener) => {
     const wrappedListener = (_event: Electron.IpcRendererEvent, request: unknown) => {
diff --git a/apps/desktop/src/ssh/DesktopSshRemoteApi.test.ts b/apps/desktop/src/ssh/DesktopSshRemoteApi.test.ts
deleted file mode 100644
index 8b6798d38cb..00000000000
--- a/apps/desktop/src/ssh/DesktopSshRemoteApi.test.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { assert, describe, it } from "@effect/vitest";
-import { SshHttpBridgeError } from "@t3tools/ssh/errors";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
-
-import * as DesktopSshRemoteApi from "./DesktopSshRemoteApi.ts";
-
-function jsonResponse(request: HttpClientRequest.HttpClientRequest, body: unknown, status = 200) {
-  return HttpClientResponse.fromWeb(
-    request,
-    new Response(JSON.stringify(body), {
-      status,
-      headers: { "content-type": "application/json" },
-    }),
-  );
-}
-
-function makeLayer(
-  handler: (
-    request: HttpClientRequest.HttpClientRequest,
-  ) => Effect.Effect<HttpClientResponse.HttpClientResponse>,
-) {
-  return DesktopSshRemoteApi.layer.pipe(
-    Layer.provide(
-      Layer.succeed(
-        HttpClient.HttpClient,
-        HttpClient.make((request) => handler(request)),
-      ),
-    ),
-  );
-}
-
-describe("DesktopSshRemoteApi", () => {
-  it.effect("fetches and decodes the remote environment descriptor", () => {
-    const requestUrls: string[] = [];
-    const layer = makeLayer((request) =>
-      Effect.sync(() => {
-        requestUrls.push(request.url);
-        return jsonResponse(request, {
-          environmentId: "remote-env",
-          label: "Remote Devbox",
-          platform: { os: "linux", arch: "x64" },
-          serverVersion: "1.2.3",
-          capabilities: { repositoryIdentity: true },
-        });
-      }),
-    );
-
-    return Effect.gen(function* () {
-      const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-      const descriptor = yield* remoteApi.fetchEnvironmentDescriptor({
-        httpBaseUrl: "http://127.0.0.1:41773/",
-      });
-
-      assert.equal(descriptor.label, "Remote Devbox");
-      assert.deepEqual(requestUrls, ["http://127.0.0.1:41773/.well-known/t3/environment"]);
-    }).pipe(Effect.provide(layer));
-  });
-
-  it.effect("wraps schema decode failures in a typed remote api error", () => {
-    const layer = makeLayer((request) =>
-      Effect.succeed(jsonResponse(request, { environmentId: "remote-env" })),
-    );
-
-    return Effect.gen(function* () {
-      const remoteApi = yield* DesktopSshRemoteApi.DesktopSshRemoteApi;
-      const error = yield* remoteApi
-        .fetchEnvironmentDescriptor({
-          httpBaseUrl: "http://127.0.0.1:41773/",
-        })
-        .pipe(Effect.flip);
-
-      assert.instanceOf(error, DesktopSshRemoteApi.DesktopSshRemoteApiError);
-      assert.equal(error.operation, "fetch-environment-descriptor");
-      assert.equal(error.cause instanceof SshHttpBridgeError, false);
-    }).pipe(Effect.provide(layer));
-  });
-});
diff --git a/apps/desktop/src/ssh/DesktopSshRemoteApi.ts b/apps/desktop/src/ssh/DesktopSshRemoteApi.ts
deleted file mode 100644
index fda08491060..00000000000
--- a/apps/desktop/src/ssh/DesktopSshRemoteApi.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-import {
-  AuthBearerBootstrapResult,
-  AuthSessionState,
-  AuthWebSocketTokenResult,
-  type AuthBearerBootstrapResult as AuthBearerBootstrapResultType,
-  type AuthSessionState as AuthSessionStateType,
-  type AuthWebSocketTokenResult as AuthWebSocketTokenResultType,
-  ExecutionEnvironmentDescriptor,
-  type ExecutionEnvironmentDescriptor as ExecutionEnvironmentDescriptorType,
-} from "@t3tools/contracts";
-import { SshHttpBridgeError } from "@t3tools/ssh/errors";
-import { fetchLoopbackSshJson } from "@t3tools/ssh/tunnel";
-import * as Context from "effect/Context";
-import * as Data from "effect/Data";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Schema from "effect/Schema";
-import { HttpClient } from "effect/unstable/http";
-
-export type DesktopSshRemoteApiOperation =
-  | "fetch-environment-descriptor"
-  | "bootstrap-bearer-session"
-  | "fetch-session-state"
-  | "issue-websocket-token";
-
-export class DesktopSshRemoteApiError extends Data.TaggedError("DesktopSshRemoteApiError")<{
-  readonly operation: DesktopSshRemoteApiOperation;
-  readonly cause: SshHttpBridgeError | Schema.SchemaError;
-}> {
-  override get message() {
-    return `SSH remote API request failed during ${this.operation}.`;
-  }
-}
-
-export interface DesktopSshRemoteApiShape {
-  readonly fetchEnvironmentDescriptor: (input: {
-    readonly httpBaseUrl: string;
-  }) => Effect.Effect<ExecutionEnvironmentDescriptorType, DesktopSshRemoteApiError>;
-  readonly bootstrapBearerSession: (input: {
-    readonly httpBaseUrl: string;
-    readonly credential: string;
-  }) => Effect.Effect<AuthBearerBootstrapResultType, DesktopSshRemoteApiError>;
-  readonly fetchSessionState: (input: {
-    readonly httpBaseUrl: string;
-    readonly bearerToken: string;
-  }) => Effect.Effect<AuthSessionStateType, DesktopSshRemoteApiError>;
-  readonly issueWebSocketToken: (input: {
-    readonly httpBaseUrl: string;
-    readonly bearerToken: string;
-  }) => Effect.Effect<AuthWebSocketTokenResultType, DesktopSshRemoteApiError>;
-}
-
-export class DesktopSshRemoteApi extends Context.Service<
-  DesktopSshRemoteApi,
-  DesktopSshRemoteApiShape
->()("@t3tools/desktop/ssh/DesktopSshRemoteApi") {}
-
-const decodeExecutionEnvironmentDescriptor = Schema.decodeUnknownEffect(
-  ExecutionEnvironmentDescriptor,
-);
-const decodeAuthBearerBootstrapResult = Schema.decodeUnknownEffect(AuthBearerBootstrapResult);
-const decodeAuthSessionState = Schema.decodeUnknownEffect(AuthSessionState);
-const decodeAuthWebSocketTokenResult = Schema.decodeUnknownEffect(AuthWebSocketTokenResult);
-
-const mapError =
-  (operation: DesktopSshRemoteApiOperation) =>
-  (cause: SshHttpBridgeError | Schema.SchemaError): DesktopSshRemoteApiError =>
-    new DesktopSshRemoteApiError({ operation, cause });
-
-const make = Effect.gen(function* () {
-  const httpClient = yield* HttpClient.HttpClient;
-  const provideHttpClient = <A, E>(effect: Effect.Effect<A, E, HttpClient.HttpClient>) =>
-    effect.pipe(Effect.provideService(HttpClient.HttpClient, httpClient));
-
-  return DesktopSshRemoteApi.of({
-    fetchEnvironmentDescriptor: ({ httpBaseUrl }) =>
-      fetchLoopbackSshJson<unknown>({
-        httpBaseUrl,
-        pathname: "/.well-known/t3/environment",
-      }).pipe(
-        Effect.flatMap(decodeExecutionEnvironmentDescriptor),
-        Effect.mapError(mapError("fetch-environment-descriptor")),
-        provideHttpClient,
-        Effect.withSpan("desktop.sshRemoteApi.fetchEnvironmentDescriptor"),
-      ),
-    bootstrapBearerSession: ({ httpBaseUrl, credential }) =>
-      fetchLoopbackSshJson<unknown>({
-        httpBaseUrl,
-        pathname: "/api/auth/bootstrap/bearer",
-        method: "POST",
-        body: { credential },
-      }).pipe(
-        Effect.flatMap(decodeAuthBearerBootstrapResult),
-        Effect.mapError(mapError("bootstrap-bearer-session")),
-        provideHttpClient,
-        Effect.withSpan("desktop.sshRemoteApi.bootstrapBearerSession"),
-      ),
-    fetchSessionState: ({ httpBaseUrl, bearerToken }) =>
-      fetchLoopbackSshJson<unknown>({
-        httpBaseUrl,
-        pathname: "/api/auth/session",
-        bearerToken,
-      }).pipe(
-        Effect.flatMap(decodeAuthSessionState),
-        Effect.mapError(mapError("fetch-session-state")),
-        provideHttpClient,
-        Effect.withSpan("desktop.sshRemoteApi.fetchSessionState"),
-      ),
-    issueWebSocketToken: ({ httpBaseUrl, bearerToken }) =>
-      fetchLoopbackSshJson<unknown>({
-        httpBaseUrl,
-        pathname: "/api/auth/ws-token",
-        method: "POST",
-        bearerToken,
-      }).pipe(
-        Effect.flatMap(decodeAuthWebSocketTokenResult),
-        Effect.mapError(mapError("issue-websocket-token")),
-        provideHttpClient,
-        Effect.withSpan("desktop.sshRemoteApi.issueWebSocketToken"),
-      ),
-  });
-});
-
-export const layer = Layer.effect(DesktopSshRemoteApi, make);
diff --git a/apps/mobile/src/lib/connection.test.ts b/apps/mobile/src/lib/connection.test.ts
index 42c330f2355..e55d20bd190 100644
--- a/apps/mobile/src/lib/connection.test.ts
+++ b/apps/mobile/src/lib/connection.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 
-import { redactPairingCredential } from "./connection";
+import { mobileAuthClientMetadata, redactPairingCredential } from "./connection";
 
 vi.mock("./runtime", () => ({
   mobileRemoteHttpRuntime: {
@@ -8,7 +8,21 @@ vi.mock("./runtime", () => ({
   },
 }));
 
+vi.mock("react-native", () => ({
+  Platform: {
+    OS: "ios",
+  },
+}));
+
 describe("mobile remote connection records", () => {
+  it("identifies mobile token exchanges for authorized-client presentation", () => {
+    expect(mobileAuthClientMetadata()).toEqual({
+      label: "T3 Code Mobile",
+      deviceType: "mobile",
+      os: "iOS",
+    });
+  });
+
   it("removes one-time bootstrap credentials before persisting pairing URLs", () => {
     expect(redactPairingCredential("https://desktop.example/#token=bootstrap-token")).toBe(
       "https://desktop.example/",
diff --git a/apps/mobile/src/lib/connection.ts b/apps/mobile/src/lib/connection.ts
index 1d11112c61c..8d87fda09c2 100644
--- a/apps/mobile/src/lib/connection.ts
+++ b/apps/mobile/src/lib/connection.ts
@@ -1,9 +1,10 @@
-import { EnvironmentId } from "@t3tools/contracts";
+import { type AuthClientPresentationMetadata, EnvironmentId } from "@t3tools/contracts";
 import {
   bootstrapRemoteBearerSession,
   fetchRemoteEnvironmentDescriptor,
 } from "@t3tools/client-runtime";
 import { resolveRemotePairingTarget, stripPairingTokenFromUrl } from "@t3tools/shared/remote";
+import { Platform } from "react-native";
 import { mobileRemoteHttpRuntime } from "./runtime";
 
 export interface RemoteConnectionInput {
@@ -36,6 +37,14 @@ export function redactPairingCredential(pairingUrl: string): string {
   }
 }
 
+export function mobileAuthClientMetadata(): AuthClientPresentationMetadata {
+  return {
+    label: "T3 Code Mobile",
+    deviceType: "mobile",
+    ...(Platform.OS === "ios" ? { os: "iOS" } : Platform.OS === "android" ? { os: "Android" } : {}),
+  };
+}
+
 export async function bootstrapRemoteConnection(
   input: RemoteConnectionInput,
 ): Promise<SavedRemoteConnection> {
@@ -53,6 +62,7 @@ export async function bootstrapRemoteConnection(
     bootstrapRemoteBearerSession({
       httpBaseUrl: target.httpBaseUrl,
       credential: target.credential,
+      clientMetadata: mobileAuthClientMetadata(),
     }),
   );
 
@@ -63,6 +73,6 @@ export async function bootstrapRemoteConnection(
     displayUrl: target.httpBaseUrl,
     httpBaseUrl: target.httpBaseUrl,
     wsBaseUrl: target.wsBaseUrl,
-    bearerToken: bootstrap.sessionToken,
+    bearerToken: bootstrap.access_token,
   };
 }
diff --git a/apps/server/src/auth/EnvironmentAuth.test.ts b/apps/server/src/auth/EnvironmentAuth.test.ts
new file mode 100644
index 00000000000..871ec1eab60
--- /dev/null
+++ b/apps/server/src/auth/EnvironmentAuth.test.ts
@@ -0,0 +1,261 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { AuthAdministrativeScopes } from "@t3tools/contracts";
+import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import type { ServerConfigShape } from "../config.ts";
+import { ServerConfig } from "../config.ts";
+import { SqlitePersistenceMemory } from "../persistence/Layers/Sqlite.ts";
+import * as PairingGrantStore from "./PairingGrantStore.ts";
+import * as EnvironmentAuth from "./EnvironmentAuth.ts";
+
+import * as ServerSecretStore from "./ServerSecretStore.ts";
+
+const makeServerConfigLayer = (overrides?: Partial<ServerConfigShape>) =>
+  Layer.effect(
+    ServerConfig,
+    Effect.gen(function* () {
+      const config = yield* ServerConfig;
+      return {
+        ...config,
+        ...overrides,
+      } satisfies ServerConfigShape;
+    }),
+  ).pipe(Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-auth-server-test-" })));
+
+const makeEnvironmentAuthLayer = (overrides?: Partial<ServerConfigShape>) =>
+  EnvironmentAuth.layer.pipe(
+    Layer.provide(SqlitePersistenceMemory),
+    Layer.provide(ServerSecretStore.layer),
+    Layer.provide(makeServerConfigLayer(overrides)),
+  );
+
+const makeCookieRequest = (
+  sessionToken: string,
+): Parameters<EnvironmentAuth.EnvironmentAuthShape["authenticateHttpRequest"]>[0] =>
+  ({
+    cookies: {
+      t3_session: sessionToken,
+    },
+    headers: {},
+  }) as unknown as Parameters<EnvironmentAuth.EnvironmentAuthShape["authenticateHttpRequest"]>[0];
+
+const requestMetadata = {
+  deviceType: "desktop" as const,
+  os: "macOS",
+  browser: "Chrome",
+  ipAddress: "192.168.1.23",
+};
+
+it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
+  it.effect("classifies invalid bootstrap credential failures for the HTTP boundary", () =>
+    Effect.sync(() => {
+      const error = EnvironmentAuth.toBootstrapExchangeError(
+        new PairingGrantStore.BootstrapCredentialInvalidError({
+          message: "Unknown bootstrap credential.",
+        }),
+      );
+
+      expect(error._tag).toBe("ServerAuthInvalidCredentialError");
+      if (error._tag === "ServerAuthInvalidCredentialError") {
+        expect(error.reason).toBe("invalid_credential");
+      }
+    }),
+  );
+
+  it.effect("maps unexpected bootstrap failures to 500", () =>
+    Effect.sync(() => {
+      const error = EnvironmentAuth.toBootstrapExchangeError(
+        new PairingGrantStore.BootstrapCredentialInternalError({
+          message: "Failed to consume bootstrap credential.",
+          cause: new Error("sqlite is unavailable"),
+        }),
+      );
+
+      expect(error._tag).toBe("ServerAuthInternalError");
+      expect(error.message).toBe("Failed to validate bootstrap credential.");
+    }),
+  );
+
+  it.effect("issues standard pairing credentials by default", () =>
+    Effect.gen(function* () {
+      const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+
+      const pairingCredential = yield* serverAuth.issuePairingCredential();
+      const exchanged = yield* serverAuth.createBrowserSession(
+        pairingCredential.credential,
+        requestMetadata,
+      );
+      const verified = yield* serverAuth.authenticateHttpRequest(
+        makeCookieRequest(exchanged.sessionToken),
+      );
+
+      expect(verified.sessionId.length).toBeGreaterThan(0);
+      expect(verified.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+      ]);
+      expect(verified.subject).toBe("one-time-token");
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect("does not exchange ordinary pairing grants for administrative access tokens", () =>
+    Effect.gen(function* () {
+      const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+      const pairingCredential = yield* serverAuth.issuePairingCredential();
+
+      const error = yield* serverAuth
+        .exchangeBootstrapCredentialForAccessToken(
+          pairingCredential.credential,
+          ["orchestration:read", "access:write"],
+          requestMetadata,
+        )
+        .pipe(Effect.flip);
+
+      expect(error._tag).toBe("ServerAuthInvalidRequestError");
+      if (error._tag === "ServerAuthInvalidRequestError") {
+        expect(error.reason).toBe("scope_not_granted");
+      }
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect("inherits a constrained pairing grant when token exchange omits scope", () =>
+    Effect.gen(function* () {
+      const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+      const pairingCredential = yield* serverAuth.issuePairingCredential({
+        scopes: ["orchestration:read"],
+      });
+
+      const token = yield* serverAuth.exchangeBootstrapCredentialForAccessToken(
+        pairingCredential.credential,
+        undefined,
+        requestMetadata,
+      );
+
+      expect(token.scope).toBe("orchestration:read");
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect("keeps user-issued administrative pairing links manageable", () =>
+    Effect.gen(function* () {
+      const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+      const pairingCredential = yield* serverAuth.issuePairingCredential({
+        scopes: AuthAdministrativeScopes,
+      });
+      const listedPairingLinks = yield* serverAuth.listPairingLinks();
+
+      expect(
+        listedPairingLinks.find((pairingLink) => pairingLink.id === pairingCredential.id)?.subject,
+      ).toBe("one-time-token");
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect("issues startup pairing URLs that bootstrap administrative sessions", () =>
+    Effect.gen(function* () {
+      const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+
+      const pairingUrl = yield* serverAuth.issueStartupPairingUrl("http://127.0.0.1:3773");
+      const token = new URLSearchParams(new URL(pairingUrl).hash.slice(1)).get("token");
+      const listedPairingLinks = yield* serverAuth.listPairingLinks();
+      expect(token).toBeTruthy();
+      expect(
+        listedPairingLinks.some(
+          (pairingLink) => pairingLink.subject === "administrative-bootstrap",
+        ),
+      ).toBe(false);
+
+      const exchanged = yield* serverAuth.createBrowserSession(token ?? "", requestMetadata);
+      const verified = yield* serverAuth.authenticateHttpRequest(
+        makeCookieRequest(exchanged.sessionToken),
+      );
+
+      expect(verified.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
+      expect(verified.subject).toBe("administrative-bootstrap");
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect(
+    "lists pairing links and revokes other sessions while keeping the administrative session",
+    () =>
+      Effect.gen(function* () {
+        const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+
+        const administrativeExchange = yield* serverAuth.createBrowserSession(
+          "desktop-bootstrap-token",
+          requestMetadata,
+        );
+        const administrativeSession = yield* serverAuth.authenticateHttpRequest(
+          makeCookieRequest(administrativeExchange.sessionToken),
+        );
+        const pairingCredential = yield* serverAuth.issuePairingCredential({
+          label: "Julius iPhone",
+        });
+        const listedPairingLinks = yield* serverAuth.listPairingLinks();
+        const clientExchange = yield* serverAuth.createBrowserSession(
+          pairingCredential.credential,
+          {
+            ...requestMetadata,
+            deviceType: "mobile",
+            os: "iOS",
+            browser: "Safari",
+            ipAddress: "192.168.1.88",
+          },
+        );
+        const clientSession = yield* serverAuth.authenticateHttpRequest(
+          makeCookieRequest(clientExchange.sessionToken),
+        );
+        const clientsBeforeRevoke = yield* serverAuth.listClientSessions(
+          administrativeSession.sessionId,
+        );
+        const revokedCount = yield* serverAuth.revokeOtherClientSessions(
+          administrativeSession.sessionId,
+        );
+        const clientsAfterRevoke = yield* serverAuth.listClientSessions(
+          administrativeSession.sessionId,
+        );
+
+        expect(listedPairingLinks.map((entry) => entry.id)).toContain(pairingCredential.id);
+        expect(listedPairingLinks.find((entry) => entry.id === pairingCredential.id)?.label).toBe(
+          "Julius iPhone",
+        );
+        expect(clientsBeforeRevoke).toHaveLength(2);
+        expect(
+          clientsBeforeRevoke.find((entry) => entry.sessionId === administrativeSession.sessionId)
+            ?.current,
+        ).toBe(true);
+        expect(
+          clientsBeforeRevoke.find((entry) => entry.sessionId === clientSession.sessionId)?.current,
+        ).toBe(false);
+        expect(
+          clientsBeforeRevoke.find((entry) => entry.sessionId === clientSession.sessionId)?.client
+            .label,
+        ).toBe("Julius iPhone");
+        expect(
+          clientsBeforeRevoke.find((entry) => entry.sessionId === clientSession.sessionId)?.client
+            .deviceType,
+        ).toBe("mobile");
+        expect(revokedCount).toBe(1);
+        expect(clientsAfterRevoke).toHaveLength(1);
+        expect(clientsAfterRevoke[0]?.sessionId).toBe(administrativeSession.sessionId);
+      }).pipe(
+        Effect.provide(
+          makeEnvironmentAuthLayer({
+            desktopBootstrapToken: "desktop-bootstrap-token",
+          }),
+        ),
+      ),
+  );
+});
diff --git a/apps/server/src/auth/EnvironmentAuth.ts b/apps/server/src/auth/EnvironmentAuth.ts
new file mode 100644
index 00000000000..abb1f7b792e
--- /dev/null
+++ b/apps/server/src/auth/EnvironmentAuth.ts
@@ -0,0 +1,662 @@
+import {
+  AuthAccessTokenType,
+  AuthAccessWriteScope,
+  AuthAdministrativeScopes,
+  AuthStandardClientScopes,
+  type AuthAccessTokenResult,
+  type AuthBrowserSessionResult,
+  type AuthClientMetadata,
+  type AuthClientSession,
+  type AuthCreatePairingCredentialInput,
+  type AuthEnvironmentScope,
+  type AuthPairingLink,
+  type AuthPairingCredentialResult,
+  type AuthSessionId,
+  type AuthSessionState,
+  type ServerAuthDescriptor,
+  type ServerAuthSessionMethod,
+  type AuthWebSocketTicketResult,
+} from "@t3tools/contracts";
+import { encodeOAuthScope } from "@t3tools/shared/oauthScope";
+import * as Context from "effect/Context";
+import * as Data from "effect/Data";
+import * as DateTime from "effect/DateTime";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
+
+import * as EnvironmentAuthPolicy from "./EnvironmentAuthPolicy.ts";
+import * as PairingGrantStore from "./PairingGrantStore.ts";
+import * as ServerSecretStore from "./ServerSecretStore.ts";
+import * as SessionStore from "./SessionStore.ts";
+import { layerConfig as SqlitePersistenceLayer } from "../persistence/Layers/Sqlite.ts";
+
+export const DEFAULT_SESSION_SUBJECT = "cli-issued-session";
+export const INTERNAL_ADMINISTRATIVE_BOOTSTRAP_SUBJECT = "administrative-bootstrap";
+
+export interface IssuedPairingLink {
+  readonly id: string;
+  readonly credential: string;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+  readonly subject: string;
+  readonly label?: string;
+  readonly createdAt: DateTime.Utc;
+  readonly expiresAt: DateTime.Utc;
+}
+
+export interface IssuedBearerSession {
+  readonly sessionId: AuthSessionId;
+  readonly token: string;
+  readonly method: "bearer-access-token";
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+  readonly subject: string;
+  readonly client: AuthClientMetadata;
+  readonly expiresAt: DateTime.Utc;
+}
+
+export interface AuthenticatedSession {
+  readonly sessionId: AuthSessionId;
+  readonly subject: string;
+  readonly method: ServerAuthSessionMethod;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+  readonly expiresAt?: DateTime.DateTime;
+}
+
+export class ServerAuthInternalError extends Data.TaggedError("ServerAuthInternalError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class ServerAuthInvalidCredentialError extends Data.TaggedError(
+  "ServerAuthInvalidCredentialError",
+)<{
+  readonly reason: "missing_credential" | "invalid_credential";
+  readonly cause?: unknown;
+}> {}
+
+export class ServerAuthInvalidRequestError extends Data.TaggedError(
+  "ServerAuthInvalidRequestError",
+)<{
+  readonly reason: "invalid_scope" | "scope_not_granted";
+}> {}
+
+export class ServerAuthForbiddenOperationError extends Data.TaggedError(
+  "ServerAuthForbiddenOperationError",
+)<{
+  readonly reason: "current_session_revoke_not_allowed";
+}> {}
+
+export interface EnvironmentAuthShape {
+  readonly getDescriptor: () => Effect.Effect<ServerAuthDescriptor>;
+  readonly getSessionState: (
+    request: HttpServerRequest.HttpServerRequest,
+  ) => Effect.Effect<AuthSessionState, ServerAuthInternalError>;
+  readonly createBrowserSession: (
+    credential: string,
+    requestMetadata: AuthClientMetadata,
+  ) => Effect.Effect<
+    {
+      readonly response: AuthBrowserSessionResult;
+      readonly sessionToken: string;
+    },
+    ServerAuthInvalidCredentialError | ServerAuthInternalError
+  >;
+  readonly exchangeBootstrapCredentialForAccessToken: (
+    credential: string,
+    requestedScopes: ReadonlyArray<AuthEnvironmentScope> | undefined,
+    requestMetadata: AuthClientMetadata,
+  ) => Effect.Effect<
+    AuthAccessTokenResult,
+    ServerAuthInvalidCredentialError | ServerAuthInvalidRequestError | ServerAuthInternalError
+  >;
+  readonly createPairingLink: (input?: {
+    readonly ttl?: Duration.Duration;
+    readonly label?: string;
+    readonly scopes?: ReadonlyArray<AuthEnvironmentScope>;
+    readonly subject?: string;
+  }) => Effect.Effect<IssuedPairingLink, ServerAuthInternalError>;
+  readonly issuePairingCredential: (
+    input?: AuthCreatePairingCredentialInput,
+  ) => Effect.Effect<AuthPairingCredentialResult, ServerAuthInternalError>;
+  readonly issueStartupPairingCredential: () => Effect.Effect<
+    AuthPairingCredentialResult,
+    ServerAuthInternalError
+  >;
+  readonly listPairingLinks: (input?: {
+    readonly excludeSubjects?: ReadonlyArray<string>;
+  }) => Effect.Effect<ReadonlyArray<AuthPairingLink>, ServerAuthInternalError>;
+  readonly revokePairingLink: (id: string) => Effect.Effect<boolean, ServerAuthInternalError>;
+  readonly issueSession: (input?: {
+    readonly ttl?: Duration.Duration;
+    readonly subject?: string;
+    readonly scopes?: ReadonlyArray<AuthEnvironmentScope>;
+    readonly label?: string;
+  }) => Effect.Effect<IssuedBearerSession, ServerAuthInternalError>;
+  readonly listSessions: () => Effect.Effect<
+    ReadonlyArray<AuthClientSession>,
+    ServerAuthInternalError
+  >;
+  readonly revokeSession: (
+    sessionId: AuthSessionId,
+  ) => Effect.Effect<boolean, ServerAuthInternalError>;
+  readonly revokeOtherSessionsExcept: (
+    sessionId: AuthSessionId,
+  ) => Effect.Effect<number, ServerAuthInternalError>;
+  readonly listClientSessions: (
+    currentSessionId: AuthSessionId,
+  ) => Effect.Effect<ReadonlyArray<AuthClientSession>, ServerAuthInternalError>;
+  readonly revokeClientSession: (
+    currentSessionId: AuthSessionId,
+    targetSessionId: AuthSessionId,
+  ) => Effect.Effect<boolean, ServerAuthForbiddenOperationError | ServerAuthInternalError>;
+  readonly revokeOtherClientSessions: (
+    currentSessionId: AuthSessionId,
+  ) => Effect.Effect<number, ServerAuthInternalError>;
+  readonly authenticateHttpRequest: (
+    request: HttpServerRequest.HttpServerRequest,
+  ) => Effect.Effect<
+    AuthenticatedSession,
+    ServerAuthInvalidCredentialError | ServerAuthInternalError
+  >;
+  readonly authenticateWebSocketUpgrade: (
+    request: HttpServerRequest.HttpServerRequest,
+  ) => Effect.Effect<
+    AuthenticatedSession,
+    ServerAuthInvalidCredentialError | ServerAuthInternalError
+  >;
+  readonly issueWebSocketTicket: (
+    session: Pick<AuthenticatedSession, "sessionId">,
+  ) => Effect.Effect<AuthWebSocketTicketResult, ServerAuthInternalError>;
+  readonly issueStartupPairingUrl: (
+    baseUrl: string,
+  ) => Effect.Effect<string, ServerAuthInternalError>;
+}
+
+export class EnvironmentAuth extends Context.Service<EnvironmentAuth, EnvironmentAuthShape>()(
+  "t3/auth/EnvironmentAuth",
+) {}
+
+type BootstrapExchangeResult = {
+  readonly response: AuthBrowserSessionResult;
+  readonly sessionToken: string;
+};
+
+const AUTHORIZATION_PREFIX = "Bearer ";
+const WEBSOCKET_TICKET_QUERY_PARAM = "wsTicket";
+
+const bySessionPriority = (left: AuthClientSession, right: AuthClientSession) => {
+  const leftCanManage = left.scopes.includes(AuthAccessWriteScope);
+  const rightCanManage = right.scopes.includes(AuthAccessWriteScope);
+  if (leftCanManage !== rightCanManage) {
+    return leftCanManage ? -1 : 1;
+  }
+  if (left.connected !== right.connected) {
+    return left.connected ? -1 : 1;
+  }
+  return right.issuedAt.epochMilliseconds - left.issuedAt.epochMilliseconds;
+};
+
+const toInternalError =
+  (message: string) =>
+  (cause: unknown): ServerAuthInternalError =>
+    new ServerAuthInternalError({ message, cause });
+
+export function toBootstrapExchangeError(
+  cause: PairingGrantStore.BootstrapCredentialError,
+): ServerAuthInvalidCredentialError | ServerAuthInternalError {
+  if (cause._tag === "BootstrapCredentialInternalError") {
+    return new ServerAuthInternalError({
+      message: "Failed to validate bootstrap credential.",
+      cause,
+    });
+  }
+
+  return new ServerAuthInvalidCredentialError({
+    reason: "invalid_credential",
+    cause,
+  });
+}
+
+const mapSessionVerificationErrors = <A, R>(
+  effect: Effect.Effect<A, SessionStore.SessionCredentialError, R>,
+): Effect.Effect<A, ServerAuthInvalidCredentialError | ServerAuthInternalError, R> =>
+  effect.pipe(
+    Effect.catchTags({
+      SessionCredentialInvalidError: (cause) =>
+        Effect.fail(new ServerAuthInvalidCredentialError({ reason: "invalid_credential", cause })),
+      SessionCredentialInternalError: (cause) =>
+        Effect.fail(
+          new ServerAuthInternalError({
+            message: "Failed to validate session credential.",
+            cause,
+          }),
+        ),
+    }),
+  );
+
+function parseBearerToken(request: HttpServerRequest.HttpServerRequest): string | null {
+  const header = request.headers["authorization"];
+  if (typeof header !== "string" || !header.startsWith(AUTHORIZATION_PREFIX)) {
+    return null;
+  }
+  const token = header.slice(AUTHORIZATION_PREFIX.length).trim();
+  return token.length > 0 ? token : null;
+}
+
+export const make = Effect.fn("makeEnvironmentAuth")(function* () {
+  const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
+  const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
+  const sessions = yield* SessionStore.SessionStore;
+  const descriptor = yield* policy.getDescriptor();
+
+  const authenticateToken = (
+    token: string,
+  ): Effect.Effect<
+    AuthenticatedSession,
+    ServerAuthInvalidCredentialError | ServerAuthInternalError
+  > =>
+    sessions.verify(token).pipe(
+      Effect.tapErrorTag("SessionCredentialInvalidError", (cause) =>
+        Effect.logWarning("Rejected authenticated session credential.").pipe(
+          Effect.annotateLogs({
+            reason: cause.message,
+          }),
+        ),
+      ),
+      Effect.map((session) => ({
+        sessionId: session.sessionId,
+        subject: session.subject,
+        method: session.method,
+        scopes: session.scopes,
+        ...(session.expiresAt ? { expiresAt: session.expiresAt } : {}),
+      })),
+      mapSessionVerificationErrors,
+    );
+
+  const authenticateRequest = (request: HttpServerRequest.HttpServerRequest) => {
+    const cookieToken = request.cookies[sessions.cookieName];
+    const bearerToken = parseBearerToken(request);
+    const credential = cookieToken ?? bearerToken;
+    if (!credential) {
+      return Effect.fail(new ServerAuthInvalidCredentialError({ reason: "missing_credential" }));
+    }
+    return authenticateToken(credential);
+  };
+
+  const getSessionState: EnvironmentAuthShape["getSessionState"] = (request) =>
+    authenticateRequest(request).pipe(
+      Effect.map(
+        (session) =>
+          ({
+            authenticated: true,
+            auth: descriptor,
+            scopes: session.scopes,
+            sessionMethod: session.method,
+            ...(session.expiresAt ? { expiresAt: DateTime.toUtc(session.expiresAt) } : {}),
+          }) satisfies AuthSessionState,
+      ),
+      Effect.catchTag("ServerAuthInvalidCredentialError", () =>
+        Effect.succeed({
+          authenticated: false,
+          auth: descriptor,
+        } satisfies AuthSessionState),
+      ),
+      Effect.withSpan("EnvironmentAuth.getSessionState"),
+    );
+
+  const createBrowserSession: EnvironmentAuthShape["createBrowserSession"] = (
+    credential,
+    requestMetadata,
+  ) =>
+    bootstrapCredentials.consume(credential).pipe(
+      Effect.mapError(toBootstrapExchangeError),
+      Effect.flatMap((grant) =>
+        sessions
+          .issue({
+            method: "browser-session-cookie",
+            subject: grant.subject,
+            scopes: grant.scopes,
+            client: {
+              ...requestMetadata,
+              ...(grant.label ? { label: grant.label } : {}),
+            },
+          })
+          .pipe(
+            Effect.mapError(
+              (cause) =>
+                new ServerAuthInternalError({
+                  message: "Failed to issue authenticated session.",
+                  cause,
+                }),
+            ),
+          ),
+      ),
+      Effect.map(
+        (session) =>
+          ({
+            response: {
+              authenticated: true,
+              scopes: session.scopes,
+              sessionMethod: session.method,
+              expiresAt: DateTime.toUtc(session.expiresAt),
+            } satisfies AuthBrowserSessionResult,
+            sessionToken: session.token,
+          }) satisfies BootstrapExchangeResult,
+      ),
+      Effect.withSpan("EnvironmentAuth.createBrowserSession"),
+    );
+
+  const exchangeBootstrapCredentialForAccessToken: EnvironmentAuthShape["exchangeBootstrapCredentialForAccessToken"] =
+    (credential, requestedScopes, requestMetadata) =>
+      bootstrapCredentials.consume(credential).pipe(
+        Effect.mapError(toBootstrapExchangeError),
+        Effect.flatMap((grant) =>
+          Effect.gen(function* () {
+            const grantedScopes = requestedScopes ?? grant.scopes;
+            if (!grantedScopes.every((scope) => grant.scopes.includes(scope))) {
+              return yield* new ServerAuthInvalidRequestError({
+                reason: "scope_not_granted",
+              });
+            }
+            return yield* sessions
+              .issue({
+                method: "bearer-access-token",
+                subject: grant.subject,
+                scopes: grantedScopes,
+                client: {
+                  ...requestMetadata,
+                  ...(grant.label ? { label: grant.label } : {}),
+                },
+              })
+              .pipe(
+                Effect.mapError(
+                  (cause) =>
+                    new ServerAuthInternalError({
+                      message: "Failed to issue authenticated access token.",
+                      cause,
+                    }),
+                ),
+              );
+          }),
+        ),
+        Effect.flatMap((session) =>
+          DateTime.now.pipe(
+            Effect.map(
+              (now) =>
+                ({
+                  access_token: session.token,
+                  issued_token_type: AuthAccessTokenType,
+                  token_type: "Bearer",
+                  expires_in: Math.max(
+                    0,
+                    Math.floor(
+                      (session.expiresAt.epochMilliseconds - now.epochMilliseconds) / 1000,
+                    ),
+                  ),
+                  scope: encodeOAuthScope(session.scopes),
+                }) satisfies AuthAccessTokenResult,
+            ),
+          ),
+        ),
+        Effect.withSpan("EnvironmentAuth.exchangeBootstrapCredentialForAccessToken"),
+      );
+
+  const issuePairingCredentialForSubject = (input: {
+    readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+    readonly subject: string;
+    readonly label?: string;
+  }) =>
+    createPairingLink({
+      scopes: input.scopes,
+      subject: input.subject,
+      ...(input.label ? { label: input.label } : {}),
+    }).pipe(
+      Effect.map(
+        (issued) =>
+          ({
+            id: issued.id,
+            credential: issued.credential,
+            ...(issued.label ? { label: issued.label } : {}),
+            expiresAt: issued.expiresAt,
+          }) satisfies AuthPairingCredentialResult,
+      ),
+    );
+
+  const createPairingLink: EnvironmentAuthShape["createPairingLink"] = Effect.fn(
+    "EnvironmentAuth.createPairingLink",
+  )(
+    function* (input) {
+      const createdAt = yield* DateTime.now;
+      const issued = yield* bootstrapCredentials.issueOneTimeToken({
+        scopes: input?.scopes ?? AuthStandardClientScopes,
+        subject: input?.subject ?? "one-time-token",
+        ...(input?.ttl ? { ttl: input.ttl } : {}),
+        ...(input?.label ? { label: input.label } : {}),
+      });
+      return {
+        id: issued.id,
+        credential: issued.credential,
+        scopes: input?.scopes ?? AuthStandardClientScopes,
+        subject: input?.subject ?? "one-time-token",
+        ...(issued.label ? { label: issued.label } : {}),
+        createdAt: DateTime.toUtc(createdAt),
+        expiresAt: DateTime.toUtc(issued.expiresAt),
+      } satisfies IssuedPairingLink;
+    },
+    Effect.mapError(toInternalError("Failed to create pairing link.")),
+  );
+
+  const listPairingLinks: EnvironmentAuthShape["listPairingLinks"] = (input) =>
+    bootstrapCredentials.listActive().pipe(
+      Effect.map((pairingLinks) => {
+        const excludedSubjects = input?.excludeSubjects ?? [
+          INTERNAL_ADMINISTRATIVE_BOOTSTRAP_SUBJECT,
+        ];
+        return pairingLinks
+          .filter((pairingLink) => !excludedSubjects.includes(pairingLink.subject))
+          .toSorted(
+            (left, right) => right.createdAt.epochMilliseconds - left.createdAt.epochMilliseconds,
+          );
+      }),
+      Effect.mapError(toInternalError("Failed to list pairing links.")),
+      Effect.withSpan("EnvironmentAuth.listPairingLinks"),
+    );
+
+  const revokePairingLink: EnvironmentAuthShape["revokePairingLink"] = (id) =>
+    bootstrapCredentials
+      .revoke(id)
+      .pipe(
+        Effect.mapError(toInternalError("Failed to revoke pairing link.")),
+        Effect.withSpan("EnvironmentAuth.revokePairingLink"),
+      );
+
+  const issueSession: EnvironmentAuthShape["issueSession"] = (input) =>
+    sessions
+      .issue({
+        subject: input?.subject ?? DEFAULT_SESSION_SUBJECT,
+        method: "bearer-access-token",
+        scopes: input?.scopes ?? AuthAdministrativeScopes,
+        client: {
+          ...(input?.label ? { label: input.label } : {}),
+          deviceType: "bot",
+        },
+        ...(input?.ttl ? { ttl: input.ttl } : {}),
+      })
+      .pipe(
+        Effect.map(
+          (issued) =>
+            ({
+              sessionId: issued.sessionId,
+              token: issued.token,
+              method: "bearer-access-token",
+              scopes: issued.scopes,
+              subject: input?.subject ?? DEFAULT_SESSION_SUBJECT,
+              client: issued.client,
+              expiresAt: DateTime.toUtc(issued.expiresAt),
+            }) satisfies IssuedBearerSession,
+        ),
+        Effect.mapError(toInternalError("Failed to issue session token.")),
+        Effect.withSpan("EnvironmentAuth.issueSession"),
+      );
+
+  const listSessions: EnvironmentAuthShape["listSessions"] = () =>
+    sessions.listActive().pipe(
+      Effect.map((activeSessions) => activeSessions.toSorted(bySessionPriority)),
+      Effect.mapError(toInternalError("Failed to list sessions.")),
+      Effect.withSpan("EnvironmentAuth.listSessions"),
+    );
+
+  const revokeSession: EnvironmentAuthShape["revokeSession"] = (sessionId) =>
+    sessions
+      .revoke(sessionId)
+      .pipe(
+        Effect.mapError(toInternalError("Failed to revoke session.")),
+        Effect.withSpan("EnvironmentAuth.revokeSession"),
+      );
+
+  const revokeOtherSessionsExcept: EnvironmentAuthShape["revokeOtherSessionsExcept"] = (
+    sessionId,
+  ) =>
+    sessions
+      .revokeAllExcept(sessionId)
+      .pipe(
+        Effect.mapError(toInternalError("Failed to revoke other sessions.")),
+        Effect.withSpan("EnvironmentAuth.revokeOtherSessionsExcept"),
+      );
+
+  const issuePairingCredential: EnvironmentAuthShape["issuePairingCredential"] = (input) =>
+    issuePairingCredentialForSubject({
+      scopes: input?.scopes ?? AuthStandardClientScopes,
+      subject: "one-time-token",
+      ...(input?.label ? { label: input.label } : {}),
+    }).pipe(Effect.withSpan("EnvironmentAuth.issuePairingCredential"));
+
+  const issueStartupPairingCredential: EnvironmentAuthShape["issueStartupPairingCredential"] = () =>
+    issuePairingCredentialForSubject({
+      scopes: AuthAdministrativeScopes,
+      subject: INTERNAL_ADMINISTRATIVE_BOOTSTRAP_SUBJECT,
+    }).pipe(Effect.withSpan("EnvironmentAuth.issueStartupPairingCredential"));
+
+  const listClientSessions: EnvironmentAuthShape["listClientSessions"] = (currentSessionId) =>
+    listSessions().pipe(
+      Effect.map((clientSessions) =>
+        clientSessions.map(
+          (clientSession): AuthClientSession => ({
+            ...clientSession,
+            current: clientSession.sessionId === currentSessionId,
+          }),
+        ),
+      ),
+      Effect.withSpan("EnvironmentAuth.listClientSessions"),
+    );
+
+  const revokeClientSession: EnvironmentAuthShape["revokeClientSession"] = Effect.fn(
+    "EnvironmentAuth.revokeClientSession",
+  )(function* (currentSessionId, targetSessionId) {
+    if (currentSessionId === targetSessionId) {
+      return yield* new ServerAuthForbiddenOperationError({
+        reason: "current_session_revoke_not_allowed",
+      });
+    }
+    return yield* revokeSession(targetSessionId);
+  });
+
+  const revokeOtherClientSessions: EnvironmentAuthShape["revokeOtherClientSessions"] = (
+    currentSessionId,
+  ) =>
+    revokeOtherSessionsExcept(currentSessionId).pipe(
+      Effect.withSpan("EnvironmentAuth.revokeOtherClientSessions"),
+    );
+
+  const issueStartupPairingUrl: EnvironmentAuthShape["issueStartupPairingUrl"] = (baseUrl) =>
+    issueStartupPairingCredential().pipe(
+      Effect.map((issued) => {
+        const url = new URL(baseUrl);
+        url.pathname = "/pair";
+        url.searchParams.delete("token");
+        url.hash = new URLSearchParams([["token", issued.credential]]).toString();
+        return url.toString();
+      }),
+      Effect.withSpan("EnvironmentAuth.issueStartupPairingUrl"),
+    );
+
+  const issueWebSocketTicket: EnvironmentAuthShape["issueWebSocketTicket"] = (session) =>
+    sessions.issueWebSocketToken(session.sessionId).pipe(
+      Effect.mapError(
+        (cause) =>
+          new ServerAuthInternalError({
+            message: "Failed to issue websocket token.",
+            cause,
+          }),
+      ),
+      Effect.map(
+        (issued) =>
+          ({
+            ticket: issued.token,
+            expiresAt: DateTime.toUtc(issued.expiresAt),
+          }) satisfies AuthWebSocketTicketResult,
+      ),
+      Effect.withSpan("EnvironmentAuth.issueWebSocketTicket"),
+    );
+
+  const authenticateHttpRequest: EnvironmentAuthShape["authenticateHttpRequest"] = (request) =>
+    authenticateRequest(request).pipe(Effect.withSpan("EnvironmentAuth.authenticateHttpRequest"));
+
+  const authenticateWebSocketUpgrade: EnvironmentAuthShape["authenticateWebSocketUpgrade"] =
+    Effect.fn("EnvironmentAuth.authenticateWebSocketUpgrade")(function* (request) {
+      const requestUrl = HttpServerRequest.toURL(request);
+      if (Option.isSome(requestUrl)) {
+        const websocketTicket = requestUrl.value.searchParams.get(WEBSOCKET_TICKET_QUERY_PARAM);
+        if (websocketTicket && websocketTicket.trim().length > 0) {
+          return yield* sessions.verifyWebSocketToken(websocketTicket).pipe(
+            Effect.map((session) => ({
+              sessionId: session.sessionId,
+              subject: session.subject,
+              method: session.method,
+              scopes: session.scopes,
+              ...(session.expiresAt ? { expiresAt: session.expiresAt } : {}),
+            })),
+            mapSessionVerificationErrors,
+          );
+        }
+      }
+
+      return yield* authenticateRequest(request);
+    });
+
+  return {
+    getDescriptor: () =>
+      Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuth.getDescriptor")),
+    getSessionState,
+    createBrowserSession,
+    exchangeBootstrapCredentialForAccessToken,
+    createPairingLink,
+    issuePairingCredential,
+    issueStartupPairingCredential,
+    listPairingLinks,
+    revokePairingLink,
+    issueSession,
+    listSessions,
+    revokeSession,
+    revokeOtherSessionsExcept,
+    listClientSessions,
+    revokeClientSession,
+    revokeOtherClientSessions,
+    authenticateHttpRequest,
+    authenticateWebSocketUpgrade,
+    issueWebSocketTicket,
+    issueStartupPairingUrl,
+  } satisfies EnvironmentAuthShape;
+});
+
+export const layer = Layer.effect(EnvironmentAuth, make()).pipe(
+  Layer.provideMerge(PairingGrantStore.layer),
+  Layer.provideMerge(SessionStore.layer),
+  Layer.provideMerge(EnvironmentAuthPolicy.layer),
+);
+
+export const storageLayer = Layer.mergeAll(ServerSecretStore.layer, SqlitePersistenceLayer);
+
+export const runtimeLayer = layer.pipe(Layer.provideMerge(storageLayer));
diff --git a/apps/server/src/auth/EnvironmentAuthAdmin.test.ts b/apps/server/src/auth/EnvironmentAuthAdmin.test.ts
new file mode 100644
index 00000000000..44c28dea416
--- /dev/null
+++ b/apps/server/src/auth/EnvironmentAuthAdmin.test.ts
@@ -0,0 +1,125 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import type { ServerConfigShape } from "../config.ts";
+import { ServerConfig } from "../config.ts";
+import { SqlitePersistenceMemory } from "../persistence/Layers/Sqlite.ts";
+import * as EnvironmentAuth from "./EnvironmentAuth.ts";
+import * as ServerSecretStore from "./ServerSecretStore.ts";
+import * as SessionStore from "./SessionStore.ts";
+
+const makeServerConfigLayer = (
+  overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
+) =>
+  Layer.effect(
+    ServerConfig,
+    Effect.gen(function* () {
+      const config = yield* ServerConfig;
+      return {
+        ...config,
+        ...overrides,
+      } satisfies ServerConfigShape;
+    }),
+  ).pipe(
+    Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-auth-control-plane-test-" })),
+  );
+
+const makeEnvironmentAuthLayer = (
+  overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
+) =>
+  EnvironmentAuth.layer.pipe(
+    Layer.provideMerge(ServerSecretStore.layer),
+    Layer.provideMerge(SqlitePersistenceMemory),
+    Layer.provide(makeServerConfigLayer(overrides)),
+  );
+
+it.layer(NodeServices.layer)("EnvironmentAuth administrative operations", (it) => {
+  it.effect("creates, lists, and revokes client pairing links", () =>
+    Effect.gen(function* () {
+      const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;
+
+      const created = yield* environmentAuth.createPairingLink({
+        scopes: ["orchestration:read"],
+        subject: "one-time-token",
+        label: "CI phone",
+      });
+      const listedBeforeRevoke = yield* environmentAuth.listPairingLinks();
+      const revoked = yield* environmentAuth.revokePairingLink(created.id);
+      const listedAfterRevoke = yield* environmentAuth.listPairingLinks();
+
+      expect(created.scopes).toEqual(["orchestration:read"]);
+      expect(created.credential.length).toBeGreaterThan(0);
+      expect(listedBeforeRevoke).toHaveLength(1);
+      expect(listedBeforeRevoke[0]?.id).toBe(created.id);
+      expect(listedBeforeRevoke[0]?.label).toBe("CI phone");
+      expect(listedBeforeRevoke[0]?.credential).toBe(created.credential);
+      expect(revoked).toBe(true);
+      expect(listedAfterRevoke).toHaveLength(0);
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect("issues bearer access token sessions without exposing raw tokens", () =>
+    Effect.gen(function* () {
+      const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;
+      const sessionCredentials = yield* SessionStore.SessionStore;
+
+      const issued = yield* environmentAuth.issueSession({
+        label: "deploy-bot",
+      });
+      const verified = yield* sessionCredentials.verify(issued.token);
+      const listedBeforeRevoke = yield* environmentAuth.listSessions();
+      const revoked = yield* environmentAuth.revokeSession(issued.sessionId);
+      const listedAfterRevoke = yield* environmentAuth.listSessions();
+
+      expect(issued.method).toBe("bearer-access-token");
+      expect(issued.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
+      expect(issued.client.deviceType).toBe("bot");
+      expect(issued.client.label).toBe("deploy-bot");
+      expect(verified.sessionId).toBe(issued.sessionId);
+      expect(verified.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
+      expect(verified.method).toBe("bearer-access-token");
+      expect(listedBeforeRevoke).toHaveLength(1);
+      expect(listedBeforeRevoke[0]?.sessionId).toBe(issued.sessionId);
+      expect("token" in (listedBeforeRevoke[0] ?? {})).toBe(false);
+      expect(revoked).toBe(true);
+      expect(listedAfterRevoke).toHaveLength(0);
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+
+  it.effect("surfaces lastConnectedAt through the listed session view", () =>
+    Effect.gen(function* () {
+      const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;
+      const sessionCredentials = yield* SessionStore.SessionStore;
+
+      const issued = yield* environmentAuth.issueSession({
+        label: "remote-ipad",
+      });
+      const beforeConnect = yield* environmentAuth.listSessions();
+      yield* sessionCredentials.markConnected(issued.sessionId);
+      const afterConnect = yield* environmentAuth.listSessions();
+
+      expect(beforeConnect[0]?.lastConnectedAt).toBeNull();
+      expect(afterConnect[0]?.lastConnectedAt).not.toBeNull();
+    }).pipe(Effect.provide(makeEnvironmentAuthLayer())),
+  );
+});
diff --git a/apps/server/src/auth/Layers/ServerAuthPolicy.test.ts b/apps/server/src/auth/EnvironmentAuthPolicy.test.ts
similarity index 74%
rename from apps/server/src/auth/Layers/ServerAuthPolicy.test.ts
rename to apps/server/src/auth/EnvironmentAuthPolicy.test.ts
index fcc56686d8f..c9f5dc6230d 100644
--- a/apps/server/src/auth/Layers/ServerAuthPolicy.test.ts
+++ b/apps/server/src/auth/EnvironmentAuthPolicy.test.ts
@@ -3,13 +3,12 @@ import { expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 
-import type { ServerConfigShape } from "../../config.ts";
-import { ServerConfig } from "../../config.ts";
-import { ServerAuthPolicy } from "../Services/ServerAuthPolicy.ts";
-import { ServerAuthPolicyLive } from "./ServerAuthPolicy.ts";
+import type { ServerConfigShape } from "../config.ts";
+import { ServerConfig } from "../config.ts";
+import * as EnvironmentAuthPolicy from "./EnvironmentAuthPolicy.ts";
 
-const makeServerAuthPolicyLayer = (overrides?: Partial<ServerConfigShape>) =>
-  ServerAuthPolicyLive.pipe(
+const makeEnvironmentAuthPolicyLayer = (overrides?: Partial<ServerConfigShape>) =>
+  EnvironmentAuthPolicy.layer.pipe(
     Layer.provide(
       Layer.effect(
         ServerConfig,
@@ -26,10 +25,10 @@ const makeServerAuthPolicyLayer = (overrides?: Partial<ServerConfigShape>) =>
     ),
   );
 
-it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
+it.layer(NodeServices.layer)("EnvironmentAuthPolicy.layer", (it) => {
   it.effect("uses desktop-managed-local policy for desktop mode", () =>
     Effect.gen(function* () {
-      const policy = yield* ServerAuthPolicy;
+      const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
       const descriptor = yield* policy.getDescriptor();
 
       expect(descriptor.policy).toBe("desktop-managed-local");
@@ -37,7 +36,7 @@ it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
       expect(descriptor.sessionCookieName).toBe("t3_session_3773");
     }).pipe(
       Effect.provide(
-        makeServerAuthPolicyLayer({
+        makeEnvironmentAuthPolicyLayer({
           mode: "desktop",
           port: 3773,
         }),
@@ -47,14 +46,14 @@ it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
 
   it.effect("uses remote-reachable policy for desktop mode when bound beyond loopback", () =>
     Effect.gen(function* () {
-      const policy = yield* ServerAuthPolicy;
+      const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
       const descriptor = yield* policy.getDescriptor();
 
       expect(descriptor.policy).toBe("remote-reachable");
       expect(descriptor.bootstrapMethods).toEqual(["desktop-bootstrap", "one-time-token"]);
     }).pipe(
       Effect.provide(
-        makeServerAuthPolicyLayer({
+        makeEnvironmentAuthPolicyLayer({
           mode: "desktop",
           host: "0.0.0.0",
         }),
@@ -64,7 +63,7 @@ it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
 
   it.effect("uses loopback-browser policy for loopback web hosts", () =>
     Effect.gen(function* () {
-      const policy = yield* ServerAuthPolicy;
+      const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
       const descriptor = yield* policy.getDescriptor();
 
       expect(descriptor.policy).toBe("loopback-browser");
@@ -72,7 +71,7 @@ it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
       expect(descriptor.sessionCookieName).toBe("t3_session");
     }).pipe(
       Effect.provide(
-        makeServerAuthPolicyLayer({
+        makeEnvironmentAuthPolicyLayer({
           mode: "web",
           host: "127.0.0.1",
         }),
@@ -82,14 +81,14 @@ it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
 
   it.effect("uses remote-reachable policy for wildcard web hosts", () =>
     Effect.gen(function* () {
-      const policy = yield* ServerAuthPolicy;
+      const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
       const descriptor = yield* policy.getDescriptor();
 
       expect(descriptor.policy).toBe("remote-reachable");
       expect(descriptor.bootstrapMethods).toEqual(["one-time-token"]);
     }).pipe(
       Effect.provide(
-        makeServerAuthPolicyLayer({
+        makeEnvironmentAuthPolicyLayer({
           mode: "web",
           host: "0.0.0.0",
         }),
@@ -99,13 +98,13 @@ it.layer(NodeServices.layer)("ServerAuthPolicyLive", (it) => {
 
   it.effect("uses remote-reachable policy for non-loopback web hosts", () =>
     Effect.gen(function* () {
-      const policy = yield* ServerAuthPolicy;
+      const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
       const descriptor = yield* policy.getDescriptor();
 
       expect(descriptor.policy).toBe("remote-reachable");
     }).pipe(
       Effect.provide(
-        makeServerAuthPolicyLayer({
+        makeEnvironmentAuthPolicyLayer({
           mode: "web",
           host: "192.168.1.50",
         }),
diff --git a/apps/server/src/auth/Layers/ServerAuthPolicy.ts b/apps/server/src/auth/EnvironmentAuthPolicy.ts
similarity index 53%
rename from apps/server/src/auth/Layers/ServerAuthPolicy.ts
rename to apps/server/src/auth/EnvironmentAuthPolicy.ts
index 2c000bc1883..3968ddb2531 100644
--- a/apps/server/src/auth/Layers/ServerAuthPolicy.ts
+++ b/apps/server/src/auth/EnvironmentAuthPolicy.ts
@@ -1,13 +1,22 @@
 import type { ServerAuthDescriptor } from "@t3tools/contracts";
+import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 
-import { ServerConfig } from "../../config.ts";
-import { ServerAuthPolicy, type ServerAuthPolicyShape } from "../Services/ServerAuthPolicy.ts";
-import { resolveSessionCookieName } from "../utils.ts";
-import { isLoopbackHost, isWildcardHost } from "../../startupAccess.ts";
+import { ServerConfig } from "../config.ts";
+import { resolveSessionCookieName } from "./utils.ts";
+import { isLoopbackHost, isWildcardHost } from "../startupAccess.ts";
 
-export const makeServerAuthPolicy = Effect.gen(function* () {
+export interface EnvironmentAuthPolicyShape {
+  readonly getDescriptor: () => Effect.Effect<ServerAuthDescriptor>;
+}
+
+export class EnvironmentAuthPolicy extends Context.Service<
+  EnvironmentAuthPolicy,
+  EnvironmentAuthPolicyShape
+>()("t3/auth/EnvironmentAuthPolicy") {}
+
+export const make = Effect.fn("makeEnvironmentAuthPolicy")(function* () {
   const config = yield* ServerConfig;
   const isRemoteReachable = isWildcardHost(config.host) || !isLoopbackHost(config.host);
 
@@ -30,7 +39,7 @@ export const makeServerAuthPolicy = Effect.gen(function* () {
   const descriptor: ServerAuthDescriptor = {
     policy,
     bootstrapMethods,
-    sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+    sessionMethods: ["browser-session-cookie", "bearer-access-token"],
     sessionCookieName: resolveSessionCookieName({
       mode: config.mode,
       port: config.port,
@@ -38,8 +47,9 @@ export const makeServerAuthPolicy = Effect.gen(function* () {
   };
 
   return {
-    getDescriptor: () => Effect.succeed(descriptor),
-  } satisfies ServerAuthPolicyShape;
+    getDescriptor: () =>
+      Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")),
+  } satisfies EnvironmentAuthPolicyShape;
 });
 
-export const ServerAuthPolicyLive = Layer.effect(ServerAuthPolicy, makeServerAuthPolicy);
+export const layer = Layer.effect(EnvironmentAuthPolicy, make());
diff --git a/apps/server/src/auth/Layers/AuthControlPlane.test.ts b/apps/server/src/auth/Layers/AuthControlPlane.test.ts
deleted file mode 100644
index 23ea4e97958..00000000000
--- a/apps/server/src/auth/Layers/AuthControlPlane.test.ts
+++ /dev/null
@@ -1,112 +0,0 @@
-import * as NodeServices from "@effect/platform-node/NodeServices";
-import { expect, it } from "@effect/vitest";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-
-import type { ServerConfigShape } from "../../config.ts";
-import { ServerConfig } from "../../config.ts";
-import { BootstrapCredentialServiceLive } from "./BootstrapCredentialService.ts";
-import { ServerSecretStoreLive } from "./ServerSecretStore.ts";
-import { SessionCredentialServiceLive } from "./SessionCredentialService.ts";
-import { SqlitePersistenceMemory } from "../../persistence/Layers/Sqlite.ts";
-import { AuthControlPlane } from "../Services/AuthControlPlane.ts";
-import { makeAuthControlPlane } from "./AuthControlPlane.ts";
-import { SessionCredentialService } from "../Services/SessionCredentialService.ts";
-
-const makeServerConfigLayer = (
-  overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
-) =>
-  Layer.effect(
-    ServerConfig,
-    Effect.gen(function* () {
-      const config = yield* ServerConfig;
-      return {
-        ...config,
-        ...overrides,
-      } satisfies ServerConfigShape;
-    }),
-  ).pipe(
-    Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-auth-control-plane-test-" })),
-  );
-
-const makeAuthControlPlaneLayer = (
-  overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
-) =>
-  Layer.effect(AuthControlPlane, makeAuthControlPlane).pipe(
-    Layer.provideMerge(BootstrapCredentialServiceLive),
-    Layer.provideMerge(SessionCredentialServiceLive),
-    Layer.provideMerge(ServerSecretStoreLive),
-    Layer.provideMerge(SqlitePersistenceMemory),
-    Layer.provide(makeServerConfigLayer(overrides)),
-  );
-
-it.layer(NodeServices.layer)("AuthControlPlane", (it) => {
-  it.effect("creates, lists, and revokes client pairing links", () =>
-    Effect.gen(function* () {
-      const authControlPlane = yield* AuthControlPlane;
-
-      const created = yield* authControlPlane.createPairingLink({
-        role: "client",
-        subject: "one-time-token",
-        label: "CI phone",
-      });
-      const listedBeforeRevoke = yield* authControlPlane.listPairingLinks({ role: "client" });
-      const revoked = yield* authControlPlane.revokePairingLink(created.id);
-      const listedAfterRevoke = yield* authControlPlane.listPairingLinks({ role: "client" });
-
-      expect(created.role).toBe("client");
-      expect(created.credential.length).toBeGreaterThan(0);
-      expect(listedBeforeRevoke).toHaveLength(1);
-      expect(listedBeforeRevoke[0]?.id).toBe(created.id);
-      expect(listedBeforeRevoke[0]?.label).toBe("CI phone");
-      expect(listedBeforeRevoke[0]?.credential).toBe(created.credential);
-      expect(revoked).toBe(true);
-      expect(listedAfterRevoke).toHaveLength(0);
-    }).pipe(Effect.provide(makeAuthControlPlaneLayer())),
-  );
-
-  it.effect("issues bearer sessions and lists them without exposing raw tokens", () =>
-    Effect.gen(function* () {
-      const authControlPlane = yield* AuthControlPlane;
-      const sessionCredentials = yield* SessionCredentialService;
-
-      const issued = yield* authControlPlane.issueSession({
-        label: "deploy-bot",
-      });
-      const verified = yield* sessionCredentials.verify(issued.token);
-      const listedBeforeRevoke = yield* authControlPlane.listSessions();
-      const revoked = yield* authControlPlane.revokeSession(issued.sessionId);
-      const listedAfterRevoke = yield* authControlPlane.listSessions();
-
-      expect(issued.method).toBe("bearer-session-token");
-      expect(issued.role).toBe("owner");
-      expect(issued.client.deviceType).toBe("bot");
-      expect(issued.client.label).toBe("deploy-bot");
-      expect(verified.sessionId).toBe(issued.sessionId);
-      expect(verified.role).toBe("owner");
-      expect(verified.method).toBe("bearer-session-token");
-      expect(listedBeforeRevoke).toHaveLength(1);
-      expect(listedBeforeRevoke[0]?.sessionId).toBe(issued.sessionId);
-      expect("token" in (listedBeforeRevoke[0] ?? {})).toBe(false);
-      expect(revoked).toBe(true);
-      expect(listedAfterRevoke).toHaveLength(0);
-    }).pipe(Effect.provide(makeAuthControlPlaneLayer())),
-  );
-
-  it.effect("surfaces lastConnectedAt through the listed session view", () =>
-    Effect.gen(function* () {
-      const authControlPlane = yield* AuthControlPlane;
-      const sessionCredentials = yield* SessionCredentialService;
-
-      const issued = yield* authControlPlane.issueSession({
-        label: "remote-ipad",
-      });
-      const beforeConnect = yield* authControlPlane.listSessions();
-      yield* sessionCredentials.markConnected(issued.sessionId);
-      const afterConnect = yield* authControlPlane.listSessions();
-
-      expect(beforeConnect[0]?.lastConnectedAt).toBeNull();
-      expect(afterConnect[0]?.lastConnectedAt).not.toBeNull();
-    }).pipe(Effect.provide(makeAuthControlPlaneLayer())),
-  );
-});
diff --git a/apps/server/src/auth/Layers/AuthControlPlane.ts b/apps/server/src/auth/Layers/AuthControlPlane.ts
deleted file mode 100644
index 6c42cd2db17..00000000000
--- a/apps/server/src/auth/Layers/AuthControlPlane.ts
+++ /dev/null
@@ -1,186 +0,0 @@
-import type { AuthClientSession, AuthPairingLink } from "@t3tools/contracts";
-import * as DateTime from "effect/DateTime";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-
-import { BootstrapCredentialServiceLive } from "./BootstrapCredentialService.ts";
-import { ServerSecretStoreLive } from "./ServerSecretStore.ts";
-import { SessionCredentialServiceLive } from "./SessionCredentialService.ts";
-import { BootstrapCredentialService } from "../Services/BootstrapCredentialService.ts";
-import { SessionCredentialService } from "../Services/SessionCredentialService.ts";
-import { layerConfig as SqlitePersistenceLayerLive } from "../../persistence/Layers/Sqlite.ts";
-import {
-  AuthControlPlane,
-  AuthControlPlaneError,
-  DEFAULT_SESSION_SUBJECT,
-} from "../Services/AuthControlPlane.ts";
-import type {
-  AuthControlPlaneShape,
-  IssuedBearerSession,
-  IssuedPairingLink,
-} from "../Services/AuthControlPlane.ts";
-
-const bySessionPriority = (left: AuthClientSession, right: AuthClientSession) => {
-  if (left.role !== right.role) {
-    return left.role === "owner" ? -1 : 1;
-  }
-  if (left.connected !== right.connected) {
-    return left.connected ? -1 : 1;
-  }
-  return right.issuedAt.epochMilliseconds - left.issuedAt.epochMilliseconds;
-};
-
-const toAuthControlPlaneError =
-  (message: string) =>
-  (cause: unknown): AuthControlPlaneError =>
-    new AuthControlPlaneError({
-      message,
-      cause,
-    });
-
-export const makeAuthControlPlane = Effect.gen(function* () {
-  const bootstrapCredentials = yield* BootstrapCredentialService;
-  const sessions = yield* SessionCredentialService;
-
-  const createPairingLink: AuthControlPlaneShape["createPairingLink"] = (input) =>
-    Effect.gen(function* () {
-      const createdAt = yield* DateTime.now;
-      const issued = yield* bootstrapCredentials.issueOneTimeToken({
-        role: input?.role ?? "client",
-        subject: input?.subject ?? "one-time-token",
-        ...(input?.ttl ? { ttl: input.ttl } : {}),
-        ...(input?.label ? { label: input.label } : {}),
-      });
-      return {
-        id: issued.id,
-        credential: issued.credential,
-        role: input?.role ?? "client",
-        subject: input?.subject ?? "one-time-token",
-        ...(issued.label ? { label: issued.label } : {}),
-        createdAt: DateTime.toUtc(createdAt),
-        expiresAt: DateTime.toUtc(issued.expiresAt),
-      } satisfies IssuedPairingLink;
-    }).pipe(Effect.mapError(toAuthControlPlaneError("Failed to create pairing link.")));
-
-  const listPairingLinks: AuthControlPlaneShape["listPairingLinks"] = (input) =>
-    bootstrapCredentials.listActive().pipe(
-      Effect.map((pairingLinks) => {
-        const activeLinks: Array<AuthPairingLink> = [];
-        for (const pairingLink of pairingLinks) {
-          if (input?.role && pairingLink.role !== input.role) {
-            continue;
-          }
-          if (input?.excludeSubjects?.includes(pairingLink.subject)) {
-            continue;
-          }
-          activeLinks.push(
-            pairingLink.label
-              ? ({
-                  id: pairingLink.id,
-                  credential: pairingLink.credential,
-                  role: pairingLink.role,
-                  subject: pairingLink.subject,
-                  label: pairingLink.label,
-                  createdAt: pairingLink.createdAt,
-                  expiresAt: pairingLink.expiresAt,
-                } satisfies AuthPairingLink)
-              : ({
-                  id: pairingLink.id,
-                  credential: pairingLink.credential,
-                  role: pairingLink.role,
-                  subject: pairingLink.subject,
-                  createdAt: pairingLink.createdAt,
-                  expiresAt: pairingLink.expiresAt,
-                } satisfies AuthPairingLink),
-          );
-        }
-        return activeLinks.toSorted(
-          (left, right) => right.createdAt.epochMilliseconds - left.createdAt.epochMilliseconds,
-        );
-      }),
-      Effect.mapError(toAuthControlPlaneError("Failed to list pairing links.")),
-    );
-
-  const revokePairingLink: AuthControlPlaneShape["revokePairingLink"] = (id) =>
-    bootstrapCredentials
-      .revoke(id)
-      .pipe(Effect.mapError(toAuthControlPlaneError("Failed to revoke pairing link.")));
-
-  const issueSession: AuthControlPlaneShape["issueSession"] = (input) =>
-    sessions
-      .issue({
-        subject: input?.subject ?? DEFAULT_SESSION_SUBJECT,
-        method: "bearer-session-token",
-        role: input?.role ?? "owner",
-        client: {
-          ...(input?.label ? { label: input.label } : {}),
-          deviceType: "bot",
-        },
-        ...(input?.ttl ? { ttl: input.ttl } : {}),
-      })
-      .pipe(
-        Effect.flatMap((issued) => {
-          if (issued.method !== "bearer-session-token") {
-            return Effect.fail(
-              new AuthControlPlaneError({
-                message: "CLI session issuance produced an unexpected session method.",
-              }),
-            );
-          }
-
-          return Effect.succeed({
-            sessionId: issued.sessionId,
-            token: issued.token,
-            method: "bearer-session-token" as const,
-            role: issued.role,
-            subject: input?.subject ?? DEFAULT_SESSION_SUBJECT,
-            client: issued.client,
-            expiresAt: DateTime.toUtc(issued.expiresAt),
-          } satisfies IssuedBearerSession);
-        }),
-        Effect.mapError(toAuthControlPlaneError("Failed to issue session token.")),
-      );
-
-  const listSessions: AuthControlPlaneShape["listSessions"] = () =>
-    sessions.listActive().pipe(
-      Effect.map((activeSessions) => activeSessions.toSorted(bySessionPriority)),
-      Effect.mapError(toAuthControlPlaneError("Failed to list sessions.")),
-    );
-
-  const revokeSession: AuthControlPlaneShape["revokeSession"] = (sessionId) =>
-    sessions
-      .revoke(sessionId)
-      .pipe(Effect.mapError(toAuthControlPlaneError("Failed to revoke session.")));
-
-  const revokeOtherSessionsExcept: AuthControlPlaneShape["revokeOtherSessionsExcept"] = (
-    sessionId,
-  ) =>
-    sessions
-      .revokeAllExcept(sessionId)
-      .pipe(Effect.mapError(toAuthControlPlaneError("Failed to revoke other sessions.")));
-
-  return {
-    createPairingLink,
-    listPairingLinks,
-    revokePairingLink,
-    issueSession,
-    listSessions,
-    revokeSession,
-    revokeOtherSessionsExcept,
-  } satisfies AuthControlPlaneShape;
-});
-
-export const AuthCoreLive = Layer.mergeAll(
-  BootstrapCredentialServiceLive,
-  SessionCredentialServiceLive,
-);
-
-export const AuthStorageLive = Layer.mergeAll(ServerSecretStoreLive, SqlitePersistenceLayerLive);
-
-export const AuthRuntimeLive = AuthCoreLive.pipe(Layer.provideMerge(AuthStorageLive));
-
-export const AuthControlPlaneLive = Layer.effect(AuthControlPlane, makeAuthControlPlane);
-
-export const AuthControlPlaneRuntimeLive = AuthControlPlaneLive.pipe(
-  Layer.provideMerge(AuthRuntimeLive),
-);
diff --git a/apps/server/src/auth/Layers/ServerAuth.test.ts b/apps/server/src/auth/Layers/ServerAuth.test.ts
deleted file mode 100644
index 748f4ded731..00000000000
--- a/apps/server/src/auth/Layers/ServerAuth.test.ts
+++ /dev/null
@@ -1,183 +0,0 @@
-import * as NodeServices from "@effect/platform-node/NodeServices";
-import { expect, it } from "@effect/vitest";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-
-import type { ServerConfigShape } from "../../config.ts";
-import { ServerConfig } from "../../config.ts";
-import { SqlitePersistenceMemory } from "../../persistence/Layers/Sqlite.ts";
-import { BootstrapCredentialError } from "../Services/BootstrapCredentialService.ts";
-import { ServerAuth, type ServerAuthShape } from "../Services/ServerAuth.ts";
-import { ServerAuthLive, toBootstrapExchangeAuthError } from "./ServerAuth.ts";
-import { ServerSecretStoreLive } from "./ServerSecretStore.ts";
-
-const makeServerConfigLayer = (overrides?: Partial<ServerConfigShape>) =>
-  Layer.effect(
-    ServerConfig,
-    Effect.gen(function* () {
-      const config = yield* ServerConfig;
-      return {
-        ...config,
-        ...overrides,
-      } satisfies ServerConfigShape;
-    }),
-  ).pipe(Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-auth-server-test-" })));
-
-const makeServerAuthLayer = (overrides?: Partial<ServerConfigShape>) =>
-  ServerAuthLive.pipe(
-    Layer.provide(SqlitePersistenceMemory),
-    Layer.provide(ServerSecretStoreLive),
-    Layer.provide(makeServerConfigLayer(overrides)),
-  );
-
-const makeCookieRequest = (
-  sessionToken: string,
-): Parameters<ServerAuthShape["authenticateHttpRequest"]>[0] =>
-  ({
-    cookies: {
-      t3_session: sessionToken,
-    },
-    headers: {},
-  }) as unknown as Parameters<ServerAuthShape["authenticateHttpRequest"]>[0];
-
-const requestMetadata = {
-  deviceType: "desktop" as const,
-  os: "macOS",
-  browser: "Chrome",
-  ipAddress: "192.168.1.23",
-};
-
-it.layer(NodeServices.layer)("ServerAuthLive", (it) => {
-  it.effect("maps invalid bootstrap credential failures to 401", () =>
-    Effect.sync(() => {
-      const error = toBootstrapExchangeAuthError(
-        new BootstrapCredentialError({
-          message: "Unknown bootstrap credential.",
-          status: 401,
-        }),
-      );
-
-      expect(error.status).toBe(401);
-      expect(error.message).toBe("Invalid bootstrap credential.");
-    }),
-  );
-
-  it.effect("maps unexpected bootstrap failures to 500", () =>
-    Effect.sync(() => {
-      const error = toBootstrapExchangeAuthError(
-        new BootstrapCredentialError({
-          message: "Failed to consume bootstrap credential.",
-          status: 500,
-          cause: new Error("sqlite is unavailable"),
-        }),
-      );
-
-      expect(error.status).toBe(500);
-      expect(error.message).toBe("Failed to validate bootstrap credential.");
-    }),
-  );
-
-  it.effect("issues client pairing credentials by default", () =>
-    Effect.gen(function* () {
-      const serverAuth = yield* ServerAuth;
-
-      const pairingCredential = yield* serverAuth.issuePairingCredential();
-      const exchanged = yield* serverAuth.exchangeBootstrapCredential(
-        pairingCredential.credential,
-        requestMetadata,
-      );
-      const verified = yield* serverAuth.authenticateHttpRequest(
-        makeCookieRequest(exchanged.sessionToken),
-      );
-
-      expect(verified.sessionId.length).toBeGreaterThan(0);
-      expect(verified.role).toBe("client");
-      expect(verified.subject).toBe("one-time-token");
-    }).pipe(Effect.provide(makeServerAuthLayer())),
-  );
-
-  it.effect("issues startup pairing URLs that bootstrap owner sessions", () =>
-    Effect.gen(function* () {
-      const serverAuth = yield* ServerAuth;
-
-      const pairingUrl = yield* serverAuth.issueStartupPairingUrl("http://127.0.0.1:3773");
-      const token = new URLSearchParams(new URL(pairingUrl).hash.slice(1)).get("token");
-      const listedPairingLinks = yield* serverAuth.listPairingLinks();
-      expect(token).toBeTruthy();
-      expect(
-        listedPairingLinks.some((pairingLink) => pairingLink.subject === "owner-bootstrap"),
-      ).toBe(false);
-
-      const exchanged = yield* serverAuth.exchangeBootstrapCredential(token ?? "", requestMetadata);
-      const verified = yield* serverAuth.authenticateHttpRequest(
-        makeCookieRequest(exchanged.sessionToken),
-      );
-
-      expect(verified.role).toBe("owner");
-      expect(verified.subject).toBe("owner-bootstrap");
-    }).pipe(Effect.provide(makeServerAuthLayer())),
-  );
-
-  it.effect("lists pairing links and revokes other client sessions while keeping the owner", () =>
-    Effect.gen(function* () {
-      const serverAuth = yield* ServerAuth;
-
-      const ownerExchange = yield* serverAuth.exchangeBootstrapCredential(
-        "desktop-bootstrap-token",
-        requestMetadata,
-      );
-      const ownerSession = yield* serverAuth.authenticateHttpRequest(
-        makeCookieRequest(ownerExchange.sessionToken),
-      );
-      const pairingCredential = yield* serverAuth.issuePairingCredential({
-        label: "Julius iPhone",
-      });
-      const listedPairingLinks = yield* serverAuth.listPairingLinks();
-      const clientExchange = yield* serverAuth.exchangeBootstrapCredential(
-        pairingCredential.credential,
-        {
-          ...requestMetadata,
-          deviceType: "mobile",
-          os: "iOS",
-          browser: "Safari",
-          ipAddress: "192.168.1.88",
-        },
-      );
-      const clientSession = yield* serverAuth.authenticateHttpRequest(
-        makeCookieRequest(clientExchange.sessionToken),
-      );
-      const clientsBeforeRevoke = yield* serverAuth.listClientSessions(ownerSession.sessionId);
-      const revokedCount = yield* serverAuth.revokeOtherClientSessions(ownerSession.sessionId);
-      const clientsAfterRevoke = yield* serverAuth.listClientSessions(ownerSession.sessionId);
-
-      expect(listedPairingLinks.map((entry) => entry.id)).toContain(pairingCredential.id);
-      expect(listedPairingLinks.find((entry) => entry.id === pairingCredential.id)?.label).toBe(
-        "Julius iPhone",
-      );
-      expect(clientsBeforeRevoke).toHaveLength(2);
-      expect(
-        clientsBeforeRevoke.find((entry) => entry.sessionId === ownerSession.sessionId)?.current,
-      ).toBe(true);
-      expect(
-        clientsBeforeRevoke.find((entry) => entry.sessionId === clientSession.sessionId)?.current,
-      ).toBe(false);
-      expect(
-        clientsBeforeRevoke.find((entry) => entry.sessionId === clientSession.sessionId)?.client
-          .label,
-      ).toBe("Julius iPhone");
-      expect(
-        clientsBeforeRevoke.find((entry) => entry.sessionId === clientSession.sessionId)?.client
-          .deviceType,
-      ).toBe("mobile");
-      expect(revokedCount).toBe(1);
-      expect(clientsAfterRevoke).toHaveLength(1);
-      expect(clientsAfterRevoke[0]?.sessionId).toBe(ownerSession.sessionId);
-    }).pipe(
-      Effect.provide(
-        makeServerAuthLayer({
-          desktopBootstrapToken: "desktop-bootstrap-token",
-        }),
-      ),
-    ),
-  );
-});
diff --git a/apps/server/src/auth/Layers/ServerAuth.ts b/apps/server/src/auth/Layers/ServerAuth.ts
deleted file mode 100644
index 238475aca37..00000000000
--- a/apps/server/src/auth/Layers/ServerAuth.ts
+++ /dev/null
@@ -1,398 +0,0 @@
-import {
-  type AuthBearerBootstrapResult,
-  type AuthClientSession,
-  type AuthBootstrapResult,
-  type AuthPairingCredentialResult,
-  type AuthSessionState,
-  type AuthWebSocketTokenResult,
-} from "@t3tools/contracts";
-import * as DateTime from "effect/DateTime";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
-import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
-
-import { AuthControlPlane } from "../Services/AuthControlPlane.ts";
-import { ServerAuthPolicyLive } from "./ServerAuthPolicy.ts";
-import { BootstrapCredentialService } from "../Services/BootstrapCredentialService.ts";
-import { BootstrapCredentialError } from "../Services/BootstrapCredentialService.ts";
-import { ServerAuthPolicy } from "../Services/ServerAuthPolicy.ts";
-import {
-  ServerAuth,
-  type AuthenticatedSession,
-  AuthError,
-  type ServerAuthShape,
-} from "../Services/ServerAuth.ts";
-import {
-  SessionCredentialError,
-  SessionCredentialService,
-} from "../Services/SessionCredentialService.ts";
-import { AuthControlPlaneLive, AuthCoreLive } from "./AuthControlPlane.ts";
-
-type BootstrapExchangeResult = {
-  readonly response: AuthBootstrapResult;
-  readonly sessionToken: string;
-};
-
-const AUTHORIZATION_PREFIX = "Bearer ";
-const WEBSOCKET_TOKEN_QUERY_PARAM = "wsToken";
-
-export function toBootstrapExchangeAuthError(cause: BootstrapCredentialError): AuthError {
-  if (cause.status === 500) {
-    return new AuthError({
-      message: "Failed to validate bootstrap credential.",
-      status: 500,
-      cause,
-    });
-  }
-
-  return new AuthError({
-    message: "Invalid bootstrap credential.",
-    status: 401,
-    cause,
-  });
-}
-
-function parseBearerToken(request: HttpServerRequest.HttpServerRequest): string | null {
-  const header = request.headers["authorization"];
-  if (typeof header !== "string" || !header.startsWith(AUTHORIZATION_PREFIX)) {
-    return null;
-  }
-  const token = header.slice(AUTHORIZATION_PREFIX.length).trim();
-  return token.length > 0 ? token : null;
-}
-
-export const makeServerAuth = Effect.gen(function* () {
-  const policy = yield* ServerAuthPolicy;
-  const bootstrapCredentials = yield* BootstrapCredentialService;
-  const authControlPlane = yield* AuthControlPlane;
-  const sessions = yield* SessionCredentialService;
-  const descriptor = yield* policy.getDescriptor();
-
-  const authenticateToken = (token: string): Effect.Effect<AuthenticatedSession, AuthError> =>
-    sessions.verify(token).pipe(
-      Effect.tapError((cause: SessionCredentialError) =>
-        Effect.logWarning("Rejected authenticated session credential.").pipe(
-          Effect.annotateLogs({
-            reason: cause.message,
-          }),
-        ),
-      ),
-      Effect.map((session) => ({
-        sessionId: session.sessionId,
-        subject: session.subject,
-        method: session.method,
-        role: session.role,
-        ...(session.expiresAt ? { expiresAt: session.expiresAt } : {}),
-      })),
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Unauthorized request.",
-            status: 401,
-            cause,
-          }),
-      ),
-    );
-
-  const authenticateRequest = (request: HttpServerRequest.HttpServerRequest) => {
-    const cookieToken = request.cookies[sessions.cookieName];
-    const bearerToken = parseBearerToken(request);
-    const credential = cookieToken ?? bearerToken;
-    if (!credential) {
-      return Effect.fail(
-        new AuthError({
-          message: "Authentication required.",
-          status: 401,
-        }),
-      );
-    }
-    return authenticateToken(credential);
-  };
-
-  const getSessionState: ServerAuthShape["getSessionState"] = (request) =>
-    authenticateRequest(request).pipe(
-      Effect.map(
-        (session) =>
-          ({
-            authenticated: true,
-            auth: descriptor,
-            role: session.role,
-            sessionMethod: session.method,
-            ...(session.expiresAt ? { expiresAt: DateTime.toUtc(session.expiresAt) } : {}),
-          }) satisfies AuthSessionState,
-      ),
-      Effect.catchTag("AuthError", () =>
-        Effect.succeed({
-          authenticated: false,
-          auth: descriptor,
-        } satisfies AuthSessionState),
-      ),
-    );
-
-  const exchangeBootstrapCredential: ServerAuthShape["exchangeBootstrapCredential"] = (
-    credential,
-    requestMetadata,
-  ) =>
-    bootstrapCredentials.consume(credential).pipe(
-      Effect.mapError(toBootstrapExchangeAuthError),
-      Effect.flatMap((grant) =>
-        sessions
-          .issue({
-            method: "browser-session-cookie",
-            subject: grant.subject,
-            role: grant.role,
-            client: {
-              ...requestMetadata,
-              ...(grant.label ? { label: grant.label } : {}),
-            },
-          })
-          .pipe(
-            Effect.mapError(
-              (cause) =>
-                new AuthError({
-                  message: "Failed to issue authenticated session.",
-                  cause,
-                }),
-            ),
-          ),
-      ),
-      Effect.map(
-        (session) =>
-          ({
-            response: {
-              authenticated: true,
-              role: session.role,
-              sessionMethod: session.method,
-              expiresAt: DateTime.toUtc(session.expiresAt),
-            } satisfies AuthBootstrapResult,
-            sessionToken: session.token,
-          }) satisfies BootstrapExchangeResult,
-      ),
-    );
-
-  const exchangeBootstrapCredentialForBearerSession: ServerAuthShape["exchangeBootstrapCredentialForBearerSession"] =
-    (credential, requestMetadata) =>
-      bootstrapCredentials.consume(credential).pipe(
-        Effect.mapError(toBootstrapExchangeAuthError),
-        Effect.flatMap((grant) =>
-          sessions
-            .issue({
-              method: "bearer-session-token",
-              subject: grant.subject,
-              role: grant.role,
-              client: {
-                ...requestMetadata,
-                ...(grant.label ? { label: grant.label } : {}),
-              },
-            })
-            .pipe(
-              Effect.mapError(
-                (cause) =>
-                  new AuthError({
-                    message: "Failed to issue authenticated session.",
-                    cause,
-                  }),
-              ),
-            ),
-        ),
-        Effect.map(
-          (session) =>
-            ({
-              authenticated: true,
-              role: session.role,
-              sessionMethod: "bearer-session-token",
-              expiresAt: DateTime.toUtc(session.expiresAt),
-              sessionToken: session.token,
-            }) satisfies AuthBearerBootstrapResult,
-        ),
-      );
-
-  const issuePairingCredential: ServerAuthShape["issuePairingCredential"] = (input) =>
-    authControlPlane
-      .createPairingLink({
-        role: input?.role ?? "client",
-        subject: input?.role === "owner" ? "owner-bootstrap" : "one-time-token",
-        ...(input?.label ? { label: input.label } : {}),
-      })
-      .pipe(
-        Effect.mapError(
-          (cause) =>
-            new AuthError({
-              message: "Failed to issue pairing credential.",
-              cause,
-            }),
-        ),
-        Effect.map(
-          (issued) =>
-            ({
-              id: issued.id,
-              credential: issued.credential,
-              ...(issued.label ? { label: issued.label } : {}),
-              expiresAt: issued.expiresAt,
-            }) satisfies AuthPairingCredentialResult,
-        ),
-      );
-
-  const listPairingLinks: ServerAuthShape["listPairingLinks"] = () =>
-    authControlPlane
-      .listPairingLinks({
-        role: "client",
-        excludeSubjects: ["owner-bootstrap"],
-      })
-      .pipe(
-        Effect.mapError(
-          (cause) =>
-            new AuthError({
-              message: "Failed to load pairing links.",
-              cause,
-            }),
-        ),
-      );
-
-  const revokePairingLink: ServerAuthShape["revokePairingLink"] = (id) =>
-    authControlPlane.revokePairingLink(id).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Failed to revoke pairing link.",
-            cause,
-          }),
-      ),
-    );
-
-  const listClientSessions: ServerAuthShape["listClientSessions"] = (currentSessionId) =>
-    authControlPlane.listSessions().pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Failed to load paired clients.",
-            cause,
-          }),
-      ),
-      Effect.map((clientSessions) =>
-        clientSessions.map(
-          (clientSession): AuthClientSession => ({
-            ...clientSession,
-            current: clientSession.sessionId === currentSessionId,
-          }),
-        ),
-      ),
-    );
-
-  const revokeClientSession: ServerAuthShape["revokeClientSession"] = (
-    currentSessionId,
-    targetSessionId,
-  ) =>
-    Effect.gen(function* () {
-      if (currentSessionId === targetSessionId) {
-        return yield* new AuthError({
-          message: "Use revoke other clients to keep the current owner session active.",
-          status: 403,
-        });
-      }
-      return yield* authControlPlane.revokeSession(targetSessionId).pipe(
-        Effect.mapError(
-          (cause) =>
-            new AuthError({
-              message: "Failed to revoke client session.",
-              cause,
-            }),
-        ),
-      );
-    });
-
-  const revokeOtherClientSessions: ServerAuthShape["revokeOtherClientSessions"] = (
-    currentSessionId,
-  ) =>
-    authControlPlane.revokeOtherSessionsExcept(currentSessionId).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Failed to revoke other client sessions.",
-            cause,
-          }),
-      ),
-    );
-
-  const issueStartupPairingUrl: ServerAuthShape["issueStartupPairingUrl"] = (baseUrl) =>
-    issuePairingCredential({ role: "owner" }).pipe(
-      Effect.map((issued) => {
-        const url = new URL(baseUrl);
-        url.pathname = "/pair";
-        url.searchParams.delete("token");
-        url.hash = new URLSearchParams([["token", issued.credential]]).toString();
-        return url.toString();
-      }),
-    );
-
-  const issueWebSocketToken: ServerAuthShape["issueWebSocketToken"] = (session) =>
-    sessions.issueWebSocketToken(session.sessionId).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Failed to issue websocket token.",
-            cause,
-          }),
-      ),
-      Effect.map(
-        (issued) =>
-          ({
-            token: issued.token,
-            expiresAt: DateTime.toUtc(issued.expiresAt),
-          }) satisfies AuthWebSocketTokenResult,
-      ),
-    );
-
-  const authenticateWebSocketUpgrade: ServerAuthShape["authenticateWebSocketUpgrade"] = (request) =>
-    Effect.gen(function* () {
-      const requestUrl = HttpServerRequest.toURL(request);
-      if (Option.isSome(requestUrl)) {
-        const websocketToken = requestUrl.value.searchParams.get(WEBSOCKET_TOKEN_QUERY_PARAM);
-        if (websocketToken && websocketToken.trim().length > 0) {
-          return yield* sessions.verifyWebSocketToken(websocketToken).pipe(
-            Effect.map((session) => ({
-              sessionId: session.sessionId,
-              subject: session.subject,
-              method: session.method,
-              role: session.role,
-              ...(session.expiresAt ? { expiresAt: session.expiresAt } : {}),
-            })),
-            Effect.mapError(
-              (cause) =>
-                new AuthError({
-                  message: "Unauthorized request.",
-                  status: 401,
-                  cause,
-                }),
-            ),
-          );
-        }
-      }
-
-      return yield* authenticateRequest(request);
-    });
-
-  return {
-    getDescriptor: () => Effect.succeed(descriptor),
-    getSessionState,
-    exchangeBootstrapCredential,
-    exchangeBootstrapCredentialForBearerSession,
-    issuePairingCredential,
-    listPairingLinks,
-    revokePairingLink,
-    listClientSessions,
-    revokeClientSession,
-    revokeOtherClientSessions,
-    authenticateHttpRequest: authenticateRequest,
-    authenticateWebSocketUpgrade,
-    issueWebSocketToken,
-    issueStartupPairingUrl,
-  } satisfies ServerAuthShape;
-});
-
-export const ServerAuthLive = Layer.effect(ServerAuth, makeServerAuth).pipe(
-  Layer.provideMerge(AuthControlPlaneLive),
-  Layer.provideMerge(AuthCoreLive),
-  Layer.provideMerge(ServerAuthPolicyLive),
-);
diff --git a/apps/server/src/auth/Layers/ServerSecretStore.ts b/apps/server/src/auth/Layers/ServerSecretStore.ts
deleted file mode 100644
index d80242280bd..00000000000
--- a/apps/server/src/auth/Layers/ServerSecretStore.ts
+++ /dev/null
@@ -1,152 +0,0 @@
-import * as Crypto from "node:crypto";
-
-import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Layer from "effect/Layer";
-import * as Path from "effect/Path";
-import * as Predicate from "effect/Predicate";
-import * as PlatformError from "effect/PlatformError";
-
-import { ServerConfig } from "../../config.ts";
-import {
-  SecretStoreError,
-  ServerSecretStore,
-  type ServerSecretStoreShape,
-} from "../Services/ServerSecretStore.ts";
-
-export const makeServerSecretStore = Effect.gen(function* () {
-  const fileSystem = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-  const serverConfig = yield* ServerConfig;
-
-  yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
-  yield* fileSystem.chmod(serverConfig.secretsDir, 0o700).pipe(
-    Effect.mapError(
-      (cause) =>
-        new SecretStoreError({
-          message: `Failed to secure secrets directory ${serverConfig.secretsDir}.`,
-          cause,
-        }),
-    ),
-  );
-
-  const resolveSecretPath = (name: string) => path.join(serverConfig.secretsDir, `${name}.bin`);
-
-  const isPlatformError = (u: unknown): u is PlatformError.PlatformError =>
-    Predicate.isTagged(u, "PlatformError");
-
-  const get: ServerSecretStoreShape["get"] = (name) =>
-    fileSystem.readFile(resolveSecretPath(name)).pipe(
-      Effect.map((bytes) => Uint8Array.from(bytes)),
-      Effect.catch((cause) =>
-        cause.reason._tag === "NotFound"
-          ? Effect.succeed(null)
-          : Effect.fail(
-              new SecretStoreError({
-                message: `Failed to read secret ${name}.`,
-                cause,
-              }),
-            ),
-      ),
-    );
-
-  const set: ServerSecretStoreShape["set"] = (name, value) => {
-    const secretPath = resolveSecretPath(name);
-    const tempPath = `${secretPath}.${Crypto.randomUUID()}.tmp`;
-    return Effect.gen(function* () {
-      yield* fileSystem.writeFile(tempPath, value);
-      yield* fileSystem.chmod(tempPath, 0o600);
-      yield* fileSystem.rename(tempPath, secretPath);
-      yield* fileSystem.chmod(secretPath, 0o600);
-    }).pipe(
-      Effect.catch((cause) =>
-        fileSystem.remove(tempPath).pipe(
-          Effect.ignore,
-          Effect.flatMap(() =>
-            Effect.fail(
-              new SecretStoreError({
-                message: `Failed to persist secret ${name}.`,
-                cause,
-              }),
-            ),
-          ),
-        ),
-      ),
-    );
-  };
-
-  const create: ServerSecretStoreShape["set"] = (name, value) => {
-    const secretPath = resolveSecretPath(name);
-    return Effect.scoped(
-      Effect.gen(function* () {
-        const file = yield* fileSystem.open(secretPath, {
-          flag: "wx",
-          mode: 0o600,
-        });
-        yield* file.writeAll(value);
-        yield* file.sync;
-        yield* fileSystem.chmod(secretPath, 0o600);
-      }),
-    ).pipe(
-      Effect.mapError(
-        (cause) =>
-          new SecretStoreError({
-            message: `Failed to persist secret ${name}.`,
-            cause,
-          }),
-      ),
-    );
-  };
-
-  const getOrCreateRandom: ServerSecretStoreShape["getOrCreateRandom"] = (name, bytes) =>
-    get(name).pipe(
-      Effect.flatMap((existing) => {
-        if (existing) {
-          return Effect.succeed(existing);
-        }
-
-        const generated = Crypto.randomBytes(bytes);
-        return create(name, generated).pipe(
-          Effect.as(Uint8Array.from(generated)),
-          Effect.catchTag("SecretStoreError", (error) =>
-            isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists"
-              ? get(name).pipe(
-                  Effect.flatMap((created) =>
-                    created !== null
-                      ? Effect.succeed(created)
-                      : Effect.fail(
-                          new SecretStoreError({
-                            message: `Failed to read secret ${name} after concurrent creation.`,
-                          }),
-                        ),
-                  ),
-                )
-              : Effect.fail(error),
-          ),
-        );
-      }),
-    );
-
-  const remove: ServerSecretStoreShape["remove"] = (name) =>
-    fileSystem.remove(resolveSecretPath(name)).pipe(
-      Effect.catch((cause) =>
-        cause.reason._tag === "NotFound"
-          ? Effect.void
-          : Effect.fail(
-              new SecretStoreError({
-                message: `Failed to remove secret ${name}.`,
-                cause,
-              }),
-            ),
-      ),
-    );
-
-  return {
-    get,
-    set,
-    getOrCreateRandom,
-    remove,
-  } satisfies ServerSecretStoreShape;
-});
-
-export const ServerSecretStoreLive = Layer.effect(ServerSecretStore, makeServerSecretStore);
diff --git a/apps/server/src/auth/Layers/BootstrapCredentialService.test.ts b/apps/server/src/auth/PairingGrantStore.test.ts
similarity index 69%
rename from apps/server/src/auth/Layers/BootstrapCredentialService.test.ts
rename to apps/server/src/auth/PairingGrantStore.test.ts
index 110dae84379..0c33a753f7d 100644
--- a/apps/server/src/auth/Layers/BootstrapCredentialService.test.ts
+++ b/apps/server/src/auth/PairingGrantStore.test.ts
@@ -5,11 +5,10 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as TestClock from "effect/testing/TestClock";
 
-import type { ServerConfigShape } from "../../config.ts";
-import { ServerConfig } from "../../config.ts";
-import { SqlitePersistenceMemory } from "../../persistence/Layers/Sqlite.ts";
-import { BootstrapCredentialService } from "../Services/BootstrapCredentialService.ts";
-import { BootstrapCredentialServiceLive } from "./BootstrapCredentialService.ts";
+import type { ServerConfigShape } from "../config.ts";
+import { ServerConfig } from "../config.ts";
+import { SqlitePersistenceMemory } from "../persistence/Layers/Sqlite.ts";
+import * as PairingGrantStore from "./PairingGrantStore.ts";
 
 const makeServerConfigLayer = (
   overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
@@ -27,44 +26,50 @@ const makeServerConfigLayer = (
     Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-auth-bootstrap-test-" })),
   );
 
-const makeBootstrapCredentialLayer = (
+const makePairingGrantStoreLayer = (
   overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
 ) =>
-  BootstrapCredentialServiceLive.pipe(
+  PairingGrantStore.layer.pipe(
     Layer.provide(SqlitePersistenceMemory),
     Layer.provide(makeServerConfigLayer(overrides)),
   );
 
-it.layer(NodeServices.layer)("BootstrapCredentialServiceLive", (it) => {
+it.layer(NodeServices.layer)("PairingGrantStore.layer", (it) => {
   it.effect("issues pairing tokens in a short manual-entry format", () =>
     Effect.gen(function* () {
-      const bootstrapCredentials = yield* BootstrapCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
       const issued = yield* bootstrapCredentials.issueOneTimeToken();
 
       expect(issued.credential).toMatch(/^[23456789ABCDEFGHJKLMNPQRSTUVWXYZ]{12}$/);
-    }).pipe(Effect.provide(makeBootstrapCredentialLayer())),
+    }).pipe(Effect.provide(makePairingGrantStoreLayer())),
   );
 
   it.effect("issues one-time bootstrap tokens that can only be consumed once", () =>
     Effect.gen(function* () {
-      const bootstrapCredentials = yield* BootstrapCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
       const issued = yield* bootstrapCredentials.issueOneTimeToken({ label: "Julius iPhone" });
       const first = yield* bootstrapCredentials.consume(issued.credential);
       const second = yield* Effect.flip(bootstrapCredentials.consume(issued.credential));
 
       expect(first.method).toBe("one-time-token");
-      expect(first.role).toBe("client");
+      expect(first.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+      ]);
       expect(first.subject).toBe("one-time-token");
       expect(first.label).toBe("Julius iPhone");
       expect(issued.label).toBe("Julius iPhone");
-      expect(second._tag).toBe("BootstrapCredentialError");
+      expect(second._tag).toBe("BootstrapCredentialInvalidError");
       expect(second.message).toContain("Unknown bootstrap credential");
-    }).pipe(Effect.provide(makeBootstrapCredentialLayer())),
+    }).pipe(Effect.provide(makePairingGrantStoreLayer())),
   );
 
   it.effect("atomically consumes a one-time token when multiple requests race", () =>
     Effect.gen(function* () {
-      const bootstrapCredentials = yield* BootstrapCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
       const token = yield* bootstrapCredentials.issueOneTimeToken();
       const results = yield* Effect.all(
         Array.from({ length: 8 }, () =>
@@ -81,26 +86,34 @@ it.layer(NodeServices.layer)("BootstrapCredentialServiceLive", (it) => {
       expect(successes).toHaveLength(1);
       expect(failures).toHaveLength(7);
       for (const failure of failures) {
-        expect(failure.failure._tag).toBe("BootstrapCredentialError");
+        expect(failure.failure._tag).toBe("BootstrapCredentialInvalidError");
         expect(failure.failure.message).toContain("Unknown bootstrap credential");
       }
-    }).pipe(Effect.provide(makeBootstrapCredentialLayer())),
+    }).pipe(Effect.provide(makePairingGrantStoreLayer())),
   );
 
   it.effect("seeds the desktop bootstrap credential as a one-time grant", () =>
     Effect.gen(function* () {
-      const bootstrapCredentials = yield* BootstrapCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
       const first = yield* bootstrapCredentials.consume("desktop-bootstrap-token");
       const second = yield* Effect.flip(bootstrapCredentials.consume("desktop-bootstrap-token"));
 
       expect(first.method).toBe("desktop-bootstrap");
-      expect(first.role).toBe("owner");
+      expect(first.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
       expect(first.subject).toBe("desktop-bootstrap");
-      expect(second._tag).toBe("BootstrapCredentialError");
-      expect(second.status).toBe(401);
+      expect(second._tag).toBe("BootstrapCredentialInvalidError");
     }).pipe(
       Effect.provide(
-        makeBootstrapCredentialLayer({
+        makePairingGrantStoreLayer({
           desktopBootstrapToken: "desktop-bootstrap-token",
         }),
       ),
@@ -109,18 +122,17 @@ it.layer(NodeServices.layer)("BootstrapCredentialServiceLive", (it) => {
 
   it.effect("reports seeded desktop bootstrap credentials as expired after their ttl", () =>
     Effect.gen(function* () {
-      const bootstrapCredentials = yield* BootstrapCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
 
       yield* TestClock.adjust(Duration.minutes(6));
       const expired = yield* Effect.flip(bootstrapCredentials.consume("desktop-bootstrap-token"));
 
-      expect(expired._tag).toBe("BootstrapCredentialError");
-      expect(expired.status).toBe(401);
+      expect(expired._tag).toBe("BootstrapCredentialInvalidError");
       expect(expired.message).toContain("Bootstrap credential expired");
     }).pipe(
       Effect.provide(
         Layer.merge(
-          makeBootstrapCredentialLayer({
+          makePairingGrantStoreLayer({
             desktopBootstrapToken: "desktop-bootstrap-token",
           }),
           TestClock.layer(),
@@ -131,9 +143,11 @@ it.layer(NodeServices.layer)("BootstrapCredentialServiceLive", (it) => {
 
   it.effect("lists and revokes active pairing links", () =>
     Effect.gen(function* () {
-      const bootstrapCredentials = yield* BootstrapCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
       const first = yield* bootstrapCredentials.issueOneTimeToken();
-      const second = yield* bootstrapCredentials.issueOneTimeToken({ role: "owner" });
+      const second = yield* bootstrapCredentials.issueOneTimeToken({
+        scopes: ["orchestration:read", "access:write"],
+      });
 
       const activeBeforeRevoke = yield* bootstrapCredentials.listActive();
       expect(activeBeforeRevoke.map((entry) => entry.id)).toContain(first.id);
@@ -147,7 +161,7 @@ it.layer(NodeServices.layer)("BootstrapCredentialServiceLive", (it) => {
       expect(activeAfterRevoke.map((entry) => entry.id)).not.toContain(first.id);
       expect(activeAfterRevoke.map((entry) => entry.id)).toContain(second.id);
       expect(revokedConsume.message).toContain("no longer available");
-      expect(revokedConsume.status).toBe(401);
-    }).pipe(Effect.provide(makeBootstrapCredentialLayer())),
+      expect(revokedConsume._tag).toBe("BootstrapCredentialInvalidError");
+    }).pipe(Effect.provide(makePairingGrantStoreLayer())),
   );
 });
diff --git a/apps/server/src/auth/Layers/BootstrapCredentialService.ts b/apps/server/src/auth/PairingGrantStore.ts
similarity index 59%
rename from apps/server/src/auth/Layers/BootstrapCredentialService.ts
rename to apps/server/src/auth/PairingGrantStore.ts
index 394a20dc62f..4fcc133ebb4 100644
--- a/apps/server/src/auth/Layers/BootstrapCredentialService.ts
+++ b/apps/server/src/auth/PairingGrantStore.ts
@@ -1,5 +1,13 @@
-import type { AuthPairingLink } from "@t3tools/contracts";
+import {
+  AuthAdministrativeScopes,
+  AuthStandardClientScopes,
+  type AuthEnvironmentScope,
+  type AuthPairingLink,
+  type ServerAuthBootstrapMethod,
+} from "@t3tools/contracts";
+import * as Context from "effect/Context";
 import * as Crypto from "effect/Crypto";
+import * as Data from "effect/Data";
 import * as DateTime from "effect/DateTime";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
@@ -9,17 +17,71 @@ import * as Ref from "effect/Ref";
 import * as Stream from "effect/Stream";
 import * as Option from "effect/Option";
 
-import { ServerConfig } from "../../config.ts";
-import { AuthPairingLinkRepositoryLive } from "../../persistence/Layers/AuthPairingLinks.ts";
-import { AuthPairingLinkRepository } from "../../persistence/Services/AuthPairingLinks.ts";
-import {
-  BootstrapCredentialError,
-  BootstrapCredentialService,
-  type BootstrapCredentialChange,
-  type BootstrapCredentialServiceShape,
-  type BootstrapGrant,
-  type IssuedBootstrapCredential,
-} from "../Services/BootstrapCredentialService.ts";
+import { ServerConfig } from "../config.ts";
+import { AuthPairingLinkRepositoryLive } from "../persistence/Layers/AuthPairingLinks.ts";
+import { AuthPairingLinkRepository } from "../persistence/Services/AuthPairingLinks.ts";
+
+export interface BootstrapGrant {
+  readonly method: ServerAuthBootstrapMethod;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+  readonly subject: string;
+  readonly label?: string;
+  readonly expiresAt: DateTime.DateTime;
+}
+
+export class BootstrapCredentialInvalidError extends Data.TaggedError(
+  "BootstrapCredentialInvalidError",
+)<{
+  readonly message: string;
+}> {}
+
+export class BootstrapCredentialInternalError extends Data.TaggedError(
+  "BootstrapCredentialInternalError",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export type BootstrapCredentialError =
+  | BootstrapCredentialInvalidError
+  | BootstrapCredentialInternalError;
+
+export interface IssuedBootstrapCredential {
+  readonly id: string;
+  readonly credential: string;
+  readonly label?: string;
+  readonly expiresAt: DateTime.Utc;
+}
+
+export type BootstrapCredentialChange =
+  | {
+      readonly type: "pairingLinkUpserted";
+      readonly pairingLink: AuthPairingLink;
+    }
+  | {
+      readonly type: "pairingLinkRemoved";
+      readonly id: string;
+    };
+
+export interface PairingGrantStoreShape {
+  readonly issueOneTimeToken: (input?: {
+    readonly ttl?: Duration.Duration;
+    readonly scopes?: ReadonlyArray<AuthEnvironmentScope>;
+    readonly subject?: string;
+    readonly label?: string;
+  }) => Effect.Effect<IssuedBootstrapCredential, BootstrapCredentialInternalError>;
+  readonly listActive: () => Effect.Effect<
+    ReadonlyArray<AuthPairingLink>,
+    BootstrapCredentialInternalError
+  >;
+  readonly streamChanges: Stream.Stream<BootstrapCredentialChange>;
+  readonly revoke: (id: string) => Effect.Effect<boolean, BootstrapCredentialInternalError>;
+  readonly consume: (credential: string) => Effect.Effect<BootstrapGrant, BootstrapCredentialError>;
+}
+
+export class PairingGrantStore extends Context.Service<PairingGrantStore, PairingGrantStoreShape>()(
+  "t3/auth/PairingGrantStore",
+) {}
 
 interface StoredBootstrapGrant extends BootstrapGrant {
   readonly remainingUses: number | "unbounded";
@@ -39,32 +101,42 @@ type ConsumeResult =
 const DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES = Duration.minutes(5);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
+const PAIRING_TOKEN_REJECTION_LIMIT =
+  Math.floor(256 / PAIRING_TOKEN_ALPHABET.length) * PAIRING_TOKEN_ALPHABET.length;
 
-const generatePairingToken = (): string => {
-  const randomBytes = crypto.getRandomValues(new Uint8Array(PAIRING_TOKEN_LENGTH));
+const invalidBootstrapCredentialError = (message: string) =>
+  new BootstrapCredentialInvalidError({
+    message,
+  });
 
-  return Array.from(randomBytes, (value) => PAIRING_TOKEN_ALPHABET[value & 31]).join("");
-};
+const internalBootstrapCredentialError = (message: string, cause: unknown) =>
+  new BootstrapCredentialInternalError({
+    message,
+    cause,
+  });
 
-export const makeBootstrapCredentialService = Effect.gen(function* () {
+export const make = Effect.fn("makePairingGrantStore")(function* () {
   const crypto = yield* Crypto.Crypto;
   const config = yield* ServerConfig;
   const pairingLinks = yield* AuthPairingLinkRepository;
   const seededGrantsRef = yield* Ref.make(new Map<string, StoredBootstrapGrant>());
   const changesPubSub = yield* PubSub.unbounded<BootstrapCredentialChange>();
-
-  const invalidBootstrapCredentialError = (message: string) =>
-    new BootstrapCredentialError({
-      message,
-      status: 401,
-    });
-
-  const internalBootstrapCredentialError = (message: string, cause: unknown) =>
-    new BootstrapCredentialError({
-      message,
-      status: 500,
-      cause,
-    });
+  const generatePairingToken = Effect.gen(function* () {
+    let credential = "";
+    while (credential.length < PAIRING_TOKEN_LENGTH) {
+      const bytes = yield* crypto.randomBytes(PAIRING_TOKEN_LENGTH);
+      for (const byte of bytes) {
+        if (byte >= PAIRING_TOKEN_REJECTION_LIMIT) {
+          continue;
+        }
+        credential += PAIRING_TOKEN_ALPHABET[byte % PAIRING_TOKEN_ALPHABET.length]!;
+        if (credential.length === PAIRING_TOKEN_LENGTH) {
+          return credential;
+        }
+      }
+    }
+    return credential;
+  });
 
   const seedGrant = (credential: string, grant: StoredBootstrapGrant) =>
     Ref.update(seededGrantsRef, (current) => {
@@ -89,7 +161,7 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
     const now = yield* DateTime.now;
     yield* seedGrant(config.desktopBootstrapToken, {
       method: "desktop-bootstrap",
-      role: "owner",
+      scopes: AuthAdministrativeScopes,
       subject: "desktop-bootstrap",
       expiresAt: DateTime.add(now, {
         milliseconds: Duration.toMillis(DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES),
@@ -101,8 +173,10 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
   const toBootstrapCredentialError = (message: string) => (cause: unknown) =>
     internalBootstrapCredentialError(message, cause);
 
-  const listActive: BootstrapCredentialServiceShape["listActive"] = () =>
-    Effect.gen(function* () {
+  const listActive: PairingGrantStoreShape["listActive"] = Effect.fn(
+    "PairingGrantStore.listActive",
+  )(
+    function* () {
       const now = yield* DateTime.now;
       const rows = yield* pairingLinks.listActive({ now });
 
@@ -111,7 +185,7 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
           ? ({
               id: row.id,
               credential: row.credential,
-              role: row.role,
+              scopes: row.scopes,
               subject: row.subject,
               label: row.label,
               createdAt: row.createdAt,
@@ -120,16 +194,18 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
           : ({
               id: row.id,
               credential: row.credential,
-              role: row.role,
+              scopes: row.scopes,
               subject: row.subject,
               createdAt: row.createdAt,
               expiresAt: row.expiresAt,
             } satisfies AuthPairingLink),
       );
-    }).pipe(Effect.mapError(toBootstrapCredentialError("Failed to load active pairing links.")));
+    },
+    Effect.mapError(toBootstrapCredentialError("Failed to load active pairing links.")),
+  );
 
-  const revoke: BootstrapCredentialServiceShape["revoke"] = (id) =>
-    Effect.gen(function* () {
+  const revoke: PairingGrantStoreShape["revoke"] = Effect.fn("PairingGrantStore.revoke")(
+    function* (id) {
       const revokedAt = yield* DateTime.now;
       const revoked = yield* pairingLinks.revoke({
         id,
@@ -139,12 +215,16 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
         yield* emitRemoved(id);
       }
       return revoked;
-    }).pipe(Effect.mapError(toBootstrapCredentialError("Failed to revoke pairing link.")));
+    },
+    Effect.mapError(toBootstrapCredentialError("Failed to revoke pairing link.")),
+  );
 
-  const issueOneTimeToken: BootstrapCredentialServiceShape["issueOneTimeToken"] = (input) =>
-    Effect.gen(function* () {
+  const issueOneTimeToken: PairingGrantStoreShape["issueOneTimeToken"] = Effect.fn(
+    "PairingGrantStore.issueOneTimeToken",
+  )(
+    function* (input) {
       const id = yield* crypto.randomUUIDv4;
-      const credential = generatePairingToken();
+      const credential = yield* generatePairingToken;
       const ttl = input?.ttl ?? DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES;
       const now = yield* DateTime.now;
       const expiresAt = DateTime.add(now, { milliseconds: Duration.toMillis(ttl) });
@@ -158,7 +238,7 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
         id,
         credential,
         method: "one-time-token",
-        role: input?.role ?? "client",
+        scopes: input?.scopes ?? AuthStandardClientScopes,
         subject: input?.subject ?? "one-time-token",
         label: input?.label ?? null,
         createdAt: now,
@@ -167,17 +247,19 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
       yield* emitUpsert({
         id,
         credential,
-        role: input?.role ?? "client",
+        scopes: input?.scopes ?? AuthStandardClientScopes,
         subject: input?.subject ?? "one-time-token",
         ...(input?.label ? { label: input.label } : {}),
         createdAt: now,
         expiresAt,
       });
       return issued;
-    }).pipe(Effect.mapError(toBootstrapCredentialError("Failed to issue pairing credential.")));
+    },
+    Effect.mapError(toBootstrapCredentialError("Failed to issue pairing credential.")),
+  );
 
-  const consume: BootstrapCredentialServiceShape["consume"] = (credential) =>
-    Effect.gen(function* () {
+  const consume: PairingGrantStoreShape["consume"] = Effect.fn("PairingGrantStore.consume")(
+    function* (credential) {
       const now = yield* DateTime.now;
       const seededResult: ConsumeResult = yield* Ref.modify(
         seededGrantsRef,
@@ -224,7 +306,7 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
               _tag: "success",
               grant: {
                 method: grant.method,
-                role: grant.role,
+                scopes: grant.scopes,
                 subject: grant.subject,
                 ...(grant.label ? { label: grant.label } : {}),
                 expiresAt: grant.expiresAt,
@@ -252,7 +334,7 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
         yield* emitRemoved(consumed.value.id);
         return {
           method: consumed.value.method,
-          role: consumed.value.role,
+          scopes: consumed.value.scopes,
           subject: consumed.value.subject,
           ...(consumed.value.label ? { label: consumed.value.label } : {}),
           expiresAt: consumed.value.expiresAt,
@@ -279,13 +361,14 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
       }
 
       return yield* invalidBootstrapCredentialError("Bootstrap credential is no longer available.");
-    }).pipe(
-      Effect.mapError((cause) =>
-        cause instanceof BootstrapCredentialError
-          ? cause
-          : internalBootstrapCredentialError("Failed to consume bootstrap credential.", cause),
-      ),
-    );
+    },
+    Effect.mapError((cause) =>
+      cause._tag === "BootstrapCredentialInvalidError" ||
+      cause._tag === "BootstrapCredentialInternalError"
+        ? cause
+        : internalBootstrapCredentialError("Failed to consume bootstrap credential.", cause),
+    ),
+  );
 
   return {
     issueOneTimeToken,
@@ -295,10 +378,9 @@ export const makeBootstrapCredentialService = Effect.gen(function* () {
     },
     revoke,
     consume,
-  } satisfies BootstrapCredentialServiceShape;
+  } satisfies PairingGrantStoreShape;
 });
 
-export const BootstrapCredentialServiceLive = Layer.effect(
-  BootstrapCredentialService,
-  makeBootstrapCredentialService,
-).pipe(Layer.provideMerge(AuthPairingLinkRepositoryLive));
+export const layer = Layer.effect(PairingGrantStore, make()).pipe(
+  Layer.provideMerge(AuthPairingLinkRepositoryLive),
+);
diff --git a/apps/server/src/auth/Layers/ServerSecretStore.test.ts b/apps/server/src/auth/ServerSecretStore.test.ts
similarity index 89%
rename from apps/server/src/auth/Layers/ServerSecretStore.test.ts
rename to apps/server/src/auth/ServerSecretStore.test.ts
index 30b5a9d35ed..93339f4d4db 100644
--- a/apps/server/src/auth/Layers/ServerSecretStore.test.ts
+++ b/apps/server/src/auth/ServerSecretStore.test.ts
@@ -8,15 +8,14 @@ import * as Layer from "effect/Layer";
 import * as Ref from "effect/Ref";
 import * as PlatformError from "effect/PlatformError";
 
-import { ServerConfig } from "../../config.ts";
-import { SecretStoreError, ServerSecretStore } from "../Services/ServerSecretStore.ts";
-import { ServerSecretStoreLive } from "./ServerSecretStore.ts";
+import { ServerConfig } from "../config.ts";
+import * as ServerSecretStore from "./ServerSecretStore.ts";
 
 const makeServerConfigLayer = () =>
   ServerConfig.layerTest(process.cwd(), { prefix: "t3-secret-store-test-" });
 
 const makeServerSecretStoreLayer = () =>
-  Layer.provide(ServerSecretStoreLive, makeServerConfigLayer());
+  Layer.provide(ServerSecretStore.layer, makeServerConfigLayer());
 
 const PermissionDeniedFileSystemLayer = Layer.effect(
   FileSystem.FileSystem,
@@ -40,7 +39,7 @@ const PermissionDeniedFileSystemLayer = Layer.effect(
 ).pipe(Layer.provide(NodeServices.layer));
 
 const makePermissionDeniedSecretStoreLayer = () =>
-  ServerSecretStoreLive.pipe(
+  ServerSecretStore.layer.pipe(
     Layer.provide(makeServerConfigLayer()),
     Layer.provideMerge(PermissionDeniedFileSystemLayer),
   );
@@ -67,7 +66,7 @@ const RenameFailureFileSystemLayer = Layer.effect(
 ).pipe(Layer.provide(NodeServices.layer));
 
 const makeRenameFailureSecretStoreLayer = () =>
-  ServerSecretStoreLive.pipe(
+  ServerSecretStore.layer.pipe(
     Layer.provide(makeServerConfigLayer()),
     Layer.provideMerge(RenameFailureFileSystemLayer),
   );
@@ -94,7 +93,7 @@ const RemoveFailureFileSystemLayer = Layer.effect(
 ).pipe(Layer.provide(NodeServices.layer));
 
 const makeRemoveFailureSecretStoreLayer = () =>
-  ServerSecretStoreLive.pipe(
+  ServerSecretStore.layer.pipe(
     Layer.provide(makeServerConfigLayer()),
     Layer.provideMerge(RemoveFailureFileSystemLayer),
   );
@@ -140,15 +139,15 @@ const ConcurrentReadMissFileSystemLayer = Layer.effect(
 ).pipe(Layer.provide(NodeServices.layer));
 
 const makeConcurrentCreateSecretStoreLayer = () =>
-  ServerSecretStoreLive.pipe(
+  ServerSecretStore.layer.pipe(
     Layer.provide(makeServerConfigLayer()),
     Layer.provideMerge(ConcurrentReadMissFileSystemLayer),
   );
 
-it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
+it.layer(NodeServices.layer)("ServerSecretStore.layer", (it) => {
   it.effect("returns null when a secret file does not exist", () =>
     Effect.gen(function* () {
-      const secretStore = yield* ServerSecretStore;
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
 
       const secret = yield* secretStore.get("missing-secret");
 
@@ -158,7 +157,7 @@ it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
 
   it.effect("reuses an existing secret instead of regenerating it", () =>
     Effect.gen(function* () {
-      const secretStore = yield* ServerSecretStore;
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
 
       const first = yield* secretStore.getOrCreateRandom("session-signing-key", 32);
       const second = yield* secretStore.getOrCreateRandom("session-signing-key", 32);
@@ -169,7 +168,7 @@ it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
 
   it.effect("returns the persisted secret when concurrent creators race", () =>
     Effect.gen(function* () {
-      const secretStore = yield* ServerSecretStore;
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
 
       const [first, second] = yield* Effect.all(
         [
@@ -207,9 +206,9 @@ it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
         }),
       ).pipe(Layer.provide(NodeServices.layer));
 
-      const secretStore = yield* Effect.service(ServerSecretStore).pipe(
+      const secretStore = yield* Effect.service(ServerSecretStore.ServerSecretStore).pipe(
         Effect.provide(
-          ServerSecretStoreLive.pipe(
+          ServerSecretStore.layer.pipe(
             Layer.provide(makeServerConfigLayer()),
             Layer.provideMerge(recordingFileSystemLayer),
           ),
@@ -227,11 +226,11 @@ it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
 
   it.effect("propagates read failures other than missing-file errors", () =>
     Effect.gen(function* () {
-      const secretStore = yield* ServerSecretStore;
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
 
       const error = yield* Effect.flip(secretStore.getOrCreateRandom("session-signing-key", 32));
 
-      expect(error).toBeInstanceOf(SecretStoreError);
+      expect(error).toBeInstanceOf(ServerSecretStore.SecretStoreError);
       expect(error.message).toContain("Failed to read secret session-signing-key.");
       expect(error.cause).toBeInstanceOf(PlatformError.PlatformError);
       expect((error.cause as PlatformError.PlatformError).reason._tag).toBe("PermissionDenied");
@@ -240,13 +239,13 @@ it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
 
   it.effect("propagates write failures instead of treating them as success", () =>
     Effect.gen(function* () {
-      const secretStore = yield* ServerSecretStore;
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
 
       const error = yield* Effect.flip(
         secretStore.set("session-signing-key", Uint8Array.from([1, 2, 3])),
       );
 
-      expect(error).toBeInstanceOf(SecretStoreError);
+      expect(error).toBeInstanceOf(ServerSecretStore.SecretStoreError);
       expect(error.message).toContain("Failed to persist secret session-signing-key.");
       expect(error.cause).toBeInstanceOf(PlatformError.PlatformError);
       expect((error.cause as PlatformError.PlatformError).reason._tag).toBe("PermissionDenied");
@@ -255,11 +254,11 @@ it.layer(NodeServices.layer)("ServerSecretStoreLive", (it) => {
 
   it.effect("propagates remove failures other than missing-file errors", () =>
     Effect.gen(function* () {
-      const secretStore = yield* ServerSecretStore;
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
 
       const error = yield* Effect.flip(secretStore.remove("session-signing-key"));
 
-      expect(error).toBeInstanceOf(SecretStoreError);
+      expect(error).toBeInstanceOf(ServerSecretStore.SecretStoreError);
       expect(error.message).toContain("Failed to remove secret session-signing-key.");
       expect(error.cause).toBeInstanceOf(PlatformError.PlatformError);
       expect((error.cause as PlatformError.PlatformError).reason._tag).toBe("PermissionDenied");
diff --git a/apps/server/src/auth/ServerSecretStore.ts b/apps/server/src/auth/ServerSecretStore.ts
new file mode 100644
index 00000000000..93dcc95aa5e
--- /dev/null
+++ b/apps/server/src/auth/ServerSecretStore.ts
@@ -0,0 +1,193 @@
+import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Predicate from "effect/Predicate";
+import * as PlatformError from "effect/PlatformError";
+
+import { ServerConfig } from "../config.ts";
+
+export class SecretStoreError extends Data.TaggedError("SecretStoreError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export interface ServerSecretStoreShape {
+  readonly get: (name: string) => Effect.Effect<Uint8Array | null, SecretStoreError>;
+  readonly set: (name: string, value: Uint8Array) => Effect.Effect<void, SecretStoreError>;
+  readonly getOrCreateRandom: (
+    name: string,
+    bytes: number,
+  ) => Effect.Effect<Uint8Array, SecretStoreError>;
+  readonly remove: (name: string) => Effect.Effect<void, SecretStoreError>;
+}
+
+export class ServerSecretStore extends Context.Service<ServerSecretStore, ServerSecretStoreShape>()(
+  "t3/auth/ServerSecretStore",
+) {}
+
+export const make = Effect.fn("makeServerSecretStore")(function* () {
+  const crypto = yield* Crypto.Crypto;
+  const fileSystem = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const serverConfig = yield* ServerConfig;
+
+  yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
+  yield* fileSystem.chmod(serverConfig.secretsDir, 0o700).pipe(
+    Effect.mapError(
+      (cause) =>
+        new SecretStoreError({
+          message: `Failed to secure secrets directory ${serverConfig.secretsDir}.`,
+          cause,
+        }),
+    ),
+  );
+
+  const resolveSecretPath = (name: string) => path.join(serverConfig.secretsDir, `${name}.bin`);
+
+  const isPlatformError = (u: unknown): u is PlatformError.PlatformError =>
+    Predicate.isTagged(u, "PlatformError");
+
+  const get: ServerSecretStoreShape["get"] = (name) =>
+    fileSystem.readFile(resolveSecretPath(name)).pipe(
+      Effect.map((bytes) => Uint8Array.from(bytes)),
+      Effect.catch((cause) =>
+        cause.reason._tag === "NotFound"
+          ? Effect.succeed(null)
+          : Effect.fail(
+              new SecretStoreError({
+                message: `Failed to read secret ${name}.`,
+                cause,
+              }),
+            ),
+      ),
+      Effect.withSpan("ServerSecretStore.get"),
+    );
+
+  const set: ServerSecretStoreShape["set"] = (name, value) => {
+    const secretPath = resolveSecretPath(name);
+    return crypto.randomUUIDv4.pipe(
+      Effect.mapError(
+        (cause) =>
+          new SecretStoreError({
+            message: `Failed to create temporary path for secret ${name}.`,
+            cause,
+          }),
+      ),
+      Effect.flatMap((uuid) => {
+        const tempPath = `${secretPath}.${uuid}.tmp`;
+        return Effect.gen(function* () {
+          yield* fileSystem.writeFile(tempPath, value);
+          yield* fileSystem.chmod(tempPath, 0o600);
+          yield* fileSystem.rename(tempPath, secretPath);
+          yield* fileSystem.chmod(secretPath, 0o600);
+        }).pipe(
+          Effect.catch((cause) =>
+            fileSystem.remove(tempPath).pipe(
+              Effect.ignore,
+              Effect.flatMap(() =>
+                Effect.fail(
+                  new SecretStoreError({
+                    message: `Failed to persist secret ${name}.`,
+                    cause,
+                  }),
+                ),
+              ),
+            ),
+          ),
+        );
+      }),
+      Effect.withSpan("ServerSecretStore.set"),
+    );
+  };
+
+  const create: ServerSecretStoreShape["set"] = (name, value) => {
+    const secretPath = resolveSecretPath(name);
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const file = yield* fileSystem.open(secretPath, {
+          flag: "wx",
+          mode: 0o600,
+        });
+        yield* file.writeAll(value);
+        yield* file.sync;
+        yield* fileSystem.chmod(secretPath, 0o600);
+      }),
+    ).pipe(
+      Effect.mapError(
+        (cause) =>
+          new SecretStoreError({
+            message: `Failed to persist secret ${name}.`,
+            cause,
+          }),
+      ),
+    );
+  };
+
+  const getOrCreateRandom: ServerSecretStoreShape["getOrCreateRandom"] = (name, bytes) =>
+    get(name).pipe(
+      Effect.flatMap((existing) => {
+        if (existing) {
+          return Effect.succeed(existing);
+        }
+
+        return crypto.randomBytes(bytes).pipe(
+          Effect.mapError(
+            (cause) =>
+              new SecretStoreError({
+                message: `Failed to generate random bytes for secret ${name}.`,
+                cause,
+              }),
+          ),
+          Effect.flatMap((generated) =>
+            create(name, generated).pipe(
+              Effect.as(Uint8Array.from(generated)),
+              Effect.catchTag("SecretStoreError", (error) =>
+                isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists"
+                  ? get(name).pipe(
+                      Effect.flatMap((created) =>
+                        created !== null
+                          ? Effect.succeed(created)
+                          : Effect.fail(
+                              new SecretStoreError({
+                                message: `Failed to read secret ${name} after concurrent creation.`,
+                              }),
+                            ),
+                      ),
+                    )
+                  : Effect.fail(error),
+              ),
+            ),
+          ),
+        );
+      }),
+      Effect.withSpan("ServerSecretStore.getOrCreateRandom"),
+    );
+
+  const remove: ServerSecretStoreShape["remove"] = (name) =>
+    fileSystem.remove(resolveSecretPath(name)).pipe(
+      Effect.catch((cause) =>
+        cause.reason._tag === "NotFound"
+          ? Effect.void
+          : Effect.fail(
+              new SecretStoreError({
+                message: `Failed to remove secret ${name}.`,
+                cause,
+              }),
+            ),
+      ),
+      Effect.withSpan("ServerSecretStore.remove"),
+    );
+
+  return {
+    get,
+    set,
+    getOrCreateRandom,
+    remove,
+  } satisfies ServerSecretStoreShape;
+});
+
+export const layer = Layer.effect(ServerSecretStore, make());
diff --git a/apps/server/src/auth/Services/AuthControlPlane.ts b/apps/server/src/auth/Services/AuthControlPlane.ts
deleted file mode 100644
index f71c6e32e9b..00000000000
--- a/apps/server/src/auth/Services/AuthControlPlane.ts
+++ /dev/null
@@ -1,73 +0,0 @@
-import type {
-  AuthClientMetadata,
-  AuthClientSession,
-  AuthPairingLink,
-  AuthSessionId,
-} from "@t3tools/contracts";
-import * as Data from "effect/Data";
-import * as DateTime from "effect/DateTime";
-import * as Duration from "effect/Duration";
-import * as Effect from "effect/Effect";
-import * as Context from "effect/Context";
-import type { SessionRole } from "./SessionCredentialService.ts";
-
-export const DEFAULT_SESSION_SUBJECT = "cli-issued-session";
-
-export interface IssuedPairingLink {
-  readonly id: string;
-  readonly credential: string;
-  readonly role: SessionRole;
-  readonly subject: string;
-  readonly label?: string;
-  readonly createdAt: DateTime.Utc;
-  readonly expiresAt: DateTime.Utc;
-}
-
-export interface IssuedBearerSession {
-  readonly sessionId: AuthSessionId;
-  readonly token: string;
-  readonly method: "bearer-session-token";
-  readonly role: SessionRole;
-  readonly subject: string;
-  readonly client: AuthClientMetadata;
-  readonly expiresAt: DateTime.Utc;
-}
-
-export class AuthControlPlaneError extends Data.TaggedError("AuthControlPlaneError")<{
-  readonly message: string;
-  readonly cause?: unknown;
-}> {}
-
-export interface AuthControlPlaneShape {
-  readonly createPairingLink: (input?: {
-    readonly ttl?: Duration.Duration;
-    readonly label?: string;
-    readonly role?: SessionRole;
-    readonly subject?: string;
-  }) => Effect.Effect<IssuedPairingLink, AuthControlPlaneError>;
-  readonly listPairingLinks: (input?: {
-    readonly role?: SessionRole;
-    readonly excludeSubjects?: ReadonlyArray<string>;
-  }) => Effect.Effect<ReadonlyArray<AuthPairingLink>, AuthControlPlaneError>;
-  readonly revokePairingLink: (id: string) => Effect.Effect<boolean, AuthControlPlaneError>;
-  readonly issueSession: (input?: {
-    readonly ttl?: Duration.Duration;
-    readonly subject?: string;
-    readonly role?: SessionRole;
-    readonly label?: string;
-  }) => Effect.Effect<IssuedBearerSession, AuthControlPlaneError>;
-  readonly listSessions: () => Effect.Effect<
-    ReadonlyArray<AuthClientSession>,
-    AuthControlPlaneError
-  >;
-  readonly revokeSession: (
-    sessionId: AuthSessionId,
-  ) => Effect.Effect<boolean, AuthControlPlaneError>;
-  readonly revokeOtherSessionsExcept: (
-    sessionId: AuthSessionId,
-  ) => Effect.Effect<number, AuthControlPlaneError>;
-}
-
-export class AuthControlPlane extends Context.Service<AuthControlPlane, AuthControlPlaneShape>()(
-  "t3/auth/Services/AuthControlPlane",
-) {}
diff --git a/apps/server/src/auth/Services/BootstrapCredentialService.ts b/apps/server/src/auth/Services/BootstrapCredentialService.ts
deleted file mode 100644
index 70dd1d5aead..00000000000
--- a/apps/server/src/auth/Services/BootstrapCredentialService.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import type { AuthPairingLink, ServerAuthBootstrapMethod } from "@t3tools/contracts";
-import * as Data from "effect/Data";
-import * as DateTime from "effect/DateTime";
-import * as Duration from "effect/Duration";
-import * as Context from "effect/Context";
-import type * as Effect from "effect/Effect";
-import type * as Stream from "effect/Stream";
-
-export type BootstrapCredentialRole = "owner" | "client";
-
-export interface BootstrapGrant {
-  readonly method: ServerAuthBootstrapMethod;
-  readonly role: BootstrapCredentialRole;
-  readonly subject: string;
-  readonly label?: string;
-  readonly expiresAt: DateTime.DateTime;
-}
-
-export class BootstrapCredentialError extends Data.TaggedError("BootstrapCredentialError")<{
-  readonly message: string;
-  readonly status?: 401 | 500;
-  readonly cause?: unknown;
-}> {}
-
-export interface IssuedBootstrapCredential {
-  readonly id: string;
-  readonly credential: string;
-  readonly label?: string;
-  readonly expiresAt: DateTime.Utc;
-}
-
-export type BootstrapCredentialChange =
-  | {
-      readonly type: "pairingLinkUpserted";
-      readonly pairingLink: AuthPairingLink;
-    }
-  | {
-      readonly type: "pairingLinkRemoved";
-      readonly id: string;
-    };
-
-export interface BootstrapCredentialServiceShape {
-  readonly issueOneTimeToken: (input?: {
-    readonly ttl?: Duration.Duration;
-    readonly role?: BootstrapCredentialRole;
-    readonly subject?: string;
-    readonly label?: string;
-  }) => Effect.Effect<IssuedBootstrapCredential, BootstrapCredentialError>;
-  readonly listActive: () => Effect.Effect<
-    ReadonlyArray<AuthPairingLink>,
-    BootstrapCredentialError
-  >;
-  readonly streamChanges: Stream.Stream<BootstrapCredentialChange>;
-  readonly revoke: (id: string) => Effect.Effect<boolean, BootstrapCredentialError>;
-  readonly consume: (credential: string) => Effect.Effect<BootstrapGrant, BootstrapCredentialError>;
-}
-
-export class BootstrapCredentialService extends Context.Service<
-  BootstrapCredentialService,
-  BootstrapCredentialServiceShape
->()("t3/auth/Services/BootstrapCredentialService") {}
diff --git a/apps/server/src/auth/Services/ServerAuth.ts b/apps/server/src/auth/Services/ServerAuth.ts
deleted file mode 100644
index 3ea93b77f94..00000000000
--- a/apps/server/src/auth/Services/ServerAuth.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import type {
-  AuthBearerBootstrapResult,
-  AuthBootstrapResult,
-  AuthClientMetadata,
-  AuthClientSession,
-  AuthCreatePairingCredentialInput,
-  AuthPairingLink,
-  AuthPairingCredentialResult,
-  AuthSessionId,
-  AuthSessionState,
-  ServerAuthDescriptor,
-  ServerAuthSessionMethod,
-  AuthWebSocketTokenResult,
-} from "@t3tools/contracts";
-import * as Data from "effect/Data";
-import * as DateTime from "effect/DateTime";
-import * as Context from "effect/Context";
-import type * as Effect from "effect/Effect";
-import type * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
-import type { SessionRole } from "./SessionCredentialService.ts";
-
-export interface AuthenticatedSession {
-  readonly sessionId: AuthSessionId;
-  readonly subject: string;
-  readonly method: ServerAuthSessionMethod;
-  readonly role: SessionRole;
-  readonly expiresAt?: DateTime.DateTime;
-}
-
-export class AuthError extends Data.TaggedError("AuthError")<{
-  readonly message: string;
-  readonly status?: 400 | 401 | 403 | 500;
-  readonly cause?: unknown;
-}> {}
-
-export interface ServerAuthShape {
-  readonly getDescriptor: () => Effect.Effect<ServerAuthDescriptor>;
-  readonly getSessionState: (
-    request: HttpServerRequest.HttpServerRequest,
-  ) => Effect.Effect<AuthSessionState, never>;
-  readonly exchangeBootstrapCredential: (
-    credential: string,
-    requestMetadata: AuthClientMetadata,
-  ) => Effect.Effect<
-    {
-      readonly response: AuthBootstrapResult;
-      readonly sessionToken: string;
-    },
-    AuthError
-  >;
-  readonly exchangeBootstrapCredentialForBearerSession: (
-    credential: string,
-    requestMetadata: AuthClientMetadata,
-  ) => Effect.Effect<AuthBearerBootstrapResult, AuthError>;
-  readonly issuePairingCredential: (
-    input?: AuthCreatePairingCredentialInput & {
-      readonly role?: SessionRole;
-    },
-  ) => Effect.Effect<AuthPairingCredentialResult, AuthError>;
-  readonly listPairingLinks: () => Effect.Effect<ReadonlyArray<AuthPairingLink>, AuthError>;
-  readonly revokePairingLink: (id: string) => Effect.Effect<boolean, AuthError>;
-  readonly listClientSessions: (
-    currentSessionId: AuthSessionId,
-  ) => Effect.Effect<ReadonlyArray<AuthClientSession>, AuthError>;
-  readonly revokeClientSession: (
-    currentSessionId: AuthSessionId,
-    targetSessionId: AuthSessionId,
-  ) => Effect.Effect<boolean, AuthError>;
-  readonly revokeOtherClientSessions: (
-    currentSessionId: AuthSessionId,
-  ) => Effect.Effect<number, AuthError>;
-  readonly authenticateHttpRequest: (
-    request: HttpServerRequest.HttpServerRequest,
-  ) => Effect.Effect<AuthenticatedSession, AuthError>;
-  readonly authenticateWebSocketUpgrade: (
-    request: HttpServerRequest.HttpServerRequest,
-  ) => Effect.Effect<AuthenticatedSession, AuthError>;
-  readonly issueWebSocketToken: (
-    session: AuthenticatedSession,
-  ) => Effect.Effect<AuthWebSocketTokenResult, AuthError>;
-  readonly issueStartupPairingUrl: (baseUrl: string) => Effect.Effect<string, AuthError>;
-}
-
-export class ServerAuth extends Context.Service<ServerAuth, ServerAuthShape>()(
-  "t3/auth/Services/ServerAuth",
-) {}
diff --git a/apps/server/src/auth/Services/ServerAuthPolicy.ts b/apps/server/src/auth/Services/ServerAuthPolicy.ts
deleted file mode 100644
index 5d9ef68cf95..00000000000
--- a/apps/server/src/auth/Services/ServerAuthPolicy.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { ServerAuthDescriptor } from "@t3tools/contracts";
-import * as Context from "effect/Context";
-import type * as Effect from "effect/Effect";
-
-export interface ServerAuthPolicyShape {
-  readonly getDescriptor: () => Effect.Effect<ServerAuthDescriptor>;
-}
-
-export class ServerAuthPolicy extends Context.Service<ServerAuthPolicy, ServerAuthPolicyShape>()(
-  "t3/auth/Services/ServerAuthPolicy",
-) {}
diff --git a/apps/server/src/auth/Services/ServerSecretStore.ts b/apps/server/src/auth/Services/ServerSecretStore.ts
deleted file mode 100644
index f5c6f6dfef4..00000000000
--- a/apps/server/src/auth/Services/ServerSecretStore.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import * as Data from "effect/Data";
-import * as Context from "effect/Context";
-import type * as Effect from "effect/Effect";
-
-export class SecretStoreError extends Data.TaggedError("SecretStoreError")<{
-  readonly message: string;
-  readonly cause?: unknown;
-}> {}
-
-export interface ServerSecretStoreShape {
-  readonly get: (name: string) => Effect.Effect<Uint8Array | null, SecretStoreError>;
-  readonly set: (name: string, value: Uint8Array) => Effect.Effect<void, SecretStoreError>;
-  readonly getOrCreateRandom: (
-    name: string,
-    bytes: number,
-  ) => Effect.Effect<Uint8Array, SecretStoreError>;
-  readonly remove: (name: string) => Effect.Effect<void, SecretStoreError>;
-}
-
-export class ServerSecretStore extends Context.Service<ServerSecretStore, ServerSecretStoreShape>()(
-  "t3/auth/Services/ServerSecretStore",
-) {}
diff --git a/apps/server/src/auth/Services/SessionCredentialService.ts b/apps/server/src/auth/Services/SessionCredentialService.ts
deleted file mode 100644
index 7dc049c910e..00000000000
--- a/apps/server/src/auth/Services/SessionCredentialService.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-import type {
-  AuthClientMetadata,
-  AuthClientSession,
-  AuthSessionId,
-  ServerAuthSessionMethod,
-} from "@t3tools/contracts";
-import * as Data from "effect/Data";
-import * as DateTime from "effect/DateTime";
-import * as Duration from "effect/Duration";
-import * as Context from "effect/Context";
-import type * as Effect from "effect/Effect";
-import type * as Stream from "effect/Stream";
-
-export type SessionRole = "owner" | "client";
-
-export interface IssuedSession {
-  readonly sessionId: AuthSessionId;
-  readonly token: string;
-  readonly method: ServerAuthSessionMethod;
-  readonly client: AuthClientMetadata;
-  readonly expiresAt: DateTime.DateTime;
-  readonly role: SessionRole;
-}
-
-export interface VerifiedSession {
-  readonly sessionId: AuthSessionId;
-  readonly token: string;
-  readonly method: ServerAuthSessionMethod;
-  readonly client: AuthClientMetadata;
-  readonly expiresAt?: DateTime.DateTime;
-  readonly subject: string;
-  readonly role: SessionRole;
-}
-
-export type SessionCredentialChange =
-  | {
-      readonly type: "clientUpserted";
-      readonly clientSession: AuthClientSession;
-    }
-  | {
-      readonly type: "clientRemoved";
-      readonly sessionId: AuthSessionId;
-    };
-
-export class SessionCredentialError extends Data.TaggedError("SessionCredentialError")<{
-  readonly message: string;
-  readonly cause?: unknown;
-}> {}
-
-export interface SessionCredentialServiceShape {
-  readonly cookieName: string;
-  readonly issue: (input?: {
-    readonly ttl?: Duration.Duration;
-    readonly subject?: string;
-    readonly method?: ServerAuthSessionMethod;
-    readonly role?: SessionRole;
-    readonly client?: AuthClientMetadata;
-  }) => Effect.Effect<IssuedSession, SessionCredentialError>;
-  readonly verify: (token: string) => Effect.Effect<VerifiedSession, SessionCredentialError>;
-  readonly issueWebSocketToken: (
-    sessionId: AuthSessionId,
-    input?: {
-      readonly ttl?: Duration.Duration;
-    },
-  ) => Effect.Effect<
-    {
-      readonly token: string;
-      readonly expiresAt: DateTime.DateTime;
-    },
-    SessionCredentialError
-  >;
-  readonly verifyWebSocketToken: (
-    token: string,
-  ) => Effect.Effect<VerifiedSession, SessionCredentialError>;
-  readonly listActive: () => Effect.Effect<
-    ReadonlyArray<AuthClientSession>,
-    SessionCredentialError
-  >;
-  readonly streamChanges: Stream.Stream<SessionCredentialChange>;
-  readonly revoke: (sessionId: AuthSessionId) => Effect.Effect<boolean, SessionCredentialError>;
-  readonly revokeAllExcept: (
-    sessionId: AuthSessionId,
-  ) => Effect.Effect<number, SessionCredentialError>;
-  readonly markConnected: (sessionId: AuthSessionId) => Effect.Effect<void, never>;
-  readonly markDisconnected: (sessionId: AuthSessionId) => Effect.Effect<void, never>;
-}
-
-export class SessionCredentialService extends Context.Service<
-  SessionCredentialService,
-  SessionCredentialServiceShape
->()("t3/auth/Services/SessionCredentialService") {}
diff --git a/apps/server/src/auth/Layers/SessionCredentialService.test.ts b/apps/server/src/auth/SessionStore.test.ts
similarity index 58%
rename from apps/server/src/auth/Layers/SessionCredentialService.test.ts
rename to apps/server/src/auth/SessionStore.test.ts
index 5609c2fdea2..00abd6b9945 100644
--- a/apps/server/src/auth/Layers/SessionCredentialService.test.ts
+++ b/apps/server/src/auth/SessionStore.test.ts
@@ -5,12 +5,13 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as TestClock from "effect/testing/TestClock";
 
-import type { ServerConfigShape } from "../../config.ts";
-import { ServerConfig } from "../../config.ts";
-import { SqlitePersistenceMemory } from "../../persistence/Layers/Sqlite.ts";
-import { SessionCredentialService } from "../Services/SessionCredentialService.ts";
-import { ServerSecretStoreLive } from "./ServerSecretStore.ts";
-import { SessionCredentialServiceLive } from "./SessionCredentialService.ts";
+import type { ServerConfigShape } from "../config.ts";
+import { ServerConfig } from "../config.ts";
+import { PersistenceSqlError } from "../persistence/Errors.ts";
+import { SqlitePersistenceMemory } from "../persistence/Layers/Sqlite.ts";
+import { AuthSessionRepository } from "../persistence/Services/AuthSessions.ts";
+import * as SessionStore from "./SessionStore.ts";
+import * as ServerSecretStore from "./ServerSecretStore.ts";
 
 const makeServerConfigLayer = (
   overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
@@ -26,22 +27,46 @@ const makeServerConfigLayer = (
     }),
   ).pipe(Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-auth-session-test-" })));
 
-const makeSessionCredentialLayer = (
+const makeSessionStoreLayer = (
   overrides?: Partial<Pick<ServerConfigShape, "desktopBootstrapToken">>,
 ) =>
-  SessionCredentialServiceLive.pipe(
+  SessionStore.layer.pipe(
     Layer.provide(SqlitePersistenceMemory),
-    Layer.provide(ServerSecretStoreLive),
+    Layer.provide(ServerSecretStore.layer),
     Layer.provide(makeServerConfigLayer(overrides)),
   );
 
-it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
+const repositoryFailure = new PersistenceSqlError({
+  operation: "AuthSessionRepository.getById:query",
+  detail: "sqlite is unavailable",
+});
+
+const failingSessionLookupRepositoryLayer = Layer.succeed(AuthSessionRepository, {
+  create: () => Effect.void,
+  getById: () => Effect.fail(repositoryFailure),
+  listActive: () => Effect.succeed([]),
+  revoke: () => Effect.succeed(false),
+  revokeAllExcept: () => Effect.succeed([]),
+  setLastConnectedAt: () => Effect.void,
+});
+
+const failingSessionLookupCredentialLayer = Layer.effect(
+  SessionStore.SessionStore,
+  SessionStore.make(),
+).pipe(
+  Layer.provide(failingSessionLookupRepositoryLayer),
+  Layer.provide(ServerSecretStore.layer),
+  Layer.provide(SqlitePersistenceMemory),
+  Layer.provide(makeServerConfigLayer()),
+);
+
+it.layer(NodeServices.layer)("SessionStore.layer", (it) => {
   it.effect("issues and verifies signed browser session tokens", () =>
     Effect.gen(function* () {
-      const sessions = yield* SessionCredentialService;
+      const sessions = yield* SessionStore.SessionStore;
       const issued = yield* sessions.issue({
         subject: "desktop-bootstrap",
-        role: "owner",
+        scopes: ["orchestration:read", "access:write"],
         client: {
           label: "Desktop app",
           deviceType: "desktop",
@@ -54,41 +79,65 @@ it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
 
       expect(verified.method).toBe("browser-session-cookie");
       expect(verified.subject).toBe("desktop-bootstrap");
-      expect(verified.role).toBe("owner");
+      expect(verified.scopes).toEqual(["orchestration:read", "access:write"]);
       expect(verified.client.label).toBe("Desktop app");
       expect(verified.client.browser).toBe("Electron");
       expect(verified.expiresAt?.toString()).toBe(issued.expiresAt.toString());
-    }).pipe(Effect.provide(makeSessionCredentialLayer())),
+    }).pipe(Effect.provide(makeSessionStoreLayer())),
   );
   it.effect("rejects malformed session tokens", () =>
     Effect.gen(function* () {
-      const sessions = yield* SessionCredentialService;
+      const sessions = yield* SessionStore.SessionStore;
       const error = yield* Effect.flip(sessions.verify("not-a-session-token"));
 
-      expect(error._tag).toBe("SessionCredentialError");
+      expect(error._tag).toBe("SessionCredentialInvalidError");
       expect(error.message).toContain("Malformed session token");
-    }).pipe(Effect.provide(makeSessionCredentialLayer())),
+    }).pipe(Effect.provide(makeSessionStoreLayer())),
+  );
+  it.effect("preserves repository failures while verifying session and websocket credentials", () =>
+    Effect.gen(function* () {
+      const sessions = yield* SessionStore.SessionStore;
+      const issued = yield* sessions.issue({
+        method: "bearer-access-token",
+        subject: "repository-failure",
+      });
+      const websocket = yield* sessions.issueWebSocketToken(issued.sessionId);
+
+      const sessionError = yield* Effect.flip(sessions.verify(issued.token));
+      const websocketError = yield* Effect.flip(sessions.verifyWebSocketToken(websocket.token));
+
+      expect(sessionError._tag).toBe("SessionCredentialInternalError");
+      expect(websocketError._tag).toBe("SessionCredentialInternalError");
+      expect(sessionError.cause).toBe(repositoryFailure);
+      expect(websocketError.cause).toBe(repositoryFailure);
+    }).pipe(Effect.provide(failingSessionLookupCredentialLayer)),
   );
   it.effect("verifies session tokens against the Effect clock", () =>
     Effect.gen(function* () {
-      const sessions = yield* SessionCredentialService;
+      const sessions = yield* SessionStore.SessionStore;
       const issued = yield* sessions.issue({
-        method: "bearer-session-token",
+        method: "bearer-access-token",
         subject: "test-clock",
       });
       const verified = yield* sessions.verify(issued.token);
 
-      expect(verified.method).toBe("bearer-session-token");
+      expect(verified.method).toBe("bearer-access-token");
       expect(verified.subject).toBe("test-clock");
-      expect(verified.role).toBe("client");
-    }).pipe(Effect.provide(Layer.merge(makeSessionCredentialLayer(), TestClock.layer()))),
+      expect(verified.scopes).toEqual([
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+      ]);
+    }).pipe(Effect.provide(Layer.merge(makeSessionStoreLayer(), TestClock.layer()))),
   );
 
   it.effect("rejects websocket tokens once the parent session has expired", () =>
     Effect.gen(function* () {
-      const sessions = yield* SessionCredentialService;
+      const sessions = yield* SessionStore.SessionStore;
       const issued = yield* sessions.issue({
-        method: "bearer-session-token",
+        method: "bearer-access-token",
         subject: "short-lived",
         ttl: Duration.seconds(1),
       });
@@ -98,15 +147,15 @@ it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
 
       const error = yield* Effect.flip(sessions.verifyWebSocketToken(websocket.token));
       expect(error.message).toContain("expired");
-    }).pipe(Effect.provide(Layer.merge(makeSessionCredentialLayer(), TestClock.layer()))),
+    }).pipe(Effect.provide(Layer.merge(makeSessionStoreLayer(), TestClock.layer()))),
   );
 
   it.effect("lists active sessions, tracks connectivity, and revokes other sessions", () =>
     Effect.gen(function* () {
-      const sessions = yield* SessionCredentialService;
-      const owner = yield* sessions.issue({
+      const sessions = yield* SessionStore.SessionStore;
+      const administrative = yield* sessions.issue({
         subject: "desktop-bootstrap",
-        role: "owner",
+        scopes: ["orchestration:read", "access:write"],
         client: {
           label: "Desktop app",
           deviceType: "desktop",
@@ -116,7 +165,7 @@ it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
       });
       const client = yield* sessions.issue({
         subject: "one-time-token",
-        role: "client",
+        scopes: ["orchestration:read"],
         client: {
           label: "Julius iPhone",
           deviceType: "mobile",
@@ -128,7 +177,7 @@ it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
 
       yield* sessions.markConnected(client.sessionId);
       const beforeRevoke = yield* sessions.listActive();
-      const revokedCount = yield* sessions.revokeAllExcept(owner.sessionId);
+      const revokedCount = yield* sessions.revokeAllExcept(administrative.sessionId);
       const afterRevoke = yield* sessions.listActive();
       const revokedClient = yield* Effect.flip(sessions.verify(client.token));
 
@@ -140,21 +189,22 @@ it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
         "Julius iPhone",
       );
       expect(
-        beforeRevoke.find((entry) => entry.sessionId === owner.sessionId)?.client.deviceType,
+        beforeRevoke.find((entry) => entry.sessionId === administrative.sessionId)?.client
+          .deviceType,
       ).toBe("desktop");
       expect(revokedCount).toBe(1);
       expect(afterRevoke).toHaveLength(1);
-      expect(afterRevoke[0]?.sessionId).toBe(owner.sessionId);
+      expect(afterRevoke[0]?.sessionId).toBe(administrative.sessionId);
       expect(revokedClient.message).toContain("revoked");
-    }).pipe(Effect.provide(makeSessionCredentialLayer())),
+    }).pipe(Effect.provide(makeSessionStoreLayer())),
   );
 
   it.effect("persists lastConnectedAt on first connect and updates it after reconnect", () =>
     Effect.gen(function* () {
-      const sessions = yield* SessionCredentialService;
+      const sessions = yield* SessionStore.SessionStore;
       const issued = yield* sessions.issue({
         subject: "reconnect-test",
-        method: "bearer-session-token",
+        method: "bearer-access-token",
       });
 
       const beforeConnect = yield* sessions.listActive();
@@ -188,6 +238,6 @@ it.layer(NodeServices.layer)("SessionCredentialServiceLive", (it) => {
       expect(afterReconnect[0]?.connected).toBe(true);
       expect(afterReconnect[0]?.lastConnectedAt).not.toBeNull();
       expect(afterReconnect[0]?.lastConnectedAt?.toString()).not.toBe(firstConnectedAt?.toString());
-    }).pipe(Effect.provide(Layer.merge(makeSessionCredentialLayer(), TestClock.layer()))),
+    }).pipe(Effect.provide(Layer.merge(makeSessionStoreLayer(), TestClock.layer()))),
   );
 });
diff --git a/apps/server/src/auth/Layers/SessionCredentialService.ts b/apps/server/src/auth/SessionStore.ts
similarity index 63%
rename from apps/server/src/auth/Layers/SessionCredentialService.ts
rename to apps/server/src/auth/SessionStore.ts
index 7d06c40da8d..83f38c6b6d7 100644
--- a/apps/server/src/auth/Layers/SessionCredentialService.ts
+++ b/apps/server/src/auth/SessionStore.ts
@@ -1,6 +1,16 @@
-import { AuthSessionId, type AuthClientMetadata, type AuthClientSession } from "@t3tools/contracts";
+import {
+  AuthSessionId,
+  AuthStandardClientScopes,
+  AuthEnvironmentScopes,
+  type AuthClientMetadata,
+  type AuthClientSession,
+  type AuthEnvironmentScope,
+  type ServerAuthSessionMethod,
+} from "@t3tools/contracts";
 import * as Clock from "effect/Clock";
+import * as Context from "effect/Context";
 import * as Crypto from "effect/Crypto";
+import * as Data from "effect/Data";
 import * as DateTime from "effect/DateTime";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
@@ -11,25 +21,106 @@ import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import * as Option from "effect/Option";
 
-import { ServerConfig } from "../../config.ts";
-import { AuthSessionRepositoryLive } from "../../persistence/Layers/AuthSessions.ts";
-import { AuthSessionRepository } from "../../persistence/Services/AuthSessions.ts";
-import { ServerSecretStore } from "../Services/ServerSecretStore.ts";
-import {
-  SessionCredentialError,
-  SessionCredentialService,
-  type IssuedSession,
-  type SessionCredentialChange,
-  type SessionCredentialServiceShape,
-  type VerifiedSession,
-} from "../Services/SessionCredentialService.ts";
+import { ServerConfig } from "../config.ts";
+import { AuthSessionRepositoryLive } from "../persistence/Layers/AuthSessions.ts";
+import { AuthSessionRepository } from "../persistence/Services/AuthSessions.ts";
+import * as ServerSecretStore from "./ServerSecretStore.ts";
 import {
   base64UrlDecodeUtf8,
   base64UrlEncode,
   resolveSessionCookieName,
   signPayload,
   timingSafeEqualBase64Url,
-} from "../utils.ts";
+} from "./utils.ts";
+
+export interface IssuedSession {
+  readonly sessionId: AuthSessionId;
+  readonly token: string;
+  readonly method: ServerAuthSessionMethod;
+  readonly client: AuthClientMetadata;
+  readonly expiresAt: DateTime.DateTime;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+}
+
+export interface VerifiedSession {
+  readonly sessionId: AuthSessionId;
+  readonly token: string;
+  readonly method: ServerAuthSessionMethod;
+  readonly client: AuthClientMetadata;
+  readonly expiresAt?: DateTime.DateTime;
+  readonly subject: string;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+}
+
+export type SessionCredentialChange =
+  | {
+      readonly type: "clientUpserted";
+      readonly clientSession: AuthClientSession;
+    }
+  | {
+      readonly type: "clientRemoved";
+      readonly sessionId: AuthSessionId;
+    };
+
+export class SessionCredentialInvalidError extends Data.TaggedError(
+  "SessionCredentialInvalidError",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export class SessionCredentialInternalError extends Data.TaggedError(
+  "SessionCredentialInternalError",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+export type SessionCredentialError = SessionCredentialInvalidError | SessionCredentialInternalError;
+
+export interface SessionStoreShape {
+  readonly cookieName: string;
+  readonly issue: (input?: {
+    readonly ttl?: Duration.Duration;
+    readonly subject?: string;
+    readonly method?: ServerAuthSessionMethod;
+    readonly scopes?: ReadonlyArray<AuthEnvironmentScope>;
+    readonly client?: AuthClientMetadata;
+  }) => Effect.Effect<IssuedSession, SessionCredentialInternalError>;
+  readonly verify: (token: string) => Effect.Effect<VerifiedSession, SessionCredentialError>;
+  readonly issueWebSocketToken: (
+    sessionId: AuthSessionId,
+    input?: {
+      readonly ttl?: Duration.Duration;
+    },
+  ) => Effect.Effect<
+    {
+      readonly token: string;
+      readonly expiresAt: DateTime.DateTime;
+    },
+    SessionCredentialInternalError
+  >;
+  readonly verifyWebSocketToken: (
+    token: string,
+  ) => Effect.Effect<VerifiedSession, SessionCredentialError>;
+  readonly listActive: () => Effect.Effect<
+    ReadonlyArray<AuthClientSession>,
+    SessionCredentialInternalError
+  >;
+  readonly streamChanges: Stream.Stream<SessionCredentialChange>;
+  readonly revoke: (
+    sessionId: AuthSessionId,
+  ) => Effect.Effect<boolean, SessionCredentialInternalError>;
+  readonly revokeAllExcept: (
+    sessionId: AuthSessionId,
+  ) => Effect.Effect<number, SessionCredentialInternalError>;
+  readonly markConnected: (sessionId: AuthSessionId) => Effect.Effect<void, never>;
+  readonly markDisconnected: (sessionId: AuthSessionId) => Effect.Effect<void, never>;
+}
+
+export class SessionStore extends Context.Service<SessionStore, SessionStoreShape>()(
+  "t3/auth/SessionStore",
+) {}
 
 const SIGNING_SECRET_NAME = "server-signing-key";
 const DEFAULT_SESSION_TTL = Duration.days(30);
@@ -40,8 +131,8 @@ const SessionClaims = Schema.Struct({
   kind: Schema.Literal("session"),
   sid: AuthSessionId,
   sub: Schema.String,
-  role: Schema.Literals(["owner", "client"]),
-  method: Schema.Literals(["browser-session-cookie", "bearer-session-token"]),
+  scopes: AuthEnvironmentScopes,
+  method: Schema.Literals(["browser-session-cookie", "bearer-access-token"]),
   iat: Schema.Number,
   exp: Schema.Number,
 });
@@ -90,10 +181,16 @@ function toAuthClientSession(input: Omit<AuthClientSession, "current">): AuthCli
   };
 }
 
-export const makeSessionCredentialService = Effect.gen(function* () {
+const toSessionCredentialInternalError = (message: string) => (cause: unknown) =>
+  new SessionCredentialInternalError({
+    message,
+    cause,
+  });
+
+export const make = Effect.fn("makeSessionStore")(function* () {
   const crypto = yield* Crypto.Crypto;
   const serverConfig = yield* ServerConfig;
-  const secretStore = yield* ServerSecretStore;
+  const secretStore = yield* ServerSecretStore.ServerSecretStore;
   const authSessions = yield* AuthSessionRepository;
   const signingSecret = yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME, 32);
   const connectedSessionsRef = yield* Ref.make(new Map<string, number>());
@@ -103,12 +200,6 @@ export const makeSessionCredentialService = Effect.gen(function* () {
     port: serverConfig.port,
   });
 
-  const toSessionCredentialError = (message: string) => (cause: unknown) =>
-    new SessionCredentialError({
-      message,
-      cause,
-    });
-
   const emitUpsert = (clientSession: AuthClientSession) =>
     PubSub.publish(changesPubSub, {
       type: "clientUpserted",
@@ -133,7 +224,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         toAuthClientSession({
           sessionId: row.value.sessionId,
           subject: row.value.subject,
-          role: row.value.role,
+          scopes: row.value.scopes,
           method: row.value.method,
           client: toClientMetadata(row.value.client),
           issuedAt: row.value.issuedAt,
@@ -144,7 +235,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
       );
     });
 
-  const markConnected: SessionCredentialServiceShape["markConnected"] = (sessionId) =>
+  const markConnected: SessionStoreShape["markConnected"] = (sessionId) =>
     Ref.modify(connectedSessionsRef, (current) => {
       const next = new Map(current);
       const wasDisconnected = !next.has(sessionId);
@@ -175,9 +266,10 @@ export const makeSessionCredentialService = Effect.gen(function* () {
           }),
         ),
       ),
+      Effect.withSpan("SessionStore.markConnected"),
     );
 
-  const markDisconnected: SessionCredentialServiceShape["markDisconnected"] = (sessionId) =>
+  const markDisconnected: SessionStoreShape["markDisconnected"] = (sessionId) =>
     Ref.update(connectedSessionsRef, (current) => {
       const next = new Map(current);
       const remaining = (next.get(sessionId) ?? 0) - 1;
@@ -200,11 +292,12 @@ export const makeSessionCredentialService = Effect.gen(function* () {
           }),
         ),
       ),
+      Effect.withSpan("SessionStore.markDisconnected"),
     );
 
   const encodeClaims = Schema.encodeEffect(Schema.fromJsonString(SessionClaims));
-  const issue: SessionCredentialServiceShape["issue"] = (input) =>
-    Effect.gen(function* () {
+  const issue: SessionStoreShape["issue"] = Effect.fn("SessionStore.issue")(
+    function* (input) {
       const sessionId = AuthSessionId.make(yield* crypto.randomUUIDv4);
       const issuedAt = yield* DateTime.now;
       const expiresAt = DateTime.add(issuedAt, {
@@ -215,7 +308,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         kind: "session",
         sid: sessionId,
         sub: input?.subject ?? "browser",
-        role: input?.role ?? "client",
+        scopes: input?.scopes ?? AuthStandardClientScopes,
         method: input?.method ?? "browser-session-cookie",
         iat: issuedAt.epochMilliseconds,
         exp: expiresAt.epochMilliseconds,
@@ -224,7 +317,8 @@ export const makeSessionCredentialService = Effect.gen(function* () {
       const encodedPayload = yield* encodeClaims(claims).pipe(
         Effect.map(base64UrlEncode),
         Effect.mapError(
-          (cause) => new SessionCredentialError({ message: "Failed to encode claims", cause }),
+          (cause) =>
+            new SessionCredentialInternalError({ message: "Failed to encode claims", cause }),
         ),
       );
       const signature = signPayload(encodedPayload, signingSecret);
@@ -232,7 +326,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
       yield* authSessions.create({
         sessionId,
         subject: claims.sub,
-        role: claims.role,
+        scopes: claims.scopes,
         method: claims.method,
         client: {
           label: client.label ?? null,
@@ -249,7 +343,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         toAuthClientSession({
           sessionId,
           subject: claims.sub,
-          role: claims.role,
+          scopes: claims.scopes,
           method: claims.method,
           client,
           issuedAt,
@@ -265,22 +359,24 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         method: claims.method,
         client,
         expiresAt: expiresAt,
-        role: claims.role,
+        scopes: claims.scopes,
       } satisfies IssuedSession;
-    }).pipe(Effect.mapError(toSessionCredentialError("Failed to issue session credential.")));
+    },
+    Effect.mapError(toSessionCredentialInternalError("Failed to issue session credential.")),
+  );
 
-  const verify: SessionCredentialServiceShape["verify"] = (token) =>
-    Effect.gen(function* () {
+  const verify: SessionStoreShape["verify"] = Effect.fn("SessionStore.verify")(
+    function* (token) {
       const [encodedPayload, signature] = token.split(".");
       if (!encodedPayload || !signature) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Malformed session token.",
         });
       }
 
       const expectedSignature = signPayload(encodedPayload, signingSecret);
       if (!timingSafeEqualBase64Url(signature, expectedSignature)) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Invalid session token signature.",
         });
       }
@@ -288,7 +384,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
       const claims = yield* decodeSessionClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(
         Effect.mapError(
           (cause) =>
-            new SessionCredentialError({
+            new SessionCredentialInvalidError({
               message: "Invalid session token payload.",
               cause,
             }),
@@ -297,26 +393,26 @@ export const makeSessionCredentialService = Effect.gen(function* () {
 
       const now = yield* Clock.currentTimeMillis;
       if (claims.exp <= now) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Session token expired.",
         });
       }
 
       const row = yield* authSessions.getById({ sessionId: claims.sid });
       if (Option.isNone(row)) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Unknown session token.",
         });
       }
       if (row.value.revokedAt !== null) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Session token revoked.",
         });
       }
 
       const expiresAt = DateTime.make(claims.exp);
       if (Option.isNone(expiresAt)) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Invalid `exp` claim",
         });
       }
@@ -328,25 +424,24 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         client: toClientMetadata(row.value.client),
         expiresAt: expiresAt.value,
         subject: claims.sub,
-        role: claims.role,
+        scopes: claims.scopes,
       } satisfies VerifiedSession;
-    }).pipe(
-      Effect.mapError((cause) =>
-        cause instanceof SessionCredentialError
-          ? cause
-          : new SessionCredentialError({
-              message: "Failed to verify session credential.",
-              cause,
-            }),
-      ),
-    );
+    },
+    Effect.mapError((cause) =>
+      cause._tag === "SessionCredentialInvalidError"
+        ? cause
+        : new SessionCredentialInternalError({
+            message: "Failed to verify session credential.",
+            cause,
+          }),
+    ),
+  );
 
   const encodeWsClaims = Schema.encodeEffect(Schema.fromJsonString(WebSocketClaims));
-  const issueWebSocketToken: SessionCredentialServiceShape["issueWebSocketToken"] = (
-    sessionId,
-    input,
-  ) =>
-    Effect.gen(function* () {
+  const issueWebSocketToken: SessionStoreShape["issueWebSocketToken"] = Effect.fn(
+    "SessionStore.issueWebSocketToken",
+  )(
+    function* (sessionId, input) {
       const issuedAt = yield* DateTime.now;
       const expiresAt = DateTime.add(issuedAt, {
         milliseconds: Duration.toMillis(input?.ttl ?? DEFAULT_WEBSOCKET_TOKEN_TTL),
@@ -361,7 +456,8 @@ export const makeSessionCredentialService = Effect.gen(function* () {
       const encodedPayload = yield* encodeWsClaims(claims).pipe(
         Effect.map(base64UrlEncode),
         Effect.mapError(
-          (cause) => new SessionCredentialError({ message: "Failed to encode claims", cause }),
+          (cause) =>
+            new SessionCredentialInternalError({ message: "Failed to encode claims", cause }),
         ),
       );
       const signature = signPayload(encodedPayload, signingSecret);
@@ -369,20 +465,24 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         token: `${encodedPayload}.${signature}`,
         expiresAt,
       };
-    }).pipe(Effect.mapError(toSessionCredentialError("Failed to issue websocket token.")));
+    },
+    Effect.mapError(toSessionCredentialInternalError("Failed to issue websocket token.")),
+  );
 
-  const verifyWebSocketToken: SessionCredentialServiceShape["verifyWebSocketToken"] = (token) =>
-    Effect.gen(function* () {
+  const verifyWebSocketToken: SessionStoreShape["verifyWebSocketToken"] = Effect.fn(
+    "SessionStore.verifyWebSocketToken",
+  )(
+    function* (token) {
       const [encodedPayload, signature] = token.split(".");
       if (!encodedPayload || !signature) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Malformed websocket token.",
         });
       }
 
       const expectedSignature = signPayload(encodedPayload, signingSecret);
       if (!timingSafeEqualBase64Url(signature, expectedSignature)) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Invalid websocket token signature.",
         });
       }
@@ -390,7 +490,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
       const claims = yield* decodeWebSocketClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(
         Effect.mapError(
           (cause) =>
-            new SessionCredentialError({
+            new SessionCredentialInvalidError({
               message: "Invalid websocket token payload.",
               cause,
             }),
@@ -399,24 +499,24 @@ export const makeSessionCredentialService = Effect.gen(function* () {
 
       const now = yield* Clock.currentTimeMillis;
       if (claims.exp <= now) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Websocket token expired.",
         });
       }
 
       const row = yield* authSessions.getById({ sessionId: claims.sid });
       if (Option.isNone(row)) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Unknown websocket session.",
         });
       }
       if (row.value.expiresAt.epochMilliseconds <= now) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Websocket session expired.",
         });
       }
       if (row.value.revokedAt !== null) {
-        return yield* new SessionCredentialError({
+        return yield* new SessionCredentialInvalidError({
           message: "Websocket session revoked.",
         });
       }
@@ -428,21 +528,21 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         client: toClientMetadata(row.value.client),
         expiresAt: row.value.expiresAt,
         subject: row.value.subject,
-        role: row.value.role,
+        scopes: row.value.scopes,
       } satisfies VerifiedSession;
-    }).pipe(
-      Effect.mapError((cause) =>
-        cause instanceof SessionCredentialError
-          ? cause
-          : new SessionCredentialError({
-              message: "Failed to verify websocket token.",
-              cause,
-            }),
-      ),
-    );
+    },
+    Effect.mapError((cause) =>
+      cause._tag === "SessionCredentialInvalidError"
+        ? cause
+        : new SessionCredentialInternalError({
+            message: "Failed to verify websocket token.",
+            cause,
+          }),
+    ),
+  );
 
-  const listActive: SessionCredentialServiceShape["listActive"] = () =>
-    Effect.gen(function* () {
+  const listActive: SessionStoreShape["listActive"] = Effect.fn("SessionStore.listActive")(
+    function* () {
       const now = yield* DateTime.now;
       const connectedSessions = yield* Ref.get(connectedSessionsRef);
       const rows = yield* authSessions.listActive({ now });
@@ -451,7 +551,7 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         toAuthClientSession({
           sessionId: row.sessionId,
           subject: row.subject,
-          role: row.role,
+          scopes: row.scopes,
           method: row.method,
           client: toClientMetadata(row.client),
           issuedAt: row.issuedAt,
@@ -460,10 +560,12 @@ export const makeSessionCredentialService = Effect.gen(function* () {
           connected: connectedSessions.has(row.sessionId),
         }),
       );
-    }).pipe(Effect.mapError(toSessionCredentialError("Failed to list active sessions.")));
+    },
+    Effect.mapError(toSessionCredentialInternalError("Failed to list active sessions.")),
+  );
 
-  const revoke: SessionCredentialServiceShape["revoke"] = (sessionId) =>
-    Effect.gen(function* () {
+  const revoke: SessionStoreShape["revoke"] = Effect.fn("SessionStore.revoke")(
+    function* (sessionId) {
       const revokedAt = yield* DateTime.now;
       const revoked = yield* authSessions.revoke({
         sessionId,
@@ -478,10 +580,14 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         yield* emitRemoved(sessionId);
       }
       return revoked;
-    }).pipe(Effect.mapError(toSessionCredentialError("Failed to revoke session.")));
+    },
+    Effect.mapError(toSessionCredentialInternalError("Failed to revoke session.")),
+  );
 
-  const revokeAllExcept: SessionCredentialServiceShape["revokeAllExcept"] = (sessionId) =>
-    Effect.gen(function* () {
+  const revokeAllExcept: SessionStoreShape["revokeAllExcept"] = Effect.fn(
+    "SessionStore.revokeAllExcept",
+  )(
+    function* (sessionId) {
       const revokedAt = yield* DateTime.now;
       const revokedSessionIds = yield* authSessions.revokeAllExcept({
         currentSessionId: sessionId,
@@ -505,7 +611,9 @@ export const makeSessionCredentialService = Effect.gen(function* () {
         );
       }
       return revokedSessionIds.length;
-    }).pipe(Effect.mapError(toSessionCredentialError("Failed to revoke other sessions.")));
+    },
+    Effect.mapError(toSessionCredentialInternalError("Failed to revoke other sessions.")),
+  );
 
   return {
     cookieName,
@@ -521,10 +629,9 @@ export const makeSessionCredentialService = Effect.gen(function* () {
     revokeAllExcept,
     markConnected,
     markDisconnected,
-  } satisfies SessionCredentialServiceShape;
+  } satisfies SessionStoreShape;
 });
 
-export const SessionCredentialServiceLive = Layer.effect(
-  SessionCredentialService,
-  makeSessionCredentialService,
-).pipe(Layer.provideMerge(AuthSessionRepositoryLive));
+export const layer = Layer.effect(SessionStore, make()).pipe(
+  Layer.provideMerge(AuthSessionRepositoryLive),
+);
diff --git a/apps/server/src/auth/http.ts b/apps/server/src/auth/http.ts
index 670ff5abbff..b36c8dd647f 100644
--- a/apps/server/src/auth/http.ts
+++ b/apps/server/src/auth/http.ts
@@ -1,265 +1,371 @@
 import {
-  type AuthBearerBootstrapResult,
-  AuthBootstrapInput,
-  AuthCreatePairingCredentialInput,
-  AuthRevokeClientSessionInput,
-  AuthRevokePairingLinkInput,
-  type AuthWebSocketTokenResult,
+  AuthAccessReadScope,
+  AuthAccessWriteScope,
+  AuthStandardClientScopes,
+  AuthOrchestrationOperateScope,
+  AuthOrchestrationReadScope,
+  AuthRelayReadScope,
+  AuthRelayWriteScope,
+  AuthReviewWriteScope,
+  AuthTerminalOperateScope,
+  EnvironmentAuthInvalidError,
+  type EnvironmentAuthInvalidReason,
+  EnvironmentHttpApi,
+  EnvironmentInternalError,
+  type EnvironmentInternalErrorReason,
+  EnvironmentOperationForbiddenError,
+  EnvironmentRequestInvalidError,
+  type EnvironmentRequestInvalidReason,
+  EnvironmentScopeRequiredError,
+  EnvironmentAuthenticatedAuth,
+  EnvironmentAuthenticatedPrincipal,
 } from "@t3tools/contracts";
+import type { AuthEnvironmentScope } from "@t3tools/contracts";
+import { parseAllowedOAuthScope } from "@t3tools/shared/oauthScope";
+import { causeErrorTag } from "@t3tools/shared/observability";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
-import * as Schema from "effect/Schema";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import * as Layer from "effect/Layer";
+import * as Cookies from "effect/unstable/http/Cookies";
+import * as HttpEffect from "effect/unstable/http/HttpEffect";
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 
-import { AuthError, ServerAuth } from "./Services/ServerAuth.ts";
-import { SessionCredentialService } from "./Services/SessionCredentialService.ts";
+import * as EnvironmentAuth from "./EnvironmentAuth.ts";
+import * as SessionStore from "./SessionStore.ts";
 import { deriveAuthClientMetadata } from "./utils.ts";
-import { browserApiCorsHeaders } from "../httpCors.ts";
 
-export const respondToAuthError = (error: AuthError) =>
-  Effect.gen(function* () {
-    if ((error.status ?? 500) >= 500) {
-      yield* Effect.logError("auth route failed", {
-        message: error.message,
-        cause: error.cause,
-      });
-    }
-    return HttpServerResponse.jsonUnsafe(
-      {
-        error: error.message,
-      },
-      { status: error.status ?? 500, headers: browserApiCorsHeaders },
-    );
-  });
+export const currentEnvironmentTraceId = Effect.currentParentSpan.pipe(
+  Effect.map((span) => span.traceId),
+  Effect.orElseSucceed(() => "unavailable"),
+);
 
-export const authSessionRouteLayer = HttpRouter.add(
-  "GET",
-  "/api/auth/session",
-  Effect.gen(function* () {
+export function annotateEnvironmentRequest(endpoint: string) {
+  return Effect.gen(function* () {
     const request = yield* HttpServerRequest.HttpServerRequest;
-    const serverAuth = yield* ServerAuth;
-    const session = yield* serverAuth.getSessionState(request);
-    return HttpServerResponse.jsonUnsafe(session, {
-      status: 200,
-      headers: browserApiCorsHeaders,
+    const url = HttpServerRequest.toURL(request);
+    const traceId = yield* currentEnvironmentTraceId;
+
+    yield* Effect.addFinalizer((exit) =>
+      exit._tag === "Failure"
+        ? Effect.logWarning("environment api request failed", {
+            endpoint,
+            traceId,
+            errorTag: causeErrorTag(exit.cause),
+            cause: exit.cause,
+          })
+        : Effect.void,
+    );
+    yield* Effect.annotateLogsScoped({ "environment.endpoint": endpoint, traceId });
+    yield* Effect.annotateCurrentSpan({
+      "environment.endpoint": endpoint,
+      "http.request.method": request.method,
+      "url.path": url._tag === "Some" ? url.value.pathname : "unknown",
     });
-  }),
-);
+  });
+}
 
-const PairingCredentialRequestHeaders = Schema.Struct({
-  "content-length": Schema.optionalKey(Schema.String),
-  "content-type": Schema.optionalKey(Schema.String),
-  "transfer-encoding": Schema.optionalKey(Schema.String),
-});
+export function failEnvironmentAuthInvalid(reason: EnvironmentAuthInvalidReason) {
+  return currentEnvironmentTraceId.pipe(
+    Effect.flatMap((traceId) =>
+      Effect.fail(new EnvironmentAuthInvalidError({ code: "auth_invalid", reason, traceId })),
+    ),
+  );
+}
 
-function hasRequestBody(headers: typeof PairingCredentialRequestHeaders.Type) {
-  const contentLengthHeader = headers["content-length"];
-  if (typeof contentLengthHeader === "string") {
-    const contentLength = Number.parseInt(contentLengthHeader, 10);
-    if (Number.isFinite(contentLength)) {
-      return contentLength > 0;
-    }
-  }
-  return typeof headers["transfer-encoding"] === "string";
+export function failEnvironmentInvalidRequest(reason: EnvironmentRequestInvalidReason) {
+  return currentEnvironmentTraceId.pipe(
+    Effect.flatMap((traceId) =>
+      Effect.fail(new EnvironmentRequestInvalidError({ code: "invalid_request", reason, traceId })),
+    ),
+  );
 }
 
-export const authBootstrapRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/bootstrap",
-  Effect.gen(function* () {
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const serverAuth = yield* ServerAuth;
-    const sessions = yield* SessionCredentialService;
-    const payload = yield* HttpServerRequest.schemaBodyJson(AuthBootstrapInput).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Invalid bootstrap payload.",
-            status: 400,
-            cause,
-          }),
+export function failEnvironmentScopeRequired(requiredScope: AuthEnvironmentScope) {
+  return currentEnvironmentTraceId.pipe(
+    Effect.flatMap((traceId) =>
+      Effect.fail(
+        new EnvironmentScopeRequiredError({
+          code: "insufficient_scope",
+          requiredScope,
+          traceId,
+        }),
       ),
-    );
-    const result = yield* serverAuth.exchangeBootstrapCredential(
-      payload.credential,
-      deriveAuthClientMetadata({ request }),
-    );
-
-    return yield* HttpServerResponse.jsonUnsafe(result.response, {
-      status: 200,
-      headers: browserApiCorsHeaders,
-    }).pipe(
-      HttpServerResponse.setCookie(sessions.cookieName, result.sessionToken, {
-        expires: DateTime.toDate(result.response.expiresAt),
-        httpOnly: true,
-        path: "/",
-        sameSite: "lax",
-      }),
-    );
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
+    ),
+  );
+}
 
-export const authBearerBootstrapRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/bootstrap/bearer",
-  Effect.gen(function* () {
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const serverAuth = yield* ServerAuth;
-    const payload = yield* HttpServerRequest.schemaBodyJson(AuthBootstrapInput).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Invalid bootstrap payload.",
-            status: 400,
-            cause,
-          }),
+function failEnvironmentOperationForbidden(reason: "current_session_revoke_not_allowed") {
+  return currentEnvironmentTraceId.pipe(
+    Effect.flatMap((traceId) =>
+      Effect.fail(
+        new EnvironmentOperationForbiddenError({
+          code: "operation_forbidden",
+          reason,
+          traceId,
+        }),
       ),
-    );
-    const result = yield* serverAuth.exchangeBootstrapCredentialForBearerSession(
-      payload.credential,
-      deriveAuthClientMetadata({ request }),
-    );
-    return HttpServerResponse.jsonUnsafe(result satisfies AuthBearerBootstrapResult, {
-      status: 200,
-      headers: browserApiCorsHeaders,
-    });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
-
-export const authWebSocketTokenRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/ws-token",
-  Effect.gen(function* () {
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const serverAuth = yield* ServerAuth;
-    const session = yield* serverAuth.authenticateHttpRequest(request);
-    const result = yield* serverAuth.issueWebSocketToken(session);
-    return HttpServerResponse.jsonUnsafe(result satisfies AuthWebSocketTokenResult, {
-      status: 200,
-      headers: browserApiCorsHeaders,
-    });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
+    ),
+  );
+}
 
-export const authPairingCredentialRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/pairing-token",
-  Effect.gen(function* () {
-    const serverAuth = yield* ServerAuth;
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const session = yield* serverAuth.authenticateHttpRequest(request);
-    if (session.role !== "owner") {
-      return yield* new AuthError({
-        message: "Only owner sessions can create pairing credentials.",
-        status: 403,
+export function failEnvironmentInternal(reason: EnvironmentInternalErrorReason, error?: unknown) {
+  return Effect.gen(function* () {
+    const traceId = yield* currentEnvironmentTraceId;
+    if (error !== undefined) {
+      yield* Effect.logError("environment api operation failed", {
+        reason,
+        traceId,
+        cause: error,
       });
     }
-    const headers = yield* HttpServerRequest.schemaHeaders(PairingCredentialRequestHeaders).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Invalid pairing credential request headers.",
-            status: 400,
-            cause,
-          }),
-      ),
-    );
-    const payload = hasRequestBody(headers)
-      ? yield* HttpServerRequest.schemaBodyJson(AuthCreatePairingCredentialInput).pipe(
-          Effect.mapError(
-            (cause) =>
-              new AuthError({
-                message: "Invalid pairing credential payload.",
-                status: 400,
-                cause,
-              }),
-          ),
-        )
-      : {};
-    const result = yield* serverAuth.issuePairingCredential(payload);
-    return HttpServerResponse.jsonUnsafe(result, { status: 200 });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
+    return yield* new EnvironmentInternalError({ code: "internal_error", reason, traceId });
+  });
+}
 
-const authenticateOwnerSession = Effect.gen(function* () {
-  const request = yield* HttpServerRequest.HttpServerRequest;
-  const serverAuth = yield* ServerAuth;
-  const session = yield* serverAuth.authenticateHttpRequest(request);
-  if (session.role !== "owner") {
-    return yield* new AuthError({
-      message: "Only owner sessions can manage network access.",
-      status: 403,
-    });
+export const requireEnvironmentScope = Effect.fn("environment.auth.requireScope")(function* (
+  scope: AuthEnvironmentScope,
+) {
+  const session = yield* EnvironmentAuthenticatedPrincipal;
+  if (!session.scopes.has(scope)) {
+    return yield* failEnvironmentScopeRequired(scope);
   }
-  return { serverAuth, session } as const;
+  return session;
 });
 
-export const authPairingLinksRouteLayer = HttpRouter.add(
-  "GET",
-  "/api/auth/pairing-links",
+export const environmentAuthenticatedAuthLayer = Layer.effect(
+  EnvironmentAuthenticatedAuth,
   Effect.gen(function* () {
-    const { serverAuth } = yield* authenticateOwnerSession;
-    const pairingLinks = yield* serverAuth.listPairingLinks();
-    return HttpServerResponse.jsonUnsafe(pairingLinks, { status: 200 });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
-
-export const authPairingLinksRevokeRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/pairing-links/revoke",
-  Effect.gen(function* () {
-    const { serverAuth } = yield* authenticateOwnerSession;
-    const payload = yield* HttpServerRequest.schemaBodyJson(AuthRevokePairingLinkInput).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Invalid revoke pairing link payload.",
-            status: 400,
-            cause,
+    const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+    return (httpEffect) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const session = yield* serverAuth.authenticateHttpRequest(request).pipe(
+          Effect.catchTags({
+            ServerAuthInvalidCredentialError: (error) => failEnvironmentAuthInvalid(error.reason),
+            ServerAuthInternalError: (error) => failEnvironmentInternal("internal_error", error),
           }),
-      ),
-    );
-    const revoked = yield* serverAuth.revokePairingLink(payload.id);
-    return HttpServerResponse.jsonUnsafe({ revoked }, { status: 200 });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
+        );
+        return yield* httpEffect.pipe(
+          Effect.provideService(EnvironmentAuthenticatedPrincipal, {
+            ...session,
+            scopes: new Set(session.scopes),
+          }),
+        );
+      });
+  }),
 );
 
-export const authClientsRouteLayer = HttpRouter.add(
-  "GET",
-  "/api/auth/clients",
-  Effect.gen(function* () {
-    const { serverAuth, session } = yield* authenticateOwnerSession;
-    const clients = yield* serverAuth.listClientSessions(session.sessionId);
-    return HttpServerResponse.jsonUnsafe(clients, { status: 200 });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
+export const authHttpApiLayer = HttpApiBuilder.group(
+  EnvironmentHttpApi,
+  "auth",
+  Effect.fnUntraced(function* (handlers) {
+    const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+    const sessions = yield* SessionStore.SessionStore;
 
-export const authClientsRevokeRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/clients/revoke",
-  Effect.gen(function* () {
-    const { serverAuth, session } = yield* authenticateOwnerSession;
-    const payload = yield* HttpServerRequest.schemaBodyJson(AuthRevokeClientSessionInput).pipe(
-      Effect.mapError(
-        (cause) =>
-          new AuthError({
-            message: "Invalid revoke client payload.",
-            status: 400,
-            cause,
-          }),
-      ),
-    );
-    const revoked = yield* serverAuth.revokeClientSession(session.sessionId, payload.sessionId);
-    return HttpServerResponse.jsonUnsafe({ revoked }, { status: 200 });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
-);
+    return handlers
+      .handle(
+        "session",
+        Effect.fn("environment.auth.session")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            return yield* serverAuth.getSessionState(request);
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("internal_error", error),
+          ),
+        ),
+      )
+      .handle(
+        "browserSession",
+        Effect.fn("environment.auth.browserSession")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            const result = yield* serverAuth.createBrowserSession(
+              args.payload.credential,
+              deriveAuthClientMetadata({ request }),
+            );
+            const sessionCookies = yield* Effect.fromResult(
+              Cookies.set(Cookies.empty, sessions.cookieName, result.sessionToken, {
+                expires: DateTime.toDate(result.response.expiresAt),
+                httpOnly: true,
+                path: "/",
+                sameSite: "lax",
+              }),
+            ).pipe(Effect.catch(() => failEnvironmentInternal("browser_session_cookie_failed")));
 
-export const authClientsRevokeOthersRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/auth/clients/revoke-others",
-  Effect.gen(function* () {
-    const { serverAuth, session } = yield* authenticateOwnerSession;
-    const revokedCount = yield* serverAuth.revokeOtherClientSessions(session.sessionId);
-    return HttpServerResponse.jsonUnsafe({ revokedCount }, { status: 200 });
-  }).pipe(Effect.catchTag("AuthError", (error) => respondToAuthError(error))),
+            yield* HttpEffect.appendPreResponseHandler((_request, response) =>
+              Effect.succeed(HttpServerResponse.mergeCookies(response, sessionCookies)),
+            );
+            return result.response;
+          },
+          Effect.catchTags({
+            ServerAuthInvalidCredentialError: (error) => failEnvironmentAuthInvalid(error.reason),
+            ServerAuthInternalError: (error) =>
+              failEnvironmentInternal("browser_session_issuance_failed", error),
+          }),
+        ),
+      )
+      .handle(
+        "token",
+        Effect.fn("environment.auth.token")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const request = yield* HttpServerRequest.HttpServerRequest;
+            const requestedScopes =
+              args.payload.scope === undefined
+                ? undefined
+                : parseAllowedOAuthScope({
+                    value: args.payload.scope,
+                    allowedScopes: new Set<AuthEnvironmentScope>([
+                      AuthOrchestrationReadScope,
+                      AuthOrchestrationOperateScope,
+                      AuthTerminalOperateScope,
+                      AuthReviewWriteScope,
+                      AuthAccessReadScope,
+                      AuthAccessWriteScope,
+                      AuthRelayReadScope,
+                      AuthRelayWriteScope,
+                    ]),
+                  });
+            if (requestedScopes === null)
+              return yield* failEnvironmentInvalidRequest("invalid_scope");
+            return yield* serverAuth.exchangeBootstrapCredentialForAccessToken(
+              args.payload.subject_token,
+              requestedScopes,
+              deriveAuthClientMetadata({
+                request,
+                presented: {
+                  ...(args.payload.client_label ? { label: args.payload.client_label } : {}),
+                  ...(args.payload.client_device_type
+                    ? { deviceType: args.payload.client_device_type }
+                    : {}),
+                  ...(args.payload.client_os ? { os: args.payload.client_os } : {}),
+                },
+              }),
+            );
+          },
+          Effect.catchTags({
+            ServerAuthInvalidCredentialError: (error) => failEnvironmentAuthInvalid(error.reason),
+            ServerAuthInvalidRequestError: (error) => failEnvironmentInvalidRequest(error.reason),
+            ServerAuthInternalError: (error) =>
+              failEnvironmentInternal("access_token_issuance_failed", error),
+          }),
+        ),
+      )
+      .handle(
+        "webSocketTicket",
+        Effect.fn("environment.auth.webSocketTicket")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const session = yield* EnvironmentAuthenticatedPrincipal;
+            return yield* serverAuth.issueWebSocketTicket(session);
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("websocket_ticket_issuance_failed", error),
+          ),
+        ),
+      )
+      .handle(
+        "pairingCredential",
+        Effect.fn("environment.auth.pairingCredential")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const session = yield* requireEnvironmentScope(AuthAccessWriteScope);
+            const delegatedScopes = args.payload.scopes ?? AuthStandardClientScopes;
+            if (
+              delegatedScopes.length === 0 ||
+              new Set<AuthEnvironmentScope>(delegatedScopes).size !== delegatedScopes.length
+            ) {
+              return yield* failEnvironmentInvalidRequest("invalid_scope");
+            }
+            for (const delegatedScope of delegatedScopes) {
+              if (!session.scopes.has(delegatedScope)) {
+                return yield* failEnvironmentScopeRequired(delegatedScope);
+              }
+            }
+            return yield* serverAuth.issuePairingCredential(args.payload);
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("pairing_credential_issuance_failed", error),
+          ),
+        ),
+      )
+      .handle(
+        "pairingLinks",
+        Effect.fn("environment.auth.pairingLinks")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            yield* requireEnvironmentScope(AuthAccessReadScope);
+            return yield* serverAuth.listPairingLinks();
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("pairing_links_load_failed", error),
+          ),
+        ),
+      )
+      .handle(
+        "revokePairingLink",
+        Effect.fn("environment.auth.revokePairingLink")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            yield* requireEnvironmentScope(AuthAccessWriteScope);
+            const revoked = yield* serverAuth.revokePairingLink(args.payload.id);
+            return { revoked };
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("pairing_link_revoke_failed", error),
+          ),
+        ),
+      )
+      .handle(
+        "clients",
+        Effect.fn("environment.auth.clients")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const session = yield* requireEnvironmentScope(AuthAccessReadScope);
+            return yield* serverAuth.listClientSessions(session.sessionId);
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("client_sessions_load_failed", error),
+          ),
+        ),
+      )
+      .handle(
+        "revokeClient",
+        Effect.fn("environment.auth.revokeClient")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const session = yield* requireEnvironmentScope(AuthAccessWriteScope);
+            const revoked = yield* serverAuth.revokeClientSession(
+              session.sessionId,
+              args.payload.sessionId,
+            );
+            return { revoked };
+          },
+          Effect.catchTags({
+            ServerAuthForbiddenOperationError: (error) =>
+              failEnvironmentOperationForbidden(error.reason),
+            ServerAuthInternalError: (error) =>
+              failEnvironmentInternal("client_session_revoke_failed", error),
+          }),
+        ),
+      )
+      .handle(
+        "revokeOtherClients",
+        Effect.fn("environment.auth.revokeOtherClients")(
+          function* (args) {
+            yield* annotateEnvironmentRequest(args.endpoint.name);
+            const session = yield* requireEnvironmentScope(AuthAccessWriteScope);
+            const revokedCount = yield* serverAuth.revokeOtherClientSessions(session.sessionId);
+            return { revokedCount };
+          },
+          Effect.catchTag("ServerAuthInternalError", (error) =>
+            failEnvironmentInternal("client_session_revoke_failed", error),
+          ),
+        ),
+      );
+  }),
 );
diff --git a/apps/server/src/auth/utils.test.ts b/apps/server/src/auth/utils.test.ts
index e7a540d81ba..578c7f79ace 100644
--- a/apps/server/src/auth/utils.test.ts
+++ b/apps/server/src/auth/utils.test.ts
@@ -23,4 +23,32 @@ describe("deriveAuthClientMetadata", () => {
       os: "macOS",
     });
   });
+
+  it("applies client-presented display identity without replacing transport metadata", () => {
+    const metadata = deriveAuthClientMetadata({
+      request: {
+        headers: {
+          "user-agent":
+            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/136.0.7103.93 Electron/36.3.2 Safari/537.36",
+        },
+        source: {
+          remoteAddress: "::ffff:192.168.213.72",
+        },
+      } as never,
+      presented: {
+        label: "T3 Code Mobile",
+        deviceType: "mobile",
+        os: "iOS",
+      },
+    });
+
+    expect(metadata).toMatchObject({
+      label: "T3 Code Mobile",
+      browser: "Electron",
+      deviceType: "mobile",
+      ipAddress: "192.168.213.72",
+      os: "iOS",
+    });
+    expect(metadata.userAgent).toContain("Electron/36.3.2");
+  });
 });
diff --git a/apps/server/src/auth/utils.ts b/apps/server/src/auth/utils.ts
index 2c76a81f65e..26b4ae4c4b2 100644
--- a/apps/server/src/auth/utils.ts
+++ b/apps/server/src/auth/utils.ts
@@ -1,4 +1,8 @@
-import type { AuthClientMetadata, AuthClientMetadataDeviceType } from "@t3tools/contracts";
+import type {
+  AuthClientMetadata,
+  AuthClientMetadataDeviceType,
+  AuthClientPresentationMetadata,
+} from "@t3tools/contracts";
 import type * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
 import * as Crypto from "node:crypto";
 
@@ -115,17 +119,17 @@ function readRemoteAddressFromSource(source: unknown): string | undefined {
 
 export function deriveAuthClientMetadata(input: {
   readonly request: HttpServerRequest.HttpServerRequest;
-  readonly label?: string;
+  readonly presented?: AuthClientPresentationMetadata;
 }): AuthClientMetadata {
   const userAgent = normalizeNonEmptyString(input.request.headers["user-agent"]);
   const ipAddress = readRemoteAddressFromSource(input.request.source);
-  const os = inferOs(userAgent);
+  const os = input.presented?.os ?? inferOs(userAgent);
   const browser = inferBrowser(userAgent);
   return {
-    ...(input.label ? { label: input.label } : {}),
+    ...(input.presented?.label ? { label: input.presented.label } : {}),
     ...(ipAddress ? { ipAddress } : {}),
     ...(userAgent ? { userAgent } : {}),
-    deviceType: inferDeviceType(userAgent),
+    deviceType: input.presented?.deviceType ?? inferDeviceType(userAgent),
     ...(os ? { os } : {}),
     ...(browser ? { browser } : {}),
   };
diff --git a/apps/server/src/bin.test.ts b/apps/server/src/bin.test.ts
index fbf6d80c560..2cd8bb68c7c 100644
--- a/apps/server/src/bin.test.ts
+++ b/apps/server/src/bin.test.ts
@@ -6,12 +6,15 @@ import { join } from "node:path";
 
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import * as NodeServices from "@effect/platform-node/NodeServices";
+import { EnvironmentOrchestrationHttpApi } from "@t3tools/contracts";
 import * as NetService from "@t3tools/shared/Net";
 import { assert, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as HttpRouter from "effect/unstable/http/HttpRouter";
 import * as HttpServer from "effect/unstable/http/HttpServer";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 import * as CliError from "effect/unstable/cli/CliError";
 import * as TestConsole from "effect/testing/TestConsole";
 import { Command } from "effect/unstable/cli";
@@ -20,10 +23,7 @@ import { cli } from "./bin.ts";
 import { deriveServerPaths, ServerConfig, type ServerConfigShape } from "./config.ts";
 import { ProjectionSnapshotQuery } from "./orchestration/Services/ProjectionSnapshotQuery.ts";
 import { OrchestrationLayerLive } from "./orchestration/runtimeLayer.ts";
-import {
-  orchestrationDispatchRouteLayer,
-  orchestrationSnapshotRouteLayer,
-} from "./orchestration/http.ts";
+import { orchestrationHttpApiLayer } from "./orchestration/http.ts";
 import { layerConfig as SqlitePersistenceLayerLive } from "./persistence/Layers/Sqlite.ts";
 import { RepositoryIdentityResolverLive } from "./project/Layers/RepositoryIdentityResolver.ts";
 import {
@@ -31,10 +31,12 @@ import {
   persistServerRuntimeState,
 } from "./serverRuntimeState.ts";
 import { WorkspacePathsLive } from "./workspace/Layers/WorkspacePaths.ts";
-import { ServerSecretStoreLive } from "./auth/Layers/ServerSecretStore.ts";
-import { ServerAuthLive } from "./auth/Layers/ServerAuth.ts";
+import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
+import { environmentAuthenticatedAuthLayer } from "./auth/http.ts";
 
 const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, NetService.layer);
+class ProjectCliHttpApi extends HttpApi.make("environment").add(EnvironmentOrchestrationHttpApi) {}
 
 const runCli = (args: ReadonlyArray<string>) => Command.runWith(cli, { version: "0.0.0" })(args);
 const runCliWithRuntime = (args: ReadonlyArray<string>) =>
@@ -105,18 +107,18 @@ const readPersistedSnapshot = (baseDir: string) =>
 const withLiveProjectCliServer = <A, E, R>(baseDir: string, run: () => Effect.Effect<A, E, R>) =>
   Effect.gen(function* () {
     const config = yield* makeCliTestServerConfig(baseDir);
-    const routesLayer = Layer.mergeAll(
-      orchestrationSnapshotRouteLayer,
-      orchestrationDispatchRouteLayer,
+    const routesLayer = HttpApiBuilder.layer(ProjectCliHttpApi).pipe(
+      Layer.provide(orchestrationHttpApiLayer),
+      Layer.provide(environmentAuthenticatedAuthLayer),
     );
     const appLayer = HttpRouter.serve(routesLayer, {
       disableListenLog: true,
       disableLogger: true,
     }).pipe(
       Layer.provideMerge(
-        ServerAuthLive.pipe(
+        EnvironmentAuth.layer.pipe(
           Layer.provideMerge(SqlitePersistenceLayerLive),
-          Layer.provide(ServerSecretStoreLive),
+          Layer.provide(ServerSecretStore.layer),
         ),
       ),
       Layer.provideMerge(makeProjectPersistenceLayer(config)),
@@ -214,7 +216,7 @@ it.layer(NodeServices.layer)("bin cli parsing", (it) => {
       const issued = JSON.parse(issuedOutput.output) as {
         readonly sessionId: string;
         readonly token: string;
-        readonly role: string;
+        readonly scopes: ReadonlyArray<string>;
       };
       const listedOutput = yield* captureStdout(
         runCli(["auth", "session", "list", "--base-dir", baseDir, "--json"]),
@@ -223,15 +225,33 @@ it.layer(NodeServices.layer)("bin cli parsing", (it) => {
       const listed = JSON.parse(listedOutput.output) as ReadonlyArray<{
         readonly sessionId: string;
         readonly token?: string;
-        readonly role: string;
+        readonly scopes: ReadonlyArray<string>;
       }>;
 
       assert.equal(typeof issued.sessionId, "string");
       assert.equal(typeof issued.token, "string");
-      assert.equal(issued.role, "owner");
+      assert.deepEqual(issued.scopes, [
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
       assert.equal(listed.length, 1);
       assert.equal(listed[0]?.sessionId, issued.sessionId);
-      assert.equal(listed[0]?.role, "owner");
+      assert.deepEqual(listed[0]?.scopes, [
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
       assert.equal("token" in (listed[0] ?? {}), false);
     }),
   );
diff --git a/apps/server/src/cli/auth.ts b/apps/server/src/cli/auth.ts
index d54731b4a24..4f1fc48871d 100644
--- a/apps/server/src/cli/auth.ts
+++ b/apps/server/src/cli/auth.ts
@@ -1,4 +1,8 @@
-import { AuthSessionId } from "@t3tools/contracts";
+import {
+  AuthAdministrativeScopes,
+  AuthSessionId,
+  AuthStandardClientScopes,
+} from "@t3tools/contracts";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -6,9 +10,8 @@ import * as Option from "effect/Option";
 import * as References from "effect/References";
 import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
 
-import { AuthControlPlaneRuntimeLive } from "../auth/Layers/AuthControlPlane.ts";
-import { AuthControlPlane } from "../auth/Services/AuthControlPlane.ts";
-import type { AuthControlPlaneShape } from "../auth/Services/AuthControlPlane.ts";
+import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";
+
 import {
   formatIssuedPairingCredential,
   formatIssuedSession,
@@ -23,9 +26,9 @@ import {
   resolveCliAuthConfig,
 } from "./config.ts";
 
-const runWithAuthControlPlane = <A, E>(
+const runWithEnvironmentAuth = <A, E>(
   flags: CliAuthLocationFlags,
-  run: (authControlPlane: AuthControlPlaneShape) => Effect.Effect<A, E>,
+  run: (environmentAuth: EnvironmentAuth.EnvironmentAuthShape) => Effect.Effect<A, E>,
   options?: {
     readonly quietLogs?: boolean;
   },
@@ -35,11 +38,11 @@ const runWithAuthControlPlane = <A, E>(
     const config = yield* resolveCliAuthConfig(flags, logLevel);
     const minimumLogLevel = options?.quietLogs ? "Error" : config.logLevel;
     return yield* Effect.gen(function* () {
-      const authControlPlane = yield* AuthControlPlane;
-      return yield* run(authControlPlane);
+      const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;
+      return yield* run(environmentAuth);
     }).pipe(
       Effect.provide(
-        Layer.mergeAll(AuthControlPlaneRuntimeLive).pipe(
+        Layer.mergeAll(EnvironmentAuth.runtimeLayer).pipe(
           Layer.provide(Layer.succeed(ServerConfig, config)),
           Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)),
         ),
@@ -58,11 +61,6 @@ const jsonFlag = Flag.boolean("json").pipe(
   Flag.withDefault(false),
 );
 
-const sessionRoleFlag = Flag.choice("role", ["owner", "client"]).pipe(
-  Flag.withDescription("Role for the issued bearer session."),
-  Flag.withDefault("owner"),
-);
-
 const labelFlag = Flag.string("label").pipe(
   Flag.withDescription("Optional human-readable label."),
   Flag.optional,
@@ -92,12 +90,12 @@ const pairingCreateCommand = Command.make("create", {
 }).pipe(
   Command.withDescription("Issue a new client pairing token."),
   Command.withHandler((flags) =>
-    runWithAuthControlPlane(
+    runWithEnvironmentAuth(
       flags,
-      (authControlPlane) =>
+      (environmentAuth) =>
         Effect.gen(function* () {
-          const issued = yield* authControlPlane.createPairingLink({
-            role: "client",
+          const issued = yield* environmentAuth.createPairingLink({
+            scopes: AuthStandardClientScopes,
             subject: "one-time-token",
             ...(Option.isSome(flags.ttl) ? { ttl: flags.ttl.value } : {}),
             ...(Option.isSome(flags.label) ? { label: flags.label.value } : {}),
@@ -121,11 +119,13 @@ const pairingListCommand = Command.make("list", {
 }).pipe(
   Command.withDescription("List active client pairing tokens without revealing their secrets."),
   Command.withHandler((flags) =>
-    runWithAuthControlPlane(
+    runWithEnvironmentAuth(
       flags,
-      (authControlPlane) =>
+      (environmentAuth) =>
         Effect.gen(function* () {
-          const pairingLinks = yield* authControlPlane.listPairingLinks({ role: "client" });
+          const pairingLinks = yield* environmentAuth.listPairingLinks({
+            excludeSubjects: [EnvironmentAuth.INTERNAL_ADMINISTRATIVE_BOOTSTRAP_SUBJECT],
+          });
           yield* Console.log(formatPairingCredentialList(pairingLinks, { json: flags.json }));
         }),
       {
@@ -141,9 +141,9 @@ const pairingRevokeCommand = Command.make("revoke", {
 }).pipe(
   Command.withDescription("Revoke an active client pairing token."),
   Command.withHandler((flags) =>
-    runWithAuthControlPlane(flags, (authControlPlane) =>
+    runWithEnvironmentAuth(flags, (environmentAuth) =>
       Effect.gen(function* () {
-        const revoked = yield* authControlPlane.revokePairingLink(flags.id);
+        const revoked = yield* environmentAuth.revokePairingLink(flags.id);
         yield* Console.log(
           revoked
             ? `Revoked pairing credential ${flags.id}.\n`
@@ -162,20 +162,19 @@ const pairingCommand = Command.make("pairing").pipe(
 const sessionIssueCommand = Command.make("issue", {
   ...authLocationFlags,
   ttl: ttlFlag,
-  role: sessionRoleFlag,
   label: labelFlag,
   subject: subjectFlag,
   tokenOnly: tokenOnlyFlag,
   json: jsonFlag,
 }).pipe(
-  Command.withDescription("Issue a bearer session token for headless or remote clients."),
+  Command.withDescription("Issue a scoped bearer access token for headless or remote clients."),
   Command.withHandler((flags) =>
-    runWithAuthControlPlane(
+    runWithEnvironmentAuth(
       flags,
-      (authControlPlane) =>
+      (environmentAuth) =>
         Effect.gen(function* () {
-          const issued = yield* authControlPlane.issueSession({
-            role: flags.role,
+          const issued = yield* environmentAuth.issueSession({
+            scopes: AuthAdministrativeScopes,
             ...(Option.isSome(flags.ttl) ? { ttl: flags.ttl.value } : {}),
             ...(Option.isSome(flags.label) ? { label: flags.label.value } : {}),
             ...(Option.isSome(flags.subject) ? { subject: flags.subject.value } : {}),
@@ -200,11 +199,11 @@ const sessionListCommand = Command.make("list", {
 }).pipe(
   Command.withDescription("List active sessions without revealing bearer tokens."),
   Command.withHandler((flags) =>
-    runWithAuthControlPlane(
+    runWithEnvironmentAuth(
       flags,
-      (authControlPlane) =>
+      (environmentAuth) =>
         Effect.gen(function* () {
-          const sessions = yield* authControlPlane.listSessions();
+          const sessions = yield* environmentAuth.listSessions();
           yield* Console.log(formatSessionList(sessions, { json: flags.json }));
         }),
       {
@@ -223,9 +222,9 @@ const sessionRevokeCommand = Command.make("revoke", {
 }).pipe(
   Command.withDescription("Revoke an active session."),
   Command.withHandler((flags) =>
-    runWithAuthControlPlane(flags, (authControlPlane) =>
+    runWithEnvironmentAuth(flags, (environmentAuth) =>
       Effect.gen(function* () {
-        const revoked = yield* authControlPlane.revokeSession(flags.sessionId);
+        const revoked = yield* environmentAuth.revokeSession(flags.sessionId);
         yield* Console.log(
           revoked
             ? `Revoked session ${flags.sessionId}.\n`
diff --git a/apps/server/src/cli/project.ts b/apps/server/src/cli/project.ts
index 05e96160c5e..95e9ed7f383 100644
--- a/apps/server/src/cli/project.ts
+++ b/apps/server/src/cli/project.ts
@@ -1,6 +1,9 @@
 import {
   CommandId,
-  OrchestrationReadModel,
+  AuthAdministrativeScopes,
+  EnvironmentHttpApi,
+  EnvironmentHttpCommonError,
+  type OrchestrationReadModel,
   ProjectId,
   type ClientOrchestrationCommand,
 } from "@t3tools/contracts";
@@ -18,16 +21,11 @@ import * as Path from "effect/Path";
 import * as References from "effect/References";
 import * as Schema from "effect/Schema";
 import { Argument, Command, Flag, GlobalFlag } from "effect/unstable/cli";
-import {
-  FetchHttpClient,
-  HttpClient,
-  HttpClientRequest,
-  HttpClientResponse,
-} from "effect/unstable/http";
-
-import { AuthControlPlaneRuntimeLive } from "../auth/Layers/AuthControlPlane.ts";
-import { AuthControlPlane } from "../auth/Services/AuthControlPlane.ts";
-import type { AuthControlPlaneShape } from "../auth/Services/AuthControlPlane.ts";
+import { FetchHttpClient, HttpClient, HttpClientError } from "effect/unstable/http";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
+
+import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";
+
 import { ServerConfig, type ServerConfigShape } from "../config.ts";
 import { OrchestrationEngineService } from "../orchestration/Services/OrchestrationEngine.ts";
 import { ProjectionSnapshotQuery } from "../orchestration/Services/ProjectionSnapshotQuery.ts";
@@ -78,50 +76,53 @@ const ProjectCliRuntimeLive = Layer.mergeAll(
 );
 
 const PROJECT_CLI_LIVE_SERVER_TIMEOUT = Duration.seconds(1);
-const OrchestrationHttpErrorResponse = Schema.Struct({
-  error: Schema.String,
-});
-
+const isEnvironmentHttpCommonError = Schema.is(EnvironmentHttpCommonError);
 const withProjectCliSessionToken = <A, E, R>(
-  authControlPlane: AuthControlPlaneShape,
+  environmentAuth: EnvironmentAuth.EnvironmentAuthShape,
   run: (token: string) => Effect.Effect<A, E, R>,
 ) =>
   Effect.acquireUseRelease(
-    authControlPlane.issueSession({
-      role: "owner",
+    environmentAuth.issueSession({
+      scopes: AuthAdministrativeScopes,
       label: "t3 project cli",
     }),
     (issued) => run(issued.token),
-    (issued) => authControlPlane.revokeSession(issued.sessionId).pipe(Effect.ignore({ log: true })),
+    (issued) => environmentAuth.revokeSession(issued.sessionId).pipe(Effect.ignore({ log: true })),
   );
 
 const withProjectCliLiveServerTimeout = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   effect.pipe(Effect.timeout(PROJECT_CLI_LIVE_SERVER_TIMEOUT));
 
-const runLiveServerRequest = <A, E extends Error, R>(
-  request: HttpClientRequest.HttpClientRequest,
-  handle: (response: HttpClientResponse.HttpClientResponse) => Effect.Effect<A, E, R>,
-) =>
-  Effect.gen(function* () {
-    const httpClient = yield* HttpClient.HttpClient;
-    const response = yield* httpClient.execute(request);
-    return yield* handle(response);
-  }).pipe(withProjectCliLiveServerTimeout);
-
-const decodeOrchestrationReadModelResponse = (response: HttpClientResponse.HttpClientResponse) =>
-  HttpClientResponse.schemaBodyJson(OrchestrationReadModel)(response);
-
-const readErrorMessageFromResponse = (response: HttpClientResponse.HttpClientResponse) =>
-  HttpClientResponse.schemaBodyJson(OrchestrationHttpErrorResponse)(response).pipe(
-    Effect.map((body) => body.error),
-    Effect.catch(() => Effect.succeed(null)),
-    Effect.map((body) => {
-      if (typeof body === "string" && body.trim().length > 0) {
-        return body;
-      }
-      return `Server request failed with status ${response.status}.`;
+const failLiveServerRequest = (cause: unknown) => {
+  if (isEnvironmentHttpCommonError(cause)) {
+    return Effect.fail(
+      new ProjectCommandError({
+        message: `Server request failed (${cause.code}, trace ${cause.traceId}).`,
+      }),
+    );
+  }
+  if (HttpClientError.isHttpClientError(cause) && cause.response !== undefined) {
+    return Effect.fail(
+      new ProjectCommandError({
+        message: `Server request failed with undeclared status ${cause.response.status}.`,
+      }),
+    );
+  }
+  return Effect.fail(
+    new ProjectCommandError({
+      message: `Failed to call running server: ${String(cause)}.`,
     }),
   );
+};
+
+const makeLiveServerClient = (origin: string) =>
+  Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    return yield* HttpApiClient.makeWith(EnvironmentHttpApi, {
+      baseUrl: origin,
+      httpClient,
+    });
+  });
 
 const normalizeWorkspaceRootForProjectCommand = Effect.fn(
   "normalizeWorkspaceRootForProjectCommand",
@@ -193,42 +194,25 @@ const findActiveProjectTarget = Effect.fn("findActiveProjectTarget")(function* (
 });
 
 const fetchLiveOrchestrationSnapshot = (origin: string, bearerToken: string) =>
-  runLiveServerRequest(
-    HttpClientRequest.get(`${origin}/api/orchestration/snapshot`).pipe(
-      HttpClientRequest.acceptJson,
-      HttpClientRequest.bearerToken(bearerToken),
-    ),
-    HttpClientResponse.matchStatus({
-      "2xx": decodeOrchestrationReadModelResponse,
-      orElse: (response) =>
-        readErrorMessageFromResponse(response).pipe(
-          Effect.flatMap((message) => Effect.fail(new ProjectCommandError({ message }))),
-        ),
-    }),
-  );
+  Effect.gen(function* () {
+    const client = yield* makeLiveServerClient(origin);
+    return yield* client.orchestration.snapshot({
+      headers: { authorization: `Bearer ${bearerToken}` },
+    });
+  }).pipe(withProjectCliLiveServerTimeout, Effect.catch(failLiveServerRequest));
 
 const dispatchLiveOrchestrationCommand = (
   origin: string,
   bearerToken: string,
   command: ProjectCliDispatchCommand,
 ) =>
-  HttpClientRequest.post(`${origin}/api/orchestration/dispatch`).pipe(
-    HttpClientRequest.acceptJson,
-    HttpClientRequest.bearerToken(bearerToken),
-    HttpClientRequest.bodyJson(command),
-    Effect.flatMap((request) =>
-      runLiveServerRequest(
-        request,
-        HttpClientResponse.matchStatus({
-          "2xx": () => Effect.void,
-          orElse: (response) =>
-            readErrorMessageFromResponse(response).pipe(
-              Effect.flatMap((message) => Effect.fail(new ProjectCommandError({ message }))),
-            ),
-        }),
-      ),
-    ),
-  );
+  Effect.gen(function* () {
+    const client = yield* makeLiveServerClient(origin);
+    yield* client.orchestration.dispatch({
+      headers: { authorization: `Bearer ${bearerToken}` },
+      payload: command,
+    } as Parameters<typeof client.orchestration.dispatch>[0]);
+  }).pipe(withProjectCliLiveServerTimeout, Effect.catch(failLiveServerRequest));
 
 const getOfflineSnapshot = Effect.fn("getOfflineSnapshot")(function* () {
   const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
@@ -236,13 +220,13 @@ const getOfflineSnapshot = Effect.fn("getOfflineSnapshot")(function* () {
 });
 
 const tryResolveLiveProjectExecutionMode = Effect.fn("tryResolveLiveProjectExecutionMode")(
-  function* (authControlPlane: AuthControlPlaneShape, config: ServerConfigShape) {
+  function* (environmentAuth: EnvironmentAuth.EnvironmentAuthShape, config: ServerConfigShape) {
     const runtimeState = yield* readPersistedServerRuntimeState(config.serverRuntimeStatePath);
     if (Option.isNone(runtimeState)) {
       return Option.none<{ readonly origin: string }>();
     }
 
-    const attempt = withProjectCliSessionToken(authControlPlane, (token) =>
+    const attempt = withProjectCliSessionToken(environmentAuth, (token) =>
       fetchLiveOrchestrationSnapshot(runtimeState.value.origin, token).pipe(
         Effect.as({
           origin: runtimeState.value.origin,
@@ -279,11 +263,11 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (
   const minimumLogLevel = config.logLevel;
 
   return yield* Effect.gen(function* () {
-    const authControlPlane = yield* AuthControlPlane;
-    const liveMode = yield* tryResolveLiveProjectExecutionMode(authControlPlane, config);
+    const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;
+    const liveMode = yield* tryResolveLiveProjectExecutionMode(environmentAuth, config);
 
     if (Option.isSome(liveMode)) {
-      return yield* withProjectCliSessionToken(authControlPlane, (token) =>
+      return yield* withProjectCliSessionToken(environmentAuth, (token) =>
         Effect.gen(function* () {
           const snapshot = yield* fetchLiveOrchestrationSnapshot(liveMode.value.origin, token);
           const output = yield* run({
@@ -314,7 +298,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (
     }).pipe(Effect.provide(offlineRuntimeLayer));
   }).pipe(
     Effect.provide(
-      Layer.mergeAll(AuthControlPlaneRuntimeLive, WorkspacePathsLive).pipe(
+      Layer.mergeAll(EnvironmentAuth.runtimeLayer, WorkspacePathsLive).pipe(
         Layer.provideMerge(FetchHttpClient.layer),
         Layer.provide(Layer.succeed(ServerConfig, config)),
         Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)),
diff --git a/apps/server/src/cliAuthFormat.test.ts b/apps/server/src/cliAuthFormat.test.ts
index 3ffaf6fba74..a428adc7bea 100644
--- a/apps/server/src/cliAuthFormat.test.ts
+++ b/apps/server/src/cliAuthFormat.test.ts
@@ -13,7 +13,7 @@ it("formats issued pairing credentials with the secret and optional pair URL", (
     {
       id: "pairing-1",
       credential: "secret-pairing-token",
-      role: "client",
+      scopes: ["orchestration:read"],
       subject: "one-time-token",
       createdAt: DateTime.makeUnsafe("2026-04-08T09:00:00.000Z"),
       expiresAt: DateTime.makeUnsafe("2026-04-08T10:00:00.000Z"),
@@ -33,7 +33,7 @@ it("formats pairing listings without exposing the secret token", () => {
         credential: "secret-pairing-token",
         subject: "one-time-token",
         label: "Phone",
-        role: "client",
+        scopes: ["orchestration:read"],
         createdAt: DateTime.makeUnsafe("2026-04-08T09:00:00.000Z"),
         expiresAt: DateTime.makeUnsafe("2026-04-08T10:00:00.000Z"),
       },
@@ -50,8 +50,8 @@ it("formats issued sessions with the bearer token but omits tokens from listings
     {
       sessionId: "session-1" as never,
       token: "secret-session-token",
-      method: "bearer-session-token",
-      role: "owner",
+      method: "bearer-access-token",
+      scopes: ["orchestration:read", "access:write"],
       subject: "cli-issued-session",
       client: {
         label: "deploy-bot",
@@ -66,8 +66,8 @@ it("formats issued sessions with the bearer token but omits tokens from listings
     [
       {
         sessionId: "session-1" as never,
-        method: "bearer-session-token",
-        role: "owner",
+        method: "bearer-access-token",
+        scopes: ["orchestration:read", "access:write"],
         subject: "cli-issued-session",
         client: {
           label: "deploy-bot",
diff --git a/apps/server/src/cliAuthFormat.ts b/apps/server/src/cliAuthFormat.ts
index 4078860ff94..2ef5ba10a80 100644
--- a/apps/server/src/cliAuthFormat.ts
+++ b/apps/server/src/cliAuthFormat.ts
@@ -1,7 +1,7 @@
 import type { AuthClientMetadata, AuthClientSession, AuthPairingLink } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 
-import type { IssuedBearerSession, IssuedPairingLink } from "./auth/Services/AuthControlPlane.ts";
+import type { IssuedBearerSession, IssuedPairingLink } from "./auth/EnvironmentAuth.ts";
 
 const newline = "\n";
 
@@ -47,7 +47,7 @@ export function formatIssuedPairingCredential(
         id: credential.id,
         credential: credential.credential,
         ...(credential.label ? { label: credential.label } : {}),
-        role: credential.role,
+        scopes: credential.scopes,
         expiresAt: toIsoString(credential.expiresAt),
         ...(pairUrl ? { pairUrl } : {}),
       },
@@ -77,7 +77,7 @@ export function formatPairingCredentialList(
       credentials.map((credential) => ({
         id: credential.id,
         ...(credential.label ? { label: credential.label } : {}),
-        role: credential.role,
+        scopes: credential.scopes,
         createdAt: toIsoString(credential.createdAt),
         expiresAt: toIsoString(credential.expiresAt),
       })),
@@ -95,7 +95,7 @@ export function formatPairingCredentialList(
       .map((credential) =>
         [
           `${credential.id}${credential.label ? ` (${credential.label})` : ""}`,
-          `  role: ${credential.role}`,
+          `  scopes: ${credential.scopes.join(" ")}`,
           `  created: ${toIsoString(credential.createdAt)}`,
           `  expires: ${toIsoString(credential.expiresAt)}`,
         ].join(newline),
@@ -121,7 +121,7 @@ export function formatIssuedSession(
         sessionId: session.sessionId,
         token: session.token,
         method: session.method,
-        role: session.role,
+        scopes: session.scopes,
         subject: session.subject,
         client: session.client,
         expiresAt: toIsoString(session.expiresAt),
@@ -133,7 +133,8 @@ export function formatIssuedSession(
 
   return (
     [
-      `Issued ${session.role} bearer session ${session.sessionId}.`,
+      `Issued bearer access token ${session.sessionId}.`,
+      `Scopes: ${session.scopes.join(" ")}`,
       `Token: ${session.token}`,
       `Subject: ${session.subject}`,
       `Client: ${formatClientMetadata(session.client)}`,
@@ -153,7 +154,7 @@ export function formatSessionList(
       sessions.map((session) => ({
         sessionId: session.sessionId,
         method: session.method,
-        role: session.role,
+        scopes: session.scopes,
         subject: session.subject,
         client: session.client,
         connected: session.connected,
@@ -174,7 +175,8 @@ export function formatSessionList(
     sessions
       .map((session) =>
         [
-          `${session.sessionId} [${session.role}]${session.connected ? " connected" : ""}`,
+          `${session.sessionId}${session.connected ? " connected" : ""}`,
+          `  scopes: ${session.scopes.join(" ")}`,
           `  method: ${session.method}`,
           `  subject: ${session.subject}`,
           `  client: ${formatClientMetadata(session.client)}`,
diff --git a/apps/server/src/http.ts b/apps/server/src/http.ts
index f287b4c59bf..0e521ecca9c 100644
--- a/apps/server/src/http.ts
+++ b/apps/server/src/http.ts
@@ -1,4 +1,9 @@
 import Mime from "@effect/platform-node/Mime";
+import {
+  AuthOrchestrationOperateScope,
+  AuthOrchestrationReadScope,
+  EnvironmentHttpApi,
+} from "@t3tools/contracts";
 import { decodeOtlpTraceRecords } from "@t3tools/shared/observability";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
@@ -13,7 +18,9 @@ import {
   HttpRouter,
   HttpServerResponse,
   HttpServerRequest,
+  HttpServerRespondable,
 } from "effect/unstable/http";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 import { OtlpTracer } from "effect/unstable/observability";
 
 import {
@@ -25,14 +32,15 @@ import { resolveAttachmentPathById } from "./attachmentStore.ts";
 import { resolveStaticDir, ServerConfig } from "./config.ts";
 import { BrowserTraceCollector } from "./observability/Services/BrowserTraceCollector.ts";
 import { ProjectFaviconResolver } from "./project/Services/ProjectFaviconResolver.ts";
-import { ServerAuth } from "./auth/Services/ServerAuth.ts";
-import { respondToAuthError } from "./auth/http.ts";
-import { ServerEnvironment } from "./environment/Services/ServerEnvironment.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
 import {
-  browserApiCorsAllowedHeaders,
-  browserApiCorsAllowedMethods,
-  browserApiCorsHeaders,
-} from "./httpCors.ts";
+  annotateEnvironmentRequest,
+  failEnvironmentScopeRequired,
+  failEnvironmentAuthInvalid,
+  failEnvironmentInternal,
+} from "./auth/http.ts";
+import { ServerEnvironment } from "./environment/Services/ServerEnvironment.ts";
+import { browserApiCorsAllowedHeaders, browserApiCorsAllowedMethods } from "./httpCors.ts";
 
 const PROJECT_FAVICON_CACHE_CONTROL = "public, max-age=3600";
 const FALLBACK_PROJECT_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="#6b728080" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" data-fallback="project-favicon"><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-8l-2-2H4a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2Z"/></svg>`;
@@ -40,8 +48,8 @@ const OTLP_TRACES_PROXY_PATH = "/api/observability/v1/traces";
 const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "::1", "localhost"]);
 
 export const browserApiCorsLayer = HttpRouter.cors({
-  allowedMethods: [...browserApiCorsAllowedMethods],
-  allowedHeaders: [...browserApiCorsAllowedHeaders],
+  allowedMethods: browserApiCorsAllowedMethods,
+  allowedHeaders: browserApiCorsAllowedHeaders,
   maxAge: 600,
 });
 
@@ -61,23 +69,35 @@ export function resolveDevRedirectUrl(devUrl: URL, requestUrl: URL): string {
   return redirectUrl.toString();
 }
 
-const requireAuthenticatedRequest = Effect.gen(function* () {
-  const request = yield* HttpServerRequest.HttpServerRequest;
-  const serverAuth = yield* ServerAuth;
-  yield* serverAuth.authenticateHttpRequest(request);
-});
-
-export const serverEnvironmentRouteLayer = HttpRouter.add(
-  "GET",
-  "/.well-known/t3/environment",
+const authenticateRawRouteWithScope = (
+  scope: typeof AuthOrchestrationReadScope | typeof AuthOrchestrationOperateScope,
+) =>
   Effect.gen(function* () {
-    const descriptor = yield* Effect.service(ServerEnvironment).pipe(
-      Effect.flatMap((serverEnvironment) => serverEnvironment.getDescriptor),
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+    const session = yield* serverAuth.authenticateHttpRequest(request).pipe(
+      Effect.catchTags({
+        ServerAuthInvalidCredentialError: (error) => failEnvironmentAuthInvalid(error.reason),
+        ServerAuthInternalError: (error) => failEnvironmentInternal("internal_error", error),
+      }),
+    );
+    if (!session.scopes.includes(scope)) {
+      return yield* failEnvironmentScopeRequired(scope);
+    }
+  });
+
+export const serverEnvironmentHttpApiLayer = HttpApiBuilder.group(
+  EnvironmentHttpApi,
+  "metadata",
+  Effect.fnUntraced(function* (handlers) {
+    const serverEnvironment = yield* ServerEnvironment;
+    return handlers.handle(
+      "descriptor",
+      Effect.fn("environment.metadata.descriptor")(function* (args) {
+        yield* annotateEnvironmentRequest(args.endpoint.name);
+        return yield* serverEnvironment.getDescriptor;
+      }),
     );
-    return HttpServerResponse.jsonUnsafe(descriptor, {
-      status: 200,
-      headers: browserApiCorsHeaders,
-    });
   }),
 );
 
@@ -90,7 +110,7 @@ export const otlpTracesProxyRouteLayer = HttpRouter.add(
   "POST",
   OTLP_TRACES_PROXY_PATH,
   Effect.gen(function* () {
-    yield* requireAuthenticatedRequest;
+    yield* authenticateRawRouteWithScope(AuthOrchestrationOperateScope);
     const request = yield* HttpServerRequest.HttpServerRequest;
     const config = yield* ServerConfig;
     const otlpTracesUrl = config.otlpTracesUrl;
@@ -132,14 +152,20 @@ export const otlpTracesProxyRouteLayer = HttpRouter.add(
           Effect.succeed(HttpServerResponse.text("Trace export failed.", { status: 502 })),
         ),
       );
-  }).pipe(Effect.catchTag("AuthError", respondToAuthError)),
+  }).pipe(
+    Effect.catchTags({
+      EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
+      EnvironmentInternalError: HttpServerRespondable.toResponse,
+      EnvironmentScopeRequiredError: HttpServerRespondable.toResponse,
+    }),
+  ),
 );
 
 export const attachmentsRouteLayer = HttpRouter.add(
   "GET",
   `${ATTACHMENTS_ROUTE_PREFIX}/*`,
   Effect.gen(function* () {
-    yield* requireAuthenticatedRequest;
+    yield* authenticateRawRouteWithScope(AuthOrchestrationReadScope);
     const request = yield* HttpServerRequest.HttpServerRequest;
     const url = HttpServerRequest.toURL(request);
     if (Option.isNone(url)) {
@@ -188,14 +214,20 @@ export const attachmentsRouteLayer = HttpRouter.add(
         Effect.succeed(HttpServerResponse.text("Internal Server Error", { status: 500 })),
       ),
     );
-  }).pipe(Effect.catchTag("AuthError", respondToAuthError)),
+  }).pipe(
+    Effect.catchTags({
+      EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
+      EnvironmentInternalError: HttpServerRespondable.toResponse,
+      EnvironmentScopeRequiredError: HttpServerRespondable.toResponse,
+    }),
+  ),
 );
 
 export const projectFaviconRouteLayer = HttpRouter.add(
   "GET",
   "/api/project-favicon",
   Effect.gen(function* () {
-    yield* requireAuthenticatedRequest;
+    yield* authenticateRawRouteWithScope(AuthOrchestrationReadScope);
     const request = yield* HttpServerRequest.HttpServerRequest;
     const url = HttpServerRequest.toURL(request);
     if (Option.isNone(url)) {
@@ -229,7 +261,13 @@ export const projectFaviconRouteLayer = HttpRouter.add(
         Effect.succeed(HttpServerResponse.text("Internal Server Error", { status: 500 })),
       ),
     );
-  }).pipe(Effect.catchTag("AuthError", respondToAuthError)),
+  }).pipe(
+    Effect.catchTags({
+      EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
+      EnvironmentInternalError: HttpServerRespondable.toResponse,
+      EnvironmentScopeRequiredError: HttpServerRespondable.toResponse,
+    }),
+  ),
 );
 
 export const staticAndDevRouteLayer = HttpRouter.add(
diff --git a/apps/server/src/orchestration/http.ts b/apps/server/src/orchestration/http.ts
index aaf3a3a108b..a148f98474b 100644
--- a/apps/server/src/orchestration/http.ts
+++ b/apps/server/src/orchestration/http.ts
@@ -1,95 +1,59 @@
 import {
-  ClientOrchestrationCommand,
-  OrchestrationDispatchCommandError,
-  OrchestrationGetSnapshotError,
-  type OrchestrationReadModel,
+  AuthOrchestrationOperateScope,
+  AuthOrchestrationReadScope,
+  EnvironmentHttpApi,
 } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 
-import { ServerAuth } from "../auth/Services/ServerAuth.ts";
 import { normalizeDispatchCommand } from "./Normalizer.ts";
+import {
+  annotateEnvironmentRequest,
+  failEnvironmentInternal,
+  failEnvironmentInvalidRequest,
+  requireEnvironmentScope,
+} from "../auth/http.ts";
 import { OrchestrationEngineService } from "./Services/OrchestrationEngine.ts";
 import { ProjectionSnapshotQuery } from "./Services/ProjectionSnapshotQuery.ts";
 
-const respondToOrchestrationHttpError = (
-  error: OrchestrationDispatchCommandError | OrchestrationGetSnapshotError,
-) =>
-  Effect.gen(function* () {
-    if (error._tag === "OrchestrationGetSnapshotError") {
-      yield* Effect.logError("orchestration http route failed", {
-        message: error.message,
-        cause: error.cause,
-      });
-      return HttpServerResponse.jsonUnsafe({ error: error.message }, { status: 500 });
-    }
-
-    return HttpServerResponse.jsonUnsafe({ error: error.message }, { status: 400 });
-  });
-
-const authenticateOwnerSession = Effect.gen(function* () {
-  const request = yield* HttpServerRequest.HttpServerRequest;
-  const serverAuth = yield* ServerAuth;
-  const session = yield* serverAuth.authenticateHttpRequest(request);
-  if (session.role !== "owner") {
-    return yield* new OrchestrationDispatchCommandError({
-      message: "Only owner sessions can manage projects.",
-    });
-  }
-  return session;
-});
-
-export const orchestrationSnapshotRouteLayer = HttpRouter.add(
-  "GET",
-  "/api/orchestration/snapshot",
-  Effect.gen(function* () {
-    yield* authenticateOwnerSession;
+export const orchestrationHttpApiLayer = HttpApiBuilder.group(
+  EnvironmentHttpApi,
+  "orchestration",
+  Effect.fnUntraced(function* (handlers) {
     const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
-    const snapshot = yield* projectionSnapshotQuery.getSnapshot().pipe(
-      Effect.mapError(
-        (cause) =>
-          new OrchestrationGetSnapshotError({
-            message: "Failed to load orchestration snapshot.",
-            cause,
-          }),
-      ),
-    );
-    return HttpServerResponse.jsonUnsafe(snapshot satisfies OrchestrationReadModel, {
-      status: 200,
-    });
-  }).pipe(
-    Effect.catchTags({
-      OrchestrationDispatchCommandError: respondToOrchestrationHttpError,
-      OrchestrationGetSnapshotError: respondToOrchestrationHttpError,
-    }),
-  ),
-);
-
-export const orchestrationDispatchRouteLayer = HttpRouter.add(
-  "POST",
-  "/api/orchestration/dispatch",
-  Effect.gen(function* () {
-    yield* authenticateOwnerSession;
     const orchestrationEngine = yield* OrchestrationEngineService;
-    const command = yield* HttpServerRequest.schemaBodyJson(ClientOrchestrationCommand).pipe(
-      Effect.mapError(
-        (cause) =>
-          new OrchestrationDispatchCommandError({
-            message: "Invalid orchestration command payload.",
-            cause,
-          }),
-      ),
-    );
-    const normalizedCommand = yield* normalizeDispatchCommand(command);
-    const result = yield* orchestrationEngine.dispatch(normalizedCommand).pipe(
-      Effect.mapError(
-        (cause) =>
-          new OrchestrationDispatchCommandError({
-            message: "Failed to dispatch orchestration command.",
-            cause,
-          }),
-      ),
-    );
-    return HttpServerResponse.jsonUnsafe(result, { status: 200 });
-  }).pipe(Effect.catchTag("OrchestrationDispatchCommandError", respondToOrchestrationHttpError)),
+
+    return handlers
+      .handle(
+        "snapshot",
+        Effect.fn("environment.orchestration.snapshot")(function* (args) {
+          yield* annotateEnvironmentRequest(args.endpoint.name);
+          yield* requireEnvironmentScope(AuthOrchestrationReadScope);
+          return yield* projectionSnapshotQuery
+            .getSnapshot()
+            .pipe(
+              Effect.catch((cause) =>
+                failEnvironmentInternal("orchestration_snapshot_failed", cause),
+              ),
+            );
+        }),
+      )
+      .handle(
+        "dispatch",
+        Effect.fn("environment.orchestration.dispatch")(function* (args) {
+          yield* annotateEnvironmentRequest(args.endpoint.name);
+          yield* requireEnvironmentScope(AuthOrchestrationOperateScope);
+          const normalizedCommand = yield* normalizeDispatchCommand(args.payload).pipe(
+            Effect.catch(() => failEnvironmentInvalidRequest("invalid_command")),
+          );
+          return yield* orchestrationEngine
+            .dispatch(normalizedCommand)
+            .pipe(
+              Effect.catch((cause) =>
+                failEnvironmentInternal("orchestration_dispatch_failed", cause),
+              ),
+            );
+        }),
+      );
+  }),
 );
diff --git a/apps/server/src/persistence/Layers/AuthPairingLinks.ts b/apps/server/src/persistence/Layers/AuthPairingLinks.ts
index 15c572ad0a1..7519c65c123 100644
--- a/apps/server/src/persistence/Layers/AuthPairingLinks.ts
+++ b/apps/server/src/persistence/Layers/AuthPairingLinks.ts
@@ -38,7 +38,7 @@ const makeAuthPairingLinkRepository = Effect.gen(function* () {
           id,
           credential,
           method,
-          role,
+          scopes,
           subject,
           label,
           created_at,
@@ -50,7 +50,7 @@ const makeAuthPairingLinkRepository = Effect.gen(function* () {
           ${input.id},
           ${input.credential},
           ${input.method},
-          ${input.role},
+          ${JSON.stringify(input.scopes)},
           ${input.subject},
           ${input.label},
           ${input.createdAt},
@@ -76,7 +76,7 @@ const makeAuthPairingLinkRepository = Effect.gen(function* () {
           id AS "id",
           credential AS "credential",
           method AS "method",
-          role AS "role",
+          scopes AS "scopes",
           subject AS "subject",
           label AS "label",
           created_at AS "createdAt",
@@ -95,7 +95,7 @@ const makeAuthPairingLinkRepository = Effect.gen(function* () {
           id AS "id",
           credential AS "credential",
           method AS "method",
-          role AS "role",
+          scopes AS "scopes",
           subject AS "subject",
           label AS "label",
           created_at AS "createdAt",
@@ -133,7 +133,7 @@ const makeAuthPairingLinkRepository = Effect.gen(function* () {
           id AS "id",
           credential AS "credential",
           method AS "method",
-          role AS "role",
+          scopes AS "scopes",
           subject AS "subject",
           label AS "label",
           created_at AS "createdAt",
diff --git a/apps/server/src/persistence/Layers/AuthSessions.ts b/apps/server/src/persistence/Layers/AuthSessions.ts
index 6774e79c81a..ab84e3fa041 100644
--- a/apps/server/src/persistence/Layers/AuthSessions.ts
+++ b/apps/server/src/persistence/Layers/AuthSessions.ts
@@ -1,4 +1,4 @@
-import { AuthSessionId } from "@t3tools/contracts";
+import { AuthEnvironmentScopes, AuthSessionId, ServerAuthSessionMethod } from "@t3tools/contracts";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 import * as SqlSchema from "effect/unstable/sql/SqlSchema";
 import * as Effect from "effect/Effect";
@@ -26,8 +26,8 @@ import {
 const AuthSessionDbRow = Schema.Struct({
   sessionId: AuthSessionId,
   subject: Schema.String,
-  role: Schema.Literals(["owner", "client"]),
-  method: Schema.Literals(["browser-session-cookie", "bearer-session-token"]),
+  scopes: Schema.fromJsonString(AuthEnvironmentScopes),
+  method: ServerAuthSessionMethod,
   clientLabel: Schema.NullOr(Schema.String),
   clientIpAddress: Schema.NullOr(Schema.String),
   clientUserAgent: Schema.NullOr(Schema.String),
@@ -44,7 +44,7 @@ function toAuthSessionRecord(row: typeof AuthSessionDbRow.Type): AuthSessionReco
   return {
     sessionId: row.sessionId,
     subject: row.subject,
-    role: row.role,
+    scopes: row.scopes,
     method: row.method,
     client: {
       label: row.clientLabel,
@@ -78,7 +78,7 @@ const makeAuthSessionRepository = Effect.gen(function* () {
         INSERT INTO auth_sessions (
           session_id,
           subject,
-          role,
+          scopes,
           method,
           client_label,
           client_ip_address,
@@ -93,7 +93,7 @@ const makeAuthSessionRepository = Effect.gen(function* () {
         VALUES (
           ${input.sessionId},
           ${input.subject},
-          ${input.role},
+          ${JSON.stringify(input.scopes)},
           ${input.method},
           ${input.client.label},
           ${input.client.ipAddress},
@@ -116,7 +116,7 @@ const makeAuthSessionRepository = Effect.gen(function* () {
         SELECT
           session_id AS "sessionId",
           subject AS "subject",
-          role AS "role",
+          scopes AS "scopes",
           method AS "method",
           client_label AS "clientLabel",
           client_ip_address AS "clientIpAddress",
@@ -141,7 +141,7 @@ const makeAuthSessionRepository = Effect.gen(function* () {
         SELECT
           session_id AS "sessionId",
           subject AS "subject",
-          role AS "role",
+          scopes AS "scopes",
           method AS "method",
           client_label AS "clientLabel",
           client_ip_address AS "clientIpAddress",
diff --git a/apps/server/src/persistence/Migrations.ts b/apps/server/src/persistence/Migrations.ts
index cc5024d5f51..9524deae8d8 100644
--- a/apps/server/src/persistence/Migrations.ts
+++ b/apps/server/src/persistence/Migrations.ts
@@ -43,6 +43,7 @@ import Migration0027 from "./Migrations/027_ProviderSessionRuntimeInstanceId.ts"
 import Migration0028 from "./Migrations/028_ProjectionThreadSessionInstanceId.ts";
 import Migration0029 from "./Migrations/029_ProjectionThreadDetailOrderingIndexes.ts";
 import Migration0030 from "./Migrations/030_ProjectionThreadShellArchiveIndexes.ts";
+import Migration0031 from "./Migrations/031_AuthAuthorizationScopes.ts";
 
 /**
  * Migration loader with all migrations defined inline.
@@ -85,6 +86,7 @@ export const migrationEntries = [
   [28, "ProjectionThreadSessionInstanceId", Migration0028],
   [29, "ProjectionThreadDetailOrderingIndexes", Migration0029],
   [30, "ProjectionThreadShellArchiveIndexes", Migration0030],
+  [31, "AuthAuthorizationScopes", Migration0031],
 ] as const;
 
 export const makeMigrationLoader = (throughId?: number) =>
diff --git a/apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.test.ts b/apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.test.ts
new file mode 100644
index 00000000000..cb50dc2c6cd
--- /dev/null
+++ b/apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.test.ts
@@ -0,0 +1,80 @@
+import { assert, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+
+import { runMigrations } from "../Migrations.ts";
+import * as NodeSqliteClient from "../NodeSqliteClient.ts";
+
+const layer = it.layer(Layer.mergeAll(NodeSqliteClient.layerMemory()));
+
+layer("031_AuthAuthorizationScopes", (it) => {
+  it.effect("invalidates role-based auth records and installs scoped auth tables", () =>
+    Effect.gen(function* () {
+      const sql = yield* SqlClient.SqlClient;
+
+      yield* runMigrations({ toMigrationInclusive: 30 });
+
+      yield* sql`
+        INSERT INTO auth_pairing_links (
+          id,
+          credential,
+          method,
+          role,
+          subject,
+          created_at,
+          expires_at
+        )
+        VALUES (
+          'link-owner',
+          'bootstrap-owner',
+          'desktop-bootstrap',
+          'owner',
+          'desktop',
+          '2026-05-29T00:00:00.000Z',
+          '2026-05-29T01:00:00.000Z'
+        )
+      `;
+      yield* sql`
+        INSERT INTO auth_sessions (
+          session_id,
+          subject,
+          role,
+          method,
+          issued_at,
+          expires_at
+        )
+        VALUES (
+          'session-owner',
+          'desktop',
+          'owner',
+          'browser-session-cookie',
+          '2026-05-29T00:00:00.000Z',
+          '2026-05-29T01:00:00.000Z'
+        )
+      `;
+
+      yield* runMigrations({ toMigrationInclusive: 31 });
+
+      const pairingColumns = yield* sql<{ readonly name: string }>`
+        PRAGMA table_info(auth_pairing_links)
+      `;
+      const sessionColumns = yield* sql<{ readonly name: string }>`
+        PRAGMA table_info(auth_sessions)
+      `;
+      const pairingRows = yield* sql<{ readonly id: string }>`
+        SELECT id FROM auth_pairing_links
+      `;
+      const sessionRows = yield* sql<{ readonly sessionId: string }>`
+        SELECT session_id AS "sessionId" FROM auth_sessions
+      `;
+
+      assert.isTrue(pairingColumns.some((column) => column.name === "scopes"));
+      assert.isFalse(pairingColumns.some((column) => column.name === "role"));
+      assert.isTrue(sessionColumns.some((column) => column.name === "scopes"));
+      assert.isFalse(sessionColumns.some((column) => column.name === "role"));
+      assert.deepStrictEqual(pairingRows, []);
+      assert.deepStrictEqual(sessionRows, []);
+    }),
+  );
+});
diff --git a/apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.ts b/apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.ts
new file mode 100644
index 00000000000..59f9f9695c2
--- /dev/null
+++ b/apps/server/src/persistence/Migrations/031_AuthAuthorizationScopes.ts
@@ -0,0 +1,57 @@
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+
+/**
+ * This is an intentional alpha cutover: role-bearing credentials and sessions
+ * cannot safely be assigned new capabilities implicitly.
+ */
+export default Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+
+  yield* sql`DROP TABLE IF EXISTS auth_pairing_links`;
+  yield* sql`DROP TABLE IF EXISTS auth_sessions`;
+
+  yield* sql`
+    CREATE TABLE auth_pairing_links (
+      id TEXT PRIMARY KEY,
+      credential TEXT NOT NULL UNIQUE,
+      method TEXT NOT NULL,
+      scopes TEXT NOT NULL,
+      subject TEXT NOT NULL,
+      label TEXT,
+      created_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      consumed_at TEXT,
+      revoked_at TEXT
+    )
+  `;
+
+  yield* sql`
+    CREATE INDEX idx_auth_pairing_links_active
+    ON auth_pairing_links(revoked_at, consumed_at, expires_at)
+  `;
+
+  yield* sql`
+    CREATE TABLE auth_sessions (
+      session_id TEXT PRIMARY KEY,
+      subject TEXT NOT NULL,
+      scopes TEXT NOT NULL,
+      method TEXT NOT NULL,
+      client_label TEXT,
+      client_ip_address TEXT,
+      client_user_agent TEXT,
+      client_device_type TEXT NOT NULL DEFAULT 'unknown',
+      client_os TEXT,
+      client_browser TEXT,
+      issued_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      last_connected_at TEXT,
+      revoked_at TEXT
+    )
+  `;
+
+  yield* sql`
+    CREATE INDEX idx_auth_sessions_active
+    ON auth_sessions(revoked_at, expires_at, issued_at)
+  `;
+});
diff --git a/apps/server/src/persistence/Services/AuthPairingLinks.ts b/apps/server/src/persistence/Services/AuthPairingLinks.ts
index c81ce51a3f4..16a9c4035ae 100644
--- a/apps/server/src/persistence/Services/AuthPairingLinks.ts
+++ b/apps/server/src/persistence/Services/AuthPairingLinks.ts
@@ -2,6 +2,7 @@ import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Context from "effect/Context";
 import type * as Effect from "effect/Effect";
+import { AuthEnvironmentScopes } from "@t3tools/contracts";
 
 import type { AuthPairingLinkRepositoryError } from "../Errors.ts";
 
@@ -9,7 +10,7 @@ export const AuthPairingLinkRecord = Schema.Struct({
   id: Schema.String,
   credential: Schema.String,
   method: Schema.Literals(["desktop-bootstrap", "one-time-token"]),
-  role: Schema.Literals(["owner", "client"]),
+  scopes: Schema.fromJsonString(AuthEnvironmentScopes),
   subject: Schema.String,
   label: Schema.NullOr(Schema.String),
   createdAt: Schema.DateTimeUtcFromString,
@@ -23,7 +24,7 @@ export const CreateAuthPairingLinkInput = Schema.Struct({
   id: Schema.String,
   credential: Schema.String,
   method: Schema.Literals(["desktop-bootstrap", "one-time-token"]),
-  role: Schema.Literals(["owner", "client"]),
+  scopes: AuthEnvironmentScopes,
   subject: Schema.String,
   label: Schema.NullOr(Schema.String),
   createdAt: Schema.DateTimeUtcFromString,
diff --git a/apps/server/src/persistence/Services/AuthSessions.ts b/apps/server/src/persistence/Services/AuthSessions.ts
index a92573f9f9e..c08956bdd71 100644
--- a/apps/server/src/persistence/Services/AuthSessions.ts
+++ b/apps/server/src/persistence/Services/AuthSessions.ts
@@ -1,4 +1,9 @@
-import { AuthClientMetadataDeviceType, AuthSessionId } from "@t3tools/contracts";
+import {
+  AuthClientMetadataDeviceType,
+  AuthEnvironmentScopes,
+  AuthSessionId,
+  ServerAuthSessionMethod,
+} from "@t3tools/contracts";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Context from "effect/Context";
@@ -19,8 +24,8 @@ export type AuthSessionClientMetadataRecord = typeof AuthSessionClientMetadataRe
 export const AuthSessionRecord = Schema.Struct({
   sessionId: AuthSessionId,
   subject: Schema.String,
-  role: Schema.Literals(["owner", "client"]),
-  method: Schema.Literals(["browser-session-cookie", "bearer-session-token"]),
+  scopes: AuthEnvironmentScopes,
+  method: ServerAuthSessionMethod,
   client: AuthSessionClientMetadataRecord,
   issuedAt: Schema.DateTimeUtcFromString,
   expiresAt: Schema.DateTimeUtcFromString,
@@ -32,8 +37,8 @@ export type AuthSessionRecord = typeof AuthSessionRecord.Type;
 export const CreateAuthSessionInput = Schema.Struct({
   sessionId: AuthSessionId,
   subject: Schema.String,
-  role: Schema.Literals(["owner", "client"]),
-  method: Schema.Literals(["browser-session-cookie", "bearer-session-token"]),
+  scopes: AuthEnvironmentScopes,
+  method: ServerAuthSessionMethod,
   client: AuthSessionClientMetadataRecord,
   issuedAt: Schema.DateTimeUtcFromString,
   expiresAt: Schema.DateTimeUtcFromString,
diff --git a/apps/server/src/server.test.ts b/apps/server/src/server.test.ts
index ae920aeb88e..7cd9efe5fd7 100644
--- a/apps/server/src/server.test.ts
+++ b/apps/server/src/server.test.ts
@@ -3,6 +3,9 @@ import * as NodeSocket from "@effect/platform-node/NodeSocket";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 
 import {
+  AuthAccessTokenType,
+  AuthEnvironmentBootstrapTokenType,
+  AuthTokenExchangeGrantType,
   CommandId,
   DEFAULT_SERVER_SETTINGS,
   EnvironmentId,
@@ -46,6 +49,7 @@ import {
   HttpClient,
   HttpRouter,
   HttpServer,
+  UrlParams,
 } from "effect/unstable/http";
 import { OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { RpcClient, RpcSerialization } from "effect/unstable/rpc";
@@ -114,8 +118,8 @@ import * as VcsProvisioningService from "./vcs/VcsProvisioningService.ts";
 import * as GitWorkflowService from "./git/GitWorkflowService.ts";
 import * as ReviewService from "./review/ReviewService.ts";
 import * as SourceControlRepositoryService from "./sourceControl/SourceControlRepositoryService.ts";
-import { ServerSecretStoreLive } from "./auth/Layers/ServerSecretStore.ts";
-import { ServerAuthLive } from "./auth/Layers/ServerAuth.ts";
+import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
 import * as ProcessDiagnostics from "./diagnostics/ProcessDiagnostics.ts";
 import * as ProcessResourceMonitor from "./diagnostics/ProcessResourceMonitor.ts";
 import * as TraceDiagnostics from "./diagnostics/TraceDiagnostics.ts";
@@ -215,7 +219,10 @@ const browserOtlpTracingLayer = Layer.mergeAll(
 );
 
 const makeAuthTestLayer = () =>
-  ServerAuthLive.pipe(Layer.provide(SqlitePersistenceMemory), Layer.provide(ServerSecretStoreLive));
+  EnvironmentAuth.layer.pipe(
+    Layer.provide(SqlitePersistenceMemory),
+    Layer.provide(ServerSecretStore.layer),
+  );
 
 const makeBrowserOtlpPayload = (spanName: string) =>
   Effect.gen(function* () {
@@ -799,7 +806,7 @@ const bootstrapBrowserSession = (
   },
 ) =>
   Effect.gen(function* () {
-    const response = yield* HttpClient.post("/api/auth/bootstrap", {
+    const response = yield* HttpClient.post("/api/auth/browser-session", {
       headers: options?.headers,
       body: yield* HttpBody.json({ credential }),
     });
@@ -815,23 +822,46 @@ const bootstrapBrowserSession = (
     };
   });
 
-const bootstrapBearerSession = (
+const exchangeAccessToken = (
   credential = defaultDesktopBootstrapToken,
   options?: {
     readonly headers?: Record<string, string>;
+    readonly scope?: string;
+    readonly clientMetadata?: {
+      readonly label?: string;
+      readonly deviceType?: string;
+      readonly os?: string;
+    };
   },
 ) =>
   Effect.gen(function* () {
-    const response = yield* HttpClient.post("/api/auth/bootstrap/bearer", {
+    const response = yield* HttpClient.post("/oauth/token", {
       headers: options?.headers,
-      body: yield* HttpBody.json({ credential }),
+      body: HttpBody.urlParams(
+        UrlParams.fromInput({
+          grant_type: AuthTokenExchangeGrantType,
+          subject_token: credential,
+          subject_token_type: AuthEnvironmentBootstrapTokenType,
+          requested_token_type: AuthAccessTokenType,
+          scope:
+            options?.scope ??
+            "orchestration:read orchestration:operate terminal:operate review:write relay:read access:read access:write relay:write",
+          ...(options?.clientMetadata?.label ? { client_label: options.clientMetadata.label } : {}),
+          ...(options?.clientMetadata?.deviceType
+            ? { client_device_type: options.clientMetadata.deviceType }
+            : {}),
+          ...(options?.clientMetadata?.os ? { client_os: options.clientMetadata.os } : {}),
+        }),
+      ),
     });
     const body = (yield* response.json) as {
-      readonly authenticated: boolean;
-      readonly sessionMethod: string;
-      readonly expiresAt: string;
-      readonly sessionToken?: string;
-      readonly error?: string;
+      readonly access_token?: string;
+      readonly issued_token_type?: string;
+      readonly token_type?: string;
+      readonly expires_in?: number;
+      readonly scope?: string;
+      readonly _tag?: string;
+      readonly message?: string;
     };
     return {
       response,
@@ -863,20 +893,20 @@ const getAuthenticatedSessionCookieHeader = (credential = defaultDesktopBootstra
 
 const getAuthenticatedBearerSessionToken = (credential = defaultDesktopBootstrapToken) =>
   Effect.gen(function* () {
-    const { response, body } = yield* bootstrapBearerSession(credential);
+    const { response, body } = yield* exchangeAccessToken(credential);
     if (response.status !== 200) {
       return yield* new AuthenticationGetterError({
         message: `Expected bearer bootstrap response to succeed, got ${response.status}`,
       });
     }
 
-    if (!body.sessionToken) {
+    if (!body.access_token) {
       return yield* new AuthenticationGetterError({
-        message: "Expected bearer bootstrap response to include a session token.",
+        message: "Expected token exchange response to include an access token.",
       });
     }
 
-    return body.sessionToken;
+    return body.access_token;
   });
 
 const extractSessionTokenFromSetCookie = (cookieHeader: string): string => {
@@ -895,8 +925,16 @@ const splitHeaderTokens = (value: string | null) =>
     .filter((token) => token.length > 0)
     .toSorted();
 
-const assertBrowserApiCorsHeaders = (headers: Readonly<Record<string, string | undefined>>) => {
+const assertBrowserApiCorsResponseHeaders = (
+  headers: Readonly<Record<string, string | undefined>>,
+) => {
   assert.equal(headers["access-control-allow-origin"], "*");
+};
+
+const assertBrowserApiCorsPreflightHeaders = (
+  headers: Readonly<Record<string, string | undefined>>,
+) => {
+  assertBrowserApiCorsResponseHeaders(headers);
   assert.deepEqual(splitHeaderTokens(headers["access-control-allow-methods"] ?? null), [
     "GET",
     "OPTIONS",
@@ -1039,7 +1077,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       const body = (yield* response.json) as typeof testEnvironmentDescriptor;
 
       assert.equal(response.status, 200);
-      assertBrowserApiCorsHeaders(response.headers);
+      assertBrowserApiCorsResponseHeaders(response.headers);
       assert.deepEqual(body, testEnvironmentDescriptor);
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
@@ -1063,10 +1101,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       assert.equal(body.authenticated, false);
       assert.equal(body.auth.policy, "desktop-managed-local");
       assert.deepEqual(body.auth.bootstrapMethods, ["desktop-bootstrap"]);
-      assert.deepEqual(body.auth.sessionMethods, [
-        "browser-session-cookie",
-        "bearer-session-token",
-      ]);
+      assert.deepEqual(body.auth.sessionMethods, ["browser-session-cookie", "bearer-access-token"]);
       assert.isTrue(body.auth.sessionCookieName.startsWith("t3_session_"));
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
@@ -1103,56 +1138,134 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
-  it.effect(
-    "bootstraps a bearer session and authenticates the session endpoint via authorization header",
-    () =>
-      Effect.gen(function* () {
-        yield* buildAppUnderTest();
+  it.effect("exchanges a bootstrap grant for a scoped bearer access token", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest();
 
-        const { response: bootstrapResponse, body: bootstrapBody } =
-          yield* bootstrapBearerSession();
+      const { response: bootstrapResponse, body: tokenBody } = yield* exchangeAccessToken();
 
-        assert.equal(bootstrapResponse.status, 200);
-        assert.equal(bootstrapBody.authenticated, true);
-        assert.equal(bootstrapBody.sessionMethod, "bearer-session-token");
-        assert.equal(typeof bootstrapBody.sessionToken, "string");
-        assert.isTrue((bootstrapBody.sessionToken?.length ?? 0) > 0);
+      assert.equal(bootstrapResponse.status, 200);
+      assert.equal(tokenBody.issued_token_type, AuthAccessTokenType);
+      assert.equal(tokenBody.token_type, "Bearer");
+      assert.equal(
+        tokenBody.scope,
+        "orchestration:read orchestration:operate terminal:operate review:write relay:read access:read access:write relay:write",
+      );
+      assert.equal(typeof tokenBody.access_token, "string");
+      assert.isTrue((tokenBody.access_token?.length ?? 0) > 0);
 
-        const sessionResponse = yield* HttpClient.get("/api/auth/session", {
-          headers: {
-            authorization: `Bearer ${bootstrapBody.sessionToken ?? ""}`,
-          },
-        });
-        const sessionBody = (yield* sessionResponse.json) as {
-          readonly authenticated: boolean;
-          readonly sessionMethod?: string;
-        };
+      const sessionResponse = yield* HttpClient.get("/api/auth/session", {
+        headers: {
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
+        },
+      });
+      const sessionBody = (yield* sessionResponse.json) as {
+        readonly authenticated: boolean;
+        readonly sessionMethod?: string;
+        readonly scopes?: ReadonlyArray<string>;
+      };
 
-        assert.equal(sessionResponse.status, 200);
-        assert.equal(sessionBody.authenticated, true);
-        assert.equal(sessionBody.sessionMethod, "bearer-session-token");
-      }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+      assert.equal(sessionResponse.status, 200);
+      assert.equal(sessionBody.authenticated, true);
+      assert.equal(sessionBody.sessionMethod, "bearer-access-token");
+      assert.deepEqual(sessionBody.scopes, [
+        "orchestration:read",
+        "orchestration:operate",
+        "terminal:operate",
+        "review:write",
+        "relay:read",
+        "access:read",
+        "access:write",
+        "relay:write",
+      ]);
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
-  it.effect("issues short-lived websocket tokens for authenticated bearer sessions", () =>
+  it.effect("issues short-lived websocket tickets for authenticated bearer sessions", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest();
 
       const bearerToken = yield* getAuthenticatedBearerSessionToken();
-      const wsTokenResponse = yield* HttpClient.post("/api/auth/ws-token", {
+      const wsTicketResponse = yield* HttpClient.post("/api/auth/websocket-ticket", {
         headers: {
           authorization: `Bearer ${bearerToken}`,
         },
       });
-      const wsTokenBody = (yield* wsTokenResponse.json) as {
-        readonly token: string;
+      const wsTicketBody = (yield* wsTicketResponse.json) as {
+        readonly ticket: string;
         readonly expiresAt: string;
       };
 
-      assert.equal(wsTokenResponse.status, 200);
-      assert.equal(typeof wsTokenBody.token, "string");
-      assert.isTrue(wsTokenBody.token.length > 0);
-      assert.equal(typeof wsTokenBody.expiresAt, "string");
+      assert.equal(wsTicketResponse.status, 200);
+      assert.equal(typeof wsTicketBody.ticket, "string");
+      assert.isTrue(wsTicketBody.ticket.length > 0);
+      assert.equal(typeof wsTicketBody.expiresAt, "string");
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
+  it.effect("does not allow management-only access tokens to operate the environment", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest();
+
+      const { response: exchangeResponse, body: tokenBody } = yield* exchangeAccessToken(
+        defaultDesktopBootstrapToken,
+        { scope: "access:write" },
+      );
+      assert.equal(exchangeResponse.status, 200);
+      assert.equal(tokenBody.scope, "access:write");
+      assert.isDefined(tokenBody.access_token);
+
+      const overbroadPairingResponse = yield* HttpClient.post("/api/auth/pairing-token", {
+        headers: {
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
+        },
+        body: yield* HttpBody.json({}),
+      });
+      const overbroadPairingBody = (yield* overbroadPairingResponse.json) as {
+        readonly requiredScope: string;
+      };
+      const pairingResponse = yield* HttpClient.post("/api/auth/pairing-token", {
+        headers: {
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
+        },
+        body: yield* HttpBody.json({ scopes: ["access:write"] }),
+      });
+      const wsTicketResponse = yield* HttpClient.post("/api/auth/websocket-ticket", {
+        headers: {
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
+        },
+      });
+      const wsTicketBody = (yield* wsTicketResponse.json) as { readonly ticket: string };
+      const faviconResponse = yield* HttpClient.get("/api/project-favicon?cwd=/tmp", {
+        headers: {
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
+        },
+      });
+      const faviconBody = (yield* faviconResponse.json) as {
+        readonly _tag: string;
+        readonly code: string;
+        readonly requiredScope: string;
+        readonly traceId: string;
+      };
+
+      assert.equal(overbroadPairingResponse.status, 403);
+      assert.equal(overbroadPairingBody.requiredScope, "orchestration:read");
+      assert.equal(pairingResponse.status, 200);
+      assert.equal(wsTicketResponse.status, 200);
+      assert.equal(faviconResponse.status, 403);
+      assert.equal(faviconBody._tag, "EnvironmentScopeRequiredError");
+      assert.equal(faviconBody.code, "insufficient_scope");
+      assert.equal(faviconBody.requiredScope, "orchestration:read");
+      assert.equal(typeof faviconBody.traceId, "string");
+
+      const wsUrl = `${yield* getWsServerUrl("/ws", { authenticated: false })}?wsTicket=${encodeURIComponent(wsTicketBody.ticket)}`;
+      const rpcError = yield* Effect.flip(
+        Effect.scoped(withWsRpcClient(wsUrl, (client) => client[WS_METHODS.serverGetConfig]({}))),
+      );
+      assert.equal(rpcError._tag, "EnvironmentAuthorizationError");
+      if (rpcError._tag === "EnvironmentAuthorizationError") {
+        assert.equal(rpcError.requiredScope, "orchestration:read");
+      }
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
@@ -1161,7 +1274,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       yield* buildAppUnderTest();
 
       const origin = crossOriginClientOrigin;
-      const { response: bootstrapResponse, body: bootstrapBody } = yield* bootstrapBearerSession(
+      const { response: bootstrapResponse, body: tokenBody } = yield* exchangeAccessToken(
         defaultDesktopBootstrapToken,
         {
           headers: { origin },
@@ -1169,13 +1282,13 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       );
 
       assert.equal(bootstrapResponse.status, 200);
-      assertBrowserApiCorsHeaders(bootstrapResponse.headers);
-      assert.equal(bootstrapBody.authenticated, true);
-      assert.equal(typeof bootstrapBody.sessionToken, "string");
+      assertBrowserApiCorsResponseHeaders(bootstrapResponse.headers);
+      assert.equal(tokenBody.token_type, "Bearer");
+      assert.equal(typeof tokenBody.access_token, "string");
 
       const sessionResponse = yield* HttpClient.get("/api/auth/session", {
         headers: {
-          authorization: `Bearer ${bootstrapBody.sessionToken ?? ""}`,
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
           origin,
         },
       });
@@ -1185,33 +1298,33 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       };
 
       assert.equal(sessionResponse.status, 200);
-      assertBrowserApiCorsHeaders(sessionResponse.headers);
+      assertBrowserApiCorsResponseHeaders(sessionResponse.headers);
       assert.equal(sessionBody.authenticated, true);
-      assert.equal(sessionBody.sessionMethod, "bearer-session-token");
+      assert.equal(sessionBody.sessionMethod, "bearer-access-token");
 
-      const wsTokenResponse = yield* HttpClient.post("/api/auth/ws-token", {
+      const wsTicketResponse = yield* HttpClient.post("/api/auth/websocket-ticket", {
         headers: {
-          authorization: `Bearer ${bootstrapBody.sessionToken ?? ""}`,
+          authorization: `Bearer ${tokenBody.access_token ?? ""}`,
           origin,
         },
       });
-      const wsTokenBody = (yield* wsTokenResponse.json) as {
-        readonly token: string;
+      const wsTicketBody = (yield* wsTicketResponse.json) as {
+        readonly ticket: string;
       };
 
-      assert.equal(wsTokenResponse.status, 200);
-      assertBrowserApiCorsHeaders(wsTokenResponse.headers);
-      assert.equal(typeof wsTokenBody.token, "string");
+      assert.equal(wsTicketResponse.status, 200);
+      assertBrowserApiCorsResponseHeaders(wsTicketResponse.headers);
+      assert.equal(typeof wsTicketBody.ticket, "string");
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
   it.effect(
-    "responds to remote auth websocket-token preflight requests with authorization CORS headers",
+    "responds to remote auth websocket-ticket preflight requests with authorization CORS headers",
     () =>
       Effect.gen(function* () {
         yield* buildAppUnderTest();
 
-        const response = yield* HttpClient.options("/api/auth/ws-token", {
+        const response = yield* HttpClient.options("/api/auth/websocket-ticket", {
           headers: {
             origin: crossOriginClientOrigin,
             "access-control-request-method": "POST",
@@ -1220,26 +1333,93 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         });
 
         assert.equal(response.status, 204);
-        assertBrowserApiCorsHeaders(response.headers);
+        assertBrowserApiCorsPreflightHeaders(response.headers);
       }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
-  it.effect("includes CORS headers on remote websocket-token auth failures", () =>
+  it.effect("includes CORS headers on remote websocket-ticket auth failures", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest();
 
-      const response = yield* HttpClient.post("/api/auth/ws-token", {
+      const response = yield* HttpClient.post("/api/auth/websocket-ticket", {
         headers: {
           origin: crossOriginClientOrigin,
         },
       });
       const body = (yield* response.json) as {
-        readonly error?: string;
+        readonly _tag?: string;
+        readonly code?: string;
+        readonly reason?: string;
+        readonly traceId?: string;
       };
 
       assert.equal(response.status, 401);
-      assertBrowserApiCorsHeaders(response.headers);
-      assert.equal(body.error, "Authentication required.");
+      assertBrowserApiCorsResponseHeaders(response.headers);
+      assert.equal(body._tag, "EnvironmentAuthInvalidError");
+      assert.equal(body.code, "auth_invalid");
+      assert.equal(body.reason, "missing_credential");
+      assert.equal(typeof body.traceId, "string");
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
+  it.effect("persists token exchange client display metadata for authorized-client listings", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest({
+        config: {
+          host: "0.0.0.0",
+        },
+      });
+
+      const ownerCookie = yield* getAuthenticatedSessionCookieHeader();
+      const pairingResponse = yield* HttpClient.post("/api/auth/pairing-token", {
+        headers: {
+          cookie: ownerCookie,
+        },
+        body: yield* HttpBody.json({}),
+      });
+      const pairingBody = (yield* pairingResponse.json) as {
+        readonly credential: string;
+      };
+
+      const { response } = yield* exchangeAccessToken(pairingBody.credential, {
+        headers: {
+          "user-agent": "undici",
+        },
+        scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
+        clientMetadata: {
+          label: "T3 Code Mobile",
+          deviceType: "mobile",
+          os: "iOS",
+        },
+      });
+
+      const clientsResponse = yield* HttpClient.get("/api/auth/clients", {
+        headers: {
+          cookie: ownerCookie,
+        },
+      });
+      const clients = (yield* clientsResponse.json) as ReadonlyArray<{
+        readonly current: boolean;
+        readonly client: {
+          readonly label?: string;
+          readonly deviceType: string;
+          readonly ipAddress?: string;
+          readonly os?: string;
+          readonly userAgent?: string;
+        };
+      }>;
+      const mobileClient = clients.find((client) => !client.current);
+
+      assert.equal(pairingResponse.status, 200);
+      assert.equal(response.status, 200);
+      assert.equal(clientsResponse.status, 200);
+      assert.deepInclude(mobileClient?.client, {
+        label: "T3 Code Mobile",
+        deviceType: "mobile",
+        os: "iOS",
+        ipAddress: "127.0.0.1",
+        userAgent: "undici",
+      });
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
@@ -1251,6 +1431,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: yield* getAuthenticatedSessionCookieHeader(),
         },
+        body: yield* HttpBody.json({}),
       });
       const body = (yield* response.json) as {
         readonly credential: string;
@@ -1270,16 +1451,61 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
+  it.effect("issues pairing credentials for bearer sessions with access management scope", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest();
+
+      const bearerToken = yield* getAuthenticatedBearerSessionToken();
+      const response = yield* HttpClient.post("/api/auth/pairing-token", {
+        headers: {
+          authorization: `Bearer ${bearerToken}`,
+        },
+        body: yield* HttpBody.json({ label: "Hosted web" }),
+      });
+      const body = (yield* response.json) as {
+        readonly credential: string;
+        readonly label?: string;
+      };
+
+      assert.equal(response.status, 200);
+      assert.isTrue(body.credential.length > 0);
+      assert.equal(body.label, "Hosted web");
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
+  it.effect("rejects pairing credentials with an empty scope grant", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest();
+
+      const response = yield* HttpClient.post("/api/auth/pairing-token", {
+        headers: {
+          cookie: yield* getAuthenticatedSessionCookieHeader(),
+        },
+        body: yield* HttpBody.json({ scopes: [] }),
+      });
+      const body = (yield* response.json) as {
+        readonly code: string;
+        readonly reason: string;
+      };
+
+      assert.equal(response.status, 400);
+      assert.equal(body.code, "invalid_request");
+      assert.equal(body.reason, "invalid_scope");
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
   it.effect("rejects unauthenticated pairing credential requests", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest();
 
-      const response = yield* HttpClient.post("/api/auth/pairing-token");
+      const response = yield* HttpClient.post("/api/auth/pairing-token", {
+        body: yield* HttpBody.json({}),
+      });
       assert.equal(response.status, 401);
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
-  it.effect("lists and revokes pairing links for owner sessions", () =>
+  it.effect("lists and revokes pairing links for access management sessions", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest({
         config: {
@@ -1292,6 +1518,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: ownerCookie,
         },
+        body: yield* HttpBody.json({}),
       });
       const createdBody = (yield* createdResponse.json) as {
         readonly id: string;
@@ -1324,7 +1551,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
-  it.effect("rejects pairing credential requests from non-owner paired sessions", () =>
+  it.effect("rejects pairing credential requests without access management scope", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest({
         config: {
@@ -1336,6 +1563,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: yield* getAuthenticatedSessionCookieHeader(),
         },
+        body: yield* HttpBody.json({}),
       });
       const ownerBody = (yield* ownerResponse.json) as {
         readonly credential: string;
@@ -1347,17 +1575,24 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: pairedSessionCookie,
         },
+        body: yield* HttpBody.json({}),
       });
       const pairedBody = (yield* pairedResponse.json) as {
-        readonly error: string;
+        readonly _tag: string;
+        readonly code: string;
+        readonly requiredScope: string;
+        readonly traceId: string;
       };
 
       assert.equal(pairedResponse.status, 403);
-      assert.equal(pairedBody.error, "Only owner sessions can create pairing credentials.");
+      assert.equal(pairedBody._tag, "EnvironmentScopeRequiredError");
+      assert.equal(pairedBody.code, "insufficient_scope");
+      assert.equal(pairedBody.requiredScope, "access:write");
+      assert.equal(typeof pairedBody.traceId, "string");
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
-  it.effect("lists paired clients and revokes other sessions while keeping the owner", () =>
+  it.effect("lists paired clients and revokes other sessions while keeping the administrator", () =>
     Effect.gen(function* () {
       yield* buildAppUnderTest({
         config: {
@@ -1429,9 +1664,13 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: pairedSessionCookieHeader,
         },
+        body: yield* HttpBody.json({}),
       });
       const pairedClientPairingBody = (yield* pairedClientPairingResponse.json) as {
-        readonly error: string;
+        readonly _tag: string;
+        readonly code: string;
+        readonly reason: string;
+        readonly traceId: string;
       };
 
       assert.equal(listBeforeResponse.status, 200);
@@ -1452,7 +1691,69 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       assert.lengthOf(clientsAfter, 1);
       assert.equal(clientsAfter[0]?.current, true);
       assert.equal(pairedClientPairingResponse.status, 401);
-      assert.equal(pairedClientPairingBody.error, "Unauthorized request.");
+      assert.equal(pairedClientPairingBody._tag, "EnvironmentAuthInvalidError");
+      assert.equal(pairedClientPairingBody.code, "auth_invalid");
+      assert.equal(pairedClientPairingBody.reason, "invalid_credential");
+      assert.equal(typeof pairedClientPairingBody.traceId, "string");
+    }).pipe(Effect.provide(NodeHttpServer.layerTest)),
+  );
+
+  it.effect("separates access inventory reads from credential management writes", () =>
+    Effect.gen(function* () {
+      yield* buildAppUnderTest({
+        config: {
+          host: "0.0.0.0",
+        },
+      });
+
+      const ownerCookie = yield* getAuthenticatedSessionCookieHeader();
+      const issueScopedSession = Effect.fnUntraced(function* (
+        scope: "access:read" | "access:write",
+      ) {
+        const pairingResponse = yield* HttpClient.post("/api/auth/pairing-token", {
+          headers: {
+            cookie: ownerCookie,
+          },
+          body: yield* HttpBody.json({ scopes: [scope] }),
+        });
+        assert.equal(pairingResponse.status, 200);
+        const pairingBody = (yield* pairingResponse.json) as {
+          readonly credential: string;
+        };
+        return yield* getAuthenticatedSessionCookieHeader(pairingBody.credential);
+      });
+
+      const readCookie = yield* issueScopedSession("access:read");
+      const readListResponse = yield* HttpClient.get("/api/auth/clients", {
+        headers: {
+          cookie: readCookie,
+        },
+      });
+      const readWriteResponse = yield* HttpClient.post("/api/auth/pairing-token", {
+        headers: {
+          cookie: readCookie,
+        },
+        body: yield* HttpBody.json({}),
+      });
+      const readWriteBody = (yield* readWriteResponse.json) as {
+        readonly requiredScope: string;
+      };
+
+      const writeCookie = yield* issueScopedSession("access:write");
+      const writeListResponse = yield* HttpClient.get("/api/auth/clients", {
+        headers: {
+          cookie: writeCookie,
+        },
+      });
+      const writeListBody = (yield* writeListResponse.json) as {
+        readonly requiredScope: string;
+      };
+
+      assert.equal(readListResponse.status, 200);
+      assert.equal(readWriteResponse.status, 403);
+      assert.equal(readWriteBody.requiredScope, "access:write");
+      assert.equal(writeListResponse.status, 403);
+      assert.equal(writeListBody.requiredScope, "access:read");
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
@@ -1469,6 +1770,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: ownerCookie,
         },
+        body: yield* HttpBody.json({}),
       });
       const pairingBody = (yield* pairingResponse.json) as {
         readonly credential: string;
@@ -1499,6 +1801,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         headers: {
           cookie: pairedSessionCookie,
         },
+        body: yield* HttpBody.json({}),
       });
 
       assert.equal(revokeResponse.status, 200);
@@ -1515,10 +1818,9 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
 
       assert.equal(first.response.status, 200);
       assert.equal(second.response.status, 401);
-      assert.equal(
-        (second.body as { readonly error?: string }).error,
-        "Invalid bootstrap credential.",
-      );
+      assert.equal((second.body as { readonly _tag?: string })._tag, "EnvironmentAuthInvalidError");
+      assert.equal((second.body as { readonly code?: string }).code, "auth_invalid");
+      assert.equal((second.body as { readonly reason?: string }).reason, "invalid_credential");
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
@@ -1594,15 +1896,15 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         yield* buildAppUnderTest();
 
         const bearerToken = yield* getAuthenticatedBearerSessionToken();
-        const wsTokenResponse = yield* HttpClient.post("/api/auth/ws-token", {
+        const wsTicketResponse = yield* HttpClient.post("/api/auth/websocket-ticket", {
           headers: {
             authorization: `Bearer ${bearerToken}`,
           },
         });
-        const wsTokenBody = (yield* wsTokenResponse.json) as {
-          readonly token: string;
+        const wsTicketBody = (yield* wsTicketResponse.json) as {
+          readonly ticket: string;
         };
-        const wsUrl = `${yield* getWsServerUrl("/ws", { authenticated: false })}?wsToken=${encodeURIComponent(wsTokenBody.token)}`;
+        const wsUrl = `${yield* getWsServerUrl("/ws", { authenticated: false })}?wsTicket=${encodeURIComponent(wsTicketBody.ticket)}`;
 
         const response = yield* Effect.scoped(
           withWsRpcClient(wsUrl, (client) => client[WS_METHODS.serverGetConfig]({})),
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index 13516c77259..5c0bbb8425a 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -1,13 +1,15 @@
+import { EnvironmentHttpApi } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { FetchHttpClient, HttpRouter, HttpServer } from "effect/unstable/http";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
 
 import { ServerConfig } from "./config.ts";
 import {
   attachmentsRouteLayer,
   otlpTracesProxyRouteLayer,
   projectFaviconRouteLayer,
-  serverEnvironmentRouteLayer,
+  serverEnvironmentHttpApiLayer,
   staticAndDevRouteLayer,
   browserApiCorsLayer,
 } from "./http.ts";
@@ -62,20 +64,9 @@ import * as SourceControlRepositoryService from "./sourceControl/SourceControlRe
 import { ProjectSetupScriptRunnerLive } from "./project/Layers/ProjectSetupScriptRunner.ts";
 import { ObservabilityLive } from "./observability/Layers/Observability.ts";
 import { ServerEnvironmentLive } from "./environment/Layers/ServerEnvironment.ts";
-import {
-  authBearerBootstrapRouteLayer,
-  authBootstrapRouteLayer,
-  authClientsRevokeOthersRouteLayer,
-  authClientsRevokeRouteLayer,
-  authClientsRouteLayer,
-  authPairingLinksRevokeRouteLayer,
-  authPairingLinksRouteLayer,
-  authPairingCredentialRouteLayer,
-  authSessionRouteLayer,
-  authWebSocketTokenRouteLayer,
-} from "./auth/http.ts";
-import { ServerSecretStoreLive } from "./auth/Layers/ServerSecretStore.ts";
-import { ServerAuthLive } from "./auth/Layers/ServerAuth.ts";
+import { authHttpApiLayer, environmentAuthenticatedAuthLayer } from "./auth/http.ts";
+import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
 import * as ProcessDiagnostics from "./diagnostics/ProcessDiagnostics.ts";
 import * as ProcessResourceMonitor from "./diagnostics/ProcessResourceMonitor.ts";
 import * as TraceDiagnostics from "./diagnostics/TraceDiagnostics.ts";
@@ -85,10 +76,7 @@ import {
   makePersistedServerRuntimeState,
   persistServerRuntimeState,
 } from "./serverRuntimeState.ts";
-import {
-  orchestrationDispatchRouteLayer,
-  orchestrationSnapshotRouteLayer,
-} from "./orchestration/http.ts";
+import { orchestrationHttpApiLayer } from "./orchestration/http.ts";
 import * as NetService from "@t3tools/shared/Net";
 import { disableTailscaleServe, ensureTailscaleServe } from "@t3tools/tailscale";
 
@@ -238,9 +226,9 @@ const WorkspaceLayerLive = Layer.mergeAll(
   WorkspaceFileSystemLayerLive,
 );
 
-const AuthLayerLive = ServerAuthLive.pipe(
+const AuthLayerLive = EnvironmentAuth.layer.pipe(
   Layer.provideMerge(PersistenceLayerLive),
-  Layer.provide(ServerSecretStoreLive),
+  Layer.provide(ServerSecretStore.layer),
 );
 
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(
@@ -301,22 +289,15 @@ const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(
 );
 
 export const makeRoutesLayer = Layer.mergeAll(
-  authBearerBootstrapRouteLayer,
-  authBootstrapRouteLayer,
-  authClientsRevokeOthersRouteLayer,
-  authClientsRevokeRouteLayer,
-  authClientsRouteLayer,
-  authPairingLinksRevokeRouteLayer,
-  authPairingLinksRouteLayer,
-  authPairingCredentialRouteLayer,
-  authSessionRouteLayer,
-  authWebSocketTokenRouteLayer,
+  HttpApiBuilder.layer(EnvironmentHttpApi).pipe(
+    Layer.provide(authHttpApiLayer),
+    Layer.provide(orchestrationHttpApiLayer),
+    Layer.provide(serverEnvironmentHttpApiLayer),
+    Layer.provide(environmentAuthenticatedAuthLayer),
+  ),
   attachmentsRouteLayer,
-  orchestrationDispatchRouteLayer,
-  orchestrationSnapshotRouteLayer,
   otlpTracesProxyRouteLayer,
   projectFaviconRouteLayer,
-  serverEnvironmentRouteLayer,
   staticAndDevRouteLayer,
   websocketRpcRouteLayer,
 ).pipe(Layer.provide(browserApiCorsLayer));
diff --git a/apps/server/src/serverRuntimeStartup.ts b/apps/server/src/serverRuntimeStartup.ts
index c069623ca8f..8c41e28b7b3 100644
--- a/apps/server/src/serverRuntimeStartup.ts
+++ b/apps/server/src/serverRuntimeStartup.ts
@@ -32,7 +32,7 @@ import { ServerLifecycleEvents } from "./serverLifecycleEvents.ts";
 import { ServerSettingsService } from "./serverSettings.ts";
 import { ServerEnvironment } from "./environment/Services/ServerEnvironment.ts";
 import { AnalyticsService } from "./telemetry/Services/AnalyticsService.ts";
-import { ServerAuth } from "./auth/Services/ServerAuth.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
 import { ProviderSessionReaper } from "./provider/Services/ProviderSessionReaper.ts";
 import {
   formatHeadlessServeOutput,
@@ -244,7 +244,7 @@ export const resolveAutoBootstrapWelcomeTargets = Effect.gen(function* () {
 
 const resolveStartupBrowserTarget = Effect.gen(function* () {
   const serverConfig = yield* ServerConfig;
-  const serverAuth = yield* ServerAuth;
+  const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
   const localUrl = `http://localhost:${serverConfig.port}`;
   const bindUrl =
     serverConfig.host && !isWildcardHost(serverConfig.host)
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index 5ea2e03813f..2ccbb121be8 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -47,8 +47,7 @@ import { ServerConfig } from "./config.ts";
 import { type DeepPartial, deepMerge } from "@t3tools/shared/Struct";
 import { fromJsonStringPretty, fromLenientJson } from "@t3tools/shared/schemaJson";
 import { applyServerSettingsPatch } from "@t3tools/shared/serverSettings";
-import { ServerSecretStoreLive } from "./auth/Layers/ServerSecretStore.ts";
-import { ServerSecretStore } from "./auth/Services/ServerSecretStore.ts";
+import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
 
 const encodeServerSettings = Schema.encodeEffect(ServerSettings);
 const encodeServerSettingsJson = Schema.encodeUnknownEffect(fromJsonStringPretty(ServerSettings));
@@ -257,7 +256,7 @@ const makeServerSettings = Effect.gen(function* () {
   const { settingsPath } = yield* ServerConfig;
   const fs = yield* FileSystem.FileSystem;
   const pathService = yield* Path.Path;
-  const secretStore = yield* ServerSecretStore;
+  const secretStore = yield* ServerSecretStore.ServerSecretStore;
   const writeSemaphore = yield* Semaphore.make(1);
   const cacheKey = "settings" as const;
   const changesPubSub = yield* PubSub.unbounded<ServerSettings>();
@@ -580,5 +579,5 @@ const makeServerSettings = Effect.gen(function* () {
 });
 
 export const ServerSettingsLive = Layer.effect(ServerSettingsService, makeServerSettings).pipe(
-  Layer.provide(ServerSecretStoreLive),
+  Layer.provide(ServerSecretStore.layer),
 );
diff --git a/apps/server/src/startupAccess.ts b/apps/server/src/startupAccess.ts
index d3b6898d75b..7a03dafaefe 100644
--- a/apps/server/src/startupAccess.ts
+++ b/apps/server/src/startupAccess.ts
@@ -5,7 +5,7 @@ import * as Effect from "effect/Effect";
 import { HttpServer } from "effect/unstable/http";
 
 import { ServerConfig } from "./config.ts";
-import { ServerAuth } from "./auth/Services/ServerAuth.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
 
 export interface HeadlessServeAccessInfo {
   readonly connectionString: string;
@@ -133,12 +133,12 @@ export const formatHeadlessServeOutput = (accessInfo: HeadlessServeAccessInfo):
 export const issueHeadlessServeAccessInfo = Effect.fn("issueHeadlessServeAccessInfo")(function* () {
   const serverConfig = yield* ServerConfig;
   const httpServer = yield* HttpServer.HttpServer;
-  const serverAuth = yield* ServerAuth;
+  const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
   const connectionString = resolveHeadlessConnectionString(
     serverConfig.host,
     resolveListeningPort(httpServer.address, serverConfig.port),
   );
-  const issued = yield* serverAuth.issuePairingCredential({ role: "owner" });
+  const issued = yield* serverAuth.issueStartupPairingCredential();
 
   return {
     connectionString,
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 1d0af00e3a7..da8e3f694db 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -11,7 +11,14 @@ import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import {
   DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL,
+  AuthOrchestrationOperateScope,
+  AuthOrchestrationReadScope,
+  AuthReviewWriteScope,
+  AuthTerminalOperateScope,
+  AuthAccessReadScope,
+  AuthAccessStreamError,
   type AuthAccessStreamEvent,
+  type AuthEnvironmentScope,
   AuthSessionId,
   CommandId,
   EventId,
@@ -29,6 +36,7 @@ import {
   ProjectWriteFileError,
   OrchestrationReplayEventsError,
   FilesystemBrowseError,
+  EnvironmentAuthorizationError,
   ThreadId,
   type TerminalAttachStreamEvent,
   type TerminalError,
@@ -38,7 +46,7 @@ import {
   WsRpcGroup,
 } from "@t3tools/contracts";
 import { clamp } from "effect/Number";
-import { HttpRouter, HttpServerRequest } from "effect/unstable/http";
+import { HttpRouter, HttpServerRequest, HttpServerRespondable } from "effect/unstable/http";
 import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
 
 import { CheckpointDiffQuery } from "./checkpointing/Services/CheckpointDiffQuery.ts";
@@ -49,9 +57,9 @@ import { normalizeDispatchCommand } from "./orchestration/Normalizer.ts";
 import { OrchestrationEngineService } from "./orchestration/Services/OrchestrationEngine.ts";
 import { ProjectionSnapshotQuery } from "./orchestration/Services/ProjectionSnapshotQuery.ts";
 import {
-  observeRpcEffect,
-  observeRpcStream,
-  observeRpcStreamEffect,
+  observeRpcEffect as instrumentRpcEffect,
+  observeRpcStream as instrumentRpcStream,
+  observeRpcStreamEffect as instrumentRpcStreamEffect,
 } from "./observability/RpcInstrumentation.ts";
 import { ProviderRegistry } from "./provider/Services/ProviderRegistry.ts";
 import * as ProviderMaintenanceRunner from "./provider/providerMaintenanceRunner.ts";
@@ -69,7 +77,8 @@ import { ReviewService } from "./review/ReviewService.ts";
 import { ProjectSetupScriptRunner } from "./project/Services/ProjectSetupScriptRunner.ts";
 import { RepositoryIdentityResolver } from "./project/Services/RepositoryIdentityResolver.ts";
 import { ServerEnvironment } from "./environment/Services/ServerEnvironment.ts";
-import { ServerAuth } from "./auth/Services/ServerAuth.ts";
+import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts";
+import type { AuthenticatedSession } from "./auth/EnvironmentAuth.ts";
 import * as ProcessDiagnostics from "./diagnostics/ProcessDiagnostics.ts";
 import * as ProcessResourceMonitor from "./diagnostics/ProcessResourceMonitor.ts";
 import * as TraceDiagnostics from "./diagnostics/TraceDiagnostics.ts";
@@ -84,15 +93,9 @@ import * as GitVcsDriver from "./vcs/GitVcsDriver.ts";
 import * as VcsDriverRegistry from "./vcs/VcsDriverRegistry.ts";
 import * as VcsProjectConfig from "./vcs/VcsProjectConfig.ts";
 import * as VcsProcess from "./vcs/VcsProcess.ts";
-import {
-  BootstrapCredentialService,
-  type BootstrapCredentialChange,
-} from "./auth/Services/BootstrapCredentialService.ts";
-import {
-  SessionCredentialService,
-  type SessionCredentialChange,
-} from "./auth/Services/SessionCredentialService.ts";
-import { respondToAuthError } from "./auth/http.ts";
+import * as PairingGrantStore from "./auth/PairingGrantStore.ts";
+import * as SessionStore from "./auth/SessionStore.ts";
+import { failEnvironmentAuthInvalid, failEnvironmentInternal } from "./auth/http.ts";
 const isOrchestrationDispatchCommandError = Schema.is(OrchestrationDispatchCommandError);
 const isWorkspacePathOutsideRootError = Schema.is(WorkspacePathOutsideRootError);
 
@@ -122,8 +125,62 @@ function isThreadDetailEvent(event: OrchestrationEvent): event is Extract<
 
 const PROVIDER_STATUS_DEBOUNCE_MS = 200;
 
+const RPC_REQUIRED_SCOPE = new Map<string, AuthEnvironmentScope>([
+  [ORCHESTRATION_WS_METHODS.dispatchCommand, AuthOrchestrationOperateScope],
+  [ORCHESTRATION_WS_METHODS.getTurnDiff, AuthOrchestrationReadScope],
+  [ORCHESTRATION_WS_METHODS.getFullThreadDiff, AuthOrchestrationReadScope],
+  [ORCHESTRATION_WS_METHODS.replayEvents, AuthOrchestrationReadScope],
+  [ORCHESTRATION_WS_METHODS.subscribeShell, AuthOrchestrationReadScope],
+  [ORCHESTRATION_WS_METHODS.getArchivedShellSnapshot, AuthOrchestrationReadScope],
+  [ORCHESTRATION_WS_METHODS.subscribeThread, AuthOrchestrationReadScope],
+  [WS_METHODS.serverGetConfig, AuthOrchestrationReadScope],
+  [WS_METHODS.serverRefreshProviders, AuthOrchestrationOperateScope],
+  [WS_METHODS.serverUpdateProvider, AuthOrchestrationOperateScope],
+  [WS_METHODS.serverUpsertKeybinding, AuthOrchestrationOperateScope],
+  [WS_METHODS.serverRemoveKeybinding, AuthOrchestrationOperateScope],
+  [WS_METHODS.serverGetSettings, AuthOrchestrationReadScope],
+  [WS_METHODS.serverUpdateSettings, AuthOrchestrationOperateScope],
+  [WS_METHODS.serverDiscoverSourceControl, AuthOrchestrationReadScope],
+  [WS_METHODS.serverGetTraceDiagnostics, AuthOrchestrationReadScope],
+  [WS_METHODS.serverGetProcessDiagnostics, AuthOrchestrationReadScope],
+  [WS_METHODS.serverGetProcessResourceHistory, AuthOrchestrationReadScope],
+  [WS_METHODS.serverSignalProcess, AuthOrchestrationOperateScope],
+  [WS_METHODS.sourceControlLookupRepository, AuthOrchestrationReadScope],
+  [WS_METHODS.sourceControlCloneRepository, AuthOrchestrationOperateScope],
+  [WS_METHODS.sourceControlPublishRepository, AuthOrchestrationOperateScope],
+  [WS_METHODS.projectsSearchEntries, AuthOrchestrationReadScope],
+  [WS_METHODS.projectsWriteFile, AuthOrchestrationOperateScope],
+  [WS_METHODS.shellOpenInEditor, AuthOrchestrationOperateScope],
+  [WS_METHODS.filesystemBrowse, AuthOrchestrationReadScope],
+  [WS_METHODS.subscribeVcsStatus, AuthOrchestrationReadScope],
+  [WS_METHODS.vcsRefreshStatus, AuthOrchestrationReadScope],
+  [WS_METHODS.vcsPull, AuthOrchestrationOperateScope],
+  [WS_METHODS.gitRunStackedAction, AuthOrchestrationOperateScope],
+  [WS_METHODS.gitResolvePullRequest, AuthOrchestrationOperateScope],
+  [WS_METHODS.gitPreparePullRequestThread, AuthOrchestrationOperateScope],
+  [WS_METHODS.vcsListRefs, AuthOrchestrationReadScope],
+  [WS_METHODS.vcsCreateWorktree, AuthOrchestrationOperateScope],
+  [WS_METHODS.vcsRemoveWorktree, AuthOrchestrationOperateScope],
+  [WS_METHODS.vcsCreateRef, AuthOrchestrationOperateScope],
+  [WS_METHODS.vcsSwitchRef, AuthOrchestrationOperateScope],
+  [WS_METHODS.vcsInit, AuthOrchestrationOperateScope],
+  [WS_METHODS.reviewGetDiffPreview, AuthReviewWriteScope],
+  [WS_METHODS.terminalOpen, AuthTerminalOperateScope],
+  [WS_METHODS.terminalAttach, AuthTerminalOperateScope],
+  [WS_METHODS.terminalWrite, AuthTerminalOperateScope],
+  [WS_METHODS.terminalResize, AuthTerminalOperateScope],
+  [WS_METHODS.terminalClear, AuthTerminalOperateScope],
+  [WS_METHODS.terminalRestart, AuthTerminalOperateScope],
+  [WS_METHODS.terminalClose, AuthTerminalOperateScope],
+  [WS_METHODS.subscribeTerminalEvents, AuthTerminalOperateScope],
+  [WS_METHODS.subscribeTerminalMetadata, AuthTerminalOperateScope],
+  [WS_METHODS.subscribeServerConfig, AuthOrchestrationReadScope],
+  [WS_METHODS.subscribeServerLifecycle, AuthOrchestrationReadScope],
+  [WS_METHODS.subscribeAuthAccess, AuthAccessReadScope],
+]);
+
 function toAuthAccessStreamEvent(
-  change: BootstrapCredentialChange | SessionCredentialChange,
+  change: PairingGrantStore.BootstrapCredentialChange | SessionStore.SessionCredentialChange,
   revision: number,
   currentSessionId: AuthSessionId,
 ): AuthAccessStreamEvent {
@@ -162,9 +219,10 @@ function toAuthAccessStreamEvent(
   }
 }
 
-const makeWsRpcLayer = (currentSessionId: AuthSessionId) =>
+const makeWsRpcLayer = (currentSession: AuthenticatedSession) =>
   WsRpcGroup.toLayer(
     Effect.gen(function* () {
+      const currentSessionId = currentSession.sessionId;
       const crypto = yield* Crypto.Crypto;
       const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
       const orchestrationEngine = yield* OrchestrationEngineService;
@@ -187,7 +245,7 @@ const makeWsRpcLayer = (currentSessionId: AuthSessionId) =>
       const projectSetupScriptRunner = yield* ProjectSetupScriptRunner;
       const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
       const serverEnvironment = yield* ServerEnvironment;
-      const serverAuth = yield* ServerAuth;
+      const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
       const sourceControlDiscovery = yield* SourceControlDiscoveryLayer.SourceControlDiscovery;
       const automaticGitFetchInterval = serverSettings.getSettings.pipe(
         Effect.map((settings) => settings.automaticGitFetchInterval),
@@ -198,10 +256,70 @@ const makeWsRpcLayer = (currentSessionId: AuthSessionId) =>
         ),
       );
       const sourceControlRepositories = yield* SourceControlRepositoryService;
-      const bootstrapCredentials = yield* BootstrapCredentialService;
-      const sessions = yield* SessionCredentialService;
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
+      const sessions = yield* SessionStore.SessionStore;
       const processDiagnostics = yield* ProcessDiagnostics.ProcessDiagnostics;
       const processResourceMonitor = yield* ProcessResourceMonitor.ProcessResourceMonitor;
+      const authorizationError = (requiredScope: AuthEnvironmentScope) =>
+        new EnvironmentAuthorizationError({
+          message: `The authenticated token is missing required scope: ${requiredScope}.`,
+          requiredScope,
+        });
+      const authorizeEffect = <A, E, R>(
+        requiredScope: AuthEnvironmentScope,
+        effect: Effect.Effect<A, E, R>,
+      ): Effect.Effect<A, E | EnvironmentAuthorizationError, R> =>
+        currentSession.scopes.includes(requiredScope)
+          ? effect
+          : Effect.fail(authorizationError(requiredScope));
+      const authorizeStream = <A, E, R>(
+        requiredScope: AuthEnvironmentScope,
+        stream: Stream.Stream<A, E, R>,
+      ): Stream.Stream<A, E | EnvironmentAuthorizationError, R> =>
+        currentSession.scopes.includes(requiredScope)
+          ? stream
+          : Stream.fail(authorizationError(requiredScope));
+      const requiredScopeForMethod = (method: string): AuthEnvironmentScope => {
+        const requiredScope = RPC_REQUIRED_SCOPE.get(method);
+        if (requiredScope === undefined) {
+          throw new Error(`RPC method ${method} has no declared authorization scope.`);
+        }
+        return requiredScope;
+      };
+      const observeRpcEffect = <A, E, R>(
+        method: string,
+        effect: Effect.Effect<A, E, R>,
+        traceAttributes?: Readonly<Record<string, unknown>>,
+      ) =>
+        instrumentRpcEffect(
+          method,
+          authorizeEffect(requiredScopeForMethod(method), effect),
+          traceAttributes,
+        );
+      const observeRpcStream = <A, E, R>(
+        method: string,
+        stream: Stream.Stream<A, E, R>,
+        traceAttributes?: Readonly<Record<string, unknown>>,
+      ) =>
+        instrumentRpcStream(
+          method,
+          authorizeStream(requiredScopeForMethod(method), stream),
+          traceAttributes,
+        );
+      const observeRpcStreamEffect = <A, StreamError, StreamContext, EffectError, EffectContext>(
+        method: string,
+        effect: Effect.Effect<
+          Stream.Stream<A, StreamError, StreamContext>,
+          EffectError,
+          EffectContext
+        >,
+        traceAttributes?: Readonly<Record<string, unknown>>,
+      ) =>
+        instrumentRpcStreamEffect(
+          method,
+          authorizeEffect(requiredScopeForMethod(method), effect),
+          traceAttributes,
+        );
       const toDispatchCommandError = (cause: unknown, fallbackMessage: string) =>
         isOrchestrationDispatchCommandError(cause)
           ? cause
@@ -220,9 +338,16 @@ const makeWsRpcLayer = (currentSessionId: AuthSessionId) =>
 
       const loadAuthAccessSnapshot = () =>
         Effect.all({
-          pairingLinks: serverAuth.listPairingLinks().pipe(Effect.orDie),
-          clientSessions: serverAuth.listClientSessions(currentSessionId).pipe(Effect.orDie),
-        });
+          pairingLinks: serverAuth.listPairingLinks(),
+          clientSessions: serverAuth.listClientSessions(currentSessionId),
+        }).pipe(
+          Effect.mapError(
+            (error) =>
+              new AuthAccessStreamError({
+                message: error.message,
+              }),
+          ),
+        );
 
       const appendSetupScriptActivity = (input: {
         readonly threadId: ThreadId;
@@ -1258,7 +1383,7 @@ const makeWsRpcLayer = (currentSessionId: AuthSessionId) =>
               const initialSnapshot = yield* loadAuthAccessSnapshot();
               const revisionRef = yield* Ref.make(1);
               const accessChanges: Stream.Stream<
-                BootstrapCredentialChange | SessionCredentialChange
+                PairingGrantStore.BootstrapCredentialChange | SessionStore.SessionCredentialChange
               > = Stream.merge(bootstrapCredentials.streamChanges, sessions.streamChanges);
 
               const liveEvents: Stream.Stream<AuthAccessStreamEvent> = accessChanges.pipe(
@@ -1294,14 +1419,19 @@ export const websocketRpcRouteLayer = Layer.unwrap(
       "/ws",
       Effect.gen(function* () {
         const request = yield* HttpServerRequest.HttpServerRequest;
-        const serverAuth = yield* ServerAuth;
-        const sessions = yield* SessionCredentialService;
-        const session = yield* serverAuth.authenticateWebSocketUpgrade(request);
+        const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+        const sessions = yield* SessionStore.SessionStore;
+        const session = yield* serverAuth.authenticateWebSocketUpgrade(request).pipe(
+          Effect.catchTags({
+            ServerAuthInvalidCredentialError: (error) => failEnvironmentAuthInvalid(error.reason),
+            ServerAuthInternalError: (error) => failEnvironmentInternal("internal_error", error),
+          }),
+        );
         const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, {
           disableTracing: true,
         }).pipe(
           Effect.provide(
-            makeWsRpcLayer(session.sessionId).pipe(
+            makeWsRpcLayer(session).pipe(
               Layer.provideMerge(RpcSerialization.layerJson),
               Layer.provide(ProviderMaintenanceRunner.layer),
               Layer.provide(
@@ -1333,7 +1463,12 @@ export const websocketRpcRouteLayer = Layer.unwrap(
           () => rpcWebSocketHttpEffect,
           () => sessions.markDisconnected(session.sessionId),
         );
-      }).pipe(Effect.catchTag("AuthError", respondToAuthError)),
+      }).pipe(
+        Effect.catchTags({
+          EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
+          EnvironmentInternalError: HttpServerRespondable.toResponse,
+        }),
+      ),
     ),
   ),
 );
diff --git a/apps/web/package.json b/apps/web/package.json
index 9ef17991e64..c16a8893e50 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -43,6 +43,7 @@
     "zustand": "^5.0.11"
   },
   "devDependencies": {
+    "@effect/platform-node": "catalog:",
     "@rolldown/plugin-babel": "^0.2.0",
     "@tailwindcss/vite": "^4.0.0",
     "@tanstack/router-plugin": "^1.161.0",
@@ -51,7 +52,7 @@
     "@types/react-dom": "~19.2.3",
     "@vercel/config": "^0.3.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/browser-playwright": "^4.0.18",
+    "@vitest/browser-playwright": "catalog:",
     "babel-plugin-react-compiler": "1.0.0",
     "msw": "2.12.11",
     "playwright": "^1.58.2",
diff --git a/apps/web/src/authBootstrap.test.ts b/apps/web/src/authBootstrap.test.ts
index e6f08f147ca..3f00e5947f8 100644
--- a/apps/web/src/authBootstrap.test.ts
+++ b/apps/web/src/authBootstrap.test.ts
@@ -1,15 +1,17 @@
-import type { DesktopBridge } from "@t3tools/contracts";
+import {
+  AuthSessionState as AuthSessionStateSchema,
+  EnvironmentAuthInvalidError,
+  type AuthBrowserSessionResult,
+  type AuthCreatePairingCredentialInput,
+  type AuthSessionState,
+  type DesktopBridge,
+} from "@t3tools/contracts";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-function jsonResponse(body: unknown, init?: ResponseInit) {
-  return new Response(JSON.stringify(body), {
-    headers: {
-      "content-type": "application/json",
-    },
-    status: 200,
-    ...init,
-  });
-}
+import { installEnvironmentHttpTest } from "../test/environmentHttpTest";
 
 type TestWindow = {
   location: URL;
@@ -19,6 +21,42 @@ type TestWindow = {
   desktopBridge?: DesktopBridge;
 };
 
+const LOOPBACK_AUTH = {
+  policy: "loopback-browser",
+  bootstrapMethods: ["one-time-token"],
+  sessionMethods: ["browser-session-cookie"],
+  sessionCookieName: "t3_session",
+} as const;
+
+const DESKTOP_AUTH = {
+  policy: "desktop-managed-local",
+  bootstrapMethods: ["desktop-bootstrap"],
+  sessionMethods: ["browser-session-cookie"],
+  sessionCookieName: "t3_session",
+} as const;
+
+const SESSION_EXPIRES_AT = DateTime.makeUnsafe("2026-04-05T00:00:00.000Z");
+const encodeAuthSessionState = Schema.encodeSync(AuthSessionStateSchema);
+
+const unauthenticatedSession = (auth: AuthSessionState["auth"]): AuthSessionState => ({
+  authenticated: false,
+  auth,
+});
+
+const authenticatedSession = (auth: AuthSessionState["auth"]): AuthSessionState => ({
+  authenticated: true,
+  auth,
+  sessionMethod: "browser-session-cookie",
+  expiresAt: SESSION_EXPIRES_AT,
+});
+
+const browserSession = (scopes: AuthBrowserSessionResult["scopes"]): AuthBrowserSessionResult => ({
+  authenticated: true,
+  scopes,
+  sessionMethod: "browser-session-cookie",
+  expiresAt: SESSION_EXPIRES_AT,
+});
+
 function installTestBrowser(url: string) {
   const testWindow: TestWindow = {
     location: new URL(url),
@@ -35,8 +73,36 @@ function installTestBrowser(url: string) {
   return testWindow;
 }
 
-function sessionResponse(body: unknown, init?: ResponseInit) {
-  return jsonResponse(body, init);
+function sequence<A>(...values: ReadonlyArray<A>) {
+  let index = 0;
+  return () => values[Math.min(index++, values.length - 1)]!;
+}
+
+let disposeHttpTest: (() => Promise<void>) | undefined;
+
+async function installAuthApi(input: {
+  readonly session?: () => AuthSessionState;
+  readonly browserSession?: (
+    credential: string,
+  ) => Effect.Effect<AuthBrowserSessionResult, EnvironmentAuthInvalidError>;
+  readonly pairingCredential?: (payload: AuthCreatePairingCredentialInput) => Effect.Effect<{
+    readonly id: string;
+    readonly credential: string;
+    readonly label?: string;
+    readonly expiresAt: DateTime.Utc;
+  }>;
+}) {
+  const testApi = await installEnvironmentHttpTest({
+    ...(input.session ? { session: () => Effect.succeed(input.session!()) } : {}),
+    ...(input.browserSession
+      ? { browserSession: (payload) => input.browserSession!(payload.credential) }
+      : {}),
+    ...(input.pairingCredential
+      ? { pairingCredential: (payload) => input.pairingCredential!(payload) }
+      : {}),
+  });
+  disposeHttpTest = testApi.dispose;
+  return testApi;
 }
 
 describe("resolveInitialServerAuthGateState", () => {
@@ -47,6 +113,8 @@ describe("resolveInitialServerAuthGateState", () => {
   });
 
   afterEach(async () => {
+    await disposeHttpTest?.();
+    disposeHttpTest = undefined;
     const { __resetServerAuthBootstrapForTests } = await import("./environments/primary");
     __resetServerAuthBootstrapForTests();
     vi.unstubAllEnvs();
@@ -55,40 +123,14 @@ describe("resolveInitialServerAuthGateState", () => {
   });
 
   it("reuses an in-flight silent bootstrap attempt", async () => {
-    const fetchMock = vi
-      .fn<typeof fetch>()
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: false,
-          auth: {
-            policy: "desktop-managed-local",
-            bootstrapMethods: ["desktop-bootstrap"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonResponse({
-          authenticated: true,
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      )
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: true,
-          auth: {
-            policy: "loopback-browser",
-            bootstrapMethods: ["one-time-token"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      );
-    vi.stubGlobal("fetch", fetchMock);
+    const nextSession = sequence(
+      unauthenticatedSession(DESKTOP_AUTH),
+      authenticatedSession(DESKTOP_AUTH),
+    );
+    const testApi = await installAuthApi({
+      session: nextSession,
+      browserSession: () => Effect.succeed(browserSession(["orchestration:read", "access:write"])),
+    });
 
     const testWindow = installTestBrowser("http://localhost/");
     testWindow.desktopBridge = {
@@ -104,90 +146,45 @@ describe("resolveInitialServerAuthGateState", () => {
 
     await Promise.all([resolveInitialServerAuthGateState(), resolveInitialServerAuthGateState()]);
 
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-    expect(fetchMock.mock.calls[0]?.[0]).toBe("http://localhost:3773/api/auth/session");
-    expect(fetchMock.mock.calls[1]?.[0]).toBe("http://localhost:3773/api/auth/bootstrap");
-    expect(fetchMock.mock.calls[2]?.[0]).toBe("http://localhost:3773/api/auth/session");
+    expect(testApi.calls.session).toBe(2);
+    expect(testApi.calls.browserSession).toEqual([{ credential: "desktop-bootstrap-token" }]);
   });
 
-  it("uses https fetch urls when the primary environment uses wss", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(
-      sessionResponse({
-        authenticated: false,
-        auth: {
-          policy: "loopback-browser",
-          bootstrapMethods: ["one-time-token"],
-          sessionMethods: ["browser-session-cookie"],
-          sessionCookieName: "t3_session",
-        },
-      }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
+  it("uses https urls when the primary environment uses wss", async () => {
+    await installAuthApi({ session: () => unauthenticatedSession(LOOPBACK_AUTH) });
     vi.stubEnv("VITE_HTTP_URL", "https://remote.example.com");
     vi.stubEnv("VITE_WS_URL", "wss://remote.example.com");
 
-    const { resolveInitialServerAuthGateState } = await import("./environments/primary");
+    const { resolveInitialServerAuthGateState, resolvePrimaryEnvironmentHttpUrl } =
+      await import("./environments/primary");
 
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "requires-auth",
-      auth: {
-        policy: "loopback-browser",
-        bootstrapMethods: ["one-time-token"],
-        sessionMethods: ["browser-session-cookie"],
-        sessionCookieName: "t3_session",
-      },
-    });
-
-    expect(fetchMock).toHaveBeenCalledWith("https://remote.example.com/api/auth/session", {
-      credentials: "include",
+      auth: LOOPBACK_AUTH,
     });
+    expect(resolvePrimaryEnvironmentHttpUrl("/api/auth/session")).toBe(
+      "https://remote.example.com/api/auth/session",
+    );
   });
 
   it("uses the current origin as an auth proxy base for local dev environments", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(
-      sessionResponse({
-        authenticated: false,
-        auth: {
-          policy: "loopback-browser",
-          bootstrapMethods: ["one-time-token"],
-          sessionMethods: ["browser-session-cookie"],
-          sessionCookieName: "t3_session",
-        },
-      }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
+    await installAuthApi({ session: () => unauthenticatedSession(LOOPBACK_AUTH) });
     installTestBrowser("http://localhost:5735/");
 
-    const { resolveInitialServerAuthGateState } = await import("./environments/primary");
+    const { resolveInitialServerAuthGateState, resolvePrimaryEnvironmentHttpUrl } =
+      await import("./environments/primary");
 
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "requires-auth",
-      auth: {
-        policy: "loopback-browser",
-        bootstrapMethods: ["one-time-token"],
-        sessionMethods: ["browser-session-cookie"],
-        sessionCookieName: "t3_session",
-      },
-    });
-
-    expect(fetchMock).toHaveBeenCalledWith("http://localhost:5735/api/auth/session", {
-      credentials: "include",
+      auth: LOOPBACK_AUTH,
     });
+    expect(resolvePrimaryEnvironmentHttpUrl("/api/auth/session")).toBe(
+      "http://localhost:5735/api/auth/session",
+    );
   });
 
   it("uses the vite proxy for desktop-managed loopback auth requests during local dev", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(
-      sessionResponse({
-        authenticated: false,
-        auth: {
-          policy: "desktop-managed-local",
-          bootstrapMethods: ["desktop-bootstrap"],
-          sessionMethods: ["browser-session-cookie"],
-          sessionCookieName: "t3_session",
-        },
-      }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
+    await installAuthApi({ session: () => unauthenticatedSession(DESKTOP_AUTH) });
     vi.stubEnv("VITE_DEV_SERVER_URL", "http://127.0.0.1:5733");
 
     const testWindow = installTestBrowser("http://127.0.0.1:5733/");
@@ -199,47 +196,25 @@ describe("resolveInitialServerAuthGateState", () => {
       }),
     } as DesktopBridge;
 
-    const { resolveInitialServerAuthGateState } = await import("./environments/primary");
+    const { resolveInitialServerAuthGateState, resolvePrimaryEnvironmentHttpUrl } =
+      await import("./environments/primary");
 
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "requires-auth",
-      auth: {
-        policy: "desktop-managed-local",
-        bootstrapMethods: ["desktop-bootstrap"],
-        sessionMethods: ["browser-session-cookie"],
-        sessionCookieName: "t3_session",
-      },
-    });
-
-    expect(fetchMock).toHaveBeenCalledWith("http://127.0.0.1:5733/api/auth/session", {
-      credentials: "include",
+      auth: DESKTOP_AUTH,
     });
+    expect(resolvePrimaryEnvironmentHttpUrl("/api/auth/session")).toBe(
+      "http://127.0.0.1:5733/api/auth/session",
+    );
   });
 
   it("returns a requires-auth state instead of throwing when no bootstrap credential exists", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(
-      sessionResponse({
-        authenticated: false,
-        auth: {
-          policy: "loopback-browser",
-          bootstrapMethods: ["one-time-token"],
-          sessionMethods: ["browser-session-cookie"],
-          sessionCookieName: "t3_session",
-        },
-      }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
+    await installAuthApi({ session: () => unauthenticatedSession(LOOPBACK_AUTH) });
     const { resolveInitialServerAuthGateState } = await import("./environments/primary");
 
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "requires-auth",
-      auth: {
-        policy: "loopback-browser",
-        bootstrapMethods: ["one-time-token"],
-        sessionMethods: ["browser-session-cookie"],
-        sessionCookieName: "t3_session",
-      },
+      auth: LOOPBACK_AUTH,
     });
   });
 
@@ -251,15 +226,10 @@ describe("resolveInitialServerAuthGateState", () => {
       .mockResolvedValueOnce(new Response("Bad Gateway", { status: 502 }))
       .mockResolvedValueOnce(new Response("Bad Gateway", { status: 502 }))
       .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: false,
-          auth: {
-            policy: "loopback-browser",
-            bootstrapMethods: ["one-time-token"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-        }),
+        new Response(
+          JSON.stringify(encodeAuthSessionState(unauthenticatedSession(LOOPBACK_AUTH))),
+          { status: 200, headers: { "content-type": "application/json" } },
+        ),
       );
     vi.stubGlobal("fetch", fetchMock);
 
@@ -270,12 +240,7 @@ describe("resolveInitialServerAuthGateState", () => {
 
     await expect(gateStatePromise).resolves.toEqual({
       status: "requires-auth",
-      auth: {
-        policy: "loopback-browser",
-        bootstrapMethods: ["one-time-token"],
-        sessionMethods: ["browser-session-cookie"],
-        sessionCookieName: "t3_session",
-      },
+      auth: LOOPBACK_AUTH,
     });
     expect(fetchMock).toHaveBeenCalledTimes(4);
   });
@@ -298,136 +263,60 @@ describe("resolveInitialServerAuthGateState", () => {
   });
 
   it("allows manual token submission after the initial auth check requires pairing", async () => {
-    const fetchMock = vi
-      .fn<typeof fetch>()
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: false,
-          auth: {
-            policy: "loopback-browser",
-            bootstrapMethods: ["one-time-token"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonResponse({
-          authenticated: true,
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      )
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: true,
-          auth: {
-            policy: "loopback-browser",
-            bootstrapMethods: ["one-time-token"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      );
-    vi.stubGlobal("fetch", fetchMock);
-    installTestBrowser("http://localhost/");
-
+    const nextSession = sequence(
+      unauthenticatedSession(LOOPBACK_AUTH),
+      authenticatedSession(LOOPBACK_AUTH),
+    );
+    const testApi = await installAuthApi({
+      session: nextSession,
+      browserSession: () => Effect.succeed(browserSession(["orchestration:read"])),
+    });
     const { resolveInitialServerAuthGateState, submitServerAuthCredential } =
       await import("./environments/primary");
 
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "requires-auth",
-      auth: {
-        policy: "loopback-browser",
-        bootstrapMethods: ["one-time-token"],
-        sessionMethods: ["browser-session-cookie"],
-        sessionCookieName: "t3_session",
-      },
+      auth: LOOPBACK_AUTH,
     });
     await expect(submitServerAuthCredential("retry-token")).resolves.toBeUndefined();
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "authenticated",
     });
-    expect(fetchMock).toHaveBeenCalledTimes(3);
+    expect(testApi.calls.browserSession).toEqual([{ credential: "retry-token" }]);
+    expect(testApi.calls.session).toBe(2);
   });
 
   it("surfaces a friendly error message when an invalid pairing token is submitted", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(
-      jsonResponse(
-        {
-          error: "Invalid bootstrap credential.",
-        },
-        {
-          status: 401,
-        },
-      ),
-    );
-    vi.stubGlobal("fetch", fetchMock);
+    const testApi = await installAuthApi({
+      browserSession: () =>
+        Effect.fail(
+          new EnvironmentAuthInvalidError({
+            code: "auth_invalid",
+            reason: "invalid_credential",
+            traceId: "trace-invalid-credential",
+          }),
+        ),
+    });
 
     const { submitServerAuthCredential } = await import("./environments/primary");
 
     await expect(submitServerAuthCredential("bad-token")).rejects.toThrow(
       "Invalid pairing token. Check the token and try again.",
     );
-    expect(fetchMock).toHaveBeenCalledWith("http://localhost/api/auth/bootstrap", {
-      body: JSON.stringify({ credential: "bad-token" }),
-      credentials: "include",
-      headers: {
-        "content-type": "application/json",
-      },
-      method: "POST",
-    });
+    expect(testApi.calls.browserSession).toEqual([{ credential: "bad-token" }]);
   });
 
   it("waits for the authenticated session to become observable after silent desktop bootstrap", async () => {
     vi.useFakeTimers();
-    const fetchMock = vi
-      .fn<typeof fetch>()
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: false,
-          auth: {
-            policy: "desktop-managed-local",
-            bootstrapMethods: ["desktop-bootstrap"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonResponse({
-          authenticated: true,
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      )
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: false,
-          auth: {
-            policy: "desktop-managed-local",
-            bootstrapMethods: ["desktop-bootstrap"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-        }),
-      )
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: true,
-          auth: {
-            policy: "desktop-managed-local",
-            bootstrapMethods: ["desktop-bootstrap"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      );
-    vi.stubGlobal("fetch", fetchMock);
+    const nextSession = sequence(
+      unauthenticatedSession(DESKTOP_AUTH),
+      unauthenticatedSession(DESKTOP_AUTH),
+      authenticatedSession(DESKTOP_AUTH),
+    );
+    const testApi = await installAuthApi({
+      session: nextSession,
+      browserSession: () => Effect.succeed(browserSession(["orchestration:read", "access:write"])),
+    });
 
     const testWindow = installTestBrowser("http://localhost/");
     testWindow.desktopBridge = {
@@ -444,43 +333,14 @@ describe("resolveInitialServerAuthGateState", () => {
     const gateStatePromise = resolveInitialServerAuthGateState();
     await vi.advanceTimersByTimeAsync(100);
 
-    await expect(gateStatePromise).resolves.toEqual({
-      status: "authenticated",
-    });
-    expect(fetchMock).toHaveBeenCalledTimes(4);
-    expect(fetchMock.mock.calls[2]?.[0]).toBe("http://localhost:3773/api/auth/session");
-    expect(fetchMock.mock.calls[3]?.[0]).toBe("http://localhost:3773/api/auth/session");
+    await expect(gateStatePromise).resolves.toEqual({ status: "authenticated" });
+    expect(testApi.calls.session).toBe(3);
   });
 
   it("memoizes the authenticated gate state after the first successful read", async () => {
-    const fetchMock = vi
-      .fn<typeof fetch>()
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: true,
-          auth: {
-            policy: "loopback-browser",
-            bootstrapMethods: ["one-time-token"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-          sessionMethod: "browser-session-cookie",
-          expiresAt: "2026-04-05T00:00:00.000Z",
-        }),
-      )
-      .mockResolvedValueOnce(
-        sessionResponse({
-          authenticated: false,
-          auth: {
-            policy: "loopback-browser",
-            bootstrapMethods: ["one-time-token"],
-            sessionMethods: ["browser-session-cookie"],
-            sessionCookieName: "t3_session",
-          },
-        }),
-      );
-    vi.stubGlobal("fetch", fetchMock);
-
+    const testApi = await installAuthApi({
+      session: sequence(authenticatedSession(LOOPBACK_AUTH), unauthenticatedSession(LOOPBACK_AUTH)),
+    });
     const { resolveInitialServerAuthGateState } = await import("./environments/primary");
 
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
@@ -489,35 +349,33 @@ describe("resolveInitialServerAuthGateState", () => {
     await expect(resolveInitialServerAuthGateState()).resolves.toEqual({
       status: "authenticated",
     });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(testApi.calls.session).toBe(1);
   });
 
   it("creates a pairing credential from the authenticated auth endpoint", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValueOnce(
-      jsonResponse({
-        id: "pairing-link-1",
-        credential: "pairing-token",
-        label: "Julius iPhone",
-        expiresAt: "2026-04-05T00:00:00.000Z",
-      }),
-    );
-    vi.stubGlobal("fetch", fetchMock);
-
+    const testApi = await installAuthApi({
+      pairingCredential: (payload) =>
+        Effect.succeed({
+          id: "pairing-link-1",
+          credential: "pairing-token",
+          ...(payload.label === undefined ? {} : { label: payload.label }),
+          expiresAt: SESSION_EXPIRES_AT,
+        }),
+    });
     const { createServerPairingCredential } = await import("./environments/primary");
 
-    await expect(createServerPairingCredential("Julius iPhone")).resolves.toEqual({
+    const credential = await createServerPairingCredential({
+      label: "Julius iPhone",
+      scopes: ["orchestration:read"],
+    });
+    expect(credential).toMatchObject({
       id: "pairing-link-1",
       credential: "pairing-token",
       label: "Julius iPhone",
-      expiresAt: "2026-04-05T00:00:00.000Z",
-    });
-    expect(fetchMock).toHaveBeenCalledWith("http://localhost/api/auth/pairing-token", {
-      body: JSON.stringify({ label: "Julius iPhone" }),
-      credentials: "include",
-      headers: {
-        "content-type": "application/json",
-      },
-      method: "POST",
     });
+    expect(DateTime.formatIso(credential.expiresAt)).toBe("2026-04-05T00:00:00.000Z");
+    expect(testApi.calls.pairingCredential).toEqual([
+      { label: "Julius iPhone", scopes: ["orchestration:read"] },
+    ]);
   });
 });
diff --git a/apps/web/src/components/ChatView.browser.tsx b/apps/web/src/components/ChatView.browser.tsx
index d4eb3da3263..e490ff986dc 100644
--- a/apps/web/src/components/ChatView.browser.tsx
+++ b/apps/web/src/components/ChatView.browser.tsx
@@ -194,7 +194,7 @@ function createBaseServerConfig(): ServerConfig {
     auth: {
       policy: "loopback-browser",
       bootstrapMethods: ["one-time-token"],
-      sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+      sessionMethods: ["browser-session-cookie", "bearer-access-token"],
       sessionCookieName: "t3_session",
     },
     cwd: "/repo/project",
diff --git a/apps/web/src/components/KeybindingsToast.browser.tsx b/apps/web/src/components/KeybindingsToast.browser.tsx
index 4320f6ecf4a..63715f201c1 100644
--- a/apps/web/src/components/KeybindingsToast.browser.tsx
+++ b/apps/web/src/components/KeybindingsToast.browser.tsx
@@ -96,7 +96,7 @@ function createBaseServerConfig(): ServerConfig {
     auth: {
       policy: "loopback-browser",
       bootstrapMethods: ["one-time-token"],
-      sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+      sessionMethods: ["browser-session-cookie", "bearer-access-token"],
       sessionCookieName: "t3_session",
     },
     cwd: "/repo/project",
diff --git a/apps/web/src/components/settings/ConnectionsSettings.tsx b/apps/web/src/components/settings/ConnectionsSettings.tsx
index 8549b42b526..b9aa9ce6c59 100644
--- a/apps/web/src/components/settings/ConnectionsSettings.tsx
+++ b/apps/web/src/components/settings/ConnectionsSettings.tsx
@@ -9,7 +9,18 @@ import {
 } from "lucide-react";
 import { type ReactNode, memo, useCallback, useEffect, useMemo, useState } from "react";
 import {
+  AuthAccessReadScope,
+  AuthAccessWriteScope,
+  AuthAdministrativeScopes,
+  AuthOrchestrationOperateScope,
+  AuthOrchestrationReadScope,
+  AuthRelayReadScope,
+  AuthRelayWriteScope,
+  AuthReviewWriteScope,
+  AuthStandardClientScopes,
+  AuthTerminalOperateScope,
   type AuthClientSession,
+  type AuthEnvironmentScope,
   type AuthPairingLink,
   type AdvertisedEndpoint,
   type DesktopDiscoveredSshHost,
@@ -31,6 +42,7 @@ import {
   useRelativeTimeTick,
 } from "./settingsLayout";
 import { Input } from "../ui/input";
+import { Checkbox } from "../ui/checkbox";
 import {
   Dialog,
   DialogClose,
@@ -75,11 +87,11 @@ import { getPairingTokenFromUrl, setPairingTokenOnUrl } from "../../pairingUrl";
 import { readHostedPairingRequest } from "../../hostedPairing";
 import {
   createServerPairingCredential,
-  fetchSessionState,
   revokeOtherServerClientSessions,
   revokeServerClientSession,
   revokeServerPairingLink,
   isLoopbackHostname,
+  usePrimarySessionState,
   type ServerClientSessionRecord,
   type ServerPairingLinkRecord,
 } from "~/environments/primary";
@@ -114,6 +126,97 @@ function formatAccessTimestamp(value: string): string {
   return accessTimestampFormatter.format(parsed);
 }
 
+const PAIRING_SCOPE_OPTIONS: ReadonlyArray<{
+  readonly scope: AuthEnvironmentScope;
+  readonly title: string;
+  readonly description: string;
+}> = [
+  {
+    scope: AuthOrchestrationReadScope,
+    title: "View environment",
+    description: "Read threads, status, diffs, and configuration.",
+  },
+  {
+    scope: AuthOrchestrationOperateScope,
+    title: "Operate tasks",
+    description: "Start tasks and perform changes in the environment.",
+  },
+  {
+    scope: AuthTerminalOperateScope,
+    title: "Use terminals",
+    description: "Create terminals and send input to running shells.",
+  },
+  {
+    scope: AuthReviewWriteScope,
+    title: "Write reviews",
+    description: "Create comments while reviewing changes.",
+  },
+  {
+    scope: AuthAccessReadScope,
+    title: "View access",
+    description: "Inspect pairing links and authorized clients.",
+  },
+  {
+    scope: AuthAccessWriteScope,
+    title: "Manage access",
+    description: "Issue and revoke credentials for other clients.",
+  },
+  {
+    scope: AuthRelayReadScope,
+    title: "View relay",
+    description: "Inspect managed relay connectivity.",
+  },
+  {
+    scope: AuthRelayWriteScope,
+    title: "Manage relay",
+    description: "Change managed tunnel connectivity.",
+  },
+];
+
+function AccessScopeSummary({
+  scopes,
+  label,
+}: {
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+  readonly label: string;
+}) {
+  const scopeCountLabel = `${scopes.length} ${scopes.length === 1 ? "scope" : "scopes"}`;
+
+  return (
+    <Popover>
+      <PopoverTrigger
+        openOnHover
+        delay={250}
+        closeDelay={100}
+        render={
+          <button
+            type="button"
+            aria-label={`${label}: show ${scopeCountLabel}`}
+            className="cursor-help underline decoration-border underline-offset-2 outline-hidden hover:text-foreground focus-visible:text-foreground"
+          />
+        }
+      >
+        {scopeCountLabel}
+      </PopoverTrigger>
+      <PopoverPopup
+        side="top"
+        align="start"
+        tooltipStyle
+        className="w-max max-w-80 whitespace-normal"
+      >
+        <p className="mb-1 font-medium">Granted scopes</p>
+        <div className="flex flex-col gap-0.5">
+          {scopes.map((scope) => (
+            <code key={scope} className="font-mono text-foreground/85">
+              {scope}
+            </code>
+          ))}
+        </div>
+      </PopoverPopup>
+    </Popover>
+  );
+}
+
 type ConnectionStatusDotProps = {
   tooltipText?: string | null;
   dotClassName: string;
@@ -629,8 +732,7 @@ const PairingLinkListRow = memo(function PairingLinkListRow({
 
   const expiresAbsolute = formatAccessTimestamp(pairingLink.expiresAt);
 
-  const roleLabel = pairingLink.role === "owner" ? "Owner" : "Client";
-  const primaryLabel = pairingLink.label ?? `${roleLabel} link`;
+  const primaryLabel = pairingLink.label ?? "Pairing link";
   const defaultEndpointCopyOption =
     endpointCopyOptions.find((option) => option.key === defaultEndpointKey) ??
     endpointCopyOptions[0] ??
@@ -759,7 +861,9 @@ const PairingLinkListRow = memo(function PairingLinkListRow({
             </Popover>
           </div>
           <p className="text-xs text-muted-foreground" title={expiresAbsolute}>
-            {[roleLabel, formatExpiresInLabel(pairingLink.expiresAt, nowMs)].join(" · ")}
+            {formatExpiresInLabel(pairingLink.expiresAt, nowMs)}
+            <span aria-hidden> · </span>
+            <AccessScopeSummary scopes={pairingLink.scopes} label="Pairing link scopes" />
           </p>
           {shareablePairingUrl === null ? (
             <p className="text-[11px] text-muted-foreground/70">
@@ -900,7 +1004,6 @@ const ConnectedClientListRow = memo(function ConnectedClientListRow({
     : lastConnectedAt
       ? `Last connected at ${formatAccessTimestamp(lastConnectedAt)}`
       : "Not connected yet.";
-  const roleLabel = clientSession.role === "owner" ? "Owner" : "Client";
   const deviceInfoBits = [
     clientSession.client.deviceType !== "unknown"
       ? clientSession.client.deviceType[0]?.toUpperCase() + clientSession.client.deviceType.slice(1)
@@ -932,7 +1035,13 @@ const ConnectedClientListRow = memo(function ConnectedClientListRow({
             ) : null}
           </div>
           <p className="text-xs text-muted-foreground">
-            {[roleLabel, ...deviceInfoBits].join(" · ")}
+            {deviceInfoBits.length > 0 ? (
+              <>
+                {deviceInfoBits.join(" · ")}
+                <span aria-hidden> · </span>
+              </>
+            ) : null}
+            <AccessScopeSummary scopes={clientSession.scopes} label="Client scopes" />
           </p>
         </div>
         <div className="flex w-full shrink-0 items-center gap-2 sm:w-auto sm:justify-end">
@@ -965,13 +1074,17 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
 }: AuthorizedClientsHeaderActionProps) {
   const [dialogOpen, setDialogOpen] = useState(false);
   const [pairingLabel, setPairingLabel] = useState("");
+  const [pairingScopes, setPairingScopes] = useState<ReadonlyArray<AuthEnvironmentScope>>([
+    ...AuthStandardClientScopes,
+  ]);
   const [isCreatingPairingLink, setIsCreatingPairingLink] = useState(false);
 
   const handleCreatePairingLink = useCallback(async () => {
     setIsCreatingPairingLink(true);
     try {
-      await createServerPairingCredential(pairingLabel);
+      await createServerPairingCredential({ label: pairingLabel, scopes: pairingScopes });
       setPairingLabel("");
+      setPairingScopes([...AuthStandardClientScopes]);
       setDialogOpen(false);
     } catch (error) {
       const message = error instanceof Error ? error.message : "Failed to create pairing URL.";
@@ -985,7 +1098,13 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
     } finally {
       setIsCreatingPairingLink(false);
     }
-  }, [pairingLabel]);
+  }, [pairingLabel, pairingScopes]);
+
+  const togglePairingScope = useCallback((scope: AuthEnvironmentScope, checked: boolean) => {
+    setPairingScopes((current) =>
+      checked ? [...current, scope] : current.filter((currentScope) => currentScope !== scope),
+    );
+  }, []);
 
   return (
     <div className="flex items-center gap-2">
@@ -1005,6 +1124,7 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
           setDialogOpen(open);
           if (!open) {
             setPairingLabel("");
+            setPairingScopes([...AuthStandardClientScopes]);
           }
         }}
       >
@@ -1016,7 +1136,7 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
             </Button>
           }
         />
-        <DialogPopup className="max-w-sm">
+        <DialogPopup className="max-w-md">
           <DialogHeader>
             <DialogTitle>Create pairing link</DialogTitle>
             <DialogDescription>
@@ -1024,7 +1144,7 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
               authorized client.
             </DialogDescription>
           </DialogHeader>
-          <DialogPanel>
+          <DialogPanel className="space-y-5">
             <label className="block">
               <span className="mb-1.5 block text-xs font-medium text-foreground">
                 Client label (optional)
@@ -1037,6 +1157,62 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
                 autoFocus
               />
             </label>
+            <section className="space-y-3">
+              <div className="flex items-center justify-between gap-3">
+                <div>
+                  <h3 className="text-xs font-medium text-foreground">Permissions</h3>
+                  <p className="text-xs text-muted-foreground">
+                    Limit what the paired client can do.
+                  </p>
+                </div>
+                <div className="flex gap-1">
+                  <Button
+                    size="xs"
+                    variant="outline"
+                    disabled={isCreatingPairingLink}
+                    onClick={() => setPairingScopes([AuthOrchestrationReadScope])}
+                  >
+                    Read only
+                  </Button>
+                  <Button
+                    size="xs"
+                    variant="outline"
+                    disabled={isCreatingPairingLink}
+                    onClick={() => setPairingScopes([...AuthStandardClientScopes])}
+                  >
+                    Standard
+                  </Button>
+                </div>
+              </div>
+              <div className="divide-y divide-border/60 rounded-lg border border-input bg-muted/25">
+                {PAIRING_SCOPE_OPTIONS.map(({ scope, title, description }) => (
+                  <label
+                    key={scope}
+                    className="flex cursor-pointer items-start gap-3 px-3 py-2.5 transition-colors hover:bg-muted/40"
+                  >
+                    <Checkbox
+                      className="mt-0.5"
+                      checked={pairingScopes.includes(scope)}
+                      disabled={isCreatingPairingLink}
+                      onCheckedChange={(checked) => togglePairingScope(scope, checked === true)}
+                    />
+                    <span className="min-w-0">
+                      <span className="block text-xs font-medium text-foreground">{title}</span>
+                      <span className="block text-xs leading-snug text-muted-foreground">
+                        {description}
+                      </span>
+                    </span>
+                  </label>
+                ))}
+              </div>
+              {pairingScopes.length === 0 ? (
+                <p className="text-xs text-destructive">Select at least one permission.</p>
+              ) : pairingScopes.includes(AuthAccessWriteScope) ? (
+                <p className="text-xs text-warning">
+                  This client can create or revoke access for other devices.
+                </p>
+              ) : null}
+            </section>
           </DialogPanel>
           <DialogFooter variant="bare">
             <Button
@@ -1046,7 +1222,10 @@ const AuthorizedClientsHeaderAction = memo(function AuthorizedClientsHeaderActio
             >
               Cancel
             </Button>
-            <Button disabled={isCreatingPairingLink} onClick={() => void handleCreatePairingLink()}>
+            <Button
+              disabled={isCreatingPairingLink || pairingScopes.length === 0}
+              onClick={() => void handleCreatePairingLink()}
+            >
               {isCreatingPairingLink ? "Creating…" : "Create link"}
             </Button>
           </DialogFooter>
@@ -1290,14 +1469,12 @@ function SavedBackendListRow({
         : connectionState === "error"
           ? "bg-destructive"
           : "bg-muted-foreground/40";
-  const roleLabel = runtime?.role ? (runtime.role === "owner" ? "Owner" : "Client") : null;
   const descriptorLabel = runtime?.descriptor?.label ?? null;
   const displayLabel = descriptorLabel ?? record.label;
   const statusTooltip = getSavedBackendStatusTooltip(runtime, record, nowMs);
   const versionMismatch = resolveServerConfigVersionMismatch(runtime?.serverConfig);
   const metadataBits = [
     record.desktopSsh ? `SSH ${formatDesktopSshTarget(record.desktopSsh)}` : null,
-    roleLabel,
     record.lastConnectedAt
       ? `Last connected ${formatAccessTimestamp(record.lastConnectedAt)}`
       : null,
@@ -1317,8 +1494,14 @@ function SavedBackendListRow({
             />
             <h3 className="text-sm font-medium text-foreground">{displayLabel}</h3>
           </div>
-          {metadataBits.length > 0 ? (
-            <p className="text-xs text-muted-foreground">{metadataBits.join(" · ")}</p>
+          {metadataBits.length > 0 || runtime?.scopes ? (
+            <p className="text-xs text-muted-foreground">
+              {metadataBits.length > 0 ? metadataBits.join(" · ") : null}
+              {metadataBits.length > 0 && runtime?.scopes ? <span aria-hidden> · </span> : null}
+              {runtime?.scopes ? (
+                <AccessScopeSummary scopes={runtime.scopes} label="Granted scopes" />
+              ) : null}
+            </p>
           ) : null}
           {versionMismatch ? (
             <p className="flex items-center gap-1 text-warning text-xs">
@@ -1401,12 +1584,13 @@ const DesktopSshHostRow = memo(function DesktopSshHostRow({
 
 export function ConnectionsSettings() {
   const desktopBridge = window.desktopBridge;
-  const [currentSessionRole, setCurrentSessionRole] = useState<"owner" | "client" | null>(
-    desktopBridge ? "owner" : null,
-  );
-  const [currentAuthPolicy, setCurrentAuthPolicy] = useState<
-    "desktop-managed-local" | "loopback-browser" | "remote-reachable" | "unsafe-no-auth" | null
-  >(desktopBridge ? null : null);
+  const primarySessionState = usePrimarySessionState();
+  const currentSessionScopes = desktopBridge
+    ? AuthAdministrativeScopes
+    : primarySessionState.data?.authenticated
+      ? (primarySessionState.data.scopes ?? null)
+      : null;
+  const currentAuthPolicy = desktopBridge ? null : (primarySessionState.data?.auth.policy ?? null);
   const savedEnvironmentsById = useSavedEnvironmentRegistryStore((state) => state.byId);
   const savedEnvironmentIds = useMemo(
     () =>
@@ -1516,7 +1700,7 @@ export function ConnectionsSettings() {
   const setDefaultAdvertisedEndpointKey = useUiStateStore(
     (state) => state.setDefaultAdvertisedEndpointKey,
   );
-  const canManageLocalBackend = currentSessionRole === "owner";
+  const canManageLocalBackend = currentSessionScopes?.includes(AuthAccessWriteScope) ?? false;
   const isLocalBackendNetworkAccessible = desktopBridge
     ? desktopServerExposureState?.mode === "network-accessible"
     : currentAuthPolicy === "remote-reachable";
@@ -1929,30 +2113,6 @@ export function ConnectionsSettings() {
     savedBackendMode,
   ]);
 
-  useEffect(() => {
-    if (desktopBridge) {
-      setCurrentSessionRole("owner");
-      return;
-    }
-
-    let cancelled = false;
-    void fetchSessionState()
-      .then((session) => {
-        if (cancelled) return;
-        setCurrentSessionRole(session.authenticated ? (session.role ?? null) : null);
-        setCurrentAuthPolicy(session.auth.policy);
-      })
-      .catch(() => {
-        if (cancelled) return;
-        setCurrentSessionRole(null);
-        setCurrentAuthPolicy(null);
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, [desktopBridge]);
-
   useEffect(() => {
     if (!canManageLocalBackend) return;
 
@@ -2065,10 +2225,7 @@ export function ConnectionsSettings() {
     setDesktopAdvertisedEndpoints([]);
     setDesktopServerExposureError(null);
   }, [canManageLocalBackend]);
-  const visibleDesktopPairingLinks = useMemo(
-    () => desktopPairingLinks.filter((pairingLink) => pairingLink.role === "client"),
-    [desktopPairingLinks],
-  );
+  const visibleDesktopPairingLinks = desktopPairingLinks;
   const tailscaleHttpsEndpoint = useMemo(
     () => desktopAdvertisedEndpoints.find(isTailscaleHttpsEndpoint) ?? null,
     [desktopAdvertisedEndpoints],
@@ -2650,8 +2807,8 @@ export function ConnectionsSettings() {
       ) : (
         <SettingsSection title="Local backend access">
           <SettingsRow
-            title="Owner tools"
-            description="Pairing links and client-session management are only available to owner sessions for this backend."
+            title="Administrative access"
+            description="Pairing links and client-session management require the access:write scope for this backend."
           />
         </SettingsSection>
       )}
diff --git a/apps/web/src/components/settings/SettingsPanels.browser.tsx b/apps/web/src/components/settings/SettingsPanels.browser.tsx
index 34f24006edc..9427a91f98e 100644
--- a/apps/web/src/components/settings/SettingsPanels.browser.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.browser.tsx
@@ -3,6 +3,7 @@ import "../../index.css";
 import {
   type AuthAccessStreamEvent,
   type AuthAccessSnapshot,
+  type AuthEnvironmentScope,
   AuthSessionId,
   DEFAULT_SERVER_SETTINGS,
   EnvironmentId,
@@ -217,7 +218,7 @@ function createBaseServerConfig(): ServerConfig {
     auth: {
       policy: "loopback-browser",
       bootstrapMethods: ["one-time-token"],
-      sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+      sessionMethods: ["browser-session-cookie", "bearer-access-token"],
       sessionCookieName: "t3_session",
     },
     cwd: "/repo/project",
@@ -286,7 +287,7 @@ function createEmptyProcessResourceHistoryResult(): ServerProcessResourceHistory
 function makePairingLink(input: {
   readonly id: string;
   readonly credential: string;
-  readonly role: "owner" | "client";
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
   readonly subject: string;
   readonly label?: string;
   readonly createdAt: string;
@@ -302,7 +303,7 @@ function makePairingLink(input: {
 function makeClientSession(input: {
   readonly sessionId: string;
   readonly subject: string;
-  readonly role: "owner" | "client";
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
   readonly method: "browser-session-cookie";
   readonly client?: {
     readonly label?: string;
@@ -394,26 +395,26 @@ const createDesktopBridgeStub = (overrides?: {
       },
     }),
     bootstrapSshBearerSession: vi.fn().mockResolvedValue({
-      authenticated: true,
-      role: "owner",
-      sessionMethod: "bearer-session-token",
-      expiresAt: "2026-05-01T12:00:00.000Z",
-      sessionToken: "ssh-bearer-token",
+      access_token: "ssh-bearer-token",
+      issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+      token_type: "Bearer",
+      expires_in: 3_600,
+      scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
     }),
     fetchSshSessionState: vi.fn().mockResolvedValue({
       authenticated: true,
       auth: {
         policy: "remote-reachable",
         bootstrapMethods: ["one-time-token"],
-        sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+        sessionMethods: ["browser-session-cookie", "bearer-access-token"],
         sessionCookieName: "t3_session",
       },
-      role: "owner",
-      sessionMethod: "bearer-session-token",
+      scopes: ["orchestration:read", "access:write"],
+      sessionMethod: "bearer-access-token",
       expiresAt: "2026-05-01T12:00:00.000Z",
     }),
-    issueSshWebSocketToken: vi.fn().mockResolvedValue({
-      token: "ssh-ws-token",
+    issueSshWebSocketTicket: vi.fn().mockResolvedValue({
+      ticket: "ssh-ws-ticket",
       expiresAt: "2026-05-01T12:05:00.000Z",
     }),
     onSshPasswordPrompt: vi.fn(() => () => {}),
@@ -508,7 +509,7 @@ describe("GeneralSettingsPanel observability", () => {
         makeClientSession({
           sessionId: "session-owner",
           subject: "browser-owner",
-          role: "owner",
+          scopes: ["orchestration:read", "access:write"],
           method: "browser-session-cookie",
           client: {
             label: "Chrome on Mac",
@@ -531,7 +532,7 @@ describe("GeneralSettingsPanel observability", () => {
           JSON.stringify({
             authenticated: true,
             auth: createBaseServerConfig().auth,
-            role: "owner",
+            scopes: ["orchestration:read", "access:write"],
             sessionMethod: "browser-session-cookie",
             expiresAt: "2036-05-07T00:00:00.000Z",
           }),
@@ -776,7 +777,7 @@ describe("GeneralSettingsPanel observability", () => {
       makeClientSession({
         sessionId: "session-owner",
         subject: "desktop-bootstrap",
-        role: "owner",
+        scopes: ["orchestration:read", "access:write"],
         method: "browser-session-cookie",
         client: {
           label: "This Mac",
@@ -805,7 +806,7 @@ describe("GeneralSettingsPanel observability", () => {
             makePairingLink({
               id: "pairing-link-1",
               credential: "pairing-token",
-              role: "client",
+              scopes: ["orchestration:read"],
               subject: "one-time-token",
               label: "Julius iPhone",
               createdAt: "2036-04-07T00:00:00.000Z",
@@ -817,7 +818,7 @@ describe("GeneralSettingsPanel observability", () => {
             makeClientSession({
               sessionId: "session-client",
               subject: "one-time-token",
-              role: "client",
+              scopes: ["orchestration:read"],
               method: "browser-session-cookie",
               client: {
                 label: "Julius iPhone",
@@ -867,12 +868,22 @@ describe("GeneralSettingsPanel observability", () => {
     await expect.element(page.getByText("This Mac")).toBeInTheDocument();
     await page.getByRole("button", { name: "Create link", exact: true }).click();
     await expect.element(page.getByText("Create pairing link")).toBeInTheDocument();
+    await expect.element(page.getByRole("checkbox", { name: /View environment/ })).toBeChecked();
+    await expect.element(page.getByRole("checkbox", { name: /Operate tasks/ })).toBeChecked();
+    await page.getByRole("button", { name: "Read only", exact: true }).click();
+    await expect.element(page.getByRole("checkbox", { name: /View environment/ })).toBeChecked();
+    await expect.element(page.getByRole("checkbox", { name: /Operate tasks/ })).not.toBeChecked();
     await page.getByRole("button", { name: "Create link", exact: true }).click();
     authAccessHarness.emitPairingLinkUpserted(pairingLinks[0]!);
     authAccessHarness.emitClientUpserted(clientSessions[1]!);
     await expect
-      .element(page.getByText("Client · Mobile · iOS · Safari · 192.168.1.88"))
+      .element(page.getByRole("button", { name: "Pairing link scopes: show 1 scope" }))
+      .toBeInTheDocument();
+    await expect
+      .element(page.getByText("Mobile · iOS · Safari · 192.168.1.88"))
       .toBeInTheDocument();
+    await page.getByRole("button", { name: "Client scopes: show 1 scope" }).click();
+    await expect.element(page.getByText("orchestration:read", { exact: true })).toBeInTheDocument();
     await expect
       .element(page.getByRole("button", { name: /^Copy pairing URL for:/ }))
       .toBeInTheDocument();
@@ -893,7 +904,7 @@ describe("GeneralSettingsPanel observability", () => {
       makeClientSession({
         sessionId: "session-owner",
         subject: "desktop-bootstrap",
-        role: "owner",
+        scopes: ["orchestration:read", "access:write"],
         method: "browser-session-cookie",
         client: {
           label: "This Mac",
@@ -909,7 +920,7 @@ describe("GeneralSettingsPanel observability", () => {
       makeClientSession({
         sessionId: "session-client",
         subject: "one-time-token",
-        role: "client",
+        scopes: ["orchestration:read"],
         method: "browser-session-cookie",
         client: {
           label: "Julius iPhone",
diff --git a/apps/web/src/environments/primary/auth.ts b/apps/web/src/environments/primary/auth.ts
index 9a7e39a0207..40bd277fc0e 100644
--- a/apps/web/src/environments/primary/auth.ts
+++ b/apps/web/src/environments/primary/auth.ts
@@ -1,21 +1,25 @@
 import type {
-  AuthBootstrapInput,
-  AuthBootstrapResult,
+  AuthBrowserSessionResult,
   AuthClientMetadata,
-  AuthCreatePairingCredentialInput,
+  AuthEnvironmentScope,
   AuthPairingCredentialResult,
-  AuthRevokeClientSessionInput,
-  AuthRevokePairingLinkInput,
   AuthSessionId,
   AuthSessionState,
 } from "@t3tools/contracts";
+import { EnvironmentHttpCommonError } from "@t3tools/contracts";
+import type { EnvironmentHttpCommonError as EnvironmentHttpCommonErrorType } from "@t3tools/contracts";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { HttpClientError } from "effect/unstable/http";
 
 import {
   getPairingTokenFromUrl,
   stripPairingTokenFromUrl as stripPairingTokenUrl,
 } from "../../pairingUrl";
 
-import { resolvePrimaryEnvironmentHttpUrl } from "./target";
+import { PrimaryEnvironmentHttpClient } from "./httpClient";
+import { runPrimaryHttp } from "../../lib/runtime";
 import * as Data from "effect/Data";
 import * as Predicate from "effect/Predicate";
 
@@ -25,11 +29,12 @@ export class BootstrapHttpError extends Data.TaggedError("BootstrapHttpError")<{
 }> {}
 const isBootstrapHttpError = (u: unknown): u is BootstrapHttpError =>
   Predicate.isTagged(u, "BootstrapHttpError");
+const isEnvironmentHttpCommonError = Schema.is(EnvironmentHttpCommonError);
 
 export interface ServerPairingLinkRecord {
   readonly id: string;
   readonly credential: string;
-  readonly role: "owner" | "client";
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
   readonly subject: string;
   readonly label?: string;
   readonly createdAt: string;
@@ -39,8 +44,8 @@ export interface ServerPairingLinkRecord {
 export interface ServerClientSessionRecord {
   readonly sessionId: AuthSessionId;
   readonly subject: string;
-  readonly role: "owner" | "client";
-  readonly method: "browser-session-cookie" | "bearer-session-token";
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope>;
+  readonly method: "browser-session-cookie" | "bearer-access-token";
   readonly client: AuthClientMetadata;
   readonly issuedAt: string;
   readonly expiresAt: string;
@@ -93,79 +98,97 @@ function getDesktopBootstrapCredential(): string | null {
 
 export async function fetchSessionState(): Promise<AuthSessionState> {
   return retryTransientBootstrap(async () => {
-    const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/session"), {
-      credentials: "include",
-    });
-    if (!response.ok) {
+    try {
+      return await runPrimaryHttp(
+        PrimaryEnvironmentHttpClient.pipe(
+          Effect.flatMap((client) => client.auth.session({ headers: {} })),
+        ),
+      );
+    } catch (error) {
+      const status = readHttpApiStatus(error);
       throw new BootstrapHttpError({
-        message: `Failed to load server auth session state (${response.status}).`,
-        status: response.status,
+        message: `Failed to load server auth session state (${status ?? "unknown"}).`,
+        status: status ?? 500,
       });
     }
-    return (await response.json()) as AuthSessionState;
   });
 }
 
-async function readErrorMessage(response: Response, fallbackMessage: string): Promise<string> {
-  const text = await response.text();
-  return text || fallbackMessage;
+function readHttpApiStatus(error: unknown): number | null {
+  if (isEnvironmentHttpCommonError(error)) {
+    return readEnvironmentHttpErrorStatus(error);
+  }
+  return HttpClientError.isHttpClientError(error) && error.response !== undefined
+    ? error.response.status
+    : null;
 }
 
-const INVALID_BOOTSTRAP_CREDENTIAL_MESSAGES = new Set([
-  "Invalid bootstrap credential.",
-  "Unknown bootstrap credential.",
-]);
-
-function parseBootstrapErrorMessage(message: string): string {
-  const trimmed = message.trim();
-  if (trimmed.length === 0) {
-    return "";
+function readEnvironmentHttpErrorStatus(error: EnvironmentHttpCommonErrorType): number {
+  switch (error._tag) {
+    case "EnvironmentRequestInvalidError":
+      return 400;
+    case "EnvironmentAuthInvalidError":
+      return 401;
+    case "EnvironmentScopeRequiredError":
+    case "EnvironmentOperationForbiddenError":
+      return 403;
+    case "EnvironmentInternalError":
+      return 500;
   }
+}
 
-  try {
-    const parsed = JSON.parse(trimmed) as {
-      error?: unknown;
-    };
-    if (typeof parsed.error === "string" && parsed.error.trim().length > 0) {
-      return parsed.error.trim();
-    }
-  } catch {
-    // Not JSON; fall back to plain text.
+function readHttpApiErrorMessage(error: unknown, fallbackMessage: string): string {
+  if (!isEnvironmentHttpCommonError(error)) {
+    return fallbackMessage;
+  }
+  switch (error._tag) {
+    case "EnvironmentAuthInvalidError":
+      return error.reason === "missing_credential"
+        ? "Authentication required."
+        : "Invalid bootstrap credential.";
+    case "EnvironmentRequestInvalidError":
+      return error.reason === "invalid_scope"
+        ? "Requested token scope is invalid."
+        : "Requested scope exceeds the bootstrap credential grant.";
+    case "EnvironmentScopeRequiredError":
+      return `The authenticated token is missing required scope: ${error.requiredScope}.`;
+    case "EnvironmentOperationForbiddenError":
+      return "This operation is not allowed for the current session.";
+    case "EnvironmentInternalError":
+      return fallbackMessage;
   }
-
-  return trimmed;
 }
 
+const INVALID_BOOTSTRAP_CREDENTIAL_MESSAGES = new Set([
+  "Invalid bootstrap credential.",
+  "Unknown bootstrap credential.",
+]);
+
 function toFriendlyBootstrapErrorMessage(status: number, message: string): string {
-  const parsedMessage = parseBootstrapErrorMessage(message);
-  if (status === 401 && INVALID_BOOTSTRAP_CREDENTIAL_MESSAGES.has(parsedMessage)) {
+  const trimmedMessage = message.trim();
+  if (status === 401 && INVALID_BOOTSTRAP_CREDENTIAL_MESSAGES.has(trimmedMessage)) {
     return "Invalid pairing token. Check the token and try again.";
   }
 
-  return parsedMessage;
+  return trimmedMessage;
 }
 
-async function exchangeBootstrapCredential(credential: string): Promise<AuthBootstrapResult> {
+async function exchangeBootstrapCredential(credential: string): Promise<AuthBrowserSessionResult> {
   return retryTransientBootstrap(async () => {
-    const payload: AuthBootstrapInput = { credential };
-    const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/bootstrap"), {
-      body: JSON.stringify(payload),
-      credentials: "include",
-      headers: {
-        "content-type": "application/json",
-      },
-      method: "POST",
-    });
-
-    if (!response.ok) {
-      const message = toFriendlyBootstrapErrorMessage(response.status, await response.text());
+    try {
+      return await runPrimaryHttp(
+        PrimaryEnvironmentHttpClient.pipe(
+          Effect.flatMap((client) => client.auth.browserSession({ payload: { credential } })),
+        ),
+      );
+    } catch (error) {
+      const status = readHttpApiStatus(error) ?? 500;
+      const message = toFriendlyBootstrapErrorMessage(status, readHttpApiErrorMessage(error, ""));
       throw new BootstrapHttpError({
-        message: message || `Failed to bootstrap auth session (${response.status}).`,
-        status: response.status,
+        message: message || `Failed to bootstrap auth session (${status}).`,
+        status,
       });
     }
-
-    return (await response.json()) as AuthBootstrapResult;
   });
 }
 
@@ -266,57 +289,93 @@ export async function submitServerAuthCredential(credential: string): Promise<vo
   stripPairingTokenFromUrl();
 }
 
-export async function createServerPairingCredential(
-  label?: string,
-): Promise<AuthPairingCredentialResult> {
-  const trimmedLabel = label?.trim();
-  const payload: AuthCreatePairingCredentialInput = trimmedLabel ? { label: trimmedLabel } : {};
-  const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/pairing-token"), {
-    body: JSON.stringify(payload),
-    credentials: "include",
-    headers: {
-      "content-type": "application/json",
-    },
-    method: "POST",
-  });
-
-  if (!response.ok) {
+export async function createServerPairingCredential(input?: {
+  readonly label?: string;
+  readonly scopes?: ReadonlyArray<AuthEnvironmentScope>;
+}): Promise<AuthPairingCredentialResult> {
+  const trimmedLabel = input?.label?.trim();
+  try {
+    return await runPrimaryHttp(
+      PrimaryEnvironmentHttpClient.pipe(
+        Effect.flatMap((client) =>
+          client.auth.pairingCredential({
+            headers: {},
+            payload: {
+              ...(trimmedLabel ? { label: trimmedLabel } : {}),
+              ...(input?.scopes ? { scopes: input.scopes } : {}),
+            },
+          }),
+        ),
+      ),
+    );
+  } catch (error) {
     throw new Error(
-      await readErrorMessage(response, `Failed to create pairing credential (${response.status}).`),
+      readHttpApiErrorMessage(
+        error,
+        `Failed to create pairing credential (${readHttpApiStatus(error) ?? "unknown"}).`,
+      ),
+      { cause: error },
     );
   }
-
-  return (await response.json()) as AuthPairingCredentialResult;
 }
 
 export async function listServerPairingLinks(): Promise<ReadonlyArray<ServerPairingLinkRecord>> {
-  const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/pairing-links"), {
-    credentials: "include",
-  });
-
-  if (!response.ok) {
+  try {
+    const pairingLinks = await runPrimaryHttp(
+      PrimaryEnvironmentHttpClient.pipe(
+        Effect.flatMap((client) => client.auth.pairingLinks({ headers: {} })),
+      ),
+    );
+    return pairingLinks.map((pairingLink) => {
+      const timestamps = {
+        createdAt: DateTime.formatIso(pairingLink.createdAt),
+        expiresAt: DateTime.formatIso(pairingLink.expiresAt),
+      };
+      if (pairingLink.label === undefined) {
+        return {
+          id: pairingLink.id,
+          credential: pairingLink.credential,
+          scopes: pairingLink.scopes,
+          subject: pairingLink.subject,
+          createdAt: timestamps.createdAt,
+          expiresAt: timestamps.expiresAt,
+        };
+      }
+      return {
+        id: pairingLink.id,
+        credential: pairingLink.credential,
+        scopes: pairingLink.scopes,
+        subject: pairingLink.subject,
+        label: pairingLink.label,
+        createdAt: timestamps.createdAt,
+        expiresAt: timestamps.expiresAt,
+      };
+    });
+  } catch (error) {
     throw new Error(
-      await readErrorMessage(response, `Failed to load pairing links (${response.status}).`),
+      readHttpApiErrorMessage(
+        error,
+        `Failed to load pairing links (${readHttpApiStatus(error) ?? "unknown"}).`,
+      ),
+      { cause: error },
     );
   }
-
-  return (await response.json()) as ReadonlyArray<ServerPairingLinkRecord>;
 }
 
 export async function revokeServerPairingLink(id: string): Promise<void> {
-  const payload: AuthRevokePairingLinkInput = { id };
-  const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/pairing-links/revoke"), {
-    body: JSON.stringify(payload),
-    credentials: "include",
-    headers: {
-      "content-type": "application/json",
-    },
-    method: "POST",
-  });
-
-  if (!response.ok) {
+  try {
+    await runPrimaryHttp(
+      PrimaryEnvironmentHttpClient.pipe(
+        Effect.flatMap((client) => client.auth.revokePairingLink({ headers: {}, payload: { id } })),
+      ),
+    );
+  } catch (error) {
     throw new Error(
-      await readErrorMessage(response, `Failed to revoke pairing link (${response.status}).`),
+      readHttpApiErrorMessage(
+        error,
+        `Failed to revoke pairing link (${readHttpApiStatus(error) ?? "unknown"}).`,
+      ),
+      { cause: error },
     );
   }
 }
@@ -324,57 +383,75 @@ export async function revokeServerPairingLink(id: string): Promise<void> {
 export async function listServerClientSessions(): Promise<
   ReadonlyArray<ServerClientSessionRecord>
 > {
-  const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/clients"), {
-    credentials: "include",
-  });
-
-  if (!response.ok) {
+  try {
+    const clientSessions = await runPrimaryHttp(
+      PrimaryEnvironmentHttpClient.pipe(
+        Effect.flatMap((client) => client.auth.clients({ headers: {} })),
+      ),
+    );
+    return clientSessions.map((clientSession) => ({
+      sessionId: clientSession.sessionId,
+      subject: clientSession.subject,
+      scopes: clientSession.scopes,
+      method: clientSession.method,
+      client: clientSession.client,
+      issuedAt: DateTime.formatIso(clientSession.issuedAt),
+      expiresAt: DateTime.formatIso(clientSession.expiresAt),
+      lastConnectedAt:
+        clientSession.lastConnectedAt === null
+          ? null
+          : DateTime.formatIso(clientSession.lastConnectedAt),
+      connected: clientSession.connected,
+      current: clientSession.current,
+    }));
+  } catch (error) {
     throw new Error(
-      await readErrorMessage(response, `Failed to load paired clients (${response.status}).`),
+      readHttpApiErrorMessage(
+        error,
+        `Failed to load paired clients (${readHttpApiStatus(error) ?? "unknown"}).`,
+      ),
+      { cause: error },
     );
   }
-
-  return (await response.json()) as ReadonlyArray<ServerClientSessionRecord>;
 }
 
 export async function revokeServerClientSession(sessionId: AuthSessionId): Promise<void> {
-  const payload: AuthRevokeClientSessionInput = { sessionId };
-  const response = await fetch(resolvePrimaryEnvironmentHttpUrl("/api/auth/clients/revoke"), {
-    body: JSON.stringify(payload),
-    credentials: "include",
-    headers: {
-      "content-type": "application/json",
-    },
-    method: "POST",
-  });
-
-  if (!response.ok) {
+  try {
+    await runPrimaryHttp(
+      PrimaryEnvironmentHttpClient.pipe(
+        Effect.flatMap((client) =>
+          client.auth.revokeClient({ headers: {}, payload: { sessionId } }),
+        ),
+      ),
+    );
+  } catch (error) {
     throw new Error(
-      await readErrorMessage(response, `Failed to revoke client session (${response.status}).`),
+      readHttpApiErrorMessage(
+        error,
+        `Failed to revoke client session (${readHttpApiStatus(error) ?? "unknown"}).`,
+      ),
+      { cause: error },
     );
   }
 }
 
 export async function revokeOtherServerClientSessions(): Promise<number> {
-  const response = await fetch(
-    resolvePrimaryEnvironmentHttpUrl("/api/auth/clients/revoke-others"),
-    {
-      credentials: "include",
-      method: "POST",
-    },
-  );
-
-  if (!response.ok) {
+  try {
+    const result = await runPrimaryHttp(
+      PrimaryEnvironmentHttpClient.pipe(
+        Effect.flatMap((client) => client.auth.revokeOtherClients({ headers: {} })),
+      ),
+    );
+    return result.revokedCount;
+  } catch (error) {
     throw new Error(
-      await readErrorMessage(
-        response,
-        `Failed to revoke other client sessions (${response.status}).`,
+      readHttpApiErrorMessage(
+        error,
+        `Failed to revoke other client sessions (${readHttpApiStatus(error) ?? "unknown"}).`,
       ),
+      { cause: error },
     );
   }
-
-  const result = (await response.json()) as { revokedCount?: number };
-  return result.revokedCount ?? 0;
 }
 
 export async function resolveInitialServerAuthGateState(): Promise<ServerAuthGateState> {
diff --git a/apps/web/src/environments/primary/bootstrap.test.ts b/apps/web/src/environments/primary/bootstrap.test.ts
index 6081e425e9d..d92c2587696 100644
--- a/apps/web/src/environments/primary/bootstrap.test.ts
+++ b/apps/web/src/environments/primary/bootstrap.test.ts
@@ -1,25 +1,18 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { EnvironmentId } from "@t3tools/contracts";
+import { EnvironmentId, type ExecutionEnvironmentDescriptor } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
 
 import {
   getPrimaryKnownEnvironment,
+  resolvePrimaryEnvironmentHttpUrl,
   resolveInitialPrimaryEnvironmentDescriptor,
   resetPrimaryEnvironmentDescriptorForTests,
   writePrimaryEnvironmentDescriptor,
 } from ".";
-
-function jsonResponse(body: unknown, init?: ResponseInit) {
-  return new Response(JSON.stringify(body), {
-    headers: {
-      "content-type": "application/json",
-    },
-    status: 200,
-    ...init,
-  });
-}
+import { installEnvironmentHttpTest } from "../../../test/environmentHttpTest";
 
 const BASE_ENVIRONMENT = {
-  environmentId: "environment-local",
+  environmentId: EnvironmentId.make("environment-local"),
   label: "Local environment",
   platform: {
     os: "darwin",
@@ -29,7 +22,17 @@ const BASE_ENVIRONMENT = {
   capabilities: {
     repositoryIdentity: true,
   },
-};
+} satisfies ExecutionEnvironmentDescriptor;
+
+let disposeHttpTest: (() => Promise<void>) | undefined;
+
+async function installDescriptorApi() {
+  const testApi = await installEnvironmentHttpTest({
+    descriptor: () => Effect.succeed(BASE_ENVIRONMENT),
+  });
+  disposeHttpTest = testApi.dispose;
+  return testApi;
+}
 
 function installTestBrowser(url: string) {
   vi.stubGlobal("window", {
@@ -47,7 +50,9 @@ describe("environmentBootstrap", () => {
     installTestBrowser("http://localhost/");
   });
 
-  afterEach(() => {
+  afterEach(async () => {
+    await disposeHttpTest?.();
+    disposeHttpTest = undefined;
     resetPrimaryEnvironmentDescriptorForTests();
     vi.unstubAllEnvs();
     vi.useRealTimers();
@@ -88,35 +93,35 @@ describe("environmentBootstrap", () => {
   });
 
   it("reuses an in-flight descriptor bootstrap request", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(jsonResponse(BASE_ENVIRONMENT));
-    vi.stubGlobal("fetch", fetchMock);
+    const testApi = await installDescriptorApi();
 
     await Promise.all([
       resolveInitialPrimaryEnvironmentDescriptor(),
       resolveInitialPrimaryEnvironmentDescriptor(),
     ]);
 
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(fetchMock).toHaveBeenCalledWith("http://localhost/.well-known/t3/environment");
+    expect(testApi.calls.descriptor).toBe(1);
   });
 
   it("uses https descriptor urls when the primary environment uses wss", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(jsonResponse(BASE_ENVIRONMENT));
-    vi.stubGlobal("fetch", fetchMock);
     vi.stubEnv("VITE_HTTP_URL", "https://remote.example.com");
     vi.stubEnv("VITE_WS_URL", "wss://remote.example.com");
+    await installDescriptorApi();
 
     await expect(resolveInitialPrimaryEnvironmentDescriptor()).resolves.toEqual(BASE_ENVIRONMENT);
-    expect(fetchMock).toHaveBeenCalledWith("https://remote.example.com/.well-known/t3/environment");
+    expect(resolvePrimaryEnvironmentHttpUrl("/.well-known/t3/environment")).toBe(
+      "https://remote.example.com/.well-known/t3/environment",
+    );
   });
 
   it("derives the websocket url when only VITE_HTTP_URL is configured", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(jsonResponse(BASE_ENVIRONMENT));
-    vi.stubGlobal("fetch", fetchMock);
     vi.stubEnv("VITE_HTTP_URL", "https://remote.example.com");
+    await installDescriptorApi();
 
     await expect(resolveInitialPrimaryEnvironmentDescriptor()).resolves.toEqual(BASE_ENVIRONMENT);
-    expect(fetchMock).toHaveBeenCalledWith("https://remote.example.com/.well-known/t3/environment");
+    expect(resolvePrimaryEnvironmentHttpUrl("/.well-known/t3/environment")).toBe(
+      "https://remote.example.com/.well-known/t3/environment",
+    );
     expect(getPrimaryKnownEnvironment()?.target).toEqual({
       httpBaseUrl: "https://remote.example.com/",
       wsBaseUrl: "wss://remote.example.com/",
@@ -124,12 +129,13 @@ describe("environmentBootstrap", () => {
   });
 
   it("derives the http url when only VITE_WS_URL is configured", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(jsonResponse(BASE_ENVIRONMENT));
-    vi.stubGlobal("fetch", fetchMock);
     vi.stubEnv("VITE_WS_URL", "wss://remote.example.com");
+    await installDescriptorApi();
 
     await expect(resolveInitialPrimaryEnvironmentDescriptor()).resolves.toEqual(BASE_ENVIRONMENT);
-    expect(fetchMock).toHaveBeenCalledWith("https://remote.example.com/.well-known/t3/environment");
+    expect(resolvePrimaryEnvironmentHttpUrl("/.well-known/t3/environment")).toBe(
+      "https://remote.example.com/.well-known/t3/environment",
+    );
     expect(getPrimaryKnownEnvironment()?.target).toEqual({
       httpBaseUrl: "https://remote.example.com/",
       wsBaseUrl: "wss://remote.example.com/",
@@ -137,17 +143,16 @@ describe("environmentBootstrap", () => {
   });
 
   it("uses the current origin as the descriptor base for local dev environments", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(jsonResponse(BASE_ENVIRONMENT));
-    vi.stubGlobal("fetch", fetchMock);
     installTestBrowser("http://localhost:5735/");
+    await installDescriptorApi();
 
     await expect(resolveInitialPrimaryEnvironmentDescriptor()).resolves.toEqual(BASE_ENVIRONMENT);
-    expect(fetchMock).toHaveBeenCalledWith("http://localhost:5735/.well-known/t3/environment");
+    expect(resolvePrimaryEnvironmentHttpUrl("/.well-known/t3/environment")).toBe(
+      "http://localhost:5735/.well-known/t3/environment",
+    );
   });
 
   it("uses the vite proxy for desktop-managed loopback descriptor requests during local dev", async () => {
-    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(jsonResponse(BASE_ENVIRONMENT));
-    vi.stubGlobal("fetch", fetchMock);
     vi.stubEnv("VITE_DEV_SERVER_URL", "http://127.0.0.1:5733");
     vi.stubGlobal("window", {
       location: new URL("http://127.0.0.1:5733/"),
@@ -163,8 +168,11 @@ describe("environmentBootstrap", () => {
         }),
       },
     });
+    await installDescriptorApi();
 
     await expect(resolveInitialPrimaryEnvironmentDescriptor()).resolves.toEqual(BASE_ENVIRONMENT);
-    expect(fetchMock).toHaveBeenCalledWith("http://127.0.0.1:5733/.well-known/t3/environment");
+    expect(resolvePrimaryEnvironmentHttpUrl("/.well-known/t3/environment")).toBe(
+      "http://127.0.0.1:5733/.well-known/t3/environment",
+    );
   });
 });
diff --git a/apps/web/src/environments/primary/context.ts b/apps/web/src/environments/primary/context.ts
index dea1683c4d0..db4406ecee0 100644
--- a/apps/web/src/environments/primary/context.ts
+++ b/apps/web/src/environments/primary/context.ts
@@ -4,13 +4,15 @@ import {
   type KnownEnvironment,
 } from "@t3tools/client-runtime";
 import type { EnvironmentId, ExecutionEnvironmentDescriptor } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
+import { HttpClientError } from "effect/unstable/http";
 import { create } from "zustand";
 
 import { BootstrapHttpError, retryTransientBootstrap } from "./auth";
+import { PrimaryEnvironmentHttpClient } from "./httpClient";
 
-import { readPrimaryEnvironmentTarget, resolvePrimaryEnvironmentHttpUrl } from "./target";
-
-const SERVER_ENVIRONMENT_DESCRIPTOR_PATH = "/.well-known/t3/environment";
+import { runPrimaryHttp } from "../../lib/runtime";
+import { readPrimaryEnvironmentTarget } from "./target";
 
 interface PrimaryEnvironmentBootstrapState {
   readonly descriptor: ExecutionEnvironmentDescriptor | null;
@@ -48,17 +50,22 @@ function createPrimaryKnownEnvironment(input: {
 
 async function fetchPrimaryEnvironmentDescriptor(): Promise<ExecutionEnvironmentDescriptor> {
   return retryTransientBootstrap(async () => {
-    const response = await fetch(
-      resolvePrimaryEnvironmentHttpUrl(SERVER_ENVIRONMENT_DESCRIPTOR_PATH),
-    );
-    if (!response.ok) {
+    let descriptor: ExecutionEnvironmentDescriptor;
+    try {
+      descriptor = await runPrimaryHttp(
+        PrimaryEnvironmentHttpClient.pipe(Effect.flatMap((client) => client.metadata.descriptor())),
+      );
+    } catch (error) {
+      const status =
+        HttpClientError.isHttpClientError(error) && error.response !== undefined
+          ? error.response.status
+          : 500;
       throw new BootstrapHttpError({
-        message: `Failed to load server environment descriptor (${response.status}).`,
-        status: response.status,
+        message: `Failed to load server environment descriptor (${status}).`,
+        status,
       });
     }
 
-    const descriptor = (await response.json()) as ExecutionEnvironmentDescriptor;
     writePrimaryEnvironmentDescriptor(descriptor);
     return descriptor;
   });
diff --git a/apps/web/src/environments/primary/httpClient.ts b/apps/web/src/environments/primary/httpClient.ts
new file mode 100644
index 00000000000..d9404b4b8d3
--- /dev/null
+++ b/apps/web/src/environments/primary/httpClient.ts
@@ -0,0 +1,20 @@
+import { makeEnvironmentHttpApiClient } from "@t3tools/client-runtime";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { resolvePrimaryEnvironmentHttpUrl } from "./target";
+
+export type PrimaryEnvironmentHttpClientShape = Effect.Success<
+  ReturnType<typeof makeEnvironmentHttpApiClient>
+>;
+
+export class PrimaryEnvironmentHttpClient extends Context.Service<
+  PrimaryEnvironmentHttpClient,
+  PrimaryEnvironmentHttpClientShape
+>()("@t3tools/web/environments/primary/httpClient/PrimaryEnvironmentHttpClient") {}
+
+export const primaryEnvironmentHttpClientLive = Layer.effect(
+  PrimaryEnvironmentHttpClient,
+  Effect.suspend(() => makeEnvironmentHttpApiClient(resolvePrimaryEnvironmentHttpUrl("/"))),
+);
diff --git a/apps/web/src/environments/primary/index.ts b/apps/web/src/environments/primary/index.ts
index 2614164b6ad..6856b9ac5fa 100644
--- a/apps/web/src/environments/primary/index.ts
+++ b/apps/web/src/environments/primary/index.ts
@@ -32,4 +32,6 @@ export {
   __resetServerAuthBootstrapForTests,
 } from "./auth";
 
+export { refreshPrimarySessionState, usePrimarySessionState } from "./sessionState";
+
 export { resolvePrimaryEnvironmentHttpUrl, isLoopbackHostname } from "./target";
diff --git a/apps/web/src/environments/primary/sessionState.ts b/apps/web/src/environments/primary/sessionState.ts
new file mode 100644
index 00000000000..9312646cc32
--- /dev/null
+++ b/apps/web/src/environments/primary/sessionState.ts
@@ -0,0 +1,37 @@
+import { useAtomValue } from "@effect/atom-react";
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { AsyncResult, Atom } from "effect/unstable/reactivity";
+import { useCallback } from "react";
+
+import { appAtomRegistry } from "../../rpc/atomRegistry";
+import { fetchSessionState } from "./auth";
+
+const primarySessionStateAtom = Atom.make(Effect.promise(fetchSessionState)).pipe(
+  Atom.swr({ staleTime: 5_000, revalidateOnMount: true }),
+  Atom.setIdleTTL(5 * 60_000),
+  Atom.withLabel("primary-environment:session"),
+);
+
+export function refreshPrimarySessionState(): void {
+  appAtomRegistry.refresh(primarySessionStateAtom);
+}
+
+export function usePrimarySessionState() {
+  const result = useAtomValue(primarySessionStateAtom);
+  const refresh = useCallback(() => {
+    refreshPrimarySessionState();
+  }, []);
+  let error: string | null = null;
+  if (result._tag === "Failure") {
+    const cause = Cause.squash(result.cause);
+    error = cause instanceof Error ? cause.message : "Could not read environment session.";
+  }
+  return {
+    data: Option.getOrNull(AsyncResult.value(result)),
+    error,
+    isPending: result.waiting,
+    refresh,
+  };
+}
diff --git a/apps/web/src/environments/runtime/catalog.ts b/apps/web/src/environments/runtime/catalog.ts
index 7ece1ccb0ca..5d1c9560518 100644
--- a/apps/web/src/environments/runtime/catalog.ts
+++ b/apps/web/src/environments/runtime/catalog.ts
@@ -1,6 +1,6 @@
 import { getKnownEnvironmentHttpBaseUrl } from "@t3tools/client-runtime";
 import type {
-  AuthSessionRole,
+  AuthEnvironmentScope,
   EnvironmentId,
   ExecutionEnvironmentDescriptor,
   PersistedSavedEnvironmentRecord,
@@ -272,7 +272,7 @@ export interface SavedEnvironmentRuntimeState {
   readonly authState: SavedEnvironmentAuthState;
   readonly lastError: string | null;
   readonly lastErrorAt: string | null;
-  readonly role: AuthSessionRole | null;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope> | null;
   readonly descriptor: ExecutionEnvironmentDescriptor | null;
   readonly serverConfig: ServerConfig | null;
   readonly connectedAt: string | null;
@@ -295,7 +295,7 @@ const DEFAULT_SAVED_ENVIRONMENT_RUNTIME_STATE: SavedEnvironmentRuntimeState = Ob
   authState: "unknown",
   lastError: null,
   lastErrorAt: null,
-  role: null,
+  scopes: null,
   descriptor: null,
   serverConfig: null,
   connectedAt: null,
diff --git a/apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts b/apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts
index 7e847780e04..df4d504fdbf 100644
--- a/apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts
+++ b/apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts
@@ -1,13 +1,15 @@
-import { EnvironmentId } from "@t3tools/contracts";
+import { EnvironmentAuthInvalidError, EnvironmentId } from "@t3tools/contracts";
+import * as Schema from "effect/Schema";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+const decodeEnvironmentAuthInvalidError = Schema.decodeUnknownSync(EnvironmentAuthInvalidError);
+
 let mockSavedRecords: Array<Record<string, unknown>> = [];
 
 const mockResolveRemotePairingTarget = vi.fn();
 const mockFetchRemoteEnvironmentDescriptor = vi.fn();
 const mockBootstrapRemoteBearerSession = vi.fn();
 const mockFetchRemoteSessionState = vi.fn();
-const mockIsRemoteEnvironmentAuthHttpError = vi.fn((_: unknown) => false);
 const mockResolveRemoteWebSocketConnectionUrl = vi.fn();
 const mockRemoteHttpRunPromise = vi.fn((effect: Promise<unknown>) => effect);
 const mockBootstrapSshBearerSession = vi.fn();
@@ -128,7 +130,6 @@ vi.mock("@t3tools/client-runtime", async (importOriginal) => {
     })),
     fetchRemoteEnvironmentDescriptor: mockFetchRemoteEnvironmentDescriptor,
     fetchRemoteSessionState: mockFetchRemoteSessionState,
-    isRemoteEnvironmentAuthHttpError: mockIsRemoteEnvironmentAuthHttpError,
     resolveRemoteWebSocketConnectionUrl: mockResolveRemoteWebSocketConnectionUrl,
   };
 });
@@ -153,7 +154,7 @@ describe("addSavedEnvironment", () => {
         fetchSshEnvironmentDescriptor: mockFetchSshEnvironmentDescriptor,
         bootstrapSshBearerSession: mockBootstrapSshBearerSession,
         fetchSshSessionState: mockFetchSshSessionState,
-        issueSshWebSocketToken: vi.fn(),
+        issueSshWebSocketTicket: vi.fn(),
       },
     });
     mockResolveRemotePairingTarget.mockImplementation(
@@ -176,24 +177,23 @@ describe("addSavedEnvironment", () => {
       label: "Remote environment",
     });
     mockBootstrapRemoteBearerSession.mockResolvedValue({
-      sessionToken: "bearer-token",
-      role: "owner",
+      access_token: "bearer-token",
+      scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
     });
     mockFetchRemoteSessionState.mockResolvedValue({
       authenticated: true,
-      role: "owner",
+      scopes: ["orchestration:read", "access:write"],
     });
-    mockIsRemoteEnvironmentAuthHttpError.mockReturnValue(false);
     mockResolveRemoteWebSocketConnectionUrl.mockResolvedValue(
-      "wss://remote.example.com/?wsToken=remote-token",
+      "wss://remote.example.com/?wsTicket=remote-token",
     );
     mockFetchSshEnvironmentDescriptor.mockResolvedValue({
       environmentId: EnvironmentId.make("environment-1"),
       label: "Remote environment",
     });
     mockBootstrapSshBearerSession.mockResolvedValue({
-      sessionToken: "ssh-bearer-token",
-      role: "owner",
+      access_token: "ssh-bearer-token",
+      scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
     });
     mockPersistSavedEnvironmentRecord.mockResolvedValue(undefined);
     mockWriteSavedEnvironmentBearerToken.mockResolvedValue(false);
@@ -202,7 +202,7 @@ describe("addSavedEnvironment", () => {
     mockRemoveSavedEnvironmentBearerToken.mockResolvedValue(undefined);
     mockFetchSshSessionState.mockResolvedValue({
       authenticated: true,
-      role: "owner",
+      scopes: ["orchestration:read", "access:write"],
     });
     mockCreateEnvironmentConnection.mockImplementation(
       (input: { knownEnvironment: { environmentId: EnvironmentId }; client: unknown }) => ({
@@ -381,18 +381,18 @@ describe("addSavedEnvironment", () => {
     mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true);
     mockBootstrapSshBearerSession
       .mockResolvedValueOnce({
-        sessionToken: "ssh-bearer-token",
-        role: "owner",
+        access_token: "ssh-bearer-token",
+        scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
       })
       .mockResolvedValueOnce({
-        sessionToken: "ssh-bearer-token-2",
-        role: "owner",
+        access_token: "ssh-bearer-token-2",
+        scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
       });
     mockFetchSshSessionState
       .mockRejectedValueOnce(new Error("[ssh_http:401] Unauthorized"))
       .mockResolvedValueOnce({
         authenticated: true,
-        role: "owner",
+        scopes: ["orchestration:read", "access:write"],
       });
 
     const { connectDesktopSshEnvironment, resetEnvironmentServiceForTests } =
@@ -418,14 +418,13 @@ describe("addSavedEnvironment", () => {
 
   it("does not attempt desktop ssh bearer recovery for non-ssh saved environments", async () => {
     mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true);
-    const authError = {
-      status: 401,
-      message: "Unauthorized",
-    };
+    const authError = decodeEnvironmentAuthInvalidError({
+      _tag: "EnvironmentAuthInvalidError",
+      code: "auth_invalid",
+      reason: "invalid_credential",
+      traceId: "trace-auth-test",
+    });
     mockFetchRemoteSessionState.mockRejectedValueOnce(authError);
-    mockIsRemoteEnvironmentAuthHttpError.mockImplementation(
-      (error: unknown) => error === authError,
-    );
 
     const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service");
 
@@ -450,18 +449,18 @@ describe("addSavedEnvironment", () => {
     mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true);
     mockBootstrapSshBearerSession
       .mockResolvedValueOnce({
-        sessionToken: "ssh-bearer-token",
-        role: "owner",
+        access_token: "ssh-bearer-token",
+        scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
       })
       .mockResolvedValueOnce({
-        sessionToken: "ssh-bearer-token-2",
-        role: "owner",
+        access_token: "ssh-bearer-token-2",
+        scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
       });
     mockFetchSshSessionState
       .mockRejectedValueOnce(new Error("[ssh_http:401] Unauthorized"))
       .mockResolvedValueOnce({
         authenticated: true,
-        role: "owner",
+        scopes: ["orchestration:read", "access:write"],
       });
 
     const createdConnections: Array<{
@@ -745,7 +744,7 @@ describe("addSavedEnvironment", () => {
     );
     let resolveSessionState!: (value: {
       readonly authenticated: true;
-      readonly role: "owner";
+      readonly scopes: ReadonlyArray<"orchestration:read" | "access:write">;
     }) => void;
     mockFetchRemoteSessionState.mockReturnValue(
       new Promise((resolve) => {
@@ -768,7 +767,7 @@ describe("addSavedEnvironment", () => {
     await disconnectSavedEnvironment(EnvironmentId.make("environment-1"));
     resolveSessionState({
       authenticated: true,
-      role: "owner",
+      scopes: ["orchestration:read", "access:write"],
     });
     await expect(reconnectPromise).resolves.toBeUndefined();
 
diff --git a/apps/web/src/environments/runtime/service.savedEnvironments.test.ts b/apps/web/src/environments/runtime/service.savedEnvironments.test.ts
index d47a6109af0..103001e91b9 100644
--- a/apps/web/src/environments/runtime/service.savedEnvironments.test.ts
+++ b/apps/web/src/environments/runtime/service.savedEnvironments.test.ts
@@ -222,7 +222,7 @@ describe("saved environment startup", () => {
 
     mockFetchRemoteSessionState.mockResolvedValue({
       authenticated: true,
-      role: "owner",
+      scopes: ["orchestration:read", "access:write"],
     });
     mockGetSavedEnvironmentRecord.mockImplementation((environmentId: EnvironmentId) =>
       environmentId === savedRecord.environmentId ? savedRecord : null,
diff --git a/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts b/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts
index 0ce5f51d93c..00333445879 100644
--- a/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts
+++ b/apps/web/src/environments/runtime/service.threadSubscriptions.test.ts
@@ -153,7 +153,6 @@ vi.mock("@t3tools/client-runtime", async (importOriginal) => {
     ...actual,
     createWsRpcClient: vi.fn(() => stubWsClient),
     fetchRemoteSessionState: mockFetchRemoteSessionState,
-    isRemoteEnvironmentAuthHttpError: vi.fn(() => false),
     resolveRemoteWebSocketConnectionUrl: mockResolveRemoteWebSocketConnectionUrl,
   };
 });
@@ -304,7 +303,7 @@ describe("retainThreadDetailSubscription", () => {
     mockReadSavedEnvironmentBearerToken.mockResolvedValue(null);
     mockFetchRemoteSessionState.mockResolvedValue({
       authenticated: true,
-      role: "client",
+      scopes: ["orchestration:read"],
     });
     mockConnectionReconnects.length = 0;
   });
diff --git a/apps/web/src/environments/runtime/service.ts b/apps/web/src/environments/runtime/service.ts
index fff04830434..406a855d3c2 100644
--- a/apps/web/src/environments/runtime/service.ts
+++ b/apps/web/src/environments/runtime/service.ts
@@ -1,5 +1,6 @@
 import {
-  type AuthSessionRole,
+  AuthEnvironmentScope,
+  AuthStandardClientScopes,
   type DesktopSshEnvironmentBootstrap,
   type DesktopSshEnvironmentTarget,
   type EnvironmentId,
@@ -7,6 +8,7 @@ import {
   type OrchestrationShellSnapshot,
   type OrchestrationShellStreamEvent,
   type ServerConfig,
+  EnvironmentAuthInvalidError,
   ThreadId,
 } from "@t3tools/contracts";
 import {
@@ -15,12 +17,12 @@ import {
   bootstrapRemoteBearerSession,
   fetchRemoteEnvironmentDescriptor,
   fetchRemoteSessionState,
-  isRemoteEnvironmentAuthHttpError,
   resolveRemoteWebSocketConnectionUrl,
 } from "@t3tools/client-runtime";
 
 import { type QueryClient } from "@tanstack/react-query";
 import { Throttler } from "@tanstack/react-pacer";
+import * as Schema from "effect/Schema";
 import {
   createKnownEnvironment,
   getKnownEnvironmentWsBaseUrl,
@@ -76,6 +78,8 @@ import {
   deriveLogicalProjectKeyFromSettings,
   derivePhysicalProjectKey,
 } from "../../logicalProject";
+
+const decodeIssuedBearerScopes = Schema.decodeUnknownSync(Schema.Array(AuthEnvironmentScope));
 import { getClientSettings } from "~/hooks/useSettings";
 import { subscribeTerminalMetadata, terminalSessionManager } from "../../terminalSessionState";
 import { resetWsReconnectBackoff } from "~/rpc/wsConnectionState";
@@ -99,6 +103,7 @@ type ThreadDetailSubscriptionEntry = {
 };
 
 const environmentConnections = new Map<EnvironmentId, EnvironmentConnection>();
+const isEnvironmentAuthInvalidError = Schema.is(EnvironmentAuthInvalidError);
 
 function isSavedEnvironmentConnectionCancelledError(
   error: unknown,
@@ -738,6 +743,10 @@ async function bootstrapDesktopSshBearerSession(httpBaseUrl: string, credential:
   return await getDesktopSshBridge().bootstrapSshBearerSession(httpBaseUrl, credential);
 }
 
+function readIssuedBearerScopes(scope: string): ReadonlyArray<AuthEnvironmentScope> {
+  return decodeIssuedBearerScopes(scope.split(" "));
+}
+
 async function fetchDesktopSshSessionState(httpBaseUrl: string, bearerToken: string) {
   return await getDesktopSshBridge().fetchSshSessionState(httpBaseUrl, bearerToken);
 }
@@ -747,9 +756,9 @@ async function resolveDesktopSshWebSocketConnectionUrl(
   httpBaseUrl: string,
   bearerToken: string,
 ) {
-  const issued = await getDesktopSshBridge().issueSshWebSocketToken(httpBaseUrl, bearerToken);
+  const issued = await getDesktopSshBridge().issueSshWebSocketTicket(httpBaseUrl, bearerToken);
   const url = new URL(wsBaseUrl, window.location.origin);
-  url.searchParams.set("wsToken", issued.token);
+  url.searchParams.set("wsTicket", issued.ticket);
   return url.toString();
 }
 
@@ -799,7 +808,7 @@ async function prepareSavedEnvironmentRecordForConnection(
 async function issueDesktopSshBearerSession(record: SavedEnvironmentRecord): Promise<{
   readonly record: SavedEnvironmentRecord;
   readonly bearerToken: string;
-  readonly role: AuthSessionRole | null;
+  readonly scopes: ReadonlyArray<AuthEnvironmentScope> | null;
 }> {
   const registrySnapshot = snapshotSavedEnvironmentRegistry([record.environmentId]);
   const prepared = await prepareSavedEnvironmentRecordForConnection(record, {
@@ -827,7 +836,7 @@ async function issueDesktopSshBearerSession(record: SavedEnvironmentRecord): Pro
   });
   const didPersistBearerToken = await writeSavedEnvironmentBearerToken(
     prepared.record.environmentId,
-    bearerSession.sessionToken,
+    bearerSession.access_token,
   );
   if (!didPersistBearerToken) {
     await persistSavedEnvironmentRegistryRollback(registrySnapshot);
@@ -836,8 +845,8 @@ async function issueDesktopSshBearerSession(record: SavedEnvironmentRecord): Pro
 
   return {
     record: prepared.record,
-    bearerToken: bearerSession.sessionToken,
-    role: bearerSession.role ?? null,
+    bearerToken: bearerSession.access_token,
+    scopes: readIssuedBearerScopes(bearerSession.scope),
   };
 }
 
@@ -1214,7 +1223,7 @@ async function refreshSavedEnvironmentMetadata(
   environmentId: EnvironmentId,
   bearerToken: string,
   client: WsRpcClient,
-  roleHint?: AuthSessionRole | null,
+  scopeHint?: ReadonlyArray<AuthEnvironmentScope> | null,
   configHint?: ServerConfig | null,
 ): Promise<void> {
   const record = getSavedEnvironmentRecord(environmentId);
@@ -1238,7 +1247,7 @@ async function refreshSavedEnvironmentMetadata(
     authState: sessionState.authenticated ? "authenticated" : "requires-auth",
     descriptor: serverConfig.environment,
     serverConfig,
-    role: sessionState.authenticated ? (sessionState.role ?? roleHint ?? null) : null,
+    scopes: sessionState.authenticated ? (sessionState.scopes ?? scopeHint ?? null) : null,
   });
   useSavedEnvironmentRegistryStore
     .getState()
@@ -1311,7 +1320,7 @@ async function ensureSavedEnvironmentConnection(
   options?: {
     readonly client?: WsRpcClient;
     readonly bearerToken?: string;
-    readonly role?: AuthSessionRole | null;
+    readonly scopes?: ReadonlyArray<AuthEnvironmentScope> | null;
     readonly serverConfig?: ServerConfig | null;
   },
 ): Promise<EnvironmentConnection> {
@@ -1330,7 +1339,7 @@ async function ensureSavedEnvironmentConnection(
     isCurrent: attempt.isCurrent,
     promise: Promise.resolve().then(async () => {
       let activeRecord = record;
-      let roleHint = options?.role ?? null;
+      let scopeHint = options?.scopes ?? null;
       let bearerToken =
         options?.bearerToken ?? (await readSavedEnvironmentBearerToken(record.environmentId));
       if (!bearerToken) {
@@ -1338,11 +1347,11 @@ async function ensureSavedEnvironmentConnection(
           const issued = await issueDesktopSshBearerSession(record);
           activeRecord = issued.record;
           bearerToken = issued.bearerToken;
-          roleHint = issued.role;
+          scopeHint = [...AuthStandardClientScopes];
         } else {
           useSavedEnvironmentRuntimeStore.getState().patch(record.environmentId, {
             authState: "requires-auth",
-            role: null,
+            scopes: null,
             connectionState: "disconnected",
             lastError: "Saved environment is missing its saved credential. Pair it again.",
             lastErrorAt: isoNow(),
@@ -1409,13 +1418,13 @@ async function ensureSavedEnvironmentConnection(
             activeRecord.environmentId,
             activeBearerToken,
             client,
-            roleHint,
+            scopeHint,
             initialServerConfig,
           );
         } catch (error) {
           const isAuthError = activeRecord.desktopSsh
             ? isSshHttpAuthError(error, 401)
-            : isRemoteEnvironmentAuthHttpError(error) && error.status === 401;
+            : isEnvironmentAuthInvalidError(error);
           if (!isAuthError) {
             throw error;
           }
@@ -1429,12 +1438,12 @@ async function ensureSavedEnvironmentConnection(
           const issued = await issueDesktopSshBearerSession(activeRecord);
           activeRecord = issued.record;
           bearerToken = issued.bearerToken;
-          roleHint = issued.role;
+          scopeHint = [...AuthStandardClientScopes];
           await connection.dispose().catch(() => undefined);
           pendingSavedEnvironmentConnections.delete(activeRecord.environmentId);
           return await ensureSavedEnvironmentConnection(activeRecord, {
             bearerToken,
-            role: roleHint,
+            scopes: scopeHint,
             serverConfig: options?.serverConfig ?? null,
           });
         }
@@ -1638,7 +1647,7 @@ export async function reconnectSavedEnvironment(environmentId: EnvironmentId): P
         await removeConnection(environmentId).catch(() => false);
         await ensureSavedEnvironmentConnection(issued.record, {
           bearerToken: issued.bearerToken,
-          role: issued.role,
+          scopes: [...AuthStandardClientScopes],
         });
         return;
       } catch (recoveryError) {
@@ -1714,7 +1723,7 @@ export async function addSavedEnvironment(input: {
   await persistSavedEnvironmentRecord(record);
   const didPersistBearerToken = await writeSavedEnvironmentBearerToken(
     environmentId,
-    bearerSession.sessionToken,
+    bearerSession.access_token,
   );
   if (!didPersistBearerToken) {
     await persistSavedEnvironmentRegistryRollback(registrySnapshot);
@@ -1726,8 +1735,8 @@ export async function addSavedEnvironment(input: {
   }
   await removeConnection(environmentId).catch(() => false);
   await ensureSavedEnvironmentConnection(record, {
-    bearerToken: bearerSession.sessionToken,
-    role: bearerSession.role,
+    bearerToken: bearerSession.access_token,
+    scopes: readIssuedBearerScopes(bearerSession.scope),
   });
   return record;
 }
diff --git a/apps/web/src/lib/runtime.ts b/apps/web/src/lib/runtime.ts
index 3d5c426076c..8c1f0f0a5b5 100644
--- a/apps/web/src/lib/runtime.ts
+++ b/apps/web/src/lib/runtime.ts
@@ -1,5 +1,39 @@
 import * as ManagedRuntime from "effect/ManagedRuntime";
+import type * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { FetchHttpClient } from "effect/unstable/http";
 
 import { remoteHttpClientLayer } from "@t3tools/client-runtime";
+import {
+  PrimaryEnvironmentHttpClient,
+  primaryEnvironmentHttpClientLive,
+} from "../environments/primary/httpClient";
 
 export const remoteHttpRuntime = ManagedRuntime.make(remoteHttpClientLayer(globalThis.fetch));
+
+const primaryHttpRuntime = ManagedRuntime.make(
+  primaryEnvironmentHttpClientLive.pipe(
+    Layer.provide(
+      Layer.mergeAll(
+        remoteHttpClientLayer((input, init) => globalThis.fetch(input, init)),
+        Layer.succeed(FetchHttpClient.RequestInit, { credentials: "include" }),
+      ),
+    ),
+  ),
+);
+
+export type PrimaryHttpEffectRunner = <A, E>(
+  effect: Effect.Effect<A, E, PrimaryEnvironmentHttpClient>,
+) => Promise<A>;
+
+const livePrimaryHttpRunner: PrimaryHttpEffectRunner = (effect) =>
+  primaryHttpRuntime.runPromise(effect);
+
+let primaryHttpRunner = livePrimaryHttpRunner;
+
+export const runPrimaryHttp = <A, E>(effect: Effect.Effect<A, E, PrimaryEnvironmentHttpClient>) =>
+  primaryHttpRunner(effect);
+
+export function __setPrimaryHttpRunnerForTests(runner?: PrimaryHttpEffectRunner): void {
+  primaryHttpRunner = runner ?? livePrimaryHttpRunner;
+}
diff --git a/apps/web/src/localApi.test.ts b/apps/web/src/localApi.test.ts
index bc912231d7f..22e61204da2 100644
--- a/apps/web/src/localApi.test.ts
+++ b/apps/web/src/localApi.test.ts
@@ -202,8 +202,8 @@ function makeDesktopBridge(overrides: Partial<DesktopBridge> = {}): DesktopBridg
     fetchSshSessionState: async () => {
       throw new Error("fetchSshSessionState not implemented in test");
     },
-    issueSshWebSocketToken: async () => {
-      throw new Error("issueSshWebSocketToken not implemented in test");
+    issueSshWebSocketTicket: async () => {
+      throw new Error("issueSshWebSocketTicket not implemented in test");
     },
     onSshPasswordPrompt: () => () => undefined,
     resolveSshPasswordPrompt: async () => undefined,
@@ -289,7 +289,7 @@ const baseServerConfig: ServerConfig = {
   auth: {
     policy: "loopback-browser",
     bootstrapMethods: ["one-time-token"],
-    sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+    sessionMethods: ["browser-session-cookie", "bearer-access-token"],
     sessionCookieName: "t3_session",
   },
   cwd: "/tmp/workspace",
diff --git a/apps/web/src/rpc/serverState.test.ts b/apps/web/src/rpc/serverState.test.ts
index 506ef84eeaa..c6abda7782a 100644
--- a/apps/web/src/rpc/serverState.test.ts
+++ b/apps/web/src/rpc/serverState.test.ts
@@ -76,7 +76,7 @@ const baseServerConfig: ServerConfig = {
   auth: {
     policy: "loopback-browser",
     bootstrapMethods: ["one-time-token"],
-    sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+    sessionMethods: ["browser-session-cookie", "bearer-access-token"],
     sessionCookieName: "t3_session",
   },
   cwd: "/tmp/workspace",
diff --git a/apps/web/test/authHttpHandlers.ts b/apps/web/test/authHttpHandlers.ts
index 6ff158fc696..a888f7fa5da 100644
--- a/apps/web/test/authHttpHandlers.ts
+++ b/apps/web/test/authHttpHandlers.ts
@@ -1,11 +1,27 @@
 import {
+  AuthSessionId,
+  EnvironmentAuthenticatedAuth,
+  EnvironmentAuthenticatedPrincipal,
+  EnvironmentAuthHttpApi,
   EnvironmentId,
+  EnvironmentMetadataHttpApi,
+  type AuthEnvironmentScope,
   type ExecutionEnvironmentDescriptor,
   type ServerAuthDescriptor,
 } from "@t3tools/contracts";
-import { HttpResponse, http } from "msw";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { HttpRouter, HttpServer } from "effect/unstable/http";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { http } from "msw";
 
-const TEST_SESSION_EXPIRES_AT = "2026-05-01T12:00:00.000Z";
+const BrowserEnvironmentHttpApi = HttpApi.make("browserEnvironment")
+  .add(EnvironmentMetadataHttpApi)
+  .add(EnvironmentAuthHttpApi);
+
+const TEST_SESSION_EXPIRES_AT = DateTime.makeUnsafe("2026-05-01T12:00:00.000Z");
 const TEST_ENVIRONMENT_DESCRIPTOR: ExecutionEnvironmentDescriptor = {
   environmentId: EnvironmentId.make("environment-local"),
   label: "Local environment",
@@ -19,23 +35,69 @@ const TEST_ENVIRONMENT_DESCRIPTOR: ExecutionEnvironmentDescriptor = {
   },
 };
 
+const unexpectedEndpoint = (endpoint: string) =>
+  Effect.die(new Error(`Unexpected browser environment HTTP endpoint: ${endpoint}`));
+
 export function createAuthenticatedSessionHandlers(getAuthDescriptor: () => ServerAuthDescriptor) {
-  return [
-    http.get("*/.well-known/t3/environment", () => HttpResponse.json(TEST_ENVIRONMENT_DESCRIPTOR)),
-    http.get("*/api/auth/session", () =>
-      HttpResponse.json({
-        authenticated: true,
-        auth: getAuthDescriptor(),
-        sessionMethod: "browser-session-cookie",
+  const authenticatedAuthLayer = Layer.succeed(EnvironmentAuthenticatedAuth, (httpEffect) =>
+    httpEffect.pipe(
+      Effect.provideService(EnvironmentAuthenticatedPrincipal, {
+        sessionId: AuthSessionId.make("browser-session"),
+        subject: "browser-client",
+        method: "browser-session-cookie",
+        scopes: new Set<AuthEnvironmentScope>(),
         expiresAt: TEST_SESSION_EXPIRES_AT,
       }),
     ),
-    http.post("*/api/auth/bootstrap", () =>
-      HttpResponse.json({
-        authenticated: true,
-        sessionMethod: "browser-session-cookie",
-        expiresAt: TEST_SESSION_EXPIRES_AT,
-      }),
+  );
+  const metadataLayer = HttpApiBuilder.group(BrowserEnvironmentHttpApi, "metadata", (handlers) =>
+    handlers.handle("descriptor", () => Effect.succeed(TEST_ENVIRONMENT_DESCRIPTOR)),
+  );
+  const authLayer = HttpApiBuilder.group(BrowserEnvironmentHttpApi, "auth", (handlers) =>
+    handlers
+      .handle("session", () =>
+        Effect.succeed({
+          authenticated: true,
+          auth: getAuthDescriptor(),
+          sessionMethod: "browser-session-cookie",
+          expiresAt: TEST_SESSION_EXPIRES_AT,
+        }),
+      )
+      .handle("browserSession", () =>
+        Effect.succeed({
+          authenticated: true,
+          scopes: [
+            "orchestration:read",
+            "orchestration:operate",
+            "terminal:operate",
+            "review:write",
+            "relay:read",
+          ],
+          sessionMethod: "browser-session-cookie",
+          expiresAt: TEST_SESSION_EXPIRES_AT,
+        }),
+      )
+      .handle("token", () => unexpectedEndpoint("auth.token"))
+      .handle("webSocketTicket", () => unexpectedEndpoint("auth.webSocketTicket"))
+      .handle("pairingCredential", () => unexpectedEndpoint("auth.pairingCredential"))
+      .handle("pairingLinks", () => unexpectedEndpoint("auth.pairingLinks"))
+      .handle("revokePairingLink", () => unexpectedEndpoint("auth.revokePairingLink"))
+      .handle("clients", () => unexpectedEndpoint("auth.clients"))
+      .handle("revokeClient", () => unexpectedEndpoint("auth.revokeClient"))
+      .handle("revokeOtherClients", () => unexpectedEndpoint("auth.revokeOtherClients")),
+  ).pipe(Layer.provide(authenticatedAuthLayer));
+  const { handler } = HttpRouter.toWebHandler(
+    HttpApiBuilder.layer(BrowserEnvironmentHttpApi).pipe(
+      Layer.provide(metadataLayer),
+      Layer.provide(authLayer),
+      Layer.provide(authenticatedAuthLayer),
+      Layer.provide(HttpServer.layerServices),
     ),
+    { disableLogger: true },
+  );
+
+  return [
+    http.all("*/.well-known/t3/environment", ({ request }) => handler(request)),
+    http.all("*/api/auth/*", ({ request }) => handler(request)),
   ] as const;
 }
diff --git a/apps/web/test/environmentHttpTest.ts b/apps/web/test/environmentHttpTest.ts
new file mode 100644
index 00000000000..ce43faacc40
--- /dev/null
+++ b/apps/web/test/environmentHttpTest.ts
@@ -0,0 +1,136 @@
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
+import {
+  AuthSessionId,
+  EnvironmentAuthenticatedAuth,
+  EnvironmentAuthenticatedPrincipal,
+  EnvironmentHttpApi,
+  type AuthBrowserSessionRequest,
+  type AuthBrowserSessionResult,
+  type AuthCreatePairingCredentialInput,
+  type AuthEnvironmentScope,
+  type AuthPairingCredentialResult,
+  type AuthSessionState,
+  type ExecutionEnvironmentDescriptor,
+  type EnvironmentAuthInvalidError,
+} from "@t3tools/contracts";
+import * as DateTime from "effect/DateTime";
+import type * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+import { HttpApiTest } from "effect/unstable/httpapi";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+
+import { PrimaryEnvironmentHttpClient } from "../src/environments/primary/httpClient";
+import { __setPrimaryHttpRunnerForTests } from "../src/lib/runtime";
+
+type BrowserSessionHandler = (
+  payload: AuthBrowserSessionRequest,
+) => Effect.Effect<AuthBrowserSessionResult, EnvironmentAuthInvalidError>;
+
+interface EnvironmentHttpTestScenario {
+  readonly descriptor?: () => Effect.Effect<ExecutionEnvironmentDescriptor>;
+  readonly session?: () => Effect.Effect<AuthSessionState>;
+  readonly browserSession?: BrowserSessionHandler;
+  readonly pairingCredential?: (
+    payload: AuthCreatePairingCredentialInput,
+  ) => Effect.Effect<AuthPairingCredentialResult>;
+}
+
+export interface EnvironmentHttpTestCalls {
+  descriptor: number;
+  session: number;
+  browserSession: Array<AuthBrowserSessionRequest>;
+  pairingCredential: Array<AuthCreatePairingCredentialInput>;
+}
+
+const unexpectedEndpoint = (endpoint: string) =>
+  Effect.die(new Error(`Unexpected environment HTTP endpoint: ${endpoint}`));
+
+const authenticatedAuth: Context.Service.Shape<typeof EnvironmentAuthenticatedAuth> = (
+  httpEffect,
+) =>
+  httpEffect.pipe(
+    Effect.provideService(EnvironmentAuthenticatedPrincipal, {
+      sessionId: AuthSessionId.make("test-session"),
+      subject: "test-client",
+      method: "browser-session-cookie",
+      scopes: new Set<AuthEnvironmentScope>(),
+      expiresAt: DateTime.makeUnsafe("2026-05-01T12:00:00.000Z"),
+    }),
+  );
+
+export async function installEnvironmentHttpTest(scenario: EnvironmentHttpTestScenario) {
+  const calls: EnvironmentHttpTestCalls = {
+    descriptor: 0,
+    session: 0,
+    browserSession: [],
+    pairingCredential: [],
+  };
+
+  const client = await Effect.runPromise(
+    HttpApiTest.groups(EnvironmentHttpApi, ["metadata", "auth"]).pipe(
+      Effect.provide([
+        NodeHttpServer.layerHttpServices,
+        HttpApiBuilder.group(EnvironmentHttpApi, "metadata", (handlers) =>
+          handlers.handle(
+            "descriptor",
+            Effect.fn("test.environment.metadata.descriptor")(function* () {
+              calls.descriptor += 1;
+              return yield* scenario.descriptor?.() ?? unexpectedEndpoint("metadata.descriptor");
+            }),
+          ),
+        ),
+        HttpApiBuilder.group(EnvironmentHttpApi, "auth", (handlers) =>
+          handlers
+            .handle(
+              "session",
+              Effect.fn("test.environment.auth.session")(function* () {
+                calls.session += 1;
+                return yield* scenario.session?.() ?? unexpectedEndpoint("auth.session");
+              }),
+            )
+            .handle(
+              "browserSession",
+              Effect.fn("test.environment.auth.browserSession")(function* ({ payload }) {
+                calls.browserSession.push(payload);
+                return yield* (
+                  scenario.browserSession?.(payload) ?? unexpectedEndpoint("auth.browserSession")
+                );
+              }),
+            )
+            .handle("token", () => unexpectedEndpoint("auth.token"))
+            .handle("webSocketTicket", () => unexpectedEndpoint("auth.webSocketTicket"))
+            .handle(
+              "pairingCredential",
+              Effect.fn("test.environment.auth.pairingCredential")(function* ({ payload }) {
+                calls.pairingCredential.push(payload);
+                return yield* (
+                  scenario.pairingCredential?.(payload) ??
+                    unexpectedEndpoint("auth.pairingCredential")
+                );
+              }),
+            )
+            .handle("pairingLinks", () => unexpectedEndpoint("auth.pairingLinks"))
+            .handle("revokePairingLink", () => unexpectedEndpoint("auth.revokePairingLink"))
+            .handle("clients", () => unexpectedEndpoint("auth.clients"))
+            .handle("revokeClient", () => unexpectedEndpoint("auth.revokeClient"))
+            .handle("revokeOtherClients", () => unexpectedEndpoint("auth.revokeOtherClients")),
+        ),
+      ]),
+      Effect.provideService(EnvironmentAuthenticatedAuth, authenticatedAuth),
+      Effect.scoped,
+    ),
+  );
+
+  const runtime = ManagedRuntime.make(Layer.succeed(PrimaryEnvironmentHttpClient, client));
+  __setPrimaryHttpRunnerForTests((effect) => runtime.runPromise(effect));
+
+  return {
+    calls,
+    async dispose() {
+      __setPrimaryHttpRunnerForTests();
+      await runtime.dispose();
+    },
+  };
+}
diff --git a/bun.lock b/bun.lock
index 29c54444357..f5accdb8ef3 100644
--- a/bun.lock
+++ b/bun.lock
@@ -20,6 +20,7 @@
       "version": "0.0.24",
       "dependencies": {
         "@effect/platform-node": "catalog:",
+        "@t3tools/client-runtime": "workspace:*",
         "@t3tools/contracts": "workspace:*",
         "@t3tools/shared": "workspace:*",
         "@t3tools/ssh": "workspace:*",
@@ -179,6 +180,7 @@
         "zustand": "^5.0.11",
       },
       "devDependencies": {
+        "@effect/platform-node": "catalog:",
         "@rolldown/plugin-babel": "^0.2.0",
         "@tailwindcss/vite": "^4.0.0",
         "@tanstack/router-plugin": "^1.161.0",
@@ -187,7 +189,7 @@
         "@types/react-dom": "~19.2.3",
         "@vercel/config": "^0.3.0",
         "@vitejs/plugin-react": "^6.0.0",
-        "@vitest/browser-playwright": "^4.0.18",
+        "@vitest/browser-playwright": "catalog:",
         "babel-plugin-react-compiler": "1.0.0",
         "msw": "2.12.11",
         "playwright": "^1.58.2",
@@ -345,10 +347,11 @@
     "@types/bun": "^1.3.11",
     "@types/node": "^24.10.13",
     "@typescript/native-preview": "7.0.0-dev.20260527.2",
+    "@vitest/browser-playwright": "4.1.0",
     "effect": "4.0.0-beta.73",
     "tsdown": "^0.20.3",
     "typescript": "~6.0.3",
-    "vitest": "^4.0.0",
+    "vitest": "4.1.0",
   },
   "packages": {
     "@adobe/css-tools": ["@adobe/css-tools@4.5.0", "", {}, "sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q=="],
diff --git a/docs/environment-auth.md b/docs/environment-auth.md
new file mode 100644
index 00000000000..af92bcb474d
--- /dev/null
+++ b/docs/environment-auth.md
@@ -0,0 +1,113 @@
+# Environment Authentication Profile
+
+The environment server and the relay use separate credentials, issuers, and trust
+boundaries. They intentionally use a similar OAuth-shaped model so that permission
+checks and token exchange behavior can be audited against established concepts.
+
+## Authorization Model
+
+Environment authorization is capability-based. A session carries zero or more
+OAuth-style scope strings:
+
+| Scope                   | Permission                                                               |
+| ----------------------- | ------------------------------------------------------------------------ |
+| `orchestration:read`    | Read snapshots, status, events, configuration, and filesystem/VCS state. |
+| `orchestration:operate` | Dispatch user operations and mutate environment-side workspace state.    |
+| `terminal:operate`      | Create, attach, input, resize, clear, restart, and terminate terminals.  |
+| `review:write`          | Read review diff previews used to compose review feedback.               |
+| `access:read`           | Inspect pairing links and client sessions.                               |
+| `access:write`          | Create or revoke pairing links and client sessions.                      |
+| `relay:read`            | Inspect managed relay connectivity.                                      |
+| `relay:write`           | Link, configure, or unlink managed relay connectivity.                   |
+
+Ordinary pairing links grant the four client-operation scopes and read access to
+managed relay connectivity:
+`orchestration:read orchestration:operate terminal:operate review:write relay:read`.
+The desktop bootstrap credential and command-line administrative bootstrap
+credentials additionally grant `access:read access:write relay:write`.
+
+## Authentication Flows
+
+### Browser Session
+
+`POST /api/auth/browser-session` consumes a one-time bootstrap credential and creates a
+browser session cookie. The cookie is an HTTP transport adapter for the same
+scoped session model; the response never exposes the session secret to browser
+JavaScript.
+
+### Bearer Access Token
+
+Non-browser clients use `POST /oauth/token` with an
+`application/x-www-form-urlencoded` body:
+
+```text
+grant_type=urn:ietf:params:oauth:grant-type:token-exchange
+subject_token=<bootstrap credential>
+subject_token_type=urn:t3:params:oauth:token-type:environment-bootstrap
+requested_token_type=urn:ietf:params:oauth:token-type:access_token
+scope=orchestration:read orchestration:operate terminal:operate review:write relay:read
+```
+
+Clients may additionally submit `client_label`, `client_device_type`, and
+`client_os` extension parameters so the authorized-clients UI can identify the
+device that established the session. These are presentation hints only; the
+environment derives transport metadata such as IP address and user agent from
+the request and does not use these fields for authorization.
+
+The response has the token-exchange shape:
+
+```json
+{
+  "access_token": "<opaque session token>",
+  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
+  "token_type": "Bearer",
+  "expires_in": 3600,
+  "scope": "orchestration:read orchestration:operate terminal:operate review:write relay:read"
+}
+```
+
+Requested scopes must be a subset of the one-time bootstrap credential grant.
+An ordinary paired client therefore cannot exchange its grant for
+`access:read`, `access:write`, or `relay:write`.
+
+### WebSocket Ticket
+
+`POST /api/auth/websocket-ticket` accepts any authenticated session and returns
+a short-lived, single-purpose WebSocket ticket. This keeps bearer tokens and
+browser cookies out of WebSocket URLs while allowing the socket handshake to
+authenticate. The ticket carries its session's scopes; each RPC method then
+enforces `orchestration:read`, `orchestration:operate`, `terminal:operate`,
+`review:write`, or `access:read` as appropriate. Review feedback submission
+currently dispatches an orchestration operation, so clients performing it also
+need `orchestration:operate`. Creating a ticket is not
+authorization to call every RPC method.
+
+## Standards Alignment
+
+- Bearer access tokens are used through the `Authorization: Bearer` scheme from
+  RFC 6750.
+- The token endpoint profiles the request and response vocabulary from OAuth 2.0
+  Token Exchange (RFC 8693), including `subject_token`, `requested_token_type`,
+  `access_token`, `issued_token_type`, and `token_type`.
+- Scope values follow the OAuth 2.0 scope model from RFC 6749: space-delimited,
+  unordered capabilities with subset checking during exchange.
+
+This is intentionally not a general-purpose OAuth authorization server. The
+environment bootstrap token type is private, the bootstrap cookie and WebSocket
+connection-token routes are product-specific adapters, and the API returns its
+typed `HttpApi` errors rather than implementing every OAuth error response
+surface.
+
+## Upgrade Behavior
+
+Migration `031_AuthAuthorizationScopes` is a hard cutover from role-bearing auth
+records to scoped records. It deletes existing pairing links and sessions while
+leaving non-authentication environment state unchanged. Upgraded clients must
+pair again; old `owner` or `client` credentials are never silently mapped to new
+capabilities.
+
+## Relay Boundary
+
+Relay-managed tunnels use their own tokens and keys. The relay can reuse scope
+parsing and token-exchange conventions, but an environment access token is not a
+relay token and cannot be presented to the relay.
diff --git a/package.json b/package.json
index 8bd251ce350..9b2aedf1000 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,8 @@
       "@typescript/native-preview": "7.0.0-dev.20260527.2",
       "tsdown": "^0.20.3",
       "typescript": "~6.0.3",
-      "vitest": "^4.0.0"
+      "@vitest/browser-playwright": "4.1.0",
+      "vitest": "4.1.0"
     }
   },
   "type": "module",
diff --git a/packages/client-runtime/src/remote.test.ts b/packages/client-runtime/src/remote.test.ts
index c832f4f3858..27c0ce9271d 100644
--- a/packages/client-runtime/src/remote.test.ts
+++ b/packages/client-runtime/src/remote.test.ts
@@ -2,19 +2,23 @@ import { describe, expect, it } from "@effect/vitest";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Fiber from "effect/Fiber";
+import * as Schema from "effect/Schema";
 import * as TestClock from "effect/testing/TestClock";
-import { HttpClient } from "effect/unstable/http";
 
+import { EnvironmentAuthInvalidError } from "@t3tools/contracts";
 import {
   bootstrapRemoteBearerSession,
   fetchRemoteEnvironmentDescriptor,
   fetchRemoteSessionState,
-  issueRemoteWebSocketToken,
+  issueRemoteWebSocketTicket,
   remoteHttpClientLayer,
+  RemoteEnvironmentAuthInvalidJsonError,
   RemoteEnvironmentAuthTimeoutError,
   resolveRemoteWebSocketConnectionUrl,
 } from "./remote.ts";
 
+const isEnvironmentAuthInvalidError = Schema.is(EnvironmentAuthInvalidError);
+
 type FetchCall = readonly [input: RequestInfo | URL, init: RequestInit];
 
 const recordedFetch = (...responses: ReadonlyArray<Response>) => {
@@ -42,10 +46,7 @@ const hangingFetch = () => {
   return { fetchFn, calls };
 };
 
-const provideRemoteHttp =
-  (fetchFn: typeof fetch) =>
-  <A, E, R>(effect: Effect.Effect<A, E, R | HttpClient.HttpClient>) =>
-    effect.pipe(Effect.provide(remoteHttpClientLayer(fetchFn)));
+const provideRemoteHttp = (fetchFn: typeof fetch) => Effect.provide(remoteHttpClientLayer(fetchFn));
 
 const expectFetchCall = (
   calls: ReadonlyArray<FetchCall>,
@@ -90,11 +91,12 @@ describe("remote", () => {
       const fetch = recordedFetch(
         Response.json(
           {
-            authenticated: true,
-            role: "client",
-            sessionMethod: "bearer-session-token",
-            expiresAt: "2026-05-01T12:00:00.000Z",
-            sessionToken: "bearer-token",
+            access_token: "bearer-token",
+            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+            token_type: "Bearer",
+            expires_in: 3600,
+            scope:
+              "orchestration:read orchestration:operate terminal:operate review:write relay:read",
           },
           { status: 200 },
         ),
@@ -106,16 +108,80 @@ describe("remote", () => {
       }).pipe(provideRemoteHttp(fetch.fetchFn));
 
       expect(result).toMatchObject({
-        sessionMethod: "bearer-session-token",
-        sessionToken: "bearer-token",
+        token_type: "Bearer",
+        access_token: "bearer-token",
+        scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read",
       });
       expectFetchCall(fetch.calls, 1, {
-        url: "https://remote.example.com/api/auth/bootstrap/bearer",
+        url: "https://remote.example.com/oauth/token",
         method: "POST",
         headers: {
-          "content-type": "application/json",
+          "content-type": "application/x-www-form-urlencoded",
         },
-        body: `{"credential":"pairing-token"}`,
+        body: "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&subject_token=pairing-token&subject_token_type=urn%3At3%3Aparams%3Aoauth%3Atoken-type%3Aenvironment-bootstrap&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token",
+      });
+    }),
+  );
+
+  it.effect("submits optional client display metadata during bearer token exchange", () =>
+    Effect.gen(function* () {
+      const fetch = recordedFetch(
+        Response.json(
+          {
+            access_token: "bearer-token",
+            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+            token_type: "Bearer",
+            expires_in: 3600,
+            scope:
+              "orchestration:read orchestration:operate terminal:operate review:write relay:read",
+          },
+          { status: 200 },
+        ),
+      );
+
+      yield* bootstrapRemoteBearerSession({
+        httpBaseUrl: "https://remote.example.com/",
+        credential: "pairing-token",
+        clientMetadata: {
+          label: "T3 Code Mobile",
+          deviceType: "mobile",
+          os: "iOS",
+        },
+      }).pipe(provideRemoteHttp(fetch.fetchFn));
+
+      expectFetchCall(fetch.calls, 1, {
+        url: "https://remote.example.com/oauth/token",
+        method: "POST",
+        body: "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&subject_token=pairing-token&subject_token_type=urn%3At3%3Aparams%3Aoauth%3Atoken-type%3Aenvironment-bootstrap&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&client_label=T3+Code+Mobile&client_device_type=mobile&client_os=iOS",
+      });
+    }),
+  );
+
+  it.effect("allows a client to explicitly narrow a pairing grant", () =>
+    Effect.gen(function* () {
+      const fetch = recordedFetch(
+        Response.json(
+          {
+            access_token: "read-only-token",
+            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+            token_type: "Bearer",
+            expires_in: 3600,
+            scope: "orchestration:read",
+          },
+          { status: 200 },
+        ),
+      );
+
+      yield* bootstrapRemoteBearerSession({
+        httpBaseUrl: "https://remote.example.com/",
+        credential: "pairing-token",
+        scopes: ["orchestration:read"],
+      }).pipe(provideRemoteHttp(fetch.fetchFn));
+
+      expectFetchCall(fetch.calls, 1, {
+        url: "https://remote.example.com/oauth/token",
+        method: "POST",
+        body: "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&subject_token=pairing-token&subject_token_type=urn%3At3%3Aparams%3Aoauth%3Atoken-type%3Aenvironment-bootstrap&requested_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token&scope=orchestration%3Aread",
       });
     }),
   );
@@ -144,18 +210,24 @@ describe("remote", () => {
             auth: {
               policy: "remote-reachable",
               bootstrapMethods: ["one-time-token"],
-              sessionMethods: ["browser-session-cookie", "bearer-session-token"],
+              sessionMethods: ["browser-session-cookie", "bearer-access-token"],
               sessionCookieName: "t3_session",
             },
-            role: "client",
-            sessionMethod: "bearer-session-token",
+            scopes: [
+              "orchestration:read",
+              "orchestration:operate",
+              "terminal:operate",
+              "review:write",
+              "relay:read",
+            ],
+            sessionMethod: "bearer-access-token",
             expiresAt: "2026-05-01T12:00:00.000Z",
           },
           { status: 200 },
         ),
         Response.json(
           {
-            token: "ws-token",
+            ticket: "ws-ticket",
             expiresAt: "2026-05-01T12:05:00.000Z",
           },
           { status: 200 },
@@ -176,15 +248,21 @@ describe("remote", () => {
       }).pipe(provideRemoteHttp(fetch.fetchFn));
       expect(session).toMatchObject({
         authenticated: true,
-        role: "client",
+        scopes: [
+          "orchestration:read",
+          "orchestration:operate",
+          "terminal:operate",
+          "review:write",
+          "relay:read",
+        ],
       });
 
-      const token = yield* issueRemoteWebSocketToken({
+      const token = yield* issueRemoteWebSocketTicket({
         httpBaseUrl: "https://remote.example.com/",
         bearerToken: "bearer-token",
       }).pipe(provideRemoteHttp(fetch.fetchFn));
       expect(token).toMatchObject({
-        token: "ws-token",
+        ticket: "ws-ticket",
       });
 
       expectFetchCall(fetch.calls, 1, {
@@ -199,7 +277,7 @@ describe("remote", () => {
         },
       });
       expectFetchCall(fetch.calls, 3, {
-        url: "https://remote.example.com/api/auth/ws-token",
+        url: "https://remote.example.com/api/auth/websocket-ticket",
         method: "POST",
         headers: {
           authorization: "Bearer bearer-token",
@@ -227,25 +305,82 @@ describe("remote", () => {
     }).pipe(Effect.provide(TestClock.layer())),
   );
 
-  it.effect("mints a websocket url that targets the rpc route with a short-lived ws token", () =>
+  it.effect("revives declared typed errors from remote auth failures", () =>
     Effect.gen(function* () {
       const fetch = recordedFetch(
         Response.json(
           {
-            token: "ws-token",
-            expiresAt: "2026-05-01T12:05:00.000Z",
+            _tag: "EnvironmentAuthInvalidError",
+            code: "auth_invalid",
+            reason: "missing_credential",
+            traceId: "trace-auth-test",
+          },
+          { status: 401 },
+        ),
+      );
+
+      const error = yield* issueRemoteWebSocketTicket({
+        httpBaseUrl: "https://remote.example.com/",
+        bearerToken: "expired-token",
+      }).pipe(provideRemoteHttp(fetch.fetchFn), Effect.flip);
+
+      expect(isEnvironmentAuthInvalidError(error)).toBe(true);
+      if (isEnvironmentAuthInvalidError(error)) {
+        expect(error.reason).toBe("missing_credential");
+        expect(error.traceId).toBe("trace-auth-test");
+      }
+    }),
+  );
+
+  it.effect("classifies malformed successful remote auth responses as invalid responses", () =>
+    Effect.gen(function* () {
+      const fetch = recordedFetch(
+        Response.json(
+          {
+            access_token: "",
+            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",
+            token_type: "Bearer",
+            expires_in: 3600,
+            scope:
+              "orchestration:read orchestration:operate terminal:operate review:write relay:read",
           },
           { status: 200 },
         ),
       );
 
-      const url = yield* resolveRemoteWebSocketConnectionUrl({
-        wsBaseUrl: "wss://remote.example.com/",
+      const error = yield* bootstrapRemoteBearerSession({
         httpBaseUrl: "https://remote.example.com/",
-        bearerToken: "bearer-token",
-      }).pipe(provideRemoteHttp(fetch.fetchFn));
+        credential: "pairing-token",
+      }).pipe(provideRemoteHttp(fetch.fetchFn), Effect.flip);
 
-      expect(url).toBe("wss://remote.example.com/ws?wsToken=ws-token");
+      expect(error).toBeInstanceOf(RemoteEnvironmentAuthInvalidJsonError);
+      expect(error.message).toBe(
+        "Remote auth endpoint returned an invalid response from https://remote.example.com/oauth/token.",
+      );
     }),
   );
+
+  it.effect(
+    "mints a websocket url that targets the rpc route with a short-lived websocket ticket",
+    () =>
+      Effect.gen(function* () {
+        const fetch = recordedFetch(
+          Response.json(
+            {
+              ticket: "ws-ticket",
+              expiresAt: "2026-05-01T12:05:00.000Z",
+            },
+            { status: 200 },
+          ),
+        );
+
+        const url = yield* resolveRemoteWebSocketConnectionUrl({
+          wsBaseUrl: "wss://remote.example.com/",
+          httpBaseUrl: "https://remote.example.com/",
+          bearerToken: "bearer-token",
+        }).pipe(provideRemoteHttp(fetch.fetchFn));
+
+        expect(url).toBe("wss://remote.example.com/ws?wsTicket=ws-ticket");
+      }),
+  );
 });
diff --git a/packages/client-runtime/src/remote.ts b/packages/client-runtime/src/remote.ts
index 34dc5aef249..cc8ef361b77 100644
--- a/packages/client-runtime/src/remote.ts
+++ b/packages/client-runtime/src/remote.ts
@@ -1,30 +1,31 @@
+import {
+  AuthAccessTokenType,
+  type AuthClientPresentationMetadata,
+  AuthEnvironmentBootstrapTokenType,
+  AuthTokenExchangeGrantType,
+  type AuthEnvironmentScope,
+  EnvironmentHttpApi,
+  EnvironmentHttpCommonError,
+} from "@t3tools/contracts";
+import { encodeOAuthScope } from "@t3tools/shared/oauthScope";
 import type {
-  AuthBearerBootstrapResult,
-  AuthSessionState,
-  AuthWebSocketTokenResult,
-  ExecutionEnvironmentDescriptor,
+  EnvironmentAuthInvalidError,
+  EnvironmentInternalError,
+  EnvironmentOperationForbiddenError,
+  EnvironmentRequestInvalidError,
+  EnvironmentScopeRequiredError,
 } from "@t3tools/contracts";
-import { decodeJsonResult } from "@t3tools/shared/schemaJson";
 import * as Data from "effect/Data";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
-import { identity } from "effect/Function";
-import {
-  FetchHttpClient,
-  HttpClient,
-  HttpClientRequest,
-  HttpClientResponse,
-} from "effect/unstable/http";
+import { FetchHttpClient, HttpClient, HttpClientError } from "effect/unstable/http";
+import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
 
 const DEFAULT_REMOTE_REQUEST_TIMEOUT_MS = 10_000;
-const RemoteAuthErrorBody = Schema.Struct({
-  error: Schema.optional(Schema.String),
-});
-const decodeRemoteAuthErrorBody = decodeJsonResult(RemoteAuthErrorBody);
+const isEnvironmentHttpCommonError = Schema.is(EnvironmentHttpCommonError);
 
 const remoteEndpointUrl = (httpBaseUrl: string, pathname: string): string => {
   const url = new URL(httpBaseUrl);
@@ -34,6 +35,14 @@ const remoteEndpointUrl = (httpBaseUrl: string, pathname: string): string => {
   return url.toString();
 };
 
+const remoteApiBaseUrl = (httpBaseUrl: string): string => {
+  const url = new URL(httpBaseUrl);
+  url.pathname = "/";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+};
+
 export class RemoteEnvironmentAuthFetchError extends Data.TaggedError(
   "RemoteEnvironmentAuthFetchError",
 )<{
@@ -41,13 +50,6 @@ export class RemoteEnvironmentAuthFetchError extends Data.TaggedError(
   readonly cause: unknown;
 }> {}
 
-export class RemoteEnvironmentAuthResponseReadError extends Data.TaggedError(
-  "RemoteEnvironmentAuthResponseReadError",
-)<{
-  readonly message: string;
-  readonly cause: unknown;
-}> {}
-
 export class RemoteEnvironmentAuthInvalidJsonError extends Data.TaggedError(
   "RemoteEnvironmentAuthInvalidJsonError",
 )<{
@@ -55,14 +57,19 @@ export class RemoteEnvironmentAuthInvalidJsonError extends Data.TaggedError(
   readonly cause: unknown;
 }> {}
 
-export class RemoteEnvironmentAuthHttpError extends Data.TaggedError(
-  "RemoteEnvironmentAuthHttpError",
+export class RemoteEnvironmentAuthUndeclaredStatusError extends Data.TaggedError(
+  "RemoteEnvironmentAuthUndeclaredStatusError",
 )<{
   readonly message: string;
   readonly status: number;
+  readonly requestUrl: string;
 }> {
-  constructor(message: string, status: number) {
-    super({ message, status });
+  constructor(requestUrl: string, status: number) {
+    super({
+      message: `Remote auth endpoint ${requestUrl} returned undeclared status ${status}.`,
+      requestUrl,
+      status,
+    });
   }
 }
 
@@ -83,87 +90,67 @@ export class RemoteEnvironmentAuthTimeoutError extends Data.TaggedError(
 }
 
 export type RemoteEnvironmentAuthError =
+  | EnvironmentRequestInvalidError
+  | EnvironmentAuthInvalidError
+  | EnvironmentScopeRequiredError
+  | EnvironmentOperationForbiddenError
+  | EnvironmentInternalError
   | RemoteEnvironmentAuthFetchError
-  | RemoteEnvironmentAuthResponseReadError
   | RemoteEnvironmentAuthInvalidJsonError
-  | RemoteEnvironmentAuthHttpError
+  | RemoteEnvironmentAuthUndeclaredStatusError
   | RemoteEnvironmentAuthTimeoutError;
 
-export const isRemoteEnvironmentAuthHttpError = (
-  error: unknown,
-): error is RemoteEnvironmentAuthHttpError => error instanceof RemoteEnvironmentAuthHttpError;
-
-const readRemoteAuthErrorMessage = (
-  response: HttpClientResponse.HttpClientResponse,
-  fallbackMessage: string,
-): Effect.Effect<string, RemoteEnvironmentAuthResponseReadError> =>
-  response.text.pipe(
-    Effect.mapError(
-      (cause) =>
-        new RemoteEnvironmentAuthResponseReadError({
-          message: "Remote auth endpoint returned an unreadable error response.",
-          cause,
-        }),
-    ),
-    Effect.map((text) => {
-      if (!text) {
-        return fallbackMessage;
-      }
-
-      const decoded = decodeRemoteAuthErrorBody(text);
-      if (Result.isSuccess(decoded) && decoded.success.error) {
-        return decoded.success.error;
-      }
-
-      return text;
-    }),
-  );
-
-const readRemoteJson = <T>(
-  response: HttpClientResponse.HttpClientResponse,
-  requestUrl: string,
-): Effect.Effect<T, RemoteEnvironmentAuthInvalidJsonError> =>
-  response.json.pipe(
-    Effect.mapError(
-      (cause) =>
-        new RemoteEnvironmentAuthInvalidJsonError({
-          message: `Remote auth endpoint returned invalid JSON from ${requestUrl}.`,
-          cause,
-        }),
-    ),
-    Effect.map((value) => value as T),
-  );
-
 export const remoteHttpClientLayer = (
   fetchFn: typeof globalThis.fetch,
 ): Layer.Layer<HttpClient.HttpClient> =>
   FetchHttpClient.layer.pipe(Layer.provide(Layer.succeed(FetchHttpClient.Fetch, fetchFn)));
 
-const fetchRemoteJson = Effect.fn("clientRuntime.remote.fetchRemoteJson")(function* <T>(input: {
-  readonly httpBaseUrl: string;
-  readonly pathname: string;
-  readonly method?: "GET" | "POST";
-  readonly bearerToken?: string;
-  readonly body?: unknown;
-  readonly timeoutMs?: number;
-}) {
-  const requestUrl = remoteEndpointUrl(input.httpBaseUrl, input.pathname);
-  const method = input.method ?? "GET";
-  const timeoutMs = input.timeoutMs ?? DEFAULT_REMOTE_REQUEST_TIMEOUT_MS;
-  const request = HttpClientRequest.make(method)(requestUrl).pipe(
-    input.bearerToken ? HttpClientRequest.bearerToken(input.bearerToken) : identity,
-    input.body !== undefined ? HttpClientRequest.bodyJsonUnsafe(input.body) : identity,
+const failRemoteRequest = (
+  requestUrl: string,
+  cause: unknown,
+): Effect.Effect<never, RemoteEnvironmentAuthError> => {
+  if (cause instanceof RemoteEnvironmentAuthTimeoutError) {
+    return Effect.fail(cause);
+  }
+  if (isEnvironmentHttpCommonError(cause)) {
+    return Effect.fail(cause);
+  }
+  if (Schema.isSchemaError(cause)) {
+    return Effect.fail(
+      new RemoteEnvironmentAuthInvalidJsonError({
+        message: `Remote auth endpoint returned an invalid response from ${requestUrl}.`,
+        cause,
+      }),
+    );
+  }
+  if (HttpClientError.isHttpClientError(cause) && cause.response !== undefined) {
+    const response = cause.response;
+    if (response.status < 200 || response.status >= 300) {
+      return Effect.fail(
+        new RemoteEnvironmentAuthUndeclaredStatusError(requestUrl, response.status),
+      );
+    }
+    return Effect.fail(
+      new RemoteEnvironmentAuthInvalidJsonError({
+        message: `Remote auth endpoint returned an invalid response from ${requestUrl}.`,
+        cause,
+      }),
+    );
+  }
+  return Effect.fail(
+    new RemoteEnvironmentAuthFetchError({
+      message: `Failed to fetch remote auth endpoint ${requestUrl} (${String(cause)}).`,
+      cause,
+    }),
   );
+};
 
-  const client = yield* HttpClient.HttpClient;
-  const response = yield* client.execute(request).pipe(
-    Effect.mapError(
-      (cause) =>
-        new RemoteEnvironmentAuthFetchError({
-          message: `Failed to fetch remote auth endpoint ${requestUrl} (${String(cause)}).`,
-          cause,
-        }),
-    ),
+const executeRemoteRequest = <A, E, R>(
+  requestUrl: string,
+  timeoutMs: number,
+  request: Effect.Effect<A, E, R>,
+): Effect.Effect<A, RemoteEnvironmentAuthError, R> =>
+  request.pipe(
     Effect.timeoutOption(Duration.millis(timeoutMs)),
     Effect.flatMap(
       Option.match({
@@ -171,38 +158,46 @@ const fetchRemoteJson = Effect.fn("clientRuntime.remote.fetchRemoteJson")(functi
         onSome: Effect.succeed,
       }),
     ),
+    Effect.catch((cause) => failRemoteRequest(requestUrl, cause)),
   );
 
-  if (response.status < 200 || response.status >= 300) {
-    return yield* readRemoteAuthErrorMessage(
-      response,
-      `Remote auth request failed (${response.status}).`,
-    ).pipe(
-      Effect.flatMap((message) =>
-        Effect.fail(new RemoteEnvironmentAuthHttpError(message, response.status)),
-      ),
-    );
-  }
-
-  return yield* readRemoteJson<T>(response, requestUrl);
-});
+export const makeEnvironmentHttpApiClient = (httpBaseUrl: string) =>
+  Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    return yield* HttpApiClient.makeWith(EnvironmentHttpApi, {
+      httpClient,
+      baseUrl: remoteApiBaseUrl(httpBaseUrl),
+    });
+  });
 
 export const bootstrapRemoteBearerSession = Effect.fn(
   "clientRuntime.remote.bootstrapRemoteBearerSession",
 )(function* (input: {
   readonly httpBaseUrl: string;
   readonly credential: string;
+  readonly scopes?: ReadonlyArray<AuthEnvironmentScope>;
+  readonly clientMetadata?: AuthClientPresentationMetadata;
   readonly timeoutMs?: number;
 }) {
-  return yield* fetchRemoteJson<AuthBearerBootstrapResult>({
-    httpBaseUrl: input.httpBaseUrl,
-    pathname: "/api/auth/bootstrap/bearer",
-    method: "POST",
-    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
-    body: {
-      credential: input.credential,
-    },
-  });
+  const client = yield* makeEnvironmentHttpApiClient(input.httpBaseUrl);
+  return yield* executeRemoteRequest(
+    remoteEndpointUrl(input.httpBaseUrl, "/oauth/token"),
+    input.timeoutMs ?? DEFAULT_REMOTE_REQUEST_TIMEOUT_MS,
+    client.auth.token({
+      payload: {
+        grant_type: AuthTokenExchangeGrantType,
+        subject_token: input.credential,
+        subject_token_type: AuthEnvironmentBootstrapTokenType,
+        requested_token_type: AuthAccessTokenType,
+        ...(input.scopes ? { scope: encodeOAuthScope(input.scopes) } : {}),
+        ...(input.clientMetadata?.label ? { client_label: input.clientMetadata.label } : {}),
+        ...(input.clientMetadata?.deviceType
+          ? { client_device_type: input.clientMetadata.deviceType }
+          : {}),
+        ...(input.clientMetadata?.os ? { client_os: input.clientMetadata.os } : {}),
+      },
+    }),
+  );
 });
 
 export const fetchRemoteSessionState = Effect.fn("clientRuntime.remote.fetchRemoteSessionState")(
@@ -211,39 +206,47 @@ export const fetchRemoteSessionState = Effect.fn("clientRuntime.remote.fetchRemo
     readonly bearerToken: string;
     readonly timeoutMs?: number;
   }) {
-    return yield* fetchRemoteJson<AuthSessionState>({
-      httpBaseUrl: input.httpBaseUrl,
-      pathname: "/api/auth/session",
-      bearerToken: input.bearerToken,
-      ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
-    });
+    const client = yield* makeEnvironmentHttpApiClient(input.httpBaseUrl);
+    return yield* executeRemoteRequest(
+      remoteEndpointUrl(input.httpBaseUrl, "/api/auth/session"),
+      input.timeoutMs ?? DEFAULT_REMOTE_REQUEST_TIMEOUT_MS,
+      client.auth.session({
+        headers: {
+          authorization: `Bearer ${input.bearerToken}`,
+        },
+      }),
+    );
   },
 );
 
 export const fetchRemoteEnvironmentDescriptor = Effect.fn(
   "clientRuntime.remote.fetchRemoteEnvironmentDescriptor",
 )(function* (input: { readonly httpBaseUrl: string; readonly timeoutMs?: number }) {
-  return yield* fetchRemoteJson<ExecutionEnvironmentDescriptor>({
-    httpBaseUrl: input.httpBaseUrl,
-    pathname: "/.well-known/t3/environment",
-    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
-  });
+  const client = yield* makeEnvironmentHttpApiClient(input.httpBaseUrl);
+  return yield* executeRemoteRequest(
+    remoteEndpointUrl(input.httpBaseUrl, "/.well-known/t3/environment"),
+    input.timeoutMs ?? DEFAULT_REMOTE_REQUEST_TIMEOUT_MS,
+    client.metadata.descriptor(),
+  );
 });
 
-export const issueRemoteWebSocketToken = Effect.fn(
-  "clientRuntime.remote.issueRemoteWebSocketToken",
+export const issueRemoteWebSocketTicket = Effect.fn(
+  "clientRuntime.remote.issueRemoteWebSocketTicket",
 )(function* (input: {
   readonly httpBaseUrl: string;
   readonly bearerToken: string;
   readonly timeoutMs?: number;
 }) {
-  return yield* fetchRemoteJson<AuthWebSocketTokenResult>({
-    httpBaseUrl: input.httpBaseUrl,
-    pathname: "/api/auth/ws-token",
-    method: "POST",
-    bearerToken: input.bearerToken,
-    ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
-  });
+  const client = yield* makeEnvironmentHttpApiClient(input.httpBaseUrl);
+  return yield* executeRemoteRequest(
+    remoteEndpointUrl(input.httpBaseUrl, "/api/auth/websocket-ticket"),
+    input.timeoutMs ?? DEFAULT_REMOTE_REQUEST_TIMEOUT_MS,
+    client.auth.webSocketTicket({
+      headers: {
+        authorization: `Bearer ${input.bearerToken}`,
+      },
+    }),
+  );
 });
 
 export const resolveRemoteWebSocketConnectionUrl = Effect.fn(
@@ -254,7 +257,7 @@ export const resolveRemoteWebSocketConnectionUrl = Effect.fn(
   readonly bearerToken: string;
   readonly timeoutMs?: number;
 }) {
-  const issued = yield* issueRemoteWebSocketToken({
+  const issued = yield* issueRemoteWebSocketTicket({
     httpBaseUrl: input.httpBaseUrl,
     bearerToken: input.bearerToken,
     ...(input.timeoutMs ? { timeoutMs: input.timeoutMs } : {}),
@@ -264,6 +267,6 @@ export const resolveRemoteWebSocketConnectionUrl = Effect.fn(
   if (url.pathname === "" || url.pathname === "/") {
     url.pathname = "/ws";
   }
-  url.searchParams.set("wsToken", issued.token);
+  url.searchParams.set("wsTicket", issued.ticket);
   return url.toString();
 });
diff --git a/packages/client-runtime/src/wsTransport.test.ts b/packages/client-runtime/src/wsTransport.test.ts
index cc1c2e3d829..1933c3e0348 100644
--- a/packages/client-runtime/src/wsTransport.test.ts
+++ b/packages/client-runtime/src/wsTransport.test.ts
@@ -170,13 +170,13 @@ describe("WsTransport", () => {
   });
 
   it("supports async websocket url providers", async () => {
-    const transport = createTransport(async () => "wss://remote.example.com/?wsToken=dynamic");
+    const transport = createTransport(async () => "wss://remote.example.com/?wsTicket=dynamic");
 
     await waitFor(() => {
       expect(sockets).toHaveLength(1);
     });
 
-    expect(getSocket().url).toBe("wss://remote.example.com/ws?wsToken=dynamic");
+    expect(getSocket().url).toBe("wss://remote.example.com/ws?wsTicket=dynamic");
     await transport.dispose();
   });
 
diff --git a/packages/contracts/src/auth.ts b/packages/contracts/src/auth.ts
index 8439d12b069..2b062fc2d6e 100644
--- a/packages/contracts/src/auth.ts
+++ b/packages/contracts/src/auth.ts
@@ -1,4 +1,5 @@
 import * as Schema from "effect/Schema";
+import * as HttpApiSchema from "effect/unstable/httpapi/HttpApiSchema";
 
 import { AuthSessionId, TrimmedNonEmptyString } from "./baseSchemas.ts";
 
@@ -60,17 +61,56 @@ export type ServerAuthBootstrapMethod = typeof ServerAuthBootstrapMethod.Type;
  * Current methods:
  * - `browser-session-cookie`: cookie-backed browser session, used by the web
  *   app after bootstrap/pairing
- * - `bearer-session-token`: token-based session suitable for non-cookie or
+ * - `bearer-access-token`: scoped token suitable for non-cookie or
  *   non-browser clients
  */
 export const ServerAuthSessionMethod = Schema.Literals([
   "browser-session-cookie",
-  "bearer-session-token",
+  "bearer-access-token",
 ]);
 export type ServerAuthSessionMethod = typeof ServerAuthSessionMethod.Type;
 
-export const AuthSessionRole = Schema.Literals(["owner", "client"]);
-export type AuthSessionRole = typeof AuthSessionRole.Type;
+export const AuthOrchestrationReadScope = "orchestration:read" as const;
+export const AuthOrchestrationOperateScope = "orchestration:operate" as const;
+export const AuthTerminalOperateScope = "terminal:operate" as const;
+export const AuthReviewWriteScope = "review:write" as const;
+export const AuthAccessReadScope = "access:read" as const;
+export const AuthAccessWriteScope = "access:write" as const;
+export const AuthRelayReadScope = "relay:read" as const;
+export const AuthRelayWriteScope = "relay:write" as const;
+export const AuthEnvironmentScope = Schema.Literals([
+  AuthOrchestrationReadScope,
+  AuthOrchestrationOperateScope,
+  AuthTerminalOperateScope,
+  AuthReviewWriteScope,
+  AuthAccessReadScope,
+  AuthAccessWriteScope,
+  AuthRelayReadScope,
+  AuthRelayWriteScope,
+]);
+export type AuthEnvironmentScope = typeof AuthEnvironmentScope.Type;
+export const AuthEnvironmentScopes = Schema.Array(AuthEnvironmentScope);
+export type AuthEnvironmentScopes = typeof AuthEnvironmentScopes.Type;
+
+export const AuthStandardClientScopes = [
+  AuthOrchestrationReadScope,
+  AuthOrchestrationOperateScope,
+  AuthTerminalOperateScope,
+  AuthReviewWriteScope,
+  AuthRelayReadScope,
+] as const;
+export const AuthAdministrativeScopes = [
+  ...AuthStandardClientScopes,
+  AuthAccessReadScope,
+  AuthAccessWriteScope,
+  AuthRelayWriteScope,
+] as const;
+
+export const AuthTokenExchangeGrantType =
+  "urn:ietf:params:oauth:grant-type:token-exchange" as const;
+export const AuthAccessTokenType = "urn:ietf:params:oauth:token-type:access_token" as const;
+export const AuthEnvironmentBootstrapTokenType =
+  "urn:t3:params:oauth:token-type:environment-bootstrap" as const;
 
 /**
  * Server-advertised auth capabilities for a specific execution environment.
@@ -100,33 +140,61 @@ export const ServerAuthDescriptor = Schema.Struct({
 });
 export type ServerAuthDescriptor = typeof ServerAuthDescriptor.Type;
 
-export const AuthBootstrapInput = Schema.Struct({
+export const AuthBrowserSessionRequest = Schema.Struct({
   credential: TrimmedNonEmptyString,
 });
-export type AuthBootstrapInput = typeof AuthBootstrapInput.Type;
+export type AuthBrowserSessionRequest = typeof AuthBrowserSessionRequest.Type;
 
-export const AuthBootstrapResult = Schema.Struct({
+export const AuthBrowserSessionResult = Schema.Struct({
   authenticated: Schema.Literal(true),
-  role: AuthSessionRole,
+  scopes: AuthEnvironmentScopes,
   sessionMethod: ServerAuthSessionMethod,
   expiresAt: Schema.DateTimeUtc,
 });
-export type AuthBootstrapResult = typeof AuthBootstrapResult.Type;
+export type AuthBrowserSessionResult = typeof AuthBrowserSessionResult.Type;
 
-export const AuthBearerBootstrapResult = Schema.Struct({
-  authenticated: Schema.Literal(true),
-  role: AuthSessionRole,
-  sessionMethod: Schema.Literal("bearer-session-token"),
-  expiresAt: Schema.DateTimeUtc,
-  sessionToken: TrimmedNonEmptyString,
+export const AuthClientMetadataDeviceType = Schema.Literals([
+  "desktop",
+  "mobile",
+  "tablet",
+  "bot",
+  "unknown",
+]);
+export type AuthClientMetadataDeviceType = typeof AuthClientMetadataDeviceType.Type;
+
+export const AuthClientPresentationMetadata = Schema.Struct({
+  label: Schema.optionalKey(TrimmedNonEmptyString),
+  deviceType: Schema.optionalKey(AuthClientMetadataDeviceType),
+  os: Schema.optionalKey(TrimmedNonEmptyString),
+});
+export type AuthClientPresentationMetadata = typeof AuthClientPresentationMetadata.Type;
+
+export const AuthTokenExchangeRequest = Schema.Struct({
+  grant_type: Schema.Literal(AuthTokenExchangeGrantType),
+  subject_token: TrimmedNonEmptyString,
+  subject_token_type: Schema.Literal(AuthEnvironmentBootstrapTokenType),
+  requested_token_type: Schema.Literal(AuthAccessTokenType),
+  scope: Schema.optionalKey(TrimmedNonEmptyString),
+  client_label: Schema.optionalKey(TrimmedNonEmptyString),
+  client_device_type: Schema.optionalKey(AuthClientMetadataDeviceType),
+  client_os: Schema.optionalKey(TrimmedNonEmptyString),
+}).pipe(HttpApiSchema.asFormUrlEncoded());
+export type AuthTokenExchangeRequest = typeof AuthTokenExchangeRequest.Type;
+
+export const AuthAccessTokenResult = Schema.Struct({
+  access_token: TrimmedNonEmptyString,
+  issued_token_type: Schema.Literal(AuthAccessTokenType),
+  token_type: Schema.Literal("Bearer"),
+  expires_in: Schema.Number,
+  scope: TrimmedNonEmptyString,
 });
-export type AuthBearerBootstrapResult = typeof AuthBearerBootstrapResult.Type;
+export type AuthAccessTokenResult = typeof AuthAccessTokenResult.Type;
 
-export const AuthWebSocketTokenResult = Schema.Struct({
-  token: TrimmedNonEmptyString,
+export const AuthWebSocketTicketResult = Schema.Struct({
+  ticket: TrimmedNonEmptyString,
   expiresAt: Schema.DateTimeUtc,
 });
-export type AuthWebSocketTokenResult = typeof AuthWebSocketTokenResult.Type;
+export type AuthWebSocketTicketResult = typeof AuthWebSocketTicketResult.Type;
 
 export const AuthPairingCredentialResult = Schema.Struct({
   id: TrimmedNonEmptyString,
@@ -139,7 +207,7 @@ export type AuthPairingCredentialResult = typeof AuthPairingCredentialResult.Typ
 export const AuthPairingLink = Schema.Struct({
   id: TrimmedNonEmptyString,
   credential: TrimmedNonEmptyString,
-  role: AuthSessionRole,
+  scopes: AuthEnvironmentScopes,
   subject: TrimmedNonEmptyString,
   label: Schema.optionalKey(TrimmedNonEmptyString),
   createdAt: Schema.DateTimeUtc,
@@ -147,15 +215,6 @@ export const AuthPairingLink = Schema.Struct({
 });
 export type AuthPairingLink = typeof AuthPairingLink.Type;
 
-export const AuthClientMetadataDeviceType = Schema.Literals([
-  "desktop",
-  "mobile",
-  "tablet",
-  "bot",
-  "unknown",
-]);
-export type AuthClientMetadataDeviceType = typeof AuthClientMetadataDeviceType.Type;
-
 export const AuthClientMetadata = Schema.Struct({
   label: Schema.optionalKey(TrimmedNonEmptyString),
   ipAddress: Schema.optionalKey(TrimmedNonEmptyString),
@@ -169,7 +228,7 @@ export type AuthClientMetadata = typeof AuthClientMetadata.Type;
 export const AuthClientSession = Schema.Struct({
   sessionId: AuthSessionId,
   subject: TrimmedNonEmptyString,
-  role: AuthSessionRole,
+  scopes: AuthEnvironmentScopes,
   method: ServerAuthSessionMethod,
   client: AuthClientMetadata,
   issuedAt: Schema.DateTimeUtc,
@@ -214,6 +273,21 @@ export const AuthAccessStreamPairingLinkRemovedEvent = Schema.Struct({
 export type AuthAccessStreamPairingLinkRemovedEvent =
   typeof AuthAccessStreamPairingLinkRemovedEvent.Type;
 
+export class AuthAccessStreamError extends Schema.TaggedErrorClass<AuthAccessStreamError>()(
+  "AuthAccessStreamError",
+  {
+    message: Schema.String,
+  },
+) {}
+
+export class EnvironmentAuthorizationError extends Schema.TaggedErrorClass<EnvironmentAuthorizationError>()(
+  "EnvironmentAuthorizationError",
+  {
+    message: Schema.String,
+    requiredScope: AuthEnvironmentScope,
+  },
+) {}
+
 export const AuthAccessStreamClientUpsertedEvent = Schema.Struct({
   version: Schema.Literal(1),
   revision: Schema.Number,
@@ -253,13 +327,14 @@ export type AuthRevokeClientSessionInput = typeof AuthRevokeClientSessionInput.T
 
 export const AuthCreatePairingCredentialInput = Schema.Struct({
   label: Schema.optionalKey(TrimmedNonEmptyString),
+  scopes: Schema.optionalKey(AuthEnvironmentScopes),
 });
 export type AuthCreatePairingCredentialInput = typeof AuthCreatePairingCredentialInput.Type;
 
 export const AuthSessionState = Schema.Struct({
   authenticated: Schema.Boolean,
   auth: ServerAuthDescriptor,
-  role: Schema.optionalKey(AuthSessionRole),
+  scopes: Schema.optionalKey(AuthEnvironmentScopes),
   sessionMethod: Schema.optionalKey(ServerAuthSessionMethod),
   expiresAt: Schema.optionalKey(Schema.DateTimeUtc),
 });
diff --git a/packages/contracts/src/environmentHttp.ts b/packages/contracts/src/environmentHttp.ts
new file mode 100644
index 00000000000..93189f62a9e
--- /dev/null
+++ b/packages/contracts/src/environmentHttp.ts
@@ -0,0 +1,325 @@
+import * as Context from "effect/Context";
+import type * as DateTime from "effect/DateTime";
+import * as Schema from "effect/Schema";
+import * as HttpApi from "effect/unstable/httpapi/HttpApi";
+import * as HttpApiEndpoint from "effect/unstable/httpapi/HttpApiEndpoint";
+import * as HttpApiGroup from "effect/unstable/httpapi/HttpApiGroup";
+import * as HttpApiMiddleware from "effect/unstable/httpapi/HttpApiMiddleware";
+import * as HttpServerRespondable from "effect/unstable/http/HttpServerRespondable";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+
+import {
+  AuthAccessTokenResult,
+  AuthBrowserSessionRequest,
+  AuthBrowserSessionResult,
+  AuthClientSession,
+  AuthCreatePairingCredentialInput,
+  AuthPairingCredentialResult,
+  AuthPairingLink,
+  AuthRevokeClientSessionInput,
+  AuthRevokePairingLinkInput,
+  AuthEnvironmentScope,
+  AuthTokenExchangeRequest,
+  AuthSessionState,
+  AuthWebSocketTicketResult,
+  ServerAuthSessionMethod,
+} from "./auth.ts";
+import { AuthSessionId, TrimmedNonEmptyString } from "./baseSchemas.ts";
+import { ExecutionEnvironmentDescriptor } from "./environment.ts";
+import {
+  ClientOrchestrationCommand,
+  DispatchResult,
+  OrchestrationReadModel,
+} from "./orchestration.ts";
+
+const OptionalBearerHeaders = Schema.Struct({
+  authorization: Schema.optionalKey(Schema.String),
+});
+
+export const EnvironmentRequestInvalidReason = Schema.Literals([
+  "invalid_scope",
+  "scope_not_granted",
+  "invalid_command",
+]);
+export type EnvironmentRequestInvalidReason = typeof EnvironmentRequestInvalidReason.Type;
+
+export const EnvironmentAuthInvalidReason = Schema.Literals([
+  "missing_credential",
+  "invalid_credential",
+]);
+export type EnvironmentAuthInvalidReason = typeof EnvironmentAuthInvalidReason.Type;
+
+export const EnvironmentOperationForbiddenReason = Schema.Literals([
+  "current_session_revoke_not_allowed",
+]);
+export type EnvironmentOperationForbiddenReason = typeof EnvironmentOperationForbiddenReason.Type;
+
+export const EnvironmentInternalErrorReason = Schema.Literals([
+  "bootstrap_validation_failed",
+  "browser_session_issuance_failed",
+  "browser_session_cookie_failed",
+  "access_token_issuance_failed",
+  "websocket_ticket_issuance_failed",
+  "pairing_credential_issuance_failed",
+  "pairing_links_load_failed",
+  "pairing_link_revoke_failed",
+  "client_sessions_load_failed",
+  "client_session_revoke_failed",
+  "orchestration_snapshot_failed",
+  "orchestration_dispatch_failed",
+  "internal_error",
+]);
+export type EnvironmentInternalErrorReason = typeof EnvironmentInternalErrorReason.Type;
+
+export class EnvironmentRequestInvalidError extends Schema.TaggedErrorClass<EnvironmentRequestInvalidError>()(
+  "EnvironmentRequestInvalidError",
+  {
+    code: Schema.Literal("invalid_request"),
+    reason: EnvironmentRequestInvalidReason,
+    traceId: TrimmedNonEmptyString,
+  },
+  { httpApiStatus: 400 },
+) {
+  [HttpServerRespondable.symbol]() {
+    return HttpServerResponse.schemaJson(EnvironmentRequestInvalidError)(this, { status: 400 });
+  }
+}
+
+export class EnvironmentAuthInvalidError extends Schema.TaggedErrorClass<EnvironmentAuthInvalidError>()(
+  "EnvironmentAuthInvalidError",
+  {
+    code: Schema.Literal("auth_invalid"),
+    reason: EnvironmentAuthInvalidReason,
+    traceId: TrimmedNonEmptyString,
+  },
+  { httpApiStatus: 401 },
+) {
+  [HttpServerRespondable.symbol]() {
+    return HttpServerResponse.schemaJson(EnvironmentAuthInvalidError)(this, { status: 401 });
+  }
+}
+
+export class EnvironmentScopeRequiredError extends Schema.TaggedErrorClass<EnvironmentScopeRequiredError>()(
+  "EnvironmentScopeRequiredError",
+  {
+    code: Schema.Literal("insufficient_scope"),
+    requiredScope: AuthEnvironmentScope,
+    traceId: TrimmedNonEmptyString,
+  },
+  { httpApiStatus: 403 },
+) {
+  [HttpServerRespondable.symbol]() {
+    return HttpServerResponse.schemaJson(EnvironmentScopeRequiredError)(this, { status: 403 });
+  }
+}
+
+export class EnvironmentOperationForbiddenError extends Schema.TaggedErrorClass<EnvironmentOperationForbiddenError>()(
+  "EnvironmentOperationForbiddenError",
+  {
+    code: Schema.Literal("operation_forbidden"),
+    reason: EnvironmentOperationForbiddenReason,
+    traceId: TrimmedNonEmptyString,
+  },
+  { httpApiStatus: 403 },
+) {
+  [HttpServerRespondable.symbol]() {
+    return HttpServerResponse.schemaJson(EnvironmentOperationForbiddenError)(this, { status: 403 });
+  }
+}
+
+export class EnvironmentInternalError extends Schema.TaggedErrorClass<EnvironmentInternalError>()(
+  "EnvironmentInternalError",
+  {
+    code: Schema.Literal("internal_error"),
+    reason: EnvironmentInternalErrorReason,
+    traceId: TrimmedNonEmptyString,
+  },
+  { httpApiStatus: 500 },
+) {
+  [HttpServerRespondable.symbol]() {
+    return HttpServerResponse.schemaJson(EnvironmentInternalError)(this, { status: 500 });
+  }
+}
+
+export const EnvironmentHttpCommonError = Schema.Union([
+  EnvironmentRequestInvalidError,
+  EnvironmentAuthInvalidError,
+  EnvironmentScopeRequiredError,
+  EnvironmentOperationForbiddenError,
+  EnvironmentInternalError,
+]);
+export type EnvironmentHttpCommonError = typeof EnvironmentHttpCommonError.Type;
+
+const EnvironmentAuthenticationErrors = [
+  EnvironmentAuthInvalidError,
+  EnvironmentInternalError,
+] as const;
+const EnvironmentSessionCreationErrors = [
+  EnvironmentAuthInvalidError,
+  EnvironmentInternalError,
+] as const;
+const EnvironmentTokenExchangeErrors = [
+  EnvironmentRequestInvalidError,
+  EnvironmentAuthInvalidError,
+  EnvironmentInternalError,
+] as const;
+const EnvironmentScopedOperationErrors = [
+  EnvironmentScopeRequiredError,
+  EnvironmentInternalError,
+] as const;
+const EnvironmentPairingCredentialErrors = [
+  EnvironmentRequestInvalidError,
+  ...EnvironmentScopedOperationErrors,
+] as const;
+const EnvironmentSessionRevokeErrors = [
+  EnvironmentScopeRequiredError,
+  EnvironmentOperationForbiddenError,
+  EnvironmentInternalError,
+] as const;
+const EnvironmentOrchestrationSnapshotErrors = [
+  EnvironmentScopeRequiredError,
+  EnvironmentInternalError,
+] as const;
+const EnvironmentOrchestrationDispatchErrors = [
+  EnvironmentRequestInvalidError,
+  EnvironmentScopeRequiredError,
+  EnvironmentInternalError,
+] as const;
+
+export interface EnvironmentSessionPrincipalShape {
+  readonly sessionId: AuthSessionId;
+  readonly subject: string;
+  readonly method: ServerAuthSessionMethod;
+  readonly scopes: ReadonlySet<AuthEnvironmentScope>;
+  readonly expiresAt?: DateTime.DateTime;
+}
+
+export class EnvironmentAuthenticatedPrincipal extends Context.Service<
+  EnvironmentAuthenticatedPrincipal,
+  EnvironmentSessionPrincipalShape
+>()("@t3tools/contracts/environmentHttp/EnvironmentAuthenticatedPrincipal") {}
+
+export class EnvironmentAuthenticatedAuth extends HttpApiMiddleware.Service<
+  EnvironmentAuthenticatedAuth,
+  { provides: EnvironmentAuthenticatedPrincipal }
+>()("EnvironmentAuthenticatedAuth", {
+  error: EnvironmentAuthenticationErrors,
+}) {}
+
+export const AuthPairingLinkRevokeResult = Schema.Struct({
+  revoked: Schema.Boolean,
+});
+export type AuthPairingLinkRevokeResult = typeof AuthPairingLinkRevokeResult.Type;
+
+export const AuthClientSessionRevokeResult = Schema.Struct({
+  revoked: Schema.Boolean,
+});
+export type AuthClientSessionRevokeResult = typeof AuthClientSessionRevokeResult.Type;
+
+export const AuthOtherClientSessionsRevokeResult = Schema.Struct({
+  revokedCount: Schema.Number,
+});
+export type AuthOtherClientSessionsRevokeResult = typeof AuthOtherClientSessionsRevokeResult.Type;
+
+export class EnvironmentMetadataHttpApi extends HttpApiGroup.make("metadata").add(
+  HttpApiEndpoint.get("descriptor", "/.well-known/t3/environment", {
+    success: ExecutionEnvironmentDescriptor,
+  }),
+) {}
+
+export class EnvironmentAuthHttpApi extends HttpApiGroup.make("auth")
+  .add(
+    HttpApiEndpoint.get("session", "/api/auth/session", {
+      headers: OptionalBearerHeaders,
+      success: AuthSessionState,
+      error: [EnvironmentInternalError],
+    }),
+  )
+  .add(
+    HttpApiEndpoint.post("browserSession", "/api/auth/browser-session", {
+      payload: AuthBrowserSessionRequest,
+      success: AuthBrowserSessionResult,
+      error: EnvironmentSessionCreationErrors,
+    }),
+  )
+  .add(
+    HttpApiEndpoint.post("token", "/oauth/token", {
+      payload: AuthTokenExchangeRequest,
+      success: AuthAccessTokenResult,
+      error: EnvironmentTokenExchangeErrors,
+    }),
+  )
+  .add(
+    HttpApiEndpoint.post("webSocketTicket", "/api/auth/websocket-ticket", {
+      headers: OptionalBearerHeaders,
+      success: AuthWebSocketTicketResult,
+      error: [EnvironmentInternalError],
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.post("pairingCredential", "/api/auth/pairing-token", {
+      headers: OptionalBearerHeaders,
+      payload: AuthCreatePairingCredentialInput,
+      success: AuthPairingCredentialResult,
+      error: EnvironmentPairingCredentialErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.get("pairingLinks", "/api/auth/pairing-links", {
+      headers: OptionalBearerHeaders,
+      success: Schema.Array(AuthPairingLink),
+      error: EnvironmentScopedOperationErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.post("revokePairingLink", "/api/auth/pairing-links/revoke", {
+      headers: OptionalBearerHeaders,
+      payload: AuthRevokePairingLinkInput,
+      success: AuthPairingLinkRevokeResult,
+      error: EnvironmentScopedOperationErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.get("clients", "/api/auth/clients", {
+      headers: OptionalBearerHeaders,
+      success: Schema.Array(AuthClientSession),
+      error: EnvironmentScopedOperationErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.post("revokeClient", "/api/auth/clients/revoke", {
+      headers: OptionalBearerHeaders,
+      payload: AuthRevokeClientSessionInput,
+      success: AuthClientSessionRevokeResult,
+      error: EnvironmentSessionRevokeErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.post("revokeOtherClients", "/api/auth/clients/revoke-others", {
+      headers: OptionalBearerHeaders,
+      success: AuthOtherClientSessionsRevokeResult,
+      error: EnvironmentScopedOperationErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  ) {}
+
+export class EnvironmentOrchestrationHttpApi extends HttpApiGroup.make("orchestration")
+  .add(
+    HttpApiEndpoint.get("snapshot", "/api/orchestration/snapshot", {
+      headers: OptionalBearerHeaders,
+      success: OrchestrationReadModel,
+      error: EnvironmentOrchestrationSnapshotErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  )
+  .add(
+    HttpApiEndpoint.post("dispatch", "/api/orchestration/dispatch", {
+      headers: OptionalBearerHeaders,
+      payload: ClientOrchestrationCommand,
+      success: DispatchResult,
+      error: EnvironmentOrchestrationDispatchErrors,
+    }).middleware(EnvironmentAuthenticatedAuth),
+  ) {}
+
+export class EnvironmentHttpApi extends HttpApi.make("environment")
+  .add(EnvironmentMetadataHttpApi)
+  .add(EnvironmentAuthHttpApi)
+  .add(EnvironmentOrchestrationHttpApi) {}
diff --git a/packages/contracts/src/index.ts b/packages/contracts/src/index.ts
index 50d533b62e6..bf26014c46e 100644
--- a/packages/contracts/src/index.ts
+++ b/packages/contracts/src/index.ts
@@ -1,6 +1,7 @@
 export * from "./baseSchemas.ts";
 export * from "./auth.ts";
 export * from "./environment.ts";
+export * from "./environmentHttp.ts";
 export * from "./desktopBootstrap.ts";
 export * from "./remoteAccess.ts";
 export * from "./ipc.ts";
diff --git a/packages/contracts/src/ipc.ts b/packages/contracts/src/ipc.ts
index d643ccd2d9f..684974fcac5 100644
--- a/packages/contracts/src/ipc.ts
+++ b/packages/contracts/src/ipc.ts
@@ -66,7 +66,7 @@ import type {
   OrchestrationThreadStreamItem,
 } from "./orchestration.ts";
 import { EnvironmentId } from "./baseSchemas.ts";
-import { AuthBearerBootstrapResult, AuthSessionState, AuthWebSocketTokenResult } from "./auth.ts";
+import { AuthAccessTokenResult, AuthSessionState, AuthWebSocketTicketResult } from "./auth.ts";
 import { AdvertisedEndpoint } from "./remoteAccess.ts";
 import { EditorId } from "./editor.ts";
 import { ExecutionEnvironmentDescriptor } from "./environment.ts";
@@ -394,12 +394,12 @@ export interface DesktopBridge {
   bootstrapSshBearerSession: (
     httpBaseUrl: string,
     credential: string,
-  ) => Promise<AuthBearerBootstrapResult>;
+  ) => Promise<AuthAccessTokenResult>;
   fetchSshSessionState: (httpBaseUrl: string, bearerToken: string) => Promise<AuthSessionState>;
-  issueSshWebSocketToken: (
+  issueSshWebSocketTicket: (
     httpBaseUrl: string,
     bearerToken: string,
-  ) => Promise<AuthWebSocketTokenResult>;
+  ) => Promise<AuthWebSocketTicketResult>;
   onSshPasswordPrompt: (listener: (request: DesktopSshPasswordPromptRequest) => void) => () => void;
   resolveSshPasswordPrompt: (requestId: string, password: string | null) => Promise<void>;
   getServerExposureState: () => Promise<DesktopServerExposureState>;
diff --git a/packages/contracts/src/rpc.ts b/packages/contracts/src/rpc.ts
index 41f6a696d3a..814e403b64c 100644
--- a/packages/contracts/src/rpc.ts
+++ b/packages/contracts/src/rpc.ts
@@ -3,7 +3,11 @@ import * as Rpc from "effect/unstable/rpc/Rpc";
 import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
 
 import { ExternalLauncherError, LaunchEditorInput } from "./editor.ts";
-import { AuthAccessStreamEvent } from "./auth.ts";
+import {
+  AuthAccessStreamError,
+  AuthAccessStreamEvent,
+  EnvironmentAuthorizationError,
+} from "./auth.ts";
 import {
   FilesystemBrowseInput,
   FilesystemBrowseResult,
@@ -179,19 +183,19 @@ export const WS_METHODS = {
 export const WsServerUpsertKeybindingRpc = Rpc.make(WS_METHODS.serverUpsertKeybinding, {
   payload: ServerUpsertKeybindingInput,
   success: ServerUpsertKeybindingResult,
-  error: KeybindingsConfigError,
+  error: Schema.Union([KeybindingsConfigError, EnvironmentAuthorizationError]),
 });
 
 export const WsServerRemoveKeybindingRpc = Rpc.make(WS_METHODS.serverRemoveKeybinding, {
   payload: ServerRemoveKeybindingInput,
   success: ServerRemoveKeybindingResult,
-  error: KeybindingsConfigError,
+  error: Schema.Union([KeybindingsConfigError, EnvironmentAuthorizationError]),
 });
 
 export const WsServerGetConfigRpc = Rpc.make(WS_METHODS.serverGetConfig, {
   payload: Schema.Struct({}),
   success: ServerConfig,
-  error: Schema.Union([KeybindingsConfigError, ServerSettingsError]),
+  error: Schema.Union([KeybindingsConfigError, ServerSettingsError, EnvironmentAuthorizationError]),
 });
 
 export const WsServerRefreshProvidersRpc = Rpc.make(WS_METHODS.serverRefreshProviders, {
@@ -205,39 +209,43 @@ export const WsServerRefreshProvidersRpc = Rpc.make(WS_METHODS.serverRefreshProv
     instanceId: Schema.optional(ProviderInstanceId),
   }),
   success: ServerProviderUpdatedPayload,
+  error: EnvironmentAuthorizationError,
 });
 
 export const WsServerUpdateProviderRpc = Rpc.make(WS_METHODS.serverUpdateProvider, {
   payload: ServerProviderUpdateInput,
   success: ServerProviderUpdatedPayload,
-  error: ServerProviderUpdateError,
+  error: Schema.Union([ServerProviderUpdateError, EnvironmentAuthorizationError]),
 });
 
 export const WsServerGetSettingsRpc = Rpc.make(WS_METHODS.serverGetSettings, {
   payload: Schema.Struct({}),
   success: ServerSettings,
-  error: ServerSettingsError,
+  error: Schema.Union([ServerSettingsError, EnvironmentAuthorizationError]),
 });
 
 export const WsServerUpdateSettingsRpc = Rpc.make(WS_METHODS.serverUpdateSettings, {
   payload: Schema.Struct({ patch: ServerSettingsPatch }),
   success: ServerSettings,
-  error: ServerSettingsError,
+  error: Schema.Union([ServerSettingsError, EnvironmentAuthorizationError]),
 });
 
 export const WsServerDiscoverSourceControlRpc = Rpc.make(WS_METHODS.serverDiscoverSourceControl, {
   payload: Schema.Struct({}),
   success: SourceControlDiscoveryResult,
+  error: EnvironmentAuthorizationError,
 });
 
 export const WsServerGetTraceDiagnosticsRpc = Rpc.make(WS_METHODS.serverGetTraceDiagnostics, {
   payload: Schema.Struct({}),
   success: ServerTraceDiagnosticsResult,
+  error: EnvironmentAuthorizationError,
 });
 
 export const WsServerGetProcessDiagnosticsRpc = Rpc.make(WS_METHODS.serverGetProcessDiagnostics, {
   payload: Schema.Struct({}),
   success: ServerProcessDiagnosticsResult,
+  error: EnvironmentAuthorizationError,
 });
 
 export const WsServerGetProcessResourceHistoryRpc = Rpc.make(
@@ -245,12 +253,14 @@ export const WsServerGetProcessResourceHistoryRpc = Rpc.make(
   {
     payload: ServerProcessResourceHistoryInput,
     success: ServerProcessResourceHistoryResult,
+    error: EnvironmentAuthorizationError,
   },
 );
 
 export const WsServerSignalProcessRpc = Rpc.make(WS_METHODS.serverSignalProcess, {
   payload: ServerSignalProcessInput,
   success: ServerSignalProcessResult,
+  error: EnvironmentAuthorizationError,
 });
 
 export const WsSourceControlLookupRepositoryRpc = Rpc.make(
@@ -258,14 +268,14 @@ export const WsSourceControlLookupRepositoryRpc = Rpc.make(
   {
     payload: SourceControlRepositoryLookupInput,
     success: SourceControlRepositoryInfo,
-    error: SourceControlRepositoryError,
+    error: Schema.Union([SourceControlRepositoryError, EnvironmentAuthorizationError]),
   },
 );
 
 export const WsSourceControlCloneRepositoryRpc = Rpc.make(WS_METHODS.sourceControlCloneRepository, {
   payload: SourceControlCloneRepositoryInput,
   success: SourceControlCloneRepositoryResult,
-  error: SourceControlRepositoryError,
+  error: Schema.Union([SourceControlRepositoryError, EnvironmentAuthorizationError]),
 });
 
 export const WsSourceControlPublishRepositoryRpc = Rpc.make(
@@ -273,103 +283,103 @@ export const WsSourceControlPublishRepositoryRpc = Rpc.make(
   {
     payload: SourceControlPublishRepositoryInput,
     success: SourceControlPublishRepositoryResult,
-    error: SourceControlRepositoryError,
+    error: Schema.Union([SourceControlRepositoryError, EnvironmentAuthorizationError]),
   },
 );
 
 export const WsProjectsSearchEntriesRpc = Rpc.make(WS_METHODS.projectsSearchEntries, {
   payload: ProjectSearchEntriesInput,
   success: ProjectSearchEntriesResult,
-  error: ProjectSearchEntriesError,
+  error: Schema.Union([ProjectSearchEntriesError, EnvironmentAuthorizationError]),
 });
 
 export const WsProjectsWriteFileRpc = Rpc.make(WS_METHODS.projectsWriteFile, {
   payload: ProjectWriteFileInput,
   success: ProjectWriteFileResult,
-  error: ProjectWriteFileError,
+  error: Schema.Union([ProjectWriteFileError, EnvironmentAuthorizationError]),
 });
 
 export const WsShellOpenInEditorRpc = Rpc.make(WS_METHODS.shellOpenInEditor, {
   payload: LaunchEditorInput,
-  error: ExternalLauncherError,
+  error: Schema.Union([ExternalLauncherError, EnvironmentAuthorizationError]),
 });
 
 export const WsFilesystemBrowseRpc = Rpc.make(WS_METHODS.filesystemBrowse, {
   payload: FilesystemBrowseInput,
   success: FilesystemBrowseResult,
-  error: FilesystemBrowseError,
+  error: Schema.Union([FilesystemBrowseError, EnvironmentAuthorizationError]),
 });
 
 export const WsSubscribeVcsStatusRpc = Rpc.make(WS_METHODS.subscribeVcsStatus, {
   payload: VcsStatusInput,
   success: VcsStatusStreamEvent,
-  error: GitManagerServiceError,
+  error: Schema.Union([GitManagerServiceError, EnvironmentAuthorizationError]),
   stream: true,
 });
 
 export const WsVcsPullRpc = Rpc.make(WS_METHODS.vcsPull, {
   payload: VcsPullInput,
   success: VcsPullResult,
-  error: GitCommandError,
+  error: Schema.Union([GitCommandError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsRefreshStatusRpc = Rpc.make(WS_METHODS.vcsRefreshStatus, {
   payload: VcsStatusInput,
   success: VcsStatusResult,
-  error: GitManagerServiceError,
+  error: Schema.Union([GitManagerServiceError, EnvironmentAuthorizationError]),
 });
 
 export const WsGitRunStackedActionRpc = Rpc.make(WS_METHODS.gitRunStackedAction, {
   payload: GitRunStackedActionInput,
   success: GitActionProgressEvent,
-  error: GitManagerServiceError,
+  error: Schema.Union([GitManagerServiceError, EnvironmentAuthorizationError]),
   stream: true,
 });
 
 export const WsGitResolvePullRequestRpc = Rpc.make(WS_METHODS.gitResolvePullRequest, {
   payload: GitPullRequestRefInput,
   success: GitResolvePullRequestResult,
-  error: GitManagerServiceError,
+  error: Schema.Union([GitManagerServiceError, EnvironmentAuthorizationError]),
 });
 
 export const WsGitPreparePullRequestThreadRpc = Rpc.make(WS_METHODS.gitPreparePullRequestThread, {
   payload: GitPreparePullRequestThreadInput,
   success: GitPreparePullRequestThreadResult,
-  error: GitManagerServiceError,
+  error: Schema.Union([GitManagerServiceError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsListRefsRpc = Rpc.make(WS_METHODS.vcsListRefs, {
   payload: VcsListRefsInput,
   success: VcsListRefsResult,
-  error: GitCommandError,
+  error: Schema.Union([GitCommandError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsCreateWorktreeRpc = Rpc.make(WS_METHODS.vcsCreateWorktree, {
   payload: VcsCreateWorktreeInput,
   success: VcsCreateWorktreeResult,
-  error: GitCommandError,
+  error: Schema.Union([GitCommandError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsRemoveWorktreeRpc = Rpc.make(WS_METHODS.vcsRemoveWorktree, {
   payload: VcsRemoveWorktreeInput,
-  error: GitCommandError,
+  error: Schema.Union([GitCommandError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsCreateRefRpc = Rpc.make(WS_METHODS.vcsCreateRef, {
   payload: VcsCreateRefInput,
   success: VcsCreateRefResult,
-  error: GitCommandError,
+  error: Schema.Union([GitCommandError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsSwitchRefRpc = Rpc.make(WS_METHODS.vcsSwitchRef, {
   payload: VcsSwitchRefInput,
   success: VcsSwitchRefResult,
-  error: GitCommandError,
+  error: Schema.Union([GitCommandError, EnvironmentAuthorizationError]),
 });
 
 export const WsVcsInitRpc = Rpc.make(WS_METHODS.vcsInit, {
   payload: VcsInitInput,
-  error: VcsError,
+  error: Schema.Union([VcsError, EnvironmentAuthorizationError]),
 });
 
 /**
@@ -380,46 +390,46 @@ export const WsVcsInitRpc = Rpc.make(WS_METHODS.vcsInit, {
 export const WsReviewGetDiffPreviewRpc = Rpc.make(WS_METHODS.reviewGetDiffPreview, {
   payload: ReviewDiffPreviewInput,
   success: ReviewDiffPreviewResult,
-  error: ReviewDiffPreviewError,
+  error: Schema.Union([ReviewDiffPreviewError, EnvironmentAuthorizationError]),
 });
 
 export const WsTerminalOpenRpc = Rpc.make(WS_METHODS.terminalOpen, {
   payload: TerminalOpenInput,
   success: TerminalSessionSnapshot,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
 });
 
 export const WsTerminalAttachRpc = Rpc.make(WS_METHODS.terminalAttach, {
   payload: TerminalAttachInput,
   success: TerminalAttachStreamEvent,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
   stream: true,
 });
 
 export const WsTerminalWriteRpc = Rpc.make(WS_METHODS.terminalWrite, {
   payload: TerminalWriteInput,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
 });
 
 export const WsTerminalResizeRpc = Rpc.make(WS_METHODS.terminalResize, {
   payload: TerminalResizeInput,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
 });
 
 export const WsTerminalClearRpc = Rpc.make(WS_METHODS.terminalClear, {
   payload: TerminalClearInput,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
 });
 
 export const WsTerminalRestartRpc = Rpc.make(WS_METHODS.terminalRestart, {
   payload: TerminalRestartInput,
   success: TerminalSessionSnapshot,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
 });
 
 export const WsTerminalCloseRpc = Rpc.make(WS_METHODS.terminalClose, {
   payload: TerminalCloseInput,
-  error: TerminalError,
+  error: Schema.Union([TerminalError, EnvironmentAuthorizationError]),
 });
 
 export const WsOrchestrationDispatchCommandRpc = Rpc.make(
@@ -427,14 +437,14 @@ export const WsOrchestrationDispatchCommandRpc = Rpc.make(
   {
     payload: ClientOrchestrationCommand,
     success: OrchestrationRpcSchemas.dispatchCommand.output,
-    error: OrchestrationDispatchCommandError,
+    error: Schema.Union([OrchestrationDispatchCommandError, EnvironmentAuthorizationError]),
   },
 );
 
 export const WsOrchestrationGetTurnDiffRpc = Rpc.make(ORCHESTRATION_WS_METHODS.getTurnDiff, {
   payload: OrchestrationGetTurnDiffInput,
   success: OrchestrationRpcSchemas.getTurnDiff.output,
-  error: OrchestrationGetTurnDiffError,
+  error: Schema.Union([OrchestrationGetTurnDiffError, EnvironmentAuthorizationError]),
 });
 
 export const WsOrchestrationGetFullThreadDiffRpc = Rpc.make(
@@ -442,14 +452,14 @@ export const WsOrchestrationGetFullThreadDiffRpc = Rpc.make(
   {
     payload: OrchestrationGetFullThreadDiffInput,
     success: OrchestrationRpcSchemas.getFullThreadDiff.output,
-    error: OrchestrationGetFullThreadDiffError,
+    error: Schema.Union([OrchestrationGetFullThreadDiffError, EnvironmentAuthorizationError]),
   },
 );
 
 export const WsOrchestrationReplayEventsRpc = Rpc.make(ORCHESTRATION_WS_METHODS.replayEvents, {
   payload: OrchestrationReplayEventsInput,
   success: OrchestrationRpcSchemas.replayEvents.output,
-  error: OrchestrationReplayEventsError,
+  error: Schema.Union([OrchestrationReplayEventsError, EnvironmentAuthorizationError]),
 });
 
 export const WsOrchestrationGetArchivedShellSnapshotRpc = Rpc.make(
@@ -457,14 +467,14 @@ export const WsOrchestrationGetArchivedShellSnapshotRpc = Rpc.make(
   {
     payload: OrchestrationRpcSchemas.getArchivedShellSnapshot.input,
     success: OrchestrationRpcSchemas.getArchivedShellSnapshot.output,
-    error: OrchestrationGetSnapshotError,
+    error: Schema.Union([OrchestrationGetSnapshotError, EnvironmentAuthorizationError]),
   },
 );
 
 export const WsOrchestrationSubscribeShellRpc = Rpc.make(ORCHESTRATION_WS_METHODS.subscribeShell, {
   payload: OrchestrationRpcSchemas.subscribeShell.input,
   success: OrchestrationRpcSchemas.subscribeShell.output,
-  error: OrchestrationGetSnapshotError,
+  error: Schema.Union([OrchestrationGetSnapshotError, EnvironmentAuthorizationError]),
   stream: true,
 });
 
@@ -473,7 +483,7 @@ export const WsOrchestrationSubscribeThreadRpc = Rpc.make(
   {
     payload: OrchestrationRpcSchemas.subscribeThread.input,
     success: OrchestrationRpcSchemas.subscribeThread.output,
-    error: OrchestrationGetSnapshotError,
+    error: Schema.Union([OrchestrationGetSnapshotError, EnvironmentAuthorizationError]),
     stream: true,
   },
 );
@@ -481,31 +491,35 @@ export const WsOrchestrationSubscribeThreadRpc = Rpc.make(
 export const WsSubscribeTerminalEventsRpc = Rpc.make(WS_METHODS.subscribeTerminalEvents, {
   payload: Schema.Struct({}),
   success: TerminalEvent,
+  error: EnvironmentAuthorizationError,
   stream: true,
 });
 
 export const WsSubscribeTerminalMetadataRpc = Rpc.make(WS_METHODS.subscribeTerminalMetadata, {
   payload: Schema.Struct({}),
   success: TerminalMetadataStreamEvent,
+  error: EnvironmentAuthorizationError,
   stream: true,
 });
 
 export const WsSubscribeServerConfigRpc = Rpc.make(WS_METHODS.subscribeServerConfig, {
   payload: Schema.Struct({}),
   success: ServerConfigStreamEvent,
-  error: Schema.Union([KeybindingsConfigError, ServerSettingsError]),
+  error: Schema.Union([KeybindingsConfigError, ServerSettingsError, EnvironmentAuthorizationError]),
   stream: true,
 });
 
 export const WsSubscribeServerLifecycleRpc = Rpc.make(WS_METHODS.subscribeServerLifecycle, {
   payload: Schema.Struct({}),
   success: ServerLifecycleStreamEvent,
+  error: EnvironmentAuthorizationError,
   stream: true,
 });
 
 export const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
   payload: Schema.Struct({}),
   success: AuthAccessStreamEvent,
+  error: Schema.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
   stream: true,
 });
 
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 9a38b19bbe0..622523db7f6 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -79,6 +79,10 @@
       "types": "./src/remote.ts",
       "import": "./src/remote.ts"
     },
+    "./oauthScope": {
+      "types": "./src/oauthScope.ts",
+      "import": "./src/oauthScope.ts"
+    },
     "./searchRanking": {
       "types": "./src/searchRanking.ts",
       "import": "./src/searchRanking.ts"
diff --git a/packages/shared/src/oauthScope.test.ts b/packages/shared/src/oauthScope.test.ts
new file mode 100644
index 00000000000..7b0033d98c7
--- /dev/null
+++ b/packages/shared/src/oauthScope.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+
+import { encodeOAuthScope, parseAllowedOAuthScope, parseOAuthScope } from "./oauthScope.ts";
+
+describe("OAuth scopes", () => {
+  it("parses an RFC 6749 space-delimited scope set without duplicating permissions", () => {
+    expect(parseOAuthScope("orchestration:read access:write orchestration:read")).toEqual([
+      "orchestration:read",
+      "access:write",
+    ]);
+  });
+
+  it("rejects whitespace that is not the SP delimiter or introduces empty tokens", () => {
+    expect(parseOAuthScope("orchestration:read\taccess:write")).toBeNull();
+    expect(parseOAuthScope("orchestration:read  access:write")).toBeNull();
+  });
+
+  it("encodes and restricts requested scopes to the allowed capability set", () => {
+    expect(encodeOAuthScope(["orchestration:read", "access:write"])).toBe(
+      "orchestration:read access:write",
+    );
+    expect(
+      parseAllowedOAuthScope({
+        value: "orchestration:read access:write",
+        allowedScopes: new Set(["orchestration:read", "access:write"] as const),
+      }),
+    ).toEqual(["orchestration:read", "access:write"]);
+    expect(
+      parseAllowedOAuthScope({
+        value: "orchestration:read relay:write",
+        allowedScopes: new Set(["orchestration:read", "access:write"] as const),
+      }),
+    ).toBeNull();
+  });
+});
diff --git a/packages/shared/src/oauthScope.ts b/packages/shared/src/oauthScope.ts
new file mode 100644
index 00000000000..7016e49280a
--- /dev/null
+++ b/packages/shared/src/oauthScope.ts
@@ -0,0 +1,40 @@
+const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
+
+/**
+ * Decodes an RFC 6749 `scope` value as a set while preserving first-seen order.
+ */
+export function parseOAuthScope(value: string): ReadonlyArray<string> | null {
+  if (value.length === 0) {
+    return null;
+  }
+
+  const scopes = value.split(" ");
+  if (scopes.some((scope) => !OAUTH_SCOPE_TOKEN.test(scope))) {
+    return null;
+  }
+
+  return [...new Set(scopes)];
+}
+
+export function encodeOAuthScope(scopes: ReadonlyArray<string>): string {
+  const encoded = scopes.join(" ");
+  const parsed = parseOAuthScope(encoded);
+  if (parsed === null || parsed.length !== scopes.length) {
+    throw new Error("OAuth scopes must be non-empty, valid, and unique.");
+  }
+  return encoded;
+}
+
+export function parseAllowedOAuthScope<Scope extends string>(input: {
+  readonly value: string;
+  readonly allowedScopes: ReadonlySet<Scope>;
+}): ReadonlyArray<Scope> | null {
+  const scopes = parseOAuthScope(input.value);
+  if (
+    scopes === null ||
+    !scopes.every((scope): scope is Scope => input.allowedScopes.has(scope as Scope))
+  ) {
+    return null;
+  }
+  return scopes;
+}
diff --git a/packages/shared/src/observability.test.ts b/packages/shared/src/observability.test.ts
index 2943bf46a42..57537b63e19 100644
--- a/packages/shared/src/observability.test.ts
+++ b/packages/shared/src/observability.test.ts
@@ -1,6 +1,7 @@
 import { assert, describe, it } from "@effect/vitest";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as Arr from "effect/Array";
+import * as Cause from "effect/Cause";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
@@ -12,12 +13,27 @@ import * as Schema from "effect/Schema";
 import * as Tracer from "effect/Tracer";
 
 import {
+  causeErrorTag,
   compactTraceAttributes,
   makeLocalFileTracer,
   makeTraceSink,
   type TraceRecord,
 } from "./observability.ts";
 
+describe("causeErrorTag", () => {
+  it("reports the tagged failure value instead of the Cause reason wrapper", () => {
+    assert.equal(
+      causeErrorTag(Cause.fail({ _tag: "ServerAuthInvalidCredentialError" })),
+      "ServerAuthInvalidCredentialError",
+    );
+  });
+
+  it("reports structural cause kinds when no typed failure exists", () => {
+    assert.equal(causeErrorTag(Cause.die(new Error("unexpected"))), "Die");
+    assert.equal(causeErrorTag(Cause.interrupt()), "Interrupt");
+  });
+});
+
 const TraceRecordLine = Schema.Struct({
   name: Schema.String,
   spanId: Schema.String,
diff --git a/packages/shared/src/observability.ts b/packages/shared/src/observability.ts
index 1fd75cf4ac6..68d4985db95 100644
--- a/packages/shared/src/observability.ts
+++ b/packages/shared/src/observability.ts
@@ -73,6 +73,22 @@ export interface OtlpTraceRecord extends BaseTraceRecord {
 
 export type TraceRecord = EffectTraceRecord | OtlpTraceRecord;
 
+function taggedErrorName(error: unknown): string {
+  return typeof error === "object" && error !== null && "_tag" in error
+    ? String(error._tag)
+    : error instanceof Error
+      ? error.name
+      : typeof error;
+}
+
+export function causeErrorTag(cause: Cause.Cause<unknown>): string {
+  const failure = Cause.findErrorOption(cause);
+  if (Option.isSome(failure)) {
+    return taggedErrorName(failure.value);
+  }
+  return cause.reasons[0]?._tag ?? "Empty";
+}
+
 export interface TraceSinkOptions {
   readonly filePath: string;
   readonly maxBytes: number;
diff --git a/packages/ssh/src/tunnel.test.ts b/packages/ssh/src/tunnel.test.ts
index 80e684d8611..0c223c79605 100644
--- a/packages/ssh/src/tunnel.test.ts
+++ b/packages/ssh/src/tunnel.test.ts
@@ -293,7 +293,7 @@ describe("ssh tunnel scripts", () => {
         makeSuccessfulProcess(`{
   "id": "88941235-6ed5-4184-a2ff-5339e2075958",
   "credential": "LCL4R2TPHDKQ",
-  "role": "client",
+  "scopes": ["orchestration:read"],
   "expiresAt": "2026-04-29T01:01:20.994Z"
 }
 
@@ -321,7 +321,7 @@ describe("ssh tunnel scripts", () => {
 {
   "id": "88941235-6ed5-4184-a2ff-5339e2075958",
   "credential": "LCL4R2TPHDKQ",
-  "role": "client",
+  "scopes": ["orchestration:read"],
   "expiresAt": "2026-04-29T01:01:20.994Z"
 }
 
diff --git a/packages/ssh/src/tunnel.ts b/packages/ssh/src/tunnel.ts
index 0de48b5721d..88a30960e84 100644
--- a/packages/ssh/src/tunnel.ts
+++ b/packages/ssh/src/tunnel.ts
@@ -160,13 +160,8 @@ const RemotePairingResult = Schema.Struct({
   credential: Schema.String,
 });
 
-const RemoteHttpError = Schema.Struct({
-  error: Schema.optional(Schema.String),
-});
-
 const decodeRemoteLaunchResult = Schema.decodeEffect(fromLenientJson(RemoteLaunchResult));
 const decodeRemotePairingResult = Schema.decodeEffect(fromLenientJson(RemotePairingResult));
-const decodeRemoteHttpError = Schema.decodeEffect(Schema.fromJsonString(RemoteHttpError));
 
 const decodeRemoteJsonOutput = <A, E>(
   stdout: string,
@@ -991,92 +986,27 @@ function isLoopbackHostname(hostname: string): boolean {
   return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
 }
 
-function resolveLoopbackSshHttpUrl(
-  rawHttpBaseUrl: unknown,
-  pathname: string,
-): Effect.Effect<URL, SshHttpBridgeError> {
-  return Effect.try({
-    try: () => {
-      if (typeof rawHttpBaseUrl !== "string" || rawHttpBaseUrl.trim().length === 0) {
-        throw new Error("Invalid SSH forwarded http base URL.");
-      }
-      const baseUrl = new URL(rawHttpBaseUrl);
-      if (!isLoopbackHostname(baseUrl.hostname)) {
-        throw new Error("SSH desktop bridge only supports loopback forwarded URLs.");
-      }
-      const url = new URL(baseUrl.toString());
-      url.pathname = pathname;
-      url.search = "";
-      url.hash = "";
-      return url;
-    },
-    catch: (cause) =>
-      new SshHttpBridgeError({
-        message: cause instanceof Error ? cause.message : "Invalid SSH forwarded http base URL.",
-        cause,
-      }),
-  });
-}
-
-export const fetchLoopbackSshJson = Effect.fn("ssh/tunnel.fetchLoopbackSshJson")(function* <
-  T,
->(input: {
-  readonly httpBaseUrl: unknown;
-  readonly pathname: string;
-  readonly method?: "GET" | "POST";
-  readonly bearerToken?: unknown;
-  readonly body?: unknown;
-}): Effect.fn.Return<T, SshHttpBridgeError, HttpClient.HttpClient> {
-  const requestUrl = yield* resolveLoopbackSshHttpUrl(input.httpBaseUrl, input.pathname);
-  const bearerToken =
-    typeof input.bearerToken === "string" && input.bearerToken.trim().length > 0
-      ? input.bearerToken
-      : null;
-
-  const request = (
-    input.method === "POST"
-      ? HttpClientRequest.post(requestUrl.toString())
-      : HttpClientRequest.get(requestUrl.toString())
-  ).pipe(
-    input.body === undefined ? (req) => req : HttpClientRequest.bodyJsonUnsafe(input.body),
-    bearerToken
-      ? HttpClientRequest.setHeader("authorization", `Bearer ${bearerToken}`)
-      : (req) => req,
-  );
-  const client = yield* HttpClient.HttpClient;
-  const response = yield* client.execute(request).pipe(
-    Effect.mapError(
-      (cause) =>
+export const resolveLoopbackSshHttpBaseUrl = Effect.fn("ssh/tunnel.resolveLoopbackSshHttpBaseUrl")(
+  function* (rawHttpBaseUrl: unknown): Effect.fn.Return<string, SshHttpBridgeError> {
+    return yield* Effect.try({
+      try: () => {
+        if (typeof rawHttpBaseUrl !== "string" || rawHttpBaseUrl.trim().length === 0) {
+          throw new Error("Invalid SSH forwarded http base URL.");
+        }
+        const baseUrl = new URL(rawHttpBaseUrl);
+        if (!isLoopbackHostname(baseUrl.hostname)) {
+          throw new Error("SSH desktop bridge only supports loopback forwarded URLs.");
+        }
+        return baseUrl.toString();
+      },
+      catch: (cause) =>
         new SshHttpBridgeError({
-          message: `Failed to reach SSH forwarded endpoint ${requestUrl.toString()}.`,
+          message: cause instanceof Error ? cause.message : "Invalid SSH forwarded http base URL.",
           cause,
         }),
-    ),
-  );
-  if (response.status < 200 || response.status >= 300) {
-    const text = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
-    const parsedError = yield* decodeRemoteHttpError(text).pipe(
-      Effect.catch(() => Effect.succeed(null)),
-    );
-    const message =
-      parsedError?.error && parsedError.error.trim().length > 0
-        ? parsedError.error
-        : text || `SSH forwarded request failed (${response.status}).`;
-    return yield* new SshHttpBridgeError({
-      status: response.status,
-      message: `[ssh_http:${response.status}] ${message} (${input.method ?? "GET"} ${requestUrl.toString()})`,
     });
-  }
-  return (yield* response.json.pipe(
-    Effect.mapError(
-      (cause) =>
-        new SshHttpBridgeError({
-          message: `SSH forwarded endpoint ${requestUrl.toString()} returned invalid JSON.`,
-          cause,
-        }),
-    ),
-  )) as T;
-});
+  },
+);
 
 const reserveLocalTunnelPort = Effect.fn("ssh/tunnel.reserveLocalTunnelPort")(function* () {
   const net = yield* NetService.NetService;
diff --git a/scripts/lib/reference-repos.ts b/scripts/lib/reference-repos.ts
index f3244c37870..f765abe2aea 100644
--- a/scripts/lib/reference-repos.ts
+++ b/scripts/lib/reference-repos.ts
@@ -18,4 +18,13 @@ export const referenceRepos: ReadonlyArray<ReferenceRepo> = [
     packageVersionPath: ["workspaces", "catalog", "effect"],
     versionTagPrefix: "effect@",
   },
+  {
+    id: "alchemy-effect",
+    prefix: ".repos/alchemy-effect",
+    repository: "https://github.com/alchemy-run/alchemy-effect.git",
+    latestRef: "main",
+    packageJsonPath: "infra/relay/package.json",
+    packageVersionPath: ["dependencies", "alchemy"],
+    versionTagPrefix: "v",
+  },
 ];
diff --git a/scripts/sync-reference-repos.test.ts b/scripts/sync-reference-repos.test.ts
index 330645f29b1..bc987cef062 100644
--- a/scripts/sync-reference-repos.test.ts
+++ b/scripts/sync-reference-repos.test.ts
@@ -17,6 +17,7 @@ import {
 
 const encoder = new TextEncoder();
 const effectSmol = referenceRepos[0]!;
+const alchemyEffect = referenceRepos[1]!;
 
 function mockHandle() {
   return ChildProcessSpawner.makeHandle({
@@ -84,6 +85,23 @@ it.layer(NodeServices.layer)("sync-reference-repos", (it) => {
     }),
   );
 
+  it.effect("resolves the alchemy-effect tag from the relay package", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const rootDir = yield* fs.makeTempDirectoryScoped({
+        prefix: "sync-reference-repos-alchemy-version-",
+      });
+      yield* fs.makeDirectory(path.join(rootDir, "infra", "relay"), { recursive: true });
+      yield* fs.writeFileString(
+        path.join(rootDir, "infra", "relay", "package.json"),
+        '{"dependencies":{"alchemy":"2.0.0-beta.49"}}',
+      );
+
+      assert.equal(yield* resolveReferenceRepoRef(alchemyEffect, rootDir, false), "v2.0.0-beta.49");
+    }),
+  );
+
   it.effect("plans an add for a missing subtree and a pull for an existing subtree", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
@@ -126,7 +144,9 @@ it.layer(NodeServices.layer)("sync-reference-repos", (it) => {
         '{"workspaces":{"catalog":{"effect":"4.0.0-beta.73"}}}',
       );
 
-      yield* syncReferenceRepos({ rootDir }).pipe(Effect.provide(mockSpawnerLayer(commands)));
+      yield* syncReferenceRepos({ rootDir, repoId: "effect-smol" }).pipe(
+        Effect.provide(mockSpawnerLayer(commands)),
+      );
 
       assert.deepStrictEqual(commands, [
         {
@@ -153,7 +173,7 @@ it.layer(NodeServices.layer)("sync-reference-repos", (it) => {
 
       assert.equal(
         error.message,
-        "Unknown reference repo 'missing'. Expected one of: effect-smol.",
+        "Unknown reference repo 'missing'. Expected one of: effect-smol, alchemy-effect.",
       );
     }),
   );